joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x14], r8b
je 0x180047474
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x13
jb 0x180047461
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004749d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040d10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800474b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 6], r8b
je 0x1800474e4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x1800474d1
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004750d
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 5], r8b
je 0x180047554
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x180047541
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004757d
mov r8d, 4
mov rcx, rbx
call fcn.180040d10
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180048040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048073
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048060
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004809d
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 8], 0
je 0x1800480c3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x1800480b0
mov byte [rdi + 8], 0
lea r9, [rdi + 7]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800480f1
mov r8d, 7
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048100
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180048133
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180048120
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004815d
mov r8d, 6
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 5], 0
je 0x180048183
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048170
mov byte [rdi + 5], 0
lea r8, [rdi + 4]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800481b1
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800481c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 8], r8b
je 0x1800481f4
mov eax, r8d
lea ecx, [rax + 0x33]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x1800481e1
mov byte [rdx + 8], r8b
lea rax, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004821e
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e3e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048290
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x1800482c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x1800482b0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800482ed
mov r8d, 6
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 7], 0
je 0x180048313
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048300
mov byte [rdi + 7], 0
lea r9, [rdi + 6]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048341
mov r8d, 6
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048383
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048370
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800483ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x16], 0
je 0x1800483d3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x15
jb 0x1800483c0
mov byte [rdi + 0x16], 0
lea r8, [rdi + 0x15]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048401
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x180048443
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x180048430
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004846d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180048493
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180048480
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800484c1
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800484d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048503
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1800484f0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004852d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180048553
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180048540
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048581
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048590
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x1800485c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800485b0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800485ed
mov r8d, 5
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 6], 0
je 0x180048613
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048600
mov byte [rdi + 6], 0
lea r9, [rdi + 5]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048641
mov r8d, 5
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048650
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048683
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048670
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800486ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800486d3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800486c0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048701
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048710
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048743
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048730
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004876d
mov r8d, 4
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x180048793
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048780
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800487c1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800487d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048803
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1800487f0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004882d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xc], 0
je 0x180048853
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x180048840
mov byte [rdi + 0xc], 0
lea r9, [rdi + 0xb]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048881
mov r8d, recv
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e3e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xd], dl
je 0x1800488e2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xc
jb 0x1800488d0
mov byte [rbx + 0xd], dl
lea r8, [rbx + 0xc]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004890f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048920
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048953
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048940
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004897d
mov r8d, 7
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x1800489a3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048990
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800489d1
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800489e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048a13
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048a00
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048a3d
mov r8d, 4
mov rcx, rbx
call fcn.180040d10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 5], 0
je 0x180048a63
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048a50
mov byte [rdi + 5], 0
lea r9, [rdi + 4]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048a91
mov r8d, 4
mov rdx, rdi
mov rcx, r10
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e3e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x180048af2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x180048ae0
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048b1f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048b30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048b63
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048b50
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048b8d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048bb3
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048ba0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048be1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x18], sil
je 0x180048c23
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x17
jb 0x180048c10
mov byte [rdx + 0x18], sil
lea rax, [rdx + 0x17]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048c4d
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1e], 0
je 0x180048c73
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1d
jb 0x180048c60
mov byte [rdi + 0x1e], 0
lea r8, [rdi + 0x1d]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048ca1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048cb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180048ce3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180048cd0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048d0d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180048d33
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180048d20
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048d61
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051770
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x1f], dl
je 0x180048dc2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax + 0x33]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x1e
jb 0x180048db0
mov byte [rbx + 0x1f], dl
lea r8, [rbx + 0x1e]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048def
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, r9
call fcn.180040d10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180048e00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048e33
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048e20
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048e5d
mov r8d, recv
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180048e83
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048e70
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048eb1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048ec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180048ef3
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180048ee0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048f1d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040d10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x25], 0
je 0x180048f43
mov rcx, rsi
nop
lea eax, [rcx + 0x33]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x24
jb 0x180048f30
mov byte [rdi + 0x25], 0
lea r8, [rdi + 0x24]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048f71
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040d10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret