joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049bc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049bb0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049bed
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x15], 0
je 0x180049c13
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049c00
mov byte [rdi + 0x15], 0
lea r8, [rdi + 0x14]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049c41
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1e], r8b
je 0x180049c84
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1d
jb 0x180049c71
mov byte [rdx + 0x1e], r8b
lea rax, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049cae
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051570
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180049d03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180049cf0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049d2d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049d53
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049d40
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049d81
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x180049dc4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x180049db1
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049dee
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003c020
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049e43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049e30
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049e6d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x180049e93
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x180049e80
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049ec1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x38], sil
je 0x180049f03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x37
jb 0x180049ef0
mov byte [rdx + 0x38], sil
lea rax, [rdx + 0x37]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049f2d
mov r8d, gethostname
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x40], 0
je 0x180049f53
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x3f
jb 0x180049f40
mov byte [rdi + 0x40], 0
lea r8, [rdi + 0x3f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049f81
mov r8d, 0x3f
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049fe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xe], dl
je 0x18004a032
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xd
jb 0x18004a020
mov byte [rbx + 0xe], dl
lea r8, [rbx + 0xd]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004a05f
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a070
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004a0a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004a090
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a0cd
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a0f3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a0e0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a121
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e1e0
nop
lea r10, [rdi + 0x20]
mov qword [rsp + 0x20], r10
xor edx, edx
cmp byte [rbx + 0x10], dl
je 0x18004a182
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xf
jb 0x18004a170
mov byte [rbx + 0x10], dl
lea r9, [rbx + 0xf]
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp rbx, r9
je 0x18004a1af
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov rcx, r10
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a1c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a1f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a1e0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a21d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a243
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a230
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a271
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a280
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a2b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a2a0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a2dd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004a303
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004a2f0
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a331
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a340
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a373
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a360
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a39d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a3c3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a3b0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a3f1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a400
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004a433
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004a420
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a45d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a483
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a470
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a4b1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a4c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x12], sil
je 0x18004a4f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x11
jb 0x18004a4e0
mov byte [rdx + 0x12], sil
lea rax, [rdx + 0x11]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a51d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a543
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a530
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a571
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x18004a5b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x18004a5a0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a5dd
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x26], 0
je 0x18004a603
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x25
jb 0x18004a5f0
mov byte [rdi + 0x26], 0
lea r8, [rdi + 0x25]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a631
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a640
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x18004a673
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x18004a660
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a69d
mov r8d, 7
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004a6c3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004a6b0
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a6f1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a700
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004a733
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004a720
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a75d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a783
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a770
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a7b1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x19], r8b
je 0x18004a7f4
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x18004a7e1
mov byte [rdx + 0x19], r8b
lea rax, [rdx + 0x18]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004a81e
mov r8d, Ordinal_26
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ae10
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004a840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004a873
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004a860
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a89d
mov r8d, 5
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 8], 0
je 0x18004a8c3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x18004a8b0
mov byte [rdi + 8], 0
lea r8, [rdi + 7]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a8f1
mov r8d, 7
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a900
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a933
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a920
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a95d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1c], 0
je 0x18004a983
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1b
jb 0x18004a970
mov byte [rdi + 0x1c], 0
lea r8, [rdi + 0x1b]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a9b1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a9c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e320
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0x11], dl
je 0x18004aa12
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x10
jb 0x18004aa00
mov byte [rbx + 0x11], dl
lea r8, [rbx + 0x10]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004aa3f
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18004aa50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 4], sil
je 0x18004aa83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 3
jb 0x18004aa70
mov byte [rdx + 4], sil
lea rax, [rdx + 3]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aaad
mov r8d, 3
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x18004aad3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x18004aac0
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ab01
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004ab10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004ab43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004ab30
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ab6d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004ab93
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004ab80
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004abc1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret