joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800489f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048a23
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048a10
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048a4d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xc], 0
je 0x180048a73
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x180048a60
mov byte [rdi + 0xc], 0
lea r9, [rdi + 0xb]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048aa1
mov r8d, recv
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e5d0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xd], dl
je 0x180048b02
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xc
jb 0x180048af0
mov byte [rbx + 0xd], dl
lea r8, [rbx + 0xc]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048b2f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048b40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180048b73
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180048b60
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048b9d
mov r8d, 7
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x180048bc3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048bb0
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048bf1
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048c00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048c33
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048c20
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048c5d
mov r8d, 4
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 5], 0
je 0x180048c83
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180048c70
mov byte [rdi + 5], 0
lea r9, [rdi + 4]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048cb1
mov r8d, 4
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e5d0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x180048d12
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x180048d00
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048d3f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048d83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048d70
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048dad
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048dd3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048dc0
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048e01
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x18], sil
je 0x180048e43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x17
jb 0x180048e30
mov byte [rdx + 0x18], sil
lea rax, [rdx + 0x17]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048e6d
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1e], 0
je 0x180048e93
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1d
jb 0x180048e80
mov byte [rdi + 0x1e], 0
lea r8, [rdi + 0x1d]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048ec1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180048f03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180048ef0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048f2d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180048f53
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180048f40
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048f81
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.180051a00
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x1f], dl
je 0x180048fe2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x1e
jb 0x180048fd0
mov byte [rbx + 0x1f], dl
lea r8, [rbx + 0x1e]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004900f
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049053
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180049040
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004907d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x1800490a3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180049090
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800490d1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800490e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180049113
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180049100
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004913d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x25], 0
je 0x180049163
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x24
jb 0x180049150
mov byte [rdi + 0x25], 0
lea r8, [rdi + 0x24]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049191
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800491a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x1800491d3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x1800491c0
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800491fd
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xe], 0
je 0x180049223
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180049210
mov byte [rdi + 0xe], 0
lea r9, [rdi + 0xd]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049251
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e5d0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 8], dl
je 0x1800492b2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x46]
xor byte [rax + rbx], cl
inc rax
cmp rax, 7
jb 0x1800492a0
mov byte [rbx + 8], dl
lea r8, [rbx + 7]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x1800492df
mov r8d, 7
mov rdx, rbx
mov rcx, r9
call fcn.180040f40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800492f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x180049323
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x180049310
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004934d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x15], 0
je 0x180049373
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049360
mov byte [rdi + 0x15], 0
lea r9, [rdi + 0x14]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800493a1
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800493b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x1800493e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x1800493d0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004940d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049433
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049420
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049461
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x1800494a4
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049491
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800494ce
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051990
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800494f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180049523
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180049510
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004954d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049573
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049560
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800495a1
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800495b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x1800495e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x1800495d0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004960d
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180049633
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180049620
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049661
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049670
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x1800496a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x180049690
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800496cd
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x19], 0
je 0x1800496f3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x18
jb 0x1800496e0
mov byte [rdi + 0x19], 0
lea r8, [rdi + 0x18]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049721
mov r8d, Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049730
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x27], sil
je 0x180049763
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x26
jb 0x180049750
mov byte [rdx + 0x27], sil
lea rax, [rdx + 0x26]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004978d
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x27], 0
je 0x1800497b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x26
jb 0x1800497a0
mov byte [rdi + 0x27], 0
lea r9, [rdi + 0x26]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800497e1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800497f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x26], r8b
je 0x180049824
mov eax, r8d
lea ecx, [rax - 0x46]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x25
jb 0x180049811
mov byte [rdx + 0x26], r8b
lea rax, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004984e
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040f40
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b2b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049870
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x1800498a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049890
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800498cd
mov r8d, 0xa
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800498f3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800498e0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049921
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049963
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049950
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004998d
mov r8d, recv
mov rcx, rbx
call fcn.180040f40
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x1800499b3
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x1800499a0
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800499e1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800499f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049a23
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049a10
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049a4d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040f40
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xb], 0
je 0x180049a73
mov rcx, rsi
nop
lea eax, [rcx - 0x46]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xa
jb 0x180049a60
mov byte [rdi + 0xb], 0
lea r9, [rdi + 0xa]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049aa1
mov r8d, 0xa
mov rdx, rdi
mov rcx, r10
call fcn.180040f40
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret