joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x1800490c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x1800490b0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800490ed
mov r8d, 7
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180049113
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180049100
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049141
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049183
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180049170
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800491ad
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x1800491d3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x1800491c0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049201
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x180049243
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x180049230
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004926d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049293
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049280
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800492c1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800492d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049303
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x1800492f0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004932d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x11], 0
je 0x180049353
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049340
mov byte [rdi + 0x11], 0
lea r9, [rdi + 0x10]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049381
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x32], sil
je 0x1800493c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x31
jb 0x1800493b0
mov byte [rdx + 0x32], sil
lea rax, [rdx + 0x31]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800493ed
mov r8d, Ordinal_50
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x30], 0
je 0x180049413
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x2f
jb 0x180049400
mov byte [rdi + 0x30], 0
lea r8, [rdi + 0x2f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049441
mov r8d, Ordinal_50
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180049470
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800494ad
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800494d3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800494c0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049501
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049544
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049531
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004956e
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051260
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049590
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x1800495c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x1800495b0
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800495ed
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x15], 0
je 0x180049613
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180049600
mov byte [rdi + 0x15], 0
lea r8, [rdi + 0x14]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049641
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1e], r8b
je 0x180049684
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1d
jb 0x180049671
mov byte [rdx + 0x1e], r8b
lea rax, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800496ae
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180050f70
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800496d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180049703
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x1800496f0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004972d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049753
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049740
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049781
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x20], r8b
je 0x1800497c4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x1800497b1
mov byte [rdx + 0x20], r8b
lea rax, [rdx + 0x1f]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800497ee
mov r8d, Ordinal_33
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003b9b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049810
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049843
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049830
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004986d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x180049893
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x180049880
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800498c1
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800498d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x38], sil
je 0x180049903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x37
jb 0x1800498f0
mov byte [rdx + 0x38], sil
lea rax, [rdx + 0x37]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004992d
mov r8d, gethostname
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x40], 0
je 0x180049953
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x3f
jb 0x180049940
mov byte [rdi + 0x40], 0
lea r8, [rdi + 0x3f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049981
mov r8d, 0x3f
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800499e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001dff0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xe], dl
je 0x180049a32
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xd
jb 0x180049a20
mov byte [rbx + 0xe], dl
lea r8, [rbx + 0xd]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180049a5f
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
mov rcx, r9
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049a70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049aa3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180049a90
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049acd
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049af3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049ae0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049b21
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001dff0
nop
lea r10, [rdi + 0x20]
mov qword [rsp + 0x20], r10
xor edx, edx
cmp byte [rbx + 0x10], dl
je 0x180049b82
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x2b]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xf
jb 0x180049b70
mov byte [rbx + 0x10], dl
lea r9, [rbx + 0xf]
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp rbx, r9
je 0x180049baf
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov rcx, r10
call fcn.180040510
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049bc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180049bf3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180049be0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049c1d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049c43
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049c30
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049c71
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049c80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180049cb3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180049ca0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049cdd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x180049d03
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x180049cf0
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049d31
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049d40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x180049d73
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x180049d60
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049d9d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x180049dc3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x180049db0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049df1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049e00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x180049e33
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x180049e20
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049e5d
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049e83
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049e70
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049eb1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049ec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x12], sil
je 0x180049ef3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x11
jb 0x180049ee0
mov byte [rdx + 0x12], sil
lea rax, [rdx + 0x11]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049f1d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049f43
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049f30
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049f71
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049f80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049fb3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180049fa0
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049fdd
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x26], 0
je 0x18004a003
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x25
jb 0x180049ff0
mov byte [rdi + 0x26], 0
lea r8, [rdi + 0x25]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a031
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret