joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800471a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 5], r8b
je 0x1800471d4
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x1800471c1
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800471fd
mov r8d, 4
mov rcx, rbx
call fcn.180040990
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047cc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180047cf3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180047ce0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047d1d
mov r8d, 7
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 8], 0
je 0x180047d43
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x180047d30
mov byte [rdi + 8], 0
lea r9, [rdi + 7]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180047d71
mov r8d, 7
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180047db3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180047da0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047ddd
mov r8d, 6
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 5], 0
je 0x180047e03
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180047df0
mov byte [rdi + 5], 0
lea r8, [rdi + 4]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047e31
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180047e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 8], r8b
je 0x180047e74
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x180047e61
mov byte [rdx + 8], r8b
lea rax, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180047e9e
mov r8d, 7
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e2b0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180047f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180047f43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180047f30
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047f6d
mov r8d, 6
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 7], 0
je 0x180047f93
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180047f80
mov byte [rdi + 7], 0
lea r9, [rdi + 6]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180047fc1
mov r8d, 6
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047fd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048003
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180047ff0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004802d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x16], 0
je 0x180048053
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x15
jb 0x180048040
mov byte [rdi + 0x16], 0
lea r8, [rdi + 0x15]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048081
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x1800480c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x1800480b0
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800480ed
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180048113
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180048100
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048141
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048183
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180048170
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800481ad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x1800481d3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x1800481c0
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048201
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x180048243
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x180048230
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004826d
mov r8d, 5
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 6], 0
je 0x180048293
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048280
mov byte [rdi + 6], 0
lea r9, [rdi + 5]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800482c1
mov r8d, 5
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800482d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180048303
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1800482f0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004832d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180048353
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180048340
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048381
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x1800483c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x1800483b0
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800483ed
mov r8d, 4
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x180048413
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180048400
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048441
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048470
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800484ad
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xc], 0
je 0x1800484d3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xb
jb 0x1800484c0
mov byte [rdi + 0xc], 0
lea r9, [rdi + 0xb]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048501
mov r8d, recv
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2b0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xd], dl
je 0x180048562
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xc
jb 0x180048550
mov byte [rbx + 0xd], dl
lea r8, [rbx + 0xc]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004858f
mov r8d, recv
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800485a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x1800485d3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x1800485c0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800485fd
mov r8d, 7
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x180048623
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180048610
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048651
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048660
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180048693
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180048680
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800486bd
mov r8d, 4
mov rcx, rbx
call fcn.180040990
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 5], 0
je 0x1800486e3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x1800486d0
mov byte [rdi + 5], 0
lea r9, [rdi + 4]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048711
mov r8d, 4
mov rdx, rdi
mov rcx, r10
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2b0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xb], dl
je 0x180048772
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xa
jb 0x180048760
mov byte [rbx + 0xb], dl
lea r8, [rbx + 0xa]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004879f
mov r8d, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800487b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x1800487e3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1800487d0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004880d
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180048833
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180048820
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048861
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048870
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x18], sil
je 0x1800488a3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x17
jb 0x180048890
mov byte [rdx + 0x18], sil
lea rax, [rdx + 0x17]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800488cd
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1e], 0
je 0x1800488f3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1d
jb 0x1800488e0
mov byte [rdi + 0x1e], 0
lea r8, [rdi + 0x1d]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048921
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180048963
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180048950
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004898d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x1800489b3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x1800489a0
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800489e1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800489f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
mov rcx, rax
call fcn.1800513f0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x30], r9
xor edx, edx
cmp byte [rbx + 0x1f], dl
je 0x180048a42
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x1e
jb 0x180048a30
mov byte [rbx + 0x1f], dl
lea r8, [rbx + 0x1e]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048a6f
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180048a80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048ab3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048aa0
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048add
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180048b03
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048af0
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048b31
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048b40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180048b73
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180048b60
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048b9d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x25], 0
je 0x180048bc3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x24
jb 0x180048bb0
mov byte [rdi + 0x25], 0
lea r8, [rdi + 0x24]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048bf1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret