joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049c90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049cc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049cb0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049ced
mov r8d, 0xa
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x180049d13
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x180049d00
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049d41
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x38], sil
je 0x180049d83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x37
jb 0x180049d70
mov byte [rdx + 0x38], sil
lea rax, [rdx + 0x37]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049dad
mov r8d, gethostname
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x40], 0
je 0x180049dd3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x3f
jb 0x180049dc0
mov byte [rdi + 0x40], 0
lea r8, [rdi + 0x3f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049e01
mov r8d, 0x3f
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0xe], dl
je 0x180049eb2
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xd
jb 0x180049ea0
mov byte [rbx + 0xe], dl
lea r8, [rbx + 0xd]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180049edf
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180049ef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049f23
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180049f10
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049f4d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049f73
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049f60
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049fa1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049fb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e170
nop
lea r10, [rdi + 0x20]
mov qword [rsp + 0x20], r10
xor edx, edx
cmp byte [rbx + 0x10], dl
je 0x18004a002
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0xf
jb 0x180049ff0
mov byte [rbx + 0x10], dl
lea r9, [rbx + 0xf]
mov qword [r10], rdx
mov qword [r10 + 0x10], rdx
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], dl
cmp rbx, r9
je 0x18004a02f
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov rcx, r10
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a073
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a060
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a09d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a0c3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a0b0
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a0f1
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a100
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a133
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a120
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a15d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x17], 0
je 0x18004a183
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x16
jb 0x18004a170
mov byte [rdi + 0x17], 0
lea r8, [rdi + 0x16]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a1b1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a1c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a1f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a1e0
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a21d
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1a], 0
je 0x18004a243
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x19
jb 0x18004a230
mov byte [rdi + 0x1a], 0
lea r8, [rdi + 0x19]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a271
mov r8d, Ordinal_30
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a280
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x13], sil
je 0x18004a2b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x12
jb 0x18004a2a0
mov byte [rdx + 0x13], sil
lea rax, [rdx + 0x12]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a2dd
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a303
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a2f0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a331
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a340
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x12], sil
je 0x18004a373
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x11
jb 0x18004a360
mov byte [rdx + 0x12], sil
lea rax, [rdx + 0x11]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a39d
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a3c3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a3b0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a3f1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a400
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x18004a433
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x18004a420
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a45d
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x26], 0
je 0x18004a483
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x25
jb 0x18004a470
mov byte [rdi + 0x26], 0
lea r8, [rdi + 0x25]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a4b1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a4c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x18004a4f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x18004a4e0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a51d
mov r8d, 7
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x18004a543
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x18004a530
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a571
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x14], sil
je 0x18004a5b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x18004a5a0
mov byte [rdx + 0x14], sil
lea rax, [rdx + 0x13]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a5dd
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004a603
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004a5f0
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a631
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x19], r8b
je 0x18004a674
mov eax, r8d
lea ecx, [rax - 3]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x18004a661
mov byte [rdx + 0x19], r8b
lea rax, [rdx + 0x18]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004a69e
mov r8d, Ordinal_26
mov rcx, rbx
call fcn.180040990
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ac20
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x18004a6f3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x18004a6e0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a71d
mov r8d, 5
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 8], 0
je 0x18004a743
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x18004a730
mov byte [rdi + 8], 0
lea r8, [rdi + 7]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a771
mov r8d, 7
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a780
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x18004a7b3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x18004a7a0
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a7dd
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1c], 0
je 0x18004a803
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1b
jb 0x18004a7f0
mov byte [rdi + 0x1c], 0
lea r8, [rdi + 0x1b]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a831
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004a840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e2b0
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 0x11], dl
je 0x18004a892
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 3]
xor byte [rax + rbx], cl
inc rax
cmp rax, 0x10
jb 0x18004a880
mov byte [rbx + 0x11], dl
lea r8, [rbx + 0x10]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x18004a8bf
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, r9
call fcn.180040990
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004a8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 4], sil
je 0x18004a903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 3
jb 0x18004a8f0
mov byte [rdx + 4], sil
lea rax, [rdx + 3]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a92d
mov r8d, 3
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 6], 0
je 0x18004a953
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x18004a940
mov byte [rdi + 6], 0
lea r8, [rdi + 5]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004a981
mov r8d, 5
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004a990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004a9c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004a9b0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004a9ed
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x18004aa13
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x18004aa00
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004aa41
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004aa50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x18004aa83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x18004aa70
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004aaad
mov r8d, recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x13], 0
je 0x18004aad3
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x12
jb 0x18004aac0
mov byte [rdi + 0x13], 0
lea r8, [rdi + 0x12]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ab01
mov r8d, reloc.WS2_32.dll_select
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ab10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x18004ab43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x18004ab30
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ab6d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1d], 0
je 0x18004ab93
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1c
jb 0x18004ab80
mov byte [rdi + 0x1d], 0
lea r8, [rdi + 0x1c]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004abc1
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004abd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x18004ac03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x18004abf0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004ac2d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040990
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x18004ac53
mov rcx, rsi
nop
lea eax, [rcx - 3]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x18004ac40
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x18004ac81
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040990
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret