joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800465a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x10], r8b
je 0x1800465d4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xf
jb 0x1800465c1
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800465fd
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xe], r8b
je 0x180046644
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xd
jb 0x180046631
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004666d
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xc], r8b
je 0x1800466b4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xb
jb 0x1800466a1
mov byte [rdx + 0xc], r8b
lea rcx, [rdx + 0xb]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800466dd
mov r8d, recv
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 7], r8b
je 0x1800467a4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 6
jb 0x180046791
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800467cd
mov r8d, 6
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800467e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 4], r8b
je 0x180046814
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 3
jb 0x180046801
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004683d
mov r8d, 3
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 8], r8b
je 0x180046884
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x180046871
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800468ad
mov r8d, 7
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800468c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xf], r8b
je 0x1800468f4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xe
jb 0x1800468e1
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004691d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x11], r8b
je 0x180046964
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x10
jb 0x180046951
mov byte [rdx + 0x11], r8b
lea rcx, [rdx + 0x10]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18004698d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800469a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x17], r8b
je 0x1800469d4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x16
jb 0x1800469c1
mov byte [rdx + 0x17], r8b
lea rcx, [rdx + 0x16]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1800469fd
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x15], r8b
je 0x180046a44
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x14
jb 0x180046a31
mov byte [rdx + 0x15], r8b
lea rcx, [rdx + 0x14]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046a6d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046a80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x13], r8b
je 0x180046ab4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x12
jb 0x180046aa1
mov byte [rdx + 0x13], r8b
lea rcx, [rdx + 0x12]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046add
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0xd], r8b
je 0x180046b24
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0xc
jb 0x180046b11
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046b4d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180046b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x12], r8b
je 0x180046b94
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x11
jb 0x180046b81
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046bbd
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 3], r8b
je 0x180046c04
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 2
jb 0x180046bf1
mov byte [rdx + 3], r8b
lea rcx, [rdx + 2]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046c2d
mov r8d, 2
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 0x14], r8b
je 0x180046c74
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x13
jb 0x180046c61
mov byte [rdx + 0x14], r8b
lea rcx, [rdx + 0x13]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046c9d
mov r8d, reloc.WS2_32.dll_send
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180046cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 6], r8b
je 0x180046ce4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 5
jb 0x180046cd1
mov byte [rdx + 6], r8b
lea rcx, [rdx + 5]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046d0d
mov r8d, 5
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180046d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rbx, rcx
cmp byte [rdx + 5], r8b
je 0x180046d54
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 4
jb 0x180046d41
mov byte [rdx + 5], r8b
lea rcx, [rdx + 4]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x180046d7d
mov r8d, 4
mov rcx, rbx
call fcn.180040510
mov ecx, dword [rdi]
mov rax, rbx
mov dword [rbx + 0x20], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180047840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x180047873
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x180047860
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004789d
mov r8d, 7
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 8], 0
je 0x1800478c3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 7
jb 0x1800478b0
mov byte [rdi + 8], 0
lea r9, [rdi + 7]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800478f1
mov r8d, 7
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047900
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180047933
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180047920
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004795d
mov r8d, 6
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 5], 0
je 0x180047983
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 4
jb 0x180047970
mov byte [rdi + 5], 0
lea r8, [rdi + 4]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800479b1
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800479c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r8d, r8d
cmp byte [rdx + 8], r8b
je 0x1800479f4
mov eax, r8d
lea ecx, [rax - 0x2b]
xor byte [rax + rdx], cl
inc rax
cmp rax, 7
jb 0x1800479e1
mov byte [rdx + 8], r8b
lea rax, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180047a1e
mov r8d, 7
mov rcx, rbx
call fcn.180040510
nop
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
call fcn.18001e130
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180047a90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 7], sil
je 0x180047ac3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 6
jb 0x180047ab0
mov byte [rdx + 7], sil
lea rax, [rdx + 6]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047aed
mov r8d, 6
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 7], 0
je 0x180047b13
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180047b00
mov byte [rdi + 7], 0
lea r9, [rdi + 6]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180047b41
mov r8d, 6
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047b50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180047b83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180047b70
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047bad
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x16], 0
je 0x180047bd3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x15
jb 0x180047bc0
mov byte [rdi + 0x16], 0
lea r8, [rdi + 0x15]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047c01
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180047c10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xf], sil
je 0x180047c43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x180047c30
mov byte [rdx + 0xf], sil
lea rax, [rdx + 0xe]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047c6d
mov r8d, recv
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180047c93
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180047c80
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047cc1
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180047d03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180047cf0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047d2d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180047d53
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180047d40
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047d81
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180047d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 6], sil
je 0x180047dc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 5
jb 0x180047db0
mov byte [rdx + 6], sil
lea rax, [rdx + 5]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047ded
mov r8d, 5
mov rcx, rbx
call fcn.180040510
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 6], 0
je 0x180047e13
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 5
jb 0x180047e00
mov byte [rdi + 6], 0
lea r9, [rdi + 5]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180047e41
mov r8d, 5
mov rdx, rdi
mov rcx, r10
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180047e83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x180047e70
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047ead
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180047ed3
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180047ec0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047f01
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180047f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 5], sil
je 0x180047f43
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x2b]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jb 0x180047f30
mov byte [rdx + 5], sil
lea rax, [rdx + 4]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180047f6d
mov r8d, 4
mov rcx, rbx
call fcn.180040510
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 7], 0
je 0x180047f93
mov rcx, rsi
nop
lea eax, [rcx - 0x2b]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 6
jb 0x180047f80
mov byte [rdi + 7], 0
lea r8, [rdi + 6]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180047fc1
mov r8d, 6
mov rdx, rdi
mov rcx, r9
call fcn.180040510
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret