joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048c00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180048c33
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180048c20
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048c5d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180048c83
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048c70
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048cb1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048cc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1b], sil
je 0x180048cf3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1a
jb 0x180048ce0
mov byte [rdx + 0x1b], sil
lea rax, [rdx + 0x1a]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048d1d
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x25], 0
je 0x180048d43
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x24
jb 0x180048d30
mov byte [rdi + 0x25], 0
lea r8, [rdi + 0x24]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180048d71
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xe], sil
je 0x180048db3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x180048da0
mov byte [rdx + 0xe], sil
lea rax, [rdx + 0xd]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048ddd
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xe], 0
je 0x180048e03
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180048df0
mov byte [rdi + 0xe], 0
lea r9, [rdi + 0xd]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048e31
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180048e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
mov rax, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rdx, rcx
mov rcx, rax
call fcn.18001e320
nop
lea r9, [rdi + 0x20]
mov qword [rsp + 0x20], r9
xor edx, edx
cmp byte [rbx + 8], dl
je 0x180048e92
mov eax, edx
nop word [rax + rax]
lea ecx, [rax - 0x70]
xor byte [rax + rbx], cl
inc rax
cmp rax, 7
jb 0x180048e80
mov byte [rbx + 8], dl
lea r8, [rbx + 7]
mov qword [r9], rdx
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], dl
cmp rbx, r8
je 0x180048ebf
mov r8d, 7
mov rdx, rbx
mov rcx, r9
call fcn.180040b10
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180048ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x15], sil
je 0x180048f03
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x14
jb 0x180048ef0
mov byte [rdx + 0x15], sil
lea rax, [rdx + 0x14]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048f2d
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x15], 0
je 0x180048f53
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x14
jb 0x180048f40
mov byte [rdi + 0x15], 0
lea r9, [rdi + 0x14]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180048f81
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180048f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180048fc3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x180048fb0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180048fed
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049013
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049000
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049041
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049084
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049071
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x1800490ae
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003c020
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800490d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x10], sil
je 0x180049103
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xf
jb 0x1800490f0
mov byte [rdx + 0x10], sil
lea rax, [rdx + 0xf]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004912d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x12], 0
je 0x180049153
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x11
jb 0x180049140
mov byte [rdi + 0x12], 0
lea r8, [rdi + 0x11]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049181
mov r8d, reloc.WS2_32.dll_recvfrom
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1c], sil
je 0x1800491c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x1800491b0
mov byte [rdx + 0x1c], sil
lea rax, [rdx + 0x1b]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800491ed
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x20], 0
je 0x180049213
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1f
jb 0x180049200
mov byte [rdi + 0x20], 0
lea r8, [rdi + 0x1f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049241
mov r8d, Ordinal_33
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x17], sil
je 0x180049283
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x16
jb 0x180049270
mov byte [rdx + 0x17], sil
lea rax, [rdx + 0x16]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800492ad
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x19], 0
je 0x1800492d3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x18
jb 0x1800492c0
mov byte [rdi + 0x19], 0
lea r8, [rdi + 0x18]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049301
mov r8d, Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049310
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x27], sil
je 0x180049343
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x26
jb 0x180049330
mov byte [rdx + 0x27], sil
lea rax, [rdx + 0x26]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004936d
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x27], 0
je 0x180049393
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x26
jb 0x180049380
mov byte [rdi + 0x27], 0
lea r9, [rdi + 0x26]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x1800493c1
mov r8d, Ordinal_41
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800493d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x26], r8b
je 0x180049404
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x25
jb 0x1800493f1
mov byte [rdx + 0x26], r8b
lea rax, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x18004942e
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.18003ae10
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180049450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049483
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180049470
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800494ad
mov r8d, 0xa
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x1800494d3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x1800494c0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049501
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xd], sil
je 0x180049543
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x180049530
mov byte [rdx + 0xd], sil
lea rax, [rdx + 0xc]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004956d
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0xe], 0
je 0x180049593
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xd
jb 0x180049580
mov byte [rdi + 0xe], 0
lea r8, [rdi + 0xd]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800495c1
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800495d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xb], sil
je 0x180049603
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800495f0
mov byte [rdx + 0xb], sil
lea rax, [rdx + 0xa]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004962d
mov r8d, 0xa
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0xb], 0
je 0x180049653
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0xa
jb 0x180049640
mov byte [rdi + 0xb], 0
lea r9, [rdi + 0xa]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049681
mov r8d, 0xa
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 8], sil
je 0x1800496c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 7
jb 0x1800496b0
mov byte [rdx + 8], sil
lea rax, [rdx + 7]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800496ed
mov r8d, 7
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x14], 0
je 0x180049713
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x13
jb 0x180049700
mov byte [rdi + 0x14], 0
lea r8, [rdi + 0x13]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049741
mov r8d, reloc.WS2_32.dll_send
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049750
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x1a], sil
je 0x180049783
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x19
jb 0x180049770
mov byte [rdx + 0x1a], sil
lea rax, [rdx + 0x19]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800497ad
mov r8d, Ordinal_30
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x1b], 0
je 0x1800497d3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x1a
jb 0x1800497c0
mov byte [rdi + 0x1b], 0
lea r8, [rdi + 0x1a]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049801
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049810
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x16], sil
je 0x180049843
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x180049830
mov byte [rdx + 0x16], sil
lea rax, [rdx + 0x15]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004986d
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x18], 0
je 0x180049893
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x17
jb 0x180049880
mov byte [rdi + 0x18], 0
lea r8, [rdi + 0x17]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x1800498c1
mov r8d, reloc.WS2_32.dll_socket
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800498d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x11], sil
je 0x180049903
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x10
jb 0x1800498f0
mov byte [rdx + 0x11], sil
lea rax, [rdx + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x18004992d
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180040b10
nop
lea r10, [rbx + 0x20]
mov qword [rsp + 0x20], r10
cmp byte [rdi + 0x11], 0
je 0x180049953
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049940
mov byte [rdi + 0x11], 0
lea r9, [rdi + 0x10]
mov qword [r10], rsi
mov qword [r10 + 0x10], rsi
mov qword [r10 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r10], 0
cmp rdi, r9
je 0x180049981
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r10
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0x32], sil
je 0x1800499c3
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x31
jb 0x1800499b0
mov byte [rdx + 0x32], sil
lea rax, [rdx + 0x31]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x1800499ed
mov r8d, Ordinal_50
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x30], 0
je 0x180049a13
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x2f
jb 0x180049a00
mov byte [rdi + 0x30], 0
lea r8, [rdi + 0x2f]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049a41
mov r8d, Ordinal_50
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
cmp byte [rdx + 0xc], sil
je 0x180049a83
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180049a70
mov byte [rdx + 0xc], sil
lea rax, [rdx + 0xb]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
cmp rdx, rax
je 0x180049aad
mov r8d, recv
mov rcx, rbx
call fcn.180040b10
nop
lea r9, [rbx + 0x20]
mov qword [rsp + 0x20], r9
cmp byte [rdi + 0x11], 0
je 0x180049ad3
mov rcx, rsi
nop
lea eax, [rcx - 0x70]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, 0x10
jb 0x180049ac0
mov byte [rdi + 0x11], 0
lea r8, [rdi + 0x10]
mov qword [r9], rsi
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r9], 0
cmp rdi, r8
je 0x180049b01
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
mov rcx, r9
call fcn.180040b10
nop
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180049b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
cmp byte [rdx + 0x1b], r8b
je 0x180049b44
mov eax, r8d
lea ecx, [rax - 0x70]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1a
jb 0x180049b31
mov byte [rdx + 0x1b], r8b
lea rax, [rdx + 0x1a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rax
je 0x180049b6e
mov r8d, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.180040b10
nop
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.180051860
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret