joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400706f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
mov r8, rcx
je 0x140070861
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007082f
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111e60]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x30
jb 0x140070743
cmp rax, 0x34
jae 0x14007085c
movabs r9, 0x577b1fbddfe50fc9
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x34
jb 0x140070840
mov byte [r8 + 0x34], 0
ret
Function at 0x140070870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
mov r8, rcx
je 0x1400709e1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400709af
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112420]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x38
jb 0x1400708c3
cmp rax, 0x3b
jae 0x1400709dc
movabs r9, 0xc991a39b6bb7eb4d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x3b
jb 0x1400709c0
mov byte [r8 + 0x3b], 0
ret
Function at 0x1400709f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x140070b61
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140070b2f
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401116c0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140070a43
cmp rax, 0x19
jae 0x140070b5c
movabs r9, 0x93b1dcfe9857fc9
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x140070b40
mov byte [r8 + 0x19], 0
ret
Function at 0x140070b70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
mov r8, rcx
je 0x140070ce1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140070caf
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112620]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x40
jb 0x140070bc3
cmp rax, 0x41
jae 0x140070cdc
movabs r9, 0xf3171395370ffb21
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x41
jb 0x140070cc0
mov byte [r8 + 0x41], 0
ret
Function at 0x140070cf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
mov r8, rcx
je 0x140070e71
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140070e40
movdqa xmm2, xmmword [0x1401113e0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r10d, 2
movdqa xmm4, xmmword [0x140112110]
sub r9, r8
movdqa xmm5, xmmword [0x140111540]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x30
jb 0x140070d50
mov byte [r8 + 0x30], 0
ret
movabs r9, 0x85f30135097b63f1
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x30
jb 0x140070e50
mov byte [r8 + 0x30], 0
ret
Function at 0x140070e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
mov r8, rcx
je 0x140070ff1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140070fbf
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112000]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x140070ed3
cmp rax, 0x2a
jae 0x140070fec
movabs r9, 0x738f23a1c99d9fe1
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x2a
jb 0x140070fd0
mov byte [r8 + 0x2a], 0
ret
Function at 0x140071000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
mov r8, rcx
je 0x140071171
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007113f
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401122d0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x140071053
cmp rax, 0x29
jae 0x14007116c
movabs r9, 0xab8f21ab1187c50f
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x29
jb 0x140071150
mov byte [r8 + 0x29], 0
ret
Function at 0x140071180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
mov r8, rcx
je 0x1400712f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400712bf
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111e50]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x1400711d3
cmp rax, 0x29
jae 0x1400712ec
movabs r9, 0x5701fb2dfb938d65
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x29
jb 0x1400712d0
mov byte [r8 + 0x29], 0
ret
Function at 0x140071300
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
mov r8, rcx
je 0x140071471
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007143f
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401120f0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x140071353
cmp rax, 0x21
jae 0x14007146c
movabs r9, 0x839385f735d58385
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x21
jb 0x140071450
mov byte [r8 + 0x21], 0
ret
Function at 0x140071480
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x1400715f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400715bf
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111e10]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x1400714d3
cmp rax, 0x11
jae 0x1400715ec
movabs r9, 0x51eb552585b39f4d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x1400715d0
mov byte [r8 + 0x11], 0
ret
Function at 0x140071600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5b], 0
mov r8, rcx
je 0x140071771
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007173f
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401122b0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x58
jb 0x140071653
cmp rax, 0x5b
jae 0x14007176c
movabs r9, 0xa92f07a353213337
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x5b
jb 0x140071750
mov byte [r8 + 0x5b], 0
ret

Function at 0x140071780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140071882
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140071857
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x1401122b0]
movdqa xmm2, xmmword [0x140111540]
movdqa xmm0, xmmword [0x1401113e0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
movabs r9, 0xa92f07a353213337
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x140071861
mov byte [r8 + 0xc], 0
ret
Function at 0x140071890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x51], 0
mov r8, rcx
je 0x140071a01
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400719cf
movdqa xmm2, xmmword [0x1401113e0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112190]
sub r9, rcx
movdqa xmm5, xmmword [0x140111540]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x50
jb 0x1400718e3
cmp rax, 0x51
jae 0x1400719fc
movabs r9, 0x91cd9be16b933947
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x51
jb 0x1400719e0
mov byte [r8 + 0x51], 0
ret

Function at 0x140071a10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140071b12
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140071ae7
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140112190]
movdqa xmm2, xmmword [0x140111540]
movdqa xmm0, xmmword [0x1401113e0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
movabs r9, 0x91cd9be16b933947
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x140071af1
mov byte [r8 + 0xc], 0
ret