joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006f70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
mov r8, rcx
je 0x1400070e1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400070af
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b460]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x140006fc3
cmp rax, 0x27
jae 0x1400070dc
movabs r9, 0x213fa5c5059bd715
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x27
jb 0x1400070c0
mov byte [r8 + 0x27], 0
ret
Function at 0x1400070f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb9], 0
mov r8, rcx
je 0x140007276
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007240
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b650]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
nop word [rax + rax]
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0xb8
jb 0x140007150
cmp rax, 0xb9
jae 0x14000726e
movabs r9, 0x7d0149afab056bdd
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xb9
jb 0x140007250
mov byte [r8 + 0xb9], 0
ret
Function at 0x140007280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
mov r8, rcx
je 0x140007401
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400073d0
movdqa xmm2, xmmword [0x14007b2f0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r10d, 2
movdqa xmm4, xmmword [0x14007b630]
sub r9, r8
movdqa xmm5, xmmword [0x14007b360]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x10
jb 0x1400072e0
mov byte [r8 + 0x10], 0
ret
movabs r9, 0x6f5d01851325072d
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x10
jb 0x1400073e0
mov byte [r8 + 0x10], 0
ret
Function at 0x140007410
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
mov r8, rcx
je 0x140007581
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14000754f
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b8a0]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140007463
cmp rax, 0x17
jae 0x14000757c
movabs r9, 0xebe1417985296fdf
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x17
jb 0x140007560
mov byte [r8 + 0x17], 0
ret
Function at 0x140007590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x1400076e1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400076b3
movzx eax, word [rcx]
movdqa xmm5, xmmword [0x14007b690]
movdqa xmm4, xmmword [0x14007b360]
movdqa xmm3, xmmword [0x14007b2f0]
movdqa xmm2, xmmword [reloc.WS2_32.dll_bind]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm3, 3
movd eax, xmm1
movdqa xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm2, 3
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
mov word [rcx + 8], ax
movzx eax, word [rcx + 0xa]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 0xa], ax
mov byte [rcx + 0xc], 0
ret
movabs r9, 0x8165c1cfa9fd3505
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x1400076c0
mov byte [r8 + 0xc], 0
ret
Function at 0x1400076f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
mov r8, rcx
je 0x140007871
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007840
movdqa xmm2, xmmword [0x14007b2f0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r10d, 2
movdqa xmm4, xmmword [0x14007b8d0]
sub r9, r8
movdqa xmm5, xmmword [0x14007b360]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x10
jb 0x140007750
mov byte [r8 + 0x10], 0
ret
movabs r9, 0xf5578f1333032df5
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x10
jb 0x140007850
mov byte [r8 + 0x10], 0
ret
Function at 0x140007880
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x1400079f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400079bf
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b860]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x1400078d3
cmp rax, 0x13
jae 0x1400079ec
movabs r9, 0xe7bf2d95a54b2d63
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x13
jb 0x1400079d0
mov byte [r8 + 0x13], 0
ret
Function at 0x140007a00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x140007b71
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007b3f
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b5f0]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140007a53
cmp rax, 0x13
jae 0x140007b6c
movabs r9, 0x67f7a945730d6b67
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x13
jb 0x140007b50
mov byte [r8 + 0x13], 0
ret
Function at 0x140007b80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x140007cf1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007cbf
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b600]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140007bd3
cmp rax, 0x11
jae 0x140007cec
movabs r9, 0x695fdf51e51fa977
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x140007cd0
mov byte [r8 + 0x11], 0
ret
Function at 0x140007d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r8, rcx
je 0x140007e71
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007e3f
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b4c0]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140007d53
cmp rax, 0x12
jae 0x140007e6c
movabs r9, 0x331b5f3be9257109
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x12
jb 0x140007e50
mov byte [r8 + 0x12], 0
ret
Function at 0x140007e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
mov r8, rcx
je 0x140008001
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140007fd0
movdqa xmm2, xmmword [0x14007b2f0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r10d, 2
movdqa xmm4, xmmword [0x14007b710]
sub r9, r8
movdqa xmm5, xmmword [0x14007b360]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x10
jb 0x140007ee0
mov byte [r8 + 0x10], 0
ret
movabs r9, 0x918db9e1398751e3
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x10
jb 0x140007fe0
mov byte [r8 + 0x10], 0
ret
Function at 0x140008010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r8, rcx
je 0x140008181
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14000814f
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b490]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140008063
cmp rax, 0x12
jae 0x14000817c
movabs r9, 0x2b3dcfb5b5d3957b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x12
jb 0x140008160
mov byte [r8 + 0x12], 0
ret
Function at 0x140008190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x140008301
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400082cf
movdqa xmm2, xmmword [0x14007b2f0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14007b740]
sub r9, rcx
movdqa xmm5, xmmword [0x14007b360]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x1400081e3
cmp rax, 0x11
jae 0x1400082fc
movabs r9, 0x9b77efa71fa53b3f
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x1400082e0
mov byte [r8 + 0x11], 0
ret
Function at 0x140008310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140008461
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140008433
movzx eax, word [rcx]
movdqa xmm5, xmmword [0x14007b450]
movdqa xmm4, xmmword [0x14007b360]
movdqa xmm3, xmmword [0x14007b2f0]
movdqa xmm2, xmmword [reloc.WS2_32.dll_bind]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm3, 3
movd eax, xmm1
movdqa xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm2, 3
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
mov word [rcx + 8], ax
movzx eax, word [rcx + 0xa]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 0xa], ax
mov byte [rcx + 0xc], 0
ret
movabs r9, 0x1f25313bb56143eb
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x140008440
mov byte [r8 + 0xc], 0
ret