joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008f50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x42], 0
mov r8, rcx
je 0x1400090e6
xor eax, eax
cmp dword [0x140044090], 5
jl 0x1400090a8
movdqa xmm0, xmmword [0x14003d9d0]
lea rdx, [rcx + 8]
movdqa xmm2, xmmword [0x14003d940]
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003dd40]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rcx, [rax + 2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rdx, [rdx + 0x10]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x18]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
movd dword [rdx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x14], xmm1
lea rcx, [rax + 6]
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x10]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x10], xmm1
lea rcx, [rax + 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp rcx, 0x24
jb 0x140008fb0
cmp rax, 0x21
jae 0x1400090e1
movabs r9, 0xbb2103bf0b4d771d
mov r10d, 0xff
nop dword [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x21
jb 0x1400090c0
mov byte [r8 + 0x42], 0
add rsp, 0x18
ret

Function at 0x140009150
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
lea rdi, [0x1400487f0]
mov rax, qword [rdi]
test rax, rax
je 0x140009183
call rax
test al, al
je 0x1400091ac
inc ebx
add rdi, 8
cmp ebx, 2
jl 0x140009175
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400195c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.14000c0f0
lea rcx, [rsp + 0x30]
call fcn.14000c100
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000c120
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14000c980
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, 0x20
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call fcn.14001f580
mov rsi, rax
test rax, rax
je 0x14000ca73
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000ca37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000ca37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x40bda363
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000ca32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000ca10
cmp r8d, 0xe0caca7c
je 0x14000ca3c
test r9d, r9d
jne 0x14000c9f0
mov rax, qword [rax]
jmp 0x14000c9c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov rcx, rsi
call rax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x14000ca7b
mov rcx, rsi
call fcn.14001f0e8
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x14000ca90
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dword [rsp + 0x30], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000cb37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000cb37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb443af1c
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000cb32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000cb10
cmp r8d, 0xba6fda70
je 0x14000cb3c
test r9d, r9d
jne 0x14000caf0
mov rax, qword [rax]
jmp 0x14000cac0
mov ecx, dword [rbx + 0x24]
lea r8, [rsp + 0x30]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov ecx, 1
call rax
mov ecx, dword [rsp + 0x30]
inc ecx
add rcx, rcx
call fcn.14001f580
mov rsi, rax
test rax, rax
je 0x14000cc3f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000cc07
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000cc07
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1cd9bcd3
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cc02
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14000cbe0
cmp r8d, 0x5346c2db
je 0x14000cc0c
test r9d, r9d
jne 0x14000cbc0
mov rax, qword [rax]
jmp 0x14000cb90
mov edx, dword [rbx + 0x24]
mov ecx, 1
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
lea r8, [rsp + 0x30]
add rax, r10
mov rdx, rsi
call rax
test eax, eax
jne 0x14000cc51
mov rcx, rsi
call fcn.14001f0e8
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cc70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000cd17
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000cd17
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x107896f2
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000cd12
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000ccf0
cmp r8d, 0x37324eb2
je 0x14000cd1c
test r9d, r9d
jne 0x14000ccd0
mov rax, qword [rax]
jmp 0x14000cca0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
call rax
cmp eax, 0xffffffff
je 0x14000cd56
test al, 0x10
jne 0x14000cd56
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140015a10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x140015ba6
xor eax, eax
cmp dword [0x140044090], 5
jl 0x140015b6c
movdqa xmm0, xmmword [0x14003d9d0]
mov edx, 4
movdqa xmm2, xmmword [0x14003d940]
add rcx, 8
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003dc40]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rax, [rdx - 4]
movq xmm0, rax
lea rcx, [rcx + 0x10]
punpcklqdq xmm0, xmm0
lea rax, [rdx - 2]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx + 2]
movd dword [rcx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x14]
xorps xmm1, xmm0
movq xmm0, rdx
movd dword [rcx - 0x14], xmm1
add rdx, 8
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movq xmm0, rax
movd dword [rcx - 0x10], xmm1
lea rax, [rdx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd dword [rcx - 0xc], xmm1
cmp rax, 0x10
jb 0x140015a70
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
movabs r9, 0x73f5739d0f31a9d3
mov r10d, 0xff
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x140015b80
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
Function at 0x140015bb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x140015d16
xor eax, eax
cmp dword [0x140044090], 5
jl 0x140015cd8
movdqa xmm5, xmmword [0x14003daa0]
movdqa xmm4, xmmword [0x14003d9c0]
movdqa xmm3, xmmword [0x14003d940]
movdqa xmm2, xmmword [0x14003d960]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx]
pshufb xmm1, xmm4
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x14003d9d0]
andps xmm1, xmm6
psllq xmm3, 3
xorps xmm1, xmm0
movdqa xmm0, xmm2
movd dword [rcx], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 4]
pshufb xmm1, xmm4
psllq xmm2, 3
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd dword [rcx + 4], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 8]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [0x14003d990]
movd dword [rcx + 8], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 0xc]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
movd xmm0, dword [rcx + 0x10]
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0x10], xmm1
movd xmm0, dword [rcx + 0x14]
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
andps xmm1, xmm6
movaps xmm6, xmmword [rsp]
xorps xmm1, xmm0
movd dword [rcx + 0x14], xmm1
mov byte [rcx + 0x18], al
add rsp, 0x18
ret
movabs r9, 0x1ff9b589bb03dd41
mov r10d, 0xff
nop dword [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0xc
jb 0x140015cf0
mov byte [r8 + 0x18], 0
add rsp, 0x18
ret
Function at 0x140015d20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x140015e86
xor eax, eax
cmp dword [0x140044090], 5
jl 0x140015e48
movdqa xmm5, xmmword [0x14003de10]
movdqa xmm4, xmmword [0x14003d9c0]
movdqa xmm3, xmmword [0x14003d940]
movdqa xmm2, xmmword [0x14003d960]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx]
pshufb xmm1, xmm4
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x14003d9d0]
andps xmm1, xmm6
psllq xmm3, 3
xorps xmm1, xmm0
movdqa xmm0, xmm2
movd dword [rcx], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 4]
pshufb xmm1, xmm4
psllq xmm2, 3
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd dword [rcx + 4], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 8]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [0x14003d990]
movd dword [rcx + 8], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 0xc]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
movd xmm0, dword [rcx + 0x10]
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0x10], xmm1
movd xmm0, dword [rcx + 0x14]
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
andps xmm1, xmm6
movaps xmm6, xmmword [rsp]
xorps xmm1, xmm0
movd dword [rcx + 0x14], xmm1
mov byte [rcx + 0x18], al
add rsp, 0x18
ret
movabs r9, 0xe9cfff4b37a95fed
mov r10d, 0xff
nop dword [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0xc
jb 0x140015e60
mov byte [r8 + 0x18], 0
add rsp, 0x18
ret
Function at 0x140015e90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x140016026
xor eax, eax
cmp dword [0x140044090], 5
jl 0x140015fec
movdqa xmm0, xmmword [0x14003d9d0]
mov edx, 4
movdqa xmm2, xmmword [0x14003d940]
add rcx, 8
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003ddd0]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rax, [rdx - 4]
movq xmm0, rax
lea rcx, [rcx + 0x10]
punpcklqdq xmm0, xmm0
lea rax, [rdx - 2]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx + 2]
movd dword [rcx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x14]
xorps xmm1, xmm0
movq xmm0, rdx
movd dword [rcx - 0x14], xmm1
add rdx, 8
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movq xmm0, rax
movd dword [rcx - 0x10], xmm1
lea rax, [rdx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd dword [rcx - 0xc], xmm1
cmp rax, 0x10
jb 0x140015ef0
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
movabs r9, 0xd3011d6b252959dd
mov r10d, 0xff
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x140016000
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
Function at 0x140016030
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x1400161c6
xor eax, eax
cmp dword [0x140044090], 5
jl 0x14001618c
movdqa xmm0, xmmword [0x14003d9d0]
mov edx, 4
movdqa xmm2, xmmword [0x14003d940]
add rcx, 8
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003de50]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rax, [rdx - 4]
movq xmm0, rax
lea rcx, [rcx + 0x10]
punpcklqdq xmm0, xmm0
lea rax, [rdx - 2]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx + 2]
movd dword [rcx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x14]
xorps xmm1, xmm0
movq xmm0, rdx
movd dword [rcx - 0x14], xmm1
add rdx, 8
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movq xmm0, rax
movd dword [rcx - 0x10], xmm1
lea rax, [rdx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd dword [rcx - 0xc], xmm1
cmp rax, 0x10
jb 0x140016090
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
movabs r9, 0xfbbb351f3f6575f5
mov r10d, 0xff
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x1400161a0
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
Function at 0x1400161d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x140016366
xor eax, eax
cmp dword [0x140044090], 5
jl 0x14001632c
movdqa xmm0, xmmword [0x14003d9d0]
mov edx, 4
movdqa xmm2, xmmword [0x14003d940]
add rcx, 8
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003da40]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rax, [rdx - 4]
movq xmm0, rax
lea rcx, [rcx + 0x10]
punpcklqdq xmm0, xmm0
lea rax, [rdx - 2]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx + 2]
movd dword [rcx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x14]
xorps xmm1, xmm0
movq xmm0, rdx
movd dword [rcx - 0x14], xmm1
add rdx, 8
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movq xmm0, rax
movd dword [rcx - 0x10], xmm1
lea rax, [rdx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd dword [rcx - 0xc], xmm1
cmp rax, 0x10
jb 0x140016230
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
movabs r9, 0xdf73d154bcdcd99
mov r10d, 0xff
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x140016340
mov byte [r8 + 0x20], 0
add rsp, 0x18
ret
Function at 0x140016370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x24], 0
mov r8, rcx
je 0x140016506
xor eax, eax
cmp dword [0x140044090], 5
jl 0x1400164c8
movdqa xmm0, xmmword [0x14003d9d0]
lea rdx, [rcx + 8]
movdqa xmm2, xmmword [0x14003d940]
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003dd00]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rcx, [rax + 2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rdx, [rdx + 0x10]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x18]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
movd dword [rdx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x14], xmm1
lea rcx, [rax + 6]
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x10]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x10], xmm1
lea rcx, [rax + 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp rcx, 0x14
jb 0x1400163d0
cmp rax, 0x12
jae 0x140016501
movabs r9, 0xad3f396dbf31916f
mov r10d, 0xff
nop dword [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x12
jb 0x1400164e0
mov byte [r8 + 0x24], 0
add rsp, 0x18
ret
Function at 0x140016510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x22], 0
mov r8, rcx
je 0x1400166a6
xor eax, eax
cmp dword [0x140044090], 5
jl 0x140016668
movdqa xmm0, xmmword [0x14003d9d0]
lea rdx, [rcx + 8]
movdqa xmm2, xmmword [0x14003d940]
movdqa xmm3, xmmword [0x14003d9a0]
movdqa xmm4, xmmword [0x14003dc20]
movdqa xmm5, xmmword [0x14003d9c0]
movdqa xmmword [rsp], xmm0
mov r9d, dword [rsp]
nop word [rax + rax]
lea rcx, [rax + 2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rdx, [rdx + 0x10]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x18]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
movd dword [rdx - 0x18], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x14], xmm1
lea rcx, [rax + 6]
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movd xmm0, r9d
andps xmm1, xmm0
movd xmm0, dword [rdx - 0x10]
xorps xmm1, xmm0
movq xmm0, rcx
movd dword [rdx - 0x10], xmm1
lea rcx, [rax + 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, r9d
pshufb xmm1, xmm5
andps xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp rcx, 0x14
jb 0x140016570
cmp rax, 0x11
jae 0x1400166a1
movabs r9, 0x6f45aded393f75d1
mov r10d, 0xff
nop dword [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0x11
jb 0x140016680
mov byte [r8 + 0x22], 0
add rsp, 0x18
ret
Function at 0x1400166b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
cmp byte [rcx + 0x1a], 0
mov r8, rcx
je 0x140016816
xor eax, eax
cmp dword [0x140044090], 5
jl 0x1400167d5
movdqa xmm5, xmmword [0x14003dce0]
mov eax, recv
movdqa xmm4, xmmword [0x14003d9c0]
movdqa xmm3, xmmword [0x14003d940]
movdqa xmm2, xmmword [0x14003d960]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx]
pshufb xmm1, xmm4
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x14003d9d0]
andps xmm1, xmm6
psllq xmm3, 3
xorps xmm1, xmm0
movdqa xmm0, xmm2
movd dword [rcx], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 4]
pshufb xmm1, xmm4
psllq xmm2, 3
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd dword [rcx + 4], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 8]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movdqa xmm0, xmmword [0x14003d990]
movd dword [rcx + 8], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 0xc]
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
movd xmm0, dword [rcx + 0x10]
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
andps xmm1, xmm6
xorps xmm1, xmm0
movd dword [rcx + 0x10], xmm1
movd xmm0, dword [rcx + 0x14]
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
andps xmm1, xmm6
movaps xmm6, xmmword [rsp]
xorps xmm1, xmm0
movd dword [rcx + 0x14], xmm1
movabs r9, 0xa9af1f9f19e1b389
mov r10d, 0xff
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0xd
jb 0x1400167f0
mov byte [r8 + 0x1a], 0
add rsp, 0x18
ret