joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f5e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
mov r8, rcx
je 0x14006f751
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006f71f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401117a0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x38
jb 0x14006f633
cmp rax, 0x3d
jae 0x14006f74c
movabs r9, 0x17bb15f3a395cb43
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x3d
jb 0x14006f730
mov byte [r8 + 0x3d], 0
ret
Function at 0x14006f760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x14006f8d1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006f89f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112120]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x14006f7b3
cmp rax, 0x19
jae 0x14006f8cc
movabs r9, 0x8da375d3a937d747
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x14006f8b0
mov byte [r8 + 0x19], 0
ret
Function at 0x14006f8e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x14006fa51
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006fa1f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111710]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x14006f933
cmp rax, 0x19
jae 0x14006fa4c
movabs r9, 0x93b1dcfe9857fc9
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x14006fa30
mov byte [r8 + 0x19], 0
ret
Function at 0x14006fa60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
mov r8, rcx
je 0x14006fbd1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006fb9f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401125a0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x40
jb 0x14006fab3
cmp rax, 0x41
jae 0x14006fbcc
movabs r9, 0xf3171395370ffb21
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x41
jb 0x14006fbb0
mov byte [r8 + 0x41], 0
ret
Function at 0x14006fbe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
mov r8, rcx
je 0x14006fd61
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006fd30
movdqa xmm2, xmmword [0x140111430]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r10d, 2
movdqa xmm4, xmmword [0x1401120d0]
sub r9, r8
movdqa xmm5, xmmword [0x140111590]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x30
jb 0x14006fc40
mov byte [r8 + 0x30], 0
ret
movabs r9, 0x85f30135097b63f1
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x30
jb 0x14006fd40
mov byte [r8 + 0x30], 0
ret
Function at 0x14006fd70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
mov r8, rcx
je 0x14006fee1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14006feaf
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111f20]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x14006fdc3
cmp rax, 0x2a
jae 0x14006fedc
movabs r9, 0x738f23a1c99d9fe1
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x2a
jb 0x14006fec0
mov byte [r8 + 0x2a], 0
ret
Function at 0x14006fef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
mov r8, rcx
je 0x140070061
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007002f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112220]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x14006ff43
cmp rax, 0x29
jae 0x14007005c
movabs r9, 0xab8f21ab1187c50f
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x29
jb 0x140070040
mov byte [r8 + 0x29], 0
ret
Function at 0x140070070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
mov r8, rcx
je 0x1400701e1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400701af
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111de0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x1400700c3
cmp rax, 0x29
jae 0x1400701dc
movabs r9, 0x5701fb2dfb938d65
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x29
jb 0x1400701c0
mov byte [r8 + 0x29], 0
ret
Function at 0x1400701f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
mov r8, rcx
je 0x140070361
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007032f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1401120a0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x140070243
cmp rax, 0x21
jae 0x14007035c
movabs r9, 0x839385f735d58385
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x21
jb 0x140070340
mov byte [r8 + 0x21], 0
ret
Function at 0x140070370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x1400704e1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400704af
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140111db0]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x1400703c3
cmp rax, 0x11
jae 0x1400704dc
movabs r9, 0x51eb552585b39f4d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x1400704c0
mov byte [r8 + 0x11], 0
ret
Function at 0x1400704f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5b], 0
mov r8, rcx
je 0x140070661
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14007062f
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112210]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x58
jb 0x140070543
cmp rax, 0x5b
jae 0x14007065c
movabs r9, 0xa92f07a353213337
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x5b
jb 0x140070640
mov byte [r8 + 0x5b], 0
ret

Function at 0x140070670
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140070772
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140070747
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140112210]
movdqa xmm2, xmmword [0x140111590]
movdqa xmm0, xmmword [0x140111430]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
movabs r9, 0xa92f07a353213337
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x140070751
mov byte [r8 + 0xc], 0
ret
Function at 0x140070780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x51], 0
mov r8, rcx
je 0x1400708f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400708bf
movdqa xmm2, xmmword [0x140111430]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140112150]
sub r9, rcx
movdqa xmm5, xmmword [0x140111590]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x50
jb 0x1400707d3
cmp rax, 0x51
jae 0x1400708ec
movabs r9, 0x91cd9be16b933947
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x51
jb 0x1400708d0
mov byte [r8 + 0x51], 0
ret

Function at 0x140070900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x140070a02
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400709d7
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140112150]
movdqa xmm2, xmmword [0x140111590]
movdqa xmm0, xmmword [0x140111430]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
movabs r9, 0x91cd9be16b933947
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x1400709e1
mov byte [r8 + 0xc], 0
ret