joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b464
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e2e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x17
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b50e
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000b516
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000b4c3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b52c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e300]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 4
jne 0x18000b587
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000b5ca
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e300]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 4
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b674
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000b67c
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000b629
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b692
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x18
xor r8d, r8d
lea rdx, [0x18002e340]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x16
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b73c
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000b744
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x18
jne 0x18000b6f1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000b75a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e360]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 9
jne 0x18000b7b6
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000ba3a
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0xf
xor r8d, r8d
lea rdx, [0x18002e360]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0xe
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000bae4
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000baec
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x1f
jne 0x18000ba99
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000bb02
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 4
xor r8d, r8d
lea rdx, [0x18002e380]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0xe
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000bbac
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000bbb4
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x14
jne 0x18000bb61
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000bbca
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e380]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 0xa
jne 0x18000bc26
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000bc6a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e3c0]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 4
jne 0x18000bcc5
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000bd08
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0xb
xor r8d, r8d
lea rdx, [0x18002e3c0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x10
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000bdb2
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000bdba
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x1b
jne 0x18000bd67
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000bdd0
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x14
xor r8d, r8d
lea rdx, [0x18002e3e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x1d
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000be7a
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000be82
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x14
jne 0x18000be2f
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000be98
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e3e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 9
jne 0x18000bef4
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000bf38
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x1d
xor r8d, r8d
lea rdx, [0x18002e400]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x16
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000bfe2
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000bfea
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x1d
jne 0x18000bf97
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000c000
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e420]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 0xa
jne 0x18000c05c
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000c0a0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor r12d, r12d
lea rdi, [0x18003f258]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r15, [0x18002e420]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call rbp
mov ebx, eax
rdtsc
mov r14, rax
call r13
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebx, r14d
xor ebx, eax
xor ebx, edx
xor edx, edx
mov ecx, dword [r15 + rdx*4]
mov r8d, ebx
rol r8d, cl
mov eax, dword [r15 + rdx*4 + 8]
mov ebx, dword [rsi + rdx*4]
shr ecx, 8
ror ebx, cl
xor ebx, r8d
mov r8d, eax
or r8d, 1
imul r8d, ebx
mov ecx, eax
rol r8d, cl
xor dword [rsi + rdx*4 + 4], r8d
inc rdx
cmp rdx, 6
jne 0x18000c113
mov eax, dword [r15 + r12*4]
imul ecx, eax, 0x7ed55d16
xor ecx, ebx
or eax, 1
imul eax, ecx
mov dword [rsi + r12*4 + 0x5c], eax
inc r12
cmp r12, 8
jne case.default.0x18000c1b0
mov rcx, rsi
call fcn.18000c2de
mov rcx, rsi
call fcn.18000c000
mov edi, eax
mov rbx, 0xffffffffffffffee
xor r14d, r14d
lea rcx, [r14*4]
mov eax, dword [r15 + r14*4]
mov edx, eax
shr edx, 0x18
and edx, 7
lea r12, [0x18002f04c]
movsxd rdx, dword [r12 + rdx*4]
add rdx, r12
xor r13d, r13d
jmp rdx
add rbx, 3
add r13, 7
add ebp, 7
mov eax, dword [rsi + r14*4 + 0x5c]
mov ecx, dword [rcx + r15]
rol eax, cl
xor eax, edi
mov edi, dword [rsi + r14*4]
shr ecx, 8
ror edi, cl
jmp 0x18000c23e
mov eax, dword [rsi + r14*4 + 0x60]
add eax, edi
mov ecx, dword [r15 + r14*4 + 8]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
jmp 0x18000c2ae
or eax, 1
imul eax, edi
lea ecx, [rbx + 0x12]
mov edx, 0x9722ad87
shr edx, cl
mov ecx, edx
jmp 0x18000c2aa
lea eax, [r14 + 4]
and eax, 7
mov ecx, dword [r15 + rax*4]
rol edi, cl
lea eax, [r14 + 3]
and eax, 7
mov eax, dword [rsi + rax*4 + 0x5c]
shr ecx, 8
ror eax, cl
xor edi, eax
jmp 0x18000c2ae
mov eax, dword [rsi + rbx*4 + 0x48]
mov ecx, dword [rcx + r15]
imul edx, ecx, 0x7ed55d16
xor edx, eax
or ecx, 1
imul ecx, edx
xor edi, ecx
jmp 0x18000c2ae
lea ecx, [r13 - 0x17]
cmp r14, 4
cmovb rcx, r13
mov ecx, ecx
mov edx, dword [rsi + rcx*4]
add edx, edi
shr eax, 0x10
mov ecx, eax
ror edx, cl
mov edi, edx
jmp 0x18000c2ae
mov eax, dword [rsi + r14*4 + 0x5c]
or eax, 1
lea ecx, [r14 + 5]
and ecx, 7
xor eax, dword [r15 + rcx*4]
imul edi, eax
jmp 0x18000c2ae
mov eax, dword [rsi + r14*4 + 0x64]
mov edx, dword [rcx + r15]
xor eax, edx
or eax, 1
imul eax, edi
mov ecx, dword [rsi + r14*4 + 0x64]
xor ecx, edx
rol eax, cl
mov edi, eax
test r14b, 1
jne 0x18000c2d4
inc r14
cmp r14, 6
jne 0x18000c1b2
mov eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.18000c2de
jmp 0x18000c2b4
Function at 0x18000c2de
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 7
xor r8d, r8d
lea rdx, [0x18002e420]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x13
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000c388
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000c390
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x17
jne 0x18000c33d
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000c3a6
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e440]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 6
jne 0x18000c401
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000c444
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e440]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 5
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000c4ee
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000c4f6
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000c4a3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000c50c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e460]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 5
jne 0x18000c567
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000c5aa
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e460]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x13
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000c654
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000c65c
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000c609
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000c672
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x1d
xor r8d, r8d
lea rdx, [0x18002e480]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x11
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000c71c
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000c724
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x1d
jne 0x18000c6d1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret