joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004d33
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor r14d, r14d
lea rsi, [0x18003f258]
mov rbp, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r15, [0x18002e320]
mov rcx, rsi
call rbp
call r12
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r14d
and r9d, 7
mov r9d, dword [r15 + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, edi
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r14*4 + 0x28], r9d
inc r14
cmp r14, 0x12
jne 0x180004d77
xor edi, edi
lea r14, [0x18003f258]
xor esi, esi
mov rcx, r14
call rbp
call r12
mov ebp, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, ebx
xor ebp, eax
xor ebp, edx
xor edx, edx
mov eax, edx
and eax, 7
mov eax, dword [r15 + rax*4]
mov ecx, eax
rol ebp, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, ebp
lea r8, [rdx + 1]
mov ecx, r8d
and ecx, 7
mov ecx, dword [r15 + rcx*4]
mov ebp, ecx
or ebp, 1
imul ebp, eax
rol ebp, cl
xor dword [rsp + rdx*4 + 0x28], ebp
mov rdx, r8
cmp r8, 0xc
jne 0x180004e2c
mov r12d, dword [r15 + rdi*4]
mov ebx, r12d
or ebx, 1
imul ebx, ebp
mov r13, r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
rdtsc
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r14d
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, r14d
xor ebp, eax
xor ebp, edx
rol ebp, 0x12
xor edx, edx
mov eax, edx
and eax, 7
mov eax, dword [r15 + rax*4]
mov ecx, eax
rol ecx, 0x19
xor ecx, ebp
xor dword [rsp + rdx*4 + 0x28], ecx
mov r9d, dword [rsp + rdx*4 + 0x28]
lea r8, [rdx + 1]
mov ecx, r8d
and ecx, 7
mov ecx, dword [r15 + rcx*4]
mov r10d, ecx
or r10d, 1
imul r10d, r9d
rol r10d, cl
mov dword [rsp + rdx*4 + 0x28], r10d
mov r9d, dword [rsp + rdx*4 + 0x28]
test dl, 1
jne 0x180004f10
shr eax, 0x18
mov ecx, eax
ror r9d, cl
jmp 0x180004f18
shr eax, 0x10
mov ecx, eax
rol r9d, cl
mov dword [rsp + rdx*4 + 0x28], r9d
mov rdx, r8
cmp r8, 0x12
jne 0x180004ec2
mov ecx, r12d
rol ebx, cl
xor esi, ebx
inc rdi
cmp rdi, 4
mov rbp, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14, r13
jne 0x180004ded
xor esi, 0x97fca752
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180004f77
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor r15d, r15d
lea r14, [0x18003f258]
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rsi, [0x18002e340]
mov rcx, r14
call r12
call rbp
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r15d
and r9d, 7
mov r9d, dword [rsi + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, edi
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r15*4 + 0x30], r9d
inc r15
cmp r15, 0x18
jne 0x180004fbb
lea rdi, [0x18003f258]
lea rbx, [0x18002edac]
xor eax, eax
xor r14d, r14d

Function at 0x18000530c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor r14d, r14d
lea rsi, [0x18003f258]
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbp, [0x18002e360]
mov rcx, rsi
call r15
call r12
mov edi, eax
rdtsc
mov rbx, rax
call r13
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r14d
and r9d, 7
mov r9d, dword [rbp + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, edi
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r14*4 + 0x24], r9d
inc r14
cmp r14, 0x1f
jne 0x180005357
lea rdi, [rsp + 0x24]
mov rcx, rdi
call fcn.18000b75a
mov esi, eax
mov ebx, 5
mov rcx, rdi
call fcn.18000b7fa
imul ebp, eax, 0x7ed55d16
xor ebp, esi
mov rcx, rdi
call fcn.18000b7fa
mov esi, eax
or esi, 1
imul esi, ebp
mov rcx, rdi
call fcn.18000ba3a
dec ebx
jne 0x1800053d5
xor esi, 0xf949720f
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180005793
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor r14d, r14d
lea rsi, [0x18003f258]
mov rbp, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r15, [0x18002e3a0]
mov rcx, rsi
call rbp
call r12
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r14d
and r9d, 7
mov r9d, dword [r15 + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, edi
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r14*4 + 0x28], r9d
inc r14
cmp r14, 0x12
jne 0x1800057d7
xor edi, edi
lea r14, [0x18003f258]
xor esi, esi
mov rcx, r14
call rbp
call r12
mov ebp, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, ebx
xor ebp, eax
xor ebp, edx
xor edx, edx
mov eax, edx
and eax, 7
mov eax, dword [r15 + rax*4]
mov ecx, eax
rol ebp, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, ebp
lea r8, [rdx + 1]
mov ecx, r8d
and ecx, 7
mov ecx, dword [r15 + rcx*4]
mov ebp, ecx
or ebp, 1
imul ebp, eax
rol ebp, cl
xor dword [rsp + rdx*4 + 0x28], ebp
mov rdx, r8
cmp r8, 0xf
jne 0x18000588c
mov r12d, dword [r15 + rdi*4]
mov ebx, r12d
or ebx, 1
imul ebx, ebp
mov r13, r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
rdtsc
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r14d
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, r14d
xor ebp, eax
xor ebp, edx
rol ebp, 0x12
xor edx, edx
mov eax, edx
and eax, 7
mov eax, dword [r15 + rax*4]
mov ecx, eax
rol ecx, 0x13
xor ecx, ebp
xor dword [rsp + rdx*4 + 0x28], ecx
mov r9d, dword [rsp + rdx*4 + 0x28]
lea r8, [rdx + 1]
mov ecx, r8d
and ecx, 7
mov ecx, dword [r15 + rcx*4]
mov r10d, ecx
or r10d, 1
imul r10d, r9d
rol r10d, cl
mov dword [rsp + rdx*4 + 0x28], r10d
mov r9d, dword [rsp + rdx*4 + 0x28]
test dl, 1
jne 0x180005970
shr eax, 0x18
mov ecx, eax
ror r9d, cl
jmp 0x180005978
shr eax, 0x10
mov ecx, eax
rol r9d, cl
mov dword [rsp + rdx*4 + 0x28], r9d
mov rdx, r8
cmp r8, 0x12
jne 0x180005922
mov ecx, r12d
rol ebx, cl
xor esi, ebx
inc rdi
cmp rdi, 4
mov rbp, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14, r13
jne 0x18000584d
xor esi, 0xed572d72
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180005cfc
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor esi, esi
lea r15, [0x18003f258]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdi, [0x18002e3e0]
mov rcx, r15
call r13
call r12
mov ebx, eax
rdtsc
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, esi
and r9d, 7
mov r9d, dword [rdi + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, ebx
xor r10d, r14d
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + rsi*4 + 0x30], r9d
inc rsi
cmp rsi, 0x14
jne 0x180005d3f
lea rbx, [0x18003f258]
lea r14, [0x18002ee0c]
xor eax, eax
xor esi, esi
Function at 0x1800063d9
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r14d, r14d
lea rsi, [0x18003f258]
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbp, [0x18002e420]
mov rcx, rsi
call r15
call r12
mov edi, eax
rdtsc
mov rbx, rax
call r13
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r14d
and r9d, 7
mov r9d, dword [rbp + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, edi
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r14*4 + 0x24], r9d
inc r14
cmp r14, 0x17
jne 0x180006424
lea rdi, [rsp + 0x24]
mov rcx, rdi
call fcn.18000c000
mov esi, eax
mov ebx, 5
mov rcx, rdi
call fcn.18000c0a0
imul ebp, eax, 0x7ed55d16
xor ebp, esi
mov rcx, rdi
call fcn.18000c0a0
mov esi, eax
or esi, 1
imul esi, ebp
mov rcx, rdi
call fcn.18000c2de
dec ebx
jne 0x1800064a2
xor esi, 0x9722ad87
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800068a6
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r14d, r14d
lea rsi, [0x18003f258]
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdi, [0x18002e460]
mov rcx, rsi
call r15
call r12
mov ebp, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, r14d
and r9d, 7
mov r9d, dword [rdi + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, ebp
xor r10d, ebx
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + r14*4 + 0x34], r9d
inc r14
cmp r14, 0x13
jne 0x1800068ea
lea rbp, [rsp + 0x34]
mov rcx, rbp
call fcn.18000c50c
mov esi, eax
xor eax, eax
lea r13, [0x18002ee6c]
Function at 0x18000811f
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor esi, esi
lea r15, [0x18003f258]
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdi, [0x18002e540]
mov rcx, r15
call r12
call r13
mov ebx, eax
rdtsc
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, esi
and r9d, 7
mov r9d, dword [rdi + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, ebx
xor r10d, r14d
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + rsi*4 + 0x30], r9d
inc rsi
cmp rsi, 0x10
jne 0x180008162
xor eax, eax
lea rbx, [0x18003f258]
lea r14, [0x18002ef4c]
xor esi, esi
Function at 0x180009b0a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e0a0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 0xb
jne 0x180009b66
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x180009baa
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor r15d, r15d
lea rdi, [0x18003f258]
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r12, [0x18002e0a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call r13
mov ebx, eax
rdtsc
mov r14, rax
call rbp
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebx, r14d
xor ebx, eax
xor ebx, edx
mov eax, 2
mov rdx, r12
mov ecx, dword [rdx]
mov r8d, ebx
rol r8d, cl
mov ebx, dword [rsi + rax*4 - 8]
shr ecx, 8
ror ebx, cl
xor ebx, r8d
mov ecx, eax
and ecx, 7
mov ecx, dword [r12 + rcx*4]
mov r8d, ecx
or r8d, 1
imul r8d, ebx
rol r8d, cl
xor dword [rsi + rax*4 - 4], r8d
inc rax
add rdx, 4
cmp rax, 9
jne 0x180009c23
mov eax, dword [r12 + r15*4]
imul ecx, eax, 0x7ed55d16
xor ecx, ebx
or eax, 1
imul eax, ecx
mov dword [rsi + r15*4 + 0x5c], eax
inc r15
cmp r15, 8
jne case.default.0x180009cc1
mov rcx, rsi
call fcn.180009df6
mov rcx, rsi
call fcn.180009b0a
mov ebx, eax
lea r14, [0x18002e0a0]
xor r15d, r15d
mov eax, dword [r14]
mov ecx, eax
shr ecx, 0x18
and ecx, 7
lea r12, [0x18002efac]
movsxd rcx, dword [r12 + rcx*4]
add rcx, r12
xor edi, edi
xor r13d, r13d
mov rbp, r14
jmp rcx
mov eax, dword [rsi + r15*4 + 0x5c]
mov ecx, dword [rbp]
rol eax, cl
xor eax, ebx
mov ebx, dword [rsi + r15*4]
shr ecx, 8
ror ebx, cl
jmp 0x180009d52
mov eax, dword [rsi + r15*4 + 0x60]
or eax, 1
imul eax, ebx
mov edx, 0xd8bbc27
mov ecx, edi
shr edx, cl
mov ecx, edx
rol eax, cl
mov ebx, eax
jmp 0x180009dc5
lea eax, [r15 + 4]
mov eax, dword [rsi + rdi*4]
mov ecx, dword [rbp]
imul edx, ecx, 0x7ed55d16
xor edx, eax
or ecx, 1
imul ecx, edx
lea ecx, [r13 - 0x17]
cmp r15, 4
cmovb rcx, r13
mov ecx, ecx
mov edx, dword [rsi + rcx*4]
add edx, ebx
shr eax, 0x10
call 0x153c22697
retf 0x39eb
mov eax, dword [rsi + r15*4 + 0x5c]
or eax, 1
lea ecx, [r15 + 5]
and ecx, 7
xor eax, dword [r14 + rcx*4]
imul ebx, eax
jmp 0x180009dc5
lea eax, [r15 + 2]
and eax, 7
mov edx, dword [rsi + rax*4 + 0x5c]
mov r8d, dword [rbp]
xor edx, r8d
or edx, 1
imul edx, ebx
mov ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, r8d
rol edx, cl
mov ebx, edx
mov byte [rdi], 0x4a
lea ecx, [rdi*4]
Function at 0x180009df6
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 7
xor r8d, r8d
lea rdx, [0x18002e0a0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 4
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x180009ea0
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x180009ea8
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x17
jne 0x180009e55
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x180009ebe
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e0c0]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 5
jne 0x180009f19
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x180009f5c
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x19
xor r8d, r8d
lea rdx, [0x18002e0c0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x10
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000a006
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000a00e
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x19
jne 0x180009fbb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a024
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e0e0]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 5
jne 0x18000a07f
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000a0c2
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e0e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x18
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000a16c
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000a174
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000a121
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a18a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e160]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 0xf
jne 0x18000a1e6
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret