joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a22a
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor r15d, r15d
lea rdi, [0x18003f258]
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r12, [0x18002e160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call r13
mov ebx, eax
rdtsc
mov r14, rax
call rbp
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebx, r14d
xor ebx, eax
xor ebx, edx
mov eax, 2
mov rdx, r12
mov ecx, dword [rdx]
mov r8d, ebx
rol r8d, cl
mov ebx, dword [rsi + rax*4 - 8]
shr ecx, 8
ror ebx, cl
xor ebx, r8d
mov ecx, eax
and ecx, 7
mov ecx, dword [r12 + rcx*4]
mov r8d, ecx
or r8d, 1
imul r8d, ebx
rol r8d, cl
xor dword [rsi + rax*4 - 4], r8d
inc rax
add rdx, 4
cmp rax, 9
jne 0x18000a2a3
mov eax, dword [r12 + r15*4]
imul ecx, eax, 0x7ed55d16
xor ecx, ebx
or eax, 1
imul eax, ecx
mov dword [rsi + r15*4 + 0x5c], eax
inc r15
cmp r15, 8
jne case.default.0x18000a34c
mov rcx, rsi
call fcn.18000a458
mov rcx, rsi
call fcn.18000a18a
mov ebx, eax
mov r14, 0xffffffffffffffeb
xor r15d, r15d
lea rcx, [r15*4]
lea r12, [0x18002e160]
mov eax, dword [r12 + r15*4]
mov edx, eax
shr edx, 0x18
and edx, 7
lea r13, [0x18002efcc]
movsxd rdx, dword [r13 + rdx*4]
add rdx, r13
xor edi, edi
jmp rdx
add rdi, 3
add r14, 7
mov byte [rdi], 0x4a
lea ecx, [rdi*4]
mov eax, dword [r12 + r15*4]
mov edx, eax
shr edx, 0x18
and edx, 7
movsxd rdx, dword [r13 + rdx*4]
add rdx, r13
jmp rdx
mov eax, dword [rsi + r15*4 + 0x5c]
mov ecx, dword [rcx + r12]
rol eax, cl
xor eax, ebx
mov ebx, dword [rsi + r15*4]
shr ecx, 8
ror ebx, cl
jmp 0x18000a3cb
mov eax, dword [rsi + r15*4 + 0x60]
add eax, ebx
mov ecx, dword [r12 + r15*4 + 8]
mov ebx, ecx
or ebx, 1
imul ebx, eax
rol ebx, cl
jmp 0x18000a428
or eax, 1
imul eax, ebx
mov edx, 0x9cc72aa7
mov ecx, edi
shr edx, cl
mov ecx, edx
jmp 0x18000a424
mov ecx, dword [r12 + r15*4 + 0x10]
rol ebx, cl
mov eax, dword [rsi + r15*4 + 0x68]
shr ecx, 8
ror eax, cl
xor ebx, eax
jmp 0x18000a428
mov eax, dword [rsi + rdi*4]
mov ecx, dword [rcx + r12]
imul edx, ecx, 0x7ed55d16
xor edx, eax
or ecx, 1
imul ecx, edx
xor ebx, ecx
jmp 0x18000a428
mov edx, dword [rsi + r14*4 + 0x54]
add edx, ebx
shr eax, 0x10
mov ecx, eax
ror edx, cl
mov ebx, edx
jmp 0x18000a428
mov eax, dword [rsi + r15*4 + 0x5c]
or eax, 1
xor eax, dword [r12 + r15*4 + 0x14]
imul ebx, eax
jmp 0x18000a428
mov eax, dword [rsi + r15*4 + 0x64]
mov edx, dword [rcx + r12]
xor eax, edx
or eax, 1
imul eax, ebx
mov ecx, dword [rsi + r15*4 + 0x64]
xor ecx, edx
rol eax, cl
mov ebx, eax
test r15b, 1
jne 0x18000a44e
inc r15
cmp r15, 3
jne 0x18000a34e
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.18000a458
jmp 0x18000a42e
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffa4
mov ecx, dword [r12]
mov edx, ecx
shr edx, 0x18
and edx, 7
movsxd rdx, dword [r10 + rdx*4]
add rdx, r10
jmp rdx
Function at 0x18000a458
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 7
xor r8d, r8d
lea rdx, [0x18002e160]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x16
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000a502
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000a50a
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x17
jne 0x18000a4b7
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a520
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
lea rdx, [0x18002e180]
mov r8d, 1
mov r9, rdx
mov eax, dword [r9]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
mov ecx, r8d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4 - 4], edi
add r9, 4
inc r8
cmp r8, 9
jne 0x18000a582
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000a89e
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x17
xor r8d, r8d
lea rdx, [0x18002e180]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x1c
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000a948
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000a950
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x17
jne 0x18000a8fd
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a966
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x18
xor r8d, r8d
lea rdx, [0x18002e1a0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x17
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000aa10
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000aa18
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x18
jne 0x18000a9c5
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000aa2e
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e1c0]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 6
jne 0x18000aa89
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000aacc
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x11
xor r8d, r8d
lea rdx, [0x18002e1c0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 2
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000ab76
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000ab7e
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x11
jne 0x18000ab2b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000ab94
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor r8d, r8d
lea rdx, [0x18002e1e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol edi, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, edi
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov edi, ecx
or edi, 1
imul edi, eax
rol edi, cl
xor dword [rsi + r8*4], edi
mov r8, r9
cmp r9, 0xe
jne 0x18000abf0
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000ac34
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor r12d, r12d
lea rdi, [0x18003f258]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r15, [0x18002e1e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call rbp
mov ebx, eax
rdtsc
mov r14, rax
call r13
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebx, r14d
xor ebx, eax
xor ebx, edx
xor edx, edx
mov ecx, dword [r15 + rdx*4]
mov r8d, ebx
rol r8d, cl
mov eax, dword [r15 + rdx*4 + 8]
mov ebx, dword [rsi + rdx*4]
shr ecx, 8
ror ebx, cl
xor ebx, r8d
mov r8d, eax
or r8d, 1
imul r8d, ebx
mov ecx, eax
rol r8d, cl
xor dword [rsi + rdx*4 + 4], r8d
inc rdx
cmp rdx, 6
jne 0x18000aca7
mov eax, dword [r15 + r12*4]
imul ecx, eax, 0x7ed55d16
xor ecx, ebx
or eax, 1
imul eax, ecx
mov dword [rsi + r12*4 + 0x5c], eax
inc r12
cmp r12, 8
jne case.default.0x18000ad39
mov rcx, rsi
call fcn.18000ae6e
mov rcx, rsi
call fcn.18000ab94
mov ebx, eax
xor r14d, r14d
mov eax, dword [r15]
mov ecx, eax
shr ecx, 0x18
and ecx, 7
lea r12, [0x18002f00c]
movsxd rcx, dword [r12 + rcx*4]
add rcx, r12
xor edi, edi
xor r13d, r13d
mov rbp, r15
jmp rcx
mov eax, dword [rsi + r14*4 + 0x5c]
mov ecx, dword [rbp]
rol eax, cl
xor eax, ebx
mov ebx, dword [rsi + r14*4]
shr ecx, 8
ror ebx, cl
jmp 0x18000adca
mov eax, dword [rsi + r14*4 + 0x60]
add eax, ebx
lea ecx, [r14 + 2]
and ecx, 7
mov ecx, dword [r15 + rcx*4]
mov ebx, ecx
or ebx, 1
imul ebx, eax
rol ebx, cl
jmp 0x18000ae3d
or eax, 1
imul eax, ebx
mov edx, 0xfb469ec7
mov ecx, edi
shr edx, cl
mov ecx, edx
rol eax, cl
mov ebx, eax
jmp 0x18000ae3d
lea eax, [r14 + 4]
and eax, 7
mov ecx, dword [r15 + rax*4]
rol ebx, cl
lea eax, [r14 + 3]
and eax, 7
mov eax, dword [rsi + rax*4 + 0x5c]
shr ecx, 8
ror eax, cl
xor ebx, eax
jmp 0x18000ae3d
mov eax, dword [rsi + rdi*4]
mov ecx, dword [rbp]
imul edx, ecx, 0x7ed55d16
xor edx, eax
or ecx, 1
imul ecx, edx
xor ebx, ecx
jmp 0x18000ae3d
lea ecx, [r13 - 0x17]
cmp r14, 4
cmovb rcx, r13
mov ecx, ecx
mov edx, dword [rsi + rcx*4]
add edx, ebx
shr eax, 0x10
mov ecx, eax
ror edx, cl
jmp 0x18000ae3b
mov eax, dword [rsi + r14*4 + 0x5c]
or eax, 1
lea ecx, [r14 + 5]
and ecx, 7
xor eax, dword [r15 + rcx*4]
imul ebx, eax
jmp 0x18000ae3d
lea eax, [r14 + 2]
and eax, 7
mov edx, dword [rsi + rax*4 + 0x5c]
mov r8d, dword [rbp]
xor edx, r8d
or edx, 1
imul edx, ebx
mov ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, r8d
rol edx, cl
mov ebx, edx
test r14b, 1
jne 0x18000ae63
inc r14
cmp r14, 7
jne case.0x18000a72b.7
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.18000ae6e
jmp 0x18000ae43
Function at 0x18000ae6e
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 7
xor r8d, r8d
lea rdx, [0x18002e1e0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 2
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000af18
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000af20
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x17
jne 0x18000aecd
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000af36
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
xor edx, edx
lea r8, [0x18002e200]
mov ecx, dword [r8 + rdx*4]
mov r9d, edi
rol r9d, cl
mov eax, dword [r8 + rdx*4 + 8]
mov edi, dword [rsi + rdx*4]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov r9d, eax
or r9d, 1
imul r9d, edi
mov ecx, eax
rol r9d, cl
xor dword [rsi + rdx*4 + 4], r9d
inc rdx
cmp rdx, 5
jne 0x18000af91
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000afd4
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 3
xor r8d, r8d
lea rdx, [0x18002e200]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x1b
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b07e
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000b086
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x13
jne 0x18000b033
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b09c
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x10
xor r8d, r8d
lea rdx, [0x18002e220]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 3
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b146
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000b14e
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x10
jne 0x18000b0fb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000b164
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x15
xor r8d, r8d
lea rdx, [0x18002e260]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x12
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b20e
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000b216
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x15
jne 0x18000b1c3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b22c
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x1d
xor r8d, r8d
lea rdx, [0x18002e280]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x17
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b2d6
shr eax, 0x10
mov ecx, eax
rol r10d, cl
jmp 0x18000b2de
shr eax, 0x18
mov ecx, eax
ror r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x1d
jne 0x18000b28b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000b2f4
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
rol edi, 0x18
xor r8d, r8d
lea rdx, [0x18002e2c0]
mov eax, r8d
and eax, 7
mov eax, dword [rdx + rax*4]
mov ecx, eax
rol ecx, 0x14
xor ecx, edi
xor dword [rsi + r8*4], ecx
mov r10d, dword [rsi + r8*4]
lea r9, [r8 + 1]
mov ecx, r9d
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r11d, ecx
or r11d, 1
imul r11d, r10d
rol r11d, cl
mov dword [rsi + r8*4], r11d
mov r10d, dword [rsi + r8*4]
test r8b, 1
jne 0x18000b39e
shr eax, 0x18
mov ecx, eax
ror r10d, cl
jmp 0x18000b3a6
shr eax, 0x10
mov ecx, eax
rol r10d, cl
mov dword [rsi + r8*4], r10d
mov r8, r9
cmp r9, 0x18
jne 0x18000b353
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b3bc
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x18003f258]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, ebx
rol ecx, 0xd
mov edx, edi
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor edi, ebx
xor edi, eax
xor edi, edx
mov eax, 2
lea rdx, [0x18002e2e0]
mov r8, rdx
mov ecx, dword [r8]
mov r9d, edi
rol r9d, cl
mov edi, dword [rsi + rax*4 - 8]
shr ecx, 8
ror edi, cl
xor edi, r9d
mov ecx, eax
and ecx, 7
mov ecx, dword [rdx + rcx*4]
mov r9d, ecx
or r9d, 1
imul r9d, edi
rol r9d, cl
xor dword [rsi + rax*4 - 4], r9d
inc rax
add r8, 4
cmp rax, 9
jne 0x18000b41d
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret