Function at 0x1400021a0
Capabilities:
Hash data using fnv
Persist via run registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x208
call fcn.140006104
mov rbx, rax
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002254
lea rdx, str.Error_opening_registry_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400049f0
mov rcx, rax
lea rdx, [0x140004bc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400022c8
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x140002260
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.UsbAutomate
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400022bd
lea rdx, str.Error_setting_registry_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400049f0
mov rcx, rax
lea rdx, [0x140004bc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400060c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x50]
call fcn.140001480
nop
mov dword [rbp - 0x64], 0
mov qword [rbp - 0x60], 0xc
mov qword [rbp - 0x58], 0xf
movsd xmm0, qword [str.automate.auv]
movsd qword [rbp - 0x70], xmm0
mov eax, dword [0x1400086f0]
mov dword [rbp - 0x68], eax
mov byte [rbp - 0x64], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movabs rsi, 0xb2f4fc0794908cf3
movabs r12, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movabs r14, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
movss xmm6, dword [0x1400088a0]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
call fcn.140001480
nop
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000243a
mov r9, qword [rsp + 0x58]
movzx esi, byte [rbx + 0x10]
mov eax, esi
xor rax, r12
imul rax, r13
mov r8, qword [rbp - 0x80]
and r8, rax
mov rcx, r8
add rcx, rcx
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + rcx*8 + 8]
cmp rdx, r9
je 0x1400023e9
add r8, r8
mov rcx, qword [rax + r8*8]
cmp sil, byte [rdx + 0x10]
je 0x1400023eb
cmp rdx, rcx
je 0x1400023e9
mov rdx, qword [rdx + 8]
cmp sil, byte [rdx + 0x10]
jne 0x1400023d8
jmp 0x1400023eb
xor edx, edx
mov rax, r9
test rdx, rdx
cmovne rax, rdx
cmp rax, r9
jne 0x14000241d
lea rdx, [rbp - 0x70]
movzx ecx, sil
call fcn.140001b90
test al, al
je 0x140002418
lea rdx, [rbp - 0x70]
movzx ecx, sil
call fcn.140001650
mov r9, qword [rsp + 0x58]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x1400023a2
mov rdi, qword [rbp - 0x48]
movabs rsi, 0xb2f4fc0794908cf3
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x50], eax
mov r8, rdi
mov rdx, qword [rdi]
lea rcx, [rsp + 0x58]
call fcn.140004fa0
mov rcx, qword [rsp + 0x60]
xorps xmm0, xmm0
test rcx, rcx
js 0x140002465
cvtsi2ss xmm0, rcx
jmp 0x14000247a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsp + 0x50]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
comiss xmm0, xmm6
jb 0x1400024a2
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x1400024a2
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov rcx, qword [0x140008820]
cmp rax, 8
cmova rcx, rax
mov rdx, qword [rbp - 0x78]
cmp rdx, rcx
jae 0x1400024de
cmp rdx, 0x200
jae 0x1400024db
lea rax, [rdx*8]
mov rdx, rax
cmp rax, rcx
jae 0x1400024de
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140004660
nop
lea rcx, [rsp + 0x40]
call fcn.1400013a0
mov rbx, qword [rsp + 0x40]
movabs rax, 0x7ffffffffa0a1eff
cmp rbx, rax
jge 0x140002510
add rbx, 0x5f5e100
jmp 0x140002520
movabs rbx, 0x7fffffffffffffff
nop word [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rdi, 0x989680
jne 0x140002541
imul rax, rcx, 0x64
jmp 0x1400025b0
cmp rdi, 0x16e3600
jne 0x140002595
mov rax, rsi
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rsi
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x1400025b0
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, rbx
jge 0x1400025fe
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x1400025cf
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140002520
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400025f2
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002520
lea rcx, [rbp - 0x50]
call fcn.1400015a0
jmp 0x140002370