Function at 0x1401072d2
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x47d5759b
pushf
not eax
add eax, 0xc868ac60
xor eax, 0x8faae5b5
rol eax, 0xd
popf
pushf
not eax
add eax, 0xeebfb00c
xor eax, 0xb4518e24
rol eax, 0x25
popf
cmp eax, 4
jne 0x14010730f
popf
pop rax
jmp 0x140107761
cmp eax, 0
jne 0x14010731e
popf
pop rax
jmp 0x1401074a4
cmp eax, 3
jne 0x14010732d
popf
pop rax
jmp 0x1401076cb
cmp eax, 1
jne 0x14010733c
popf
pop rax
jmp 0x140107576
cmp eax, 0xd
jne 0x14010734b
popf
pop rax
jmp 0x140107bb9
cmp eax, 0x1a
jne 0x14010735a
popf
pop rax
jmp 0x140108241
cmp eax, 0xe
jne 0x140107369
popf
pop rax
jmp 0x140107c3b
cmp eax, 0xb
jne 0x140107378
popf
pop rax
jmp 0x140107a35
cmp eax, 0x19
jne 0x140107387
popf
pop rax
jmp 0x1401081de
cmp eax, 8
jne 0x140107396
popf
pop rax
jmp 0x140107909
cmp eax, 0x10
jne 0x1401073a5
popf
pop rax
jmp 0x140107dac
cmp eax, 0x17
jne 0x1401073b4
popf
pop rax
jmp 0x140108121
cmp eax, 9
jne 0x1401073c3
popf
pop rax
jmp 0x1401079a6
cmp eax, 0x12
jne 0x1401073d2
popf
pop rax
jmp 0x140107f24
cmp eax, 0x18
jne 0x1401073e1
popf
pop rax
jmp 0x140108183
cmp eax, 0x11
jne 0x1401073f0
popf
pop rax
jmp 0x140107e6d
cmp eax, 0x1b
jne 0x1401073ff
popf
pop rax
jmp 0x1401082a8
cmp eax, 0x16
jne 0x14010740e
popf
pop rax
jmp 0x1401080a9
cmp eax, 0xa
jne 0x14010741d
popf
pop rax
jmp 0x1401079f4
cmp eax, 0x14
jne 0x14010742c
popf
pop rax
jmp 0x140107fcf
cmp eax, 0xf
jne 0x14010743b
popf
pop rax
jmp 0x140107cf6
cmp eax, 0x13
jne 0x14010744a
popf
pop rax
jmp 0x140107f71
cmp eax, 0x15
jne 0x140107459
popf
pop rax
jmp 0x140108018
cmp eax, 2
jne 0x140107468
popf
pop rax
jmp 0x14010762f
cmp eax, 6
jne 0x140107477
popf
pop rax
jmp 0x14010784e
cmp eax, 0xc
jne 0x140107486
popf
pop rax
jmp 0x140107aca
cmp eax, 7
jne 0x140107495
popf
pop rax
jmp 0x1401078c0
cmp eax, 5
jne 0x1401074a4
popf
pop rax
jmp 0x1401077f9
push rbp
push rdi
push r14
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rsi
mov rax, qword [0x140084080]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rdi, rdx
mov r14, rcx
test rdx, rdx
je 0x14010751d
push rax
pushf
mov eax, 0xfa15819a
pushf
not eax
add eax, 0xe6c69cbf
xor eax, 0xc72ff572
rol eax, 0x91
popf
pushf
not eax
add eax, 0xeecef320
xor eax, 0xf492b0ef
rol eax, 0xec
popf
pushf
not eax
add eax, 0xc2bce882
xor eax, 0xc20c0a16
rol eax, 0xa7
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xaa17db5a
pushf
not eax
add eax, 0xd41567d4
xor eax, 0xda63eb98
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xcb153c94
xor eax, 0xd71abddb
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xd9549bf3
xor eax, 0xcf26c29d
rol eax, 0xde
popf
pushf
not eax
add eax, 0xfbdec081
xor eax, 0xa3f8a93c
rol eax, 0x9b
popf
jmp 0x140107300
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rcx + 8]
jmp 0x14010758e
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x140107595
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401075e9
push rax
pushf
mov eax, 0x92dcdf6f
pushf
not eax
add eax, 0xc64d53fc
xor eax, 0xc8c4eea4
rol eax, 1
popf
pushf
not eax
add eax, 0xded8d459
xor eax, 0xe0377607
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xb08cc0ed
xor eax, 0x95cc8001
rol eax, 0xf3
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xe6a59991
pushf
not eax
add eax, 0xb055fab0
xor eax, 0xf6cf7f67
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xa68b5779
xor eax, 0xf17fea7d
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xdfbe5e9a
xor eax, 0xb2811fee
rol eax, 0xc0
popf
jmp 0x140107300
xor ebx, ebx
mov qword [rbp + 8], rbx
mov eax, dword [rbp]
cmp eax, 0x400
ja 0x140107685
push rax
pushf
mov eax, 0xb1aac23f
pushf
not eax
add eax, 0xec6a1286
xor eax, 0x8220a61d
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xbf898f10
xor eax, 0xdf7b5690
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x9230124d
xor eax, 0xf9aed8c3
rol eax, 0x9d
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xf6d2fbc
pushf
not eax
add eax, 0xb6b8810c
xor eax, 0x80381052
rol eax, 0xe
popf
pushf
not eax
add eax, 0xbf78fc6c
xor eax, 0xd54284e1
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x80efb9c5
xor eax, 0xc805eeeb
rol eax, 0x5a
popf
jmp 0x140107300
mov ecx, eax
call fcn.1400bf541
test al, al
je 0x14010771c
push rax
pushf
mov eax, 0x1ac7f40d
pushf
not eax
add eax, 0xd78a45db
xor eax, 0xe2904d39
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xaef6b006
xor eax, 0xafd0ef0b
rol eax, 0x49
popf
pushf
not eax
add eax, 0xc281884c
xor eax, 0xc4db0d17
rol eax, 0x38
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xca72e61b
pushf
not eax
add eax, 0xa959a42e
xor eax, 0xf4327256
rol eax, 1
popf
pushf
not eax
add eax, 0xbdb7e9f8
xor eax, 0xc291e616
rol eax, 0xda
popf
pushf
not eax
add eax, 0xb9d27c6c
xor eax, 0xd3247d8e
rol eax, 0x31
popf
jmp 0x140107300
mov eax, dword [rbp]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1401077a0
push rax
pushf
mov eax, 0x9ec5974c
pushf
not eax
add eax, 0xe7528ba9
xor eax, 0x9f6f4c7f
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xcc3770ab
xor eax, 0xad7846e9
rol eax, 0xd6
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x841f9c55
pushf
not eax
add eax, 0xb426f3ac
xor eax, 0xc97fc262
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xadefda9d
xor eax, 0x98dc1406
rol eax, 0x4c
popf
pushf
not eax
add eax, 0x94b09157
xor eax, 0xb5da28fc
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xea744444
xor eax, 0xb736c1e1
rol eax, 0x1f
popf
jmp 0x140107300
movabs rcx, 0x7b45f43cd87e3084
pushf
not rcx
add rcx, 0x739ad914
xor rcx, 0x64e35472
rol rcx, 0x5e
popf
pushf
not rcx
add rcx, 0x7d18ad65
xor rcx, 0x48c31d74
rol rcx, 0xb8
popf
pushf
not rcx
add rcx, 0x49078f6c
xor rcx, 0x78b499cb
rol rcx, 0xac
popf
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e99e7
sub rsp, rcx
lea rsi, [rsp + 0x30]
jmp 0x140107a35
mov eax, dword [rbp]
push rax
pushf
mov eax, 0x5afc169e
pushf
not eax
add eax, 0xf30f8303
xor eax, 0x858a6dc1
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xe28a203c
xor eax, 0xd037613f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xca7ba837
xor eax, 0x80fbfd6c
rol eax, 0x33
popf
jmp 0x140107300
mov ecx, eax
add rcx, 0x10
jmp 0x140107910
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x140107973
push rax
pushf
mov eax, 0xc5e36753
pushf
not eax
add eax, 0xd9938c98
xor eax, 0xef155cc6
rol eax, 1
popf
pushf
not eax
add eax, 0xc6a9e84a
xor eax, 0xe8679874
rol eax, 0x58
popf
pushf
not eax
add eax, 0xf462673a
xor eax, 0xf2487136
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xeb09da8d
xor eax, 0xa41f2eed
rol eax, 0xae
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xa27389af
pushf
not eax
add eax, 0x8cdb33a1
xor eax, 0xc93a447a
rol eax, 0xde
popf
pushf
not eax
add eax, 0x85d05500
xor eax, 0xecf8d99d
rol eax, 0x85
popf
jmp 0x140107300
mov rsi, rbx
jmp 0x140107a35
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 8], rax
lea rsi, [rax + 0x10]
push rax
pushf
mov eax, 0xdc93fd0d
pushf
not eax
add eax, 0xadfdafb2
xor eax, 0xb6d019d6
rol eax, 0x79
popf
pushf
not eax
add eax, 0xd8263ad0
xor eax, 0xf3540779
rol eax, 0x92
popf
jmp 0x140107300
test rsi, rsi
je 0x140107a84
push rax
pushf
mov eax, 0xe055ce1
pushf
not eax
add eax, 0x9c8a4731
xor eax, 0xe9fc285a
rol eax, 2
popf
pushf
not eax
add eax, 0xda1dad2d
xor eax, 0xdae2ece1
rol eax, 9
popf
pushf
not eax
add eax, 0x96817f37
xor eax, 0xe5911169
rol eax, 0xcd
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x61db8b4f
pushf
not eax
add eax, 0xb69ad51d
xor eax, 0xa6d609be
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xf5820ab6
xor eax, 0x8cebef51
rol eax, 0x21
popf
pushf
not eax
add eax, 0xee4ba116
xor eax, 0xf7cd8528
rol eax, 0xcc
popf
jmp 0x140107300
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp]
mov r8, rsi
mov edx, 0xfe0923ca
pushf
not edx
add edx, 0x8777d9de
xor edx, 0xe84b906a
rol edx, 0xed
popf
pushf
not edx
add edx, 0xdd0aab9f
xor edx, 0xf02dcf0a
rol edx, 0x5a
popf
pushf
not edx
add edx, 0xb02fb05d
xor edx, 0xed0f159b
rol edx, 0x72
popf
mov rcx, qword [r14 + 8]
jmp 0x140107b23
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140107b73
push rax
pushf
mov eax, 0x7f943e30
pushf
not eax
add eax, 0x85aa6aad
xor eax, 0xe909b99f
rol eax, 0x78
popf
pushf
not eax
add eax, 0xa59cd417
xor eax, 0xcd01bf15
rol eax, 0x64
popf
pushf
not eax
add eax, 0x87121ada
xor eax, 0xbc51b199
rol eax, 0x94
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x4ea3e1ae
pushf
not eax
add eax, 0xd963e2fd
xor eax, 0xfb3b09e2
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xa81fb209
xor eax, 0x8a032c57
rol eax, 0x94
popf
pushf
not eax
add eax, 0xb5c80904
xor eax, 0xdece9348
rol eax, 0x29
popf
jmp 0x140107300
mov rsi, qword [rsi]
cmp byte [rdi + 0x4c], 0
je 0x140107c08
push rax
pushf
mov eax, 0xb297f75d
pushf
not eax
add eax, 0xca3691d0
xor eax, 0xfdce33bd
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x9511992a
xor eax, 0xc823254c
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xad716556
xor eax, 0xbf9d7f32
rol eax, 0xb3
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x88217163
pushf
not eax
add eax, 0xfa1579ff
xor eax, 0xbed2f51e
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x91a799b0
xor eax, 0xc7e83fbc
rol eax, 0xb9
popf
jmp 0x140107300
lea rax, [rdi + 8]
cmp rax, rsi
je 0x140107c9d
push rax
pushf
mov eax, 0x3ef5ba50
pushf
not eax
add eax, 0xa50c2eb7
xor eax, 0xcf9c6300
rol eax, 0x96
popf
pushf
not eax
add eax, 0xd21dc907
xor eax, 0xafd01a6f
rol eax, 4
popf
pushf
not eax
add eax, 0xef12c5a7
xor eax, 0x96134375
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xd1ccedfd
xor eax, 0xfe41bf26
rol eax, 0x75
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x43d93c
pushf
not eax
add eax, 0xfb53a37d
xor eax, 0xfcf6da02
rol eax, 0x17
popf
pushf
not eax
add eax, 0x9bdea707
xor eax, 0xf8608efe
rol eax, 0xf
popf
pushf
not eax
add eax, 0x9f188168
xor eax, 0xdf698d6f
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xdeb3f539
xor eax, 0xb43dbb85
rol eax, 0xe1
popf
jmp 0x140107300
mov dword [rdi + 0x50], 7
lea rcx, [rdi + 0x58]
call fcn.1400ca3d9
lea rcx, [rdi + 0x60]
call fcn.1400ca3d9
lea rcx, [rdi + 0x68]
call fcn.1400ca3d9
lea rcx, [rdi + 0x70]
call fcn.1400ca3d9
mov byte [rdi + 0x4c], 0
mov rcx, rsi
jmp 0x140107d29
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140107d79
push rax
pushf
mov eax, 0xe2a15952
pushf
not eax
add eax, 0xcf85ee68
xor eax, 0x9fdf765a
rol eax, 0x76
popf
pushf
not eax
add eax, 0xb3dc1870
xor eax, 0xd77aa016
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xb4bfca58
xor eax, 0x889eb9ba
rol eax, 0x9f
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x4732f4e
pushf
not eax
add eax, 0x82c3454b
xor eax, 0x9375cd93
rol eax, 0x16
popf
pushf
not eax
add eax, 0xa9961f60
xor eax, 0x8d9ae1e9
rol eax, 0x77
popf
jmp 0x140107300
mov rcx, rsi
jmp 0x140107db0
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp eax, 0x44
ja 0x140107e14
push rax
pushf
mov eax, 0x29885f9f
pushf
not eax
add eax, 0xa15e50dd
xor eax, 0xfb2d06cc
rol eax, 0xce
popf
pushf
not eax
add eax, 0x8c8c2b97
xor eax, 0x830b9ae5
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xb9b586fd
xor eax, 0x91bc185d
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xddd533be
xor eax, 0xfa3900ad
rol eax, 0xea
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xb4c67b17
pushf
not eax
add eax, 0xd1f4e967
xor eax, 0x824cc7e0
rol eax, 0x92
popf
pushf
not eax
add eax, 0x8405b55a
xor eax, 0xad5bdea6
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xf49b5f6a
xor eax, 0xa00b762f
rol eax, 0x79
popf
pushf
not eax
add eax, 0xd9ed44e7
xor eax, 0xf3200b7d
rol eax, 0xe3
popf
jmp 0x140107300
mov byte [rdi + 0x4c], 1
lea rdx, [rdi + 8]
mov r8, rsi
mov ecx, eax
jmp 0x140107e7b
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x140107ede
push rax
pushf
mov eax, 0x782eb578
pushf
not eax
add eax, 0xc9ac1314
xor eax, 0xb3cd71d8
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x9cec6c3a
xor eax, 0xb17504f3
rol eax, 0x43
popf
pushf
not eax
add eax, 0x856b327e
xor eax, 0xdee3293a
rol eax, 0x52
popf
pushf
not eax
add eax, 0xeb064e10
xor eax, 0xdfcc35a9
rol eax, 0x93
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xdac19e09
pushf
not eax
add eax, 0x8878a166
xor eax, 0x999cf988
rol eax, 0xde
popf
pushf
not eax
add eax, 0xb45b586d
xor eax, 0xca787642
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xea2eecdd
xor eax, 0xa022e201
rol eax, 0x79
popf
jmp 0x140107300
mov dword [rdi + 0x50], 8
push rax
pushf
mov eax, 0x330e0a41
pushf
not eax
add eax, 0xb364df1e
xor eax, 0xd86496de
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xf7b6d805
xor eax, 0xe2a8d381
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xe913b57a
xor eax, 0xb32b72cf
rol eax, 0x3d
popf
jmp 0x140107300
mov dil, reloc.WS2_32.dll_gethostname
pushf
not dil
add dil, 0x80
xor dil, 0xd8
rol dil, 0xec
popf
pushf
not dil
add dil, 0x1b
xor dil, 0x39
rol dil, 0x75
popf
jmp 0x140108018
xor dil, dil
push rax
pushf
mov eax, 0x254dd4d8
pushf
not eax
add eax, 0xbd81d5ef
xor eax, 0xcffdc28d
rol eax, 0x81
popf
pushf
not eax
add eax, 0x8d33478d
xor eax, 0xaeeba574
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xeadffe69
xor eax, 0xd7445e7f
rol eax, 0x5a
popf
jmp 0x140107300
test rbx, rbx
je 0x140108063
push rax
pushf
mov eax, 0x449b9d2e
pushf
not eax
add eax, 0xb030d411
xor eax, 0x9f79930e
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x810582bd
xor eax, 0xb9903f15
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xe1c4deb7
xor eax, 0x8bc00dcd
rol eax, 0x49
popf
jmp 0x140107300
push rax
pushf
mov eax, 0x18b13cb0
pushf
not eax
add eax, 0x9bdc53d0
xor eax, 0xff8a1b58
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xd0172af1
xor eax, 0x98491f85
rol eax, 0x40
popf
pushf
not eax
add eax, 0xe136aee0
xor eax, 0x907aa0f8
rol eax, 0xab
popf
jmp 0x140107300
mov rcx, rbx
mov rbx, qword [rbx]
jmp 0x1401080b0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x1401080ee
push rax
pushf
mov eax, 0x3d13a0e5
pushf
not eax
add eax, 0x95db1d57
xor eax, 0xc26e1fe0
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xaf690d44
xor eax, 0xe23a5b7b
rol eax, 0xaf
popf
jmp 0x140107300
push rax
pushf
mov eax, 0xb3748fb9
pushf
not eax
add eax, 0xdd7bea22
xor eax, 0xcdde3e62
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xafb387c3
xor eax, 0xf600bfad
rol eax, 0xc8
popf
jmp 0x140107300
movzx eax, dil
jmp 0x1401081de
xor al, al
push rax
pushf
mov eax, 0x357eaef
pushf
not eax
add eax, 0xca57b17d
xor eax, 0xb2227b09
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xc4274c0e
xor eax, 0xc9e54cd4
rol eax, 0x45
popf
pushf
not eax
add eax, 0xc7826161
xor eax, 0xfe15d304
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x8ad2be5a
xor eax, 0xbc57d57e
rol eax, 0xe6
popf
jmp 0x140107300
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.1400e25f6
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x20]
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x39b6d8ca
pushf
not ecx
add ecx, 0xc1741be9
xor ecx, 0x96b94fc9
rol ecx, 0x76
popf
pushf
not ecx
add ecx, 0xbcb47ed1
xor ecx, 0x9af163cd
rol ecx, 0xb6
popf
call fcn.1400eaa16
int3
call fcn.1400af4bf
mov byte [rdi + 0x4c], 0
mov ecx, eax
call fcn.1400eaa16
int3