Function at 0x1402677ba
Capabilities:
Hash data using murmur3
Set registry value

Disassembly:
push rax
pushf
mov eax, 0x2709ddbb
pushf
not eax
add eax, 0x85c4d782
xor eax, 0xfeeb2efa
rol eax, 0x42
popf
pushf
not eax
add eax, 0xcfa692c7
xor eax, 0xdd489a2c
rol eax, 0x90
popf
pushf
not eax
add eax, 0xaa509dca
xor eax, 0xfa580ab2
rol eax, 0xa9
popf
cmp eax, 4
jne 0x14026780a
popf
pop rax
jmp 0x140267c38
cmp eax, 0
jne 0x140267819
popf
pop rax
jmp 0x140267954
cmp eax, 3
jne 0x140267828
popf
pop rax
jmp 0x140267bb3
cmp eax, 1
jne 0x140267837
popf
pop rax
jmp 0x140267a12
cmp eax, 0xd
jne 0x140267846
popf
pop rax
jmp 0x1402681dd
cmp eax, 7
jne 0x140267855
popf
pop rax
jmp 0x140267dd0
cmp eax, 0xe
jne 0x140267864
popf
pop rax
jmp 0x140268225
cmp eax, 0xb
jne 0x140267873
popf
pop rax
jmp 0x140268071
cmp eax, 0xc
jne 0x140267882
popf
pop rax
jmp 0x14026816a
cmp eax, 8
jne 0x140267891
popf
pop rax
jmp 0x140267e36
cmp eax, 0x10
jne 0x1402678a0
popf
pop rax
jmp 0x140268360
cmp eax, 2
jne 0x1402678af
popf
pop rax
jmp 0x140267b26
cmp eax, 9
jne 0x1402678be
popf
pop rax
jmp 0x140267e7f
cmp eax, 0x12
jne 0x1402678cd
popf
pop rax
jmp 0x140268462
cmp eax, 6
jne 0x1402678dc
popf
pop rax
jmp 0x140267d2c
cmp eax, 0x11
jne 0x1402678eb
popf
pop rax
jmp 0x140268428
cmp eax, 5
jne 0x1402678fa
popf
pop rax
jmp 0x140267cc2
cmp eax, 0x16
jne 0x140267909
popf
pop rax
jmp 0x140268549
cmp eax, 0xa
jne 0x140267918
popf
pop rax
jmp 0x140267f96
cmp eax, 0x14
jne 0x140267927
popf
pop rax
jmp 0x1402684e0
cmp eax, 0xf
jne 0x140267936
popf
pop rax
jmp 0x1402682ba
cmp eax, 0x13
jne 0x140267945
popf
pop rax
jmp 0x14026849a
cmp eax, 0x15
jne 0x140267954
popf
pop rax
jmp 0x140268543
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400c1010]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r12d, r12d
mov r15, r9
mov r14, r8
mov dword [rsp + 0x28], r12d
mov rbp, rdx
mov qword [rsp + 0x50], r12
mov r8, r15
mov qword [rsp + 0x20], r12
lea r9d, [r12 - 1]
xor edx, edx
xor ecx, ecx
jmp 0x14026799b
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
je 0x1402679df
push rax
pushf
mov eax, 0xda33289d
pushf
not eax
add eax, 0xbc33c1f8
xor eax, 0xefec5534
rol eax, 0x63
popf
pushf
not eax
add eax, 0xfffa57fa
xor eax, 0x9493f489
rol eax, 0x46
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0xf9423b1e
pushf
not eax
add eax, 0xfaf4e397
xor eax, 0xb3fcef83
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x87230e98
xor eax, 0x9859d078
rol eax, 0x5a
popf
jmp 0x1402677fb
movabs rax, 0xdcd2de861116361e
pushf
not rax
add rax, 0x713b2527
xor rax, 0x7252d529
rol rax, 0x95
popf
pushf
not rax
add rax, 0x74021065
xor rax, 0x4fddaee6
rol rax, 0xd3
popf
pushf
not rax
add rax, 0x74db8ddc
xor rax, 0x53a5c348
rol rax, 0xd0
popf
pushf
not rax
add rax, 0x6b3f6cf4
xor rax, 0x59670841
rol rax, 0x37
popf
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
mov rdi, rsi
movdqu xmmword [rsp + 0x58], xmm0
cmp rsi, rax
ja 0x140267af3
push rax
pushf
mov eax, 0x74a8a571
pushf
not eax
add eax, 0xc488c310
xor eax, 0x843c52f1
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xf3e2360b
xor eax, 0xcf45cdc9
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xef15df87
xor eax, 0x805f88dc
rol eax, 0x88
popf
pushf
not eax
add eax, 0xe80ffda0
xor eax, 0xea469034
rol eax, 0x27
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0xae889584
pushf
not eax
add eax, 0xe3dc7d4b
xor eax, 0xf18b2d2f
rol eax, 0x16
popf
pushf
not eax
add eax, 0xfd04f3d8
xor eax, 0xf293bda5
rol eax, 0x65
popf
jmp 0x1402677fb
add rdi, rdi
mov qword [rsp + 0x88], rbx
cmp rdi, 0x1000
jb 0x140267b6d
push rax
pushf
mov eax, 0xa5f0bd6d
pushf
not eax
add eax, 0xa1d4c9c0
xor eax, 0xeed415cf
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xbc00a4b1
xor eax, 0xeaada30f
rol eax, 0xfd
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0xf734ca23
pushf
not eax
add eax, 0xfacc6a0c
xor eax, 0xd4c89074
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xa6a2846d
xor eax, 0xed0a0bf0
rol eax, 0x87
popf
pushf
not eax
add eax, 0xb8ddfadb
xor eax, 0xc5d453e1
rol eax, 0xa7
popf
jmp 0x1402677fb
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140267bf2
push rax
pushf
mov eax, 0x97aaa6f4
pushf
not eax
add eax, 0xe0afed21
xor eax, 0x89f44247
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xd095acb1
xor eax, 0xdf9140f2
rol eax, 1
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x921aae5f
pushf
not eax
add eax, 0xd63a15be
xor eax, 0xe0ab8ff2
rol eax, 0x39
popf
pushf
not eax
add eax, 0xdfb6dabf
xor eax, 0xa3e99dc5
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x8d2fdb4b
xor eax, 0x83ceaa80
rol eax, 0x79
popf
jmp 0x1402677fb
call fcn.1400fe169
mov rcx, rax
test rax, rax
je 0x140267c7c
push rax
pushf
mov eax, 0x4abe10bc
pushf
not eax
add eax, 0xcf806b6d
xor eax, 0xe18f08c8
rol eax, 0x72
popf
pushf
not eax
add eax, 0xdb294e9a
xor eax, 0x914db964
rol eax, 0x4f
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x33da8dd6
pushf
not eax
add eax, 0xce5a594c
xor eax, 0xeb4fca9c
rol eax, 0xe
popf
pushf
not eax
add eax, 0xbeff489f
xor eax, 0x95d476fa
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x811c4766
xor eax, 0xc711733e
rol eax, 0x84
popf
jmp 0x1402677fb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140267e7f
test rdi, rdi
je 0x140267d8a
push rax
pushf
mov eax, 0x15bd27ef
pushf
not eax
add eax, 0xcd926087
xor eax, 0xc24cbabe
rol eax, 0xce
popf
pushf
not eax
add eax, 0xc3f9afdf
xor eax, 0xf93fc897
rol eax, 0xff
popf
pushf
not eax
add eax, 0xc1bad9c3
xor eax, 0xe90c24db
rol eax, 0x64
popf
pushf
not eax
add eax, 0xd70f2949
xor eax, 0xfd24a049
rol eax, 0x7f
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x97b19517
pushf
not eax
add eax, 0x805782a7
xor eax, 0x8f357804
rol eax, 0x90
popf
pushf
not eax
add eax, 0xa14cc109
xor eax, 0xb2c57a75
rol eax, 0xf
popf
pushf
not eax
add eax, 0x94313f48
xor eax, 0x82aa6245
rol eax, 0x9c
popf
jmp 0x1402677fb
mov rcx, rdi
call fcn.1400fe169
jmp 0x140267e7f
mov rax, r12
push rax
pushf
mov eax, 0xef288ef0
pushf
not eax
add eax, 0xd1cec4b9
xor eax, 0xaaf9d38a
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xbb13a2db
xor eax, 0xd2277d64
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xad1d298b
xor eax, 0x998d820f
rol eax, 0x36
popf
jmp 0x1402677fb
lea rbx, [rdi + rax]
mov qword [rsp + 0x58], rax
mov r8, rdi
mov qword [rsp + 0x68], rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x58]
mov r9d, 0xadabba35
pushf
not r9d
add r9d, 0xeb0d4118
xor r9d, 0xd6460a3d
rol r9d, 0xf1
popf
pushf
not r9d
add r9d, 0x929745f9
xor r9d, 0x87289056
rol r9d, 0x4a
popf
mov dword [rsp + 0x28], esi
mov r8, r15
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov qword [rsp + 0x60], rbx
jmp 0x140267eed
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140267f50
push rax
pushf
mov eax, 0x1accc1d6
pushf
not eax
add eax, 0xab49f74a
xor eax, 0xe7e6002a
rol eax, 0xda
popf
pushf
not eax
add eax, 0xec25a462
xor eax, 0xdcdac64f
rol eax, 0x23
popf
pushf
not eax
add eax, 0xe0b88fb9
xor eax, 0x819501ee
rol eax, 0xef
popf
pushf
not eax
add eax, 0x90d5e315
xor eax, 0x959d9de6
rol eax, 0x69
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x6f0bc04f
pushf
not eax
add eax, 0xbf55f99f
xor eax, 0xbb9c37d3
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xe387b4fc
xor eax, 0xb3b13910
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xf58e8f95
xor eax, 0x91f25b9f
rol eax, 0x60
popf
jmp 0x1402677fb
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r12d
jmp 0x140267fc8
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14026802b
push rax
pushf
mov eax, 0xb7562082
pushf
not eax
add eax, 0xf82bbc96
xor eax, 0x9133ec21
rol eax, 0x40
popf
pushf
not eax
add eax, 0xfea43e97
xor eax, 0xb23f763d
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xe756efc8
xor eax, 0xeafd5cde
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x9cd86b8f
xor eax, 0xe6d1eadd
rol eax, 0x12
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x48db0ac0
pushf
not eax
add eax, 0xb42f0d09
xor eax, 0x831a0728
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe50e6097
xor eax, 0xe382ac14
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xc85649b8
xor eax, 0xe4b96774
rol eax, 0xe0
popf
jmp 0x1402677fb
mov rax, qword [rsp + 0x58]
mov r9d, 0xa3c9cf69
pushf
not r9d
add r9d, 0xf8e44f25
xor r9d, 0x96c11427
rol r9d, 0x8e
popf
pushf
not r9d
add r9d, 0x9810a929
xor r9d, 0xbd296832
rol r9d, 0x94
popf
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 0x5a
mov rdx, r14
mov qword [rsp + 0x20], rax
jmp 0x1402680c7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
jmp 0x1402680d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140268138
push rax
pushf
mov eax, 0x172baf69
pushf
not eax
add eax, 0xb6508a61
xor eax, 0xb783da44
rol eax, 0x72
popf
pushf
not eax
add eax, 0xfc4215ff
xor eax, 0xd1798000
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xb7784030
xor eax, 0xe0681665
rol eax, 0x47
popf
pushf
not eax
add eax, 0xf2c50a12
xor eax, 0x9236d5c6
rol eax, 0x3d
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x644c809d
pushf
not eax
add eax, 0xe09659a1
xor eax, 0xf16909c3
rol eax, 1
popf
pushf
not eax
add eax, 0xb5fdcce7
xor eax, 0x9bb12b65
rol eax, 0x90
popf
jmp 0x1402677fb
mov bl, 0xf0
pushf
not bl
add bl, 0x19
xor bl, 0xb1
rol bl, 0x9a
popf
pushf
not bl
add bl, 0x87
xor bl, 0x7c
rol bl, 0x4f
popf
pushf
not bl
add bl, 0x2e
xor bl, 0x6c
rol bl, 0x22
popf
pushf
not bl
add bl, 0x69
xor bl, 0x18
rol bl, 0x7f
popf
jmp 0x140268225
xor bl, bl
push rax
pushf
mov eax, 0xfaf6980d
pushf
not eax
add eax, 0x80739042
xor eax, 0xeb9cdb7b
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x8c430f32
xor eax, 0xa7045f12
rol eax, 0xab
popf
pushf
not eax
add eax, 0x955ea8b5
xor eax, 0x8cf991f4
rol eax, 0xf7
popf
jmp 0x1402677fb
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140268287
push rax
pushf
mov eax, 0xed52b414
pushf
not eax
add eax, 0x90bdd699
xor eax, 0xb5a97f46
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xf79543d2
xor eax, 0xa0e6d5d2
rol eax, 0x15
popf
pushf
not eax
add eax, 0x8fd08f10
xor eax, 0x99dd85ce
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xab91af80
xor eax, 0xccdb1eec
rol eax, 1
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x1a58d62a
pushf
not eax
add eax, 0xb12f309e
xor eax, 0xce379605
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xaef83108
xor eax, 0xfca922a4
rol eax, 0x2d
popf
jmp 0x1402677fb
mov rdx, qword [rsp + 0x68]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x14026831a
push rax
pushf
mov eax, 0x7a01f2d
pushf
not eax
add eax, 0xc8d04787
xor eax, 0x85736a99
rol eax, 0x98
popf
pushf
not eax
add eax, 0xc6ef5062
xor eax, 0xa63233f3
rol eax, 0x93
popf
pushf
not eax
add eax, 0x8f060e06
xor eax, 0x97a1093d
rol eax, 0xc4
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0xd47b8735
pushf
not eax
add eax, 0xdea369dc
xor eax, 0xb3059a26
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x8aaab11a
xor eax, 0xece705b9
rol eax, 0xd
popf
pushf
not eax
add eax, 0xc92fc2e5
xor eax, 0xf61234c4
rol eax, 0xbc
popf
jmp 0x1402677fb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1402683ce
push rax
pushf
mov eax, 0x779ae9b1
pushf
not eax
add eax, 0xfdaa7f08
xor eax, 0x8d82808c
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xba783659
xor eax, 0xbd9f746f
rol eax, 0x57
popf
pushf
not eax
add eax, 0xf90bc165
xor eax, 0xc74d7d4c
rol eax, 0xce
popf
pushf
not eax
add eax, 0xce851640
xor eax, 0x9c0166f8
rol eax, 0x82
popf
jmp 0x1402677fb
push rax
pushf
mov eax, 0x2d41d04b
pushf
not eax
add eax, 0x91e3ece6
xor eax, 0xcc2e8559
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x8b73417e
xor eax, 0xc19f86c2
rol eax, 0x37
popf
pushf
not eax
add eax, 0xa836e07c
xor eax, 0xee460524
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xde9a2b5c
xor eax, 0xd23c1439
rol eax, 4
popf
jmp 0x1402677fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140199402
push rax
pushf
mov eax, 0x6f88a143
pushf
not eax
add eax, 0xd4d1e865
xor eax, 0xd871104f
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xf3483803
xor eax, 0xcf1c80a4
rol eax, 0xa5
popf
jmp 0x1402677fb
mov rdi, qword [rsp + 0x80]
movzx eax, bl
mov rbx, qword [rsp + 0x88]
push rax
pushf
mov eax, 0xeb5b5d77
pushf
not eax
add eax, 0xef7cbc36
xor eax, 0x8a1d7284
rol eax, 0x77
popf
pushf
not eax
add eax, 0xf68be309
xor eax, 0xd944c4f7
rol eax, 0xa2
popf
jmp 0x1402677fb
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14020dea3
add rsp, 0x90
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.140123ba6
int3
call fcn.1400fca5b
int3