Function at 0x14004fa30
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x988]
sub rsp, 0xa60
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1401ba200]
xor rax, rsp
mov qword [rbp + 0x930], rax
xorps xmm0, xmm0
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], rax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
lea rdx, [rbp + 0x20]
call fcn.14004f410
nop
mov rdi, qword [rbp + 0x28]
mov rbx, qword [rdi]
mov rcx, qword [rbp - 0x78]
cmp rbx, rdi
je 0x14004faeb
nop word [rax + rax]
lea r8, [rbx + 0x10]
cmp rcx, qword [rbp - 0x70]
je 0x14004fad0
mov rdx, r8
call fcn.140004b70
mov rcx, qword [rbp - 0x78]
add rcx, 0x20
mov qword [rbp - 0x78], rcx
jmp 0x14004fae0
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.140054e90
mov rcx, qword [rbp - 0x78]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x14004fab0
xor edx, edx
mov rax, qword [rbp - 0x80]
cmp rax, rcx
je 0x14004fb0b
nop word [rax + rax]
inc edx
add rax, 0x20
cmp rax, rcx
jne 0x14004fb00
lea eax, [rdx + 1]
cdqe
mov qword [rsp + 0x50], rax
cmp rax, 1
jle 0x140050154
mov qword [rsp + 0x48], 1
movabs rax, 0xb725fcdb2f623b5
mov qword [rbp + 0x60], rax
movabs rax, 0x641c21a4cbbd9236
mov qword [rbp + 0x68], rax
movabs rax, 0x2b16338292ab08ee
mov qword [rsp + 0x68], rax
movabs rax, 0x641c2184f1fed37b
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor r13d, r13d
movdqa xmm6, xmmword [rbp + 0x60]
movdqu xmm7, xmmword [rsp + 0x68]
movabs r14, 0x100000001b3
movdqa xmm0, xmm6
xorps xmm0, xmm7
movdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [0x140398630]
call fcn.1400531d0
mov r12, rax
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
sub rcx, rdx
sar rcx, 5
cmp rcx, rbx
jbe 0x1400501f3
lea rsi, [rdx + r13]
mov rdi, qword [rsi + 0x10]
mov r8, rsi
mov r15, qword [rsi + 0x18]
cmp r15, 0xf
jbe 0x14004fbd0
mov r8, qword [rsi]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test rdi, rdi
je 0x14004fbf5
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r14
inc rcx
cmp rcx, rdi
jb 0x14004fbe1
mov rcx, qword [rbp + 0x50]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x38]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [rbp + 0x28]
je 0x140050217
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14004fc32
mov rdx, qword [rdx]
mov rcx, rsi
cmp r15, 0xf
jbe 0x14004fc3e
mov rcx, qword [rsi]
cmp rdi, rax
jne 0x14004fc4f
mov r8, rdi
call fcn.1400f1290
test eax, eax
je 0x14004fc5e
cmp rbx, r14
je 0x140050217
mov rbx, qword [rbx + 8]
jmp 0x14004fc20
test rbx, rbx
je 0x140050217
lea rdx, [rbx + 0x30]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14004fc79
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140054be0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rcx]
call qword [rdx + htons]
nop
lea rcx, [rsp + 0x58]
call fcn.140053090
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx edi, al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004fce2
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rax, rax
je 0x14004fce2
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
movzx edx, dil
mov rcx, rbx
call fcn.140054700
mov rcx, rbx
call fcn.140052ca0
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
sub rax, rcx
sar rax, 5
mov rbx, qword [rsp + 0x40]
cmp rax, rbx
jbe 0x140050211
lea rdx, [rcx + r13]
cmp qword [rdx + 0x18], 0xf
jbe 0x14004fd2a
mov r8, qword [rdx]
mov r9, r8
add r8, qword [rdx + 0x10]
jmp 0x14004fd34
mov r8, qword [rdx + 0x10]
add r8, rdx
mov r9, rdx
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
cmp r9, r8
jne 0x14004fd5e
mov qword [rbp + 0x10], r12
mov eax, recv
mov qword [rbp + 0x18], rax
mov byte [rbp], r12b
jmp 0x14004fd71
sub r8, r9
mov rdx, r9
lea rcx, [rbp]
call fcn.140003aa0
mov rax, qword [rbp + 0x18]
lea r15, [rbp]
cmp rax, 0xf
cmova r15, qword [rbp]
mov qword [rsp + 0x68], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140050127
mov r14d, r12d
mov dword [rsp + 0x78], 0x400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
lea r8, [rbp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14005011c
nop
mov qword [rbp + 0x60], r12
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400500d9
mov dword [rbp - 0x48], 0x400
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x470]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400500cf
mov rdx, r15
lea rcx, [rbp + 0x470]
call fcn.1400d0448
test eax, eax
jne 0x1400500cf
lea rdx, [rbp - 0x68]
call fcn.14004ed60
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov rbx, qword [rbp - 0x58]
lea rsi, [rbp - 0x68]
mov r9, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
cmova rsi, r9
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14005020b
mov qword [rbp - 8], recv
cmp rbx, 0xf
ja 0x14004fed1
mov qword [rbp - 0x10], rbx
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x20], xmm0
jmp 0x14004ff6f
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x14004fef0
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14004ff17
cmp rdi, 0x16
mov eax, socket
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14004ff39
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140050205
mov rcx, rax
call fcn.1400b4970
mov rcx, rax
test rax, rax
je 0x1400501ff
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004ff48
test rcx, rcx
je 0x14004ff45
call fcn.1400b4970
jmp 0x14004ff48
mov rax, r12
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rdi
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1400f0850
mov rdx, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
mov r9, qword [rbp - 0x68]
lea rdi, [rbp - 0x68]
cmp rdx, 0xf
seta cl
cmova rdi, r9
add rdi, rbx
lea rax, [rbp - 0x68]
test cl, cl
je 0x14004ff8e
add rbx, r9
jmp 0x14004ff95
add rbx, rax
lea r9, [rbp - 0x68]
mov r8b, 0x2d
mov rdx, rbx
mov rcx, r9
call fcn.1400b2ae0
mov r10, rax
cmp rax, rbx
je 0x14004ffc9
inc rax
cmp rax, rbx
je 0x14004ffc9
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x14004ffc1
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x14004ffb3
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
seta r8b
cmova rcx, qword [rbp - 0x68]
mov r9, r10
sub r9, rcx
sub rdi, r10
mov rbx, qword [rbp - 0x58]
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
lea rcx, [rbp - 0x68]
test r8b, r8b
cmovne rcx, qword [rbp - 0x68]
add rcx, r9
sub rbx, rdi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call fcn.1400f0850
mov qword [rbp - 0x58], rbx
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
seta r8b
cmova rax, qword [rbp - 0x68]
add rax, rbx
lea rdx, [rbp - 0x68]
test r8b, r8b
cmovne rdx, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
lea rcx, [rbp - 0x40]
cmp rdx, rax
jne 0x140050064
mov qword [rbp - 0x28], recv
mov byte [rbp - 0x40], 0
jmp 0x14005007d
sub rax, rdx
mov r8, rax
call fcn.140003aa0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140050084
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NetworkAddress
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp - 0x40]
call fcn.140005280
nop
lea rcx, [rbp - 0x20]
call fcn.140005280
nop
lea rcx, [rbp - 0x68]
call fcn.140005280
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x78], 0x400
inc r14d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
lea r8, [rbp + 0x70]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14004fdf0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x48]
inc rdi
mov qword [rsp + 0x48], rdi
inc rbx
mov qword [rsp + 0x40], rbx
add r13, 0x20
lea rcx, [rbp]
call fcn.140005280
cmp rdi, qword [rsp + 0x50]
jl 0x14004fb77
lea rcx, [rbp + 0x20]
call fcn.14004f9a0
nop
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x1400501b9
mov rdi, qword [rbp - 0x78]
cmp rbx, rdi
je 0x140050185
mov rcx, rbx
call fcn.140005280
add rbx, 0x20
cmp rbx, rdi
jne 0x140050170
mov rbx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400501b1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400501f9
mov rcx, rbx
call fcn.1400b4bec
mov rcx, qword [rbp + 0x930]
xor rcx, rsp
call fcn.1400b4820
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140052180
nop
call fcn.1400c434c
nop
call fcn.1400c434c
int3
call fcn.140001770
int3
call fcn.140001830
nop
call fcn.140052180
int3
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1400b287c
int3