Function at 0x140041f70
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce8]
sub rsp, 0xde8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
xor r13d, r13d
mov edi, r13d
mov qword [rbp - 0x50], r13
lea rdx, [rbp - 0x20]
call fcn.1400418b0
nop
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rsi]
mov r12, qword [rbp - 0x58]
cmp rbx, rsi
je 0x140042001
nop dword [rax]
lea r8, [rbx + 0x10]
cmp r12, rdi
je 0x140041fde
mov rdx, r8
mov rcx, r12
call fcn.140043060
add r12, 0x20
mov qword [rbp - 0x58], r12
jmp 0x140041ff2
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.140044320
mov rdi, qword [rbp - 0x50]
mov r12, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
jne 0x140041fc0
mov rsi, qword [rbp - 0x18]
mov ecx, r13d
mov r15, qword [rbp - 0x60]
mov rax, r15
cmp r15, r12
je 0x14004201b
inc ecx
add rax, 0x20
cmp rax, r12
jne 0x140042010
lea eax, [rcx + 1]
cmp eax, 1
jle 0x140042700
sub r12, r15
sar r12, 5
test r12, r12
je 0x140042727
movabs r9, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
mov rdi, qword [r15 + 0x10]
mov r8, r15
mov r14, qword [r15 + 0x18]
cmp r14, 0xf
jbe 0x14004205f
mov r8, qword [r15]
mov rdx, rcx
mov rcx, r13
test rdi, rdi
je 0x140042084
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x140042070
mov rcx, qword [rbp + 0x10]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp - 8]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rsi
je 0x1400426f2
mov rsi, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400420c2
mov rdx, qword [rdx]
mov rcx, r15
cmp r14, 0xf
jbe 0x1400420ce
mov rcx, qword [r15]
cmp rdi, rax
jne 0x1400420df
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400420ee
cmp rbx, rsi
je 0x1400426f2
mov rbx, qword [rbx + 8]
jmp 0x1400420b0
test rbx, rbx
je 0x1400426f2
lea rdx, [rbx + 0x30]
lea rcx, str.___Old_MAC:__s_n
cmp qword [rdx + 0x18], 0xf
jbe 0x140042113
mov rdx, qword [rdx]
call fcn.140041170
jmp 0x140042121
call fcn.140041170
test r12, r12
je 0x140042727
mov rcx, r15
mov r8, qword [r15 + 0x18]
cmp r8, 0xf
jbe 0x140042131
mov rcx, qword [r15]
mov r9, qword [r15 + 0x10]
add r9, rcx
test r12, r12
je 0x140042727
mov rdx, r15
cmp r8, 0xf
jbe 0x14004214d
mov rdx, qword [r15]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor esi, esi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
cmp rdx, r9
jne 0x140042176
mov qword [rbp - 0x38], rsi
mov ebx, 7
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x48], si
jmp 0x140042186
sub r9, rdx
lea rcx, [rbp - 0x48]
call fcn.1400441c0
mov rbx, qword [rbp - 0x30]
lea r13, [rbp - 0x48]
mov rdi, qword [rbp - 0x48]
mov qword [rbp - 0x28], rdi
cmp rbx, 7
cmova r13, rdi
mov qword [rbp + 0xd40], rsi
lea rax, [rbp + 0xd40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140042693
mov r14d, esi
mov dword [rbp + 0xd30], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xd30]
lea r8, [rbp + 0x4e0]
xor edx, edx
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140042685
nop dword [rax + rax]
mov qword [rbp + 0xd48], rsi
lea rax, [rbp + 0xd48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x4e0]
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140042636
mov dword [rbp + 0xd38], 0x400
lea rax, [rbp + 0xd38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140042629
lea rax, [rbp + 0x20]
mov r8, r13
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400422b7
add rax, 2
test ecx, ecx
jne 0x1400422a3
test edx, edx
jne 0x140042629
lea rdx, [rsp + 0x40]
call fcn.1400411f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
cmova rsi, r9
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140042733
cmp rdi, 0xf
ja 0x14004232c
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
jmp 0x1400423cf
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x14004234b
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140042372
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140042394
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004272d
mov rcx, rax
call fcn.140139918
mov rcx, rax
test rax, rax
je 0x1400426dd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400423a2
test rcx, rcx
je 0x1400423a0
call fcn.140139918
jmp 0x1400423a2
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
lea rsi, [rsp + 0x40]
cmp rdx, 0xf
seta cl
cmova rsi, r9
add rsi, rdi
lea rax, [rsp + 0x40]
test cl, cl
je 0x1400423f1
lea rbx, [rdi + r9]
jmp 0x1400423fa
lea rbx, [rdi + rax]
lea r9, [rsp + 0x40]
mov r8b, reloc.WLDAP32.dll_Ordinal_45
mov rdx, rbx
mov rcx, r9
call fcn.140138df0
mov r10, rax
cmp rax, rbx
je 0x14004242e
inc rax
cmp rax, rbx
je 0x14004242e
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x140042426
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x140042418
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
seta r8b
cmova rcx, qword [rsp + 0x40]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rbx, qword [rsp + 0x50]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x40]
test r8b, r8b
cmovne rcx, qword [rsp + 0x40]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
seta r8b
cmova r9, qword [rsp + 0x40]
add r9, rbx
lea rdx, [rsp + 0x40]
test r8b, r8b
cmovne rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor esi, esi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea rcx, [rbp - 0x80]
cmp rdx, r9
jne 0x1400424d7
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
jmp 0x1400424ed
sub r9, rdx
call fcn.1400441c0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], si
jne 0x1400424f4
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NetworkAddress
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14004254c
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, str.___New_MAC:__s_n
call fcn.140041170
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14004258c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042587
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400426d6
call fcn.140139b94
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400425d9
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400425d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400426dd
call fcn.140139b94
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140042629
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400426e4
call fcn.140139b94
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0xd30], 0x400
inc r14d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0xd30]
lea r8, [rbp + 0x4e0]
mov edx, r14d
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140042220
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rbx, 7
jbe 0x1400426ca
lea rdx, [rbx*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400426c2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400426eb
mov rcx, rdi
call fcn.140139b94
mov rsi, qword [rbp - 0x18]
xor r13d, r13d
jmp 0x140042037
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
lea rcx, [rbp - 0x20]
call fcn.140041eb0
nop
lea rcx, [rbp - 0x60]
call fcn.140042740
add rsp, 0xde8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400432f0
nop
call fcn.140004490
int3
call fcn.14002e060
int3