Function at 0x140002380
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140021f60]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x48]
mov byte [rbp - 0x50], cl
lea rdx, str.SystemWPAPnP
mov r9d, GetProcAddress
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x4c]
lea rdx, str.seed
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x4c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140002402
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x28]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, 0x80090016
jne 0x140002443
lea rcx, [rbp - 0x28]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
movzx eax, byte [rbp - 0x50]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x40], 0
lea r8d, [r9 + 4]
mov byte [rbp - 0x3f], al
mov word [rbp - 0x3e], 0
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 0x4c]
lea r8, [rbp - 0x20]
mov edx, 2
mov dword [rbp - 0x4c], 0x10
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400024d1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400024e2
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rbp - 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetup
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x20]
lea rdx, str.PrivateHash
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov dword [rbp - 0x4c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140002549
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x48]
lea rdx, str.SoftwareMicrosoftDriver_Signing
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
lea rdx, str.Policy
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov dword [rbp - 0x4c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400025b0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x48]
lea rdx, str.SoftwareMicrosoftDriver_Signing
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
lea rdx, str.Policy
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov dword [rbp - 0x4c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140002617
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007230
add rsp, 0x80
pop rbp
ret