Function at 0x140002180
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd20]
sub rsp, 0xe20
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0xd10], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov esi, r15d
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x70], r15
lea rdx, [rbp - 0x70]
call fcn.140001910
nop
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rdi]
mov r13, qword [rsp + 0x68]
cmp rbx, rdi
je 0x140002235
nop dword [rax + rax]
lea r8, [rbx + 0x10]
cmp r13, rsi
je 0x14000220f
mov rdx, r8
mov rcx, r13
call fcn.1400035b0
add r13, 0x20
mov qword [rsp + 0x68], r13
jmp 0x140002226
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.140004860
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x1400021f0
mov qword [rbp - 0x80], rsi
mov r14, qword [rsp + 0x60]
mov rbx, r14
cmp r14, r13
je 0x140002a2e
mov rcx, r15
mov rdx, r13
sub rdx, rbx
sar rdx, 5
mov qword [rbp - 0x78], rdx
movabs r12, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
mov rax, rcx
inc rcx
mov qword [rsp + 0x78], rcx
cmp rdx, rax
jbe 0x140002ac1
shl rax, 5
lea rsi, [rax + r14]
lea rdx, str.___Adapter:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c60
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400022a7
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.140004540
mov rcx, rax
lea rdx, [0x140003e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400022d0
mov r9, qword [rsi]
mov rdx, r12
mov r8, qword [rsi + 0x10]
mov rcx, r15
test r8, r8
je 0x1400022f4
nop
movzx eax, byte [r9 + rcx]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, r8
jb 0x1400022e0
mov rcx, qword [rbp - 0x40]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp - 0x58]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [rbp - 0x68]
je 0x140002a7b
mov r15, qword [rax + rcx*8]
mov r12, qword [rsi + 0x18]
mov r14, r8
nop dword [rax]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0xf
jbe 0x14000232f
mov rdx, qword [rdi + 0x10]
mov rcx, rsi
cmp r12, 0xf
jbe 0x14000233b
mov rcx, qword [rsi]
cmp r14, qword [rdi + 0x20]
jne 0x14000234d
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000235c
cmp rdi, r15
je 0x140002a7b
mov rdi, qword [rdi + 8]
jmp 0x140002320
test rdi, rdi
je 0x140002a7b
lea rdx, str.___Old_MAC:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c60
lea rdx, [rdi + 0x30]
cmp qword [rdi + 0x48], 0xf
jbe 0x140002387
mov rdx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x40]
mov rcx, rax
call fcn.140004540
mov rcx, rax
lea rdx, [0x140003e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsp + 0x78]
lea r8, [rdx - 1]
shl r8, 5
mov r14, qword [rsp + 0x60]
add r8, r14
cmp qword [r8 + 0x18], 0xf
jbe 0x1400023d4
mov r9, qword [r8]
lea rax, [rdx - 1]
shl rax, 5
mov rdx, qword [rax + r14]
add r9, qword [r8 + 0x10]
jmp 0x1400023e5
mov r9, qword [r8 + 0x10]
add r9, r8
dec rdx
shl rdx, 5
add rdx, r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor r12d, r12d
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
cmp rdx, r9
jne 0x140002410
mov qword [rbp + 0x40], r12
mov esi, 7
mov qword [rbp + 0x48], rsi
mov word [rbp + 0x30], r12w
jmp 0x140002420
sub r9, rdx
lea rcx, [rbp + 0x30]
call fcn.140004700
mov rsi, qword [rbp + 0x48]
lea r15, [rbp + 0x30]
mov rdi, qword [rbp + 0x30]
cmp rsi, 7
cmova r15, rdi
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400029cb
mov dword [rsp + 0x40], 0x400
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x510]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000292e
xor edi, edi
nop word [rax + rax]
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x510]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400028e0
mov dword [rsp + 0x58], 0x400
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400028d5
lea rax, [rbp + 0x50]
mov r8, r15
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002544
add rax, 2
test ecx, ecx
jne 0x140002530
test edx, edx
jne 0x1400028d5
lea rdx, [rbp - 0x30]
call fcn.140001290
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
lea r14, [rbp - 0x30]
mov r9, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
cmova r14, r9
mov rsi, qword [rbp - 0x20]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140002acd
cmp rsi, 0xf
ja 0x1400025af
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x10], xmm0
jmp 0x14000264c
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1400025ce
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400025f5
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002617
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ac7
mov rcx, rax
call fcn.140004c90
mov rcx, rax
test rax, rax
je 0x1400029bd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002625
test rcx, rcx
je 0x140002623
call fcn.140004c90
jmp 0x140002625
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x20]
mov r9, qword [rbp - 0x30]
lea r14, [rbp - 0x30]
cmp rdx, 0xf
seta cl
cmova r14, r9
add r14, rsi
lea rax, [rbp - 0x30]
test cl, cl
je 0x14000266c
lea rdi, [rsi + r9]
jmp 0x140002674
lea rdi, [rsi + rax]
lea r9, [rbp - 0x30]
mov r8b, 0x2d
mov rdx, rdi
mov rcx, r9
call fcn.140004b60
mov r10, rax
cmp rax, rdi
je 0x1400026a8
inc rax
cmp rax, rdi
je 0x1400026a8
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x1400026a0
mov byte [r10], cl
inc r10
inc rax
cmp rax, rdi
jne 0x140002692
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
seta r8b
cmova rcx, qword [rbp - 0x30]
mov r9, r10
sub r9, rcx
sub r14, r10
mov rdi, qword [rbp - 0x20]
mov rax, rdi
sub rax, r9
cmp rax, r14
cmovb r14, rax
lea rcx, [rbp - 0x30]
test r8b, r8b
cmovne rcx, qword [rbp - 0x30]
add rcx, r9
sub rdi, r14
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + r14]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x20], rdi
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
seta r8b
cmova r9, qword [rbp - 0x30]
add r9, rdi
lea rdx, [rbp - 0x30]
test r8b, r8b
cmovne rdx, qword [rbp - 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor edi, edi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
cmp rdx, r9
jne 0x140002746
mov qword [rbp + 0x20], rdi
mov eax, 7
mov qword [rbp + 0x28], rax
mov word [rbp + 0x10], di
jmp 0x140002756
sub r9, rdx
lea rcx, [rbp + 0x10]
call fcn.140004700
mov rax, qword [rbp + 0x28]
lea rcx, [rbp + 0x10]
cmp rax, 7
cmova rcx, qword [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140002770
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NetworkAddress
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400027ff
lea rdx, str.___New_MAC:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c60
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
mov rcx, rax
call fcn.140004540
mov rcx, rax
lea rdx, [0x140003e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, r15
xor edx, edx
call fcn.140002ae0
mov r8, r15
mov edx, 1
call fcn.140002ae0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000283f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000283a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400029b6
call fcn.140004ccc
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000288a
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002885
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400029bd
call fcn.140004ccc
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400028d5
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400029c4
call fcn.140004ccc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], 0x400
inc r12d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x510]
mov edx, r12d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400024b0
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140006588]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c60
mov rcx, rax
lea rdx, [0x140003e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp rsi, 7
jbe 0x140002998
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002990
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a1e
mov rcx, rdi
call fcn.140004ccc
add rbx, 0x20
cmp rbx, r13
je 0x140002a2e
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor r15d, r15d
jmp 0x140002257
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.____Cannot_Access_Registry...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003c60
mov rcx, rax
lea rdx, [0x140003e30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp rsi, 7
jbe 0x140002a2e
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002a25
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140004ccc
nop
lea rcx, [rbp - 0x70]
call fcn.1400020c0
nop
test r14, r14
je 0x140002a91
mov rdx, r13
mov rcx, r14
call fcn.1400041d0
mov rdx, qword [rbp - 0x80]
sub rdx, r14
and rdx, 0xffffffffffffffe0
mov rax, r14
cmp rdx, 0x1000
jb 0x140002a89
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
mov rcx, r14
call fcn.140004ccc
mov rcx, qword [rbp + 0xd10]
xor rcx, rsp
call fcn.140004c70
lea r11, [rsp + 0xe20]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003820
nop
call fcn.1400011b0
int3
call fcn.140001250
int3