Function at 0x140026cd0
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rdx
xor r13d, r13d
mov dword [rbp - 0x29], r13d
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov r8, rdx
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0xf]
call fcn.14001b460
nop
call fcn.140024040
mov rsi, rax
lea r15, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae r15, qword [rbp + 0xf]
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], r13b
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x49]
call fcn.140006a18
nop
call fcn.140046300
lea r14, [rsi + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
mov ecx, r13d
movabs r12, 0x100000001b3
mov r8, qword [rbp - 0x39]
test r8, r8
je 0x140026db4
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r12
inc rcx
cmp rcx, r8
jb 0x140026da1
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x21]
mov rcx, rsi
call fcn.140025670
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140026dd3
mov rax, qword [rsi + 8]
jmp 0x140026dda
mov rcx, qword [rsi + 8]
mov rax, rcx
cmp rcx, rax
je 0x140026dfc
mov rsi, qword [rcx + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x140026e06
mov rdx, r15
lea rcx, [rbp - 1]
call rsi
jmp 0x140026e06
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140026e41
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027110
call fcn.14006a794
call fcn.140024040
mov rsi, rax
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], 0
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x49]
call fcn.140006a18
nop
call fcn.140046300
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov rcx, r13
mov r8, qword [rbp - 0x39]
test r8, r8
je 0x140026eb3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r12
inc rcx
cmp rcx, r8
jb 0x140026ea0
mov r9, rbx
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x21]
mov rcx, rsi
call fcn.140025670
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140026ed5
mov rax, qword [rsi + 8]
jmp 0x140026edc
mov rcx, qword [rsi + 8]
mov rax, rcx
cmp rcx, rax
je 0x140026efe
mov rbx, qword [rcx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140026f08
lea rcx, [rbp - 1]
call rbx
mov esi, eax
jmp 0x140026f0d
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0xc0000138
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140026f49
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026f43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027116
call fcn.14006a794
nop
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r13w
mov dword [rbp - 0x29], 2
mov rax, qword [rdi + 0x10]
add rax, 0x22
cmp rax, 8
jb 0x140027012
movabs rbx, 0x7ffffffffffffffe
cmp rax, rbx
ja 0x14002711c
or rax, 7
cmp rax, rbx
ja 0x140026f9e
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002712e
add rcx, rcx
cmp rcx, 0x1000
jb 0x140026fed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002712e
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x140027122
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140026fff
test rcx, rcx
je 0x140026ffc
call fcn.14006a79c
mov rcx, rax
jmp 0x140026fff
mov rcx, r13
mov qword [rbp - 9], rbx
movzx eax, word [rbp - 0x21]
mov word [rcx], ax
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x11], r13
mov r8d, 0x22
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x21]
call fcn.1400094c0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140027036
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x21]
call fcn.1400094c0
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14002709f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027128
call fcn.14006a794
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x1400270db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400270d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002710a
call fcn.14006a794
mov eax, esi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14006a770
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400094ac
int3
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400011a0
int3