Function at 0x1400292f0
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140093020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x69], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov r8, rdx
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rbp + 7]
call fcn.1400063d0
nop
call fcn.140012290
mov r13, rax
lea rcx, [rbp + 7]
call fcn.140002c00
mov r12, rax
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x41]
call fcn.140003040
nop
call fcn.14002b010
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp - 0x41]
call fcn.140002bf0
mov rsi, rax
lea rcx, [rbp - 0x41]
call fcn.140002ee0
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov edx, edi
movabs r8, 0x100000001b3
test rsi, rsi
je 0x1400293c3
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor r9, rcx
imul r9, r8
inc rdx
cmp rdx, rsi
jb 0x1400293b0
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x19]
mov rcx, r13
call fcn.140012ae0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400293e0
mov rcx, qword [r13 + 8]
mov qword [rbp - 0x21], rcx
lea rdx, [r13 + 8]
lea rcx, [rbp - 0x21]
call fcn.140001650
mov rax, qword [r13 + 8]
mov qword [rbp - 0x19], rax
lea rdx, [r13 + 8]
lea rcx, [rbp - 0x19]
call fcn.140001650
mov rax, qword [rbp - 0x21]
lea rcx, [r13 + 0x40]
cmp rax, qword [rbp - 0x19]
je 0x14002942e
mov rsi, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x140029435
mov rdx, r12
lea rcx, [rbp - 9]
call rsi
jmp 0x140029435
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x41]
call fcn.140002f90
call fcn.140012290
mov r13, rax
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x61]
call fcn.140003040
nop
call fcn.14002b010
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp - 0x61]
call fcn.140002bf0
mov rsi, rax
lea rcx, [rbp - 0x61]
call fcn.140002ee0
test rsi, rsi
je 0x1400294a3
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rax + rdi]
xor rbx, rcx
imul rbx, rdx
inc rdi
cmp rdi, rsi
jb 0x140029490
mov r9, rbx
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x41]
mov rcx, r13
call fcn.140012ae0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400294c3
mov rcx, qword [r13 + 8]
mov qword [rbp - 0x19], rcx
lea rdx, [r13 + 8]
lea rcx, [rbp - 0x19]
call fcn.140001650
mov rax, qword [r13 + 8]
mov qword [rbp - 0x21], rax
lea rdx, [r13 + 8]
lea rcx, [rbp - 0x21]
call fcn.140001650
mov rax, qword [rbp - 0x19]
lea rcx, [r13 + 0x40]
cmp rax, qword [rbp - 0x21]
je 0x140029510
mov rbx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140029516
lea rcx, [rbp - 9]
call rbx
mov ebx, eax
jmp 0x14002951b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rbp - 0x61]
call fcn.140002f90
mov r8, qword [rbp - 0x69]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x61]
call fcn.1400063d0
mov rcx, rax
call fcn.140002c00
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, [rbp - 0x61]
call fcn.140002d40
nop
lea rcx, [rbp + 7]
call fcn.140002d40
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400433a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret