Function at 0x140026ab0
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1400f0020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov rcx, qword [rdx + 0x10]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
sub rax, rcx
cmp rax, 0x34
jb 0x140026e57
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140026b17
mov rax, qword [rdx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rbp + 7]
call fcn.14001ba4c
nop
call fcn.140023e20
mov r15, rax
lea r13, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r13, qword [rbp + 7]
xor ebx, ebx
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], bl
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x39]
call fcn.1400069f0
nop
call fcn.140045d40
lea r12, [r15 + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rdx, qword [rbp - 0x39]
movabs rdi, 0xcbf29ce484222325
mov r9, rdi
mov ecx, ebx
movabs r10, 0x100000001b3
mov r8, qword [rbp - 0x29]
test r8, r8
je 0x140026bd3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140026bc0
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
mov rcx, r15
call fcn.140025420
mov r8, qword [rax + 8]
test r8, r8
je 0x140026c10
cmp r8, qword [r15 + 8]
je 0x140026c10
mov r15, qword [r8 + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15, r15
je 0x140026c1a
mov rdx, r13
lea rcx, [rbp - 9]
call r15
jmp 0x140026c1a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140026c55
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026c50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e5d
call fcn.14006a754
call fcn.140023e20
mov r13, rax
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x39]
call fcn.1400069f0
nop
call fcn.140045d40
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rcx, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x140026cc3
movabs r8, 0x100000001b3
nop
movzx eax, byte [rbx + rcx]
xor rdi, rax
imul rdi, r8
inc rbx
cmp rbx, rdx
jb 0x140026cb0
mov r9, rdi
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
mov rcx, r13
call fcn.140025420
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140026d02
cmp rdx, qword [r13 + 8]
je 0x140026d02
mov rbx, qword [rdx + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140026d0c
lea rcx, [rbp - 9]
call rbx
mov ebx, eax
jmp 0x140026d11
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140026d4c
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026d47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e63
call fcn.14006a754
mov rax, qword [rsi + 0x10]
sub r14, rax
cmp r14, 0x22
jb 0x140026e69
cmp qword [rsi + 0x18], 8
jb 0x140026d67
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x39]
call fcn.14001ba4c
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x140026de6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026de0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e6f
call fcn.14006a754
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140026e22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e51
call fcn.14006a754
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14006a730
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140097d64
int3
call fcn.140001300
nop
call fcn.140097d64
nop
call fcn.140097d64
int3
call fcn.140001300
int3
call fcn.140097d64
int3