Function at 0x14000d270
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov ecx, 0x37
mov dword [rsp + 0x60], 0x6b0037
mov dword [rsp + 0x64], 0x520045
mov dword [rsp + 0x68], 0x5e0050
mov dword [rsp + 0x6c], 0x430044
mov dword [rsp + 0x70], 0x4e0045
mov dword [rsp + 0x74], 0x5a006b
mov dword [rsp + 0x78], 0x540056
mov dword [rsp + 0x7c], 0x5e005f
mov dword [rbp - 0x80], 0x520059
mov dword [rbp - 0x7c], 0x64006b
mov dword [rbp - 0x78], 0x64006e
mov dword [rbp - 0x74], 0x720063
mov dword [rbp - 0x70], 0x6b007a
mov dword [rbp - 0x6c], 0x420074
mov dword [rbp - 0x68], 0x450045
mov dword [rbp - 0x64], 0x590052
mov dword [rbp - 0x60], 0x740043
mov dword [rbp - 0x5c], 0x590058
mov dword [rbp - 0x58], 0x450043
mov dword [rbp - 0x54], 0x5b0058
mov dword [rbp - 0x50], 0x520064
mov dword [rbp - 0x4c], 0x6b0043
mov dword [rbp - 0x48], 0x520064
mov dword [rbp - 0x44], 0x410045
mov dword [rbp - 0x40], 0x54005e
mov dword [rbp - 0x3c], 0x440052
mov dword [rbp - 0x38], 0x37006b
movzx eax, word [0x14005dcda]
xor ax, cx
mov word [rbp - 0x34], ax
movzx eax, word [0x14005dcdc]
xor ax, cx
mov word [rbp - 0x32], ax
movzx eax, word [0x14005dcde]
xor ax, cx
mov word [rbp - 0x30], ax
movzx eax, word [0x14005dce0]
xor ax, cx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14005dce2]
xor ax, cx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14005dce4]
xor ax, cx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14005dce6]
xor ax, cx
mov word [rbp - 0x28], ax
movzx eax, word [0x14005dce8]
xor ax, cx
mov word [rbp - 0x26], ax
movzx eax, word [0x14005dcea]
xor ax, cx
mov word [rbp - 0x24], ax
movzx eax, word [0x14005dcec]
xor ax, cx
mov word [rbp - 0x22], ax
movzx eax, word [0x14005dcee]
xor ax, cx
mov word [rbp - 0x20], ax
movzx eax, word [0x14005dcf0]
xor ax, cx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14005dcf2]
xor ax, cx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14005dcf4]
xor ax, cx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14005dcf6]
xor ax, cx
mov word [rbp - 0x18], ax
movzx eax, word [str.NtLoadDriver]
xor ax, cx
mov word [rbp - 0x16], ax
movzx eax, word [0x14005dcfa]
xor ax, cx
mov word [rbp - 0x14], ax
movzx eax, word [0x14005dcfc]
xor ax, cx
mov word [rbp - 0x12], ax
movzx eax, word [0x14005dcfe]
xor ax, cx
mov word [rbp - 0x10], ax
movzx eax, word [0x14005dd00]
xor ax, cx
mov word [rbp - 0xe], ax
movzx eax, word [0x14005dd02]
xor ax, cx
mov word [rbp - 0xc], ax
movzx eax, word [0x14005dd04]
xor ax, cx
mov word [rbp - 0xa], ax
movzx eax, word [0x14005dd06]
xor ax, cx
mov word [rbp - 8], ax
movzx eax, word [str.NtUnloadDriver]
xor ax, cx
mov word [rbp - 6], ax
movzx eax, word [0x14005dd0a]
xor ax, cx
mov word [rbp - 4], ax
movzx eax, word [0x14005dd0c]
xor ax, cx
mov word [rbp - 2], ax
movzx eax, word [0x14005dd0e]
xor ax, cx
mov word [rbp], ax
movzx eax, word [0x14005dd10]
xor ax, cx
mov word [rbp + 2], ax
movzx eax, word [0x14005dd12]
xor ax, cx
mov word [rbp + 4], ax
movzx eax, word [0x14005dd14]
xor ax, cx
mov word [rbp + 6], ax
movzx eax, word [0x14005dd16]
xor ax, cx
mov word [rbp + 8], ax
movzx eax, word [0x14005dd18]
xor ax, cx
mov word [rbp + 0xa], ax
movzx eax, word [0x14005dd1a]
xor ax, cx
mov word [rbp + 0xc], ax
movzx eax, word [0x14005dd1c]
xor ax, cx
mov word [rbp + 0xe], ax
movzx eax, word [0x14005dd1e]
xor ax, cx
mov word [rbp + 0x10], ax
movzx eax, word [str.SYSTEMCurrentControlSetServices_]
xor ax, cx
mov word [rbp + 0x12], ax
movzx eax, word [0x14005dd22]
xor ax, cx
mov word [rbp + 0x14], ax
movzx eax, word [0x14005dd24]
xor ax, cx
mov word [rbp + 0x16], ax
movzx eax, word [0x14005dd26]
xor ax, cx
mov word [rbp + 0x18], ax
movzx eax, word [0x14005dd28]
xor ax, cx
mov word [rbp + 0x1a], ax
movzx eax, word [0x14005dd2a]
xor ax, cx
mov word [rbp + 0x1c], ax
movzx eax, word [0x14005dd2c]
xor ax, cx
mov word [rbp + 0x1e], ax
movzx eax, word [0x14005dd2e]
xor ax, cx
mov word [rbp + 0x20], ax
movzx eax, word [0x14005dd30]
xor ax, cx
mov word [rbp + 0x22], ax
movzx eax, word [0x14005dd32]
xor ax, cx
mov word [rbp + 0x24], ax
movzx eax, word [0x14005dd34]
xor ax, cx
mov word [rbp + 0x26], ax
movzx eax, word [0x14005dd36]
xor ax, cx
mov word [rbp + 0x28], ax
movzx eax, word [0x14005dd38]
xor ax, cx
mov word [rbp + 0x2a], ax
movzx eax, word [0x14005dd3a]
xor ax, cx
mov word [rbp + 0x2c], ax
movzx eax, word [0x14005dd3c]
xor ax, cx
mov word [rbp + 0x2e], ax
movzx eax, word [0x14005dd3e]
xor ax, cx
mov word [rbp + 0x30], ax
movzx eax, word [0x14005dd40]
xor ax, cx
mov word [rbp + 0x32], ax
xor eax, eax
mov word [rbp + 0x34], ax
xor ebx, ebx
nop word [rax + rax]
xor word [rsp + rax*2 + 0x62], cx
inc rax
cmp rax, 0x69
jae 0x14000d665
movzx ecx, word [rsp + 0x60]
jmp 0x14000d650
mov word [rbp + 0x34], bx
lea rax, [rsp + 0x62]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x14000d675
mov rdx, qword [rdx + 0x10]
movabs r15, 0x7ffffffffffffffe
mov rax, r15
sub rax, rdx
cmp rax, rcx
jb 0x14000da2b
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14000d6a8
mov rax, qword [rsi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x62]
lea rcx, [rbp + 0x48]
call fcn.140012e20
nop
call fcn.140009d60
mov r13, rax
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rax, qword [rbp + 0x48]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0x14
lea rdx, [0x14005dce0]
lea rcx, [rsp + 0x40]
call fcn.140010610
nop
call fcn.14001f360
lea r12, [r13 + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
setae byte [rbp + 0xc0]
mov r14, qword [rsp + 0x40]
cmovae rdx, r14
movabs rdi, 0xcbf29ce484222325
mov r9, rdi
mov rcx, rbx
movabs r10, 0x100000001b3
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x14000d783
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14000d770
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.140013260
mov r8, qword [rax + 8]
test r8, r8
je 0x14000d7c5
cmp r8, qword [r13 + 8]
je 0x14000d7c5
mov r13, qword [r8 + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r13, r13
je 0x14000d7cf
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x38]
call r13
jmp 0x14000d7cf
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp byte [rbp + 0xc0], 0
je 0x14000d80d
mov rdx, qword [rsp + 0x58]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14000d805
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000da31
mov rcx, r14
call fcn.140021138
call fcn.140009d60
mov r13, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rsp + 0x40]
call fcn.140010610
nop
call fcn.14001f360
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
setae byte [rbp + 0xc0]
mov r14, qword [rsp + 0x40]
cmovae rcx, r14
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14000d8a3
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor rdi, rax
imul rdi, r8
inc rbx
cmp rbx, rdx
jb 0x14000d890
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.140013260
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000d8e3
cmp rdx, qword [r13 + 8]
je 0x14000d8e3
mov rbx, qword [rdx + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14000d8ed
lea rcx, [rbp + 0x38]
call rbx
mov ebx, eax
jmp 0x14000d8f2
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp byte [rbp + 0xc0], 0
je 0x14000d930
mov rdx, qword [rsp + 0x58]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14000d928
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000da31
mov rcx, r14
call fcn.140021138
mov rax, qword [rsi + 0x10]
sub r15, rax
cmp r15, 0x22
jb 0x14000da37
cmp qword [rsi + 0x18], 8
jb 0x14000d94b
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x40]
call fcn.140012e20
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000d9cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d9c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000da3d
call fcn.140021138
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x14000da08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000da03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000da25
call fcn.140021138
mov eax, ebx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002e15c
int3
call fcn.140009230
nop
call fcn.14002e15c
nop
call fcn.140009230
int3
call fcn.14002e15c
int3