Function at 0x180010a60
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r12, rdx
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov rsi, qword [rdx + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 0x34
jb 0x18001104e
mov r13, r12
cmp qword [r12 + 0x18], 8
jb 0x180010acb
mov r13, qword [r12]
mov qword [rbp - 9], rcx
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], rcx
lea r14, [rsi + 0x34]
mov r15d, 7
mov ebx, r15d
lea rdi, [rbp - 9]
lea eax, [r15 + 3]
lea rcx, [rax - 0xb]
cmp r14, rbx
jbe 0x180010b27
mov rbx, r14
or rbx, r15
cmp rbx, rdx
jbe 0x180010b05
mov rbx, rdx
jmp 0x180010b0c
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp - 9]
call fcn.180005c50
mov rdi, rax
mov qword [rbp - 9], rax
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], rbx
movaps xmm0, xmmword [str._registrymachineSYSTEMCurrentControlSetServices_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1800e31a0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1800e31b0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1800e31c0]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x1800e31d0]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x1800e31e0]
movups xmmword [rdi + 0x50], xmm1
movsd xmm0, qword [0x1800e31f0]
movsd qword [rdi + 0x60], xmm0
lea rcx, [rdi + 0x68]
lea r8, [rsi + rsi]
mov rdx, r13
call fcn.1800956b0
xor ebx, ebx
mov word [rdi + r14*2], bx
call fcn.180009850
mov r13, rax
lea rax, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rax, qword [rbp - 9]
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], bl
lea r8d, [rbx + 0x14]
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x51]
call fcn.1800058b0
nop
call fcn.180022290
lea rax, [r13 + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
setae r9b
mov byte [rsp + 0x20], r9b
mov r14, qword [rbp - 0x51]
cmovae r8, r14
movabs rdi, 0xcbf29ce484222325
mov rdx, rdi
mov ecx, ebx
movabs r10, 0x100000001b3
mov rsi, qword [rbp - 0x41]
test rsi, rsi
je 0x180010c44
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, rsi
jb 0x180010c30
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov rdx, qword [r13 + 8]
mov qword [rbp - 0x79], rdx
cmp rbx, rdx
je 0x180010cbb
mov r13, qword [rax + rcx*8]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180010c82
mov rdx, qword [rdx]
lea rcx, [rbp - 0x51]
test r9b, r9b
cmovne rcx, r14
cmp rsi, rax
jne 0x180010ca4
mov r8, rsi
call fcn.1800961b0
test eax, eax
je 0x180010caf
movzx r9d, byte [rsp + 0x20]
cmp rbx, r13
je 0x180010cb7
mov rbx, qword [rbx + 8]
jmp 0x180010c70
mov rdx, qword [rbp - 0x79]
xor esi, esi
jmp 0x180010cbf
mov rdx, qword [rbp - 0x79]
xor esi, esi
mov ebx, esi
test rbx, rbx
cmove rbx, rdx
mov rcx, qword [rsp + 0x28]
cmp rbx, rdx
je 0x180010ceb
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180010cf2
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp + 0x17]
call rbx
jmp 0x180010cf2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp byte [rsp + 0x20], 0
je 0x180010d2d
mov rdx, qword [rbp - 0x39]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x180010d25
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011054
mov rcx, r14
call fcn.180093588
call fcn.180009850
mov r13, rax
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x31]
call fcn.1800058b0
nop
call fcn.180022290
lea rax, [r13 + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
setae r8b
mov byte [rsp + 0x20], r8b
mov r14, qword [rbp - 0x31]
cmovae rdx, r14
mov rcx, rsi
mov rsi, qword [rbp - 0x21]
test rsi, rsi
je 0x180010dc3
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, rsi
jb 0x180010db0
mov rcx, qword [r13 + 0x30]
and rcx, rdi
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r13, qword [r13 + 8]
cmp rbx, r13
je 0x180010e33
mov rdi, qword [rax + rcx*8]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180010e02
mov rdx, qword [rdx]
lea rcx, [rbp - 0x31]
test r8b, r8b
cmovne rcx, r14
cmp rsi, rax
jne 0x180010e24
mov r8, rsi
call fcn.1800961b0
test eax, eax
je 0x180010e2f
movzx r8d, byte [rsp + 0x20]
cmp rbx, rdi
je 0x180010e33
mov rbx, qword [rbx + 8]
jmp 0x180010df0
xor edi, edi
jmp 0x180010e37
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r13
mov rcx, qword [rsp + 0x28]
cmp rbx, r13
je 0x180010e62
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180010e68
lea rcx, [rbp + 0x17]
call rbx
mov r13d, eax
jmp 0x180010e6e
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r13d, 0xc0000138
cmp byte [rsp + 0x20], 0
je 0x180010ea9
mov rdx, qword [rbp - 0x19]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x180010ea1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011054
mov rcx, r14
call fcn.180093588
mov rsi, qword [r12 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 0x22
jb 0x18001105a
cmp qword [r12 + 0x18], 8
jb 0x180010ed4
mov r12, qword [r12]
mov qword [rbp - 0x71], rdi
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x59], rdi
lea rdi, [rsi + 0x22]
lea rbx, [rbp - 0x71]
cmp rdi, 7
jbe 0x180010f2e
mov r15, rdi
or r15, 7
cmp r15, rcx
jbe 0x180010eff
mov r15, rcx
jmp 0x180010f0c
cmp r15, 0xa
mov eax, 0xa
cmovb r15, rax
mov rdx, r15
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x71]
call fcn.180005c50
mov rbx, rax
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x59], r15
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x1800e3250]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1800e3260]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1800e3270]
movups xmmword [rbx + 0x30], xmm1
mov eax, dword [0x1800e3280]
mov dword [rbx + 0x40], eax
lea rcx, [rbx + 0x44]
lea r8, [rsi + rsi]
mov rdx, r12
call fcn.1800956b0
xor esi, esi
mov word [rbx + rdi*2], si
lea rdx, [rbp - 0x71]
cmp qword [rbp - 0x59], 8
cmovae rdx, qword [rbp - 0x71]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rdx, qword [rbp - 0x59]
cmp rdx, 8
jb 0x180010fdc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180010fd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011060
call fcn.180093588
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x180011018
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011013
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011048
call fcn.180093588
mov eax, r13d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180093c30
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18009a4c4
int3
call fcn.180001ee0
nop
call fcn.18009a4c4
nop
call fcn.180001ee0
int3
call fcn.18009a4c4
int3