Function at 0x140023ef0
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov qword [rsp + 0x68], rdx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str._registrymachineSYSTEMCurrentControlSetServices_
call fcn.140004b50
mov rcx, rax
call fcn.1400032c0
mov rdi, rax
mov rsi, qword [rbx + 0x10]
mov rcx, rbx
call fcn.140006750
sub rax, rsi
cmp rax, rdi
jb 0x1400242b0
mov rcx, rbx
call fcn.140003d90
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str._registrymachineSYSTEMCurrentControlSetServices_
mov r8, rbx
lea rcx, [rsp + 0x80]
call fcn.14001a120
nop
call fcn.140010200
mov r13, rax
lea rcx, [rsp + 0x80]
call fcn.140003d90
mov r15, rax
mov qword [rsp + 0x40], rax
lea rdx, str.RtlInitUnicodeString
lea rcx, [rsp + 0x48]
call fcn.140003230
nop
call fcn.140025990
lea rbp, [r13 + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x48]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.140003eb0
movabs rsi, 0xcbf29ce484222325
mov rdx, rsi
mov r8d, r14d
movabs r9, 0x100000001b3
test rbx, rbx
je 0x140024024
nop dword [rax]
movzx ecx, byte [rax + r8]
xor rdx, rcx
imul rdx, r9
inc r8
cmp r8, rbx
jb 0x140024010
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r13 + 8]
je 0x140024096
mov r12, qword [rax + rcx*8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.140004b00
mov r15, rax
mov rbp, qword [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140004b00
cmp rbp, rbx
jne 0x140024077
mov r8, rbp
mov rdx, r15
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x140024082
cmp rdi, r12
je 0x14002408d
mov rdi, qword [rdi + 8]
jmp 0x140024041
lea rbp, [r13 + 0x40]
mov r15, qword [rsp + 0x40]
jmp 0x140024099
lea rbp, [r13 + 0x40]
mov r15, qword [rsp + 0x40]
mov rdi, r14
test rdi, rdi
je 0x1400240c2
cmp rdi, qword [r13 + 8]
je 0x1400240c2
mov rbx, qword [rdi + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400240cc
mov rdx, r15
lea rcx, [rsp + 0x70]
call rbx
jmp 0x1400240cc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x48]
call fcn.1400040b0
call fcn.140010200
mov r13, rax
lea rdx, str.NtUnloadDriver
lea rcx, [rsp + 0x48]
call fcn.140003230
nop
call fcn.140025990
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x48]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.140003eb0
mov rdx, r14
test rbx, rbx
je 0x140024143
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [rax + rdx]
xor rsi, rcx
imul rsi, r8
inc rdx
cmp rdx, rbx
jb 0x140024130
mov rcx, qword [r13 + 0x30]
and rcx, rsi
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r13 + 8]
je 0x1400241a4
mov r15, qword [rax + rcx*8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.140004b00
mov rbp, rax
mov rsi, qword [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140004b00
cmp rsi, rbx
jne 0x140024196
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x1400241a1
cmp rdi, r15
je 0x1400241a4
mov rdi, qword [rdi + 8]
jmp 0x140024160
mov r14, rdi
test r14, r14
je 0x1400241cd
cmp r14, qword [r13 + 8]
je 0x1400241cd
mov rbx, qword [r14 + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400241d7
lea rcx, [rsp + 0x70]
call rbx
mov ebx, eax
jmp 0x1400241dc
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x48]
call fcn.1400040b0
lea rcx, str.SYSTEMCurrentControlSetServices_
call fcn.140004b50
mov rcx, rax
call fcn.1400032c0
mov rdi, rax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rbp + 0x10]
mov rcx, rbp
call fcn.140006750
sub rax, rsi
cmp rax, rdi
jb 0x1400242aa
mov rcx, rbp
call fcn.140003d90
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.SYSTEMCurrentControlSetServices_
mov r8, rbp
lea rcx, [rsp + 0x48]
call fcn.14001a120
lea rcx, [rsp + 0x48]
call fcn.140003d90
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, [rsp + 0x48]
call fcn.140003de0
nop
lea rcx, [rsp + 0x80]
call fcn.140003de0
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001920
nop
call fcn.140001920
int3