Function at 0x10078eb0
Capabilities:
Delete registry key
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013f65d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, SysReAllocString
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [esi + 0x10]
sub eax, ecx
cmp eax, 0x34
jb 0x100791d4
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10078ef6
mov eax, dword [esi]
push ecx
push eax
push 0x34
push str._registrymachineSYSTEMCurrentControlSetServices_
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x54]
call fcn.1006ece0
mov dword [ebp - 4], 0
call fcn.10063ca0
cmp dword [ebp - 0x40], 8
lea ecx, [ebp - 0x3c]
mov edi, eax
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x54]
mov dword [ebp + 8], edi
cmovae eax, dword [ebp - 0x54]
push 0x14
push 0x10197264
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.100485f0
mov byte [ebp - 4], 1
call fcn.1007a8b0
lea eax, [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x28], 0x10
lea edi, [ebp - 0x3c]
mov ebx, dword [ebp - 0x3c]
mov edx, 0x811c9dc5
cmovae edi, ebx
xor ecx, ecx
cmp dword [ebp - 0x2c], ecx
jbe 0x10078f92
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x2c]
jb 0x10078f80
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push edx
push eax
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.10064540
mov eax, dword [eax + 4]
test eax, eax
je 0x10078fd5
cmp eax, dword [edi + 4]
je 0x10078fd5
mov eax, dword [eax + 0x20]
mov dword [ebp + 8], eax
lea eax, [edi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push eax
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10078fe1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
call eax
jmp 0x10078fe1
lea eax, [edi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push eax
call edi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x10079018
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x1007900e
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100791af
push ecx
push ebx
call fcn.1013b151
add esp, 8
call fcn.10063ca0
push 0xe
mov ebx, eax
mov dword [ebp - 0x3c], 0
push 0x1019727c
lea ecx, [ebp - 0x3c]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.100485f0
mov byte [ebp - 4], 2
call fcn.1007a8b0
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x28], 0x10
lea ebx, [ebp - 0x3c]
mov edx, 0x811c9dc5
cmovae ebx, dword [ebp - 0x3c]
xor ecx, ecx
cmp dword [ebp - 0x2c], ecx
jbe 0x10079082
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x2c]
jb 0x10079070
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push edx
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.10064540
mov eax, dword [eax + 4]
test eax, eax
je 0x100790bb
cmp eax, dword [ebx + 4]
je 0x100790bb
mov ebx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
add eax, 0x20
push eax
call edi
test ebx, ebx
je 0x100790c1
lea eax, [ebp - 0x1c]
push eax
call ebx
mov edi, eax
jmp 0x100790c6
lea eax, [ebx + 0x20]
push eax
call edi
mov edi, 0xc0000138
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x10079100
mov edx, dword [ebp - 0x3c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100790f6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100791af
push ecx
push edx
call fcn.1013b151
add esp, 8
mov eax, dword [esi + 0x10]
mov ecx, SysReAllocString
sub ecx, eax
cmp ecx, 0x22
jb 0x100791d9
cmp dword [esi + 0x14], 8
jb 0x1007911b
mov esi, dword [esi]
push eax
push esi
push 0x22
push str.SYSTEMCurrentControlSetServices_
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call fcn.1006ece0
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 0x28]
cmp ecx, 8
jb 0x10079183
mov edx, dword [ebp - 0x3c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10079179
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10079179
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013b151
add esp, 8
mov ecx, dword [ebp - 0x40]
cmp ecx, 8
jb 0x100791bf
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100791b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100791b5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013b151
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100474b0
call fcn.100474b0
int3