Function at 0x1402ce190
Capabilities:
Delete registry key
Install driver
Set registry value
Unload driver

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
movaps xmmword [rsp + 0x140], xmm6
mov dword [rsp + 0x70], r9d
mov dword [rsp + 0x6c], r8d
mov rbx, rdx
mov r15, rcx
mov rax, qword [0x140353a28]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea r14, [rsp + 0x128]
test rdx, rdx
mov eax, 0x65469ba
mov ecx, 0xd050126e
cmove ecx, eax
mov dword [rsp + 0x68], ecx
mov eax, 0xa7af5486
lea rsi, [rsp + 0x108]
mov rbp, qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r13, qword [sym.imp.ntdll.dll_NtClose]
xorps xmm6, xmm6
mov qword [rsp + 0x80], r15
jmp 0x1402ce240
mov eax, dword [0x140354e70]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x888fbd79
mov ecx, 0xacb4d37d
cmove eax, ecx
cmp dword [0x140354e74], 0xa
cmovl eax, ecx
nop word [rax + rax]
cmp eax, 0xf2e87b44
jle 0x1402ce2a0
cmp eax, 0x49742046
jg 0x1402ce300
cmp eax, 0x200b6970
jg 0x1402ce3a7
cmp eax, 0x65469b9
jle 0x1402ce4b2
cmp eax, 0x65469ba
je 0x1402ce64d
cmp eax, 0x13b5a0b2
je 0x1402ce6cf
cmp eax, 0x1c869917
jne 0x1402ce240
mov eax, dword [0x140354e70]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd1285a54
mov ecx, 0x5d4e60c5
jmp 0x1402ce22a
cmp eax, 0xacb4d37c
jle 0x1402ce350
cmp eax, 0xd050126d
jg 0x1402ce3ed
cmp eax, 0xb5358289
jle 0x1402ce4dc
cmp eax, 0xb535828a
je 0x1402ce6fa
cmp eax, 0xba1b32fd
je 0x1402ce714
cmp eax, 0xc50a8a6a
jne 0x1402ce240
cmp byte [rsp + 0x42], 0
mov eax, 0x82188375
mov ecx, 0x69585ddb
cmovne eax, ecx
jmp 0x1402ce240
cmp eax, 0x5f2f3e35
jle 0x1402ce435
cmp eax, 0x69585dda
jle 0x1402ce4fc
cmp eax, 0x69585ddb
je 0x1402ce72b
cmp eax, 0x773fe2c8
je 0x1402ce745
cmp eax, 0x7e5f45db
jne 0x1402ce240
mov eax, 0x13b5a0b2
mov r12d, dword [rsp + 0x64]
jmp 0x1402ce240
cmp eax, 0x8eaec45e
jle 0x1402ce477
cmp eax, 0x9b46da87
jle 0x1402ce51c
cmp eax, 0x9b46da88
je 0x1402ce211
cmp eax, 0x9f28b792
je 0x1402ce7c1
cmp eax, 0xa7af5486
jne 0x1402ce240
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0xe0], eax
mov eax, 0x5eeef687
jmp 0x1402ce240
cmp eax, 0x3f946745
jle 0x1402ce54a
cmp eax, 0x3f946746
je 0x1402ce7d6
cmp eax, 0x42e908cd
je 0x1402ce821
cmp eax, 0x456c9338
jne 0x1402ce240
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], rax
mov eax, 0x773fe2c8
jmp 0x1402ce240
cmp eax, 0xd5f54e6c
jle 0x1402ce5dd
cmp eax, 0xd5f54e6d
je 0x1402ce835
cmp eax, 0xe8691dc9
je 0x1402ce844
cmp eax, 0xf1d05584
jne 0x1402ce240
cmp byte [rsp + 0x41], 0
mov eax, 0x13b5a0b2
mov ecx, 0x49742047
cmovne eax, ecx
mov r12d, dword [rsp + 0x58]
jmp 0x1402ce240
cmp eax, 0x59bb977f
jle 0x1402ce5fd
cmp eax, 0x59bb9780
je 0x1402ce858
cmp eax, 0x5eeef687
jne 0x1402cebce
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rsp + 0x68]
jmp 0x1402ce240
cmp eax, 0x888fbd78
jg 0x1402ce62d
cmp eax, 0x81bbcbae
je 0x1402ce874
cmp eax, 0x82188375
jne 0x1402ce240
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xc0], rax
mov eax, 0x5f2f3e36
jmp 0x1402ce240
cmp eax, 0xf2e87b45
je 0x1402ce8c1
cmp eax, 0xfccff710
jne 0x1402ce240
cmp dword [rsp + 0x60], 0
setns byte [rsp + 0x43]
mov eax, 0x59bb9780
jmp 0x1402ce240
cmp eax, 0xacb4d37d
je 0x1402ce8d9
cmp eax, 0xb087df91
jne 0x1402ce240
mov eax, 0xb535828a
jmp 0x1402ce240
cmp eax, 0x5f2f3e36
je 0x1402ce8f7
cmp eax, 0x66ec239f
jne 0x1402ce240
mov eax, 0xba1b32fd
jmp 0x1402ce240
cmp eax, 0x8eaec45f
je 0x1402ce90c
cmp eax, 0x92e256b6
jne 0x1402ce240
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov eax, 0x88afbded
jmp 0x1402ce240
cmp eax, 0x200b6971
je 0x1402ce926
cmp eax, 0x2b81197a
jne 0x1402ce240
mov dword [rsp + 0x44], r12d
mov r13, rsi
mov rsi, rbp
mov r15, r14
mov r12, rbx
mov r14, qword [rsp + 0xd8]
mov ebx, dword [rsp + 0x74]
mov rdi, qword [rsp + 0xa0]
mov eax, 0x401f257c
nop word [rax + rax]
cmp eax, 0x2164bbd3
je 0x1402ce946
cmp eax, 0x401f257c
jne 0x1402ce590
mov rbp, r13
mov rcx, r13
lea rdx, str.ImagePath
call rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r13
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov dword [rsp + 0xf8], eax
mov eax, 0x2164bbd3
jmp 0x1402ce590
cmp eax, 0xd050126e
je 0x1402ce9d6
cmp eax, 0xd1285a54
jne 0x1402ce240
mov eax, 0x1c869917
jmp 0x1402ce240
cmp eax, 0x49742047
je 0x1402ceaba
cmp eax, 0x4db37a87
jne 0x1402ce240
lea rax, [rsp + 0xe4]
mov qword [rsp + 0xa8], rax
mov eax, 0x456c9338
jmp 0x1402ce240
cmp eax, 0x888fbd79
je 0x1402ceada
cmp eax, 0x88afbded
jne 0x1402ce240
mov eax, 0x82188375
jmp 0x1402ce240
mov eax, 0x1e39f522
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x8bfebb28
je 0x1402ceae4
cmp eax, 0x1e39f522
jne 0x1402ce660
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
lea rdi, [rsp + 0xf8]
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call rbp
mov dword [rsp + 0x108], 0x30
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x120], 0x40
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0xe8], r14
mov eax, 0x8bfebb28
jmp 0x1402ce660
mov dword [rsp + 0x78], r12d
mov rax, qword [rsp + 0x88]
mov eax, dword [0x140354e70]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd1285a54
mov ecx, 0x1c869917
jmp 0x1402ce22a
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], rax
mov eax, 0x9f28b792
jmp 0x1402ce240
cmp dword [rsp + 0x64], 0
mov eax, 0xb535828a
mov ecx, 0x8eaec45f
cmovns eax, ecx
jmp 0x1402ce240
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb8], rax
mov eax, 0x92e256b6
jmp 0x1402ce240
mov dword [rsp + 0x44], r12d
mov r12, rsi
mov r15, r14
mov r14, rbx
mov rdi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
mov eax, 0x401f257c
nop dword [rax + rax]
cmp eax, 0x2164bbd3
je 0x1402ceb30
cmp eax, 0x401f257c
jne 0x1402ce770
mov rsi, r12
mov rcx, r12
lea rdx, [0x140330106]
call rbp
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, rbx
mov rdx, r12
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov dword [rsp + 0xf8], eax
mov eax, 0x2164bbd3
jmp 0x1402ce770
mov rcx, qword [rsp + 0xd0]
call r13
mov eax, 0x9b46da88
jmp 0x1402ce240
mov eax, 0x44119a54
nop dword [rax + rax]
cmp eax, 0xbf737882
je 0x1402ceb5e
cmp eax, 0x44119a54
jne 0x1402ce7e0
mov qword [rsp + 0xf8], rsi
mov rax, qword [rsp + 0xf8]
mov rcx, rsi
mov rdx, r15
call rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov dword [rsp + 0xe8], eax
mov eax, 0xbf737882
jmp 0x1402ce7e0
cmp dword [rsp + 0x5c], 0
sets byte [rsp + 0x42]
mov eax, 0xc50a8a6a
jmp 0x1402ce240
mov eax, 0x13b5a0b2
mov r12d, dword [rsp + 0x5c]
jmp 0x1402ce240
cmp dword [rsp + 0x58], 0
setns byte [rsp + 0x41]
mov eax, 0xf1d05584
jmp 0x1402ce240
cmp byte [rsp + 0x43], 0
mov eax, 0x13b5a0b2
mov ecx, 0x81bbcbae
cmovne eax, ecx
mov r12d, dword [rsp + 0x60]
jmp 0x1402ce240
mov eax, 0x7013cf57
nop dword [rax]
cmp eax, 0x3768ca64
je 0x1402ceb7b
cmp eax, 0x7013cf57
jne 0x1402ce880
mov qword [rsp + 0xf8], rsi
mov rax, qword [rsp + 0xf8]
mov rcx, rsi
mov rdx, r15
call rbp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov dword [rsp + 0xe8], eax
mov eax, 0x3768ca64
jmp 0x1402ce880
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov eax, 0xb087df91
jmp 0x1402ce240
mov eax, dword [0x140354e70]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x888fbd79
mov ecx, 0x7e5f45db
jmp 0x1402ce22a
mov rcx, qword [rsp + 0xc0]
call r13
mov eax, 0xd5f54e6d
jmp 0x1402ce240
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xc8], rax
mov eax, 0xf2e87b45
jmp 0x1402ce240
mov rax, qword [rsp + 0x98]
add eax, eax
mov dword [rsp + 0x74], eax
mov qword [rsp + 0xa0], rbx
mov eax, 0x2b81197a
jmp 0x1402ce240
mov eax, dword [rsp + 0xf8]
mov rbx, qword [rsp + 0xd8]
mov eax, 0x401f257c
mov rdi, r12
mov rcx, r15
mov r15, qword [rsp + 0x80]
mov rbp, rsi
mov r14, rcx
mov rsi, r13
mov r13, qword [sym.imp.ntdll.dll_NtClose]
mov r12d, dword [rsp + 0x44]
nop dword [rax]
cmp eax, 0x2164bbd3
je 0x1402ceb98
cmp eax, 0x401f257c
jne 0x1402ce980
mov rcx, rsi
lea rdx, str.Type
call rbp
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov dword [rsp + 0xf8], eax
mov eax, 0x2164bbd3
jmp 0x1402ce980
lea rdi, [rsp + 0xf8]
mov qword [rsp + 0x90], rdi
mov rax, qword [rsp + 0x90]
mov rcx, rdi
mov rdx, r15
call rbp
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x48]
xor edx, edx
call rbp
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x108], 0x30
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x120], 0x40
mov qword [rsp + 0x118], rdi
mov eax, 0x10a5e945
nop word cs:[rax + rax]
nop
cmp eax, 0xd31cec34
je 0x1402cebbc
cmp eax, 0x10a5e945
jne 0x1402cea50
movups xmmword [r14], xmm6
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0xd8]
mov edx, 0x2000000
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x90]
mov eax, 0xd31cec34
jmp 0x1402cea50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cdqe
mov qword [rsp + 0x98], rax
mov eax, 0x200b6971
jmp 0x1402ce240
mov eax, 0xacb4d37d
jmp 0x1402ce240
mov rax, qword [rsp + 0xe8]
mov qword [rax], 0
mov qword [rsp + 0x130], 0
lea rcx, [rsp + 0xd8]
mov edx, 0x2000000
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtOpenKeyEx]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x60], eax
mov eax, 0xfccff710
jmp 0x1402ce240
mov eax, dword [rsp + 0xf8]
mov eax, 0x3f946746
mov rbx, r14
mov r14, r15
mov r13, qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rsp + 0x80]
mov rsi, r12
mov r12d, dword [rsp + 0x44]
jmp 0x1402ce240
mov rax, qword [rsp + 0xf8]
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x5c], eax
mov eax, 0x42e908cd
jmp 0x1402ce240
mov rax, qword [rsp + 0xf8]
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x64], eax
mov eax, 0x66ec239f
jmp 0x1402ce240
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0xe4], 0xffffffff
mov eax, 0x4db37a87
mov ecx, 0x3f946746
cmove eax, ecx
mov rbx, rdi
jmp 0x1402ce240
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x58], eax
mov eax, 0xe8691dc9
jmp 0x1402ce240
cmp eax, 0x5d4e60c5
jne 0x1402ce240
mov esi, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1402de620
mov eax, esi
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret