Function at 0x140075360
Capabilities:
Delete registry key
Encode data using xor
Unload driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rdi, rcx
mov dword [rsp + 0x40], 0x9eb29eab
mov dword [rsp + 0x44], 0x9ea49ea3
mov dword [rsp + 0x48], 0x9ee49ea5
mov dword [rsp + 0x4c], 0x9ea09eaf
mov dword [rsp + 0x50], 0x9ea1
xor r15d, r15d
mov edx, r15d
mov r14d, 0x613b
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r14w
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x1400753c0
mov word [rsp + 0x52], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007582a
mov dword [rsp + 0x60], 0x9e949e99
mov dword [rsp + 0x64], 0x9eaf9ea2
mov dword [rsp + 0x68], 0x9eb99ea0
mov dword [rsp + 0x6c], 0x9ebe9ebf
mov dword [rsp + 0x70], 0x9e929eb4
mov dword [rsp + 0x74], 0x9eb19e82
mov dword [rsp + 0x78], 0x9eba9eb2
mov dword [rsp + 0x7c], 0x9eba9eba
mov dword [rbp - 0x80], 0x9e8a9eb0
mov dword [rbp - 0x7c], 0x9ea19e84
mov dword [rbp - 0x78], 0x9eae9eaa
mov dword [rbp - 0x74], 0x9eb19ebe
mov dword [rbp - 0x70], 0x9e9d9e81
mov dword [rbp - 0x6c], 0x9e929eaa
mov dword [rbp - 0x68], 0x9e879e93
mov dword [rbp - 0x64], 0x9e909e8d
mov dword [rbp - 0x60], 0x9e899ea6
mov dword [rbp - 0x5c], 0x9e9c9e89
mov dword [rbp - 0x58], 0x9e859e9b
mov dword [rbp - 0x54], 0x9ebf9e87
mov dword [rbp - 0x50], 0x9e9a9e88
mov dword [rbp - 0x4c], 0x9ea39eb3
mov dword [rbp - 0x48], 0x9e809e94
mov dword [rbp - 0x44], 0x9e9d9e85
mov dword [rbp - 0x40], 0x9e939e96
mov dword [rbp - 0x3c], 0x9ea49e84
xor eax, eax
mov word [rbp - 0x38], ax
mov edx, r15d
nop
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r14w
xor word [rcx], ax
inc edx
cmp edx, 0x34
jb 0x1400754c0
mov word [rbp - 0x38], r15w
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x1400754f1
mov rdx, qword [rdi + 0x10]
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rdx
cmp rax, rcx
jb 0x140075851
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x140075525
mov rax, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.1400684d0
nop
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x9e9f9e96
mov dword [rsp + 0x64], 0x9e9c9e94
mov dword [rsp + 0x68], 0x9e879e8c
mov dword [rsp + 0x6c], 0x9e8f9e97
mov dword [rsp + 0x70], 0x9ebc9eb8
mov dword [rsp + 0x74], 0x9eb59ebd
mov dword [rsp + 0x78], 0x9ea69ebf
mov dword [rsp + 0x7c], 0x9ebb9e90
mov dword [rbp - 0x80], 0x9ea29ebb
mov dword [rbp - 0x7c], 0x9eb79ea5
mov dword [rbp - 0x78], 0x9e899eb5
mov dword [rbp - 0x74], 0x9ea89ebe
mov dword [rbp - 0x70], 0x9e8d9e81
mov dword [rbp - 0x6c], 0x9e929eba
mov dword [rbp - 0x68], 0x9e8b9e97
mov dword [rbp - 0x64], 0x9e819e80
mov dword [rbp - 0x60], 0x9eba9e96
xor eax, eax
mov word [rbp - 0x5c], ax
mov edx, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r14w
xor word [rcx], ax
inc edx
cmp edx, 0x22
jb 0x1400755f0
mov word [rbp - 0x5c], r15w
lea rax, [rsp + 0x60]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140075620
mov rax, qword [rdi + 0x10]
sub rsi, rax
cmp rsi, rbx
jb 0x140075857
cmp qword [rdi + 0x18], 8
jb 0x140075644
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.1400684d0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14007568f
cmp eax, 2
sete bl
jmp 0x14007579a
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
movdqa xmm0, xmmword [0x1400bada0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400ba5e0]
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, r15d
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, r8d
lea rdx, [rsp + 0x40]
add rdx, rcx
lea ecx, [r8 - 0x3b]
xor byte [rdx], cl
inc r8d
cmp r8d, 0x1f
jb 0x1400756d0
mov byte [rsp + 0x5f], 0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14006e010
test ebx, ebx
je 0x140075775
movdqa xmm0, xmmword [0x1400bafa0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xb991f6b1
mov dword [rsp + 0x54], 0xb8beb6b0
mov dword [rsp + 0x58], 0xd5fffc
mov eax, r15d
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
add rdx, rcx
lea ecx, [rax - 0x3b]
xor byte [rdx], cl
inc eax
cmp eax, 0x1b
jb 0x140075730
mov byte [rsp + 0x5b], 0
lea rcx, [rsp + 0x40]
call fcn.14006e010
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x14007579a
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x140075798
xor bl, bl
jmp 0x14007579a
mov bl, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400757da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400757d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007585d
call fcn.1400775a8
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140075827
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075822
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007584b
call fcn.1400775a8
movzx eax, bl
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400871d4
int3
call fcn.140006b60
nop
call fcn.140006b60
nop
call fcn.1400871d4
int3