Function at 0x180001a10
Capabilities:
Delete registry key
Install driver
Set registry value
Unload driver

Disassembly:
mov r11, rsp
push rbp
push rbx
lea rbp, [r11 - 0x28]
sub rsp, 0x118
mov rax, qword [0x18001b008]
xor rax, rsp
mov qword [rbp - 8], rax
mov qword [r11 + 0x10], rsi
xorps xmm0, xmm0
mov qword [r11 + 0x18], rdi
mov rsi, rcx
mov qword [r11 - 0x20], r14
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x58], r14
movups xmmword [rbp - 0x78], xmm0
call fcn.180001730
mov rdi, rax
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x180001a79
mov rcx, rdi
call fcn.180001800
mov ebx, eax
test eax, eax
js 0x180001dc6
lea r8, [rsp + 0x70]
mov qword [rsp + 0x100], r15
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x180001ac2
mov rcx, qword [rsp + 0x70]
lea rdx, str.SeLoadDriverPrivilege
mov r9d, 2
xor r8d, r8d
call qword [sym.imp.ProcessHacker.exe_PhSetTokenPrivilege]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
lea r15, [0x18001bb88]
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov qword [rbp - 0x58], r15
lea r8, [rbp - 0x68]
mov qword [rsp + 0x20], r14
mov edx, 0x2000000
mov dword [rbp - 0x68], 0x30
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x60], r14
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x50], 0xc0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x180001dbe
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x78]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov ebx, eax
test eax, eax
js 0x180001dbe
mov rcx, qword [rsp + 0x58]
lea rax, str.Type
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x148], r12
mov dword [rsp + 0x48], 0xa0008
mov dword [rsp + 0x40], 1
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180001db6
mov rcx, qword [rsp + 0x58]
lea rax, str.ErrorControl
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x110], r13
mov dword [rsp + 0x48], 0x1a0018
mov dword [rsp + 0x40], 1
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180001dae
mov rcx, qword [rsp + 0x58]
lea rax, str.Start
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0xc000a
mov dword [rsp + 0x40], 3
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180001dae
mov rcx, qword [rsp + 0x58]
lea rax, str.ImagePath
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
movzx eax, word [rbp - 0x78]
mov r9d, 2
add eax, 2
mov dword [rsp + 0x48], 0x140012
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180001dae
test rsi, rsi
je 0x180001d91
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x30], rax
lea r9, [0x18001bb78]
mov dword [rsp + 0x28], r14d
lea rcx, [rsp + 0x60]
mov edx, 0x30006
mov dword [rsp + 0x20], r14d
mov r8, 0xfffffffffffffffd
call qword [sym.imp.ProcessHacker.exe_PhCreateKey]
mov ebx, eax
test eax, eax
js 0x180001dae
mov rcx, qword [rsp + 0x60]
lea rax, [0x180016e98]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x78]
mov r9d, 4
mov qword [rbp - 0x80], rax
xor r8d, r8d
mov dword [rsp + 0x78], 0x1c001a
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180001d70
cmp byte [rsi + 4], r14b
je 0x180001d82
lea rax, [0x180016eb8]
mov dword [rsp + 0x78], 0x2a0028
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x38], 2
mov dword [rbp - 0x34], 1
call fcn.1800021f0
test eax, eax
js 0x180001d82
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x28], 0x2c
lea rdx, [rsp + 0x78]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
jns 0x180001d82
cmp dword [rsp + 0x68], 1
jne 0x180001d82
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x180001dae
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtLoadDriver]
cmp eax, 0xc000010e
mov ebx, eax
cmove ebx, r14d
mov r13, qword [rsp + 0x110]
mov r12, qword [rsp + 0x148]
mov r15, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x138]
test rcx, rcx
je 0x180001de6
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rdi
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
cmp qword [rbp - 0x70], 0
mov rdi, qword [rsp + 0x140]
je 0x180001e08
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180003cb0
add rsp, 0x118
pop rbx
pop rbp
ret