Function at 0x1402d2d70
Capabilities:
Delete registry key
Install driver
Unload driver

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0xb4], r9d
mov dword [rsp + 0xb0], r8d
test rdx, rdx
mov eax, 0xfbd463ef
mov ecx, 0x88b5de4f
cmove ecx, eax
mov dword [rsp + 0x5c], ecx
mov eax, 0x2aeaa22b
xorps xmm6, xmm6
lea rbx, [rsp + 0xc8]
mov r12, qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r15, qword [sym.imp.ntdll.dll_NtDeleteKey]
mov r13, qword [sym.imp.ntdll.dll_NtClose]
lea rbp, [rsp + 0xb8]
jmp 0x1402d2e1d
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb42581e3
mov ecx, 0xcd7182f8
nop
cmove eax, ecx
cmp dword [0x14035ce14], 0xa
cmovl eax, ecx
cmp eax, 0xeb4b0353
jle 0x1402d2e70
cmp eax, 0x23eea25b
jle 0x1402d2ed0
cmp eax, 0x691d82b4
jle 0x1402d2fe5
cmp eax, 0x7858140f
jle 0x1402d30d8
cmp eax, 0x7a29a2f2
jg 0x1402d32ae
cmp eax, 0x78581410
je 0x1402d334f
cmp eax, 0x7974120d
jne 0x1402d2e1d
mov eax, 0xae5947a1
jmp 0x1402d2e1d
cmp eax, 0xb588426d
jle 0x1402d2fa0
cmp eax, 0xcd7182f7
jle 0x1402d3028
cmp eax, 0xda28ae64
jle 0x1402d3103
cmp eax, 0xe2e086b7
jg 0x1402d32d8
cmp eax, 0xda28ae65
je 0x1402d336d
cmp eax, 0xdbdbe986
jne 0x1402d2e1d
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x23eea25c
mov ecx, 0x204076b4
jmp 0x1402d2e10
cmp eax, 0x436d604
jg 0x1402d305d
cmp eax, 0xfa49edc5
jle 0x1402d313d
cmp eax, 0x44106b
jg 0x1402d3326
cmp eax, 0xfa49edc6
je 0x1402d3389
cmp eax, 0xfbd463ef
jne 0x1402d2e1d
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rbp
mov rax, qword [rsp + 0x50]
mov rcx, rbp
mov rdx, rdi
call r12
mov dword [rsp + 0xc8], 0x30
mov eax, 0x787d4164
nop word [rax + rax]
cmp eax, 0x5a061939
je 0x1402d339b
cmp eax, 0x787d4164
jne 0x1402d2f40
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0xe0], 0x40
mov qword [rsp + 0xd8], rbp
lea rax, [rsp + 0xe8]
movups xmmword [rax], xmm6
lea rcx, [rsp + 0xa8]
mov edx, 0x2000000
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtOpenKeyEx]
mov dword [rsp + 0x64], eax
mov eax, 0x5a061939
jmp 0x1402d2f40
cmp eax, 0x9f544e53
jg 0x1402d3098
cmp eax, 0x91d2fe8f
jg 0x1402d3173
cmp eax, 0x84fe02ab
je 0x1402d33ba
cmp eax, 0x88b5de4f
je 0x1402d33d8
cmp eax, 0x8ad93227
jne 0x1402d2e1d
mov eax, dword [rsp + 0x40]
mov eax, 0x8a9d2fe
jmp 0x1402d2e1d
cmp eax, 0x48b4fe10
jg 0x1402d319e
cmp eax, 0x23eea25c
je 0x1402d340a
cmp eax, 0x2aeaa22b
je 0x1402d341c
cmp eax, 0x3d08b8bd
jne 0x1402d2e1d
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
mov eax, 0x84fe02ab
jmp 0x1402d2e1d
cmp eax, 0xc1ebc0f1
jg 0x1402d31d6
cmp eax, 0xb588426e
je 0x1402d3438
cmp eax, 0xba18274a
je 0x1402d3442
cmp eax, 0xbe8fe046
jne 0x1402d2e1d
mov eax, dword [rsp + 0x5c]
jmp 0x1402d2e1d
cmp eax, 0x13ab334a
jg 0x1402d3233
cmp eax, 0x436d605
je 0x1402d345c
cmp eax, 0x8a9d2fe
je 0x1402d3466
cmp eax, 0xb3f8645
jne 0x1402d2e1d
mov eax, 0x44106c
mov r14d, dword [rsp + 0x4c]
jmp 0x1402d2e1d
cmp eax, 0xaee44c89
jg 0x1402d327a
cmp eax, 0x9f544e54
je 0x1402d348e
cmp eax, 0xae5947a1
je 0x1402d349d
cmp eax, 0xae80e0da
jne 0x1402d2e1d
cmp dword [rsp + 0x48], 0
sets byte [rsp + 0x3d]
mov eax, 0x48b4fe11
jmp 0x1402d2e1d
cmp eax, 0x691d82b5
je 0x1402d34bb
cmp eax, 0x6d1454be
je 0x1402d34d5
cmp eax, 0x6d88700d
jne 0x1402d2e1d
mov eax, 0x2d73e91
jmp 0x1402d2e1d
cmp eax, 0xcd7182f8
je 0x1402d34ec
cmp eax, 0xcf10d376
je 0x1402d3523
cmp eax, 0xd96cf49c
jne 0x1402d2e1d
mov eax, dword [rsp + 0x60]
cmp eax, 0xffffffff
mov eax, 0xc1ebc0f2
mov ecx, 0xe9fee8cc
cmove eax, ecx
jmp 0x1402d2e1d
cmp eax, 0xeb4b0354
je 0x1402d2df6
cmp eax, 0xee3ea910
je 0x1402d3598
cmp eax, 0xf3748ab3
jne 0x1402d2e1d
mov rcx, qword [rsp + 0xa0]
call r13
mov eax, 0x9f544e54
jmp 0x1402d2e1d
cmp eax, 0x91d2fe90
je 0x1402d35ad
cmp eax, 0x93adf5f8
je 0x1402d35c9
cmp eax, 0x9cd4cb80
jne 0x1402d2e1d
mov eax, 0xb3f8645
jmp 0x1402d2e1d
cmp eax, 0x48b4fe11
je 0x1402d35e7
cmp eax, 0x4fff824d
je 0x1402d3605
cmp eax, 0x67e4e1fd
jne 0x1402d2e1d
cmp byte [rsp + 0x3d], 0
mov eax, 0x691d82b5
mov ecx, 0xba18274a
cmovne eax, ecx
jmp 0x1402d2e1d
cmp eax, 0xc1ebc0f2
je 0x1402d360f
cmp eax, 0xc5eb7f9b
je 0x1402d3629
cmp eax, 0xc618316f
jne 0x1402d2e1d
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea rdx, [0x140338306]
xor r8d, r8d
mov r9d, 4
call fcn.1402d2590
mov eax, 0xe2e086b8
jmp 0x1402d2e1d
cmp eax, 0x13ab334b
je 0x1402d3633
cmp eax, 0x13da6962
je 0x1402d3647
cmp eax, 0x204076b4
jne 0x1402d2e1d
mov rcx, qword [rsp + 0x78]
call r13
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x23eea25c
mov ecx, 0x9cd4cb80
jmp 0x1402d2e10
cmp eax, 0xaee44c8a
je 0x1402d369a
cmp eax, 0xb1a9fe2c
je 0x1402d36a4
cmp eax, 0xb42581e3
jne 0x1402d2e1d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, 0xcd7182f8
jmp 0x1402d2e1d
cmp eax, 0x7a29a2f3
je 0x1402d36bb
cmp eax, 0x7bfe29ce
jne 0x1402d2e1d
cmp dword [rsp + 0x44], 0
setns byte [rsp + 0x3c]
mov eax, 0xda28ae65
jmp 0x1402d2e1d
cmp eax, 0xe2e086b8
je 0x1402d36e1
cmp eax, 0xe9fee8cc
jne 0x1402d2e1d
mov qword [rsp + 0xb8], rbx
mov rax, qword [rsp + 0xb8]
mov rcx, rbx
mov rdx, rdi
call r12
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov rcx, qword [rsp + 0xb8]
mov dword [rsp + 0x48], eax
mov eax, 0xae80e0da
jmp 0x1402d2e1d
cmp eax, 0x2d73e91
jne 0x1402d36fd
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6d88700d
mov ecx, 0x67e4e1fd
jmp 0x1402d2e10
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x436d605
mov ecx, 0x4fff824d
jmp 0x1402d2e10
cmp byte [rsp + 0x3c], 0
mov eax, 0x44106c
mov ecx, 0xeb4b0354
cmovne eax, ecx
mov r14d, dword [rsp + 0x44]
jmp 0x1402d2e1d
mov rcx, qword [rsp + 0x70]
call r15
mov eax, 0x7a29a2f3
jmp 0x1402d2e1d
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x80]
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x40], eax
mov eax, 0x93adf5f8
jmp 0x1402d2e1d
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfa49edc6
mov ecx, 0x7a29a2f3
jmp 0x1402d2e10
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r9, rdi
call fcn.1402d2440
mov dword [rsp + 0x44], eax
mov eax, 0x7bfe29ce
jmp 0x1402d2e1d
mov rcx, qword [rsp + 0x78]
call r13
mov eax, 0x204076b4
jmp 0x1402d2e1d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, 0xbe8fe046
jmp 0x1402d2e1d
mov eax, 0xcf10d376
jmp 0x1402d2e1d
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rax
mov eax, 0xee3ea910
jmp 0x1402d2e1d
mov eax, 0x78581410
jmp 0x1402d2e1d
cmp dword [rsp + 0x40], 0
setns byte [rsp + 0x3e]
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8ad93227
mov ecx, 0xc5eb7f9b
jmp 0x1402d2e10
mov eax, 0x44106c
mov r14d, dword [rsp + 0x48]
jmp 0x1402d2e1d
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x436d605
mov ecx, 0x78581410
jmp 0x1402d2e10
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rax
mov eax, 0xf3748ab3
jmp 0x1402d2e1d
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov eax, 0xdbdbe986
jmp 0x1402d2e1d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cdqe
add rax, rax
mov qword [rsp + 0x88], rax
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb42581e3
mov ecx, 0xb588426e
jmp 0x1402d2e10
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, str.ImagePath
xor r8d, r8d
mov r9d, 1
call fcn.1402d2590
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea rdx, str.Type
xor r8d, r8d
mov r9d, 4
call fcn.1402d2590
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x60], eax
mov eax, 0xd96cf49c
jmp 0x1402d2e1d
mov rcx, qword [rsp + 0x98]
call r15
mov eax, 0xaee44c8a
jmp 0x1402d2e1d
cmp byte [rsp + 0x3e], 0
mov eax, 0x44106c
mov ecx, 0x13da6962
cmovne eax, ecx
mov r14d, dword [rsp + 0x40]
jmp 0x1402d2e1d
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8ad93227
mov ecx, 0x8a9d2fe
jmp 0x1402d2e10
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6d88700d
mov ecx, 0x2d73e91
jmp 0x1402d2e10
mov eax, 0x6d1454be
jmp 0x1402d2e1d
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x90], rax
mov eax, 0xc618316f
jmp 0x1402d2e1d
mov eax, 0x91d2fe90
jmp 0x1402d2e1d
cmp dword [rsp + 0x4c], 0
setns byte [rsp + 0x3f]
mov eax, 0xb1a9fe2c
jmp 0x1402d2e1d
mov qword [rsp + 0xb8], rbx
mov rax, qword [rsp + 0xb8]
mov rcx, rbx
mov rdx, rdi
call r12
mov eax, 0x77120056
nop word cs:[rax + rax]
nop
cmp eax, 0xf5d51f04
je 0x1402d36eb
cmp eax, 0x77120056
jne 0x1402d3670
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xb8]
mov eax, 0xf5d51f04
jmp 0x1402d3670
mov eax, 0x691d82b5
jmp 0x1402d2e1d
cmp byte [rsp + 0x3f], 0
mov eax, 0x6d1454be
mov ecx, 0x3d08b8bd
cmovne eax, ecx
jmp 0x1402d2e1d
mov rcx, qword [rsp + 0x70]
call r15
mov eax, dword [0x14035ce10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfa49edc6
mov ecx, 0x7974120d
jmp 0x1402d2e10
mov eax, 0xe9fee8cc
jmp 0x1402d2e1d
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov eax, 0x13ab334b
jmp 0x1402d2e1d
cmp eax, 0x44106c
jne 0x1402d2e1d
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1402e6030
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret