Function at 0x140214767
Capabilities:
Delete registry key
Install driver
Unload driver

Disassembly:
jmp 0x14041a000
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x180
lea rdi, [rsp + 0x40]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x190]
mov qword [rsp + 0xb8], 0
mov rax, qword [rsp + 0x190]
mov rdx, qword [rax + 8]
lea rcx, [0x14095fdd8]
call sym.SystemInformer.exe_PhConcatStringRef2
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140210adb
movzx eax, al
test eax, eax
jne 0x14041a080
mov rcx, qword [rsp + 0x48]
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, 0xc0000106
jmp 0x14041a39b
movzx eax, byte [rsp + 0x198]
test eax, eax
je 0x14041a291
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0xd4]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rax
xor r8d, r8d
mov edx, 0x20006
lea rcx, [rsp + 0x98]
call sym.SystemInformer.exe_PhCreateKey
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x14041a257
cmp dword [rsp + 0xd4], 1
jne 0x14041a248
mov qword [rsp + 0xf8], 8
lea rax, [0x1407b0e98]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x190]
mov rdx, qword [rax]
lea rcx, [rsp + 0xf8]
call sym.SystemInformer.exe_PhConcatStringRef2
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x124], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x124]
mov r8d, 4
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x98]
call fcn.14020fb59
mov dword [rsp + 0x144], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x144]
mov r8d, 4
lea rdx, str.Type
mov rcx, qword [rsp + 0x98]
call fcn.14020fb59
mov dword [rsp + 0x164], 4
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x164]
mov r8d, 4
lea rdx, [0x140751650]
mov rcx, qword [rsp + 0x98]
call fcn.14020fb59
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
add rax, 2
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 8]
mov r8d, 1
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x98]
call fcn.14020fb59
mov rax, qword [rsp + 0x190]
mov rax, qword [rax + 0x10]
mov eax, dword [rax]
add rax, 2
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
mov r9, qword [rcx + 8]
mov r8d, 1
lea rdx, str.ObjectName
mov rcx, qword [rsp + 0x98]
call fcn.14020fb59
mov rcx, qword [rsp + 0x50]
call sym.SystemInformer.exe_PhDereferenceObject
mov rcx, qword [rsp + 0x190]
call fcn.14020d0f7
nop
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
nop
mov rax, qword [rsp + 0x190]
movzx eax, byte [rax + 0x39]
test eax, eax
je 0x14041a280
mov dl, 1
mov rax, qword [rsp + 0x190]
mov rcx, qword [rax + 8]
call fcn.140210743
mov dword [rsp + 0x40], eax
jmp 0x14041a28f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov dword [rsp + 0x40], eax
jmp 0x14041a2c9
mov rax, qword [rsp + 0x190]
movzx eax, byte [rax + 0x39]
test eax, eax
je 0x14041a2ba
xor edx, edx
mov rax, qword [rsp + 0x190]
mov rcx, qword [rax + 8]
call fcn.140210743
mov dword [rsp + 0x40], eax
jmp 0x14041a2c9
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x14041a2e0
movzx eax, byte [rsp + 0x198]
test eax, eax
jne 0x14041a38d
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x20], 0
mov r9, rax
xor r8d, r8d
mov edx, 0x30019
lea rcx, [rsp + 0x98]
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
jl 0x14041a38d
mov dword [rsp + 0x20], 0
lea r9, [0x14095fde8]
mov r8, qword [rsp + 0x98]
mov edx, 0x10000
lea rcx, [rsp + 0xb8]
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
jl 0x14041a357
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtClose]
nop
xor r9d, r9d
lea r8, [0x14041d0e0]
xor edx, edx
mov rcx, qword [rsp + 0x98]
call sym.SystemInformer.exe_PhEnumerateKey
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
nop
mov rcx, qword [rsp + 0x48]
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [rsp + 0x40]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407b1740]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x180
pop rdi
ret