Function at 0x140075280
Capabilities:
Delete registry key
Encode data using xor
Unload driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rdi, rcx
mov dword [rsp + 0x40], 0x4ee24efb
mov dword [rsp + 0x44], 0x4ef44ef3
mov dword [rsp + 0x48], 0x4eb44ef5
mov dword [rsp + 0x4c], 0x4ef04eff
mov dword [rsp + 0x50], 0x4ef1
xor r15d, r15d
mov edx, r15d
mov r14d, 0x4e95
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
lea eax, [r14 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x1400752e0
mov word [rsp + 0x52], r15w
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007573a
mov dword [rsp + 0x60], 0x4ec44ec9
mov dword [rsp + 0x64], 0x4eff4ef2
mov dword [rsp + 0x68], 0x4ee94ef0
mov dword [rsp + 0x6c], 0x4eee4eef
mov dword [rsp + 0x70], 0x4ec24ee4
mov dword [rsp + 0x74], 0x4ec14ed2
mov dword [rsp + 0x78], 0x4eca4ec2
mov dword [rsp + 0x7c], 0x4eca4eca
mov dword [rbp - 0x80], 0x4efa4ec0
mov dword [rbp - 0x7c], 0x4ed14ef4
mov dword [rbp - 0x78], 0x4ede4eda
mov dword [rbp - 0x74], 0x4ec14ece
mov dword [rbp - 0x70], 0x4eed4ef1
mov dword [rbp - 0x6c], 0x4ec24eda
mov dword [rbp - 0x68], 0x4ed74ec3
mov dword [rbp - 0x64], 0x4ec04edd
mov dword [rbp - 0x60], 0x4ed94ef6
mov dword [rbp - 0x5c], 0x4ecc4ed9
mov dword [rbp - 0x58], 0x4ed54ecb
mov dword [rbp - 0x54], 0x4eef4ed7
mov dword [rbp - 0x50], 0x4eca4ed8
mov dword [rbp - 0x4c], 0x4e934ee3
mov dword [rbp - 0x48], 0x4eb04ea4
mov dword [rbp - 0x44], 0x4ead4eb5
mov dword [rbp - 0x40], 0x4ea34ea6
mov dword [rbp - 0x3c], 0x4e944eb4
xor eax, eax
mov word [rbp - 0x38], ax
mov edx, r15d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
lea eax, [r14 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0x34
jb 0x1400753e0
mov word [rbp - 0x38], r15w
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x140075410
mov rdx, qword [rdi + 0x10]
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rdx
cmp rax, rcx
jb 0x140075761
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x140075444
mov rax, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.140068460
nop
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x4ecf4ec6
mov dword [rsp + 0x64], 0x4ecc4ec4
mov dword [rsp + 0x68], 0x4ed74edc
mov dword [rsp + 0x6c], 0x4edf4ec7
mov dword [rsp + 0x70], 0x4eec4ee8
mov dword [rsp + 0x74], 0x4ec54eed
mov dword [rsp + 0x78], 0x4ed64ecf
mov dword [rsp + 0x7c], 0x4ecb4ee0
mov dword [rbp - 0x80], 0x4ed24ecb
mov dword [rbp - 0x7c], 0x4ec74ed5
mov dword [rbp - 0x78], 0x4ef94ec5
mov dword [rbp - 0x74], 0x4ed84ece
mov dword [rbp - 0x70], 0x4efd4ef1
mov dword [rbp - 0x6c], 0x4ec24eca
mov dword [rbp - 0x68], 0x4edb4ec7
mov dword [rbp - 0x64], 0x4ed14ed0
mov dword [rbp - 0x60], 0x4eea4ec6
xor eax, eax
mov word [rbp - 0x5c], ax
mov edx, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
lea eax, [r14 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0x22
jb 0x140075510
mov word [rbp - 0x5c], r15w
lea rax, [rsp + 0x60]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140075534
mov rax, qword [rdi + 0x10]
sub rsi, rax
cmp rsi, rbx
jb 0x140075767
cmp qword [rdi + 0x18], 8
jb 0x140075558
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140068460
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400755a3
cmp eax, 2
sete bl
jmp 0x1400756aa
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
movdqa xmm0, xmmword [0x1400bb0e0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400ba580]
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, r15d
nop dword [rax + rax]
movsxd rcx, r8d
lea rdx, [rsp + 0x40]
add rdx, rcx
lea ecx, [r8 - 0x6b]
xor byte [rdx], cl
inc r8d
cmp r8d, 0x1f
jb 0x1400755e0
mov byte [rsp + 0x5f], 0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14006df70
test ebx, ebx
je 0x140075685
movdqa xmm0, xmmword [0x1400baf20]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xc9e186c1
mov dword [rsp + 0x54], 0xc8cec6c0
mov dword [rsp + 0x58], 0xa58f8c
mov eax, r15d
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
add rdx, rcx
lea ecx, [rax - 0x6b]
xor byte [rdx], cl
inc eax
cmp eax, 0x1b
jb 0x140075640
mov byte [rsp + 0x5b], 0
lea rcx, [rsp + 0x40]
call fcn.14006df70
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x1400756aa
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x1400756a8
xor bl, bl
jmp 0x1400756aa
mov bl, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400756ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400756e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007576d
call fcn.140077488
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140075737
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007575b
call fcn.140077488
movzx eax, bl
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400870b4
int3
call fcn.140006b20
nop
call fcn.140006b20
nop
call fcn.1400870b4
int3