Function at 0x12bec
Capabilities:
Create device object
Delete registry key
Unload driver

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
xor esi, esi
mov rbx, rcx
lea rdx, [0x00028fb0]
lea ebp, [rsi + 4]
lea rcx, [rax - 0x70]
mov qword [rsp + 0x40], rsi
mov dword [rax + 0x10], ebp
mov qword [rax + 0x18], rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x40]
lea edx, [rbp + 0x7c]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, esi
jl 0x12e3f
mov rax, qword [rsp + 0xe0]
mov rdi, qword [rax + 8]
cmp rdi, rsi
je 0x12e2d
mov rax, qword [rdi + 0x30]
mov qword [0x0002acb8], rdi
cmp rax, rsi
je 0x12dcf
cmp qword [rax + 0x20], rsi
je 0x12dcf
mov edx, 0x400
xor ecx, ecx
mov word [rsp + 0x48], si
mov word [rsp + 0x4a], dx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x50], rax
cmp rax, rsi
je 0x12dcf
movzx r8d, word [rsp + 0x4a]
xor edx, edx
mov rcx, rax
call fcn.00024250
lea rdx, [0x00029030]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov rdx, qword [rdi + 0x30]
lea rcx, [rsp + 0x48]
add rdx, 0x18
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [0x00024400]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0xd8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
mov r8d, ebp
mov dword [rsp + 0x20], ebp
call fcn.000128dc
cmp eax, esi
jge 0x12dbd
lea ecx, [rsi + 0x1e]
call qword [sym.imp.HAL.dll_KeStallExecutionProcessor]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0xe8]
mov edx, 0xf003f
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x90], 0x240
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x12d89
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0xe8]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, esi
jge 0x12dbd
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwUnloadDriver]
mov ecx, 0x1e
call qword [sym.imp.HAL.dll_KeStallExecutionProcessor]
lea r9, [rsp + 0xd8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
mov r8d, ebp
mov dword [rsp + 0x20], ebp
call fcn.000128dc
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x12dcf
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rdi + 8]
mov qword [0x0002acc8], rcx
cmp rcx, rsi
je 0x12e2d
cmp dword [rcx + 0x48], 0x12
je 0x12dee
mov rcx, qword [rcx + 0x10]
cmp rcx, rsi
jne 0x12ddf
mov qword [0x0002acc8], rcx
cmp rcx, rsi
je 0x12e2d
cmp dword [rcx + 0x48], 0x12
jne 0x12e2d
call sub.ntoskrnl.exe_IoGetLowerDeviceObject
mov qword [0x0002acd0], rax
cmp rax, rsi
je 0x12e2d
mov rax, qword [rdi + 0xe8]
mov qword [0x0002acc0], rax
lea rax, [0x00012b84]
mov qword [rdi + 0xe8], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x12e90
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x12e90
lea rax, [0x0002aca0]
lea r8, [rsp + 0x58]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, esi
jl 0x12e90
lea rdx, [0x000291b0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret