Function at 0x140074b50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Install driver
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rbx, rcx
lea rcx, [rbp + 0x70]
call fcn.14006e1c0
nop
mov dword [rsp + 0x30], 0x9e9f9e96
mov dword [rsp + 0x34], 0x9e9c9e94
mov dword [rsp + 0x38], 0x9e879e8c
mov dword [rsp + 0x3c], 0x9e8f9e97
mov dword [rsp + 0x40], 0x9ebc9eb8
mov dword [rsp + 0x44], 0x9eb59ebd
mov dword [rsp + 0x48], 0x9ea69ebf
mov dword [rsp + 0x4c], 0x9ebb9e90
mov dword [rsp + 0x50], 0x9ea29ebb
mov dword [rsp + 0x54], 0x9eb79ea5
mov dword [rsp + 0x58], 0x9e899eb5
mov dword [rsp + 0x5c], 0x9ea89ebe
mov dword [rsp + 0x60], 0x9e8d9e81
mov dword [rsp + 0x64], 0x9e929eba
mov dword [rsp + 0x68], 0x9e8b9e97
mov dword [rsp + 0x6c], 0x9e819e80
mov dword [rsp + 0x70], 0x9eba9e96
xor eax, eax
mov word [rsp + 0x74], ax
lea rcx, [rsp + 0x30]
call fcn.1400758f0
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140075930
nop
mov dword [rbp - 0x34], 0x9ef99e99
mov dword [rbp - 0x30], 0x9e949ef8
xor eax, eax
mov word [rbp - 0x2c], ax
lea rcx, [rbp - 0x34]
call fcn.1400758b0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x50]
call fcn.140075930
nop
lea rcx, [rbp + 0xb0]
call fcn.140060d70
lea r8, [rbp + 0x120]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
je 0x140074cdb
movdqa xmm0, xmmword [0x1400baef0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xaab2a5f5
mov dword [rsp + 0x44], 0xb9b8b3af
mov dword [rsp + 0x48], 0x99bab5fd
mov word [rsp + 0x4c], 0xeb
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x3b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x1d
jb 0x140074cb0
mov byte [rsp + 0x4d], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
jmp 0x14007531e
mov eax, dword [rbp + 0x60]
lea edi, [rax + rax]
lea rcx, [rbp + 0x50]
call fcn.140060d70
mov rbx, rax
mov dword [rsp + 0x30], 0x9eab9e8c
mov dword [rsp + 0x34], 0x9eaf9ea6
mov dword [rsp + 0x38], 0x9e9a9eac
mov dword [rsp + 0x3c], 0x9eb89eaa
mov dword [rsp + 0x40], 0x9ea5
lea rcx, [rsp + 0x30]
call fcn.140060910
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
je 0x140074dbb
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400baef0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bab60]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x9a93958c
mov dword [rsp + 0x54], 0x8d9dca90
mov dword [rsp + 0x58], 0xfa8a9b81
xor eax, eax
mov byte [rsp + 0x5c], al
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x3b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x2c
jb 0x140074d90
mov byte [rsp + 0x5c], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
jmp 0x14007531e
mov dword [rsp + 0x30], 0x9ebf9e91
mov dword [rsp + 0x34], 0x9ead9eb7
xor eax, eax
mov word [rsp + 0x38], ax
lea rcx, [rsp + 0x30]
call fcn.1400758b0
mov dword [rsp + 0x28], 4
lea rcx, [0x1400ba234]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
mov rcx, qword [rbp + 0x120]
test eax, eax
je 0x140074e7b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400baef0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bad10]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x848690c5
mov dword [rsp + 0x54], 0xe18f9c
xor ebx, ebx
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x3b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x27
jb 0x140074e50
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
jmp 0x14007531e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x30], 0x9eb29eab
mov dword [rsp + 0x34], 0x9ea49ea3
mov dword [rsp + 0x38], 0x9ee49ea5
mov dword [rsp + 0x3c], 0x9ea09eaf
mov dword [rsp + 0x40], 0x9ea1
lea rcx, [rsp + 0x30]
call fcn.140060910
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140074ec9
lea edi, [rax + 1]
jmp 0x14007531e
lea r9, [rbp + 0x118]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edi, eax
movdqa xmm0, xmmword [0x1400bb070]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bad00]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xedbec0
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x3b]
xor byte [rcx], al
inc edx
cmp edx, 0x23
jb 0x140074f10
mov byte [rsp + 0x53], bl
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006e010
test edi, edi
jns 0x140074fca
movdqa xmm0, xmmword [0x1400bb080]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bafc0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bae10]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400baab0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400baad0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400baa50]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x6554951
mov word [rbp - 0x6c], 0x23
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x3b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x65
jb 0x140074fa0
mov byte [rbp - 0x6b], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
jmp 0x14007531e
mov dword [rbp - 0x2a], 0x9e949e99
mov dword [rbp - 0x26], 0x9eaf9ea2
mov dword [rbp - 0x22], 0x9eb99ea0
mov dword [rbp - 0x1e], 0x9ebe9ebf
mov dword [rbp - 0x1a], 0x9e929eb4
mov dword [rbp - 0x16], 0x9eb19e82
mov dword [rbp - 0x12], 0x9eba9eb2
mov dword [rbp - 0xe], 0x9eba9eba
mov dword [rbp - 0xa], 0x9e8a9eb0
mov dword [rbp - 6], 0x9ea19e84
mov dword [rbp - 2], 0x9eae9eaa
mov dword [rbp + 2], 0x9eb19ebe
mov dword [rbp + 6], 0x9e9d9e81
mov dword [rbp + 0xa], 0x9e929eaa
mov dword [rbp + 0xe], 0x9e879e93
mov dword [rbp + 0x12], 0x9e909e8d
mov dword [rbp + 0x16], 0x9e899ea6
mov dword [rbp + 0x1a], 0x9e9c9e89
mov dword [rbp + 0x1e], 0x9e859e9b
mov dword [rbp + 0x22], 0x9ebf9e87
mov dword [rbp + 0x26], 0x9e9a9e88
mov dword [rbp + 0x2a], 0x9ea39eb3
mov dword [rbp + 0x2e], 0x9e809e94
mov dword [rbp + 0x32], 0x9e9d9e85
mov dword [rbp + 0x36], 0x9e939e96
mov dword [rbp + 0x3a], 0x9ea49e84
xor eax, eax
mov word [rbp + 0x3e], ax
lea rcx, [rbp - 0x2a]
call fcn.140075870
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.140075930
nop
lea rcx, [rbp + 0x90]
call fcn.140060d70
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov edi, eax
movdqa xmm0, xmmword [0x1400bae50]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xb9a385f5
mov dword [rsp + 0x44], 0xfca8afad
mov dword [rsp + 0x48], 0xb8faa6ed
mov word [rsp + 0x4c], 0xeb
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x3b]
xor byte [rcx], al
inc edx
cmp edx, 0x1d
jb 0x140075100
mov byte [rsp + 0x4d], 0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006e010
cmp edi, 0xc0000603
jne 0x140075308
movdqa xmm0, xmmword [0x1400baf90]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb0e0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bacf0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400ba620]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400ba640]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400baa20]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400baa30]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400ba630]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [str._89_9l:_8q_]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x3c773a30
mov dword [rbp - 0x3c], 0x392d332b
mov word [rbp - 0x38], 0x542f
xor eax, eax
mov byte [rbp - 0x36], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x3b]
xor byte [rcx], al
inc edx
cmp edx, 0x9a
jb 0x1400751d0
mov byte [rbp - 0x36], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
movdqa xmm0, xmmword [0x1400bad40]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400babd0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bacd0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400baa90]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400baa80]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400baa60]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400baa70]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x3d515c
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x3b]
xor byte [rcx], al
inc edx
cmp edx, 0x73
jb 0x140075270
mov byte [rbp - 0x5d], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
movdqa xmm0, xmmword [0x1400baf80]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bac40]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bace0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x8cd79287
mov dword [rsp + 0x64], 0xf6cbda96
xor eax, eax
mov byte [rsp + 0x68], al
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x3b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x38
jb 0x1400752e0
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call fcn.14006e010
jmp 0x140075311
cmp edi, 0xc000010e
cmove edi, ebx
lea rcx, [rbp + 0x90]
call fcn.140060b20
nop
lea rcx, [rbp + 0x50]
call fcn.140060b20
nop
lea rcx, [rbp + 0xb0]
call fcn.140060b20
nop
lea rcx, [rbp + 0x70]
call fcn.140060b20
mov eax, edi
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret