Function at 0x14003f6d0
Capabilities:
Delete registry key
Unload driver

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x1400f3680]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x58], r14d
xorps xmm0, xmm0
movups xmmword [r11 - 0x80], xmm0
mov qword [r11 - 0x70], r14
mov qword [r11 - 0x68], r14
lea r8d, [r14 + 0x34]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [r11 - 0x80]
call fcn.140004100
nop
mov rsi, qword [rdi + 0x10]
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14003f73e
mov r9, qword [rdi]
mov r15, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14003f794
lea rax, [r15 + rsi]
mov qword [rsp + 0xd8], rax
lea rbx, [rsp + 0xc8]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0xc8]
lea rcx, [rbx + r15]
mov r8, rsi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rsi]
mov byte [rax + r15], 0
jmp 0x14003f7af
mov qword [rsp + 0x20], rsi
movzx r8d, byte [rsp + 0x30]
mov rdx, rsi
lea rcx, [rsp + 0xc8]
call fcn.14000b440
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0xf
cmova rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0xe8]
call sub.ntdll.dll_RtlInitAnsiString
mov r8b, 1
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xf8]
call sub.ntdll.dll_RtlAnsiStringToUnicodeString
lea rcx, [rsp + 0xf8]
call sub.ntdll.dll_NtUnloadDriver
mov esi, eax
mov dword [rsp + 0x5c], eax
mov ecx, dword [0x1400fe8c0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400fd450], ecx
jg 0x14003fbc4
lea rbx, [0x1400fd430]
cmp qword [0x1400fd448], 0xf
cmova rbx, qword [0x1400fd430]
lea r8, [rsp + 0xc0]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14003f864
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14003f885
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0xa0]
call fcn.14003f5f0
nop
mov r13, rax
cmp qword [rax + 0x18], 7
jbe 0x14003f8a0
mov r13, qword [rax]
mov r12, qword [rax + 0x10]
call fcn.140096a9c
mov dword [rsp + 0xc0], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x58], 8
test r12, r12
je 0x14003f9cc
cmp r12, 0x7fffffff
ja 0x14003fc2c
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov ecx, eax
call fcn.140096b0c
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x14003fc36
movsxd rcx, esi
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
ja 0x14003f936
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], 0
jmp 0x14003f992
mov r15, rcx
sub r15, rdx
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rdx
cmp r15, rax
ja 0x14003f977
mov qword [rsp + 0x48], rcx
lea rbx, [rsp + 0x38]
cmp r8, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rdx
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.14009866e
mov byte [rbx + r15], 0
jmp 0x14003f992
mov byte [rsp + 0x20], 0
mov r9, r15
movzx r8d, byte [rsp + 0x30]
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14000b5d0
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov rdx, r13
mov ecx, dword [rsp + 0xc0]
call fcn.140096b0c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14003fc41
mov esi, dword [rsp + 0x5c]
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14003f9da
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140022d60
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.14003d2f0
nop
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
call fcn.140097150
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14003fc4b
lea rcx, [rsp + 0x80]
call fcn.140004b40
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003faaa
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003faa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003faa5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
movdqa xmm0, xmmword [0x1400a9990]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14003fafd
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003faf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003faf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0xa0]
call fcn.140004b40
nop
test esi, esi
setne r14b
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0xf
jbe 0x14003fb6a
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fb65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003fb65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
mov eax, r14d
jmp 0x14003fb97
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140097850
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x1400fd450]
call fcn.140097660
cmp dword [0x1400fd450], 0xffffffff
jne 0x14003f828
xorps xmm0, xmm0
movups xmmword [0x1400fd430], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x1400fd440], xmm1
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rbx, [0x1400fd430]
mov rcx, rbx
call fcn.140004100
lea rcx, [0x14009f770]
call fcn.140097d80
nop
lea rcx, [0x1400fd450]
call fcn.1400975f4
jmp 0x14003f82f
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.140021ff0
shr rsi, 0x20
mov ecx, esi
call fcn.14003f3b0
shr rcx, 0x20
call fcn.14003f3b0
nop
shr rdx, 0x20
lea r8, [rsp + 0x80]
lea rcx, [0x1400b0bc4]
call fcn.14003f340
int3