Function at 0x180001e20
Capabilities:
Delete registry key
Set registry value
Unload driver

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x4f]
sub rsp, 0xc8
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
call fcn.180001730
mov rsi, rax
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x180001e5c
mov rcx, rsi
call fcn.180001800
test eax, eax
js 0x1800020d4
mov qword [rsp + 0xc0], rbx
lea r8, [rbp - 0x11]
mov qword [rsp + 0xb8], rdi
lea rcx, [rbp + 0x7f]
xorps xmm0, xmm0
mov qword [rsp + 0xb0], r14
xor r14d, r14d
mov dword [rbp - 0x11], 0x30
mov qword [rsp + 0x30], r14
lea rdi, [0x18001bba8]
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov edx, 0x3001f
mov qword [rsp + 0x20], r14
mov qword [rbp - 9], r14
mov dword [rbp + 7], 0xc0
mov qword [rbp - 1], rdi
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x180002091
mov rcx, qword [rsi + 8]
lea rdx, [rbp - 0x21]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov ebx, eax
test eax, eax
js 0x180002091
mov rcx, qword [rbp + 0x7f]
lea rax, str.Type
mov qword [rbp - 0x29], rax
lea r9d, [r14 + 4]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x31]
mov qword [rsp + 0xa8], r15
mov dword [rbp - 0x31], 0xa0008
mov dword [rbp + 0x67], 1
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180002089
mov rcx, qword [rbp + 0x7f]
lea rax, str.ErrorControl
mov qword [rbp - 0x29], rax
lea r9d, [r14 + 4]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x31]
mov dword [rbp - 0x31], 0x1a0018
mov dword [rbp + 0x6f], 1
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180002089
mov rcx, qword [rbp + 0x7f]
lea rax, str.Start
mov qword [rbp - 0x29], rax
lea r9d, [r14 + 4]
lea rax, [rbp + 0x77]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x31]
mov dword [rbp - 0x31], 0xc000a
mov dword [rbp + 0x77], 3
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180002089
mov rcx, qword [rbp + 0x7f]
lea rax, str.ImagePath
mov qword [rbp - 0x29], rax
lea r9d, [r14 + 2]
movzx eax, word [rbp - 0x21]
lea rdx, [rbp - 0x31]
add eax, 2
mov dword [rbp - 0x31], 0x140012
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x180002089
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ecx, 0x80000000
mov ebx, eax
add eax, ecx
test ecx, eax
jne 0x18000202b
cmp ebx, 0xc0000034
jne 0x180002089
lea r9, [0x18001bb98]
mov qword [rbp - 0x39], r14
mov edx, 0x10000
mov dword [rsp + 0x20], r14d
mov r8, 0xfffffffffffffffd
lea rcx, [rbp - 0x39]
call qword [sym.imp.ProcessHacker.exe_PhOpenKey]
mov edi, eax
test eax, eax
js 0x18000206d
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword [rbp - 0x39]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp edi, 0xc0000034
mov ebx, r14d
cmovne ebx, edi
test ebx, ebx
js 0x180002089
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov ebx, eax
mov r15, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x7f]
mov r14, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
test rcx, rcx
je 0x1800020b0
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rsi
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
cmp qword [rbp - 0x19], 0
je 0x1800020ca
lea rcx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xc8
pop rsi
pop rbp
ret