Function at 0x140002110
Capabilities:
Delete file
Delete registry key
Unload driver
Write file on windows

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp ecx, 2
jge 0x140002148
lea rcx, str.Invalid_arguments._Usage:_GDRVLoader.exe_TargetDriver.sys_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002390
add rsp, 0x78
ret
mov qword [rsp + 0x80], rbx
lea rcx, [0x140004a30]
mov qword [rsp + 0x70], rdi
mov edi, 0xc0000001
call fcn.140001010
lea rdx, [rsp + 0x58]
lea rcx, [0x140004a48]
call fcn.1400020c0
xor ebx, ebx
mov qword [rsp + 0x88], rsi
mov ecx, ebx
lea rdx, [rsp + 0x58]
lea r8, [0x140004a4c]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400021a6
cmp rcx, 4
jne 0x140002190
jmp 0x1400021d8
mov rcx, rbx
lea rdx, [rsp + 0x58]
lea r8, [0x140004a50]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400022ae
cmp rcx, 4
jne 0x1400021c0
mov qword [rsp + 0x30], rbx
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x10000000
mov dword [rsp + 0x44], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000224c
cmp rsi, 0xffffffffffffffff
je 0x140002274
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbx
mov r8d, 0x6650
lea rdx, [0x140006040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140002274
call fcn.140001d60
mov edi, eax
test eax, eax
js 0x140002263
lea rcx, [0x140004a58]
call fcn.140001010
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
jns 0x140002282
mov edx, edi
lea rcx, str.Error:__08X_n
call fcn.140001010
mov rdi, qword [rsp + 0x70]
mov eax, 1
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002390
add rsp, 0x78
ret
movzx edx, byte [rsp + 0x58]
movzx eax, byte [rsp + 0x5a]
movzx ecx, byte [rsp + 0x59]
cmp dl, 0x4e
jne 0x1400022cb
cmp cl, 0x6f
jne 0x1400022cb
test al, al
je 0x1400022d9
cmp dl, 0x6e
jne 0x140002274
cmp cl, 0x6f
jne 0x140002274
test al, al
jne 0x140002274
mov r8d, dword [0x14000ce98]
xor r9d, r9d
call fcn.140001a80
test eax, eax
jns 0x1400022fc
mov edx, eax
lea rcx, str.WARNING:_failed_to_re_enable_DSE_through_Gigabyte_loader_driver:__08X_n
call fcn.140001010
jmp 0x140002308
lea rcx, str.Successfully_re_enabled_DSE._n
call fcn.140001010
lea rdx, [0x14000cea0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
lea rdx, [0x14000cec4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor r8d, r8d
lea r9, [rsp + 0x40]
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edi, eax
test eax, eax
js 0x140002274
movzx edx, byte [rsp + 0x40]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rcx, str.Driver_unloaded_successfully_n
call fcn.140001010
jmp 0x140002282