Function at 0x140002040
Capabilities:
Delete file
Delete registry key
Unload driver
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp ecx, 3
jl 0x140002297
mov r8, qword [rdx + 8]
xor ebp, ebp
mov rdi, qword [rdx + 0x10]
mov ecx, ebp
lea rdx, str.LOAD
nop
movzx eax, word [r8 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140002097
cmp rcx, 5
jne 0x140002080
jmp 0x1400020ba
mov rcx, rbp
lea rdx, str.load
movzx eax, word [r8 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14000215d
cmp rcx, 5
jne 0x1400020a1
mov qword [rsp + 0x30], rbp
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x10000000
mov dword [rsp + 0x44], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x140002136
cmp rsi, 0xffffffffffffffff
je 0x140002297
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbp
mov r8d, 0x6650
lea rdx, [0x140006040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140002297
mov rdx, rdi
call fcn.140001c20
test eax, eax
js 0x140002297
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
jmp 0x140002299
mov rcx, rbp
lea rdx, str.UNLOAD
nop word [rax + rax]
movzx eax, word [r8 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140002187
cmp rcx, 7
jne 0x140002170
jmp 0x1400021aa
mov rcx, rbp
lea rdx, str.unload
movzx eax, word [r8 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140002297
cmp rcx, 7
jne 0x140002191
xor r8d, r8d
lea r9, [rsp + 0x40]
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test eax, eax
js 0x140002297
mov ebx, 0x34
lea rsi, [0x14000cea0]
lea r8, str.RegistryMachineSystemCurrentControlSetServices_
mov rcx, rsi
lea edx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx ecx, word [rdi]
mov rdx, rdi
test cx, cx
je 0x14000223b
add rdx, 2
cmp cx, 0x5c
mov rax, rdx
cmovne rax, rdi
movzx ecx, word [rdx]
mov rdi, rax
test cx, cx
jne 0x1400021f0
movzx ecx, word [rax]
test cx, cx
je 0x14000223b
lea rax, [0x14000cf08]
nop dword [rax]
cmp cx, 0x2e
je 0x14000223b
add rdi, 2
mov word [rax], cx
inc ebx
add rax, 2
movzx ecx, word [rdi]
test cx, cx
jne 0x140002220
movsxd rax, ebx
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov word [rsi + rax*2], bp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
test eax, eax
js 0x140002275
lea rdx, [0x14000cec4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
movzx edx, byte [rsp + 0x40]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test ebx, ebx
js 0x140002297
mov eax, 1
jmp 0x140002299
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400022d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret