Function at 0x140002a30
Capabilities:
Delete registry key
Encode data using xor
Get common file path
Unload driver
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x3f8], rbx
mov r15, rdx
movsxd rsi, ecx
xor ecx, ecx
call fcn.14000e020
mov rcx, rax
call fcn.14000ad5c
mov dword [rsp + 0x40], 0x445a4252
mov dword [rsp + 0x44], 0x191a4f4e
mov dword [rsp + 0x48], 0x42495c00
mov word [rsp + 0x4c], pe_nt_image_headers64
xor r13d, r13d
mov ecx, r13d
nop word [rax + rax]
lea eax, [rcx + 0x26]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x140002aa0
mov byte [rsp + 0x4d], r13b
movdqa xmm0, xmmword [0x14004af40]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], r13b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140003190
nop
movdqa xmm0, xmmword [0x14004af60]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14004af50]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x60], pe_nt_image_headers64
mov rcx, r13
nop
lea eax, [rcx + 0x26]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x20
jb 0x140002b00
mov byte [rsp + 0x61], 0
lea rdx, [rsp + 0x40]
lea rcx, [0x140062870]
call fcn.140003190
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x70]
call fcn.140008810
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
jbe 0x140002c19
movdqa xmm0, xmmword [0x14004af70]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x5c4c1742
mov dword [rsp + 0x54], 0x4d1c4b57
mov dword [rsp + 0x58], 0x284b5f
mov byte [rsp + 0x5c], 1
mov rcx, r13
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x26]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1b
jb 0x140002b90
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x40]
call fcn.1400036d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140003550
movzx edx, al
mov rcx, rbx
call fcn.140003b90
mov rcx, rbx
call fcn.1400033a0
mov dword [rbp + 0x308], 0x5a5d4656
mov word [rbp + 0x30c], 0x4f
mov byte [rbp + 0x30e], 1
mov rcx, r13
lea eax, [rcx + 0x26]
xor byte [rbp + rcx + 0x308], al
inc rcx
cmp rcx, 5
jb 0x140002bf3
mov byte [rbp + 0x30e], 0
lea rcx, [rbp + 0x308]
call fcn.14000ddb8
lea rax, [rbp - 0x70]
mov rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp byte [rax + rcx], 0
jne 0x140002c24
lea rax, [rbp - 0x70]
cmp byte [rcx + rax - 1], 0x5c
jne 0x140002c3e
mov byte [rcx + rax - 1], 0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x300]
mov r8d, 0xf780
lea rdx, [0x140053090]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000ad30
mov r8d, eax
mov eax, 0xd1b1b919
imul r8d
add edx, r8d
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2711
sub r8d, ecx
mov eax, r8d
cdq
mov edi, eax
xor edi, edx
sub edi, edx
lea rcx, [0x140062870]
cmp qword [0x140062888], 0x10
cmovae rcx, qword [0x140062870]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x300]
lea r8d, [rdi + 0x2400]
lea rdx, [0x140050c90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, r13d
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rbp + 0xa0]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x140002d60
movups xmm0, xmmword [str._termdd64.sys]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1400393a0]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x1400393a8]
mov dword [rcx + 0x18], eax
mov r12, rsi
test esi, esi
jle 0x140002fd3
mov rsi, r13
mov ebx, 1
lea r13, [0x140064a90]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x1400393c0]
mov rcx, qword [r15 + rsi*8]
call fcn.14000b054
test eax, eax
cmove r14d, ebx
lea rdx, [0x1400393c8]
mov rcx, qword [r15 + rsi*8]
call fcn.14000b054
test eax, eax
jne 0x140002e14
mov r8d, r14d
mov rdx, qword [r15 + rsi*8 + 8]
lea rcx, [rbp + 0xa0]
call fcn.140002550
test al, al
je 0x140002e03
lea rcx, str.___Install_driver_successfully._n
call fcn.1400011f0
jmp 0x140002fc7
lea rcx, str.____Failed_to_installing_driver._n
call fcn.1400011f0
jmp 0x140002fc7
lea rdx, [0x14003941c]
mov rcx, qword [r15 + rsi*8]
call fcn.14000b054
test eax, eax
jne 0x140002fc7
mov rdi, qword [r15 + rsi*8 + 8]
lea r9, [rbp + 0x2f0]
xor r8d, r8d
mov dl, 1
lea ecx, [rax + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
js 0x140002fb6
test rdi, rdi
je 0x140002e70
mov rdx, rdi
mov rcx, r13
call fcn.1400022b0
mov r8d, 0x34
movaps xmm0, xmmword [str.RegistryMachineSYSTEMCurrentControlSetServices_]
movaps xmmword [0x140064a90], xmm0
movaps xmm1, xmmword [0x140039250]
movaps xmmword [0x140064aa0], xmm1
movaps xmm0, xmmword [0x140039260]
movaps xmmword [0x140064ab0], xmm0
movaps xmm1, xmmword [0x140039270]
movaps xmmword [0x140064ac0], xmm1
movaps xmm0, xmmword [0x140039280]
movaps xmmword [0x140064ad0], xmm0
movaps xmm1, xmmword [0x140039290]
movaps xmmword [0x140064ae0], xmm1
movsd xmm0, qword [0x1400392a0]
movsd qword [0x140064af0], xmm0
movzx eax, word [0x1400392a8]
mov word [0x140064af8], ax
mov rdx, rdi
movzx eax, word [rdi]
test ax, ax
je 0x140002f3d
nop dword [rax]
nop word [rax + rax]
add rdx, 2
mov rcx, rdx
cmp ax, 0x5c
cmovne rcx, rdi
mov rdi, rcx
movzx eax, word [rdx]
test ax, ax
jne 0x140002f00
movzx eax, word [rcx]
test ax, ax
je 0x140002f3d
cmp ax, 0x2e
je 0x140002f3d
mov word [r13 + r8*2], ax
inc r8
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x140002f22
xor eax, eax
mov word [r13 + r8*2], ax
mov rdx, r13
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, qword [rsp + 0x48]
lea rcx, str.Unload____s_n
call fcn.140001190
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
lea rdx, [0x140064ab4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
js 0x140002fb6
lea rdx, [0x140064ab4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rcx, str.___Uninstall_driver_successfully._n
jmp 0x140002fbd
lea rcx, str.____Failed_to_uninstall_drivers._n
call fcn.1400011f0
mov ebx, 1
inc rsi
cmp rsi, r12
jl 0x140002db0
lea rcx, str.termdd64.sys
call fcn.14000b33c
lea rcx, str.vmk.sys
call fcn.14000b33c
lea rcx, [0x140062870]
call fcn.140003050
mov rcx, rax
call fcn.14000b33c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14000ad24
int3