Function at 0x401f00
Capabilities:
Delete file
Terminate process

Disassembly:
push rdi
push rsi
push rbx
mov ebx, ecx
mov ecx, 1
sub rsp, 0xa0
call fcn.004011c0
lea rcx, str.WindowsD_v2.2_kat_lua.cz_2016_n
mov esi, eax
call sub.msvcrt.dll_puts
lea rcx, str.This_program_can_manipulate_various_restrictions_of_Windows:_n__Driver_signing__DSE__breaks_freeware_utilities__n__Process_protection__unkillable_processes__WinTCB__n__Most_common_methods_of_read_only_registry_locking_n
call sub.msvcrt.dll_puts
test ebx, ebx
jne 0x401f4b
lea rcx, str.usage:__n_nDriver_actions:_n_WinD64__I________________________install__disable_DSE_permanently_n_WinD64__U________________________uninstall__re_enable_DSE_permanently_n_WinD64__L__servicedriver.sys____load___or_re_load__if_present__a_driver_n_nMisc_actions:_n_WinD64__W________________________run_interactive_installer_n_WinD64__D__pid___________________de_protect_specified_PID_n_nRegistry_actions:_n_WinD64__RD__RegistryPath_______R_O_lock_Disable_n_WinD64__RE__RegistryPath_______R_O_lock_Enable_n_WinD64__ND__RegistryPath_______Notify_refresh_Disable_n_WinD64__NE__RegistryPath_______Notify_refresh_re_Enable_n_WinD64__CD_______________________Disable_global_registry_callbacks_n_WinD64__CE_______________________Enable_global_registry_callbacks
call sub.msvcrt.dll_puts
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.Entering_interactive_mode__invoke_WinD64____for_cmd_options__n
call sub.msvcrt.dll_puts
test esi, esi
je 0x401fb2
lea rcx, str.Detected_running_WinD64.
call sub.msvcrt.dll_puts
lea rcx, str.Do_you_wish_to_uninstall_it_
call fcn.00401370
test eax, eax
je 0x4020d2
lea rcx, str.Uninstalling...
call sub.msvcrt.dll_printf
xor ecx, ecx
call fcn.004011c0
mov ebx, eax
lea rcx, str.All_done__Press_enter_to_close...
call sub.msvcrt.dll_printf
nop dword [rax]
call sub.msvcrt.dll_getchar
cmp eax, 0xa
jne 0x401fa0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.WinD64_is_not_installed._Unsigned_drivers_will_not_load_at_boot.
call sub.msvcrt.dll_puts
lea rcx, str.Do_you_wish_to_install_it_system_wide_
call fcn.00401370
test eax, eax
je 0x4020d2
lea rcx, str.Were_going_to_patch_deep_into_windows_and_something_may_go_awry._nThe_changes_can_be_reversed_by_restoring_registry__part_of_restore_._nCreating_a_backup_you_can_boot_into_is_STRONGLY_advised.
call sub.msvcrt.dll_puts
lea rcx, str.Create_a_system_restore_point_
call fcn.00401370
test eax, eax
jne 0x402003
lea rcx, str.Installing...
call sub.msvcrt.dll_printf
call fcn.00401ea0
mov ebx, eax
jmp 0x401f90
lea rbx, [rsp + 0x30]
mov eax, esi
mov ecx, 0x1c
mov rdi, rbx
rep stosd dword [rdi], eax
lea rax, str.open
lea rcx, str.SHELL32
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x40], rax
lea rax, str.wind_restorepoint.vbs
mov qword [rsp + 0x48], rax
lea rax, [0x00403a2a]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.ShellExecuteExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rsi, rax
mov dword [rsp + 0x2c], 1
je 0x4020b2
lea rdx, [0x00403a43]
lea rcx, str.wind_restorepoint.vbs
call sub.msvcrt.dll_fopen
lea r8, str.Before_installing_WinD64
lea rdx, str.set_objGetObject__winmgmts:._rootdefault:Systemrestore___nobj.Enable_____nobj.CreateRestorePoint___s___0__100_nWScript.Quit_123
mov rdi, rax
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rcx, rbx
call rsi
test eax, eax
jne 0x4020ef
lea rcx, str.Restore_point_creation_failed__nCreate_restore_point_manualy_NOW_and_then_proceed_
call sub.msvcrt.dll_puts
lea rcx, str.Do_you_want_to_proceed_with_installation_
call fcn.00401370
test eax, eax
jne 0x401fee
lea rcx, str.Operation_cancelled__press_enter_to_close...
call sub.msvcrt.dll_printf
nop
call sub.msvcrt.dll_getchar
cmp eax, 0xa
jne 0x4020e0
jmp 0x401f40
lea rcx, str.Creating_restore_point...
call sub.msvcrt.dll_printf
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
call sub.msvcrt.dll_fflush
or edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x2c]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea rcx, str.wind_restorepoint.vbs
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [rsp + 0x2c], 0x7b
jne 0x4020b2
lea rcx, str.Done_
call sub.msvcrt.dll_puts
jmp 0x401fee