Function at 0x1400b3ebf
Capabilities:
Create process on windows
Execute command
Terminate process

Disassembly:
jmp 0x140206720
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x778
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x798]
mov rax, qword [0x1405424c0]
xor rax, rbp
mov qword [rbp + 0x718], rax
lea rcx, [0x14055d54f]
call fcn.1400b5fb2
nop
mov rdx, qword [rbp + 0x748]
mov rcx, qword [rbp + 0x740]
call fcn.1400b5b02
mov rcx, qword [rbp + 0x740]
mov dword [rcx], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..driver
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbp + 0x740]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x740]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x140206c0b
lea rdx, str.Driver_Not_Found..
lea rcx, [rbp + 0x508]
call fcn.1400b3fc8
nop
mov edx, 0x32
lea rcx, [rbp + 0x508]
call fcn.1400b3c49
nop
lea rcx, [rbp + 0x508]
call fcn.1400b58d2
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str.Loading_driver..
lea rcx, [rbp + 0x548]
call fcn.1400b3fc8
nop
mov edx, 0x32
lea rcx, [rbp + 0x548]
call fcn.1400b3c49
nop
lea rcx, [rbp + 0x548]
call fcn.1400b58d2
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 8]
call fcn.1400b5fc1
nop
lea rcx, [rbp + 8]
call fcn.1400b4fe5
movzx eax, al
test eax, eax
je 0x14020688e
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_get_executable_directory.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rdx, str.driver
lea rcx, [rbp + 0x48]
call fcn.1400b3fc8
nop
lea rdx, str.driver.sys
lea rcx, [rbp + 0x88]
call fcn.1400b3fc8
nop
lea rdx, str.mapper.exe
lea rcx, [rbp + 0xc8]
call fcn.1400b3fc8
nop
lea r8, [0x1402787f4]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x588]
call fcn.1400b599a
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbp + 0x700], rax
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x108]
call fcn.1400b627d
nop
lea rcx, [rbp + 0x588]
call fcn.1400b58d2
nop
lea r8, [0x1402787f4]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x5c8]
call fcn.1400b599a
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbp + 0x700], rax
lea r8, [rbp + 0x88]
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x148]
call fcn.1400b627d
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400b58d2
nop
lea r8, [0x1402787f4]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x608]
call fcn.1400b599a
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbp + 0x700], rax
lea r8, [rbp + 0xc8]
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x188]
call fcn.1400b627d
nop
lea rcx, [rbp + 0x608]
call fcn.1400b58d2
nop
lea r8, [0x1402787fc]
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x648]
call fcn.1400b599a
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbp + 0x700], rax
lea r8, [rbp + 0x148]
mov rdx, qword [rbp + 0x700]
lea rcx, [rbp + 0x688]
call fcn.1400b627d
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov qword [rbp + 0x710], rax
lea r8, [0x1402787f8]
mov rdx, qword [rbp + 0x710]
lea rcx, [rbp + 0x1c8]
call fcn.1400b4bfd
nop
lea rcx, [rbp + 0x688]
call fcn.1400b58d2
nop
lea rcx, [rbp + 0x648]
call fcn.1400b58d2
nop
mov dword [rbp + 0x210], 0x68
lea rax, [rbp + 0x218]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0x298]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rbp + 0x1c8]
call fcn.1400b4004
lea rcx, [rbp + 0x298]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140206b15
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140206b32
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_execute_mapper.exe.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [0x140278850]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
mov edx, 0x64
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rdx, str.Driver_Has_Loaded_Successfully_
lea rcx, [rbp + 0x6c8]
call fcn.1400b3fc8
nop
mov edx, 0x32
lea rcx, [rbp + 0x6c8]
call fcn.1400b3c49
nop
lea rcx, [rbp + 0x6c8]
call fcn.1400b58d2
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.1400b4a13
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rbp + 0x740]
mov edx, dword [rax]
mov rax, qword [rbp + 0x740]
mov rcx, qword [rax + 8]
call fcn.1400b31d1
movzx eax, al
test eax, eax
jne 0x140206c74
lea rdx, str.Failed_to_attach_to_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400b3532
mov qword [rbp + 0x6f8], rax
lea rdx, [0x1400b3203]
mov rcx, qword [rbp + 0x6f8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rax, qword [rbp + 0x740]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140276260]
call fcn.1400b57c4
mov rax, rdi
mov rcx, qword [rbp + 0x718]
xor rcx, rbp
call fcn.1400b4707
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret