Function at 0x1402558f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x18f0
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x18e0], rax
call fcn.140254630
lea rcx, [rsp + 0xe1]
xor edx, edx
mov r8d, 0x3ff
mov ebx, 1
mov byte [rsp + 0xe0], 0
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x14e1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x14e0], 0
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x14e0]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x14e0]
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
je 0x14025598d
mov byte [rax], 0
call fcn.1400494c0
mov rdi, rax
mov rax, qword [rax]
mov rcx, rdi
call qword [rax + 8]
xor esi, esi
test eax, eax
jne 0x1402559a8
mov ebx, esi
jmp 0x1402559b1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, rsi
nop
nop
nop
movzx eax, byte [rsp + rcx + 0x14e0]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0xdf], al
jne 0x1402559c0
test ebx, ebx
jne 0x140255e76
lea rcx, [rsp + 0x8e1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x8e0], sil
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xce1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xce0], sil
call sub.ntdll.dll_memset
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x8e0]
lea rdx, [rsp + 0xe0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140255a40
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xce0]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140255a70
call fcn.140225970
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x8e0]
test eax, eax
je 0x140255aec
xor eax, eax
repne scasb al, byte [rdi]
mov rax, qword [str.SetupGreen64.exe]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x140376510]
mov qword [rdi + 7], rax
movzx eax, word [0x140376518]
mov word [rdi + 0xf], ax
xor eax, eax
lea rdi, [rsp + 0xce0]
repne scasb al, byte [rdi]
mov rax, qword [str.LoadDrv_x64.exe]
mov qword [rdi - 1], rax
mov rax, qword [0x140376528]
mov qword [rdi + 7], rax
movzx eax, byte [0x140376530]
mov byte [rdi + 0xf], al
jmp 0x140255b4c
xor eax, eax
repne scasb al, byte [rdi]
mov rax, qword [str.SetupGreen32.exe]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x140376540]
mov qword [rdi + 7], rax
movzx eax, word [0x140376548]
mov word [rdi + 0xf], ax
xor eax, eax
lea rdi, [rsp + 0xce0]
repne scasb al, byte [rdi]
mov rax, qword [str.LoadDrv_Win32.exe]
mov qword [rdi - 1], rax
mov rax, qword [0x140376558]
mov qword [rdi + 7], rax
movzx eax, word [0x140376560]
mov word [rdi + 0xf], ax
movzx eax, byte [0x140376562]
mov byte [rdi + 0x11], al
lea rcx, [rsp + 0x4e1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x4e0], sil
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x10e1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + Ordinal_4327], sil
call sub.ntdll.dll_memset
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x4e0]
lea rdx, [rsp + 0xe0]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140255ba0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x10e0]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140255bd0
call fcn.140225970
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x4e0]
test eax, eax
je 0x140255c53
xor eax, eax
repne scasb al, byte [rdi]
mov rax, qword [str.SetupGreen64.exe__u]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x140376570]
mov qword [rdi + 7], rax
mov eax, dword [0x140376578]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x14037657c]
mov byte [rdi + 0x13], al
xor eax, eax
lea rdi, [rsp + 0x10e0]
repne scasb al, byte [rdi]
mov rax, qword [str.LoadDrv_x64.exe__u]
mov qword [rdi - 1], rax
mov rax, qword [0x140376588]
mov qword [rdi + 7], rax
mov eax, dword [0x140376590]
mov dword [rdi + 0xf], eax
jmp 0x140255cba
xor eax, eax
repne scasb al, byte [rdi]
mov rax, qword [str.SetupGreen32.exe__u]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x1403765a0]
mov qword [rdi + 7], rax
mov eax, dword [0x1403765a8]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x1403765ac]
mov byte [rdi + 0x13], al
xor eax, eax
lea rdi, [rsp + 0x10e0]
repne scasb al, byte [rdi]
mov rax, qword [str.LoadDrv_Win32.exe__u]
mov qword [rdi - 1], rax
mov rax, qword [0x1403765b8]
mov qword [rdi + 7], rax
mov eax, dword [0x1403765c0]
mov dword [rdi + 0xf], eax
movzx eax, word [0x1403765c4]
mov word [rdi + 0x13], ax
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call sub.ntdll.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x4e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
mov dword [rsp + 0x20], esi
mov word [rsp + 0xb0], si
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x10e0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x8e0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rdx, [rsp + 0xce0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x18e0]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x18f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret