Function at 0x140006650
Capabilities:
Create process on windows
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14005a010]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor ebx, ebx
lea rcx, [rbp + 0x78]
call fcn.140006220
nop
lea rcx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rbp + 0xa0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.notepad
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400068a0
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x170423a2414dd4af
mov qword [rbp + 0x120], rax
movabs rax, 0x50fdaab308672560
mov qword [rbp + 0x128], rax
movabs rax, 0x9fc8d254071094f9
mov qword [rbp + 0x130], rax
movabs rax, 0xda596e9d7d2b750a
mov qword [rbp + 0x138], rax
movabs rax, 0x5b2451c73724a6eb
mov qword [rbp + 8], rax
movabs rax, 0x11ddcddd6103440f
mov qword [rbp + 0x10], rax
movabs rax, 0xece8e0747575e09f
mov qword [rbp + 0x18], rax
movabs rax, 0xda5363f91344166f
mov qword [rbp + 0x20], rax
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rbp + 0x18]
movaps xmmword [rbp + 0x50], xmm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
vzeroupper
call fcn.140006dd0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006310
test eax, eax
je 0x1400068b4
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140006828
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140006828
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140006851
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserRemoteRedrawScreen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005ac00], rax
test rax, rax
jne 0x140006899
lea rdx, str.SetupDriver_Error_r_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006dd0
lea rdx, str._r_n_r_nwill_try_to_terminate_driver__r_n_r_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006dd0
call fcn.140006510
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x140006890
lea rdx, str.terminate_driver_error_r_n
jmp 0x1400068ae
lea rdx, str.terminate_driver_success_r_n
jmp 0x1400068ae
mov ebx, 1
jmp 0x1400068b4
lea rdx, str.CreateProcess_Error_r_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006dd0
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1400068f5
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140046ebc
mov eax, ebx
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140046c10
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rbp
ret