Function at 0x140007660
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.1400097a4
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x14000be00]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:Windows_assemblydriver.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000ba80]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000ba88]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14000ba8c]
mov word [rdx + 0x1c], ax
mov byte [rdx + 0x1e], 0
mov r8d, 0x1c00
lea rdx, [0x14004fa00]
lea rcx, [rsp + 0x20]
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000771c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007717
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007717
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400097e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.1400097a4
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x14000be00]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:Windows_assemblydriver.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14000baa0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000baa8]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14000baac]
mov word [rdx + 0x1c], ax
mov byte [rdx + 0x1e], 0
mov r8d, 0x23a00
lea rdx, [0x14002c000]
lea rcx, [rsp + 0x20]
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400077d4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400097e0
lea rcx, str.C:Windows_assemblydriver.exe_C:Windows_assemblydriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Windows_assemblydriver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Windows_assemblydriver.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
or eax, 0xffffffff
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add al, 0x48
add ecx, eax
jmp 0x14001a1f1
cmp dword [rax + 4], ebx
je 0x14001a1f8
add rax, 0x10
cmp rax, rcx
jne 0x14001a1e8
xor eax, eax
test rax, rax
jne 0x14001a20f
call 0x1400179ac
mov dword [rax], 0x16
call 0x140017804
jmp 0x14001a1b8
lea rdi, [rax + 8]
js 0x14001a21b
xor r14b, r14b
mov byte [rsp + 0x70], r14b
jmp 0x14001a23f
xor r13d, r13d
test r14b, r14b
je 0x14001a251
lea ecx, [r13 + 3]
call 0x1400173ac
nop
mov rsi, qword [rdi]
test r14b, r14b
je 0x14001a26b
mov rax, qword [0x140029400]
mov ecx, eax
and ecx, 0x3f
xor rsi, rax
ror rsi, cl
cmp rsi, 1
je 0x14001a300
test rsi, rsi
je 0x14001a367
mov r12d, 0x910
cmp ebx, 0xb
or esi, dword [rdi + 0x35]
bt r12d, ebx
jae 0x14001a2be
mov r13, qword [r15 + 8]
mov qword [rsp + 0x30], r13
insb byte [rdi], dx
and al, 0x30
and qword [r15 + 8], 0
cmp ebx, 8
jne 0x14001a2f4
call 0x1400171b0
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], eax
call 0x1400171b0
mov dword [rax + 0x10], 0x8c
cmp ebx, 8
or byte [rbp + 0x31], dh
mov rax, qword [0x1400208a8]
shl rax, 4
add rax, qword [r15]
mov rcx, qword [0x1400208b0]
shl rcx, 4
add rcx, rax
mov qword [rsp + 0x28], rax
and al, 0x28
cmp rax, rcx
je 0x14001a306
and qword [rax + 8], 0
add rax, 0x10
jmp 0x14001a2df
mov rax, qword [0x140029400]
mov qword [rdi], rax
jmp 0x14001a306
mov r12d, 0x910
test r14b, r14b
je 0x14001a315
mov ecx, 3
call 0x140017400
cmp rsi, 1
jne 0x14001a322
xor eax, eax
jmp 0x14001a1bb
cmp ebx, 8
jne 0x14001a33b
call 0x1400171b0
mov edx, dword [rax + 0x10]
mov ecx, ebx
mov rax, rsi
call 0x14001e3e0
jmp 0x14001a345
mov ecx, ebx
mov rax, rsi
call 0x14001e3e0
cmp ebx, 0xb
ja 0x14001a31b
bt r12d, ebx
jae 0x14001a31b
mov qword [r15 + 8], r13
cmp ebx, 8
jne 0x14001a31b
call 0x1400171b0
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x10], ecx
jmp 0x14001a31b
test r14b, r14b
je 0x14001a374
lea ecx, [rsi + 3]
call 0x140017400
mov ecx, 3
call 0x14001619c
nop
int3