Function at 0x140001860
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
lea rdx, str.____Unloading_vulnerable_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005cd0
lea rdx, [0x140005ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400018c9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
lea rsi, [0x14001ebd0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rsi + r8], bl
jne 0x1400018f0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140005ac0
nop
lea rcx, [rsp + 0x30]
call fcn.14000bcc0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001952
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000194d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000194d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d0d4
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0xa0]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140001982
cmp byte [rbp + rax + 0x9f], 0x5c
jne 0x1400019ac
dec rax
cmp rax, 0x104
jae 0x140001d42
mov byte [rbp + rax + 0xa0], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp + 0xa0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400019d0
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.140005ac0
nop
mov r8d, 1
lea rdx, [0x14000f9b4]
lea rcx, [rsp + 0x30]
call fcn.140005c20
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140001a30
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140005c20
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001ab0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001aab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d0d4
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001b03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d0d4
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.140005360
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
movabs rax, 0x1c926b9d39431d5f
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x23d6df
sub rcx, rax
add ecx, 0x1649d
movsxd rsi, ecx
mov rcx, rsi
call fcn.14000d89c
mov rdi, rax
test rsi, rsi
je 0x140001bbb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r9d, ecx
mov byte [rbx + rdi], r9b
inc rbx
cmp rbx, rsi
jb 0x140001b88
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd r8, dword [rcx + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test byte [r8 + rax + 0x10], 6
lea rdx, str.____Error_dumping_shit_inside_the_disk
jne 0x140001bef
lea rdx, str.___Vul_driver_data_destroyed_before_unlink
call fcn.140005cd0
lea rdx, [0x140005ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x68]
call fcn.140005780
test rax, rax
jne 0x140001c2e
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call fcn.14000d0d4
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x68], rax
cmp qword [rbp + 0x18], 0
je 0x140001cac
mov rax, qword [rbp - 0x50]
lea rcx, [rbp + 8]
cmp qword [rax], rcx
jne 0x140001cac
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x18]
mov dword [rax], edx
cmp byte [rbp + 0x14], 0
je 0x140001cbb
lea rcx, [rbp - 0x68]
call fcn.140005780
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001d1a
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d0d4
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000d0b0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14000d47c
int3