Function at 0x140011520
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bbe60
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_30]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32NtVuln.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400e4b20]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400e4b28]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400e4b2c]
mov word [rdx + 0x1c], ax
mov byte [rdx + 0x1e], 0
mov r8d, 0x4190
lea rdx, [0x1426655d0]
lea rcx, [rsp + 0x20]
call fcn.140011370
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400115dc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400115d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400115d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbe9c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bbe60
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_30]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32NtVuln.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400e4b40]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400e4b48]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400e4b4c]
mov word [rdx + 0x1c], ax
mov byte [rdx + 0x1e], 0
mov r8d, 0x95200
lea rdx, [0x140150090]
lea rcx, [rsp + 0x20]
call fcn.140011370
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140011694
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001168f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001168f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbe9c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bbe60
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400e6a10]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32UdMap.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400e4b60]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400e4b68]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x1400e4b6c]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
mov r8d, 0x248033f
lea rdx, [0x1401e5290]
lea rcx, [rsp + 0x20]
call fcn.140011370
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14001174b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011746
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011746
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbe9c
lea rcx, str.C:WindowsSystem32NtVuln.exe_C:WindowsSystem32NtVuln.sys___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32NtVuln.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32NtVuln.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32UdMap.exe___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2710
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_Sleep]
jne 0x1401b76b7
lea rcx, [0x1401ba120]
jns 0x1401b76cf
add byte [rax], al
call 0x1401b74a0
mov rcx, rdi
call qword [0x1401bb5d0]
jmp 0x1401b7701
lea rcx, [0x1401ba0f0]
mov rdx, rax
call 0x1401b74a0
mov r11d, ebx
lea rcx, [r11 + r11*4]
mov qword [r13 + rcx*8 + 0x18], rsi
mov qword [r13 + rcx*8 + 0x10], rdi
jl 0x1401b76a3
adc byte [rcx - 0x77], cl
insb byte [rdi], dx
int 8
je 0x1401b769e
sbb byte [rcx - 0x77], cl
jl 0x1401b76a3
adc byte [rcx - 0x77], cl
insb byte [rdi], dx
int 8
mov qword [r13 + rcx*8 + 0x20], r12
mov eax, dword [rdi + 0x2c]
and rsi, 0xfffffffffffff000
add rax, rsi
mov qword [r13 + rcx*8], rax
jmp 0x1401b7704
mov rax, rsi
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
int3
insb byte [rdi], dx
and byte [rdi + 0x69], dl
outsb dx, byte [rsi]
outsd dx, dword fs:[rsi]
ja case.0x1400bbfe9.4
and byte [rdx + rsi*2 + 0x69], al
jbe 0x1401b9f26
jb 0x1401b9f06
jb 0x1401b9f2a
invalid
push rbx
je case.0x1400bbfe9.4
jb 0x1401b9f43
imul ebp, dword [rsi + 0x67], 0xcccc000a
int3
push rdi
imul ebp, dword [rsi + 0x64], 0x2073776f
jb case.0x1400bbfe9.2
jbe 0x1401b9f56
jb case.0x140011788.7
insb byte [rdi], dx
insb byte [rdi], dx
outsd dx, dword [rsi]
jae 0x1401b9f5c
cmp ah, byte [rax]
invalid
outsb dx, byte [rsi]
or al, byte [eax]
int3
int3
int3
cmp ah, byte gs:[rax]
push rbx
and byte [rbx + 0x74], dl
invalid
je 0x1401b9f8d
jb 0x1401b9fa2
imul ebp, dword [rsi + 0x67], 0xcccc000a
int3
int3
jbe 0x1401b9fb0
imul esp, dword [rbx + 0x65], 0x746e6f43
jb case.0x140011788.1
invalid
insb byte [rdi], dx
cmp ah, byte [rax]
outsb dx, byte [rsi]
jo 0x1401b9fcb
je 0x1401b9f9a
jne 0x1401b9fc0
jb 0x1401b9f7e
jb 0x1401b9f7e
ja 0x1401b9fc1
jae 0x1401b9f82
push rbp
or r8b, byte [rax]
or al, byte [rax]
int3
jae 0x1401b9f9c
jb 0x1401b9fe8
imul esi, dword [rsi + 0x65], 0x76654472
imul esp, dword [rbx + 0x65], 0x746e6f43
jb 0x1401b9ffd
jbe 0x1401b9fe6
jb 0x1401b9fc7
jbe 0x1401b9fef
jbe 0x1401b9fef
invalid
outsd dx, dword [rsi]
insb byte [rdi], dx
cmp ah, byte [rax]
outsb dx, byte [rsi]
jbe 0x1401b9ff6
insb byte [rdi], dx
imul esp, dword [rax + riz + 0x49], 0x4c54434f
and byte [rbx + 0x6f], ah
push r12
push rsp
and byte [rbx + 0x6f], r12b
and byte gs:[rax], dh
and byte gs:[rax], dh
js 0x1401b9fcc
xor byte [rax + 0xa], bh
add ah, cl
int3
pop rdi
pop r15
push rbp
push rbp
push rbp
pop r15
pop rdi
push rax
push rdx
push rsp
pop rdi
push rbp
cmp r12b, byte [rax]
cmp r12b, byte [rax]
cmp r12b, byte [rax]
jne 0x1401ba040
invalid
int3
int3
int3
push r8
pop rcx
pop rdi
push rbp
cmp r12b, byte [rax]
outsb dx, byte [rsi]
and byte gs:[rdi + 0x66], ch
and byte [rax + rbp*2 + 0x65], dh
and byte [rdx + 0x75], ah
jb 0x1401ba08a
and byte [rdi + 0x61], dh
jae 0x1401ba03c
push rbp
or r8b, byte [rax]
int3
pop rdi
push rbp
cmp r12b, byte [rax]
cmp r12b, byte [rax]
outsb dx, byte [rsi]
and byte gs:[rdi + 0x66], ch
and byte [rax + rbp*2 + 0x65], dh
and byte [rdx + 0x75], ah
jb 0x1401ba0ca
and byte [rdi + 0x61], dh
jae 0x1401ba07c
push rbp
or r8b, byte [rax]
int3
push rbp
cmp r12b, byte [rax]
outsb dx, byte [rsi]
and byte gs:[rdi + 0x66], ch
and byte [rax + rbp*2 + 0x65], dh
and byte [rdx + 0x75], ah
jb 0x1401ba109
and byte [rdi + 0x61], dh
jae 0x1401ba0bb
push rbp
or r8b, byte [rax]
int3
int3
push rbp
jae 0x1401ba132
jb 0x1401ba110
jb 0x1401ba138
jae 0x1401ba148
cmp ah, byte [rax]
push rbp
outsb dx, byte [rsi]
invalid
jb 0x1401ba171
jae 0x1401ba181
and byte [rdi + rbp*2 + 0x20], dl
jb 0x1401ba17a
outsd dx, dword [rsi]
and byte [rsi + 0x72], al
and byte gs:[0x16593d13c], bh
and byte gs:[0x16593d13c], bh
jo 0x1401ba128
add ah, cl
pop rdi
invalid
je 0x1401ba180
jae 0x1401ba192
jb 0x1401ba170
jb 0x1401ba198
jae 0x1401ba1a8
jae 0x1401ba1a8
cmp ah, byte [rax]
insd dword [rdi], dx
insd dword [rdi], dx
invalid
invalid
jb 0x1401ba1d8
jb 0x1401ba1d8
jae 0x1401ba1e8
cmp ah, byte [rax]
jb 0x1401ba1e9
outsb dx, byte [rsi]
insb byte [rdi], dx
jbe 0x1401ba1e6
insb byte [rdi], dx
insb byte [rdi], dx
jb 0x1401ba1ec
jae 0x1401ba1fc
and byte [0x16593d1af], bh
jo 0x1401ba19b
add ah, cl
int3
int3
int3
int3
and byte [r10], r13b
and byte [rax], ch
xor eax, 0x20353335
sub eax, 0x7a697320
outsd dx, dword gs:[rsi]
sub byte [rbp + 0x44], cl
sub qword [rcx], r13
and byte [rdi], ch
and byte [rbx + 0x69], dh
jp 0x1401ba22d
outsd dx, dword [rsi]
sub byte [rbp + 0x4c], dl
pop r15
push rax
push rsp
push rdx
sub dword [rax], esp
cmp eax, 0xa642520
add ah, cl
and eax, 0xcc000a64
int3
outsb dx, byte [rsi]
je 0x1401ba240
je 0x1401ba240
je 0x1401ba240
jae 0x1401ba252
jb 0x1401ba230
jb 0x1401ba230
jb 0x1401ba258
jae 0x1401ba268
cmp ah, byte [rax]
push rbp
jae 0x1401ba263
outsb dx, byte [rsi]
and byte [ebp + 0x65], ch
and byte [rbp + 0x65], ch
insd dword [rdi], dx
outsd dx, dword [rsi]
jb 0x1401ba27c
and byte [rbp + 0x61], ch
jo 0x1401ba228
je 0x1401ba26b
invalid
int3
int3
invalid
and byte [rbp + 0x6e], dl
insd dword [rdi], dx
invalid
jb 0x1401ba2c1
outsd dx, dword [rsi]
and byte gs:[rbp + 0x61], ch
jo 0x1401ba2cc
insd dword [rdi], dx
invalid
and byte fs:[rcx + 0x64], ah
jb 0x1401ba2c9
jae 0x1401ba2d9
jae 0x1401ba2d9
and byte [rax], dh
js 0x1401ba28f
jo 0x1401ba298
sub al, 0x20
outsb dx, byte gs:[rsi]
and byte [rbp + riz*2 + 0x6e], cl
je 0x1401ba2db
and byte [0x10c1bacdd], ah
int3
int3
js 0x1401ba2cc
and byte [rcx + 0x64], al
jb 0x1401ba2fd
jae 0x1401ba30d
and byte [rsi + 0x6f], ch
je 0x1401ba2bf
outsw dx, word [rsi]
jne 0x1401ba311
and byte fs:[rcx + 0x6e], ch
and byte [rcx + riz*2 + 0x62], dh
insb byte [rdi], dx
and byte gs:[0x1b48b10d3], ch
and byte [rbp + 0x6e], dh
insd dword [rdi], dx
invalid
js 0x1401ba2e6
jo 0x1401ba2ef
and byte [rbp + riz*2 + 0x6e], cl
je 0x1401ba332
push 0xa642520
add ah, cl
and byte [0x10c1bad34], ah
or al, byte fs:[rax]
int3
invalid
jb 0x1401ba342
jb 0x1401ba342
jae 0x1401ba352
js 0x1401ba31c
and byte [rdi + 0x6c], al
outsd dx, dword [rsi]
vxorps zmm29 {k7}, zmm2, dword [rcx + 0x1b8]{1to16}
insd dword [rdi], dx
insd dword [rdi], dx
outsd dx, dword [rsi]
jb 0x1401ba36c
invalid
pop rbp
jb 0x1401ba369
jae 0x1401ba379
push rsp
outsd dx, dword [rsi]
jb 0x1401ba370
and byte gs:[0x14a8bc832], bh
cmp eax, 0xa702520
or al, byte [rax]
int3
add ah, cl
int3
int3
and byte [rbp + 0x6e], dl
insd dword [rdi], dx
invalid
outsb dx, byte [rsi]
invalid
add ah, cl
int3
jb 0x1401ba3d2
jae 0x1401ba3e2
jae 0x1401ba3e2
js 0x1401ba3ac
js 0x1401ba3ac
and byte [rbx + 0x6b], dl
imul esi, dword [rax + 0x70], 0x4d206465
insd dword [rdi], dx
and byte fs:[rbp + 0x6d], cl
push rbp
outsb dx, byte [rsi]
insd dword [rdi], dx
invalid
or r8b, byte [rax]
int3
outsd dx, dword [rsi]
invalid
insb byte [rdi], dx
push rbp
outsb dx, byte [rsi]
insd dword [rdi], dx
invalid