Function at 0x140001070
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
lea rcx, str.___Hello_there_ObbedCode_Reporting_for_Duty_for_the_Sandboxie_Crack_n
call fcn.140001000
lea rcx, str.____Remember_if_this_is_your_First_time_running_the_Loader_you_may_need_to_Restart_Re_Run_it_again_for_success
call fcn.140001000
lea rcx, str.___Checking_Registry_Values__VulnerableDriverBlocklistEnable___HypervisorEnforcedCodeIntegrity_..._n
call fcn.140001000
lea rcx, str.___Dropping_the_gdvr.sys_in_the_System32_Folder..._n
call fcn.140001000
call fcn.140001710
test al, al
jne 0x1400010dc
lea rcx, str.____Failed_to_Drop_Driver_gdvr.sys...._n
call fcn.140001000
mov eax, 1
add rsp, 0x7c0
pop rbp
ret
mov qword [rsp + 0x7b8], rbx
lea rcx, str.___gdvr.sys_dropped_in_the_System32_Folder.._n
mov qword [rsp + 0x7b0], rdi
call fcn.140001000
lea rcx, str.___Preparing_Exploit_by_Disabling_Core_Isolation_what_not..._n
call fcn.140001000
lea rcx, str.___Disabling__VulnerableDriverBlocklistEnable_..._n
call fcn.140001000
movaps xmm0, xmmword [str.RegistryMachineSYSTEMCurrentControlSetControlCIConfig]
lea rdx, [rbp + 0x10]
movaps xmm1, xmmword [0x1400035c0]
lea rcx, [rsp + 0x40]
movzx eax, word [0x140003628]
xor edi, edi
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [0x1400035d0]
movaps xmmword [rbp + 0x30], xmm0
movaps xmm0, xmmword [0x1400035f0]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x140003610]
movaps xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [0x1400035e0]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm0, qword [0x140003620]
movaps xmmword [rbp + 0x40], xmm1
movaps xmm1, xmmword [0x140003600]
movsd qword [rbp + 0x80], xmm0
movaps xmm0, xmmword [str.VulnerableDriverBlocklistEnable]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x140003640]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [0x140003650]
movaps xmmword [rbp + 0xa0], xmm1
movaps xmm1, xmmword [0x140003660]
movaps xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0x88], ax
movaps xmmword [rbp + 0xc0], xmm1
mov dword [rbp + 0x6d8], edi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x6e0]
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0x20006
mov dword [rsp + 0x78], 0x40
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x1400016da
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x6e0]
lea rax, [rbp + 0x6d8]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x50]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x6e0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400016da
lea rcx, str.___Registry_key__VulnerableDriverBlocklistEnable__value_set_successfully..._n
call fcn.140001000
lea rcx, str.___Disabling__HypervisorEnforcedCodeIntegrity___Core_Isolation__Memory_Integrity_..._n
call fcn.140001000
movaps xmm0, xmmword [str.RegistryMachineSYSTEMCurrentControlSetControlDeviceGuardScenarios]
lea rdx, [rbp + 0x110]
movaps xmm1, xmmword [0x1400038e0]
lea rcx, [rsp + 0x50]
movzx eax, word [0x140003960]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm0, xmmword [0x1400038f0]
movaps xmmword [rbp + 0x130], xmm0
movaps xmm0, xmmword [0x140003910]
movaps xmmword [rbp + 0x120], xmm1
movaps xmm1, xmmword [0x140003900]
movaps xmmword [rbp + 0x150], xmm0
movaps xmm0, xmmword [0x140003930]
movaps xmmword [rbp + 0x140], xmm1
movaps xmm1, xmmword [0x140003920]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm0, xmmword [0x140003950]
movaps xmmword [rbp + 0x160], xmm1
movaps xmm1, xmmword [0x140003940]
movaps xmmword [rbp + 0x190], xmm0
movaps xmm0, xmmword [str.HypervisorEnforcedCodeIntegrity]
movaps xmmword [rbp + 0x180], xmm1
movaps xmm1, xmmword [0x140003980]
movaps xmmword [rbp + 0xd0], xmm0
movaps xmm0, xmmword [0x140003990]
movaps xmmword [rbp + 0xe0], xmm1
movaps xmm1, xmmword [0x1400039a0]
movaps xmmword [rbp + 0xf0], xmm0
mov word [rbp + 0x1a0], ax
movaps xmmword [rbp + 0x100], xmm1
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x6e0]
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0x20006
mov dword [rsp + 0x78], 0x40
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x1400016d1
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x6e0]
lea rax, [rbp + 0x6d8]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x40]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x6e0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400016d1
lea rcx, str.___Registry_key__HypervisorEnforcedCodeIntegrity__value_set_successfully..._n
call fcn.140001000
lea rcx, str.___Disabling__HypervisorEnforcedCodeIntegrity___Core_Isolation__Memory_Integrity__v2..._n
call fcn.140001000
lea rax, str.RegistryMachineSYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity
movups xmm0, xmmword [rax]
lea rcx, [rbp + 0x1b0]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x1b0]
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movzx eax, word [rax + 0x50]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [str.Enabled]
movups xmmword [rcx + 0x40], xmm1
mov word [rcx + 0x50], ax
lea rcx, [rsp + 0x50]
movups xmmword [rbp - 0x70], xmm0
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x6e0]
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0x20006
mov dword [rsp + 0x78], 0x40
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, eax
test eax, eax
js 0x1400016c8
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x6e0]
lea rax, [rbp + 0x6d8]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x40]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x6e0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400016c8
lea rcx, str.___Registry_key__HypervisorEnforcedCodeIntegrity__v2_value_set_successfully..._n
call fcn.140001000
lea rcx, str.___Now_Exploiting_gdrv.sys_Driver_to_load_in_SbieDrv.sys__Make_sure_I_am_in_the_Directory_of_the_SbieDrv.sys_..._n
call fcn.140001000
movaps xmm0, xmmword [str.C:WindowsSystem32Driversgdrv.sys]
lea r9, [rbp + 0x6d0]
movaps xmm1, xmmword [0x140003120]
xor r8d, r8d
movzx eax, word [0x140003158]
mov dl, 1
movaps xmmword [rbp - 0x40], xmm0
mov ecx, 0xa
movaps xmm0, xmmword [0x140003130]
movaps xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [0x140003150]
movsd qword [rbp], xmm0
movups xmm0, xmmword [str.SbieDrv.sys]
mov word [rbp + 8], ax
movaps xmmword [rbp - 0x30], xmm1
movaps xmm1, xmmword [0x140003140]
movups xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [0x140004018]
movsd qword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x10], xmm1
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov ebx, eax
test eax, eax
jns 0x140001643
lea rcx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator._n
call fcn.140001000
lea rcx, str.____Error_Still_attempting_to_Run_SandMan.exe...__08x_n
jmp 0x1400016e1
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [rbp + 0x4a0]
mov edx, 0x208
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
mov ebx, eax
test eax, eax
js 0x140001637
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [rbp + 0x290]
mov edx, 0x208
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
mov ebx, eax
test eax, eax
js 0x140001637
lea rdx, [rbp + 0x290]
lea rcx, [0x14000b650]
call fcn.140001cb0
mov ebx, eax
test eax, eax
js 0x140001637
lea rdx, [rbp + 0x4a0]
lea rcx, [0x14000b860]
call fcn.140001cb0
mov ebx, eax
test eax, eax
js 0x140001637
call fcn.140001e40
jmp 0x1400016e8
lea rcx, str.____Failed_to_set_registry_key_value...__HKLMSYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity__Enabled__Error:__08x_n
jmp 0x1400016e1
lea rcx, str.____Failed_to_set_registry_key_value...__HKLMSYSTEMCurrentControlSetControlDeviceGuardScenarios__HypervisorEnforcedCodeIntegrity__Error:__08x_n
jmp 0x1400016e1
lea rcx, str.____Failed_to_set_registry_key_value...__HKLMSYSTEMCurrentControlSetControlCIConfig__VulnerableDriverBlocklistEnable__Error:__08x_n
mov edx, ebx
call fcn.140001000
mov rdi, qword [rsp + 0x7b0]
mov eax, ebx
mov rbx, qword [rsp + 0x7b8]
add rsp, 0x7c0
pop rbp
ret