Function at 0x140029490
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140113f00]
xor rax, rsp
mov qword [rbp + 0xd0], rax
movzx r15d, cl
xor r12d, r12d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r8, str.systemroot
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov rdx, qword [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rdx + r8], r12b
jne 0x140029520
lea rcx, [rsp + 0x38]
call fcn.1400208d0
nop
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x140029585
lea rax, [rcx + 0x14]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.System32win32k.sys
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], 0
lea rax, [rsp + 0x38]
jmp 0x1400295aa
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, str.System32win32k.sys
movzx r8d, byte [rsp + 0x30]
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x38]
call fcn.140020e30
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140029608
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
movdqa xmm6, xmmword [0x1400de460]
movdqu xmmword [rsp + 0x48], xmm6
mov byte [rsp + 0x38], 0
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r8d, 0x2b
lea rdx, str.https:__msdl.microsoft.com_download_symbols
lea rcx, [rsp + 0x58]
call fcn.1400208d0
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140021620
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140026cf0
nop
lea rcx, [rbp - 0x20]
call fcn.14002ce60
test al, al
je 0x140029aec
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8d, socket
lea rdx, str.NtUserSetGestureConfig
lea rcx, [rsp + 0x38]
call fcn.1400208d0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0x70], 0x58
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
lea r8, [rbp + 0x70]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.dbghelp.dll_SymFromName]
lea rcx, [rsp + 0x38]
test eax, eax
jne 0x140029730
call fcn.140021f80
jmp 0x140029ae4
mov esi, dword [rbp + 0xa8]
sub esi, dword [rbp + 0x90]
call fcn.140021f80
cmp esi, 0xffffffff
je 0x140029ae4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, ebx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140114be0], xmm0
movups xmmword [0x140114bf0], xmm0
movups xmmword [0x140114c00], xmm0
movups xmmword [0x140114c10], xmm0
movups xmmword [0x140114c20], xmm0
movups xmmword [0x140114c30], xmm0
mov dword [0x140114c40], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
add r8d, 0xa
movsxd r14, r8d
test r8d, r8d
jle 0x140029816
mov rbx, r12
lea r13, [0x140000000]
movabs r12, 0x4ec4ec4ec4ec4ec5
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r12
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + r13 + 0xe1eb8]
mov byte [rbx + r13 + 0x114be0], al
inc rbx
cmp rbx, r14
jl 0x1400297e0
xor r12d, r12d
lea rcx, [rbp - 0x48]
call fcn.140028f30
nop
cmp qword [rbp - 0x38], 0
je 0x140029a90
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov r8d, 0x36c8
lea rdx, [0x1400de500]
lea rcx, [rbp - 0x48]
call fcn.1400308f0
test al, al
je 0x140029a90
lea rcx, [rbp - 0x48]
call fcn.140030400
test al, al
jne 0x140029883
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rcx, qword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
jmp 0x140029a90
lea rcx, [0x140114c58]
call fcn.14002ef40
test al, al
jne 0x1400298a0
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, listen
lea rdx, str.ntoskrnl.exe
lea rcx, [rsp + 0x58]
call fcn.1400208d0
nop
lea rcx, [rsp + 0x58]
call fcn.140030da0
mov qword [0x140114c48], rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140029921
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029915
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
mov rax, qword [0x140114c48]
test rax, rax
jne 0x140029933
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, 0xa
lea rdx, str.win32k.sys
lea rcx, [rsp + 0x58]
call fcn.1400208d0
nop
lea rcx, [rsp + 0x58]
call fcn.140030da0
mov rbx, rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400299a9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400299a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400299a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
mov rcx, rdi
test rbx, rbx
jne 0x1400299bb
call fcn.14002b2a0
jmp 0x140029a90
movsxd rdx, esi
add rdx, rbx
lea rax, [0x1400e1f9c]
mov qword [rsp + 0x20], rax
lea r9, [0x1400e1fa0]
mov r8d, 0x100
call fcn.140028a40
mov rbx, rax
test rax, rax
jne 0x1400299f4
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
mov dword [rbp - 0x50], r12d
lea rdx, [rax + 3]
mov r9d, 4
lea r8, [rbp - 0x50]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
jne 0x140029a20
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
movsxd rcx, dword [rbp - 0x50]
add rcx, 7
add rcx, rbx
mov qword [0x140114c50], rcx
test r15b, r15b
je 0x140029a8d
mov rcx, rdi
call fcn.140027e00
mov rcx, rdi
test al, al
jne 0x140029a4d
call fcn.14002b2a0
jmp 0x140029a90
call fcn.140027440
test al, al
jne 0x140029a60
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
mov rcx, qword [0x140114c58]
call fcn.140027b50
mov rcx, rdi
test al, al
jne 0x140029a7a
call fcn.14002b2a0
jmp 0x140029a90
call fcn.140028160
test al, al
jne 0x140029a8d
mov rcx, rdi
call fcn.14002b2a0
jmp 0x140029a90
mov rdi, r12
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140029ad3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029ace
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
movdqa xmm6, xmmword [0x1400de460]
cmp byte [rbp + 1], 0
je 0x140029b27
mov edx, 0x10000000
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm6, xmmword [0x1400de460]
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140029b66
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029b59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029ba8
call fcn.1400d8ba8
movdqa xmm6, xmmword [0x1400de460]
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140029bbc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029baf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029baf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
movdqa xmm6, xmmword [0x1400de460]
movdqa xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140029c03
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029bfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029bfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d8ba8
mov rax, rdi
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400d8ff0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret