Function at 0x140003ed0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x120
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor ecx, ecx
call fcn.14000cab0
mov rcx, rax
call fcn.14000ca98
call fcn.14000ca6c
mov ebx, eax
and ebx, 0x80000003
jge 0x140003f10
dec ebx
or ebx, 0xfffffffc
inc ebx
movaps xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
add ebx, 7
movaps xmm1, xmmword [0x140026460]
mov edx, 1
movzx eax, word [0x1400264b8]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [0x140026470]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [0x140026490]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmm1, xmmword [0x140026480]
mov word [rsp + 0x108], ax
lea eax, [rbx*2 + 0xc]
movaps xmmword [rsp + 0xe0], xmm0
movsd xmm0, qword [0x1400264b0]
movaps xmmword [rsp + 0xd0], xmm1
movaps xmm1, xmmword [0x1400264a0]
movsxd rcx, eax
movsd qword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm1
call fcn.14000964c
mov qword [0x14002cc28], rax
test rax, rax
je 0x140004432
mov qword [rsp + 0x130], rbp
xor ebp, ebp
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], rdi
mov edi, ebp
movsxd rsi, ebx
test ebx, ebx
jle 0x140004017
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ebx, [rax - 1]
call fcn.14000ca6c
cdq
idiv ebx
movsxd rax, edx
movzx ecx, word [rsp + rax*2 + 0xa0]
mov rax, qword [0x14002cc28]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, rsi
jl 0x140003fe0
mov eax, dword [0x14002cc20]
mov rsi, qword [rsp + 0x138]
cmp eax, 1
jne 0x140004138
mov qword [rsp + 0x30], rbp
lea rcx, str..EchoDrv
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
cmp rax, 0xffffffffffffffff
jne 0x1400040b5
call fcn.140003b70
test eax, eax
je 0x1400043dc
lea rcx, str.Driver_loaded_successfully._n
call fcn.140001010
mov qword [rsp + 0x30], rbp
lea rcx, str..EchoDrv
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
mov ecx, 1
call fcn.14000ca64
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov rcx, qword [0x14002cc48]
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov edx, 0x9e6a0594
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x140004121
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_initialize_driver_1___d_n
call fcn.140001010
mov rcx, qword [0x14002cc48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400043e8
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov qword [0x14002cc50], rax
mov eax, 1
jmp 0x1400043ea
cmp eax, 2
jne 0x1400041d6
mov qword [rsp + 0x30], rbp
lea rcx, str..DBUtil_2_3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
cmp rax, 0xffffffffffffffff
jne 0x14000442b
call fcn.140003b70
test eax, eax
je 0x1400043dc
lea rcx, str.Driver_loaded_successfully._n
call fcn.140001010
mov qword [rsp + 0x30], rbp
lea rcx, str..DBUtil_2_3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
mov eax, 1
jmp 0x1400043ea
cmp eax, 3
jne 0x140004270
mov qword [rsp + 0x30], rbp
lea rcx, str..WNBIOS
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
cmp rax, 0xffffffffffffffff
jne 0x14000442b
call fcn.140003b70
test eax, eax
je 0x1400043dc
lea rcx, str.Driver_loaded_successfully._n
call fcn.140001010
mov qword [rsp + 0x30], rbp
lea rcx, str..WNBIOS
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
mov eax, 1
jmp 0x1400043ea
cmp eax, 4
jne 0x1400043e8
mov qword [rsp + 0x30], rbp
lea rcx, str..BaiZhanTang
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
cmp rax, 0xffffffffffffffff
jne 0x14000430e
lea rax, str.BaiZhanTang
mov qword [0x14002cc28], rax
call fcn.140003b70
test eax, eax
je 0x1400043dc
lea rcx, str.Driver_loaded_successfully._n
call fcn.140001010
mov qword [rsp + 0x30], rbp
lea rcx, str..BaiZhanTang
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x14002cc48], rax
lea rcx, str.Getting_CR3_Please_Wait....._n
call fcn.140001010
movups xmm0, xmmword [str.BaiZhanTang_WLWZ]
movzx eax, byte [0x1400269a8]
mov byte [rsp + 0x90], al
xor eax, eax
cmp dword [0x14002cc24], eax
movups xmmword [rsp + 0x80], xmm0
mov word [rsp + 0x78], ax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
jne 0x140004421
mov ebx, 0x100000
movabs rdi, 0xffffff000
nop dword [rax + rax]
lea rcx, [rsp + 0x80]
mov qword [0x14002cc40], rbx
call fcn.140004570
test rax, rax
je 0x14000439c
mov r8d, 0x28
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140004450
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x48]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400043c3
inc rax
test ecx, ecx
jne 0x1400043b0
test edx, edx
je 0x140004413
add rbx, 0x1000
cmp rbx, rdi
jb 0x140004370
lea rcx, str._ERROR__CR3_Not_Found._n
jmp 0x1400043e3
lea rcx, str.Driver_loading_failed._n
call fcn.140001010
xor eax, eax
mov rbp, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140005460
add rsp, 0x120
pop rbx
ret
cmp rbx, rdi
jb 0x140004421
lea rcx, str._ERROR__CR3_Not_Found._n
jmp 0x1400043e3
mov dword [0x14002cc24], 1
mov eax, 1
jmp 0x1400043ea
lea rcx, str.Random_Error__n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]