Function at 0x140001860
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, qword [0x14001ec18]
lea rdx, str.____Unloading_vulnerable_driver
mov rcx, qword [0x14000f270]
call fcn.140005cf0
lea rdx, [0x140005ec0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400018cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
lea rsi, [0x14001ebb0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rsi + r8], bl
jne 0x1400018f2
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140005ae0
nop
lea rcx, [rsp + 0x30]
call fcn.14000bd70
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001954
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000194f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000194f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d284
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xa0]
call fcn.14000e3a2
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0xa0]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140001984
cmp byte [rbp + rax + 0x9f], 0x5c
jne 0x1400019ae
dec rax
cmp rax, 0x104
jae 0x140001d42
mov byte [rbp + rax + 0xa0], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rbp + 0xa0]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400019d0
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.140005ae0
nop
mov r8d, 1
lea rdx, [0x14000f9f4]
lea rcx, [rsp + 0x30]
call fcn.140005c40
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140001a30
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140005c40
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001ab0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001aab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d284
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001b03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d284
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x70]
call fcn.14000e3a2
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.140005380
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
movabs rax, 0x1c926b9d39431d5f
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x23d6df
sub rcx, rax
add ecx, 0x1649d
movsxd rsi, ecx
mov rcx, rsi
call fcn.14000da4c
mov rdi, rax
test rsi, rsi
je 0x140001bbb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r9d, ecx
mov byte [rbx + rdi], r9b
inc rbx
cmp rbx, rsi
jb 0x140001b88
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd r8, dword [rcx + 4]
mov rcx, qword [0x14000f270]
test byte [r8 + rax + 0x10], 6
lea rdx, str.____Error_dumping_shit_inside_the_disk
jne 0x140001bef
lea rdx, str.___Vul_driver_data_destroyed_before_unlink
call fcn.140005cf0
lea rdx, [0x140005ec0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x68]
call fcn.1400057a0
test rax, rax
jne 0x140001c2e
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call fcn.14000d284
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x68], rax
cmp qword [rbp + 0x18], 0
je 0x140001cac
mov rax, qword [rbp - 0x50]
lea rcx, [rbp + 8]
cmp qword [rax], rcx
jne 0x140001cac
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x18]
mov dword [rax], edx
cmp byte [rbp + 0x14], 0
je 0x140001cbb
lea rcx, [rbp - 0x68]
call fcn.1400057a0
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001d1a
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d284
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000d260
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14000d62c
int3