Function at 0x140001450
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.140002d80
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x140004700]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.c:Usersdriver.sys]
movups xmmword [rax], xmm0
movzx ecx, word [0x140004528]
mov word [rax + 0x10], cx
movzx ecx, byte [0x14000452a]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov r8d, 0x2e00
lea rdx, [0x14002c670]
lea rcx, [rsp + 0x20]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400014fd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002dbc
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.140002d80
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x140004700]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.c:Usersmapper.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x140004540]
mov word [rax + 0x10], cx
movzx ecx, byte [0x140004542]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov r8d, 0x255a8
lea rdx, [0x1400070c0]
lea rcx, [rsp + 0x20]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400015a6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002dbc
lea rcx, str.c:Usersmapper.exe_c:Usersdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.c:Usersdriver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.c:Usersmapper.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add ecx, eax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
cmp r14w, r15w
jae 0x14000a94c
nop dword [rax]
nop word [rax + rax]
invalid
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call 0x1400174be
test eax, eax
jne 0x14000a945
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x14000a933
cmp rdi, rax
je 0x14000a9cc
inc esi
cmp esi, r15d
jb 0x14000a910
mov rcx, qword [0x140018790]
lea rdx, [0x14001a3c0]
call 0x14000c5e0
lea rdx, [0x14000c7c0]
mov rcx, rax
call qword [0x140018678]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call 0x14000a6a0
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call 0x140016220
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000a94c
mov edx, dword [rbx + 8]
lea rcx, [rsp + 0x50]
add rcx, rax
je 0x14000a94c
test edx, edx
je 0x14000a94c
lea rax, [rsp + 0x50]
and al, 0x50
mov r14d, edx
sub rcx, rax
lea rdx, [rcx + r13]
jmp 0x14000a972