Function at 0x14000c338
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov r15d, ecx
lea rdi, [rsp + 0x50]
mov r12d, edx
xor eax, eax
mov edx, 0x208
xor ebx, ebx
mov ecx, edx
mov dword [rbp + 0x7e0], ebx
rep stosb byte [rdi], al
mov ecx, edx
mov qword [rsp + 0x20], rbx
lea rdi, [rbp + 0x160]
xor r9d, r9d
rep stosb byte [rdi], al
lea rcx, str._list
xor r8d, r8d
xor edx, edx
mov r14d, ebx
call fcn.140010b50
test eax, eax
je 0x14000c3b3
call fcn.14000cfec
mov ebx, 1
jmp 0x14000c910
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rcx, str._diag
xor edx, edx
call fcn.140010b50
test eax, eax
je 0x14000c3d7
call fcn.140013148
jmp 0x14000c3a9
mov r13d, 0x104
mov qword [rsp + 0x20], rbx
mov esi, 1
lea r8, [rsp + 0x50]
mov r9d, r13d
lea rcx, str._prv
mov edx, esi
call fcn.140010b50
test eax, eax
je 0x14000c439
lea rcx, [rsp + 0x50]
call fcn.1400013ac
mov r14d, eax
cmp eax, 0x34
jb 0x14000c42a
xor r9d, r9d
lea rdx, str.____Invalid_provider_id__lu_specified__default_will_be_used___lu__r_n
mov r8d, eax
mov ecx, esi
call fcn.140011090
mov r14d, ebx
mov edx, r14d
lea rcx, str.___Selected_provider:__lu_r_n
call fcn.140002fc8
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, str._dse
call fcn.140010b50
test eax, eax
je 0x14000c4df
lea rcx, [rsp + 0x50]
call fcn.1400013ac
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov r8d, r12d
mov edx, r15d
mov ecx, r14d
mov r13d, eax
call fcn.14000d6e8
mov rdi, rax
test rax, rax
je 0x14000c910
mov rax, qword [rax + 0x40]
cmp qword [rax + 0x40], rbx
je 0x14000c4d7
mov ecx, r12d
call fcn.140004700
mov r8, rax
test rax, rax
jne 0x14000c4c8
mov ecx, r12d
call fcn.140004544
mov r8, rax
test rax, rax
jne 0x14000c4c8
lea rdx, str.____Could_not_query_system_variable_address__abort._r_n
mov ecx, esi
call fcn.140011090
jmp 0x14000c4d7
mov rax, qword [rdi + 0x40]
mov edx, r13d
mov rcx, rdi
call qword [rax + 0x40]
mov ebx, eax
mov rcx, rdi
jmp 0x14000c8f6
lea rax, [rbp + 0x7e0]
mov r9d, r13d
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, esi
lea rcx, str._map
call fcn.140010b50
test eax, eax
je 0x14000c798
cmp dword [rbp + 0x7e0], ebx
jne 0x14000c51d
lea rdx, str.____Input_file_not_specified_r_n
jmp 0x14000c627
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x160]
mov edx, esi
lea rcx, str._scv
mov r15d, esi
call fcn.140010b50
test eax, eax
je 0x14000c56e
lea rcx, [rbp + 0x160]
call fcn.1400013ac
mov r15d, eax
dec eax
cmp eax, 3
jbe 0x14000c56e
mov r9d, esi
lea rdx, str.____Unrecognized_shellcode_version__lu__default_will_be_used___lu__r_n
mov r8d, r15d
mov ecx, esi
call fcn.140011090
mov r15d, esi
xor eax, eax
mov dword [rbp + 0x7e0], ebx
lea rdi, [rbp + 0x370]
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x7e0]
mov r9d, r13d
lea rcx, str._drvn
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x370]
mov edx, esi
call fcn.140010b50
mov eax, dword [rbp + 0x7e0]
lea rdx, [rbp + 0x370]
neg eax
mov dword [rbp + 0x7e0], ebx
lea rdi, [rbp + 0x580]
mov ecx, 0x208
sbb rax, rax
lea r8, [rbp + 0x580]
and rax, rdx
mov r9d, r13d
mov qword [rsp + 0x30], rax
mov edx, esi
xor eax, eax
rep stosb byte [rdi], al
lea rax, [rbp + 0x7e0]
lea rcx, str._drvr
mov qword [rsp + 0x20], rax
call fcn.140010b50
mov eax, dword [rbp + 0x7e0]
lea rcx, [rsp + 0x50]
neg eax
lea rax, [rbp + 0x580]
sbb r13, r13
and r13, rax
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x14000c633
lea rdx, str.____Input_file_cannot_be_found__abort._r_n
mov ecx, esi
call fcn.140011090
jmp 0x14000c910
mov edx, r15d
lea rcx, str.___Driver_mapping_using_shellcode_version:__lu_r_n
call fcn.140002fc8
cmp r15d, 3
jne 0x14000c689
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x14000c65b
lea rdx, str.____Driver_object_name_is_required_when_working_with_this_shellcode_r_n____Use_the_following_commands_to_supply_object_name_and_optionally_registry_key_name_r_n_t_drvn__ObjectName__and_or_r_n_t_drvr__ObjectKeyName__r_n_te.g._kdu__scv_3__drvn_MyName__map_MyDriver.sys_r_n
jmp 0x14000c627
lea rcx, str.___Driver_object_name:___ws__r_n
call fcn.140002fc8
test r13, r13
je 0x14000c67d
mov rdx, r13
lea rcx, str.___Registry_key_name:___ws__r_n
call fcn.140002fc8
jmp 0x14000c689
lea rcx, str.___No_driver_registry_key_name_specified__driver_object_name_will_be_used_instead_r_n
call fcn.140002fc8
lea rdx, [rsp + 0x50]
mov dword [rbp + 0x7e0], 2
lea rcx, [rsp + 0x38]
mov qword [rbp + 0x7e8], rbx
mov rsi, rbx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rbp + 0x7e8]
xor ecx, ecx
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x7e0]
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x14000c6e8
mov rcx, qword [rbp + 0x7e8]
test rcx, rcx
je 0x14000c706
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x14000c6fb
mov eax, 0xc000007b
mov edx, eax
lea rcx, str.____Error_while_loading_input_driver_file
call fcn.140011f18
jmp 0x14000c910
mov rsi, qword [rbp + 0x7e8]
mov eax, ebx
jmp 0x14000c70a
test eax, eax
js 0x14000c6e8
test rsi, rsi
je 0x14000c6e8
mov r8, rsi
lea rdx, [rsp + 0x50]
lea rcx, str.___Input_driver_file___ws__loaded_at_0x_p_r_n
call fcn.140002fc8
mov edx, dword [rbp + 0x7d0]
mov r9d, r15d
mov r8d, r12d
mov dword [rsp + 0x20], ebx
mov ecx, r14d
call fcn.14000d6e8
mov rdi, rax
test rax, rax
je 0x14000c78a
cmp r15d, 3
jne 0x14000c773
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14000c75f
lea rcx, [rdi + 0x54]
mov rdx, rax
call fcn.14000fa18
test r13, r13
je 0x14000c773
lea rcx, [rdi + 0x260]
mov rdx, r13
call fcn.14000fa18
mov rax, qword [rdi + 0x40]
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x38]
mov rcx, rdi
mov ebx, eax
call fcn.14000de00
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
jmp 0x14000c910
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, [0x14003c998]
call fcn.140010b50
lea r8, [rsp + 0x50]
test eax, eax
je 0x14000c822
movzx edx, word [rsp + 0x50]
mov rdi, rbx
jmp 0x14000c7e6
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14000c7eb
movzx eax, dx
lea rdi, [rdi + rdi*4]
add r8, 2
lea rdi, [rdi - 0x18]
lea rdi, [rax + rdi*2]
movzx edx, word [r8]
test dx, dx
jne 0x14000c7c6
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, r15d
mov ecx, r14d
call fcn.14000d6e8
mov rsi, rax
test rax, rax
je 0x14000c910
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14000e408
jmp 0x14000c8f1
mov r9d, r13d
mov qword [rsp + 0x20], rbx
mov edx, esi
lea rcx, str._pse
call fcn.140010b50
test eax, eax
je 0x14000c872
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, r15d
mov ecx, r14d
call fcn.14000d6e8
mov rdi, rax
test rax, rax
je 0x14000c910
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000e2c0
mov rcx, rdi
jmp 0x14000c8f4
mov r9d, r13d
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, str._dmp
call fcn.140010b50
test eax, eax
je 0x14000c8fd
movzx edx, word [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rdi, rbx
jmp 0x14000c8c0
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14000c8c5
movzx eax, dx
lea rdi, [rdi + rdi*4]
add r8, 2
lea rdi, [rdi - 0x18]
lea rdi, [rax + rdi*2]
movzx edx, word [r8]
test dx, dx
jne 0x14000c8a0
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov r8d, r12d
mov edx, r15d
mov ecx, r14d
call fcn.14000d6e8
mov rsi, rax
test rax, rax
je 0x14000c910
mov rdx, rdi
mov rcx, rax
call fcn.14000e080
mov rcx, rsi
mov ebx, eax
call fcn.14000de00
jmp 0x14000c910
lea rdx, str.____No_valid_parameters_combination_specified_or_command_is_not_recognized__see_Usage_for_help_r_n____Usage:_kdu__Provider__Command__r_n_nParameters:__r_nkdu__list___________List_available_providers_r_nkdu__diag___________Run_system_diagnostic_for_troubleshooting_r_nkdu__prv_id_________Optional__sets_provider_id_to_be_used_with_rest_of_commands__default_0_r_nkdu__pse_cmdline____Launch_program_as_PPL_r_nkdu__dmp_pid________Dump_virtual_memory_of_the_given_process_r_nkdu__ps_pid_________Disable_ProtectedProcess_for_given_pid_r_nkdu__dse_value______Write_user_defined_value_to_the_system_DSE_state_flags_r_nkdu__map_filename___Map_driver_to_the_kernel_and_execute_it_entry_point__this_command_have_dependencies_listed_below_r_n_scv_version________Optional__select_shellcode_version__default_1_r_n_drvn_name__________Driver_object_name__only_valid_for_shellcode_version_3__r_n_drvr_name__________Optional__driver_registry_key_name__only_valid_for_shellcode_version_3__r_n
lea rcx, str._s_r_n
call fcn.140002fc8
mov eax, ebx
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x890
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret