Function at 0x14000c5a0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
mov rcx, rdx
call fcn.14000db70
test rax, rax
je 0x14000c63b
mov r15, rax
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000c64b
mov esi, dword [r15 + 0x50]
xor ebp, ebp
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12d, 0
test rax, rax
je 0x14000c68a
mov r13, rax
movzx eax, word [r15 + 0x14]
mov r14d, dword [r15 + rax + 0x24]
cmp byte [rsp + 0xf8], 0
cmovne ebp, r14d
sub esi, ebp
cmp dword [rsp + 0x100], 1
jne 0x14000c6a1
mov rcx, rbx
mov edx, esi
call fcn.14000c4d0
jmp 0x14000c6ae
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x14000c659
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Image_is_not_64_bit
call fcn.1400022d0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor r12d, r12d
mov rax, r12
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, esi
mov rcx, rbx
xor edx, edx
call fcn.140007640
mov r12, rax
test rax, rax
je 0x14000cae0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x38], rsi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.1400022d0
mov rcx, rax
mov rdx, r12
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rbp, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rbp
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov r8d, dword [r15 + 0x54]
mov rcx, r13
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r15 + 6]
test ax, ax
je 0x14000c772
mov rcx, r15
add rcx, 0x18
movzx ebp, word [r15 + 0x14]
add rbp, rcx
add rbp, 0xc
xor esi, esi
jmp 0x14000c750
add rsi, 1
movzx ecx, ax
add rbp, 0x28
cmp rsi, rcx
jae 0x14000c772
cmp byte [rbp + 0x18], 0
js 0x14000c740
mov ecx, dword [rbp]
mov r8d, dword [rbp + 4]
add rcx, r13
mov edx, dword [rbp + 8]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r15 + 6]
jmp 0x14000c740
mov rsi, r12
cmp byte [rsp + 0xf8], 0
je 0x14000c7f6
mov rsi, r12
sub rsi, r14
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Skipped_0x
call fcn.1400022d0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, r14d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, str._bytes_of_PE_Header
mov rcx, rax
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rdi, rsi
sub rdi, qword [r15 + 0x30]
lea rcx, [rsp + 0x50]
mov rdx, r13
call fcn.14000dba0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
cmp rcx, rax
mov r14, rsi
je 0x14000c88e
mov r8, rbx
jmp 0x14000c839
add rcx, 0x18
cmp rcx, rax
je 0x14000c886
mov ebp, dword [rcx + 0x10]
test ebp, ebp
je 0x14000c830
xor edx, edx
jmp 0x14000c85b
add rdx, 1
mov ebx, ebp
cmp rdx, rbx
jae 0x14000c830
mov rsi, qword [rcx + 8]
movzx esi, word [rsi + rdx*2]
mov ebx, esi
and ebx, 0xf000
cmp ebx, 0xa000
jne 0x14000c850
and esi, 0xfff
mov rbp, qword [rcx]
add qword [rbp + rsi], rdi
mov ebp, dword [rcx + 0x10]
jmp 0x14000c850
mov rcx, qword [rsp + 0x50]
mov rbx, r8
test rcx, rcx
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x68]
je 0x14000c8e0
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14000c8ca
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x14000ccf8
add rdx, 0x27
mov rcx, rax
call fcn.140010960
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov rcx, r13
mov rdx, r14
call fcn.14000cd00
test al, al
je 0x14000cb35
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, r13
call fcn.14000dd40
mov rcx, rbx
mov rdx, rdi
call fcn.14000ce50
test al, al
je 0x14000cb48
mov edi, esi
mov r8d, ebp
add r8, r13
mov rcx, rbx
mov rdx, r12
mov r9, rdi
call fcn.140005d90
test al, al
je 0x14000cb58
mov rsi, rbx
mov rbp, qword [rsp + 0x110]
mov eax, dword [r15 + 0x28]
add r14, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.1400022d0
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rbx
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
test rbp, rbp
je 0x14000c9ad
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8, r12
mov r9, rdi
call rbp
test al, al
je 0x14000cc61
mov cl, byte [rsp + 0x108]
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x48]
mov r9, r12
test cl, cl
jne 0x14000c9cd
mov r9, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x34]
mov rbx, rsi
mov rcx, rsi
mov r8, r14
call fcn.14000d130
test al, al
je 0x14000cc23
mov rax, qword [rsp + 0x118]
mov bl, byte [rsp + 0xf0]
test rax, rax
je 0x14000ca07
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___DriverEntry_returned_0x
call fcn.1400022d0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
test bl, bl
je 0x14000cb1f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_memory
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rsi
mov rdx, r12
cmp dword [rsp + 0x100], 1
jne 0x14000ccaa
mov r8, qword [rsp + 0x38]
call fcn.140006ba0
test al, al
je 0x14000ccb7
lea rdx, str.___Memory_has_been_released
jmp 0x14000ccbe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.1400022d0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor r12d, r12d
mov rcx, r13
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000c68a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x14000c659
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14000cb66
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_write_local_image_to_remote_image
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, r13
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_memory
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rcx, rbx
mov rdx, r12
cmp dword [rsp + 0x100], 1
jne 0x14000cbfb
mov r8d, esi
call fcn.140006ba0
jmp 0x14000cc00
call fcn.140007fd0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
je 0x14000cc17
lea rdx, str.___Memory_has_been_released
jmp 0x14000c659
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x14000c659
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_call_driver_entry
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x14000cca0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Callback_returns_false__failed_
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov rbx, rsi
mov rsi, qword [rsp + 0x38]
jmp 0x14000cb94
call fcn.140007fd0
test al, al
jne 0x14000cad4
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x14000cb1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3