Similarity

140008694
140008694 // align 0x10

1400086a0
1400086a0BeaconPrintf:
1400086a0push r15
1400086a2lea r15, [rip+0x242b7]
1400086a9push r14
1400086abpush r13
1400086admov r13l, ecx
1400086b0push r12
1400086b2push rbp
1400086b3push rdi
1400086b4mov rdi, rdx
1400086b7push rsi
1400086b8push rbx
1400086b9sub rsp, 88
1400086bdmov [rsp+32], rdx
1400086c2mov rdx, r15
1400086c5mov [rsp+176], r8
1400086cdmov r8l, 201
1400086d3mov [rsp+184], r9
1400086dbmov r9l, ecx
1400086delea rcx, [rip+0x23016]
1400086e5call printf
1400086eaxor edx, edx
1400086ecmov rcx, [rsp+152]
1400086f4xor eax, eax
1400086f6mov [rsp+68], edx
1400086falea rdx, [rsp+68]
1400086ffmov [rsp+72], rax
140008704call GetRequestIDForCallingObjectFile
140008709test eax, eax
14000870bje 0x14000871d
14000870dmov edx, [rsp+68]
140008711mov ecx, 94
140008716call PackageCreateWithRequestID
14000871bjmp 0x140008727
14000871d
14000871dloc_14000871d:
14000871dmov ecx, 94
140008722call PackageCreate
140008727
140008727loc_140008727:
140008727mov r12, [rip+0x23c42]
14000872emov rsi, rax
140008731mov r8, rdi
140008734xor edx, edx
140008736lea r9, [rsp+176]
14000873exor ecx, ecx
140008740mov [rsp+72], r9
140008745mov [rsp+56], r9
14000874acall [r12+1612]
140008752mov ecx, 64
140008757movsxd rbx, eax
14000875amov rdx, rbx
14000875dcall [r12+932]
140008765mov r9, [rsp+56]
14000876amov r8, rdi
14000876dmov rdx, rbx
140008770mov rbp, rax
140008773mov rcx, rax
140008776call [r12+1612]
14000877emov [rsp+32], rbp
140008783mov r9l, ebx
140008786mov r8l, 224
14000878cmov rdx, r15
14000878flea rcx, [rip+0x22f92]
140008796mov rdi, rbp
140008799call printf
14000879emov edx, r13l
1400087a1mov rcx, rsi
1400087a4call PackageAddInt32
1400087a9mov r8, rbx
1400087acmov rdx, rbp
1400087afmov rcx, rsi
1400087b2call PackageAddBytes
1400087b7mov rcx, rsi
1400087bacall PackageTransmit
1400087bfmov rcx, rbx
1400087c2xor eax, eax
1400087c4rep stosb [rdi], al
1400087c6mov rcx, rbp
1400087c9call [r12+940]
1400087d1add rsp, 88
1400087d5pop rbx
1400087d6pop rsi
1400087d7pop rdi
1400087d8pop rbp
1400087d9pop r12
1400087dbpop r13
1400087ddpop r14
1400087dfpop r15
1400087e1ret
1400086a0

1400087e2
1400087e2 // align 0x10

1400087f0
1400087f0BeaconSpawnTemporaryProcess:
1400087f0sub rsp, 88
1400087f4mov rax, [rip+0x23b75]
1400087fbmov r10l, edx
1400087fetest ecx, ecx
140008800mov rdx, [rax+264]
140008807cmove rdx, [rax+256]
14000880ftest r10l, r10l
140008812je 0x14000884b
140008814mov [rsp+64], r8
140008819xor r8l, r8l
14000881cxor ecx, ecx
14000881emov [rsp+72], r9
140008823xor r9l, r9l
140008826mov [rsp+56], r8
14000882bmov [rsp+48], r8
140008830xor r8l, r8l
140008833mov [rsp+40], 0x8000000
14000883bmov [rsp+32], 1
140008843call [rax+956]
140008849jmp 0x14000887e
14000884b
14000884bloc_14000884b:
14000884bxor ecx, ecx
14000884dmov [rsp+64], r9
140008852mov r9, rdx
140008855mov edx, 1
14000885amov [rsp+56], r8
14000885fxor r8l, r8l
140008862mov [rsp+48], rcx
140008867mov [rsp+40], rcx
14000886cor rcx, -1
140008870mov [rsp+32], 1024
140008878call [rax+1356]
14000887e
14000887eloc_14000887e:
14000887eadd rsp, 88
140008882ret
1400087f0

140008883
140008883 // align 0x10

140008890
140008890BeaconUseToken:
140008890sub rsp, 72
140008894xor r9l, r9l
140008897xor r8l, r8l
14000889axor edx, edx
14000889clea rax, [rsp+56]
1400088a1mov [rsp+32], 1
1400088a9mov [rsp+40], rax
1400088aemov [rsp+56], -1
1400088b7call SysNtDuplicateToken
1400088bctest eax, eax
1400088beje 0x1400088dc
1400088c0mov rax, [rip+0x23aa9]
1400088c7xor ecx, ecx
1400088c9mov rdx, [rsp+56]
1400088cecall [rax+1604]
1400088d4test eax, eax
1400088d6setne al
1400088d9movzx eax, al
1400088dc
1400088dcloc_1400088dc:
1400088dcadd rsp, 72
1400088e0ret
140008890

1400088e1
1400088e1 // align 0x10

1400088f0
1400088f0CanTokenBeImpersonated:
1400088f0push rbx
1400088f1xor eax, eax
1400088f3sub rsp, 48
1400088f7mov [rsp+40], rax
1400088fccall SysImpersonateLoggedOnUser
140008901test eax, eax
140008903jne 0x140008909
140008905
140008905loc_140008905:
140008905xor eax, eax
140008907jmp 0x140008955
140008909
140008909loc_140008909:
140008909lea r9, [rsp+40]
14000890emov r8l, 1
140008914mov rax, [rip+0x23a55]
14000891bmov edx, 0x2000000
140008920mov rcx, -2
140008927call [rax+1588]
14000892dmov ebx, eax
14000892fcall TokenRevSelf
140008934test ebx, ebx
140008936je 0x140008905
140008938mov rcx, [rsp+40]
14000893dcall IsImpersonationToken
140008942mov rcx, [rsp+40]
140008947mov ebx, eax
140008949call SysNtClose
14000894exor eax, eax
140008950test ebx, ebx
140008952setne al
140008955
140008955loc_140008955:
140008955add rsp, 48
140008959pop rbx
14000895aret
1400088f0

14000895b
14000895b // align 0x10

140008960
140008960CfgAddressAdd:
140008960push rdi
140008961mov r8, rcx
140008964xor eax, eax
140008966mov ecx, 9
14000896bsub rdx, r8
14000896eadd rsp, -128
140008972lea rdi, [rsp+92]
140008977mov [rsp+72], r8
14000897clea r9, [rsp+72]
140008981rep stosd [rdi], eax
140008983xor eax, eax
140008985mov [rsp+56], rdx
14000898aor rcx, -1
14000898emov [rsp+52], eax
140008992movsxd rax, [r8+60]
140008996mov edx, 2
14000899bmov [rsp+64], 1
1400089a4mov eax, [r8+rax+80]
1400089a9mov [rsp+40], 40
1400089b1mov r8l, 1
1400089b7mov [rsp+88], 1
1400089bfadd rax, 4095
1400089c5and rax, -4096
1400089cbmov [rsp+80], rax
1400089d0lea rax, [rsp+52]
1400089d5mov [rsp+96], rax
1400089dalea rax, [rsp+56]
1400089dfmov [rsp+104], rax
1400089e4lea rax, [rsp+88]
1400089e9mov [rsp+32], rax
1400089eecall SysNtSetInformationVirtualMemory
1400089f3test eax, eax
1400089f5jns 0x140008a13
1400089f7mov r9l, eax
1400089famov r8l, 1249
140008a00lea rdx, [rip+0x23f19]
140008a07lea rcx, [rip+0x21d14]
140008a0ecall printf
140008a13
140008a13loc_140008a13:
140008a13sub rsp, -128
140008a17pop rdi
140008a18ret
140008960

140008a19
140008a19 // align 0x10

140008a20
140008a20CfgQueryEnforced:
140008a20sub rsp, 72
140008a24xor eax, eax
140008a26mov edx, 52
140008a2bor rcx, -1
140008a2fmov [rsp+32], rax
140008a34mov r9l, 8
140008a3alea r8, [rsp+56]
140008a3fmov [rsp+56], 7
140008a48call SysNtQueryInformationProcess
140008a4dlea rdx, [rip+0x2431c]
140008a54test eax, eax
140008a56jns 0x140008a71
140008a58mov r9l, eax
140008a5bmov r8l, 1208
140008a61lea rcx, [rip+0x21c4a]
140008a68call printf
140008a6dxor eax, eax
140008a6fjmp 0x140008a9e
140008a71
140008a71loc_140008a71:
140008a71cmp [rsp+60], 0
140008a76lea rax, [rip+0x21c2a]
140008a7dlea r9, [rip+0x21c28]
140008a84mov r8l, 1212
140008a8acmovne r9, rax
140008a8elea rcx, [rip+0x21c55]
140008a95call printf
140008a9amov eax, [rsp+60]
140008a9e
140008a9eloc_140008a9e:
140008a9eadd rsp, 72
140008aa2ret
140008a20

140008aa3
140008aa3 // align 0x10

140008ab0
140008ab0CharStringToWCharString:
140008ab0mov eax, r8l
140008ab3
140008ab3loc_140008ab3:
140008ab3dec eax
140008ab5js 0x140008ad8
140008ab7movsx r9w, [rdx]
140008abcadd rcx, 2
140008ac0inc rdx
140008ac3mov [rcx-2], r9w
140008ac8test r9w, r9w
140008accjne 0x140008ab3
140008acecdqe
140008ad0sub r8, rax
140008ad3lea rax, [r8-1]
140008ad7ret
140008ad8
140008ad8loc_140008ad8:
140008ad8movsxd rdx, eax
140008adbmov rax, r8
140008adesub rax, rdx
140008ae1ret
140008ab0

140008ae2
140008ae2 // align 0x10

140008af0
140008af0ClrCreateInstance:
140008af0push rbp
140008af1xor eax, eax
140008af3mov rbp, rdx
140008af6push rdi
140008af7mov rdi, r9
140008afapush rsi
140008afbmov rsi, r8
140008afemov r8, rdx
140008b01lea rdx, [rip+0x1c508]
140008b08push rbx
140008b09mov rbx, rcx
140008b0clea rcx, [rip+0x1c4cd]
140008b13sub rsp, 56
140008b17mov [rsp+44], eax
140008b1bmov rax, [rip+0x2384e]
140008b22call [rax+1276]
140008b28test eax, eax
140008b2ajne 0x140008be8
140008b30mov rcx, [rbp]
140008b34mov r9, rsi
140008b37lea r8, [rip+0x1c4e2]
140008b3emov rdx, rbx
140008b41mov rax, [rcx]
140008b44call [rax+24]
140008b47test eax, eax
140008b49jne 0x140008bcf
140008b4fmov rcx, [rsi]
140008b52lea rdx, [rsp+44]
140008b57mov rax, [rcx]
140008b5acall [rax+80]
140008b5dtest eax, eax
140008b5fjne 0x140008baf
140008b61cmp [rsp+44], 0
140008b66je 0x140008baf
140008b68mov rcx, [rsi]
140008b6bmov r9, rdi
140008b6elea r8, [rip+0x1c4bb]
140008b75lea rdx, [rip+0x1c474]
140008b7cmov rax, [rcx]
140008b7fcall [rax+72]
140008b82test eax, eax
140008b84jne 0x140008b96
140008b86mov rcx, [rdi]
140008b89mov rax, [rcx]
140008b8ccall [rax+80]
140008b8fmov eax, 1
140008b94jmp 0x140008c01
140008b96
140008b96loc_140008b96:
140008b96mov r9, rbx
140008b99mov r8l, 559
140008b9flea rdx, [rip+0x239fa]
140008ba6lea rcx, [rip+0x1eb0a]
140008badjmp 0x140008bc6
140008baf
140008bafloc_140008baf:
140008bafmov r9, rbx
140008bb2mov r8l, 565
140008bb8lea rdx, [rip+0x239e1]
140008bbflea rcx, [rip+0x1eb8d]
140008bc6
140008bc6loc_140008bc6:
140008bc6call printf
140008bcbxor eax, eax
140008bcdjmp 0x140008c01
140008bcf
140008bcfloc_140008bcf:
140008bcfmov r9, rbx
140008bd2mov r8l, 571
140008bd8lea rdx, [rip+0x239c1]
140008bdflea rcx, [rip+0x1ebfb]
140008be6jmp 0x140008bc6
140008be8
140008be8loc_140008be8:
140008be8mov r9, rbx
140008bebmov r8l, 577
140008bf1lea rdx, [rip+0x239a8]
140008bf8lea rcx, [rip+0x1ec7a]
140008bffjmp 0x140008bc6
140008c01
140008c01loc_140008c01:
140008c01add rsp, 56
140008c05pop rbx
140008c06pop rsi
140008c07pop rdi
140008c08pop rbp
140008c09ret
140008af0

140008c0a
140008c0a // align 0x10

140008c10
140008c10CoffeeCleanup:
140008c10push rdi
140008c11xor edx, edx
140008c13push rsi
140008c14push rbx
140008c15sub rsp, 64
140008c19mov [rsp+48], rdx
140008c1emov [rsp+56], rdx
140008c23test rcx, rcx
140008c26je 0x140008d09
140008c2cmov r8, [rcx+40]
140008c30mov rbx, rcx
140008c33test r8, r8
140008c36je 0x140008d09
140008c3cmov [rsp+32], 4
140008c44mov r9, [rcx+48]
140008c48or rdx, -1
140008c4cmov ecx, 2
140008c51call MemoryProtect
140008c56test eax, eax
140008c58je 0x140008c66
140008c5amov rdi, [rbx+40]
140008c5emov rcx, [rbx+48]
140008c62xor eax, eax
140008c64rep stosb [rdi], al
140008c66
140008c66loc_140008c66:
140008c66mov rax, [rbx+40]
140008c6aor rcx, -1
140008c6elea rdx, [rsp+48]
140008c73mov r9l, 32768
140008c79lea r8, [rsp+56]
140008c7emov [rsp+48], rax
140008c83mov rax, [rbx+48]
140008c87mov [rsp+56], rax
140008c8ccall SysNtFreeVirtualMemory
140008c91mov ecx, eax
140008c93test eax, eax
140008c95jns 0x140008cd9
140008c97mov rdi, [rip+0x236d2]
140008c9emov rsi, [rdi+2230]
140008ca5call [rdi+348]
140008cabmov r8l, 383
140008cb1lea rdx, [rip+0x24508]
140008cb8lea rcx, [rip+0x226ef]
140008cbfmov [rsi+104], eax
140008cc2mov rax, [rdi+2230]
140008cc9mov eax, [rax+104]
140008cccmov [rsp+32], eax
140008cd0mov r9, [rbx+40]
140008cd4call printf
140008cd9
140008cd9loc_140008cd9:
140008cd9mov rdi, [rbx+60]
140008cddtest rdi, rdi
140008ce0je 0x140008d09
140008ce2mov rax, [rbx+8]
140008ce6movzx ecx, [rax+2]
140008ceaxor eax, eax
140008cecshl rcx, 4
140008cf0rep stosb [rdi], al
140008cf2mov rax, [rip+0x23677]
140008cf9mov rcx, [rbx+60]
140008cfdcall [rax+940]
140008d03xor eax, eax
140008d05mov [rbx+60], rax
140008d09
140008d09loc_140008d09:
140008d09add rsp, 64
140008d0dpop rbx
140008d0epop rsi
140008d0fpop rdi
140008d10ret
140008c10

140008d11
140008d11 // align 0x10

140008d20
140008d20CoffeeExecuteFunction:
140008d20push r15
140008d22push r14
140008d24mov r14, r9
140008d27push r13
140008d29mov r13, r8
140008d2cpush r12
140008d2epush rbp
140008d2fpush rdi
140008d30push rsi
140008d31xor esi, esi
140008d33push rbx
140008d34mov rbx, rcx
140008d37mov rcx, rdx
140008d3asub rsp, 56
140008d3emov [rsp+136], rdx
140008d46call StringLengthA
140008d4bmov rbp, [rip+0x2361e]
140008d52mov r15, rax
140008d55cmp [rbp+240], 0
140008d5cje 0x140008db1
140008d5elea r9, [rip+0x22564]
140008d65mov r8l, 238
140008d6blea rdx, [rip+0x2450e]
140008d72lea rcx, [rip+0x2253c]
140008d79call printf
140008d7elea rdx, [rip+0x1940b]
140008d85mov ecx, 1
140008d8acall [rbp+428]
140008d90mov rsi, rax
140008d93test rax, rax
140008d96jne 0x140008db1
140008d98mov rax, [rbp+2230]
140008d9fmov ecx, 1
140008da4mov edx, [rax+104]
140008da7call PackageTransmitError
140008dacjmp 0x140008e4b
140008db1
140008db1loc_140008db1:
140008db1xor r12l, r12l
140008db4jmp 0x140008db9
140008db6
140008db6loc_140008db6:
140008db6inc r12l
140008db9
140008db9loc_140008db9:
140008db9mov rax, [rbx+8]
140008dbdcmp r12w, [rax+2]
140008dc2jae 0x140008edb
140008dc8movzx edi, r12w
140008dccmov rdx, [rbx]
140008dcfimul rax, rdi, 40
140008dd3lea rax, [rdx+rax+20]
140008dd8cmp [rax+16], 0
140008ddcmov [rbx+16], rax
140008de0je 0x140008db6
140008de2mov r9l, [rax+36]
140008de6mov eax, 1
140008debmov edx, r9l
140008deeand edx, 0xffffffffe0000000
140008df4jne 0x140008e52
140008df6
140008df6loc_140008df6:
140008df6mov rdx, [rbx+16]
140008dfatest [rdx+39], 4
140008dfeje 0x140008e03
140008e00or ah, 2
140008e03
140008e03loc_140008e03:
140008e03mov r10, [rbx+60]
140008e07shl rdi, 4
140008e0bor rdx, -1
140008e0fmov ecx, 2
140008e14add r10, rdi
140008e17mov r9, [r10+8]
140008e1bmov [rsp+32], eax
140008e1fmov r8, [r10]
140008e22call MemoryProtect
140008e27test eax, eax
140008e29jne 0x140008db6
140008e2blea r9, [rip+0x224d6]
140008e32mov r8l, 283
140008e38
140008e38loc_140008e38:
140008e38lea rdx, [rip+0x24441]
140008e3flea rcx, [rip+0x2246f]
140008e46
140008e46loc_140008e46:
140008e46call printf
140008e4b
140008e4bloc_140008e4b:
140008e4bxor eax, eax
140008e4djmp 0x140009084
140008e52
140008e52loc_140008e52:
140008e52mov eax, 16
140008e57cmp edx, 0x20000000
140008e5dje 0x140008df6
140008e5fmov eax, 2
140008e64cmp edx, 0x40000000
140008e6aje 0x140008df6
140008e6cmov eax, 32
140008e71cmp edx, 0x60000000
140008e77je 0x140008df6
140008e7dmov eax, 8
140008e82cmp edx, 0xffffffff80000000
140008e88je 0x140008df6
140008e8emov eax, 128
140008e93cmp edx, 0xffffffffa0000000
140008e99je 0x140008df6
140008e9fmov eax, 4
140008ea4cmp edx, 0xffffffffc0000000
140008eaaje 0x140008df6
140008eb0cmp edx, 0xffffffffe0000000
140008eb6je 0x140008ed1
140008eb8mov r8l, 273
140008ebelea rdx, [rip+0x243bb]
140008ec5lea rcx, [rip+0x22415]
140008ecccall printf
140008ed1
140008ed1loc_140008ed1:
140008ed1mov eax, 64
140008ed6jmp 0x140008df6
140008edb
140008edbloc_140008edb:
140008edbmov r9, [rbx+76]
140008edftest r9, r9
140008ee2jne 0x140008ee8
140008ee4
140008ee4loc_140008ee4:
140008ee4xor edi, edi
140008ee6jmp 0x140008f50
140008ee8
140008ee8loc_140008ee8:
140008ee8mov [rsp+32], 2
140008ef0mov r8, [rbx+68]
140008ef4or rdx, -1
140008ef8mov ecx, 2
140008efdcall MemoryProtect
140008f02lea r9, [rip+0x223ff]
140008f09mov r8l, 295
140008f0ftest eax, eax
140008f11jne 0x140008ee4
140008f13jmp 0x140008e38
140008f18
140008f18loc_140008f18:
140008f18mov r12l, edi
140008f1bmov rdx, [rbx+32]
140008f1fimul r12, r12, 18
140008f23lea rcx, [rdx+r12]
140008f27cmp [rcx], 0
140008f2ajne 0x140008f3a
140008f2cimul rax, rax, 18
140008f30mov ecx, [rcx+4]
140008f33add rax, rcx
140008f36lea rcx, [rdx+rax]
140008f3a
140008f3aloc_140008f3a:
140008f3amov rdx, [rsp+136]
140008f42mov r8l, r15l
140008f45call MemCompare
140008f4atest eax, eax
140008f4cje 0x140008f5d
140008f4einc edi
140008f50
140008f50loc_140008f50:
140008f50mov rax, [rbx+8]
140008f54mov eax, [rax+12]
140008f57cmp edi, eax
140008f59jb 0x140008f18
140008f5bjmp 0x140008f88
140008f5d
140008f5dloc_140008f5d:
140008f5dadd r12, [rbx+32]
140008f61mov r8, [rbx+60]
140008f65movzx eax, [r12+12]
140008f6bmov r12l, [r12+8]
140008f70shl rax, 4
140008f74add r12, [r8+rax-16]
140008f79je 0x140008f88
140008f7bmov rax, [rbx+8]
140008f7fmov r9w, [rax+2]
140008f84xor eax, eax
140008f86jmp 0x140008ffc
140008f88
140008f88loc_140008f88:
140008f88mov r9, [rsp+136]
140008f90mov r8l, 324
140008f96lea rdx, [rip+0x242e3]
140008f9dlea rcx, [rip+0x2237d]
140008fa4call printf
140008fa9mov edx, [rsp+160]
140008fb0mov ecx, 20
140008fb5call PackageCreateWithRequestID
140008fbamov edx, 2
140008fbfmov rcx, rax
140008fc2mov rbx, rax
140008fc5call PackageAddInt32
140008fcamov rdx, [rsp+136]
140008fd2mov rcx, rbx
140008fd5call PackageAddString
140008fdamov rcx, rbx
140008fddcall PackageTransmit
140008fe2jmp 0x140008e4b
140008fe7
140008fe7loc_140008fe7:
140008fe7mov rcx, rax
140008feashl rcx, 4
140008feeadd rcx, r8
140008ff1mov rdx, [rcx]
140008ff4cmp r12, rdx
140008ff7jae 0x140009004
140008ff9
140008ff9loc_140008ff9:
140008ff9inc rax
140008ffc
140008ffcloc_140008ffc:
140008ffccmp ax, r9w
140009000jb 0x140008fe7
140009002jmp 0x140009023
140009004
140009004loc_140009004:
140009004add rdx, [rcx+8]
140009008cmp r12, rdx
14000900bjae 0x140008ff9
14000900dimul rax, rax, 40
140009011mov rdx, [rbx]
140009014lea rax, [rdx+rax+20]
140009019mov [rbx+16], rax
14000901dtest [rax+39], 32
140009021jne 0x14000903f
140009023
140009023loc_140009023:
140009023mov r9, r12
140009026mov r8l, 351
14000902clea rdx, [rip+0x2424d]
140009033lea rcx, [rip+0x22319]
14000903ajmp 0x140008e46
14000903f
14000903floc_14000903f:
14000903fmov r8l, 355
140009045lea rdx, [rip+0x24234]
14000904clea rcx, [rip+0x22262]
140009053lea r9, [rip+0x2233b]
14000905acall printf
14000905fmov r8, r14
140009062mov rdx, r13
140009065mov rcx, r12
140009068call CoffeeFunction
14000906dtest rsi, rsi
140009070jne 0x140009079
140009072
140009072loc_140009072:
140009072mov eax, 1
140009077jmp 0x140009084
140009079
140009079loc_140009079:
140009079mov rcx, rsi
14000907ccall [rbp+436]
140009082jmp 0x140009072
140009084
140009084loc_140009084:
140009084add rsp, 56
140009088pop rbx
140009089pop rsi
14000908apop rdi
14000908bpop rbp
14000908cpop r12
14000908epop r13
140009090pop r14
140009092pop r15
140009094ret
140008d20

140009095
140009095 // align 0x10

1400090a0
1400090a0CoffeeFunction:
1400090a0sub rsp, 40
1400090a4mov rax, rcx
1400090a7mov rcx, rdx
1400090aamov rdx, [rsp+40]
1400090afmov [rip+0x1be8a], rdx
1400090b6mov edx, r8l
1400090b9call rax
1400090bblea r9, [rip+0x221ea]
1400090c2mov r8l, 223
1400090c8lea rdx, [rip+0x24251]
1400090cflea rcx, [rip+0x221df]
1400090d6add rsp, 40
1400090dajmp 0x140023140
1400090a0

1400090df
1400090df // align 0x10

1400090e0
1400090e0CoffeeGetFunMapSize:
1400090e0push r14
1400090e2xor eax, eax
1400090e4push r13
1400090e6push r12
1400090e8xor r12l, r12l
1400090ebpush rbp
1400090ecpush rdi
1400090edpush rsi
1400090eexor esi, esi
1400090f0push rbx
1400090f1mov rbx, rcx
1400090f4sub rsp, 48
1400090f8mov [rsp+39], rax
1400090fdlea r13, [rsp+39]
140009102mov [rsp+47], 0
140009107
140009107loc_140009107:
140009107mov rax, [rbx+8]
14000910bcmp r12w, [rax+2]
140009110jae 0x1400091b1
140009116movzx edx, r12w
14000911amov rax, [rbx]
14000911dxor r14l, r14l
140009120xor ebp, ebp
140009122imul rdx, rdx, 40
140009126lea rdx, [rax+rdx+20]
14000912bmov [rbx+16], rdx
14000912fmov edx, [rdx+24]
140009132add rax, rdx
140009135
140009135loc_140009135:
140009135mov rdx, [rbx+16]
140009139mov [rbx+24], rax
14000913dmovzx edx, [rdx+32]
140009141cmp r14l, edx
140009144jae 0x1400091a9
140009146mov edx, [rax+4]
140009149mov rcx, [rbx+32]
14000914dimul rdx, rdx, 18
140009151add rdx, rcx
140009154cmp [rdx], 0
140009157je 0x140009172
140009159mov rdi, r13
14000915cmov ecx, 9
140009161mov eax, ebp
140009163rep stosb [rdi], al
140009165mov rax, [rdx]
140009168mov rcx, r13
14000916bmov [rsp+39], rax
140009170jmp 0x140009186
140009172
140009172loc_140009172:
140009172mov rax, [rbx+8]
140009176mov edx, [rdx+4]
140009179mov eax, [rax+12]
14000917cimul rax, rax, 18
140009180add rax, rdx
140009183add rcx, rax
140009186
140009186loc_140009186:
140009186xor r8l, r8l
140009189mov edx, 6
14000918ecall HashEx
140009193cmp eax, 0xffffffffec6ba2a8
140009198jne 0x14000919c
14000919ainc esi
14000919c
14000919cloc_14000919c:
14000919cmov rax, [rbx+24]
1400091a0inc r14l
1400091a3add rax, 10
1400091a7jmp 0x140009135
1400091a9
1400091a9loc_1400091a9:
1400091a9inc r12l
1400091acjmp 0x140009107
1400091b1
1400091b1loc_1400091b1:
1400091b1add rsp, 48
1400091b5mov eax, esi
1400091b7pop rbx
1400091b8shl rax, 3
1400091bcpop rsi
1400091bdpop rdi
1400091bepop rbp
1400091bfpop r12
1400091c1pop r13
1400091c3pop r14
1400091c5ret
1400090e0

1400091c6
1400091c6 // align 0x10

1400091d0
1400091d0CoffeeLdr:
1400091d0push r15
1400091d2push r14
1400091d4mov r14, r9
1400091d7push r13
1400091d9mov r13, rdx
1400091dcpush r12
1400091depush rbp
1400091dfpush rdi
1400091e0push rsi
1400091e1push rbx
1400091e2sub rsp, 88
1400091e6mov [rsp+48], r9
1400091ebmov r9, rcx
1400091eemov r12l, [rsp+192]
1400091f6mov [rsp+40], r8
1400091fbmov [rsp+32], rdx
140009200lea rdx, [rip+0x23749]
140009207mov [rsp+64], rcx
14000920clea rcx, [rip+0x222a4]
140009213mov [rsp+72], r8
140009218mov r8l, 650
14000921ecall printf
140009223test r13, r13
140009226jne 0x14000924c
140009228lea r9, [rip+0x222d7]
14000922fmov r8l, 654
140009235lea rdx, [rip+0x23714]
14000923cxor ebx, ebx
14000923elea rcx, [rip+0x22070]
140009245call printf
14000924ajmp 0x1400092b7
14000924c
14000924cloc_14000924c:
14000924cmov rsi, [rip+0x2311d]
140009253mov edx, 92
140009258mov ecx, 64
14000925dcall [rsi+932]
140009263mov [rax], r13
140009266mov rbx, rax
140009269mov [rax+8], r13
14000926dmov eax, [r13+8]
140009271mov [rbx+56], r12l
140009275add rax, r13
140009278cmp [r13], -31132
14000927fmov [rbx+32], rax
140009283mov rax, [rsi+2334]
14000928amov [rbx+84], rax
14000928emov [rsi+2334], rbx
140009295je 0x1400092be
140009297lea r9, [rip+0x22281]
14000929emov r8l, 677
1400092a4
1400092a4loc_1400092a4:
1400092a4lea rdx, [rip+0x236a5]
1400092ablea rcx, [rip+0x22003]
1400092b2call printf
1400092b7
1400092b7loc_1400092b7:
1400092b7xor ebp, ebp
1400092b9jmp 0x140009445
1400092be
1400092beloc_1400092be:
1400092bemovzx edx, [r13+2]
1400092c3mov ecx, 64
1400092c8shl rdx, 4
1400092cccall [rsi+932]
1400092d2mov rcx, rbx
1400092d5mov [rbx+60], rax
1400092d9call CoffeeGetFunMapSize
1400092decmp [rbx+60], 0
1400092e3mov [rbx+76], rax
1400092e7mov r8, rax
1400092eaje 0x1400092ff
1400092ecmov rax, [rbx+8]
1400092f0mov r9l, 20
1400092f6xor ecx, ecx
1400092f8mov r11w, [rax+2]
1400092fdjmp 0x14000930e
1400092ff
1400092ffloc_1400092ff:
1400092fflea r9, [rip+0x2222e]
140009306mov r8l, 696
14000930cjmp 0x1400092a4
14000930e
14000930eloc_14000930e:
14000930emov rax, [rbx+48]
140009312cmp r11w, cx
140009316je 0x140009342
140009318mov rdx, [rbx]
14000931binc ecx
14000931dadd rdx, r9
140009320add r9, 40
140009324mov [rbx+16], rdx
140009328mov edx, [rdx+16]
14000932badd rdx, rax
14000932emov rax, rdx
140009331neg rax
140009334and eax, 4095
140009339add rax, rdx
14000933cmov [rbx+48], rax
140009340jmp 0x14000930e
140009342
140009342loc_140009342:
140009342add r8, rax
140009345mov r9l, 4
14000934bor rdx, -1
14000934fxor ecx, ecx
140009351mov [rbx+48], r8
140009355xor r15l, r15l
140009358call MemoryAlloc
14000935dlea r9, [rip+0x221ea]
140009364mov r8l, 714
14000936amov [rbx+40], rax
14000936etest rax, rax
140009371je 0x1400092a4
140009377
140009377loc_140009377:
140009377mov rdx, [rbx+8]
14000937bcmp r15w, [rdx+2]
140009380jae 0x140009408
140009386movzx esi, r15w
14000938amov rcx, [rbx]
14000938dmovzx r9l, r15w
140009391mov r8l, 728
140009397imul rdx, rsi, 40
14000939bshl rsi, 4
14000939finc r15l
1400093a2lea rdx, [rcx+rdx+20]
1400093a7mov rcx, [rbx+60]
1400093abmov [rbx+16], rdx
1400093afmov edx, [rdx+16]
1400093b2add rcx, rsi
1400093b5mov [rcx+8], rdx
1400093b9add rdx, rax
1400093bcmov rbp, rdx
1400093bfmov [rcx], rax
1400093c2lea rcx, [rip+0x221ab]
1400093c9mov [rsp+32], rax
1400093ceneg rbp
1400093d1and ebp, 4095
1400093d7add rbp, rdx
1400093dalea rdx, [rip+0x2356f]
1400093e1call printf
1400093e6mov rdx, [rbx+16]
1400093eamov rax, [rbx+60]
1400093eemov rax, [rax+rsi]
1400093f2mov esi, [rdx+20]
1400093f5mov ecx, [rdx+16]
1400093f8mov rdi, rax
1400093fbadd rsi, r13
1400093femov rax, rbp
140009401rep movsb [rdi], [rsi]
140009403jmp 0x140009377
140009408
140009408loc_140009408:
140009408mov [rbx+68], rax
14000940cmov rcx, rbx
14000940fcall CoffeeProcessSections
140009414lea r9, [rip+0x22189]
14000941bmov r8l, 738
140009421test eax, eax
140009423je 0x1400092a4
140009429mov [rsp+32], r12l
14000942emov r8, [rsp+72]
140009433mov r9, r14
140009436mov rcx, rbx
140009439mov rdx, [rsp+64]
14000943ecall CoffeeExecuteFunction
140009443mov ebp, eax
140009445
140009445loc_140009445:
140009445lea rdx, [rip+0x23504]
14000944clea r9, [rip+0x22172]
140009453mov r8l, 745
140009459lea rcx, [rip+0x21e55]
140009460call printf
140009465mov rcx, rbx
140009468call CoffeeCleanup
14000946dmov edx, r12l
140009470mov ecx, 20
140009475test ebp, ebp
140009477je 0x140009488
140009479call PackageCreateWithRequestID
14000947emov edx, 3
140009483mov rsi, rax
140009486jmp 0x140009495
140009488
140009488loc_140009488:
140009488call PackageCreateWithRequestID
14000948dmov edx, 4
140009492mov rsi, rax
140009495
140009495loc_140009495:
140009495mov rcx, rsi
140009498call PackageAddInt32
14000949dmov rcx, rsi
1400094a0call PackageTransmit
1400094a5mov rcx, rbx
1400094a8call RemoveCoffeeFromInstance
1400094adtest rbx, rbx
1400094b0je 0x1400094e1
1400094b2mov rdi, rbx
1400094b5mov ecx, 8
1400094baxor eax, eax
1400094bcrep stosb [rdi], al
1400094bemov rax, [rip+0x22eab]
1400094c5mov rcx, rbx
1400094c8mov rax, [rax+940]
1400094cfadd rsp, 88
1400094d3pop rbx
1400094d4pop rsi
1400094d5pop rdi
1400094d6pop rbp
1400094d7pop r12
1400094d9pop r13
1400094dbpop r14
1400094ddpop r15
1400094dfjmp rax
1400094e1
1400094e1loc_1400094e1:
1400094e1add rsp, 88
1400094e5pop rbx
1400094e6pop rsi
1400094e7pop rdi
1400094e8pop rbp
1400094e9pop r12
1400094ebpop r13
1400094edpop r14
1400094efpop r15
1400094f1ret
1400091d0

1400094f2
1400094f2 // align 0x10

140009500
140009500CoffeeProcessSections:
140009500push r15
140009502lea r9, [rip+0x21eda]
140009509mov r8l, 397
14000950flea rdx, [rip+0x23b3a]
140009516push r14
140009518xor r14l, r14l
14000951bpush r13
14000951dpush r12
14000951fxor r12l, r12l
140009522push rbp
140009523mov rbp, rcx
140009526lea rcx, [rip+0x21d88]
14000952dpush rdi
14000952epush rsi
14000952fpush rbx
140009530sub rsp, 104
140009534call printf
140009539xor eax, eax
14000953bmov [rsp+95], 0
140009540lea r15, [rsp+87]
140009545mov [rsp+72], rax
14000954amov [rsp+87], rax
14000954f
14000954floc_14000954f:
14000954fmov rax, [rbp+8]
140009553cmp r12w, [rax+2]
140009558jae 0x1400097b5
14000955emovzx r13l, r12w
140009562mov rax, [rbp]
140009566xor r10l, r10l
140009569imul rdx, r13, 40
14000956dshl r13, 4
140009571lea rdx, [rax+rdx+20]
140009576mov [rbp+16], rdx
14000957amov edx, [rdx+24]
14000957dadd rax, rdx
140009580
140009580loc_140009580:
140009580mov rdx, [rbp+16]
140009584mov [rbp+24], rax
140009588movzx edx, [rdx+32]
14000958ccmp r10l, edx
14000958fjae 0x1400097ad
140009595mov r8l, [rax+4]
140009599mov rdx, [rbp+32]
14000959dimul r8, r8, 18
1400095a1add r8, rdx
1400095a4cmp [r8], 0
1400095a8je 0x1400095c3
1400095aamov rdi, r15
1400095admov ecx, 9
1400095b2xor eax, eax
1400095b4rep stosb [rdi], al
1400095b6mov rax, [r8]
1400095b9mov rdx, r15
1400095bcmov [rsp+87], rax
1400095c1jmp 0x1400095d8
1400095c3
1400095c3loc_1400095c3:
1400095c3mov rax, [rbp+8]
1400095c7mov ecx, [r8+4]
1400095cbmov eax, [rax+12]
1400095ceimul rax, rax, 18
1400095d2add rax, rcx
1400095d5add rdx, rax
1400095d8
1400095d8loc_1400095d8:
1400095d8mov rax, [rbp+24]
1400095dcmov rcx, [rbp+60]
1400095e0lea r9, [rsp+72]
1400095e5mov [rsp+60], r10l
1400095eamov [rsp+48], rdx
1400095efmov rdi, [rbp+68]
1400095f3mov ebx, [rax]
1400095f5movzx eax, [r8+12]
1400095famovzx r8l, [r8+14]
1400095ffadd rbx, [rcx+r13]
140009603shl rax, 4
140009607mov rsi, [rcx+rax-16]
14000960cmov rcx, rbp
14000960fcall CoffeeProcessSymbol
140009614mov rdx, [rsp+48]
140009619mov r10l, [rsp+60]
14000961etest eax, eax
140009620jne 0x140009643
140009622mov r9, rdx
140009625mov r8l, 445
14000962blea rdx, [rip+0x23a1e]
140009632lea rcx, [rip+0x21dbb]
140009639call printf
14000963ejmp 0x140009799
140009643
140009643loc_140009643:
140009643mov rax, [rbp+24]
140009647movzx r9l, [rax+8]
14000964cmov rax, [rsp+72]
140009651cmp r9w, 4
140009656jne 0x14000967b
140009658test rax, rax
14000965bje 0x140009702
140009661mov edx, r14l
140009664inc r14l
140009667lea rdx, [rdi+8*rdx]
14000966bmov [rdx], rax
14000966esub rdx, rbx
140009671sub edx, 4
140009674mov [rbx], edx
140009676jmp 0x14000979d
14000967b
14000967bloc_14000967b:
14000967bcmp r9w, 5
140009680jne 0x140009696
140009682test rax, rax
140009685jne 0x14000972a
14000968bmov eax, [rbx]
14000968dsub rsi, rbx
140009690lea eax, [rax+rsi-5]
140009694jmp 0x14000970b
140009696
140009696loc_140009696:
140009696cmp r9w, 6
14000969bjne 0x1400096b1
14000969dtest rax, rax
1400096a0jne 0x140009732
1400096a6mov eax, [rbx]
1400096a8sub rsi, rbx
1400096ablea eax, [rax+rsi-6]
1400096afjmp 0x14000970b
1400096b1
1400096b1loc_1400096b1:
1400096b1cmp r9w, 7
1400096b6jne 0x1400096c8
1400096b8test rax, rax
1400096bbjne 0x14000973a
1400096bdmov eax, [rbx]
1400096bfsub rsi, rbx
1400096c2lea eax, [rax+rsi-7]
1400096c6jmp 0x14000970b
1400096c8
1400096c8loc_1400096c8:
1400096c8cmp r9w, 8
1400096cdjne 0x1400096df
1400096cftest rax, rax
1400096d2jne 0x140009742
1400096d4mov eax, [rbx]
1400096d6sub rsi, rbx
1400096d9lea eax, [rax+rsi-8]
1400096ddjmp 0x14000970b
1400096df
1400096dfloc_1400096df:
1400096dfcmp r9w, 9
1400096e4jne 0x1400096f6
1400096e6test rax, rax
1400096e9jne 0x14000974a
1400096ebmov eax, [rbx]
1400096edsub rsi, rbx
1400096f0lea eax, [rax+rsi-9]
1400096f4jmp 0x14000970b
1400096f6
1400096f6loc_1400096f6:
1400096f6cmp r9w, 3
1400096fbjne 0x140009712
1400096fdtest rax, rax
140009700jne 0x140009752
140009702
140009702loc_140009702:
140009702mov eax, [rbx]
140009704sub rsi, rbx
140009707lea eax, [rax+rsi-4]
14000970b
14000970bloc_14000970b:
14000970bmov [rbx], eax
14000970djmp 0x14000979d
140009712
140009712loc_140009712:
140009712cmp r9w, 1
140009717jne 0x140009723
140009719test rax, rax
14000971cjne 0x14000975a
14000971eadd [rbx], rsi
140009721jmp 0x14000979d
140009723
140009723loc_140009723:
140009723test rax, rax
140009726je 0x140009780
140009728jmp 0x140009760
14000972a
14000972aloc_14000972a:
14000972amov r9l, 5
140009730jmp 0x140009760
140009732
140009732loc_140009732:
140009732mov r9l, 6
140009738jmp 0x140009760
14000973a
14000973aloc_14000973a:
14000973amov r9l, 7
140009740jmp 0x140009760
140009742
140009742loc_140009742:
140009742mov r9l, 8
140009748jmp 0x140009760
14000974a
14000974aloc_14000974a:
14000974amov r9l, 9
140009750jmp 0x140009760
140009752
140009752loc_140009752:
140009752mov r9l, 3
140009758jmp 0x140009760
14000975a
14000975aloc_14000975a:
14000975amov r9l, 1
140009760
140009760loc_140009760:
140009760mov [rsp+32], rdx
140009765mov r8l, 556
14000976blea rdx, [rip+0x238de]
140009772lea rcx, [rip+0x21cad]
140009779call printf
14000977ejmp 0x140009799
140009780
140009780loc_140009780:
140009780mov r8l, 560
140009786lea rdx, [rip+0x238c3]
14000978dlea rcx, [rip+0x21cd6]
140009794call printf
140009799
140009799loc_140009799:
140009799xor eax, eax
14000979bjmp 0x1400097ba
14000979d
14000979dloc_14000979d:
14000979dmov rax, [rbp+24]
1400097a1inc r10l
1400097a4add rax, 10
1400097a8jmp 0x140009580
1400097ad
1400097adloc_1400097ad:
1400097adinc r12l
1400097b0jmp 0x14000954f
1400097b5
1400097b5loc_1400097b5:
1400097b5mov eax, 1
1400097ba
1400097baloc_1400097ba:
1400097baadd rsp, 104
1400097bepop rbx
1400097bfpop rsi
1400097c0pop rdi
1400097c1pop rbp
1400097c2pop r12
1400097c4pop r13
1400097c6pop r14
1400097c8pop r15
1400097caret
140009500

1400097cb
1400097cb // align 0x10

1400097d0
1400097d0CoffeeProcessSymbol:
1400097d0push r14
1400097d2xor eax, eax
1400097d4push r13
1400097d6mov r13l, r8l
1400097d9xor r8l, r8l
1400097dcpush r12
1400097demov r12, rcx
1400097e1mov ecx, 252
1400097e6push rbp
1400097e7mov rbp, r9
1400097eapush rdi
1400097ebpush rsi
1400097ecpush rbx
1400097edmov rbx, rdx
1400097f0xor edx, edx
1400097f2mov rsi, rbx
1400097f5sub rsp, 2112
1400097fcmov [rsp+64], rax
140009801lea rdi, [rsp+80]
140009806mov [rsp+72], rax
14000980bxor eax, eax
14000980drep stosd [rdi], eax
14000980flea rdi, [rsp+1104]
140009817mov ecx, 252
14000981cmov [rsp+1088], rdx
140009824rep stosd [rdi], eax
140009826mov [rsp+1096], rdx
14000982emov rcx, rbx
140009831mov edx, 12
140009836call HashEx
14000983bxor ecx, ecx
14000983dmov [rbp], rcx
140009841mov r14l, eax
140009844mov [rsp+48], rcx
140009849mov [rsp+56], rcx
14000984emov rcx, rbx
140009851call StringLengthA
140009856lea rdx, [rsp+64]
14000985blea rcx, [rax+1]
14000985fmov rdi, rdx
140009862rep movsb [rdi], [rsi]
140009864cmp r14l, 0xffffffffd0a409b0
14000986bjne 0x1400098a3
14000986dmov r13, [rip+0x22aec]
140009874lea rdi, [rbx+6]
140009878xor r14l, r14l
14000987b
14000987bloc_14000987b:
14000987bmov esi, r14l
14000987eshl rsi, 4
140009882add rsi, r13
140009885cmp [rsi], 0
140009889je 0x1400099da
14000988fmov rcx, rdi
140009892call HashStringA
140009897mov eax, eax
140009899cmp rax, [rsi]
14000989cje 0x1400098fa
14000989einc r14l
1400098a1jmp 0x14000987b
1400098a3
1400098a3loc_1400098a3:
1400098a3mov rcx, rbx
1400098a6call SymbolIsImport
1400098abtest eax, eax
1400098adje 0x140009910
1400098afmov rcx, rbx
1400098b2call SymbolIncludesLibrary
1400098b7test eax, eax
1400098b9jne 0x140009910
1400098bblea r13, [rsp+1088]
1400098c3lea rdx, [rbx+6]
1400098c7xor edi, edi
1400098c9mov rcx, r13
1400098cccall StringCopyA
1400098d1mov r14, [rip+0x22aa8]
1400098d8
1400098d8loc_1400098d8:
1400098d8mov esi, edi
1400098dashl rsi, 4
1400098deadd rsi, r14
1400098e1cmp [rsi], 0
1400098e5je 0x1400099da
1400098ebmov rcx, r13
1400098eecall HashStringA
1400098f3mov eax, eax
1400098f5cmp rax, [rsi]
1400098f8jne 0x14000990c
1400098fa
1400098faloc_1400098fa:
1400098famov rax, [rsi+8]
1400098femov [rbp], rax
140009902
140009902loc_140009902:
140009902mov eax, 1
140009907jmp 0x140009a0e
14000990c
14000990cloc_14000990c:
14000990cinc edi
14000990ejmp 0x1400098d8
140009910
140009910loc_140009910:
140009910mov rcx, rbx
140009913call SymbolIsImport
140009918test eax, eax
14000991aje 0x1400099cf
140009920lea rdx, [rip+0x21948]
140009927lea rcx, [rsp+70]
14000992ccall StringTokenA
140009931mov rsi, rax
140009934mov rcx, rax
140009937call StringLengthA
14000993cmov rcx, rsi
14000993flea rdi, [rsi+rax+1]
140009944call LdrModuleLoad
140009949mov r13, [rip+0x22a20]
140009950test rax, rax
140009953mov r14, rax
140009956jne 0x140009984
140009958mov rax, [r13+2230]
14000995fmov r9, rsi
140009962mov r8l, 167
140009968lea rdx, [rip+0x23a31]
14000996flea rcx, [rip+0x218fb]
140009976mov eax, [rax+104]
140009979mov [rsp+32], eax
14000997dcall printf
140009982jmp 0x1400099da
140009984
140009984loc_140009984:
140009984lea rsi, [rsp+1088]
14000998cmov rdx, rdi
14000998fmov rcx, rsi
140009992call StringCopyA
140009997mov rcx, rsi
14000999acall StringLengthA
14000999fxor r8l, r8l
1400099a2mov [rsp+56], rsi
1400099a7mov r9, rbp
1400099aamov [rsp+48], ax
1400099afinc eax
1400099b1lea rdx, [rsp+48]
1400099b6mov rcx, r14
1400099b9mov [rsp+50], ax
1400099becall [r13+308]
1400099c5test eax, eax
1400099c7jns 0x140009902
1400099cdjmp 0x1400099da
1400099cf
1400099cfloc_1400099cf:
1400099cfcmp r13w, 32
1400099d4jne 0x140009902
1400099da
1400099daloc_1400099da:
1400099damov edx, [r12+56]
1400099dfmov ecx, 20
1400099e4call PackageCreateWithRequestID
1400099e9mov edx, 2
1400099eemov rsi, rax
1400099f1mov rcx, rax
1400099f4call PackageAddInt32
1400099f9mov rdx, rbx
1400099fcmov rcx, rsi
1400099ffcall PackageAddString
140009a04mov rcx, rsi
140009a07call PackageTransmit
140009a0cxor eax, eax
140009a0e
140009a0eloc_140009a0e:
140009a0eadd rsp, 2112
140009a15pop rbx
140009a16pop rsi
140009a17pop rdi
140009a18pop rbp
140009a19pop r12
140009a1bpop r13
140009a1dpop r14
140009a1fret
1400097d0

140009a20
140009a20CoffeeRunner:
140009a20push r15
140009a22push r14
140009a24push r13
140009a26push r12
140009a28push rbp
140009a29mov rbp, r9
140009a2cpush rdi
140009a2dmov edi, edx
140009a2fmov edx, 56
140009a34push rsi
140009a35mov rsi, rcx
140009a38mov ecx, 64
140009a3dpush rbx
140009a3esub rsp, 72
140009a42mov rbx, [rip+0x22927]
140009a49mov [rsp+56], r8
140009a4emov r12, [rsp+184]
140009a56mov r15, [rsp+176]
140009a5emov r14l, [rsp+192]
140009a66call [rbx+932]
140009a6cmov edx, edi
140009a6emov ecx, 64
140009a73mov r13, rax
140009a76mov eax, edi
140009a78mov [rsp+48], rax
140009a7dcall [rbx+932]
140009a83mov rdx, rbp
140009a86mov ecx, 64
140009a8bmov [r13], rax
140009a8fcall [rbx+932]
140009a95mov rdx, r12
140009a98mov ecx, 64
140009a9dmov [r13+16], rax
140009aa1call [rbx+932]
140009aa7mov [r13+8], edi
140009aabmov rcx, [rsp+48]
140009ab0or rdx, -1
140009ab4mov [r13+32], rax
140009ab8mov rdi, [r13]
140009abcxor eax, eax
140009abemov r8l, 1
140009ac4mov [r13+24], rbp
140009ac8lea r9, [rip+161]
140009acfmov [r13+40], r12
140009ad3mov [r13+48], r14l
140009ad7rep movsb [rdi], [rsi]
140009ad9mov rsi, [rsp+56]
140009ademov rcx, rbp
140009ae1mov rdi, [r13+16]
140009ae5rep movsb [rdi], [rsi]
140009ae7mov rsi, r15
140009aeamov rcx, r12
140009aedmov rdi, [r13+32]
140009af1rep movsb [rdi], [rsi]
140009af3mov ecx, 2
140009af8inc [rbx+2238]
140009afemov [rsp+40], rax
140009b03mov [rsp+32], r13
140009b08call ThreadCreate
140009b0dtest rax, rax
140009b10jne 0x140009b5a
140009b12mov rax, [rbx+2230]
140009b19lea rdx, [rip+0x22c50]
140009b20lea rcx, [rip+0x21ab1]
140009b27mov r8l, 822
140009b2dmov r9l, [rax+104]
140009b31call printf
140009b36mov rax, [rbx+2230]
140009b3dmov ecx, 1
140009b42mov edx, [rax+104]
140009b45add rsp, 72
140009b49pop rbx
140009b4apop rsi
140009b4bpop rdi
140009b4cpop rbp
140009b4dpop r12
140009b4fpop r13
140009b51pop r14
140009b53pop r15
140009b55jmp 0x140018dc0
140009b5a
140009b5aloc_140009b5a:
140009b5aadd rsp, 72
140009b5epop rbx
140009b5fpop rsi
140009b60pop rdi
140009b61pop rbp
140009b62pop r12
140009b64pop r13
140009b66pop r14
140009b68pop r15
140009b6aret
140009a20

140009b6b
140009b6b // align 0x10

140009b70
140009b70CoffeeRunnerThread:
140009b70push rdi
140009b71push rsi
140009b72push rbx
140009b73mov rbx, rcx
140009b76sub rsp, 48
140009b7amov rcx, [rcx]
140009b7dtest rcx, rcx
140009b80je 0x140009b9f
140009b82mov rdx, [rbx+16]
140009b86test rdx, rdx
140009b89je 0x140009b9f
140009b8bmov eax, [rbx+48]
140009b8emov [rsp+32], eax
140009b92mov r9, [rbx+40]
140009b96mov r8, [rbx+32]
140009b9acall CoffeeLdr
140009b9f
140009b9floc_140009b9f:
140009b9fmov rdi, [rbx]
140009ba2mov rsi, [rip+0x227c7]
140009ba9test rdi, rdi
140009bacje 0x140009bc3
140009baemov ecx, [rbx+8]
140009bb1xor eax, eax
140009bb3rep stosb [rdi], al
140009bb5mov rcx, [rbx]
140009bb8call [rsi+940]
140009bbexor ecx, ecx
140009bc0mov [rbx], rcx
140009bc3
140009bc3loc_140009bc3:
140009bc3mov rdi, [rbx+16]
140009bc7test rdi, rdi
140009bcaje 0x140009be4
140009bccmov rcx, [rbx+24]
140009bd0xor eax, eax
140009bd2rep stosb [rdi], al
140009bd4mov rcx, [rbx+16]
140009bd8call [rsi+940]
140009bdexor edx, edx
140009be0mov [rbx+16], rdx
140009be4
140009be4loc_140009be4:
140009be4mov rdi, [rbx+32]
140009be8test rdi, rdi
140009bebje 0x140009c05
140009bedmov rcx, [rbx+40]
140009bf1xor eax, eax
140009bf3rep stosb [rdi], al
140009bf5mov rcx, [rbx+32]
140009bf9call [rsi+940]
140009bffxor eax, eax
140009c01mov [rbx+32], rax
140009c05
140009c05loc_140009c05:
140009c05mov rdi, rbx
140009c08mov ecx, 56
140009c0dxor eax, eax
140009c0frep stosb [rdi], al
140009c11mov rcx, rbx
140009c14call [rsi+940]
140009c1amov rax, [0x30]
140009c23mov ecx, [rax+72]
140009c26call JobRemove
140009c2bdec [rsi+2238]
140009c31mov rax, [rsi+364]
140009c38xor ecx, ecx
140009c3aadd rsp, 48
140009c3epop rbx
140009c3fpop rsi
140009c40pop rdi
140009c41jmp rax
140009b70

140009c43
140009c43 // align 0x10

140009c50
140009c50CommandAssemblyInlineExecute:
140009c50push rbp
140009c51mov rbp, rsp
140009c54push r15
140009c56lea r15, [rip+0x1c3ab]
140009c5dpush r14
140009c5fpush r13
140009c61push r12
140009c63push rdi
140009c64push rsi
140009c65push rbx
140009c66and rsp, -16
140009c6asub rsp, 176
140009c71mov r12, [rip+0x226f8]
140009c78mov r13, [r12+2266]
140009c80test r13, r13
140009c83jne 0x140009f7f
140009c89mov rax, [r12+2230]
140009c91xor r8l, r8l
140009c94mov rbx, rcx
140009c97mov edx, 8
140009c9cmov [rsp+160], r8
140009ca4lea r14, [rsp+168]
140009cacmov rax, [rax+96]
140009cb0mov [rsp+168], r8
140009cb8mov r8l, 296
140009cbemov rcx, [rax+48]
140009cc2call [r12+316]
140009ccamov edx, [r12+8]
140009ccfxor r9l, r9l
140009cd2mov rcx, rbx
140009cd5mov [r12+2266], rax
140009cddmov [rax+256], r9l
140009ce4mov [rax], edx
140009ce6mov rdx, r14
140009ce9call ParserGetWString
140009ceemov rdx, [r12+2230]
140009cf6mov rsi, [r12+2266]
140009cfemov [rsp+160], rax
140009d06mov eax, [rsp+168]
140009d0dmov rdx, [rdx+96]
140009d11lea r8, [rax+2]
140009d15mov rcx, [rdx+48]
140009d19mov edx, 8
140009d1ecall [r12+316]
140009d26mov ecx, [rsp+168]
140009d2dmov rdx, r14
140009d30mov [rsi+8], rax
140009d34mov rax, [r12+2266]
140009d3cmov rsi, [rsp+160]
140009d44mov [rax+16], ecx
140009d47mov rax, [rax+8]
140009d4bmov rdi, rax
140009d4erep movsb [rdi], [rsi]
140009d50mov rcx, rbx
140009d53call ParserGetWString
140009d58mov rdx, [r12+2230]
140009d60mov rsi, [r12+2266]
140009d68mov [rsp+160], rax
140009d70mov eax, [rsp+168]
140009d77mov rdx, [rdx+96]
140009d7blea r8, [rax+2]
140009d7fmov rcx, [rdx+48]
140009d83mov edx, 8
140009d88call [r12+316]
140009d90mov ecx, [rsp+168]
140009d97mov rdx, r14
140009d9amov [rsi+24], rax
140009d9emov rax, [r12+2266]
140009da6mov rsi, [rsp+160]
140009daemov [rax+32], ecx
140009db1mov rax, [rax+24]
140009db5mov rdi, rax
140009db8rep movsb [rdi], [rsi]
140009dbamov rcx, rbx
140009dbdcall ParserGetWString
140009dc2mov rdx, [r12+2230]
140009dcamov rsi, [r12+2266]
140009dd2mov [rsp+160], rax
140009ddamov eax, [rsp+168]
140009de1mov rdx, [rdx+96]
140009de5lea r8, [rax+2]
140009de9mov rcx, [rdx+48]
140009dedmov edx, 8
140009df2call [r12+316]
140009dfamov ecx, [rsp+168]
140009e01mov [rsi+40], rax
140009e05mov rax, [r12+2266]
140009e0dmov rsi, [rsp+160]
140009e15mov [rax+48], ecx
140009e18mov rax, [rax+40]
140009e1cmov rdi, rax
140009e1frep movsb [rdi], [rsi]
140009e21mov rcx, rbx
140009e24call ParserGetInt32
140009e29mov ecx, eax
140009e2bmov [rsp+124], eax
140009e2fcall GetMemFile
140009e34mov r9l, [rsp+124]
140009e39test rax, rax
140009e3cje 0x140009e63
140009e3ecmp [rax+32], 0
140009e42je 0x140009e4d
140009e44mov r13, [rax+24]
140009e48mov esi, [rax+8]
140009e4bjmp 0x140009e7e
140009e4d
140009e4dloc_140009e4d:
140009e4dmov r8l, 1695
140009e53lea rdx, [rip+0x22ba6]
140009e5alea rcx, [rip+0x1c6eb]
140009e61jmp 0x140009e77
140009e63
140009e63loc_140009e63:
140009e63mov r8l, 1699
140009e69lea rdx, [rip+0x22b90]
140009e70lea rcx, [rip+0x1c705]
140009e77
140009e77loc_140009e77:
140009e77call printf
140009e7cxor esi, esi
140009e7e
140009e7eloc_140009e7e:
140009e7emov rcx, rbx
140009e81mov rdx, r14
140009e84call ParserGetWString
140009e89xor edx, edx
140009e8blea rcx, [rip+0x1d5ec]
140009e92mov r8l, 1705
140009e98mov rbx, rax
140009e9bmov rax, [r12+2266]
140009ea3mov r9l, [rax+16]
140009ea7mov [rsp+96], r13
140009eacmov [rsp+88], esi
140009eb0mov [rsp+80], rbx
140009eb5mov [rsp+72], edx
140009eb9mov rdx, [rax+40]
140009ebdmov [rsp+64], rdx
140009ec2mov edx, [rax+48]
140009ec5mov [rsp+56], edx
140009ec9mov rdx, [rax+24]
140009ecdmov [rsp+48], rdx
140009ed2mov edx, [rax+32]
140009ed5mov [rsp+40], edx
140009ed9mov rax, [rax+8]
140009eddlea rdx, [rip+0x22b1c]
140009ee4mov [rsp+32], rax
140009ee9call printf
140009eeexor ecx, ecx
140009ef0mov eax, esi
140009ef2mov [rsp+144], r13
140009efamov [rsp+136], rcx
140009f02lea rdx, [rsp+128]
140009f0alea rcx, [rsp+144]
140009f12mov [rsp+152], rax
140009f1amov [rsp+128], rbx
140009f22call DotnetExecute
140009f27test eax, eax
140009f29jne 0x140009f52
140009f2bmov ecx, 8193
140009f30call PackageCreate
140009f35mov edx, 5
140009f3amov rbx, rax
140009f3dmov rcx, rax
140009f40call PackageAddInt32
140009f45mov rcx, rbx
140009f48call PackageTransmit
140009f4dcall DotnetClose
140009f52
140009f52loc_140009f52:
140009f52mov rcx, r15
140009f55lea r9, [rip+0x1d5d5]
140009f5cmov r8l, 1728
140009f62lea rdx, [rip+0x22a97]
140009f69call printf
140009f6elea rsp, [rbp-56]
140009f72pop rbx
140009f73pop rsi
140009f74pop rdi
140009f75pop r12
140009f77pop r13
140009f79pop r14
140009f7bpop r15
140009f7dpop rbp
140009f7eret
140009f7f
140009f7floc_140009f7f:
140009f7flea rsp, [rbp-56]
140009f83mov rcx, r15
140009f86lea r9, [rip+0x1d5ca]
140009f8dmov r8l, 1732
140009f93pop rbx
140009f94lea rdx, [rip+0x22a65]
140009f9bpop rsi
140009f9cpop rdi
140009f9dpop r12
140009f9fpop r13
140009fa1pop r14
140009fa3pop r15
140009fa5pop rbp
140009fa6jmp 0x140022bf0
140009c50

140009fab
140009fab // align 0x10

140009fb0
140009fb0CommandAssemblyListVersion:
140009fb0push r15
140009fb2mov ecx, 8195
140009fb7push r14
140009fb9push r13
140009fbbpush r12
140009fbdpush rbp
140009fbepush rdi
140009fbfpush rsi
140009fc0push rbx
140009fc1xor ebx, ebx
140009fc3sub rsp, 88
140009fc7call PackageCreate
140009fccmov [rsp+56], rbx
140009fd1mov rbp, [rip+0x22398]
140009fd8lea r8, [rsp+56]
140009fddmov [rsp+64], rbx
140009fe2mov rdx, [rip+0x22587]
140009fe9mov rdi, rax
140009fecmov rcx, [rip+0x2256d]
140009ff3call [rbp+1276]
140009ff9test eax, eax
140009ffbjne 0x14000a12a
14000a001mov rcx, [rsp+56]
14000a006lea rdx, [rsp+64]
14000a00bmov rax, [rcx]
14000a00ecall [rax+40]
14000a011test eax, eax
14000a013jne 0x14000a11b
14000a019xor r11l, r11l
14000a01cxor ebx, ebx
14000a01elea r14, [rsp+52]
14000a023mov [rsp+48], r11l
14000a028lea r13, [rip+0x22951]
14000a02flea r12, [rip+0x1bfd2]
14000a036
14000a036loc_14000a036:
14000a036mov rcx, [rsp+64]
14000a03bxor r9l, r9l
14000a03exor r10l, r10l
14000a041lea r8, [rsp+72]
14000a046mov [rsp+72], r9
14000a04bmov edx, 1
14000a050mov r9, r14
14000a053mov rax, [rcx]
14000a056mov [rsp+52], r10l
14000a05bcall [rax+24]
14000a05etest eax, eax
14000a060jne 0x14000a10f
14000a066mov rbx, [rsp+72]
14000a06blea r15, [rsp+48]
14000a070xor edx, edx
14000a072mov r8, r15
14000a075mov rax, [rbx]
14000a078mov rcx, rbx
14000a07bcall [rax+24]
14000a07ecmp eax, 0xffffffff8007007a
14000a083jne 0x14000a0f2
14000a085mov edx, [rsp+48]
14000a089test edx, edx
14000a08bje 0x14000a0f2
14000a08dmov ecx, 64
14000a092call [rbp+932]
14000a098mov r8, r15
14000a09bmov rcx, rbx
14000a09emov rsi, rax
14000a0a1mov rax, [rbx]
14000a0a4mov rdx, rsi
14000a0a7call [rax+24]
14000a0aatest eax, eax
14000a0acjne 0x14000a0dc
14000a0aemov [rsp+32], rsi
14000a0b3mov r9l, [rsp+48]
14000a0b8lea rdx, [rip+0x228c1]
14000a0bflea rcx, [rip+0x1c14d]
14000a0c6mov r8l, 1762
14000a0cccall printf
14000a0d1mov rdx, rsi
14000a0d4mov rcx, rdi
14000a0d7call PackageAddWString
14000a0dc
14000a0dcloc_14000a0dc:
14000a0dcmov rcx, rsi
14000a0dfcall [rbp+940]
14000a0e5xor r8l, r8l
14000a0e8mov [rsp+48], r8l
14000a0edjmp 0x14000a036
14000a0f2
14000a0f2loc_14000a0f2:
14000a0f2lea r9, [rip+0x1c13e]
14000a0f9mov r8l, 1771
14000a0ffmov rdx, r13
14000a102mov rcx, r12
14000a105call printf
14000a10ajmp 0x14000a036
14000a10f
14000a10floc_14000a10f:
14000a10fmov rcx, [rsp+56]
14000a114test rcx, rcx
14000a117jne 0x14000a16f
14000a119jmp 0x14000a17c
14000a11b
14000a11bloc_14000a11b:
14000a11blea r9, [rip+0x1c12f]
14000a122mov r8l, 1777
14000a128jmp 0x14000a137
14000a12a
14000a12aloc_14000a12a:
14000a12alea r9, [rip+0x1c134]
14000a131mov r8l, 1780
14000a137
14000a137loc_14000a137:
14000a137lea rcx, [rip+0x1beca]
14000a13elea rdx, [rip+0x2283b]
14000a145xor ebx, ebx
14000a147call printf
14000a14cmov rcx, [rsp+56]
14000a151test rcx, rcx
14000a154jne 0x14000a16f
14000a156mov rcx, [rsp+64]
14000a15btest rcx, rcx
14000a15eje 0x14000a1a1
14000a160mov rax, [rcx]
14000a163call [rax+16]
14000a166xor ecx, ecx
14000a168mov [rsp+64], rcx
14000a16djmp 0x14000a1a1
14000a16f
14000a16floc_14000a16f:
14000a16fmov rax, [rcx]
14000a172call [rax+16]
14000a175xor edx, edx
14000a177mov [rsp+56], rdx
14000a17c
14000a17cloc_14000a17c:
14000a17cmov rcx, [rsp+64]
14000a181test rcx, rcx
14000a184je 0x14000a193
14000a186mov rax, [rcx]
14000a189call [rax+16]
14000a18cxor eax, eax
14000a18emov [rsp+64], rax
14000a193
14000a193loc_14000a193:
14000a193test rbx, rbx
14000a196je 0x14000a1a1
14000a198mov rax, [rbx]
14000a19bmov rcx, rbx
14000a19ecall [rax+16]
14000a1a1
14000a1a1loc_14000a1a1:
14000a1a1mov rcx, rdi
14000a1a4call PackageTransmit
14000a1a9add rsp, 88
14000a1adpop rbx
14000a1aepop rsi
14000a1afpop rdi
14000a1b0pop rbp
14000a1b1pop r12
14000a1b3pop r13
14000a1b5pop r14
14000a1b7pop r15
14000a1b9ret
140009fb0

14000a1ba
14000a1ba // align 0x10

14000a1c0
14000a1c0CommandCheckin:
14000a1c0sub rsp, 56
14000a1c4lea r9, [rip+0x1be35]
14000a1cbmov r8l, 171
14000a1d1lea rdx, [rip+0x22c58]
14000a1d8lea rcx, [rip+0x1be29]
14000a1dfcall printf
14000a1e4mov ecx, 100
14000a1e9call PackageCreate
14000a1eelea rcx, [rsp+40]
14000a1f3xor edx, edx
14000a1f5mov [rsp+40], rax
14000a1facall DemonMetaData
14000a1ffmov rcx, [rsp+40]
14000a204call PackageTransmit
14000a209add rsp, 56
14000a20dret
14000a1c0

14000a20e
14000a20e // align 0x10

14000a210
14000a210CommandConfig:
14000a210push r13
14000a212push r12
14000a214push rbp
14000a215push rdi
14000a216push rsi
14000a217mov rsi, rcx
14000a21amov ecx, 2500
14000a21fpush rbx
14000a220sub rsp, 72
14000a224call PackageCreate
14000a229mov rcx, rsi
14000a22cmov rbx, rax
14000a22fcall ParserGetInt32
14000a234mov rcx, rbx
14000a237mov edi, eax
14000a239mov edx, edi
14000a23bcall PackageAddInt32
14000a240cmp edi, 102
14000a243je 0x14000a451
14000a249jg 0x14000a296
14000a24bcmp edi, 7
14000a24ejg 0x14000a271
14000a250test edi, edi
14000a252js 0x14000a783
14000a258cmp edi, 7
14000a25bja 0x14000a783
14000a261lea rdx, [rip+0x1cd68]
14000a268movsxd rax, [rdx+4*rdi]
14000a26cadd rax, rdx
14000a26fjmp rax
14000a271
14000a271loc_14000a271:
14000a271cmp edi, 101
14000a274jne 0x14000a783
14000a27amov rcx, rsi
14000a27dcall ParserGetInt32
14000a282mov edx, eax
14000a284mov rax, [rip+0x220e5]
14000a28bmov [rax+248], edx
14000a291jmp 0x14000a785
14000a296
14000a296loc_14000a296:
14000a296sub edi, 150
14000a29ccmp edi, 5
14000a29fja 0x14000a783
14000a2a5lea rdx, [rip+0x1cd44]
14000a2acmovsxd rax, [rdx+4*rdi]
14000a2b0add rax, rdx
14000a2b3jmp rax
14000a2b5xor r10l, r10l
14000a2b8mov rcx, rsi
14000a2bblea rdx, [rsp+56]
14000a2c0mov [rsp+56], r10l
14000a2c5lea r12, [rip+0x231b4]
14000a2ccmov [rsp+60], r10l
14000a2d1call ParserGetString
14000a2d6lea rdx, [rsp+60]
14000a2dbmov rcx, rsi
14000a2demov rdi, rax
14000a2e1call ParserGetString
14000a2e6mov rcx, rsi
14000a2e9mov rbp, rax
14000a2eccall ParserGetInt32
14000a2f1mov r9, rdi
14000a2f4mov rdx, r12
14000a2f7mov r8l, 1826
14000a2fdlea rcx, [rip+0x1cb10]
14000a304mov esi, eax
14000a306call printf
14000a30bmov r9, rbp
14000a30emov rdx, r12
14000a311mov r8l, 1827
14000a317lea rcx, [rip+0x1cb16]
14000a31ecall printf
14000a323mov r9l, esi
14000a326mov rdx, r12
14000a329mov r8l, 1828
14000a32flea rcx, [rip+0x1cb1e]
14000a336call printf
14000a33btest rdi, rdi
14000a33eje 0x14000a5ac
14000a344mov rcx, rdi
14000a347call LdrModuleLoad
14000a34cmov r8l, 1835
14000a352mov rdx, r12
14000a355lea rcx, [rip+0x1cb16]
14000a35cmov r13, rax
14000a35fmov r9, rax
14000a362call printf
14000a367test r13, r13
14000a36aje 0x14000a59d
14000a370mov rcx, rbp
14000a373call HashStringA
14000a378mov rcx, r13
14000a37bmov edx, eax
14000a37dcall LdrFunctionAddr
14000a382mov r9, rax
14000a385test rax, rax
14000a388je 0x14000a39d
14000a38aadd rsi, rax
14000a38dmov rax, [rip+0x21fdc]
14000a394mov [rax+228], rsi
14000a39bjmp 0x14000a3b6
14000a39d
14000a39dloc_14000a39d:
14000a39dmov edx, 1
14000a3a2mov ecx, 1
14000a3a7mov [rsp+40], rax
14000a3accall PackageTransmitError
14000a3b1mov r9, [rsp+40]
14000a3b6
14000a3b6loc_14000a3b6:
14000a3b6mov r8l, 1846
14000a3bcjmp 0x14000a58c
14000a3c1mov rcx, rsi
14000a3c4call ParserGetInt32
14000a3c9mov rsi, [rip+0x21fa0]
14000a3d0lea rdx, [rip+0x230a9]
14000a3d7mov r8l, 1861
14000a3ddmov r9l, eax
14000a3e0lea rcx, [rip+0x1cac9]
14000a3e7mov [rsi+210], eax
14000a3edcall printf
14000a3f2mov edx, [rsi+210]
14000a3f8jmp 0x14000a785
14000a3fdmov rcx, rsi
14000a400call ParserGetInt32
14000a405mov edx, eax
14000a407mov rax, [rip+0x21f62]
14000a40emov [rax+224], edx
14000a414jmp 0x14000a785
14000a419mov rcx, rsi
14000a41ccall ParserGetInt32
14000a421mov edx, eax
14000a423mov rax, [rip+0x21f46]
14000a42amov [rax+240], edx
14000a430jmp 0x14000a785
14000a435mov rcx, rsi
14000a438call ParserGetInt32
14000a43dmov edx, eax
14000a43fmov rax, [rip+0x21f2a]
14000a446mov [rax+236], edx
14000a44cjmp 0x14000a785
14000a451
14000a451loc_14000a451:
14000a451mov rcx, rsi
14000a454call ParserGetInt32
14000a459mov edx, eax
14000a45bmov rax, [rip+0x21f0e]
14000a462mov [rax+252], edx
14000a468jmp 0x14000a785
14000a46dmov rcx, rsi
14000a470call ParserGetInt32
14000a475mov edx, eax
14000a477mov rax, [rip+0x21ef2]
14000a47emov [rax+272], edx
14000a484jmp 0x14000a785
14000a489xor r9l, r9l
14000a48cmov rcx, rsi
14000a48flea rdx, [rsp+56]
14000a494mov [rsp+56], r9l
14000a499lea r12, [rip+0x22fe0]
14000a4a0mov [rsp+60], r9l
14000a4a5call ParserGetString
14000a4aalea rdx, [rsp+60]
14000a4afmov rcx, rsi
14000a4b2mov rdi, rax
14000a4b5call ParserGetString
14000a4bamov rcx, rsi
14000a4bdmov rbp, rax
14000a4c0call ParserGetInt32
14000a4c5mov r9, rdi
14000a4c8mov rdx, r12
14000a4cbmov r8l, 1917
14000a4d1lea rcx, [rip+0x1c93c]
14000a4d8mov esi, eax
14000a4dacall printf
14000a4dfmov r9, rbp
14000a4e2mov rdx, r12
14000a4e5mov r8l, 1918
14000a4eblea rcx, [rip+0x1c942]
14000a4f2call printf
14000a4f7mov r9l, esi
14000a4famov rdx, r12
14000a4fdmov r8l, 1919
14000a503lea rcx, [rip+0x1c94a]
14000a50acall printf
14000a50ftest rdi, rdi
14000a512je 0x14000a5ac
14000a518mov rcx, rdi
14000a51bcall LdrModuleLoad
14000a520mov r8l, 1927
14000a526mov rdx, r12
14000a529lea rcx, [rip+0x1c942]
14000a530mov r13, rax
14000a533mov r9, rax
14000a536call printf
14000a53btest r13, r13
14000a53eje 0x14000a59d
14000a540mov rcx, rbp
14000a543call HashStringA
14000a548mov rcx, r13
14000a54bmov edx, eax
14000a54dcall LdrFunctionAddr
14000a552mov r9, rax
14000a555test rax, rax
14000a558je 0x14000a56d
14000a55aadd rsi, rax
14000a55dmov rax, [rip+0x21e0c]
14000a564mov [rax+276], rsi
14000a56bjmp 0x14000a586
14000a56d
14000a56dloc_14000a56d:
14000a56dmov edx, 1
14000a572mov ecx, 1
14000a577mov [rsp+40], rax
14000a57ccall PackageTransmitError
14000a581mov r9, [rsp+40]
14000a586
14000a586loc_14000a586:
14000a586mov r8l, 1939
14000a58c
14000a58cloc_14000a58c:
14000a58cmov rdx, r12
14000a58flea rcx, [rip+0x1c8f8]
14000a596call printf
14000a59bjmp 0x14000a5ac
14000a59d
14000a59dloc_14000a59d:
14000a59dmov edx, 126
14000a5a2mov ecx, 1
14000a5a7call PackageTransmitError
14000a5ac
14000a5acloc_14000a5ac:
14000a5acmov rdx, rdi
14000a5afmov rcx, rbx
14000a5b2call PackageAddString
14000a5b7mov rdx, rbp
14000a5bamov rcx, rbx
14000a5bdcall PackageAddString
14000a5c2jmp 0x14000a78d
14000a5c7mov rbp, [rip+0x21da2]
14000a5cexor r8l, r8l
14000a5d1mov [rsp+60], r8l
14000a5d6mov rcx, [rbp+256]
14000a5ddtest rcx, rcx
14000a5e0je 0x14000a60c
14000a5e2call StringLengthW
14000a5e7mov rdi, [rbp+256]
14000a5eelea rcx, [rax+rax]
14000a5f2xor eax, eax
14000a5f4rep stosb [rdi], al
14000a5f6mov rcx, [rbp+256]
14000a5fdcall [rbp+940]
14000a603xor ecx, ecx
14000a605mov [rbp+256], rcx
14000a60c
14000a60cloc_14000a60c:
14000a60cmov rcx, rsi
14000a60flea rdx, [rsp+60]
14000a614call ParserGetBytes
14000a619mov edx, [rsp+60]
14000a61dmov ecx, 64
14000a622mov rsi, rax
14000a625call [rbp+932]
14000a62bmov ecx, [rsp+60]
14000a62flea rdx, [rip+0x22e4a]
14000a636mov r8l, 1966
14000a63cmov [rbp+256], rax
14000a643mov rdi, rax
14000a646rep movsb [rdi], [rsi]
14000a648lea rcx, [rip+0x1c898]
14000a64fmov r9, [rbp+256]
14000a656call printf
14000a65bmov rdx, [rbp+256]
14000a662jmp 0x14000a700
14000a667mov rbp, [rip+0x21d02]
14000a66exor edx, edx
14000a670mov [rsp+60], edx
14000a674mov rcx, [rbp+264]
14000a67btest rcx, rcx
14000a67eje 0x14000a6aa
14000a680call StringLengthW
14000a685mov rdi, [rbp+264]
14000a68clea rcx, [rax+rax]
14000a690xor eax, eax
14000a692rep stosb [rdi], al
14000a694mov rcx, [rbp+264]
14000a69bcall [rbp+940]
14000a6a1xor eax, eax
14000a6a3mov [rbp+264], rax
14000a6aa
14000a6aaloc_14000a6aa:
14000a6aamov rcx, rsi
14000a6adlea rdx, [rsp+60]
14000a6b2call ParserGetBytes
14000a6b7mov edx, [rsp+60]
14000a6bbmov ecx, 64
14000a6c0mov rsi, rax
14000a6c3call [rbp+932]
14000a6c9mov ecx, [rsp+60]
14000a6cdlea rdx, [rip+0x22dac]
14000a6d4mov r8l, 1988
14000a6damov [rbp+264], rax
14000a6e1mov rdi, rax
14000a6e4rep movsb [rdi], [rsi]
14000a6e6lea rcx, [rip+0x1c832]
14000a6edmov r9, [rbp+264]
14000a6f4call printf
14000a6f9mov rdx, [rbp+264]
14000a700
14000a700loc_14000a700:
14000a700mov rcx, rbx
14000a703call PackageAddWString
14000a708jmp 0x14000a78d
14000a70dmov rcx, rsi
14000a710call ParserGetInt64
14000a715mov rsi, [rip+0x21c54]
14000a71cmov r8l, 1998
14000a722lea rdx, [rip+0x22d57]
14000a729mov r9, rax
14000a72clea rcx, [rip+0x1c824]
14000a733mov [rsi+124], rax
14000a737call printf
14000a73cmov rdx, [rsi+124]
14000a740mov rcx, rbx
14000a743call PackageAddInt64
14000a748jmp 0x14000a78d
14000a74amov rcx, rsi
14000a74dcall ParserGetInt32
14000a752mov rsi, [rip+0x21c17]
14000a759lea rdx, [rip+0x22d20]
14000a760mov r8l, 2008
14000a766mov r9l, eax
14000a769lea rcx, [rip+0x1c821]
14000a770mov [rsi+132], eax
14000a776call printf
14000a77bmov edx, [rsi+132]
14000a781jmp 0x14000a785
14000a783
14000a783loc_14000a783:
14000a783xor edx, edx
14000a785
14000a785loc_14000a785:
14000a785mov rcx, rbx
14000a788call PackageAddInt32
14000a78d
14000a78dloc_14000a78d:
14000a78dadd rsp, 72
14000a791mov rcx, rbx
14000a794pop rbx
14000a795pop rsi
14000a796pop rdi
14000a797pop rbp
14000a798pop r12
14000a79apop r13
14000a79cjmp 0x140018b90
14000a210