File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
14000bd50
14000bd50CommandInlineExecute:
14000bd50push r15
14000bd52xor eax, eax
14000bd54push r14
14000bd56push r13
14000bd58push r12
14000bd5apush rbp
14000bd5bmov rbp, rcx
14000bd5epush rdi
14000bd5fpush rsi
14000bd60push rbx
14000bd61sub rsp, 88
14000bd65mov r15, [rip+0x20604]
14000bd6clea rdx, [rsp+72]
14000bd71mov [rsp+72], eax
14000bd75mov [rsp+76], eax
14000bd79mov r12l, [r15+8]
14000bd7dcall ParserGetString
14000bd82mov rcx, rbp
14000bd85mov rsi, rax
14000bd88call ParserGetInt32
14000bd8dlea rdx, [rsp+76]
14000bd92mov rcx, rbp
14000bd95mov ebx, eax
14000bd97call ParserGetString
14000bd9cmov rcx, rbp
14000bd9fmov rdi, rax
14000bda2call ParserGetInt32
14000bda7mov ecx, ebx
14000bda9mov r13l, eax
14000bdaccall GetMemFile
14000bdb1lea rdx, [rip+0x20da8]
14000bdb8test rax, rax
14000bdbbje 0x14000bddf
14000bdbdcmp [rax+32], 0
14000bdc1je 0x14000bdcd
14000bdc3mov rbp, [rax+24]
14000bdc7mov r14l, [rax+8]
14000bdcbjmp 0x14000be00
14000bdcd
14000bdcdloc_14000bdcd:
14000bdcdmov r9l, ebx
14000bdd0mov r8l, 1103
14000bdd6lea rcx, [rip+0x1a76f]
14000bdddjmp 0x14000bdef
14000bddf
14000bddfloc_14000bddf:
14000bddfmov r9l, ebx
14000bde2mov r8l, 1107
14000bde8lea rcx, [rip+0x1a78d]
14000bdef
14000bdefloc_14000bdef:
14000bdefcall printf
14000bdf4xor ebp, ebp
14000bdf6xor r14l, r14l
14000bdf9lea rdx, [rip+0x20d60]
14000be00
14000be00loc_14000be00:
14000be00test r13l, r13l
14000be03lea rcx, [rip+0x1a1fe]
14000be0aje 0x14000be20
14000be0cdec r13l
14000be0fjne 0x14000be2f
14000be11lea r9, [rip+0x1aaa7]
14000be18mov r8l, 1121
14000be1ejmp 0x14000be66
14000be20
14000be20loc_14000be20:
14000be20lea r9, [rip+0x1aa7d]
14000be27mov r8l, 1114
14000be2djmp 0x14000be9f
14000be2f
14000be2floc_14000be2f:
14000be2flea r9, [rip+0x1aaa3]
14000be36mov r8l, 1128
14000be3ccall printf
14000be41cmp [r15+236], 0
14000be49lea rcx, [rip+0x1a1b8]
14000be50lea rdx, [rip+0x20d09]
14000be57je 0x14000be92
14000be59lea r9, [rip+0x1aa9d]
14000be60mov r8l, 1132
14000be66
14000be66loc_14000be66:
14000be66call printf
14000be6bmov eax, [rsp+76]
14000be6fmov edx, [rsp+72]
14000be73mov r9l, r14l
14000be76mov [rsp+48], r12l
14000be7bmov r8, rbp
14000be7emov rcx, rsi
14000be81mov [rsp+40], rax
14000be86mov [rsp+32], rdi
14000be8bcall CoffeeRunner
14000be90jmp 0x14000bebc
14000be92
14000be92loc_14000be92:
14000be92lea r9, [rip+0x1aa7e]
14000be99mov r8l, 1137
14000be9f
14000be9floc_14000be9f:
14000be9fcall printf
14000bea4mov [rsp+32], r12l
14000bea9mov r8, rdi
14000beacmov rdx, rbp
14000beafmov r9l, [rsp+76]
14000beb4mov rcx, rsi
14000beb7call CoffeeLdr
14000bebc
14000bebcloc_14000bebc:
14000bebcmov ecx, ebx
14000bebecall RemoveMemFile
14000bec3add rsp, 88
14000bec7pop rbx
14000bec8pop rsi
14000bec9pop rdi
14000becapop rbp
14000becbpop r12
14000becdpop r13
14000becfpop r14
14000bed1pop r15
14000bed3ret
14000bd50
14000bd50CommandInlineExecute:
14000bd50push r15
14000bd52xor eax, eax
14000bd54push r14
14000bd56push r13
14000bd58push r12
14000bd5apush rbp
14000bd5bmov rbp, rcx
14000bd5epush rdi
14000bd5fpush rsi
14000bd60push rbx
14000bd61sub rsp, 88
14000bd65mov r15, [rip+0x20604]
14000bd6clea rdx, [rsp+72]
14000bd71mov [rsp+72], eax
14000bd75mov [rsp+76], eax
14000bd79mov r12l, [r15+8]
14000bd7dcall ParserGetString
14000bd82mov rcx, rbp
14000bd85mov rsi, rax
14000bd88call ParserGetInt32
14000bd8dlea rdx, [rsp+76]
14000bd92mov rcx, rbp
14000bd95mov ebx, eax
14000bd97call ParserGetString
14000bd9cmov rcx, rbp
14000bd9fmov rdi, rax
14000bda2call ParserGetInt32
14000bda7mov ecx, ebx
14000bda9mov r13l, eax
14000bdaccall GetMemFile
14000bdb1lea rdx, [rip+0x20da8]
14000bdb8test rax, rax
14000bdbbje 0x14000bddf
14000bdbdcmp [rax+32], 0
14000bdc1je 0x14000bdcd
14000bdc3mov rbp, [rax+24]
14000bdc7mov r14l, [rax+8]
14000bdcbjmp 0x14000be00
14000bdcd
14000bdcdloc_14000bdcd:
14000bdcdmov r9l, ebx
14000bdd0mov r8l, 1103
14000bdd6lea rcx, [rip+0x1a76f]
14000bdddjmp 0x14000bdef
14000bddf
14000bddfloc_14000bddf:
14000bddfmov r9l, ebx
14000bde2mov r8l, 1107
14000bde8lea rcx, [rip+0x1a78d]
14000bdef
14000bdefloc_14000bdef:
14000bdefcall printf
14000bdf4xor ebp, ebp
14000bdf6xor r14l, r14l
14000bdf9lea rdx, [rip+0x20d60]
14000be00
14000be00loc_14000be00:
14000be00test r13l, r13l
14000be03lea rcx, [rip+0x1a1fe]
14000be0aje 0x14000be20
14000be0cdec r13l
14000be0fjne 0x14000be2f
14000be11lea r9, [rip+0x1aaa7]
14000be18mov r8l, 1121
14000be1ejmp 0x14000be66
14000be20
14000be20loc_14000be20:
14000be20lea r9, [rip+0x1aa7d]
14000be27mov r8l, 1114
14000be2djmp 0x14000be9f
14000be2f
14000be2floc_14000be2f:
14000be2flea r9, [rip+0x1aaa3]
14000be36mov r8l, 1128
14000be3ccall printf
14000be41cmp [r15+236], 0
14000be49lea rcx, [rip+0x1a1b8]
14000be50lea rdx, [rip+0x20d09]
14000be57je 0x14000be92
14000be59lea r9, [rip+0x1aa9d]
14000be60mov r8l, 1132
14000be66
14000be66loc_14000be66:
14000be66call printf
14000be6bmov eax, [rsp+76]
14000be6fmov edx, [rsp+72]
14000be73mov r9l, r14l
14000be76mov [rsp+48], r12l
14000be7bmov r8, rbp
14000be7emov rcx, rsi
14000be81mov [rsp+40], rax
14000be86mov [rsp+32], rdi
14000be8bcall CoffeeRunner
14000be90jmp 0x14000bebc
14000be92
14000be92loc_14000be92:
14000be92lea r9, [rip+0x1aa7e]
14000be99mov r8l, 1137
14000be9f
14000be9floc_14000be9f:
14000be9fcall printf
14000bea4mov [rsp+32], r12l
14000bea9mov r8, rdi
14000beacmov rdx, rbp
14000beafmov r9l, [rsp+76]
14000beb4mov rcx, rsi
14000beb7call CoffeeLdr
14000bebc
14000bebcloc_14000bebc:
14000bebcmov ecx, ebx
14000bebecall RemoveMemFile
14000bec3add rsp, 88
14000bec7pop rbx
14000bec8pop rsi
14000bec9pop rdi
14000becapop rbp
14000becbpop r12
14000becdpop r13
14000becfpop r14
14000bed1pop r15
14000bed3ret
14000bd50
14000bed4
14000bed4 // align 0x10
14000bed4 // align 0x10
14000bee0
14000bee0CommandJob:
14000bee0push r12
14000bee2lea r12, [rip+0x1a11f]
14000bee9lea r9, [rip+0x1a1f3]
14000bef0mov r8l, 196
14000bef6push rbp
14000bef7mov rbp, rcx
14000befamov rcx, r12
14000befdpush rdi
14000befelea rdi, [rip+0x20d2b]
14000bf05push rsi
14000bf06mov rdx, rdi
14000bf09push rbx
14000bf0asub rsp, 48
14000bf0ecall printf
14000bf13mov ecx, 21
14000bf18call PackageCreate
14000bf1dmov rcx, rbp
14000bf20mov rbx, rax
14000bf23call ParserGetInt32
14000bf28mov rcx, rbx
14000bf2bmov esi, eax
14000bf2dmov edx, eax
14000bf2fcall PackageAddInt32
14000bf34cmp esi, 3
14000bf37je 0x14000c064
14000bf3djg 0x14000bfa9
14000bf3fcmp esi, 1
14000bf42je 0x14000bfe0
14000bf48cmp esi, 2
14000bf4bjne 0x14000c0a3
14000bf51lea r9, [rip+0x1a1d1]
14000bf58mov r8l, 229
14000bf5emov rdx, rdi
14000bf61mov rcx, r12
14000bf64call printf
14000bf69mov rcx, rbp
14000bf6ccall ParserGetInt32
14000bf71mov ecx, eax
14000bf73mov esi, eax
14000bf75call JobSuspend
14000bf7amov r9l, esi
14000bf7dmov rdx, rdi
14000bf80mov r8l, 233
14000bf86mov [rsp+32], eax
14000bf8alea rcx, [rip+0x1a1a5]
14000bf91mov ebp, eax
14000bf93call printf
14000bf98mov edx, esi
14000bf9amov rcx, rbx
14000bf9dcall PackageAddInt32
14000bfa2mov edx, ebp
14000bfa4jmp 0x14000c09b
14000bfa9
14000bfa9loc_14000bfa9:
14000bfa9cmp esi, 4
14000bfacjne 0x14000c0a3
14000bfb2lea r9, [rip+0x1a1b1]
14000bfb9mov r8l, 255
14000bfbfmov rdx, rdi
14000bfc2mov rcx, r12
14000bfc5call printf
14000bfcamov rcx, rbp
14000bfcdcall ParserGetInt32
14000bfd2mov ecx, eax
14000bfd4mov esi, eax
14000bfd6call JobKill
14000bfdbjmp 0x14000c08d
14000bfe0
14000bfe0loc_14000bfe0:
14000bfe0lea r9, [rip+0x1a100]
14000bfe7mov r8l, 206
14000bfedmov rdx, rdi
14000bff0mov rcx, r12
14000bff3call printf
14000bff8mov rax, [rip+0x20371]
14000bffflea rbp, [rip+0x1a0eb]
14000c006mov rsi, [rax+2302]
14000c00d
14000c00dloc_14000c00d:
14000c00dtest rsi, rsi
14000c010je 0x14000c0a3
14000c016movsx eax, [rsi+10]
14000c01amov r9l, [rsi+4]
14000c01emov rdx, rdi
14000c021mov rcx, rbp
14000c024mov r8l, 212
14000c02amov [rsp+40], eax
14000c02emovsx eax, [rsi+8]
14000c032mov [rsp+32], eax
14000c036call printf
14000c03bmov edx, [rsi+4]
14000c03emov rcx, rbx
14000c041call PackageAddInt32
14000c046movsx edx, [rsi+8]
14000c04amov rcx, rbx
14000c04dcall PackageAddInt32
14000c052movsx edx, [rsi+10]
14000c056mov rcx, rbx
14000c059call PackageAddInt32
14000c05emov rsi, [rsi+32]
14000c062jmp 0x14000c00d
14000c064
14000c064loc_14000c064:
14000c064lea r9, [rip+0x1a0f3]
14000c06bmov r8l, 243
14000c071mov rdx, rdi
14000c074mov rcx, r12
14000c077call printf
14000c07cmov rcx, rbp
14000c07fcall ParserGetInt32
14000c084mov ecx, eax
14000c086mov esi, eax
14000c088call JobResume
14000c08d
14000c08dloc_14000c08d:
14000c08dmov edi, eax
14000c08fmov edx, esi
14000c091mov rcx, rbx
14000c094call PackageAddInt32
14000c099mov edx, edi
14000c09b
14000c09bloc_14000c09b:
14000c09bmov rcx, rbx
14000c09ecall PackageAddInt32
14000c0a3
14000c0a3loc_14000c0a3:
14000c0a3add rsp, 48
14000c0a7mov rcx, rbx
14000c0aapop rbx
14000c0abpop rsi
14000c0acpop rdi
14000c0adpop rbp
14000c0aepop r12
14000c0b0jmp 0x140018b90
14000bee0
14000bee0CommandJob:
14000bee0push r12
14000bee2lea r12, [rip+0x1a11f]
14000bee9lea r9, [rip+0x1a1f3]
14000bef0mov r8l, 196
14000bef6push rbp
14000bef7mov rbp, rcx
14000befamov rcx, r12
14000befdpush rdi
14000befelea rdi, [rip+0x20d2b]
14000bf05push rsi
14000bf06mov rdx, rdi
14000bf09push rbx
14000bf0asub rsp, 48
14000bf0ecall printf
14000bf13mov ecx, 21
14000bf18call PackageCreate
14000bf1dmov rcx, rbp
14000bf20mov rbx, rax
14000bf23call ParserGetInt32
14000bf28mov rcx, rbx
14000bf2bmov esi, eax
14000bf2dmov edx, eax
14000bf2fcall PackageAddInt32
14000bf34cmp esi, 3
14000bf37je 0x14000c064
14000bf3djg 0x14000bfa9
14000bf3fcmp esi, 1
14000bf42je 0x14000bfe0
14000bf48cmp esi, 2
14000bf4bjne 0x14000c0a3
14000bf51lea r9, [rip+0x1a1d1]
14000bf58mov r8l, 229
14000bf5emov rdx, rdi
14000bf61mov rcx, r12
14000bf64call printf
14000bf69mov rcx, rbp
14000bf6ccall ParserGetInt32
14000bf71mov ecx, eax
14000bf73mov esi, eax
14000bf75call JobSuspend
14000bf7amov r9l, esi
14000bf7dmov rdx, rdi
14000bf80mov r8l, 233
14000bf86mov [rsp+32], eax
14000bf8alea rcx, [rip+0x1a1a5]
14000bf91mov ebp, eax
14000bf93call printf
14000bf98mov edx, esi
14000bf9amov rcx, rbx
14000bf9dcall PackageAddInt32
14000bfa2mov edx, ebp
14000bfa4jmp 0x14000c09b
14000bfa9
14000bfa9loc_14000bfa9:
14000bfa9cmp esi, 4
14000bfacjne 0x14000c0a3
14000bfb2lea r9, [rip+0x1a1b1]
14000bfb9mov r8l, 255
14000bfbfmov rdx, rdi
14000bfc2mov rcx, r12
14000bfc5call printf
14000bfcamov rcx, rbp
14000bfcdcall ParserGetInt32
14000bfd2mov ecx, eax
14000bfd4mov esi, eax
14000bfd6call JobKill
14000bfdbjmp 0x14000c08d
14000bfe0
14000bfe0loc_14000bfe0:
14000bfe0lea r9, [rip+0x1a100]
14000bfe7mov r8l, 206
14000bfedmov rdx, rdi
14000bff0mov rcx, r12
14000bff3call printf
14000bff8mov rax, [rip+0x20371]
14000bffflea rbp, [rip+0x1a0eb]
14000c006mov rsi, [rax+2302]
14000c00d
14000c00dloc_14000c00d:
14000c00dtest rsi, rsi
14000c010je 0x14000c0a3
14000c016movsx eax, [rsi+10]
14000c01amov r9l, [rsi+4]
14000c01emov rdx, rdi
14000c021mov rcx, rbp
14000c024mov r8l, 212
14000c02amov [rsp+40], eax
14000c02emovsx eax, [rsi+8]
14000c032mov [rsp+32], eax
14000c036call printf
14000c03bmov edx, [rsi+4]
14000c03emov rcx, rbx
14000c041call PackageAddInt32
14000c046movsx edx, [rsi+8]
14000c04amov rcx, rbx
14000c04dcall PackageAddInt32
14000c052movsx edx, [rsi+10]
14000c056mov rcx, rbx
14000c059call PackageAddInt32
14000c05emov rsi, [rsi+32]
14000c062jmp 0x14000c00d
14000c064
14000c064loc_14000c064:
14000c064lea r9, [rip+0x1a0f3]
14000c06bmov r8l, 243
14000c071mov rdx, rdi
14000c074mov rcx, r12
14000c077call printf
14000c07cmov rcx, rbp
14000c07fcall ParserGetInt32
14000c084mov ecx, eax
14000c086mov esi, eax
14000c088call JobResume
14000c08d
14000c08dloc_14000c08d:
14000c08dmov edi, eax
14000c08fmov edx, esi
14000c091mov rcx, rbx
14000c094call PackageAddInt32
14000c099mov edx, edi
14000c09b
14000c09bloc_14000c09b:
14000c09bmov rcx, rbx
14000c09ecall PackageAddInt32
14000c0a3
14000c0a3loc_14000c0a3:
14000c0a3add rsp, 48
14000c0a7mov rcx, rbx
14000c0aapop rbx
14000c0abpop rsi
14000c0acpop rdi
14000c0adpop rbp
14000c0aepop r12
14000c0b0jmp 0x140018b90
14000bee0
14000c0b5
14000c0b5 // align 0x10
14000c0b5 // align 0x10
14000c0c0
14000c0c0CommandKerberos:
14000c0c0push r15
14000c0c2push r14
14000c0c4push r13
14000c0c6push r12
14000c0c8push rbp
14000c0c9push rdi
14000c0capush rsi
14000c0cbpush rbx
14000c0ccmov rbx, rcx
14000c0cfsub rsp, 56
14000c0d3call TokenCurrentHandle
14000c0d8mov ecx, 2550
14000c0ddmov rbp, rax
14000c0e0call PackageCreate
14000c0e5mov rcx, rbx
14000c0e8mov rsi, rax
14000c0ebcall ParserGetInt32
14000c0f0mov rcx, rsi
14000c0f3mov edi, eax
14000c0f5mov edx, eax
14000c0f7call PackageAddInt32
14000c0fccmp edi, 2
14000c0ffje 0x14000c531
14000c105jg 0x14000c118
14000c107test edi, edi
14000c109je 0x14000c177
14000c10bdec edi
14000c10dje 0x14000c1fe
14000c113jmp 0x14000c572
14000c118
14000c118loc_14000c118:
14000c118cmp edi, 3
14000c11bjne 0x14000c572
14000c121lea r9, [rip+0x1b33b]
14000c128mov r8l, 3140
14000c12elea rdx, [rip+0x20e4b]
14000c135lea rcx, [rip+0x19ecc]
14000c13ccall printf
14000c141lea rdx, [rsp+44]
14000c146xor eax, eax
14000c148mov rcx, rbx
14000c14bmov [rsp+44], eax
14000c14fcall ParserGetBytes
14000c154mov rcx, rbx
14000c157mov rdi, rax
14000c15acall ParserGetInt32
14000c15fmov r8l, [rsp+44]
14000c164mov rdx, rdi
14000c167mov rcx, rbp
14000c16amov r9l, eax
14000c16dcall Ptt
14000c172jmp 0x14000c563
14000c177
14000c177loc_14000c177:
14000c177lea r9, [rip+0x1b2b6]
14000c17emov r8l, 3014
14000c184lea rdx, [rip+0x20df5]
14000c18blea rcx, [rip+0x19e76]
14000c192call printf
14000c197mov rcx, rbp
14000c19acall GetLUID
14000c19fmov rbx, rax
14000c1a2test rbp, rbp
14000c1a5je 0x14000c1af
14000c1a7mov rcx, rbp
14000c1aacall SysNtClose
14000c1af
14000c1afloc_14000c1af:
14000c1afxor edx, edx
14000c1b1test rbx, rbx
14000c1b4mov rcx, rsi
14000c1b7setne dl
14000c1bacall PackageAddInt32
14000c1bftest rbx, rbx
14000c1c2je 0x14000c572
14000c1c8mov edx, [rbx+4]
14000c1cbmov rcx, rsi
14000c1cemov rdi, rbx
14000c1d1call PackageAddInt32
14000c1d6mov edx, [rbx]
14000c1d8mov rcx, rsi
14000c1dbcall PackageAddInt32
14000c1e0mov ecx, 8
14000c1e5xor eax, eax
14000c1e7rep stosb [rdi], al
14000c1e9mov rax, [rip+0x20180]
14000c1f0mov rcx, rbx
14000c1f3call [rax+940]
14000c1f9jmp 0x14000c572
14000c1fe
14000c1feloc_14000c1fe:
14000c1felea r9, [rip+0x1b23e]
14000c205mov r8l, 3041
14000c20blea rdx, [rip+0x20d6e]
14000c212xor edi, edi
14000c214lea rcx, [rip+0x19ded]
14000c21bcall printf
14000c220mov rcx, rbx
14000c223call ParserGetInt32
14000c228dec eax
14000c22ajne 0x14000c236
14000c22cmov rcx, rbx
14000c22fcall ParserGetInt32
14000c234mov edi, eax
14000c236
14000c236loc_14000c236:
14000c236mov rdx, rdi
14000c239mov rcx, rbp
14000c23ccall Klist
14000c241xor edx, edx
14000c243mov rcx, rsi
14000c246test rax, rax
14000c249mov rbx, rax
14000c24csetne dl
14000c24fcall PackageAddInt32
14000c254mov rax, rbx
14000c257xor edx, edx
14000c259
14000c259loc_14000c259:
14000c259test rax, rax
14000c25cje 0x14000c269
14000c25emov rax, [rax+7208]
14000c265inc edx
14000c267jmp 0x14000c259
14000c269
14000c269loc_14000c269:
14000c269mov rcx, rsi
14000c26ccall PackageAddInt32
14000c271mov r13, [rip+0x200f8]
14000c278
14000c278loc_14000c278:
14000c278test rbx, rbx
14000c27bje 0x14000c522
14000c281mov rdx, rbx
14000c284mov rcx, rsi
14000c287mov r14, [rbx+7208]
14000c28ecall PackageAddWString
14000c293lea rdx, [rbx+1024]
14000c29amov rcx, rsi
14000c29dcall PackageAddWString
14000c2a2mov edx, [rbx+2048]
14000c2a8mov rcx, rsi
14000c2abcall PackageAddInt32
14000c2b0mov edx, [rbx+2052]
14000c2b6mov rcx, rsi
14000c2b9call PackageAddInt32
14000c2bemov edx, [rbx+2056]
14000c2c4mov rcx, rsi
14000c2c7call PackageAddInt32
14000c2cclea rdx, [rbx+2060]
14000c2d3mov rcx, rsi
14000c2d6call PackageAddWString
14000c2dbmov edx, [rbx+3088]
14000c2e1mov rcx, rsi
14000c2e4call PackageAddInt32
14000c2e9mov edx, [rbx+3092]
14000c2efmov rcx, rsi
14000c2f2call PackageAddInt32
14000c2f7mov edx, [rbx+3096]
14000c2fdmov rcx, rsi
14000c300call PackageAddInt32
14000c305lea rdx, [rbx+3100]
14000c30cmov rcx, rsi
14000c30fcall PackageAddWString
14000c314lea rdx, [rbx+4124]
14000c31bmov rcx, rsi
14000c31ecall PackageAddWString
14000c323lea rdx, [rbx+5148]
14000c32amov rcx, rsi
14000c32dcall PackageAddWString
14000c332lea rdx, [rbx+6172]
14000c339mov rcx, rsi
14000c33ccall PackageAddWString
14000c341mov rax, [rbx+7200]
14000c348xor edx, edx
14000c34a
14000c34aloc_14000c34a:
14000c34atest rax, rax
14000c34dje 0x14000c35a
14000c34fmov rax, [rax+4144]
14000c356inc edx
14000c358jmp 0x14000c34a
14000c35a
14000c35aloc_14000c35a:
14000c35amov rcx, rsi
14000c35dxor r12l, r12l
14000c360call PackageAddInt32
14000c365
14000c365loc_14000c365:
14000c365mov rdx, [rbx+7200]
14000c36ctest rdx, rdx
14000c36fje 0x14000c4fe
14000c375mov rcx, rsi
14000c378mov r15, [rdx+4144]
14000c37fcall PackageAddWString
14000c384mov rax, [rbx+7200]
14000c38bmov rcx, rsi
14000c38elea rdx, [rax+1024]
14000c395call PackageAddWString
14000c39amov rax, [rbx+7200]
14000c3a1mov rcx, rsi
14000c3a4lea rdx, [rax+2048]
14000c3abcall PackageAddWString
14000c3b0mov rax, [rbx+7200]
14000c3b7mov rcx, rsi
14000c3balea rdx, [rax+3072]
14000c3c1call PackageAddWString
14000c3c6mov rax, [rbx+7200]
14000c3cdmov rcx, rsi
14000c3d0mov edx, [rax+4096]
14000c3d6call PackageAddInt32
14000c3dbmov rax, [rbx+7200]
14000c3e2mov rcx, rsi
14000c3e5mov edx, [rax+4100]
14000c3ebcall PackageAddInt32
14000c3f0mov rax, [rbx+7200]
14000c3f7mov rcx, rsi
14000c3famov edx, [rax+4104]
14000c400call PackageAddInt32
14000c405mov rax, [rbx+7200]
14000c40cmov rcx, rsi
14000c40fmov edx, [rax+4108]
14000c415call PackageAddInt32
14000c41amov rax, [rbx+7200]
14000c421mov rcx, rsi
14000c424mov edx, [rax+4112]
14000c42acall PackageAddInt32
14000c42fmov rax, [rbx+7200]
14000c436mov rcx, rsi
14000c439mov edx, [rax+4116]
14000c43fcall PackageAddInt32
14000c444mov rax, [rbx+7200]
14000c44bmov rcx, rsi
14000c44emov edx, [rax+4120]
14000c454call PackageAddInt32
14000c459mov rax, [rbx+7200]
14000c460mov rcx, rsi
14000c463mov edx, [rax+4124]
14000c469call PackageAddInt32
14000c46emov rax, [rbx+7200]
14000c475mov rcx, rsi
14000c478mov rdx, [rax+4128]
14000c47fmov r8l, [rax+4136]
14000c486call PackageAddBytes
14000c48bmov rax, [rbx+7200]
14000c492mov rdi, [rax+4128]
14000c499test rdi, rdi
14000c49cje 0x14000c4ce
14000c49emov ecx, [rax+4136]
14000c4a4mov eax, r12l
14000c4a7rep stosb [rdi], al
14000c4a9mov rax, [rbx+7200]
14000c4b0mov rcx, [rax+4128]
14000c4b7call [r13+940]
14000c4bemov rax, [rbx+7200]
14000c4c5xor edx, edx
14000c4c7mov [rax+4128], rdx
14000c4ce
14000c4celoc_14000c4ce:
14000c4cemov rdi, [rbx+7200]
14000c4d5test rdi, rdi
14000c4d8je 0x14000c4f2
14000c4damov ecx, 4152
14000c4dfmov eax, r12l
14000c4e2rep stosb [rdi], al
14000c4e4mov rcx, [rbx+7200]
14000c4ebcall [r13+940]
14000c4f2
14000c4f2loc_14000c4f2:
14000c4f2mov [rbx+7200], r15
14000c4f9jmp 0x14000c365
14000c4fe
14000c4feloc_14000c4fe:
14000c4femov rdi, rbx
14000c501mov ecx, 7216
14000c506xor eax, eax
14000c508rep stosb [rdi], al
14000c50amov rax, [rip+0x1fe5f]
14000c511mov rcx, rbx
14000c514mov rbx, r14
14000c517call [rax+940]
14000c51djmp 0x14000c278
14000c522
14000c522loc_14000c522:
14000c522test rbp, rbp
14000c525je 0x14000c572
14000c527mov rcx, rbp
14000c52acall SysNtClose
14000c52fjmp 0x14000c572
14000c531
14000c531loc_14000c531:
14000c531lea rdx, [rip+0x20a48]
14000c538lea r9, [rip+0x1af14]
14000c53fmov r8l, 3129
14000c545lea rcx, [rip+0x19abc]
14000c54ccall printf
14000c551mov rcx, rbx
14000c554call ParserGetInt32
14000c559mov rcx, rbp
14000c55cmov edx, eax
14000c55ecall Purge
14000c563
14000c563loc_14000c563:
14000c563xor edx, edx
14000c565test eax, eax
14000c567mov rcx, rsi
14000c56asetne dl
14000c56dcall PackageAddInt32
14000c572
14000c572loc_14000c572:
14000c572add rsp, 56
14000c576mov rcx, rsi
14000c579pop rbx
14000c57apop rsi
14000c57bpop rdi
14000c57cpop rbp
14000c57dpop r12
14000c57fpop r13
14000c581pop r14
14000c583pop r15
14000c585jmp 0x140018b90
14000c0c0
14000c0c0CommandKerberos:
14000c0c0push r15
14000c0c2push r14
14000c0c4push r13
14000c0c6push r12
14000c0c8push rbp
14000c0c9push rdi
14000c0capush rsi
14000c0cbpush rbx
14000c0ccmov rbx, rcx
14000c0cfsub rsp, 56
14000c0d3call TokenCurrentHandle
14000c0d8mov ecx, 2550
14000c0ddmov rbp, rax
14000c0e0call PackageCreate
14000c0e5mov rcx, rbx
14000c0e8mov rsi, rax
14000c0ebcall ParserGetInt32
14000c0f0mov rcx, rsi
14000c0f3mov edi, eax
14000c0f5mov edx, eax
14000c0f7call PackageAddInt32
14000c0fccmp edi, 2
14000c0ffje 0x14000c531
14000c105jg 0x14000c118
14000c107test edi, edi
14000c109je 0x14000c177
14000c10bdec edi
14000c10dje 0x14000c1fe
14000c113jmp 0x14000c572
14000c118
14000c118loc_14000c118:
14000c118cmp edi, 3
14000c11bjne 0x14000c572
14000c121lea r9, [rip+0x1b33b]
14000c128mov r8l, 3140
14000c12elea rdx, [rip+0x20e4b]
14000c135lea rcx, [rip+0x19ecc]
14000c13ccall printf
14000c141lea rdx, [rsp+44]
14000c146xor eax, eax
14000c148mov rcx, rbx
14000c14bmov [rsp+44], eax
14000c14fcall ParserGetBytes
14000c154mov rcx, rbx
14000c157mov rdi, rax
14000c15acall ParserGetInt32
14000c15fmov r8l, [rsp+44]
14000c164mov rdx, rdi
14000c167mov rcx, rbp
14000c16amov r9l, eax
14000c16dcall Ptt
14000c172jmp 0x14000c563
14000c177
14000c177loc_14000c177:
14000c177lea r9, [rip+0x1b2b6]
14000c17emov r8l, 3014
14000c184lea rdx, [rip+0x20df5]
14000c18blea rcx, [rip+0x19e76]
14000c192call printf
14000c197mov rcx, rbp
14000c19acall GetLUID
14000c19fmov rbx, rax
14000c1a2test rbp, rbp
14000c1a5je 0x14000c1af
14000c1a7mov rcx, rbp
14000c1aacall SysNtClose
14000c1af
14000c1afloc_14000c1af:
14000c1afxor edx, edx
14000c1b1test rbx, rbx
14000c1b4mov rcx, rsi
14000c1b7setne dl
14000c1bacall PackageAddInt32
14000c1bftest rbx, rbx
14000c1c2je 0x14000c572
14000c1c8mov edx, [rbx+4]
14000c1cbmov rcx, rsi
14000c1cemov rdi, rbx
14000c1d1call PackageAddInt32
14000c1d6mov edx, [rbx]
14000c1d8mov rcx, rsi
14000c1dbcall PackageAddInt32
14000c1e0mov ecx, 8
14000c1e5xor eax, eax
14000c1e7rep stosb [rdi], al
14000c1e9mov rax, [rip+0x20180]
14000c1f0mov rcx, rbx
14000c1f3call [rax+940]
14000c1f9jmp 0x14000c572
14000c1fe
14000c1feloc_14000c1fe:
14000c1felea r9, [rip+0x1b23e]
14000c205mov r8l, 3041
14000c20blea rdx, [rip+0x20d6e]
14000c212xor edi, edi
14000c214lea rcx, [rip+0x19ded]
14000c21bcall printf
14000c220mov rcx, rbx
14000c223call ParserGetInt32
14000c228dec eax
14000c22ajne 0x14000c236
14000c22cmov rcx, rbx
14000c22fcall ParserGetInt32
14000c234mov edi, eax
14000c236
14000c236loc_14000c236:
14000c236mov rdx, rdi
14000c239mov rcx, rbp
14000c23ccall Klist
14000c241xor edx, edx
14000c243mov rcx, rsi
14000c246test rax, rax
14000c249mov rbx, rax
14000c24csetne dl
14000c24fcall PackageAddInt32
14000c254mov rax, rbx
14000c257xor edx, edx
14000c259
14000c259loc_14000c259:
14000c259test rax, rax
14000c25cje 0x14000c269
14000c25emov rax, [rax+7208]
14000c265inc edx
14000c267jmp 0x14000c259
14000c269
14000c269loc_14000c269:
14000c269mov rcx, rsi
14000c26ccall PackageAddInt32
14000c271mov r13, [rip+0x200f8]
14000c278
14000c278loc_14000c278:
14000c278test rbx, rbx
14000c27bje 0x14000c522
14000c281mov rdx, rbx
14000c284mov rcx, rsi
14000c287mov r14, [rbx+7208]
14000c28ecall PackageAddWString
14000c293lea rdx, [rbx+1024]
14000c29amov rcx, rsi
14000c29dcall PackageAddWString
14000c2a2mov edx, [rbx+2048]
14000c2a8mov rcx, rsi
14000c2abcall PackageAddInt32
14000c2b0mov edx, [rbx+2052]
14000c2b6mov rcx, rsi
14000c2b9call PackageAddInt32
14000c2bemov edx, [rbx+2056]
14000c2c4mov rcx, rsi
14000c2c7call PackageAddInt32
14000c2cclea rdx, [rbx+2060]
14000c2d3mov rcx, rsi
14000c2d6call PackageAddWString
14000c2dbmov edx, [rbx+3088]
14000c2e1mov rcx, rsi
14000c2e4call PackageAddInt32
14000c2e9mov edx, [rbx+3092]
14000c2efmov rcx, rsi
14000c2f2call PackageAddInt32
14000c2f7mov edx, [rbx+3096]
14000c2fdmov rcx, rsi
14000c300call PackageAddInt32
14000c305lea rdx, [rbx+3100]
14000c30cmov rcx, rsi
14000c30fcall PackageAddWString
14000c314lea rdx, [rbx+4124]
14000c31bmov rcx, rsi
14000c31ecall PackageAddWString
14000c323lea rdx, [rbx+5148]
14000c32amov rcx, rsi
14000c32dcall PackageAddWString
14000c332lea rdx, [rbx+6172]
14000c339mov rcx, rsi
14000c33ccall PackageAddWString
14000c341mov rax, [rbx+7200]
14000c348xor edx, edx
14000c34a
14000c34aloc_14000c34a:
14000c34atest rax, rax
14000c34dje 0x14000c35a
14000c34fmov rax, [rax+4144]
14000c356inc edx
14000c358jmp 0x14000c34a
14000c35a
14000c35aloc_14000c35a:
14000c35amov rcx, rsi
14000c35dxor r12l, r12l
14000c360call PackageAddInt32
14000c365
14000c365loc_14000c365:
14000c365mov rdx, [rbx+7200]
14000c36ctest rdx, rdx
14000c36fje 0x14000c4fe
14000c375mov rcx, rsi
14000c378mov r15, [rdx+4144]
14000c37fcall PackageAddWString
14000c384mov rax, [rbx+7200]
14000c38bmov rcx, rsi
14000c38elea rdx, [rax+1024]
14000c395call PackageAddWString
14000c39amov rax, [rbx+7200]
14000c3a1mov rcx, rsi
14000c3a4lea rdx, [rax+2048]
14000c3abcall PackageAddWString
14000c3b0mov rax, [rbx+7200]
14000c3b7mov rcx, rsi
14000c3balea rdx, [rax+3072]
14000c3c1call PackageAddWString
14000c3c6mov rax, [rbx+7200]
14000c3cdmov rcx, rsi
14000c3d0mov edx, [rax+4096]
14000c3d6call PackageAddInt32
14000c3dbmov rax, [rbx+7200]
14000c3e2mov rcx, rsi
14000c3e5mov edx, [rax+4100]
14000c3ebcall PackageAddInt32
14000c3f0mov rax, [rbx+7200]
14000c3f7mov rcx, rsi
14000c3famov edx, [rax+4104]
14000c400call PackageAddInt32
14000c405mov rax, [rbx+7200]
14000c40cmov rcx, rsi
14000c40fmov edx, [rax+4108]
14000c415call PackageAddInt32
14000c41amov rax, [rbx+7200]
14000c421mov rcx, rsi
14000c424mov edx, [rax+4112]
14000c42acall PackageAddInt32
14000c42fmov rax, [rbx+7200]
14000c436mov rcx, rsi
14000c439mov edx, [rax+4116]
14000c43fcall PackageAddInt32
14000c444mov rax, [rbx+7200]
14000c44bmov rcx, rsi
14000c44emov edx, [rax+4120]
14000c454call PackageAddInt32
14000c459mov rax, [rbx+7200]
14000c460mov rcx, rsi
14000c463mov edx, [rax+4124]
14000c469call PackageAddInt32
14000c46emov rax, [rbx+7200]
14000c475mov rcx, rsi
14000c478mov rdx, [rax+4128]
14000c47fmov r8l, [rax+4136]
14000c486call PackageAddBytes
14000c48bmov rax, [rbx+7200]
14000c492mov rdi, [rax+4128]
14000c499test rdi, rdi
14000c49cje 0x14000c4ce
14000c49emov ecx, [rax+4136]
14000c4a4mov eax, r12l
14000c4a7rep stosb [rdi], al
14000c4a9mov rax, [rbx+7200]
14000c4b0mov rcx, [rax+4128]
14000c4b7call [r13+940]
14000c4bemov rax, [rbx+7200]
14000c4c5xor edx, edx
14000c4c7mov [rax+4128], rdx
14000c4ce
14000c4celoc_14000c4ce:
14000c4cemov rdi, [rbx+7200]
14000c4d5test rdi, rdi
14000c4d8je 0x14000c4f2
14000c4damov ecx, 4152
14000c4dfmov eax, r12l
14000c4e2rep stosb [rdi], al
14000c4e4mov rcx, [rbx+7200]
14000c4ebcall [r13+940]
14000c4f2
14000c4f2loc_14000c4f2:
14000c4f2mov [rbx+7200], r15
14000c4f9jmp 0x14000c365
14000c4fe
14000c4feloc_14000c4fe:
14000c4femov rdi, rbx
14000c501mov ecx, 7216
14000c506xor eax, eax
14000c508rep stosb [rdi], al
14000c50amov rax, [rip+0x1fe5f]
14000c511mov rcx, rbx
14000c514mov rbx, r14
14000c517call [rax+940]
14000c51djmp 0x14000c278
14000c522
14000c522loc_14000c522:
14000c522test rbp, rbp
14000c525je 0x14000c572
14000c527mov rcx, rbp
14000c52acall SysNtClose
14000c52fjmp 0x14000c572
14000c531
14000c531loc_14000c531:
14000c531lea rdx, [rip+0x20a48]
14000c538lea r9, [rip+0x1af14]
14000c53fmov r8l, 3129
14000c545lea rcx, [rip+0x19abc]
14000c54ccall printf
14000c551mov rcx, rbx
14000c554call ParserGetInt32
14000c559mov rcx, rbp
14000c55cmov edx, eax
14000c55ecall Purge
14000c563
14000c563loc_14000c563:
14000c563xor edx, edx
14000c565test eax, eax
14000c567mov rcx, rsi
14000c56asetne dl
14000c56dcall PackageAddInt32
14000c572
14000c572loc_14000c572:
14000c572add rsp, 56
14000c576mov rcx, rsi
14000c579pop rbx
14000c57apop rsi
14000c57bpop rdi
14000c57cpop rbp
14000c57dpop r12
14000c57fpop r13
14000c581pop r14
14000c583pop r15
14000c585jmp 0x140018b90
14000c0c0
14000c58a
14000c58a // align 0x10
14000c58a // align 0x10
14000c590
14000c590CommandMemFile:
14000c590push rbp
14000c591xor eax, eax
14000c593push rdi
14000c594push rsi
14000c595mov rsi, rcx
14000c598mov ecx, 2560
14000c59dpush rbx
14000c59esub rsp, 56
14000c5a2mov [rsp+32], rax
14000c5a7mov [rsp+40], rax
14000c5accall PackageCreate
14000c5b1lea r9, [rip+0x1aeb9]
14000c5b8mov r8l, 3171
14000c5belea rdx, [rip+0x2069b]
14000c5c5lea rcx, [rip+0x19a3c]
14000c5ccmov rbx, rax
14000c5cfcall printf
14000c5d4mov rcx, rsi
14000c5d7call ParserGetInt32
14000c5dcmov rcx, rsi
14000c5dfmov edi, eax
14000c5e1call ParserGetInt64
14000c5e6lea rdx, [rsp+40]
14000c5ebmov rcx, rsi
14000c5eemov rbp, rax
14000c5f1call ParserGetBytes
14000c5f6mov r9l, [rsp+40]
14000c5fbmov rdx, rbp
14000c5femov ecx, edi
14000c600mov r8, rax
14000c603mov [rsp+32], rax
14000c608call ProcessMemFileChunk
14000c60dmov edx, edi
14000c60fmov rcx, rbx
14000c612mov rsi, rax
14000c615call PackageAddInt32
14000c61axor edx, edx
14000c61ctest rsi, rsi
14000c61fmov rcx, rbx
14000c622setne dl
14000c625call PackageAddInt32
14000c62amov rcx, rbx
14000c62dcall PackageTransmit
14000c632add rsp, 56
14000c636pop rbx
14000c637pop rsi
14000c638pop rdi
14000c639pop rbp
14000c63aret
14000c590
14000c590CommandMemFile:
14000c590push rbp
14000c591xor eax, eax
14000c593push rdi
14000c594push rsi
14000c595mov rsi, rcx
14000c598mov ecx, 2560
14000c59dpush rbx
14000c59esub rsp, 56
14000c5a2mov [rsp+32], rax
14000c5a7mov [rsp+40], rax
14000c5accall PackageCreate
14000c5b1lea r9, [rip+0x1aeb9]
14000c5b8mov r8l, 3171
14000c5belea rdx, [rip+0x2069b]
14000c5c5lea rcx, [rip+0x19a3c]
14000c5ccmov rbx, rax
14000c5cfcall printf
14000c5d4mov rcx, rsi
14000c5d7call ParserGetInt32
14000c5dcmov rcx, rsi
14000c5dfmov edi, eax
14000c5e1call ParserGetInt64
14000c5e6lea rdx, [rsp+40]
14000c5ebmov rcx, rsi
14000c5eemov rbp, rax
14000c5f1call ParserGetBytes
14000c5f6mov r9l, [rsp+40]
14000c5fbmov rdx, rbp
14000c5femov ecx, edi
14000c600mov r8, rax
14000c603mov [rsp+32], rax
14000c608call ProcessMemFileChunk
14000c60dmov edx, edi
14000c60fmov rcx, rbx
14000c612mov rsi, rax
14000c615call PackageAddInt32
14000c61axor edx, edx
14000c61ctest rsi, rsi
14000c61fmov rcx, rbx
14000c622setne dl
14000c625call PackageAddInt32
14000c62amov rcx, rbx
14000c62dcall PackageTransmit
14000c632add rsp, 56
14000c636pop rbx
14000c637pop rsi
14000c638pop rdi
14000c639pop rbp
14000c63aret
14000c590
14000c63b
14000c63b // align 0x10
14000c63b // align 0x10
14000c640
14000c640CommandNet:
14000c640push r15
14000c642lea r9, [rip+0x1a023]
14000c649mov r8l, 2049
14000c64fpush r14
14000c651push r13
14000c653push r12
14000c655push rbp
14000c656mov rbp, rcx
14000c659push rdi
14000c65alea rdi, [rip+0x199a7]
14000c661push rsi
14000c662lea rsi, [rip+0x20cc7]
14000c669mov rcx, rdi
14000c66cpush rbx
14000c66dmov rdx, rsi
14000c670sub rsp, 136
14000c677call printf
14000c67cmov ecx, 2100
14000c681call PackageCreate
14000c686mov rcx, rbp
14000c689mov [rsp+88], rax
14000c68ecall ParserGetInt32
14000c693mov rcx, [rsp+88]
14000c698mov r12l, eax
14000c69bmov edx, eax
14000c69dcall PackageAddInt32
14000c6a2dec r12l
14000c6a5cmp r12l, 8
14000c6a9ja 0x14000cf43
14000c6aflea rdx, [rip+0x1a1ca]
14000c6b6movsxd rax, [rdx+4*r12]
14000c6baadd rax, rdx
14000c6bdjmp rax
14000c6bfmov rcx, rdi
14000c6c2mov r8l, 2059
14000c6c8mov rdx, rsi
14000c6cblea r9, [rip+0x19fa6]
14000c6d2lea rdi, [rsp+120]
14000c6d7call printf
14000c6dcxor r11l, r11l
14000c6dfxor edx, edx
14000c6e1mov r8, rdi
14000c6e4mov rbp, [rip+0x1fc85]
14000c6ebmov [rsp+120], r11l
14000c6f0mov ecx, 2
14000c6f5call [rbp+924]
14000c6fbtest eax, eax
14000c6fdjne 0x14000ca2c
14000c703mov edx, [rsp+120]
14000c707mov ecx, 64
14000c70ccall [rbp+932]
14000c712mov rsi, rax
14000c715test rax, rax
14000c718je 0x14000ca2c
14000c71emov r8, rdi
14000c721mov rdx, rax
14000c724mov ecx, 2
14000c729call [rbp+924]
14000c72ftest eax, eax
14000c731jne 0x14000c760
14000c733mov rax, [rbp+2230]
14000c73amov ecx, 1
14000c73fmov rdi, rsi
14000c742mov edx, [rax+104]
14000c745call PackageTransmitError
14000c74amov ecx, [rsp+120]
14000c74exor eax, eax
14000c750rep stosb [rdi], al
14000c752mov rcx, rsi
14000c755call [rbp+940]
14000c75bjmp 0x14000ca2c
14000c760
14000c760loc_14000c760:
14000c760mov rcx, [rsp+88]
14000c765mov rdx, rsi
14000c768mov rdi, rsi
14000c76bcall PackageAddString
14000c770mov ecx, [rsp+120]
14000c774xor eax, eax
14000c776rep stosb [rdi], al
14000c778mov rcx, rsi
14000c77bcall [rbp+940]
14000c781jmp 0x14000cf5b
14000c786mov rcx, rdi
14000c789lea r13, [rsp+120]
14000c78elea r14, [rsp+112]
14000c793mov rdx, rsi
14000c796lea r9, [rip+0x19ef4]
14000c79dmov r8l, 2094
14000c7a3call printf
14000c7a8xor r9l, r9l
14000c7abxor r8l, r8l
14000c7aelea rdx, [rsp+116]
14000c7b3mov rcx, rbp
14000c7b6mov [rsp+120], r8
14000c7bbmov [rsp+104], r9l
14000c7c0mov [rsp+108], r9l
14000c7c5mov [rsp+112], r9l
14000c7camov [rsp+116], r9l
14000c7cfcall ParserGetWString
14000c7d4mov rcx, [rsp+88]
14000c7d9mov rdx, rax
14000c7dcmov r12, rax
14000c7dfcall PackageAddWString
14000c7e4xor r10l, r10l
14000c7e7mov rdi, [rip+0x1fb82]
14000c7eemov [rsp+116], r10l
14000c7f3
14000c7f3loc_14000c7f3:
14000c7f3lea rax, [rsp+108]
14000c7f8mov [rsp+48], r14
14000c7fdor r9l, -1
14000c801xor edx, edx
14000c803mov [rsp+40], rax
14000c808lea rax, [rsp+104]
14000c80dmov r8, r13
14000c810mov rcx, r12
14000c813mov [rsp+32], rax
14000c818call [rdi+1788]
14000c81emov ebp, eax
14000c820test eax, eax
14000c822je 0x14000c82b
14000c824cmp eax, 234
14000c829jne 0x14000c852
14000c82b
14000c82bloc_14000c82b:
14000c82bxor r15l, r15l
14000c82e
14000c82eloc_14000c82e:
14000c82emov rcx, [rsp+120]
14000c833cmp r15l, [rsp+104]
14000c838jae 0x14000c886
14000c83atest rcx, rcx
14000c83dje 0x14000c898
14000c83fmov rdx, [rcx+8*r15]
14000c843mov rcx, [rsp+88]
14000c848inc r15
14000c84bcall PackageAddWString
14000c850jmp 0x14000c82e
14000c852
14000c852loc_14000c852:
14000c852mov r12, [rdi+2230]
14000c859mov ecx, eax
14000c85bcall [rdi+348]
14000c861mov r8l, 2127
14000c867mov rdx, rsi
14000c86alea rcx, [rip+0x19e39]
14000c871mov [r12+104], eax
14000c876mov rax, [rdi+2230]
14000c87dmov r9l, [rax+104]
14000c881jmp 0x14000c9de
14000c886
14000c886loc_14000c886:
14000c886test rcx, rcx
14000c889je 0x14000c898
14000c88bcall [rdi+1836]
14000c891xor ecx, ecx
14000c893mov [rsp+120], rcx
14000c898
14000c898loc_14000c898:
14000c898cmp ebp, 234
14000c89eje 0x14000c7f3
14000c8a4jmp 0x14000ce27
14000c8a9mov rcx, rdi
14000c8aclea r14, [rsp+112]
14000c8b1lea r15, [rsp+108]
14000c8b6mov rdx, rsi
14000c8b9lea r9, [rip+0x19e19]
14000c8c0mov r8l, 2155
14000c8c6call printf
14000c8cbxor eax, eax
14000c8cdlea rdx, [rsp+116]
14000c8d2mov rcx, rbp
14000c8d5mov [rsp+120], rax
14000c8daxor eax, eax
14000c8dcmov [rsp+104], eax
14000c8e0mov [rsp+108], eax
14000c8e4mov [rsp+112], eax
14000c8e8mov [rsp+116], eax
14000c8eccall ParserGetWString
14000c8f1mov rcx, [rsp+88]
14000c8f6mov rdx, rax
14000c8f9mov r12, rax
14000c8fccall PackageAddWString
14000c901xor edx, edx
14000c903mov rdi, [rip+0x1fa66]
14000c90amov [rsp+116], edx
14000c90e
14000c90eloc_14000c90e:
14000c90elea rax, [rsp+104]
14000c913mov [rsp+64], r14
14000c918xor r8l, r8l
14000c91bxor edx, edx
14000c91dmov [rsp+48], rax
14000c922lea rax, [rsp+120]
14000c927mov r9l, 10
14000c92dmov rcx, r12
14000c930mov [rsp+56], r15
14000c935mov [rsp+40], -1
14000c93dmov [rsp+32], rax
14000c942call [rdi+1796]
14000c948mov ebp, eax
14000c94atest eax, eax
14000c94cje 0x14000c955
14000c94ecmp eax, 234
14000c953jne 0x14000c9c3
14000c955
14000c955loc_14000c955:
14000c955xor ebx, ebx
14000c957
14000c957loc_14000c957:
14000c957mov rcx, [rsp+120]
14000c95ccmp ebx, [rsp+104]
14000c960jae 0x14000ca09
14000c966test rcx, rcx
14000c969je 0x14000ca1b
14000c96fimul r13, rbx, 24
14000c973inc rbx
14000c976mov rdx, [rcx+r13+8]
14000c97bmov rcx, [rsp+88]
14000c980call PackageAddWString
14000c985mov rdx, [rsp+120]
14000c98amov rcx, [rsp+88]
14000c98fmov rdx, [rdx+r13+8]
14000c994call PackageAddWString
14000c999mov rdx, [rsp+120]
14000c99emov rcx, [rsp+88]
14000c9a3mov edx, [rdx+r13+16]
14000c9a8call PackageAddInt32
14000c9admov rdx, [rsp+120]
14000c9b2mov rcx, [rsp+88]
14000c9b7mov edx, [rdx+r13+20]
14000c9bccall PackageAddInt32
14000c9c1jmp 0x14000c957
14000c9c3
14000c9c3loc_14000c9c3:
14000c9c3mov rax, [rdi+2230]
14000c9camov r8l, 2189
14000c9d0mov rdx, rsi
14000c9d3lea rcx, [rip+0x19d1a]
14000c9damov r9l, [rax+104]
14000c9de
14000c9deloc_14000c9de:
14000c9decall printf
14000c9e3mov rax, [rdi+2230]
14000c9eamov ecx, 1
14000c9efmov edx, [rax+104]
14000c9f2call PackageTransmitError
14000c9f7mov rcx, [rsp+120]
14000c9fctest rcx, rcx
14000c9ffje 0x14000ca2c
14000ca01call [rdi+1836]
14000ca07jmp 0x14000ca2c
14000ca09
14000ca09loc_14000ca09:
14000ca09test rcx, rcx
14000ca0cje 0x14000ca1b
14000ca0ecall [rdi+1836]
14000ca14xor eax, eax
14000ca16mov [rsp+120], rax
14000ca1b
14000ca1bloc_14000ca1b:
14000ca1bcmp ebp, 234
14000ca21je 0x14000c90e
14000ca27jmp 0x14000ce27
14000ca2c
14000ca2cloc_14000ca2c:
14000ca2cmov rcx, [rsp+88]
14000ca31call PackageDestroy
14000ca36add rsp, 136
14000ca3dpop rbx
14000ca3epop rsi
14000ca3fpop rdi
14000ca40pop rbp
14000ca41pop r12
14000ca43pop r13
14000ca45pop r14
14000ca47pop r15
14000ca49ret
14000ca4alea r9, [rip+0x19cd0]
14000ca51mov r8l, 2217
14000ca57jmp 0x14000cf50
14000ca5clea r9, [rip+0x19cd9]
14000ca63mov r8l, 2224
14000ca69jmp 0x14000cf50
14000ca6elea r9, [rip+0x19ce0]
14000ca75mov r8l, 2230
14000ca7bmov rdx, rsi
14000ca7emov rcx, rdi
14000ca81call printf
14000ca86xor eax, eax
14000ca88lea rdx, [rsp+116]
14000ca8dmov rcx, rbp
14000ca90mov [rsp+120], rax
14000ca95xor eax, eax
14000ca97lea r14, [rip+0x19ccf]
14000ca9emov [rsp+104], eax
14000caa2mov [rsp+108], eax
14000caa6mov [rsp+112], eax
14000caaamov [rsp+116], eax
14000caaecall ParserGetWString
14000cab3mov rcx, [rsp+88]
14000cab8mov rdx, rax
14000cabbmov r12, rax
14000cabecall PackageAddWString
14000cac3mov r13, [rip+0x1f8a6]
14000caca
14000cacaloc_14000caca:
14000cacalea rax, [rsp+112]
14000cacfor r9l, -1
14000cad3lea r8, [rsp+120]
14000cad8mov rcx, r12
14000cadbmov [rsp+48], rax
14000cae0lea rax, [rsp+108]
14000cae5mov edx, 502
14000caeamov [rsp+40], rax
14000caeflea rax, [rsp+104]
14000caf4mov [rsp+32], rax
14000caf9call [r13+1828]
14000cb00mov ebp, eax
14000cb02test eax, eax
14000cb04je 0x14000cb11
14000cb06cmp eax, 234
14000cb0bjne 0x14000cbd1
14000cb11
14000cb11loc_14000cb11:
14000cb11xor r15l, r15l
14000cb14
14000cb14loc_14000cb14:
14000cb14mov rcx, [rsp+120]
14000cb19cmp r15l, [rsp+104]
14000cb1ejae 0x14000cbb1
14000cb24mov edi, r15l
14000cb27mov r8l, 2250
14000cb2dmov rdx, rsi
14000cb30inc r15l
14000cb33imul rdi, rdi, 72
14000cb37add rcx, rdi
14000cb3amov rax, [rcx+16]
14000cb3emov [rsp+48], rax
14000cb43mov eax, [rcx+24]
14000cb46mov [rsp+40], eax
14000cb4amov rax, [rcx+40]
14000cb4emov [rsp+32], rax
14000cb53mov r9, [rcx]
14000cb56mov rcx, r14
14000cb59call printf
14000cb5emov rax, [rsp+120]
14000cb63mov rcx, [rsp+88]
14000cb68mov rdx, [rax+rdi]
14000cb6ccall PackageAddWString
14000cb71mov rax, [rsp+120]
14000cb76mov rcx, [rsp+88]
14000cb7bmov rdx, [rax+rdi+40]
14000cb80call PackageAddWString
14000cb85mov rax, [rsp+120]
14000cb8amov rcx, [rsp+88]
14000cb8fmov rdx, [rax+rdi+16]
14000cb94call PackageAddWString
14000cb99mov rax, [rsp+120]
14000cb9emov rcx, [rsp+88]
14000cba3mov edx, [rax+rdi+24]
14000cba7call PackageAddInt32
14000cbacjmp 0x14000cb14
14000cbb1
14000cbb1loc_14000cbb1:
14000cbb1call [r13+1836]
14000cbb8xor r15l, r15l
14000cbbbmov [rsp+120], r15
14000cbc0cmp ebp, 234
14000cbc6je 0x14000caca
14000cbccjmp 0x14000cf5b
14000cbd1
14000cbd1loc_14000cbd1:
14000cbd1mov r9l, eax
14000cbd4mov r8l, 2262
14000cbdamov rdx, rsi
14000cbddlea rcx, [rip+0x19bb1]
14000cbe4call printf
14000cbe9jmp 0x14000cf5b
14000cbeelea r9, [rip+0x19bbc]
14000cbf5mov rdx, rsi
14000cbf8mov rcx, rdi
14000cbfbxor ebx, ebx
14000cbfdmov r8l, 2271
14000cc03xor r13l, r13l
14000cc06call printf
14000cc0bxor r11l, r11l
14000cc0emov rcx, rbp
14000cc11lea rdx, [rsp+116]
14000cc16mov [rsp+120], r11
14000cc1bmov [rsp+108], ebx
14000cc1fmov [rsp+112], ebx
14000cc23mov [rsp+116], ebx
14000cc27call ParserGetWString
14000cc2cmov rcx, [rsp+88]
14000cc31mov rbp, rax
14000cc34mov rdx, rax
14000cc37call PackageAddWString
14000cc3cmov r9, rbp
14000cc3fmov rdx, rsi
14000cc42mov r8l, 2283
14000cc48lea rcx, [rip+0x19b7f]
14000cc4fcall printf
14000cc54lea rax, [rsp+112]
14000cc59or r9l, -1
14000cc5dmov r12, [rip+0x1f70c]
14000cc64mov [rsp+40], rax
14000cc69lea rax, [rsp+108]
14000cc6elea r8, [rsp+120]
14000cc73mov rcx, rbp
14000cc76mov [rsp+48], r13
14000cc7bmov edx, 1
14000cc80mov [rsp+32], rax
14000cc85call [r12+1804]
14000cc8dtest eax, eax
14000cc8fje 0x14000cc9c
14000cc91cmp eax, 234
14000cc96jne 0x14000cf5b
14000cc9c
14000cc9cloc_14000cc9c:
14000cc9cmov rdx, rsi
14000cc9flea r9, [rip+0x19b4b]
14000cca6mov rcx, rdi
14000cca9xor esi, esi
14000ccabmov r8l, 2288
14000ccb1call printf
14000ccb6cmp [rsp+120], 0
14000ccbcje 0x14000cf5b
14000ccc2
14000ccc2loc_14000ccc2:
14000ccc2mov rcx, [rsp+120]
14000ccc7cmp esi, [rsp+108]
14000cccbjae 0x14000ccf9
14000cccdmov edi, esi
14000cccfinc esi
14000ccd1shl rdi, 4
14000ccd5mov rdx, [rcx+rdi]
14000ccd9mov rcx, [rsp+88]
14000ccdecall PackageAddWString
14000cce3mov rax, [rsp+120]
14000cce8mov rcx, [rsp+88]
14000ccedmov rdx, [rax+rdi+8]
14000ccf2call PackageAddWString
14000ccf7jmp 0x14000ccc2
14000ccf9
14000ccf9loc_14000ccf9:
14000ccf9call [r12+1836]
14000cd01jmp 0x14000cf5b
14000cd06mov rcx, rdi
14000cd09lea r9, [rip+0x19afe]
14000cd10mov r8l, 2307
14000cd16mov rdx, rsi
14000cd19call printf
14000cd1exor r9l, r9l
14000cd21xor r8l, r8l
14000cd24mov rcx, rbp
14000cd27lea rdx, [rsp+116]
14000cd2cmov [rsp+120], r8
14000cd31mov [rsp+108], r9l
14000cd36mov [rsp+112], r9l
14000cd3bmov [rsp+116], r9l
14000cd40call ParserGetWString
14000cd45mov rcx, [rsp+88]
14000cd4amov rdx, rax
14000cd4dmov rbp, rax
14000cd50call PackageAddWString
14000cd55lea rax, [rsp+112]
14000cd5axor r10l, r10l
14000cd5dmov rcx, rbp
14000cd60mov rdi, [rip+0x1f609]
14000cd67mov [rsp+40], rax
14000cd6clea rax, [rsp+108]
14000cd71or r9l, -1
14000cd75mov [rsp+48], r10
14000cd7alea r8, [rsp+120]
14000cd7fmov edx, 1
14000cd84mov [rsp+32], rax
14000cd89call [rdi+1812]
14000cd8ftest eax, eax
14000cd91je 0x14000cd9a
14000cd93cmp eax, 234
14000cd98jne 0x14000cdef
14000cd9a
14000cd9aloc_14000cd9a:
14000cd9axor esi, esi
14000cd9ccmp [rsp+120], 0
14000cda2jne 0x14000cdb8
14000cda4
14000cda4loc_14000cda4:
14000cda4mov rcx, [rsp+120]
14000cda9call [rdi+1836]
14000cdafxor ecx, ecx
14000cdb1mov [rsp+120], rcx
14000cdb6jmp 0x14000ce27
14000cdb8
14000cdb8loc_14000cdb8:
14000cdb8mov rax, [rsp+120]
14000cdbdcmp esi, [rsp+108]
14000cdc1jae 0x14000cda4
14000cdc3mov ebp, esi
14000cdc5mov rcx, [rsp+88]
14000cdcainc esi
14000cdccshl rbp, 4
14000cdd0mov rdx, [rax+rbp]
14000cdd4call PackageAddWString
14000cdd9mov rax, [rsp+120]
14000cddemov rcx, [rsp+88]
14000cde3mov rdx, [rax+rbp+8]
14000cde8call PackageAddWString
14000cdedjmp 0x14000cdb8
14000cdef
14000cdefloc_14000cdef:
14000cdefmov rdx, [rdi+2230]
14000cdf6lea rcx, [rip+0x19a29]
14000cdfdmov r8l, 2336
14000ce03mov r9l, [rdx+104]
14000ce07mov [rsp+32], eax
14000ce0bmov rdx, rsi
14000ce0ecall printf
14000ce13mov rax, [rdi+2230]
14000ce1amov ecx, 1
14000ce1fmov edx, [rax+104]
14000ce22call PackageTransmitError
14000ce27
14000ce27loc_14000ce27:
14000ce27mov rcx, [rsp+120]
14000ce2cjmp 0x14000cefc
14000ce31lea r9, [rip+0x19a1e]
14000ce38mov r8l, 2351
14000ce3emov rcx, rdi
14000ce41mov rdx, rsi
14000ce44call printf
14000ce49xor edx, edx
14000ce4bxor eax, eax
14000ce4dmov rcx, rbp
14000ce50mov [rsp+104], edx
14000ce54mov [rsp+108], edx
14000ce58mov [rsp+112], edx
14000ce5cmov [rsp+116], edx
14000ce60lea rdx, [rsp+116]
14000ce65mov [rsp+120], rax
14000ce6acall ParserGetWString
14000ce6fmov rcx, [rsp+88]
14000ce74mov rdx, rax
14000ce77mov rbp, rax
14000ce7acall PackageAddWString
14000ce7flea rax, [rsp+112]
14000ce84xor r8l, r8l
14000ce87xor edx, edx
14000ce89mov [rsp+56], rax
14000ce8emov rdi, [rip+0x1f4db]
14000ce95lea rax, [rsp+108]
14000ce9amov rcx, rbp
14000ce9dmov [rsp+48], rax
14000cea2lea rax, [rsp+104]
14000cea7lea r9, [rsp+120]
14000ceacmov [rsp+40], rax
14000ceb1mov [rsp+32], -1
14000ceb9call [rdi+1820]
14000cebftest eax, eax
14000cec1je 0x14000ceca
14000cec3cmp eax, 234
14000cec8jne 0x14000cf09
14000ceca
14000cecaloc_14000ceca:
14000cecaxor esi, esi
14000cecc
14000ceccloc_14000cecc:
14000ceccmov rcx, [rsp+120]
14000ced1cmp esi, [rsp+104]
14000ced5jae 0x14000cefc
14000ced7mov eax, esi
14000ced9mov rdx, [rcx+8*rax]
14000ceddtest rdx, rdx
14000cee0je 0x14000cef8
14000cee2mov rcx, [rsp+88]
14000cee7call PackageAddWString
14000ceecmov rcx, [rsp+88]
14000cef1xor edx, edx
14000cef3call PackageAddInt32
14000cef8
14000cef8loc_14000cef8:
14000cef8inc esi
14000cefajmp 0x14000cecc
14000cefc
14000cefcloc_14000cefc:
14000cefctest rcx, rcx
14000ceffje 0x14000cf5b
14000cf01call [rdi+1836]
14000cf07jmp 0x14000cf5b
14000cf09
14000cf09loc_14000cf09:
14000cf09mov rdx, [rdi+2230]
14000cf10mov r8l, 2384
14000cf16lea rcx, [rip+0x19909]
14000cf1dmov r9l, [rdx+104]
14000cf21mov [rsp+32], eax
14000cf25mov rdx, rsi
14000cf28call printf
14000cf2dmov rax, [rdi+2230]
14000cf34mov ecx, 1
14000cf39mov edx, [rax+104]
14000cf3ccall PackageTransmitError
14000cf41jmp 0x14000cf5b
14000cf43
14000cf43loc_14000cf43:
14000cf43lea r9, [rip+0x19923]
14000cf4amov r8l, 2393
14000cf50
14000cf50loc_14000cf50:
14000cf50mov rdx, rsi
14000cf53mov rcx, rdi
14000cf56call printf
14000cf5b
14000cf5bloc_14000cf5b:
14000cf5bmov rcx, [rsp+88]
14000cf60add rsp, 136
14000cf67pop rbx
14000cf68pop rsi
14000cf69pop rdi
14000cf6apop rbp
14000cf6bpop r12
14000cf6dpop r13
14000cf6fpop r14
14000cf71pop r15
14000cf73jmp 0x140018b90
14000c640
14000c640CommandNet:
14000c640push r15
14000c642lea r9, [rip+0x1a023]
14000c649mov r8l, 2049
14000c64fpush r14
14000c651push r13
14000c653push r12
14000c655push rbp
14000c656mov rbp, rcx
14000c659push rdi
14000c65alea rdi, [rip+0x199a7]
14000c661push rsi
14000c662lea rsi, [rip+0x20cc7]
14000c669mov rcx, rdi
14000c66cpush rbx
14000c66dmov rdx, rsi
14000c670sub rsp, 136
14000c677call printf
14000c67cmov ecx, 2100
14000c681call PackageCreate
14000c686mov rcx, rbp
14000c689mov [rsp+88], rax
14000c68ecall ParserGetInt32
14000c693mov rcx, [rsp+88]
14000c698mov r12l, eax
14000c69bmov edx, eax
14000c69dcall PackageAddInt32
14000c6a2dec r12l
14000c6a5cmp r12l, 8
14000c6a9ja 0x14000cf43
14000c6aflea rdx, [rip+0x1a1ca]
14000c6b6movsxd rax, [rdx+4*r12]
14000c6baadd rax, rdx
14000c6bdjmp rax
14000c6bfmov rcx, rdi
14000c6c2mov r8l, 2059
14000c6c8mov rdx, rsi
14000c6cblea r9, [rip+0x19fa6]
14000c6d2lea rdi, [rsp+120]
14000c6d7call printf
14000c6dcxor r11l, r11l
14000c6dfxor edx, edx
14000c6e1mov r8, rdi
14000c6e4mov rbp, [rip+0x1fc85]
14000c6ebmov [rsp+120], r11l
14000c6f0mov ecx, 2
14000c6f5call [rbp+924]
14000c6fbtest eax, eax
14000c6fdjne 0x14000ca2c
14000c703mov edx, [rsp+120]
14000c707mov ecx, 64
14000c70ccall [rbp+932]
14000c712mov rsi, rax
14000c715test rax, rax
14000c718je 0x14000ca2c
14000c71emov r8, rdi
14000c721mov rdx, rax
14000c724mov ecx, 2
14000c729call [rbp+924]
14000c72ftest eax, eax
14000c731jne 0x14000c760
14000c733mov rax, [rbp+2230]
14000c73amov ecx, 1
14000c73fmov rdi, rsi
14000c742mov edx, [rax+104]
14000c745call PackageTransmitError
14000c74amov ecx, [rsp+120]
14000c74exor eax, eax
14000c750rep stosb [rdi], al
14000c752mov rcx, rsi
14000c755call [rbp+940]
14000c75bjmp 0x14000ca2c
14000c760
14000c760loc_14000c760:
14000c760mov rcx, [rsp+88]
14000c765mov rdx, rsi
14000c768mov rdi, rsi
14000c76bcall PackageAddString
14000c770mov ecx, [rsp+120]
14000c774xor eax, eax
14000c776rep stosb [rdi], al
14000c778mov rcx, rsi
14000c77bcall [rbp+940]
14000c781jmp 0x14000cf5b
14000c786mov rcx, rdi
14000c789lea r13, [rsp+120]
14000c78elea r14, [rsp+112]
14000c793mov rdx, rsi
14000c796lea r9, [rip+0x19ef4]
14000c79dmov r8l, 2094
14000c7a3call printf
14000c7a8xor r9l, r9l
14000c7abxor r8l, r8l
14000c7aelea rdx, [rsp+116]
14000c7b3mov rcx, rbp
14000c7b6mov [rsp+120], r8
14000c7bbmov [rsp+104], r9l
14000c7c0mov [rsp+108], r9l
14000c7c5mov [rsp+112], r9l
14000c7camov [rsp+116], r9l
14000c7cfcall ParserGetWString
14000c7d4mov rcx, [rsp+88]
14000c7d9mov rdx, rax
14000c7dcmov r12, rax
14000c7dfcall PackageAddWString
14000c7e4xor r10l, r10l
14000c7e7mov rdi, [rip+0x1fb82]
14000c7eemov [rsp+116], r10l
14000c7f3
14000c7f3loc_14000c7f3:
14000c7f3lea rax, [rsp+108]
14000c7f8mov [rsp+48], r14
14000c7fdor r9l, -1
14000c801xor edx, edx
14000c803mov [rsp+40], rax
14000c808lea rax, [rsp+104]
14000c80dmov r8, r13
14000c810mov rcx, r12
14000c813mov [rsp+32], rax
14000c818call [rdi+1788]
14000c81emov ebp, eax
14000c820test eax, eax
14000c822je 0x14000c82b
14000c824cmp eax, 234
14000c829jne 0x14000c852
14000c82b
14000c82bloc_14000c82b:
14000c82bxor r15l, r15l
14000c82e
14000c82eloc_14000c82e:
14000c82emov rcx, [rsp+120]
14000c833cmp r15l, [rsp+104]
14000c838jae 0x14000c886
14000c83atest rcx, rcx
14000c83dje 0x14000c898
14000c83fmov rdx, [rcx+8*r15]
14000c843mov rcx, [rsp+88]
14000c848inc r15
14000c84bcall PackageAddWString
14000c850jmp 0x14000c82e
14000c852
14000c852loc_14000c852:
14000c852mov r12, [rdi+2230]
14000c859mov ecx, eax
14000c85bcall [rdi+348]
14000c861mov r8l, 2127
14000c867mov rdx, rsi
14000c86alea rcx, [rip+0x19e39]
14000c871mov [r12+104], eax
14000c876mov rax, [rdi+2230]
14000c87dmov r9l, [rax+104]
14000c881jmp 0x14000c9de
14000c886
14000c886loc_14000c886:
14000c886test rcx, rcx
14000c889je 0x14000c898
14000c88bcall [rdi+1836]
14000c891xor ecx, ecx
14000c893mov [rsp+120], rcx
14000c898
14000c898loc_14000c898:
14000c898cmp ebp, 234
14000c89eje 0x14000c7f3
14000c8a4jmp 0x14000ce27
14000c8a9mov rcx, rdi
14000c8aclea r14, [rsp+112]
14000c8b1lea r15, [rsp+108]
14000c8b6mov rdx, rsi
14000c8b9lea r9, [rip+0x19e19]
14000c8c0mov r8l, 2155
14000c8c6call printf
14000c8cbxor eax, eax
14000c8cdlea rdx, [rsp+116]
14000c8d2mov rcx, rbp
14000c8d5mov [rsp+120], rax
14000c8daxor eax, eax
14000c8dcmov [rsp+104], eax
14000c8e0mov [rsp+108], eax
14000c8e4mov [rsp+112], eax
14000c8e8mov [rsp+116], eax
14000c8eccall ParserGetWString
14000c8f1mov rcx, [rsp+88]
14000c8f6mov rdx, rax
14000c8f9mov r12, rax
14000c8fccall PackageAddWString
14000c901xor edx, edx
14000c903mov rdi, [rip+0x1fa66]
14000c90amov [rsp+116], edx
14000c90e
14000c90eloc_14000c90e:
14000c90elea rax, [rsp+104]
14000c913mov [rsp+64], r14
14000c918xor r8l, r8l
14000c91bxor edx, edx
14000c91dmov [rsp+48], rax
14000c922lea rax, [rsp+120]
14000c927mov r9l, 10
14000c92dmov rcx, r12
14000c930mov [rsp+56], r15
14000c935mov [rsp+40], -1
14000c93dmov [rsp+32], rax
14000c942call [rdi+1796]
14000c948mov ebp, eax
14000c94atest eax, eax
14000c94cje 0x14000c955
14000c94ecmp eax, 234
14000c953jne 0x14000c9c3
14000c955
14000c955loc_14000c955:
14000c955xor ebx, ebx
14000c957
14000c957loc_14000c957:
14000c957mov rcx, [rsp+120]
14000c95ccmp ebx, [rsp+104]
14000c960jae 0x14000ca09
14000c966test rcx, rcx
14000c969je 0x14000ca1b
14000c96fimul r13, rbx, 24
14000c973inc rbx
14000c976mov rdx, [rcx+r13+8]
14000c97bmov rcx, [rsp+88]
14000c980call PackageAddWString
14000c985mov rdx, [rsp+120]
14000c98amov rcx, [rsp+88]
14000c98fmov rdx, [rdx+r13+8]
14000c994call PackageAddWString
14000c999mov rdx, [rsp+120]
14000c99emov rcx, [rsp+88]
14000c9a3mov edx, [rdx+r13+16]
14000c9a8call PackageAddInt32
14000c9admov rdx, [rsp+120]
14000c9b2mov rcx, [rsp+88]
14000c9b7mov edx, [rdx+r13+20]
14000c9bccall PackageAddInt32
14000c9c1jmp 0x14000c957
14000c9c3
14000c9c3loc_14000c9c3:
14000c9c3mov rax, [rdi+2230]
14000c9camov r8l, 2189
14000c9d0mov rdx, rsi
14000c9d3lea rcx, [rip+0x19d1a]
14000c9damov r9l, [rax+104]
14000c9de
14000c9deloc_14000c9de:
14000c9decall printf
14000c9e3mov rax, [rdi+2230]
14000c9eamov ecx, 1
14000c9efmov edx, [rax+104]
14000c9f2call PackageTransmitError
14000c9f7mov rcx, [rsp+120]
14000c9fctest rcx, rcx
14000c9ffje 0x14000ca2c
14000ca01call [rdi+1836]
14000ca07jmp 0x14000ca2c
14000ca09
14000ca09loc_14000ca09:
14000ca09test rcx, rcx
14000ca0cje 0x14000ca1b
14000ca0ecall [rdi+1836]
14000ca14xor eax, eax
14000ca16mov [rsp+120], rax
14000ca1b
14000ca1bloc_14000ca1b:
14000ca1bcmp ebp, 234
14000ca21je 0x14000c90e
14000ca27jmp 0x14000ce27
14000ca2c
14000ca2cloc_14000ca2c:
14000ca2cmov rcx, [rsp+88]
14000ca31call PackageDestroy
14000ca36add rsp, 136
14000ca3dpop rbx
14000ca3epop rsi
14000ca3fpop rdi
14000ca40pop rbp
14000ca41pop r12
14000ca43pop r13
14000ca45pop r14
14000ca47pop r15
14000ca49ret
14000ca4alea r9, [rip+0x19cd0]
14000ca51mov r8l, 2217
14000ca57jmp 0x14000cf50
14000ca5clea r9, [rip+0x19cd9]
14000ca63mov r8l, 2224
14000ca69jmp 0x14000cf50
14000ca6elea r9, [rip+0x19ce0]
14000ca75mov r8l, 2230
14000ca7bmov rdx, rsi
14000ca7emov rcx, rdi
14000ca81call printf
14000ca86xor eax, eax
14000ca88lea rdx, [rsp+116]
14000ca8dmov rcx, rbp
14000ca90mov [rsp+120], rax
14000ca95xor eax, eax
14000ca97lea r14, [rip+0x19ccf]
14000ca9emov [rsp+104], eax
14000caa2mov [rsp+108], eax
14000caa6mov [rsp+112], eax
14000caaamov [rsp+116], eax
14000caaecall ParserGetWString
14000cab3mov rcx, [rsp+88]
14000cab8mov rdx, rax
14000cabbmov r12, rax
14000cabecall PackageAddWString
14000cac3mov r13, [rip+0x1f8a6]
14000caca
14000cacaloc_14000caca:
14000cacalea rax, [rsp+112]
14000cacfor r9l, -1
14000cad3lea r8, [rsp+120]
14000cad8mov rcx, r12
14000cadbmov [rsp+48], rax
14000cae0lea rax, [rsp+108]
14000cae5mov edx, 502
14000caeamov [rsp+40], rax
14000caeflea rax, [rsp+104]
14000caf4mov [rsp+32], rax
14000caf9call [r13+1828]
14000cb00mov ebp, eax
14000cb02test eax, eax
14000cb04je 0x14000cb11
14000cb06cmp eax, 234
14000cb0bjne 0x14000cbd1
14000cb11
14000cb11loc_14000cb11:
14000cb11xor r15l, r15l
14000cb14
14000cb14loc_14000cb14:
14000cb14mov rcx, [rsp+120]
14000cb19cmp r15l, [rsp+104]
14000cb1ejae 0x14000cbb1
14000cb24mov edi, r15l
14000cb27mov r8l, 2250
14000cb2dmov rdx, rsi
14000cb30inc r15l
14000cb33imul rdi, rdi, 72
14000cb37add rcx, rdi
14000cb3amov rax, [rcx+16]
14000cb3emov [rsp+48], rax
14000cb43mov eax, [rcx+24]
14000cb46mov [rsp+40], eax
14000cb4amov rax, [rcx+40]
14000cb4emov [rsp+32], rax
14000cb53mov r9, [rcx]
14000cb56mov rcx, r14
14000cb59call printf
14000cb5emov rax, [rsp+120]
14000cb63mov rcx, [rsp+88]
14000cb68mov rdx, [rax+rdi]
14000cb6ccall PackageAddWString
14000cb71mov rax, [rsp+120]
14000cb76mov rcx, [rsp+88]
14000cb7bmov rdx, [rax+rdi+40]
14000cb80call PackageAddWString
14000cb85mov rax, [rsp+120]
14000cb8amov rcx, [rsp+88]
14000cb8fmov rdx, [rax+rdi+16]
14000cb94call PackageAddWString
14000cb99mov rax, [rsp+120]
14000cb9emov rcx, [rsp+88]
14000cba3mov edx, [rax+rdi+24]
14000cba7call PackageAddInt32
14000cbacjmp 0x14000cb14
14000cbb1
14000cbb1loc_14000cbb1:
14000cbb1call [r13+1836]
14000cbb8xor r15l, r15l
14000cbbbmov [rsp+120], r15
14000cbc0cmp ebp, 234
14000cbc6je 0x14000caca
14000cbccjmp 0x14000cf5b
14000cbd1
14000cbd1loc_14000cbd1:
14000cbd1mov r9l, eax
14000cbd4mov r8l, 2262
14000cbdamov rdx, rsi
14000cbddlea rcx, [rip+0x19bb1]
14000cbe4call printf
14000cbe9jmp 0x14000cf5b
14000cbeelea r9, [rip+0x19bbc]
14000cbf5mov rdx, rsi
14000cbf8mov rcx, rdi
14000cbfbxor ebx, ebx
14000cbfdmov r8l, 2271
14000cc03xor r13l, r13l
14000cc06call printf
14000cc0bxor r11l, r11l
14000cc0emov rcx, rbp
14000cc11lea rdx, [rsp+116]
14000cc16mov [rsp+120], r11
14000cc1bmov [rsp+108], ebx
14000cc1fmov [rsp+112], ebx
14000cc23mov [rsp+116], ebx
14000cc27call ParserGetWString
14000cc2cmov rcx, [rsp+88]
14000cc31mov rbp, rax
14000cc34mov rdx, rax
14000cc37call PackageAddWString
14000cc3cmov r9, rbp
14000cc3fmov rdx, rsi
14000cc42mov r8l, 2283
14000cc48lea rcx, [rip+0x19b7f]
14000cc4fcall printf
14000cc54lea rax, [rsp+112]
14000cc59or r9l, -1
14000cc5dmov r12, [rip+0x1f70c]
14000cc64mov [rsp+40], rax
14000cc69lea rax, [rsp+108]
14000cc6elea r8, [rsp+120]
14000cc73mov rcx, rbp
14000cc76mov [rsp+48], r13
14000cc7bmov edx, 1
14000cc80mov [rsp+32], rax
14000cc85call [r12+1804]
14000cc8dtest eax, eax
14000cc8fje 0x14000cc9c
14000cc91cmp eax, 234
14000cc96jne 0x14000cf5b
14000cc9c
14000cc9cloc_14000cc9c:
14000cc9cmov rdx, rsi
14000cc9flea r9, [rip+0x19b4b]
14000cca6mov rcx, rdi
14000cca9xor esi, esi
14000ccabmov r8l, 2288
14000ccb1call printf
14000ccb6cmp [rsp+120], 0
14000ccbcje 0x14000cf5b
14000ccc2
14000ccc2loc_14000ccc2:
14000ccc2mov rcx, [rsp+120]
14000ccc7cmp esi, [rsp+108]
14000cccbjae 0x14000ccf9
14000cccdmov edi, esi
14000cccfinc esi
14000ccd1shl rdi, 4
14000ccd5mov rdx, [rcx+rdi]
14000ccd9mov rcx, [rsp+88]
14000ccdecall PackageAddWString
14000cce3mov rax, [rsp+120]
14000cce8mov rcx, [rsp+88]
14000ccedmov rdx, [rax+rdi+8]
14000ccf2call PackageAddWString
14000ccf7jmp 0x14000ccc2
14000ccf9
14000ccf9loc_14000ccf9:
14000ccf9call [r12+1836]
14000cd01jmp 0x14000cf5b
14000cd06mov rcx, rdi
14000cd09lea r9, [rip+0x19afe]
14000cd10mov r8l, 2307
14000cd16mov rdx, rsi
14000cd19call printf
14000cd1exor r9l, r9l
14000cd21xor r8l, r8l
14000cd24mov rcx, rbp
14000cd27lea rdx, [rsp+116]
14000cd2cmov [rsp+120], r8
14000cd31mov [rsp+108], r9l
14000cd36mov [rsp+112], r9l
14000cd3bmov [rsp+116], r9l
14000cd40call ParserGetWString
14000cd45mov rcx, [rsp+88]
14000cd4amov rdx, rax
14000cd4dmov rbp, rax
14000cd50call PackageAddWString
14000cd55lea rax, [rsp+112]
14000cd5axor r10l, r10l
14000cd5dmov rcx, rbp
14000cd60mov rdi, [rip+0x1f609]
14000cd67mov [rsp+40], rax
14000cd6clea rax, [rsp+108]
14000cd71or r9l, -1
14000cd75mov [rsp+48], r10
14000cd7alea r8, [rsp+120]
14000cd7fmov edx, 1
14000cd84mov [rsp+32], rax
14000cd89call [rdi+1812]
14000cd8ftest eax, eax
14000cd91je 0x14000cd9a
14000cd93cmp eax, 234
14000cd98jne 0x14000cdef
14000cd9a
14000cd9aloc_14000cd9a:
14000cd9axor esi, esi
14000cd9ccmp [rsp+120], 0
14000cda2jne 0x14000cdb8
14000cda4
14000cda4loc_14000cda4:
14000cda4mov rcx, [rsp+120]
14000cda9call [rdi+1836]
14000cdafxor ecx, ecx
14000cdb1mov [rsp+120], rcx
14000cdb6jmp 0x14000ce27
14000cdb8
14000cdb8loc_14000cdb8:
14000cdb8mov rax, [rsp+120]
14000cdbdcmp esi, [rsp+108]
14000cdc1jae 0x14000cda4
14000cdc3mov ebp, esi
14000cdc5mov rcx, [rsp+88]
14000cdcainc esi
14000cdccshl rbp, 4
14000cdd0mov rdx, [rax+rbp]
14000cdd4call PackageAddWString
14000cdd9mov rax, [rsp+120]
14000cddemov rcx, [rsp+88]
14000cde3mov rdx, [rax+rbp+8]
14000cde8call PackageAddWString
14000cdedjmp 0x14000cdb8
14000cdef
14000cdefloc_14000cdef:
14000cdefmov rdx, [rdi+2230]
14000cdf6lea rcx, [rip+0x19a29]
14000cdfdmov r8l, 2336
14000ce03mov r9l, [rdx+104]
14000ce07mov [rsp+32], eax
14000ce0bmov rdx, rsi
14000ce0ecall printf
14000ce13mov rax, [rdi+2230]
14000ce1amov ecx, 1
14000ce1fmov edx, [rax+104]
14000ce22call PackageTransmitError
14000ce27
14000ce27loc_14000ce27:
14000ce27mov rcx, [rsp+120]
14000ce2cjmp 0x14000cefc
14000ce31lea r9, [rip+0x19a1e]
14000ce38mov r8l, 2351
14000ce3emov rcx, rdi
14000ce41mov rdx, rsi
14000ce44call printf
14000ce49xor edx, edx
14000ce4bxor eax, eax
14000ce4dmov rcx, rbp
14000ce50mov [rsp+104], edx
14000ce54mov [rsp+108], edx
14000ce58mov [rsp+112], edx
14000ce5cmov [rsp+116], edx
14000ce60lea rdx, [rsp+116]
14000ce65mov [rsp+120], rax
14000ce6acall ParserGetWString
14000ce6fmov rcx, [rsp+88]
14000ce74mov rdx, rax
14000ce77mov rbp, rax
14000ce7acall PackageAddWString
14000ce7flea rax, [rsp+112]
14000ce84xor r8l, r8l
14000ce87xor edx, edx
14000ce89mov [rsp+56], rax
14000ce8emov rdi, [rip+0x1f4db]
14000ce95lea rax, [rsp+108]
14000ce9amov rcx, rbp
14000ce9dmov [rsp+48], rax
14000cea2lea rax, [rsp+104]
14000cea7lea r9, [rsp+120]
14000ceacmov [rsp+40], rax
14000ceb1mov [rsp+32], -1
14000ceb9call [rdi+1820]
14000cebftest eax, eax
14000cec1je 0x14000ceca
14000cec3cmp eax, 234
14000cec8jne 0x14000cf09
14000ceca
14000cecaloc_14000ceca:
14000cecaxor esi, esi
14000cecc
14000ceccloc_14000cecc:
14000ceccmov rcx, [rsp+120]
14000ced1cmp esi, [rsp+104]
14000ced5jae 0x14000cefc
14000ced7mov eax, esi
14000ced9mov rdx, [rcx+8*rax]
14000ceddtest rdx, rdx
14000cee0je 0x14000cef8
14000cee2mov rcx, [rsp+88]
14000cee7call PackageAddWString
14000ceecmov rcx, [rsp+88]
14000cef1xor edx, edx
14000cef3call PackageAddInt32
14000cef8
14000cef8loc_14000cef8:
14000cef8inc esi
14000cefajmp 0x14000cecc
14000cefc
14000cefcloc_14000cefc:
14000cefctest rcx, rcx
14000ceffje 0x14000cf5b
14000cf01call [rdi+1836]
14000cf07jmp 0x14000cf5b
14000cf09
14000cf09loc_14000cf09:
14000cf09mov rdx, [rdi+2230]
14000cf10mov r8l, 2384
14000cf16lea rcx, [rip+0x19909]
14000cf1dmov r9l, [rdx+104]
14000cf21mov [rsp+32], eax
14000cf25mov rdx, rsi
14000cf28call printf
14000cf2dmov rax, [rdi+2230]
14000cf34mov ecx, 1
14000cf39mov edx, [rax+104]
14000cf3ccall PackageTransmitError
14000cf41jmp 0x14000cf5b
14000cf43
14000cf43loc_14000cf43:
14000cf43lea r9, [rip+0x19923]
14000cf4amov r8l, 2393
14000cf50
14000cf50loc_14000cf50:
14000cf50mov rdx, rsi
14000cf53mov rcx, rdi
14000cf56call printf
14000cf5b
14000cf5bloc_14000cf5b:
14000cf5bmov rcx, [rsp+88]
14000cf60add rsp, 136
14000cf67pop rbx
14000cf68pop rsi
14000cf69pop rdi
14000cf6apop rbp
14000cf6bpop r12
14000cf6dpop r13
14000cf6fpop r14
14000cf71pop r15
14000cf73jmp 0x140018b90
14000c640
14000cf78
14000cf78 // align 0x10
14000cf78 // align 0x10
14000cf80
14000cf80CommandPivot:
14000cf80push rbp
14000cf81mov rbp, rsp
14000cf84push r14
14000cf86push r13
14000cf88mov r13, rcx
14000cf8bmov ecx, 2520
14000cf90push r12
14000cf92lea r12, [rip+0x1906f]
14000cf99push rdi
14000cf9apush rsi
14000cf9bpush rbx
14000cf9clea rbx, [rip+0x202fd]
14000cfa3and rsp, -16
14000cfa7sub rsp, 96
14000cfabcall PackageCreate
14000cfb0mov rcx, r13
14000cfb3mov rsi, rax
14000cfb6call ParserGetInt32
14000cfbbmov rcx, rsi
14000cfbemov edi, eax
14000cfc0mov edx, eax
14000cfc2call PackageAddInt32
14000cfc7mov r9l, edi
14000cfcamov rdx, rbx
14000cfcdmov r8l, 2408
14000cfd3lea rcx, [rip+0x1a06e]
14000cfdacall printf
14000cfdfcmp edi, 11
14000cfe2je 0x14000d1da
14000cfe8jg 0x14000cffd
14000cfeacmp edi, 1
14000cfedje 0x14000d00b
14000cfefcmp edi, 10
14000cff2je 0x14000d07a
14000cff8jmp 0x14000d28a
14000cffd
14000cffdloc_14000cffd:
14000cffdcmp edi, 12
14000d000je 0x14000d204
14000d006jmp 0x14000d28a
14000d00b
14000d00bloc_14000d00b:
14000d00blea r9, [rip+0x1a053]
14000d012mov r8l, 2414
14000d018mov rdx, rbx
14000d01bmov rcx, r12
14000d01ecall printf
14000d023mov rax, [rip+0x1f346]
14000d02alea r13, [rip+0x1a045]
14000d031mov rdi, [rax+2294]
14000d038
14000d038loc_14000d038:
14000d038test rdi, rdi
14000d03bje 0x14000d28a
14000d041mov rax, [rdi+8]
14000d045mov r8l, 2421
14000d04bmov rdx, rbx
14000d04emov rcx, r13
14000d051mov [rsp+32], rax
14000d056mov r9l, [rdi]
14000d059call printf
14000d05emov edx, [rdi]
14000d060mov rcx, rsi
14000d063call PackageAddInt32
14000d068mov rdx, [rdi+8]
14000d06cmov rcx, rsi
14000d06fcall PackageAddWString
14000d074mov rdi, [rdi+32]
14000d078jmp 0x14000d038
14000d07a
14000d07aloc_14000d07a:
14000d07alea r9, [rip+0x1a032]
14000d081mov r8l, 2436
14000d087mov rdx, rbx
14000d08amov rcx, r12
14000d08dcall printf
14000d092xor r8l, r8l
14000d095xor ecx, ecx
14000d097lea rdx, [rsp+88]
14000d09cmov [rsp+80], r8
14000d0a1mov [rsp+88], r8
14000d0a6mov [rsp+68], ecx
14000d0aamov rcx, r13
14000d0admov [rsp+72], r8
14000d0b2call ParserGetBytes
14000d0b7lea rdx, [rsp+72]
14000d0bclea rcx, [rsp+48]
14000d0c1mov [rsp+80], rax
14000d0c6movups x0, [rsp+80]
14000d0cblea r8, [rsp+68]
14000d0d0movups [rsp+48], x0
14000d0d5call PivotAdd
14000d0damov r13, [rip+0x1f28f]
14000d0e1test eax, eax
14000d0e3je 0x14000d1ac
14000d0e9mov eax, [rsp+68]
14000d0edmov r9, [rsp+72]
14000d0f2mov r8l, 2446
14000d0f8mov rdx, rbx
14000d0fblea rcx, [rip+0x19fc9]
14000d102mov [rsp+32], eax
14000d106call printf
14000d10bmov rcx, rsi
14000d10emov edx, 1
14000d113call PackageAddInt32
14000d118mov r8l, [rsp+68]
14000d11dmov rdx, [rsp+72]
14000d122mov rcx, rsi
14000d125call PackageAddBytes
14000d12amov ecx, [rsp+68]
14000d12emov rdi, [rsp+72]
14000d133xor eax, eax
14000d135rep stosb [rdi], al
14000d137mov rcx, [rsp+72]
14000d13ccall [r13+940]
14000d143xor edx, edx
14000d145mov r8l, 2458
14000d14bmov rcx, r12
14000d14emov [rsp+72], rdx
14000d153lea r9, [rip+0x19fa0]
14000d15amov rdx, rbx
14000d15dmov rdi, [r13+2294]
14000d164call printf
14000d169lea r13, [rip+0x19f9a]
14000d170
14000d170loc_14000d170:
14000d170test rdi, rdi
14000d173je 0x14000d18f
14000d175mov r9l, [rdi]
14000d178mov r8l, 2462
14000d17emov rdx, rbx
14000d181mov rcx, r13
14000d184call printf
14000d189mov rdi, [rdi+32]
14000d18djmp 0x14000d170
14000d18f
14000d18floc_14000d18f:
14000d18flea r9, [rip+0x19f88]
14000d196mov r8l, 2467
14000d19cmov rdx, rbx
14000d19fmov rcx, r12
14000d1a2call printf
14000d1a7jmp 0x14000d28a
14000d1ac
14000d1acloc_14000d1ac:
14000d1aclea r9, [rip+0x19f6d]
14000d1b3mov r8l, 2472
14000d1b9mov rdx, rbx
14000d1bcmov rcx, r12
14000d1bfcall printf
14000d1c4xor edx, edx
14000d1c6mov rcx, rsi
14000d1c9call PackageAddInt32
14000d1cemov rax, [r13+2230]
14000d1d5mov edx, [rax+104]
14000d1d8jmp 0x14000d1f7
14000d1da
14000d1daloc_14000d1da:
14000d1damov rcx, r13
14000d1ddcall ParserGetInt32
14000d1e2mov ecx, eax
14000d1e4mov edi, eax
14000d1e6call PivotRemove
14000d1ebmov rcx, rsi
14000d1eemov edx, eax
14000d1f0call PackageAddInt32
14000d1f5mov edx, edi
14000d1f7
14000d1f7loc_14000d1f7:
14000d1f7mov rcx, rsi
14000d1facall PackageAddInt32
14000d1ffjmp 0x14000d28a
14000d204
14000d204loc_14000d204:
14000d204lea r9, [rip+0x19f27]
14000d20bmov r8l, 2495
14000d211mov rdx, rbx
14000d214mov rcx, r12
14000d217call printf
14000d21cmov rcx, r13
14000d21fcall ParserGetInt32
14000d224mov r14, [rip+0x1f145]
14000d22blea rdx, [rsp+88]
14000d230mov rcx, r13
14000d233mov esi, eax
14000d235xor eax, eax
14000d237mov [rsp+80], rax
14000d23cmov rdi, [r14+2294]
14000d243mov [rsp+88], rax
14000d248call ParserGetBytes
14000d24dmov [rsp+80], rax
14000d252test rax, rax
14000d255je 0x14000d25e
14000d257cmp [rsp+88], 0
14000d25cjne 0x14000d283
14000d25e
14000d25eloc_14000d25e:
14000d25elea r9, [rip+0x19ee5]
14000d265mov r8l, 2505
14000d26bmov rdx, rbx
14000d26emov rcx, r12
14000d271call printf
14000d276jmp 0x14000d330
14000d27b
14000d27bloc_14000d27b:
14000d27bcmp [rdi], esi
14000d27dje 0x14000d2d2
14000d27fmov rdi, [rdi+32]
14000d283
14000d283loc_14000d283:
14000d283test rdi, rdi
14000d286jne 0x14000d27b
14000d288jmp 0x14000d2b8
14000d28a
14000d28aloc_14000d28a:
14000d28amov rcx, r12
14000d28dmov rdx, rbx
14000d290lea r9, [rip+0x19f26]
14000d297mov r8l, 2542
14000d29dcall printf
14000d2a2lea rsp, [rbp-48]
14000d2a6mov rcx, rsi
14000d2a9pop rbx
14000d2aapop rsi
14000d2abpop rdi
14000d2acpop r12
14000d2aepop r13
14000d2b0pop r14
14000d2b2pop rbp
14000d2b3jmp 0x140018b90
14000d2b8
14000d2b8loc_14000d2b8:
14000d2b8mov r9l, esi
14000d2bbmov r8l, 2531
14000d2c1mov rdx, rbx
14000d2c4lea rcx, [rip+0x19f02]
14000d2cbcall printf
14000d2d0jmp 0x14000d330
14000d2d2
14000d2d2loc_14000d2d2:
14000d2d2mov rcx, [rdi+24]
14000d2d6lea rdx, [rsp+80]
14000d2dbcall PipeWrite
14000d2e0test eax, eax
14000d2e2jne 0x14000d312
14000d2e4mov rdx, rbx
14000d2e7mov rcx, r12
14000d2ealea r9, [rip+0x19e78]
14000d2f1mov r8l, 2526
14000d2f7call printf
14000d2fcmov rax, [r14+2230]
14000d303mov ecx, 1
14000d308mov edx, [rax+104]
14000d30bcall PackageTransmitError
14000d310jmp 0x14000d330
14000d312
14000d312loc_14000d312:
14000d312mov [rsp+32], esi
14000d316mov r9l, [rsp+88]
14000d31bmov r8l, 2530
14000d321mov rdx, rbx
14000d324lea rcx, [rip+0x19e4f]
14000d32bcall printf
14000d330
14000d330loc_14000d330:
14000d330lea rsp, [rbp-48]
14000d334pop rbx
14000d335pop rsi
14000d336pop rdi
14000d337pop r12
14000d339pop r13
14000d33bpop r14
14000d33dpop rbp
14000d33eret
14000cf80
14000cf80CommandPivot:
14000cf80push rbp
14000cf81mov rbp, rsp
14000cf84push r14
14000cf86push r13
14000cf88mov r13, rcx
14000cf8bmov ecx, 2520
14000cf90push r12
14000cf92lea r12, [rip+0x1906f]
14000cf99push rdi
14000cf9apush rsi
14000cf9bpush rbx
14000cf9clea rbx, [rip+0x202fd]
14000cfa3and rsp, -16
14000cfa7sub rsp, 96
14000cfabcall PackageCreate
14000cfb0mov rcx, r13
14000cfb3mov rsi, rax
14000cfb6call ParserGetInt32
14000cfbbmov rcx, rsi
14000cfbemov edi, eax
14000cfc0mov edx, eax
14000cfc2call PackageAddInt32
14000cfc7mov r9l, edi
14000cfcamov rdx, rbx
14000cfcdmov r8l, 2408
14000cfd3lea rcx, [rip+0x1a06e]
14000cfdacall printf
14000cfdfcmp edi, 11
14000cfe2je 0x14000d1da
14000cfe8jg 0x14000cffd
14000cfeacmp edi, 1
14000cfedje 0x14000d00b
14000cfefcmp edi, 10
14000cff2je 0x14000d07a
14000cff8jmp 0x14000d28a
14000cffd
14000cffdloc_14000cffd:
14000cffdcmp edi, 12
14000d000je 0x14000d204
14000d006jmp 0x14000d28a
14000d00b
14000d00bloc_14000d00b:
14000d00blea r9, [rip+0x1a053]
14000d012mov r8l, 2414
14000d018mov rdx, rbx
14000d01bmov rcx, r12
14000d01ecall printf
14000d023mov rax, [rip+0x1f346]
14000d02alea r13, [rip+0x1a045]
14000d031mov rdi, [rax+2294]
14000d038
14000d038loc_14000d038:
14000d038test rdi, rdi
14000d03bje 0x14000d28a
14000d041mov rax, [rdi+8]
14000d045mov r8l, 2421
14000d04bmov rdx, rbx
14000d04emov rcx, r13
14000d051mov [rsp+32], rax
14000d056mov r9l, [rdi]
14000d059call printf
14000d05emov edx, [rdi]
14000d060mov rcx, rsi
14000d063call PackageAddInt32
14000d068mov rdx, [rdi+8]
14000d06cmov rcx, rsi
14000d06fcall PackageAddWString
14000d074mov rdi, [rdi+32]
14000d078jmp 0x14000d038
14000d07a
14000d07aloc_14000d07a:
14000d07alea r9, [rip+0x1a032]
14000d081mov r8l, 2436
14000d087mov rdx, rbx
14000d08amov rcx, r12
14000d08dcall printf
14000d092xor r8l, r8l
14000d095xor ecx, ecx
14000d097lea rdx, [rsp+88]
14000d09cmov [rsp+80], r8
14000d0a1mov [rsp+88], r8
14000d0a6mov [rsp+68], ecx
14000d0aamov rcx, r13
14000d0admov [rsp+72], r8
14000d0b2call ParserGetBytes
14000d0b7lea rdx, [rsp+72]
14000d0bclea rcx, [rsp+48]
14000d0c1mov [rsp+80], rax
14000d0c6movups x0, [rsp+80]
14000d0cblea r8, [rsp+68]
14000d0d0movups [rsp+48], x0
14000d0d5call PivotAdd
14000d0damov r13, [rip+0x1f28f]
14000d0e1test eax, eax
14000d0e3je 0x14000d1ac
14000d0e9mov eax, [rsp+68]
14000d0edmov r9, [rsp+72]
14000d0f2mov r8l, 2446
14000d0f8mov rdx, rbx
14000d0fblea rcx, [rip+0x19fc9]
14000d102mov [rsp+32], eax
14000d106call printf
14000d10bmov rcx, rsi
14000d10emov edx, 1
14000d113call PackageAddInt32
14000d118mov r8l, [rsp+68]
14000d11dmov rdx, [rsp+72]
14000d122mov rcx, rsi
14000d125call PackageAddBytes
14000d12amov ecx, [rsp+68]
14000d12emov rdi, [rsp+72]
14000d133xor eax, eax
14000d135rep stosb [rdi], al
14000d137mov rcx, [rsp+72]
14000d13ccall [r13+940]
14000d143xor edx, edx
14000d145mov r8l, 2458
14000d14bmov rcx, r12
14000d14emov [rsp+72], rdx
14000d153lea r9, [rip+0x19fa0]
14000d15amov rdx, rbx
14000d15dmov rdi, [r13+2294]
14000d164call printf
14000d169lea r13, [rip+0x19f9a]
14000d170
14000d170loc_14000d170:
14000d170test rdi, rdi
14000d173je 0x14000d18f
14000d175mov r9l, [rdi]
14000d178mov r8l, 2462
14000d17emov rdx, rbx
14000d181mov rcx, r13
14000d184call printf
14000d189mov rdi, [rdi+32]
14000d18djmp 0x14000d170
14000d18f
14000d18floc_14000d18f:
14000d18flea r9, [rip+0x19f88]
14000d196mov r8l, 2467
14000d19cmov rdx, rbx
14000d19fmov rcx, r12
14000d1a2call printf
14000d1a7jmp 0x14000d28a
14000d1ac
14000d1acloc_14000d1ac:
14000d1aclea r9, [rip+0x19f6d]
14000d1b3mov r8l, 2472
14000d1b9mov rdx, rbx
14000d1bcmov rcx, r12
14000d1bfcall printf
14000d1c4xor edx, edx
14000d1c6mov rcx, rsi
14000d1c9call PackageAddInt32
14000d1cemov rax, [r13+2230]
14000d1d5mov edx, [rax+104]
14000d1d8jmp 0x14000d1f7
14000d1da
14000d1daloc_14000d1da:
14000d1damov rcx, r13
14000d1ddcall ParserGetInt32
14000d1e2mov ecx, eax
14000d1e4mov edi, eax
14000d1e6call PivotRemove
14000d1ebmov rcx, rsi
14000d1eemov edx, eax
14000d1f0call PackageAddInt32
14000d1f5mov edx, edi
14000d1f7
14000d1f7loc_14000d1f7:
14000d1f7mov rcx, rsi
14000d1facall PackageAddInt32
14000d1ffjmp 0x14000d28a
14000d204
14000d204loc_14000d204:
14000d204lea r9, [rip+0x19f27]
14000d20bmov r8l, 2495
14000d211mov rdx, rbx
14000d214mov rcx, r12
14000d217call printf
14000d21cmov rcx, r13
14000d21fcall ParserGetInt32
14000d224mov r14, [rip+0x1f145]
14000d22blea rdx, [rsp+88]
14000d230mov rcx, r13
14000d233mov esi, eax
14000d235xor eax, eax
14000d237mov [rsp+80], rax
14000d23cmov rdi, [r14+2294]
14000d243mov [rsp+88], rax
14000d248call ParserGetBytes
14000d24dmov [rsp+80], rax
14000d252test rax, rax
14000d255je 0x14000d25e
14000d257cmp [rsp+88], 0
14000d25cjne 0x14000d283
14000d25e
14000d25eloc_14000d25e:
14000d25elea r9, [rip+0x19ee5]
14000d265mov r8l, 2505
14000d26bmov rdx, rbx
14000d26emov rcx, r12
14000d271call printf
14000d276jmp 0x14000d330
14000d27b
14000d27bloc_14000d27b:
14000d27bcmp [rdi], esi
14000d27dje 0x14000d2d2
14000d27fmov rdi, [rdi+32]
14000d283
14000d283loc_14000d283:
14000d283test rdi, rdi
14000d286jne 0x14000d27b
14000d288jmp 0x14000d2b8
14000d28a
14000d28aloc_14000d28a:
14000d28amov rcx, r12
14000d28dmov rdx, rbx
14000d290lea r9, [rip+0x19f26]
14000d297mov r8l, 2542
14000d29dcall printf
14000d2a2lea rsp, [rbp-48]
14000d2a6mov rcx, rsi
14000d2a9pop rbx
14000d2aapop rsi
14000d2abpop rdi
14000d2acpop r12
14000d2aepop r13
14000d2b0pop r14
14000d2b2pop rbp
14000d2b3jmp 0x140018b90
14000d2b8
14000d2b8loc_14000d2b8:
14000d2b8mov r9l, esi
14000d2bbmov r8l, 2531
14000d2c1mov rdx, rbx
14000d2c4lea rcx, [rip+0x19f02]
14000d2cbcall printf
14000d2d0jmp 0x14000d330
14000d2d2
14000d2d2loc_14000d2d2:
14000d2d2mov rcx, [rdi+24]
14000d2d6lea rdx, [rsp+80]
14000d2dbcall PipeWrite
14000d2e0test eax, eax
14000d2e2jne 0x14000d312
14000d2e4mov rdx, rbx
14000d2e7mov rcx, r12
14000d2ealea r9, [rip+0x19e78]
14000d2f1mov r8l, 2526
14000d2f7call printf
14000d2fcmov rax, [r14+2230]
14000d303mov ecx, 1
14000d308mov edx, [rax+104]
14000d30bcall PackageTransmitError
14000d310jmp 0x14000d330
14000d312
14000d312loc_14000d312:
14000d312mov [rsp+32], esi
14000d316mov r9l, [rsp+88]
14000d31bmov r8l, 2530
14000d321mov rdx, rbx
14000d324lea rcx, [rip+0x19e4f]
14000d32bcall printf
14000d330
14000d330loc_14000d330:
14000d330lea rsp, [rbp-48]
14000d334pop rbx
14000d335pop rsi
14000d336pop rdi
14000d337pop r12
14000d339pop r13
14000d33bpop r14
14000d33dpop rbp
14000d33eret
14000cf80
14000d33f
14000d33f // align 0x10
14000d33f // align 0x10
14000d340
14000d340CommandProc:
14000d340push rbp
14000d341mov rbp, rsp
14000d344push r15
14000d346push r14
14000d348push r13
14000d34apush r12
14000d34cpush rdi
14000d34dpush rsi
14000d34epush rbx
14000d34fmov rbx, rcx
14000d352and rsp, -16
14000d356sub rsp, 1168
14000d35dcall ParserGetInt32
14000d362mov ecx, 4112
14000d367mov esi, eax
14000d369call PackageCreate
14000d36emovsx edx, si
14000d371sub esi, 2
14000d374mov rcx, rax
14000d377mov [rsp+72], rax
14000d37ccall PackageAddInt32
14000d381cmp si, 5
14000d385ja 0x14000dc9b
14000d38blea rdx, [rip+0x1908e]
14000d392movzx esi, si
14000d395movsxd rax, [rdx+4*rsi]
14000d399add rax, rdx
14000d39cjmp rax
14000d39elea rcx, [rip+0x18c63]
14000d3a5lea r9, [rip+0x18ee0]
14000d3acmov r8l, 278
14000d3b2lea rdx, [rip+0x1f847]
14000d3b9lea rdi, [rsp+112]
14000d3becall printf
14000d3c3mov esi, [rbx+20]
14000d3c6mov ecx, 12
14000d3cbxor eax, eax
14000d3cdrep stosd [rdi], eax
14000d3cftest esi, esi
14000d3d1je 0x14000d411
14000d3d3mov rcx, rbx
14000d3d6call ParserGetInt32
14000d3dbmov edx, 0x1fffff
14000d3e0mov ecx, eax
14000d3e2mov esi, eax
14000d3e4call ProcessOpen
14000d3e9mov rbx, rax
14000d3ectest rax, rax
14000d3efje 0x14000d415
14000d3f1mov rax, [rip+0x1ef78]
14000d3f8mov ecx, 1
14000d3fdmov rax, [rax+2230]
14000d404mov edx, [rax+104]
14000d407call PackageTransmitError
14000d40cjmp 0x14000dc9b
14000d411
14000d411loc_14000d411:
14000d411or rbx, -1
14000d415
14000d415loc_14000d415:
14000d415xor ecx, ecx
14000d417xor edx, edx
14000d419lea r8, [rsp+112]
14000d41emov r9l, 48
14000d424mov [rsp+32], rcx
14000d429mov rcx, rbx
14000d42ccall SysNtQueryInformationProcess
14000d431test eax, eax
14000d433js 0x14000d5c6
14000d439xor eax, eax
14000d43bmov ecx, 56
14000d440lea r14, [rsp+104]
14000d445xor edx, edx
14000d447mov [rsp+88], rax
14000d44clea rdi, [rsp+160]
14000d454lea r15, [rsp+160]
14000d45cmov [rsp+96], rax
14000d461lea r13, [rsp+648]
14000d469mov [rsp+104], rax
14000d46exor eax, eax
14000d470rep stosd [rdi], eax
14000d472lea rdi, [rsp+648]
14000d47amov ecx, 130
14000d47fmov [rsp+384], rdx
14000d487rep stosd [rdi], eax
14000d489lea rdi, [rsp+400]
14000d491mov ecx, 61
14000d496mov [rsp+392], rdx
14000d49erep stosd [rdi], eax
14000d4a0mov rcx, [rsp+72]
14000d4a5mov edx, esi
14000d4a7call PackageAddInt32
14000d4acmov rax, [rsp+120]
14000d4b1mov [rsp+32], r14
14000d4b6mov rcx, rbx
14000d4b9mov r9l, 8
14000d4bflea r8, [rsp+88]
14000d4c4lea rdx, [rax+24]
14000d4c8call SysNtReadVirtualMemory
14000d4cdtest eax, eax
14000d4cfjs 0x14000d5c6
14000d4d5mov rax, [rsp+88]
14000d4damov r9l, 8
14000d4e0lea r8, [rsp+96]
14000d4e5mov rcx, rbx
14000d4e8lea r12, [rax+32]
14000d4ecxor eax, eax
14000d4eemov [rsp+104], rax
14000d4f3mov rdx, r12
14000d4f6mov [rsp+32], rax
14000d4fbcall SysNtReadVirtualMemory
14000d500test eax, eax
14000d502js 0x14000d5c6
14000d508
14000d508loc_14000d508:
14000d508mov rdx, [rsp+96]
14000d50dcmp rdx, r12
14000d510je 0x14000d5c6
14000d516xor eax, eax
14000d518sub rdx, 16
14000d51cmov r9l, 224
14000d522mov r8, r15
14000d525mov [rsp+32], rax
14000d52amov rcx, rbx
14000d52dcall SysNtReadVirtualMemory
14000d532test eax, eax
14000d534js 0x14000d508
14000d536mov [rsp+32], r14
14000d53bmov rdx, [rsp+240]
14000d543mov r8, r13
14000d546mov rcx, rbx
14000d549movzx r9l, [rsp+232]
14000d552lea rsi, [rsp+384]
14000d55acall SysNtReadVirtualMemory
14000d55fmovzx r8l, [rsp+232]
14000d568test r8w, r8w
14000d56cje 0x14000d59d
14000d56emov rdx, r13
14000d571mov rcx, rsi
14000d574call WCharStringToCharString
14000d579mov rcx, [rsp+72]
14000d57emov rdx, rsi
14000d581mov [rsp+104], rax
14000d586call PackageAddString
14000d58bmov rdx, [rsp+208]
14000d593mov rcx, [rsp+72]
14000d598call PackageAddPtr
14000d59d
14000d59dloc_14000d59d:
14000d59dmov edx, 260
14000d5a2xor eax, eax
14000d5a4mov rdi, r13
14000d5a7mov rcx, rdx
14000d5aarep stosb [rdi], al
14000d5acmov rdi, rsi
14000d5afmov rcx, rdx
14000d5b2rep stosb [rdi], al
14000d5b4mov rax, [rsp+176]
14000d5bcmov [rsp+96], rax
14000d5c1jmp 0x14000d508
14000d5c6
14000d5c6loc_14000d5c6:
14000d5c6or rcx, -1
14000d5catest rbx, rbx
14000d5cdjne 0x14000dc96
14000d5d3jmp 0x14000dc9b
14000d5d8lea r12, [rip+0x1f621]
14000d5dfxor edi, edi
14000d5e1xor esi, esi
14000d5e3xor r13l, r13l
14000d5e6lea r9, [rip+0x18cad]
14000d5edmov r8l, 343
14000d5f3mov rdx, r12
14000d5f6lea rcx, [rip+0x18a0b]
14000d5fdcall printf
14000d602xor eax, eax
14000d604mov ecx, 61
14000d609xor r11l, r11l
14000d60cmov [rsp+648], rdi
14000d614lea rdx, [rsp+96]
14000d619mov [rsp+656], rdi
14000d621lea rdi, [rsp+664]
14000d629rep stosd [rdi], eax
14000d62bmov [rsp+104], r11
14000d630mov rcx, rbx
14000d633mov [rsp+112], r11
14000d638mov [rsp+96], esi
14000d63cmov [rsp+384], r13
14000d644mov [rsp+392], r13
14000d64ccall ParserGetString
14000d651lea rcx, [rsp+104]
14000d656lea rdx, [rsp+112]
14000d65bmov rsi, rax
14000d65ecall ProcessSnapShot
14000d663mov ecx, eax
14000d665test eax, eax
14000d667js 0x14000d853
14000d66dmov r9, [rsp+104]
14000d672mov rdx, r12
14000d675mov r8l, 360
14000d67blea rcx, [rip+0x18c23]
14000d682lea r12, [rsp+648]
14000d68alea r14, [rsp+160]
14000d692call printf
14000d697mov rbx, [rsp+104]
14000d69cmov r13, [rip+0x1eccd]
14000d6a3
14000d6a3loc_14000d6a3:
14000d6a3mov rax, [rsp+104]
14000d6a8mov rcx, r12
14000d6abmov rdx, [rax+64]
14000d6afmovzx r8l, [rax+56]
14000d6b4call WCharStringToCharString
14000d6b9mov r8l, [rsp+96]
14000d6bemov rdx, rsi
14000d6c1mov rcx, r12
14000d6c4call MemCompare
14000d6c9test eax, eax
14000d6cbjne 0x14000d800
14000d6d1xor r10l, r10l
14000d6d4mov rax, [rsp+104]
14000d6d9cmp [r13+92], 2
14000d6desbb edx, edx
14000d6e0mov [rsp+160], r10
14000d6e8and edx, -3072
14000d6eemov ecx, [rax+80]
14000d6f1add edx, 4096
14000d6f7call ProcessOpen
14000d6fcmov rdi, rax
14000d6fftest rax, rax
14000d702je 0x14000d6a3
14000d704mov r8, r14
14000d707mov edx, 8
14000d70cmov rcx, rax
14000d70fcall SysNtOpenProcessToken
14000d714test eax, eax
14000d716js 0x14000d730
14000d718mov rcx, [rsp+160]
14000d720lea rdx, [rsp+384]
14000d728xor r8l, r8l
14000d72bcall TokenQueryOwner
14000d730
14000d730loc_14000d730:
14000d730mov rcx, [rsp+72]
14000d735mov rdx, r12
14000d738call PackageAddString
14000d73dmov rax, [rsp+104]
14000d742mov rcx, [rsp+72]
14000d747mov edx, [rax+80]
14000d74acall PackageAddInt32
14000d74fmov rax, [rsp+104]
14000d754mov rcx, [rsp+72]
14000d759mov edx, [rax+88]
14000d75ccall PackageAddInt32
14000d761mov r8l, [rsp+392]
14000d769mov rcx, [rsp+72]
14000d76emov rdx, [rsp+384]
14000d776call PackageAddBytes
14000d77bmov rcx, rdi
14000d77ecall ProcessIsWow
14000d783mov rcx, [rsp+72]
14000d788cmp eax, 1
14000d78bsbb edx, edx
14000d78dand edx, -22
14000d790add edx, 86
14000d793call PackageAddInt32
14000d798mov rcx, rdi
14000d79bcall SysNtClose
14000d7a0mov rcx, [rsp+160]
14000d7a8test rcx, rcx
14000d7abje 0x14000d7bd
14000d7adcall SysNtClose
14000d7b2xor r9l, r9l
14000d7b5mov [rsp+160], r9
14000d7bd
14000d7bdloc_14000d7bd:
14000d7bdmov rdi, [rsp+384]
14000d7c5test rdi, rdi
14000d7c8je 0x14000d800
14000d7camov ecx, [rsp+392]
14000d7d1xor eax, eax
14000d7d3rep stosb [rdi], al
14000d7d5mov rax, [r13+2230]
14000d7dcmov r8, [rsp+384]
14000d7e4xor edx, edx
14000d7e6mov rax, [rax+96]
14000d7eamov rcx, [rax+48]
14000d7eecall [r13+332]
14000d7f5xor r8l, r8l
14000d7f8mov [rsp+384], r8
14000d800
14000d800loc_14000d800:
14000d800mov rax, [rsp+104]
14000d805mov edx, [rax]
14000d807test edx, edx
14000d809je 0x14000d818
14000d80badd rax, rdx
14000d80emov [rsp+104], rax
14000d813jmp 0x14000d6a3
14000d818
14000d818loc_14000d818:
14000d818test rbx, rbx
14000d81bje 0x14000dc9b
14000d821mov rcx, [rsp+112]
14000d826mov rdi, rbx
14000d829xor eax, eax
14000d82brep stosb [rdi], al
14000d82dmov rax, [rip+0x1eb3c]
14000d834mov r8, rbx
14000d837mov rdx, [rax+2230]
14000d83emov rdx, [rdx+96]
14000d842mov rcx, [rdx+48]
14000d846xor edx, edx
14000d848call [rax+332]
14000d84ejmp 0x14000dc9b
14000d853
14000d853loc_14000d853:
14000d853mov rax, [rip+0x1eb16]
14000d85amov rbx, [rax+2230]
14000d861call [rax+348]
14000d867mov [rbx+104], eax
14000d86ajmp 0x14000dc9b
14000d86flea r9, [rip+0x18a53]
14000d876mov r8l, 431
14000d87clea rdx, [rip+0x1f37d]
14000d883mov r15l, 6
14000d889lea rcx, [rip+0x18778]
14000d890lea rdi, [rsp+648]
14000d898call printf
14000d89dxor eax, eax
14000d89fmov rcx, r15
14000d8a2xor edx, edx
14000d8a4rep stosd [rdi], eax
14000d8a6mov [rsp+160], edx
14000d8adlea rsi, [rip+0x189cd]
14000d8b4mov [rsp+384], edx
14000d8bbmov r15, rcx
14000d8bemov rcx, rbx
14000d8c1call ParserGetInt32
14000d8c6mov rcx, rbx
14000d8c9lea rdx, [rsp+160]
14000d8d1mov r14l, eax
14000d8d4call ParserGetWString
14000d8d9lea rdx, [rsp+384]
14000d8e1mov rcx, rbx
14000d8e4mov r13, rax
14000d8e7call ParserGetWString
14000d8ecmov rcx, rbx
14000d8efmov rdi, rax
14000d8f2call ParserGetInt32
14000d8f7mov rcx, rbx
14000d8famov r12l, eax
14000d8fdcall ParserGetInt32
14000d902cmp [rsp+160], 0
14000d90amov r9l, r14l
14000d90dmov r8l, 449
14000d913cmove r13, r15
14000d917lea rdx, [rip+0x1f2e2]
14000d91ecmp [rsp+384], 0
14000d926mov ebx, eax
14000d928lea rcx, [rip+0x189a7]
14000d92fcmove rdi, r15
14000d933call printf
14000d938mov eax, [rsp+160]
14000d93fmov r9, r13
14000d942mov r8l, 450
14000d948lea rdx, [rip+0x1f2b1]
14000d94flea rcx, [rip+0x189a6]
14000d956mov [rsp+32], eax
14000d95alea r15, [rip+0x18925]
14000d961call printf
14000d966mov eax, [rsp+384]
14000d96dmov r9, rdi
14000d970mov r8l, 451
14000d976lea rdx, [rip+0x1f283]
14000d97dlea rcx, [rip+0x189a4]
14000d984mov [rsp+32], eax
14000d988call printf
14000d98dtest r12l, r12l
14000d990mov r9, r15
14000d993mov [rsp+32], r12l
14000d998cmovne r9, rsi
14000d99cmov r8l, 452
14000d9a2lea rdx, [rip+0x1f257]
14000d9a9lea rcx, [rip+0x189a4]
14000d9b0call printf
14000d9b5test ebx, ebx
14000d9b7mov [rsp+32], ebx
14000d9bbmov r8l, 453
14000d9c1cmovne r15, rsi
14000d9c5lea rdx, [rip+0x1f234]
14000d9cclea rcx, [rip+0x189ac]
14000d9d3mov r9, r15
14000d9d6call printf
14000d9dbxor ecx, ecx
14000d9ddmov [rsp+40], r12l
14000d9e2mov r8, rdi
14000d9e5lea rax, [rsp+648]
14000d9edmov [rsp+48], rcx
14000d9f2mov r9l, r14l
14000d9f5mov rdx, r13
14000d9f8mov [rsp+32], rax
14000d9fdmov ecx, 1
14000da02call ProcessCreate
14000da07mov rcx, [rsp+72]
14000da0cmov rdx, r13
14000da0fmov edi, eax
14000da11call PackageAddWString
14000da16xor edx, edx
14000da18test edi, edi
14000da1aje 0x14000da23
14000da1cmov edx, [rsp+664]
14000da23
14000da23loc_14000da23:
14000da23mov rcx, [rsp+72]
14000da28call PackageAddInt32
14000da2dmov rcx, [rsp+72]
14000da32mov edx, edi
14000da34call PackageAddInt32
14000da39mov rcx, [rsp+72]
14000da3emov edx, r12l
14000da41call PackageAddInt32
14000da46mov rcx, [rsp+72]
14000da4bmov edx, ebx
14000da4dcall PackageAddInt32
14000da52test edi, edi
14000da54je 0x14000dc9b
14000da5amov rcx, [rsp+656]
14000da62call SysNtClose
14000da67test r12l, r12l
14000da6ajne 0x14000da79
14000da6cmov rcx, [rsp+648]
14000da74call SysNtClose
14000da79
14000da79loc_14000da79:
14000da79mov r9l, [rsp+664]
14000da81mov r8l, 470
14000da87lea rdx, [rip+0x1f172]
14000da8elea rcx, [rip+0x18915]
14000da95call printf
14000da9ajmp 0x14000dc9b
14000da9flea r13, [rip+0x1f15a]
14000daa6lea r9, [rip+0x1892d]
14000daadmov r8l, 476
14000dab3mov rdx, r13
14000dab6lea rcx, [rip+0x1854b]
14000dabdlea rdi, [rsp+648]
14000dac5call printf
14000dacamov rcx, rbx
14000dacdlea r14, [rsp+648]
14000dad5call ParserGetInt32
14000dadamov rcx, rbx
14000daddmov r12l, eax
14000dae0call ParserGetInt32
14000dae5mov ecx, 12
14000daeamov edx, 0x1fffff
14000daefmov ebx, eax
14000daf1xor eax, eax
14000daf3rep stosd [rdi], eax
14000daf5xor eax, eax
14000daf7mov ecx, r12l
14000dafamov [rsp+384], rax
14000db02call ProcessOpen
14000db07test rax, rax
14000db0amov rsi, rax
14000db0dje 0x14000dc9b
14000db13mov rcx, [rsp+72]
14000db18mov edx, r12l
14000db1bxor edi, edi
14000db1dlea r12, [rsp+384]
14000db25call PackageAddInt32
14000db2amov rcx, [rsp+72]
14000db2fmov edx, ebx
14000db31call PackageAddInt32
14000db36
14000db36loc_14000db36:
14000db36mov [rsp+40], r12
14000db3bxor r8l, r8l
14000db3emov r9, r14
14000db41mov rdx, rdi
14000db44mov [rsp+32], 48
14000db4dmov rcx, rsi
14000db50call SysNtQueryVirtualMemory
14000db55test eax, eax
14000db57js 0x14000dc08
14000db5dmov rdx, [rsp+648]
14000db65mov rdi, [rsp+672]
14000db6dadd rdi, rdx
14000db70cmp [rsp+688], 0x10000
14000db7bje 0x14000db36
14000db7dcmp [rsp+656], 0
14000db86je 0x14000db36
14000db88test ebx, ebx
14000db8aje 0x14000dbb5
14000db8ccmp [rsp+664], ebx
14000db93jne 0x14000db36
14000db95mov rdx, r13
14000db98mov r9l, ebx
14000db9bmov r8l, 512
14000dba1lea rcx, [rip+0x1883f]
14000dba8call printf
14000dbadmov rdx, [rsp+648]
14000dbb5
14000dbb5loc_14000dbb5:
14000dbb5mov rcx, [rsp+72]
14000dbbacall PackageAddPtr
14000dbbfmov edx, [rsp+672]
14000dbc6mov rcx, [rsp+72]
14000dbcbcall PackageAddInt32
14000dbd0mov edx, [rsp+664]
14000dbd7mov rcx, [rsp+72]
14000dbdccall PackageAddInt32
14000dbe1mov edx, [rsp+680]
14000dbe8mov rcx, [rsp+72]
14000dbedcall PackageAddInt32
14000dbf2mov edx, [rsp+688]
14000dbf9mov rcx, [rsp+72]
14000dbfecall PackageAddInt32
14000dc03jmp 0x14000db36
14000dc08
14000dc08loc_14000dc08:
14000dc08mov rcx, rsi
14000dc0bjmp 0x14000dc96
14000dc10lea r9, [rip+0x187fe]
14000dc17mov r8l, 536
14000dc1dlea rdx, [rip+0x1efdc]
14000dc24lea rcx, [rip+0x183dd]
14000dc2bcall printf
14000dc30mov rcx, rbx
14000dc33call ParserGetInt32
14000dc38mov edx, 1
14000dc3dmov ecx, eax
14000dc3fmov esi, eax
14000dc41call ProcessOpen
14000dc46xor edx, edx
14000dc48mov rbx, rax
14000dc4btest rax, rax
14000dc4ejne 0x14000dc68
14000dc50mov rcx, [rsp+72]
14000dc55call PackageAddInt32
14000dc5amov rcx, [rsp+72]
14000dc5fmov edx, esi
14000dc61call PackageAddInt32
14000dc66jmp 0x14000dc9b
14000dc68
14000dc68loc_14000dc68:
14000dc68mov rcx, rax
14000dc6bmov rax, [rip+0x1e6fe]
14000dc72call [rax+980]
14000dc78mov rcx, [rsp+72]
14000dc7dmov edx, 1
14000dc82call PackageAddInt32
14000dc87mov rcx, [rsp+72]
14000dc8cmov edx, esi
14000dc8ecall PackageAddInt32
14000dc93mov rcx, rbx
14000dc96
14000dc96loc_14000dc96:
14000dc96call SysNtClose
14000dc9b
14000dc9bloc_14000dc9b:
14000dc9bmov rcx, [rsp+72]
14000dca0lea rsp, [rbp-56]
14000dca4pop rbx
14000dca5pop rsi
14000dca6pop rdi
14000dca7pop r12
14000dca9pop r13
14000dcabpop r14
14000dcadpop r15
14000dcafpop rbp
14000dcb0jmp 0x140018b90
14000d340
14000d340CommandProc:
14000d340push rbp
14000d341mov rbp, rsp
14000d344push r15
14000d346push r14
14000d348push r13
14000d34apush r12
14000d34cpush rdi
14000d34dpush rsi
14000d34epush rbx
14000d34fmov rbx, rcx
14000d352and rsp, -16
14000d356sub rsp, 1168
14000d35dcall ParserGetInt32
14000d362mov ecx, 4112
14000d367mov esi, eax
14000d369call PackageCreate
14000d36emovsx edx, si
14000d371sub esi, 2
14000d374mov rcx, rax
14000d377mov [rsp+72], rax
14000d37ccall PackageAddInt32
14000d381cmp si, 5
14000d385ja 0x14000dc9b
14000d38blea rdx, [rip+0x1908e]
14000d392movzx esi, si
14000d395movsxd rax, [rdx+4*rsi]
14000d399add rax, rdx
14000d39cjmp rax
14000d39elea rcx, [rip+0x18c63]
14000d3a5lea r9, [rip+0x18ee0]
14000d3acmov r8l, 278
14000d3b2lea rdx, [rip+0x1f847]
14000d3b9lea rdi, [rsp+112]
14000d3becall printf
14000d3c3mov esi, [rbx+20]
14000d3c6mov ecx, 12
14000d3cbxor eax, eax
14000d3cdrep stosd [rdi], eax
14000d3cftest esi, esi
14000d3d1je 0x14000d411
14000d3d3mov rcx, rbx
14000d3d6call ParserGetInt32
14000d3dbmov edx, 0x1fffff
14000d3e0mov ecx, eax
14000d3e2mov esi, eax
14000d3e4call ProcessOpen
14000d3e9mov rbx, rax
14000d3ectest rax, rax
14000d3efje 0x14000d415
14000d3f1mov rax, [rip+0x1ef78]
14000d3f8mov ecx, 1
14000d3fdmov rax, [rax+2230]
14000d404mov edx, [rax+104]
14000d407call PackageTransmitError
14000d40cjmp 0x14000dc9b
14000d411
14000d411loc_14000d411:
14000d411or rbx, -1
14000d415
14000d415loc_14000d415:
14000d415xor ecx, ecx
14000d417xor edx, edx
14000d419lea r8, [rsp+112]
14000d41emov r9l, 48
14000d424mov [rsp+32], rcx
14000d429mov rcx, rbx
14000d42ccall SysNtQueryInformationProcess
14000d431test eax, eax
14000d433js 0x14000d5c6
14000d439xor eax, eax
14000d43bmov ecx, 56
14000d440lea r14, [rsp+104]
14000d445xor edx, edx
14000d447mov [rsp+88], rax
14000d44clea rdi, [rsp+160]
14000d454lea r15, [rsp+160]
14000d45cmov [rsp+96], rax
14000d461lea r13, [rsp+648]
14000d469mov [rsp+104], rax
14000d46exor eax, eax
14000d470rep stosd [rdi], eax
14000d472lea rdi, [rsp+648]
14000d47amov ecx, 130
14000d47fmov [rsp+384], rdx
14000d487rep stosd [rdi], eax
14000d489lea rdi, [rsp+400]
14000d491mov ecx, 61
14000d496mov [rsp+392], rdx
14000d49erep stosd [rdi], eax
14000d4a0mov rcx, [rsp+72]
14000d4a5mov edx, esi
14000d4a7call PackageAddInt32
14000d4acmov rax, [rsp+120]
14000d4b1mov [rsp+32], r14
14000d4b6mov rcx, rbx
14000d4b9mov r9l, 8
14000d4bflea r8, [rsp+88]
14000d4c4lea rdx, [rax+24]
14000d4c8call SysNtReadVirtualMemory
14000d4cdtest eax, eax
14000d4cfjs 0x14000d5c6
14000d4d5mov rax, [rsp+88]
14000d4damov r9l, 8
14000d4e0lea r8, [rsp+96]
14000d4e5mov rcx, rbx
14000d4e8lea r12, [rax+32]
14000d4ecxor eax, eax
14000d4eemov [rsp+104], rax
14000d4f3mov rdx, r12
14000d4f6mov [rsp+32], rax
14000d4fbcall SysNtReadVirtualMemory
14000d500test eax, eax
14000d502js 0x14000d5c6
14000d508
14000d508loc_14000d508:
14000d508mov rdx, [rsp+96]
14000d50dcmp rdx, r12
14000d510je 0x14000d5c6
14000d516xor eax, eax
14000d518sub rdx, 16
14000d51cmov r9l, 224
14000d522mov r8, r15
14000d525mov [rsp+32], rax
14000d52amov rcx, rbx
14000d52dcall SysNtReadVirtualMemory
14000d532test eax, eax
14000d534js 0x14000d508
14000d536mov [rsp+32], r14
14000d53bmov rdx, [rsp+240]
14000d543mov r8, r13
14000d546mov rcx, rbx
14000d549movzx r9l, [rsp+232]
14000d552lea rsi, [rsp+384]
14000d55acall SysNtReadVirtualMemory
14000d55fmovzx r8l, [rsp+232]
14000d568test r8w, r8w
14000d56cje 0x14000d59d
14000d56emov rdx, r13
14000d571mov rcx, rsi
14000d574call WCharStringToCharString
14000d579mov rcx, [rsp+72]
14000d57emov rdx, rsi
14000d581mov [rsp+104], rax
14000d586call PackageAddString
14000d58bmov rdx, [rsp+208]
14000d593mov rcx, [rsp+72]
14000d598call PackageAddPtr
14000d59d
14000d59dloc_14000d59d:
14000d59dmov edx, 260
14000d5a2xor eax, eax
14000d5a4mov rdi, r13
14000d5a7mov rcx, rdx
14000d5aarep stosb [rdi], al
14000d5acmov rdi, rsi
14000d5afmov rcx, rdx
14000d5b2rep stosb [rdi], al
14000d5b4mov rax, [rsp+176]
14000d5bcmov [rsp+96], rax
14000d5c1jmp 0x14000d508
14000d5c6
14000d5c6loc_14000d5c6:
14000d5c6or rcx, -1
14000d5catest rbx, rbx
14000d5cdjne 0x14000dc96
14000d5d3jmp 0x14000dc9b
14000d5d8lea r12, [rip+0x1f621]
14000d5dfxor edi, edi
14000d5e1xor esi, esi
14000d5e3xor r13l, r13l
14000d5e6lea r9, [rip+0x18cad]
14000d5edmov r8l, 343
14000d5f3mov rdx, r12
14000d5f6lea rcx, [rip+0x18a0b]
14000d5fdcall printf
14000d602xor eax, eax
14000d604mov ecx, 61
14000d609xor r11l, r11l
14000d60cmov [rsp+648], rdi
14000d614lea rdx, [rsp+96]
14000d619mov [rsp+656], rdi
14000d621lea rdi, [rsp+664]
14000d629rep stosd [rdi], eax
14000d62bmov [rsp+104], r11
14000d630mov rcx, rbx
14000d633mov [rsp+112], r11
14000d638mov [rsp+96], esi
14000d63cmov [rsp+384], r13
14000d644mov [rsp+392], r13
14000d64ccall ParserGetString
14000d651lea rcx, [rsp+104]
14000d656lea rdx, [rsp+112]
14000d65bmov rsi, rax
14000d65ecall ProcessSnapShot
14000d663mov ecx, eax
14000d665test eax, eax
14000d667js 0x14000d853
14000d66dmov r9, [rsp+104]
14000d672mov rdx, r12
14000d675mov r8l, 360
14000d67blea rcx, [rip+0x18c23]
14000d682lea r12, [rsp+648]
14000d68alea r14, [rsp+160]
14000d692call printf
14000d697mov rbx, [rsp+104]
14000d69cmov r13, [rip+0x1eccd]
14000d6a3
14000d6a3loc_14000d6a3:
14000d6a3mov rax, [rsp+104]
14000d6a8mov rcx, r12
14000d6abmov rdx, [rax+64]
14000d6afmovzx r8l, [rax+56]
14000d6b4call WCharStringToCharString
14000d6b9mov r8l, [rsp+96]
14000d6bemov rdx, rsi
14000d6c1mov rcx, r12
14000d6c4call MemCompare
14000d6c9test eax, eax
14000d6cbjne 0x14000d800
14000d6d1xor r10l, r10l
14000d6d4mov rax, [rsp+104]
14000d6d9cmp [r13+92], 2
14000d6desbb edx, edx
14000d6e0mov [rsp+160], r10
14000d6e8and edx, -3072
14000d6eemov ecx, [rax+80]
14000d6f1add edx, 4096
14000d6f7call ProcessOpen
14000d6fcmov rdi, rax
14000d6fftest rax, rax
14000d702je 0x14000d6a3
14000d704mov r8, r14
14000d707mov edx, 8
14000d70cmov rcx, rax
14000d70fcall SysNtOpenProcessToken
14000d714test eax, eax
14000d716js 0x14000d730
14000d718mov rcx, [rsp+160]
14000d720lea rdx, [rsp+384]
14000d728xor r8l, r8l
14000d72bcall TokenQueryOwner
14000d730
14000d730loc_14000d730:
14000d730mov rcx, [rsp+72]
14000d735mov rdx, r12
14000d738call PackageAddString
14000d73dmov rax, [rsp+104]
14000d742mov rcx, [rsp+72]
14000d747mov edx, [rax+80]
14000d74acall PackageAddInt32
14000d74fmov rax, [rsp+104]
14000d754mov rcx, [rsp+72]
14000d759mov edx, [rax+88]
14000d75ccall PackageAddInt32
14000d761mov r8l, [rsp+392]
14000d769mov rcx, [rsp+72]
14000d76emov rdx, [rsp+384]
14000d776call PackageAddBytes
14000d77bmov rcx, rdi
14000d77ecall ProcessIsWow
14000d783mov rcx, [rsp+72]
14000d788cmp eax, 1
14000d78bsbb edx, edx
14000d78dand edx, -22
14000d790add edx, 86
14000d793call PackageAddInt32
14000d798mov rcx, rdi
14000d79bcall SysNtClose
14000d7a0mov rcx, [rsp+160]
14000d7a8test rcx, rcx
14000d7abje 0x14000d7bd
14000d7adcall SysNtClose
14000d7b2xor r9l, r9l
14000d7b5mov [rsp+160], r9
14000d7bd
14000d7bdloc_14000d7bd:
14000d7bdmov rdi, [rsp+384]
14000d7c5test rdi, rdi
14000d7c8je 0x14000d800
14000d7camov ecx, [rsp+392]
14000d7d1xor eax, eax
14000d7d3rep stosb [rdi], al
14000d7d5mov rax, [r13+2230]
14000d7dcmov r8, [rsp+384]
14000d7e4xor edx, edx
14000d7e6mov rax, [rax+96]
14000d7eamov rcx, [rax+48]
14000d7eecall [r13+332]
14000d7f5xor r8l, r8l
14000d7f8mov [rsp+384], r8
14000d800
14000d800loc_14000d800:
14000d800mov rax, [rsp+104]
14000d805mov edx, [rax]
14000d807test edx, edx
14000d809je 0x14000d818
14000d80badd rax, rdx
14000d80emov [rsp+104], rax
14000d813jmp 0x14000d6a3
14000d818
14000d818loc_14000d818:
14000d818test rbx, rbx
14000d81bje 0x14000dc9b
14000d821mov rcx, [rsp+112]
14000d826mov rdi, rbx
14000d829xor eax, eax
14000d82brep stosb [rdi], al
14000d82dmov rax, [rip+0x1eb3c]
14000d834mov r8, rbx
14000d837mov rdx, [rax+2230]
14000d83emov rdx, [rdx+96]
14000d842mov rcx, [rdx+48]
14000d846xor edx, edx
14000d848call [rax+332]
14000d84ejmp 0x14000dc9b
14000d853
14000d853loc_14000d853:
14000d853mov rax, [rip+0x1eb16]
14000d85amov rbx, [rax+2230]
14000d861call [rax+348]
14000d867mov [rbx+104], eax
14000d86ajmp 0x14000dc9b
14000d86flea r9, [rip+0x18a53]
14000d876mov r8l, 431
14000d87clea rdx, [rip+0x1f37d]
14000d883mov r15l, 6
14000d889lea rcx, [rip+0x18778]
14000d890lea rdi, [rsp+648]
14000d898call printf
14000d89dxor eax, eax
14000d89fmov rcx, r15
14000d8a2xor edx, edx
14000d8a4rep stosd [rdi], eax
14000d8a6mov [rsp+160], edx
14000d8adlea rsi, [rip+0x189cd]
14000d8b4mov [rsp+384], edx
14000d8bbmov r15, rcx
14000d8bemov rcx, rbx
14000d8c1call ParserGetInt32
14000d8c6mov rcx, rbx
14000d8c9lea rdx, [rsp+160]
14000d8d1mov r14l, eax
14000d8d4call ParserGetWString
14000d8d9lea rdx, [rsp+384]
14000d8e1mov rcx, rbx
14000d8e4mov r13, rax
14000d8e7call ParserGetWString
14000d8ecmov rcx, rbx
14000d8efmov rdi, rax
14000d8f2call ParserGetInt32
14000d8f7mov rcx, rbx
14000d8famov r12l, eax
14000d8fdcall ParserGetInt32
14000d902cmp [rsp+160], 0
14000d90amov r9l, r14l
14000d90dmov r8l, 449
14000d913cmove r13, r15
14000d917lea rdx, [rip+0x1f2e2]
14000d91ecmp [rsp+384], 0
14000d926mov ebx, eax
14000d928lea rcx, [rip+0x189a7]
14000d92fcmove rdi, r15
14000d933call printf
14000d938mov eax, [rsp+160]
14000d93fmov r9, r13
14000d942mov r8l, 450
14000d948lea rdx, [rip+0x1f2b1]
14000d94flea rcx, [rip+0x189a6]
14000d956mov [rsp+32], eax
14000d95alea r15, [rip+0x18925]
14000d961call printf
14000d966mov eax, [rsp+384]
14000d96dmov r9, rdi
14000d970mov r8l, 451
14000d976lea rdx, [rip+0x1f283]
14000d97dlea rcx, [rip+0x189a4]
14000d984mov [rsp+32], eax
14000d988call printf
14000d98dtest r12l, r12l
14000d990mov r9, r15
14000d993mov [rsp+32], r12l
14000d998cmovne r9, rsi
14000d99cmov r8l, 452
14000d9a2lea rdx, [rip+0x1f257]
14000d9a9lea rcx, [rip+0x189a4]
14000d9b0call printf
14000d9b5test ebx, ebx
14000d9b7mov [rsp+32], ebx
14000d9bbmov r8l, 453
14000d9c1cmovne r15, rsi
14000d9c5lea rdx, [rip+0x1f234]
14000d9cclea rcx, [rip+0x189ac]
14000d9d3mov r9, r15
14000d9d6call printf
14000d9dbxor ecx, ecx
14000d9ddmov [rsp+40], r12l
14000d9e2mov r8, rdi
14000d9e5lea rax, [rsp+648]
14000d9edmov [rsp+48], rcx
14000d9f2mov r9l, r14l
14000d9f5mov rdx, r13
14000d9f8mov [rsp+32], rax
14000d9fdmov ecx, 1
14000da02call ProcessCreate
14000da07mov rcx, [rsp+72]
14000da0cmov rdx, r13
14000da0fmov edi, eax
14000da11call PackageAddWString
14000da16xor edx, edx
14000da18test edi, edi
14000da1aje 0x14000da23
14000da1cmov edx, [rsp+664]
14000da23
14000da23loc_14000da23:
14000da23mov rcx, [rsp+72]
14000da28call PackageAddInt32
14000da2dmov rcx, [rsp+72]
14000da32mov edx, edi
14000da34call PackageAddInt32
14000da39mov rcx, [rsp+72]
14000da3emov edx, r12l
14000da41call PackageAddInt32
14000da46mov rcx, [rsp+72]
14000da4bmov edx, ebx
14000da4dcall PackageAddInt32
14000da52test edi, edi
14000da54je 0x14000dc9b
14000da5amov rcx, [rsp+656]
14000da62call SysNtClose
14000da67test r12l, r12l
14000da6ajne 0x14000da79
14000da6cmov rcx, [rsp+648]
14000da74call SysNtClose
14000da79
14000da79loc_14000da79:
14000da79mov r9l, [rsp+664]
14000da81mov r8l, 470
14000da87lea rdx, [rip+0x1f172]
14000da8elea rcx, [rip+0x18915]
14000da95call printf
14000da9ajmp 0x14000dc9b
14000da9flea r13, [rip+0x1f15a]
14000daa6lea r9, [rip+0x1892d]
14000daadmov r8l, 476
14000dab3mov rdx, r13
14000dab6lea rcx, [rip+0x1854b]
14000dabdlea rdi, [rsp+648]
14000dac5call printf
14000dacamov rcx, rbx
14000dacdlea r14, [rsp+648]
14000dad5call ParserGetInt32
14000dadamov rcx, rbx
14000daddmov r12l, eax
14000dae0call ParserGetInt32
14000dae5mov ecx, 12
14000daeamov edx, 0x1fffff
14000daefmov ebx, eax
14000daf1xor eax, eax
14000daf3rep stosd [rdi], eax
14000daf5xor eax, eax
14000daf7mov ecx, r12l
14000dafamov [rsp+384], rax
14000db02call ProcessOpen
14000db07test rax, rax
14000db0amov rsi, rax
14000db0dje 0x14000dc9b
14000db13mov rcx, [rsp+72]
14000db18mov edx, r12l
14000db1bxor edi, edi
14000db1dlea r12, [rsp+384]
14000db25call PackageAddInt32
14000db2amov rcx, [rsp+72]
14000db2fmov edx, ebx
14000db31call PackageAddInt32
14000db36
14000db36loc_14000db36:
14000db36mov [rsp+40], r12
14000db3bxor r8l, r8l
14000db3emov r9, r14
14000db41mov rdx, rdi
14000db44mov [rsp+32], 48
14000db4dmov rcx, rsi
14000db50call SysNtQueryVirtualMemory
14000db55test eax, eax
14000db57js 0x14000dc08
14000db5dmov rdx, [rsp+648]
14000db65mov rdi, [rsp+672]
14000db6dadd rdi, rdx
14000db70cmp [rsp+688], 0x10000
14000db7bje 0x14000db36
14000db7dcmp [rsp+656], 0
14000db86je 0x14000db36
14000db88test ebx, ebx
14000db8aje 0x14000dbb5
14000db8ccmp [rsp+664], ebx
14000db93jne 0x14000db36
14000db95mov rdx, r13
14000db98mov r9l, ebx
14000db9bmov r8l, 512
14000dba1lea rcx, [rip+0x1883f]
14000dba8call printf
14000dbadmov rdx, [rsp+648]
14000dbb5
14000dbb5loc_14000dbb5:
14000dbb5mov rcx, [rsp+72]
14000dbbacall PackageAddPtr
14000dbbfmov edx, [rsp+672]
14000dbc6mov rcx, [rsp+72]
14000dbcbcall PackageAddInt32
14000dbd0mov edx, [rsp+664]
14000dbd7mov rcx, [rsp+72]
14000dbdccall PackageAddInt32
14000dbe1mov edx, [rsp+680]
14000dbe8mov rcx, [rsp+72]
14000dbedcall PackageAddInt32
14000dbf2mov edx, [rsp+688]
14000dbf9mov rcx, [rsp+72]
14000dbfecall PackageAddInt32
14000dc03jmp 0x14000db36
14000dc08
14000dc08loc_14000dc08:
14000dc08mov rcx, rsi
14000dc0bjmp 0x14000dc96
14000dc10lea r9, [rip+0x187fe]
14000dc17mov r8l, 536
14000dc1dlea rdx, [rip+0x1efdc]
14000dc24lea rcx, [rip+0x183dd]
14000dc2bcall printf
14000dc30mov rcx, rbx
14000dc33call ParserGetInt32
14000dc38mov edx, 1
14000dc3dmov ecx, eax
14000dc3fmov esi, eax
14000dc41call ProcessOpen
14000dc46xor edx, edx
14000dc48mov rbx, rax
14000dc4btest rax, rax
14000dc4ejne 0x14000dc68
14000dc50mov rcx, [rsp+72]
14000dc55call PackageAddInt32
14000dc5amov rcx, [rsp+72]
14000dc5fmov edx, esi
14000dc61call PackageAddInt32
14000dc66jmp 0x14000dc9b
14000dc68
14000dc68loc_14000dc68:
14000dc68mov rcx, rax
14000dc6bmov rax, [rip+0x1e6fe]
14000dc72call [rax+980]
14000dc78mov rcx, [rsp+72]
14000dc7dmov edx, 1
14000dc82call PackageAddInt32
14000dc87mov rcx, [rsp+72]
14000dc8cmov edx, esi
14000dc8ecall PackageAddInt32
14000dc93mov rcx, rbx
14000dc96
14000dc96loc_14000dc96:
14000dc96call SysNtClose
14000dc9b
14000dc9bloc_14000dc9b:
14000dc9bmov rcx, [rsp+72]
14000dca0lea rsp, [rbp-56]
14000dca4pop rbx
14000dca5pop rsi
14000dca6pop rdi
14000dca7pop r12
14000dca9pop r13
14000dcabpop r14
14000dcadpop r15
14000dcafpop rbp
14000dcb0jmp 0x140018b90
14000d340
14000dcb5
14000dcb5 // align 0x10
14000dcb5 // align 0x10
14000dcc0
14000dcc0CommandProcList:
14000dcc0push r15
14000dcc2push r14
14000dcc4push r13
14000dcc6push r12
14000dcc8push rbp
14000dcc9push rdi
14000dccapush rsi
14000dccbmov rsi, rcx
14000dccexor ecx, ecx
14000dcd0push rbx
14000dcd1sub rsp, 120
14000dcd5mov [rsp+72], rcx
14000dcdalea rdx, [rsp+80]
14000dcdfmov [rsp+80], rcx
14000dce4mov [rsp+88], rcx
14000dce9mov [rsp+96], rcx
14000dceemov [rsp+104], rcx
14000dcf3lea rcx, [rsp+72]
14000dcf8call ProcessSnapShot
14000dcfdmov rbx, [rip+0x1e66c]
14000dd04test eax, eax
14000dd06js 0x14000df43
14000dd0cmov rax, [rsp+80]
14000dd11mov r9, [rsp+72]
14000dd16lea rbp, [rip+0x1eeb3]
14000dd1dmov r8l, 587
14000dd23mov rdx, rbp
14000dd26lea rcx, [rip+0x18447]
14000dd2dlea r13, [rip+0x184ad]
14000dd34mov [rsp+32], rax
14000dd39lea r14, [rip+0x18480]
14000dd40lea r15, [rip+0x182c1]
14000dd47call printf
14000dd4cmov ecx, 12
14000dd51mov r12, [rsp+72]
14000dd56call PackageCreate
14000dd5bmov rcx, rsi
14000dd5exor esi, esi
14000dd60mov [rsp+56], rax
14000dd65call ParserGetInt32
14000dd6amov rcx, [rsp+56]
14000dd6fmov edx, eax
14000dd71call PackageAddInt32
14000dd76
14000dd76loc_14000dd76:
14000dd76cmp [rbx+92], 2
14000dd7amov rax, [rsp+72]
14000dd7fsbb edx, edx
14000dd81mov ecx, [rax+80]
14000dd84and edx, -3072
14000dd8aadd edx, 4096
14000dd90call ProcessOpen
14000dd95mov rdi, rax
14000dd98test rax, rax
14000dd9bje 0x14000de14
14000dd9dlea r8, [rsp+88]
14000dda2mov edx, 8
14000dda7mov rcx, rax
14000ddaacall SysNtOpenProcessToken
14000ddafmov r9l, eax
14000ddb2test eax, eax
14000ddb4js 0x14000ddf9
14000ddb6mov rcx, [rsp+88]
14000ddbbxor r8l, r8l
14000ddbelea rdx, [rsp+96]
14000ddc3call TokenQueryOwner
14000ddc8test eax, eax
14000ddcajne 0x14000dde1
14000ddcclea r9, [rip+0x183ca]
14000ddd3mov r8l, 613
14000ddd9mov rdx, rbp
14000dddcmov rcx, r15
14000dddfjmp 0x14000ddf2
14000dde1
14000dde1loc_14000dde1:
14000dde1mov r9, [rsp+96]
14000dde6mov r8l, 615
14000ddecmov rdx, rbp
14000ddefmov rcx, r14
14000ddf2
14000ddf2loc_14000ddf2:
14000ddf2call printf
14000ddf7jmp 0x14000de0a
14000ddf9
14000ddf9loc_14000ddf9:
14000ddf9mov r8l, 618
14000ddffmov rdx, rbp
14000de02mov rcx, r13
14000de05call printf
14000de0a
14000de0aloc_14000de0a:
14000de0amov rcx, rdi
14000de0dcall ProcessIsWow
14000de12mov esi, eax
14000de14
14000de14loc_14000de14:
14000de14mov rax, [rsp+72]
14000de19mov rcx, [rsp+56]
14000de1emovzx r8l, [rax+56]
14000de23mov rdx, [rax+64]
14000de27call PackageAddBytes
14000de2cmov rax, [rsp+72]
14000de31mov rcx, [rsp+56]
14000de36mov edx, [rax+80]
14000de39call PackageAddInt32
14000de3emov rcx, [rsp+56]
14000de43mov edx, esi
14000de45call PackageAddInt32
14000de4amov rax, [rsp+72]
14000de4fmov rcx, [rsp+56]
14000de54mov edx, [rax+88]
14000de57call PackageAddInt32
14000de5cmov rax, [rsp+72]
14000de61mov rcx, [rsp+56]
14000de66mov edx, [rax+100]
14000de69call PackageAddInt32
14000de6emov rax, [rsp+72]
14000de73mov rcx, [rsp+56]
14000de78mov edx, [rax+4]
14000de7bcall PackageAddInt32
14000de80mov rdx, [rsp+96]
14000de85mov r8l, [rsp+104]
14000de8amov rcx, [rsp+56]
14000de8fcall PackageAddBytes
14000de94mov rdx, [rsp+72]
14000de99mov eax, [rbx+76]
14000de9ccmp [rdx+80], rax
14000dea0je 0x14000deaa
14000dea2mov rcx, rdi
14000dea5call SysNtClose
14000deaa
14000deaaloc_14000deaa:
14000deaamov rcx, [rsp+88]
14000deaftest rcx, rcx
14000deb2je 0x14000deb9
14000deb4call SysNtClose
14000deb9
14000deb9loc_14000deb9:
14000deb9mov rdi, [rsp+96]
14000debetest rdi, rdi
14000dec1je 0x14000def4
14000dec3mov ecx, [rsp+104]
14000dec7xor eax, eax
14000dec9rep stosb [rdi], al
14000decbmov rax, [rbx+2230]
14000ded2xor edx, edx
14000ded4mov r8, [rsp+96]
14000ded9mov rax, [rax+96]
14000deddmov rcx, [rax+48]
14000dee1call [rbx+332]
14000dee7xor eax, eax
14000dee9xor edx, edx
14000deebmov [rsp+96], rax
14000def0mov [rsp+104], edx
14000def4
14000def4loc_14000def4:
14000def4mov rax, [rsp+72]
14000def9mov edx, [rax]
14000defbtest edx, edx
14000defdje 0x14000df0c
14000deffadd rax, rdx
14000df02mov [rsp+72], rax
14000df07jmp 0x14000dd76
14000df0c
14000df0cloc_14000df0c:
14000df0cmov rcx, [rsp+56]
14000df11call PackageTransmit
14000df16test r12, r12
14000df19je 0x14000df57
14000df1bmov rcx, [rsp+80]
14000df20mov rdi, r12
14000df23xor eax, eax
14000df25rep stosb [rdi], al
14000df27mov rax, [rbx+2230]
14000df2emov r8, r12
14000df31xor edx, edx
14000df33mov rax, [rax+96]
14000df37mov rcx, [rax+48]
14000df3bcall [rbx+332]
14000df41jmp 0x14000df57
14000df43
14000df43loc_14000df43:
14000df43mov ecx, eax
14000df45call [rbx+348]
14000df4bmov ecx, 1
14000df50mov edx, eax
14000df52call PackageTransmitError
14000df57
14000df57loc_14000df57:
14000df57add rsp, 120
14000df5bpop rbx
14000df5cpop rsi
14000df5dpop rdi
14000df5epop rbp
14000df5fpop r12
14000df61pop r13
14000df63pop r14
14000df65pop r15
14000df67ret
14000dcc0
14000dcc0CommandProcList:
14000dcc0push r15
14000dcc2push r14
14000dcc4push r13
14000dcc6push r12
14000dcc8push rbp
14000dcc9push rdi
14000dccapush rsi
14000dccbmov rsi, rcx
14000dccexor ecx, ecx
14000dcd0push rbx
14000dcd1sub rsp, 120
14000dcd5mov [rsp+72], rcx
14000dcdalea rdx, [rsp+80]
14000dcdfmov [rsp+80], rcx
14000dce4mov [rsp+88], rcx
14000dce9mov [rsp+96], rcx
14000dceemov [rsp+104], rcx
14000dcf3lea rcx, [rsp+72]
14000dcf8call ProcessSnapShot
14000dcfdmov rbx, [rip+0x1e66c]
14000dd04test eax, eax
14000dd06js 0x14000df43
14000dd0cmov rax, [rsp+80]
14000dd11mov r9, [rsp+72]
14000dd16lea rbp, [rip+0x1eeb3]
14000dd1dmov r8l, 587
14000dd23mov rdx, rbp
14000dd26lea rcx, [rip+0x18447]
14000dd2dlea r13, [rip+0x184ad]
14000dd34mov [rsp+32], rax
14000dd39lea r14, [rip+0x18480]
14000dd40lea r15, [rip+0x182c1]
14000dd47call printf
14000dd4cmov ecx, 12
14000dd51mov r12, [rsp+72]
14000dd56call PackageCreate
14000dd5bmov rcx, rsi
14000dd5exor esi, esi
14000dd60mov [rsp+56], rax
14000dd65call ParserGetInt32
14000dd6amov rcx, [rsp+56]
14000dd6fmov edx, eax
14000dd71call PackageAddInt32
14000dd76
14000dd76loc_14000dd76:
14000dd76cmp [rbx+92], 2
14000dd7amov rax, [rsp+72]
14000dd7fsbb edx, edx
14000dd81mov ecx, [rax+80]
14000dd84and edx, -3072
14000dd8aadd edx, 4096
14000dd90call ProcessOpen
14000dd95mov rdi, rax
14000dd98test rax, rax
14000dd9bje 0x14000de14
14000dd9dlea r8, [rsp+88]
14000dda2mov edx, 8
14000dda7mov rcx, rax
14000ddaacall SysNtOpenProcessToken
14000ddafmov r9l, eax
14000ddb2test eax, eax
14000ddb4js 0x14000ddf9
14000ddb6mov rcx, [rsp+88]
14000ddbbxor r8l, r8l
14000ddbelea rdx, [rsp+96]
14000ddc3call TokenQueryOwner
14000ddc8test eax, eax
14000ddcajne 0x14000dde1
14000ddcclea r9, [rip+0x183ca]
14000ddd3mov r8l, 613
14000ddd9mov rdx, rbp
14000dddcmov rcx, r15
14000dddfjmp 0x14000ddf2
14000dde1
14000dde1loc_14000dde1:
14000dde1mov r9, [rsp+96]
14000dde6mov r8l, 615
14000ddecmov rdx, rbp
14000ddefmov rcx, r14
14000ddf2
14000ddf2loc_14000ddf2:
14000ddf2call printf
14000ddf7jmp 0x14000de0a
14000ddf9
14000ddf9loc_14000ddf9:
14000ddf9mov r8l, 618
14000ddffmov rdx, rbp
14000de02mov rcx, r13
14000de05call printf
14000de0a
14000de0aloc_14000de0a:
14000de0amov rcx, rdi
14000de0dcall ProcessIsWow
14000de12mov esi, eax
14000de14
14000de14loc_14000de14:
14000de14mov rax, [rsp+72]
14000de19mov rcx, [rsp+56]
14000de1emovzx r8l, [rax+56]
14000de23mov rdx, [rax+64]
14000de27call PackageAddBytes
14000de2cmov rax, [rsp+72]
14000de31mov rcx, [rsp+56]
14000de36mov edx, [rax+80]
14000de39call PackageAddInt32
14000de3emov rcx, [rsp+56]
14000de43mov edx, esi
14000de45call PackageAddInt32
14000de4amov rax, [rsp+72]
14000de4fmov rcx, [rsp+56]
14000de54mov edx, [rax+88]
14000de57call PackageAddInt32
14000de5cmov rax, [rsp+72]
14000de61mov rcx, [rsp+56]
14000de66mov edx, [rax+100]
14000de69call PackageAddInt32
14000de6emov rax, [rsp+72]
14000de73mov rcx, [rsp+56]
14000de78mov edx, [rax+4]
14000de7bcall PackageAddInt32
14000de80mov rdx, [rsp+96]
14000de85mov r8l, [rsp+104]
14000de8amov rcx, [rsp+56]
14000de8fcall PackageAddBytes
14000de94mov rdx, [rsp+72]
14000de99mov eax, [rbx+76]
14000de9ccmp [rdx+80], rax
14000dea0je 0x14000deaa
14000dea2mov rcx, rdi
14000dea5call SysNtClose
14000deaa
14000deaaloc_14000deaa:
14000deaamov rcx, [rsp+88]
14000deaftest rcx, rcx
14000deb2je 0x14000deb9
14000deb4call SysNtClose
14000deb9
14000deb9loc_14000deb9:
14000deb9mov rdi, [rsp+96]
14000debetest rdi, rdi
14000dec1je 0x14000def4
14000dec3mov ecx, [rsp+104]
14000dec7xor eax, eax
14000dec9rep stosb [rdi], al
14000decbmov rax, [rbx+2230]
14000ded2xor edx, edx
14000ded4mov r8, [rsp+96]
14000ded9mov rax, [rax+96]
14000deddmov rcx, [rax+48]
14000dee1call [rbx+332]
14000dee7xor eax, eax
14000dee9xor edx, edx
14000deebmov [rsp+96], rax
14000def0mov [rsp+104], edx
14000def4
14000def4loc_14000def4:
14000def4mov rax, [rsp+72]
14000def9mov edx, [rax]
14000defbtest edx, edx
14000defdje 0x14000df0c
14000deffadd rax, rdx
14000df02mov [rsp+72], rax
14000df07jmp 0x14000dd76
14000df0c
14000df0cloc_14000df0c:
14000df0cmov rcx, [rsp+56]
14000df11call PackageTransmit
14000df16test r12, r12
14000df19je 0x14000df57
14000df1bmov rcx, [rsp+80]
14000df20mov rdi, r12
14000df23xor eax, eax
14000df25rep stosb [rdi], al
14000df27mov rax, [rbx+2230]
14000df2emov r8, r12
14000df31xor edx, edx
14000df33mov rax, [rax+96]
14000df37mov rcx, [rax+48]
14000df3bcall [rbx+332]
14000df41jmp 0x14000df57
14000df43
14000df43loc_14000df43:
14000df43mov ecx, eax
14000df45call [rbx+348]
14000df4bmov ecx, 1
14000df50mov edx, eax
14000df52call PackageTransmitError
14000df57
14000df57loc_14000df57:
14000df57add rsp, 120
14000df5bpop rbx
14000df5cpop rsi
14000df5dpop rdi
14000df5epop rbp
14000df5fpop r12
14000df61pop r13
14000df63pop r14
14000df65pop r15
14000df67ret
14000dcc0
Loading..