Similarity

14001c740
14001c740SharedSleep:
14001c740push rbx
14001c741mov rbx, rcx
14001c744imul rbx, rbx, 1000
14001c74bsub rsp, 32
14001c74fcall RandomNumber32
14001c754call SharedTimestamp
14001c759add rbx, rax
14001c75c
14001c75cloc_14001c75c:
14001c75ccall SharedTimestamp
14001c761cmp rax, rbx
14001c764jb 0x14001c75c
14001c766add rsp, 32
14001c76apop rbx
14001c76bjmp 0x14001c770
14001c740

14001c770
14001c770SharedTimestamp:
14001c770mov eax, [0x7ffe0014]
14001c777mov edx, [0x7ffe001c]
14001c77eshl rdx, 32
14001c782or rax, rdx
14001c785ret
14001c770

14001c786
14001c786 // align 0x10

14001c790
14001c790ShuffleArray:
14001c790push r12
14001c792lea r12, [rdx-1]
14001c796push rbp
14001c797mov ebp, 32767
14001c79cpush rdi
14001c79dmov rdi, rdx
14001c7a0push rsi
14001c7a1mov rsi, rcx
14001c7a4push rbx
14001c7a5xor ebx, ebx
14001c7a7sub rsp, 32
14001c7ab
14001c7abloc_14001c7ab:
14001c7abcmp rbx, r12
14001c7aejae 0x14001c7f1
14001c7b0call RandomNumber32
14001c7b5mov r8, rdi
14001c7b8xor edx, edx
14001c7basub r8, rbx
14001c7bdmov ecx, eax
14001c7bfmov rax, rbp
14001c7c2div r8
14001c7c5and ecx, 32767
14001c7cbxor edx, edx
14001c7cdlea r8, [rax+1]
14001c7d1mov rax, rcx
14001c7d4mov rcx, [rsi+8*rbx]
14001c7d8div r8
14001c7dbadd rax, rbx
14001c7delea rax, [rsi+8*rax]
14001c7e2mov rdx, [rax]
14001c7e5mov [rax], rcx
14001c7e8mov [rsi+8*rbx], rdx
14001c7ecinc rbx
14001c7efjmp 0x14001c7ab
14001c7f1
14001c7f1loc_14001c7f1:
14001c7f1add rsp, 32
14001c7f5pop rbx
14001c7f6pop rsi
14001c7f7pop rdi
14001c7f8pop rbp
14001c7f9pop r12
14001c7fbret
14001c790

14001c7fc
14001c7fc // align 0x10

14001c800
14001c800SleepObf:
14001c800push rdi
14001c801push rsi
14001c802push rbx
14001c803add rsp, -128
14001c807call SleepTime
14001c80cmov rbx, [rip+64349]
14001c813mov edx, [rbx+210]
14001c819test eax, eax
14001c81bje 0x14001c925
14001c821mov r9l, [rbx+2238]
14001c828mov esi, eax
14001c82atest r9l, r9l
14001c82dje 0x14001c84d
14001c82fmov r8l, 732
14001c835lea rdx, [rip+65076]
14001c83clea rcx, [rip+50371]
14001c843call printf
14001c848jmp 0x14001c8df
14001c84d
14001c84dloc_14001c84d:
14001c84dcmp edx, 2
14001c850ja 0x14001c85c
14001c852test edx, edx
14001c854je 0x14001c8df
14001c85ajmp 0x14001c8d4
14001c85c
14001c85cloc_14001c85c:
14001c85ccmp edx, 3
14001c85fjne 0x14001c8df
14001c861mov eax, r9l
14001c864lea rdi, [rsp+108]
14001c869mov ecx, 5
14001c86exor edx, edx
14001c870rep stosd [rdi], eax
14001c872lea rdi, [rsp+108]
14001c877mov rcx, rdi
14001c87acall [rbx+1492]
14001c880mov [rsp+112], rax
14001c885test rax, rax
14001c888je 0x14001c925
14001c88emov ecx, 24576
14001c893mov [rsp+32], rdi
14001c898xor r8l, r8l
14001c89bxor edx, edx
14001c89dlea r9, [rip-38132]
14001c8a4call [rbx+1516]
14001c8aamov [rsp+120], rax
14001c8afmov rcx, rax
14001c8b2test rax, rax
14001c8b5je 0x14001c8cc
14001c8b7mov [rsp+108], esi
14001c8bbcall [rbx+1508]
14001c8c1mov rcx, [rsp+120]
14001c8c6call [rbx+1524]
14001c8cc
14001c8ccloc_14001c8cc:
14001c8cccall [rbx+1500]
14001c8d2jmp 0x14001c925
14001c8d4
14001c8d4loc_14001c8d4:
14001c8d4mov ecx, eax
14001c8d6call TimerObf
14001c8dbtest eax, eax
14001c8ddjne 0x14001c925
14001c8df
14001c8dfloc_14001c8df:
14001c8dfmov rcx, [rbx+2118]
14001c8e6mov r8, [rbx+1692]
14001c8edor r9, -1
14001c8f1movsxd rax, [rcx+60]
14001c8f5mov edx, [rcx+rax+80]
14001c8f9xor eax, eax
14001c8fbmov [rsp+80], rax
14001c900mov [rsp+72], rax
14001c905mov [rsp+64], rax
14001c90amov [rsp+56], rax
14001c90fmov [rsp+48], rax
14001c914mov [rsp+40], rax
14001c919mov eax, esi
14001c91bmov [rsp+32], rax
14001c920call SpoofRetAddr
14001c925
14001c925loc_14001c925:
14001c925sub rsp, -128
14001c929pop rbx
14001c92apop rsi
14001c92bpop rdi
14001c92cret
14001c800

14001c92d
14001c92d // align 0x10

14001c930
14001c930SleepTime:
14001c930push r12
14001c932xor eax, eax
14001c934push rbp
14001c935push rdi
14001c936push rsi
14001c937push rbx
14001c938sub rsp, 48
14001c93cmov r12, [rip+64045]
14001c943mov [rsp+32], rax
14001c948imul ebx, [r12+96], 1000
14001c951mov [rsp+40], rax
14001c956mov esi, [r12+100]
14001c95bmov edi, [r12+132]
14001c963call InWorkingHours
14001c968test eax, eax
14001c96ajne 0x14001c9f0
14001c970test ebx, ebx
14001c972je 0x14001ca25
14001c978mov edx, edi
14001c97amov ebp, edi
14001c97clea rcx, [rsp+32]
14001c981mov ebx, edi
14001c983shr edx, 11
14001c986shr ebp, 6
14001c989mov esi, edx
14001c98bshr ebx, 17
14001c98eand ebp, 31
14001c991call [r12+1140]
14001c999and ebx, 31
14001c99cand esi, 63
14001c99fmovzx r8l, [rsp+40]
14001c9a5movzx ecx, [rsp+42]
14001c9aamovzx ebx, bx
14001c9admovzx edx, si
14001c9b0cmp r8w, bp
14001c9b4jne 0x14001c9c0
14001c9b6and edi, 63
14001c9b9cmp di, [rsp+42]
14001c9bejmp 0x14001c9c4
14001c9c0
14001c9c0loc_14001c9c0:
14001c9c0cmp bp, r8w
14001c9c4
14001c9c4loc_14001c9c4:
14001c9c4jae 0x14001c9de
14001c9c6mov eax, 23
14001c9cbimul ebx, ebx, 60
14001c9cesub eax, r8l
14001c9d1imul eax, eax, 60
14001c9d4add ebx, edx
14001c9d6sub eax, ecx
14001c9d8lea ebx, [rax+rbx+60]
14001c9dcjmp 0x14001c9e8
14001c9de
14001c9deloc_14001c9de:
14001c9desub ebx, r8l
14001c9e1sub edx, ecx
14001c9e3imul ebx, ebx, 60
14001c9e6add ebx, edx
14001c9e8
14001c9e8loc_14001c9e8:
14001c9e8imul ebx, ebx, 1000
14001c9eejmp 0x14001ca25
14001c9f0
14001c9f0loc_14001c9f0:
14001c9f0imul esi, ebx
14001c9f3cmp esi, 99
14001c9f6jbe 0x14001ca25
14001c9f8call RandomNumber32
14001c9fdxor edx, edx
14001c9ffmov r8l, 100
14001ca05mov ecx, eax
14001ca07mov eax, esi
14001ca09div r8l
14001ca0cxor edx, edx
14001ca0emov esi, eax
14001ca10mov eax, ecx
14001ca12div esi
14001ca14mov edi, edx
14001ca16call RandomBool
14001ca1btest eax, eax
14001ca1dje 0x14001ca23
14001ca1fadd ebx, edi
14001ca21jmp 0x14001ca25
14001ca23
14001ca23loc_14001ca23:
14001ca23sub ebx, edi
14001ca25
14001ca25loc_14001ca25:
14001ca25add rsp, 48
14001ca29mov eax, ebx
14001ca2bpop rbx
14001ca2cpop rsi
14001ca2dpop rdi
14001ca2epop rbp
14001ca2fpop r12
14001ca31ret
14001c930

14001ca32
14001ca32 // align 0x10

14001ca40
14001ca40SocketCleanDead:
14001ca40push rsi
14001ca41push rbx
14001ca42xor ebx, ebx
14001ca44sub rsp, 40
14001ca48mov rsi, [rip+63777]
14001ca4fmov rcx, [rsi+2326]
14001ca56
14001ca56loc_14001ca56:
14001ca56test rcx, rcx
14001ca59je 0x14001caa0
14001ca5bmov edx, [rcx+16]
14001ca5emov rax, [rcx+48]
14001ca62sub edx, 4
14001ca65cmp edx, 1
14001ca68jbe 0x14001ca72
14001ca6a
14001ca6aloc_14001ca6a:
14001ca6amov rbx, rcx
14001ca6dmov rcx, rax
14001ca70jmp 0x14001ca56
14001ca72
14001ca72loc_14001ca72:
14001ca72test rbx, rbx
14001ca75jne 0x14001ca8e
14001ca77mov [rsi+2326], rax
14001ca7ecall SocketFree
14001ca83mov rax, [rsi+2326]
14001ca8axor ecx, ecx
14001ca8cjmp 0x14001ca6a
14001ca8e
14001ca8eloc_14001ca8e:
14001ca8emov [rbx+48], rax
14001ca92call SocketFree
14001ca97mov rax, [rbx+48]
14001ca9bmov rcx, rbx
14001ca9ejmp 0x14001ca6a
14001caa0
14001caa0loc_14001caa0:
14001caa0add rsp, 40
14001caa4pop rbx
14001caa5pop rsi
14001caa6ret
14001ca40

14001caa7
14001caa7 // align 0x10

14001cab0
14001cab0SocketClients:
14001cab0push r14
14001cab2push r13
14001cab4push r12
14001cab6lea r12, [rip+50454]
14001cabdpush rbp
14001cabelea rbp, [rip+0x1069b]
14001cac5push rdi
14001cac6push rsi
14001cac7push rbx
14001cac8sub rsp, 80
14001caccmov rdi, [rip+63645]
14001cad3mov [rsp+76], 1
14001cadblea r13, [rsp+76]
14001cae0mov rbx, [rdi+2326]
14001cae7
14001cae7loc_14001cae7:
14001cae7test rbx, rbx
14001caeaje 0x14001cc00
14001caf0cmp [rbx+16], 1
14001caf4jne 0x14001cbf7
14001cafamov rcx, [rbx+8]
14001cafexor r8l, r8l
14001cb01xor edx, edx
14001cb03call [rdi+1900]
14001cb09mov rsi, rax
14001cb0ccmp rax, -1
14001cb10je 0x14001cbf7
14001cb16mov r9, rax
14001cb19mov r8l, 242
14001cb1fmov rdx, rbp
14001cb22mov rcx, r12
14001cb25call printf
14001cb2amov r8, r13
14001cb2dmov edx, 0xffffffff8004667e
14001cb32mov rcx, rsi
14001cb35call [rdi+1876]
14001cb3binc eax
14001cb3dje 0x14001cbce
14001cb43mov eax, [rbx+40]
14001cb46mov r8l, [rbx+20]
14001cb4axor r9l, r9l
14001cb4dmov edx, 3
14001cb52mov rcx, rsi
14001cb55mov [rsp+48], eax
14001cb59mov eax, [rbx+36]
14001cb5cmov [rsp+40], eax
14001cb60mov eax, [rbx+32]
14001cb63mov [rsp+32], eax
14001cb67call SocketNew
14001cb6cmov ecx, 2540
14001cb71mov r14, rax
14001cb74call PackageCreate
14001cb79mov edx, 16
14001cb7emov rcx, rax
14001cb81mov rsi, rax
14001cb84call PackageAddInt32
14001cb89mov edx, [r14]
14001cb8cmov rcx, rsi
14001cb8fcall PackageAddInt32
14001cb94mov edx, [r14+20]
14001cb98mov rcx, rsi
14001cb9bcall PackageAddInt32
14001cba0mov edx, [r14+32]
14001cba4mov rcx, rsi
14001cba7call PackageAddInt32
14001cbacmov edx, [r14+36]
14001cbb0mov rcx, rsi
14001cbb3call PackageAddInt32
14001cbb8mov edx, [r14+40]
14001cbbcmov rcx, rsi
14001cbbfcall PackageAddInt32
14001cbc4mov rcx, rsi
14001cbc7call PackageTransmit
14001cbccjmp 0x14001cbf7
14001cbce
14001cbceloc_14001cbce:
14001cbcemov rax, [rdi+2230]
14001cbd5lea rcx, [rip+49981]
14001cbdcmov r8l, 271
14001cbe2mov rdx, rbp
14001cbe5mov r9l, [rax+104]
14001cbe9call printf
14001cbeemov rcx, rsi
14001cbf1call [rdi+1908]
14001cbf7
14001cbf7loc_14001cbf7:
14001cbf7mov rbx, [rbx+48]
14001cbfbjmp 0x14001cae7
14001cc00
14001cc00loc_14001cc00:
14001cc00add rsp, 80
14001cc04pop rbx
14001cc05pop rsi
14001cc06pop rdi
14001cc07pop rbp
14001cc08pop r12
14001cc0apop r13
14001cc0cpop r14
14001cc0eret
14001cab0

14001cc0f
14001cc0f // align 0x10

14001cc10
14001cc10SocketFree:
14001cc10push rdi
14001cc11mov r8l, 431
14001cc17lea rdx, [rip+0x100e2]
14001cc1epush rsi
14001cc1fpush rbx
14001cc20mov rbx, rcx
14001cc23sub rsp, 32
14001cc27mov r9l, [rcx]
14001cc2alea rcx, [rip+50217]
14001cc31call printf
14001cc36mov eax, [rbx+16]
14001cc39cmp eax, 4
14001cc3cjne 0x14001cc88
14001cc3emov ecx, 2540
14001cc43call PackageCreate
14001cc48mov edx, 4
14001cc4dmov rcx, rax
14001cc50mov rsi, rax
14001cc53call PackageAddInt32
14001cc58mov edx, [rbx]
14001cc5amov rcx, rsi
14001cc5dcall PackageAddInt32
14001cc62mov edx, [rbx+20]
14001cc65mov rcx, rsi
14001cc68call PackageAddInt32
14001cc6dmov edx, [rbx+32]
14001cc70mov rcx, rsi
14001cc73call PackageAddInt32
14001cc78mov edx, [rbx+36]
14001cc7bmov rcx, rsi
14001cc7ecall PackageAddInt32
14001cc83mov edx, [rbx+40]
14001cc86jmp 0x14001ccb6
14001cc88
14001cc88loc_14001cc88:
14001cc88cmp eax, 5
14001cc8bjne 0x14001ccc6
14001cc8dmov ecx, 2540
14001cc92call PackageCreate
14001cc97mov edx, 19
14001cc9cmov rcx, rax
14001cc9fmov rsi, rax
14001cca2call PackageAddInt32
14001cca7mov edx, [rbx]
14001cca9mov rcx, rsi
14001ccaccall PackageAddInt32
14001ccb1mov edx, 2
14001ccb6
14001ccb6loc_14001ccb6:
14001ccb6mov rcx, rsi
14001ccb9call PackageAddInt32
14001ccbemov rcx, rsi
14001ccc1call PackageTransmit
14001ccc6
14001ccc6loc_14001ccc6:
14001ccc6mov rcx, [rbx+8]
14001cccamov rsi, [rip+63135]
14001ccd1test rcx, rcx
14001ccd4je 0x14001cce2
14001ccd6call [rsi+1908]
14001ccdcxor eax, eax
14001ccdemov [rbx+8], rax
14001cce2
14001cce2loc_14001cce2:
14001cce2mov rdi, rbx
14001cce5mov ecx, 56
14001cceaxor eax, eax
14001ccecrep stosb [rdi], al
14001cceemov rax, [rsi+2230]
14001ccf5mov r8, rbx
14001ccf8xor edx, edx
14001ccfamov rax, [rax+96]
14001ccfemov rcx, [rax+48]
14001cd02mov rax, [rsi+332]
14001cd09add rsp, 32
14001cd0dpop rbx
14001cd0epop rsi
14001cd0fpop rdi
14001cd10jmp rax
14001cc10

14001cd12
14001cd12 // align 0x10

14001cd20
14001cd20SocketNew:
14001cd20push rbp
14001cd21xor eax, eax
14001cd23mov rbp, rsp
14001cd26push r15
14001cd28push r14
14001cd2apush r13
14001cd2cmov r13l, edx
14001cd2fxor edx, edx
14001cd31push r12
14001cd33mov r12l, r8l
14001cd36push rdi
14001cd37push rsi
14001cd38mov rsi, rcx
14001cd3bmov ecx, 7
14001cd40push rbx
14001cd41mov rbx, r9
14001cd44and rsp, -16
14001cd48sub rsp, 208
14001cd4fmov r14l, [rbp+48]
14001cd53lea rdi, [rsp+180]
14001cd5bmov [rsp+164], rdx
14001cd63rep stosd [rdi], eax
14001cd65mov [rsp+172], rdx
14001cd6dmov [rsp+160], 1
14001cd78test r8l, r8l
14001cd7bjne 0x14001cda4
14001cd7dtest r9, r9
14001cd80jne 0x14001cda4
14001cd82lea r9, [rip+49173]
14001cd89mov r8l, 69
14001cd8flea rdx, [rip+0x1049a]
14001cd96lea rcx, [rip+49071]
14001cd9dcall printf
14001cda2jmp 0x14001cdfe
14001cda4
14001cda4loc_14001cda4:
14001cda4mov eax, [rbp+64]
14001cda7mov r9, rsi
14001cdaamov r8l, 73
14001cdb0lea rdx, [rip+0x10479]
14001cdb7lea rcx, [rip+49145]
14001cdbemov [rsp+72], eax
14001cdc2mov eax, [rbp+56]
14001cdc5mov [rsp+56], r14l
14001cdcamov [rsp+64], eax
14001cdcemov [rsp+48], rbx
14001cdd3mov [rsp+40], r12l
14001cdd8mov [rsp+32], r13l
14001cdddcall printf
14001cde2test r13l, r13l
14001cde5je 0x14001d1b6
14001cdebcmp r13l, 3
14001cdefje 0x14001d1b6
14001cdf5call InitWSA
14001cdfatest eax, eax
14001cdfcjne 0x14001ce05
14001cdfe
14001cdfeloc_14001cdfe:
14001cdfexor edi, edi
14001ce00jmp 0x14001d236
14001ce05
14001ce05loc_14001ce05:
14001ce05lea r9, [rip+49184]
14001ce0cmov r8l, 82
14001ce12lea rdx, [rip+0x10417]
14001ce19lea rcx, [rip+48940]
14001ce20call printf
14001ce25xor eax, eax
14001ce27xor r9l, r9l
14001ce2atest r12l, r12l
14001ce2dmov [rsp+40], eax
14001ce31mov rdi, [rip+62776]
14001ce38mov edx, 1
14001ce3dmov r8l, 6
14001ce43mov [rsp+32], eax
14001ce47je 0x14001cee8
14001ce4dmov ecx, 2
14001ce52call [rdi+1860]
14001ce58mov rsi, rax
14001ce5bcmp rax, -1
14001ce5fjne 0x14001ce77
14001ce61mov rax, [rdi+2230]
14001ce68mov r8l, 89
14001ce6emov r9l, [rax+104]
14001ce72jmp 0x14001cf0d
14001ce77
14001ce77loc_14001ce77:
14001ce77mov eax, r14l
14001ce7amov [rsp+56], r14l
14001ce7fmovzx r9l, r12b
14001ce83mov r8l, 98
14001ce89xchg al, ah
14001ce8blea rdx, [rip+0x1039e]
14001ce92lea rcx, [rip+49099]
14001ce99mov [rsp+168], r12l
14001cea1mov [rsp+164], 2
14001ceabmov [rsp+166], ax
14001ceb3mov eax, r12l
14001ceb6shr eax, 24
14001ceb9mov [rsp+48], eax
14001cebdmov eax, r12l
14001cec0shr eax, 16
14001cec3movzx eax, al
14001cec6mov [rsp+40], eax
14001cecamov eax, r12l
14001cecdmovzx eax, ah
14001ced0mov [rsp+32], eax
14001ced4call printf
14001ced9cmp r13l, 2
14001ceddjne 0x14001d0ab
14001cee3jmp 0x14001cff9
14001cee8
14001cee8loc_14001cee8:
14001cee8mov ecx, 23
14001ceedcall [rdi+1860]
14001cef3mov rsi, rax
14001cef6cmp rax, -1
14001cefajne 0x14001cf25
14001cefcmov rax, [rdi+2230]
14001cf03mov r8l, 111
14001cf09mov r9l, [rax+104]
14001cf0d
14001cf0dloc_14001cf0d:
14001cf0dlea rdx, [rip+0x1031c]
14001cf14lea rcx, [rip+48930]
14001cf1bcall printf
14001cf20jmp 0x14001cdfe
14001cf25
14001cf25loc_14001cf25:
14001cf25mov eax, r14l
14001cf28movups x0, [rbx]
14001cf2bmov [rsp+152], r14l
14001cf33mov r8l, 120
14001cf39xchg al, ah
14001cf3blea rdx, [rip+0x102ee]
14001cf42mov [rsp+180], 23
14001cf4clea rcx, [rip+48955]
14001cf53movups [rsp+188], x0
14001cf5bmov [rsp+182], ax
14001cf63movzx eax, [rbx+15]
14001cf67mov [rsp+144], eax
14001cf6emovzx eax, [rbx+14]
14001cf72mov [rsp+136], eax
14001cf79movzx eax, [rbx+13]
14001cf7dmov [rsp+128], eax
14001cf84movzx eax, [rbx+12]
14001cf88mov [rsp+120], eax
14001cf8cmovzx eax, [rbx+11]
14001cf90mov [rsp+112], eax
14001cf94movzx eax, [rbx+10]
14001cf98mov [rsp+104], eax
14001cf9cmovzx eax, [rbx+9]
14001cfa0mov [rsp+96], eax
14001cfa4movzx eax, [rbx+8]
14001cfa8mov [rsp+88], eax
14001cfacmovzx eax, [rbx+7]
14001cfb0mov [rsp+80], eax
14001cfb4movzx eax, [rbx+6]
14001cfb8mov [rsp+72], eax
14001cfbcmovzx eax, [rbx+5]
14001cfc0mov [rsp+64], eax
14001cfc4movzx eax, [rbx+4]
14001cfc8mov [rsp+56], eax
14001cfccmovzx eax, [rbx+3]
14001cfd0mov [rsp+48], eax
14001cfd4movzx eax, [rbx+2]
14001cfd8mov [rsp+40], eax
14001cfdcmovzx eax, [rbx+1]
14001cfe0mov [rsp+32], eax
14001cfe4movzx r9l, [rbx]
14001cfe8call printf
14001cfedcmp r13l, 2
14001cff1jne 0x14001d0ab
14001cff7jmp 0x14001d027
14001cff9
14001cff9loc_14001cff9:
14001cff9lea rdx, [rsp+164]
14001d001mov r8l, 16
14001d007mov rcx, rsi
14001d00acall [rdi+1932]
14001d010inc eax
14001d012jne 0x14001d066
14001d014mov rax, [rdi+2230]
14001d01bmov r8l, 136
14001d021mov r9l, [rax+104]
14001d025jmp 0x14001d053
14001d027
14001d027loc_14001d027:
14001d027mov r8l, 28
14001d02dlea rdx, [rsp+180]
14001d035mov rcx, rsi
14001d038call [rdi+1932]
14001d03einc eax
14001d040jne 0x14001d066
14001d042mov rax, [rdi+2230]
14001d049mov r8l, 145
14001d04fmov r9l, [rax+104]
14001d053
14001d053loc_14001d053:
14001d053lea rdx, [rip+0x101d6]
14001d05alea rcx, [rip+48788]
14001d061jmp 0x14001d167
14001d066
14001d066loc_14001d066:
14001d066mov rdi, [rip+62211]
14001d06dlea r8, [rsp+160]
14001d075mov edx, 0xffffffff8004667e
14001d07amov rcx, rsi
14001d07dcall [rdi+1876]
14001d083lea r9, [rip+48823]
14001d08amov r8l, 157
14001d090inc eax
14001d092jne 0x14001d1a3
14001d098mov rax, [rdi+2230]
14001d09fmov r8l, 153
14001d0a5mov r9l, [rax+104]
14001d0a9jmp 0x14001d0dd
14001d0ab
14001d0abloc_14001d0ab:
14001d0abmov rdi, [rip+62142]
14001d0b2lea r8, [rsp+160]
14001d0bamov edx, 0xffffffff8004667e
14001d0bfmov rcx, rsi
14001d0c2call [rdi+1876]
14001d0c8inc eax
14001d0cajne 0x14001d0ed
14001d0ccmov rax, [rdi+2230]
14001d0d3mov r8l, 166
14001d0d9mov r9l, [rax+104]
14001d0dd
14001d0ddloc_14001d0dd:
14001d0ddlea rdx, [rip+0x1014c]
14001d0e4lea rcx, [rip+48686]
14001d0ebjmp 0x14001d167
14001d0ed
14001d0edloc_14001d0ed:
14001d0edlea rdx, [rsp+164]
14001d0f5mov r8l, 16
14001d0fbmov rcx, rsi
14001d0fecall [rdi+1884]
14001d104inc eax
14001d106jne 0x14001d129
14001d108mov rax, [rdi+2230]
14001d10fmov r8l, 173
14001d115lea rdx, [rip+0x10114]
14001d11clea rcx, [rip+48688]
14001d123mov r9l, [rax+104]
14001d127jmp 0x14001d167
14001d129
14001d129loc_14001d129:
14001d129mov edx, 1
14001d12emov rcx, rsi
14001d131call [rdi+1892]
14001d137lea r9, [rip+48729]
14001d13emov r8l, 184
14001d144inc eax
14001d146jne 0x14001d1a3
14001d148mov rax, [rdi+2230]
14001d14fmov r8l, 180
14001d155lea rdx, [rip+0x100d4]
14001d15clea rcx, [rip+48657]
14001d163mov r9l, [rax+104]
14001d167
14001d167loc_14001d167:
14001d167call printf
14001d16clea rax, [rsi-1]
14001d170cmp rax, -3
14001d174ja 0x14001cdfe
14001d17amov rbx, [rip+61935]
14001d181mov rcx, rsi
14001d184mov rax, [rbx+2230]
14001d18bmov edi, [rax+104]
14001d18ecall [rbx+1908]
14001d194mov rax, [rbx+2230]
14001d19bmov [rax+104], edi
14001d19ejmp 0x14001cdfe
14001d1a3
14001d1a3loc_14001d1a3:
14001d1a3lea rdx, [rip+0x10086]
14001d1aalea rcx, [rip+48027]
14001d1b1call printf
14001d1b6
14001d1b6loc_14001d1b6:
14001d1b6mov r15, [rip+61875]
14001d1bdmov r8l, 56
14001d1c3mov edx, 8
14001d1c8mov rax, [r15+2230]
14001d1cfmov rax, [rax+96]
14001d1d3mov rcx, [rax+48]
14001d1d7call [r15+316]
14001d1demov rdi, rax
14001d1e1call RandomNumber32
14001d1e6mov [rdi+16], r13l
14001d1eamov r9, rdi
14001d1edmov r8l, 202
14001d1f3mov [rdi], eax
14001d1f5mov eax, [rbp+56]
14001d1f8lea rdx, [rip+0x10031]
14001d1fflea rcx, [rip+48550]
14001d206mov [rdi+20], r12l
14001d20amov [rdi+36], eax
14001d20dmov eax, [rbp+64]
14001d210mov [rdi+24], rbx
14001d214mov [rdi+40], eax
14001d217mov rax, [r15+2326]
14001d21emov [rdi+32], r14l
14001d222mov [rdi+8], rsi
14001d226mov [rdi+48], rax
14001d22amov [r15+2326], rdi
14001d231call printf
14001d236
14001d236loc_14001d236:
14001d236lea rsp, [rbp-56]
14001d23amov rax, rdi
14001d23dpop rbx
14001d23epop rsi
14001d23fpop rdi
14001d240pop r12
14001d242pop r13
14001d244pop r14
14001d246pop r15
14001d248pop rbp
14001d249ret
14001cd20

14001d24a
14001d24a // align 0x10

14001d250
14001d250SocketPush:
14001d250sub rsp, 40
14001d254call SocketClients
14001d259call SocketRead
14001d25eadd rsp, 40
14001d262jmp 0x14001ca40
14001d250

14001d267
14001d267 // align 0x10

14001d270
14001d270SocketRead:
14001d270push r15
14001d272xor r9l, r9l
14001d275push r14
14001d277push r13
14001d279push r12
14001d27bpush rbp
14001d27cpush rdi
14001d27dpush rsi
14001d27epush rbx
14001d27fsub rsp, 104
14001d283mov r12, [rip+61670]
14001d28amov [rsp+80], r9
14001d28fmov [rsp+88], r9
14001d294mov rbx, [r12+2326]
14001d29c
14001d29cloc_14001d29c:
14001d29ctest rbx, rbx
14001d29fje 0x14001d566
14001d2a5mov eax, [rbx+16]
14001d2a8sub eax, 2
14001d2abcmp eax, 1
14001d2aeja 0x14001d55d
14001d2b4lea rax, [rsp+88]
14001d2b9xor ebp, ebp
14001d2bbxor r13l, r13l
14001d2bexor r14l, r14l
14001d2c1mov [rsp+64], rax
14001d2c6xor r15l, r15l
14001d2c9
14001d2c9loc_14001d2c9:
14001d2c9xor ecx, ecx
14001d2cbxor r8l, r8l
14001d2cemov edx, 0x4004667f
14001d2d3mov [rsp+88], ecx
14001d2d7mov rcx, [rbx+8]
14001d2dbmov [rsp+80], r8
14001d2e0mov r8, [rsp+64]
14001d2e5call [r12+1876]
14001d2edinc eax
14001d2efjne 0x14001d334
14001d2f1mov eax, [rbx+16]
14001d2f4mov r8l, 323
14001d2falea rdx, [rip+64767]
14001d301lea rcx, [rip+48361]
14001d308mov r15l, 1
14001d30emov [rsp+32], eax
14001d312mov r9l, [rbx]
14001d315call printf
14001d31axor eax, eax
14001d31ccmp [rbx+16], 3
14001d320setne al
14001d323add eax, 4
14001d326mov [rbx+16], eax
14001d329call [r12+1868]
14001d331mov r14l, eax
14001d334
14001d334loc_14001d334:
14001d334mov r8l, [rsp+88]
14001d339test r8l, r8l
14001d33cje 0x14001d45e
14001d342mov rax, [r12+2230]
14001d34amov edx, 8
14001d34fmov rax, [rax+96]
14001d353mov rcx, [rax+48]
14001d357call [r12+316]
14001d35fmov rcx, [rbx+8]
14001d363mov r9, [rsp+64]
14001d368mov r8l, [rsp+88]
14001d36dmov rdx, rax
14001d370mov [rsp+80], rax
14001d375call RecvAll
14001d37atest eax, eax
14001d37cjne 0x14001d38f
14001d37ecall [r12+1868]
14001d386mov r15l, 1
14001d38cmov r14l, eax
14001d38f
14001d38floc_14001d38f:
14001d38fmov eax, [rsp+88]
14001d393test eax, eax
14001d395je 0x14001d45e
14001d39btest r13, r13
14001d39ejne 0x14001d3b3
14001d3a0xor edx, edx
14001d3a2mov r13, [rsp+80]
14001d3a7mov ebp, eax
14001d3a9mov [rsp+80], rdx
14001d3aejmp 0x14001d45e
14001d3b3
14001d3b3loc_14001d3b3:
14001d3b3mov rdx, [r12+2230]
14001d3bblea r8l, [rax+rbp]
14001d3bfmov rsi, r13
14001d3c2mov rdx, [rdx+96]
14001d3c6mov rcx, [rdx+48]
14001d3camov edx, 8
14001d3cfcall [r12+316]
14001d3d7mov [rsp+56], rax
14001d3dcmov eax, ebp
14001d3demov rdi, [rsp+56]
14001d3e3mov rcx, rax
14001d3e6rep movsb [rdi], [rsi]
14001d3e8mov rcx, rax
14001d3ebxor eax, eax
14001d3edmov [rsp+72], rdi
14001d3f2mov rdi, r13
14001d3f5rep stosb [rdi], al
14001d3f7mov rax, [r12+2230]
14001d3ffmov r8, r13
14001d402xor edx, edx
14001d404mov rax, [rax+96]
14001d408mov rcx, [rax+48]
14001d40ccall [r12+332]
14001d414mov ecx, [rsp+88]
14001d418mov rsi, [rsp+80]
14001d41dxor eax, eax
14001d41fmov rdi, [rsp+72]
14001d424rep movsb [rdi], [rsi]
14001d426mov ecx, [rsp+88]
14001d42amov rdi, [rsp+80]
14001d42fadd ebp, ecx
14001d431rep stosb [rdi], al
14001d433mov rax, [r12+2230]
14001d43bmov r8, [rsp+80]
14001d440xor edx, edx
14001d442mov rax, [rax+96]
14001d446mov rcx, [rax+48]
14001d44acall [r12+332]
14001d452xor eax, eax
14001d454mov r13, [rsp+56]
14001d459mov [rsp+80], rax
14001d45e
14001d45eloc_14001d45e:
14001d45ecmp [rsp+88], 0
14001d463jne 0x14001d2c9
14001d469test ebp, ebp
14001d46bje 0x14001d4e1
14001d46dmov eax, [rbx]
14001d46fmov r9l, ebp
14001d472mov r8l, 379
14001d478lea rdx, [rip+64385]
14001d47flea rcx, [rip+48037]
14001d486mov [rsp+32], eax
14001d48acall printf
14001d48fmov ecx, 2540
14001d494call PackageCreate
14001d499mov edx, 17
14001d49emov rcx, rax
14001d4a1mov rsi, rax
14001d4a4call PackageAddInt32
14001d4a9mov edx, [rbx]
14001d4abmov rcx, rsi
14001d4aecall PackageAddInt32
14001d4b3mov edx, [rbx+16]
14001d4b6mov rcx, rsi
14001d4b9call PackageAddInt32
14001d4bemov edx, 1
14001d4c3mov rcx, rsi
14001d4c6call PackageAddInt32
14001d4cbmov rcx, rsi
14001d4cemov r8l, ebp
14001d4d1mov rdx, r13
14001d4d4call PackageAddBytes
14001d4d9mov rcx, rsi
14001d4dccall PackageTransmit
14001d4e1
14001d4e1loc_14001d4e1:
14001d4e1test r15l, r15l
14001d4e4je 0x14001d532
14001d4e6mov ecx, 2540
14001d4ebcall PackageCreate
14001d4f0mov edx, 17
14001d4f5mov rcx, rax
14001d4f8mov r15, rax
14001d4fbcall PackageAddInt32
14001d500mov edx, [rbx]
14001d502mov rcx, r15
14001d505call PackageAddInt32
14001d50amov edx, [rbx+16]
14001d50dmov rcx, r15
14001d510call PackageAddInt32
14001d515xor edx, edx
14001d517mov rcx, r15
14001d51acall PackageAddInt32
14001d51fmov rcx, r15
14001d522mov edx, r14l
14001d525call PackageAddInt32
14001d52amov rcx, r15
14001d52dcall PackageTransmit
14001d532
14001d532loc_14001d532:
14001d532test r13, r13
14001d535je 0x14001d55d
14001d537mov ecx, ebp
14001d539mov rdi, r13
14001d53cxor eax, eax
14001d53erep stosb [rdi], al
14001d540mov rax, [r12+2230]
14001d548mov r8, r13
14001d54bxor edx, edx
14001d54dmov rax, [rax+96]
14001d551mov rcx, [rax+48]
14001d555call [r12+332]
14001d55d
14001d55dloc_14001d55d:
14001d55dmov rbx, [rbx+48]
14001d561jmp 0x14001d29c
14001d566
14001d566loc_14001d566:
14001d566add rsp, 104
14001d56apop rbx
14001d56bpop rsi
14001d56cpop rdi
14001d56dpop rbp
14001d56epop r12
14001d570pop r13
14001d572pop r14
14001d574pop r15
14001d576ret
14001d270

14001d577
14001d577 // align 0x10

14001d580
14001d580SpoofRetAddr:
14001d580test r8, r8
14001d583je 0x14001d620
14001d589push rsi
14001d58amov rsi, r9
14001d58dpush rbx
14001d58emov rbx, r8
14001d591sub rsp, 120
14001d595call FindGadget
14001d59atest rax, rax
14001d59djne 0x14001d5a3
14001d59fxor eax, eax
14001d5a1jmp 0x14001d619
14001d5a3
14001d5a3loc_14001d5a3:
14001d5a3mov [rsp+88], rax
14001d5a8xor ecx, ecx
14001d5aamov rax, [rsp+224]
14001d5b2xor edx, edx
14001d5b4mov [rsp+40], rcx
14001d5b9mov r9, [rsp+192]
14001d5c1mov rcx, rsi
14001d5c4mov [rsp+72], rax
14001d5c9mov rax, [rsp+216]
14001d5d1mov [rsp+104], rdx
14001d5d6mov r8, [rsp+184]
14001d5demov [rsp+64], rax
14001d5e3mov rax, [rsp+208]
14001d5ebmov rdx, [rsp+176]
14001d5f3mov [rsp+96], rbx
14001d5f8mov [rsp+56], rax
14001d5fdmov rax, [rsp+200]
14001d605mov [rsp+48], rax
14001d60alea rax, [rsp+88]
14001d60fmov [rsp+32], rax
14001d614call Spoof
14001d619
14001d619loc_14001d619:
14001d619add rsp, 120
14001d61dpop rbx
14001d61epop rsi
14001d61fret
14001d620
14001d620loc_14001d620:
14001d620xor eax, eax
14001d622ret
14001d580

14001d623
14001d623 // align 0x10

14001d630
14001d630StringCompareIW:
14001d630push rsi
14001d631mov r11, rdx
14001d634xor r8l, r8l
14001d637push rbx
14001d638mov rbx, rcx
14001d63bsub rsp, 40
14001d63f
14001d63floc_14001d63f:
14001d63fmovzx ecx, [rbx+r8]
14001d644call ToLowerCaseW
14001d649mov r9l, ecx
14001d64cmovzx ecx, [r11+r8]
14001d651mov r10l, eax
14001d654call ToLowerCaseW
14001d659cmp r10w, ax
14001d65djne 0x14001d66d
14001d65fadd r8, 2
14001d663test r9w, r9w
14001d667jne 0x14001d63f
14001d669xor eax, eax
14001d66bjmp 0x14001d676
14001d66d
14001d66dloc_14001d66d:
14001d66dcmp r9w, cx
14001d671sbb eax, eax
14001d673or eax, 1
14001d676
14001d676loc_14001d676:
14001d676add rsp, 40
14001d67apop rbx
14001d67bpop rsi
14001d67cret
14001d630

14001d67d
14001d67d // align 0x10

14001d680
14001d680StringCompareW:
14001d680xor eax, eax
14001d682
14001d682loc_14001d682:
14001d682mov r8w, [rcx+rax]
14001d687cmp r8w, [rdx+rax]
14001d68cjne 0x14001d69b
14001d68eadd rax, 2
14001d692test r8w, r8w
14001d696jne 0x14001d682
14001d698xor eax, eax
14001d69aret
14001d69b
14001d69bloc_14001d69b:
14001d69bsbb eax, eax
14001d69dor eax, 1
14001d6a0ret
14001d680

14001d6a1
14001d6a1 // align 0x10

14001d6b0
14001d6b0StringConcatW:
14001d6b0sub rsp, 40
14001d6b4mov r9, rcx
14001d6b7call StringLengthW
14001d6bclea rcx, [rcx+2*rax]
14001d6c0call StringCopyW
14001d6c5mov rax, r9
14001d6c8add rsp, 40
14001d6ccret
14001d6b0

14001d6cd
14001d6cd // align 0x10

14001d6d0
14001d6d0StringCopyA:
14001d6d0mov rax, rcx
14001d6d3xor ecx, ecx
14001d6d5
14001d6d5loc_14001d6d5:
14001d6d5mov r8b, [rdx+rcx]
14001d6d9mov [rax+rcx], r8b
14001d6ddinc rcx
14001d6e0test r8b, r8b
14001d6e3jne 0x14001d6d5
14001d6e5ret
14001d6d0

14001d6e6
14001d6e6 // align 0x10

14001d6f0
14001d6f0StringCopyW:
14001d6f0mov rax, rcx
14001d6f3xor ecx, ecx
14001d6f5
14001d6f5loc_14001d6f5:
14001d6f5mov r8w, [rdx+rcx]
14001d6famov [rax+rcx], r8w
14001d6ffadd rcx, 2
14001d703test r8w, r8w
14001d707jne 0x14001d6f5
14001d709ret
14001d6f0

14001d70a
14001d70a // align 0x10

14001d710
14001d710StringLengthA:
14001d710xor eax, eax
14001d712test rcx, rcx
14001d715je 0x14001d727
14001d717mov rax, rcx
14001d71a
14001d71aloc_14001d71a:
14001d71acmp [rax], 0
14001d71dje 0x14001d724
14001d71finc rax
14001d722jmp 0x14001d71a
14001d724
14001d724loc_14001d724:
14001d724sub rax, rcx
14001d727
14001d727loc_14001d727:
14001d727ret
14001d710

14001d728
14001d728 // align 0x10

14001d730
14001d730StringLengthW:
14001d730mov rax, rcx
14001d733
14001d733loc_14001d733:
14001d733cmp [rax], 0
14001d737je 0x14001d73f
14001d739add rax, 2
14001d73djmp 0x14001d733
14001d73f
14001d73floc_14001d73f:
14001d73fsub rax, rcx
14001d742sar rax, 1
14001d745ret
14001d730

14001d746
14001d746 // align 0x10

14001d750
14001d750StringTokenA:
14001d750mov rax, rcx
14001d753test rcx, rcx
14001d756je 0x14001d7ab
14001d758
14001d758loc_14001d758:
14001d758mov r10, rax
14001d75bmovsx r8l, [rax]
14001d75finc rax
14001d762mov rcx, rdx
14001d765
14001d765loc_14001d765:
14001d765movsx r9l, [rcx]
14001d769inc rcx
14001d76ctest r9l, r9l
14001d76fje 0x14001d778
14001d771cmp r8l, r9l
14001d774jne 0x14001d765
14001d776jmp 0x14001d758
14001d778
14001d778loc_14001d778:
14001d778test r8l, r8l
14001d77bje 0x14001d7a9
14001d77d
14001d77dloc_14001d77d:
14001d77dmovsx r9l, [rax]
14001d781inc rax
14001d784mov rcx, rdx
14001d787
14001d787loc_14001d787:
14001d787movsx r8l, [rcx]
14001d78binc rcx
14001d78ecmp r9l, r8l
14001d791jne 0x14001d7a2
14001d793test r9l, r9l
14001d796jne 0x14001d79c
14001d798
14001d798loc_14001d798:
14001d798mov rax, r10
14001d79bret
14001d79c
14001d79cloc_14001d79c:
14001d79cmov [rax-1], 0
14001d7a0jmp 0x14001d798
14001d7a2
14001d7a2loc_14001d7a2:
14001d7a2test r8l, r8l
14001d7a5jne 0x14001d787
14001d7a7jmp 0x14001d77d
14001d7a9
14001d7a9loc_14001d7a9:
14001d7a9xor eax, eax
14001d7ab
14001d7abloc_14001d7ab:
14001d7abret
14001d750

14001d7ac
14001d7ac // align 0x10

14001d7b0
14001d7b0SymbolIncludesLibrary:
14001d7b0push rbx
14001d7b1xor r8l, r8l
14001d7b4mov edx, 6
14001d7b9mov rbx, rcx
14001d7bcsub rsp, 32
14001d7c0call HashEx
14001d7c5cmp eax, 0xffffffffec6ba2a8
14001d7caje 0x14001d7d0
14001d7cc
14001d7ccloc_14001d7cc:
14001d7ccxor eax, eax
14001d7cejmp 0x14001d7f5
14001d7d0
14001d7d0loc_14001d7d0:
14001d7d0mov rcx, rbx
14001d7d3call StringLengthA
14001d7d8mov edx, 7
14001d7dddec rax
14001d7e0
14001d7e0loc_14001d7e0:
14001d7e0cmp rdx, rax
14001d7e3jae 0x14001d7cc
14001d7e5cmp [rbx+rdx], 36
14001d7e9je 0x14001d7f0
14001d7ebinc rdx
14001d7eejmp 0x14001d7e0
14001d7f0
14001d7f0loc_14001d7f0:
14001d7f0mov eax, 1
14001d7f5
14001d7f5loc_14001d7f5:
14001d7f5add rsp, 32
14001d7f9pop rbx
14001d7faret
14001d7b0

14001d7fb
14001d7fb // align 0x10

14001d800
14001d800SymbolIsImport:
14001d800sub rsp, 40
14001d804xor r8l, r8l
14001d807mov edx, 6
14001d80ccall HashEx
14001d811cmp eax, 0xffffffffec6ba2a8
14001d816sete al
14001d819add rsp, 40
14001d81dmovzx eax, al
14001d820ret
14001d800

14001d821
14001d821 // align 0x10

14001d830
14001d830SysDuplicateTokenEx:
14001d830push rdi
14001d831xor eax, eax
14001d833mov r10, rcx
14001d836mov ecx, 12
14001d83bpush rsi
14001d83cpush rbx
14001d83dsub rsp, 112
14001d841lea rdi, [rsp+64]
14001d846mov [rsp+52], 12
14001d84erep stosd [rdi], eax
14001d850xor eax, eax
14001d852mov [rsp+56], r9l
14001d857mov [rsp+60], eax
14001d85bmov [rsp+64], 48
14001d863test r8, r8
14001d866je 0x14001d881
14001d868xor eax, eax
14001d86acmp [r8+16], 0
14001d86fsetne al
14001d872add eax, eax
14001d874mov [rsp+88], eax
14001d878mov rax, [r8+8]
14001d87cmov [rsp+96], rax
14001d881
14001d881loc_14001d881:
14001d881lea rax, [rsp+52]
14001d886xor r9l, r9l
14001d889lea r8, [rsp+64]
14001d88emov rcx, r10
14001d891mov [rsp+104], rax
14001d896mov rax, [rsp+184]
14001d89emov [rsp+40], rax
14001d8a3mov eax, [rsp+176]
14001d8aamov [rsp+32], eax
14001d8aecall SysNtDuplicateToken
14001d8b3mov ebx, eax
14001d8b5mov eax, 1
14001d8batest ebx, ebx
14001d8bcjns 0x14001d901
14001d8bemov rsi, [rip+60075]
14001d8c5mov ecx, ebx
14001d8c7call [rsi+348]
14001d8cdmov r9l, ebx
14001d8d0mov r8l, 400
14001d8d6lea rdx, [rip+64483]
14001d8ddmov [rsp+32], eax
14001d8e1lea rcx, [rip+49224]
14001d8e8call printf
14001d8edmov rdi, [rsi+2230]
14001d8f4mov ecx, ebx
14001d8f6call [rsi+348]
14001d8fcmov [rdi+104], eax
14001d8ffxor eax, eax
14001d901
14001d901loc_14001d901:
14001d901add rsp, 112
14001d905pop rbx
14001d906pop rsi
14001d907pop rdi
14001d908ret
14001d830

14001d909
14001d909 // align 0x10

14001d910
14001d910SysExtract:
14001d910push rsi
14001d911push rbx
14001d912sub rsp, 40
14001d916test rcx, rcx
14001d919jne 0x14001d938
14001d91blea r9, [rip+48057]
14001d922mov r8l, 104
14001d928lea rdx, [rip+61361]
14001d92flea rcx, [rip+48017]
14001d936jmp 0x14001d966
14001d938
14001d938loc_14001d938:
14001d938mov r10l, edx
14001d93bmov rdx, r8
14001d93exor r8l, r8l
14001d941mov rbx, rcx
14001d944mov rax, rdx
14001d947mov rsi, r9
14001d94aor rax, r9
14001d94djne 0x14001d97b
14001d94fmov r9, rcx
14001d952mov r8l, 110
14001d958lea rdx, [rip+61313]
14001d95flea rcx, [rip+48021]
14001d966
14001d966loc_14001d966:
14001d966call printf
14001d96b
14001d96bloc_14001d96b:
14001d96bxor eax, eax
14001d96djmp 0x14001da45
14001d972
14001d972loc_14001d972:
14001d972cmp r9b, 76
14001d976je 0x14001d98d
14001d978
14001d978loc_14001d978:
14001d978inc r8l
14001d97b
14001d97bloc_14001d97b:
14001d97bmov ecx, r8l
14001d97elea rax, [rbx+rcx]
14001d982mov r9, [rax]
14001d985cmp r9b, -61
14001d989jne 0x14001d972
14001d98bjmp 0x14001d9e5
14001d98d
14001d98dloc_14001d98d:
14001d98dcmp [rbx+rcx+1], -117
14001d992jne 0x14001d978
14001d994cmp [rbx+rcx+2], -47
14001d999jne 0x14001d978
14001d99bcmp [rbx+rcx+3], -72
14001d9a0jne 0x14001d978
14001d9a2test rdx, rdx
14001d9a5jne 0x14001d9b3
14001d9a7test rsi, rsi
14001d9aaje 0x14001d96b
14001d9ac
14001d9acloc_14001d9ac:
14001d9aclea rcx, [rbx+rcx+30]
14001d9b1jmp 0x14001d9d9
14001d9b3
14001d9b3loc_14001d9b3:
14001d9b3movzx r9l, [rbx+rcx+5]
14001d9b9movzx r8l, [rbx+rcx+4]
14001d9bfshl r9l, 8
14001d9c3or r8l, r9l
14001d9c6mov [rdx], r8w
14001d9catest rsi, rsi
14001d9cdjne 0x14001d9ac
14001d9cfjmp 0x14001da40
14001d9d1
14001d9d1loc_14001d9d1:
14001d9d1inc rax
14001d9d4cmp rcx, rax
14001d9d7je 0x14001d9e5
14001d9d9
14001d9d9loc_14001d9d9:
14001d9d9cmp [rax], 1295
14001d9dejne 0x14001d9d1
14001d9e0mov [rsi], rax
14001d9e3jmp 0x14001da40
14001d9e5
14001d9e5loc_14001d9e5:
14001d9e5test rdx, rdx
14001d9e8je 0x14001da1b
14001d9eatest r10l, r10l
14001d9edjne 0x14001da0d
14001d9ef
14001d9efloc_14001d9ef:
14001d9efmov r9, rbx
14001d9f2mov r8l, 184
14001d9f8lea rdx, [rip+61153]
14001d9fflea rcx, [rip+47931]
14001da06call printf
14001da0bjmp 0x14001da1b
14001da0d
14001da0dloc_14001da0d:
14001da0dmov rcx, rbx
14001da10call FindSsnOfHookedSyscall
14001da15test eax, eax
14001da17je 0x14001d9ef
14001da19jmp 0x14001da45
14001da1b
14001da1bloc_14001da1b:
14001da1btest rsi, rsi
14001da1eje 0x14001d96b
14001da24mov r9, rbx
14001da27mov r8l, 188
14001da2dlea rdx, [rip+61100]
14001da34lea rcx, [rip+47941]
14001da3bjmp 0x14001d966
14001da40
14001da40loc_14001da40:
14001da40mov eax, 1
14001da45
14001da45loc_14001da45:
14001da45add rsp, 40
14001da49pop rbx
14001da4apop rsi
14001da4bret
14001d910

14001da4c
14001da4c // align 0x10

14001da50
14001da50SysImpersonateLoggedOnUser:
14001da50push rdi
14001da51xor eax, eax
14001da53xor r8l, r8l
14001da56xor r9l, r9l
14001da59push rsi
14001da5axor r11l, r11l
14001da5dxor r10l, r10l
14001da60mov edx, 8
14001da65push rbx
14001da66mov rbx, rcx
14001da69mov ecx, 12
14001da6esub rsp, 144
14001da75lea rdi, [rsp+96]
14001da7amov [rsp+84], r8
14001da7flea r8, [rsp+64]
14001da84rep stosd [rdi], eax
14001da86lea rax, [rsp+68]
14001da8bmov [rsp+92], r9l
14001da90mov rcx, rbx
14001da93mov [rsp+32], rax
14001da98mov r9l, 4
14001da9emov [rsp+72], r10
14001daa3mov [rsp+64], r11l
14001daa8mov [rsp+68], r11l
14001daadcall SysNtQueryInformationToken
14001dab2test eax, eax
14001dab4jns 0x14001daeb
14001dab6mov ecx, eax
14001dab8mov [rsp+60], eax
14001dabcmov rax, [rip+59565]
14001dac3call [rax+348]
14001dac9mov r9l, [rsp+60]
14001dacemov r8l, 1300
14001dad4lea rdx, [rip+60949]
14001dadbmov [rsp+32], eax
14001dadflea rcx, [rip+49627]
14001dae6jmp 0x14001dbea
14001daeb
14001daebloc_14001daeb:
14001daebcmp [rsp+64], 1
14001daf0lea rsi, [rsp+72]
14001daf5jne 0x14001db96
14001dafbmov eax, 0xffffffff80000003
14001db00mov [rsp+40], rsi
14001db05xor edx, edx
14001db07xor ecx, ecx
14001db09shl rax, 2
14001db0dmov [rsp+120], edx
14001db11xor r9l, r9l
14001db14lea r8, [rsp+96]
14001db19mov [rsp+32], 2
14001db21mov edx, 12
14001db26mov [rsp+84], rax
14001db2bxor eax, eax
14001db2dmov [rsp+104], rax
14001db32mov [rsp+112], rax
14001db37lea rax, [rsp+84]
14001db3cmov [rsp+128], rcx
14001db44mov rcx, rbx
14001db47mov [rsp+92], 1
14001db4emov [rsp+96], 48
14001db56mov [rsp+136], rax
14001db5ecall SysNtDuplicateToken
14001db63test eax, eax
14001db65jns 0x14001db6e
14001db67
14001db67loc_14001db67:
14001db67xor eax, eax
14001db69jmp 0x14001dbf4
14001db6e
14001db6eloc_14001db6e:
14001db6emov r9l, 8
14001db74mov r8, rsi
14001db77mov edx, 5
14001db7cmov rcx, -2
14001db83call SysNtSetInformationThread
14001db88mov rcx, [rsp+72]
14001db8dmov ebx, eax
14001db8fcall SysNtClose
14001db94jmp 0x14001dbb7
14001db96
14001db96loc_14001db96:
14001db96mov r9l, 8
14001db9cmov r8, rsi
14001db9fmov edx, 5
14001dba4mov rcx, -2
14001dbabmov [rsp+72], rbx
14001dbb0call SysNtSetInformationThread
14001dbb5mov ebx, eax
14001dbb7
14001dbb7loc_14001dbb7:
14001dbb7mov eax, 1
14001dbbctest ebx, ebx
14001dbbejns 0x14001dbf4
14001dbc0mov rax, [rip+59305]
14001dbc7mov ecx, ebx
14001dbc9call [rax+348]
14001dbcfmov r9l, ebx
14001dbd2mov r8l, 1354
14001dbd8lea rdx, [rip+60689]
14001dbdfmov [rsp+32], eax
14001dbe3lea rcx, [rip+49429]
14001dbea
14001dbealoc_14001dbea:
14001dbeacall printf
14001dbefjmp 0x14001db67
14001dbf4
14001dbf4loc_14001dbf4:
14001dbf4add rsp, 144
14001dbfbpop rbx
14001dbfcpop rsi
14001dbfdpop rdi
14001dbferet
14001da50

14001dbff
14001dbff // align 0x10

14001dc00
14001dc00SysInitialize:
14001dc00push rbx
14001dc01xor eax, eax
14001dc03sub rsp, 64
14001dc07mov [rsp+56], rax
14001dc0cxor eax, eax
14001dc0etest rcx, rcx
14001dc11je 0x14001e861
14001dc17mov edx, 0xffffffff8cfcc776
14001dc1ccall LdrFunctionAddr
14001dc21mov rbx, [rip+59208]
14001dc28test rax, rax
14001dc2bmov rcx, rax
14001dc2eje 0x14001dc75
14001dc30lea r9, [rsp+56]
14001dc35xor r8l, r8l
14001dc38mov edx, 1
14001dc3dcall SysExtract
14001dc42mov rax, [rsp+56]
14001dc47test rax, rax
14001dc4aje 0x14001dc55
14001dc4cmov [rbx+2028], rax
14001dc53jmp 0x14001dc75
14001dc55
14001dc55loc_14001dc55:
14001dc55lea r9, [rip+47463]
14001dc5cmov r8l, 32
14001dc62lea rdx, [rip+61639]
14001dc69lea rcx, [rip+47191]
14001dc70call printf
14001dc75
14001dc75loc_14001dc75:
14001dc75mov rcx, [rbx+492]
14001dc7ctest rcx, rcx
14001dc7fje 0x14001dccc
14001dc81xor r9l, r9l
14001dc84lea r8, [rbx+2040]
14001dc8bmov edx, 1
14001dc90call SysExtract
14001dc95mov rax, [rbx+492]
14001dc9clea r9, [rip+47426]
14001dca3mov r8l, 44
14001dca9lea rdx, [rip+61568]
14001dcb0lea rcx, [rip+47419]
14001dcb7mov [rsp+40], rax
14001dcbcmovzx eax, [rbx+2040]
14001dcc3mov [rsp+32], eax
14001dcc7call printf
14001dccc
14001dcccloc_14001dccc:
14001dcccmov rcx, [rbx+500]
14001dcd3test rcx, rcx
14001dcd6je 0x14001dd23
14001dcd8xor r9l, r9l
14001dcdblea r8, [rbx+2042]
14001dce2mov edx, 1
14001dce7call SysExtract
14001dcecmov rax, [rbx+500]
14001dcf3lea r9, [rip+47404]
14001dcfamov r8l, 45
14001dd00lea rdx, [rip+61481]
14001dd07lea rcx, [rip+47332]
14001dd0emov [rsp+40], rax
14001dd13movzx eax, [rbx+2042]
14001dd1amov [rsp+32], eax
14001dd1ecall printf
14001dd23
14001dd23loc_14001dd23:
14001dd23mov rcx, [rbx+516]
14001dd2atest rcx, rcx
14001dd2dje 0x14001dd7a
14001dd2fxor r9l, r9l
14001dd32lea r8, [rbx+2046]
14001dd39mov edx, 1
14001dd3ecall SysExtract
14001dd43mov rax, [rbx+516]
14001dd4alea r9, [rip+47335]
14001dd51mov r8l, 46
14001dd57lea rdx, [rip+61394]
14001dd5elea rcx, [rip+47245]
14001dd65mov [rsp+40], rax
14001dd6amovzx eax, [rbx+2046]
14001dd71mov [rsp+32], eax
14001dd75call printf
14001dd7a
14001dd7aloc_14001dd7a:
14001dd7amov rcx, [rbx+508]
14001dd81test rcx, rcx
14001dd84je 0x14001ddd1
14001dd86xor r9l, r9l
14001dd89lea r8, [rbx+2044]
14001dd90mov edx, 1
14001dd95call SysExtract
14001dd9amov rax, [rbx+508]
14001dda1lea r9, [rip+47262]
14001dda8mov r8l, 47
14001ddaelea rdx, [rip+61307]
14001ddb5lea rcx, [rip+47158]
14001ddbcmov [rsp+40], rax
14001ddc1movzx eax, [rbx+2044]
14001ddc8mov [rsp+32], eax
14001ddcccall printf
14001ddd1
14001ddd1loc_14001ddd1:
14001ddd1mov rcx, [rbx+524]
14001ddd8test rcx, rcx
14001dddbje 0x14001de28
14001ddddxor r9l, r9l
14001dde0lea r8, [rbx+2048]
14001dde7mov edx, 1
14001ddeccall SysExtract
14001ddf1mov rax, [rbx+524]
14001ddf8lea r9, [rip+47194]
14001ddffmov r8l, 48
14001de05lea rdx, [rip+61220]
14001de0clea rcx, [rip+47071]
14001de13mov [rsp+40], rax
14001de18movzx eax, [rbx+2048]
14001de1fmov [rsp+32], eax
14001de23call printf
14001de28
14001de28loc_14001de28:
14001de28mov rcx, [rbx+532]
14001de2ftest rcx, rcx
14001de32je 0x14001de7f
14001de34xor r9l, r9l
14001de37lea r8, [rbx+2050]
14001de3emov edx, 1
14001de43call SysExtract
14001de48mov rax, [rbx+532]
14001de4flea r9, [rip+47126]
14001de56mov r8l, 49
14001de5clea rdx, [rip+61133]
14001de63lea rcx, [rip+46984]
14001de6amov [rsp+40], rax
14001de6fmovzx eax, [rbx+2050]
14001de76mov [rsp+32], eax
14001de7acall printf
14001de7f
14001de7floc_14001de7f:
14001de7fmov rcx, [rbx+540]
14001de86test rcx, rcx
14001de89je 0x14001ded6
14001de8bxor r9l, r9l
14001de8elea r8, [rbx+2052]
14001de95mov edx, 1
14001de9acall SysExtract
14001de9fmov rax, [rbx+540]
14001dea6lea r9, [rip+47056]
14001deadmov r8l, 50
14001deb3lea rdx, [rip+61046]
14001debalea rcx, [rip+46897]
14001dec1mov [rsp+40], rax
14001dec6movzx eax, [rbx+2052]
14001decdmov [rsp+32], eax
14001ded1call printf
14001ded6
14001ded6loc_14001ded6:
14001ded6mov rcx, [rbx+548]
14001deddtest rcx, rcx
14001dee0je 0x14001df2d
14001dee2xor r9l, r9l
14001dee5lea r8, [rbx+2054]
14001deecmov edx, 1
14001def1call SysExtract
14001def6mov rax, [rbx+548]
14001defdlea r9, [rip+46986]
14001df04mov r8l, 51
14001df0alea rdx, [rip+60959]
14001df11lea rcx, [rip+46810]
14001df18mov [rsp+40], rax
14001df1dmovzx eax, [rbx+2054]
14001df24mov [rsp+32], eax
14001df28call printf
14001df2d
14001df2dloc_14001df2d:
14001df2dmov rcx, [rbx+556]
14001df34test rcx, rcx
14001df37je 0x14001df84
14001df39xor r9l, r9l
14001df3clea r8, [rbx+2056]
14001df43mov edx, 1
14001df48call SysExtract
14001df4dmov rax, [rbx+556]
14001df54lea r9, [rip+46915]
14001df5bmov r8l, 52
14001df61lea rdx, [rip+60872]
14001df68lea rcx, [rip+46723]
14001df6fmov [rsp+40], rax
14001df74movzx eax, [rbx+2056]
14001df7bmov [rsp+32], eax
14001df7fcall printf
14001df84
14001df84loc_14001df84:
14001df84mov rcx, [rbx+564]
14001df8btest rcx, rcx
14001df8eje 0x14001dfdb
14001df90xor r9l, r9l
14001df93lea r8, [rbx+2058]
14001df9amov edx, 1
14001df9fcall SysExtract
14001dfa4mov rax, [rbx+564]
14001dfablea r9, [rip+46843]
14001dfb2mov r8l, 53
14001dfb8lea rdx, [rip+60785]
14001dfbflea rcx, [rip+46636]
14001dfc6mov [rsp+40], rax
14001dfcbmovzx eax, [rbx+2058]
14001dfd2mov [rsp+32], eax
14001dfd6call printf
14001dfdb
14001dfdbloc_14001dfdb:
14001dfdbmov rcx, [rbx+572]
14001dfe2test rcx, rcx
14001dfe5je 0x14001e032
14001dfe7xor r9l, r9l
14001dfealea r8, [rbx+2060]
14001dff1mov edx, 1
14001dff6call SysExtract
14001dffbmov rax, [rbx+572]
14001e002lea r9, [rip+46770]
14001e009mov r8l, 54
14001e00flea rdx, [rip+60698]
14001e016lea rcx, [rip+46549]
14001e01dmov [rsp+40], rax
14001e022movzx eax, [rbx+2060]
14001e029mov [rsp+32], eax
14001e02dcall printf
14001e032
14001e032loc_14001e032:
14001e032mov rcx, [rbx+580]
14001e039test rcx, rcx
14001e03cje 0x14001e089
14001e03exor r9l, r9l
14001e041lea r8, [rbx+2062]
14001e048mov edx, 1
14001e04dcall SysExtract
14001e052mov rax, [rbx+580]
14001e059lea r9, [rip+46700]
14001e060mov r8l, 55
14001e066lea rdx, [rip+60611]
14001e06dlea rcx, [rip+46462]
14001e074mov [rsp+40], rax
14001e079movzx eax, [rbx+2062]
14001e080mov [rsp+32], eax
14001e084call printf
14001e089
14001e089loc_14001e089:
14001e089mov rcx, [rbx+588]
14001e090test rcx, rcx
14001e093je 0x14001e0e0
14001e095xor r9l, r9l
14001e098lea r8, [rbx+2064]
14001e09fmov edx, 1
14001e0a4call SysExtract
14001e0a9mov rax, [rbx+588]
14001e0b0lea r9, [rip+46631]
14001e0b7mov r8l, 56
14001e0bdlea rdx, [rip+60524]
14001e0c4lea rcx, [rip+46375]
14001e0cbmov [rsp+40], rax
14001e0d0movzx eax, [rbx+2064]
14001e0d7mov [rsp+32], eax
14001e0dbcall printf
14001e0e0
14001e0e0loc_14001e0e0:
14001e0e0mov rcx, [rbx+596]
14001e0e7test rcx, rcx
14001e0eaje 0x14001e137
14001e0ecxor r9l, r9l
14001e0eflea r8, [rbx+2066]
14001e0f6mov edx, 1
14001e0fbcall SysExtract
14001e100mov rax, [rbx+596]
14001e107lea r9, [rip+46563]
14001e10emov r8l, 57
14001e114lea rdx, [rip+60437]
14001e11blea rcx, [rip+46288]
14001e122mov [rsp+40], rax
14001e127movzx eax, [rbx+2066]
14001e12emov [rsp+32], eax
14001e132call printf
14001e137
14001e137loc_14001e137:
14001e137mov rcx, [rbx+604]
14001e13etest rcx, rcx
14001e141je 0x14001e18e
14001e143xor r9l, r9l
14001e146lea r8, [rbx+2068]
14001e14dmov edx, 1
14001e152call SysExtract
14001e157mov rax, [rbx+604]
14001e15elea r9, [rip+46495]
14001e165mov r8l, 58
14001e16blea rdx, [rip+60350]
14001e172lea rcx, [rip+46201]
14001e179mov [rsp+40], rax
14001e17emovzx eax, [rbx+2068]
14001e185mov [rsp+32], eax
14001e189call printf
14001e18e
14001e18eloc_14001e18e:
14001e18emov rcx, [rbx+612]
14001e195test rcx, rcx
14001e198je 0x14001e1e5
14001e19axor r9l, r9l
14001e19dlea r8, [rbx+2070]
14001e1a4mov edx, 1
14001e1a9call SysExtract
14001e1aemov rax, [rbx+612]
14001e1b5lea r9, [rip+46434]
14001e1bcmov r8l, 59
14001e1c2lea rdx, [rip+60263]
14001e1c9lea rcx, [rip+46114]
14001e1d0mov [rsp+40], rax
14001e1d5movzx eax, [rbx+2070]
14001e1dcmov [rsp+32], eax
14001e1e0call printf
14001e1e5
14001e1e5loc_14001e1e5:
14001e1e5mov rcx, [rbx+620]
14001e1ectest rcx, rcx
14001e1efje 0x14001e23c
14001e1f1xor r9l, r9l
14001e1f4lea r8, [rbx+2072]
14001e1fbmov edx, 1
14001e200call SysExtract
14001e205mov rax, [rbx+620]
14001e20clea r9, [rip+46372]
14001e213mov r8l, 60
14001e219lea rdx, [rip+60176]
14001e220lea rcx, [rip+46027]
14001e227mov [rsp+40], rax
14001e22cmovzx eax, [rbx+2072]
14001e233mov [rsp+32], eax
14001e237call printf
14001e23c
14001e23cloc_14001e23c:
14001e23cmov rcx, [rbx+636]
14001e243test rcx, rcx
14001e246je 0x14001e293
14001e248xor r9l, r9l
14001e24blea r8, [rbx+2074]
14001e252mov edx, 1
14001e257call SysExtract
14001e25cmov rax, [rbx+636]
14001e263lea r9, [rip+46307]
14001e26amov r8l, 61
14001e270lea rdx, [rip+60089]
14001e277lea rcx, [rip+45940]
14001e27emov [rsp+40], rax
14001e283movzx eax, [rbx+2074]
14001e28amov [rsp+32], eax
14001e28ecall printf
14001e293
14001e293loc_14001e293:
14001e293mov rcx, [rbx+644]
14001e29atest rcx, rcx
14001e29dje 0x14001e2ea
14001e29fxor r9l, r9l
14001e2a2lea r8, [rbx+2076]
14001e2a9mov edx, 1
14001e2aecall SysExtract
14001e2b3mov rax, [rbx+644]
14001e2balea r9, [rip+46244]
14001e2c1mov r8l, 62
14001e2c7lea rdx, [rip+60002]
14001e2celea rcx, [rip+45853]
14001e2d5mov [rsp+40], rax
14001e2damovzx eax, [rbx+2076]
14001e2e1mov [rsp+32], eax
14001e2e5call printf
14001e2ea
14001e2ealoc_14001e2ea:
14001e2eamov rcx, [rbx+652]
14001e2f1test rcx, rcx
14001e2f4je 0x14001e341
14001e2f6xor r9l, r9l
14001e2f9lea r8, [rbx+2078]
14001e300mov edx, 1
14001e305call SysExtract
14001e30amov rax, [rbx+652]
14001e311lea r9, [rip+46178]
14001e318mov r8l, 63
14001e31elea rdx, [rip+59915]
14001e325lea rcx, [rip+45766]
14001e32cmov [rsp+40], rax
14001e331movzx eax, [rbx+2078]
14001e338mov [rsp+32], eax
14001e33ccall printf
14001e341
14001e341loc_14001e341:
14001e341mov rcx, [rbx+660]
14001e348test rcx, rcx
14001e34bje 0x14001e398
14001e34dxor r9l, r9l
14001e350lea r8, [rbx+2080]
14001e357mov edx, 1
14001e35ccall SysExtract
14001e361mov rax, [rbx+660]
14001e368lea r9, [rip+46111]
14001e36fmov r8l, 64
14001e375lea rdx, [rip+59828]
14001e37clea rcx, [rip+45679]
14001e383mov [rsp+40], rax
14001e388movzx eax, [rbx+2080]
14001e38fmov [rsp+32], eax
14001e393call printf
14001e398
14001e398loc_14001e398:
14001e398mov rcx, [rbx+668]
14001e39ftest rcx, rcx
14001e3a2je 0x14001e3ef
14001e3a4xor r9l, r9l
14001e3a7lea r8, [rbx+2082]
14001e3aemov edx, 1
14001e3b3call SysExtract
14001e3b8mov rax, [rbx+668]
14001e3bflea r9, [rip+46044]
14001e3c6mov r8l, 65
14001e3cclea rdx, [rip+59741]
14001e3d3lea rcx, [rip+45592]
14001e3damov [rsp+40], rax
14001e3dfmovzx eax, [rbx+2082]
14001e3e6mov [rsp+32], eax
14001e3eacall printf
14001e3ef
14001e3efloc_14001e3ef:
14001e3efmov rcx, [rbx+676]
14001e3f6test rcx, rcx
14001e3f9je 0x14001e446
14001e3fbxor r9l, r9l
14001e3felea r8, [rbx+2084]
14001e405mov edx, 1
14001e40acall SysExtract
14001e40fmov rax, [rbx+676]
14001e416lea r9, [rip+45978]
14001e41dmov r8l, 66
14001e423lea rdx, [rip+59654]
14001e42alea rcx, [rip+45505]
14001e431mov [rsp+40], rax
14001e436movzx eax, [rbx+2084]
14001e43dmov [rsp+32], eax
14001e441call printf
14001e446
14001e446loc_14001e446:
14001e446mov rcx, [rbx+684]
14001e44dtest rcx, rcx
14001e450je 0x14001e49d
14001e452xor r9l, r9l
14001e455lea r8, [rbx+2086]
14001e45cmov edx, 1
14001e461call SysExtract
14001e466mov rax, [rbx+684]
14001e46dlea r9, [rip+45914]
14001e474mov r8l, 67
14001e47alea rdx, [rip+59567]
14001e481lea rcx, [rip+45418]
14001e488mov [rsp+40], rax
14001e48dmovzx eax, [rbx+2086]
14001e494mov [rsp+32], eax
14001e498call printf
14001e49d
14001e49dloc_14001e49d:
14001e49dmov rcx, [rbx+700]
14001e4a4test rcx, rcx
14001e4a7je 0x14001e4f4
14001e4a9xor r9l, r9l
14001e4aclea r8, [rbx+2088]
14001e4b3mov edx, 1
14001e4b8call SysExtract
14001e4bdmov rax, [rbx+700]
14001e4c4lea r9, [rip+45845]
14001e4cbmov r8l, 68
14001e4d1lea rdx, [rip+59480]
14001e4d8lea rcx, [rip+45331]
14001e4dfmov [rsp+40], rax
14001e4e4movzx eax, [rbx+2088]
14001e4ebmov [rsp+32], eax
14001e4efcall printf
14001e4f4
14001e4f4loc_14001e4f4:
14001e4f4mov rcx, [rbx+708]
14001e4fbtest rcx, rcx
14001e4feje 0x14001e54b
14001e500xor r9l, r9l
14001e503lea r8, [rbx+2090]
14001e50amov edx, 1
14001e50fcall SysExtract
14001e514mov rax, [rbx+708]
14001e51blea r9, [rip+45778]
14001e522mov r8l, 69
14001e528lea rdx, [rip+59393]
14001e52flea rcx, [rip+45244]
14001e536mov [rsp+40], rax
14001e53bmovzx eax, [rbx+2090]
14001e542mov [rsp+32], eax
14001e546call printf
14001e54b
14001e54bloc_14001e54b:
14001e54bmov rcx, [rbx+716]
14001e552test rcx, rcx
14001e555je 0x14001e5a2
14001e557xor r9l, r9l
14001e55alea r8, [rbx+2092]
14001e561mov edx, 1
14001e566call SysExtract
14001e56bmov rax, [rbx+716]
14001e572lea r9, [rip+45722]
14001e579mov r8l, 70
14001e57flea rdx, [rip+59306]
14001e586lea rcx, [rip+45157]
14001e58dmov [rsp+40], rax
14001e592movzx eax, [rbx+2092]
14001e599mov [rsp+32], eax
14001e59dcall printf
14001e5a2
14001e5a2loc_14001e5a2:
14001e5a2mov rcx, [rbx+724]
14001e5a9test rcx, rcx
14001e5acje 0x14001e5f9
14001e5aexor r9l, r9l
14001e5b1lea r8, [rbx+2094]
14001e5b8mov edx, 1
14001e5bdcall SysExtract
14001e5c2mov rax, [rbx+724]
14001e5c9lea r9, [rip+45656]
14001e5d0mov r8l, 71
14001e5d6lea rdx, [rip+59219]
14001e5ddlea rcx, [rip+45070]
14001e5e4mov [rsp+40], rax
14001e5e9movzx eax, [rbx+2094]
14001e5f0mov [rsp+32], eax
14001e5f4call printf
14001e5f9
14001e5f9loc_14001e5f9:
14001e5f9mov rcx, [rbx+732]
14001e600test rcx, rcx
14001e603je 0x14001e650
14001e605xor r9l, r9l
14001e608lea r8, [rbx+2096]
14001e60fmov edx, 1
14001e614call SysExtract
14001e619mov rax, [rbx+732]
14001e620lea r9, [rip+45593]
14001e627mov r8l, 72
14001e62dlea rdx, [rip+59132]
14001e634lea rcx, [rip+44983]
14001e63bmov [rsp+40], rax
14001e640movzx eax, [rbx+2096]
14001e647mov [rsp+32], eax
14001e64bcall printf
14001e650
14001e650loc_14001e650:
14001e650mov rcx, [rbx+740]
14001e657test rcx, rcx
14001e65aje 0x14001e6a7
14001e65cxor r9l, r9l
14001e65flea r8, [rbx+2098]
14001e666mov edx, 1
14001e66bcall SysExtract
14001e670mov rax, [rbx+740]
14001e677lea r9, [rip+45531]
14001e67emov r8l, 73
14001e684lea rdx, [rip+59045]
14001e68blea rcx, [rip+44896]
14001e692mov [rsp+40], rax
14001e697movzx eax, [rbx+2098]
14001e69emov [rsp+32], eax
14001e6a2call printf
14001e6a7
14001e6a7loc_14001e6a7:
14001e6a7mov rbx, [rip+56514]
14001e6aemov rcx, [rbx+452]
14001e6b5test rcx, rcx
14001e6b8je 0x14001e705
14001e6baxor r9l, r9l
14001e6bdlea r8, [rbx+2100]
14001e6c4mov edx, 1
14001e6c9call SysExtract
14001e6cemov rax, [rbx+452]
14001e6d5lea r9, [rip+45451]
14001e6dcmov r8l, 74
14001e6e2lea rdx, [rip+58951]
14001e6e9lea rcx, [rip+44802]
14001e6f0mov [rsp+40], rax
14001e6f5movzx eax, [rbx+2100]
14001e6fcmov [rsp+32], eax
14001e700call printf
14001e705
14001e705loc_14001e705:
14001e705mov rcx, [rbx+460]
14001e70ctest rcx, rcx
14001e70fje 0x14001e75c
14001e711xor r9l, r9l
14001e714lea r8, [rbx+2102]
14001e71bmov edx, 1
14001e720call SysExtract
14001e725mov rax, [rbx+460]
14001e72clea r9, [rip+45372]
14001e733mov r8l, 75
14001e739lea rdx, [rip+58864]
14001e740lea rcx, [rip+44715]
14001e747mov [rsp+40], rax
14001e74cmovzx eax, [rbx+2102]
14001e753mov [rsp+32], eax
14001e757call printf
14001e75c
14001e75cloc_14001e75c:
14001e75cmov rcx, [rbx+468]
14001e763test rcx, rcx
14001e766je 0x14001e7b3
14001e768xor r9l, r9l
14001e76blea r8, [rbx+2104]
14001e772mov edx, 1
14001e777call SysExtract
14001e77cmov rax, [rbx+468]
14001e783lea r9, [rip+45296]
14001e78amov r8l, 76
14001e790lea rdx, [rip+58777]
14001e797lea rcx, [rip+44628]
14001e79emov [rsp+40], rax
14001e7a3movzx eax, [rbx+2104]
14001e7aamov [rsp+32], eax
14001e7aecall printf
14001e7b3
14001e7b3loc_14001e7b3:
14001e7b3mov rcx, [rbx+476]
14001e7batest rcx, rcx
14001e7bdje 0x14001e80a
14001e7bfxor r9l, r9l
14001e7c2lea r8, [rbx+2106]
14001e7c9mov edx, 1
14001e7cecall SysExtract
14001e7d3mov rax, [rbx+476]
14001e7dalea r9, [rip+45232]
14001e7e1mov r8l, 77
14001e7e7lea rdx, [rip+58690]
14001e7eelea rcx, [rip+44541]
14001e7f5mov [rsp+40], rax
14001e7famovzx eax, [rbx+2106]
14001e801mov [rsp+32], eax
14001e805call printf
14001e80a
14001e80aloc_14001e80a:
14001e80amov rcx, [rbx+484]
14001e811test rcx, rcx
14001e814je 0x14001e861
14001e816xor r9l, r9l
14001e819lea r8, [rbx+2108]
14001e820mov edx, 1
14001e825call SysExtract
14001e82amov rax, [rbx+484]
14001e831lea r9, [rip+45175]
14001e838mov r8l, 78
14001e83elea rdx, [rip+58603]
14001e845lea rcx, [rip+44454]
14001e84cmov [rsp+40], rax
14001e851movzx eax, [rbx+2108]
14001e858mov [rsp+32], eax
14001e85ccall printf
14001e861
14001e861loc_14001e861:
14001e861add rsp, 64
14001e865pop rbx
14001e866ret
14001dc00