Similarity

14001d580
14001d580SpoofRetAddr:
14001d580test r8, r8
14001d583je 0x14001d620
14001d589push rsi
14001d58amov rsi, r9
14001d58dpush rbx
14001d58emov rbx, r8
14001d591sub rsp, 120
14001d595call FindGadget
14001d59atest rax, rax
14001d59djne 0x14001d5a3
14001d59fxor eax, eax
14001d5a1jmp 0x14001d619
14001d5a3
14001d5a3loc_14001d5a3:
14001d5a3mov [rsp+88], rax
14001d5a8xor ecx, ecx
14001d5aamov rax, [rsp+224]
14001d5b2xor edx, edx
14001d5b4mov [rsp+40], rcx
14001d5b9mov r9, [rsp+192]
14001d5c1mov rcx, rsi
14001d5c4mov [rsp+72], rax
14001d5c9mov rax, [rsp+216]
14001d5d1mov [rsp+104], rdx
14001d5d6mov r8, [rsp+184]
14001d5demov [rsp+64], rax
14001d5e3mov rax, [rsp+208]
14001d5ebmov rdx, [rsp+176]
14001d5f3mov [rsp+96], rbx
14001d5f8mov [rsp+56], rax
14001d5fdmov rax, [rsp+200]
14001d605mov [rsp+48], rax
14001d60alea rax, [rsp+88]
14001d60fmov [rsp+32], rax
14001d614call Spoof
14001d619
14001d619loc_14001d619:
14001d619add rsp, 120
14001d61dpop rbx
14001d61epop rsi
14001d61fret
14001d620
14001d620loc_14001d620:
14001d620xor eax, eax
14001d622ret
14001d580

14001d623
14001d623 // align 0x10

14001d630
14001d630StringCompareIW:
14001d630push rsi
14001d631mov r11, rdx
14001d634xor r8l, r8l
14001d637push rbx
14001d638mov rbx, rcx
14001d63bsub rsp, 40
14001d63f
14001d63floc_14001d63f:
14001d63fmovzx ecx, [rbx+r8]
14001d644call ToLowerCaseW
14001d649mov r9l, ecx
14001d64cmovzx ecx, [r11+r8]
14001d651mov r10l, eax
14001d654call ToLowerCaseW
14001d659cmp r10w, ax
14001d65djne 0x14001d66d
14001d65fadd r8, 2
14001d663test r9w, r9w
14001d667jne 0x14001d63f
14001d669xor eax, eax
14001d66bjmp 0x14001d676
14001d66d
14001d66dloc_14001d66d:
14001d66dcmp r9w, cx
14001d671sbb eax, eax
14001d673or eax, 1
14001d676
14001d676loc_14001d676:
14001d676add rsp, 40
14001d67apop rbx
14001d67bpop rsi
14001d67cret
14001d630

14001d67d
14001d67d // align 0x10

14001d680
14001d680StringCompareW:
14001d680xor eax, eax
14001d682
14001d682loc_14001d682:
14001d682mov r8w, [rcx+rax]
14001d687cmp r8w, [rdx+rax]
14001d68cjne 0x14001d69b
14001d68eadd rax, 2
14001d692test r8w, r8w
14001d696jne 0x14001d682
14001d698xor eax, eax
14001d69aret
14001d69b
14001d69bloc_14001d69b:
14001d69bsbb eax, eax
14001d69dor eax, 1
14001d6a0ret
14001d680

14001d6a1
14001d6a1 // align 0x10

14001d6b0
14001d6b0StringConcatW:
14001d6b0sub rsp, 40
14001d6b4mov r9, rcx
14001d6b7call StringLengthW
14001d6bclea rcx, [rcx+2*rax]
14001d6c0call StringCopyW
14001d6c5mov rax, r9
14001d6c8add rsp, 40
14001d6ccret
14001d6b0

14001d6cd
14001d6cd // align 0x10

14001d6d0
14001d6d0StringCopyA:
14001d6d0mov rax, rcx
14001d6d3xor ecx, ecx
14001d6d5
14001d6d5loc_14001d6d5:
14001d6d5mov r8b, [rdx+rcx]
14001d6d9mov [rax+rcx], r8b
14001d6ddinc rcx
14001d6e0test r8b, r8b
14001d6e3jne 0x14001d6d5
14001d6e5ret
14001d6d0

14001d6e6
14001d6e6 // align 0x10

14001d6f0
14001d6f0StringCopyW:
14001d6f0mov rax, rcx
14001d6f3xor ecx, ecx
14001d6f5
14001d6f5loc_14001d6f5:
14001d6f5mov r8w, [rdx+rcx]
14001d6famov [rax+rcx], r8w
14001d6ffadd rcx, 2
14001d703test r8w, r8w
14001d707jne 0x14001d6f5
14001d709ret
14001d6f0

14001d70a
14001d70a // align 0x10

14001d710
14001d710StringLengthA:
14001d710xor eax, eax
14001d712test rcx, rcx
14001d715je 0x14001d727
14001d717mov rax, rcx
14001d71a
14001d71aloc_14001d71a:
14001d71acmp [rax], 0
14001d71dje 0x14001d724
14001d71finc rax
14001d722jmp 0x14001d71a
14001d724
14001d724loc_14001d724:
14001d724sub rax, rcx
14001d727
14001d727loc_14001d727:
14001d727ret
14001d710

14001d728
14001d728 // align 0x10

14001d730
14001d730StringLengthW:
14001d730mov rax, rcx
14001d733
14001d733loc_14001d733:
14001d733cmp [rax], 0
14001d737je 0x14001d73f
14001d739add rax, 2
14001d73djmp 0x14001d733
14001d73f
14001d73floc_14001d73f:
14001d73fsub rax, rcx
14001d742sar rax, 1
14001d745ret
14001d730

14001d746
14001d746 // align 0x10

14001d750
14001d750StringTokenA:
14001d750mov rax, rcx
14001d753test rcx, rcx
14001d756je 0x14001d7ab
14001d758
14001d758loc_14001d758:
14001d758mov r10, rax
14001d75bmovsx r8l, [rax]
14001d75finc rax
14001d762mov rcx, rdx
14001d765
14001d765loc_14001d765:
14001d765movsx r9l, [rcx]
14001d769inc rcx
14001d76ctest r9l, r9l
14001d76fje 0x14001d778
14001d771cmp r8l, r9l
14001d774jne 0x14001d765
14001d776jmp 0x14001d758
14001d778
14001d778loc_14001d778:
14001d778test r8l, r8l
14001d77bje 0x14001d7a9
14001d77d
14001d77dloc_14001d77d:
14001d77dmovsx r9l, [rax]
14001d781inc rax
14001d784mov rcx, rdx
14001d787
14001d787loc_14001d787:
14001d787movsx r8l, [rcx]
14001d78binc rcx
14001d78ecmp r9l, r8l
14001d791jne 0x14001d7a2
14001d793test r9l, r9l
14001d796jne 0x14001d79c
14001d798
14001d798loc_14001d798:
14001d798mov rax, r10
14001d79bret
14001d79c
14001d79cloc_14001d79c:
14001d79cmov [rax-1], 0
14001d7a0jmp 0x14001d798
14001d7a2
14001d7a2loc_14001d7a2:
14001d7a2test r8l, r8l
14001d7a5jne 0x14001d787
14001d7a7jmp 0x14001d77d
14001d7a9
14001d7a9loc_14001d7a9:
14001d7a9xor eax, eax
14001d7ab
14001d7abloc_14001d7ab:
14001d7abret
14001d750

14001d7ac
14001d7ac // align 0x10

14001d7b0
14001d7b0SymbolIncludesLibrary:
14001d7b0push rbx
14001d7b1xor r8l, r8l
14001d7b4mov edx, 6
14001d7b9mov rbx, rcx
14001d7bcsub rsp, 32
14001d7c0call HashEx
14001d7c5cmp eax, 0xffffffffec6ba2a8
14001d7caje 0x14001d7d0
14001d7cc
14001d7ccloc_14001d7cc:
14001d7ccxor eax, eax
14001d7cejmp 0x14001d7f5
14001d7d0
14001d7d0loc_14001d7d0:
14001d7d0mov rcx, rbx
14001d7d3call StringLengthA
14001d7d8mov edx, 7
14001d7dddec rax
14001d7e0
14001d7e0loc_14001d7e0:
14001d7e0cmp rdx, rax
14001d7e3jae 0x14001d7cc
14001d7e5cmp [rbx+rdx], 36
14001d7e9je 0x14001d7f0
14001d7ebinc rdx
14001d7eejmp 0x14001d7e0
14001d7f0
14001d7f0loc_14001d7f0:
14001d7f0mov eax, 1
14001d7f5
14001d7f5loc_14001d7f5:
14001d7f5add rsp, 32
14001d7f9pop rbx
14001d7faret
14001d7b0

14001d7fb
14001d7fb // align 0x10

14001d800
14001d800SymbolIsImport:
14001d800sub rsp, 40
14001d804xor r8l, r8l
14001d807mov edx, 6
14001d80ccall HashEx
14001d811cmp eax, 0xffffffffec6ba2a8
14001d816sete al
14001d819add rsp, 40
14001d81dmovzx eax, al
14001d820ret
14001d800

14001d821
14001d821 // align 0x10

14001d830
14001d830SysDuplicateTokenEx:
14001d830push rdi
14001d831xor eax, eax
14001d833mov r10, rcx
14001d836mov ecx, 12
14001d83bpush rsi
14001d83cpush rbx
14001d83dsub rsp, 112
14001d841lea rdi, [rsp+64]
14001d846mov [rsp+52], 12
14001d84erep stosd [rdi], eax
14001d850xor eax, eax
14001d852mov [rsp+56], r9l
14001d857mov [rsp+60], eax
14001d85bmov [rsp+64], 48
14001d863test r8, r8
14001d866je 0x14001d881
14001d868xor eax, eax
14001d86acmp [r8+16], 0
14001d86fsetne al
14001d872add eax, eax
14001d874mov [rsp+88], eax
14001d878mov rax, [r8+8]
14001d87cmov [rsp+96], rax
14001d881
14001d881loc_14001d881:
14001d881lea rax, [rsp+52]
14001d886xor r9l, r9l
14001d889lea r8, [rsp+64]
14001d88emov rcx, r10
14001d891mov [rsp+104], rax
14001d896mov rax, [rsp+184]
14001d89emov [rsp+40], rax
14001d8a3mov eax, [rsp+176]
14001d8aamov [rsp+32], eax
14001d8aecall SysNtDuplicateToken
14001d8b3mov ebx, eax
14001d8b5mov eax, 1
14001d8batest ebx, ebx
14001d8bcjns 0x14001d901
14001d8bemov rsi, [rip+60075]
14001d8c5mov ecx, ebx
14001d8c7call [rsi+348]
14001d8cdmov r9l, ebx
14001d8d0mov r8l, 400
14001d8d6lea rdx, [rip+64483]
14001d8ddmov [rsp+32], eax
14001d8e1lea rcx, [rip+49224]
14001d8e8call printf
14001d8edmov rdi, [rsi+2230]
14001d8f4mov ecx, ebx
14001d8f6call [rsi+348]
14001d8fcmov [rdi+104], eax
14001d8ffxor eax, eax
14001d901
14001d901loc_14001d901:
14001d901add rsp, 112
14001d905pop rbx
14001d906pop rsi
14001d907pop rdi
14001d908ret
14001d830

14001d909
14001d909 // align 0x10

14001d910
14001d910SysExtract:
14001d910push rsi
14001d911push rbx
14001d912sub rsp, 40
14001d916test rcx, rcx
14001d919jne 0x14001d938
14001d91blea r9, [rip+48057]
14001d922mov r8l, 104
14001d928lea rdx, [rip+61361]
14001d92flea rcx, [rip+48017]
14001d936jmp 0x14001d966
14001d938
14001d938loc_14001d938:
14001d938mov r10l, edx
14001d93bmov rdx, r8
14001d93exor r8l, r8l
14001d941mov rbx, rcx
14001d944mov rax, rdx
14001d947mov rsi, r9
14001d94aor rax, r9
14001d94djne 0x14001d97b
14001d94fmov r9, rcx
14001d952mov r8l, 110
14001d958lea rdx, [rip+61313]
14001d95flea rcx, [rip+48021]
14001d966
14001d966loc_14001d966:
14001d966call printf
14001d96b
14001d96bloc_14001d96b:
14001d96bxor eax, eax
14001d96djmp 0x14001da45
14001d972
14001d972loc_14001d972:
14001d972cmp r9b, 76
14001d976je 0x14001d98d
14001d978
14001d978loc_14001d978:
14001d978inc r8l
14001d97b
14001d97bloc_14001d97b:
14001d97bmov ecx, r8l
14001d97elea rax, [rbx+rcx]
14001d982mov r9, [rax]
14001d985cmp r9b, -61
14001d989jne 0x14001d972
14001d98bjmp 0x14001d9e5
14001d98d
14001d98dloc_14001d98d:
14001d98dcmp [rbx+rcx+1], -117
14001d992jne 0x14001d978
14001d994cmp [rbx+rcx+2], -47
14001d999jne 0x14001d978
14001d99bcmp [rbx+rcx+3], -72
14001d9a0jne 0x14001d978
14001d9a2test rdx, rdx
14001d9a5jne 0x14001d9b3
14001d9a7test rsi, rsi
14001d9aaje 0x14001d96b
14001d9ac
14001d9acloc_14001d9ac:
14001d9aclea rcx, [rbx+rcx+30]
14001d9b1jmp 0x14001d9d9
14001d9b3
14001d9b3loc_14001d9b3:
14001d9b3movzx r9l, [rbx+rcx+5]
14001d9b9movzx r8l, [rbx+rcx+4]
14001d9bfshl r9l, 8
14001d9c3or r8l, r9l
14001d9c6mov [rdx], r8w
14001d9catest rsi, rsi
14001d9cdjne 0x14001d9ac
14001d9cfjmp 0x14001da40
14001d9d1
14001d9d1loc_14001d9d1:
14001d9d1inc rax
14001d9d4cmp rcx, rax
14001d9d7je 0x14001d9e5
14001d9d9
14001d9d9loc_14001d9d9:
14001d9d9cmp [rax], 1295
14001d9dejne 0x14001d9d1
14001d9e0mov [rsi], rax
14001d9e3jmp 0x14001da40
14001d9e5
14001d9e5loc_14001d9e5:
14001d9e5test rdx, rdx
14001d9e8je 0x14001da1b
14001d9eatest r10l, r10l
14001d9edjne 0x14001da0d
14001d9ef
14001d9efloc_14001d9ef:
14001d9efmov r9, rbx
14001d9f2mov r8l, 184
14001d9f8lea rdx, [rip+61153]
14001d9fflea rcx, [rip+47931]
14001da06call printf
14001da0bjmp 0x14001da1b
14001da0d
14001da0dloc_14001da0d:
14001da0dmov rcx, rbx
14001da10call FindSsnOfHookedSyscall
14001da15test eax, eax
14001da17je 0x14001d9ef
14001da19jmp 0x14001da45
14001da1b
14001da1bloc_14001da1b:
14001da1btest rsi, rsi
14001da1eje 0x14001d96b
14001da24mov r9, rbx
14001da27mov r8l, 188
14001da2dlea rdx, [rip+61100]
14001da34lea rcx, [rip+47941]
14001da3bjmp 0x14001d966
14001da40
14001da40loc_14001da40:
14001da40mov eax, 1
14001da45
14001da45loc_14001da45:
14001da45add rsp, 40
14001da49pop rbx
14001da4apop rsi
14001da4bret
14001d910

14001da4c
14001da4c // align 0x10

14001da50
14001da50SysImpersonateLoggedOnUser:
14001da50push rdi
14001da51xor eax, eax
14001da53xor r8l, r8l
14001da56xor r9l, r9l
14001da59push rsi
14001da5axor r11l, r11l
14001da5dxor r10l, r10l
14001da60mov edx, 8
14001da65push rbx
14001da66mov rbx, rcx
14001da69mov ecx, 12
14001da6esub rsp, 144
14001da75lea rdi, [rsp+96]
14001da7amov [rsp+84], r8
14001da7flea r8, [rsp+64]
14001da84rep stosd [rdi], eax
14001da86lea rax, [rsp+68]
14001da8bmov [rsp+92], r9l
14001da90mov rcx, rbx
14001da93mov [rsp+32], rax
14001da98mov r9l, 4
14001da9emov [rsp+72], r10
14001daa3mov [rsp+64], r11l
14001daa8mov [rsp+68], r11l
14001daadcall SysNtQueryInformationToken
14001dab2test eax, eax
14001dab4jns 0x14001daeb
14001dab6mov ecx, eax
14001dab8mov [rsp+60], eax
14001dabcmov rax, [rip+59565]
14001dac3call [rax+348]
14001dac9mov r9l, [rsp+60]
14001dacemov r8l, 1300
14001dad4lea rdx, [rip+60949]
14001dadbmov [rsp+32], eax
14001dadflea rcx, [rip+49627]
14001dae6jmp 0x14001dbea
14001daeb
14001daebloc_14001daeb:
14001daebcmp [rsp+64], 1
14001daf0lea rsi, [rsp+72]
14001daf5jne 0x14001db96
14001dafbmov eax, 0xffffffff80000003
14001db00mov [rsp+40], rsi
14001db05xor edx, edx
14001db07xor ecx, ecx
14001db09shl rax, 2
14001db0dmov [rsp+120], edx
14001db11xor r9l, r9l
14001db14lea r8, [rsp+96]
14001db19mov [rsp+32], 2
14001db21mov edx, 12
14001db26mov [rsp+84], rax
14001db2bxor eax, eax
14001db2dmov [rsp+104], rax
14001db32mov [rsp+112], rax
14001db37lea rax, [rsp+84]
14001db3cmov [rsp+128], rcx
14001db44mov rcx, rbx
14001db47mov [rsp+92], 1
14001db4emov [rsp+96], 48
14001db56mov [rsp+136], rax
14001db5ecall SysNtDuplicateToken
14001db63test eax, eax
14001db65jns 0x14001db6e
14001db67
14001db67loc_14001db67:
14001db67xor eax, eax
14001db69jmp 0x14001dbf4
14001db6e
14001db6eloc_14001db6e:
14001db6emov r9l, 8
14001db74mov r8, rsi
14001db77mov edx, 5
14001db7cmov rcx, -2
14001db83call SysNtSetInformationThread
14001db88mov rcx, [rsp+72]
14001db8dmov ebx, eax
14001db8fcall SysNtClose
14001db94jmp 0x14001dbb7
14001db96
14001db96loc_14001db96:
14001db96mov r9l, 8
14001db9cmov r8, rsi
14001db9fmov edx, 5
14001dba4mov rcx, -2
14001dbabmov [rsp+72], rbx
14001dbb0call SysNtSetInformationThread
14001dbb5mov ebx, eax
14001dbb7
14001dbb7loc_14001dbb7:
14001dbb7mov eax, 1
14001dbbctest ebx, ebx
14001dbbejns 0x14001dbf4
14001dbc0mov rax, [rip+59305]
14001dbc7mov ecx, ebx
14001dbc9call [rax+348]
14001dbcfmov r9l, ebx
14001dbd2mov r8l, 1354
14001dbd8lea rdx, [rip+60689]
14001dbdfmov [rsp+32], eax
14001dbe3lea rcx, [rip+49429]
14001dbea
14001dbealoc_14001dbea:
14001dbeacall printf
14001dbefjmp 0x14001db67
14001dbf4
14001dbf4loc_14001dbf4:
14001dbf4add rsp, 144
14001dbfbpop rbx
14001dbfcpop rsi
14001dbfdpop rdi
14001dbferet
14001da50

14001dbff
14001dbff // align 0x10

14001dc00
14001dc00SysInitialize:
14001dc00push rbx
14001dc01xor eax, eax
14001dc03sub rsp, 64
14001dc07mov [rsp+56], rax
14001dc0cxor eax, eax
14001dc0etest rcx, rcx
14001dc11je 0x14001e861
14001dc17mov edx, 0xffffffff8cfcc776
14001dc1ccall LdrFunctionAddr
14001dc21mov rbx, [rip+59208]
14001dc28test rax, rax
14001dc2bmov rcx, rax
14001dc2eje 0x14001dc75
14001dc30lea r9, [rsp+56]
14001dc35xor r8l, r8l
14001dc38mov edx, 1
14001dc3dcall SysExtract
14001dc42mov rax, [rsp+56]
14001dc47test rax, rax
14001dc4aje 0x14001dc55
14001dc4cmov [rbx+2028], rax
14001dc53jmp 0x14001dc75
14001dc55
14001dc55loc_14001dc55:
14001dc55lea r9, [rip+47463]
14001dc5cmov r8l, 32
14001dc62lea rdx, [rip+61639]
14001dc69lea rcx, [rip+47191]
14001dc70call printf
14001dc75
14001dc75loc_14001dc75:
14001dc75mov rcx, [rbx+492]
14001dc7ctest rcx, rcx
14001dc7fje 0x14001dccc
14001dc81xor r9l, r9l
14001dc84lea r8, [rbx+2040]
14001dc8bmov edx, 1
14001dc90call SysExtract
14001dc95mov rax, [rbx+492]
14001dc9clea r9, [rip+47426]
14001dca3mov r8l, 44
14001dca9lea rdx, [rip+61568]
14001dcb0lea rcx, [rip+47419]
14001dcb7mov [rsp+40], rax
14001dcbcmovzx eax, [rbx+2040]
14001dcc3mov [rsp+32], eax
14001dcc7call printf
14001dccc
14001dcccloc_14001dccc:
14001dcccmov rcx, [rbx+500]
14001dcd3test rcx, rcx
14001dcd6je 0x14001dd23
14001dcd8xor r9l, r9l
14001dcdblea r8, [rbx+2042]
14001dce2mov edx, 1
14001dce7call SysExtract
14001dcecmov rax, [rbx+500]
14001dcf3lea r9, [rip+47404]
14001dcfamov r8l, 45
14001dd00lea rdx, [rip+61481]
14001dd07lea rcx, [rip+47332]
14001dd0emov [rsp+40], rax
14001dd13movzx eax, [rbx+2042]
14001dd1amov [rsp+32], eax
14001dd1ecall printf
14001dd23
14001dd23loc_14001dd23:
14001dd23mov rcx, [rbx+516]
14001dd2atest rcx, rcx
14001dd2dje 0x14001dd7a
14001dd2fxor r9l, r9l
14001dd32lea r8, [rbx+2046]
14001dd39mov edx, 1
14001dd3ecall SysExtract
14001dd43mov rax, [rbx+516]
14001dd4alea r9, [rip+47335]
14001dd51mov r8l, 46
14001dd57lea rdx, [rip+61394]
14001dd5elea rcx, [rip+47245]
14001dd65mov [rsp+40], rax
14001dd6amovzx eax, [rbx+2046]
14001dd71mov [rsp+32], eax
14001dd75call printf
14001dd7a
14001dd7aloc_14001dd7a:
14001dd7amov rcx, [rbx+508]
14001dd81test rcx, rcx
14001dd84je 0x14001ddd1
14001dd86xor r9l, r9l
14001dd89lea r8, [rbx+2044]
14001dd90mov edx, 1
14001dd95call SysExtract
14001dd9amov rax, [rbx+508]
14001dda1lea r9, [rip+47262]
14001dda8mov r8l, 47
14001ddaelea rdx, [rip+61307]
14001ddb5lea rcx, [rip+47158]
14001ddbcmov [rsp+40], rax
14001ddc1movzx eax, [rbx+2044]
14001ddc8mov [rsp+32], eax
14001ddcccall printf
14001ddd1
14001ddd1loc_14001ddd1:
14001ddd1mov rcx, [rbx+524]
14001ddd8test rcx, rcx
14001dddbje 0x14001de28
14001ddddxor r9l, r9l
14001dde0lea r8, [rbx+2048]
14001dde7mov edx, 1
14001ddeccall SysExtract
14001ddf1mov rax, [rbx+524]
14001ddf8lea r9, [rip+47194]
14001ddffmov r8l, 48
14001de05lea rdx, [rip+61220]
14001de0clea rcx, [rip+47071]
14001de13mov [rsp+40], rax
14001de18movzx eax, [rbx+2048]
14001de1fmov [rsp+32], eax
14001de23call printf
14001de28
14001de28loc_14001de28:
14001de28mov rcx, [rbx+532]
14001de2ftest rcx, rcx
14001de32je 0x14001de7f
14001de34xor r9l, r9l
14001de37lea r8, [rbx+2050]
14001de3emov edx, 1
14001de43call SysExtract
14001de48mov rax, [rbx+532]
14001de4flea r9, [rip+47126]
14001de56mov r8l, 49
14001de5clea rdx, [rip+61133]
14001de63lea rcx, [rip+46984]
14001de6amov [rsp+40], rax
14001de6fmovzx eax, [rbx+2050]
14001de76mov [rsp+32], eax
14001de7acall printf
14001de7f
14001de7floc_14001de7f:
14001de7fmov rcx, [rbx+540]
14001de86test rcx, rcx
14001de89je 0x14001ded6
14001de8bxor r9l, r9l
14001de8elea r8, [rbx+2052]
14001de95mov edx, 1
14001de9acall SysExtract
14001de9fmov rax, [rbx+540]
14001dea6lea r9, [rip+47056]
14001deadmov r8l, 50
14001deb3lea rdx, [rip+61046]
14001debalea rcx, [rip+46897]
14001dec1mov [rsp+40], rax
14001dec6movzx eax, [rbx+2052]
14001decdmov [rsp+32], eax
14001ded1call printf
14001ded6
14001ded6loc_14001ded6:
14001ded6mov rcx, [rbx+548]
14001deddtest rcx, rcx
14001dee0je 0x14001df2d
14001dee2xor r9l, r9l
14001dee5lea r8, [rbx+2054]
14001deecmov edx, 1
14001def1call SysExtract
14001def6mov rax, [rbx+548]
14001defdlea r9, [rip+46986]
14001df04mov r8l, 51
14001df0alea rdx, [rip+60959]
14001df11lea rcx, [rip+46810]
14001df18mov [rsp+40], rax
14001df1dmovzx eax, [rbx+2054]
14001df24mov [rsp+32], eax
14001df28call printf
14001df2d
14001df2dloc_14001df2d:
14001df2dmov rcx, [rbx+556]
14001df34test rcx, rcx
14001df37je 0x14001df84
14001df39xor r9l, r9l
14001df3clea r8, [rbx+2056]
14001df43mov edx, 1
14001df48call SysExtract
14001df4dmov rax, [rbx+556]
14001df54lea r9, [rip+46915]
14001df5bmov r8l, 52
14001df61lea rdx, [rip+60872]
14001df68lea rcx, [rip+46723]
14001df6fmov [rsp+40], rax
14001df74movzx eax, [rbx+2056]
14001df7bmov [rsp+32], eax
14001df7fcall printf
14001df84
14001df84loc_14001df84:
14001df84mov rcx, [rbx+564]
14001df8btest rcx, rcx
14001df8eje 0x14001dfdb
14001df90xor r9l, r9l
14001df93lea r8, [rbx+2058]
14001df9amov edx, 1
14001df9fcall SysExtract
14001dfa4mov rax, [rbx+564]
14001dfablea r9, [rip+46843]
14001dfb2mov r8l, 53
14001dfb8lea rdx, [rip+60785]
14001dfbflea rcx, [rip+46636]
14001dfc6mov [rsp+40], rax
14001dfcbmovzx eax, [rbx+2058]
14001dfd2mov [rsp+32], eax
14001dfd6call printf
14001dfdb
14001dfdbloc_14001dfdb:
14001dfdbmov rcx, [rbx+572]
14001dfe2test rcx, rcx
14001dfe5je 0x14001e032
14001dfe7xor r9l, r9l
14001dfealea r8, [rbx+2060]
14001dff1mov edx, 1
14001dff6call SysExtract
14001dffbmov rax, [rbx+572]
14001e002lea r9, [rip+46770]
14001e009mov r8l, 54
14001e00flea rdx, [rip+60698]
14001e016lea rcx, [rip+46549]
14001e01dmov [rsp+40], rax
14001e022movzx eax, [rbx+2060]
14001e029mov [rsp+32], eax
14001e02dcall printf
14001e032
14001e032loc_14001e032:
14001e032mov rcx, [rbx+580]
14001e039test rcx, rcx
14001e03cje 0x14001e089
14001e03exor r9l, r9l
14001e041lea r8, [rbx+2062]
14001e048mov edx, 1
14001e04dcall SysExtract
14001e052mov rax, [rbx+580]
14001e059lea r9, [rip+46700]
14001e060mov r8l, 55
14001e066lea rdx, [rip+60611]
14001e06dlea rcx, [rip+46462]
14001e074mov [rsp+40], rax
14001e079movzx eax, [rbx+2062]
14001e080mov [rsp+32], eax
14001e084call printf
14001e089
14001e089loc_14001e089:
14001e089mov rcx, [rbx+588]
14001e090test rcx, rcx
14001e093je 0x14001e0e0
14001e095xor r9l, r9l
14001e098lea r8, [rbx+2064]
14001e09fmov edx, 1
14001e0a4call SysExtract
14001e0a9mov rax, [rbx+588]
14001e0b0lea r9, [rip+46631]
14001e0b7mov r8l, 56
14001e0bdlea rdx, [rip+60524]
14001e0c4lea rcx, [rip+46375]
14001e0cbmov [rsp+40], rax
14001e0d0movzx eax, [rbx+2064]
14001e0d7mov [rsp+32], eax
14001e0dbcall printf
14001e0e0
14001e0e0loc_14001e0e0:
14001e0e0mov rcx, [rbx+596]
14001e0e7test rcx, rcx
14001e0eaje 0x14001e137
14001e0ecxor r9l, r9l
14001e0eflea r8, [rbx+2066]
14001e0f6mov edx, 1
14001e0fbcall SysExtract
14001e100mov rax, [rbx+596]
14001e107lea r9, [rip+46563]
14001e10emov r8l, 57
14001e114lea rdx, [rip+60437]
14001e11blea rcx, [rip+46288]
14001e122mov [rsp+40], rax
14001e127movzx eax, [rbx+2066]
14001e12emov [rsp+32], eax
14001e132call printf
14001e137
14001e137loc_14001e137:
14001e137mov rcx, [rbx+604]
14001e13etest rcx, rcx
14001e141je 0x14001e18e
14001e143xor r9l, r9l
14001e146lea r8, [rbx+2068]
14001e14dmov edx, 1
14001e152call SysExtract
14001e157mov rax, [rbx+604]
14001e15elea r9, [rip+46495]
14001e165mov r8l, 58
14001e16blea rdx, [rip+60350]
14001e172lea rcx, [rip+46201]
14001e179mov [rsp+40], rax
14001e17emovzx eax, [rbx+2068]
14001e185mov [rsp+32], eax
14001e189call printf
14001e18e
14001e18eloc_14001e18e:
14001e18emov rcx, [rbx+612]
14001e195test rcx, rcx
14001e198je 0x14001e1e5
14001e19axor r9l, r9l
14001e19dlea r8, [rbx+2070]
14001e1a4mov edx, 1
14001e1a9call SysExtract
14001e1aemov rax, [rbx+612]
14001e1b5lea r9, [rip+46434]
14001e1bcmov r8l, 59
14001e1c2lea rdx, [rip+60263]
14001e1c9lea rcx, [rip+46114]
14001e1d0mov [rsp+40], rax
14001e1d5movzx eax, [rbx+2070]
14001e1dcmov [rsp+32], eax
14001e1e0call printf
14001e1e5
14001e1e5loc_14001e1e5:
14001e1e5mov rcx, [rbx+620]
14001e1ectest rcx, rcx
14001e1efje 0x14001e23c
14001e1f1xor r9l, r9l
14001e1f4lea r8, [rbx+2072]
14001e1fbmov edx, 1
14001e200call SysExtract
14001e205mov rax, [rbx+620]
14001e20clea r9, [rip+46372]
14001e213mov r8l, 60
14001e219lea rdx, [rip+60176]
14001e220lea rcx, [rip+46027]
14001e227mov [rsp+40], rax
14001e22cmovzx eax, [rbx+2072]
14001e233mov [rsp+32], eax
14001e237call printf
14001e23c
14001e23cloc_14001e23c:
14001e23cmov rcx, [rbx+636]
14001e243test rcx, rcx
14001e246je 0x14001e293
14001e248xor r9l, r9l
14001e24blea r8, [rbx+2074]
14001e252mov edx, 1
14001e257call SysExtract
14001e25cmov rax, [rbx+636]
14001e263lea r9, [rip+46307]
14001e26amov r8l, 61
14001e270lea rdx, [rip+60089]
14001e277lea rcx, [rip+45940]
14001e27emov [rsp+40], rax
14001e283movzx eax, [rbx+2074]
14001e28amov [rsp+32], eax
14001e28ecall printf
14001e293
14001e293loc_14001e293:
14001e293mov rcx, [rbx+644]
14001e29atest rcx, rcx
14001e29dje 0x14001e2ea
14001e29fxor r9l, r9l
14001e2a2lea r8, [rbx+2076]
14001e2a9mov edx, 1
14001e2aecall SysExtract
14001e2b3mov rax, [rbx+644]
14001e2balea r9, [rip+46244]
14001e2c1mov r8l, 62
14001e2c7lea rdx, [rip+60002]
14001e2celea rcx, [rip+45853]
14001e2d5mov [rsp+40], rax
14001e2damovzx eax, [rbx+2076]
14001e2e1mov [rsp+32], eax
14001e2e5call printf
14001e2ea
14001e2ealoc_14001e2ea:
14001e2eamov rcx, [rbx+652]
14001e2f1test rcx, rcx
14001e2f4je 0x14001e341
14001e2f6xor r9l, r9l
14001e2f9lea r8, [rbx+2078]
14001e300mov edx, 1
14001e305call SysExtract
14001e30amov rax, [rbx+652]
14001e311lea r9, [rip+46178]
14001e318mov r8l, 63
14001e31elea rdx, [rip+59915]
14001e325lea rcx, [rip+45766]
14001e32cmov [rsp+40], rax
14001e331movzx eax, [rbx+2078]
14001e338mov [rsp+32], eax
14001e33ccall printf
14001e341
14001e341loc_14001e341:
14001e341mov rcx, [rbx+660]
14001e348test rcx, rcx
14001e34bje 0x14001e398
14001e34dxor r9l, r9l
14001e350lea r8, [rbx+2080]
14001e357mov edx, 1
14001e35ccall SysExtract
14001e361mov rax, [rbx+660]
14001e368lea r9, [rip+46111]
14001e36fmov r8l, 64
14001e375lea rdx, [rip+59828]
14001e37clea rcx, [rip+45679]
14001e383mov [rsp+40], rax
14001e388movzx eax, [rbx+2080]
14001e38fmov [rsp+32], eax
14001e393call printf
14001e398
14001e398loc_14001e398:
14001e398mov rcx, [rbx+668]
14001e39ftest rcx, rcx
14001e3a2je 0x14001e3ef
14001e3a4xor r9l, r9l
14001e3a7lea r8, [rbx+2082]
14001e3aemov edx, 1
14001e3b3call SysExtract
14001e3b8mov rax, [rbx+668]
14001e3bflea r9, [rip+46044]
14001e3c6mov r8l, 65
14001e3cclea rdx, [rip+59741]
14001e3d3lea rcx, [rip+45592]
14001e3damov [rsp+40], rax
14001e3dfmovzx eax, [rbx+2082]
14001e3e6mov [rsp+32], eax
14001e3eacall printf
14001e3ef
14001e3efloc_14001e3ef:
14001e3efmov rcx, [rbx+676]
14001e3f6test rcx, rcx
14001e3f9je 0x14001e446
14001e3fbxor r9l, r9l
14001e3felea r8, [rbx+2084]
14001e405mov edx, 1
14001e40acall SysExtract
14001e40fmov rax, [rbx+676]
14001e416lea r9, [rip+45978]
14001e41dmov r8l, 66
14001e423lea rdx, [rip+59654]
14001e42alea rcx, [rip+45505]
14001e431mov [rsp+40], rax
14001e436movzx eax, [rbx+2084]
14001e43dmov [rsp+32], eax
14001e441call printf
14001e446
14001e446loc_14001e446:
14001e446mov rcx, [rbx+684]
14001e44dtest rcx, rcx
14001e450je 0x14001e49d
14001e452xor r9l, r9l
14001e455lea r8, [rbx+2086]
14001e45cmov edx, 1
14001e461call SysExtract
14001e466mov rax, [rbx+684]
14001e46dlea r9, [rip+45914]
14001e474mov r8l, 67
14001e47alea rdx, [rip+59567]
14001e481lea rcx, [rip+45418]
14001e488mov [rsp+40], rax
14001e48dmovzx eax, [rbx+2086]
14001e494mov [rsp+32], eax
14001e498call printf
14001e49d
14001e49dloc_14001e49d:
14001e49dmov rcx, [rbx+700]
14001e4a4test rcx, rcx
14001e4a7je 0x14001e4f4
14001e4a9xor r9l, r9l
14001e4aclea r8, [rbx+2088]
14001e4b3mov edx, 1
14001e4b8call SysExtract
14001e4bdmov rax, [rbx+700]
14001e4c4lea r9, [rip+45845]
14001e4cbmov r8l, 68
14001e4d1lea rdx, [rip+59480]
14001e4d8lea rcx, [rip+45331]
14001e4dfmov [rsp+40], rax
14001e4e4movzx eax, [rbx+2088]
14001e4ebmov [rsp+32], eax
14001e4efcall printf
14001e4f4
14001e4f4loc_14001e4f4:
14001e4f4mov rcx, [rbx+708]
14001e4fbtest rcx, rcx
14001e4feje 0x14001e54b
14001e500xor r9l, r9l
14001e503lea r8, [rbx+2090]
14001e50amov edx, 1
14001e50fcall SysExtract
14001e514mov rax, [rbx+708]
14001e51blea r9, [rip+45778]
14001e522mov r8l, 69
14001e528lea rdx, [rip+59393]
14001e52flea rcx, [rip+45244]
14001e536mov [rsp+40], rax
14001e53bmovzx eax, [rbx+2090]
14001e542mov [rsp+32], eax
14001e546call printf
14001e54b
14001e54bloc_14001e54b:
14001e54bmov rcx, [rbx+716]
14001e552test rcx, rcx
14001e555je 0x14001e5a2
14001e557xor r9l, r9l
14001e55alea r8, [rbx+2092]
14001e561mov edx, 1
14001e566call SysExtract
14001e56bmov rax, [rbx+716]
14001e572lea r9, [rip+45722]
14001e579mov r8l, 70
14001e57flea rdx, [rip+59306]
14001e586lea rcx, [rip+45157]
14001e58dmov [rsp+40], rax
14001e592movzx eax, [rbx+2092]
14001e599mov [rsp+32], eax
14001e59dcall printf
14001e5a2
14001e5a2loc_14001e5a2:
14001e5a2mov rcx, [rbx+724]
14001e5a9test rcx, rcx
14001e5acje 0x14001e5f9
14001e5aexor r9l, r9l
14001e5b1lea r8, [rbx+2094]
14001e5b8mov edx, 1
14001e5bdcall SysExtract
14001e5c2mov rax, [rbx+724]
14001e5c9lea r9, [rip+45656]
14001e5d0mov r8l, 71
14001e5d6lea rdx, [rip+59219]
14001e5ddlea rcx, [rip+45070]
14001e5e4mov [rsp+40], rax
14001e5e9movzx eax, [rbx+2094]
14001e5f0mov [rsp+32], eax
14001e5f4call printf
14001e5f9
14001e5f9loc_14001e5f9:
14001e5f9mov rcx, [rbx+732]
14001e600test rcx, rcx
14001e603je 0x14001e650
14001e605xor r9l, r9l
14001e608lea r8, [rbx+2096]
14001e60fmov edx, 1
14001e614call SysExtract
14001e619mov rax, [rbx+732]
14001e620lea r9, [rip+45593]
14001e627mov r8l, 72
14001e62dlea rdx, [rip+59132]
14001e634lea rcx, [rip+44983]
14001e63bmov [rsp+40], rax
14001e640movzx eax, [rbx+2096]
14001e647mov [rsp+32], eax
14001e64bcall printf
14001e650
14001e650loc_14001e650:
14001e650mov rcx, [rbx+740]
14001e657test rcx, rcx
14001e65aje 0x14001e6a7
14001e65cxor r9l, r9l
14001e65flea r8, [rbx+2098]
14001e666mov edx, 1
14001e66bcall SysExtract
14001e670mov rax, [rbx+740]
14001e677lea r9, [rip+45531]
14001e67emov r8l, 73
14001e684lea rdx, [rip+59045]
14001e68blea rcx, [rip+44896]
14001e692mov [rsp+40], rax
14001e697movzx eax, [rbx+2098]
14001e69emov [rsp+32], eax
14001e6a2call printf
14001e6a7
14001e6a7loc_14001e6a7:
14001e6a7mov rbx, [rip+56514]
14001e6aemov rcx, [rbx+452]
14001e6b5test rcx, rcx
14001e6b8je 0x14001e705
14001e6baxor r9l, r9l
14001e6bdlea r8, [rbx+2100]
14001e6c4mov edx, 1
14001e6c9call SysExtract
14001e6cemov rax, [rbx+452]
14001e6d5lea r9, [rip+45451]
14001e6dcmov r8l, 74
14001e6e2lea rdx, [rip+58951]
14001e6e9lea rcx, [rip+44802]
14001e6f0mov [rsp+40], rax
14001e6f5movzx eax, [rbx+2100]
14001e6fcmov [rsp+32], eax
14001e700call printf
14001e705
14001e705loc_14001e705:
14001e705mov rcx, [rbx+460]
14001e70ctest rcx, rcx
14001e70fje 0x14001e75c
14001e711xor r9l, r9l
14001e714lea r8, [rbx+2102]
14001e71bmov edx, 1
14001e720call SysExtract
14001e725mov rax, [rbx+460]
14001e72clea r9, [rip+45372]
14001e733mov r8l, 75
14001e739lea rdx, [rip+58864]
14001e740lea rcx, [rip+44715]
14001e747mov [rsp+40], rax
14001e74cmovzx eax, [rbx+2102]
14001e753mov [rsp+32], eax
14001e757call printf
14001e75c
14001e75cloc_14001e75c:
14001e75cmov rcx, [rbx+468]
14001e763test rcx, rcx
14001e766je 0x14001e7b3
14001e768xor r9l, r9l
14001e76blea r8, [rbx+2104]
14001e772mov edx, 1
14001e777call SysExtract
14001e77cmov rax, [rbx+468]
14001e783lea r9, [rip+45296]
14001e78amov r8l, 76
14001e790lea rdx, [rip+58777]
14001e797lea rcx, [rip+44628]
14001e79emov [rsp+40], rax
14001e7a3movzx eax, [rbx+2104]
14001e7aamov [rsp+32], eax
14001e7aecall printf
14001e7b3
14001e7b3loc_14001e7b3:
14001e7b3mov rcx, [rbx+476]
14001e7batest rcx, rcx
14001e7bdje 0x14001e80a
14001e7bfxor r9l, r9l
14001e7c2lea r8, [rbx+2106]
14001e7c9mov edx, 1
14001e7cecall SysExtract
14001e7d3mov rax, [rbx+476]
14001e7dalea r9, [rip+45232]
14001e7e1mov r8l, 77
14001e7e7lea rdx, [rip+58690]
14001e7eelea rcx, [rip+44541]
14001e7f5mov [rsp+40], rax
14001e7famovzx eax, [rbx+2106]
14001e801mov [rsp+32], eax
14001e805call printf
14001e80a
14001e80aloc_14001e80a:
14001e80amov rcx, [rbx+484]
14001e811test rcx, rcx
14001e814je 0x14001e861
14001e816xor r9l, r9l
14001e819lea r8, [rbx+2108]
14001e820mov edx, 1
14001e825call SysExtract
14001e82amov rax, [rbx+484]
14001e831lea r9, [rip+45175]
14001e838mov r8l, 78
14001e83elea rdx, [rip+58603]
14001e845lea rcx, [rip+44454]
14001e84cmov [rsp+40], rax
14001e851movzx eax, [rbx+2108]
14001e858mov [rsp+32], eax
14001e85ccall printf
14001e861
14001e861loc_14001e861:
14001e861add rsp, 64
14001e865pop rbx
14001e866ret
14001dc00

14001e867
14001e867 // align 0x10

14001e870
14001e870SysNtAlertResumeThread:
14001e870push rbx
14001e871xor eax, eax
14001e873mov rbx, rcx
14001e876sub rsp, 64
14001e87amov [rsp+48], rax
14001e87fmov [rsp+56], rax
14001e884mov rax, [rip+56037]
14001e88bcmp [rax+218], 0
14001e892je 0x14001e8d7
14001e894mov rcx, [rax+2028]
14001e89btest rcx, rcx
14001e89eje 0x14001e8d7
14001e8a0mov r8w, [rax+2088]
14001e8a8test r8w, r8w
14001e8acje 0x14001e8d7
14001e8aemov [rsp+48], rcx
14001e8b3lea rcx, [rsp+48]
14001e8b8mov [rsp+88], rdx
14001e8bdmov [rsp+56], r8w
14001e8c3call SysSetConfig
14001e8c8mov rdx, [rsp+88]
14001e8cdmov rcx, rbx
14001e8d0call SysInvoke
14001e8d5jmp 0x14001e8e0
14001e8d7
14001e8d7loc_14001e8d7:
14001e8d7mov rcx, rbx
14001e8dacall [rax+700]
14001e8e0
14001e8e0loc_14001e8e0:
14001e8e0mov [rsp+32], eax
14001e8e4lea r9, [rip+43614]
14001e8ebmov ebx, eax
14001e8edmov r8l, 365
14001e8f3lea rdx, [rip+60326]
14001e8falea rcx, [rip+43103]
14001e901call printf.constprop.0
14001e906add rsp, 64
14001e90amov eax, ebx
14001e90cpop rbx
14001e90dret
14001e870

14001e90e
14001e90e // align 0x10

14001e910
14001e910SysNtAllocateVirtualMemory:
14001e910push rdi
14001e911xor eax, eax
14001e913push rsi
14001e914push rbx
14001e915mov rbx, rcx
14001e918sub rsp, 64
14001e91cmov [rsp+48], rax
14001e921mov esi, [rsp+128]
14001e928mov [rsp+56], rax
14001e92dmov rax, [rip+55868]
14001e934mov edi, [rsp+136]
14001e93bcmp [rax+218], 0
14001e942je 0x14001e9a3
14001e944mov rcx, [rax+2028]
14001e94btest rcx, rcx
14001e94eje 0x14001e9a3
14001e950mov r10w, [rax+2074]
14001e958test r10w, r10w
14001e95cje 0x14001e9a3
14001e95emov [rsp+48], rcx
14001e963lea rcx, [rsp+48]
14001e968mov [rsp+120], r9
14001e96dmov [rsp+112], r8
14001e972mov [rsp+104], rdx
14001e977mov [rsp+56], r10w
14001e97dcall SysSetConfig
14001e982mov [rsp+40], edi
14001e986mov r9, [rsp+120]
14001e98bmov rcx, rbx
14001e98emov r8, [rsp+112]
14001e993mov rdx, [rsp+104]
14001e998mov [rsp+32], esi
14001e99ccall SysInvoke
14001e9a1jmp 0x14001e9b4
14001e9a3
14001e9a3loc_14001e9a3:
14001e9a3mov [rsp+40], edi
14001e9a7mov rcx, rbx
14001e9aamov [rsp+32], esi
14001e9aecall [rax+636]
14001e9b4
14001e9b4loc_14001e9b4:
14001e9b4mov [rsp+32], eax
14001e9b8lea r9, [rip+43255]
14001e9bfmov ebx, eax
14001e9c1mov r8l, 270
14001e9c7lea rdx, [rip+57826]
14001e9celea rcx, [rip+42891]
14001e9d5call printf.constprop.0
14001e9daadd rsp, 64
14001e9demov eax, ebx
14001e9e0pop rbx
14001e9e1pop rsi
14001e9e2pop rdi
14001e9e3ret
14001e910

14001e9e4
14001e9e4 // align 0x10

14001e9f0
14001e9f0SysNtClose:
14001e9f0push rbx
14001e9f1xor eax, eax
14001e9f3mov rbx, rcx
14001e9f6sub rsp, 64
14001e9famov [rsp+48], rax
14001e9ffmov [rsp+56], rax
14001ea04mov rax, [rip+55653]
14001ea0bcmp [rax+218], 0
14001ea12je 0x14001ea4a
14001ea14mov rdx, [rax+2028]
14001ea1btest rdx, rdx
14001ea1eje 0x14001ea4a
14001ea20mov cx, [rax+2100]
14001ea27test cx, cx
14001ea2aje 0x14001ea4a
14001ea2cmov [rsp+56], cx
14001ea31lea rcx, [rsp+48]
14001ea36mov [rsp+48], rdx
14001ea3bcall SysSetConfig
14001ea40mov rcx, rbx
14001ea43call SysInvoke
14001ea48jmp 0x14001ea53
14001ea4a
14001ea4aloc_14001ea4a:
14001ea4amov rcx, rbx
14001ea4dcall [rax+452]
14001ea53
14001ea53loc_14001ea53:
14001ea53mov [rsp+32], eax
14001ea57lea r9, [rip+43378]
14001ea5emov ebx, eax
14001ea60mov r8l, 451
14001ea66lea rdx, [rip+58787]
14001ea6dlea rcx, [rip+42732]
14001ea74call printf.constprop.0
14001ea79add rsp, 64
14001ea7dmov eax, ebx
14001ea7fpop rbx
14001ea80ret
14001e9f0

14001ea81
14001ea81 // align 0x10

14001ea90
14001ea90SysNtCreateEvent:
14001ea90push rsi
14001ea91xor eax, eax
14001ea93push rbx
14001ea94mov rbx, rcx
14001ea97sub rsp, 72
14001ea9bmov [rsp+48], rax
14001eaa0movzx esi, [rsp+128]
14001eaa8mov [rsp+56], rax
14001eaadmov rax, [rip+55484]
14001eab4cmp [rax+218], 0
14001eabbje 0x14001eb16
14001eabdmov rcx, [rax+2028]
14001eac4test rcx, rcx
14001eac7je 0x14001eb16
14001eac9mov r10w, [rax+2058]
14001ead1test r10w, r10w
14001ead5je 0x14001eb16
14001ead7mov [rsp+48], rcx
14001eadclea rcx, [rsp+48]
14001eae1mov [rsp+120], r9l
14001eae6mov [rsp+112], r8
14001eaebmov [rsp+104], edx
14001eaefmov [rsp+56], r10w
14001eaf5call SysSetConfig
14001eafamov [rsp+32], esi
14001eafemov edx, [rsp+104]
14001eb02mov rcx, rbx
14001eb05mov r9l, [rsp+120]
14001eb0amov r8, [rsp+112]
14001eb0fcall SysInvoke
14001eb14jmp 0x14001eb23
14001eb16
14001eb16loc_14001eb16:
14001eb16mov [rsp+32], esi
14001eb1amov rcx, rbx
14001eb1dcall [rax+564]
14001eb23
14001eb23loc_14001eb23:
14001eb23mov [rsp+32], eax
14001eb27lea r9, [rip+42728]
14001eb2emov ebx, eax
14001eb30mov r8l, 138
14001eb36lea rdx, [rip+58243]
14001eb3dlea rcx, [rip+42524]
14001eb44call printf.constprop.0
14001eb49add rsp, 72
14001eb4dmov eax, ebx
14001eb4fpop rbx
14001eb50pop rsi
14001eb51ret
14001ea90

14001eb52
14001eb52 // align 0x10

14001eb60
14001eb60SysNtCreateThreadEx:
14001eb60push r15
14001eb62xor eax, eax
14001eb64push r14
14001eb66push r13
14001eb68push r12
14001eb6apush rbp
14001eb6bpush rdi
14001eb6cpush rsi
14001eb6dpush rbx
14001eb6emov rbx, rcx
14001eb71sub rsp, 120
14001eb75mov [rsp+96], rax
14001eb7amov rsi, [rsp+224]
14001eb82mov [rsp+104], rax
14001eb87mov rax, [rip+55266]
14001eb8emov rdi, [rsp+232]
14001eb96mov ebp, [rsp+240]
14001eb9dcmp [rax+218], 0
14001eba4mov r12, [rsp+248]
14001ebacmov r13, [rsp+256]
14001ebb4mov r14, [rsp+264]
14001ebbcmov r15, [rsp+272]
14001ebc4je 0x14001ec53
14001ebcamov rcx, [rax+2028]
14001ebd1test rcx, rcx
14001ebd4je 0x14001ec53
14001ebd6mov r10w, [rax+2060]
14001ebdetest r10w, r10w
14001ebe2je 0x14001ec53
14001ebe4mov [rsp+96], rcx
14001ebe9lea rcx, [rsp+96]
14001ebeemov [rsp+216], r9
14001ebf6mov [rsp+208], r8
14001ebfemov [rsp+200], edx
14001ec05mov [rsp+104], r10w
14001ec0bcall SysSetConfig
14001ec10mov [rsp+80], r15
14001ec15mov rcx, rbx
14001ec18mov r9, [rsp+216]
14001ec20mov [rsp+72], r14
14001ec25mov r8, [rsp+208]
14001ec2dmov [rsp+64], r13
14001ec32mov edx, [rsp+200]
14001ec39mov [rsp+56], r12
14001ec3emov [rsp+48], ebp
14001ec42mov [rsp+40], rdi
14001ec47mov [rsp+32], rsi
14001ec4ccall SysInvoke
14001ec51jmp 0x14001ec7e
14001ec53
14001ec53loc_14001ec53:
14001ec53mov [rsp+80], r15
14001ec58mov rcx, rbx
14001ec5bmov [rsp+72], r14
14001ec60mov [rsp+64], r13
14001ec65mov [rsp+56], r12
14001ec6amov [rsp+48], ebp
14001ec6emov [rsp+40], rdi
14001ec73mov [rsp+32], rsi
14001ec78call [rax+572]
14001ec7e
14001ec7eloc_14001ec7e:
14001ec7emov [rsp+32], eax
14001ec82lea r9, [rip+42395]
14001ec89mov ebx, eax
14001ec8bmov r8l, 159
14001ec91lea rdx, [rip+57864]
14001ec98lea rcx, [rip+42177]
14001ec9fcall printf.constprop.0
14001eca4add rsp, 120
14001eca8mov eax, ebx
14001ecaapop rbx
14001ecabpop rsi
14001ecacpop rdi
14001ecadpop rbp
14001ecaepop r12
14001ecb0pop r13
14001ecb2pop r14
14001ecb4pop r15
14001ecb6ret
14001eb60

14001ecb7
14001ecb7 // align 0x10

14001ecc0
14001ecc0SysNtDuplicateObject:
14001ecc0push rbp
14001ecc1xor eax, eax
14001ecc3push rdi
14001ecc4push rsi
14001ecc5push rbx
14001ecc6mov rbx, rcx
14001ecc9sub rsp, 88
14001eccdmov [rsp+64], rax
14001ecd2mov esi, [rsp+160]
14001ecd9mov [rsp+72], rax
14001ecdemov rax, [rip+54923]
14001ece5mov edi, [rsp+168]
14001ececmov ebp, [rsp+176]
14001ecf3cmp [rax+218], 0
14001ecfaje 0x14001ed71
14001ecfcmov rcx, [rax+2028]
14001ed03test rcx, rcx
14001ed06je 0x14001ed71
14001ed08mov r10w, [rax+2062]
14001ed10test r10w, r10w
14001ed14je 0x14001ed71
14001ed16mov [rsp+64], rcx
14001ed1blea rcx, [rsp+64]
14001ed20mov [rsp+152], r9
14001ed28mov [rsp+144], r8
14001ed30mov [rsp+136], rdx
14001ed38mov [rsp+72], r10w
14001ed3ecall SysSetConfig
14001ed43mov [rsp+48], ebp
14001ed47mov rcx, rbx
14001ed4amov r9, [rsp+152]
14001ed52mov [rsp+40], edi
14001ed56mov r8, [rsp+144]
14001ed5emov [rsp+32], esi
14001ed62mov rdx, [rsp+136]
14001ed6acall SysInvoke
14001ed6fjmp 0x14001ed86
14001ed71
14001ed71loc_14001ed71:
14001ed71mov [rsp+48], ebp
14001ed75mov rcx, rbx
14001ed78mov [rsp+40], edi
14001ed7cmov [rsp+32], esi
14001ed80call [rax+580]
14001ed86
14001ed86loc_14001ed86:
14001ed86mov [rsp+32], eax
14001ed8alea r9, [rip+42148]
14001ed91mov ebx, eax
14001ed93mov r8l, 188
14001ed99lea rdx, [rip+57568]
14001eda0lea rcx, [rip+41913]
14001eda7call printf.constprop.0
14001edacadd rsp, 88
14001edb0mov eax, ebx
14001edb2pop rbx
14001edb3pop rsi
14001edb4pop rdi
14001edb5pop rbp
14001edb6ret
14001ecc0

14001edb7
14001edb7 // align 0x10

14001edc0
14001edc0SysNtDuplicateToken:
14001edc0push rdi
14001edc1xor eax, eax
14001edc3movzx r9l, r9b
14001edc7push rsi
14001edc8push rbx
14001edc9mov rbx, rcx
14001edccsub rsp, 80
14001edd0mov [rsp+64], rax
14001edd5mov esi, [rsp+144]
14001eddcmov [rsp+72], rax
14001ede1mov rax, [rip+54664]
14001ede8mov rdi, [rsp+152]
14001edf0cmp [rax+218], 0
14001edf7je 0x14001ee5d
14001edf9mov rcx, [rax+2028]
14001ee00test rcx, rcx
14001ee03je 0x14001ee5d
14001ee05mov r10w, [rax+2050]
14001ee0dtest r10w, r10w
14001ee11je 0x14001ee5d
14001ee13mov [rsp+64], rcx
14001ee18lea rcx, [rsp+64]
14001ee1dmov [rsp+128], r8
14001ee25mov [rsp+120], edx
14001ee29mov [rsp+60], r9l
14001ee2emov [rsp+72], r10w
14001ee34call SysSetConfig
14001ee39mov [rsp+32], esi
14001ee3dmov edx, [rsp+120]
14001ee41mov rcx, rbx
14001ee44mov [rsp+40], rdi
14001ee49mov r9l, [rsp+60]
14001ee4emov r8, [rsp+128]
14001ee56call SysInvoke
14001ee5bjmp 0x14001ee6f
14001ee5d
14001ee5dloc_14001ee5d:
14001ee5dmov [rsp+40], rdi
14001ee62mov rcx, rbx
14001ee65mov [rsp+32], esi
14001ee69call [rax+532]
14001ee6f
14001ee6floc_14001ee6f:
14001ee6fmov [rsp+32], eax
14001ee73lea r9, [rip+41819]
14001ee7amov ebx, eax
14001ee7cmov r8l, 84
14001ee82lea rdx, [rip+57527]
14001ee89lea rcx, [rip+41680]
14001ee90call printf.constprop.0
14001ee95add rsp, 80
14001ee99mov eax, ebx
14001ee9bpop rbx
14001ee9cpop rsi
14001ee9dpop rdi
14001ee9eret
14001edc0

14001ee9f
14001ee9f // align 0x10

14001eea0
14001eea0SysNtFreeVirtualMemory:
14001eea0push rbx
14001eea1xor eax, eax
14001eea3mov rbx, rcx
14001eea6sub rsp, 64
14001eeaamov [rsp+48], rax
14001eeafmov [rsp+56], rax
14001eeb4mov rax, [rip+54453]
14001eebbcmp [rax+218], 0
14001eec2je 0x14001ef1b
14001eec4mov rcx, [rax+2028]
14001eecbtest rcx, rcx
14001eeceje 0x14001ef1b
14001eed0mov r10w, [rax+2080]
14001eed8test r10w, r10w
14001eedcje 0x14001ef1b
14001eedemov [rsp+48], rcx
14001eee3lea rcx, [rsp+48]
14001eee8mov [rsp+104], r9l
14001eeedmov [rsp+96], r8
14001eef2mov [rsp+88], rdx
14001eef7mov [rsp+56], r10w
14001eefdcall SysSetConfig
14001ef02mov r9l, [rsp+104]
14001ef07mov r8, [rsp+96]
14001ef0cmov rcx, rbx
14001ef0fmov rdx, [rsp+88]
14001ef14call SysInvoke
14001ef19jmp 0x14001ef24
14001ef1b
14001ef1bloc_14001ef1b:
14001ef1bmov rcx, rbx
14001ef1ecall [rax+660]
14001ef24
14001ef24loc_14001ef24:
14001ef24mov [rsp+32], eax
14001ef28lea r9, [rip+41908]
14001ef2fmov ebx, eax
14001ef31mov r8l, 299
14001ef37lea rdx, [rip+56322]
14001ef3elea rcx, [rip+41499]
14001ef45call printf.constprop.0
14001ef4aadd rsp, 64
14001ef4emov eax, ebx
14001ef50pop rbx
14001ef51ret
14001eea0

14001ef52
14001ef52 // align 0x10

14001ef60
14001ef60SysNtGetContextThread:
14001ef60push rbx
14001ef61xor eax, eax
14001ef63mov rbx, rcx
14001ef66sub rsp, 64
14001ef6amov [rsp+48], rax
14001ef6fmov [rsp+56], rax
14001ef74mov rax, [rip+54261]
14001ef7bcmp [rax+218], 0
14001ef82je 0x14001efc7
14001ef84mov rcx, [rax+2028]
14001ef8btest rcx, rcx
14001ef8eje 0x14001efc7
14001ef90mov r8w, [rax+2064]
14001ef98test r8w, r8w
14001ef9cje 0x14001efc7
14001ef9emov [rsp+48], rcx
14001efa3lea rcx, [rsp+48]
14001efa8mov [rsp+88], rdx
14001efadmov [rsp+56], r8w
14001efb3call SysSetConfig
14001efb8mov rdx, [rsp+88]
14001efbdmov rcx, rbx
14001efc0call SysInvoke
14001efc5jmp 0x14001efd0
14001efc7
14001efc7loc_14001efc7:
14001efc7mov rcx, rbx
14001efcacall [rax+588]
14001efd0
14001efd0loc_14001efd0:
14001efd0mov [rsp+32], eax
14001efd4lea r9, [rip+41580]
14001efdbmov ebx, eax
14001efddmov r8l, 200
14001efe3lea rdx, [rip+56918]
14001efealea rcx, [rip+41327]
14001eff1call printf.constprop.0
14001eff6add rsp, 64
14001effamov eax, ebx
14001effcpop rbx
14001effdret
14001ef60

14001effe
14001effe // align 0x10

14001f000
14001f000SysNtGetNextThread:
14001f000push rdi
14001f001xor eax, eax
14001f003push rsi
14001f004push rbx
14001f005mov rbx, rcx
14001f008sub rsp, 64
14001f00cmov [rsp+48], rax
14001f011mov esi, [rsp+128]
14001f018mov [rsp+56], rax
14001f01dmov rax, [rip+54092]
14001f024mov rdi, [rsp+136]
14001f02ccmp [rax+218], 0
14001f033je 0x14001f095
14001f035mov rcx, [rax+2028]
14001f03ctest rcx, rcx
14001f03fje 0x14001f095
14001f041mov r10w, [rax+2108]
14001f049test r10w, r10w
14001f04dje 0x14001f095
14001f04fmov [rsp+48], rcx
14001f054lea rcx, [rsp+48]
14001f059mov [rsp+120], r9l
14001f05emov [rsp+112], r8l
14001f063mov [rsp+104], rdx
14001f068mov [rsp+56], r10w
14001f06ecall SysSetConfig
14001f073mov [rsp+40], rdi
14001f078mov r9l, [rsp+120]
14001f07dmov rcx, rbx
14001f080mov r8l, [rsp+112]
14001f085mov rdx, [rsp+104]
14001f08amov [rsp+32], esi
14001f08ecall SysInvoke
14001f093jmp 0x14001f0a7
14001f095
14001f095loc_14001f095:
14001f095mov [rsp+40], rdi
14001f09amov rcx, rbx
14001f09dmov [rsp+32], esi
14001f0a1call [rax+484]
14001f0a7
14001f0a7loc_14001f0a7:
14001f0a7mov [rsp+32], eax
14001f0ablea r9, [rip+41819]
14001f0b2mov ebx, eax
14001f0b4mov r8l, 497
14001f0balea rdx, [rip+54735]
14001f0c1lea rcx, [rip+41112]
14001f0c8call printf.constprop.0
14001f0cdadd rsp, 64
14001f0d1mov eax, ebx
14001f0d3pop rbx
14001f0d4pop rsi
14001f0d5pop rdi
14001f0d6ret
14001f000

14001f0d7
14001f0d7 // align 0x10

14001f0e0
14001f0e0SysNtOpenProcess:
14001f0e0push rbx
14001f0e1xor eax, eax
14001f0e3mov rbx, rcx
14001f0e6sub rsp, 64
14001f0eamov [rsp+48], rax
14001f0efmov [rsp+56], rax
14001f0f4mov rax, [rip+53877]
14001f0fbcmp [rax+218], 0
14001f102je 0x14001f159
14001f104mov rcx, [rax+2028]
14001f10btest rcx, rcx
14001f10eje 0x14001f159
14001f110mov r10w, [rax+2046]
14001f118test r10w, r10w
14001f11cje 0x14001f159
14001f11emov [rsp+48], rcx
14001f123lea rcx, [rsp+48]
14001f128mov [rsp+104], r9
14001f12dmov [rsp+96], r8
14001f132mov [rsp+88], edx
14001f136mov [rsp+56], r10w
14001f13ccall SysSetConfig
14001f141mov r9, [rsp+104]
14001f146mov r8, [rsp+96]
14001f14bmov rcx, rbx
14001f14emov edx, [rsp+88]
14001f152call SysInvoke
14001f157jmp 0x14001f162
14001f159
14001f159loc_14001f159:
14001f159mov rcx, rbx
14001f15ccall [rax+516]
14001f162
14001f162loc_14001f162:
14001f162mov [rsp+32], eax
14001f166lea r9, [rip+40994]
14001f16dmov ebx, eax
14001f16fmov r8l, 29
14001f175lea rdx, [rip+57172]
14001f17clea rcx, [rip+40925]
14001f183call printf.constprop.0
14001f188add rsp, 64
14001f18cmov eax, ebx
14001f18epop rbx
14001f18fret
14001f0e0

14001f190
14001f190SysNtOpenProcessToken:
14001f190push rbx
14001f191xor eax, eax
14001f193mov rbx, rcx
14001f196sub rsp, 64
14001f19amov [rsp+48], rax
14001f19fmov [rsp+56], rax
14001f1a4mov rax, [rip+53701]
14001f1abcmp [rax+218], 0
14001f1b2je 0x14001f1ff
14001f1b4mov rcx, [rax+2028]
14001f1bbtest rcx, rcx
14001f1beje 0x14001f1ff
14001f1c0mov r9w, [rax+2048]
14001f1c8test r9w, r9w
14001f1ccje 0x14001f1ff
14001f1cemov [rsp+48], rcx
14001f1d3lea rcx, [rsp+48]
14001f1d8mov [rsp+96], r8
14001f1ddmov [rsp+88], edx
14001f1e1mov [rsp+56], r9w
14001f1e7call SysSetConfig
14001f1ecmov r8, [rsp+96]
14001f1f1mov edx, [rsp+88]
14001f1f5mov rcx, rbx
14001f1f8call SysInvoke
14001f1fdjmp 0x14001f208
14001f1ff
14001f1ffloc_14001f1ff:
14001f1ffmov rcx, rbx
14001f202call [rax+524]
14001f208
14001f208loc_14001f208:
14001f208mov [rsp+32], eax
14001f20clea r9, [rip+40879]
14001f213mov ebx, eax
14001f215mov r8l, 68
14001f21blea rdx, [rip+56638]
14001f222lea rcx, [rip+40759]
14001f229call printf.constprop.0
14001f22eadd rsp, 64
14001f232mov eax, ebx
14001f234pop rbx
14001f235ret
14001f190

14001f236
14001f236 // align 0x10

14001f240
14001f240SysNtOpenThread:
14001f240push rbx
14001f241xor eax, eax
14001f243mov rbx, rcx
14001f246sub rsp, 64
14001f24amov [rsp+48], rax
14001f24fmov [rsp+56], rax
14001f254mov rax, [rip+53525]
14001f25bcmp [rax+218], 0
14001f262je 0x14001f2b9
14001f264mov rcx, [rax+2028]
14001f26btest rcx, rcx
14001f26eje 0x14001f2b9
14001f270mov r10w, [rax+2040]
14001f278test r10w, r10w
14001f27cje 0x14001f2b9
14001f27emov [rsp+48], rcx
14001f283lea rcx, [rsp+48]
14001f288mov [rsp+104], r9
14001f28dmov [rsp+96], r8
14001f292mov [rsp+88], edx
14001f296mov [rsp+56], r10w
14001f29ccall SysSetConfig
14001f2a1mov r9, [rsp+104]
14001f2a6mov r8, [rsp+96]
14001f2abmov rcx, rbx
14001f2aemov edx, [rsp+88]
14001f2b2call SysInvoke
14001f2b7jmp 0x14001f2c2
14001f2b9
14001f2b9loc_14001f2b9:
14001f2b9mov rcx, rbx
14001f2bccall [rax+492]
14001f2c2
14001f2c2loc_14001f2c2:
14001f2c2mov [rsp+32], eax
14001f2c6lea r9, [rip+40629]
14001f2cdmov ebx, eax
14001f2cfmov r8l, 15
14001f2d5lea rdx, [rip+56852]
14001f2dclea rcx, [rip+40573]
14001f2e3call printf.constprop.0
14001f2e8add rsp, 64
14001f2ecmov eax, ebx
14001f2eepop rbx
14001f2efret
14001f240

14001f2f0
14001f2f0SysNtOpenThreadToken:
14001f2f0push rbx
14001f2f1xor eax, eax
14001f2f3mov rbx, rcx
14001f2f6movzx r8l, r8b
14001f2fasub rsp, 80
14001f2femov [rsp+64], rax
14001f303mov [rsp+72], rax
14001f308mov rax, [rip+53345]
14001f30fcmp [rax+218], 0
14001f316je 0x14001f36d
14001f318mov rcx, [rax+2028]
14001f31ftest rcx, rcx
14001f322je 0x14001f36d
14001f324mov r10w, [rax+2042]
14001f32ctest r10w, r10w
14001f330je 0x14001f36d
14001f332mov [rsp+64], rcx
14001f337lea rcx, [rsp+64]
14001f33cmov [rsp+120], r9
14001f341mov [rsp+104], edx
14001f345mov [rsp+60], r8l
14001f34amov [rsp+72], r10w
14001f350call SysSetConfig
14001f355mov r9, [rsp+120]
14001f35amov r8l, [rsp+60]
14001f35fmov rcx, rbx
14001f362mov edx, [rsp+104]
14001f366call SysInvoke
14001f36bjmp 0x14001f376
14001f36d
14001f36dloc_14001f36d:
14001f36dmov rcx, rbx
14001f370call [rax+500]
14001f376
14001f376loc_14001f376:
14001f376mov [rsp+32], eax
14001f37alea r9, [rip+40495]
14001f381mov ebx, eax
14001f383mov r8l, 55
14001f389lea rdx, [rip+56576]
14001f390lea rcx, [rip+40393]
14001f397call printf.constprop.0
14001f39cadd rsp, 80
14001f3a0mov eax, ebx
14001f3a2pop rbx
14001f3a3ret
14001f2f0

14001f3a4
14001f3a4 // align 0x10

14001f3b0
14001f3b0SysNtProtectVirtualMemory:
14001f3b0push rsi
14001f3b1xor eax, eax
14001f3b3push rbx
14001f3b4mov rbx, rcx
14001f3b7sub rsp, 72
14001f3bbmov [rsp+48], rax
14001f3c0mov rsi, [rsp+128]
14001f3c8mov [rsp+56], rax
14001f3cdmov rax, [rip+53148]
14001f3d4cmp [rax+218], 0
14001f3dbje 0x14001f439
14001f3ddmov rcx, [rax+2028]
14001f3e4test rcx, rcx
14001f3e7je 0x14001f439
14001f3e9mov r10w, [rax+2084]
14001f3f1test r10w, r10w
14001f3f5je 0x14001f439
14001f3f7mov [rsp+48], rcx
14001f3fclea rcx, [rsp+48]
14001f401mov [rsp+120], r9l
14001f406mov [rsp+112], r8
14001f40bmov [rsp+104], rdx
14001f410mov [rsp+56], r10w
14001f416call SysSetConfig
14001f41bmov [rsp+32], rsi
14001f420mov r9l, [rsp+120]
14001f425mov rcx, rbx
14001f428mov r8, [rsp+112]
14001f42dmov rdx, [rsp+104]
14001f432call SysInvoke
14001f437jmp 0x14001f447
14001f439
14001f439loc_14001f439:
14001f439mov [rsp+32], rsi
14001f43emov rcx, rbx
14001f441call [rax+676]
14001f447
14001f447loc_14001f447:
14001f447mov [rsp+32], eax
14001f44blea r9, [rip+40634]
14001f452mov ebx, eax
14001f454mov r8l, 326
14001f45alea rdx, [rip+54831]
14001f461lea rcx, [rip+40184]
14001f468call printf.constprop.0
14001f46dadd rsp, 72
14001f471mov eax, ebx
14001f473pop rbx
14001f474pop rsi
14001f475ret
14001f3b0

14001f476
14001f476 // align 0x10

14001f480
14001f480SysNtQueryInformationProcess:
14001f480push rsi
14001f481xor eax, eax
14001f483push rbx
14001f484mov rbx, rcx
14001f487sub rsp, 72
14001f48bmov [rsp+48], rax
14001f490mov rsi, [rsp+128]
14001f498mov [rsp+56], rax
14001f49dmov rax, [rip+52940]
14001f4a4cmp [rax+218], 0
14001f4abje 0x14001f507
14001f4admov rcx, [rax+2028]
14001f4b4test rcx, rcx
14001f4b7je 0x14001f507
14001f4b9mov r10w, [rax+2068]
14001f4c1test r10w, r10w
14001f4c5je 0x14001f507
14001f4c7mov [rsp+48], rcx
14001f4cclea rcx, [rsp+48]
14001f4d1mov [rsp+120], r9l
14001f4d6mov [rsp+112], r8
14001f4dbmov [rsp+104], edx
14001f4dfmov [rsp+56], r10w
14001f4e5call SysSetConfig
14001f4eamov [rsp+32], rsi
14001f4efmov edx, [rsp+104]
14001f4f3mov rcx, rbx
14001f4f6mov r9l, [rsp+120]
14001f4fbmov r8, [rsp+112]
14001f500call SysInvoke
14001f505jmp 0x14001f515
14001f507
14001f507loc_14001f507:
14001f507mov [rsp+32], rsi
14001f50cmov rcx, rbx
14001f50fcall [rax+604]
14001f515
14001f515loc_14001f515:
14001f515mov [rsp+32], eax
14001f519lea r9, [rip+40269]
14001f520mov ebx, eax
14001f522mov r8l, 227
14001f528lea rdx, [rip+55057]
14001f52flea rcx, [rip+39978]
14001f536call printf.constprop.0
14001f53badd rsp, 72
14001f53fmov eax, ebx
14001f541pop rbx
14001f542pop rsi
14001f543ret
14001f480

14001f544
14001f544 // align 0x10

14001f550
14001f550SysNtQueryInformationThread:
14001f550push rsi
14001f551xor eax, eax
14001f553push rbx
14001f554mov rbx, rcx
14001f557sub rsp, 72
14001f55bmov [rsp+48], rax
14001f560mov rsi, [rsp+128]
14001f568mov [rsp+56], rax
14001f56dmov rax, [rip+52732]
14001f574cmp [rax+218], 0
14001f57bje 0x14001f5d7
14001f57dmov rcx, [rax+2028]
14001f584test rcx, rcx
14001f587je 0x14001f5d7
14001f589mov r10w, [rax+2096]
14001f591test r10w, r10w
14001f595je 0x14001f5d7
14001f597mov [rsp+48], rcx
14001f59clea rcx, [rsp+48]
14001f5a1mov [rsp+120], r9l
14001f5a6mov [rsp+112], r8
14001f5abmov [rsp+104], edx
14001f5afmov [rsp+56], r10w
14001f5b5call SysSetConfig
14001f5bamov [rsp+32], rsi
14001f5bfmov edx, [rsp+104]
14001f5c3mov rcx, rbx
14001f5c6mov r9l, [rsp+120]
14001f5cbmov r8, [rsp+112]
14001f5d0call SysInvoke
14001f5d5jmp 0x14001f5e5
14001f5d7
14001f5d7loc_14001f5d7:
14001f5d7mov [rsp+32], rsi
14001f5dcmov rcx, rbx
14001f5dfcall [rax+732]
14001f5e5
14001f5e5loc_14001f5e5:
14001f5e5mov [rsp+32], eax
14001f5e9lea r9, [rip+40377]
14001f5f0mov ebx, eax
14001f5f2mov r8l, 425
14001f5f8lea rdx, [rip+56385]
14001f5fflea rcx, [rip+39770]
14001f606call printf.constprop.0
14001f60badd rsp, 72
14001f60fmov eax, ebx
14001f611pop rbx
14001f612pop rsi
14001f613ret
14001f550