Similarity

14001da50
14001da50SysImpersonateLoggedOnUser:
14001da50push rdi
14001da51xor eax, eax
14001da53xor r8l, r8l
14001da56xor r9l, r9l
14001da59push rsi
14001da5axor r11l, r11l
14001da5dxor r10l, r10l
14001da60mov edx, 8
14001da65push rbx
14001da66mov rbx, rcx
14001da69mov ecx, 12
14001da6esub rsp, 144
14001da75lea rdi, [rsp+96]
14001da7amov [rsp+84], r8
14001da7flea r8, [rsp+64]
14001da84rep stosd [rdi], eax
14001da86lea rax, [rsp+68]
14001da8bmov [rsp+92], r9l
14001da90mov rcx, rbx
14001da93mov [rsp+32], rax
14001da98mov r9l, 4
14001da9emov [rsp+72], r10
14001daa3mov [rsp+64], r11l
14001daa8mov [rsp+68], r11l
14001daadcall SysNtQueryInformationToken
14001dab2test eax, eax
14001dab4jns 0x14001daeb
14001dab6mov ecx, eax
14001dab8mov [rsp+60], eax
14001dabcmov rax, [rip+59565]
14001dac3call [rax+348]
14001dac9mov r9l, [rsp+60]
14001dacemov r8l, 1300
14001dad4lea rdx, [rip+60949]
14001dadbmov [rsp+32], eax
14001dadflea rcx, [rip+49627]
14001dae6jmp 0x14001dbea
14001daeb
14001daebloc_14001daeb:
14001daebcmp [rsp+64], 1
14001daf0lea rsi, [rsp+72]
14001daf5jne 0x14001db96
14001dafbmov eax, 0xffffffff80000003
14001db00mov [rsp+40], rsi
14001db05xor edx, edx
14001db07xor ecx, ecx
14001db09shl rax, 2
14001db0dmov [rsp+120], edx
14001db11xor r9l, r9l
14001db14lea r8, [rsp+96]
14001db19mov [rsp+32], 2
14001db21mov edx, 12
14001db26mov [rsp+84], rax
14001db2bxor eax, eax
14001db2dmov [rsp+104], rax
14001db32mov [rsp+112], rax
14001db37lea rax, [rsp+84]
14001db3cmov [rsp+128], rcx
14001db44mov rcx, rbx
14001db47mov [rsp+92], 1
14001db4emov [rsp+96], 48
14001db56mov [rsp+136], rax
14001db5ecall SysNtDuplicateToken
14001db63test eax, eax
14001db65jns 0x14001db6e
14001db67
14001db67loc_14001db67:
14001db67xor eax, eax
14001db69jmp 0x14001dbf4
14001db6e
14001db6eloc_14001db6e:
14001db6emov r9l, 8
14001db74mov r8, rsi
14001db77mov edx, 5
14001db7cmov rcx, -2
14001db83call SysNtSetInformationThread
14001db88mov rcx, [rsp+72]
14001db8dmov ebx, eax
14001db8fcall SysNtClose
14001db94jmp 0x14001dbb7
14001db96
14001db96loc_14001db96:
14001db96mov r9l, 8
14001db9cmov r8, rsi
14001db9fmov edx, 5
14001dba4mov rcx, -2
14001dbabmov [rsp+72], rbx
14001dbb0call SysNtSetInformationThread
14001dbb5mov ebx, eax
14001dbb7
14001dbb7loc_14001dbb7:
14001dbb7mov eax, 1
14001dbbctest ebx, ebx
14001dbbejns 0x14001dbf4
14001dbc0mov rax, [rip+59305]
14001dbc7mov ecx, ebx
14001dbc9call [rax+348]
14001dbcfmov r9l, ebx
14001dbd2mov r8l, 1354
14001dbd8lea rdx, [rip+60689]
14001dbdfmov [rsp+32], eax
14001dbe3lea rcx, [rip+49429]
14001dbea
14001dbealoc_14001dbea:
14001dbeacall printf
14001dbefjmp 0x14001db67
14001dbf4
14001dbf4loc_14001dbf4:
14001dbf4add rsp, 144
14001dbfbpop rbx
14001dbfcpop rsi
14001dbfdpop rdi
14001dbferet
14001da50

14001dbff
14001dbff // align 0x10

14001dc00
14001dc00SysInitialize:
14001dc00push rbx
14001dc01xor eax, eax
14001dc03sub rsp, 64
14001dc07mov [rsp+56], rax
14001dc0cxor eax, eax
14001dc0etest rcx, rcx
14001dc11je 0x14001e861
14001dc17mov edx, 0xffffffff8cfcc776
14001dc1ccall LdrFunctionAddr
14001dc21mov rbx, [rip+59208]
14001dc28test rax, rax
14001dc2bmov rcx, rax
14001dc2eje 0x14001dc75
14001dc30lea r9, [rsp+56]
14001dc35xor r8l, r8l
14001dc38mov edx, 1
14001dc3dcall SysExtract
14001dc42mov rax, [rsp+56]
14001dc47test rax, rax
14001dc4aje 0x14001dc55
14001dc4cmov [rbx+2028], rax
14001dc53jmp 0x14001dc75
14001dc55
14001dc55loc_14001dc55:
14001dc55lea r9, [rip+47463]
14001dc5cmov r8l, 32
14001dc62lea rdx, [rip+61639]
14001dc69lea rcx, [rip+47191]
14001dc70call printf
14001dc75
14001dc75loc_14001dc75:
14001dc75mov rcx, [rbx+492]
14001dc7ctest rcx, rcx
14001dc7fje 0x14001dccc
14001dc81xor r9l, r9l
14001dc84lea r8, [rbx+2040]
14001dc8bmov edx, 1
14001dc90call SysExtract
14001dc95mov rax, [rbx+492]
14001dc9clea r9, [rip+47426]
14001dca3mov r8l, 44
14001dca9lea rdx, [rip+61568]
14001dcb0lea rcx, [rip+47419]
14001dcb7mov [rsp+40], rax
14001dcbcmovzx eax, [rbx+2040]
14001dcc3mov [rsp+32], eax
14001dcc7call printf
14001dccc
14001dcccloc_14001dccc:
14001dcccmov rcx, [rbx+500]
14001dcd3test rcx, rcx
14001dcd6je 0x14001dd23
14001dcd8xor r9l, r9l
14001dcdblea r8, [rbx+2042]
14001dce2mov edx, 1
14001dce7call SysExtract
14001dcecmov rax, [rbx+500]
14001dcf3lea r9, [rip+47404]
14001dcfamov r8l, 45
14001dd00lea rdx, [rip+61481]
14001dd07lea rcx, [rip+47332]
14001dd0emov [rsp+40], rax
14001dd13movzx eax, [rbx+2042]
14001dd1amov [rsp+32], eax
14001dd1ecall printf
14001dd23
14001dd23loc_14001dd23:
14001dd23mov rcx, [rbx+516]
14001dd2atest rcx, rcx
14001dd2dje 0x14001dd7a
14001dd2fxor r9l, r9l
14001dd32lea r8, [rbx+2046]
14001dd39mov edx, 1
14001dd3ecall SysExtract
14001dd43mov rax, [rbx+516]
14001dd4alea r9, [rip+47335]
14001dd51mov r8l, 46
14001dd57lea rdx, [rip+61394]
14001dd5elea rcx, [rip+47245]
14001dd65mov [rsp+40], rax
14001dd6amovzx eax, [rbx+2046]
14001dd71mov [rsp+32], eax
14001dd75call printf
14001dd7a
14001dd7aloc_14001dd7a:
14001dd7amov rcx, [rbx+508]
14001dd81test rcx, rcx
14001dd84je 0x14001ddd1
14001dd86xor r9l, r9l
14001dd89lea r8, [rbx+2044]
14001dd90mov edx, 1
14001dd95call SysExtract
14001dd9amov rax, [rbx+508]
14001dda1lea r9, [rip+47262]
14001dda8mov r8l, 47
14001ddaelea rdx, [rip+61307]
14001ddb5lea rcx, [rip+47158]
14001ddbcmov [rsp+40], rax
14001ddc1movzx eax, [rbx+2044]
14001ddc8mov [rsp+32], eax
14001ddcccall printf
14001ddd1
14001ddd1loc_14001ddd1:
14001ddd1mov rcx, [rbx+524]
14001ddd8test rcx, rcx
14001dddbje 0x14001de28
14001ddddxor r9l, r9l
14001dde0lea r8, [rbx+2048]
14001dde7mov edx, 1
14001ddeccall SysExtract
14001ddf1mov rax, [rbx+524]
14001ddf8lea r9, [rip+47194]
14001ddffmov r8l, 48
14001de05lea rdx, [rip+61220]
14001de0clea rcx, [rip+47071]
14001de13mov [rsp+40], rax
14001de18movzx eax, [rbx+2048]
14001de1fmov [rsp+32], eax
14001de23call printf
14001de28
14001de28loc_14001de28:
14001de28mov rcx, [rbx+532]
14001de2ftest rcx, rcx
14001de32je 0x14001de7f
14001de34xor r9l, r9l
14001de37lea r8, [rbx+2050]
14001de3emov edx, 1
14001de43call SysExtract
14001de48mov rax, [rbx+532]
14001de4flea r9, [rip+47126]
14001de56mov r8l, 49
14001de5clea rdx, [rip+61133]
14001de63lea rcx, [rip+46984]
14001de6amov [rsp+40], rax
14001de6fmovzx eax, [rbx+2050]
14001de76mov [rsp+32], eax
14001de7acall printf
14001de7f
14001de7floc_14001de7f:
14001de7fmov rcx, [rbx+540]
14001de86test rcx, rcx
14001de89je 0x14001ded6
14001de8bxor r9l, r9l
14001de8elea r8, [rbx+2052]
14001de95mov edx, 1
14001de9acall SysExtract
14001de9fmov rax, [rbx+540]
14001dea6lea r9, [rip+47056]
14001deadmov r8l, 50
14001deb3lea rdx, [rip+61046]
14001debalea rcx, [rip+46897]
14001dec1mov [rsp+40], rax
14001dec6movzx eax, [rbx+2052]
14001decdmov [rsp+32], eax
14001ded1call printf
14001ded6
14001ded6loc_14001ded6:
14001ded6mov rcx, [rbx+548]
14001deddtest rcx, rcx
14001dee0je 0x14001df2d
14001dee2xor r9l, r9l
14001dee5lea r8, [rbx+2054]
14001deecmov edx, 1
14001def1call SysExtract
14001def6mov rax, [rbx+548]
14001defdlea r9, [rip+46986]
14001df04mov r8l, 51
14001df0alea rdx, [rip+60959]
14001df11lea rcx, [rip+46810]
14001df18mov [rsp+40], rax
14001df1dmovzx eax, [rbx+2054]
14001df24mov [rsp+32], eax
14001df28call printf
14001df2d
14001df2dloc_14001df2d:
14001df2dmov rcx, [rbx+556]
14001df34test rcx, rcx
14001df37je 0x14001df84
14001df39xor r9l, r9l
14001df3clea r8, [rbx+2056]
14001df43mov edx, 1
14001df48call SysExtract
14001df4dmov rax, [rbx+556]
14001df54lea r9, [rip+46915]
14001df5bmov r8l, 52
14001df61lea rdx, [rip+60872]
14001df68lea rcx, [rip+46723]
14001df6fmov [rsp+40], rax
14001df74movzx eax, [rbx+2056]
14001df7bmov [rsp+32], eax
14001df7fcall printf
14001df84
14001df84loc_14001df84:
14001df84mov rcx, [rbx+564]
14001df8btest rcx, rcx
14001df8eje 0x14001dfdb
14001df90xor r9l, r9l
14001df93lea r8, [rbx+2058]
14001df9amov edx, 1
14001df9fcall SysExtract
14001dfa4mov rax, [rbx+564]
14001dfablea r9, [rip+46843]
14001dfb2mov r8l, 53
14001dfb8lea rdx, [rip+60785]
14001dfbflea rcx, [rip+46636]
14001dfc6mov [rsp+40], rax
14001dfcbmovzx eax, [rbx+2058]
14001dfd2mov [rsp+32], eax
14001dfd6call printf
14001dfdb
14001dfdbloc_14001dfdb:
14001dfdbmov rcx, [rbx+572]
14001dfe2test rcx, rcx
14001dfe5je 0x14001e032
14001dfe7xor r9l, r9l
14001dfealea r8, [rbx+2060]
14001dff1mov edx, 1
14001dff6call SysExtract
14001dffbmov rax, [rbx+572]
14001e002lea r9, [rip+46770]
14001e009mov r8l, 54
14001e00flea rdx, [rip+60698]
14001e016lea rcx, [rip+46549]
14001e01dmov [rsp+40], rax
14001e022movzx eax, [rbx+2060]
14001e029mov [rsp+32], eax
14001e02dcall printf
14001e032
14001e032loc_14001e032:
14001e032mov rcx, [rbx+580]
14001e039test rcx, rcx
14001e03cje 0x14001e089
14001e03exor r9l, r9l
14001e041lea r8, [rbx+2062]
14001e048mov edx, 1
14001e04dcall SysExtract
14001e052mov rax, [rbx+580]
14001e059lea r9, [rip+46700]
14001e060mov r8l, 55
14001e066lea rdx, [rip+60611]
14001e06dlea rcx, [rip+46462]
14001e074mov [rsp+40], rax
14001e079movzx eax, [rbx+2062]
14001e080mov [rsp+32], eax
14001e084call printf
14001e089
14001e089loc_14001e089:
14001e089mov rcx, [rbx+588]
14001e090test rcx, rcx
14001e093je 0x14001e0e0
14001e095xor r9l, r9l
14001e098lea r8, [rbx+2064]
14001e09fmov edx, 1
14001e0a4call SysExtract
14001e0a9mov rax, [rbx+588]
14001e0b0lea r9, [rip+46631]
14001e0b7mov r8l, 56
14001e0bdlea rdx, [rip+60524]
14001e0c4lea rcx, [rip+46375]
14001e0cbmov [rsp+40], rax
14001e0d0movzx eax, [rbx+2064]
14001e0d7mov [rsp+32], eax
14001e0dbcall printf
14001e0e0
14001e0e0loc_14001e0e0:
14001e0e0mov rcx, [rbx+596]
14001e0e7test rcx, rcx
14001e0eaje 0x14001e137
14001e0ecxor r9l, r9l
14001e0eflea r8, [rbx+2066]
14001e0f6mov edx, 1
14001e0fbcall SysExtract
14001e100mov rax, [rbx+596]
14001e107lea r9, [rip+46563]
14001e10emov r8l, 57
14001e114lea rdx, [rip+60437]
14001e11blea rcx, [rip+46288]
14001e122mov [rsp+40], rax
14001e127movzx eax, [rbx+2066]
14001e12emov [rsp+32], eax
14001e132call printf
14001e137
14001e137loc_14001e137:
14001e137mov rcx, [rbx+604]
14001e13etest rcx, rcx
14001e141je 0x14001e18e
14001e143xor r9l, r9l
14001e146lea r8, [rbx+2068]
14001e14dmov edx, 1
14001e152call SysExtract
14001e157mov rax, [rbx+604]
14001e15elea r9, [rip+46495]
14001e165mov r8l, 58
14001e16blea rdx, [rip+60350]
14001e172lea rcx, [rip+46201]
14001e179mov [rsp+40], rax
14001e17emovzx eax, [rbx+2068]
14001e185mov [rsp+32], eax
14001e189call printf
14001e18e
14001e18eloc_14001e18e:
14001e18emov rcx, [rbx+612]
14001e195test rcx, rcx
14001e198je 0x14001e1e5
14001e19axor r9l, r9l
14001e19dlea r8, [rbx+2070]
14001e1a4mov edx, 1
14001e1a9call SysExtract
14001e1aemov rax, [rbx+612]
14001e1b5lea r9, [rip+46434]
14001e1bcmov r8l, 59
14001e1c2lea rdx, [rip+60263]
14001e1c9lea rcx, [rip+46114]
14001e1d0mov [rsp+40], rax
14001e1d5movzx eax, [rbx+2070]
14001e1dcmov [rsp+32], eax
14001e1e0call printf
14001e1e5
14001e1e5loc_14001e1e5:
14001e1e5mov rcx, [rbx+620]
14001e1ectest rcx, rcx
14001e1efje 0x14001e23c
14001e1f1xor r9l, r9l
14001e1f4lea r8, [rbx+2072]
14001e1fbmov edx, 1
14001e200call SysExtract
14001e205mov rax, [rbx+620]
14001e20clea r9, [rip+46372]
14001e213mov r8l, 60
14001e219lea rdx, [rip+60176]
14001e220lea rcx, [rip+46027]
14001e227mov [rsp+40], rax
14001e22cmovzx eax, [rbx+2072]
14001e233mov [rsp+32], eax
14001e237call printf
14001e23c
14001e23cloc_14001e23c:
14001e23cmov rcx, [rbx+636]
14001e243test rcx, rcx
14001e246je 0x14001e293
14001e248xor r9l, r9l
14001e24blea r8, [rbx+2074]
14001e252mov edx, 1
14001e257call SysExtract
14001e25cmov rax, [rbx+636]
14001e263lea r9, [rip+46307]
14001e26amov r8l, 61
14001e270lea rdx, [rip+60089]
14001e277lea rcx, [rip+45940]
14001e27emov [rsp+40], rax
14001e283movzx eax, [rbx+2074]
14001e28amov [rsp+32], eax
14001e28ecall printf
14001e293
14001e293loc_14001e293:
14001e293mov rcx, [rbx+644]
14001e29atest rcx, rcx
14001e29dje 0x14001e2ea
14001e29fxor r9l, r9l
14001e2a2lea r8, [rbx+2076]
14001e2a9mov edx, 1
14001e2aecall SysExtract
14001e2b3mov rax, [rbx+644]
14001e2balea r9, [rip+46244]
14001e2c1mov r8l, 62
14001e2c7lea rdx, [rip+60002]
14001e2celea rcx, [rip+45853]
14001e2d5mov [rsp+40], rax
14001e2damovzx eax, [rbx+2076]
14001e2e1mov [rsp+32], eax
14001e2e5call printf
14001e2ea
14001e2ealoc_14001e2ea:
14001e2eamov rcx, [rbx+652]
14001e2f1test rcx, rcx
14001e2f4je 0x14001e341
14001e2f6xor r9l, r9l
14001e2f9lea r8, [rbx+2078]
14001e300mov edx, 1
14001e305call SysExtract
14001e30amov rax, [rbx+652]
14001e311lea r9, [rip+46178]
14001e318mov r8l, 63
14001e31elea rdx, [rip+59915]
14001e325lea rcx, [rip+45766]
14001e32cmov [rsp+40], rax
14001e331movzx eax, [rbx+2078]
14001e338mov [rsp+32], eax
14001e33ccall printf
14001e341
14001e341loc_14001e341:
14001e341mov rcx, [rbx+660]
14001e348test rcx, rcx
14001e34bje 0x14001e398
14001e34dxor r9l, r9l
14001e350lea r8, [rbx+2080]
14001e357mov edx, 1
14001e35ccall SysExtract
14001e361mov rax, [rbx+660]
14001e368lea r9, [rip+46111]
14001e36fmov r8l, 64
14001e375lea rdx, [rip+59828]
14001e37clea rcx, [rip+45679]
14001e383mov [rsp+40], rax
14001e388movzx eax, [rbx+2080]
14001e38fmov [rsp+32], eax
14001e393call printf
14001e398
14001e398loc_14001e398:
14001e398mov rcx, [rbx+668]
14001e39ftest rcx, rcx
14001e3a2je 0x14001e3ef
14001e3a4xor r9l, r9l
14001e3a7lea r8, [rbx+2082]
14001e3aemov edx, 1
14001e3b3call SysExtract
14001e3b8mov rax, [rbx+668]
14001e3bflea r9, [rip+46044]
14001e3c6mov r8l, 65
14001e3cclea rdx, [rip+59741]
14001e3d3lea rcx, [rip+45592]
14001e3damov [rsp+40], rax
14001e3dfmovzx eax, [rbx+2082]
14001e3e6mov [rsp+32], eax
14001e3eacall printf
14001e3ef
14001e3efloc_14001e3ef:
14001e3efmov rcx, [rbx+676]
14001e3f6test rcx, rcx
14001e3f9je 0x14001e446
14001e3fbxor r9l, r9l
14001e3felea r8, [rbx+2084]
14001e405mov edx, 1
14001e40acall SysExtract
14001e40fmov rax, [rbx+676]
14001e416lea r9, [rip+45978]
14001e41dmov r8l, 66
14001e423lea rdx, [rip+59654]
14001e42alea rcx, [rip+45505]
14001e431mov [rsp+40], rax
14001e436movzx eax, [rbx+2084]
14001e43dmov [rsp+32], eax
14001e441call printf
14001e446
14001e446loc_14001e446:
14001e446mov rcx, [rbx+684]
14001e44dtest rcx, rcx
14001e450je 0x14001e49d
14001e452xor r9l, r9l
14001e455lea r8, [rbx+2086]
14001e45cmov edx, 1
14001e461call SysExtract
14001e466mov rax, [rbx+684]
14001e46dlea r9, [rip+45914]
14001e474mov r8l, 67
14001e47alea rdx, [rip+59567]
14001e481lea rcx, [rip+45418]
14001e488mov [rsp+40], rax
14001e48dmovzx eax, [rbx+2086]
14001e494mov [rsp+32], eax
14001e498call printf
14001e49d
14001e49dloc_14001e49d:
14001e49dmov rcx, [rbx+700]
14001e4a4test rcx, rcx
14001e4a7je 0x14001e4f4
14001e4a9xor r9l, r9l
14001e4aclea r8, [rbx+2088]
14001e4b3mov edx, 1
14001e4b8call SysExtract
14001e4bdmov rax, [rbx+700]
14001e4c4lea r9, [rip+45845]
14001e4cbmov r8l, 68
14001e4d1lea rdx, [rip+59480]
14001e4d8lea rcx, [rip+45331]
14001e4dfmov [rsp+40], rax
14001e4e4movzx eax, [rbx+2088]
14001e4ebmov [rsp+32], eax
14001e4efcall printf
14001e4f4
14001e4f4loc_14001e4f4:
14001e4f4mov rcx, [rbx+708]
14001e4fbtest rcx, rcx
14001e4feje 0x14001e54b
14001e500xor r9l, r9l
14001e503lea r8, [rbx+2090]
14001e50amov edx, 1
14001e50fcall SysExtract
14001e514mov rax, [rbx+708]
14001e51blea r9, [rip+45778]
14001e522mov r8l, 69
14001e528lea rdx, [rip+59393]
14001e52flea rcx, [rip+45244]
14001e536mov [rsp+40], rax
14001e53bmovzx eax, [rbx+2090]
14001e542mov [rsp+32], eax
14001e546call printf
14001e54b
14001e54bloc_14001e54b:
14001e54bmov rcx, [rbx+716]
14001e552test rcx, rcx
14001e555je 0x14001e5a2
14001e557xor r9l, r9l
14001e55alea r8, [rbx+2092]
14001e561mov edx, 1
14001e566call SysExtract
14001e56bmov rax, [rbx+716]
14001e572lea r9, [rip+45722]
14001e579mov r8l, 70
14001e57flea rdx, [rip+59306]
14001e586lea rcx, [rip+45157]
14001e58dmov [rsp+40], rax
14001e592movzx eax, [rbx+2092]
14001e599mov [rsp+32], eax
14001e59dcall printf
14001e5a2
14001e5a2loc_14001e5a2:
14001e5a2mov rcx, [rbx+724]
14001e5a9test rcx, rcx
14001e5acje 0x14001e5f9
14001e5aexor r9l, r9l
14001e5b1lea r8, [rbx+2094]
14001e5b8mov edx, 1
14001e5bdcall SysExtract
14001e5c2mov rax, [rbx+724]
14001e5c9lea r9, [rip+45656]
14001e5d0mov r8l, 71
14001e5d6lea rdx, [rip+59219]
14001e5ddlea rcx, [rip+45070]
14001e5e4mov [rsp+40], rax
14001e5e9movzx eax, [rbx+2094]
14001e5f0mov [rsp+32], eax
14001e5f4call printf
14001e5f9
14001e5f9loc_14001e5f9:
14001e5f9mov rcx, [rbx+732]
14001e600test rcx, rcx
14001e603je 0x14001e650
14001e605xor r9l, r9l
14001e608lea r8, [rbx+2096]
14001e60fmov edx, 1
14001e614call SysExtract
14001e619mov rax, [rbx+732]
14001e620lea r9, [rip+45593]
14001e627mov r8l, 72
14001e62dlea rdx, [rip+59132]
14001e634lea rcx, [rip+44983]
14001e63bmov [rsp+40], rax
14001e640movzx eax, [rbx+2096]
14001e647mov [rsp+32], eax
14001e64bcall printf
14001e650
14001e650loc_14001e650:
14001e650mov rcx, [rbx+740]
14001e657test rcx, rcx
14001e65aje 0x14001e6a7
14001e65cxor r9l, r9l
14001e65flea r8, [rbx+2098]
14001e666mov edx, 1
14001e66bcall SysExtract
14001e670mov rax, [rbx+740]
14001e677lea r9, [rip+45531]
14001e67emov r8l, 73
14001e684lea rdx, [rip+59045]
14001e68blea rcx, [rip+44896]
14001e692mov [rsp+40], rax
14001e697movzx eax, [rbx+2098]
14001e69emov [rsp+32], eax
14001e6a2call printf
14001e6a7
14001e6a7loc_14001e6a7:
14001e6a7mov rbx, [rip+56514]
14001e6aemov rcx, [rbx+452]
14001e6b5test rcx, rcx
14001e6b8je 0x14001e705
14001e6baxor r9l, r9l
14001e6bdlea r8, [rbx+2100]
14001e6c4mov edx, 1
14001e6c9call SysExtract
14001e6cemov rax, [rbx+452]
14001e6d5lea r9, [rip+45451]
14001e6dcmov r8l, 74
14001e6e2lea rdx, [rip+58951]
14001e6e9lea rcx, [rip+44802]
14001e6f0mov [rsp+40], rax
14001e6f5movzx eax, [rbx+2100]
14001e6fcmov [rsp+32], eax
14001e700call printf
14001e705
14001e705loc_14001e705:
14001e705mov rcx, [rbx+460]
14001e70ctest rcx, rcx
14001e70fje 0x14001e75c
14001e711xor r9l, r9l
14001e714lea r8, [rbx+2102]
14001e71bmov edx, 1
14001e720call SysExtract
14001e725mov rax, [rbx+460]
14001e72clea r9, [rip+45372]
14001e733mov r8l, 75
14001e739lea rdx, [rip+58864]
14001e740lea rcx, [rip+44715]
14001e747mov [rsp+40], rax
14001e74cmovzx eax, [rbx+2102]
14001e753mov [rsp+32], eax
14001e757call printf
14001e75c
14001e75cloc_14001e75c:
14001e75cmov rcx, [rbx+468]
14001e763test rcx, rcx
14001e766je 0x14001e7b3
14001e768xor r9l, r9l
14001e76blea r8, [rbx+2104]
14001e772mov edx, 1
14001e777call SysExtract
14001e77cmov rax, [rbx+468]
14001e783lea r9, [rip+45296]
14001e78amov r8l, 76
14001e790lea rdx, [rip+58777]
14001e797lea rcx, [rip+44628]
14001e79emov [rsp+40], rax
14001e7a3movzx eax, [rbx+2104]
14001e7aamov [rsp+32], eax
14001e7aecall printf
14001e7b3
14001e7b3loc_14001e7b3:
14001e7b3mov rcx, [rbx+476]
14001e7batest rcx, rcx
14001e7bdje 0x14001e80a
14001e7bfxor r9l, r9l
14001e7c2lea r8, [rbx+2106]
14001e7c9mov edx, 1
14001e7cecall SysExtract
14001e7d3mov rax, [rbx+476]
14001e7dalea r9, [rip+45232]
14001e7e1mov r8l, 77
14001e7e7lea rdx, [rip+58690]
14001e7eelea rcx, [rip+44541]
14001e7f5mov [rsp+40], rax
14001e7famovzx eax, [rbx+2106]
14001e801mov [rsp+32], eax
14001e805call printf
14001e80a
14001e80aloc_14001e80a:
14001e80amov rcx, [rbx+484]
14001e811test rcx, rcx
14001e814je 0x14001e861
14001e816xor r9l, r9l
14001e819lea r8, [rbx+2108]
14001e820mov edx, 1
14001e825call SysExtract
14001e82amov rax, [rbx+484]
14001e831lea r9, [rip+45175]
14001e838mov r8l, 78
14001e83elea rdx, [rip+58603]
14001e845lea rcx, [rip+44454]
14001e84cmov [rsp+40], rax
14001e851movzx eax, [rbx+2108]
14001e858mov [rsp+32], eax
14001e85ccall printf
14001e861
14001e861loc_14001e861:
14001e861add rsp, 64
14001e865pop rbx
14001e866ret
14001dc00

14001e867
14001e867 // align 0x10

14001e870
14001e870SysNtAlertResumeThread:
14001e870push rbx
14001e871xor eax, eax
14001e873mov rbx, rcx
14001e876sub rsp, 64
14001e87amov [rsp+48], rax
14001e87fmov [rsp+56], rax
14001e884mov rax, [rip+56037]
14001e88bcmp [rax+218], 0
14001e892je 0x14001e8d7
14001e894mov rcx, [rax+2028]
14001e89btest rcx, rcx
14001e89eje 0x14001e8d7
14001e8a0mov r8w, [rax+2088]
14001e8a8test r8w, r8w
14001e8acje 0x14001e8d7
14001e8aemov [rsp+48], rcx
14001e8b3lea rcx, [rsp+48]
14001e8b8mov [rsp+88], rdx
14001e8bdmov [rsp+56], r8w
14001e8c3call SysSetConfig
14001e8c8mov rdx, [rsp+88]
14001e8cdmov rcx, rbx
14001e8d0call SysInvoke
14001e8d5jmp 0x14001e8e0
14001e8d7
14001e8d7loc_14001e8d7:
14001e8d7mov rcx, rbx
14001e8dacall [rax+700]
14001e8e0
14001e8e0loc_14001e8e0:
14001e8e0mov [rsp+32], eax
14001e8e4lea r9, [rip+43614]
14001e8ebmov ebx, eax
14001e8edmov r8l, 365
14001e8f3lea rdx, [rip+60326]
14001e8falea rcx, [rip+43103]
14001e901call printf.constprop.0
14001e906add rsp, 64
14001e90amov eax, ebx
14001e90cpop rbx
14001e90dret
14001e870

14001e90e
14001e90e // align 0x10

14001e910
14001e910SysNtAllocateVirtualMemory:
14001e910push rdi
14001e911xor eax, eax
14001e913push rsi
14001e914push rbx
14001e915mov rbx, rcx
14001e918sub rsp, 64
14001e91cmov [rsp+48], rax
14001e921mov esi, [rsp+128]
14001e928mov [rsp+56], rax
14001e92dmov rax, [rip+55868]
14001e934mov edi, [rsp+136]
14001e93bcmp [rax+218], 0
14001e942je 0x14001e9a3
14001e944mov rcx, [rax+2028]
14001e94btest rcx, rcx
14001e94eje 0x14001e9a3
14001e950mov r10w, [rax+2074]
14001e958test r10w, r10w
14001e95cje 0x14001e9a3
14001e95emov [rsp+48], rcx
14001e963lea rcx, [rsp+48]
14001e968mov [rsp+120], r9
14001e96dmov [rsp+112], r8
14001e972mov [rsp+104], rdx
14001e977mov [rsp+56], r10w
14001e97dcall SysSetConfig
14001e982mov [rsp+40], edi
14001e986mov r9, [rsp+120]
14001e98bmov rcx, rbx
14001e98emov r8, [rsp+112]
14001e993mov rdx, [rsp+104]
14001e998mov [rsp+32], esi
14001e99ccall SysInvoke
14001e9a1jmp 0x14001e9b4
14001e9a3
14001e9a3loc_14001e9a3:
14001e9a3mov [rsp+40], edi
14001e9a7mov rcx, rbx
14001e9aamov [rsp+32], esi
14001e9aecall [rax+636]
14001e9b4
14001e9b4loc_14001e9b4:
14001e9b4mov [rsp+32], eax
14001e9b8lea r9, [rip+43255]
14001e9bfmov ebx, eax
14001e9c1mov r8l, 270
14001e9c7lea rdx, [rip+57826]
14001e9celea rcx, [rip+42891]
14001e9d5call printf.constprop.0
14001e9daadd rsp, 64
14001e9demov eax, ebx
14001e9e0pop rbx
14001e9e1pop rsi
14001e9e2pop rdi
14001e9e3ret
14001e910

14001e9e4
14001e9e4 // align 0x10

14001e9f0
14001e9f0SysNtClose:
14001e9f0push rbx
14001e9f1xor eax, eax
14001e9f3mov rbx, rcx
14001e9f6sub rsp, 64
14001e9famov [rsp+48], rax
14001e9ffmov [rsp+56], rax
14001ea04mov rax, [rip+55653]
14001ea0bcmp [rax+218], 0
14001ea12je 0x14001ea4a
14001ea14mov rdx, [rax+2028]
14001ea1btest rdx, rdx
14001ea1eje 0x14001ea4a
14001ea20mov cx, [rax+2100]
14001ea27test cx, cx
14001ea2aje 0x14001ea4a
14001ea2cmov [rsp+56], cx
14001ea31lea rcx, [rsp+48]
14001ea36mov [rsp+48], rdx
14001ea3bcall SysSetConfig
14001ea40mov rcx, rbx
14001ea43call SysInvoke
14001ea48jmp 0x14001ea53
14001ea4a
14001ea4aloc_14001ea4a:
14001ea4amov rcx, rbx
14001ea4dcall [rax+452]
14001ea53
14001ea53loc_14001ea53:
14001ea53mov [rsp+32], eax
14001ea57lea r9, [rip+43378]
14001ea5emov ebx, eax
14001ea60mov r8l, 451
14001ea66lea rdx, [rip+58787]
14001ea6dlea rcx, [rip+42732]
14001ea74call printf.constprop.0
14001ea79add rsp, 64
14001ea7dmov eax, ebx
14001ea7fpop rbx
14001ea80ret
14001e9f0

14001ea81
14001ea81 // align 0x10

14001ea90
14001ea90SysNtCreateEvent:
14001ea90push rsi
14001ea91xor eax, eax
14001ea93push rbx
14001ea94mov rbx, rcx
14001ea97sub rsp, 72
14001ea9bmov [rsp+48], rax
14001eaa0movzx esi, [rsp+128]
14001eaa8mov [rsp+56], rax
14001eaadmov rax, [rip+55484]
14001eab4cmp [rax+218], 0
14001eabbje 0x14001eb16
14001eabdmov rcx, [rax+2028]
14001eac4test rcx, rcx
14001eac7je 0x14001eb16
14001eac9mov r10w, [rax+2058]
14001ead1test r10w, r10w
14001ead5je 0x14001eb16
14001ead7mov [rsp+48], rcx
14001eadclea rcx, [rsp+48]
14001eae1mov [rsp+120], r9l
14001eae6mov [rsp+112], r8
14001eaebmov [rsp+104], edx
14001eaefmov [rsp+56], r10w
14001eaf5call SysSetConfig
14001eafamov [rsp+32], esi
14001eafemov edx, [rsp+104]
14001eb02mov rcx, rbx
14001eb05mov r9l, [rsp+120]
14001eb0amov r8, [rsp+112]
14001eb0fcall SysInvoke
14001eb14jmp 0x14001eb23
14001eb16
14001eb16loc_14001eb16:
14001eb16mov [rsp+32], esi
14001eb1amov rcx, rbx
14001eb1dcall [rax+564]
14001eb23
14001eb23loc_14001eb23:
14001eb23mov [rsp+32], eax
14001eb27lea r9, [rip+42728]
14001eb2emov ebx, eax
14001eb30mov r8l, 138
14001eb36lea rdx, [rip+58243]
14001eb3dlea rcx, [rip+42524]
14001eb44call printf.constprop.0
14001eb49add rsp, 72
14001eb4dmov eax, ebx
14001eb4fpop rbx
14001eb50pop rsi
14001eb51ret
14001ea90

14001eb52
14001eb52 // align 0x10

14001eb60
14001eb60SysNtCreateThreadEx:
14001eb60push r15
14001eb62xor eax, eax
14001eb64push r14
14001eb66push r13
14001eb68push r12
14001eb6apush rbp
14001eb6bpush rdi
14001eb6cpush rsi
14001eb6dpush rbx
14001eb6emov rbx, rcx
14001eb71sub rsp, 120
14001eb75mov [rsp+96], rax
14001eb7amov rsi, [rsp+224]
14001eb82mov [rsp+104], rax
14001eb87mov rax, [rip+55266]
14001eb8emov rdi, [rsp+232]
14001eb96mov ebp, [rsp+240]
14001eb9dcmp [rax+218], 0
14001eba4mov r12, [rsp+248]
14001ebacmov r13, [rsp+256]
14001ebb4mov r14, [rsp+264]
14001ebbcmov r15, [rsp+272]
14001ebc4je 0x14001ec53
14001ebcamov rcx, [rax+2028]
14001ebd1test rcx, rcx
14001ebd4je 0x14001ec53
14001ebd6mov r10w, [rax+2060]
14001ebdetest r10w, r10w
14001ebe2je 0x14001ec53
14001ebe4mov [rsp+96], rcx
14001ebe9lea rcx, [rsp+96]
14001ebeemov [rsp+216], r9
14001ebf6mov [rsp+208], r8
14001ebfemov [rsp+200], edx
14001ec05mov [rsp+104], r10w
14001ec0bcall SysSetConfig
14001ec10mov [rsp+80], r15
14001ec15mov rcx, rbx
14001ec18mov r9, [rsp+216]
14001ec20mov [rsp+72], r14
14001ec25mov r8, [rsp+208]
14001ec2dmov [rsp+64], r13
14001ec32mov edx, [rsp+200]
14001ec39mov [rsp+56], r12
14001ec3emov [rsp+48], ebp
14001ec42mov [rsp+40], rdi
14001ec47mov [rsp+32], rsi
14001ec4ccall SysInvoke
14001ec51jmp 0x14001ec7e
14001ec53
14001ec53loc_14001ec53:
14001ec53mov [rsp+80], r15
14001ec58mov rcx, rbx
14001ec5bmov [rsp+72], r14
14001ec60mov [rsp+64], r13
14001ec65mov [rsp+56], r12
14001ec6amov [rsp+48], ebp
14001ec6emov [rsp+40], rdi
14001ec73mov [rsp+32], rsi
14001ec78call [rax+572]
14001ec7e
14001ec7eloc_14001ec7e:
14001ec7emov [rsp+32], eax
14001ec82lea r9, [rip+42395]
14001ec89mov ebx, eax
14001ec8bmov r8l, 159
14001ec91lea rdx, [rip+57864]
14001ec98lea rcx, [rip+42177]
14001ec9fcall printf.constprop.0
14001eca4add rsp, 120
14001eca8mov eax, ebx
14001ecaapop rbx
14001ecabpop rsi
14001ecacpop rdi
14001ecadpop rbp
14001ecaepop r12
14001ecb0pop r13
14001ecb2pop r14
14001ecb4pop r15
14001ecb6ret
14001eb60

14001ecb7
14001ecb7 // align 0x10

14001ecc0
14001ecc0SysNtDuplicateObject:
14001ecc0push rbp
14001ecc1xor eax, eax
14001ecc3push rdi
14001ecc4push rsi
14001ecc5push rbx
14001ecc6mov rbx, rcx
14001ecc9sub rsp, 88
14001eccdmov [rsp+64], rax
14001ecd2mov esi, [rsp+160]
14001ecd9mov [rsp+72], rax
14001ecdemov rax, [rip+54923]
14001ece5mov edi, [rsp+168]
14001ececmov ebp, [rsp+176]
14001ecf3cmp [rax+218], 0
14001ecfaje 0x14001ed71
14001ecfcmov rcx, [rax+2028]
14001ed03test rcx, rcx
14001ed06je 0x14001ed71
14001ed08mov r10w, [rax+2062]
14001ed10test r10w, r10w
14001ed14je 0x14001ed71
14001ed16mov [rsp+64], rcx
14001ed1blea rcx, [rsp+64]
14001ed20mov [rsp+152], r9
14001ed28mov [rsp+144], r8
14001ed30mov [rsp+136], rdx
14001ed38mov [rsp+72], r10w
14001ed3ecall SysSetConfig
14001ed43mov [rsp+48], ebp
14001ed47mov rcx, rbx
14001ed4amov r9, [rsp+152]
14001ed52mov [rsp+40], edi
14001ed56mov r8, [rsp+144]
14001ed5emov [rsp+32], esi
14001ed62mov rdx, [rsp+136]
14001ed6acall SysInvoke
14001ed6fjmp 0x14001ed86
14001ed71
14001ed71loc_14001ed71:
14001ed71mov [rsp+48], ebp
14001ed75mov rcx, rbx
14001ed78mov [rsp+40], edi
14001ed7cmov [rsp+32], esi
14001ed80call [rax+580]
14001ed86
14001ed86loc_14001ed86:
14001ed86mov [rsp+32], eax
14001ed8alea r9, [rip+42148]
14001ed91mov ebx, eax
14001ed93mov r8l, 188
14001ed99lea rdx, [rip+57568]
14001eda0lea rcx, [rip+41913]
14001eda7call printf.constprop.0
14001edacadd rsp, 88
14001edb0mov eax, ebx
14001edb2pop rbx
14001edb3pop rsi
14001edb4pop rdi
14001edb5pop rbp
14001edb6ret
14001ecc0

14001edb7
14001edb7 // align 0x10

14001edc0
14001edc0SysNtDuplicateToken:
14001edc0push rdi
14001edc1xor eax, eax
14001edc3movzx r9l, r9b
14001edc7push rsi
14001edc8push rbx
14001edc9mov rbx, rcx
14001edccsub rsp, 80
14001edd0mov [rsp+64], rax
14001edd5mov esi, [rsp+144]
14001eddcmov [rsp+72], rax
14001ede1mov rax, [rip+54664]
14001ede8mov rdi, [rsp+152]
14001edf0cmp [rax+218], 0
14001edf7je 0x14001ee5d
14001edf9mov rcx, [rax+2028]
14001ee00test rcx, rcx
14001ee03je 0x14001ee5d
14001ee05mov r10w, [rax+2050]
14001ee0dtest r10w, r10w
14001ee11je 0x14001ee5d
14001ee13mov [rsp+64], rcx
14001ee18lea rcx, [rsp+64]
14001ee1dmov [rsp+128], r8
14001ee25mov [rsp+120], edx
14001ee29mov [rsp+60], r9l
14001ee2emov [rsp+72], r10w
14001ee34call SysSetConfig
14001ee39mov [rsp+32], esi
14001ee3dmov edx, [rsp+120]
14001ee41mov rcx, rbx
14001ee44mov [rsp+40], rdi
14001ee49mov r9l, [rsp+60]
14001ee4emov r8, [rsp+128]
14001ee56call SysInvoke
14001ee5bjmp 0x14001ee6f
14001ee5d
14001ee5dloc_14001ee5d:
14001ee5dmov [rsp+40], rdi
14001ee62mov rcx, rbx
14001ee65mov [rsp+32], esi
14001ee69call [rax+532]
14001ee6f
14001ee6floc_14001ee6f:
14001ee6fmov [rsp+32], eax
14001ee73lea r9, [rip+41819]
14001ee7amov ebx, eax
14001ee7cmov r8l, 84
14001ee82lea rdx, [rip+57527]
14001ee89lea rcx, [rip+41680]
14001ee90call printf.constprop.0
14001ee95add rsp, 80
14001ee99mov eax, ebx
14001ee9bpop rbx
14001ee9cpop rsi
14001ee9dpop rdi
14001ee9eret
14001edc0

14001ee9f
14001ee9f // align 0x10

14001eea0
14001eea0SysNtFreeVirtualMemory:
14001eea0push rbx
14001eea1xor eax, eax
14001eea3mov rbx, rcx
14001eea6sub rsp, 64
14001eeaamov [rsp+48], rax
14001eeafmov [rsp+56], rax
14001eeb4mov rax, [rip+54453]
14001eebbcmp [rax+218], 0
14001eec2je 0x14001ef1b
14001eec4mov rcx, [rax+2028]
14001eecbtest rcx, rcx
14001eeceje 0x14001ef1b
14001eed0mov r10w, [rax+2080]
14001eed8test r10w, r10w
14001eedcje 0x14001ef1b
14001eedemov [rsp+48], rcx
14001eee3lea rcx, [rsp+48]
14001eee8mov [rsp+104], r9l
14001eeedmov [rsp+96], r8
14001eef2mov [rsp+88], rdx
14001eef7mov [rsp+56], r10w
14001eefdcall SysSetConfig
14001ef02mov r9l, [rsp+104]
14001ef07mov r8, [rsp+96]
14001ef0cmov rcx, rbx
14001ef0fmov rdx, [rsp+88]
14001ef14call SysInvoke
14001ef19jmp 0x14001ef24
14001ef1b
14001ef1bloc_14001ef1b:
14001ef1bmov rcx, rbx
14001ef1ecall [rax+660]
14001ef24
14001ef24loc_14001ef24:
14001ef24mov [rsp+32], eax
14001ef28lea r9, [rip+41908]
14001ef2fmov ebx, eax
14001ef31mov r8l, 299
14001ef37lea rdx, [rip+56322]
14001ef3elea rcx, [rip+41499]
14001ef45call printf.constprop.0
14001ef4aadd rsp, 64
14001ef4emov eax, ebx
14001ef50pop rbx
14001ef51ret
14001eea0

14001ef52
14001ef52 // align 0x10

14001ef60
14001ef60SysNtGetContextThread:
14001ef60push rbx
14001ef61xor eax, eax
14001ef63mov rbx, rcx
14001ef66sub rsp, 64
14001ef6amov [rsp+48], rax
14001ef6fmov [rsp+56], rax
14001ef74mov rax, [rip+54261]
14001ef7bcmp [rax+218], 0
14001ef82je 0x14001efc7
14001ef84mov rcx, [rax+2028]
14001ef8btest rcx, rcx
14001ef8eje 0x14001efc7
14001ef90mov r8w, [rax+2064]
14001ef98test r8w, r8w
14001ef9cje 0x14001efc7
14001ef9emov [rsp+48], rcx
14001efa3lea rcx, [rsp+48]
14001efa8mov [rsp+88], rdx
14001efadmov [rsp+56], r8w
14001efb3call SysSetConfig
14001efb8mov rdx, [rsp+88]
14001efbdmov rcx, rbx
14001efc0call SysInvoke
14001efc5jmp 0x14001efd0
14001efc7
14001efc7loc_14001efc7:
14001efc7mov rcx, rbx
14001efcacall [rax+588]
14001efd0
14001efd0loc_14001efd0:
14001efd0mov [rsp+32], eax
14001efd4lea r9, [rip+41580]
14001efdbmov ebx, eax
14001efddmov r8l, 200
14001efe3lea rdx, [rip+56918]
14001efealea rcx, [rip+41327]
14001eff1call printf.constprop.0
14001eff6add rsp, 64
14001effamov eax, ebx
14001effcpop rbx
14001effdret
14001ef60

14001effe
14001effe // align 0x10

14001f000
14001f000SysNtGetNextThread:
14001f000push rdi
14001f001xor eax, eax
14001f003push rsi
14001f004push rbx
14001f005mov rbx, rcx
14001f008sub rsp, 64
14001f00cmov [rsp+48], rax
14001f011mov esi, [rsp+128]
14001f018mov [rsp+56], rax
14001f01dmov rax, [rip+54092]
14001f024mov rdi, [rsp+136]
14001f02ccmp [rax+218], 0
14001f033je 0x14001f095
14001f035mov rcx, [rax+2028]
14001f03ctest rcx, rcx
14001f03fje 0x14001f095
14001f041mov r10w, [rax+2108]
14001f049test r10w, r10w
14001f04dje 0x14001f095
14001f04fmov [rsp+48], rcx
14001f054lea rcx, [rsp+48]
14001f059mov [rsp+120], r9l
14001f05emov [rsp+112], r8l
14001f063mov [rsp+104], rdx
14001f068mov [rsp+56], r10w
14001f06ecall SysSetConfig
14001f073mov [rsp+40], rdi
14001f078mov r9l, [rsp+120]
14001f07dmov rcx, rbx
14001f080mov r8l, [rsp+112]
14001f085mov rdx, [rsp+104]
14001f08amov [rsp+32], esi
14001f08ecall SysInvoke
14001f093jmp 0x14001f0a7
14001f095
14001f095loc_14001f095:
14001f095mov [rsp+40], rdi
14001f09amov rcx, rbx
14001f09dmov [rsp+32], esi
14001f0a1call [rax+484]
14001f0a7
14001f0a7loc_14001f0a7:
14001f0a7mov [rsp+32], eax
14001f0ablea r9, [rip+41819]
14001f0b2mov ebx, eax
14001f0b4mov r8l, 497
14001f0balea rdx, [rip+54735]
14001f0c1lea rcx, [rip+41112]
14001f0c8call printf.constprop.0
14001f0cdadd rsp, 64
14001f0d1mov eax, ebx
14001f0d3pop rbx
14001f0d4pop rsi
14001f0d5pop rdi
14001f0d6ret
14001f000

14001f0d7
14001f0d7 // align 0x10

14001f0e0
14001f0e0SysNtOpenProcess:
14001f0e0push rbx
14001f0e1xor eax, eax
14001f0e3mov rbx, rcx
14001f0e6sub rsp, 64
14001f0eamov [rsp+48], rax
14001f0efmov [rsp+56], rax
14001f0f4mov rax, [rip+53877]
14001f0fbcmp [rax+218], 0
14001f102je 0x14001f159
14001f104mov rcx, [rax+2028]
14001f10btest rcx, rcx
14001f10eje 0x14001f159
14001f110mov r10w, [rax+2046]
14001f118test r10w, r10w
14001f11cje 0x14001f159
14001f11emov [rsp+48], rcx
14001f123lea rcx, [rsp+48]
14001f128mov [rsp+104], r9
14001f12dmov [rsp+96], r8
14001f132mov [rsp+88], edx
14001f136mov [rsp+56], r10w
14001f13ccall SysSetConfig
14001f141mov r9, [rsp+104]
14001f146mov r8, [rsp+96]
14001f14bmov rcx, rbx
14001f14emov edx, [rsp+88]
14001f152call SysInvoke
14001f157jmp 0x14001f162
14001f159
14001f159loc_14001f159:
14001f159mov rcx, rbx
14001f15ccall [rax+516]
14001f162
14001f162loc_14001f162:
14001f162mov [rsp+32], eax
14001f166lea r9, [rip+40994]
14001f16dmov ebx, eax
14001f16fmov r8l, 29
14001f175lea rdx, [rip+57172]
14001f17clea rcx, [rip+40925]
14001f183call printf.constprop.0
14001f188add rsp, 64
14001f18cmov eax, ebx
14001f18epop rbx
14001f18fret
14001f0e0

14001f190
14001f190SysNtOpenProcessToken:
14001f190push rbx
14001f191xor eax, eax
14001f193mov rbx, rcx
14001f196sub rsp, 64
14001f19amov [rsp+48], rax
14001f19fmov [rsp+56], rax
14001f1a4mov rax, [rip+53701]
14001f1abcmp [rax+218], 0
14001f1b2je 0x14001f1ff
14001f1b4mov rcx, [rax+2028]
14001f1bbtest rcx, rcx
14001f1beje 0x14001f1ff
14001f1c0mov r9w, [rax+2048]
14001f1c8test r9w, r9w
14001f1ccje 0x14001f1ff
14001f1cemov [rsp+48], rcx
14001f1d3lea rcx, [rsp+48]
14001f1d8mov [rsp+96], r8
14001f1ddmov [rsp+88], edx
14001f1e1mov [rsp+56], r9w
14001f1e7call SysSetConfig
14001f1ecmov r8, [rsp+96]
14001f1f1mov edx, [rsp+88]
14001f1f5mov rcx, rbx
14001f1f8call SysInvoke
14001f1fdjmp 0x14001f208
14001f1ff
14001f1ffloc_14001f1ff:
14001f1ffmov rcx, rbx
14001f202call [rax+524]
14001f208
14001f208loc_14001f208:
14001f208mov [rsp+32], eax
14001f20clea r9, [rip+40879]
14001f213mov ebx, eax
14001f215mov r8l, 68
14001f21blea rdx, [rip+56638]
14001f222lea rcx, [rip+40759]
14001f229call printf.constprop.0
14001f22eadd rsp, 64
14001f232mov eax, ebx
14001f234pop rbx
14001f235ret
14001f190

14001f236
14001f236 // align 0x10

14001f240
14001f240SysNtOpenThread:
14001f240push rbx
14001f241xor eax, eax
14001f243mov rbx, rcx
14001f246sub rsp, 64
14001f24amov [rsp+48], rax
14001f24fmov [rsp+56], rax
14001f254mov rax, [rip+53525]
14001f25bcmp [rax+218], 0
14001f262je 0x14001f2b9
14001f264mov rcx, [rax+2028]
14001f26btest rcx, rcx
14001f26eje 0x14001f2b9
14001f270mov r10w, [rax+2040]
14001f278test r10w, r10w
14001f27cje 0x14001f2b9
14001f27emov [rsp+48], rcx
14001f283lea rcx, [rsp+48]
14001f288mov [rsp+104], r9
14001f28dmov [rsp+96], r8
14001f292mov [rsp+88], edx
14001f296mov [rsp+56], r10w
14001f29ccall SysSetConfig
14001f2a1mov r9, [rsp+104]
14001f2a6mov r8, [rsp+96]
14001f2abmov rcx, rbx
14001f2aemov edx, [rsp+88]
14001f2b2call SysInvoke
14001f2b7jmp 0x14001f2c2
14001f2b9
14001f2b9loc_14001f2b9:
14001f2b9mov rcx, rbx
14001f2bccall [rax+492]
14001f2c2
14001f2c2loc_14001f2c2:
14001f2c2mov [rsp+32], eax
14001f2c6lea r9, [rip+40629]
14001f2cdmov ebx, eax
14001f2cfmov r8l, 15
14001f2d5lea rdx, [rip+56852]
14001f2dclea rcx, [rip+40573]
14001f2e3call printf.constprop.0
14001f2e8add rsp, 64
14001f2ecmov eax, ebx
14001f2eepop rbx
14001f2efret
14001f240

14001f2f0
14001f2f0SysNtOpenThreadToken:
14001f2f0push rbx
14001f2f1xor eax, eax
14001f2f3mov rbx, rcx
14001f2f6movzx r8l, r8b
14001f2fasub rsp, 80
14001f2femov [rsp+64], rax
14001f303mov [rsp+72], rax
14001f308mov rax, [rip+53345]
14001f30fcmp [rax+218], 0
14001f316je 0x14001f36d
14001f318mov rcx, [rax+2028]
14001f31ftest rcx, rcx
14001f322je 0x14001f36d
14001f324mov r10w, [rax+2042]
14001f32ctest r10w, r10w
14001f330je 0x14001f36d
14001f332mov [rsp+64], rcx
14001f337lea rcx, [rsp+64]
14001f33cmov [rsp+120], r9
14001f341mov [rsp+104], edx
14001f345mov [rsp+60], r8l
14001f34amov [rsp+72], r10w
14001f350call SysSetConfig
14001f355mov r9, [rsp+120]
14001f35amov r8l, [rsp+60]
14001f35fmov rcx, rbx
14001f362mov edx, [rsp+104]
14001f366call SysInvoke
14001f36bjmp 0x14001f376
14001f36d
14001f36dloc_14001f36d:
14001f36dmov rcx, rbx
14001f370call [rax+500]
14001f376
14001f376loc_14001f376:
14001f376mov [rsp+32], eax
14001f37alea r9, [rip+40495]
14001f381mov ebx, eax
14001f383mov r8l, 55
14001f389lea rdx, [rip+56576]
14001f390lea rcx, [rip+40393]
14001f397call printf.constprop.0
14001f39cadd rsp, 80
14001f3a0mov eax, ebx
14001f3a2pop rbx
14001f3a3ret
14001f2f0

14001f3a4
14001f3a4 // align 0x10

14001f3b0
14001f3b0SysNtProtectVirtualMemory:
14001f3b0push rsi
14001f3b1xor eax, eax
14001f3b3push rbx
14001f3b4mov rbx, rcx
14001f3b7sub rsp, 72
14001f3bbmov [rsp+48], rax
14001f3c0mov rsi, [rsp+128]
14001f3c8mov [rsp+56], rax
14001f3cdmov rax, [rip+53148]
14001f3d4cmp [rax+218], 0
14001f3dbje 0x14001f439
14001f3ddmov rcx, [rax+2028]
14001f3e4test rcx, rcx
14001f3e7je 0x14001f439
14001f3e9mov r10w, [rax+2084]
14001f3f1test r10w, r10w
14001f3f5je 0x14001f439
14001f3f7mov [rsp+48], rcx
14001f3fclea rcx, [rsp+48]
14001f401mov [rsp+120], r9l
14001f406mov [rsp+112], r8
14001f40bmov [rsp+104], rdx
14001f410mov [rsp+56], r10w
14001f416call SysSetConfig
14001f41bmov [rsp+32], rsi
14001f420mov r9l, [rsp+120]
14001f425mov rcx, rbx
14001f428mov r8, [rsp+112]
14001f42dmov rdx, [rsp+104]
14001f432call SysInvoke
14001f437jmp 0x14001f447
14001f439
14001f439loc_14001f439:
14001f439mov [rsp+32], rsi
14001f43emov rcx, rbx
14001f441call [rax+676]
14001f447
14001f447loc_14001f447:
14001f447mov [rsp+32], eax
14001f44blea r9, [rip+40634]
14001f452mov ebx, eax
14001f454mov r8l, 326
14001f45alea rdx, [rip+54831]
14001f461lea rcx, [rip+40184]
14001f468call printf.constprop.0
14001f46dadd rsp, 72
14001f471mov eax, ebx
14001f473pop rbx
14001f474pop rsi
14001f475ret
14001f3b0

14001f476
14001f476 // align 0x10

14001f480
14001f480SysNtQueryInformationProcess:
14001f480push rsi
14001f481xor eax, eax
14001f483push rbx
14001f484mov rbx, rcx
14001f487sub rsp, 72
14001f48bmov [rsp+48], rax
14001f490mov rsi, [rsp+128]
14001f498mov [rsp+56], rax
14001f49dmov rax, [rip+52940]
14001f4a4cmp [rax+218], 0
14001f4abje 0x14001f507
14001f4admov rcx, [rax+2028]
14001f4b4test rcx, rcx
14001f4b7je 0x14001f507
14001f4b9mov r10w, [rax+2068]
14001f4c1test r10w, r10w
14001f4c5je 0x14001f507
14001f4c7mov [rsp+48], rcx
14001f4cclea rcx, [rsp+48]
14001f4d1mov [rsp+120], r9l
14001f4d6mov [rsp+112], r8
14001f4dbmov [rsp+104], edx
14001f4dfmov [rsp+56], r10w
14001f4e5call SysSetConfig
14001f4eamov [rsp+32], rsi
14001f4efmov edx, [rsp+104]
14001f4f3mov rcx, rbx
14001f4f6mov r9l, [rsp+120]
14001f4fbmov r8, [rsp+112]
14001f500call SysInvoke
14001f505jmp 0x14001f515
14001f507
14001f507loc_14001f507:
14001f507mov [rsp+32], rsi
14001f50cmov rcx, rbx
14001f50fcall [rax+604]
14001f515
14001f515loc_14001f515:
14001f515mov [rsp+32], eax
14001f519lea r9, [rip+40269]
14001f520mov ebx, eax
14001f522mov r8l, 227
14001f528lea rdx, [rip+55057]
14001f52flea rcx, [rip+39978]
14001f536call printf.constprop.0
14001f53badd rsp, 72
14001f53fmov eax, ebx
14001f541pop rbx
14001f542pop rsi
14001f543ret
14001f480

14001f544
14001f544 // align 0x10

14001f550
14001f550SysNtQueryInformationThread:
14001f550push rsi
14001f551xor eax, eax
14001f553push rbx
14001f554mov rbx, rcx
14001f557sub rsp, 72
14001f55bmov [rsp+48], rax
14001f560mov rsi, [rsp+128]
14001f568mov [rsp+56], rax
14001f56dmov rax, [rip+52732]
14001f574cmp [rax+218], 0
14001f57bje 0x14001f5d7
14001f57dmov rcx, [rax+2028]
14001f584test rcx, rcx
14001f587je 0x14001f5d7
14001f589mov r10w, [rax+2096]
14001f591test r10w, r10w
14001f595je 0x14001f5d7
14001f597mov [rsp+48], rcx
14001f59clea rcx, [rsp+48]
14001f5a1mov [rsp+120], r9l
14001f5a6mov [rsp+112], r8
14001f5abmov [rsp+104], edx
14001f5afmov [rsp+56], r10w
14001f5b5call SysSetConfig
14001f5bamov [rsp+32], rsi
14001f5bfmov edx, [rsp+104]
14001f5c3mov rcx, rbx
14001f5c6mov r9l, [rsp+120]
14001f5cbmov r8, [rsp+112]
14001f5d0call SysInvoke
14001f5d5jmp 0x14001f5e5
14001f5d7
14001f5d7loc_14001f5d7:
14001f5d7mov [rsp+32], rsi
14001f5dcmov rcx, rbx
14001f5dfcall [rax+732]
14001f5e5
14001f5e5loc_14001f5e5:
14001f5e5mov [rsp+32], eax
14001f5e9lea r9, [rip+40377]
14001f5f0mov ebx, eax
14001f5f2mov r8l, 425
14001f5f8lea rdx, [rip+56385]
14001f5fflea rcx, [rip+39770]
14001f606call printf.constprop.0
14001f60badd rsp, 72
14001f60fmov eax, ebx
14001f611pop rbx
14001f612pop rsi
14001f613ret
14001f550

14001f614
14001f614 // align 0x10

14001f620
14001f620SysNtQueryInformationToken:
14001f620push rsi
14001f621xor eax, eax
14001f623push rbx
14001f624mov rbx, rcx
14001f627sub rsp, 72
14001f62bmov [rsp+48], rax
14001f630mov rsi, [rsp+128]
14001f638mov [rsp+56], rax
14001f63dmov rax, [rip+52524]
14001f644cmp [rax+218], 0
14001f64bje 0x14001f6a7
14001f64dmov rcx, [rax+2028]
14001f654test rcx, rcx
14001f657je 0x14001f6a7
14001f659mov r10w, [rax+2094]
14001f661test r10w, r10w
14001f665je 0x14001f6a7
14001f667mov [rsp+48], rcx
14001f66clea rcx, [rsp+48]
14001f671mov [rsp+120], r9l
14001f676mov [rsp+112], r8
14001f67bmov [rsp+104], edx
14001f67fmov [rsp+56], r10w
14001f685call SysSetConfig
14001f68amov [rsp+32], rsi
14001f68fmov edx, [rsp+104]
14001f693mov rcx, rbx
14001f696mov r9l, [rsp+120]
14001f69bmov r8, [rsp+112]
14001f6a0call SysInvoke
14001f6a5jmp 0x14001f6b5
14001f6a7
14001f6a7loc_14001f6a7:
14001f6a7mov [rsp+32], rsi
14001f6acmov rcx, rbx
14001f6afcall [rax+724]
14001f6b5
14001f6b5loc_14001f6b5:
14001f6b5mov [rsp+32], eax
14001f6b9lea r9, [rip+40145]
14001f6c0mov ebx, eax
14001f6c2mov r8l, 410
14001f6c8lea rdx, [rip+56337]
14001f6cflea rcx, [rip+39562]
14001f6d6call printf.constprop.0
14001f6dbadd rsp, 72
14001f6dfmov eax, ebx
14001f6e1pop rbx
14001f6e2pop rsi
14001f6e3ret
14001f620

14001f6e4
14001f6e4 // align 0x10

14001f6f0
14001f6f0SysNtQueryObject:
14001f6f0push rsi
14001f6f1xor eax, eax
14001f6f3push rbx
14001f6f4mov rbx, rcx
14001f6f7sub rsp, 72
14001f6fbmov [rsp+48], rax
14001f700mov rsi, [rsp+128]
14001f708mov [rsp+56], rax
14001f70dmov rax, [rip+52316]
14001f714cmp [rax+218], 0
14001f71bje 0x14001f777
14001f71dmov rcx, [rax+2028]
14001f724test rcx, rcx
14001f727je 0x14001f777
14001f729mov r10w, [rax+2098]
14001f731test r10w, r10w
14001f735je 0x14001f777
14001f737mov [rsp+48], rcx
14001f73clea rcx, [rsp+48]
14001f741mov [rsp+120], r9l
14001f746mov [rsp+112], r8
14001f74bmov [rsp+104], edx
14001f74fmov [rsp+56], r10w
14001f755call SysSetConfig
14001f75amov [rsp+32], rsi
14001f75fmov edx, [rsp+104]
14001f763mov rcx, rbx
14001f766mov r9l, [rsp+120]
14001f76bmov r8, [rsp+112]
14001f770call SysInvoke
14001f775jmp 0x14001f785
14001f777
14001f777loc_14001f777:
14001f777mov [rsp+32], rsi
14001f77cmov rcx, rbx
14001f77fcall [rax+740]
14001f785
14001f785loc_14001f785:
14001f785mov [rsp+32], eax
14001f789lea r9, [rip+39986]
14001f790mov ebx, eax
14001f792mov r8l, 440
14001f798lea rdx, [rip+55761]
14001f79flea rcx, [rip+39354]
14001f7a6call printf.constprop.0
14001f7abadd rsp, 72
14001f7afmov eax, ebx
14001f7b1pop rbx
14001f7b2pop rsi
14001f7b3ret
14001f6f0

14001f7b4
14001f7b4 // align 0x10

14001f7c0
14001f7c0SysNtQuerySystemInformation:
14001f7c0push rbx
14001f7c1xor eax, eax
14001f7c3mov ebx, ecx
14001f7c5sub rsp, 64
14001f7c9mov [rsp+48], rax
14001f7cemov [rsp+56], rax
14001f7d3mov rax, [rip+52118]
14001f7dacmp [rax+218], 0
14001f7e1je 0x14001f839
14001f7e3mov rcx, [rax+2028]
14001f7eatest rcx, rcx
14001f7edje 0x14001f839
14001f7efmov r10w, [rax+2070]
14001f7f7test r10w, r10w
14001f7fbje 0x14001f839
14001f7fdmov [rsp+48], rcx
14001f802lea rcx, [rsp+48]
14001f807mov [rsp+104], r9
14001f80cmov [rsp+96], r8l
14001f811mov [rsp+88], rdx
14001f816mov [rsp+56], r10w
14001f81ccall SysSetConfig
14001f821mov r9, [rsp+104]
14001f826mov r8l, [rsp+96]
14001f82bmov ecx, ebx
14001f82dmov rdx, [rsp+88]
14001f832call SysInvoke
14001f837jmp 0x14001f841
14001f839
14001f839loc_14001f839:
14001f839mov ecx, ebx
14001f83bcall [rax+612]
14001f841
14001f841loc_14001f841:
14001f841mov [rsp+32], eax
14001f845lea r9, [rip+39483]
14001f84cmov ebx, eax
14001f84emov r8l, 241
14001f854lea rdx, [rip+54197]
14001f85blea rcx, [rip+39166]
14001f862call printf.constprop.0
14001f867add rsp, 64
14001f86bmov eax, ebx
14001f86dpop rbx
14001f86eret
14001f7c0

14001f86f
14001f86f // align 0x10

14001f870
14001f870SysNtQueryVirtualMemory:
14001f870push rdi
14001f871xor eax, eax
14001f873push rsi
14001f874push rbx
14001f875mov rbx, rcx
14001f878sub rsp, 64
14001f87cmov [rsp+48], rax
14001f881mov rsi, [rsp+128]
14001f889mov [rsp+56], rax
14001f88emov rax, [rip+51931]
14001f895mov rdi, [rsp+136]
14001f89dcmp [rax+218], 0
14001f8a4je 0x14001f907
14001f8a6mov rcx, [rax+2028]
14001f8adtest rcx, rcx
14001f8b0je 0x14001f907
14001f8b2mov r10w, [rax+2092]
14001f8batest r10w, r10w
14001f8beje 0x14001f907
14001f8c0mov [rsp+48], rcx
14001f8c5lea rcx, [rsp+48]
14001f8camov [rsp+120], r9
14001f8cfmov [rsp+112], r8l
14001f8d4mov [rsp+104], rdx
14001f8d9mov [rsp+56], r10w
14001f8dfcall SysSetConfig
14001f8e4mov [rsp+40], rdi
14001f8e9mov r9, [rsp+120]
14001f8eemov rcx, rbx
14001f8f1mov r8l, [rsp+112]
14001f8f6mov rdx, [rsp+104]
14001f8fbmov [rsp+32], rsi
14001f900call SysInvoke
14001f905jmp 0x14001f91a
14001f907
14001f907loc_14001f907:
14001f907mov [rsp+40], rdi
14001f90cmov rcx, rbx
14001f90fmov [rsp+32], rsi
14001f914call [rax+716]
14001f91a
14001f91aloc_14001f91a:
14001f91amov [rsp+32], eax
14001f91elea r9, [rip+39511]
14001f925mov ebx, eax
14001f927mov r8l, 395
14001f92dlea rdx, [rip+55852]
14001f934lea rcx, [rip+38949]
14001f93bcall printf.constprop.0
14001f940add rsp, 64
14001f944mov eax, ebx
14001f946pop rbx
14001f947pop rsi
14001f948pop rdi
14001f949ret
14001f870

14001f94a
14001f94a // align 0x10

14001f950
14001f950SysNtQueueApcThread:
14001f950push rsi
14001f951xor eax, eax
14001f953push rbx
14001f954mov rbx, rcx
14001f957sub rsp, 72
14001f95bmov [rsp+48], rax
14001f960mov rsi, [rsp+128]
14001f968mov [rsp+56], rax
14001f96dmov rax, [rip+51708]
14001f974cmp [rax+218], 0
14001f97bje 0x14001f9d9
14001f97dmov rcx, [rax+2028]
14001f984test rcx, rcx
14001f987je 0x14001f9d9
14001f989mov r10w, [rax+2052]
14001f991test r10w, r10w
14001f995je 0x14001f9d9
14001f997mov [rsp+48], rcx
14001f99clea rcx, [rsp+48]
14001f9a1mov [rsp+120], r9
14001f9a6mov [rsp+112], r8
14001f9abmov [rsp+104], rdx
14001f9b0mov [rsp+56], r10w
14001f9b6call SysSetConfig
14001f9bbmov [rsp+32], rsi
14001f9c0mov r9, [rsp+120]
14001f9c5mov rcx, rbx
14001f9c8mov r8, [rsp+112]
14001f9cdmov rdx, [rsp+104]
14001f9d2call SysInvoke
14001f9d7jmp 0x14001f9e7
14001f9d9
14001f9d9loc_14001f9d9:
14001f9d9mov [rsp+32], rsi
14001f9demov rcx, rbx
14001f9e1call [rax+540]
14001f9e7
14001f9e7loc_14001f9e7:
14001f9e7mov [rsp+32], eax
14001f9eblea r9, [rip+38900]
14001f9f2mov ebx, eax
14001f9f4mov r8l, 99
14001f9falea rdx, [rip+54559]
14001fa01lea rcx, [rip+38744]
14001fa08call printf.constprop.0
14001fa0dadd rsp, 72
14001fa11mov eax, ebx
14001fa13pop rbx
14001fa14pop rsi
14001fa15ret
14001f950

14001fa16
14001fa16 // align 0x10

14001fa20
14001fa20SysNtReadVirtualMemory:
14001fa20push rsi
14001fa21xor eax, eax
14001fa23push rbx
14001fa24mov rbx, rcx
14001fa27sub rsp, 72
14001fa2bmov [rsp+48], rax
14001fa30mov rsi, [rsp+128]
14001fa38mov [rsp+56], rax
14001fa3dmov rax, [rip+51500]
14001fa44cmp [rax+218], 0
14001fa4bje 0x14001faa9
14001fa4dmov rcx, [rax+2028]
14001fa54test rcx, rcx
14001fa57je 0x14001faa9
14001fa59mov r10w, [rax+2078]
14001fa61test r10w, r10w
14001fa65je 0x14001faa9
14001fa67mov [rsp+48], rcx
14001fa6clea rcx, [rsp+48]
14001fa71mov [rsp+120], r9
14001fa76mov [rsp+112], r8
14001fa7bmov [rsp+104], rdx
14001fa80mov [rsp+56], r10w
14001fa86call SysSetConfig
14001fa8bmov [rsp+32], rsi
14001fa90mov r9, [rsp+120]
14001fa95mov rcx, rbx
14001fa98mov r8, [rsp+112]
14001fa9dmov rdx, [rsp+104]
14001faa2call SysInvoke
14001faa7jmp 0x14001fab7
14001faa9
14001faa9loc_14001faa9:
14001faa9mov [rsp+32], rsi
14001faaemov rcx, rbx
14001fab1call [rax+652]
14001fab7
14001fab7loc_14001fab7:
14001fab7mov [rsp+32], eax
14001fabblea r9, [rip+39009]
14001fac2mov ebx, eax
14001fac4mov r8l, 341
14001facalea rdx, [rip+53087]
14001fad1lea rcx, [rip+38536]
14001fad8call printf.constprop.0
14001faddadd rsp, 72
14001fae1mov eax, ebx
14001fae3pop rbx
14001fae4pop rsi
14001fae5ret
14001fa20

14001fae6
14001fae6 // align 0x10

14001faf0
14001faf0SysNtResumeThread:
14001faf0push rbx
14001faf1xor eax, eax
14001faf3mov rbx, rcx
14001faf6sub rsp, 64
14001fafamov [rsp+48], rax
14001faffmov [rsp+56], rax
14001fb04mov rax, [rip+51301]
14001fb0bcmp [rax+218], 0
14001fb12je 0x14001fb57
14001fb14mov rcx, [rax+2028]
14001fb1btest rcx, rcx
14001fb1eje 0x14001fb57
14001fb20mov r8w, [rax+2056]
14001fb28test r8w, r8w
14001fb2cje 0x14001fb57
14001fb2emov [rsp+48], rcx
14001fb33lea rcx, [rsp+48]
14001fb38mov [rsp+88], rdx
14001fb3dmov [rsp+56], r8w
14001fb43call SysSetConfig
14001fb48mov rdx, [rsp+88]
14001fb4dmov rcx, rbx
14001fb50call SysInvoke
14001fb55jmp 0x14001fb60
14001fb57
14001fb57loc_14001fb57:
14001fb57mov rcx, rbx
14001fb5acall [rax+556]
14001fb60
14001fb60loc_14001fb60:
14001fb60mov [rsp+32], eax
14001fb64lea r9, [rip+38556]
14001fb6bmov ebx, eax
14001fb6dmov r8l, 123
14001fb73lea rdx, [rip+54118]
14001fb7alea rcx, [rip+38367]
14001fb81call printf.constprop.0
14001fb86add rsp, 64
14001fb8amov eax, ebx
14001fb8cpop rbx
14001fb8dret
14001faf0