Similarity

14001dc00
14001dc00SysInitialize:
14001dc00push rbx
14001dc01xor eax, eax
14001dc03sub rsp, 64
14001dc07mov [rsp+56], rax
14001dc0cxor eax, eax
14001dc0etest rcx, rcx
14001dc11je 0x14001e861
14001dc17mov edx, 0xffffffff8cfcc776
14001dc1ccall LdrFunctionAddr
14001dc21mov rbx, [rip+59208]
14001dc28test rax, rax
14001dc2bmov rcx, rax
14001dc2eje 0x14001dc75
14001dc30lea r9, [rsp+56]
14001dc35xor r8l, r8l
14001dc38mov edx, 1
14001dc3dcall SysExtract
14001dc42mov rax, [rsp+56]
14001dc47test rax, rax
14001dc4aje 0x14001dc55
14001dc4cmov [rbx+2028], rax
14001dc53jmp 0x14001dc75
14001dc55
14001dc55loc_14001dc55:
14001dc55lea r9, [rip+47463]
14001dc5cmov r8l, 32
14001dc62lea rdx, [rip+61639]
14001dc69lea rcx, [rip+47191]
14001dc70call printf
14001dc75
14001dc75loc_14001dc75:
14001dc75mov rcx, [rbx+492]
14001dc7ctest rcx, rcx
14001dc7fje 0x14001dccc
14001dc81xor r9l, r9l
14001dc84lea r8, [rbx+2040]
14001dc8bmov edx, 1
14001dc90call SysExtract
14001dc95mov rax, [rbx+492]
14001dc9clea r9, [rip+47426]
14001dca3mov r8l, 44
14001dca9lea rdx, [rip+61568]
14001dcb0lea rcx, [rip+47419]
14001dcb7mov [rsp+40], rax
14001dcbcmovzx eax, [rbx+2040]
14001dcc3mov [rsp+32], eax
14001dcc7call printf
14001dccc
14001dcccloc_14001dccc:
14001dcccmov rcx, [rbx+500]
14001dcd3test rcx, rcx
14001dcd6je 0x14001dd23
14001dcd8xor r9l, r9l
14001dcdblea r8, [rbx+2042]
14001dce2mov edx, 1
14001dce7call SysExtract
14001dcecmov rax, [rbx+500]
14001dcf3lea r9, [rip+47404]
14001dcfamov r8l, 45
14001dd00lea rdx, [rip+61481]
14001dd07lea rcx, [rip+47332]
14001dd0emov [rsp+40], rax
14001dd13movzx eax, [rbx+2042]
14001dd1amov [rsp+32], eax
14001dd1ecall printf
14001dd23
14001dd23loc_14001dd23:
14001dd23mov rcx, [rbx+516]
14001dd2atest rcx, rcx
14001dd2dje 0x14001dd7a
14001dd2fxor r9l, r9l
14001dd32lea r8, [rbx+2046]
14001dd39mov edx, 1
14001dd3ecall SysExtract
14001dd43mov rax, [rbx+516]
14001dd4alea r9, [rip+47335]
14001dd51mov r8l, 46
14001dd57lea rdx, [rip+61394]
14001dd5elea rcx, [rip+47245]
14001dd65mov [rsp+40], rax
14001dd6amovzx eax, [rbx+2046]
14001dd71mov [rsp+32], eax
14001dd75call printf
14001dd7a
14001dd7aloc_14001dd7a:
14001dd7amov rcx, [rbx+508]
14001dd81test rcx, rcx
14001dd84je 0x14001ddd1
14001dd86xor r9l, r9l
14001dd89lea r8, [rbx+2044]
14001dd90mov edx, 1
14001dd95call SysExtract
14001dd9amov rax, [rbx+508]
14001dda1lea r9, [rip+47262]
14001dda8mov r8l, 47
14001ddaelea rdx, [rip+61307]
14001ddb5lea rcx, [rip+47158]
14001ddbcmov [rsp+40], rax
14001ddc1movzx eax, [rbx+2044]
14001ddc8mov [rsp+32], eax
14001ddcccall printf
14001ddd1
14001ddd1loc_14001ddd1:
14001ddd1mov rcx, [rbx+524]
14001ddd8test rcx, rcx
14001dddbje 0x14001de28
14001ddddxor r9l, r9l
14001dde0lea r8, [rbx+2048]
14001dde7mov edx, 1
14001ddeccall SysExtract
14001ddf1mov rax, [rbx+524]
14001ddf8lea r9, [rip+47194]
14001ddffmov r8l, 48
14001de05lea rdx, [rip+61220]
14001de0clea rcx, [rip+47071]
14001de13mov [rsp+40], rax
14001de18movzx eax, [rbx+2048]
14001de1fmov [rsp+32], eax
14001de23call printf
14001de28
14001de28loc_14001de28:
14001de28mov rcx, [rbx+532]
14001de2ftest rcx, rcx
14001de32je 0x14001de7f
14001de34xor r9l, r9l
14001de37lea r8, [rbx+2050]
14001de3emov edx, 1
14001de43call SysExtract
14001de48mov rax, [rbx+532]
14001de4flea r9, [rip+47126]
14001de56mov r8l, 49
14001de5clea rdx, [rip+61133]
14001de63lea rcx, [rip+46984]
14001de6amov [rsp+40], rax
14001de6fmovzx eax, [rbx+2050]
14001de76mov [rsp+32], eax
14001de7acall printf
14001de7f
14001de7floc_14001de7f:
14001de7fmov rcx, [rbx+540]
14001de86test rcx, rcx
14001de89je 0x14001ded6
14001de8bxor r9l, r9l
14001de8elea r8, [rbx+2052]
14001de95mov edx, 1
14001de9acall SysExtract
14001de9fmov rax, [rbx+540]
14001dea6lea r9, [rip+47056]
14001deadmov r8l, 50
14001deb3lea rdx, [rip+61046]
14001debalea rcx, [rip+46897]
14001dec1mov [rsp+40], rax
14001dec6movzx eax, [rbx+2052]
14001decdmov [rsp+32], eax
14001ded1call printf
14001ded6
14001ded6loc_14001ded6:
14001ded6mov rcx, [rbx+548]
14001deddtest rcx, rcx
14001dee0je 0x14001df2d
14001dee2xor r9l, r9l
14001dee5lea r8, [rbx+2054]
14001deecmov edx, 1
14001def1call SysExtract
14001def6mov rax, [rbx+548]
14001defdlea r9, [rip+46986]
14001df04mov r8l, 51
14001df0alea rdx, [rip+60959]
14001df11lea rcx, [rip+46810]
14001df18mov [rsp+40], rax
14001df1dmovzx eax, [rbx+2054]
14001df24mov [rsp+32], eax
14001df28call printf
14001df2d
14001df2dloc_14001df2d:
14001df2dmov rcx, [rbx+556]
14001df34test rcx, rcx
14001df37je 0x14001df84
14001df39xor r9l, r9l
14001df3clea r8, [rbx+2056]
14001df43mov edx, 1
14001df48call SysExtract
14001df4dmov rax, [rbx+556]
14001df54lea r9, [rip+46915]
14001df5bmov r8l, 52
14001df61lea rdx, [rip+60872]
14001df68lea rcx, [rip+46723]
14001df6fmov [rsp+40], rax
14001df74movzx eax, [rbx+2056]
14001df7bmov [rsp+32], eax
14001df7fcall printf
14001df84
14001df84loc_14001df84:
14001df84mov rcx, [rbx+564]
14001df8btest rcx, rcx
14001df8eje 0x14001dfdb
14001df90xor r9l, r9l
14001df93lea r8, [rbx+2058]
14001df9amov edx, 1
14001df9fcall SysExtract
14001dfa4mov rax, [rbx+564]
14001dfablea r9, [rip+46843]
14001dfb2mov r8l, 53
14001dfb8lea rdx, [rip+60785]
14001dfbflea rcx, [rip+46636]
14001dfc6mov [rsp+40], rax
14001dfcbmovzx eax, [rbx+2058]
14001dfd2mov [rsp+32], eax
14001dfd6call printf
14001dfdb
14001dfdbloc_14001dfdb:
14001dfdbmov rcx, [rbx+572]
14001dfe2test rcx, rcx
14001dfe5je 0x14001e032
14001dfe7xor r9l, r9l
14001dfealea r8, [rbx+2060]
14001dff1mov edx, 1
14001dff6call SysExtract
14001dffbmov rax, [rbx+572]
14001e002lea r9, [rip+46770]
14001e009mov r8l, 54
14001e00flea rdx, [rip+60698]
14001e016lea rcx, [rip+46549]
14001e01dmov [rsp+40], rax
14001e022movzx eax, [rbx+2060]
14001e029mov [rsp+32], eax
14001e02dcall printf
14001e032
14001e032loc_14001e032:
14001e032mov rcx, [rbx+580]
14001e039test rcx, rcx
14001e03cje 0x14001e089
14001e03exor r9l, r9l
14001e041lea r8, [rbx+2062]
14001e048mov edx, 1
14001e04dcall SysExtract
14001e052mov rax, [rbx+580]
14001e059lea r9, [rip+46700]
14001e060mov r8l, 55
14001e066lea rdx, [rip+60611]
14001e06dlea rcx, [rip+46462]
14001e074mov [rsp+40], rax
14001e079movzx eax, [rbx+2062]
14001e080mov [rsp+32], eax
14001e084call printf
14001e089
14001e089loc_14001e089:
14001e089mov rcx, [rbx+588]
14001e090test rcx, rcx
14001e093je 0x14001e0e0
14001e095xor r9l, r9l
14001e098lea r8, [rbx+2064]
14001e09fmov edx, 1
14001e0a4call SysExtract
14001e0a9mov rax, [rbx+588]
14001e0b0lea r9, [rip+46631]
14001e0b7mov r8l, 56
14001e0bdlea rdx, [rip+60524]
14001e0c4lea rcx, [rip+46375]
14001e0cbmov [rsp+40], rax
14001e0d0movzx eax, [rbx+2064]
14001e0d7mov [rsp+32], eax
14001e0dbcall printf
14001e0e0
14001e0e0loc_14001e0e0:
14001e0e0mov rcx, [rbx+596]
14001e0e7test rcx, rcx
14001e0eaje 0x14001e137
14001e0ecxor r9l, r9l
14001e0eflea r8, [rbx+2066]
14001e0f6mov edx, 1
14001e0fbcall SysExtract
14001e100mov rax, [rbx+596]
14001e107lea r9, [rip+46563]
14001e10emov r8l, 57
14001e114lea rdx, [rip+60437]
14001e11blea rcx, [rip+46288]
14001e122mov [rsp+40], rax
14001e127movzx eax, [rbx+2066]
14001e12emov [rsp+32], eax
14001e132call printf
14001e137
14001e137loc_14001e137:
14001e137mov rcx, [rbx+604]
14001e13etest rcx, rcx
14001e141je 0x14001e18e
14001e143xor r9l, r9l
14001e146lea r8, [rbx+2068]
14001e14dmov edx, 1
14001e152call SysExtract
14001e157mov rax, [rbx+604]
14001e15elea r9, [rip+46495]
14001e165mov r8l, 58
14001e16blea rdx, [rip+60350]
14001e172lea rcx, [rip+46201]
14001e179mov [rsp+40], rax
14001e17emovzx eax, [rbx+2068]
14001e185mov [rsp+32], eax
14001e189call printf
14001e18e
14001e18eloc_14001e18e:
14001e18emov rcx, [rbx+612]
14001e195test rcx, rcx
14001e198je 0x14001e1e5
14001e19axor r9l, r9l
14001e19dlea r8, [rbx+2070]
14001e1a4mov edx, 1
14001e1a9call SysExtract
14001e1aemov rax, [rbx+612]
14001e1b5lea r9, [rip+46434]
14001e1bcmov r8l, 59
14001e1c2lea rdx, [rip+60263]
14001e1c9lea rcx, [rip+46114]
14001e1d0mov [rsp+40], rax
14001e1d5movzx eax, [rbx+2070]
14001e1dcmov [rsp+32], eax
14001e1e0call printf
14001e1e5
14001e1e5loc_14001e1e5:
14001e1e5mov rcx, [rbx+620]
14001e1ectest rcx, rcx
14001e1efje 0x14001e23c
14001e1f1xor r9l, r9l
14001e1f4lea r8, [rbx+2072]
14001e1fbmov edx, 1
14001e200call SysExtract
14001e205mov rax, [rbx+620]
14001e20clea r9, [rip+46372]
14001e213mov r8l, 60
14001e219lea rdx, [rip+60176]
14001e220lea rcx, [rip+46027]
14001e227mov [rsp+40], rax
14001e22cmovzx eax, [rbx+2072]
14001e233mov [rsp+32], eax
14001e237call printf
14001e23c
14001e23cloc_14001e23c:
14001e23cmov rcx, [rbx+636]
14001e243test rcx, rcx
14001e246je 0x14001e293
14001e248xor r9l, r9l
14001e24blea r8, [rbx+2074]
14001e252mov edx, 1
14001e257call SysExtract
14001e25cmov rax, [rbx+636]
14001e263lea r9, [rip+46307]
14001e26amov r8l, 61
14001e270lea rdx, [rip+60089]
14001e277lea rcx, [rip+45940]
14001e27emov [rsp+40], rax
14001e283movzx eax, [rbx+2074]
14001e28amov [rsp+32], eax
14001e28ecall printf
14001e293
14001e293loc_14001e293:
14001e293mov rcx, [rbx+644]
14001e29atest rcx, rcx
14001e29dje 0x14001e2ea
14001e29fxor r9l, r9l
14001e2a2lea r8, [rbx+2076]
14001e2a9mov edx, 1
14001e2aecall SysExtract
14001e2b3mov rax, [rbx+644]
14001e2balea r9, [rip+46244]
14001e2c1mov r8l, 62
14001e2c7lea rdx, [rip+60002]
14001e2celea rcx, [rip+45853]
14001e2d5mov [rsp+40], rax
14001e2damovzx eax, [rbx+2076]
14001e2e1mov [rsp+32], eax
14001e2e5call printf
14001e2ea
14001e2ealoc_14001e2ea:
14001e2eamov rcx, [rbx+652]
14001e2f1test rcx, rcx
14001e2f4je 0x14001e341
14001e2f6xor r9l, r9l
14001e2f9lea r8, [rbx+2078]
14001e300mov edx, 1
14001e305call SysExtract
14001e30amov rax, [rbx+652]
14001e311lea r9, [rip+46178]
14001e318mov r8l, 63
14001e31elea rdx, [rip+59915]
14001e325lea rcx, [rip+45766]
14001e32cmov [rsp+40], rax
14001e331movzx eax, [rbx+2078]
14001e338mov [rsp+32], eax
14001e33ccall printf
14001e341
14001e341loc_14001e341:
14001e341mov rcx, [rbx+660]
14001e348test rcx, rcx
14001e34bje 0x14001e398
14001e34dxor r9l, r9l
14001e350lea r8, [rbx+2080]
14001e357mov edx, 1
14001e35ccall SysExtract
14001e361mov rax, [rbx+660]
14001e368lea r9, [rip+46111]
14001e36fmov r8l, 64
14001e375lea rdx, [rip+59828]
14001e37clea rcx, [rip+45679]
14001e383mov [rsp+40], rax
14001e388movzx eax, [rbx+2080]
14001e38fmov [rsp+32], eax
14001e393call printf
14001e398
14001e398loc_14001e398:
14001e398mov rcx, [rbx+668]
14001e39ftest rcx, rcx
14001e3a2je 0x14001e3ef
14001e3a4xor r9l, r9l
14001e3a7lea r8, [rbx+2082]
14001e3aemov edx, 1
14001e3b3call SysExtract
14001e3b8mov rax, [rbx+668]
14001e3bflea r9, [rip+46044]
14001e3c6mov r8l, 65
14001e3cclea rdx, [rip+59741]
14001e3d3lea rcx, [rip+45592]
14001e3damov [rsp+40], rax
14001e3dfmovzx eax, [rbx+2082]
14001e3e6mov [rsp+32], eax
14001e3eacall printf
14001e3ef
14001e3efloc_14001e3ef:
14001e3efmov rcx, [rbx+676]
14001e3f6test rcx, rcx
14001e3f9je 0x14001e446
14001e3fbxor r9l, r9l
14001e3felea r8, [rbx+2084]
14001e405mov edx, 1
14001e40acall SysExtract
14001e40fmov rax, [rbx+676]
14001e416lea r9, [rip+45978]
14001e41dmov r8l, 66
14001e423lea rdx, [rip+59654]
14001e42alea rcx, [rip+45505]
14001e431mov [rsp+40], rax
14001e436movzx eax, [rbx+2084]
14001e43dmov [rsp+32], eax
14001e441call printf
14001e446
14001e446loc_14001e446:
14001e446mov rcx, [rbx+684]
14001e44dtest rcx, rcx
14001e450je 0x14001e49d
14001e452xor r9l, r9l
14001e455lea r8, [rbx+2086]
14001e45cmov edx, 1
14001e461call SysExtract
14001e466mov rax, [rbx+684]
14001e46dlea r9, [rip+45914]
14001e474mov r8l, 67
14001e47alea rdx, [rip+59567]
14001e481lea rcx, [rip+45418]
14001e488mov [rsp+40], rax
14001e48dmovzx eax, [rbx+2086]
14001e494mov [rsp+32], eax
14001e498call printf
14001e49d
14001e49dloc_14001e49d:
14001e49dmov rcx, [rbx+700]
14001e4a4test rcx, rcx
14001e4a7je 0x14001e4f4
14001e4a9xor r9l, r9l
14001e4aclea r8, [rbx+2088]
14001e4b3mov edx, 1
14001e4b8call SysExtract
14001e4bdmov rax, [rbx+700]
14001e4c4lea r9, [rip+45845]
14001e4cbmov r8l, 68
14001e4d1lea rdx, [rip+59480]
14001e4d8lea rcx, [rip+45331]
14001e4dfmov [rsp+40], rax
14001e4e4movzx eax, [rbx+2088]
14001e4ebmov [rsp+32], eax
14001e4efcall printf
14001e4f4
14001e4f4loc_14001e4f4:
14001e4f4mov rcx, [rbx+708]
14001e4fbtest rcx, rcx
14001e4feje 0x14001e54b
14001e500xor r9l, r9l
14001e503lea r8, [rbx+2090]
14001e50amov edx, 1
14001e50fcall SysExtract
14001e514mov rax, [rbx+708]
14001e51blea r9, [rip+45778]
14001e522mov r8l, 69
14001e528lea rdx, [rip+59393]
14001e52flea rcx, [rip+45244]
14001e536mov [rsp+40], rax
14001e53bmovzx eax, [rbx+2090]
14001e542mov [rsp+32], eax
14001e546call printf
14001e54b
14001e54bloc_14001e54b:
14001e54bmov rcx, [rbx+716]
14001e552test rcx, rcx
14001e555je 0x14001e5a2
14001e557xor r9l, r9l
14001e55alea r8, [rbx+2092]
14001e561mov edx, 1
14001e566call SysExtract
14001e56bmov rax, [rbx+716]
14001e572lea r9, [rip+45722]
14001e579mov r8l, 70
14001e57flea rdx, [rip+59306]
14001e586lea rcx, [rip+45157]
14001e58dmov [rsp+40], rax
14001e592movzx eax, [rbx+2092]
14001e599mov [rsp+32], eax
14001e59dcall printf
14001e5a2
14001e5a2loc_14001e5a2:
14001e5a2mov rcx, [rbx+724]
14001e5a9test rcx, rcx
14001e5acje 0x14001e5f9
14001e5aexor r9l, r9l
14001e5b1lea r8, [rbx+2094]
14001e5b8mov edx, 1
14001e5bdcall SysExtract
14001e5c2mov rax, [rbx+724]
14001e5c9lea r9, [rip+45656]
14001e5d0mov r8l, 71
14001e5d6lea rdx, [rip+59219]
14001e5ddlea rcx, [rip+45070]
14001e5e4mov [rsp+40], rax
14001e5e9movzx eax, [rbx+2094]
14001e5f0mov [rsp+32], eax
14001e5f4call printf
14001e5f9
14001e5f9loc_14001e5f9:
14001e5f9mov rcx, [rbx+732]
14001e600test rcx, rcx
14001e603je 0x14001e650
14001e605xor r9l, r9l
14001e608lea r8, [rbx+2096]
14001e60fmov edx, 1
14001e614call SysExtract
14001e619mov rax, [rbx+732]
14001e620lea r9, [rip+45593]
14001e627mov r8l, 72
14001e62dlea rdx, [rip+59132]
14001e634lea rcx, [rip+44983]
14001e63bmov [rsp+40], rax
14001e640movzx eax, [rbx+2096]
14001e647mov [rsp+32], eax
14001e64bcall printf
14001e650
14001e650loc_14001e650:
14001e650mov rcx, [rbx+740]
14001e657test rcx, rcx
14001e65aje 0x14001e6a7
14001e65cxor r9l, r9l
14001e65flea r8, [rbx+2098]
14001e666mov edx, 1
14001e66bcall SysExtract
14001e670mov rax, [rbx+740]
14001e677lea r9, [rip+45531]
14001e67emov r8l, 73
14001e684lea rdx, [rip+59045]
14001e68blea rcx, [rip+44896]
14001e692mov [rsp+40], rax
14001e697movzx eax, [rbx+2098]
14001e69emov [rsp+32], eax
14001e6a2call printf
14001e6a7
14001e6a7loc_14001e6a7:
14001e6a7mov rbx, [rip+56514]
14001e6aemov rcx, [rbx+452]
14001e6b5test rcx, rcx
14001e6b8je 0x14001e705
14001e6baxor r9l, r9l
14001e6bdlea r8, [rbx+2100]
14001e6c4mov edx, 1
14001e6c9call SysExtract
14001e6cemov rax, [rbx+452]
14001e6d5lea r9, [rip+45451]
14001e6dcmov r8l, 74
14001e6e2lea rdx, [rip+58951]
14001e6e9lea rcx, [rip+44802]
14001e6f0mov [rsp+40], rax
14001e6f5movzx eax, [rbx+2100]
14001e6fcmov [rsp+32], eax
14001e700call printf
14001e705
14001e705loc_14001e705:
14001e705mov rcx, [rbx+460]
14001e70ctest rcx, rcx
14001e70fje 0x14001e75c
14001e711xor r9l, r9l
14001e714lea r8, [rbx+2102]
14001e71bmov edx, 1
14001e720call SysExtract
14001e725mov rax, [rbx+460]
14001e72clea r9, [rip+45372]
14001e733mov r8l, 75
14001e739lea rdx, [rip+58864]
14001e740lea rcx, [rip+44715]
14001e747mov [rsp+40], rax
14001e74cmovzx eax, [rbx+2102]
14001e753mov [rsp+32], eax
14001e757call printf
14001e75c
14001e75cloc_14001e75c:
14001e75cmov rcx, [rbx+468]
14001e763test rcx, rcx
14001e766je 0x14001e7b3
14001e768xor r9l, r9l
14001e76blea r8, [rbx+2104]
14001e772mov edx, 1
14001e777call SysExtract
14001e77cmov rax, [rbx+468]
14001e783lea r9, [rip+45296]
14001e78amov r8l, 76
14001e790lea rdx, [rip+58777]
14001e797lea rcx, [rip+44628]
14001e79emov [rsp+40], rax
14001e7a3movzx eax, [rbx+2104]
14001e7aamov [rsp+32], eax
14001e7aecall printf
14001e7b3
14001e7b3loc_14001e7b3:
14001e7b3mov rcx, [rbx+476]
14001e7batest rcx, rcx
14001e7bdje 0x14001e80a
14001e7bfxor r9l, r9l
14001e7c2lea r8, [rbx+2106]
14001e7c9mov edx, 1
14001e7cecall SysExtract
14001e7d3mov rax, [rbx+476]
14001e7dalea r9, [rip+45232]
14001e7e1mov r8l, 77
14001e7e7lea rdx, [rip+58690]
14001e7eelea rcx, [rip+44541]
14001e7f5mov [rsp+40], rax
14001e7famovzx eax, [rbx+2106]
14001e801mov [rsp+32], eax
14001e805call printf
14001e80a
14001e80aloc_14001e80a:
14001e80amov rcx, [rbx+484]
14001e811test rcx, rcx
14001e814je 0x14001e861
14001e816xor r9l, r9l
14001e819lea r8, [rbx+2108]
14001e820mov edx, 1
14001e825call SysExtract
14001e82amov rax, [rbx+484]
14001e831lea r9, [rip+45175]
14001e838mov r8l, 78
14001e83elea rdx, [rip+58603]
14001e845lea rcx, [rip+44454]
14001e84cmov [rsp+40], rax
14001e851movzx eax, [rbx+2108]
14001e858mov [rsp+32], eax
14001e85ccall printf
14001e861
14001e861loc_14001e861:
14001e861add rsp, 64
14001e865pop rbx
14001e866ret
14001dc00

14001e867
14001e867 // align 0x10

14001e870
14001e870SysNtAlertResumeThread:
14001e870push rbx
14001e871xor eax, eax
14001e873mov rbx, rcx
14001e876sub rsp, 64
14001e87amov [rsp+48], rax
14001e87fmov [rsp+56], rax
14001e884mov rax, [rip+56037]
14001e88bcmp [rax+218], 0
14001e892je 0x14001e8d7
14001e894mov rcx, [rax+2028]
14001e89btest rcx, rcx
14001e89eje 0x14001e8d7
14001e8a0mov r8w, [rax+2088]
14001e8a8test r8w, r8w
14001e8acje 0x14001e8d7
14001e8aemov [rsp+48], rcx
14001e8b3lea rcx, [rsp+48]
14001e8b8mov [rsp+88], rdx
14001e8bdmov [rsp+56], r8w
14001e8c3call SysSetConfig
14001e8c8mov rdx, [rsp+88]
14001e8cdmov rcx, rbx
14001e8d0call SysInvoke
14001e8d5jmp 0x14001e8e0
14001e8d7
14001e8d7loc_14001e8d7:
14001e8d7mov rcx, rbx
14001e8dacall [rax+700]
14001e8e0
14001e8e0loc_14001e8e0:
14001e8e0mov [rsp+32], eax
14001e8e4lea r9, [rip+43614]
14001e8ebmov ebx, eax
14001e8edmov r8l, 365
14001e8f3lea rdx, [rip+60326]
14001e8falea rcx, [rip+43103]
14001e901call printf.constprop.0
14001e906add rsp, 64
14001e90amov eax, ebx
14001e90cpop rbx
14001e90dret
14001e870

14001e90e
14001e90e // align 0x10

14001e910
14001e910SysNtAllocateVirtualMemory:
14001e910push rdi
14001e911xor eax, eax
14001e913push rsi
14001e914push rbx
14001e915mov rbx, rcx
14001e918sub rsp, 64
14001e91cmov [rsp+48], rax
14001e921mov esi, [rsp+128]
14001e928mov [rsp+56], rax
14001e92dmov rax, [rip+55868]
14001e934mov edi, [rsp+136]
14001e93bcmp [rax+218], 0
14001e942je 0x14001e9a3
14001e944mov rcx, [rax+2028]
14001e94btest rcx, rcx
14001e94eje 0x14001e9a3
14001e950mov r10w, [rax+2074]
14001e958test r10w, r10w
14001e95cje 0x14001e9a3
14001e95emov [rsp+48], rcx
14001e963lea rcx, [rsp+48]
14001e968mov [rsp+120], r9
14001e96dmov [rsp+112], r8
14001e972mov [rsp+104], rdx
14001e977mov [rsp+56], r10w
14001e97dcall SysSetConfig
14001e982mov [rsp+40], edi
14001e986mov r9, [rsp+120]
14001e98bmov rcx, rbx
14001e98emov r8, [rsp+112]
14001e993mov rdx, [rsp+104]
14001e998mov [rsp+32], esi
14001e99ccall SysInvoke
14001e9a1jmp 0x14001e9b4
14001e9a3
14001e9a3loc_14001e9a3:
14001e9a3mov [rsp+40], edi
14001e9a7mov rcx, rbx
14001e9aamov [rsp+32], esi
14001e9aecall [rax+636]
14001e9b4
14001e9b4loc_14001e9b4:
14001e9b4mov [rsp+32], eax
14001e9b8lea r9, [rip+43255]
14001e9bfmov ebx, eax
14001e9c1mov r8l, 270
14001e9c7lea rdx, [rip+57826]
14001e9celea rcx, [rip+42891]
14001e9d5call printf.constprop.0
14001e9daadd rsp, 64
14001e9demov eax, ebx
14001e9e0pop rbx
14001e9e1pop rsi
14001e9e2pop rdi
14001e9e3ret
14001e910

14001e9e4
14001e9e4 // align 0x10

14001e9f0
14001e9f0SysNtClose:
14001e9f0push rbx
14001e9f1xor eax, eax
14001e9f3mov rbx, rcx
14001e9f6sub rsp, 64
14001e9famov [rsp+48], rax
14001e9ffmov [rsp+56], rax
14001ea04mov rax, [rip+55653]
14001ea0bcmp [rax+218], 0
14001ea12je 0x14001ea4a
14001ea14mov rdx, [rax+2028]
14001ea1btest rdx, rdx
14001ea1eje 0x14001ea4a
14001ea20mov cx, [rax+2100]
14001ea27test cx, cx
14001ea2aje 0x14001ea4a
14001ea2cmov [rsp+56], cx
14001ea31lea rcx, [rsp+48]
14001ea36mov [rsp+48], rdx
14001ea3bcall SysSetConfig
14001ea40mov rcx, rbx
14001ea43call SysInvoke
14001ea48jmp 0x14001ea53
14001ea4a
14001ea4aloc_14001ea4a:
14001ea4amov rcx, rbx
14001ea4dcall [rax+452]
14001ea53
14001ea53loc_14001ea53:
14001ea53mov [rsp+32], eax
14001ea57lea r9, [rip+43378]
14001ea5emov ebx, eax
14001ea60mov r8l, 451
14001ea66lea rdx, [rip+58787]
14001ea6dlea rcx, [rip+42732]
14001ea74call printf.constprop.0
14001ea79add rsp, 64
14001ea7dmov eax, ebx
14001ea7fpop rbx
14001ea80ret
14001e9f0

14001ea81
14001ea81 // align 0x10

14001ea90
14001ea90SysNtCreateEvent:
14001ea90push rsi
14001ea91xor eax, eax
14001ea93push rbx
14001ea94mov rbx, rcx
14001ea97sub rsp, 72
14001ea9bmov [rsp+48], rax
14001eaa0movzx esi, [rsp+128]
14001eaa8mov [rsp+56], rax
14001eaadmov rax, [rip+55484]
14001eab4cmp [rax+218], 0
14001eabbje 0x14001eb16
14001eabdmov rcx, [rax+2028]
14001eac4test rcx, rcx
14001eac7je 0x14001eb16
14001eac9mov r10w, [rax+2058]
14001ead1test r10w, r10w
14001ead5je 0x14001eb16
14001ead7mov [rsp+48], rcx
14001eadclea rcx, [rsp+48]
14001eae1mov [rsp+120], r9l
14001eae6mov [rsp+112], r8
14001eaebmov [rsp+104], edx
14001eaefmov [rsp+56], r10w
14001eaf5call SysSetConfig
14001eafamov [rsp+32], esi
14001eafemov edx, [rsp+104]
14001eb02mov rcx, rbx
14001eb05mov r9l, [rsp+120]
14001eb0amov r8, [rsp+112]
14001eb0fcall SysInvoke
14001eb14jmp 0x14001eb23
14001eb16
14001eb16loc_14001eb16:
14001eb16mov [rsp+32], esi
14001eb1amov rcx, rbx
14001eb1dcall [rax+564]
14001eb23
14001eb23loc_14001eb23:
14001eb23mov [rsp+32], eax
14001eb27lea r9, [rip+42728]
14001eb2emov ebx, eax
14001eb30mov r8l, 138
14001eb36lea rdx, [rip+58243]
14001eb3dlea rcx, [rip+42524]
14001eb44call printf.constprop.0
14001eb49add rsp, 72
14001eb4dmov eax, ebx
14001eb4fpop rbx
14001eb50pop rsi
14001eb51ret
14001ea90

14001eb52
14001eb52 // align 0x10

14001eb60
14001eb60SysNtCreateThreadEx:
14001eb60push r15
14001eb62xor eax, eax
14001eb64push r14
14001eb66push r13
14001eb68push r12
14001eb6apush rbp
14001eb6bpush rdi
14001eb6cpush rsi
14001eb6dpush rbx
14001eb6emov rbx, rcx
14001eb71sub rsp, 120
14001eb75mov [rsp+96], rax
14001eb7amov rsi, [rsp+224]
14001eb82mov [rsp+104], rax
14001eb87mov rax, [rip+55266]
14001eb8emov rdi, [rsp+232]
14001eb96mov ebp, [rsp+240]
14001eb9dcmp [rax+218], 0
14001eba4mov r12, [rsp+248]
14001ebacmov r13, [rsp+256]
14001ebb4mov r14, [rsp+264]
14001ebbcmov r15, [rsp+272]
14001ebc4je 0x14001ec53
14001ebcamov rcx, [rax+2028]
14001ebd1test rcx, rcx
14001ebd4je 0x14001ec53
14001ebd6mov r10w, [rax+2060]
14001ebdetest r10w, r10w
14001ebe2je 0x14001ec53
14001ebe4mov [rsp+96], rcx
14001ebe9lea rcx, [rsp+96]
14001ebeemov [rsp+216], r9
14001ebf6mov [rsp+208], r8
14001ebfemov [rsp+200], edx
14001ec05mov [rsp+104], r10w
14001ec0bcall SysSetConfig
14001ec10mov [rsp+80], r15
14001ec15mov rcx, rbx
14001ec18mov r9, [rsp+216]
14001ec20mov [rsp+72], r14
14001ec25mov r8, [rsp+208]
14001ec2dmov [rsp+64], r13
14001ec32mov edx, [rsp+200]
14001ec39mov [rsp+56], r12
14001ec3emov [rsp+48], ebp
14001ec42mov [rsp+40], rdi
14001ec47mov [rsp+32], rsi
14001ec4ccall SysInvoke
14001ec51jmp 0x14001ec7e
14001ec53
14001ec53loc_14001ec53:
14001ec53mov [rsp+80], r15
14001ec58mov rcx, rbx
14001ec5bmov [rsp+72], r14
14001ec60mov [rsp+64], r13
14001ec65mov [rsp+56], r12
14001ec6amov [rsp+48], ebp
14001ec6emov [rsp+40], rdi
14001ec73mov [rsp+32], rsi
14001ec78call [rax+572]
14001ec7e
14001ec7eloc_14001ec7e:
14001ec7emov [rsp+32], eax
14001ec82lea r9, [rip+42395]
14001ec89mov ebx, eax
14001ec8bmov r8l, 159
14001ec91lea rdx, [rip+57864]
14001ec98lea rcx, [rip+42177]
14001ec9fcall printf.constprop.0
14001eca4add rsp, 120
14001eca8mov eax, ebx
14001ecaapop rbx
14001ecabpop rsi
14001ecacpop rdi
14001ecadpop rbp
14001ecaepop r12
14001ecb0pop r13
14001ecb2pop r14
14001ecb4pop r15
14001ecb6ret
14001eb60

14001ecb7
14001ecb7 // align 0x10

14001ecc0
14001ecc0SysNtDuplicateObject:
14001ecc0push rbp
14001ecc1xor eax, eax
14001ecc3push rdi
14001ecc4push rsi
14001ecc5push rbx
14001ecc6mov rbx, rcx
14001ecc9sub rsp, 88
14001eccdmov [rsp+64], rax
14001ecd2mov esi, [rsp+160]
14001ecd9mov [rsp+72], rax
14001ecdemov rax, [rip+54923]
14001ece5mov edi, [rsp+168]
14001ececmov ebp, [rsp+176]
14001ecf3cmp [rax+218], 0
14001ecfaje 0x14001ed71
14001ecfcmov rcx, [rax+2028]
14001ed03test rcx, rcx
14001ed06je 0x14001ed71
14001ed08mov r10w, [rax+2062]
14001ed10test r10w, r10w
14001ed14je 0x14001ed71
14001ed16mov [rsp+64], rcx
14001ed1blea rcx, [rsp+64]
14001ed20mov [rsp+152], r9
14001ed28mov [rsp+144], r8
14001ed30mov [rsp+136], rdx
14001ed38mov [rsp+72], r10w
14001ed3ecall SysSetConfig
14001ed43mov [rsp+48], ebp
14001ed47mov rcx, rbx
14001ed4amov r9, [rsp+152]
14001ed52mov [rsp+40], edi
14001ed56mov r8, [rsp+144]
14001ed5emov [rsp+32], esi
14001ed62mov rdx, [rsp+136]
14001ed6acall SysInvoke
14001ed6fjmp 0x14001ed86
14001ed71
14001ed71loc_14001ed71:
14001ed71mov [rsp+48], ebp
14001ed75mov rcx, rbx
14001ed78mov [rsp+40], edi
14001ed7cmov [rsp+32], esi
14001ed80call [rax+580]
14001ed86
14001ed86loc_14001ed86:
14001ed86mov [rsp+32], eax
14001ed8alea r9, [rip+42148]
14001ed91mov ebx, eax
14001ed93mov r8l, 188
14001ed99lea rdx, [rip+57568]
14001eda0lea rcx, [rip+41913]
14001eda7call printf.constprop.0
14001edacadd rsp, 88
14001edb0mov eax, ebx
14001edb2pop rbx
14001edb3pop rsi
14001edb4pop rdi
14001edb5pop rbp
14001edb6ret
14001ecc0

14001edb7
14001edb7 // align 0x10

14001edc0
14001edc0SysNtDuplicateToken:
14001edc0push rdi
14001edc1xor eax, eax
14001edc3movzx r9l, r9b
14001edc7push rsi
14001edc8push rbx
14001edc9mov rbx, rcx
14001edccsub rsp, 80
14001edd0mov [rsp+64], rax
14001edd5mov esi, [rsp+144]
14001eddcmov [rsp+72], rax
14001ede1mov rax, [rip+54664]
14001ede8mov rdi, [rsp+152]
14001edf0cmp [rax+218], 0
14001edf7je 0x14001ee5d
14001edf9mov rcx, [rax+2028]
14001ee00test rcx, rcx
14001ee03je 0x14001ee5d
14001ee05mov r10w, [rax+2050]
14001ee0dtest r10w, r10w
14001ee11je 0x14001ee5d
14001ee13mov [rsp+64], rcx
14001ee18lea rcx, [rsp+64]
14001ee1dmov [rsp+128], r8
14001ee25mov [rsp+120], edx
14001ee29mov [rsp+60], r9l
14001ee2emov [rsp+72], r10w
14001ee34call SysSetConfig
14001ee39mov [rsp+32], esi
14001ee3dmov edx, [rsp+120]
14001ee41mov rcx, rbx
14001ee44mov [rsp+40], rdi
14001ee49mov r9l, [rsp+60]
14001ee4emov r8, [rsp+128]
14001ee56call SysInvoke
14001ee5bjmp 0x14001ee6f
14001ee5d
14001ee5dloc_14001ee5d:
14001ee5dmov [rsp+40], rdi
14001ee62mov rcx, rbx
14001ee65mov [rsp+32], esi
14001ee69call [rax+532]
14001ee6f
14001ee6floc_14001ee6f:
14001ee6fmov [rsp+32], eax
14001ee73lea r9, [rip+41819]
14001ee7amov ebx, eax
14001ee7cmov r8l, 84
14001ee82lea rdx, [rip+57527]
14001ee89lea rcx, [rip+41680]
14001ee90call printf.constprop.0
14001ee95add rsp, 80
14001ee99mov eax, ebx
14001ee9bpop rbx
14001ee9cpop rsi
14001ee9dpop rdi
14001ee9eret
14001edc0

14001ee9f
14001ee9f // align 0x10

14001eea0
14001eea0SysNtFreeVirtualMemory:
14001eea0push rbx
14001eea1xor eax, eax
14001eea3mov rbx, rcx
14001eea6sub rsp, 64
14001eeaamov [rsp+48], rax
14001eeafmov [rsp+56], rax
14001eeb4mov rax, [rip+54453]
14001eebbcmp [rax+218], 0
14001eec2je 0x14001ef1b
14001eec4mov rcx, [rax+2028]
14001eecbtest rcx, rcx
14001eeceje 0x14001ef1b
14001eed0mov r10w, [rax+2080]
14001eed8test r10w, r10w
14001eedcje 0x14001ef1b
14001eedemov [rsp+48], rcx
14001eee3lea rcx, [rsp+48]
14001eee8mov [rsp+104], r9l
14001eeedmov [rsp+96], r8
14001eef2mov [rsp+88], rdx
14001eef7mov [rsp+56], r10w
14001eefdcall SysSetConfig
14001ef02mov r9l, [rsp+104]
14001ef07mov r8, [rsp+96]
14001ef0cmov rcx, rbx
14001ef0fmov rdx, [rsp+88]
14001ef14call SysInvoke
14001ef19jmp 0x14001ef24
14001ef1b
14001ef1bloc_14001ef1b:
14001ef1bmov rcx, rbx
14001ef1ecall [rax+660]
14001ef24
14001ef24loc_14001ef24:
14001ef24mov [rsp+32], eax
14001ef28lea r9, [rip+41908]
14001ef2fmov ebx, eax
14001ef31mov r8l, 299
14001ef37lea rdx, [rip+56322]
14001ef3elea rcx, [rip+41499]
14001ef45call printf.constprop.0
14001ef4aadd rsp, 64
14001ef4emov eax, ebx
14001ef50pop rbx
14001ef51ret
14001eea0

14001ef52
14001ef52 // align 0x10

14001ef60
14001ef60SysNtGetContextThread:
14001ef60push rbx
14001ef61xor eax, eax
14001ef63mov rbx, rcx
14001ef66sub rsp, 64
14001ef6amov [rsp+48], rax
14001ef6fmov [rsp+56], rax
14001ef74mov rax, [rip+54261]
14001ef7bcmp [rax+218], 0
14001ef82je 0x14001efc7
14001ef84mov rcx, [rax+2028]
14001ef8btest rcx, rcx
14001ef8eje 0x14001efc7
14001ef90mov r8w, [rax+2064]
14001ef98test r8w, r8w
14001ef9cje 0x14001efc7
14001ef9emov [rsp+48], rcx
14001efa3lea rcx, [rsp+48]
14001efa8mov [rsp+88], rdx
14001efadmov [rsp+56], r8w
14001efb3call SysSetConfig
14001efb8mov rdx, [rsp+88]
14001efbdmov rcx, rbx
14001efc0call SysInvoke
14001efc5jmp 0x14001efd0
14001efc7
14001efc7loc_14001efc7:
14001efc7mov rcx, rbx
14001efcacall [rax+588]
14001efd0
14001efd0loc_14001efd0:
14001efd0mov [rsp+32], eax
14001efd4lea r9, [rip+41580]
14001efdbmov ebx, eax
14001efddmov r8l, 200
14001efe3lea rdx, [rip+56918]
14001efealea rcx, [rip+41327]
14001eff1call printf.constprop.0
14001eff6add rsp, 64
14001effamov eax, ebx
14001effcpop rbx
14001effdret
14001ef60

14001effe
14001effe // align 0x10

14001f000
14001f000SysNtGetNextThread:
14001f000push rdi
14001f001xor eax, eax
14001f003push rsi
14001f004push rbx
14001f005mov rbx, rcx
14001f008sub rsp, 64
14001f00cmov [rsp+48], rax
14001f011mov esi, [rsp+128]
14001f018mov [rsp+56], rax
14001f01dmov rax, [rip+54092]
14001f024mov rdi, [rsp+136]
14001f02ccmp [rax+218], 0
14001f033je 0x14001f095
14001f035mov rcx, [rax+2028]
14001f03ctest rcx, rcx
14001f03fje 0x14001f095
14001f041mov r10w, [rax+2108]
14001f049test r10w, r10w
14001f04dje 0x14001f095
14001f04fmov [rsp+48], rcx
14001f054lea rcx, [rsp+48]
14001f059mov [rsp+120], r9l
14001f05emov [rsp+112], r8l
14001f063mov [rsp+104], rdx
14001f068mov [rsp+56], r10w
14001f06ecall SysSetConfig
14001f073mov [rsp+40], rdi
14001f078mov r9l, [rsp+120]
14001f07dmov rcx, rbx
14001f080mov r8l, [rsp+112]
14001f085mov rdx, [rsp+104]
14001f08amov [rsp+32], esi
14001f08ecall SysInvoke
14001f093jmp 0x14001f0a7
14001f095
14001f095loc_14001f095:
14001f095mov [rsp+40], rdi
14001f09amov rcx, rbx
14001f09dmov [rsp+32], esi
14001f0a1call [rax+484]
14001f0a7
14001f0a7loc_14001f0a7:
14001f0a7mov [rsp+32], eax
14001f0ablea r9, [rip+41819]
14001f0b2mov ebx, eax
14001f0b4mov r8l, 497
14001f0balea rdx, [rip+54735]
14001f0c1lea rcx, [rip+41112]
14001f0c8call printf.constprop.0
14001f0cdadd rsp, 64
14001f0d1mov eax, ebx
14001f0d3pop rbx
14001f0d4pop rsi
14001f0d5pop rdi
14001f0d6ret
14001f000

14001f0d7
14001f0d7 // align 0x10

14001f0e0
14001f0e0SysNtOpenProcess:
14001f0e0push rbx
14001f0e1xor eax, eax
14001f0e3mov rbx, rcx
14001f0e6sub rsp, 64
14001f0eamov [rsp+48], rax
14001f0efmov [rsp+56], rax
14001f0f4mov rax, [rip+53877]
14001f0fbcmp [rax+218], 0
14001f102je 0x14001f159
14001f104mov rcx, [rax+2028]
14001f10btest rcx, rcx
14001f10eje 0x14001f159
14001f110mov r10w, [rax+2046]
14001f118test r10w, r10w
14001f11cje 0x14001f159
14001f11emov [rsp+48], rcx
14001f123lea rcx, [rsp+48]
14001f128mov [rsp+104], r9
14001f12dmov [rsp+96], r8
14001f132mov [rsp+88], edx
14001f136mov [rsp+56], r10w
14001f13ccall SysSetConfig
14001f141mov r9, [rsp+104]
14001f146mov r8, [rsp+96]
14001f14bmov rcx, rbx
14001f14emov edx, [rsp+88]
14001f152call SysInvoke
14001f157jmp 0x14001f162
14001f159
14001f159loc_14001f159:
14001f159mov rcx, rbx
14001f15ccall [rax+516]
14001f162
14001f162loc_14001f162:
14001f162mov [rsp+32], eax
14001f166lea r9, [rip+40994]
14001f16dmov ebx, eax
14001f16fmov r8l, 29
14001f175lea rdx, [rip+57172]
14001f17clea rcx, [rip+40925]
14001f183call printf.constprop.0
14001f188add rsp, 64
14001f18cmov eax, ebx
14001f18epop rbx
14001f18fret
14001f0e0

14001f190
14001f190SysNtOpenProcessToken:
14001f190push rbx
14001f191xor eax, eax
14001f193mov rbx, rcx
14001f196sub rsp, 64
14001f19amov [rsp+48], rax
14001f19fmov [rsp+56], rax
14001f1a4mov rax, [rip+53701]
14001f1abcmp [rax+218], 0
14001f1b2je 0x14001f1ff
14001f1b4mov rcx, [rax+2028]
14001f1bbtest rcx, rcx
14001f1beje 0x14001f1ff
14001f1c0mov r9w, [rax+2048]
14001f1c8test r9w, r9w
14001f1ccje 0x14001f1ff
14001f1cemov [rsp+48], rcx
14001f1d3lea rcx, [rsp+48]
14001f1d8mov [rsp+96], r8
14001f1ddmov [rsp+88], edx
14001f1e1mov [rsp+56], r9w
14001f1e7call SysSetConfig
14001f1ecmov r8, [rsp+96]
14001f1f1mov edx, [rsp+88]
14001f1f5mov rcx, rbx
14001f1f8call SysInvoke
14001f1fdjmp 0x14001f208
14001f1ff
14001f1ffloc_14001f1ff:
14001f1ffmov rcx, rbx
14001f202call [rax+524]
14001f208
14001f208loc_14001f208:
14001f208mov [rsp+32], eax
14001f20clea r9, [rip+40879]
14001f213mov ebx, eax
14001f215mov r8l, 68
14001f21blea rdx, [rip+56638]
14001f222lea rcx, [rip+40759]
14001f229call printf.constprop.0
14001f22eadd rsp, 64
14001f232mov eax, ebx
14001f234pop rbx
14001f235ret
14001f190

14001f236
14001f236 // align 0x10

14001f240
14001f240SysNtOpenThread:
14001f240push rbx
14001f241xor eax, eax
14001f243mov rbx, rcx
14001f246sub rsp, 64
14001f24amov [rsp+48], rax
14001f24fmov [rsp+56], rax
14001f254mov rax, [rip+53525]
14001f25bcmp [rax+218], 0
14001f262je 0x14001f2b9
14001f264mov rcx, [rax+2028]
14001f26btest rcx, rcx
14001f26eje 0x14001f2b9
14001f270mov r10w, [rax+2040]
14001f278test r10w, r10w
14001f27cje 0x14001f2b9
14001f27emov [rsp+48], rcx
14001f283lea rcx, [rsp+48]
14001f288mov [rsp+104], r9
14001f28dmov [rsp+96], r8
14001f292mov [rsp+88], edx
14001f296mov [rsp+56], r10w
14001f29ccall SysSetConfig
14001f2a1mov r9, [rsp+104]
14001f2a6mov r8, [rsp+96]
14001f2abmov rcx, rbx
14001f2aemov edx, [rsp+88]
14001f2b2call SysInvoke
14001f2b7jmp 0x14001f2c2
14001f2b9
14001f2b9loc_14001f2b9:
14001f2b9mov rcx, rbx
14001f2bccall [rax+492]
14001f2c2
14001f2c2loc_14001f2c2:
14001f2c2mov [rsp+32], eax
14001f2c6lea r9, [rip+40629]
14001f2cdmov ebx, eax
14001f2cfmov r8l, 15
14001f2d5lea rdx, [rip+56852]
14001f2dclea rcx, [rip+40573]
14001f2e3call printf.constprop.0
14001f2e8add rsp, 64
14001f2ecmov eax, ebx
14001f2eepop rbx
14001f2efret
14001f240

14001f2f0
14001f2f0SysNtOpenThreadToken:
14001f2f0push rbx
14001f2f1xor eax, eax
14001f2f3mov rbx, rcx
14001f2f6movzx r8l, r8b
14001f2fasub rsp, 80
14001f2femov [rsp+64], rax
14001f303mov [rsp+72], rax
14001f308mov rax, [rip+53345]
14001f30fcmp [rax+218], 0
14001f316je 0x14001f36d
14001f318mov rcx, [rax+2028]
14001f31ftest rcx, rcx
14001f322je 0x14001f36d
14001f324mov r10w, [rax+2042]
14001f32ctest r10w, r10w
14001f330je 0x14001f36d
14001f332mov [rsp+64], rcx
14001f337lea rcx, [rsp+64]
14001f33cmov [rsp+120], r9
14001f341mov [rsp+104], edx
14001f345mov [rsp+60], r8l
14001f34amov [rsp+72], r10w
14001f350call SysSetConfig
14001f355mov r9, [rsp+120]
14001f35amov r8l, [rsp+60]
14001f35fmov rcx, rbx
14001f362mov edx, [rsp+104]
14001f366call SysInvoke
14001f36bjmp 0x14001f376
14001f36d
14001f36dloc_14001f36d:
14001f36dmov rcx, rbx
14001f370call [rax+500]
14001f376
14001f376loc_14001f376:
14001f376mov [rsp+32], eax
14001f37alea r9, [rip+40495]
14001f381mov ebx, eax
14001f383mov r8l, 55
14001f389lea rdx, [rip+56576]
14001f390lea rcx, [rip+40393]
14001f397call printf.constprop.0
14001f39cadd rsp, 80
14001f3a0mov eax, ebx
14001f3a2pop rbx
14001f3a3ret
14001f2f0

14001f3a4
14001f3a4 // align 0x10

14001f3b0
14001f3b0SysNtProtectVirtualMemory:
14001f3b0push rsi
14001f3b1xor eax, eax
14001f3b3push rbx
14001f3b4mov rbx, rcx
14001f3b7sub rsp, 72
14001f3bbmov [rsp+48], rax
14001f3c0mov rsi, [rsp+128]
14001f3c8mov [rsp+56], rax
14001f3cdmov rax, [rip+53148]
14001f3d4cmp [rax+218], 0
14001f3dbje 0x14001f439
14001f3ddmov rcx, [rax+2028]
14001f3e4test rcx, rcx
14001f3e7je 0x14001f439
14001f3e9mov r10w, [rax+2084]
14001f3f1test r10w, r10w
14001f3f5je 0x14001f439
14001f3f7mov [rsp+48], rcx
14001f3fclea rcx, [rsp+48]
14001f401mov [rsp+120], r9l
14001f406mov [rsp+112], r8
14001f40bmov [rsp+104], rdx
14001f410mov [rsp+56], r10w
14001f416call SysSetConfig
14001f41bmov [rsp+32], rsi
14001f420mov r9l, [rsp+120]
14001f425mov rcx, rbx
14001f428mov r8, [rsp+112]
14001f42dmov rdx, [rsp+104]
14001f432call SysInvoke
14001f437jmp 0x14001f447
14001f439
14001f439loc_14001f439:
14001f439mov [rsp+32], rsi
14001f43emov rcx, rbx
14001f441call [rax+676]
14001f447
14001f447loc_14001f447:
14001f447mov [rsp+32], eax
14001f44blea r9, [rip+40634]
14001f452mov ebx, eax
14001f454mov r8l, 326
14001f45alea rdx, [rip+54831]
14001f461lea rcx, [rip+40184]
14001f468call printf.constprop.0
14001f46dadd rsp, 72
14001f471mov eax, ebx
14001f473pop rbx
14001f474pop rsi
14001f475ret
14001f3b0

14001f476
14001f476 // align 0x10

14001f480
14001f480SysNtQueryInformationProcess:
14001f480push rsi
14001f481xor eax, eax
14001f483push rbx
14001f484mov rbx, rcx
14001f487sub rsp, 72
14001f48bmov [rsp+48], rax
14001f490mov rsi, [rsp+128]
14001f498mov [rsp+56], rax
14001f49dmov rax, [rip+52940]
14001f4a4cmp [rax+218], 0
14001f4abje 0x14001f507
14001f4admov rcx, [rax+2028]
14001f4b4test rcx, rcx
14001f4b7je 0x14001f507
14001f4b9mov r10w, [rax+2068]
14001f4c1test r10w, r10w
14001f4c5je 0x14001f507
14001f4c7mov [rsp+48], rcx
14001f4cclea rcx, [rsp+48]
14001f4d1mov [rsp+120], r9l
14001f4d6mov [rsp+112], r8
14001f4dbmov [rsp+104], edx
14001f4dfmov [rsp+56], r10w
14001f4e5call SysSetConfig
14001f4eamov [rsp+32], rsi
14001f4efmov edx, [rsp+104]
14001f4f3mov rcx, rbx
14001f4f6mov r9l, [rsp+120]
14001f4fbmov r8, [rsp+112]
14001f500call SysInvoke
14001f505jmp 0x14001f515
14001f507
14001f507loc_14001f507:
14001f507mov [rsp+32], rsi
14001f50cmov rcx, rbx
14001f50fcall [rax+604]
14001f515
14001f515loc_14001f515:
14001f515mov [rsp+32], eax
14001f519lea r9, [rip+40269]
14001f520mov ebx, eax
14001f522mov r8l, 227
14001f528lea rdx, [rip+55057]
14001f52flea rcx, [rip+39978]
14001f536call printf.constprop.0
14001f53badd rsp, 72
14001f53fmov eax, ebx
14001f541pop rbx
14001f542pop rsi
14001f543ret
14001f480

14001f544
14001f544 // align 0x10

14001f550
14001f550SysNtQueryInformationThread:
14001f550push rsi
14001f551xor eax, eax
14001f553push rbx
14001f554mov rbx, rcx
14001f557sub rsp, 72
14001f55bmov [rsp+48], rax
14001f560mov rsi, [rsp+128]
14001f568mov [rsp+56], rax
14001f56dmov rax, [rip+52732]
14001f574cmp [rax+218], 0
14001f57bje 0x14001f5d7
14001f57dmov rcx, [rax+2028]
14001f584test rcx, rcx
14001f587je 0x14001f5d7
14001f589mov r10w, [rax+2096]
14001f591test r10w, r10w
14001f595je 0x14001f5d7
14001f597mov [rsp+48], rcx
14001f59clea rcx, [rsp+48]
14001f5a1mov [rsp+120], r9l
14001f5a6mov [rsp+112], r8
14001f5abmov [rsp+104], edx
14001f5afmov [rsp+56], r10w
14001f5b5call SysSetConfig
14001f5bamov [rsp+32], rsi
14001f5bfmov edx, [rsp+104]
14001f5c3mov rcx, rbx
14001f5c6mov r9l, [rsp+120]
14001f5cbmov r8, [rsp+112]
14001f5d0call SysInvoke
14001f5d5jmp 0x14001f5e5
14001f5d7
14001f5d7loc_14001f5d7:
14001f5d7mov [rsp+32], rsi
14001f5dcmov rcx, rbx
14001f5dfcall [rax+732]
14001f5e5
14001f5e5loc_14001f5e5:
14001f5e5mov [rsp+32], eax
14001f5e9lea r9, [rip+40377]
14001f5f0mov ebx, eax
14001f5f2mov r8l, 425
14001f5f8lea rdx, [rip+56385]
14001f5fflea rcx, [rip+39770]
14001f606call printf.constprop.0
14001f60badd rsp, 72
14001f60fmov eax, ebx
14001f611pop rbx
14001f612pop rsi
14001f613ret
14001f550

14001f614
14001f614 // align 0x10

14001f620
14001f620SysNtQueryInformationToken:
14001f620push rsi
14001f621xor eax, eax
14001f623push rbx
14001f624mov rbx, rcx
14001f627sub rsp, 72
14001f62bmov [rsp+48], rax
14001f630mov rsi, [rsp+128]
14001f638mov [rsp+56], rax
14001f63dmov rax, [rip+52524]
14001f644cmp [rax+218], 0
14001f64bje 0x14001f6a7
14001f64dmov rcx, [rax+2028]
14001f654test rcx, rcx
14001f657je 0x14001f6a7
14001f659mov r10w, [rax+2094]
14001f661test r10w, r10w
14001f665je 0x14001f6a7
14001f667mov [rsp+48], rcx
14001f66clea rcx, [rsp+48]
14001f671mov [rsp+120], r9l
14001f676mov [rsp+112], r8
14001f67bmov [rsp+104], edx
14001f67fmov [rsp+56], r10w
14001f685call SysSetConfig
14001f68amov [rsp+32], rsi
14001f68fmov edx, [rsp+104]
14001f693mov rcx, rbx
14001f696mov r9l, [rsp+120]
14001f69bmov r8, [rsp+112]
14001f6a0call SysInvoke
14001f6a5jmp 0x14001f6b5
14001f6a7
14001f6a7loc_14001f6a7:
14001f6a7mov [rsp+32], rsi
14001f6acmov rcx, rbx
14001f6afcall [rax+724]
14001f6b5
14001f6b5loc_14001f6b5:
14001f6b5mov [rsp+32], eax
14001f6b9lea r9, [rip+40145]
14001f6c0mov ebx, eax
14001f6c2mov r8l, 410
14001f6c8lea rdx, [rip+56337]
14001f6cflea rcx, [rip+39562]
14001f6d6call printf.constprop.0
14001f6dbadd rsp, 72
14001f6dfmov eax, ebx
14001f6e1pop rbx
14001f6e2pop rsi
14001f6e3ret
14001f620

14001f6e4
14001f6e4 // align 0x10

14001f6f0
14001f6f0SysNtQueryObject:
14001f6f0push rsi
14001f6f1xor eax, eax
14001f6f3push rbx
14001f6f4mov rbx, rcx
14001f6f7sub rsp, 72
14001f6fbmov [rsp+48], rax
14001f700mov rsi, [rsp+128]
14001f708mov [rsp+56], rax
14001f70dmov rax, [rip+52316]
14001f714cmp [rax+218], 0
14001f71bje 0x14001f777
14001f71dmov rcx, [rax+2028]
14001f724test rcx, rcx
14001f727je 0x14001f777
14001f729mov r10w, [rax+2098]
14001f731test r10w, r10w
14001f735je 0x14001f777
14001f737mov [rsp+48], rcx
14001f73clea rcx, [rsp+48]
14001f741mov [rsp+120], r9l
14001f746mov [rsp+112], r8
14001f74bmov [rsp+104], edx
14001f74fmov [rsp+56], r10w
14001f755call SysSetConfig
14001f75amov [rsp+32], rsi
14001f75fmov edx, [rsp+104]
14001f763mov rcx, rbx
14001f766mov r9l, [rsp+120]
14001f76bmov r8, [rsp+112]
14001f770call SysInvoke
14001f775jmp 0x14001f785
14001f777
14001f777loc_14001f777:
14001f777mov [rsp+32], rsi
14001f77cmov rcx, rbx
14001f77fcall [rax+740]
14001f785
14001f785loc_14001f785:
14001f785mov [rsp+32], eax
14001f789lea r9, [rip+39986]
14001f790mov ebx, eax
14001f792mov r8l, 440
14001f798lea rdx, [rip+55761]
14001f79flea rcx, [rip+39354]
14001f7a6call printf.constprop.0
14001f7abadd rsp, 72
14001f7afmov eax, ebx
14001f7b1pop rbx
14001f7b2pop rsi
14001f7b3ret
14001f6f0

14001f7b4
14001f7b4 // align 0x10

14001f7c0
14001f7c0SysNtQuerySystemInformation:
14001f7c0push rbx
14001f7c1xor eax, eax
14001f7c3mov ebx, ecx
14001f7c5sub rsp, 64
14001f7c9mov [rsp+48], rax
14001f7cemov [rsp+56], rax
14001f7d3mov rax, [rip+52118]
14001f7dacmp [rax+218], 0
14001f7e1je 0x14001f839
14001f7e3mov rcx, [rax+2028]
14001f7eatest rcx, rcx
14001f7edje 0x14001f839
14001f7efmov r10w, [rax+2070]
14001f7f7test r10w, r10w
14001f7fbje 0x14001f839
14001f7fdmov [rsp+48], rcx
14001f802lea rcx, [rsp+48]
14001f807mov [rsp+104], r9
14001f80cmov [rsp+96], r8l
14001f811mov [rsp+88], rdx
14001f816mov [rsp+56], r10w
14001f81ccall SysSetConfig
14001f821mov r9, [rsp+104]
14001f826mov r8l, [rsp+96]
14001f82bmov ecx, ebx
14001f82dmov rdx, [rsp+88]
14001f832call SysInvoke
14001f837jmp 0x14001f841
14001f839
14001f839loc_14001f839:
14001f839mov ecx, ebx
14001f83bcall [rax+612]
14001f841
14001f841loc_14001f841:
14001f841mov [rsp+32], eax
14001f845lea r9, [rip+39483]
14001f84cmov ebx, eax
14001f84emov r8l, 241
14001f854lea rdx, [rip+54197]
14001f85blea rcx, [rip+39166]
14001f862call printf.constprop.0
14001f867add rsp, 64
14001f86bmov eax, ebx
14001f86dpop rbx
14001f86eret
14001f7c0

14001f86f
14001f86f // align 0x10

14001f870
14001f870SysNtQueryVirtualMemory:
14001f870push rdi
14001f871xor eax, eax
14001f873push rsi
14001f874push rbx
14001f875mov rbx, rcx
14001f878sub rsp, 64
14001f87cmov [rsp+48], rax
14001f881mov rsi, [rsp+128]
14001f889mov [rsp+56], rax
14001f88emov rax, [rip+51931]
14001f895mov rdi, [rsp+136]
14001f89dcmp [rax+218], 0
14001f8a4je 0x14001f907
14001f8a6mov rcx, [rax+2028]
14001f8adtest rcx, rcx
14001f8b0je 0x14001f907
14001f8b2mov r10w, [rax+2092]
14001f8batest r10w, r10w
14001f8beje 0x14001f907
14001f8c0mov [rsp+48], rcx
14001f8c5lea rcx, [rsp+48]
14001f8camov [rsp+120], r9
14001f8cfmov [rsp+112], r8l
14001f8d4mov [rsp+104], rdx
14001f8d9mov [rsp+56], r10w
14001f8dfcall SysSetConfig
14001f8e4mov [rsp+40], rdi
14001f8e9mov r9, [rsp+120]
14001f8eemov rcx, rbx
14001f8f1mov r8l, [rsp+112]
14001f8f6mov rdx, [rsp+104]
14001f8fbmov [rsp+32], rsi
14001f900call SysInvoke
14001f905jmp 0x14001f91a
14001f907
14001f907loc_14001f907:
14001f907mov [rsp+40], rdi
14001f90cmov rcx, rbx
14001f90fmov [rsp+32], rsi
14001f914call [rax+716]
14001f91a
14001f91aloc_14001f91a:
14001f91amov [rsp+32], eax
14001f91elea r9, [rip+39511]
14001f925mov ebx, eax
14001f927mov r8l, 395
14001f92dlea rdx, [rip+55852]
14001f934lea rcx, [rip+38949]
14001f93bcall printf.constprop.0
14001f940add rsp, 64
14001f944mov eax, ebx
14001f946pop rbx
14001f947pop rsi
14001f948pop rdi
14001f949ret
14001f870

14001f94a
14001f94a // align 0x10

14001f950
14001f950SysNtQueueApcThread:
14001f950push rsi
14001f951xor eax, eax
14001f953push rbx
14001f954mov rbx, rcx
14001f957sub rsp, 72
14001f95bmov [rsp+48], rax
14001f960mov rsi, [rsp+128]
14001f968mov [rsp+56], rax
14001f96dmov rax, [rip+51708]
14001f974cmp [rax+218], 0
14001f97bje 0x14001f9d9
14001f97dmov rcx, [rax+2028]
14001f984test rcx, rcx
14001f987je 0x14001f9d9
14001f989mov r10w, [rax+2052]
14001f991test r10w, r10w
14001f995je 0x14001f9d9
14001f997mov [rsp+48], rcx
14001f99clea rcx, [rsp+48]
14001f9a1mov [rsp+120], r9
14001f9a6mov [rsp+112], r8
14001f9abmov [rsp+104], rdx
14001f9b0mov [rsp+56], r10w
14001f9b6call SysSetConfig
14001f9bbmov [rsp+32], rsi
14001f9c0mov r9, [rsp+120]
14001f9c5mov rcx, rbx
14001f9c8mov r8, [rsp+112]
14001f9cdmov rdx, [rsp+104]
14001f9d2call SysInvoke
14001f9d7jmp 0x14001f9e7
14001f9d9
14001f9d9loc_14001f9d9:
14001f9d9mov [rsp+32], rsi
14001f9demov rcx, rbx
14001f9e1call [rax+540]
14001f9e7
14001f9e7loc_14001f9e7:
14001f9e7mov [rsp+32], eax
14001f9eblea r9, [rip+38900]
14001f9f2mov ebx, eax
14001f9f4mov r8l, 99
14001f9falea rdx, [rip+54559]
14001fa01lea rcx, [rip+38744]
14001fa08call printf.constprop.0
14001fa0dadd rsp, 72
14001fa11mov eax, ebx
14001fa13pop rbx
14001fa14pop rsi
14001fa15ret
14001f950

14001fa16
14001fa16 // align 0x10

14001fa20
14001fa20SysNtReadVirtualMemory:
14001fa20push rsi
14001fa21xor eax, eax
14001fa23push rbx
14001fa24mov rbx, rcx
14001fa27sub rsp, 72
14001fa2bmov [rsp+48], rax
14001fa30mov rsi, [rsp+128]
14001fa38mov [rsp+56], rax
14001fa3dmov rax, [rip+51500]
14001fa44cmp [rax+218], 0
14001fa4bje 0x14001faa9
14001fa4dmov rcx, [rax+2028]
14001fa54test rcx, rcx
14001fa57je 0x14001faa9
14001fa59mov r10w, [rax+2078]
14001fa61test r10w, r10w
14001fa65je 0x14001faa9
14001fa67mov [rsp+48], rcx
14001fa6clea rcx, [rsp+48]
14001fa71mov [rsp+120], r9
14001fa76mov [rsp+112], r8
14001fa7bmov [rsp+104], rdx
14001fa80mov [rsp+56], r10w
14001fa86call SysSetConfig
14001fa8bmov [rsp+32], rsi
14001fa90mov r9, [rsp+120]
14001fa95mov rcx, rbx
14001fa98mov r8, [rsp+112]
14001fa9dmov rdx, [rsp+104]
14001faa2call SysInvoke
14001faa7jmp 0x14001fab7
14001faa9
14001faa9loc_14001faa9:
14001faa9mov [rsp+32], rsi
14001faaemov rcx, rbx
14001fab1call [rax+652]
14001fab7
14001fab7loc_14001fab7:
14001fab7mov [rsp+32], eax
14001fabblea r9, [rip+39009]
14001fac2mov ebx, eax
14001fac4mov r8l, 341
14001facalea rdx, [rip+53087]
14001fad1lea rcx, [rip+38536]
14001fad8call printf.constprop.0
14001faddadd rsp, 72
14001fae1mov eax, ebx
14001fae3pop rbx
14001fae4pop rsi
14001fae5ret
14001fa20

14001fae6
14001fae6 // align 0x10

14001faf0
14001faf0SysNtResumeThread:
14001faf0push rbx
14001faf1xor eax, eax
14001faf3mov rbx, rcx
14001faf6sub rsp, 64
14001fafamov [rsp+48], rax
14001faffmov [rsp+56], rax
14001fb04mov rax, [rip+51301]
14001fb0bcmp [rax+218], 0
14001fb12je 0x14001fb57
14001fb14mov rcx, [rax+2028]
14001fb1btest rcx, rcx
14001fb1eje 0x14001fb57
14001fb20mov r8w, [rax+2056]
14001fb28test r8w, r8w
14001fb2cje 0x14001fb57
14001fb2emov [rsp+48], rcx
14001fb33lea rcx, [rsp+48]
14001fb38mov [rsp+88], rdx
14001fb3dmov [rsp+56], r8w
14001fb43call SysSetConfig
14001fb48mov rdx, [rsp+88]
14001fb4dmov rcx, rbx
14001fb50call SysInvoke
14001fb55jmp 0x14001fb60
14001fb57
14001fb57loc_14001fb57:
14001fb57mov rcx, rbx
14001fb5acall [rax+556]
14001fb60
14001fb60loc_14001fb60:
14001fb60mov [rsp+32], eax
14001fb64lea r9, [rip+38556]
14001fb6bmov ebx, eax
14001fb6dmov r8l, 123
14001fb73lea rdx, [rip+54118]
14001fb7alea rcx, [rip+38367]
14001fb81call printf.constprop.0
14001fb86add rsp, 64
14001fb8amov eax, ebx
14001fb8cpop rbx
14001fb8dret
14001faf0

14001fb8e
14001fb8e // align 0x10

14001fb90
14001fb90SysNtSetContextThread:
14001fb90push rbx
14001fb91xor eax, eax
14001fb93mov rbx, rcx
14001fb96sub rsp, 64
14001fb9amov [rsp+48], rax
14001fb9fmov [rsp+56], rax
14001fba4mov rax, [rip+51141]
14001fbabcmp [rax+218], 0
14001fbb2je 0x14001fbf7
14001fbb4mov rcx, [rax+2028]
14001fbbbtest rcx, rcx
14001fbbeje 0x14001fbf7
14001fbc0mov r8w, [rax+2066]
14001fbc8test r8w, r8w
14001fbccje 0x14001fbf7
14001fbcemov [rsp+48], rcx
14001fbd3lea rcx, [rsp+48]
14001fbd8mov [rsp+88], rdx
14001fbddmov [rsp+56], r8w
14001fbe3call SysSetConfig
14001fbe8mov rdx, [rsp+88]
14001fbedmov rcx, rbx
14001fbf0call SysInvoke
14001fbf5jmp 0x14001fc00
14001fbf7
14001fbf7loc_14001fbf7:
14001fbf7mov rcx, rbx
14001fbfacall [rax+596]
14001fc00
14001fc00loc_14001fc00:
14001fc00mov [rsp+32], eax
14001fc04lea r9, [rip+38479]
14001fc0bmov ebx, eax
14001fc0dmov r8l, 212
14001fc13lea rdx, [rip+53750]
14001fc1alea rcx, [rip+38207]
14001fc21call printf.constprop.0
14001fc26add rsp, 64
14001fc2amov eax, ebx
14001fc2cpop rbx
14001fc2dret
14001fb90

14001fc2e
14001fc2e // align 0x10

14001fc30
14001fc30SysNtSetInformationThread:
14001fc30push rbx
14001fc31xor eax, eax
14001fc33mov rbx, rcx
14001fc36sub rsp, 64
14001fc3amov [rsp+48], rax
14001fc3fmov [rsp+56], rax
14001fc44mov rax, [rip+50981]
14001fc4bcmp [rax+218], 0
14001fc52je 0x14001fca9
14001fc54mov rcx, [rax+2028]
14001fc5btest rcx, rcx
14001fc5eje 0x14001fca9
14001fc60mov r10w, [rax+2104]
14001fc68test r10w, r10w
14001fc6cje 0x14001fca9
14001fc6emov [rsp+48], rcx
14001fc73lea rcx, [rsp+48]
14001fc78mov [rsp+104], r9l
14001fc7dmov [rsp+96], r8
14001fc82mov [rsp+88], edx
14001fc86mov [rsp+56], r10w
14001fc8ccall SysSetConfig
14001fc91mov r9l, [rsp+104]
14001fc96mov r8, [rsp+96]
14001fc9bmov rcx, rbx
14001fc9emov edx, [rsp+88]
14001fca2call SysInvoke
14001fca7jmp 0x14001fcb2
14001fca9
14001fca9loc_14001fca9:
14001fca9mov rcx, rbx
14001fcaccall [rax+468]
14001fcb2
14001fcb2loc_14001fcb2:
14001fcb2mov [rsp+32], eax
14001fcb6lea r9, [rip+38683]
14001fcbdmov ebx, eax
14001fcbfmov r8l, 465
14001fcc5lea rdx, [rip+53316]
14001fccclea rcx, [rip+38029]
14001fcd3call printf.constprop.0
14001fcd8add rsp, 64
14001fcdcmov eax, ebx
14001fcdepop rbx
14001fcdfret
14001fc30

14001fce0
14001fce0SysNtSetInformationVirtualMemory:
14001fce0push rdi
14001fce1xor eax, eax
14001fce3push rsi
14001fce4push rbx
14001fce5mov rbx, rcx
14001fce8sub rsp, 64
14001fcecmov [rsp+48], rax
14001fcf1mov rsi, [rsp+128]
14001fcf9mov [rsp+56], rax
14001fcfemov rax, [rip+50795]
14001fd05mov edi, [rsp+136]
14001fd0ccmp [rax+218], 0
14001fd13je 0x14001fd73
14001fd15mov rcx, [rax+2028]
14001fd1ctest rcx, rcx
14001fd1fje 0x14001fd73
14001fd21mov r10w, [rax+2106]
14001fd29test r10w, r10w
14001fd2dje 0x14001fd73
14001fd2fmov [rsp+48], rcx
14001fd34lea rcx, [rsp+48]
14001fd39mov [rsp+120], r9
14001fd3emov [rsp+112], r8
14001fd43mov [rsp+104], edx
14001fd47mov [rsp+56], r10w
14001fd4dcall SysSetConfig
14001fd52mov [rsp+40], edi
14001fd56mov edx, [rsp+104]
14001fd5amov rcx, rbx
14001fd5dmov r9, [rsp+120]
14001fd62mov r8, [rsp+112]
14001fd67mov [rsp+32], rsi
14001fd6ccall SysInvoke
14001fd71jmp 0x14001fd85
14001fd73
14001fd73loc_14001fd73:
14001fd73mov [rsp+40], edi
14001fd77mov rcx, rbx
14001fd7amov [rsp+32], rsi
14001fd7fcall [rax+476]
14001fd85
14001fd85loc_14001fd85:
14001fd85mov [rsp+32], eax
14001fd89lea r9, [rip+38495]
14001fd90mov ebx, eax
14001fd92mov r8l, 481
14001fd98lea rdx, [rip+51969]
14001fd9flea rcx, [rip+37818]
14001fda6call printf.constprop.0
14001fdabadd rsp, 64
14001fdafmov eax, ebx
14001fdb1pop rbx
14001fdb2pop rsi
14001fdb3pop rdi
14001fdb4ret
14001fce0

14001fdb5
14001fdb5 // align 0x10

14001fdc0
14001fdc0SysNtSignalAndWaitForSingleObject:
14001fdc0push rbx
14001fdc1xor eax, eax
14001fdc3mov rbx, rcx
14001fdc6movzx r8l, r8b
14001fdcasub rsp, 80
14001fdcemov [rsp+64], rax
14001fdd3mov [rsp+72], rax
14001fdd8mov rax, [rip+50577]
14001fddfcmp [rax+218], 0
14001fde6je 0x14001fe3f
14001fde8mov rcx, [rax+2028]
14001fdeftest rcx, rcx
14001fdf2je 0x14001fe3f
14001fdf4mov r10w, [rax+2090]
14001fdfctest r10w, r10w
14001fe00je 0x14001fe3f
14001fe02mov [rsp+64], rcx
14001fe07lea rcx, [rsp+64]
14001fe0cmov [rsp+120], r9
14001fe11mov [rsp+104], rdx
14001fe16mov [rsp+60], r8l
14001fe1bmov [rsp+72], r10w
14001fe21call SysSetConfig
14001fe26mov r9, [rsp+120]
14001fe2bmov r8l, [rsp+60]
14001fe30mov rcx, rbx
14001fe33mov rdx, [rsp+104]
14001fe38call SysInvoke
14001fe3djmp 0x14001fe48
14001fe3f
14001fe3floc_14001fe3f:
14001fe3fmov rcx, rbx
14001fe42call [rax+708]
14001fe48
14001fe48loc_14001fe48:
14001fe48mov [rsp+32], eax
14001fe4clea r9, [rip+38154]
14001fe53mov ebx, eax
14001fe55mov r8l, 379
14001fe5blea rdx, [rip+54686]
14001fe62lea rcx, [rip+37623]
14001fe69call printf.constprop.0
14001fe6eadd rsp, 80
14001fe72mov eax, ebx
14001fe74pop rbx
14001fe75ret
14001fdc0

14001fe76
14001fe76 // align 0x10

14001fe80
14001fe80SysNtSuspendThread:
14001fe80push rbx
14001fe81xor eax, eax
14001fe83mov rbx, rcx
14001fe86sub rsp, 64
14001fe8amov [rsp+48], rax
14001fe8fmov [rsp+56], rax
14001fe94mov rax, [rip+50389]
14001fe9bcmp [rax+218], 0
14001fea2je 0x14001fee7
14001fea4mov rcx, [rax+2028]
14001feabtest rcx, rcx
14001feaeje 0x14001fee7
14001feb0mov r8w, [rax+2054]
14001feb8test r8w, r8w
14001febcje 0x14001fee7
14001febemov [rsp+48], rcx
14001fec3lea rcx, [rsp+48]
14001fec8mov [rsp+88], rdx
14001fecdmov [rsp+56], r8w
14001fed3call SysSetConfig
14001fed8mov rdx, [rsp+88]
14001feddmov rcx, rbx
14001fee0call SysInvoke
14001fee5jmp 0x14001fef0
14001fee7
14001fee7loc_14001fee7:
14001fee7mov rcx, rbx
14001feeacall [rax+548]
14001fef0
14001fef0loc_14001fef0:
14001fef0mov [rsp+32], eax
14001fef4lea r9, [rip+37628]
14001fefbmov ebx, eax
14001fefdmov r8l, 111
14001ff03lea rdx, [rip+53238]
14001ff0alea rcx, [rip+37455]
14001ff11call printf.constprop.0
14001ff16add rsp, 64
14001ff1amov eax, ebx
14001ff1cpop rbx
14001ff1dret
14001fe80

14001ff1e
14001ff1e // align 0x10

14001ff20
14001ff20SysNtTerminateProcess:
14001ff20push rbx
14001ff21xor eax, eax
14001ff23mov rbx, rcx
14001ff26sub rsp, 64
14001ff2amov [rsp+48], rax
14001ff2fmov [rsp+56], rax
14001ff34mov rax, [rip+50229]
14001ff3bcmp [rax+218], 0
14001ff42je 0x14001ff85
14001ff44mov rcx, [rax+2028]
14001ff4btest rcx, rcx
14001ff4eje 0x14001ff85
14001ff50mov r8w, [rax+2044]
14001ff58test r8w, r8w
14001ff5cje 0x14001ff85
14001ff5emov [rsp+48], rcx
14001ff63lea rcx, [rsp+48]
14001ff68mov [rsp+88], edx
14001ff6cmov [rsp+56], r8w
14001ff72call SysSetConfig
14001ff77mov edx, [rsp+88]
14001ff7bmov rcx, rbx
14001ff7ecall SysInvoke
14001ff83jmp 0x14001ff8e
14001ff85
14001ff85loc_14001ff85:
14001ff85mov rcx, rbx
14001ff88call [rax+508]
14001ff8e
14001ff8eloc_14001ff8e:
14001ff8emov [rsp+32], eax
14001ff92lea r9, [rip+37380]
14001ff99mov ebx, eax
14001ff9bmov r8l, 41
14001ffa1lea rdx, [rip+53512]
14001ffa8lea rcx, [rip+37297]
14001ffafcall printf.constprop.0
14001ffb4add rsp, 64
14001ffb8mov eax, ebx
14001ffbapop rbx
14001ffbbret
14001ff20

14001ffbc
14001ffbc // align 0x10

14001ffc0
14001ffc0SysNtTerminateThread:
14001ffc0push rbx
14001ffc1xor eax, eax
14001ffc3mov rbx, rcx
14001ffc6sub rsp, 64
14001ffcamov [rsp+48], rax
14001ffcfmov [rsp+56], rax
14001ffd4mov rax, [rip+50069]
14001ffdbcmp [rax+218], 0
14001ffe2je 0x140020025
14001ffe4mov rcx, [rax+2028]
14001ffebtest rcx, rcx
14001ffeeje 0x140020025
14001fff0mov r8w, [rax+2086]
14001fff8test r8w, r8w
14001fffcje 0x140020025
14001fffemov [rsp+48], rcx
140020003lea rcx, [rsp+48]
140020008mov [rsp+88], edx
14002000cmov [rsp+56], r8w
140020012call SysSetConfig
140020017mov edx, [rsp+88]
14002001bmov rcx, rbx
14002001ecall SysInvoke
140020023jmp 0x14002002e
140020025
140020025loc_140020025:
140020025mov rcx, rbx
140020028call [rax+684]
14002002e
14002002eloc_14002002e:
14002002emov [rsp+32], eax
140020032lea r9, [rip+37630]
140020039mov ebx, eax
14002003bmov r8l, 353
140020041lea rdx, [rip+51560]
140020048lea rcx, [rip+37137]
14002004fcall printf.constprop.0
140020054add rsp, 64
140020058mov eax, ebx
14002005apop rbx
14002005bret
14001ffc0

14002005c
14002005c // align 0x10

140020060
140020060SysNtUnmapViewOfSection:
140020060push rbx
140020061xor eax, eax
140020063mov rbx, rcx
140020066sub rsp, 64
14002006amov [rsp+48], rax
14002006fmov [rsp+56], rax
140020074mov rax, [rip+49909]
14002007bcmp [rax+218], 0
140020082je 0x1400200c7
140020084mov rcx, [rax+2028]
14002008btest rcx, rcx
14002008eje 0x1400200c7
140020090mov r8w, [rax+2082]
140020098test r8w, r8w
14002009cje 0x1400200c7
14002009emov [rsp+48], rcx
1400200a3lea rcx, [rsp+48]
1400200a8mov [rsp+88], rdx
1400200admov [rsp+56], r8w
1400200b3call SysSetConfig
1400200b8mov rdx, [rsp+88]
1400200bdmov rcx, rbx
1400200c0call SysInvoke
1400200c5jmp 0x1400200d0
1400200c7
1400200c7loc_1400200c7:
1400200c7mov rcx, rbx
1400200cacall [rax+668]
1400200d0
1400200d0loc_1400200d0:
1400200d0mov [rsp+32], eax
1400200d4lea r9, [rip+37404]
1400200dbmov ebx, eax
1400200ddmov r8l, 311
1400200e3lea rdx, [rip+51718]
1400200ealea rcx, [rip+36975]
1400200f1call printf.constprop.0
1400200f6add rsp, 64
1400200famov eax, ebx
1400200fcpop rbx
1400200fdret
140020060

1400200fe
1400200fe // align 0x10

140020100
140020100SysNtWaitForSingleObject:
140020100push rbx
140020101xor eax, eax
140020103mov rbx, rcx
140020106movzx edx, dl
140020109sub rsp, 80
14002010dmov [rsp+64], rax
140020112mov [rsp+72], rax
140020117mov rax, [rip+49746]
14002011ecmp [rax+218], 0
140020125je 0x140020172
140020127mov rcx, [rax+2028]
14002012etest rcx, rcx
140020131je 0x140020172
140020133mov r9w, [rax+2072]
14002013btest r9w, r9w
14002013fje 0x140020172
140020141mov [rsp+64], rcx
140020146lea rcx, [rsp+64]
14002014bmov [rsp+112], r8
140020150mov [rsp+60], edx
140020154mov [rsp+72], r9w
14002015acall SysSetConfig
14002015fmov r8, [rsp+112]
140020164mov edx, [rsp+60]
140020168mov rcx, rbx
14002016bcall SysInvoke
140020170jmp 0x14002017b
140020172
140020172loc_140020172:
140020172mov rcx, rbx
140020175call [rax+620]
14002017b
14002017bloc_14002017b:
14002017bmov [rsp+32], eax
14002017flea r9, [rip+37146]
140020186mov ebx, eax
140020188mov r8l, 254
14002018elea rdx, [rip+51787]
140020195lea rcx, [rip+36804]
14002019ccall printf.constprop.0
1400201a1add rsp, 80
1400201a5mov eax, ebx
1400201a7pop rbx
1400201a8ret
140020100

1400201a9
1400201a9 // align 0x10

1400201b0
1400201b0SysNtWriteVirtualMemory:
1400201b0push rsi
1400201b1xor eax, eax
1400201b3push rbx
1400201b4mov rbx, rcx
1400201b7sub rsp, 72
1400201bbmov [rsp+48], rax
1400201c0mov rsi, [rsp+128]
1400201c8mov [rsp+56], rax
1400201cdmov rax, [rip+49564]
1400201d4cmp [rax+218], 0
1400201dbje 0x140020239
1400201ddmov rcx, [rax+2028]
1400201e4test rcx, rcx
1400201e7je 0x140020239
1400201e9mov r10w, [rax+2076]
1400201f1test r10w, r10w
1400201f5je 0x140020239
1400201f7mov [rsp+48], rcx
1400201fclea rcx, [rsp+48]
140020201mov [rsp+120], r9
140020206mov [rsp+112], r8
14002020bmov [rsp+104], rdx
140020210mov [rsp+56], r10w
140020216call SysSetConfig
14002021bmov [rsp+32], rsi
140020220mov r9, [rsp+120]
140020225mov rcx, rbx
140020228mov r8, [rsp+112]
14002022dmov rdx, [rsp+104]
140020232call SysInvoke
140020237jmp 0x140020247
140020239
140020239loc_140020239:
140020239mov [rsp+32], rsi
14002023emov rcx, rbx
140020241call [rax+644]
140020247
140020247loc_140020247:
140020247mov [rsp+32], eax
14002024blea r9, [rip+36988]
140020252mov ebx, eax
140020254mov r8l, 285
14002025alea rdx, [rip+51487]
140020261lea rcx, [rip+36600]
140020268call printf.constprop.0
14002026dadd rsp, 72
140020271mov eax, ebx
140020273pop rbx
140020274pop rsi
140020275ret
1400201b0

140020276
140020276 // align 0x10

140020280
140020280ThreadCreate:
140020280push rsi
140020281mov rax, rdx
140020284push rbx
140020285xor ebx, ebx
140020287sub rsp, 168
14002028emov [rsp+96], rbx
140020293mov rdx, [rsp+224]
14002029bmov rsi, [rsp+232]
1400202a3cmp cl, 2
1400202a6je 0x140020326
1400202a8ja 0x1400202ca
1400202aatest cl, cl
1400202acjne 0x1400202f5
1400202aemov [rsp+32], rdx
1400202b3mov ecx, 2
1400202b8mov rdx, rax
1400202bbmov [rsp+40], rsi
1400202c0call ThreadCreate
1400202c5jmp 0x1400203f9
1400202ca
1400202caloc_1400202ca:
1400202cacmp cl, 3
1400202cdje 0x1400203f4
1400202d3movzx r9l, cl
1400202d7mov r8l, 276
1400202ddlea rdx, [rip+50156]
1400202e4lea rcx, [rip+38419]
1400202ebcall printf
1400202f0jmp 0x1400203f4
1400202f5
1400202f5loc_1400202f5:
1400202f5mov rcx, rax
1400202f8mov rax, [rip+49265]
1400202ffxor r11l, r11l
140020302xor r8l, r8l
140020305mov [rsp+32], rdx
14002030axor edx, edx
14002030cmov [rsp+48], rsi
140020311mov [rsp+40], r11l
140020316call [rax+764]
14002031cmov [rsp+96], rax
140020321jmp 0x1400203f4
140020326
140020326loc_140020326:
140020326lea r8, [rsp+120]
14002032bxor r10l, r10l
14002032exor ecx, ecx
140020330mov [rsp+40], rdx
140020335mov [rsp+80], r8
14002033axor r8l, r8l
14002033dmov edx, 0x1fffff
140020342mov [rsp+72], r8
140020347mov [rsp+64], r8
14002034cmov [rsp+56], r8
140020351xor r8l, r8l
140020354mov [rsp+32], r9
140020359mov r9, rax
14002035cmov [rsp+48], r10l
140020361mov [rsp+152], rcx
140020369mov [rsp+104], rcx
14002036emov [rsp+112], rcx
140020373lea rcx, [rsp+104]
140020378mov [rsp+144], rcx
140020380lea rcx, [rsp+96]
140020385mov [rsp+128], 0x10003
140020391mov [rsp+136], 16
14002039dmov [rsp+120], 40
1400203a6call SysNtCreateThreadEx
1400203abmov ebx, eax
1400203adtest eax, eax
1400203afjs 0x1400203bf
1400203b1test rsi, rsi
1400203b4je 0x1400203f4
1400203b6mov rax, [rsp+112]
1400203bbmov [rsi], eax
1400203bdjmp 0x1400203f4
1400203bf
1400203bfloc_1400203bf:
1400203bfmov r9l, eax
1400203c2mov r8l, 263
1400203c8lea rdx, [rip+49921]
1400203cflea rcx, [rip+38122]
1400203d6call printf
1400203dbmov rax, [rip+49038]
1400203e2mov ecx, ebx
1400203e4mov rsi, [rax+2230]
1400203ebcall [rax+348]
1400203f1mov [rsi+104], eax
1400203f4
1400203f4loc_1400203f4:
1400203f4mov rax, [rsp+96]
1400203f9
1400203f9loc_1400203f9:
1400203f9add rsp, 168
140020400pop rbx
140020401pop rsi
140020402ret
140020280

140020403
140020403 // align 0x10

140020410
140020410ThreadQueryTib:
140020410push rbp
140020411xor eax, eax
140020413xor r10l, r10l
140020416xor r11l, r11l
140020419mov rbp, rsp
14002041cpush r15
14002041epush r14
140020420mov r14, 0x1000000040
14002042apush r13
14002042cpush r12
14002042epush rdi
14002042fpush rsi
140020430mov rsi, rdx
140020433push rbx
140020434xor ebx, ebx
140020436and rsp, -16
14002043asub rsp, 1456
140020441mov [rbp+16], rcx
140020445mov ecx, 12
14002044amov [rsp+96], r10
14002044flea r12, [rsp+88]
140020454lea r15, [rsp+112]
140020459lea rdi, [rsp+128]
140020461mov [rsp+104], r10
140020466rep stosd [rdi], eax
140020468mov ecx, 12
14002046dmov [rsp+112], r11
140020472lea rdi, [rsp+176]
14002047arep stosd [rdi], eax
14002047cmov ecx, 308
140020481mov [rsp+120], r11
140020486lea rdi, [rsp+224]
14002048erep stosd [rdi], eax
140020490mov rax, [rip+48857]
140020497mov [rsp+88], rbx
14002049cxor ebx, ebx
14002049emov [rsp+272], 0x10000b
1400204a9mov rax, [rax+2230]
1400204b0mov r13, [rax+72]
1400204b4lea rax, [rsp+128]
1400204bcmov [rsp+72], rax
1400204c1lea rax, [rsp+176]
1400204c9mov [rsp+64], rax
1400204celea rax, [rsp+224]
1400204d6mov [rsp+56], rax
1400204db
1400204dbloc_1400204db:
1400204dbxor eax, eax
1400204ddmov [rsp+40], r12
1400204e2xor r9l, r9l
1400204e5or rcx, -1
1400204e9mov [rsp+32], eax
1400204edmov r8l, 0x1fffff
1400204f3mov rdx, rbx
1400204f6call SysNtGetNextThread
1400204fbtest eax, eax
1400204fdjs 0x140020638
140020503test rbx, rbx
140020506je 0x140020510
140020508mov rcx, rbx
14002050bcall SysNtClose
140020510
140020510loc_140020510:
140020510xor r9l, r9l
140020513mov rbx, [rsp+88]
140020518lea rdi, [rsp+96]
14002051dmov edx, 26
140020522mov [rsp+32], r9
140020527mov r8, rdi
14002052amov r9l, 16
140020530mov rcx, rbx
140020533mov [rsp+104], r14
140020538mov [rsp+96], r15
14002053dcall SysNtQueryInformationThread
140020542test eax, eax
140020544js 0x1400204db
140020546mov eax, r13l
140020549cmp [rsp+120], rax
14002054eje 0x1400204db
140020550xor edx, edx
140020552mov rcx, rbx
140020555call SysNtSuspendThread
14002055atest eax, eax
14002055cjs 0x1400204db
140020562mov rdx, [rsp+56]
140020567mov rcx, rbx
14002056acall SysNtGetContextThread
14002056ftest eax, eax
140020571js 0x140020629
140020577xor r8l, r8l
14002057amov r9, [rsp+72]
14002057for rcx, -1
140020583mov [rsp+32], 48
14002058cmov [rsp+40], r8
140020591mov rdx, [rsp+376]
140020599xor r8l, r8l
14002059ccall SysNtQueryVirtualMemory
1400205a1test eax, eax
1400205a3js 0x140020629
1400205a9xor ecx, ecx
1400205abmov r9, [rsp+64]
1400205b0xor r8l, r8l
1400205b3mov [rsp+32], 48
1400205bcmov [rsp+40], rcx
1400205c1mov rdx, [rbp+16]
1400205c5or rcx, -1
1400205c9call SysNtQueryVirtualMemory
1400205cetest eax, eax
1400205d0js 0x140020629
1400205d2mov rax, [rsp+184]
1400205dacmp [rsp+136], rax
1400205e2jne 0x140020629
1400205e4xor edx, edx
1400205e6mov eax, 7
1400205ebmov r9l, 16
1400205f1mov r8, rdi
1400205f4mov [rsp+32], rdx
1400205f9shl rax, 35
1400205fdmov edx, 26
140020602mov rcx, rbx
140020605mov [rsp+104], rax
14002060amov [rsp+96], rsi
14002060fcall SysNtQueryInformationThread
140020614test eax, eax
140020616js 0x140020629
140020618xor edx, edx
14002061amov rcx, rbx
14002061dmov esi, 1
140020622call SysNtResumeThread
140020627jmp 0x14002063a
140020629
140020629loc_140020629:
140020629xor edx, edx
14002062bmov rcx, rbx
14002062ecall SysNtResumeThread
140020633jmp 0x1400204db
140020638
140020638loc_140020638:
140020638xor esi, esi
14002063a
14002063aloc_14002063a:
14002063atest rbx, rbx
14002063dje 0x140020647
14002063fmov rcx, rbx
140020642call SysNtClose
140020647
140020647loc_140020647:
140020647lea rsp, [rbp-56]
14002064bmov eax, esi
14002064dpop rbx
14002064epop rsi
14002064fpop rdi
140020650pop r12
140020652pop r13
140020654pop r14
140020656pop r15
140020658pop rbp
140020659ret
140020410