File havoc_demon_9b6047883014e32c66300962e067762ee768a7a3f981ca51b1ce60ae7452421b.exe
Function:
Loading..
14001f000
14001f000SysNtGetNextThread:
14001f000push rdi
14001f001xor eax, eax
14001f003push rsi
14001f004push rbx
14001f005mov rbx, rcx
14001f008sub rsp, 64
14001f00cmov [rsp+48], rax
14001f011mov esi, [rsp+128]
14001f018mov [rsp+56], rax
14001f01dmov rax, [rip+54092]
14001f024mov rdi, [rsp+136]
14001f02ccmp [rax+218], 0
14001f033je 0x14001f095
14001f035mov rcx, [rax+2028]
14001f03ctest rcx, rcx
14001f03fje 0x14001f095
14001f041mov r10w, [rax+2108]
14001f049test r10w, r10w
14001f04dje 0x14001f095
14001f04fmov [rsp+48], rcx
14001f054lea rcx, [rsp+48]
14001f059mov [rsp+120], r9l
14001f05emov [rsp+112], r8l
14001f063mov [rsp+104], rdx
14001f068mov [rsp+56], r10w
14001f06ecall SysSetConfig
14001f073mov [rsp+40], rdi
14001f078mov r9l, [rsp+120]
14001f07dmov rcx, rbx
14001f080mov r8l, [rsp+112]
14001f085mov rdx, [rsp+104]
14001f08amov [rsp+32], esi
14001f08ecall SysInvoke
14001f093jmp 0x14001f0a7
14001f095
14001f095loc_14001f095:
14001f095mov [rsp+40], rdi
14001f09amov rcx, rbx
14001f09dmov [rsp+32], esi
14001f0a1call [rax+484]
14001f0a7
14001f0a7loc_14001f0a7:
14001f0a7mov [rsp+32], eax
14001f0ablea r9, [rip+41819]
14001f0b2mov ebx, eax
14001f0b4mov r8l, 497
14001f0balea rdx, [rip+54735]
14001f0c1lea rcx, [rip+41112]
14001f0c8call printf.constprop.0
14001f0cdadd rsp, 64
14001f0d1mov eax, ebx
14001f0d3pop rbx
14001f0d4pop rsi
14001f0d5pop rdi
14001f0d6ret
14001f000
14001f000SysNtGetNextThread:
14001f000push rdi
14001f001xor eax, eax
14001f003push rsi
14001f004push rbx
14001f005mov rbx, rcx
14001f008sub rsp, 64
14001f00cmov [rsp+48], rax
14001f011mov esi, [rsp+128]
14001f018mov [rsp+56], rax
14001f01dmov rax, [rip+54092]
14001f024mov rdi, [rsp+136]
14001f02ccmp [rax+218], 0
14001f033je 0x14001f095
14001f035mov rcx, [rax+2028]
14001f03ctest rcx, rcx
14001f03fje 0x14001f095
14001f041mov r10w, [rax+2108]
14001f049test r10w, r10w
14001f04dje 0x14001f095
14001f04fmov [rsp+48], rcx
14001f054lea rcx, [rsp+48]
14001f059mov [rsp+120], r9l
14001f05emov [rsp+112], r8l
14001f063mov [rsp+104], rdx
14001f068mov [rsp+56], r10w
14001f06ecall SysSetConfig
14001f073mov [rsp+40], rdi
14001f078mov r9l, [rsp+120]
14001f07dmov rcx, rbx
14001f080mov r8l, [rsp+112]
14001f085mov rdx, [rsp+104]
14001f08amov [rsp+32], esi
14001f08ecall SysInvoke
14001f093jmp 0x14001f0a7
14001f095
14001f095loc_14001f095:
14001f095mov [rsp+40], rdi
14001f09amov rcx, rbx
14001f09dmov [rsp+32], esi
14001f0a1call [rax+484]
14001f0a7
14001f0a7loc_14001f0a7:
14001f0a7mov [rsp+32], eax
14001f0ablea r9, [rip+41819]
14001f0b2mov ebx, eax
14001f0b4mov r8l, 497
14001f0balea rdx, [rip+54735]
14001f0c1lea rcx, [rip+41112]
14001f0c8call printf.constprop.0
14001f0cdadd rsp, 64
14001f0d1mov eax, ebx
14001f0d3pop rbx
14001f0d4pop rsi
14001f0d5pop rdi
14001f0d6ret
14001f000
14001f0d7
14001f0d7 // align 0x10
14001f0d7 // align 0x10
14001f0e0
14001f0e0SysNtOpenProcess:
14001f0e0push rbx
14001f0e1xor eax, eax
14001f0e3mov rbx, rcx
14001f0e6sub rsp, 64
14001f0eamov [rsp+48], rax
14001f0efmov [rsp+56], rax
14001f0f4mov rax, [rip+53877]
14001f0fbcmp [rax+218], 0
14001f102je 0x14001f159
14001f104mov rcx, [rax+2028]
14001f10btest rcx, rcx
14001f10eje 0x14001f159
14001f110mov r10w, [rax+2046]
14001f118test r10w, r10w
14001f11cje 0x14001f159
14001f11emov [rsp+48], rcx
14001f123lea rcx, [rsp+48]
14001f128mov [rsp+104], r9
14001f12dmov [rsp+96], r8
14001f132mov [rsp+88], edx
14001f136mov [rsp+56], r10w
14001f13ccall SysSetConfig
14001f141mov r9, [rsp+104]
14001f146mov r8, [rsp+96]
14001f14bmov rcx, rbx
14001f14emov edx, [rsp+88]
14001f152call SysInvoke
14001f157jmp 0x14001f162
14001f159
14001f159loc_14001f159:
14001f159mov rcx, rbx
14001f15ccall [rax+516]
14001f162
14001f162loc_14001f162:
14001f162mov [rsp+32], eax
14001f166lea r9, [rip+40994]
14001f16dmov ebx, eax
14001f16fmov r8l, 29
14001f175lea rdx, [rip+57172]
14001f17clea rcx, [rip+40925]
14001f183call printf.constprop.0
14001f188add rsp, 64
14001f18cmov eax, ebx
14001f18epop rbx
14001f18fret
14001f0e0
14001f0e0SysNtOpenProcess:
14001f0e0push rbx
14001f0e1xor eax, eax
14001f0e3mov rbx, rcx
14001f0e6sub rsp, 64
14001f0eamov [rsp+48], rax
14001f0efmov [rsp+56], rax
14001f0f4mov rax, [rip+53877]
14001f0fbcmp [rax+218], 0
14001f102je 0x14001f159
14001f104mov rcx, [rax+2028]
14001f10btest rcx, rcx
14001f10eje 0x14001f159
14001f110mov r10w, [rax+2046]
14001f118test r10w, r10w
14001f11cje 0x14001f159
14001f11emov [rsp+48], rcx
14001f123lea rcx, [rsp+48]
14001f128mov [rsp+104], r9
14001f12dmov [rsp+96], r8
14001f132mov [rsp+88], edx
14001f136mov [rsp+56], r10w
14001f13ccall SysSetConfig
14001f141mov r9, [rsp+104]
14001f146mov r8, [rsp+96]
14001f14bmov rcx, rbx
14001f14emov edx, [rsp+88]
14001f152call SysInvoke
14001f157jmp 0x14001f162
14001f159
14001f159loc_14001f159:
14001f159mov rcx, rbx
14001f15ccall [rax+516]
14001f162
14001f162loc_14001f162:
14001f162mov [rsp+32], eax
14001f166lea r9, [rip+40994]
14001f16dmov ebx, eax
14001f16fmov r8l, 29
14001f175lea rdx, [rip+57172]
14001f17clea rcx, [rip+40925]
14001f183call printf.constprop.0
14001f188add rsp, 64
14001f18cmov eax, ebx
14001f18epop rbx
14001f18fret
14001f0e0
14001f190
14001f190SysNtOpenProcessToken:
14001f190push rbx
14001f191xor eax, eax
14001f193mov rbx, rcx
14001f196sub rsp, 64
14001f19amov [rsp+48], rax
14001f19fmov [rsp+56], rax
14001f1a4mov rax, [rip+53701]
14001f1abcmp [rax+218], 0
14001f1b2je 0x14001f1ff
14001f1b4mov rcx, [rax+2028]
14001f1bbtest rcx, rcx
14001f1beje 0x14001f1ff
14001f1c0mov r9w, [rax+2048]
14001f1c8test r9w, r9w
14001f1ccje 0x14001f1ff
14001f1cemov [rsp+48], rcx
14001f1d3lea rcx, [rsp+48]
14001f1d8mov [rsp+96], r8
14001f1ddmov [rsp+88], edx
14001f1e1mov [rsp+56], r9w
14001f1e7call SysSetConfig
14001f1ecmov r8, [rsp+96]
14001f1f1mov edx, [rsp+88]
14001f1f5mov rcx, rbx
14001f1f8call SysInvoke
14001f1fdjmp 0x14001f208
14001f1ff
14001f1ffloc_14001f1ff:
14001f1ffmov rcx, rbx
14001f202call [rax+524]
14001f208
14001f208loc_14001f208:
14001f208mov [rsp+32], eax
14001f20clea r9, [rip+40879]
14001f213mov ebx, eax
14001f215mov r8l, 68
14001f21blea rdx, [rip+56638]
14001f222lea rcx, [rip+40759]
14001f229call printf.constprop.0
14001f22eadd rsp, 64
14001f232mov eax, ebx
14001f234pop rbx
14001f235ret
14001f190
14001f190SysNtOpenProcessToken:
14001f190push rbx
14001f191xor eax, eax
14001f193mov rbx, rcx
14001f196sub rsp, 64
14001f19amov [rsp+48], rax
14001f19fmov [rsp+56], rax
14001f1a4mov rax, [rip+53701]
14001f1abcmp [rax+218], 0
14001f1b2je 0x14001f1ff
14001f1b4mov rcx, [rax+2028]
14001f1bbtest rcx, rcx
14001f1beje 0x14001f1ff
14001f1c0mov r9w, [rax+2048]
14001f1c8test r9w, r9w
14001f1ccje 0x14001f1ff
14001f1cemov [rsp+48], rcx
14001f1d3lea rcx, [rsp+48]
14001f1d8mov [rsp+96], r8
14001f1ddmov [rsp+88], edx
14001f1e1mov [rsp+56], r9w
14001f1e7call SysSetConfig
14001f1ecmov r8, [rsp+96]
14001f1f1mov edx, [rsp+88]
14001f1f5mov rcx, rbx
14001f1f8call SysInvoke
14001f1fdjmp 0x14001f208
14001f1ff
14001f1ffloc_14001f1ff:
14001f1ffmov rcx, rbx
14001f202call [rax+524]
14001f208
14001f208loc_14001f208:
14001f208mov [rsp+32], eax
14001f20clea r9, [rip+40879]
14001f213mov ebx, eax
14001f215mov r8l, 68
14001f21blea rdx, [rip+56638]
14001f222lea rcx, [rip+40759]
14001f229call printf.constprop.0
14001f22eadd rsp, 64
14001f232mov eax, ebx
14001f234pop rbx
14001f235ret
14001f190
14001f236
14001f236 // align 0x10
14001f236 // align 0x10
14001f240
14001f240SysNtOpenThread:
14001f240push rbx
14001f241xor eax, eax
14001f243mov rbx, rcx
14001f246sub rsp, 64
14001f24amov [rsp+48], rax
14001f24fmov [rsp+56], rax
14001f254mov rax, [rip+53525]
14001f25bcmp [rax+218], 0
14001f262je 0x14001f2b9
14001f264mov rcx, [rax+2028]
14001f26btest rcx, rcx
14001f26eje 0x14001f2b9
14001f270mov r10w, [rax+2040]
14001f278test r10w, r10w
14001f27cje 0x14001f2b9
14001f27emov [rsp+48], rcx
14001f283lea rcx, [rsp+48]
14001f288mov [rsp+104], r9
14001f28dmov [rsp+96], r8
14001f292mov [rsp+88], edx
14001f296mov [rsp+56], r10w
14001f29ccall SysSetConfig
14001f2a1mov r9, [rsp+104]
14001f2a6mov r8, [rsp+96]
14001f2abmov rcx, rbx
14001f2aemov edx, [rsp+88]
14001f2b2call SysInvoke
14001f2b7jmp 0x14001f2c2
14001f2b9
14001f2b9loc_14001f2b9:
14001f2b9mov rcx, rbx
14001f2bccall [rax+492]
14001f2c2
14001f2c2loc_14001f2c2:
14001f2c2mov [rsp+32], eax
14001f2c6lea r9, [rip+40629]
14001f2cdmov ebx, eax
14001f2cfmov r8l, 15
14001f2d5lea rdx, [rip+56852]
14001f2dclea rcx, [rip+40573]
14001f2e3call printf.constprop.0
14001f2e8add rsp, 64
14001f2ecmov eax, ebx
14001f2eepop rbx
14001f2efret
14001f240
14001f240SysNtOpenThread:
14001f240push rbx
14001f241xor eax, eax
14001f243mov rbx, rcx
14001f246sub rsp, 64
14001f24amov [rsp+48], rax
14001f24fmov [rsp+56], rax
14001f254mov rax, [rip+53525]
14001f25bcmp [rax+218], 0
14001f262je 0x14001f2b9
14001f264mov rcx, [rax+2028]
14001f26btest rcx, rcx
14001f26eje 0x14001f2b9
14001f270mov r10w, [rax+2040]
14001f278test r10w, r10w
14001f27cje 0x14001f2b9
14001f27emov [rsp+48], rcx
14001f283lea rcx, [rsp+48]
14001f288mov [rsp+104], r9
14001f28dmov [rsp+96], r8
14001f292mov [rsp+88], edx
14001f296mov [rsp+56], r10w
14001f29ccall SysSetConfig
14001f2a1mov r9, [rsp+104]
14001f2a6mov r8, [rsp+96]
14001f2abmov rcx, rbx
14001f2aemov edx, [rsp+88]
14001f2b2call SysInvoke
14001f2b7jmp 0x14001f2c2
14001f2b9
14001f2b9loc_14001f2b9:
14001f2b9mov rcx, rbx
14001f2bccall [rax+492]
14001f2c2
14001f2c2loc_14001f2c2:
14001f2c2mov [rsp+32], eax
14001f2c6lea r9, [rip+40629]
14001f2cdmov ebx, eax
14001f2cfmov r8l, 15
14001f2d5lea rdx, [rip+56852]
14001f2dclea rcx, [rip+40573]
14001f2e3call printf.constprop.0
14001f2e8add rsp, 64
14001f2ecmov eax, ebx
14001f2eepop rbx
14001f2efret
14001f240
14001f2f0
14001f2f0SysNtOpenThreadToken:
14001f2f0push rbx
14001f2f1xor eax, eax
14001f2f3mov rbx, rcx
14001f2f6movzx r8l, r8b
14001f2fasub rsp, 80
14001f2femov [rsp+64], rax
14001f303mov [rsp+72], rax
14001f308mov rax, [rip+53345]
14001f30fcmp [rax+218], 0
14001f316je 0x14001f36d
14001f318mov rcx, [rax+2028]
14001f31ftest rcx, rcx
14001f322je 0x14001f36d
14001f324mov r10w, [rax+2042]
14001f32ctest r10w, r10w
14001f330je 0x14001f36d
14001f332mov [rsp+64], rcx
14001f337lea rcx, [rsp+64]
14001f33cmov [rsp+120], r9
14001f341mov [rsp+104], edx
14001f345mov [rsp+60], r8l
14001f34amov [rsp+72], r10w
14001f350call SysSetConfig
14001f355mov r9, [rsp+120]
14001f35amov r8l, [rsp+60]
14001f35fmov rcx, rbx
14001f362mov edx, [rsp+104]
14001f366call SysInvoke
14001f36bjmp 0x14001f376
14001f36d
14001f36dloc_14001f36d:
14001f36dmov rcx, rbx
14001f370call [rax+500]
14001f376
14001f376loc_14001f376:
14001f376mov [rsp+32], eax
14001f37alea r9, [rip+40495]
14001f381mov ebx, eax
14001f383mov r8l, 55
14001f389lea rdx, [rip+56576]
14001f390lea rcx, [rip+40393]
14001f397call printf.constprop.0
14001f39cadd rsp, 80
14001f3a0mov eax, ebx
14001f3a2pop rbx
14001f3a3ret
14001f2f0
14001f2f0SysNtOpenThreadToken:
14001f2f0push rbx
14001f2f1xor eax, eax
14001f2f3mov rbx, rcx
14001f2f6movzx r8l, r8b
14001f2fasub rsp, 80
14001f2femov [rsp+64], rax
14001f303mov [rsp+72], rax
14001f308mov rax, [rip+53345]
14001f30fcmp [rax+218], 0
14001f316je 0x14001f36d
14001f318mov rcx, [rax+2028]
14001f31ftest rcx, rcx
14001f322je 0x14001f36d
14001f324mov r10w, [rax+2042]
14001f32ctest r10w, r10w
14001f330je 0x14001f36d
14001f332mov [rsp+64], rcx
14001f337lea rcx, [rsp+64]
14001f33cmov [rsp+120], r9
14001f341mov [rsp+104], edx
14001f345mov [rsp+60], r8l
14001f34amov [rsp+72], r10w
14001f350call SysSetConfig
14001f355mov r9, [rsp+120]
14001f35amov r8l, [rsp+60]
14001f35fmov rcx, rbx
14001f362mov edx, [rsp+104]
14001f366call SysInvoke
14001f36bjmp 0x14001f376
14001f36d
14001f36dloc_14001f36d:
14001f36dmov rcx, rbx
14001f370call [rax+500]
14001f376
14001f376loc_14001f376:
14001f376mov [rsp+32], eax
14001f37alea r9, [rip+40495]
14001f381mov ebx, eax
14001f383mov r8l, 55
14001f389lea rdx, [rip+56576]
14001f390lea rcx, [rip+40393]
14001f397call printf.constprop.0
14001f39cadd rsp, 80
14001f3a0mov eax, ebx
14001f3a2pop rbx
14001f3a3ret
14001f2f0
14001f3a4
14001f3a4 // align 0x10
14001f3a4 // align 0x10
14001f3b0
14001f3b0SysNtProtectVirtualMemory:
14001f3b0push rsi
14001f3b1xor eax, eax
14001f3b3push rbx
14001f3b4mov rbx, rcx
14001f3b7sub rsp, 72
14001f3bbmov [rsp+48], rax
14001f3c0mov rsi, [rsp+128]
14001f3c8mov [rsp+56], rax
14001f3cdmov rax, [rip+53148]
14001f3d4cmp [rax+218], 0
14001f3dbje 0x14001f439
14001f3ddmov rcx, [rax+2028]
14001f3e4test rcx, rcx
14001f3e7je 0x14001f439
14001f3e9mov r10w, [rax+2084]
14001f3f1test r10w, r10w
14001f3f5je 0x14001f439
14001f3f7mov [rsp+48], rcx
14001f3fclea rcx, [rsp+48]
14001f401mov [rsp+120], r9l
14001f406mov [rsp+112], r8
14001f40bmov [rsp+104], rdx
14001f410mov [rsp+56], r10w
14001f416call SysSetConfig
14001f41bmov [rsp+32], rsi
14001f420mov r9l, [rsp+120]
14001f425mov rcx, rbx
14001f428mov r8, [rsp+112]
14001f42dmov rdx, [rsp+104]
14001f432call SysInvoke
14001f437jmp 0x14001f447
14001f439
14001f439loc_14001f439:
14001f439mov [rsp+32], rsi
14001f43emov rcx, rbx
14001f441call [rax+676]
14001f447
14001f447loc_14001f447:
14001f447mov [rsp+32], eax
14001f44blea r9, [rip+40634]
14001f452mov ebx, eax
14001f454mov r8l, 326
14001f45alea rdx, [rip+54831]
14001f461lea rcx, [rip+40184]
14001f468call printf.constprop.0
14001f46dadd rsp, 72
14001f471mov eax, ebx
14001f473pop rbx
14001f474pop rsi
14001f475ret
14001f3b0
14001f3b0SysNtProtectVirtualMemory:
14001f3b0push rsi
14001f3b1xor eax, eax
14001f3b3push rbx
14001f3b4mov rbx, rcx
14001f3b7sub rsp, 72
14001f3bbmov [rsp+48], rax
14001f3c0mov rsi, [rsp+128]
14001f3c8mov [rsp+56], rax
14001f3cdmov rax, [rip+53148]
14001f3d4cmp [rax+218], 0
14001f3dbje 0x14001f439
14001f3ddmov rcx, [rax+2028]
14001f3e4test rcx, rcx
14001f3e7je 0x14001f439
14001f3e9mov r10w, [rax+2084]
14001f3f1test r10w, r10w
14001f3f5je 0x14001f439
14001f3f7mov [rsp+48], rcx
14001f3fclea rcx, [rsp+48]
14001f401mov [rsp+120], r9l
14001f406mov [rsp+112], r8
14001f40bmov [rsp+104], rdx
14001f410mov [rsp+56], r10w
14001f416call SysSetConfig
14001f41bmov [rsp+32], rsi
14001f420mov r9l, [rsp+120]
14001f425mov rcx, rbx
14001f428mov r8, [rsp+112]
14001f42dmov rdx, [rsp+104]
14001f432call SysInvoke
14001f437jmp 0x14001f447
14001f439
14001f439loc_14001f439:
14001f439mov [rsp+32], rsi
14001f43emov rcx, rbx
14001f441call [rax+676]
14001f447
14001f447loc_14001f447:
14001f447mov [rsp+32], eax
14001f44blea r9, [rip+40634]
14001f452mov ebx, eax
14001f454mov r8l, 326
14001f45alea rdx, [rip+54831]
14001f461lea rcx, [rip+40184]
14001f468call printf.constprop.0
14001f46dadd rsp, 72
14001f471mov eax, ebx
14001f473pop rbx
14001f474pop rsi
14001f475ret
14001f3b0
14001f476
14001f476 // align 0x10
14001f476 // align 0x10
14001f480
14001f480SysNtQueryInformationProcess:
14001f480push rsi
14001f481xor eax, eax
14001f483push rbx
14001f484mov rbx, rcx
14001f487sub rsp, 72
14001f48bmov [rsp+48], rax
14001f490mov rsi, [rsp+128]
14001f498mov [rsp+56], rax
14001f49dmov rax, [rip+52940]
14001f4a4cmp [rax+218], 0
14001f4abje 0x14001f507
14001f4admov rcx, [rax+2028]
14001f4b4test rcx, rcx
14001f4b7je 0x14001f507
14001f4b9mov r10w, [rax+2068]
14001f4c1test r10w, r10w
14001f4c5je 0x14001f507
14001f4c7mov [rsp+48], rcx
14001f4cclea rcx, [rsp+48]
14001f4d1mov [rsp+120], r9l
14001f4d6mov [rsp+112], r8
14001f4dbmov [rsp+104], edx
14001f4dfmov [rsp+56], r10w
14001f4e5call SysSetConfig
14001f4eamov [rsp+32], rsi
14001f4efmov edx, [rsp+104]
14001f4f3mov rcx, rbx
14001f4f6mov r9l, [rsp+120]
14001f4fbmov r8, [rsp+112]
14001f500call SysInvoke
14001f505jmp 0x14001f515
14001f507
14001f507loc_14001f507:
14001f507mov [rsp+32], rsi
14001f50cmov rcx, rbx
14001f50fcall [rax+604]
14001f515
14001f515loc_14001f515:
14001f515mov [rsp+32], eax
14001f519lea r9, [rip+40269]
14001f520mov ebx, eax
14001f522mov r8l, 227
14001f528lea rdx, [rip+55057]
14001f52flea rcx, [rip+39978]
14001f536call printf.constprop.0
14001f53badd rsp, 72
14001f53fmov eax, ebx
14001f541pop rbx
14001f542pop rsi
14001f543ret
14001f480
14001f480SysNtQueryInformationProcess:
14001f480push rsi
14001f481xor eax, eax
14001f483push rbx
14001f484mov rbx, rcx
14001f487sub rsp, 72
14001f48bmov [rsp+48], rax
14001f490mov rsi, [rsp+128]
14001f498mov [rsp+56], rax
14001f49dmov rax, [rip+52940]
14001f4a4cmp [rax+218], 0
14001f4abje 0x14001f507
14001f4admov rcx, [rax+2028]
14001f4b4test rcx, rcx
14001f4b7je 0x14001f507
14001f4b9mov r10w, [rax+2068]
14001f4c1test r10w, r10w
14001f4c5je 0x14001f507
14001f4c7mov [rsp+48], rcx
14001f4cclea rcx, [rsp+48]
14001f4d1mov [rsp+120], r9l
14001f4d6mov [rsp+112], r8
14001f4dbmov [rsp+104], edx
14001f4dfmov [rsp+56], r10w
14001f4e5call SysSetConfig
14001f4eamov [rsp+32], rsi
14001f4efmov edx, [rsp+104]
14001f4f3mov rcx, rbx
14001f4f6mov r9l, [rsp+120]
14001f4fbmov r8, [rsp+112]
14001f500call SysInvoke
14001f505jmp 0x14001f515
14001f507
14001f507loc_14001f507:
14001f507mov [rsp+32], rsi
14001f50cmov rcx, rbx
14001f50fcall [rax+604]
14001f515
14001f515loc_14001f515:
14001f515mov [rsp+32], eax
14001f519lea r9, [rip+40269]
14001f520mov ebx, eax
14001f522mov r8l, 227
14001f528lea rdx, [rip+55057]
14001f52flea rcx, [rip+39978]
14001f536call printf.constprop.0
14001f53badd rsp, 72
14001f53fmov eax, ebx
14001f541pop rbx
14001f542pop rsi
14001f543ret
14001f480
14001f544
14001f544 // align 0x10
14001f544 // align 0x10
14001f550
14001f550SysNtQueryInformationThread:
14001f550push rsi
14001f551xor eax, eax
14001f553push rbx
14001f554mov rbx, rcx
14001f557sub rsp, 72
14001f55bmov [rsp+48], rax
14001f560mov rsi, [rsp+128]
14001f568mov [rsp+56], rax
14001f56dmov rax, [rip+52732]
14001f574cmp [rax+218], 0
14001f57bje 0x14001f5d7
14001f57dmov rcx, [rax+2028]
14001f584test rcx, rcx
14001f587je 0x14001f5d7
14001f589mov r10w, [rax+2096]
14001f591test r10w, r10w
14001f595je 0x14001f5d7
14001f597mov [rsp+48], rcx
14001f59clea rcx, [rsp+48]
14001f5a1mov [rsp+120], r9l
14001f5a6mov [rsp+112], r8
14001f5abmov [rsp+104], edx
14001f5afmov [rsp+56], r10w
14001f5b5call SysSetConfig
14001f5bamov [rsp+32], rsi
14001f5bfmov edx, [rsp+104]
14001f5c3mov rcx, rbx
14001f5c6mov r9l, [rsp+120]
14001f5cbmov r8, [rsp+112]
14001f5d0call SysInvoke
14001f5d5jmp 0x14001f5e5
14001f5d7
14001f5d7loc_14001f5d7:
14001f5d7mov [rsp+32], rsi
14001f5dcmov rcx, rbx
14001f5dfcall [rax+732]
14001f5e5
14001f5e5loc_14001f5e5:
14001f5e5mov [rsp+32], eax
14001f5e9lea r9, [rip+40377]
14001f5f0mov ebx, eax
14001f5f2mov r8l, 425
14001f5f8lea rdx, [rip+56385]
14001f5fflea rcx, [rip+39770]
14001f606call printf.constprop.0
14001f60badd rsp, 72
14001f60fmov eax, ebx
14001f611pop rbx
14001f612pop rsi
14001f613ret
14001f550
14001f550SysNtQueryInformationThread:
14001f550push rsi
14001f551xor eax, eax
14001f553push rbx
14001f554mov rbx, rcx
14001f557sub rsp, 72
14001f55bmov [rsp+48], rax
14001f560mov rsi, [rsp+128]
14001f568mov [rsp+56], rax
14001f56dmov rax, [rip+52732]
14001f574cmp [rax+218], 0
14001f57bje 0x14001f5d7
14001f57dmov rcx, [rax+2028]
14001f584test rcx, rcx
14001f587je 0x14001f5d7
14001f589mov r10w, [rax+2096]
14001f591test r10w, r10w
14001f595je 0x14001f5d7
14001f597mov [rsp+48], rcx
14001f59clea rcx, [rsp+48]
14001f5a1mov [rsp+120], r9l
14001f5a6mov [rsp+112], r8
14001f5abmov [rsp+104], edx
14001f5afmov [rsp+56], r10w
14001f5b5call SysSetConfig
14001f5bamov [rsp+32], rsi
14001f5bfmov edx, [rsp+104]
14001f5c3mov rcx, rbx
14001f5c6mov r9l, [rsp+120]
14001f5cbmov r8, [rsp+112]
14001f5d0call SysInvoke
14001f5d5jmp 0x14001f5e5
14001f5d7
14001f5d7loc_14001f5d7:
14001f5d7mov [rsp+32], rsi
14001f5dcmov rcx, rbx
14001f5dfcall [rax+732]
14001f5e5
14001f5e5loc_14001f5e5:
14001f5e5mov [rsp+32], eax
14001f5e9lea r9, [rip+40377]
14001f5f0mov ebx, eax
14001f5f2mov r8l, 425
14001f5f8lea rdx, [rip+56385]
14001f5fflea rcx, [rip+39770]
14001f606call printf.constprop.0
14001f60badd rsp, 72
14001f60fmov eax, ebx
14001f611pop rbx
14001f612pop rsi
14001f613ret
14001f550
14001f614
14001f614 // align 0x10
14001f614 // align 0x10
14001f620
14001f620SysNtQueryInformationToken:
14001f620push rsi
14001f621xor eax, eax
14001f623push rbx
14001f624mov rbx, rcx
14001f627sub rsp, 72
14001f62bmov [rsp+48], rax
14001f630mov rsi, [rsp+128]
14001f638mov [rsp+56], rax
14001f63dmov rax, [rip+52524]
14001f644cmp [rax+218], 0
14001f64bje 0x14001f6a7
14001f64dmov rcx, [rax+2028]
14001f654test rcx, rcx
14001f657je 0x14001f6a7
14001f659mov r10w, [rax+2094]
14001f661test r10w, r10w
14001f665je 0x14001f6a7
14001f667mov [rsp+48], rcx
14001f66clea rcx, [rsp+48]
14001f671mov [rsp+120], r9l
14001f676mov [rsp+112], r8
14001f67bmov [rsp+104], edx
14001f67fmov [rsp+56], r10w
14001f685call SysSetConfig
14001f68amov [rsp+32], rsi
14001f68fmov edx, [rsp+104]
14001f693mov rcx, rbx
14001f696mov r9l, [rsp+120]
14001f69bmov r8, [rsp+112]
14001f6a0call SysInvoke
14001f6a5jmp 0x14001f6b5
14001f6a7
14001f6a7loc_14001f6a7:
14001f6a7mov [rsp+32], rsi
14001f6acmov rcx, rbx
14001f6afcall [rax+724]
14001f6b5
14001f6b5loc_14001f6b5:
14001f6b5mov [rsp+32], eax
14001f6b9lea r9, [rip+40145]
14001f6c0mov ebx, eax
14001f6c2mov r8l, 410
14001f6c8lea rdx, [rip+56337]
14001f6cflea rcx, [rip+39562]
14001f6d6call printf.constprop.0
14001f6dbadd rsp, 72
14001f6dfmov eax, ebx
14001f6e1pop rbx
14001f6e2pop rsi
14001f6e3ret
14001f620
14001f620SysNtQueryInformationToken:
14001f620push rsi
14001f621xor eax, eax
14001f623push rbx
14001f624mov rbx, rcx
14001f627sub rsp, 72
14001f62bmov [rsp+48], rax
14001f630mov rsi, [rsp+128]
14001f638mov [rsp+56], rax
14001f63dmov rax, [rip+52524]
14001f644cmp [rax+218], 0
14001f64bje 0x14001f6a7
14001f64dmov rcx, [rax+2028]
14001f654test rcx, rcx
14001f657je 0x14001f6a7
14001f659mov r10w, [rax+2094]
14001f661test r10w, r10w
14001f665je 0x14001f6a7
14001f667mov [rsp+48], rcx
14001f66clea rcx, [rsp+48]
14001f671mov [rsp+120], r9l
14001f676mov [rsp+112], r8
14001f67bmov [rsp+104], edx
14001f67fmov [rsp+56], r10w
14001f685call SysSetConfig
14001f68amov [rsp+32], rsi
14001f68fmov edx, [rsp+104]
14001f693mov rcx, rbx
14001f696mov r9l, [rsp+120]
14001f69bmov r8, [rsp+112]
14001f6a0call SysInvoke
14001f6a5jmp 0x14001f6b5
14001f6a7
14001f6a7loc_14001f6a7:
14001f6a7mov [rsp+32], rsi
14001f6acmov rcx, rbx
14001f6afcall [rax+724]
14001f6b5
14001f6b5loc_14001f6b5:
14001f6b5mov [rsp+32], eax
14001f6b9lea r9, [rip+40145]
14001f6c0mov ebx, eax
14001f6c2mov r8l, 410
14001f6c8lea rdx, [rip+56337]
14001f6cflea rcx, [rip+39562]
14001f6d6call printf.constprop.0
14001f6dbadd rsp, 72
14001f6dfmov eax, ebx
14001f6e1pop rbx
14001f6e2pop rsi
14001f6e3ret
14001f620
14001f6e4
14001f6e4 // align 0x10
14001f6e4 // align 0x10
14001f6f0
14001f6f0SysNtQueryObject:
14001f6f0push rsi
14001f6f1xor eax, eax
14001f6f3push rbx
14001f6f4mov rbx, rcx
14001f6f7sub rsp, 72
14001f6fbmov [rsp+48], rax
14001f700mov rsi, [rsp+128]
14001f708mov [rsp+56], rax
14001f70dmov rax, [rip+52316]
14001f714cmp [rax+218], 0
14001f71bje 0x14001f777
14001f71dmov rcx, [rax+2028]
14001f724test rcx, rcx
14001f727je 0x14001f777
14001f729mov r10w, [rax+2098]
14001f731test r10w, r10w
14001f735je 0x14001f777
14001f737mov [rsp+48], rcx
14001f73clea rcx, [rsp+48]
14001f741mov [rsp+120], r9l
14001f746mov [rsp+112], r8
14001f74bmov [rsp+104], edx
14001f74fmov [rsp+56], r10w
14001f755call SysSetConfig
14001f75amov [rsp+32], rsi
14001f75fmov edx, [rsp+104]
14001f763mov rcx, rbx
14001f766mov r9l, [rsp+120]
14001f76bmov r8, [rsp+112]
14001f770call SysInvoke
14001f775jmp 0x14001f785
14001f777
14001f777loc_14001f777:
14001f777mov [rsp+32], rsi
14001f77cmov rcx, rbx
14001f77fcall [rax+740]
14001f785
14001f785loc_14001f785:
14001f785mov [rsp+32], eax
14001f789lea r9, [rip+39986]
14001f790mov ebx, eax
14001f792mov r8l, 440
14001f798lea rdx, [rip+55761]
14001f79flea rcx, [rip+39354]
14001f7a6call printf.constprop.0
14001f7abadd rsp, 72
14001f7afmov eax, ebx
14001f7b1pop rbx
14001f7b2pop rsi
14001f7b3ret
14001f6f0
14001f6f0SysNtQueryObject:
14001f6f0push rsi
14001f6f1xor eax, eax
14001f6f3push rbx
14001f6f4mov rbx, rcx
14001f6f7sub rsp, 72
14001f6fbmov [rsp+48], rax
14001f700mov rsi, [rsp+128]
14001f708mov [rsp+56], rax
14001f70dmov rax, [rip+52316]
14001f714cmp [rax+218], 0
14001f71bje 0x14001f777
14001f71dmov rcx, [rax+2028]
14001f724test rcx, rcx
14001f727je 0x14001f777
14001f729mov r10w, [rax+2098]
14001f731test r10w, r10w
14001f735je 0x14001f777
14001f737mov [rsp+48], rcx
14001f73clea rcx, [rsp+48]
14001f741mov [rsp+120], r9l
14001f746mov [rsp+112], r8
14001f74bmov [rsp+104], edx
14001f74fmov [rsp+56], r10w
14001f755call SysSetConfig
14001f75amov [rsp+32], rsi
14001f75fmov edx, [rsp+104]
14001f763mov rcx, rbx
14001f766mov r9l, [rsp+120]
14001f76bmov r8, [rsp+112]
14001f770call SysInvoke
14001f775jmp 0x14001f785
14001f777
14001f777loc_14001f777:
14001f777mov [rsp+32], rsi
14001f77cmov rcx, rbx
14001f77fcall [rax+740]
14001f785
14001f785loc_14001f785:
14001f785mov [rsp+32], eax
14001f789lea r9, [rip+39986]
14001f790mov ebx, eax
14001f792mov r8l, 440
14001f798lea rdx, [rip+55761]
14001f79flea rcx, [rip+39354]
14001f7a6call printf.constprop.0
14001f7abadd rsp, 72
14001f7afmov eax, ebx
14001f7b1pop rbx
14001f7b2pop rsi
14001f7b3ret
14001f6f0
14001f7b4
14001f7b4 // align 0x10
14001f7b4 // align 0x10
14001f7c0
14001f7c0SysNtQuerySystemInformation:
14001f7c0push rbx
14001f7c1xor eax, eax
14001f7c3mov ebx, ecx
14001f7c5sub rsp, 64
14001f7c9mov [rsp+48], rax
14001f7cemov [rsp+56], rax
14001f7d3mov rax, [rip+52118]
14001f7dacmp [rax+218], 0
14001f7e1je 0x14001f839
14001f7e3mov rcx, [rax+2028]
14001f7eatest rcx, rcx
14001f7edje 0x14001f839
14001f7efmov r10w, [rax+2070]
14001f7f7test r10w, r10w
14001f7fbje 0x14001f839
14001f7fdmov [rsp+48], rcx
14001f802lea rcx, [rsp+48]
14001f807mov [rsp+104], r9
14001f80cmov [rsp+96], r8l
14001f811mov [rsp+88], rdx
14001f816mov [rsp+56], r10w
14001f81ccall SysSetConfig
14001f821mov r9, [rsp+104]
14001f826mov r8l, [rsp+96]
14001f82bmov ecx, ebx
14001f82dmov rdx, [rsp+88]
14001f832call SysInvoke
14001f837jmp 0x14001f841
14001f839
14001f839loc_14001f839:
14001f839mov ecx, ebx
14001f83bcall [rax+612]
14001f841
14001f841loc_14001f841:
14001f841mov [rsp+32], eax
14001f845lea r9, [rip+39483]
14001f84cmov ebx, eax
14001f84emov r8l, 241
14001f854lea rdx, [rip+54197]
14001f85blea rcx, [rip+39166]
14001f862call printf.constprop.0
14001f867add rsp, 64
14001f86bmov eax, ebx
14001f86dpop rbx
14001f86eret
14001f7c0
14001f7c0SysNtQuerySystemInformation:
14001f7c0push rbx
14001f7c1xor eax, eax
14001f7c3mov ebx, ecx
14001f7c5sub rsp, 64
14001f7c9mov [rsp+48], rax
14001f7cemov [rsp+56], rax
14001f7d3mov rax, [rip+52118]
14001f7dacmp [rax+218], 0
14001f7e1je 0x14001f839
14001f7e3mov rcx, [rax+2028]
14001f7eatest rcx, rcx
14001f7edje 0x14001f839
14001f7efmov r10w, [rax+2070]
14001f7f7test r10w, r10w
14001f7fbje 0x14001f839
14001f7fdmov [rsp+48], rcx
14001f802lea rcx, [rsp+48]
14001f807mov [rsp+104], r9
14001f80cmov [rsp+96], r8l
14001f811mov [rsp+88], rdx
14001f816mov [rsp+56], r10w
14001f81ccall SysSetConfig
14001f821mov r9, [rsp+104]
14001f826mov r8l, [rsp+96]
14001f82bmov ecx, ebx
14001f82dmov rdx, [rsp+88]
14001f832call SysInvoke
14001f837jmp 0x14001f841
14001f839
14001f839loc_14001f839:
14001f839mov ecx, ebx
14001f83bcall [rax+612]
14001f841
14001f841loc_14001f841:
14001f841mov [rsp+32], eax
14001f845lea r9, [rip+39483]
14001f84cmov ebx, eax
14001f84emov r8l, 241
14001f854lea rdx, [rip+54197]
14001f85blea rcx, [rip+39166]
14001f862call printf.constprop.0
14001f867add rsp, 64
14001f86bmov eax, ebx
14001f86dpop rbx
14001f86eret
14001f7c0
14001f86f
14001f86f // align 0x10
14001f86f // align 0x10
14001f870
14001f870SysNtQueryVirtualMemory:
14001f870push rdi
14001f871xor eax, eax
14001f873push rsi
14001f874push rbx
14001f875mov rbx, rcx
14001f878sub rsp, 64
14001f87cmov [rsp+48], rax
14001f881mov rsi, [rsp+128]
14001f889mov [rsp+56], rax
14001f88emov rax, [rip+51931]
14001f895mov rdi, [rsp+136]
14001f89dcmp [rax+218], 0
14001f8a4je 0x14001f907
14001f8a6mov rcx, [rax+2028]
14001f8adtest rcx, rcx
14001f8b0je 0x14001f907
14001f8b2mov r10w, [rax+2092]
14001f8batest r10w, r10w
14001f8beje 0x14001f907
14001f8c0mov [rsp+48], rcx
14001f8c5lea rcx, [rsp+48]
14001f8camov [rsp+120], r9
14001f8cfmov [rsp+112], r8l
14001f8d4mov [rsp+104], rdx
14001f8d9mov [rsp+56], r10w
14001f8dfcall SysSetConfig
14001f8e4mov [rsp+40], rdi
14001f8e9mov r9, [rsp+120]
14001f8eemov rcx, rbx
14001f8f1mov r8l, [rsp+112]
14001f8f6mov rdx, [rsp+104]
14001f8fbmov [rsp+32], rsi
14001f900call SysInvoke
14001f905jmp 0x14001f91a
14001f907
14001f907loc_14001f907:
14001f907mov [rsp+40], rdi
14001f90cmov rcx, rbx
14001f90fmov [rsp+32], rsi
14001f914call [rax+716]
14001f91a
14001f91aloc_14001f91a:
14001f91amov [rsp+32], eax
14001f91elea r9, [rip+39511]
14001f925mov ebx, eax
14001f927mov r8l, 395
14001f92dlea rdx, [rip+55852]
14001f934lea rcx, [rip+38949]
14001f93bcall printf.constprop.0
14001f940add rsp, 64
14001f944mov eax, ebx
14001f946pop rbx
14001f947pop rsi
14001f948pop rdi
14001f949ret
14001f870
14001f870SysNtQueryVirtualMemory:
14001f870push rdi
14001f871xor eax, eax
14001f873push rsi
14001f874push rbx
14001f875mov rbx, rcx
14001f878sub rsp, 64
14001f87cmov [rsp+48], rax
14001f881mov rsi, [rsp+128]
14001f889mov [rsp+56], rax
14001f88emov rax, [rip+51931]
14001f895mov rdi, [rsp+136]
14001f89dcmp [rax+218], 0
14001f8a4je 0x14001f907
14001f8a6mov rcx, [rax+2028]
14001f8adtest rcx, rcx
14001f8b0je 0x14001f907
14001f8b2mov r10w, [rax+2092]
14001f8batest r10w, r10w
14001f8beje 0x14001f907
14001f8c0mov [rsp+48], rcx
14001f8c5lea rcx, [rsp+48]
14001f8camov [rsp+120], r9
14001f8cfmov [rsp+112], r8l
14001f8d4mov [rsp+104], rdx
14001f8d9mov [rsp+56], r10w
14001f8dfcall SysSetConfig
14001f8e4mov [rsp+40], rdi
14001f8e9mov r9, [rsp+120]
14001f8eemov rcx, rbx
14001f8f1mov r8l, [rsp+112]
14001f8f6mov rdx, [rsp+104]
14001f8fbmov [rsp+32], rsi
14001f900call SysInvoke
14001f905jmp 0x14001f91a
14001f907
14001f907loc_14001f907:
14001f907mov [rsp+40], rdi
14001f90cmov rcx, rbx
14001f90fmov [rsp+32], rsi
14001f914call [rax+716]
14001f91a
14001f91aloc_14001f91a:
14001f91amov [rsp+32], eax
14001f91elea r9, [rip+39511]
14001f925mov ebx, eax
14001f927mov r8l, 395
14001f92dlea rdx, [rip+55852]
14001f934lea rcx, [rip+38949]
14001f93bcall printf.constprop.0
14001f940add rsp, 64
14001f944mov eax, ebx
14001f946pop rbx
14001f947pop rsi
14001f948pop rdi
14001f949ret
14001f870
14001f94a
14001f94a // align 0x10
14001f94a // align 0x10
14001f950
14001f950SysNtQueueApcThread:
14001f950push rsi
14001f951xor eax, eax
14001f953push rbx
14001f954mov rbx, rcx
14001f957sub rsp, 72
14001f95bmov [rsp+48], rax
14001f960mov rsi, [rsp+128]
14001f968mov [rsp+56], rax
14001f96dmov rax, [rip+51708]
14001f974cmp [rax+218], 0
14001f97bje 0x14001f9d9
14001f97dmov rcx, [rax+2028]
14001f984test rcx, rcx
14001f987je 0x14001f9d9
14001f989mov r10w, [rax+2052]
14001f991test r10w, r10w
14001f995je 0x14001f9d9
14001f997mov [rsp+48], rcx
14001f99clea rcx, [rsp+48]
14001f9a1mov [rsp+120], r9
14001f9a6mov [rsp+112], r8
14001f9abmov [rsp+104], rdx
14001f9b0mov [rsp+56], r10w
14001f9b6call SysSetConfig
14001f9bbmov [rsp+32], rsi
14001f9c0mov r9, [rsp+120]
14001f9c5mov rcx, rbx
14001f9c8mov r8, [rsp+112]
14001f9cdmov rdx, [rsp+104]
14001f9d2call SysInvoke
14001f9d7jmp 0x14001f9e7
14001f9d9
14001f9d9loc_14001f9d9:
14001f9d9mov [rsp+32], rsi
14001f9demov rcx, rbx
14001f9e1call [rax+540]
14001f9e7
14001f9e7loc_14001f9e7:
14001f9e7mov [rsp+32], eax
14001f9eblea r9, [rip+38900]
14001f9f2mov ebx, eax
14001f9f4mov r8l, 99
14001f9falea rdx, [rip+54559]
14001fa01lea rcx, [rip+38744]
14001fa08call printf.constprop.0
14001fa0dadd rsp, 72
14001fa11mov eax, ebx
14001fa13pop rbx
14001fa14pop rsi
14001fa15ret
14001f950
14001f950SysNtQueueApcThread:
14001f950push rsi
14001f951xor eax, eax
14001f953push rbx
14001f954mov rbx, rcx
14001f957sub rsp, 72
14001f95bmov [rsp+48], rax
14001f960mov rsi, [rsp+128]
14001f968mov [rsp+56], rax
14001f96dmov rax, [rip+51708]
14001f974cmp [rax+218], 0
14001f97bje 0x14001f9d9
14001f97dmov rcx, [rax+2028]
14001f984test rcx, rcx
14001f987je 0x14001f9d9
14001f989mov r10w, [rax+2052]
14001f991test r10w, r10w
14001f995je 0x14001f9d9
14001f997mov [rsp+48], rcx
14001f99clea rcx, [rsp+48]
14001f9a1mov [rsp+120], r9
14001f9a6mov [rsp+112], r8
14001f9abmov [rsp+104], rdx
14001f9b0mov [rsp+56], r10w
14001f9b6call SysSetConfig
14001f9bbmov [rsp+32], rsi
14001f9c0mov r9, [rsp+120]
14001f9c5mov rcx, rbx
14001f9c8mov r8, [rsp+112]
14001f9cdmov rdx, [rsp+104]
14001f9d2call SysInvoke
14001f9d7jmp 0x14001f9e7
14001f9d9
14001f9d9loc_14001f9d9:
14001f9d9mov [rsp+32], rsi
14001f9demov rcx, rbx
14001f9e1call [rax+540]
14001f9e7
14001f9e7loc_14001f9e7:
14001f9e7mov [rsp+32], eax
14001f9eblea r9, [rip+38900]
14001f9f2mov ebx, eax
14001f9f4mov r8l, 99
14001f9falea rdx, [rip+54559]
14001fa01lea rcx, [rip+38744]
14001fa08call printf.constprop.0
14001fa0dadd rsp, 72
14001fa11mov eax, ebx
14001fa13pop rbx
14001fa14pop rsi
14001fa15ret
14001f950
14001fa16
14001fa16 // align 0x10
14001fa16 // align 0x10
14001fa20
14001fa20SysNtReadVirtualMemory:
14001fa20push rsi
14001fa21xor eax, eax
14001fa23push rbx
14001fa24mov rbx, rcx
14001fa27sub rsp, 72
14001fa2bmov [rsp+48], rax
14001fa30mov rsi, [rsp+128]
14001fa38mov [rsp+56], rax
14001fa3dmov rax, [rip+51500]
14001fa44cmp [rax+218], 0
14001fa4bje 0x14001faa9
14001fa4dmov rcx, [rax+2028]
14001fa54test rcx, rcx
14001fa57je 0x14001faa9
14001fa59mov r10w, [rax+2078]
14001fa61test r10w, r10w
14001fa65je 0x14001faa9
14001fa67mov [rsp+48], rcx
14001fa6clea rcx, [rsp+48]
14001fa71mov [rsp+120], r9
14001fa76mov [rsp+112], r8
14001fa7bmov [rsp+104], rdx
14001fa80mov [rsp+56], r10w
14001fa86call SysSetConfig
14001fa8bmov [rsp+32], rsi
14001fa90mov r9, [rsp+120]
14001fa95mov rcx, rbx
14001fa98mov r8, [rsp+112]
14001fa9dmov rdx, [rsp+104]
14001faa2call SysInvoke
14001faa7jmp 0x14001fab7
14001faa9
14001faa9loc_14001faa9:
14001faa9mov [rsp+32], rsi
14001faaemov rcx, rbx
14001fab1call [rax+652]
14001fab7
14001fab7loc_14001fab7:
14001fab7mov [rsp+32], eax
14001fabblea r9, [rip+39009]
14001fac2mov ebx, eax
14001fac4mov r8l, 341
14001facalea rdx, [rip+53087]
14001fad1lea rcx, [rip+38536]
14001fad8call printf.constprop.0
14001faddadd rsp, 72
14001fae1mov eax, ebx
14001fae3pop rbx
14001fae4pop rsi
14001fae5ret
14001fa20
14001fa20SysNtReadVirtualMemory:
14001fa20push rsi
14001fa21xor eax, eax
14001fa23push rbx
14001fa24mov rbx, rcx
14001fa27sub rsp, 72
14001fa2bmov [rsp+48], rax
14001fa30mov rsi, [rsp+128]
14001fa38mov [rsp+56], rax
14001fa3dmov rax, [rip+51500]
14001fa44cmp [rax+218], 0
14001fa4bje 0x14001faa9
14001fa4dmov rcx, [rax+2028]
14001fa54test rcx, rcx
14001fa57je 0x14001faa9
14001fa59mov r10w, [rax+2078]
14001fa61test r10w, r10w
14001fa65je 0x14001faa9
14001fa67mov [rsp+48], rcx
14001fa6clea rcx, [rsp+48]
14001fa71mov [rsp+120], r9
14001fa76mov [rsp+112], r8
14001fa7bmov [rsp+104], rdx
14001fa80mov [rsp+56], r10w
14001fa86call SysSetConfig
14001fa8bmov [rsp+32], rsi
14001fa90mov r9, [rsp+120]
14001fa95mov rcx, rbx
14001fa98mov r8, [rsp+112]
14001fa9dmov rdx, [rsp+104]
14001faa2call SysInvoke
14001faa7jmp 0x14001fab7
14001faa9
14001faa9loc_14001faa9:
14001faa9mov [rsp+32], rsi
14001faaemov rcx, rbx
14001fab1call [rax+652]
14001fab7
14001fab7loc_14001fab7:
14001fab7mov [rsp+32], eax
14001fabblea r9, [rip+39009]
14001fac2mov ebx, eax
14001fac4mov r8l, 341
14001facalea rdx, [rip+53087]
14001fad1lea rcx, [rip+38536]
14001fad8call printf.constprop.0
14001faddadd rsp, 72
14001fae1mov eax, ebx
14001fae3pop rbx
14001fae4pop rsi
14001fae5ret
14001fa20
14001fae6
14001fae6 // align 0x10
14001fae6 // align 0x10
14001faf0
14001faf0SysNtResumeThread:
14001faf0push rbx
14001faf1xor eax, eax
14001faf3mov rbx, rcx
14001faf6sub rsp, 64
14001fafamov [rsp+48], rax
14001faffmov [rsp+56], rax
14001fb04mov rax, [rip+51301]
14001fb0bcmp [rax+218], 0
14001fb12je 0x14001fb57
14001fb14mov rcx, [rax+2028]
14001fb1btest rcx, rcx
14001fb1eje 0x14001fb57
14001fb20mov r8w, [rax+2056]
14001fb28test r8w, r8w
14001fb2cje 0x14001fb57
14001fb2emov [rsp+48], rcx
14001fb33lea rcx, [rsp+48]
14001fb38mov [rsp+88], rdx
14001fb3dmov [rsp+56], r8w
14001fb43call SysSetConfig
14001fb48mov rdx, [rsp+88]
14001fb4dmov rcx, rbx
14001fb50call SysInvoke
14001fb55jmp 0x14001fb60
14001fb57
14001fb57loc_14001fb57:
14001fb57mov rcx, rbx
14001fb5acall [rax+556]
14001fb60
14001fb60loc_14001fb60:
14001fb60mov [rsp+32], eax
14001fb64lea r9, [rip+38556]
14001fb6bmov ebx, eax
14001fb6dmov r8l, 123
14001fb73lea rdx, [rip+54118]
14001fb7alea rcx, [rip+38367]
14001fb81call printf.constprop.0
14001fb86add rsp, 64
14001fb8amov eax, ebx
14001fb8cpop rbx
14001fb8dret
14001faf0
14001faf0SysNtResumeThread:
14001faf0push rbx
14001faf1xor eax, eax
14001faf3mov rbx, rcx
14001faf6sub rsp, 64
14001fafamov [rsp+48], rax
14001faffmov [rsp+56], rax
14001fb04mov rax, [rip+51301]
14001fb0bcmp [rax+218], 0
14001fb12je 0x14001fb57
14001fb14mov rcx, [rax+2028]
14001fb1btest rcx, rcx
14001fb1eje 0x14001fb57
14001fb20mov r8w, [rax+2056]
14001fb28test r8w, r8w
14001fb2cje 0x14001fb57
14001fb2emov [rsp+48], rcx
14001fb33lea rcx, [rsp+48]
14001fb38mov [rsp+88], rdx
14001fb3dmov [rsp+56], r8w
14001fb43call SysSetConfig
14001fb48mov rdx, [rsp+88]
14001fb4dmov rcx, rbx
14001fb50call SysInvoke
14001fb55jmp 0x14001fb60
14001fb57
14001fb57loc_14001fb57:
14001fb57mov rcx, rbx
14001fb5acall [rax+556]
14001fb60
14001fb60loc_14001fb60:
14001fb60mov [rsp+32], eax
14001fb64lea r9, [rip+38556]
14001fb6bmov ebx, eax
14001fb6dmov r8l, 123
14001fb73lea rdx, [rip+54118]
14001fb7alea rcx, [rip+38367]
14001fb81call printf.constprop.0
14001fb86add rsp, 64
14001fb8amov eax, ebx
14001fb8cpop rbx
14001fb8dret
14001faf0
14001fb8e
14001fb8e // align 0x10
14001fb8e // align 0x10
14001fb90
14001fb90SysNtSetContextThread:
14001fb90push rbx
14001fb91xor eax, eax
14001fb93mov rbx, rcx
14001fb96sub rsp, 64
14001fb9amov [rsp+48], rax
14001fb9fmov [rsp+56], rax
14001fba4mov rax, [rip+51141]
14001fbabcmp [rax+218], 0
14001fbb2je 0x14001fbf7
14001fbb4mov rcx, [rax+2028]
14001fbbbtest rcx, rcx
14001fbbeje 0x14001fbf7
14001fbc0mov r8w, [rax+2066]
14001fbc8test r8w, r8w
14001fbccje 0x14001fbf7
14001fbcemov [rsp+48], rcx
14001fbd3lea rcx, [rsp+48]
14001fbd8mov [rsp+88], rdx
14001fbddmov [rsp+56], r8w
14001fbe3call SysSetConfig
14001fbe8mov rdx, [rsp+88]
14001fbedmov rcx, rbx
14001fbf0call SysInvoke
14001fbf5jmp 0x14001fc00
14001fbf7
14001fbf7loc_14001fbf7:
14001fbf7mov rcx, rbx
14001fbfacall [rax+596]
14001fc00
14001fc00loc_14001fc00:
14001fc00mov [rsp+32], eax
14001fc04lea r9, [rip+38479]
14001fc0bmov ebx, eax
14001fc0dmov r8l, 212
14001fc13lea rdx, [rip+53750]
14001fc1alea rcx, [rip+38207]
14001fc21call printf.constprop.0
14001fc26add rsp, 64
14001fc2amov eax, ebx
14001fc2cpop rbx
14001fc2dret
14001fb90
14001fb90SysNtSetContextThread:
14001fb90push rbx
14001fb91xor eax, eax
14001fb93mov rbx, rcx
14001fb96sub rsp, 64
14001fb9amov [rsp+48], rax
14001fb9fmov [rsp+56], rax
14001fba4mov rax, [rip+51141]
14001fbabcmp [rax+218], 0
14001fbb2je 0x14001fbf7
14001fbb4mov rcx, [rax+2028]
14001fbbbtest rcx, rcx
14001fbbeje 0x14001fbf7
14001fbc0mov r8w, [rax+2066]
14001fbc8test r8w, r8w
14001fbccje 0x14001fbf7
14001fbcemov [rsp+48], rcx
14001fbd3lea rcx, [rsp+48]
14001fbd8mov [rsp+88], rdx
14001fbddmov [rsp+56], r8w
14001fbe3call SysSetConfig
14001fbe8mov rdx, [rsp+88]
14001fbedmov rcx, rbx
14001fbf0call SysInvoke
14001fbf5jmp 0x14001fc00
14001fbf7
14001fbf7loc_14001fbf7:
14001fbf7mov rcx, rbx
14001fbfacall [rax+596]
14001fc00
14001fc00loc_14001fc00:
14001fc00mov [rsp+32], eax
14001fc04lea r9, [rip+38479]
14001fc0bmov ebx, eax
14001fc0dmov r8l, 212
14001fc13lea rdx, [rip+53750]
14001fc1alea rcx, [rip+38207]
14001fc21call printf.constprop.0
14001fc26add rsp, 64
14001fc2amov eax, ebx
14001fc2cpop rbx
14001fc2dret
14001fb90
14001fc2e
14001fc2e // align 0x10
14001fc2e // align 0x10
14001fc30
14001fc30SysNtSetInformationThread:
14001fc30push rbx
14001fc31xor eax, eax
14001fc33mov rbx, rcx
14001fc36sub rsp, 64
14001fc3amov [rsp+48], rax
14001fc3fmov [rsp+56], rax
14001fc44mov rax, [rip+50981]
14001fc4bcmp [rax+218], 0
14001fc52je 0x14001fca9
14001fc54mov rcx, [rax+2028]
14001fc5btest rcx, rcx
14001fc5eje 0x14001fca9
14001fc60mov r10w, [rax+2104]
14001fc68test r10w, r10w
14001fc6cje 0x14001fca9
14001fc6emov [rsp+48], rcx
14001fc73lea rcx, [rsp+48]
14001fc78mov [rsp+104], r9l
14001fc7dmov [rsp+96], r8
14001fc82mov [rsp+88], edx
14001fc86mov [rsp+56], r10w
14001fc8ccall SysSetConfig
14001fc91mov r9l, [rsp+104]
14001fc96mov r8, [rsp+96]
14001fc9bmov rcx, rbx
14001fc9emov edx, [rsp+88]
14001fca2call SysInvoke
14001fca7jmp 0x14001fcb2
14001fca9
14001fca9loc_14001fca9:
14001fca9mov rcx, rbx
14001fcaccall [rax+468]
14001fcb2
14001fcb2loc_14001fcb2:
14001fcb2mov [rsp+32], eax
14001fcb6lea r9, [rip+38683]
14001fcbdmov ebx, eax
14001fcbfmov r8l, 465
14001fcc5lea rdx, [rip+53316]
14001fccclea rcx, [rip+38029]
14001fcd3call printf.constprop.0
14001fcd8add rsp, 64
14001fcdcmov eax, ebx
14001fcdepop rbx
14001fcdfret
14001fc30
14001fc30SysNtSetInformationThread:
14001fc30push rbx
14001fc31xor eax, eax
14001fc33mov rbx, rcx
14001fc36sub rsp, 64
14001fc3amov [rsp+48], rax
14001fc3fmov [rsp+56], rax
14001fc44mov rax, [rip+50981]
14001fc4bcmp [rax+218], 0
14001fc52je 0x14001fca9
14001fc54mov rcx, [rax+2028]
14001fc5btest rcx, rcx
14001fc5eje 0x14001fca9
14001fc60mov r10w, [rax+2104]
14001fc68test r10w, r10w
14001fc6cje 0x14001fca9
14001fc6emov [rsp+48], rcx
14001fc73lea rcx, [rsp+48]
14001fc78mov [rsp+104], r9l
14001fc7dmov [rsp+96], r8
14001fc82mov [rsp+88], edx
14001fc86mov [rsp+56], r10w
14001fc8ccall SysSetConfig
14001fc91mov r9l, [rsp+104]
14001fc96mov r8, [rsp+96]
14001fc9bmov rcx, rbx
14001fc9emov edx, [rsp+88]
14001fca2call SysInvoke
14001fca7jmp 0x14001fcb2
14001fca9
14001fca9loc_14001fca9:
14001fca9mov rcx, rbx
14001fcaccall [rax+468]
14001fcb2
14001fcb2loc_14001fcb2:
14001fcb2mov [rsp+32], eax
14001fcb6lea r9, [rip+38683]
14001fcbdmov ebx, eax
14001fcbfmov r8l, 465
14001fcc5lea rdx, [rip+53316]
14001fccclea rcx, [rip+38029]
14001fcd3call printf.constprop.0
14001fcd8add rsp, 64
14001fcdcmov eax, ebx
14001fcdepop rbx
14001fcdfret
14001fc30
14001fce0
14001fce0SysNtSetInformationVirtualMemory:
14001fce0push rdi
14001fce1xor eax, eax
14001fce3push rsi
14001fce4push rbx
14001fce5mov rbx, rcx
14001fce8sub rsp, 64
14001fcecmov [rsp+48], rax
14001fcf1mov rsi, [rsp+128]
14001fcf9mov [rsp+56], rax
14001fcfemov rax, [rip+50795]
14001fd05mov edi, [rsp+136]
14001fd0ccmp [rax+218], 0
14001fd13je 0x14001fd73
14001fd15mov rcx, [rax+2028]
14001fd1ctest rcx, rcx
14001fd1fje 0x14001fd73
14001fd21mov r10w, [rax+2106]
14001fd29test r10w, r10w
14001fd2dje 0x14001fd73
14001fd2fmov [rsp+48], rcx
14001fd34lea rcx, [rsp+48]
14001fd39mov [rsp+120], r9
14001fd3emov [rsp+112], r8
14001fd43mov [rsp+104], edx
14001fd47mov [rsp+56], r10w
14001fd4dcall SysSetConfig
14001fd52mov [rsp+40], edi
14001fd56mov edx, [rsp+104]
14001fd5amov rcx, rbx
14001fd5dmov r9, [rsp+120]
14001fd62mov r8, [rsp+112]
14001fd67mov [rsp+32], rsi
14001fd6ccall SysInvoke
14001fd71jmp 0x14001fd85
14001fd73
14001fd73loc_14001fd73:
14001fd73mov [rsp+40], edi
14001fd77mov rcx, rbx
14001fd7amov [rsp+32], rsi
14001fd7fcall [rax+476]
14001fd85
14001fd85loc_14001fd85:
14001fd85mov [rsp+32], eax
14001fd89lea r9, [rip+38495]
14001fd90mov ebx, eax
14001fd92mov r8l, 481
14001fd98lea rdx, [rip+51969]
14001fd9flea rcx, [rip+37818]
14001fda6call printf.constprop.0
14001fdabadd rsp, 64
14001fdafmov eax, ebx
14001fdb1pop rbx
14001fdb2pop rsi
14001fdb3pop rdi
14001fdb4ret
14001fce0
14001fce0SysNtSetInformationVirtualMemory:
14001fce0push rdi
14001fce1xor eax, eax
14001fce3push rsi
14001fce4push rbx
14001fce5mov rbx, rcx
14001fce8sub rsp, 64
14001fcecmov [rsp+48], rax
14001fcf1mov rsi, [rsp+128]
14001fcf9mov [rsp+56], rax
14001fcfemov rax, [rip+50795]
14001fd05mov edi, [rsp+136]
14001fd0ccmp [rax+218], 0
14001fd13je 0x14001fd73
14001fd15mov rcx, [rax+2028]
14001fd1ctest rcx, rcx
14001fd1fje 0x14001fd73
14001fd21mov r10w, [rax+2106]
14001fd29test r10w, r10w
14001fd2dje 0x14001fd73
14001fd2fmov [rsp+48], rcx
14001fd34lea rcx, [rsp+48]
14001fd39mov [rsp+120], r9
14001fd3emov [rsp+112], r8
14001fd43mov [rsp+104], edx
14001fd47mov [rsp+56], r10w
14001fd4dcall SysSetConfig
14001fd52mov [rsp+40], edi
14001fd56mov edx, [rsp+104]
14001fd5amov rcx, rbx
14001fd5dmov r9, [rsp+120]
14001fd62mov r8, [rsp+112]
14001fd67mov [rsp+32], rsi
14001fd6ccall SysInvoke
14001fd71jmp 0x14001fd85
14001fd73
14001fd73loc_14001fd73:
14001fd73mov [rsp+40], edi
14001fd77mov rcx, rbx
14001fd7amov [rsp+32], rsi
14001fd7fcall [rax+476]
14001fd85
14001fd85loc_14001fd85:
14001fd85mov [rsp+32], eax
14001fd89lea r9, [rip+38495]
14001fd90mov ebx, eax
14001fd92mov r8l, 481
14001fd98lea rdx, [rip+51969]
14001fd9flea rcx, [rip+37818]
14001fda6call printf.constprop.0
14001fdabadd rsp, 64
14001fdafmov eax, ebx
14001fdb1pop rbx
14001fdb2pop rsi
14001fdb3pop rdi
14001fdb4ret
14001fce0
14001fdb5
14001fdb5 // align 0x10
14001fdb5 // align 0x10
14001fdc0
14001fdc0SysNtSignalAndWaitForSingleObject:
14001fdc0push rbx
14001fdc1xor eax, eax
14001fdc3mov rbx, rcx
14001fdc6movzx r8l, r8b
14001fdcasub rsp, 80
14001fdcemov [rsp+64], rax
14001fdd3mov [rsp+72], rax
14001fdd8mov rax, [rip+50577]
14001fddfcmp [rax+218], 0
14001fde6je 0x14001fe3f
14001fde8mov rcx, [rax+2028]
14001fdeftest rcx, rcx
14001fdf2je 0x14001fe3f
14001fdf4mov r10w, [rax+2090]
14001fdfctest r10w, r10w
14001fe00je 0x14001fe3f
14001fe02mov [rsp+64], rcx
14001fe07lea rcx, [rsp+64]
14001fe0cmov [rsp+120], r9
14001fe11mov [rsp+104], rdx
14001fe16mov [rsp+60], r8l
14001fe1bmov [rsp+72], r10w
14001fe21call SysSetConfig
14001fe26mov r9, [rsp+120]
14001fe2bmov r8l, [rsp+60]
14001fe30mov rcx, rbx
14001fe33mov rdx, [rsp+104]
14001fe38call SysInvoke
14001fe3djmp 0x14001fe48
14001fe3f
14001fe3floc_14001fe3f:
14001fe3fmov rcx, rbx
14001fe42call [rax+708]
14001fe48
14001fe48loc_14001fe48:
14001fe48mov [rsp+32], eax
14001fe4clea r9, [rip+38154]
14001fe53mov ebx, eax
14001fe55mov r8l, 379
14001fe5blea rdx, [rip+54686]
14001fe62lea rcx, [rip+37623]
14001fe69call printf.constprop.0
14001fe6eadd rsp, 80
14001fe72mov eax, ebx
14001fe74pop rbx
14001fe75ret
14001fdc0
14001fdc0SysNtSignalAndWaitForSingleObject:
14001fdc0push rbx
14001fdc1xor eax, eax
14001fdc3mov rbx, rcx
14001fdc6movzx r8l, r8b
14001fdcasub rsp, 80
14001fdcemov [rsp+64], rax
14001fdd3mov [rsp+72], rax
14001fdd8mov rax, [rip+50577]
14001fddfcmp [rax+218], 0
14001fde6je 0x14001fe3f
14001fde8mov rcx, [rax+2028]
14001fdeftest rcx, rcx
14001fdf2je 0x14001fe3f
14001fdf4mov r10w, [rax+2090]
14001fdfctest r10w, r10w
14001fe00je 0x14001fe3f
14001fe02mov [rsp+64], rcx
14001fe07lea rcx, [rsp+64]
14001fe0cmov [rsp+120], r9
14001fe11mov [rsp+104], rdx
14001fe16mov [rsp+60], r8l
14001fe1bmov [rsp+72], r10w
14001fe21call SysSetConfig
14001fe26mov r9, [rsp+120]
14001fe2bmov r8l, [rsp+60]
14001fe30mov rcx, rbx
14001fe33mov rdx, [rsp+104]
14001fe38call SysInvoke
14001fe3djmp 0x14001fe48
14001fe3f
14001fe3floc_14001fe3f:
14001fe3fmov rcx, rbx
14001fe42call [rax+708]
14001fe48
14001fe48loc_14001fe48:
14001fe48mov [rsp+32], eax
14001fe4clea r9, [rip+38154]
14001fe53mov ebx, eax
14001fe55mov r8l, 379
14001fe5blea rdx, [rip+54686]
14001fe62lea rcx, [rip+37623]
14001fe69call printf.constprop.0
14001fe6eadd rsp, 80
14001fe72mov eax, ebx
14001fe74pop rbx
14001fe75ret
14001fdc0
14001fe76
14001fe76 // align 0x10
14001fe76 // align 0x10
14001fe80
14001fe80SysNtSuspendThread:
14001fe80push rbx
14001fe81xor eax, eax
14001fe83mov rbx, rcx
14001fe86sub rsp, 64
14001fe8amov [rsp+48], rax
14001fe8fmov [rsp+56], rax
14001fe94mov rax, [rip+50389]
14001fe9bcmp [rax+218], 0
14001fea2je 0x14001fee7
14001fea4mov rcx, [rax+2028]
14001feabtest rcx, rcx
14001feaeje 0x14001fee7
14001feb0mov r8w, [rax+2054]
14001feb8test r8w, r8w
14001febcje 0x14001fee7
14001febemov [rsp+48], rcx
14001fec3lea rcx, [rsp+48]
14001fec8mov [rsp+88], rdx
14001fecdmov [rsp+56], r8w
14001fed3call SysSetConfig
14001fed8mov rdx, [rsp+88]
14001feddmov rcx, rbx
14001fee0call SysInvoke
14001fee5jmp 0x14001fef0
14001fee7
14001fee7loc_14001fee7:
14001fee7mov rcx, rbx
14001feeacall [rax+548]
14001fef0
14001fef0loc_14001fef0:
14001fef0mov [rsp+32], eax
14001fef4lea r9, [rip+37628]
14001fefbmov ebx, eax
14001fefdmov r8l, 111
14001ff03lea rdx, [rip+53238]
14001ff0alea rcx, [rip+37455]
14001ff11call printf.constprop.0
14001ff16add rsp, 64
14001ff1amov eax, ebx
14001ff1cpop rbx
14001ff1dret
14001fe80
14001fe80SysNtSuspendThread:
14001fe80push rbx
14001fe81xor eax, eax
14001fe83mov rbx, rcx
14001fe86sub rsp, 64
14001fe8amov [rsp+48], rax
14001fe8fmov [rsp+56], rax
14001fe94mov rax, [rip+50389]
14001fe9bcmp [rax+218], 0
14001fea2je 0x14001fee7
14001fea4mov rcx, [rax+2028]
14001feabtest rcx, rcx
14001feaeje 0x14001fee7
14001feb0mov r8w, [rax+2054]
14001feb8test r8w, r8w
14001febcje 0x14001fee7
14001febemov [rsp+48], rcx
14001fec3lea rcx, [rsp+48]
14001fec8mov [rsp+88], rdx
14001fecdmov [rsp+56], r8w
14001fed3call SysSetConfig
14001fed8mov rdx, [rsp+88]
14001feddmov rcx, rbx
14001fee0call SysInvoke
14001fee5jmp 0x14001fef0
14001fee7
14001fee7loc_14001fee7:
14001fee7mov rcx, rbx
14001feeacall [rax+548]
14001fef0
14001fef0loc_14001fef0:
14001fef0mov [rsp+32], eax
14001fef4lea r9, [rip+37628]
14001fefbmov ebx, eax
14001fefdmov r8l, 111
14001ff03lea rdx, [rip+53238]
14001ff0alea rcx, [rip+37455]
14001ff11call printf.constprop.0
14001ff16add rsp, 64
14001ff1amov eax, ebx
14001ff1cpop rbx
14001ff1dret
14001fe80
14001ff1e
14001ff1e // align 0x10
14001ff1e // align 0x10
14001ff20
14001ff20SysNtTerminateProcess:
14001ff20push rbx
14001ff21xor eax, eax
14001ff23mov rbx, rcx
14001ff26sub rsp, 64
14001ff2amov [rsp+48], rax
14001ff2fmov [rsp+56], rax
14001ff34mov rax, [rip+50229]
14001ff3bcmp [rax+218], 0
14001ff42je 0x14001ff85
14001ff44mov rcx, [rax+2028]
14001ff4btest rcx, rcx
14001ff4eje 0x14001ff85
14001ff50mov r8w, [rax+2044]
14001ff58test r8w, r8w
14001ff5cje 0x14001ff85
14001ff5emov [rsp+48], rcx
14001ff63lea rcx, [rsp+48]
14001ff68mov [rsp+88], edx
14001ff6cmov [rsp+56], r8w
14001ff72call SysSetConfig
14001ff77mov edx, [rsp+88]
14001ff7bmov rcx, rbx
14001ff7ecall SysInvoke
14001ff83jmp 0x14001ff8e
14001ff85
14001ff85loc_14001ff85:
14001ff85mov rcx, rbx
14001ff88call [rax+508]
14001ff8e
14001ff8eloc_14001ff8e:
14001ff8emov [rsp+32], eax
14001ff92lea r9, [rip+37380]
14001ff99mov ebx, eax
14001ff9bmov r8l, 41
14001ffa1lea rdx, [rip+53512]
14001ffa8lea rcx, [rip+37297]
14001ffafcall printf.constprop.0
14001ffb4add rsp, 64
14001ffb8mov eax, ebx
14001ffbapop rbx
14001ffbbret
14001ff20
14001ff20SysNtTerminateProcess:
14001ff20push rbx
14001ff21xor eax, eax
14001ff23mov rbx, rcx
14001ff26sub rsp, 64
14001ff2amov [rsp+48], rax
14001ff2fmov [rsp+56], rax
14001ff34mov rax, [rip+50229]
14001ff3bcmp [rax+218], 0
14001ff42je 0x14001ff85
14001ff44mov rcx, [rax+2028]
14001ff4btest rcx, rcx
14001ff4eje 0x14001ff85
14001ff50mov r8w, [rax+2044]
14001ff58test r8w, r8w
14001ff5cje 0x14001ff85
14001ff5emov [rsp+48], rcx
14001ff63lea rcx, [rsp+48]
14001ff68mov [rsp+88], edx
14001ff6cmov [rsp+56], r8w
14001ff72call SysSetConfig
14001ff77mov edx, [rsp+88]
14001ff7bmov rcx, rbx
14001ff7ecall SysInvoke
14001ff83jmp 0x14001ff8e
14001ff85
14001ff85loc_14001ff85:
14001ff85mov rcx, rbx
14001ff88call [rax+508]
14001ff8e
14001ff8eloc_14001ff8e:
14001ff8emov [rsp+32], eax
14001ff92lea r9, [rip+37380]
14001ff99mov ebx, eax
14001ff9bmov r8l, 41
14001ffa1lea rdx, [rip+53512]
14001ffa8lea rcx, [rip+37297]
14001ffafcall printf.constprop.0
14001ffb4add rsp, 64
14001ffb8mov eax, ebx
14001ffbapop rbx
14001ffbbret
14001ff20
14001ffbc
14001ffbc // align 0x10
14001ffbc // align 0x10
14001ffc0
14001ffc0SysNtTerminateThread:
14001ffc0push rbx
14001ffc1xor eax, eax
14001ffc3mov rbx, rcx
14001ffc6sub rsp, 64
14001ffcamov [rsp+48], rax
14001ffcfmov [rsp+56], rax
14001ffd4mov rax, [rip+50069]
14001ffdbcmp [rax+218], 0
14001ffe2je 0x140020025
14001ffe4mov rcx, [rax+2028]
14001ffebtest rcx, rcx
14001ffeeje 0x140020025
14001fff0mov r8w, [rax+2086]
14001fff8test r8w, r8w
14001fffcje 0x140020025
14001fffemov [rsp+48], rcx
140020003lea rcx, [rsp+48]
140020008mov [rsp+88], edx
14002000cmov [rsp+56], r8w
140020012call SysSetConfig
140020017mov edx, [rsp+88]
14002001bmov rcx, rbx
14002001ecall SysInvoke
140020023jmp 0x14002002e
140020025
140020025loc_140020025:
140020025mov rcx, rbx
140020028call [rax+684]
14002002e
14002002eloc_14002002e:
14002002emov [rsp+32], eax
140020032lea r9, [rip+37630]
140020039mov ebx, eax
14002003bmov r8l, 353
140020041lea rdx, [rip+51560]
140020048lea rcx, [rip+37137]
14002004fcall printf.constprop.0
140020054add rsp, 64
140020058mov eax, ebx
14002005apop rbx
14002005bret
14001ffc0
14001ffc0SysNtTerminateThread:
14001ffc0push rbx
14001ffc1xor eax, eax
14001ffc3mov rbx, rcx
14001ffc6sub rsp, 64
14001ffcamov [rsp+48], rax
14001ffcfmov [rsp+56], rax
14001ffd4mov rax, [rip+50069]
14001ffdbcmp [rax+218], 0
14001ffe2je 0x140020025
14001ffe4mov rcx, [rax+2028]
14001ffebtest rcx, rcx
14001ffeeje 0x140020025
14001fff0mov r8w, [rax+2086]
14001fff8test r8w, r8w
14001fffcje 0x140020025
14001fffemov [rsp+48], rcx
140020003lea rcx, [rsp+48]
140020008mov [rsp+88], edx
14002000cmov [rsp+56], r8w
140020012call SysSetConfig
140020017mov edx, [rsp+88]
14002001bmov rcx, rbx
14002001ecall SysInvoke
140020023jmp 0x14002002e
140020025
140020025loc_140020025:
140020025mov rcx, rbx
140020028call [rax+684]
14002002e
14002002eloc_14002002e:
14002002emov [rsp+32], eax
140020032lea r9, [rip+37630]
140020039mov ebx, eax
14002003bmov r8l, 353
140020041lea rdx, [rip+51560]
140020048lea rcx, [rip+37137]
14002004fcall printf.constprop.0
140020054add rsp, 64
140020058mov eax, ebx
14002005apop rbx
14002005bret
14001ffc0
14002005c
14002005c // align 0x10
14002005c // align 0x10
140020060
140020060SysNtUnmapViewOfSection:
140020060push rbx
140020061xor eax, eax
140020063mov rbx, rcx
140020066sub rsp, 64
14002006amov [rsp+48], rax
14002006fmov [rsp+56], rax
140020074mov rax, [rip+49909]
14002007bcmp [rax+218], 0
140020082je 0x1400200c7
140020084mov rcx, [rax+2028]
14002008btest rcx, rcx
14002008eje 0x1400200c7
140020090mov r8w, [rax+2082]
140020098test r8w, r8w
14002009cje 0x1400200c7
14002009emov [rsp+48], rcx
1400200a3lea rcx, [rsp+48]
1400200a8mov [rsp+88], rdx
1400200admov [rsp+56], r8w
1400200b3call SysSetConfig
1400200b8mov rdx, [rsp+88]
1400200bdmov rcx, rbx
1400200c0call SysInvoke
1400200c5jmp 0x1400200d0
1400200c7
1400200c7loc_1400200c7:
1400200c7mov rcx, rbx
1400200cacall [rax+668]
1400200d0
1400200d0loc_1400200d0:
1400200d0mov [rsp+32], eax
1400200d4lea r9, [rip+37404]
1400200dbmov ebx, eax
1400200ddmov r8l, 311
1400200e3lea rdx, [rip+51718]
1400200ealea rcx, [rip+36975]
1400200f1call printf.constprop.0
1400200f6add rsp, 64
1400200famov eax, ebx
1400200fcpop rbx
1400200fdret
140020060
140020060SysNtUnmapViewOfSection:
140020060push rbx
140020061xor eax, eax
140020063mov rbx, rcx
140020066sub rsp, 64
14002006amov [rsp+48], rax
14002006fmov [rsp+56], rax
140020074mov rax, [rip+49909]
14002007bcmp [rax+218], 0
140020082je 0x1400200c7
140020084mov rcx, [rax+2028]
14002008btest rcx, rcx
14002008eje 0x1400200c7
140020090mov r8w, [rax+2082]
140020098test r8w, r8w
14002009cje 0x1400200c7
14002009emov [rsp+48], rcx
1400200a3lea rcx, [rsp+48]
1400200a8mov [rsp+88], rdx
1400200admov [rsp+56], r8w
1400200b3call SysSetConfig
1400200b8mov rdx, [rsp+88]
1400200bdmov rcx, rbx
1400200c0call SysInvoke
1400200c5jmp 0x1400200d0
1400200c7
1400200c7loc_1400200c7:
1400200c7mov rcx, rbx
1400200cacall [rax+668]
1400200d0
1400200d0loc_1400200d0:
1400200d0mov [rsp+32], eax
1400200d4lea r9, [rip+37404]
1400200dbmov ebx, eax
1400200ddmov r8l, 311
1400200e3lea rdx, [rip+51718]
1400200ealea rcx, [rip+36975]
1400200f1call printf.constprop.0
1400200f6add rsp, 64
1400200famov eax, ebx
1400200fcpop rbx
1400200fdret
140020060
1400200fe
1400200fe // align 0x10
1400200fe // align 0x10
140020100
140020100SysNtWaitForSingleObject:
140020100push rbx
140020101xor eax, eax
140020103mov rbx, rcx
140020106movzx edx, dl
140020109sub rsp, 80
14002010dmov [rsp+64], rax
140020112mov [rsp+72], rax
140020117mov rax, [rip+49746]
14002011ecmp [rax+218], 0
140020125je 0x140020172
140020127mov rcx, [rax+2028]
14002012etest rcx, rcx
140020131je 0x140020172
140020133mov r9w, [rax+2072]
14002013btest r9w, r9w
14002013fje 0x140020172
140020141mov [rsp+64], rcx
140020146lea rcx, [rsp+64]
14002014bmov [rsp+112], r8
140020150mov [rsp+60], edx
140020154mov [rsp+72], r9w
14002015acall SysSetConfig
14002015fmov r8, [rsp+112]
140020164mov edx, [rsp+60]
140020168mov rcx, rbx
14002016bcall SysInvoke
140020170jmp 0x14002017b
140020172
140020172loc_140020172:
140020172mov rcx, rbx
140020175call [rax+620]
14002017b
14002017bloc_14002017b:
14002017bmov [rsp+32], eax
14002017flea r9, [rip+37146]
140020186mov ebx, eax
140020188mov r8l, 254
14002018elea rdx, [rip+51787]
140020195lea rcx, [rip+36804]
14002019ccall printf.constprop.0
1400201a1add rsp, 80
1400201a5mov eax, ebx
1400201a7pop rbx
1400201a8ret
140020100
140020100SysNtWaitForSingleObject:
140020100push rbx
140020101xor eax, eax
140020103mov rbx, rcx
140020106movzx edx, dl
140020109sub rsp, 80
14002010dmov [rsp+64], rax
140020112mov [rsp+72], rax
140020117mov rax, [rip+49746]
14002011ecmp [rax+218], 0
140020125je 0x140020172
140020127mov rcx, [rax+2028]
14002012etest rcx, rcx
140020131je 0x140020172
140020133mov r9w, [rax+2072]
14002013btest r9w, r9w
14002013fje 0x140020172
140020141mov [rsp+64], rcx
140020146lea rcx, [rsp+64]
14002014bmov [rsp+112], r8
140020150mov [rsp+60], edx
140020154mov [rsp+72], r9w
14002015acall SysSetConfig
14002015fmov r8, [rsp+112]
140020164mov edx, [rsp+60]
140020168mov rcx, rbx
14002016bcall SysInvoke
140020170jmp 0x14002017b
140020172
140020172loc_140020172:
140020172mov rcx, rbx
140020175call [rax+620]
14002017b
14002017bloc_14002017b:
14002017bmov [rsp+32], eax
14002017flea r9, [rip+37146]
140020186mov ebx, eax
140020188mov r8l, 254
14002018elea rdx, [rip+51787]
140020195lea rcx, [rip+36804]
14002019ccall printf.constprop.0
1400201a1add rsp, 80
1400201a5mov eax, ebx
1400201a7pop rbx
1400201a8ret
140020100
1400201a9
1400201a9 // align 0x10
1400201a9 // align 0x10
1400201b0
1400201b0SysNtWriteVirtualMemory:
1400201b0push rsi
1400201b1xor eax, eax
1400201b3push rbx
1400201b4mov rbx, rcx
1400201b7sub rsp, 72
1400201bbmov [rsp+48], rax
1400201c0mov rsi, [rsp+128]
1400201c8mov [rsp+56], rax
1400201cdmov rax, [rip+49564]
1400201d4cmp [rax+218], 0
1400201dbje 0x140020239
1400201ddmov rcx, [rax+2028]
1400201e4test rcx, rcx
1400201e7je 0x140020239
1400201e9mov r10w, [rax+2076]
1400201f1test r10w, r10w
1400201f5je 0x140020239
1400201f7mov [rsp+48], rcx
1400201fclea rcx, [rsp+48]
140020201mov [rsp+120], r9
140020206mov [rsp+112], r8
14002020bmov [rsp+104], rdx
140020210mov [rsp+56], r10w
140020216call SysSetConfig
14002021bmov [rsp+32], rsi
140020220mov r9, [rsp+120]
140020225mov rcx, rbx
140020228mov r8, [rsp+112]
14002022dmov rdx, [rsp+104]
140020232call SysInvoke
140020237jmp 0x140020247
140020239
140020239loc_140020239:
140020239mov [rsp+32], rsi
14002023emov rcx, rbx
140020241call [rax+644]
140020247
140020247loc_140020247:
140020247mov [rsp+32], eax
14002024blea r9, [rip+36988]
140020252mov ebx, eax
140020254mov r8l, 285
14002025alea rdx, [rip+51487]
140020261lea rcx, [rip+36600]
140020268call printf.constprop.0
14002026dadd rsp, 72
140020271mov eax, ebx
140020273pop rbx
140020274pop rsi
140020275ret
1400201b0
1400201b0SysNtWriteVirtualMemory:
1400201b0push rsi
1400201b1xor eax, eax
1400201b3push rbx
1400201b4mov rbx, rcx
1400201b7sub rsp, 72
1400201bbmov [rsp+48], rax
1400201c0mov rsi, [rsp+128]
1400201c8mov [rsp+56], rax
1400201cdmov rax, [rip+49564]
1400201d4cmp [rax+218], 0
1400201dbje 0x140020239
1400201ddmov rcx, [rax+2028]
1400201e4test rcx, rcx
1400201e7je 0x140020239
1400201e9mov r10w, [rax+2076]
1400201f1test r10w, r10w
1400201f5je 0x140020239
1400201f7mov [rsp+48], rcx
1400201fclea rcx, [rsp+48]
140020201mov [rsp+120], r9
140020206mov [rsp+112], r8
14002020bmov [rsp+104], rdx
140020210mov [rsp+56], r10w
140020216call SysSetConfig
14002021bmov [rsp+32], rsi
140020220mov r9, [rsp+120]
140020225mov rcx, rbx
140020228mov r8, [rsp+112]
14002022dmov rdx, [rsp+104]
140020232call SysInvoke
140020237jmp 0x140020247
140020239
140020239loc_140020239:
140020239mov [rsp+32], rsi
14002023emov rcx, rbx
140020241call [rax+644]
140020247
140020247loc_140020247:
140020247mov [rsp+32], eax
14002024blea r9, [rip+36988]
140020252mov ebx, eax
140020254mov r8l, 285
14002025alea rdx, [rip+51487]
140020261lea rcx, [rip+36600]
140020268call printf.constprop.0
14002026dadd rsp, 72
140020271mov eax, ebx
140020273pop rbx
140020274pop rsi
140020275ret
1400201b0
140020276
140020276 // align 0x10
140020276 // align 0x10
140020280
140020280ThreadCreate:
140020280push rsi
140020281mov rax, rdx
140020284push rbx
140020285xor ebx, ebx
140020287sub rsp, 168
14002028emov [rsp+96], rbx
140020293mov rdx, [rsp+224]
14002029bmov rsi, [rsp+232]
1400202a3cmp cl, 2
1400202a6je 0x140020326
1400202a8ja 0x1400202ca
1400202aatest cl, cl
1400202acjne 0x1400202f5
1400202aemov [rsp+32], rdx
1400202b3mov ecx, 2
1400202b8mov rdx, rax
1400202bbmov [rsp+40], rsi
1400202c0call ThreadCreate
1400202c5jmp 0x1400203f9
1400202ca
1400202caloc_1400202ca:
1400202cacmp cl, 3
1400202cdje 0x1400203f4
1400202d3movzx r9l, cl
1400202d7mov r8l, 276
1400202ddlea rdx, [rip+50156]
1400202e4lea rcx, [rip+38419]
1400202ebcall printf
1400202f0jmp 0x1400203f4
1400202f5
1400202f5loc_1400202f5:
1400202f5mov rcx, rax
1400202f8mov rax, [rip+49265]
1400202ffxor r11l, r11l
140020302xor r8l, r8l
140020305mov [rsp+32], rdx
14002030axor edx, edx
14002030cmov [rsp+48], rsi
140020311mov [rsp+40], r11l
140020316call [rax+764]
14002031cmov [rsp+96], rax
140020321jmp 0x1400203f4
140020326
140020326loc_140020326:
140020326lea r8, [rsp+120]
14002032bxor r10l, r10l
14002032exor ecx, ecx
140020330mov [rsp+40], rdx
140020335mov [rsp+80], r8
14002033axor r8l, r8l
14002033dmov edx, 0x1fffff
140020342mov [rsp+72], r8
140020347mov [rsp+64], r8
14002034cmov [rsp+56], r8
140020351xor r8l, r8l
140020354mov [rsp+32], r9
140020359mov r9, rax
14002035cmov [rsp+48], r10l
140020361mov [rsp+152], rcx
140020369mov [rsp+104], rcx
14002036emov [rsp+112], rcx
140020373lea rcx, [rsp+104]
140020378mov [rsp+144], rcx
140020380lea rcx, [rsp+96]
140020385mov [rsp+128], 0x10003
140020391mov [rsp+136], 16
14002039dmov [rsp+120], 40
1400203a6call SysNtCreateThreadEx
1400203abmov ebx, eax
1400203adtest eax, eax
1400203afjs 0x1400203bf
1400203b1test rsi, rsi
1400203b4je 0x1400203f4
1400203b6mov rax, [rsp+112]
1400203bbmov [rsi], eax
1400203bdjmp 0x1400203f4
1400203bf
1400203bfloc_1400203bf:
1400203bfmov r9l, eax
1400203c2mov r8l, 263
1400203c8lea rdx, [rip+49921]
1400203cflea rcx, [rip+38122]
1400203d6call printf
1400203dbmov rax, [rip+49038]
1400203e2mov ecx, ebx
1400203e4mov rsi, [rax+2230]
1400203ebcall [rax+348]
1400203f1mov [rsi+104], eax
1400203f4
1400203f4loc_1400203f4:
1400203f4mov rax, [rsp+96]
1400203f9
1400203f9loc_1400203f9:
1400203f9add rsp, 168
140020400pop rbx
140020401pop rsi
140020402ret
140020280
140020280ThreadCreate:
140020280push rsi
140020281mov rax, rdx
140020284push rbx
140020285xor ebx, ebx
140020287sub rsp, 168
14002028emov [rsp+96], rbx
140020293mov rdx, [rsp+224]
14002029bmov rsi, [rsp+232]
1400202a3cmp cl, 2
1400202a6je 0x140020326
1400202a8ja 0x1400202ca
1400202aatest cl, cl
1400202acjne 0x1400202f5
1400202aemov [rsp+32], rdx
1400202b3mov ecx, 2
1400202b8mov rdx, rax
1400202bbmov [rsp+40], rsi
1400202c0call ThreadCreate
1400202c5jmp 0x1400203f9
1400202ca
1400202caloc_1400202ca:
1400202cacmp cl, 3
1400202cdje 0x1400203f4
1400202d3movzx r9l, cl
1400202d7mov r8l, 276
1400202ddlea rdx, [rip+50156]
1400202e4lea rcx, [rip+38419]
1400202ebcall printf
1400202f0jmp 0x1400203f4
1400202f5
1400202f5loc_1400202f5:
1400202f5mov rcx, rax
1400202f8mov rax, [rip+49265]
1400202ffxor r11l, r11l
140020302xor r8l, r8l
140020305mov [rsp+32], rdx
14002030axor edx, edx
14002030cmov [rsp+48], rsi
140020311mov [rsp+40], r11l
140020316call [rax+764]
14002031cmov [rsp+96], rax
140020321jmp 0x1400203f4
140020326
140020326loc_140020326:
140020326lea r8, [rsp+120]
14002032bxor r10l, r10l
14002032exor ecx, ecx
140020330mov [rsp+40], rdx
140020335mov [rsp+80], r8
14002033axor r8l, r8l
14002033dmov edx, 0x1fffff
140020342mov [rsp+72], r8
140020347mov [rsp+64], r8
14002034cmov [rsp+56], r8
140020351xor r8l, r8l
140020354mov [rsp+32], r9
140020359mov r9, rax
14002035cmov [rsp+48], r10l
140020361mov [rsp+152], rcx
140020369mov [rsp+104], rcx
14002036emov [rsp+112], rcx
140020373lea rcx, [rsp+104]
140020378mov [rsp+144], rcx
140020380lea rcx, [rsp+96]
140020385mov [rsp+128], 0x10003
140020391mov [rsp+136], 16
14002039dmov [rsp+120], 40
1400203a6call SysNtCreateThreadEx
1400203abmov ebx, eax
1400203adtest eax, eax
1400203afjs 0x1400203bf
1400203b1test rsi, rsi
1400203b4je 0x1400203f4
1400203b6mov rax, [rsp+112]
1400203bbmov [rsi], eax
1400203bdjmp 0x1400203f4
1400203bf
1400203bfloc_1400203bf:
1400203bfmov r9l, eax
1400203c2mov r8l, 263
1400203c8lea rdx, [rip+49921]
1400203cflea rcx, [rip+38122]
1400203d6call printf
1400203dbmov rax, [rip+49038]
1400203e2mov ecx, ebx
1400203e4mov rsi, [rax+2230]
1400203ebcall [rax+348]
1400203f1mov [rsi+104], eax
1400203f4
1400203f4loc_1400203f4:
1400203f4mov rax, [rsp+96]
1400203f9
1400203f9loc_1400203f9:
1400203f9add rsp, 168
140020400pop rbx
140020401pop rsi
140020402ret
140020280
140020403
140020403 // align 0x10
140020403 // align 0x10
140020410
140020410ThreadQueryTib:
140020410push rbp
140020411xor eax, eax
140020413xor r10l, r10l
140020416xor r11l, r11l
140020419mov rbp, rsp
14002041cpush r15
14002041epush r14
140020420mov r14, 0x1000000040
14002042apush r13
14002042cpush r12
14002042epush rdi
14002042fpush rsi
140020430mov rsi, rdx
140020433push rbx
140020434xor ebx, ebx
140020436and rsp, -16
14002043asub rsp, 1456
140020441mov [rbp+16], rcx
140020445mov ecx, 12
14002044amov [rsp+96], r10
14002044flea r12, [rsp+88]
140020454lea r15, [rsp+112]
140020459lea rdi, [rsp+128]
140020461mov [rsp+104], r10
140020466rep stosd [rdi], eax
140020468mov ecx, 12
14002046dmov [rsp+112], r11
140020472lea rdi, [rsp+176]
14002047arep stosd [rdi], eax
14002047cmov ecx, 308
140020481mov [rsp+120], r11
140020486lea rdi, [rsp+224]
14002048erep stosd [rdi], eax
140020490mov rax, [rip+48857]
140020497mov [rsp+88], rbx
14002049cxor ebx, ebx
14002049emov [rsp+272], 0x10000b
1400204a9mov rax, [rax+2230]
1400204b0mov r13, [rax+72]
1400204b4lea rax, [rsp+128]
1400204bcmov [rsp+72], rax
1400204c1lea rax, [rsp+176]
1400204c9mov [rsp+64], rax
1400204celea rax, [rsp+224]
1400204d6mov [rsp+56], rax
1400204db
1400204dbloc_1400204db:
1400204dbxor eax, eax
1400204ddmov [rsp+40], r12
1400204e2xor r9l, r9l
1400204e5or rcx, -1
1400204e9mov [rsp+32], eax
1400204edmov r8l, 0x1fffff
1400204f3mov rdx, rbx
1400204f6call SysNtGetNextThread
1400204fbtest eax, eax
1400204fdjs 0x140020638
140020503test rbx, rbx
140020506je 0x140020510
140020508mov rcx, rbx
14002050bcall SysNtClose
140020510
140020510loc_140020510:
140020510xor r9l, r9l
140020513mov rbx, [rsp+88]
140020518lea rdi, [rsp+96]
14002051dmov edx, 26
140020522mov [rsp+32], r9
140020527mov r8, rdi
14002052amov r9l, 16
140020530mov rcx, rbx
140020533mov [rsp+104], r14
140020538mov [rsp+96], r15
14002053dcall SysNtQueryInformationThread
140020542test eax, eax
140020544js 0x1400204db
140020546mov eax, r13l
140020549cmp [rsp+120], rax
14002054eje 0x1400204db
140020550xor edx, edx
140020552mov rcx, rbx
140020555call SysNtSuspendThread
14002055atest eax, eax
14002055cjs 0x1400204db
140020562mov rdx, [rsp+56]
140020567mov rcx, rbx
14002056acall SysNtGetContextThread
14002056ftest eax, eax
140020571js 0x140020629
140020577xor r8l, r8l
14002057amov r9, [rsp+72]
14002057for rcx, -1
140020583mov [rsp+32], 48
14002058cmov [rsp+40], r8
140020591mov rdx, [rsp+376]
140020599xor r8l, r8l
14002059ccall SysNtQueryVirtualMemory
1400205a1test eax, eax
1400205a3js 0x140020629
1400205a9xor ecx, ecx
1400205abmov r9, [rsp+64]
1400205b0xor r8l, r8l
1400205b3mov [rsp+32], 48
1400205bcmov [rsp+40], rcx
1400205c1mov rdx, [rbp+16]
1400205c5or rcx, -1
1400205c9call SysNtQueryVirtualMemory
1400205cetest eax, eax
1400205d0js 0x140020629
1400205d2mov rax, [rsp+184]
1400205dacmp [rsp+136], rax
1400205e2jne 0x140020629
1400205e4xor edx, edx
1400205e6mov eax, 7
1400205ebmov r9l, 16
1400205f1mov r8, rdi
1400205f4mov [rsp+32], rdx
1400205f9shl rax, 35
1400205fdmov edx, 26
140020602mov rcx, rbx
140020605mov [rsp+104], rax
14002060amov [rsp+96], rsi
14002060fcall SysNtQueryInformationThread
140020614test eax, eax
140020616js 0x140020629
140020618xor edx, edx
14002061amov rcx, rbx
14002061dmov esi, 1
140020622call SysNtResumeThread
140020627jmp 0x14002063a
140020629
140020629loc_140020629:
140020629xor edx, edx
14002062bmov rcx, rbx
14002062ecall SysNtResumeThread
140020633jmp 0x1400204db
140020638
140020638loc_140020638:
140020638xor esi, esi
14002063a
14002063aloc_14002063a:
14002063atest rbx, rbx
14002063dje 0x140020647
14002063fmov rcx, rbx
140020642call SysNtClose
140020647
140020647loc_140020647:
140020647lea rsp, [rbp-56]
14002064bmov eax, esi
14002064dpop rbx
14002064epop rsi
14002064fpop rdi
140020650pop r12
140020652pop r13
140020654pop r14
140020656pop r15
140020658pop rbp
140020659ret
140020410
140020410ThreadQueryTib:
140020410push rbp
140020411xor eax, eax
140020413xor r10l, r10l
140020416xor r11l, r11l
140020419mov rbp, rsp
14002041cpush r15
14002041epush r14
140020420mov r14, 0x1000000040
14002042apush r13
14002042cpush r12
14002042epush rdi
14002042fpush rsi
140020430mov rsi, rdx
140020433push rbx
140020434xor ebx, ebx
140020436and rsp, -16
14002043asub rsp, 1456
140020441mov [rbp+16], rcx
140020445mov ecx, 12
14002044amov [rsp+96], r10
14002044flea r12, [rsp+88]
140020454lea r15, [rsp+112]
140020459lea rdi, [rsp+128]
140020461mov [rsp+104], r10
140020466rep stosd [rdi], eax
140020468mov ecx, 12
14002046dmov [rsp+112], r11
140020472lea rdi, [rsp+176]
14002047arep stosd [rdi], eax
14002047cmov ecx, 308
140020481mov [rsp+120], r11
140020486lea rdi, [rsp+224]
14002048erep stosd [rdi], eax
140020490mov rax, [rip+48857]
140020497mov [rsp+88], rbx
14002049cxor ebx, ebx
14002049emov [rsp+272], 0x10000b
1400204a9mov rax, [rax+2230]
1400204b0mov r13, [rax+72]
1400204b4lea rax, [rsp+128]
1400204bcmov [rsp+72], rax
1400204c1lea rax, [rsp+176]
1400204c9mov [rsp+64], rax
1400204celea rax, [rsp+224]
1400204d6mov [rsp+56], rax
1400204db
1400204dbloc_1400204db:
1400204dbxor eax, eax
1400204ddmov [rsp+40], r12
1400204e2xor r9l, r9l
1400204e5or rcx, -1
1400204e9mov [rsp+32], eax
1400204edmov r8l, 0x1fffff
1400204f3mov rdx, rbx
1400204f6call SysNtGetNextThread
1400204fbtest eax, eax
1400204fdjs 0x140020638
140020503test rbx, rbx
140020506je 0x140020510
140020508mov rcx, rbx
14002050bcall SysNtClose
140020510
140020510loc_140020510:
140020510xor r9l, r9l
140020513mov rbx, [rsp+88]
140020518lea rdi, [rsp+96]
14002051dmov edx, 26
140020522mov [rsp+32], r9
140020527mov r8, rdi
14002052amov r9l, 16
140020530mov rcx, rbx
140020533mov [rsp+104], r14
140020538mov [rsp+96], r15
14002053dcall SysNtQueryInformationThread
140020542test eax, eax
140020544js 0x1400204db
140020546mov eax, r13l
140020549cmp [rsp+120], rax
14002054eje 0x1400204db
140020550xor edx, edx
140020552mov rcx, rbx
140020555call SysNtSuspendThread
14002055atest eax, eax
14002055cjs 0x1400204db
140020562mov rdx, [rsp+56]
140020567mov rcx, rbx
14002056acall SysNtGetContextThread
14002056ftest eax, eax
140020571js 0x140020629
140020577xor r8l, r8l
14002057amov r9, [rsp+72]
14002057for rcx, -1
140020583mov [rsp+32], 48
14002058cmov [rsp+40], r8
140020591mov rdx, [rsp+376]
140020599xor r8l, r8l
14002059ccall SysNtQueryVirtualMemory
1400205a1test eax, eax
1400205a3js 0x140020629
1400205a9xor ecx, ecx
1400205abmov r9, [rsp+64]
1400205b0xor r8l, r8l
1400205b3mov [rsp+32], 48
1400205bcmov [rsp+40], rcx
1400205c1mov rdx, [rbp+16]
1400205c5or rcx, -1
1400205c9call SysNtQueryVirtualMemory
1400205cetest eax, eax
1400205d0js 0x140020629
1400205d2mov rax, [rsp+184]
1400205dacmp [rsp+136], rax
1400205e2jne 0x140020629
1400205e4xor edx, edx
1400205e6mov eax, 7
1400205ebmov r9l, 16
1400205f1mov r8, rdi
1400205f4mov [rsp+32], rdx
1400205f9shl rax, 35
1400205fdmov edx, 26
140020602mov rcx, rbx
140020605mov [rsp+104], rax
14002060amov [rsp+96], rsi
14002060fcall SysNtQueryInformationThread
140020614test eax, eax
140020616js 0x140020629
140020618xor edx, edx
14002061amov rcx, rbx
14002061dmov esi, 1
140020622call SysNtResumeThread
140020627jmp 0x14002063a
140020629
140020629loc_140020629:
140020629xor edx, edx
14002062bmov rcx, rbx
14002062ecall SysNtResumeThread
140020633jmp 0x1400204db
140020638
140020638loc_140020638:
140020638xor esi, esi
14002063a
14002063aloc_14002063a:
14002063atest rbx, rbx
14002063dje 0x140020647
14002063fmov rcx, rbx
140020642call SysNtClose
140020647
140020647loc_140020647:
140020647lea rsp, [rbp-56]
14002064bmov eax, esi
14002064dpop rbx
14002064epop rsi
14002064fpop rdi
140020650pop r12
140020652pop r13
140020654pop r14
140020656pop r15
140020658pop rbp
140020659ret
140020410
14002065a
14002065a // align 0x10
14002065a // align 0x10
140020660
140020660TimerObf:
140020660push rbp
140020661mov eax, 18800
140020666mov rbp, rsp
140020669push r15
14002066bpush r14
14002066dpush r13
14002066fpush r12
140020671push rdi
140020672push rsi
140020673push rbx
140020674and rsp, -16
140020678call ___chkstk_ms
14002067dxor r9l, r9l
140020680xor r10l, r10l
140020683sub rsp, rax
140020686mov r12l, ecx
140020689xor eax, eax
14002068bmov ecx, 308
140020690lea rdi, [rsp+320]
140020698mov rsi, [rip+48337]
14002069fmov [rbp+24], edx
1400206a2lea r13, [rsp+320]
1400206aarep stosd [rdi], eax
1400206acmov ecx, 308
1400206b1mov [rsp+104], r9
1400206b6lea rdi, [rsp+1552]
1400206berep stosd [rdi], eax
1400206c0lea rdi, [rsp+2784]
1400206c8mov ecx, 4004
1400206cdmov [rsp+112], r9
1400206d2rep stosd [rdi], eax
1400206d4lea rdi, [rsp+208]
1400206dcmov ecx, 14
1400206e1mov [rsp+120], r9
1400206e6rep stosd [rdi], eax
1400206e8lea rdi, [rsp+264]
1400206f0mov ecx, 14
1400206f5mov [rsp+128], r9
1400206fdrep stosd [rdi], eax
1400206ffmov rax, [rsi+44]
140020703mov [rsp+136], r9
14002070bmov [rsp+144], r9
140020713mov [rsp+72], rax
140020718mov eax, [rsi+52]
14002071bmov [rsp+152], r9
140020723mov [rsp+64], rax
140020728mov rax, [rsi+56]
14002072cmov [rsp+160], r9
140020734test rax, rax
140020737mov [rsp+168], r9
14002073fmov [rsp+176], r9
140020747mov [rsp+184], r9
14002074fmov [rsp+192], r9
140020757mov [rsp+200], r9
14002075fmov [rsp+100], r10l
140020764mov [rsp+84], 64
14002076cje 0x140020789
14002076emov edx, [rsi+64]
140020771test edx, edx
140020773je 0x140020789
140020775mov ebx, edx
140020777mov [rsp+72], rax
14002077cmov [rsp+64], rbx
140020781mov [rsp+84], 32
140020789
140020789loc_140020789:
140020789xor ebx, ebx
14002078b
14002078bloc_14002078b:
14002078bcall RandomNumber32
140020790mov edx, eax
140020792lea rax, [rsp+160]
14002079amov [rsp+rbx+160], dl
1400207a1inc rbx
1400207a4cmp rbx, 16
1400207a8jne 0x14002078b
1400207aamov r14l, [rsi+52]
1400207aemov r15, [rsi+44]
1400207b2mov [rsp+184], rax
1400207bamov rax, 0x1000000010
1400207c4cmp [rbp+24], 1
1400207c8mov [rsp+176], rax
1400207d0mov [rsp+200], r15
1400207d8mov [rsp+196], r14l
1400207e0mov [rsp+192], r14l
1400207e8jne 0x1400207f7
1400207ealea rcx, [rsp+104]
1400207efcall [rsi+404]
1400207f5jmp 0x140020849
1400207f7
1400207f7loc_1400207f7:
1400207f7cmp [rbp+24], 2
1400207fbmov rax, [rsi+564]
140020802je 0x14002082e
140020804
140020804loc_140020804:
140020804xor r8l, r8l
140020807xor r9l, r9l
14002080amov edx, 0x1f0003
14002080fmov [rsp+32], r8l
140020814lea rcx, [rsp+136]
14002081cxor r8l, r8l
14002081fcall [rsi+564]
140020825test eax, eax
140020827jns 0x140020869
140020829jmp 0x140020ed4
14002082e
14002082eloc_14002082e:
14002082exor edx, edx
140020830lea rcx, [rsp+152]
140020838xor r9l, r9l
14002083bxor r8l, r8l
14002083emov [rsp+32], edx
140020842mov edx, 0x1f0003
140020847call rax
140020849
140020849loc_140020849:
140020849mov r9l, eax
14002084ctest eax, eax
14002084ejns 0x140020804
140020850mov r8l, 605
140020856lea rdx, [rip+49171]
14002085dlea rcx, [rip+33891]
140020864jmp 0x140020eeb
140020869
140020869loc_140020869:
140020869xor eax, eax
14002086bxor r9l, r9l
14002086exor r8l, r8l
140020871mov edx, 0x1f0003
140020876mov [rsp+32], eax
14002087alea rcx, [rsp+128]
140020882call [rsi+564]
140020888test eax, eax
14002088ajs 0x140020ed4
140020890xor eax, eax
140020892xor r9l, r9l
140020895xor r8l, r8l
140020898mov edx, 0x1f0003
14002089dmov [rsp+32], eax
1400208a1lea rcx, [rsp+144]
1400208a9call [rsi+564]
1400208aftest eax, eax
1400208b1js 0x140020ed4
1400208b7cmp [rbp+24], 1
1400208bbjne 0x140020930
1400208bdxor eax, eax
1400208bflea rbx, [rsp+112]
1400208c4mov r9, r13
1400208c7mov rcx, [rsp+104]
1400208ccmov r8, [rsi+420]
1400208d3mov rdx, rbx
1400208d6mov [rsp+48], 32
1400208demov [rsp+40], eax
1400208e2mov [rsp+32], 100
1400208eacall [rsi+380]
1400208f0mov r9l, eax
1400208f3test eax, eax
1400208f5js 0x140020ebe
1400208fbxor eax, eax
1400208fdmov rcx, [rsp+104]
140020902mov rdx, rbx
140020905mov [rsp+48], 32
14002090dmov [rsp+40], eax
140020911mov r9, [rsp+136]
140020919lea r8, [rip-55568]
140020920mov [rsp+32], 200
140020928call [rsi+380]
14002092ejmp 0x1400209a7
140020930
140020930loc_140020930:
140020930xor ebx, ebx
140020932cmp [rbp+24], 2
140020936jne 0x1400209bd
14002093clea rbx, [rsp+112]
140020941mov r8, [rsi+420]
140020948mov r9, r13
14002094bmov [rsp+40], 12
140020953mov [rsp+32], 100
14002095bmov rdx, [rsp+152]
140020963mov rcx, rbx
140020966call [rsi+388]
14002096cmov r9l, eax
14002096ftest eax, eax
140020971js 0x140020ebe
140020977mov [rsp+40], 12
14002097fmov r9, [rsp+136]
140020987mov rcx, rbx
14002098alea r8, [rip-55681]
140020991mov [rsp+32], 200
140020999mov rdx, [rsp+152]
1400209a1call [rsi+388]
1400209a7
1400209a7loc_1400209a7:
1400209a7mov r9l, eax
1400209aamov r8l, 596
1400209b0test eax, eax
1400209b2js 0x140020ec4
1400209b8mov ebx, 200
1400209bd
1400209bdloc_1400209bd:
1400209bdmov rcx, [rsp+136]
1400209c5xor r8l, r8l
1400209c8xor edx, edx
1400209cacall SysNtWaitForSingleObject
1400209cfmov r8l, 452
1400209d5lea rdx, [rip+48788]
1400209dclea rcx, [rip+33069]
1400209e3mov r9l, eax
1400209e6test eax, eax
1400209e8js 0x140020eeb
1400209eemov r10, [rip+47483]
1400209f5cmp [r10+214], 0
1400209fdje 0x140020aab
140020a03mov rcx, [rsp+472]
140020a0blea rdx, [rsp+208]
140020a13call ThreadQueryTib
140020a18test eax, eax
140020a1ajne 0x140020a41
140020a1clea r9, [rip+33061]
140020a23mov r8l, 461
140020a29lea rdx, [rip+48704]
140020a30lea rcx, [rip+33064]
140020a37call printf
140020a3cjmp 0x140020ef0
140020a41
140020a41loc_140020a41:
140020a41xor eax, eax
140020a43or r8, -1
140020a47lea r9, [rsp+120]
140020a4cor rcx, -1
140020a50mov [rsp+48], 2
140020a58mov rdx, -2
140020a5fmov [rsp+40], eax
140020a63mov [rsp+32], eax
140020a67call SysNtDuplicateObject
140020a6cmov r10, [rip+47357]
140020a73mov r8l, 467
140020a79lea rdx, [rip+48624]
140020a80test eax, eax
140020a82mov r9l, eax
140020a85lea rcx, [rip+32999]
140020a8cjs 0x140020eeb
140020a92lea rax, [rsp+264]
140020a9amov rsi, [r10+2230]
140020aa1mov ecx, 14
140020aa6mov rdi, rax
140020aa9rep movsd [rdi], [rsi]
140020aab
140020aabloc_140020aab:
140020aablea rax, [rsp+2784]
140020ab3lea rdx, [rsp+18800]
140020abbmov [rsp+88], rax
140020ac0
140020ac0loc_140020ac0:
140020ac0mov rdi, rax
140020ac3mov ecx, 308
140020ac8mov rsi, r13
140020acbrep movsd [rdi], [rsi]
140020acdsub [rax+152], 8
140020ad5add rax, 1232
140020adbcmp rdx, rax
140020adejne 0x140020ac0
140020ae0mov rax, [rsp+128]
140020ae8xor r13l, r13l
140020aebmov rdx, [r10+1692]
140020af2lea rsi, [rsp+100]
140020af7mov [rsp+2968], r13
140020affmov rcx, [r10+804]
140020b06lea r11, [rsp+192]
140020b0elea r8, [rsp+176]
140020b16mov [rsp+2912], rax
140020b1emov eax, -1
140020b23mov r13, [r10+1372]
140020b2amov [rsp+2920], rax
140020b32mov eax, r14l
140020b35cmp [r10+214], 0
140020b3dmov [rsp+4152], rax
140020b45mov eax, ebx
140020b47mov [rsp+1600], 0x10000b
140020b52lea rdi, [rax+r12]
140020b56mov [rsp+368], 0x10000b
140020b61mov [rsp+3032], rdx
140020b69mov [rsp+4264], rcx
140020b71mov [rsp+4144], r15
140020b79mov [rsp+4200], 4
140020b85mov [rsp+4208], rsi
140020b8dmov [rsp+5496], r13
140020b95mov [rsp+5376], r11
140020b9dmov [rsp+5384], r8
140020ba5jne 0x140020bd8
140020ba7xor r12l, r12l
140020baamov [rsp+6728], rdx
140020bb2mov edx, 4
140020bb7mov [rsp+6608], -1
140020bc3mov [rsp+6616], rdi
140020bcbmov [rsp+6664], r12
140020bd3jmp 0x140020d0d
140020bd8
140020bd8loc_140020bd8:
140020bd8mov rax, [r10+588]
140020bdflea r12, [rsp+568]
140020be7lea r15, [rsp+208]
140020befmov [rsp+11544], rdi
140020bf7mov [rsp+7840], r12
140020bfflea r12, [rsp+1800]
140020c07xor edi, edi
140020c09lea r9, [rsp+1552]
140020c11mov [rsp+6728], rax
140020c19mov rax, [rsp+120]
140020c1elea r14, [rsp+320]
140020c26mov [rsp+7848], r12
140020c2emov r12, [r10+2230]
140020c35mov [rsp+6608], rax
140020c3dmov rax, [r10+444]
140020c44mov [rsp+9080], r15
140020c4cmov r10, [r10+596]
140020c53mov r15, [rsp+120]
140020c58mov [rsp+7960], rax
140020c60mov [rsp+9192], rax
140020c68mov [rsp+12888], rax
140020c70lea rax, [rsp+264]
140020c78mov [rsp+6616], r9
140020c80mov [rsp+7896], 1
140020c8cmov [rsp+9072], r12
140020c94mov [rsp+9128], 56
140020ca0mov [rsp+10424], r10
140020ca8mov [rsp+10304], r15
140020cb0mov [rsp+10312], r14
140020cb8mov [rsp+11536], -1
140020cc4mov [rsp+11592], rdi
140020cccmov [rsp+12768], r12
140020cd4mov [rsp+12776], rax
140020cdcmov [rsp+12824], 56
140020ce8mov [rsp+14120], r10
140020cf0mov [rsp+14000], r15
140020cf8mov [rsp+14008], r9
140020d00mov [rsp+11656], rdx
140020d08mov edx, 10
140020d0d
140020d0dloc_140020d0d:
140020d0dmov eax, edx
140020d0fmov rdi, [rsp+72]
140020d14lea r14, [rsp+112]
140020d19lea r12, [rip+47952]
140020d20imul rax, rax, 1232
140020d27mov [rsp+rax+3032], r13
140020d2fxor r13l, r13l
140020d32mov [rsp+rax+2920], r8
140020d3amov r8l, 572
140020d40mov [rsp+rax+2912], r11
140020d48lea eax, [rdx+1]
140020d4bimul rax, rax, 1232
140020d52mov [rsp+rax+2912], rdi
140020d5amov rdi, [rsp+64]
140020d5fmov [rsp+rax+3032], rcx
140020d67mov [rsp+rax+2920], rdi
140020d6fmov edi, [rsp+84]
140020d73mov [rsp+rax+2976], rsi
140020d7bxor esi, esi
140020d7dmov [rsp+rax+2968], rdi
140020d85mov rdi, [rip+46564]
140020d8clea eax, [rdx+2]
140020d8fimul rax, rax, 1232
140020d96mov rcx, [rdi+460]
140020d9dmov [rsp+rax+3032], rcx
140020da5mov rcx, [rsp+144]
140020dadmov [rsp+rax+2920], rsi
140020db5lea esi, [rdx+3]
140020db8mov rdx, r12
140020dbbmov [rsp+rax+2912], rcx
140020dc3mov r9l, esi
140020dc6lea rcx, [rip+32213]
140020dcdcall printf
140020dd2
140020dd2loc_140020dd2:
140020dd2cmp [rbp+24], 1
140020dd6jne 0x140020e25
140020dd8xor r11l, r11l
140020ddbadd ebx, 100
140020ddemov r8, [rdi+692]
140020de5mov rdx, r14
140020de8mov r9, [rsp+88]
140020dedmov rcx, [rsp+104]
140020df2mov [rsp+40], r11l
140020df7mov [rsp+48], 32
140020dffmov [rsp+32], ebx
140020e03call [rdi+380]
140020e09mov r9l, eax
140020e0ctest eax, eax
140020e0ejns 0x140020e70
140020e10mov r8l, 578
140020e16mov rdx, r12
140020e19lea rcx, [rip+32171]
140020e20jmp 0x140020eeb
140020e25
140020e25loc_140020e25:
140020e25cmp [rbp+24], 2
140020e29jne 0x140020e70
140020e2badd ebx, 100
140020e2emov r9, [rsp+88]
140020e33mov rcx, r14
140020e36mov r8, [rdi+692]
140020e3dmov rdx, [rsp+152]
140020e45mov [rsp+40], 12
140020e4dmov [rsp+32], ebx
140020e51call [rdi+388]
140020e57mov r9l, eax
140020e5atest eax, eax
140020e5cjns 0x140020e70
140020e5emov r8l, 583
140020e64mov rdx, r12
140020e67lea rcx, [rip+32137]
140020e6ejmp 0x140020eeb
140020e70
140020e70loc_140020e70:
140020e70add [rsp+88], 1232
140020e79inc r13l
140020e7ccmp r13l, esi
140020e7fjb 0x140020dd2
140020e85mov rdx, [rsp+144]
140020e8dxor r9l, r9l
140020e90xor r8l, r8l
140020e93mov ebx, 1
140020e98mov rcx, [rsp+128]
140020ea0call SysNtSignalAndWaitForSingleObject
140020ea5mov r9l, eax
140020ea8test eax, eax
140020eaajns 0x140020ef2
140020eacmov r8l, 591
140020eb2mov rdx, r12
140020eb5lea rcx, [rip+32104]
140020ebcjmp 0x140020eeb
140020ebe
140020ebeloc_140020ebe:
140020ebemov r8l, 599
140020ec4
140020ec4loc_140020ec4:
140020ec4lea rdx, [rip+47525]
140020ecblea rcx, [rip+32142]
140020ed2jmp 0x140020eeb
140020ed4
140020ed4loc_140020ed4:
140020ed4mov r9l, eax
140020ed7mov r8l, 602
140020eddlea rdx, [rip+47500]
140020ee4lea rcx, [rip+32177]
140020eeb
140020eebloc_140020eeb:
140020eebcall printf
140020ef0
140020ef0loc_140020ef0:
140020ef0xor ebx, ebx
140020ef2
140020ef2loc_140020ef2:
140020ef2mov rcx, [rsp+104]
140020ef7test rcx, rcx
140020efaje 0x140020f11
140020efcmov rax, [rip+46189]
140020f03call [rax+412]
140020f09xor r10l, r10l
140020f0cmov [rsp+104], r10
140020f11
140020f11loc_140020f11:
140020f11mov rcx, [rsp+136]
140020f19test rcx, rcx
140020f1cje 0x140020f2e
140020f1ecall SysNtClose
140020f23xor r9l, r9l
140020f26mov [rsp+136], r9
140020f2e
140020f2eloc_140020f2e:
140020f2emov rcx, [rsp+128]
140020f36test rcx, rcx
140020f39je 0x140020f4b
140020f3bcall SysNtClose
140020f40xor r8l, r8l
140020f43mov [rsp+128], r8
140020f4b
140020f4bloc_140020f4b:
140020f4bmov rcx, [rsp+144]
140020f53test rcx, rcx
140020f56je 0x140020f67
140020f58call SysNtClose
140020f5dxor ecx, ecx
140020f5fmov [rsp+144], rcx
140020f67
140020f67loc_140020f67:
140020f67mov rcx, [rsp+152]
140020f6ftest rcx, rcx
140020f72je 0x140020f83
140020f74call SysNtClose
140020f79xor edx, edx
140020f7bmov [rsp+152], rdx
140020f83
140020f83loc_140020f83:
140020f83mov rcx, [rsp+120]
140020f88test rcx, rcx
140020f8bje 0x140020f99
140020f8dcall SysNtClose
140020f92xor eax, eax
140020f94mov [rsp+120], rax
140020f99
140020f99loc_140020f99:
140020f99lea rdx, [rsp+2784]
140020fa1lea r8, [rsp+18800]
140020fa9xor eax, eax
140020fabmov r9l, 1232
140020fb1
140020fb1loc_140020fb1:
140020fb1mov rdi, rdx
140020fb4mov rcx, r9
140020fb7rep stosb [rdi], al
140020fb9add rdx, 1232
140020fc0cmp rdx, r8
140020fc3jne 0x140020fb1
140020fc5lea rdi, [rsp+160]
140020fcdmov ecx, 16
140020fd2rep stosb [rdi], al
140020fd4lea rsp, [rbp-56]
140020fd8mov eax, ebx
140020fdapop rbx
140020fdbpop rsi
140020fdcpop rdi
140020fddpop r12
140020fdfpop r13
140020fe1pop r14
140020fe3pop r15
140020fe5pop rbp
140020fe6ret
140020660
140020660TimerObf:
140020660push rbp
140020661mov eax, 18800
140020666mov rbp, rsp
140020669push r15
14002066bpush r14
14002066dpush r13
14002066fpush r12
140020671push rdi
140020672push rsi
140020673push rbx
140020674and rsp, -16
140020678call ___chkstk_ms
14002067dxor r9l, r9l
140020680xor r10l, r10l
140020683sub rsp, rax
140020686mov r12l, ecx
140020689xor eax, eax
14002068bmov ecx, 308
140020690lea rdi, [rsp+320]
140020698mov rsi, [rip+48337]
14002069fmov [rbp+24], edx
1400206a2lea r13, [rsp+320]
1400206aarep stosd [rdi], eax
1400206acmov ecx, 308
1400206b1mov [rsp+104], r9
1400206b6lea rdi, [rsp+1552]
1400206berep stosd [rdi], eax
1400206c0lea rdi, [rsp+2784]
1400206c8mov ecx, 4004
1400206cdmov [rsp+112], r9
1400206d2rep stosd [rdi], eax
1400206d4lea rdi, [rsp+208]
1400206dcmov ecx, 14
1400206e1mov [rsp+120], r9
1400206e6rep stosd [rdi], eax
1400206e8lea rdi, [rsp+264]
1400206f0mov ecx, 14
1400206f5mov [rsp+128], r9
1400206fdrep stosd [rdi], eax
1400206ffmov rax, [rsi+44]
140020703mov [rsp+136], r9
14002070bmov [rsp+144], r9
140020713mov [rsp+72], rax
140020718mov eax, [rsi+52]
14002071bmov [rsp+152], r9
140020723mov [rsp+64], rax
140020728mov rax, [rsi+56]
14002072cmov [rsp+160], r9
140020734test rax, rax
140020737mov [rsp+168], r9
14002073fmov [rsp+176], r9
140020747mov [rsp+184], r9
14002074fmov [rsp+192], r9
140020757mov [rsp+200], r9
14002075fmov [rsp+100], r10l
140020764mov [rsp+84], 64
14002076cje 0x140020789
14002076emov edx, [rsi+64]
140020771test edx, edx
140020773je 0x140020789
140020775mov ebx, edx
140020777mov [rsp+72], rax
14002077cmov [rsp+64], rbx
140020781mov [rsp+84], 32
140020789
140020789loc_140020789:
140020789xor ebx, ebx
14002078b
14002078bloc_14002078b:
14002078bcall RandomNumber32
140020790mov edx, eax
140020792lea rax, [rsp+160]
14002079amov [rsp+rbx+160], dl
1400207a1inc rbx
1400207a4cmp rbx, 16
1400207a8jne 0x14002078b
1400207aamov r14l, [rsi+52]
1400207aemov r15, [rsi+44]
1400207b2mov [rsp+184], rax
1400207bamov rax, 0x1000000010
1400207c4cmp [rbp+24], 1
1400207c8mov [rsp+176], rax
1400207d0mov [rsp+200], r15
1400207d8mov [rsp+196], r14l
1400207e0mov [rsp+192], r14l
1400207e8jne 0x1400207f7
1400207ealea rcx, [rsp+104]
1400207efcall [rsi+404]
1400207f5jmp 0x140020849
1400207f7
1400207f7loc_1400207f7:
1400207f7cmp [rbp+24], 2
1400207fbmov rax, [rsi+564]
140020802je 0x14002082e
140020804
140020804loc_140020804:
140020804xor r8l, r8l
140020807xor r9l, r9l
14002080amov edx, 0x1f0003
14002080fmov [rsp+32], r8l
140020814lea rcx, [rsp+136]
14002081cxor r8l, r8l
14002081fcall [rsi+564]
140020825test eax, eax
140020827jns 0x140020869
140020829jmp 0x140020ed4
14002082e
14002082eloc_14002082e:
14002082exor edx, edx
140020830lea rcx, [rsp+152]
140020838xor r9l, r9l
14002083bxor r8l, r8l
14002083emov [rsp+32], edx
140020842mov edx, 0x1f0003
140020847call rax
140020849
140020849loc_140020849:
140020849mov r9l, eax
14002084ctest eax, eax
14002084ejns 0x140020804
140020850mov r8l, 605
140020856lea rdx, [rip+49171]
14002085dlea rcx, [rip+33891]
140020864jmp 0x140020eeb
140020869
140020869loc_140020869:
140020869xor eax, eax
14002086bxor r9l, r9l
14002086exor r8l, r8l
140020871mov edx, 0x1f0003
140020876mov [rsp+32], eax
14002087alea rcx, [rsp+128]
140020882call [rsi+564]
140020888test eax, eax
14002088ajs 0x140020ed4
140020890xor eax, eax
140020892xor r9l, r9l
140020895xor r8l, r8l
140020898mov edx, 0x1f0003
14002089dmov [rsp+32], eax
1400208a1lea rcx, [rsp+144]
1400208a9call [rsi+564]
1400208aftest eax, eax
1400208b1js 0x140020ed4
1400208b7cmp [rbp+24], 1
1400208bbjne 0x140020930
1400208bdxor eax, eax
1400208bflea rbx, [rsp+112]
1400208c4mov r9, r13
1400208c7mov rcx, [rsp+104]
1400208ccmov r8, [rsi+420]
1400208d3mov rdx, rbx
1400208d6mov [rsp+48], 32
1400208demov [rsp+40], eax
1400208e2mov [rsp+32], 100
1400208eacall [rsi+380]
1400208f0mov r9l, eax
1400208f3test eax, eax
1400208f5js 0x140020ebe
1400208fbxor eax, eax
1400208fdmov rcx, [rsp+104]
140020902mov rdx, rbx
140020905mov [rsp+48], 32
14002090dmov [rsp+40], eax
140020911mov r9, [rsp+136]
140020919lea r8, [rip-55568]
140020920mov [rsp+32], 200
140020928call [rsi+380]
14002092ejmp 0x1400209a7
140020930
140020930loc_140020930:
140020930xor ebx, ebx
140020932cmp [rbp+24], 2
140020936jne 0x1400209bd
14002093clea rbx, [rsp+112]
140020941mov r8, [rsi+420]
140020948mov r9, r13
14002094bmov [rsp+40], 12
140020953mov [rsp+32], 100
14002095bmov rdx, [rsp+152]
140020963mov rcx, rbx
140020966call [rsi+388]
14002096cmov r9l, eax
14002096ftest eax, eax
140020971js 0x140020ebe
140020977mov [rsp+40], 12
14002097fmov r9, [rsp+136]
140020987mov rcx, rbx
14002098alea r8, [rip-55681]
140020991mov [rsp+32], 200
140020999mov rdx, [rsp+152]
1400209a1call [rsi+388]
1400209a7
1400209a7loc_1400209a7:
1400209a7mov r9l, eax
1400209aamov r8l, 596
1400209b0test eax, eax
1400209b2js 0x140020ec4
1400209b8mov ebx, 200
1400209bd
1400209bdloc_1400209bd:
1400209bdmov rcx, [rsp+136]
1400209c5xor r8l, r8l
1400209c8xor edx, edx
1400209cacall SysNtWaitForSingleObject
1400209cfmov r8l, 452
1400209d5lea rdx, [rip+48788]
1400209dclea rcx, [rip+33069]
1400209e3mov r9l, eax
1400209e6test eax, eax
1400209e8js 0x140020eeb
1400209eemov r10, [rip+47483]
1400209f5cmp [r10+214], 0
1400209fdje 0x140020aab
140020a03mov rcx, [rsp+472]
140020a0blea rdx, [rsp+208]
140020a13call ThreadQueryTib
140020a18test eax, eax
140020a1ajne 0x140020a41
140020a1clea r9, [rip+33061]
140020a23mov r8l, 461
140020a29lea rdx, [rip+48704]
140020a30lea rcx, [rip+33064]
140020a37call printf
140020a3cjmp 0x140020ef0
140020a41
140020a41loc_140020a41:
140020a41xor eax, eax
140020a43or r8, -1
140020a47lea r9, [rsp+120]
140020a4cor rcx, -1
140020a50mov [rsp+48], 2
140020a58mov rdx, -2
140020a5fmov [rsp+40], eax
140020a63mov [rsp+32], eax
140020a67call SysNtDuplicateObject
140020a6cmov r10, [rip+47357]
140020a73mov r8l, 467
140020a79lea rdx, [rip+48624]
140020a80test eax, eax
140020a82mov r9l, eax
140020a85lea rcx, [rip+32999]
140020a8cjs 0x140020eeb
140020a92lea rax, [rsp+264]
140020a9amov rsi, [r10+2230]
140020aa1mov ecx, 14
140020aa6mov rdi, rax
140020aa9rep movsd [rdi], [rsi]
140020aab
140020aabloc_140020aab:
140020aablea rax, [rsp+2784]
140020ab3lea rdx, [rsp+18800]
140020abbmov [rsp+88], rax
140020ac0
140020ac0loc_140020ac0:
140020ac0mov rdi, rax
140020ac3mov ecx, 308
140020ac8mov rsi, r13
140020acbrep movsd [rdi], [rsi]
140020acdsub [rax+152], 8
140020ad5add rax, 1232
140020adbcmp rdx, rax
140020adejne 0x140020ac0
140020ae0mov rax, [rsp+128]
140020ae8xor r13l, r13l
140020aebmov rdx, [r10+1692]
140020af2lea rsi, [rsp+100]
140020af7mov [rsp+2968], r13
140020affmov rcx, [r10+804]
140020b06lea r11, [rsp+192]
140020b0elea r8, [rsp+176]
140020b16mov [rsp+2912], rax
140020b1emov eax, -1
140020b23mov r13, [r10+1372]
140020b2amov [rsp+2920], rax
140020b32mov eax, r14l
140020b35cmp [r10+214], 0
140020b3dmov [rsp+4152], rax
140020b45mov eax, ebx
140020b47mov [rsp+1600], 0x10000b
140020b52lea rdi, [rax+r12]
140020b56mov [rsp+368], 0x10000b
140020b61mov [rsp+3032], rdx
140020b69mov [rsp+4264], rcx
140020b71mov [rsp+4144], r15
140020b79mov [rsp+4200], 4
140020b85mov [rsp+4208], rsi
140020b8dmov [rsp+5496], r13
140020b95mov [rsp+5376], r11
140020b9dmov [rsp+5384], r8
140020ba5jne 0x140020bd8
140020ba7xor r12l, r12l
140020baamov [rsp+6728], rdx
140020bb2mov edx, 4
140020bb7mov [rsp+6608], -1
140020bc3mov [rsp+6616], rdi
140020bcbmov [rsp+6664], r12
140020bd3jmp 0x140020d0d
140020bd8
140020bd8loc_140020bd8:
140020bd8mov rax, [r10+588]
140020bdflea r12, [rsp+568]
140020be7lea r15, [rsp+208]
140020befmov [rsp+11544], rdi
140020bf7mov [rsp+7840], r12
140020bfflea r12, [rsp+1800]
140020c07xor edi, edi
140020c09lea r9, [rsp+1552]
140020c11mov [rsp+6728], rax
140020c19mov rax, [rsp+120]
140020c1elea r14, [rsp+320]
140020c26mov [rsp+7848], r12
140020c2emov r12, [r10+2230]
140020c35mov [rsp+6608], rax
140020c3dmov rax, [r10+444]
140020c44mov [rsp+9080], r15
140020c4cmov r10, [r10+596]
140020c53mov r15, [rsp+120]
140020c58mov [rsp+7960], rax
140020c60mov [rsp+9192], rax
140020c68mov [rsp+12888], rax
140020c70lea rax, [rsp+264]
140020c78mov [rsp+6616], r9
140020c80mov [rsp+7896], 1
140020c8cmov [rsp+9072], r12
140020c94mov [rsp+9128], 56
140020ca0mov [rsp+10424], r10
140020ca8mov [rsp+10304], r15
140020cb0mov [rsp+10312], r14
140020cb8mov [rsp+11536], -1
140020cc4mov [rsp+11592], rdi
140020cccmov [rsp+12768], r12
140020cd4mov [rsp+12776], rax
140020cdcmov [rsp+12824], 56
140020ce8mov [rsp+14120], r10
140020cf0mov [rsp+14000], r15
140020cf8mov [rsp+14008], r9
140020d00mov [rsp+11656], rdx
140020d08mov edx, 10
140020d0d
140020d0dloc_140020d0d:
140020d0dmov eax, edx
140020d0fmov rdi, [rsp+72]
140020d14lea r14, [rsp+112]
140020d19lea r12, [rip+47952]
140020d20imul rax, rax, 1232
140020d27mov [rsp+rax+3032], r13
140020d2fxor r13l, r13l
140020d32mov [rsp+rax+2920], r8
140020d3amov r8l, 572
140020d40mov [rsp+rax+2912], r11
140020d48lea eax, [rdx+1]
140020d4bimul rax, rax, 1232
140020d52mov [rsp+rax+2912], rdi
140020d5amov rdi, [rsp+64]
140020d5fmov [rsp+rax+3032], rcx
140020d67mov [rsp+rax+2920], rdi
140020d6fmov edi, [rsp+84]
140020d73mov [rsp+rax+2976], rsi
140020d7bxor esi, esi
140020d7dmov [rsp+rax+2968], rdi
140020d85mov rdi, [rip+46564]
140020d8clea eax, [rdx+2]
140020d8fimul rax, rax, 1232
140020d96mov rcx, [rdi+460]
140020d9dmov [rsp+rax+3032], rcx
140020da5mov rcx, [rsp+144]
140020dadmov [rsp+rax+2920], rsi
140020db5lea esi, [rdx+3]
140020db8mov rdx, r12
140020dbbmov [rsp+rax+2912], rcx
140020dc3mov r9l, esi
140020dc6lea rcx, [rip+32213]
140020dcdcall printf
140020dd2
140020dd2loc_140020dd2:
140020dd2cmp [rbp+24], 1
140020dd6jne 0x140020e25
140020dd8xor r11l, r11l
140020ddbadd ebx, 100
140020ddemov r8, [rdi+692]
140020de5mov rdx, r14
140020de8mov r9, [rsp+88]
140020dedmov rcx, [rsp+104]
140020df2mov [rsp+40], r11l
140020df7mov [rsp+48], 32
140020dffmov [rsp+32], ebx
140020e03call [rdi+380]
140020e09mov r9l, eax
140020e0ctest eax, eax
140020e0ejns 0x140020e70
140020e10mov r8l, 578
140020e16mov rdx, r12
140020e19lea rcx, [rip+32171]
140020e20jmp 0x140020eeb
140020e25
140020e25loc_140020e25:
140020e25cmp [rbp+24], 2
140020e29jne 0x140020e70
140020e2badd ebx, 100
140020e2emov r9, [rsp+88]
140020e33mov rcx, r14
140020e36mov r8, [rdi+692]
140020e3dmov rdx, [rsp+152]
140020e45mov [rsp+40], 12
140020e4dmov [rsp+32], ebx
140020e51call [rdi+388]
140020e57mov r9l, eax
140020e5atest eax, eax
140020e5cjns 0x140020e70
140020e5emov r8l, 583
140020e64mov rdx, r12
140020e67lea rcx, [rip+32137]
140020e6ejmp 0x140020eeb
140020e70
140020e70loc_140020e70:
140020e70add [rsp+88], 1232
140020e79inc r13l
140020e7ccmp r13l, esi
140020e7fjb 0x140020dd2
140020e85mov rdx, [rsp+144]
140020e8dxor r9l, r9l
140020e90xor r8l, r8l
140020e93mov ebx, 1
140020e98mov rcx, [rsp+128]
140020ea0call SysNtSignalAndWaitForSingleObject
140020ea5mov r9l, eax
140020ea8test eax, eax
140020eaajns 0x140020ef2
140020eacmov r8l, 591
140020eb2mov rdx, r12
140020eb5lea rcx, [rip+32104]
140020ebcjmp 0x140020eeb
140020ebe
140020ebeloc_140020ebe:
140020ebemov r8l, 599
140020ec4
140020ec4loc_140020ec4:
140020ec4lea rdx, [rip+47525]
140020ecblea rcx, [rip+32142]
140020ed2jmp 0x140020eeb
140020ed4
140020ed4loc_140020ed4:
140020ed4mov r9l, eax
140020ed7mov r8l, 602
140020eddlea rdx, [rip+47500]
140020ee4lea rcx, [rip+32177]
140020eeb
140020eebloc_140020eeb:
140020eebcall printf
140020ef0
140020ef0loc_140020ef0:
140020ef0xor ebx, ebx
140020ef2
140020ef2loc_140020ef2:
140020ef2mov rcx, [rsp+104]
140020ef7test rcx, rcx
140020efaje 0x140020f11
140020efcmov rax, [rip+46189]
140020f03call [rax+412]
140020f09xor r10l, r10l
140020f0cmov [rsp+104], r10
140020f11
140020f11loc_140020f11:
140020f11mov rcx, [rsp+136]
140020f19test rcx, rcx
140020f1cje 0x140020f2e
140020f1ecall SysNtClose
140020f23xor r9l, r9l
140020f26mov [rsp+136], r9
140020f2e
140020f2eloc_140020f2e:
140020f2emov rcx, [rsp+128]
140020f36test rcx, rcx
140020f39je 0x140020f4b
140020f3bcall SysNtClose
140020f40xor r8l, r8l
140020f43mov [rsp+128], r8
140020f4b
140020f4bloc_140020f4b:
140020f4bmov rcx, [rsp+144]
140020f53test rcx, rcx
140020f56je 0x140020f67
140020f58call SysNtClose
140020f5dxor ecx, ecx
140020f5fmov [rsp+144], rcx
140020f67
140020f67loc_140020f67:
140020f67mov rcx, [rsp+152]
140020f6ftest rcx, rcx
140020f72je 0x140020f83
140020f74call SysNtClose
140020f79xor edx, edx
140020f7bmov [rsp+152], rdx
140020f83
140020f83loc_140020f83:
140020f83mov rcx, [rsp+120]
140020f88test rcx, rcx
140020f8bje 0x140020f99
140020f8dcall SysNtClose
140020f92xor eax, eax
140020f94mov [rsp+120], rax
140020f99
140020f99loc_140020f99:
140020f99lea rdx, [rsp+2784]
140020fa1lea r8, [rsp+18800]
140020fa9xor eax, eax
140020fabmov r9l, 1232
140020fb1
140020fb1loc_140020fb1:
140020fb1mov rdi, rdx
140020fb4mov rcx, r9
140020fb7rep stosb [rdi], al
140020fb9add rdx, 1232
140020fc0cmp rdx, r8
140020fc3jne 0x140020fb1
140020fc5lea rdi, [rsp+160]
140020fcdmov ecx, 16
140020fd2rep stosb [rdi], al
140020fd4lea rsp, [rbp-56]
140020fd8mov eax, ebx
140020fdapop rbx
140020fdbpop rsi
140020fdcpop rdi
140020fddpop r12
140020fdfpop r13
140020fe1pop r14
140020fe3pop r15
140020fe5pop rbp
140020fe6ret
140020660
140020fe7
140020fe7 // align 0x10
140020fe7 // align 0x10
140020ff0
140020ff0ToLowerCaseW:
140020ff0lea edx, [rcx-65]
140020ff3mov eax, ecx
140020ff5cmp dx, 25
140020ff9ja 0x140020ffe
140020ffbor eax, 96
140020ffe
140020ffeloc_140020ffe:
140020fferet
140020ff0
140020ff0ToLowerCaseW:
140020ff0lea edx, [rcx-65]
140020ff3mov eax, ecx
140020ff5cmp dx, 25
140020ff9ja 0x140020ffe
140020ffbor eax, 96
140020ffe
140020ffeloc_140020ffe:
140020fferet
140020ff0
140020fff
140020fff // align 0x10
140020fff // align 0x10
140021000
140021000TokenAdd:
140021000push r12
140021002mov r12, rcx
140021005mov ecx, 64
14002100apush rbp
14002100bmov rbp, rdx
14002100emov edx, 56
140021013push rdi
140021014mov edi, r9l
140021017push rsi
140021018mov esi, r8l
14002101bpush rbx
14002101csub rsp, 32
140021020mov rbx, [rip+45897]
140021027call [rbx+932]
14002102dmov rdx, [rsp+112]
140021032xor ecx, ecx
140021034mov [rax], r12
140021037mov [rax+24], rdx
14002103bmov rdx, [rsp+120]
140021040mov [rax+8], rbp
140021044mov [rax+40], rdx
140021048mov rdx, [rsp+128]
140021050mov [rax+16], edi
140021053mov [rax+32], rdx
140021057xor edx, edx
140021059mov [rax+48], rdx
14002105dmov rdx, [rbx+2274]
140021064mov [rax+20], si
140021068test rdx, rdx
14002106bjne 0x140021076
14002106dmov [rbx+2274], rax
140021074jmp 0x140021088
140021076
140021076loc_140021076:
140021076mov r8, rdx
140021079mov rdx, [rdx+48]
14002107dinc ecx
14002107ftest rdx, rdx
140021082jne 0x140021076
140021084mov [r8+48], rax
140021088
140021088loc_140021088:
140021088add rsp, 32
14002108cmov eax, ecx
14002108epop rbx
14002108fpop rsi
140021090pop rdi
140021091pop rbp
140021092pop r12
140021094ret
140021000
140021000TokenAdd:
140021000push r12
140021002mov r12, rcx
140021005mov ecx, 64
14002100apush rbp
14002100bmov rbp, rdx
14002100emov edx, 56
140021013push rdi
140021014mov edi, r9l
140021017push rsi
140021018mov esi, r8l
14002101bpush rbx
14002101csub rsp, 32
140021020mov rbx, [rip+45897]
140021027call [rbx+932]
14002102dmov rdx, [rsp+112]
140021032xor ecx, ecx
140021034mov [rax], r12
140021037mov [rax+24], rdx
14002103bmov rdx, [rsp+120]
140021040mov [rax+8], rbp
140021044mov [rax+40], rdx
140021048mov rdx, [rsp+128]
140021050mov [rax+16], edi
140021053mov [rax+32], rdx
140021057xor edx, edx
140021059mov [rax+48], rdx
14002105dmov rdx, [rbx+2274]
140021064mov [rax+20], si
140021068test rdx, rdx
14002106bjne 0x140021076
14002106dmov [rbx+2274], rax
140021074jmp 0x140021088
140021076
140021076loc_140021076:
140021076mov r8, rdx
140021079mov rdx, [rdx+48]
14002107dinc ecx
14002107ftest rdx, rdx
140021082jne 0x140021076
140021084mov [r8+48], rax
140021088
140021088loc_140021088:
140021088add rsp, 32
14002108cmov eax, ecx
14002108epop rbx
14002108fpop rsi
140021090pop rdi
140021091pop rbp
140021092pop r12
140021094ret
140021000
Loading..