214 lines
15 KiB
Plaintext
214 lines
15 KiB
Plaintext
########## @ 18be3 ##########
|
|
000000018be3: mov rdi, qword ptr [rbx + 0x330]
|
|
000000018bea: test rdi, rdi
|
|
000000018bed: je 0x18bff
|
|
000000018bef: call 0x6440
|
|
000000018bf4: mov qword ptr [rbx + 0x330], 0
|
|
000000018bff: mov dword ptr [rbx + 0x84], 0
|
|
000000018c09: add rsp, 8
|
|
000000018c0d: pop rbx
|
|
000000018c0e: pop rbp
|
|
000000018c0f: ret
|
|
000000018c10: mov rdi, rbx
|
|
000000018c13: mov esi, 0x6bb6b674
|
|
000000018c18: call 0x18ad0
|
|
000000018c1d: mov rdi, qword ptr [rbx + 0x10]
|
|
000000018c21: mov dword ptr [rbx + 0x28], 0
|
|
000000018c28: test rdi, rdi
|
|
000000018c2b: je 0x18b89
|
|
000000018c31: xor esi, esi
|
|
000000018c33: call 0x6230
|
|
000000018c38: mov qword ptr [rbx + 0x10], 0
|
|
000000018c40: jmp 0x18b89
|
|
000000018c45: nop dword ptr [rax]
|
|
000000018c48: xor esi, esi
|
|
000000018c4a: call 0x6230
|
|
000000018c4f: mov qword ptr [rbx + 0x20], 0
|
|
000000018c57: jmp 0x18bc7
|
|
000000018c5c: nop dword ptr [rax]
|
|
000000018c60: test edx, edx
|
|
000000018c62: push rbx
|
|
000000018c63: mov rbx, rdi
|
|
000000018c66: jne 0x18c72
|
|
000000018c68: mov dword ptr [rdi + 0x1e8], 0
|
|
000000018c72: mov eax, dword ptr [rbx + 0x84]
|
|
000000018c78: test eax, eax
|
|
000000018c7a: jne 0x18cb0
|
|
000000018c7c: mov rdi, qword ptr [rbx + 0x68]
|
|
000000018c80: mov dword ptr [rbx + 0x78], 0
|
|
000000018c87: mov dword ptr [rbx + 0x80], 0
|
|
000000018c91: test rdi, rdi
|
|
000000018c94: je 0x18cae
|
|
000000018c96: xor esi, esi
|
|
000000018c98: call 0x6700
|
|
000000018c9d: mov rdi, qword ptr [rbx + 0x68]
|
|
000000018ca1: call 0x5d60
|
|
000000018ca6: mov qword ptr [rbx + 0x68], 0
|
|
000000018cae: pop rbx
|
|
000000018caf: ret
|
|
|
|
########## @ 1904a ##########
|
|
00000001904a: <unresolvable>
|
|
00000001904e: lea rdi, [rbx + 0x20]
|
|
000000019052: lea rdx, [rip - 0x20a9]
|
|
000000019059: xor esi, esi
|
|
00000001905b: mov rcx, rbx
|
|
00000001905e: mov dword ptr [rbx + 0x30], 1
|
|
000000019065: call 0x60e0
|
|
00000001906a: lea rdx, [rip - 0x1fd1]
|
|
000000019071: lea rdi, [rbx + 0x10]
|
|
000000019075: xor esi, esi
|
|
000000019077: mov rcx, rbx
|
|
00000001907a: mov dword ptr [rbx + 0x1ec], 0
|
|
000000019084: mov dword ptr [rbx + 0x28], 1
|
|
00000001908b: call 0x60e0
|
|
000000019090: mov edi, 0xc350
|
|
000000019095: call 0x6290
|
|
00000001909a: mov esi, 0x6bb6b673
|
|
00000001909f: mov rdi, rbx
|
|
0000000190a2: call 0x18ad0
|
|
0000000190a7: test eax, eax
|
|
0000000190a9: je 0x19178
|
|
0000000190af: mov dword ptr [rbx + 0x84], 1
|
|
0000000190b9: mov eax, 1
|
|
0000000190be: jmp 0x190cd
|
|
0000000190c0: call 0x6390
|
|
0000000190c5: mov dword ptr [rax], 0xe4ae0003
|
|
0000000190cb: xor eax, eax
|
|
0000000190cd: add rsp, 0x28
|
|
0000000190d1: pop rbx
|
|
0000000190d2: pop rbp
|
|
0000000190d3: ret
|
|
0000000190d4: nop dword ptr [rax]
|
|
0000000190d8: call 0x6390
|
|
0000000190dd: mov dword ptr [rax], 0xe4ae0005
|
|
0000000190e3: add rsp, 0x28
|
|
0000000190e7: xor eax, eax
|
|
0000000190e9: pop rbx
|
|
0000000190ea: pop rbp
|
|
0000000190eb: ret
|
|
|
|
########## @ 19a2c ##########
|
|
000000019a2c: add dh, al
|
|
000000019a2e: <unresolvable>
|
|
000000019a32: <unresolvable>
|
|
000000019a36: js 0x19a37
|
|
000000019a38: <unresolvable>
|
|
000000019a3c: leave
|
|
000000019a3d: <unresolvable>
|
|
000000019a41: push rdi
|
|
000000019a42: push r14
|
|
000000019a44: push r13
|
|
000000019a46: push r12
|
|
000000019a48: push rbp
|
|
000000019a49: push rbx
|
|
000000019a4a: mov rbx, rdi
|
|
000000019a4d: sub rsp, 0x68
|
|
000000019a51: mov qword ptr [rdi + 0xb70], 0
|
|
000000019a5c: mov qword ptr [rdi + 0xb78], 0
|
|
000000019a67: mov qword ptr [rsp + 0x18], rsi
|
|
000000019a6c: mov esi, 0x6bb6b670
|
|
000000019a71: call 0x18ad0
|
|
000000019a76: test eax, eax
|
|
000000019a78: je 0x19a84
|
|
000000019a7a: mov eax, dword ptr [rbx + 0xb70]
|
|
000000019a80: test eax, eax
|
|
000000019a82: jne 0x19ab8
|
|
000000019a84: mov rax, qword ptr [rbx + 0x58]
|
|
000000019a88: test rax, rax
|
|
000000019a8b: je 0x19c40
|
|
000000019a91: mov rcx, qword ptr [rbx + 0x60]
|
|
000000019a95: mov edi, dword ptr [rbx + 0x33c]
|
|
000000019a9b: xor edx, edx
|
|
000000019a9d: mov esi, 0xffffffff
|
|
000000019aa2: call rax
|
|
000000019aa4: xor eax, eax
|
|
000000019aa6: add rsp, 0x68
|
|
000000019aaa: pop rbx
|
|
000000019aab: pop rbp
|
|
000000019aac: pop r12
|
|
000000019aae: pop r13
|
|
000000019ab0: pop r14
|
|
000000019ab2: pop r15
|
|
000000019ab4: ret
|
|
000000019ab5: nop dword ptr [rax]
|
|
000000019ab8: mov eax, dword ptr [rbx + 0xb70]
|
|
000000019abe: cmp eax, 0x6400000
|
|
000000019ac3: ja 0x19a84
|
|
000000019ac5: mov r13d, dword ptr [rbx + 0xb70]
|
|
000000019acc: movsxd rax, r13d
|
|
000000019acf: mov rdi, rax
|
|
000000019ad2: mov qword ptr [rsp + 8], rax
|
|
000000019ad7: call 0x5e40
|
|
000000019adc: test rax, rax
|
|
000000019adf: mov qword ptr [rsp + 0x20], rax
|
|
000000019ae4: je 0x19a84
|
|
000000019ae6: lea rax, [rsp + 0x40]
|
|
000000019aeb: mov esi, 2
|
|
000000019af0: mov dword ptr [rsp + 0x3c], 0
|
|
000000019af8: mov rdi, rax
|
|
000000019afb: mov r15, rax
|
|
000000019afe: mov qword ptr [rsp + 0x28], rax
|
|
000000019b03: call 0x13aa0
|
|
000000019b08: lea rsi, [rip + 0x18401]
|
|
000000019b0f: mov rdi, r15
|
|
000000019b12: call 0x16630
|
|
000000019b17: mov rdi, r15
|
|
000000019b1a: call 0x13b30
|
|
000000019b1f: mov rax, qword ptr [rbx + 0x58]
|
|
000000019b23: test rax, rax
|
|
000000019b26: je 0x19b38
|
|
000000019b28: mov rcx, qword ptr [rbx + 0x60]
|
|
000000019b2c: mov edi, dword ptr [rbx + 0x33c]
|
|
000000019b32: xor edx, edx
|
|
000000019b34: xor esi, esi
|
|
000000019b36: call rax
|
|
|
|
########## @ 1954f ##########
|
|
00000001954f: adc eax, 0xf6000001
|
|
000000019554: ret 0xf02
|
|
000000019557: test esp, esi
|
|
000000019559: add byte ptr [rax], al
|
|
00000001955b: add byte ptr [rbx - 0x7af0fe1e], al
|
|
000000019561: jrcxz 0x19563
|
|
000000019563: add byte ptr [rax], al
|
|
000000019565: lea r14, [rbx + 0xb38]
|
|
00000001956c: mov edx, 0x38
|
|
000000019571: test r14b, 1
|
|
000000019575: mov rdi, r14
|
|
000000019578: jne 0x197e0
|
|
00000001957e: test dil, 2
|
|
000000019582: jne 0x197f8
|
|
000000019588: test dil, 4
|
|
00000001958c: jne 0x19810
|
|
000000019592: mov ecx, edx
|
|
000000019594: xor eax, eax
|
|
000000019596: shr ecx, 3
|
|
000000019599: test dl, 4
|
|
00000001959c: rep stosq qword ptr [rdi], rax
|
|
00000001959f: jne 0x19630
|
|
0000000195a5: test dl, 2
|
|
0000000195a8: jne 0x19618
|
|
0000000195aa: and edx, 1
|
|
0000000195ad: jne 0x19610
|
|
0000000195af: mov esi, 0x6bb6b66b
|
|
0000000195b4: mov rdi, rbx
|
|
0000000195b7: mov dword ptr [rsp + 8], r8d
|
|
0000000195bc: call 0x18ad0
|
|
0000000195c1: mov esi, 0x6bb6b66c
|
|
0000000195c6: mov rdi, rbx
|
|
0000000195c9: mov r13d, eax
|
|
0000000195cc: call 0x18ad0
|
|
0000000195d1: test eax, eax
|
|
0000000195d3: jne 0x19680
|
|
0000000195d9: xor eax, eax
|
|
0000000195db: add rsp, 0x18
|
|
0000000195df: pop rbx
|
|
0000000195e0: pop rbp
|
|
0000000195e1: pop r12
|
|
0000000195e3: pop r13
|
|
0000000195e5: pop r14
|
|
0000000195e7: pop r15
|
|
0000000195e9: ret
|
|
|