push eax call _MmProbeAndLockPages@12 ; MmProbeAndLockPages(x,x,x) mov [ebp+ms_exc.disabled], 0FFFFFFFEh push 40000010h push edi push edi push 1 push edi push dword ptr [ebx+20h] call MmMapLockedPagesSpecifyCache mov ecx, eax mov [ebp+var_24], ecx test ecx, ecx jnz short loc_A0F8B3 push edi push offset _ExpProfileStateMutex call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) push [ebp+arg_0] call _MmUnlockPages@4 ; MmUnlockPages(x) push edi mov esi, [ebp+var_20] push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov esi, 0C000009Ah loc_A0F8A5: ; CODE XREF: NtStartProfile(x)+AEj mov ecx, ebx call ObfDereferenceObject mov eax, esi jmp loc_A0F934 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0F8B3: ; CODE XREF: NtStartProfile(x)+131j lea eax, [ebx+2Ch] push eax push dword ptr [ebx+28h] push dword ptr [ebx+24h] push dword ptr [ebx+14h] push dword ptr [ebx+8] push dword ptr [ebx+4] push ecx mov edx, [ebx] mov ecx, [ebp+var_20] call _KeInitializeProfile@36 ; KeInitializeProfile(x,x,x,x,x,x,x,x,x) mov ecx, [ebp+var_20] call _KeStartProfile@4 ; KeStartProfile(x) mov eax, [ebp+var_24] mov [ebx+1Ch], eax inc _ExpCurrentProfileUsage push edi push offset _ExpProfileStateMutex call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) mov ecx, ebx call ObfDereferenceObject xor eax, eax jmp short loc_A0F934 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0F8FB: ; DATA XREF: .text:006AA9DCo mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_28], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0F909: ; DATA XREF: .text:006AA9E0o mov esp, [ebp+ms_exc.old_esp] xor edi, edi push edi push offset _ExpProfileStateMutex call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) push edi push [ebp+var_20] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov ecx, [ebp+var_1C] call ObfDereferenceObject mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, [ebp+var_28] loc_A0F934: ; CODE XREF: NtStartProfile(x)+3Aj ; NtStartProfile(x)+15Ej ... mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 _NtStartProfile@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall NtStopProfile(x) _NtStopProfile@4 proc near ; DATA XREF: .text:00580C30o var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 0Ch mov eax, large fs:124h lea ecx, [esp+0Ch+var_C] push ebx push esi push edi mov al, [eax+15Ah] xor ebx, ebx push ebx push ecx mov byte ptr [esp+20h+var_4], al push [esp+20h+var_4] mov eax, ds:_ExProfileObjectType push eax push 1 push [ebp+arg_0] mov [esp+30h+var_8], ebx mov [esp+30h+var_C], ebx call _ObReferenceObjectByHandle@24 ; ObReferenceObjectByHandle(x,x,x,x,x,x) test eax, eax js short loc_A0FA02 push ebx push ebx push ebx push ebx mov esi, offset _ExpProfileStateMutex push esi call KeWaitForSingleObject mov edi, [esp+18h+var_C] cmp [edi+1Ch], ebx jnz short loc_A0F9B4 push ebx push esi call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) mov [esp+18h+var_8], 0C00000B7h jmp short loc_A0F9F7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0F9B4: ; CODE XREF: NtStopProfile(x)+5Bj mov ecx, [edi+18h] call _KeStopProfile@4 ; KeStopProfile(x) mov esi, [edi+1Ch] dec _ExpCurrentProfileUsage mov [edi+1Ch], ebx mov ebx, [esp+18h+var_C] mov edi, [edi+20h] push 0 push offset _ExpProfileStateMutex mov ebx, [ebx+18h] call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) push edi push esi call MmUnmapLockedPages push edi call _MmUnlockPages@4 ; MmUnlockPages(x) push 0 push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [esp+1Ch+var_10] loc_A0F9F7: ; CODE XREF: NtStopProfile(x)+6Cj mov ecx, edi call ObfDereferenceObject mov eax, [esp+1Ch+var_C] loc_A0FA02: ; CODE XREF: NtStopProfile(x)+43j pop edi pop esi pop ebx mov esp, ebp pop ebp retn 4 _NtStopProfile@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFAllocFn(x, x) _CMFAllocFn@8 proc near ; CODE XREF: XpressDecodeCreate(x,x)+4p arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push 636D6650h push [ebp+arg_4] push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) pop ebp retn 8 _CMFAllocFn@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFCheckAccess(x, x, x) _CMFCheckAccess@12 proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+143p ; NtMapCMFModule(x,x,x,x,x,x)+60Dp var_168 = dword ptr -168h var_164 = dword ptr -164h var_160 = dword ptr -160h var_15C = dword ptr -15Ch var_158 = dword ptr -158h var_151 = byte ptr -151h var_150 = dword ptr -150h var_8C = dword ptr -8Ch var_70 = dword ptr -70h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 168h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push 74h ; size_t xor ebx, ebx mov [ebp+var_164], edx lea eax, [ebp+var_8C] mov esi, ecx push ebx ; int push eax ; void * call _memset push 0C4h ; size_t lea eax, [ebp+var_150] push ebx ; int push eax ; void * call _memset add esp, 18h mov [ebp+var_158], ebx test esi, esi jnz short loc_A0FA7C mov esi, 0C000000Dh jmp loc_A0FC32 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FA7C: ; CODE XREF: CMFCheckAccess(x,x,x)+4Dj lea eax, [esi-18h] shr eax, 8 movzx edx, al movzx eax, byte ptr [esi-0Ch] xor edx, eax movzx eax, byte ptr ds:_ObHeaderCookie xor edx, eax lea eax, [ebp+var_164] push edi mov edi, ds:_ObTypeIndexTable[edx*4] add edi, 34h push edi push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) cmp _CMFSecurityDescriptor, ebx jnz short loc_A0FAFB mov edx, edi mov [ebp+var_15C], ebx lea ecx, [ebp+var_15C] call _CMFCreateSecurityDescriptor@8 ; CMFCreateSecurityDescriptor(x,x) mov esi, eax mov eax, 0C0000000h mov ecx, esi and ecx, eax cmp ecx, eax jz loc_A0FC31 mov ecx, [ebp+var_15C] mov edx, offset _CMFSecurityDescriptor xor eax, eax lock cmpxchg [edx], ecx test eax, eax jz short loc_A0FAFB push ebx push [ebp+var_15C] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A0FAFB: ; CODE XREF: CMFCheckAccess(x,x,x)+8Fj ; CMFCheckAccess(x,x,x)+CAj mov eax, large fs:124h lea edx, [ebp+var_150] mov ecx, large fs:124h mov ebx, [ebp+var_164] push edi ; int mov eax, [eax+80h] push ebx ; int push edx ; void * lea edx, [ebp+var_8C] push edx ; void * push eax ; int push ecx ; int call _SeCreateAccessStateEx@24 ; SeCreateAccessStateEx(x,x,x,x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A0FC31 lea eax, [ebp+var_70] push eax call _SeLockSubjectContext@4 ; SeLockSubjectContext(x) push [ebp+arg_0] lea eax, [ebp+var_70] mov [ebp+var_18], 1 push eax xor esi, esi mov [ebp+var_10], 12h lea eax, [ebp+var_18] mov [ebp+var_14], esi push eax mov [ebp+var_8], esi mov [ebp+var_C], esi call _SePrivilegeCheck@12 ; SePrivilegeCheck(x,x,x) mov [ebp+var_151], al mov [ebp+var_168], esi mov [ebp+var_160], esi test al, al jnz short loc_A0FBDD lea eax, [ebp+var_168] push eax lea eax, [ebp+var_160] push eax push [ebp+arg_0] lea eax, [ebp+var_158] push edi push eax push esi push ebx push 1 lea eax, [ebp+var_70] push eax push _CMFSecurityDescriptor call _SeAccessCheck@40 ; SeAccessCheck(x,x,x,x,x,x,x,x,x,x) mov [ebp+var_151], al cmp [ebp+var_158], esi jz short loc_A0FBE3 push [ebp+var_158] lea eax, [ebp+var_8C] push eax call SeAppendPrivileges push [ebp+var_158] call _SeFreePrivileges@4 ; SeFreePrivileges(x) jmp short loc_A0FBE3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FBDD: ; CODE XREF: CMFCheckAccess(x,x,x)+15Fj mov [ebp+var_160], ebx loc_A0FBE3: ; CODE XREF: CMFCheckAccess(x,x,x)+199j ; CMFCheckAccess(x,x,x)+1B8j lea eax, [ebp+var_70] push eax call _SeUnlockSubjectContext@4 ; SeUnlockSubjectContext(x) mov esi, [ebp+var_168] mov ecx, 0C0000000h mov eax, esi and eax, ecx cmp eax, ecx jz short loc_A0FC1D cmp [ebp+var_151], 0 jz short loc_A0FC18 mov eax, [ebp+var_160] not eax test eax, ebx jnz short loc_A0FC18 xor esi, esi jmp short loc_A0FC1D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FC18: ; CODE XREF: CMFCheckAccess(x,x,x)+1E3j ; CMFCheckAccess(x,x,x)+1EFj mov esi, 0C0000022h loc_A0FC1D: ; CODE XREF: CMFCheckAccess(x,x,x)+1DAj ; CMFCheckAccess(x,x,x)+1F3j lea ecx, [ebp+var_8C] call SepDeleteAccessState lea eax, [ebp+var_70] push eax call SeReleaseSubjectContext loc_A0FC31: ; CODE XREF: CMFCheckAccess(x,x,x)+B1j ; CMFCheckAccess(x,x,x)+113j pop edi loc_A0FC32: ; CODE XREF: CMFCheckAccess(x,x,x)+54j mov ecx, [ebp+var_4] mov eax, esi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 4 _CMFCheckAccess@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFCreateSecurityDescriptor(x, x) _CMFCreateSecurityDescriptor@8 proc near ; CODE XREF: CMFCheckAccess(x,x,x)+9Fp ; CMFSystemThreadRoutine(x)+334p var_44 = dword ptr -44h var_30 = dword ptr -30h var_2C = word ptr -2Ch var_28 = dword ptr -28h var_24 = word ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = word ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 44h push ebx xor eax, eax mov [ebp+var_2C], 500h push esi push edi lea edi, [ebp+var_44] mov [ebp+var_18], 100h stosd mov ebx, edx mov edx, ecx mov [ebp+var_24], 0F00h xor ecx, ecx mov [ebp+var_4], edx and [ebp+var_C], ecx stosd mov [ebp+var_30], ecx mov [ebp+var_1C], ecx mov [ebp+var_28], ecx stosd mov [ebp+var_14], ecx mov [ebp+var_10], ecx stosd stosd xor edi, edi test edx, edx jnz short loc_A0FC96 mov esi, 0C000000Dh jmp loc_A10121 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FC96: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+46j and [edx], ecx lea eax, [ebp+var_44] push 1 push eax call _RtlCreateSecurityDescriptor@8 ; RtlCreateSecurityDescriptor(x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A10109 push 636D6650h push 0Ch push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_20], eax test eax, eax jnz short loc_A0FCD6 mov ebx, [ebp+var_4] mov esi, 0C0000017h jmp loc_A10110 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FCD6: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+83j push 1 lea ecx, [ebp+var_1C] push ecx push eax call _RtlInitializeSid@12 ; RtlInitializeSid(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz short loc_A0FD1F mov esi, [ebp+var_20] push 0 push esi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 636D6650h push 20h push 1 and [eax], edi movzx eax, byte ptr [esi+1] mov [ebp+var_1C], eax call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax mov [ebp+var_C], esi test esi, esi jnz short loc_A0FD6E loc_A0FD1A: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+1A7j ; CMFCreateSecurityDescriptor(x,x)+205j ... mov esi, 0C0000017h loc_A0FD1F: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+A9j ; CMFCreateSecurityDescriptor(x,x)+1C4j ... mov ebx, [ebp+var_4] loc_A0FD22: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+429j push 0 push [ebp+var_20] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov eax, [ebp+var_C] test eax, eax jz short loc_A0FD3B push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A0FD3B: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+EDj mov eax, [ebp+var_10] test eax, eax jz short loc_A0FD4A push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A0FD4A: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+FCj test edi, edi jz short loc_A0FD56 push 0 push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A0FD56: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+108j mov eax, [ebp+var_14] test eax, eax jz loc_A1010C push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) jmp loc_A1010C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FD6E: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+D4j push 6 lea eax, [ebp+var_30] push eax push esi call _RtlInitializeSid@12 ; RtlInitializeSid(x,x,x) push 0 push esi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 1 push esi mov dword ptr [eax], 50h call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 2 push esi mov dword ptr [eax], 38FB89B5h call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 3 push esi mov dword ptr [eax], 0CBC28419h call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 4 push esi mov dword ptr [eax], 6D236C5Ch call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 5 push esi mov dword ptr [eax], 6E770057h call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 636D6650h push 10h push 1 mov dword ptr [eax], 876402C0h movzx eax, byte ptr [esi+1] add eax, [ebp+var_1C] mov [ebp+var_1C], eax call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_10], eax test eax, eax jz loc_A0FD1A push 2 lea ecx, [ebp+var_28] push ecx push eax call _RtlInitializeSid@12 ; RtlInitializeSid(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A0FD1F mov esi, [ebp+var_10] push 0 push esi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) xor edi, edi inc edi push edi push esi mov dword ptr [eax], 2 call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 636D6650h push 10h push edi mov [eax], edi movzx eax, byte ptr [esi+1] add eax, [ebp+var_1C] mov [ebp+var_8], eax call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax mov [ebp+var_1C], edi test edi, edi jz loc_A0FD1A push 2 lea eax, [ebp+var_28] push eax push edi call _RtlInitializeSid@12 ; RtlInitializeSid(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A0FD1F push 0 push edi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 2 pop esi push 1 push edi mov [eax], esi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 636D6650h push 10h push 1 mov [eax], esi movzx eax, byte ptr [edi+1] add eax, [ebp+var_8] mov [ebp+var_8], eax call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_14], eax test eax, eax jz loc_A0FD1A push esi lea ecx, [ebp+var_30] push ecx push eax call _RtlInitializeSid@12 ; RtlInitializeSid(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A0FD1F mov esi, [ebp+var_14] push 0 push esi call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 1 push esi mov dword ptr [eax], 20h call _RtlSubAuthoritySid@8 ; RtlSubAuthoritySid(x,x) push 636D6650h mov dword ptr [eax], 220h movzx eax, byte ptr [esi+1] add eax, [ebp+var_8] lea esi, ds:6Ch[eax*4] push esi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A0FF0F mov edi, [ebp+var_1C] mov esi, 0C0000017h jmp loc_A0FD1F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A0FF0F: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+2BCj push 2 ; int push esi ; size_t push edi ; void * call _RtlCreateAcl@12 ; RtlCreateAcl(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A1005F mov eax, 10000000h mov [ebp+var_8], eax test ebx, ebx jz short loc_A0FF42 push ebx lea eax, [ebp+var_8] push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) mov eax, [ebp+var_8] loc_A0FF42: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+2EFj push 0 push [ebp+var_C] mov ecx, edi push eax push 3 push 2 pop edx call RtlpAddKnownAce mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A1005F mov eax, 10000000h mov [ebp+var_8], eax test ebx, ebx jz short loc_A0FF7E push ebx lea eax, [ebp+var_8] push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) mov eax, [ebp+var_8] loc_A0FF7E: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+32Bj mov ecx, [ebp+var_14] push 0 push ecx push eax push 3 push 2 pop edx mov ecx, edi call RtlpAddKnownAce mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A1005F mov eax, 80000000h mov [ebp+var_8], eax test ebx, ebx jz short loc_A0FFBB push ebx lea eax, [ebp+var_8] push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) mov eax, [ebp+var_8] loc_A0FFBB: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+368j push 0 push [ebp+var_20] mov ecx, edi push eax push 3 push 2 pop edx call RtlpAddKnownAce mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz loc_A1005F mov eax, 80000000h mov [ebp+var_8], eax test ebx, ebx jz short loc_A0FFF7 push ebx lea eax, [ebp+var_8] push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) mov eax, [ebp+var_8] loc_A0FFF7: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+3A4j mov ecx, [ebp+var_10] push 0 push ecx push eax push 3 push 2 pop edx mov ecx, edi call RtlpAddKnownAce mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz short loc_A1005F mov eax, 80000000h mov [ebp+var_8], eax test ebx, ebx jz short loc_A10030 push ebx lea eax, [ebp+var_8] push eax call _RtlMapGenericMask@8 ; RtlMapGenericMask(x,x) mov eax, [ebp+var_8] loc_A10030: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+3DDj xor ebx, ebx mov ecx, edi push ebx push [ebp+var_1C] push eax push 3 push 2 pop edx call RtlpAddKnownAce mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz short loc_A1005F push edi call RtlValidAcl test al, al jnz short loc_A10072 mov esi, 0C0000077h loc_A1005F: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+2DFj ; CMFCreateSecurityDescriptor(x,x)+31Bj ... mov ebx, [ebp+var_4] loc_A10062: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+4ABj ; CMFCreateSecurityDescriptor(x,x)+4C0j push 0 push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [ebp+var_1C] jmp loc_A0FD22 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10072: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+414j push ebx push edi push 1 lea eax, [ebp+var_44] push eax call RtlSetDaclSecurityDescriptor mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz short loc_A1005F push ebx push [ebp+var_C] lea eax, [ebp+var_44] push eax call _RtlSetOwnerSecurityDescriptor@12 ; RtlSetOwnerSecurityDescriptor(x,x,x) mov ecx, 0C0000000h mov esi, eax and eax, ecx cmp eax, ecx jz short loc_A1005F lea eax, [ebp+var_44] push eax call _RtlValidSecurityDescriptor@4 ; RtlValidSecurityDescriptor(x) test al, al jnz short loc_A100BA mov esi, 0C0000079h jmp short loc_A1005F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A100BA: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+46Dj lea eax, [ebp+var_8] mov [ebp+var_8], ebx push eax push ebx lea eax, [ebp+var_44] push eax call _RtlAbsoluteToSelfRelativeSD@12 ; RtlAbsoluteToSelfRelativeSD(x,x,x) mov esi, eax cmp [ebp+var_8], ebx jz short loc_A1005F push 636D6650h push [ebp+var_8] push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov ebx, [ebp+var_4] mov [ebx], eax test eax, eax jnz short loc_A100F4 mov esi, 0C0000017h jmp loc_A10062 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A100F4: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+4A4j lea ecx, [ebp+var_8] push ecx push eax lea eax, [ebp+var_44] push eax call _RtlAbsoluteToSelfRelativeSD@12 ; RtlAbsoluteToSelfRelativeSD(x,x,x) mov esi, eax jmp loc_A10062 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10109: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+6Aj mov ebx, [ebp+var_4] loc_A1010C: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+117j ; CMFCreateSecurityDescriptor(x,x)+125j test esi, esi jns short loc_A10121 loc_A10110: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+8Dj mov eax, [ebx] test eax, eax jz short loc_A10121 push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and dword ptr [ebx], 0 loc_A10121: ; CODE XREF: CMFCreateSecurityDescriptor(x,x)+4Dj ; CMFCreateSecurityDescriptor(x,x)+4CAj ... pop edi mov eax, esi pop esi pop ebx leave retn _CMFCreateSecurityDescriptor@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFFlushHitsFile(x, x) _CMFFlushHitsFile@8 proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+6EBp var_278 = dword ptr -278h var_274 = dword ptr -274h var_270 = dword ptr -270h var_26C = dword ptr -26Ch var_268 = dword ptr -268h var_264 = dword ptr -264h var_260 = dword ptr -260h var_25C = dword ptr -25Ch var_258 = dword ptr -258h var_254 = dword ptr -254h var_250 = dword ptr -250h var_24C = dword ptr -24Ch var_248 = dword ptr -248h var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = word ptr -224h ms_exc = CPPEH_RECORD ptr -18h push 268h push offset dword_6AAA60 call __SEH_prolog4_GS mov [ebp+var_230], edx mov [ebp+var_234], ecx xor esi, esi mov [ebp+var_228], esi mov [ebp+var_23C], esi mov [ebp+var_238], esi push 6 pop ecx xor eax, eax lea edi, [ebp+var_254] rep stosd mov [ebp+var_268], esi mov [ebp+var_264], esi mov [ebp+var_22C], esi mov [ebp+var_278], esi mov [ebp+var_274], esi mov ebx, esi mov eax, [ebp+var_234] test eax, eax jnz short loc_A10198 mov eax, 0C000000Dh jmp loc_A10400 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10198: ; CODE XREF: CMFFlushHitsFile(x,x)+64j test _CMFFlagsCache, 8 jnz short loc_A101E0 mov [ebp+var_25C], eax mov [ebp+var_258], edx mov eax, large fs:124h mov ecx, [eax+80h] lea eax, [ebp+var_23C] push eax lea eax, [ebp+var_258] push eax lea edx, [ebp+var_25C] call MmFlushVirtualMemory cmp eax, 0C0000088h jnz loc_A10400 loc_A101E0: ; CODE XREF: CMFFlushHitsFile(x,x)+7Aj push _CMFCacheIndex push offset ??_C@_1CK@DHBGEEEI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAR?$AAe?$AAs@NNGAKEGL@ ; "\\SystemRoot\\Rescache" push offset ??_C@_1CO@FCIFCGHL@?$AA?$CF?$AAs?$AA?2?$AAr?$AAc?$AA?$CF?$AA0?$AA4?$AAu?$AA?2?$AAr?$AAe?$AAs?$AAc?$AAa@NNGAKEGL@ ; wchar_t * push 104h ; int lea eax, [ebp+var_224] push eax ; wchar_t * call RtlStringCchPrintfW add esp, 14h mov edi, eax test edi, edi js loc_A103CB lea eax, [ebp+var_224] push eax lea eax, [ebp+var_268] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) mov [ebp+var_254], 18h mov [ebp+var_250], esi mov [ebp+var_248], 240h lea eax, [ebp+var_268] mov [ebp+var_24C], eax mov [ebp+var_244], esi mov [ebp+var_240], esi push esi push 7 lea eax, [ebp+var_23C] push eax lea eax, [ebp+var_254] push eax push 0C0000000h lea eax, [ebp+var_228] push eax call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) mov edi, eax mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jnz short loc_A1028D mov [ebp+var_228], esi jmp loc_A103CB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1028D: ; CODE XREF: CMFFlushHitsFile(x,x)+158j mov [ebp+var_254], 18h mov [ebp+var_250], esi mov [ebp+var_248], 200h mov [ebp+var_24C], esi mov [ebp+var_244], esi mov [ebp+var_240], esi push esi push 1 lea eax, [ebp+var_254] push eax push 1F0003h lea eax, [ebp+var_22C] push eax call _ZwCreateEvent@20 ; ZwCreateEvent(x,x,x,x,x) mov edi, eax mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jz loc_A103CB mov [ebp+var_270], esi mov [ebp+var_26C], esi lea edx, [ebp+var_270] mov ecx, [ebp+var_228] call _CMFGetFileSizeEx@8 ; CMFGetFileSizeEx(x,x) mov edi, eax mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jz loc_A103CB mov edi, [ebp+var_270] mov eax, [ebp+var_230] cmp eax, edi jnb short loc_A10325 mov edi, eax loc_A10325: ; CODE XREF: CMFFlushHitsFile(x,x)+1F9j push 636D6650h push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov ebx, eax mov [ebp+var_230], ebx test ebx, ebx jnz short loc_A10348 mov edi, 0C0000017h jmp loc_A103CB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10348: ; CODE XREF: CMFFlushHitsFile(x,x)+214j mov [ebp+ms_exc.disabled], esi push edi ; size_t mov ecx, [ebp+var_234] push ecx ; void * push ebx ; void * call _memcpy add esp, 0Ch mov [ebp+ms_exc.disabled], 0FFFFFFFEh push esi lea eax, [ebp+var_278] push eax push edi push ebx lea eax, [ebp+var_23C] push eax push esi push esi push [ebp+var_22C] push [ebp+var_228] call _ZwWriteFile@36 ; ZwWriteFile(x,x,x,x,x,x,x,x,x) mov edi, eax cmp edi, 103h jnz short loc_A103CB push esi push esi push [ebp+var_22C] call _ZwWaitForSingleObject@12 ; ZwWaitForSingleObject(x,x,x) mov edi, eax jmp short loc_A103CB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A103A2: ; DATA XREF: .text:006AAA74o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_260], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A103B3: ; DATA XREF: .text:006AAA78o mov esp, [ebp+ms_exc.old_esp] mov edi, [ebp+var_260] mov [ebp+ms_exc.disabled], 0FFFFFFFEh xor esi, esi mov ebx, [ebp+var_230] loc_A103CB: ; CODE XREF: CMFFlushHitsFile(x,x)+E0j ; CMFFlushHitsFile(x,x)+160j ... test ebx, ebx jz short loc_A103D6 push esi push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A103D6: ; CODE XREF: CMFFlushHitsFile(x,x)+2A5j cmp [ebp+var_22C], 0 jz short loc_A103EA push [ebp+var_22C] call _ZwClose@4 ; ZwClose(x) loc_A103EA: ; CODE XREF: CMFFlushHitsFile(x,x)+2B5j cmp [ebp+var_228], 0 jz short loc_A103FE push [ebp+var_228] call _ZwClose@4 ; ZwClose(x) loc_A103FE: ; CODE XREF: CMFFlushHitsFile(x,x)+2C9j mov eax, edi loc_A10400: ; CODE XREF: CMFFlushHitsFile(x,x)+6Bj ; CMFFlushHitsFile(x,x)+B2j mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _CMFFlushHitsFile@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFGetFileSizeEx(x, x) _CMFGetFileSizeEx@8 proc near ; CODE XREF: CMFFlushHitsFile(x,x)+1D5p ; CMFSystemThreadRoutine(x)+2D0p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_18 = dword ptr -18h var_14 = dword ptr -14h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 2Ch mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi push 6 mov esi, ecx lea edi, [ebp+var_20] pop ecx xor eax, eax mov ebx, edx and [ebp+var_28], eax and [ebp+var_24], eax push 5 rep stosd push 18h lea eax, [ebp+var_20] push eax lea eax, [ebp+var_28] push eax push esi call _ZwQueryInformationFile@20 ; ZwQueryInformationFile(x,x,x,x,x) mov edx, 0C0000000h mov ecx, eax and ecx, edx cmp ecx, edx jz short loc_A10465 mov eax, [ebp+var_18] mov [ebx], eax mov eax, [ebp+var_14] mov [ebx+4], eax xor eax, eax loc_A10465: ; CODE XREF: CMFGetFileSizeEx(x,x)+46j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _CMFGetFileSizeEx@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFGetLargePageSectionSize(x, x) _CMFGetLargePageSectionSize@8 proc near ; CODE XREF: CMFSystemThreadRoutine(x)+2F4p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx mov ebx, ds:0FFDF0244h mov eax, ecx push esi shr ebx, 0Ch mov [ebp+var_14], eax push edi mov edi, edx test ebx, ebx jnz short loc_A1049D mov esi, 0C00000BBh jmp loc_A10542 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1049D: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+1Dj mov ecx, [eax] xor esi, esi mov eax, [eax+4] mov [ebp+var_4], eax mov eax, ecx and eax, 0FFFh mov [ebp+var_8], ecx or eax, esi jz short loc_A104BA xor edx, edx inc edx jmp short loc_A104BC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A104BA: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+3Fj mov edx, esi loc_A104BC: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+44j mov eax, [ebp+var_4] shrd ecx, eax, 0Ch shr eax, 0Ch add ecx, edx mov [ebp+var_10], ecx adc eax, esi xor edx, edx mov [ebp+var_C], eax mov eax, ecx div ebx test edx, edx jnz short loc_A104E7 mov eax, [ebp+var_8] mov [edi], eax mov eax, [ebp+var_4] mov [edi+4], eax jmp short loc_A10542 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A104E7: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+64j mov esi, [ebp+var_10] xor eax, eax mov ecx, ebx sub ecx, edx mov edx, [ebp+var_C] shld eax, ecx, 0Ch shld edx, esi, 0Ch shl ecx, 0Ch shl esi, 0Ch add ecx, esi push 0 adc eax, edx add ecx, 0FFFFF001h mov [edi], ecx adc eax, 0FFFFFFFFh mov [edi+4], eax shrd ecx, eax, 0Ch pop esi shr eax, 0Ch add ecx, 1 push esi push ebx adc eax, esi push eax push ecx call __aullrem or eax, edx jnz short loc_A1053D cmp [edi+4], esi jnz short loc_A1053D mov ecx, [ebp+var_14] mov eax, [edi] cmp eax, [ecx] jnb short loc_A10542 loc_A1053D: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+B9j ; CMFGetLargePageSectionSize(x,x)+BEj mov esi, 0C0000001h loc_A10542: ; CODE XREF: CMFGetLargePageSectionSize(x,x)+24j ; CMFGetLargePageSectionSize(x,x)+71j ... pop edi mov eax, esi pop esi pop ebx leave retn _CMFGetLargePageSectionSize@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall CMFReadCompressedSegment(void *,int) _CMFReadCompressedSegment@16 proc near ; CODE XREF: CMFSystemThreadRoutine(x)+4CEp var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 44h push ebx push esi push edi xor eax, eax mov [ebp+var_20], edx mov esi, ecx mov [ebp+var_28], eax mov [ebp+var_24], eax lea edi, [ebp+var_40] mov [ebp+var_C], eax mov [ebp+var_14], eax mov [ebp+var_4], eax push 6 pop ecx rep stosd mov edi, eax test esi, esi jz loc_A10716 mov ebx, [ebp+arg_4] test ebx, ebx jz loc_A10716 test edx, edx jz loc_A10716 cmp dword ptr [ebx+54h], 400h jbe short loc_A105A2 mov esi, 0C000000Dh jmp loc_A10745 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A105A2: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+4Dj call _XpressDecodeCreate@8 ; XpressDecodeCreate(x,x) mov edi, eax mov [ebp+arg_4], edi test edi, edi jnz short loc_A105BA mov esi, 0C0000017h jmp loc_A1071B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A105BA: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+65j push esi xor eax, eax mov [ebp+var_40], 18h push 8000000h push 2 push eax mov [ebp+var_3C], eax mov [ebp+var_38], eax mov [ebp+var_30], eax mov [ebp+var_2C], eax lea eax, [ebp+var_40] push eax push 4 lea eax, [ebp+var_C] mov [ebp+var_34], 240h push eax call _ZwCreateSection@28 ; ZwCreateSection(x,x,x,x,x,x,x) mov esi, eax test esi, esi js loc_A1071B push 2 push 400000h push 2 lea eax, [ebp+var_14] push eax lea eax, [ebp+var_28] push eax push 0 push 0 lea eax, [ebp+var_4] push eax push 0FFFFFFFFh push [ebp+var_C] call _ZwMapViewOfSection@40 ; ZwMapViewOfSection(x,x,x,x,x,x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A1062A and [ebp+var_4], 0 jmp loc_A1072B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1062A: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+D6j mov esi, [ebp+var_14] mov eax, 1060h cmp esi, eax jnb short loc_A10640 loc_A10636: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+FAj mov esi, 0C0000206h jmp loc_A1071B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10640: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+EBj cmp [ebp+arg_0], eax jb short loc_A10636 mov edi, [ebp+var_20] push eax ; size_t push ebx ; void * push edi ; void * call _memcpy mov ecx, [ebp+arg_0] lea eax, [esi-1060h] mov [ebp+var_10], eax add ecx, 0FFFFEFA0h mov eax, [ebp+var_4] xor esi, esi add eax, 1060h mov [ebp+var_18], ecx mov [ebp+var_8], eax add esp, 0Ch lea eax, [edi+1060h] mov [ebp+var_1C], esi mov edi, [ebx+50h] mov [ebp+arg_0], eax mov eax, [ebx+54h] test eax, eax jz short loc_A10701 lea edx, [ebx+5Ch] mov [ebp+var_20], edx loc_A10691: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+1B6j dec eax cmp esi, eax jnz short loc_A1069B mov esi, [ebx+58h] jmp short loc_A106A0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1069B: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+14Bj mov esi, [edx+4] sub esi, [edx] loc_A106A0: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+150j cmp esi, [ebp+var_10] ja short loc_A1070C test ecx, ecx jz short loc_A1070C cmp edi, ecx jbe short loc_A106AF mov edi, ecx loc_A106AF: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+162j cmp esi, edi jnz short loc_A106C4 push edi ; size_t push [ebp+var_8] ; void * push [ebp+arg_0] ; void * call _memcpy add esp, 0Ch jmp short loc_A106D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A106C4: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+168j mov edx, [ebp+arg_0] mov ecx, [ebp+arg_4] push esi push [ebp+var_8] push edi push edi call _XpressDecode@24 ; XpressDecode(x,x,x,x,x,x) cmp eax, edi jnz short loc_A10705 loc_A106D9: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+179j add [ebp+var_8], esi sub [ebp+var_10], esi mov ecx, [ebp+var_18] mov esi, [ebp+var_1C] sub ecx, edi add [ebp+arg_0], edi inc esi mov edx, [ebp+var_20] mov eax, [ebx+54h] add edx, 4 mov [ebp+var_18], ecx mov [ebp+var_1C], esi mov [ebp+var_20], edx cmp esi, eax jb short loc_A10691 loc_A10701: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+140j xor esi, esi jmp short loc_A10711 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10705: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+18Ej mov esi, 0C000025Fh jmp short loc_A10711 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1070C: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+15Aj ; CMFReadCompressedSegment(x,x,x,x)+15Ej mov esi, 0C0000206h loc_A10711: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+1BAj ; CMFReadCompressedSegment(x,x,x,x)+1C1j mov edi, [ebp+arg_4] jmp short loc_A1071B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10716: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+2Dj ; CMFReadCompressedSegment(x,x,x,x)+38j ... mov esi, 0C000000Dh loc_A1071B: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+6Cj ; CMFReadCompressedSegment(x,x,x,x)+A9j ... cmp [ebp+var_4], 0 jz short loc_A1072B push [ebp+var_4] push 0FFFFFFFFh call _ZwUnmapViewOfSection@8 ; ZwUnmapViewOfSection(x,x) loc_A1072B: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+DCj ; CMFReadCompressedSegment(x,x,x,x)+1D6j cmp [ebp+var_C], 0 jz short loc_A10739 push [ebp+var_C] call _ZwClose@4 ; ZwClose(x) loc_A10739: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+1E6j test edi, edi jz short loc_A10745 push ecx mov ecx, edi call _XpressDecodeClose@12 ; XpressDecodeClose(x,x,x) loc_A10745: ; CODE XREF: CMFReadCompressedSegment(x,x,x,x)+54j ; CMFReadCompressedSegment(x,x,x,x)+1F2j pop edi mov eax, esi pop esi pop ebx leave retn 8 _CMFReadCompressedSegment@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFRegisterEventTime(x) _CMFRegisterEventTime@4 proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+211p ; NtMapCMFModule(x,x,x,x,x,x)+33Ap ... var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_C = dword ptr -0Ch var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 58h mov eax, ___security_cookie xor eax, esp mov [esp+58h+var_4], eax push esi push edi xor edi, edi lea eax, [esp+60h+var_40] push offset ??_C@_1HO@HPCDOJBK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI@NNGAKEGL@ push eax mov si, cx mov [esp+68h+var_40], edi mov [esp+68h+var_3C], edi mov [esp+68h+var_54], edi mov [esp+68h+var_50], edi mov [esp+68h+var_58], edi mov [esp+68h+var_38], edi mov [esp+68h+var_34], edi mov [esp+68h+var_44], edi call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push edi push edi push edi lea eax, [esp+6Ch+var_40] mov [esp+6Ch+var_30], 18h mov [esp+6Ch+var_28], eax lea eax, [esp+6Ch+var_30] push edi push eax push 2001Fh lea eax, [esp+78h+var_58] mov [esp+78h+var_2C], edi push eax mov [esp+7Ch+var_24], 240h mov [esp+7Ch+var_20], edi mov [esp+7Ch+var_1C], edi call _ZwCreateKey@28 ; ZwCreateKey(x,x,x,x,x,x,x) test eax, eax js loc_A1090D lea eax, [esp+60h+var_38] push eax call KeQuerySystemTime movzx eax, si push 0Bh pop esi sub eax, 1 jz short loc_A10823 sub eax, 1 jz short loc_A1080F dec eax sub eax, 1 jz short loc_A10808 mov eax, 0C000000Dh jmp loc_A1090D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10808: ; CODE XREF: CMFRegisterEventTime(x)+AEj push offset ??_C@_1BI@OHJGJLDO@?$AAC?$AAM?$AAF?$AAS?$AAt?$AAo?$AAp?$AAT?$AAi?$AAm?$AAe@NNGAKEGL@ ; "CMFStopTime" jmp short loc_A10814 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1080F: ; CODE XREF: CMFRegisterEventTime(x)+A8j push offset ??_C@_1BK@GCJNNPH@?$AAC?$AAM?$AAF?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm?$AAe@NNGAKEGL@ loc_A10814: ; CODE XREF: CMFRegisterEventTime(x)+BFj lea eax, [esp+64h+var_54] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) jmp loc_A108E9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10823: ; CODE XREF: CMFRegisterEventTime(x)+A3j push offset ??_C@_1BK@GCJNNPH@?$AAC?$AAM?$AAF?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm?$AAe@NNGAKEGL@ lea eax, [esp+64h+var_54] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) lea eax, [esp+60h+var_44] push eax push 14h lea eax, [esp+68h+var_18] push eax push 2 lea eax, [esp+70h+var_54] push eax push [esp+74h+var_58] call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) test eax, eax js short loc_A10886 cmp [esp+60h+var_14], esi jnz short loc_A10886 push offset ??_C@_1CC@IEGFOIJJ@?$AAC?$AAM?$AAF?$AAL?$AAa?$AAs?$AAt?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm@NNGAKEGL@ ; "CMFLastStartTime" lea eax, [esp+64h+var_4C] mov [esp+64h+var_4C], edi push eax mov [esp+68h+var_48], edi call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push 8 lea eax, [esp+64h+var_C] push eax push esi push edi lea eax, [esp+70h+var_4C] push eax push [esp+74h+var_58] call _ZwSetValueKey@24 ; ZwSetValueKey(x,x,x,x,x,x) loc_A10886: ; CODE XREF: CMFRegisterEventTime(x)+102j ; CMFRegisterEventTime(x)+108j push offset ??_C@_1CA@HHFNNGD@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm?$AAe@NNGAKEGL@ lea eax, [esp+64h+var_54] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) lea eax, [esp+60h+var_44] push eax push 14h lea eax, [esp+68h+var_18] push eax push 2 lea eax, [esp+70h+var_54] push eax push [esp+74h+var_58] call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) test eax, eax js short loc_A108E9 cmp [esp+60h+var_14], esi jnz short loc_A108E9 push offset ??_C@_1CI@GJIDLDKO@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAL?$AAa?$AAs?$AAt?$AAS?$AAt?$AAa?$AAr?$AAt@NNGAKEGL@ lea eax, [esp+64h+var_4C] mov [esp+64h+var_4C], edi push eax mov [esp+68h+var_48], edi call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push 8 lea eax, [esp+64h+var_C] push eax push esi push edi lea eax, [esp+70h+var_4C] push eax push [esp+74h+var_58] call _ZwSetValueKey@24 ; ZwSetValueKey(x,x,x,x,x,x) loc_A108E9: ; CODE XREF: CMFRegisterEventTime(x)+D0j ; CMFRegisterEventTime(x)+165j ... push 8 lea eax, [esp+64h+var_38] push eax push esi push edi lea eax, [esp+70h+var_54] push eax push [esp+74h+var_58] call _ZwSetValueKey@24 ; ZwSetValueKey(x,x,x,x,x,x) push [esp+60h+var_58] mov esi, eax call _ZwClose@4 ; ZwClose(x) mov eax, esi loc_A1090D: ; CODE XREF: CMFRegisterEventTime(x)+8Aj ; CMFRegisterEventTime(x)+B5j mov ecx, [esp+60h+var_4] pop edi pop esi xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn _CMFRegisterEventTime@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall CMFSystemThreadRoutine(x) _CMFSystemThreadRoutine@4 proc near ; DATA XREF: NtMapCMFModule(x,x,x,x,x,x)+550o var_290 = dword ptr -290h var_28A = byte ptr -28Ah var_288 = dword ptr -288h var_284 = dword ptr -284h var_280 = dword ptr -280h var_27A = byte ptr -27Ah var_279 = byte ptr -279h var_278 = dword ptr -278h var_274 = dword ptr -274h var_270 = dword ptr -270h var_26C = dword ptr -26Ch var_268 = dword ptr -268h var_264 = dword ptr -264h var_260 = dword ptr -260h var_25C = dword ptr -25Ch var_258 = dword ptr -258h var_254 = dword ptr -254h var_250 = dword ptr -250h var_24C = dword ptr -24Ch var_248 = dword ptr -248h var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = dword ptr -214h var_210 = word ptr -210h var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 284h mov eax, ___security_cookie xor eax, esp mov [esp+284h+var_4], eax push ebx push esi push edi xor edx, edx xor eax, eax mov ebx, [ebp+arg_0] mov [esp+290h+var_228], edx mov [esp+290h+var_224], edx mov [esp+290h+var_230], edx mov [esp+290h+var_22C], edx mov [esp+290h+var_268], edx mov [esp+290h+var_264], edx mov [esp+290h+var_220], edx mov [esp+290h+var_21C], edx mov [esp+290h+var_250], edx mov [esp+290h+var_218], edx mov [esp+290h+var_214], edx mov [esp+290h+var_279], dl mov [esp+290h+var_260], edx mov [esp+290h+var_26C], edx mov [esp+290h+var_254], edx mov [esp+290h+var_24C], edx mov [esp+290h+var_25C], edx mov [esp+290h+var_270], edx lea edi, [esp+290h+var_248] push 6 pop ecx rep stosd mov edi, edx mov [esp+290h+var_280], edi test ebx, ebx jz loc_A10EE4 mov eax, [ebx+28h] cmp eax, 10h jnz short loc_A109C5 push dword ptr [ebx+4] mov [esp+294h+var_274], offset aRescdir ; "RESCDIR" push offset ??_C@_1CK@DHBGEEEI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAR?$AAe?$AAs@NNGAKEGL@ ; "\\SystemRoot\\Rescache" push offset ??_C@_1CO@CAEBGMOI@?$AA?$CF?$AAs?$AA?2?$AAr?$AAc?$AA?$CF?$AA0?$AA4?$AAu?$AA?2?$AAr?$AAe?$AAs?$AAc?$AAa@NNGAKEGL@ jmp loc_A10A47 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A109C5: ; CODE XREF: CMFSystemThreadRoutine(x)+8Bj cmp eax, 20h jnz short loc_A10A27 push 636D6650h mov eax, 1060h push eax push 1 mov [esp+29Ch+var_258], eax call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax mov [esp+290h+var_280], edi test edi, edi jnz short loc_A109F4 mov esi, 0C0000017h jmp loc_A10E63 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A109F4: ; CODE XREF: CMFSystemThreadRoutine(x)+CAj push dword ptr [ebx+18h] lea eax, [esp+294h+var_210] mov [esp+294h+var_274], offset aRescseg ; "RESCSEG" push dword ptr [ebx+4] mov [esp+298h+var_278], edi push offset ??_C@_1CK@DHBGEEEI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAR?$AAe?$AAs@NNGAKEGL@ ; "\\SystemRoot\\Rescache" push offset ??_C@_1DA@KEPEHAO@?$AA?$CF?$AAs?$AA?2?$AAr?$AAc?$AA?$CF?$AA0?$AA4?$AAu?$AA?2?$AAs?$AAe?$AAg?$AAm?$AAe@NNGAKEGL@ ; wchar_t * push 104h ; int push eax ; wchar_t * call RtlStringCchPrintfW add esp, 18h jmp short loc_A10A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10A27: ; CODE XREF: CMFSystemThreadRoutine(x)+AAj cmp eax, 100h jnz loc_A10E5E push dword ptr [ebx+4] mov [esp+294h+var_274], offset aReschit ; "RESCHIT" push offset ??_C@_1CK@DHBGEEEI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAR?$AAe?$AAs@NNGAKEGL@ ; "\\SystemRoot\\Rescache" push offset ??_C@_1CO@FCIFCGHL@?$AA?$CF?$AAs?$AA?2?$AAr?$AAc?$AA?$CF?$AA0?$AA4?$AAu?$AA?2?$AAr?$AAe?$AAs?$AAc?$AAa@NNGAKEGL@ ; wchar_t * loc_A10A47: ; CODE XREF: CMFSystemThreadRoutine(x)+A2j lea eax, [esp+29Ch+var_218] mov [esp+29Ch+var_258], 8 mov [esp+29Ch+var_278], eax lea eax, [esp+29Ch+var_210] push 104h ; int push eax ; wchar_t * call RtlStringCchPrintfW add esp, 14h loc_A10A6F: ; CODE XREF: CMFSystemThreadRoutine(x)+107j mov edi, 0C0000000h mov esi, eax and eax, edi cmp eax, edi jz short loc_A10AD9 lea eax, [esp+290h+var_210] push eax lea eax, [esp+294h+var_220] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) xor ecx, ecx mov [esp+290h+var_248], 18h push ecx lea eax, [esp+294h+var_220] mov [esp+294h+var_244], ecx mov [esp+294h+var_240], eax lea eax, [esp+294h+var_228] push 7 push eax lea eax, [esp+29Ch+var_248] mov [esp+29Ch+var_23C], 240h push eax push edi lea eax, [esp+2A4h+var_26C] mov [esp+2A4h+var_238], ecx push eax mov [esp+2A8h+var_234], ecx call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) mov esi, eax and eax, edi cmp eax, edi jnz short loc_A10AE2 and [esp+290h+var_26C], 0 loc_A10AD9: ; CODE XREF: CMFSystemThreadRoutine(x)+15Cj ; CMFSystemThreadRoutine(x)+203j ... mov edi, [esp+290h+var_280] jmp loc_A10E63 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10AE2: ; CODE XREF: CMFSystemThreadRoutine(x)+1B4j xor eax, eax mov [esp+290h+var_248], 18h push eax mov [esp+294h+var_244], eax mov [esp+294h+var_240], eax mov [esp+294h+var_238], eax mov [esp+294h+var_234], eax lea eax, [esp+294h+var_248] push 1 push eax push 1F0003h lea eax, [esp+2A0h+var_260] mov [esp+2A0h+var_23C], 200h push eax call _ZwCreateEvent@20 ; ZwCreateEvent(x,x,x,x,x) mov esi, eax and eax, edi cmp eax, edi jz short loc_A10AD9 xor ecx, ecx lea eax, [esp+290h+var_268] push ecx push eax push [esp+298h+var_258] lea eax, [esp+29Ch+var_228] push [esp+29Ch+var_278] push eax push ecx push ecx push [esp+2ACh+var_260] push [esp+2B0h+var_26C] call _ZwReadFile@36 ; ZwReadFile(x,x,x,x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A10AD9 push 0 push 0 push [esp+298h+var_260] call _ZwWaitForSingleObject@12 ; ZwWaitForSingleObject(x,x,x) mov esi, eax test esi, esi jz short loc_A10B74 loc_A10B60: ; CODE XREF: CMFSystemThreadRoutine(x)+4B4j mov edi, [esp+290h+var_280] js loc_A10E63 mov esi, 0C0000001h jmp loc_A10E63 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10B74: ; CODE XREF: CMFSystemThreadRoutine(x)+240j mov ecx, [esp+290h+var_278] mov edx, [esp+290h+var_274] mov eax, [ecx] cmp eax, [edx] jnz loc_A10E54 mov eax, [ecx+4] cmp eax, [edx+4] jnz loc_A10E54 mov esi, [ebx+28h] xor edx, edx mov eax, [esp+290h+var_280] cmp esi, 20h jnz short loc_A10BB2 cmp [eax+4Ch], edx jz short loc_A10BB2 or dword ptr [ebx+14h], 4 mov [esp+290h+var_279], 1 mov byte ptr [ebx+0Ch], 1 loc_A10BB2: ; CODE XREF: CMFSystemThreadRoutine(x)+280j ; CMFSystemThreadRoutine(x)+285j cmp byte ptr [ebx+0Ch], 0 mov ecx, [esp+290h+var_26C] mov [esp+290h+var_278], edx mov [esp+290h+var_274], edx mov [esp+290h+var_258], ecx jz short loc_A10C44 mov [esp+290h+var_258], edx mov [esp+290h+var_268], edx mov [esp+290h+var_264], edx cmp esi, 10h jz short loc_A10BEA cmp esi, 100h jz short loc_A10BEA mov eax, [eax+20h] mov [esp+290h+var_268], eax jmp short loc_A10C06 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10BEA: ; CODE XREF: CMFSystemThreadRoutine(x)+2B9j ; CMFSystemThreadRoutine(x)+2C1j lea edx, [esp+290h+var_268] call _CMFGetFileSizeEx@8 ; CMFGetFileSizeEx(x,x) mov esi, eax and eax, edi cmp eax, edi jz loc_A10AD9 mov eax, [esp+290h+var_268] mov esi, [ebx+28h] loc_A10C06: ; CODE XREF: CMFSystemThreadRoutine(x)+2CAj lea edx, [esp+290h+var_230] mov [esp+290h+var_278], eax lea ecx, [esp+290h+var_268] call _CMFGetLargePageSectionSize@8 ; CMFGetLargePageSectionSize(x,x) test eax, eax js short loc_A10C2E cmp dword ptr [ebx], 0 jge short loc_A10C2E mov eax, [esp+290h+var_230] lea ecx, [esp+290h+var_230] mov [esp+290h+var_274], ecx jmp short loc_A10C40 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10C2E: ; CODE XREF: CMFSystemThreadRoutine(x)+2FBj ; CMFSystemThreadRoutine(x)+300j and dword ptr [ebx], 7FFFFFFFh lea eax, [esp+290h+var_268] mov [esp+290h+var_274], eax mov eax, [esp+290h+var_278] loc_A10C40: ; CODE XREF: CMFSystemThreadRoutine(x)+30Ej mov [esp+290h+var_250], eax loc_A10C44: ; CODE XREF: CMFSystemThreadRoutine(x)+2A8j cmp esi, 100h jz short loc_A10C63 xor edx, edx lea ecx, [esp+290h+var_24C] call _CMFCreateSecurityDescriptor@8 ; CMFCreateSecurityDescriptor(x,x) mov esi, eax and eax, edi cmp eax, edi jz loc_A10AD9 loc_A10C63: ; CODE XREF: CMFSystemThreadRoutine(x)+32Cj push [esp+290h+var_258] mov eax, [esp+294h+var_24C] xor ecx, ecx push dword ptr [ebx] mov [esp+298h+var_244], ecx push 4 push [esp+29Ch+var_274] mov [esp+2A0h+var_240], ecx mov [esp+2A0h+var_238], eax mov [esp+2A0h+var_234], ecx jmp short loc_A10CCD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10C87: ; CODE XREF: CMFSystemThreadRoutine(x)+3D4j cmp byte ptr [ebx+0Ch], 0 jz loc_A10D2F mov ecx, [ebx] test ecx, ecx jns loc_A10D2F push [esp+2A0h+var_268] mov eax, [esp+2A4h+var_288] and ecx, 7FFFFFFFh mov [esp+2A4h+var_260], eax xor edx, edx mov eax, [esp+2A4h+var_25C] push ecx mov [esp+2A8h+var_248], eax lea eax, [esp+2A8h+var_278] push 4 mov [ebx], ecx mov [esp+2ACh+var_254], edx mov [esp+2ACh+var_250], edx mov [esp+2ACh+var_244], edx push eax loc_A10CCD: ; CODE XREF: CMFSystemThreadRoutine(x)+367j lea eax, [esp+2B0h+var_258] mov [esp+2B0h+var_258], 18h push eax push 6 lea eax, [esp+2B8h+var_26C] mov [esp+2B8h+var_24C], 240h push eax call _ZwCreateSection@28 ; ZwCreateSection(x,x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A10C87 mov eax, ds:_MmSectionObjectType lea ecx, [esp+2A0h+var_284] xor edx, edx push edx push ecx push edx push eax push 0F001Fh push [esp+2B4h+var_26C] mov [esp+2B8h+var_284], edx call _ObReferenceObjectByHandle@24 ; ObReferenceObjectByHandle(x,x,x,x,x,x) mov ecx, [esp+2A0h+var_284] mov esi, eax and eax, edi mov [esp+2A0h+var_264], ecx cmp eax, edi jnz short loc_A10D39 and [esp+2A0h+var_264], 0 jmp loc_A10AD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10D2F: ; CODE XREF: CMFSystemThreadRoutine(x)+36Dj ; CMFSystemThreadRoutine(x)+377j and [esp+2A0h+var_26C], 0 jmp loc_A10AD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10D39: ; CODE XREF: CMFSystemThreadRoutine(x)+405j cmp byte ptr [ebx+0Ch], 0 jz loc_A10E0E push 4 push 400000h push 2 lea eax, [esp+2ACh+var_260] xor ecx, ecx push eax lea eax, [esp+2B0h+var_278] mov [esp+2B0h+var_278], ecx push eax push ecx push ecx lea eax, [esp+2BCh+var_280] mov [esp+2BCh+var_274], ecx push eax push 0FFFFFFFFh push [esp+2C4h+var_26C] call _ZwMapViewOfSection@40 ; ZwMapViewOfSection(x,x,x,x,x,x,x,x,x,x) mov esi, eax and eax, edi cmp eax, edi jnz short loc_A10D84 and [esp+2A0h+var_280], 0 jmp loc_A10AD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10D84: ; CODE XREF: CMFSystemThreadRoutine(x)+45Aj cmp byte ptr [esp+17h], 0 jnz short loc_A10DD7 xor edi, edi lea eax, [esp+2A0h+var_278] push edi push eax push [esp+2A8h+var_288] lea eax, [esp+2ACh+var_238] mov [esp+2ACh+var_278], edi push [esp+2ACh+var_280] mov [esp+2B0h+var_274], edi push eax push edi push edi push [esp+2BCh+var_270] push dword ptr [esp+44h] call _ZwReadFile@36 ; ZwReadFile(x,x,x,x,x,x,x,x,x) mov esi, eax test esi, esi js loc_A10AD9 push edi push edi push [esp+2A8h+var_270] call _ZwWaitForSingleObject@12 ; ZwWaitForSingleObject(x,x,x) mov esi, eax test esi, esi jz short loc_A10DF7 jmp loc_A10B60 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10DD7: ; CODE XREF: CMFSystemThreadRoutine(x)+46Bj mov edi, [esp+2A0h+var_290] push edi ; int push [esp+2A4h+var_288] ; void * and dword ptr [edi+4Ch], 0 mov edx, [esp+2A8h+var_280] mov ecx, [esp+2Ch] call _CMFReadCompressedSegment@16 ; CMFReadCompressedSegment(x,x,x,x) mov esi, eax test esi, esi js short loc_A10E63 loc_A10DF7: ; CODE XREF: CMFSystemThreadRoutine(x)+4B2j push [esp+2A0h+var_280] push 0FFFFFFFFh call _ZwUnmapViewOfSection@8 ; ZwUnmapViewOfSection(x,x) mov ecx, [esp+2A0h+var_264] xor edx, edx mov [esp+2A0h+var_280], edx jmp short loc_A10E10 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10E0E: ; CODE XREF: CMFSystemThreadRoutine(x)+41Fj xor edx, edx loc_A10E10: ; CODE XREF: CMFSystemThreadRoutine(x)+4EEj mov eax, [ebx+24h] test eax, eax jz loc_A10AD9 mov [eax], ecx cmp dword ptr [ebx+28h], 10h mov [esp+2A0h+var_264], edx jnz loc_A10AD9 cmp _CMFCacheIndex, 2710h jnz loc_A10AD9 mov eax, [ebx+14h] and eax, 0Fh or _CMFFlagsCache, eax mov eax, [ebx+4] mov _CMFCacheIndex, eax jmp loc_A10AD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10E54: ; CODE XREF: CMFSystemThreadRoutine(x)+262j ; CMFSystemThreadRoutine(x)+26Ej mov esi, 0C000A000h jmp loc_A10AD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A10E5E: ; CODE XREF: CMFSystemThreadRoutine(x)+10Ej mov esi, 0C000000Dh loc_A10E63: ; CODE XREF: CMFSystemThreadRoutine(x)+D1j ; CMFSystemThreadRoutine(x)+1BFj ... cmp [esp+290h+var_260], 0 jz short loc_A10E73 push [esp+290h+var_260] call _ZwClose@4 ; ZwClose(x) loc_A10E73: ; CODE XREF: CMFSystemThreadRoutine(x)+54Aj cmp [esp+290h+var_270], 0 jz short loc_A10E85 push [esp+290h+var_270] push 0FFFFFFFFh call _ZwUnmapViewOfSection@8 ; ZwUnmapViewOfSection(x,x) loc_A10E85: ; CODE XREF: CMFSystemThreadRoutine(x)+55Aj cmp [esp+290h+var_25C], 0 jz short loc_A10E95 push [esp+290h+var_25C] call _ZwClose@4 ; ZwClose(x) loc_A10E95: ; CODE XREF: CMFSystemThreadRoutine(x)+56Cj cmp [esp+290h+var_26C], 0 jz short loc_A10EA5 push [esp+290h+var_26C] call _ZwClose@4 ; ZwClose(x) loc_A10EA5: ; CODE XREF: CMFSystemThreadRoutine(x)+57Cj mov eax, [esp+290h+var_24C] test eax, eax jz short loc_A10EB5 push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A10EB5: ; CODE XREF: CMFSystemThreadRoutine(x)+58Dj mov eax, [esp+290h+var_254] test eax, eax jz short loc_A10EC4 mov ecx, eax call ObfDereferenceObject loc_A10EC4: ; CODE XREF: CMFSystemThreadRoutine(x)+59Dj test edi, edi jz short loc_A10ED0 push 0 push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A10ED0: ; CODE XREF: CMFSystemThreadRoutine(x)+5A8j mov eax, [ebx+10h] mov [ebx+20h], esi test eax, eax jz short loc_A10EE4 push 0 push 1 push eax call _KeSetEvent@12 ; KeSetEvent(x,x,x) loc_A10EE4: ; CODE XREF: CMFSystemThreadRoutine(x)+7Fj ; CMFSystemThreadRoutine(x)+5BAj mov ecx, [esp+290h+var_4] pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 4 _CMFSystemThreadRoutine@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall CMFUnmapModules(x) _CMFUnmapModules@4 proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+209p mov edi, edi push ebx mov ebx, ecx push esi test bl, 20h jz short loc_A10F3B push edi mov edi, _CMFSegmentSectionPointer xor eax, eax mov ecx, offset _CMFSegmentSectionPointer xchg eax, [ecx] test edi, edi jz short loc_A10F3A xor esi, esi loc_A10F1C: ; CODE XREF: CMFUnmapModules(x)+35j mov ecx, [edi+esi*4] test ecx, ecx jz short loc_A10F2C call ObfDereferenceObject and dword ptr [edi+esi*4], 0 loc_A10F2C: ; CODE XREF: CMFUnmapModules(x)+26j inc esi cmp esi, 1Eh jb short loc_A10F1C push 0 push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A10F3A: ; CODE XREF: CMFUnmapModules(x)+1Dj pop edi loc_A10F3B: ; CODE XREF: CMFUnmapModules(x)+9j test bl, 10h jz short loc_A10F60 mov ecx, _CMFDirectorySectionPointer test ecx, ecx jz short loc_A10F60 xor edx, edx mov esi, offset _CMFDirectorySectionPointer mov eax, ecx lock cmpxchg [esi], edx cmp ecx, eax jnz short loc_A10F60 call ObfDereferenceObject loc_A10F60: ; CODE XREF: CMFUnmapModules(x)+43j ; CMFUnmapModules(x)+4Dj ... test ebx, 100h jz short loc_A10F88 mov ecx, _CMFHitsSectionPointer test ecx, ecx jz short loc_A10F88 xor edx, edx mov esi, offset _CMFHitsSectionPointer mov eax, ecx lock cmpxchg [esi], edx cmp ecx, eax jnz short loc_A10F88 call ObfDereferenceObject loc_A10F88: ; CODE XREF: CMFUnmapModules(x)+6Bj ; CMFUnmapModules(x)+75j ... pop esi xor eax, eax pop ebx retn _CMFUnmapModules@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall NtMapCMFModule(x, x, x, x, x, x) _NtMapCMFModule@24 proc near ; DATA XREF: .text:00580F94o var_C8 = dword ptr -0C8h var_B8 = dword ptr -0B8h var_B4 = dword ptr -0B4h var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_A8 = dword ptr -0A8h var_A4 = dword ptr -0A4h var_A0 = dword ptr -0A0h var_9C = dword ptr -9Ch var_98 = dword ptr -98h var_94 = dword ptr -94h var_90 = dword ptr -90h var_8C = byte ptr -8Ch var_88 = dword ptr -88h var_84 = dword ptr -84h var_80 = dword ptr -80h var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_1D = byte ptr -1Dh var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch ; FUNCTION CHUNK AT 00A111CD SIZE 0000056F BYTES ; FUNCTION CHUNK AT 00A11770 SIZE 00000031 BYTES push 0B8h push offset dword_6AAA28 call __SEH_prolog4 xor ebx, ebx mov [ebp+var_30], ebx mov [ebp+var_3C], ebx push 6 pop ecx xor eax, eax lea edi, [ebp+var_B0] rep stosd mov [ebp+var_50], ebx mov [ebp+var_4C], ebx lea edi, [ebp+var_C8] stosd stosd stosd stosd mov [ebp+var_58], ebx push 2Ch ; size_t push ebx ; int lea eax, [ebp+var_98] push eax ; void * call _memset add esp, 0Ch mov [ebp+var_24], ebx mov [ebp+var_2C], ebx mov [ebp+var_30], ebx mov [ebp+var_3C], ebx mov eax, large fs:124h mov al, [eax+15Ah] mov byte ptr [ebp+var_5C], al test al, al jnz short loc_A11002 loc_A10FF5: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+7Bj mov esi, 0C0000001h loc_A10FFA: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+8Dj ; NtMapCMFModule(x,x,x,x,x,x)+EAj mov [ebp+var_1C], esi jmp loc_A11770 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11002: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+66j cmp _InitSafeBootMode, ebx jnz short loc_A10FF5 mov edi, [ebp+arg_0] test edi, 0FFE0FE81h jz short loc_A1101C loc_A11015: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+D0j ; NtMapCMFModule(x,x,x,x,x,x)+D4j mov esi, 0C000000Dh jmp short loc_A10FFA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1101C: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+86j mov ecx, offset _CMFLock call MUIInitializeResourceLock mov esi, eax mov [ebp+var_1C], esi mov ecx, esi mov eax, 0C0000000h and ecx, eax cmp ecx, eax jz loc_A11770 test edi, 20000h jz loc_A111CD mov edx, edi mov esi, 180000h and edx, esi setnz cl bt edi, 12h setb al test cl, al jnz short loc_A11015 cmp edx, esi jz short loc_A11015 mov esi, 1C0000h and edi, esi mov eax, _CMFFlagsCache and eax, esi cmp edi, eax jnz short loc_A11079 loc_A11075: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+7AAj mov esi, ebx jmp short loc_A10FFA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11079: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+E6j call _KeEnterCriticalRegion@0 ; KeEnterCriticalRegion() push 1 push _CMFLock call ExAcquireResourceExclusiveLite mov [ebp+ms_exc.disabled], ebx mov eax, _CMFFlagsCache and eax, esi cmp edi, eax jz loc_A111A3 mov ecx, _CMFDirectorySectionPointer test ecx, ecx jz short loc_A110E9 test edi, edi jnz short loc_A110B5 mov esi, 0C00000BBh jmp loc_A111A5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A110B5: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+11Cj test ecx, ecx jz short loc_A110E9 mov edx, 80000000h mov [ebp+var_68], edx test eax, eax jz short loc_A110CD mov edx, 0C0000000h mov [ebp+var_68], edx loc_A110CD: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+136j push [ebp+var_5C] call _CMFCheckAccess@12 ; CMFCheckAccess(x,x,x) mov esi, eax mov [ebp+var_1C], esi mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jz loc_A111A8 loc_A110E9: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+118j ; NtMapCMFModule(x,x,x,x,x,x)+12Aj mov eax, _CMFFlagsCache and eax, 0FFE3FFFFh mov _CMFFlagsCache, eax or eax, edi mov _CMFFlagsCache, eax mov ecx, _CMFDirectorySectionPointer test ecx, ecx jz loc_A111A3 test eax, 180000h jz loc_A111A3 mov [ebp+var_24], ebx push 68h pop esi mov [ebp+var_2C], esi mov [ebp+var_50], ebx mov [ebp+var_4C], ebx lea eax, [ebp+var_2C] push eax lea eax, [ebp+var_24] push eax push ecx call _MmMapViewInSystemSpace@12 ; MmMapViewInSystemSpace(x,x,x) mov [ebp+var_1C], eax test eax, eax js short loc_A1117D mov edx, [ebp+var_24] test edx, edx jz short loc_A1117D cmp [ebp+var_2C], esi jb short loc_A11174 and dword ptr [edx+30h], 0FFE3FFFFh mov ecx, _CMFFlagsCache and ecx, 80000h neg ecx sbb ecx, ecx and ecx, 0FFF80000h add ecx, 100000h or ecx, [edx+30h] mov [edx+30h], ecx mov edx, [ebp+var_24] loc_A11174: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+1B9j push edx call _MmUnmapViewInSystemSpace@4 ; MmUnmapViewInSystemSpace(x) mov [ebp+var_24], ebx loc_A1117D: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+1ADj ; NtMapCMFModule(x,x,x,x,x,x)+1B4j mov ecx, _CMFFlagsCache and ecx, 100000h neg ecx sbb ecx, ecx and ecx, 110h add ecx, 20h call _CMFUnmapModules@4 ; CMFUnmapModules(x) push 4 pop ecx call _CMFRegisterEventTime@4 ; CMFRegisterEventTime(x) loc_A111A3: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+10Aj ; NtMapCMFModule(x,x,x,x,x,x)+17Aj ... mov esi, ebx loc_A111A5: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+123j mov [ebp+var_1C], esi loc_A111A8: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+156j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_A111BC jmp loc_A11770 _NtMapCMFModule@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A111B9 proc near ; DATA XREF: .text:006AAA40o mov esi, [ebp-1Ch] sub_A111B9 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A111BC proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+222p mov ecx, _CMFLock call ExReleaseResourceLite call _KeLeaveCriticalRegion@0 ; KeLeaveCriticalRegion() retn sub_A111BC endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; START OF FUNCTION CHUNK FOR _NtMapCMFModule@24 loc_A111CD: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+B5j call _KeEnterCriticalRegion@0 ; KeEnterCriticalRegion() push 1 push _CMFLock call ExAcquireResourceSharedLite xor edx, edx inc edx mov [ebp+ms_exc.disabled], edx mov eax, _CMFFlagsCache test eax, eax jz short loc_A11254 mov ecx, eax and ecx, 0Fh jz short loc_A111FF and edi, 0FFFFFFF0h mov [ebp+arg_0], edi or edi, ecx jmp short loc_A11201 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A111FF: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+266j or edi, edx loc_A11201: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+270j mov [ebp+arg_0], edi test eax, 100000h jz short loc_A11228 test edi, 10000h jnz short loc_A11220 loc_A11213: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+2B6j mov esi, 0C0000098h loc_A11218: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+34Aj ; NtMapCMFModule(x,x,x,x,x,x)+3B7j ... mov [ebp+var_1C], esi jmp loc_A11693 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11220: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+284j or edi, 100000h jmp short loc_A11256 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11228: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+27Cj mov ecx, 80000h test eax, ecx jz short loc_A11249 mov eax, edi and eax, 130h cmp eax, 20h jnz short loc_A11245 test edi, 10000h jz short loc_A11213 loc_A11245: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+2AEj ; NtMapCMFModule(x,x,x,x,x,x)+2C5j or edi, ecx jmp short loc_A11256 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11249: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+2A2j mov ecx, 40000h test eax, ecx jz short loc_A11259 jmp short loc_A11245 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11254: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+25Fj or edi, edx loc_A11256: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+299j ; NtMapCMFModule(x,x,x,x,x,x)+2BAj mov [ebp+arg_0], edi loc_A11259: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+2C3j mov ecx, edi and ecx, 0FFFFFECFh mov [ebp+var_54], ecx mov [ebp+var_3C], ecx and edi, 130h mov [ebp+arg_0], edi mov eax, ecx and eax, 40h push 0 pop edx setnz dl lea edx, ds:2[edx*2] mov [ebp+var_34], edx neg eax sbb eax, eax and eax, 40000000h add eax, 80000000h mov [ebp+var_40], eax mov edx, 2710h mov [ebp+var_30], edx mov [ebp+var_1D], bl cmp edi, 10h jnz loc_A11349 mov eax, _CMFCacheIndex mov [ebp+var_38], eax cmp eax, edx jb short loc_A112E2 cmp [ebp+arg_4], edx jb short loc_A112DC cmp _CMFFirstAccess, 0 jz short loc_A112D2 xor ecx, ecx inc ecx call _CMFRegisterEventTime@4 ; CMFRegisterEventTime(x) mov _CMFFirstAccess, bl loc_A112D2: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+335j ; NtMapCMFModule(x,x,x,x,x,x)+3C9j ... mov esi, 0C000000Dh jmp loc_A11218 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A112DC: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+32Cj mov eax, [ebp+arg_4] mov [ebp+var_38], eax loc_A112E2: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+327j mov [ebp+var_30], eax test cl, 2 jz short loc_A112EE mov [ebp+var_1D], 1 loc_A112EE: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+35Bj mov eax, offset _CMFDirectorySectionPointer loc_A112F3: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+452j mov [ebp+var_28], eax mov eax, [eax] loc_A112F8: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+485j mov ecx, [ebp+var_28] loc_A112FB: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+4AFj test eax, eax jnz loc_A11574 mov ecx, _CMFLock call ExReleaseResourceLite push 1 push _CMFLock call ExAcquireResourceExclusiveLite mov ecx, _CMFFlagsCache mov eax, ecx mov edx, [ebp+var_54] xor eax, edx test eax, 1C0000h jz loc_A11441 test ecx, 180000h jz loc_A11441 loc_A1133F: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+5A7j mov esi, 0C0000001h jmp loc_A11218 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11349: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+317j cmp edi, 20h jnz loc_A113E4 cmp [ebp+arg_4], 1Eh jnb loc_A112D2 mov eax, _CMFCacheIndex mov [ebp+var_38], eax cmp eax, edx jz loc_A112D2 mov [ebp+var_30], eax cmp _CMFSegmentSectionPointer, 0 jnz short loc_A113CA push 636D6650h push 78h push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_24], eax test eax, eax jnz short loc_A11397 mov esi, 0C0000017h jmp loc_A11218 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11397: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+3FEj push 78h ; size_t push ebx ; int push eax ; void * call _memset add esp, 0Ch mov ecx, [ebp+var_24] mov edx, offset _CMFSegmentSectionPointer xor eax, eax lock cmpxchg [edx], ecx mov [ebp+var_B4], eax test eax, eax jz short loc_A113C4 push ebx push [ebp+var_24] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A113C4: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+42Cj mov [ebp+var_24], ebx mov ecx, [ebp+var_54] loc_A113CA: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+3E9j test cl, 4 jz short loc_A113D3 mov [ebp+var_1D], 1 loc_A113D3: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+440j mov ecx, _CMFSegmentSectionPointer mov eax, [ebp+arg_4] lea eax, [ecx+eax*4] jmp loc_A112F3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A113E4: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+3BFj cmp edi, 100h jnz loc_A112D2 mov eax, _CMFCacheIndex mov [ebp+var_38], eax mov [ebp+var_30], eax test cl, 8 jz short loc_A11404 mov [ebp+var_1D], 1 loc_A11404: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+471j mov [ebp+var_28], offset _CMFHitsSectionPointer mov eax, _CMFHitsSectionPointer test eax, eax jnz loc_A112F8 mov [ebp+var_64], ebx mov [ebp+var_60], ebx lea eax, [ebp+var_64] push eax call KeQuerySystemTime mov eax, [ebp+var_64] mov _CMFHitsLastFlushTime, eax mov eax, [ebp+var_60] mov dword_701314, eax mov ecx, [ebp+var_28] mov eax, [ecx] jmp loc_A112FB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11441: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+3A0j ; NtMapCMFModule(x,x,x,x,x,x)+3ACj mov ecx, [ebp+var_28] cmp [ecx], ebx jnz loc_A11566 mov [ebp+var_98], 8000000h mov eax, [ebp+var_38] mov [ebp+var_94], eax mov eax, [ebp+var_40] mov [ebp+var_90], eax mov al, [ebp+var_1D] mov [ebp+var_8C], al mov [ebp+var_88], ebx mov [ebp+var_84], edx mov eax, [ebp+arg_4] mov [ebp+var_80], eax mov eax, [ebp+var_34] mov [ebp+var_7C], eax mov [ebp+var_74], ecx mov [ebp+var_70], edi push ebx push 1 lea eax, [ebp+var_C8] push eax call _KeInitializeEvent@12 ; KeInitializeEvent(x,x,x) lea eax, [ebp+var_C8] mov [ebp+var_88], eax mov [ebp+var_B0], 18h mov [ebp+var_AC], ebx mov [ebp+var_A4], 200h mov [ebp+var_A8], ebx mov [ebp+var_A0], ebx mov [ebp+var_9C], ebx lea eax, [ebp+var_98] push eax push offset _CMFSystemThreadRoutine@4 ; CMFSystemThreadRoutine(x) push ebx push ebx lea eax, [ebp+var_B0] push eax push 1FFFFFh lea eax, [ebp+var_58] push eax call _PsCreateSystemThread@28 ; PsCreateSystemThread(x,x,x,x,x,x,x) mov esi, eax mov [ebp+var_1C], esi mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jz loc_A11693 push [ebp+var_58] call _ZwClose@4 ; ZwClose(x) push ebx push ebx push ebx push ebx lea eax, [ebp+var_C8] push eax call KeWaitForSingleObject mov esi, eax mov [ebp+var_1C], esi test esi, esi jz short loc_A11539 js loc_A11693 jmp loc_A1133F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11539: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+59Fj mov eax, [ebp+var_84] mov [ebp+var_3C], eax mov esi, [ebp+var_78] mov [ebp+var_1C], esi mov eax, esi mov ecx, 0C0000000h and eax, ecx cmp eax, ecx jz loc_A11693 cmp edi, 10h jnz short loc_A11566 push 2 pop ecx call _CMFRegisterEventTime@4 ; CMFRegisterEventTime(x) loc_A11566: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+4B9j ; NtMapCMFModule(x,x,x,x,x,x)+5CFj push _CMFLock call ExConvertExclusiveToSharedLite mov ecx, [ebp+var_28] loc_A11574: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+370j mov [ebp+var_24], ebx mov [ebp+var_2C], ebx mov [ebp+var_50], ebx mov [ebp+var_4C], ebx cmp [ebp+arg_14], 0 jz loc_A11693 cmp edi, 100h jz short loc_A115B4 push [ebp+var_5C] mov edx, [ebp+var_40] mov ecx, [ecx] call _CMFCheckAccess@12 ; CMFCheckAccess(x,x,x) mov esi, eax mov [ebp+var_1C], esi and eax, 0C0000000h cmp eax, 0C0000000h jz loc_A11693 loc_A115B4: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+603j mov eax, large fs:124h mov [ebp+var_B8], eax mov eax, [eax+80h] push [ebp+var_34] push 400000h push 1 lea ecx, [ebp+var_2C] push ecx lea ecx, [ebp+var_50] push ecx push ebx push ebx lea ecx, [ebp+var_24] push ecx push eax mov eax, [ebp+var_28] push dword ptr [eax] call MmMapViewOfSection mov esi, eax mov [ebp+var_1C], esi and eax, 0C0000000h cmp eax, 0C0000000h jnz short loc_A11602 mov [ebp+var_24], ebx jmp loc_A11693 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11602: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+66Bj cmp [ebp+arg_0], 100h jnz loc_A11693 mov [ebp+var_48], ebx mov [ebp+var_44], ebx mov eax, _CMFHitsLastFlushTime mov [ebp+arg_4], eax mov edi, dword_701314 mov [ebp+var_40], edi lea eax, [ebp+var_48] push eax call KeQuerySystemTime mov edx, [ebp+arg_4] mov ecx, edx add ecx, 61C46800h mov eax, edi adc eax, 8 cmp [ebp+var_44], eax jl short loc_A11693 jg short loc_A1164B cmp [ebp+var_48], ecx jbe short loc_A11693 loc_A1164B: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+6B7j mov eax, edx mov edx, edi mov [ebp+var_34], offset _CMFHitsLastFlushTime nop mov ebx, [ebp+var_48] mov ecx, [ebp+var_44] mov edi, [ebp+var_34] lock cmpxchg8b qword ptr [edi] mov ebx, [ebp+arg_4] cmp ebx, eax mov edi, [ebp+var_40] jnz short loc_A11691 cmp edi, edx jnz short loc_A11691 mov edx, [ebp+var_2C] mov ecx, [ebp+var_24] call _CMFFlushHitsFile@8 ; CMFFlushHitsFile(x,x) test eax, eax jns short loc_A11691 mov eax, [ebp+var_48] mov edx, [ebp+var_44] nop mov ecx, edi mov edi, [ebp+var_34] lock cmpxchg8b qword ptr [edi] loc_A11691: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+6DFj ; NtMapCMFModule(x,x,x,x,x,x)+6E3j ... xor ebx, ebx loc_A11693: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+28Ej ; NtMapCMFModule(x,x,x,x,x,x)+57Aj ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_A11741 mov eax, esi and eax, 0C0000000h cmp eax, 0C0000000h jz loc_A11770 mov [ebp+ms_exc.disabled], 2 mov ecx, [ebp+arg_14] test ecx, ecx jz short loc_A116D9 mov eax, ds:_MmUserProbeAddress cmp ecx, eax jb short loc_A116CA mov ecx, eax loc_A116CA: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+739j mov eax, [ecx] mov [ecx], eax mov ecx, [ebp+var_24] mov eax, [ebp+arg_14] mov [eax], ecx mov [ebp+var_24], ebx loc_A116D9: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+730j mov ecx, [ebp+arg_10] test ecx, ecx jz short loc_A116F6 mov edx, ecx mov eax, ds:_MmUserProbeAddress cmp ecx, eax jb short loc_A116ED mov edx, eax loc_A116ED: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+75Cj mov eax, [edx] mov [edx], eax mov eax, [ebp+var_2C] mov [ecx], eax loc_A116F6: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+751j mov ecx, [ebp+arg_8] test ecx, ecx jz short loc_A11713 mov edx, ecx mov eax, ds:_MmUserProbeAddress cmp ecx, eax jb short loc_A1170A mov edx, eax loc_A1170A: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+779j mov eax, [edx] mov [edx], eax mov eax, [ebp+var_30] mov [ecx], eax loc_A11713: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+76Ej mov ecx, [ebp+arg_C] test ecx, ecx jz short loc_A11730 mov edx, ecx mov eax, ds:_MmUserProbeAddress cmp ecx, eax jb short loc_A11727 mov edx, eax loc_A11727: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+796j mov eax, [edx] mov [edx], eax mov eax, [ebp+var_3C] mov [ecx], eax loc_A11730: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+78Bj mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp loc_A11075 ; END OF FUNCTION CHUNK FOR _NtMapCMFModule@24 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1173C proc near ; DATA XREF: .text:006AAA4Co xor ebx, ebx mov esi, [ebp-1Ch] sub_A1173C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A11741 proc near ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+70Dp mov ecx, _CMFLock call ExReleaseResourceLite call _KeLeaveCriticalRegion@0 ; KeLeaveCriticalRegion() retn sub_A11741 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A11752 proc near ; DATA XREF: .text:006AAA54o mov eax, [ebp-14h] mov eax, [eax] mov eax, [eax] mov [ebp-6Ch], eax xor eax, eax inc eax retn sub_A11752 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A11760 proc near ; DATA XREF: .text:006AAA58o mov esp, [ebp-18h] mov esi, [ebp-6Ch] mov [ebp-1Ch], esi mov dword ptr [ebp-4], 0FFFFFFFEh sub_A11760 endp ; START OF FUNCTION CHUNK FOR _NtMapCMFModule@24 loc_A11770: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+70j ; NtMapCMFModule(x,x,x,x,x,x)+A9j ... cmp [ebp+var_24], 0 jz short loc_A1178D push [ebp+var_24] mov eax, large fs:124h push dword ptr [eax+80h] call _MmUnmapViewOfSection@8 ; MmUnmapViewOfSection(x,x) mov esi, [ebp+var_1C] loc_A1178D: ; CODE XREF: NtMapCMFModule(x,x,x,x,x,x)+7E7j mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 18h ; END OF FUNCTION CHUNK FOR _NtMapCMFModule@24 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall NtPssCaptureVaSpaceBulk(x, x, x, x, x) _NtPssCaptureVaSpaceBulk@20 proc near ; DATA XREF: .text:005812D8o var_80 = dword ptr -80h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push 70h push offset dword_6AAA80 call __SEH_prolog4_GS mov eax, [ebp+arg_0] mov [ebp+var_50], eax mov eax, [ebp+arg_4] mov [ebp+var_54], eax mov esi, [ebp+arg_8] mov [ebp+var_44], esi mov [ebp+var_6C], esi mov eax, [ebp+arg_C] mov [ebp+var_3C], eax mov eax, [ebp+arg_10] mov [ebp+var_64], eax xor edx, edx mov [ebp+var_58], edx push 6 pop ecx xor eax, eax lea edi, [ebp+var_34] rep stosd mov [ebp+var_5C], edx mov [ebp+var_4C], edx mov [ebp+var_60], edx mov [ebp+var_40], edx mov ebx, edx mov [ebp+var_38], ebx mov ecx, [ebp+var_3C] cmp ecx, 0Ch jnb short loc_A11800 mov eax, 0C0000004h jmp loc_A11AD8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11800: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+53j mov eax, large fs:124h mov [ebp+var_74], eax mov al, [eax+15Ah] mov byte ptr [ebp+var_48], al lea edi, [ebp+var_80] test al, al jz short loc_A11884 xor eax, eax stosd stosd stosd mov [ebp+ms_exc.disabled], edx push 4 push ecx push esi call _ProbeForWrite@12 ; ProbeForWrite(x,x,x) mov ecx, [ebp+var_64] test ecx, ecx jz short loc_A11840 mov eax, ds:_MmUserProbeAddress cmp ecx, eax jb short loc_A1183C mov ecx, eax loc_A1183C: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+97j mov eax, [ecx] mov [ecx], eax loc_A11840: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+8Ej lea edi, [ebp+var_80] movsd movsd movsd mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov edi, [ebp+var_44] jmp short loc_A11876 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11852: ; DATA XREF: .text:006AAA94o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_68], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11860: ; DATA XREF: .text:006AAA98o mov esp, [ebp+ms_exc.old_esp] mov ebx, [ebp+var_68] mov [ebp+var_38], ebx mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov edi, [ebp+var_6C] mov [ebp+var_44], edi loc_A11876: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+AFj mov ecx, [ebp+var_3C] xor edx, edx test ebx, ebx jns short loc_A1188A jmp loc_A11AD6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11884: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+76j movsd movsd movsd mov edi, [ebp+var_44] loc_A1188A: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+DCj cmp [ebp+var_80], 0 jnz short loc_A1189D mov ebx, 0C000000Dh loc_A11895: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+10Aj ; NtPssCaptureVaSpaceBulk(x,x,x,x,x)+11Cj ... mov esi, [ebp+var_40] jmp loc_A11A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1189D: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+EDj test [ebp+var_80], 0FFFFFFFCh jz short loc_A118AD mov ebx, 0C00000BBh jmp short loc_A11895 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A118AD: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+103j mov eax, [ebp+var_54] cmp eax, ds:_MmHighestUserAddress jbe short loc_A118BF mov ebx, 0C0000141h jmp short loc_A11895 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A118BF: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+115j cmp byte ptr [ebp+var_48], 0 jz loc_A1195A push edx push edx push edx push ecx push edi call IoAllocateMdl mov esi, eax mov [ebp+var_40], esi test esi, esi jnz short loc_A118E3 mov ebx, 0C000009Ah jmp short loc_A11895 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A118E3: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+139j xor eax, eax inc eax mov [ebp+ms_exc.disabled], eax push eax xor edi, edi push edi push esi call _MmProbeAndLockPages@12 ; MmProbeAndLockPages(x,x,x) mov [ebp+ms_exc.disabled], 0FFFFFFFEh test byte ptr [esi+6], 5 jz short loc_A11908 mov edi, [esi+0Ch] mov [ebp+var_44], edi jmp short loc_A1191D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11908: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+15Dj push 40000010h push edi push edi push 1 push edi push esi call MmMapLockedPagesSpecifyCache mov edi, eax mov [ebp+var_44], eax loc_A1191D: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+165j mov esi, [ebp+var_40] test edi, edi jnz short loc_A1195E mov ebx, 0C000009Ah jmp loc_A11A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1192E: ; DATA XREF: .text:006AAAA0o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_70], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1193C: ; DATA XREF: .text:006AAAA4o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_40] push esi call _IoFreeMdl@4 ; IoFreeMdl(x) mov ebx, [ebp+var_70] mov [ebp+var_38], ebx mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp loc_A11A72 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1195A: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+122j mov esi, edx jmp short loc_A11960 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1195E: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+181j xor edx, edx loc_A11960: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+1BBj cmp [ebp+var_50], 0FFFFFFFFh jz short loc_A119C8 push edx lea eax, [ebp+var_58] push eax push 41737350h push [ebp+var_48] push ds:_PsProcessType push 1000h push [ebp+var_50] call _ObReferenceObjectByHandleWithTag@28 ; ObReferenceObjectByHandleWithTag(x,x,x,x,x,x,x) mov ebx, eax mov [ebp+var_38], ebx test ebx, ebx js loc_A11A72 mov ecx, [ebp+var_58] test dword ptr [ecx+3A8h], 1000h jz short loc_A119B6 mov edx, 41737350h call ObfDereferenceObjectWithTag mov ebx, 0C0000022h jmp loc_A11A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A119B6: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+1FFj lea eax, [ebp+var_34] push eax xor edx, edx call KiStackAttachProcess mov [ebp+var_60], 1 loc_A119C8: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+1C3j cmp byte ptr [ebp+var_48], 0 jz short loc_A119E8 lea eax, [ebp+var_4C] push eax mov eax, [ebp+var_3C] push eax push edi push [ebp+var_54] push 0FFFFFFFFh call _ZwPssCaptureVaSpaceBulk@20 ; ZwPssCaptureVaSpaceBulk(x,x,x,x,x) mov ebx, eax jmp loc_A11A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A119E8: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+22Bj xor edi, edi mov ecx, [ebp+var_44] mov [ecx+4], edi mov [ebp+var_4C], 0Ch add [ebp+var_3C], 0FFFFFFF4h lea edx, [ecx+0Ch] mov eax, [ebp+var_54] jmp short loc_A11A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11A03: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+2B8j mov eax, [ebp+var_74] mov eax, [eax+2FCh] test al, 1 jnz loc_A11ABE push 2 lea eax, [ebp+var_5C] push eax push 1Ch push edx push edi mov edx, [ebp+var_50] or ecx, 0FFFFFFFFh call MmQueryVirtualMemory mov ebx, eax mov [ebp+var_38], ebx mov ecx, [ebp+var_44] test ebx, ebx js short loc_A11AAE mov eax, [ebp+var_5C] sub [ebp+var_3C], eax add [ebp+var_4C], eax mov edx, [ebp+var_48] mov eax, [edx+0Ch] add eax, [edx] add edx, 1Ch inc dword ptr [ecx+4] mov [ecx+8], eax loc_A11A4F: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+260j cmp [ebp+var_3C], 1Ch mov [ebp+var_50], eax mov [ebp+var_48], edx jnb short loc_A11A03 loc_A11A5B: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+31Bj test ebx, ebx js short loc_A11A72 mov eax, ds:_MmHighestUserAddress inc eax cmp [ecx+8], eax jz short loc_A11A72 mov ebx, 105h loc_A11A6F: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+F7j ; NtPssCaptureVaSpaceBulk(x,x,x,x,x)+188j ... mov [ebp+var_38], ebx loc_A11A72: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+1B4j ; NtPssCaptureVaSpaceBulk(x,x,x,x,x)+1ECj ... cmp [ebp+var_60], 0 jz short loc_A11A82 xor edx, edx lea ecx, [ebp+var_34] call _KiUnstackDetachProcess@8 ; KiUnstackDetachProcess(x,x) loc_A11A82: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+2D5j test esi, esi jz short loc_A11A92 push esi call _MmUnlockPages@4 ; MmUnlockPages(x) push esi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A11A92: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+2E3j mov ecx, [ebp+var_64] test ecx, ecx jz short loc_A11AD6 mov [ebp+ms_exc.disabled], 2 mov eax, [ebp+var_4C] mov [ecx], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A11AD6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11AAE: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+292j xor eax, eax cmp eax, [ecx+4] sbb eax, eax not eax and ebx, eax mov [ebp+var_38], ebx jmp short loc_A11A5B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11ABE: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+26Dj mov ebx, 0C000004Bh jmp short loc_A11A6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11AC5: ; DATA XREF: .text:006AAAACo xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11AC9: ; DATA XREF: .text:006AAAB0o mov esp, [ebp+ms_exc.old_esp] mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov ebx, [ebp+var_38] loc_A11AD6: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+DEj ; NtPssCaptureVaSpaceBulk(x,x,x,x,x)+2F6j ... mov eax, ebx loc_A11AD8: ; CODE XREF: NtPssCaptureVaSpaceBulk(x,x,x,x,x)+5Aj mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 14h _NtPssCaptureVaSpaceBulk@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall NtDirectGraphicsCall(x, x, x, x, x) _NtDirectGraphicsCall@20 proc near ; DATA XREF: .text:005812DCo mov eax, 0C0000002h retn 14h _NtDirectGraphicsCall@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall ExWnfCleanupServerSiloState(x) _ExWnfCleanupServerSiloState@4 proc near ; CODE XREF: PspDeleteServerSiloGlobals(x)+2Ap mov edi, edi push esi mov esi, ecx cmp dword ptr [esi], 0 jz short loc_A11B35 mov eax, large fs:124h dec word ptr [eax+13Ch] nop mov ecx, [esi] push 2 pop edx call _ExpWnfDeleteScopeInstances@8 ; ExpWnfDeleteScopeInstances(x,x) mov ecx, [esi] xor edx, edx call _ExpWnfDeleteScopeInstances@8 ; ExpWnfDeleteScopeInstances(x,x) push 20666E57h push dword ptr [esi] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov ecx, large fs:124h call _KiLeaveCriticalRegionUnsafe@4 ; KiLeaveCriticalRegionUnsafe(x) loc_A11B35: ; CODE XREF: ExWnfCleanupServerSiloState(x)+8j cmp dword ptr [esi+4], 0 jz short loc_A11B43 push dword ptr [esi+4] call _ZwClose@4 ; ZwClose(x) loc_A11B43: ; CODE XREF: ExWnfCleanupServerSiloState(x)+47j cmp dword ptr [esi+8], 0 jz short loc_A11B51 push dword ptr [esi+8] call _ZwClose@4 ; ZwClose(x) loc_A11B51: ; CODE XREF: ExWnfCleanupServerSiloState(x)+55j pop esi retn _ExWnfCleanupServerSiloState@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ExpWnfAllocateNextPersistentNameSequence(x, x) _ExpWnfAllocateNextPersistentNameSequence@8 proc near ; CODE XREF: ExpWnfGenerateStateName+149AF5p var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 5Ch mov eax, ___security_cookie xor eax, esp mov [esp+5Ch+var_4], eax and [esp+5Ch+var_30], 0 xor eax, eax and [esp+5Ch+var_34], eax and [esp+5Ch+var_40], eax push ebx push esi push edi mov esi, ecx mov [esp+68h+var_28], edx push 6 pop ecx lea edi, [esp+68h+var_20] rep stosd xor edi, edi push esi mov [esp+6Ch+var_50], edi call _PsAttachSiloToCurrentThread@4 ; PsAttachSiloToCurrentThread(x) mov [esp+68h+var_24], eax call _PsGetCurrentServerSiloGlobals@0 ; PsGetCurrentServerSiloGlobals() add eax, 208h mov [esp+68h+var_44], eax lea ecx, [eax+20h] mov eax, [ecx] mov [esp+68h+var_58], eax mov eax, [ecx+4] mov [esp+68h+var_3C], ecx mov [esp+68h+var_54], eax cmp [esp+68h+var_58], edi jnz loc_A11D04 test eax, eax jnz loc_A11D04 xor ecx, ecx lea edx, [esp+68h+var_40] inc ecx call ExpWnfGetNameStoreRegistryRoot mov edi, eax mov [esp+68h+var_50], edi test edi, edi js loc_A11EBB mov ebx, [esp+68h+var_44] xor edx, edx add ebx, 18h push 0 mov ecx, ebx call KeAbPreAcquire mov esi, eax lock bts dword ptr [ebx], 0 jnb short loc_A11C0D push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockExclusiveEx loc_A11C0D: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+AEj test esi, esi jz short loc_A11C15 or byte ptr [esi+0Eh], 1 loc_A11C15: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+BCj mov ecx, [esp+68h+var_3C] mov [esp+68h+var_34], 1 mov eax, [ecx] mov ecx, [ecx+4] test eax, eax jnz loc_A11D04 test ecx, ecx jnz loc_A11D04 lea eax, [esp+68h+var_30] push eax push 18h lea eax, [esp+70h+var_20] push eax push 2 push offset _ExpWnfPermanentNameSequenceNumberValueName push [esp+7Ch+var_40] call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) mov edi, eax mov [esp+68h+var_50], edi test edi, edi js loc_A11CF8 cmp [esp+68h+var_18], 8 jz short loc_A11C71 mov edi, 0C0000001h jmp loc_A11E99 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11C71: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+112j mov eax, [esp+68h+var_10] mov ebx, [esp+68h+var_14] mov [esp+68h+var_38], eax mov [esp+68h+var_54], eax mov eax, [esp+68h+var_44] add eax, 10h mov [esp+68h+var_5C], ebx mov [esp+68h+var_58], ebx mov [esp+68h+var_4C], eax loc_A11C94: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+163j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+169j mov esi, [eax] mov ecx, [eax+4] mov eax, esi mov [esp+68h+var_48], ecx mov edx, ecx nop mov ecx, [esp+68h+var_38] mov edi, [esp+68h+var_4C] lock cmpxchg8b qword ptr [edi] mov ebx, [esp+68h+var_5C] cmp eax, esi mov eax, edi jnz short loc_A11C94 cmp edx, [esp+68h+var_48] jnz short loc_A11C94 mov ebx, [esp+68h+var_58] mov eax, [esp+68h+var_54] mov edi, [esp+68h+var_3C] mov [esp+68h+var_5C], ebx mov [esp+68h+var_48], eax loc_A11CD2: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+19Bj ; ExpWnfAllocateNextPersistentNameSequence(x,x)+1A1j mov esi, [edi] mov eax, esi mov ecx, [edi+4] mov edx, ecx mov [esp+68h+var_38], ecx nop mov ecx, [esp+68h+var_48] lock cmpxchg8b qword ptr [edi] mov ebx, [esp+68h+var_5C] cmp eax, esi jnz short loc_A11CD2 cmp edx, [esp+68h+var_38] jnz short loc_A11CD2 jmp short loc_A11D04 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11CF8: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+107j cmp edi, 0C0000034h jnz loc_A11E99 loc_A11D04: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+6Dj ; ExpWnfAllocateNextPersistentNameSequence(x,x)+75j ... mov edi, [esp+68h+var_44] add edi, 10h loc_A11D0B: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+1D8j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+1DCj ... mov eax, [edi] mov ebx, eax mov esi, [edi+4] add ebx, 1 mov ecx, esi mov [esp+68h+var_4C], eax adc ecx, 0 mov edx, esi nop lock cmpxchg8b qword ptr [edi] mov ebx, [esp+68h+var_4C] cmp eax, ebx jnz short loc_A11D0B cmp edx, esi jnz short loc_A11D0B add ebx, 1 mov [esp+68h+var_4C], ebx adc esi, 0 mov [esp+68h+var_2C], esi test ebx, ebx jnz short loc_A11D47 test esi, esi jz short loc_A11D0B loc_A11D47: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+1EEj mov ecx, [esp+68h+var_3C] mov edi, [esp+68h+var_50] mov eax, [ecx] mov [esp+68h+var_58], eax mov eax, [ecx+4] mov [esp+68h+var_54], eax cmp esi, eax jb loc_A11E89 ja short loc_A11D70 cmp ebx, [esp+68h+var_58] jbe loc_A11E89 loc_A11D70: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+211j cmp [esp+68h+var_40], 0 jnz short loc_A11D8D xor ecx, ecx lea edx, [esp+68h+var_40] inc ecx call ExpWnfGetNameStoreRegistryRoot mov edi, eax test edi, edi js loc_A11E92 loc_A11D8D: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+222j cmp [esp+68h+var_34], 0 jnz short loc_A11DD2 mov ecx, [esp+68h+var_44] xor edx, edx add ecx, 18h push 0 call KeAbPreAcquire mov ecx, [esp+68h+var_44] mov [esp+68h+var_48], eax add ecx, 18h lock bts dword ptr [ecx], 0 jnb short loc_A11DC2 push ecx mov edx, eax call ExfAcquirePushLockExclusiveEx mov eax, [esp+68h+var_48] loc_A11DC2: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+261j test eax, eax jz short loc_A11DCA or byte ptr [eax+0Eh], 1 loc_A11DCA: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+271j mov [esp+68h+var_34], 1 loc_A11DD2: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+23Fj mov ecx, [esp+68h+var_3C] mov edx, [ecx] mov eax, [ecx+4] cmp esi, eax jb loc_A11E89 ja short loc_A11DED cmp ebx, edx jbe loc_A11E89 loc_A11DED: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+290j mov eax, [ecx] mov ecx, [ecx+4] add eax, 64h mov [esp+68h+var_58], eax adc ecx, 0 mov [esp+68h+var_54], ecx cmp ecx, esi ja short loc_A11E22 jb short loc_A11E0A cmp eax, ebx jnb short loc_A11E22 loc_A11E0A: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+2B1j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+2BFj ... add eax, 64h adc ecx, 0 cmp ecx, esi jb short loc_A11E0A ja short loc_A11E1A cmp eax, ebx jb short loc_A11E0A loc_A11E1A: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+2C1j mov [esp+68h+var_58], eax mov [esp+68h+var_54], ecx loc_A11E22: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+2AFj ; ExpWnfAllocateNextPersistentNameSequence(x,x)+2B5j push 8 lea eax, [esp+6Ch+var_58] push eax push 3 push 0 push offset _ExpWnfPermanentNameSequenceNumberValueName push [esp+7Ch+var_40] call _ZwSetValueKey@24 ; ZwSetValueKey(x,x,x,x,x,x) mov edi, eax mov [esp+68h+var_50], edi test edi, edi js short loc_A11E92 mov ebx, [esp+68h+var_58] mov eax, [esp+68h+var_54] mov edi, [esp+68h+var_3C] mov [esp+68h+var_5C], ebx mov [esp+68h+var_48], eax loc_A11E59: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+322j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+328j mov esi, [edi] mov eax, esi mov ecx, [edi+4] mov edx, ecx mov [esp+68h+var_38], ecx nop mov ecx, [esp+68h+var_48] lock cmpxchg8b qword ptr [edi] mov ebx, [esp+68h+var_5C] cmp eax, esi jnz short loc_A11E59 cmp edx, [esp+68h+var_38] jnz short loc_A11E59 mov edi, [esp+68h+var_50] mov esi, [esp+68h+var_2C] mov ebx, [esp+68h+var_4C] loc_A11E89: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+20Bj ; ExpWnfAllocateNextPersistentNameSequence(x,x)+217j ... mov eax, [esp+68h+var_28] mov [eax], ebx mov [eax+4], esi loc_A11E92: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+234j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+2F0j cmp [esp+68h+var_34], 0 jz short loc_A11EBB loc_A11E99: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+119j ; ExpWnfAllocateNextPersistentNameSequence(x,x)+1ABj mov esi, [esp+68h+var_44] or eax, 0FFFFFFFFh add esi, 18h lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A11EB4 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A11EB4: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+358j mov ecx, esi call KeAbPostRelease loc_A11EBB: ; CODE XREF: ExpWnfAllocateNextPersistentNameSequence(x,x)+8Fj ; ExpWnfAllocateNextPersistentNameSequence(x,x)+344j push [esp+68h+var_24] call _PsDetachSiloFromCurrentThread@4 ; PsDetachSiloFromCurrentThread(x) mov ecx, [esp+68h+var_4] mov eax, edi pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn _ExpWnfAllocateNextPersistentNameSequence@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ExpWnfDeletePermanentStateData(x, x, x) _ExpWnfDeletePermanentStateData@12 proc near ; CODE XREF: NtDeleteWnfStateName+14A27Cp ; ExpNtDeleteWnfStateData+848A8p ... var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 3Ch mov eax, ___security_cookie xor eax, esp mov [esp+3Ch+var_4], eax mov eax, [ebp+arg_4] push ebx push esi mov esi, [ebp+arg_0] xor ebx, ebx push edi mov edi, [ebp+arg_0] shrd esi, eax, 4 push 22h shrd edi, eax, 6 pop eax push [ebp+arg_4] mov [esp+4Ch+var_30], ebx and esi, 3 push [ebp+arg_0] mov word ptr [esp+50h+var_30+2], ax and edi, 0Fh mov [esp+50h+var_34], ecx lea eax, [esp+50h+var_28] lea ecx, [esp+50h+var_30] mov [esp+50h+var_38], ebx mov [esp+50h+var_2C], eax call _ExpWnfComposeValueName@12 ; ExpWnfComposeValueName(x,x,x) mov eax, [esp+48h+var_34] mov edx, esi test eax, eax jz short loc_A11F98 lea ecx, [esp+48h+var_38] push ecx push ebx mov ecx, eax call ExpWnfGetPermanentDataStoreHandle loc_A11F4C: ; CODE XREF: ExpWnfDeletePermanentStateData(x,x,x)+CEj test eax, eax js short loc_A11F84 loc_A11F50: ; CODE XREF: ExpWnfDeletePermanentStateData(x,x,x)+A8j lea eax, [esp+48h+var_30] push eax push [esp+4Ch+var_38] call _ZwDeleteValueKey@8 ; ZwDeleteValueKey(x,x) cmp [esp+48h+var_34], 0 jnz short loc_A11F84 push [esp+48h+var_38] call _ZwClose@4 ; ZwClose(x) lea eax, [esp+48h+var_38] inc ebx push eax push ebx mov edx, esi mov ecx, edi call _ExpWnfEnumeratePermanentDataStores@16 ; ExpWnfEnumeratePermanentDataStores(x,x,x,x) test eax, eax jns short loc_A11F50 xor eax, eax loc_A11F84: ; CODE XREF: ExpWnfDeletePermanentStateData(x,x,x)+76j ; ExpWnfDeletePermanentStateData(x,x,x)+8Bj mov ecx, [esp+50h+var_C] pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A11F98: ; CODE XREF: ExpWnfDeletePermanentStateData(x,x,x)+65j lea eax, [esp+48h+var_38] mov ecx, edi push eax push 0 call _ExpWnfEnumeratePermanentDataStores@16 ; ExpWnfEnumeratePermanentDataStores(x,x,x,x) jmp short loc_A11F4C _ExpWnfDeletePermanentStateData@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ExpWnfDeleteScopeInstances(x, x) _ExpWnfDeleteScopeInstances@8 proc near ; CODE XREF: ExWnfCleanupServerSiloState(x)+1Dp ; ExWnfCleanupServerSiloState(x)+26p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch mov eax, edx mov [ebp+var_4], ecx push ebx push esi mov [ebp+var_8], eax lea esi, [ecx+14h] imul eax, 0Ch xor edx, edx push edi lea edi, [ecx+10h] push 0 add edi, eax add esi, eax mov ecx, edi call KeAbPreAcquire mov ebx, eax lock bts dword ptr [edi], 0 jnb short loc_A11FE6 push edi mov edx, ebx mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A11FE6: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+32j test ebx, ebx jz short loc_A11FEE or byte ptr [ebx+0Eh], 1 loc_A11FEE: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+40j mov eax, [esi] cmp [eax+4], esi jnz short loc_A12056 mov ecx, [eax] cmp [ecx+4], eax jnz short loc_A12056 mov [esi], ecx mov [ecx+4], esi cmp eax, esi jz short loc_A12036 mov ebx, [ebp+var_4] loc_A12008: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+8Cj and dword ptr [eax], 0 lea ecx, [eax-14h] cmp [ebp+var_8], 0 jnz short loc_A12018 and dword ptr [ebx+4], 0 loc_A12018: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+6Aj mov dl, 1 call _ExpWnfFreeScopeInstance@8 ; ExpWnfFreeScopeInstance(x,x) mov eax, [esi] cmp [eax+4], esi jnz short loc_A12056 mov ecx, [eax] cmp [ecx+4], eax jnz short loc_A12056 mov [esi], ecx mov [ecx+4], esi cmp eax, esi jnz short loc_A12008 loc_A12036: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+5Bj or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1204A mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1204A: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+99j mov ecx, edi call KeAbPostRelease pop edi pop esi pop ebx leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12056: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+4Bj ; ExpWnfDeleteScopeInstances(x,x)+52j ... push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR ; AL = character to display ; __stdcall ExpWnfEnumeratePermanentDataStores(x, x, x, x) _ExpWnfEnumeratePermanentDataStores@16: ; CODE XREF: ExpWnfDeletePermanentStateData(x,x,x)+A1p ; ExpWnfDeletePermanentStateData(x,x,x)+C9p mov edi, edi push ebp mov ebp, esp mov eax, ecx sub eax, 0 jz short loc_A1206D dec eax sub eax, 1 jz short loc_A12073 loc_A1206D: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+BDj cmp [ebp+arg_0], 0 jz short loc_A1207A loc_A12073: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+C3j mov eax, 0C0000034h jmp short loc_A12099 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1207A: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+C9j cmp edx, 3 jz short loc_A12088 cmp edx, 2 jz short loc_A12088 xor eax, eax jmp short loc_A1208B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12088: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+D5j ; ExpWnfDeleteScopeInstances(x,x)+DAj xor eax, eax inc eax loc_A1208B: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+DEj push [ebp+arg_4] push 0 push eax push ecx push 0 call ExpWnfGetPermanentDataStoreHandleByScopeId loc_A12099: ; CODE XREF: ExpWnfDeleteScopeInstances(x,x)+D0j pop ebp retn 8 _ExpWnfDeleteScopeInstances@8 endp ; sp = -1Ch ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ExpWnfGetPermanentPerUserDataStoreHandle(x, x) _ExpWnfGetPermanentPerUserDataStoreHandle@8 proc near ; CODE XREF: ExpWnfGetPermanentDataStoreHandleByScopeId+878AAp var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 34h push ebx push esi push edi mov ebx, ecx mov [ebp+var_10], edx push 6 xor eax, eax mov [ebp+var_C], ebx and [ebp+var_4], eax lea edi, [ebp+var_30] pop ecx rep stosd lea edx, [ebp+var_4] mov ecx, ebx call _RtlLengthSidAsUnicodeString@8 ; RtlLengthSidAsUnicodeString(x,x) test eax, eax js loc_A12190 mov edi, [ebp+var_4] push 20666E57h lea ebx, [edi+52h] push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A120F2 mov eax, 0C000009Ah jmp loc_A12190 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A120F2: ; CODE XREF: ExpWnfGetPermanentPerUserDataStoreHandle(x,x)+49j and [ebp+var_8], 0 lea eax, [ebp+var_8] push offset ??_C@_1CA@DOEFBOAB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?2@NNGAKEGL@ ; "\\Registry\\User\\" push eax ; int mov word ptr [ebp+var_8+2], bx mov [ebp+var_4], esi call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) movzx ecx, word ptr [ebp+var_8] xor ebx, ebx mov eax, [ebp+var_4] shr ecx, 1 push ebx push [ebp+var_C] mov word ptr [ebp+var_18+2], di lea eax, [eax+ecx*2] mov [ebp+var_14], eax xor eax, eax mov word ptr [ebp+var_18], ax lea eax, [ebp+var_18] push eax call RtlConvertSidToUnicodeString mov edi, eax test edi, edi js short loc_A12183 mov ax, word ptr [ebp+var_18] add word ptr [ebp+var_8], ax lea eax, [ebp+var_8] push offset ??_C@_1DE@CEBLELHA@?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAN?$AAo?$AAt?$AAi?$AAf?$AAi@NNGAKEGL@ ; void * push eax ; int call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) push ebx push ebx push ebx lea eax, [ebp+var_8] mov [ebp+var_30], 18h push ebx mov [ebp+var_28], eax lea eax, [ebp+var_30] push eax push 0F003Fh push [ebp+var_10] mov [ebp+var_2C], ebx mov [ebp+var_24], 240h mov [ebp+var_20], ebx mov [ebp+var_1C], ebx call _ZwCreateKey@28 ; ZwCreateKey(x,x,x,x,x,x,x) mov edi, eax loc_A12183: ; CODE XREF: ExpWnfGetPermanentPerUserDataStoreHandle(x,x)+9Aj push 20666E57h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov eax, edi loc_A12190: ; CODE XREF: ExpWnfGetPermanentPerUserDataStoreHandle(x,x)+2Cj ; ExpWnfGetPermanentPerUserDataStoreHandle(x,x)+50j pop edi pop esi pop ebx leave retn _ExpWnfGetPermanentPerUserDataStoreHandle@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall ExpWnfPopulateStateDataRemoteCallback(int,int,int,int,void *,int) _ExpWnfPopulateStateDataRemoteCallback@24 proc near ; DATA XREF: ExpWnfPopulateStateData+1478B7o arg_4 = dword ptr 0Ch arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp push edi mov edi, [ebp+arg_C] test edi, edi jnz short loc_A121A6 xor eax, eax jmp short loc_A1221E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A121A6: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+Bj mov eax, [ebp+arg_4] push ebx mov ebx, [ebp+arg_14] test ebx, ebx jnz short loc_A121BF mov dword ptr [eax+34h], 1 mov [eax+38h], edi xor eax, eax jmp short loc_A1221D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A121BF: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+1Aj mov eax, [eax+24h] push esi mov [ebp+arg_C], eax add eax, 10h push 20666E57h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A121E3 mov eax, 0C000009Ah jmp short loc_A1221C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A121E3: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+45j push 10h mov eax, 904h mov [esi], ax pop eax mov [esi+2], ax mov eax, [ebp+arg_C] push ebx ; size_t push [ebp+arg_10] ; void * mov [esi+4], eax lea eax, [esi+10h] push eax ; void * mov [esi+8], ebx mov [esi+0Ch], edi call _memcpy mov ecx, [ebp+arg_4] add esp, 0Ch mov eax, [esi+0Ch] mov [ecx+38h], eax xor eax, eax mov [ecx+34h], esi loc_A1221C: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+4Cj pop esi loc_A1221D: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+28j pop ebx loc_A1221E: ; CODE XREF: ExpWnfPopulateStateDataRemoteCallback(x,x,x,x,x,x)+Fj pop edi pop ebp retn 18h _ExpWnfPopulateStateDataRemoteCallback@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ExpCrossVmWnfPush(x, x, x, x, x, x) _ExpCrossVmWnfPush@24 proc near ; CODE XREF: ExpNtUpdateWnfStateData+149629p ; ExpNtUpdateWnfStateData+1496DBp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push esi mov esi, _ExpCrossVmIntExtensionHostGuest push edi mov edi, edx test edi, edi jnz short loc_A1223C mov esi, _ExpCrossVmIntExtensionHostRoot loc_A1223C: ; CODE XREF: ExpCrossVmWnfPush(x,x,x,x,x,x)+11j mov ecx, esi call _ExGetExtensionTable@4 ; ExGetExtensionTable(x) test eax, eax jnz short loc_A1224E mov edi, 0C0000002h jmp short loc_A12269 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1224E: ; CODE XREF: ExpCrossVmWnfPush(x,x,x,x,x,x)+22j push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push edi push 0 call dword ptr [eax+38h] mov edi, eax mov ecx, esi call _ExReleaseExtensionTable@4 ; ExReleaseExtensionTable(x) loc_A12269: ; CODE XREF: ExpCrossVmWnfPush(x,x,x,x,x,x)+29j mov eax, edi pop edi pop esi pop ebp retn 10h _ExpCrossVmWnfPush@24 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� align 4 db 2 dup(0CCh) ; Exported entry 2626. WheaRemoveErrorSource ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheaRemoveErrorSource(x) public _WheaRemoveErrorSource@4 _WheaRemoveErrorSource@4 proc near ; CODE XREF: WheaRemoveErrorSourceDeviceDriver(x)+EFp var_408 = dword ptr -408h var_404 = dword ptr -404h var_400 = dword ptr -400h var_3FC = dword ptr -3FCh var_3F8 = dword ptr -3F8h var_3F4 = dword ptr -3F4h var_3F0 = dword ptr -3F0h var_3EC = dword ptr -3ECh var_3E8 = dword ptr -3E8h var_3E4 = dword ptr -3E4h var_3E0 = dword ptr -3E0h var_14 = dword ptr -14h var_10 = byte ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 40Ch mov eax, ___security_cookie xor eax, esp mov [esp+40Ch+var_4], eax mov edx, [ebp+arg_0] mov ecx, offset _WheapErrorSourceTable push ebx push esi push edi call _WheapGetErrorSource@8 ; WheapGetErrorSource(x,x) mov ebx, eax test ebx, ebx jz loc_A12394 mov ecx, [ebx+58h] call WheapIsNonHestErrorSource test al, al jz loc_A12394 mov eax, [ebx+5Ch] cmp eax, 3 jz loc_A12394 push 4 pop edx cmp eax, edx jz loc_A12394 or [esp+418h+var_404], 0FFFFFFFFh lea esi, [ebx+50h] mov ecx, 0F3h mov [esp+418h+var_408], 0FFFFFC18h lea edi, [esp+418h+var_3E0] xor eax, eax rep movsd mov [ebx+5Ch], edx lea esi, [ebx+4Ch] or ecx, 0FFFFFFFFh lock cmpxchg [esi], ecx xor edi, edi jmp short loc_A12316 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12301: ; CODE XREF: WheaRemoveErrorSource(x)+A2j lea eax, [esp+418h+var_408] push eax push edi push edi call _KeDelayExecutionThread@12 ; KeDelayExecutionThread(x,x,x) or ecx, 0FFFFFFFFh xor eax, eax lock cmpxchg [esi], ecx loc_A12316: ; CODE XREF: WheaRemoveErrorSource(x)+89j test eax, eax jg short loc_A12301 mov ecx, ebx call _WheapCallErrorSourceUninitialize@4 ; WheapCallErrorSourceUninitialize(x) mov ecx, [ebx+24h] mov esi, eax mov dword ptr [ebx+5Ch], 3 test ecx, ecx jz short loc_A1233F push 61656857h push ecx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov [ebx+24h], edi loc_A1233F: ; CODE XREF: WheaRemoveErrorSource(x)+B9j lea eax, [esp+418h+var_400] mov [esp+418h+var_400], 674C6857h push eax mov [esp+41Ch+var_3FC], 1 mov [esp+41Ch+var_3F8], 3F1h mov [esp+41Ch+var_3F4], edi mov [esp+41Ch+var_3EC], 8000000Ch mov [esp+41Ch+var_3F0], 4C4E524Bh mov [esp+41Ch+var_3E8], 2 mov [esp+41Ch+var_3E4], 3D1h mov [esp+41Ch+var_14], esi mov [esp+41Ch+var_10], 1 call WheaLogInternalEvent loc_A12394: ; CODE XREF: WheaRemoveErrorSource(x)+30j ; WheaRemoveErrorSource(x)+40j ... mov ecx, [esp+418h+var_4] pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 4 _WheaRemoveErrorSource@4 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� align 10h ; Exported entry 2627. WheaRemoveErrorSourceDeviceDriver ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheaRemoveErrorSourceDeviceDriver(x) public _WheaRemoveErrorSourceDeviceDriver@4 _WheaRemoveErrorSourceDeviceDriver@4 proc near var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 4Ch mov eax, ___security_cookie xor eax, esp mov [esp+4Ch+var_4], eax push ebx mov ebx, [ebp+arg_0] push esi xor esi, esi push edi push ebx mov [esp+5Ch+var_28], esi mov [esp+5Ch+var_24], esi mov [esp+5Ch+var_20], esi mov [esp+5Ch+var_1C], esi mov [esp+5Ch+var_18], esi mov [esp+5Ch+var_14], esi mov [esp+5Ch+var_10], esi mov [esp+5Ch+var_C], esi call _WheaGetErrorSource@4 ; WheaGetErrorSource(x) mov edi, eax test edi, edi jz loc_A124B2 or edx, 0FFFFFFFFh lea ecx, [edi+84h] xor eax, eax lock cmpxchg [ecx], edx cmp eax, 0FFFFFFFFh jz loc_A124B2 test eax, eax jz short loc_A12473 push 20h xor eax, eax mov [esp+5Ch+var_48], 674C6857h pop edx inc eax mov [esp+58h+var_40], 40h push offset ??_C@_0BO@GODKNNIN@RemoveErrorSourceDeviceDriver@NNGAKEGL@ ; "RemoveErrorSourceDeviceDriver" lea ecx, [esp+5Ch+var_28] mov [esp+5Ch+var_44], eax mov [esp+5Ch+var_3C], eax mov [esp+5Ch+var_34], 8000002Ch mov [esp+5Ch+var_38], 4C4E524Bh mov [esp+5Ch+var_30], 2 mov [esp+5Ch+var_2C], edx call _RtlStringCchCopyA@12 ; RtlStringCchCopyA(x,x,x) lea eax, [esp+58h+var_48] push eax call WheaLogInternalEvent mov esi, 0C0000708h jmp short loc_A124B2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12473: ; CODE XREF: WheaRemoveErrorSourceDeviceDriver(x)+68j mov eax, [edi+48h] test eax, eax jz short loc_A1249E push 41454857h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) push 41454857h push dword ptr [edi+80h] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov [edi+48h], esi mov [edi+80h], esi loc_A1249E: ; CODE XREF: WheaRemoveErrorSourceDeviceDriver(x)+C8j push ebx call _WheaRemoveErrorSource@4 ; WheaRemoveErrorSource(x) mov dword ptr [edi+4Ch], offset _xKdGetAcpiTablePhase0@8 ; xKdGetAcpiTablePhase0(x,x) mov dword ptr [edi+50h], offset _KeSetDmaIoCoherency@4 ; KeSetDmaIoCoherency(x) loc_A124B2: ; CODE XREF: WheaRemoveErrorSourceDeviceDriver(x)+48j ; WheaRemoveErrorSourceDeviceDriver(x)+60j ... mov ecx, [esp+58h+var_4] mov eax, esi pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 4 _WheaRemoveErrorSourceDeviceDriver@4 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� dd 0CCCCCCCCh db 0CCh ; Exported entry 2630. WheaReportHwErrorDeviceDriver ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall WheaReportHwErrorDeviceDriver(int,int,void *,size_t,int,int,int) public _WheaReportHwErrorDeviceDriver@28 _WheaReportHwErrorDeviceDriver@28 proc near arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h mov edi, edi push ebp mov ebp, esp push [ebp+arg_18] ; int xor eax, eax push [ebp+arg_14] ; int push eax ; int push [ebp+arg_10] ; int push eax ; size_t push eax ; void * push [ebp+arg_C] ; size_t push [ebp+arg_8] ; void * push [ebp+arg_4] ; int push [ebp+arg_0] ; int call _WheaReportHwErrorDeviceDriverEx@40 ; WheaReportHwErrorDeviceDriverEx(x,x,x,x,x,x,x,x,x,x) pop ebp retn 1Ch _WheaReportHwErrorDeviceDriver@28 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� align 4 db 2 dup(0CCh) ; Exported entry 2610. WheaAttemptClearPoison ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheaAttemptClearPoison(x, x, x) public _WheaAttemptClearPoison@12 _WheaAttemptClearPoison@12 proc near var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_1B = word ptr -1Bh var_19 = dword ptr -19h var_14 = dword ptr -14h var_D = dword ptr -0Dh var_9 = dword ptr -9 var_5 = dword ptr -5 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = byte ptr 10h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 38h mov edx, [ebp+arg_0] mov ecx, edx push ebx push esi mov esi, [ebp+arg_4] xor ebx, ebx mov eax, esi mov [esp+40h+var_34], ebx shrd ecx, eax, 0Ch mov eax, large fs:124h cmp byte ptr [eax+15Ah], 1 jnz short loc_A125A0 mov al, [ebp+arg_8] push ebx mov [esp+44h+var_1C], al lea eax, [esp+44h+var_14] push ebx push eax mov [esp+4Ch+var_19], ebx mov [esp+37h], ebx mov [esp+4Ch+var_14+3], ebx mov [esp+4Ch+var_D], ebx mov [esp+4Ch+var_9], ebx mov [esp+4Ch+var_5], ebx mov [esp+4Ch+var_1], bl mov [esp+4Ch+var_28], edx mov [esp+4Ch+var_24], esi mov [esp+4Ch+var_20], ecx mov [esp+4Ch+var_1B], 101h call _KeInitializeEvent@12 ; KeInitializeEvent(x,x,x) lea eax, [esp+40h+var_28] mov [esp+40h+var_30], offset _WheapAttemptPhysicalPageOfflineWorker@4 ; WheapAttemptPhysicalPageOfflineWorker(x) mov [esp+40h+var_2C], eax lea eax, [esp+40h+var_38] push 1 push eax mov [esp+48h+var_38], ebx call ExQueueWorkItem push ebx push ebx push ebx push ebx lea eax, [esp+50h+var_14] push eax call KeWaitForSingleObject mov eax, [esp+40h+var_19+1] jmp short loc_A125AD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A125A0: ; CODE XREF: WheaAttemptClearPoison(x,x,x)+2Ej push esi push edx mov dl, [ebp+arg_8] push ecx push 1 call _WheapAttemptPhysicalPageOffline@24 ; WheapAttemptPhysicalPageOffline(x,x,x,x,x,x) loc_A125AD: ; CODE XREF: WheaAttemptClearPoison(x,x,x)+A4j pop esi pop ebx mov esp, ebp pop ebp retn 0Ch _WheaAttemptClearPoison@12 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� align 4 db 2 dup(0CCh) ; Exported entry 2611. WheaAttemptPhysicalPageOffline ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheaAttemptPhysicalPageOffline(x, x, x) public _WheaAttemptPhysicalPageOffline@12 _WheaAttemptPhysicalPageOffline@12 proc near ; CODE XREF: WheapPfaMemoryCheck(x,x)+145p ; WheapPfaRetireExpiredMemoryEntries(x,x)+A8p var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_1B = byte ptr -1Bh var_1A = dword ptr -1Ah var_15 = dword ptr -15h var_11 = dword ptr -11h var_D = dword ptr -0Dh var_9 = dword ptr -9 var_5 = dword ptr -5 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = byte ptr 0Ch arg_8 = byte ptr 10h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 40h mov eax, large fs:124h push ebx xor ebx, ebx push esi mov esi, [ebp+arg_0] mov edx, ebx mov ecx, esi mov [esp+48h+var_1A+1], ebx shld edx, ecx, 0Ch mov [esp+48h+var_15], ebx mov [esp+48h+var_11], ebx mov [esp+48h+var_D], ebx mov [esp+48h+var_9], ebx mov [esp+48h+var_5], ebx mov [esp+48h+var_1], bl mov [esp+48h+var_34], ebx shl ecx, 0Ch cmp byte ptr [eax+15Ah], 1 jnz short loc_A12680 mov al, [ebp+arg_4] mov [esp+48h+var_1C], al mov al, [ebp+arg_8] push ebx mov [esp+4Ch+var_1B], al lea eax, [esp+4Ch+var_15+1] push ebx push eax mov [esp+54h+var_1A+1], ebx mov [esp+54h+var_15], ebx mov [esp+54h+var_11], ebx mov [esp+54h+var_D], ebx mov [esp+54h+var_9], ebx mov [esp+54h+var_5], ebx mov [esp+54h+var_1], bl mov [esp+54h+var_28], ecx mov [esp+54h+var_24], edx mov [esp+54h+var_20], esi mov byte ptr [esp+54h+var_1A], bl call _KeInitializeEvent@12 ; KeInitializeEvent(x,x,x) lea eax, [esp+48h+var_28] mov [esp+48h+var_30], offset _WheapAttemptPhysicalPageOfflineWorker@4 ; WheapAttemptPhysicalPageOfflineWorker(x) mov [esp+48h+var_2C], eax lea eax, [esp+48h+var_38] push 1 push eax mov [esp+50h+var_38], ebx call ExQueueWorkItem push ebx push ebx push ebx push ebx lea eax, [esp+58h+var_15+1] push eax call KeWaitForSingleObject mov eax, [esp+48h+var_1A+2] jmp short loc_A12690 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12680: ; CODE XREF: WheaAttemptPhysicalPageOffline(x,x,x)+4Aj push edx mov dl, [ebp+arg_4] push ecx push ecx push dword ptr [ebp+arg_8] mov ecx, esi call _WheapAttemptPhysicalPageOffline@24 ; WheapAttemptPhysicalPageOffline(x,x,x,x,x,x) loc_A12690: ; CODE XREF: WheaAttemptPhysicalPageOffline(x,x,x)+C4j pop esi pop ebx mov esp, ebp pop ebp retn 0Ch _WheaAttemptPhysicalPageOffline@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapAttemptPhysicalPageOffline(x, x, x, x, x, x) _WheapAttemptPhysicalPageOffline@24 proc near ; CODE XREF: WheaAttemptClearPoison(x,x,x)+AEp ; WheaAttemptPhysicalPageOffline(x,x,x)+D1p ... var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_B = dword ptr -0Bh var_4 = dword ptr -4 arg_0 = byte ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 54h mov eax, ___security_cookie xor eax, esp mov [esp+54h+var_4], eax push ebx push esi push edi push 29h ; size_t lea eax, [esp+64h+var_30] mov [esp+64h+var_40], edx mov ebx, ecx push 0 ; int push eax ; void * mov [esp+6Ch+var_50], ebx call _memset and [esp+6Ch+var_34], 0 mov esi, ebx mov bh, [ebp+arg_0] xor ecx, ecx shld ecx, esi, 0Ch xor edx, edx mov byte ptr [esp+6Ch+var_4C], 0 shl esi, 0Ch add esp, 0Ch inc edx mov [esp+60h+var_3C], ecx mov [esp+60h+var_48], esi mov [esp+60h+var_44], ecx mov [esp+60h+var_38], 1000h test bh, bh jnz short loc_A12711 mov eax, esi mov [esp+60h+var_44], ecx or eax, edx mov [esp+60h+var_54], edx mov [esp+60h+var_48], eax jmp short loc_A12719 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12711: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+65j mov [esp+60h+var_54], 2 loc_A12719: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+77j lea eax, [esp+60h+var_38] or bl, 0FFh push eax lea eax, [esp+64h+var_48] push eax call _MmMarkPhysicalMemoryAsBad@8 ; MmMarkPhysicalMemoryAsBad(x,x) mov edi, eax test edi, edi js short loc_A12799 setz bl call ds:__imp__KeGetCurrentIrql@0 ; KeGetCurrentIrql() cmp al, 2 ja short loc_A12799 mov eax, [esp+60h+var_54] and [esp+60h+var_24], 0 mov [esp+60h+var_10], eax mov eax, [esp+60h+var_50] mov [esp+60h+var_B], eax lea eax, [esp+60h+var_30] push eax mov [esp+64h+var_30], 674C6857h mov [esp+64h+var_2C], 1 mov [esp+64h+var_28], 29h mov [esp+64h+var_1C], 80000006h mov [esp+64h+var_20], 4C4E524Bh mov [esp+64h+var_18], 2 mov [esp+64h+var_14], 9 mov [esp+64h+var_C], bl call WheaLogInternalEvent loc_A12799: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+97j ; WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+A4j cmp _WheapPolicyMemPersistOffline, 0 jz short loc_A127B8 mov ecx, [esp+60h+var_50] call _WheaPersistBadPageToBcd@4 ; WheaPersistBadPageToBcd(x) test eax, eax jns short loc_A127B3 mov edi, eax jmp short loc_A127B8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A127B3: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+115j mov byte ptr [esp+60h+var_4C], 1 loc_A127B8: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+108j ; WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+119j mov eax, 0FFh cmp bl, al jz short loc_A127C6 test bl, bl setz al loc_A127C6: ; CODE XREF: WheapAttemptPhysicalPageOffline(x,x,x,x,x,x)+127j push [esp+60h+var_40] mov dl, bh mov cl, al push [esp+64h+var_4C] push [esp+68h+var_3C] push esi call _WheapLogPageOfflineAttemptEvent@24 ; WheapLogPageOfflineAttemptEvent(x,x,x,x,x,x) mov ecx, [esp+60h+var_4] mov eax, edi pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 10h _WheapAttemptPhysicalPageOffline@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapAttemptPhysicalPageOfflineWorker(x) _WheapAttemptPhysicalPageOfflineWorker@4 proc near ; DATA XREF: WheaAttemptClearPoison(x,x,x)+76o ; WheaAttemptPhysicalPageOffline(x,x,x)+96o arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push dword ptr [esi+4] movzx eax, byte ptr [esi+0Dh] push dword ptr [esi] mov dl, [esi+0Ch] push ecx mov ecx, [esi+8] push eax call _WheapAttemptPhysicalPageOffline@24 ; WheapAttemptPhysicalPageOffline(x,x,x,x,x,x) push 0 mov [esi+10h], eax lea eax, [esi+14h] push 0 push eax call _KeSetEvent@12 ; KeSetEvent(x,x,x) pop esi pop ebp retn 4 _WheapAttemptPhysicalPageOfflineWorker@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapCountBadPageExtents(x, x) _WheapCountBadPageExtents@8 proc near ; CODE XREF: WheaPersistBadPageToBcd(x)+14Ap var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch xor eax, eax mov [ebp+var_8], edx push esi mov esi, ecx test edx, edx jz short loc_A12878 xor ecx, ecx inc eax push ebx mov ebx, [esi+4] inc ecx push edi mov edi, [esi] cmp edx, ecx jbe short loc_A12876 loc_A12849: ; CODE XREF: WheapCountBadPageExtents(x,x)+4Ej mov edx, [esi+ecx*8] add edi, 1 mov [ebp+var_4], edx mov edx, [esi+ecx*8+4] adc ebx, 0 mov [ebp+var_C], edx cmp edx, ebx mov edx, [ebp+var_8] jb short loc_A1286B ja short loc_A1286A cmp [ebp+var_4], edi jbe short loc_A1286B loc_A1286A: ; CODE XREF: WheapCountBadPageExtents(x,x)+3Dj inc eax loc_A1286B: ; CODE XREF: WheapCountBadPageExtents(x,x)+3Bj ; WheapCountBadPageExtents(x,x)+42j mov edi, [ebp+var_4] inc ecx mov ebx, [ebp+var_C] cmp ecx, edx jb short loc_A12849 loc_A12876: ; CODE XREF: WheapCountBadPageExtents(x,x)+21j pop edi pop ebx loc_A12878: ; CODE XREF: WheapCountBadPageExtents(x,x)+12j pop esi leave retn _WheapCountBadPageExtents@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapIsPageInList(x, x, x) _WheapIsPageInList@12 proc near ; CODE XREF: WheaPersistBadPageToBcd(x)+11Dp arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push esi push edi mov edi, ecx xor ecx, ecx mov esi, ecx test edx, edx jz short loc_A128A3 loc_A1288C: ; CODE XREF: WheapIsPageInList(x,x,x)+22j mov eax, [edi+esi*8] cmp eax, [ebp+arg_0] jnz short loc_A1289A cmp [edi+esi*8+4], ecx jz short loc_A128A1 loc_A1289A: ; CODE XREF: WheapIsPageInList(x,x,x)+17j inc esi cmp esi, edx jb short loc_A1288C jmp short loc_A128A3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A128A1: ; CODE XREF: WheapIsPageInList(x,x,x)+1Dj mov cl, 1 loc_A128A3: ; CODE XREF: WheapIsPageInList(x,x,x)+Fj ; WheapIsPageInList(x,x,x)+24j pop edi mov al, cl pop esi pop ebp retn 4 _WheapIsPageInList@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapSortBadPages(x, x) _WheapSortBadPages@8 proc near ; CODE XREF: WheaPersistBadPageToBcd(x)+142p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 10h cmp edx, 2 jb short locret_A1291F push esi xor esi, esi sub edx, 1 mov [ebp+var_10], edx jz short loc_A1291E push ebx push edi loc_A128C5: ; CODE XREF: WheapSortBadPages(x,x)+6Fj mov eax, edx xor bl, bl cmp eax, esi jbe short loc_A1291C loc_A128CD: ; CODE XREF: WheapSortBadPages(x,x)+63j mov edx, [ecx+eax*8-4] mov edi, [ecx+eax*8-8] mov [ebp+var_8], edx mov edx, [ecx+eax*8+4] mov [ebp+var_4], edi mov edi, [ecx+eax*8] mov [ebp+var_C], edx cmp [ebp+var_8], edx jb short loc_A1290B ja short loc_A128F1 cmp [ebp+var_4], edi jbe short loc_A1290B loc_A128F1: ; CODE XREF: WheapSortBadPages(x,x)+3Fj mov ebx, [ebp+var_C] mov edx, [ebp+var_8] mov [ecx+eax*8-4], ebx mov ebx, [ebp+var_4] mov [ecx+eax*8], ebx mov bl, 1 mov [ecx+eax*8-8], edi mov [ecx+eax*8+4], edx loc_A1290B: ; CODE XREF: WheapSortBadPages(x,x)+3Dj ; WheapSortBadPages(x,x)+44j dec eax cmp eax, esi ja short loc_A128CD mov edx, [ebp+var_10] test bl, bl jz short loc_A1291C inc esi cmp esi, edx jb short loc_A128C5 loc_A1291C: ; CODE XREF: WheapSortBadPages(x,x)+20j ; WheapSortBadPages(x,x)+6Aj pop edi pop ebx loc_A1291E: ; CODE XREF: WheapSortBadPages(x,x)+16j pop esi locret_A1291F: ; CODE XREF: WheapSortBadPages(x,x)+Bj leave retn _WheapSortBadPages@8 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; __stdcall WheapApplyPolicyChanges() _WheapApplyPolicyChanges@0: ; CODE XREF: WheapPfaReset():loc_A131E1p mov edi, edi push ebx push esi xor ebx, ebx push edi mov edi, ds:__imp__HalWheaUpdateCmciPolicy@8 ; HalWheaUpdateCmciPolicy(x,x) mov esi, ebx loc_A12930: ; CODE XREF: PAGE:00A12A8Bj cmp ds:_WheaRegPolicyTableChanged[esi], bl jz loc_A12A87 cmp esi, 0Dh jnb loc_A12A95 mov eax, esi mov ds:_WheaRegPolicyTableChanged[esi], bl shl eax, 4 mov ecx, ds:off_A41B9C[eax] jmp ds:off_A12A9D[esi*4] loc_A1295D: ; DATA XREF: PAGE:off_A12A9Do cmp [ecx], ebx setnz _WheapPolicyDisableOffline or _WheaRegistryKeysPresent, 1 jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12972: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AA1o cmp [ecx], ebx setnz _WheapPolicyMemPersistOffline or _WheaRegistryKeysPresent, 2 jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12987: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AA5o cmp [ecx], ebx setnz _WheapPolicyMemPfaDisable or _WheaRegistryKeysPresent, 4 jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1299C: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AA9o mov eax, [ecx] or _WheaRegistryKeysPresent, 8 mov _WheapPolicyMemPfaPageCount, eax jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A129AF: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AADo mov eax, [ecx] or _WheaRegistryKeysPresent, 10h mov _WheapPolicyMemPfaThreshold, eax jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A129C2: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AB1o mov eax, [ecx] mov ecx, (offset loc_98967E+2) mul ecx or _WheaRegistryKeysPresent, 20h mov _WheapPolicyMemPfaTimeout, eax mov dword_6B68EC, edx jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A129E2: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AB5o xor eax, eax cmp [ecx], ebx setnz al or _WheaRegistryKeysPresent, 100h mov _WheaRegPolicyIgnoreDummyWrite, eax jmp loc_A12A87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A129FD: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AB9o cmp [ecx], ebx setnz al or _WheaRegistryKeysPresent, 200h mov _WheapPolicyRestoreCmciEnabled, al movzx eax, al push eax push 7 jmp short loc_A12A85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A19: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12ABDo mov eax, [ecx] or _WheaRegistryKeysPresent, 400h push eax mov _WheapPolicyRestoreCmciMaxAttempts, eax push 8 jmp short loc_A12A85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A2F: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AC1o mov eax, [ecx] or _WheaRegistryKeysPresent, 800h push eax mov _WheapPolicyRestoreCmciErrorLimit, eax push 9 jmp short loc_A12A85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A45: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AC5o mov eax, [ecx] or _WheaRegistryKeysPresent, 1000h push eax mov _WheapPolicyCmciThresholdCount, eax push 0Ah jmp short loc_A12A85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A5B: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12AC9o mov eax, [ecx] or _WheaRegistryKeysPresent, 2000h push eax mov _WheapPolicyCmciThresholdTime, eax push 0Bh jmp short loc_A12A85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A71: ; CODE XREF: PAGE:00A12956j ; DATA XREF: PAGE:00A12ACDo mov eax, [ecx] or _WheaRegistryKeysPresent, 4000h push eax mov _WheapPolicyCmciThresholdPollCount, eax push 0Ch loc_A12A85: ; CODE XREF: PAGE:00A12A17j ; PAGE:00A12A2Dj ... call edi loc_A12A87: ; CODE XREF: PAGE:00A12936j ; PAGE:00A1296Dj ... inc esi cmp esi, 0Dh jb loc_A12930 pop edi pop esi pop ebx retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12A95: ; CODE XREF: PAGE:00A1293Fj call ___report_rangecheckfailure lea ecx, [ecx+0] ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� off_A12A9D dd offset loc_A1295D ; DATA XREF: PAGE:00A12956r dd offset loc_A12972 dd offset loc_A12987 dd offset loc_A1299C dd offset loc_A129AF dd offset loc_A129C2 dd offset loc_A129E2 dd offset loc_A129FD dd offset loc_A12A19 dd offset loc_A12A2F dd offset loc_A12A45 dd offset loc_A12A5B dd offset loc_A12A71 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapCommitPolicy() _WheapCommitPolicy@0 proc near ; CODE XREF: WheapWmiExecutePolicyManagementMethod(x,x,x,x,x)+3Cp var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push esi push edi mov edi, offset ??_C@_1BI@ICKPNKKL@?$AAW?$AAH?$AAE?$AAA?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy@FNODOBFM@ push edi push 2 call _RtlCheckRegistryKey@8 ; RtlCheckRegistryKey(x,x) mov esi, eax test esi, esi jns short loc_A12B0C push offset ??_C@_19MBPIHHGH@?$AAW?$AAH?$AAE?$AAA@FNODOBFM@ push 2 call _RtlCreateRegistryKey@8 ; RtlCreateRegistryKey(x,x) mov esi, eax test esi, esi js short loc_A12B5F push edi push 2 call _RtlCreateRegistryKey@8 ; RtlCreateRegistryKey(x,x) mov esi, eax test esi, esi js short loc_A12B5F loc_A12B0C: ; CODE XREF: WheapCommitPolicy()+19j xor eax, eax push ebx mov [ebp+var_4], eax mov edi, eax mov ebx, offset _WheaRegPolicyTable loc_A12B19: ; CODE XREF: WheapCommitPolicy()+77j cmp ds:_WheaRegPolicyTableChanged[edi], 0 jz short loc_A12B41 push 4 push dword ptr [ebx+4] mov byte ptr [ebp+var_4], 1 push 4 push dword ptr [ebx] push offset ??_C@_1BI@ICKPNKKL@?$AAW?$AAH?$AAE?$AAA?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy@NNGAKEGL@ push 2 call _RtlWriteRegistryValue@24 ; RtlWriteRegistryValue(x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A12B59 loc_A12B41: ; CODE XREF: WheapCommitPolicy()+4Fj inc edi add ebx, 10h cmp edi, 0Dh jb short loc_A12B19 test esi, esi js short loc_A12B59 cmp byte ptr [ebp+var_4], 0 jz short loc_A12B59 call _WheapPfaReset@0 ; WheapPfaReset() loc_A12B59: ; CODE XREF: WheapCommitPolicy()+6Ej ; WheapCommitPolicy()+7Bj ... call _WheapLogPolicyTelemetry@0 ; WheapLogPolicyTelemetry() pop ebx loc_A12B5F: ; CODE XREF: WheapCommitPolicy()+2Bj ; WheapCommitPolicy()+39j pop edi mov eax, esi pop esi leave retn _WheapCommitPolicy@0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapGetAllPolicyBufferSize() _WheapGetAllPolicyBufferSize@0 proc near ; CODE XREF: WheapWmiExecutePolicyManagementMethod(x,x,x,x,x):loc_6922E3p push 34h pop eax retn _WheapGetAllPolicyBufferSize@0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapGetAllPolicyValues(x, x, x) _WheapGetAllPolicyValues@12 proc near ; CODE XREF: WheapWmiExecutePolicyManagementMethod(x,x,x,x,x)+CDp arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp cmp edx, 34h jnb short loc_A12B7A mov eax, 0C0000023h jmp short loc_A12B9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12B7A: ; CODE XREF: WheapGetAllPolicyValues(x,x,x)+8j push esi push edi mov edi, [ebp+arg_0] xor esi, esi mov dword ptr [ecx], 0Dh loc_A12B87: ; CODE XREF: WheapGetAllPolicyValues(x,x,x)+32j mov edx, edi mov ecx, esi call _WheapGetPolicyValue@8 ; WheapGetPolicyValue(x,x) test eax, eax js short loc_A12B9D inc esi add edi, 4 cmp esi, 0Dh jb short loc_A12B87 loc_A12B9D: ; CODE XREF: WheapGetAllPolicyValues(x,x,x)+29j pop edi pop esi loc_A12B9F: ; CODE XREF: WheapGetAllPolicyValues(x,x,x)+Fj pop ebp retn 4 _WheapGetAllPolicyValues@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapGetPolicyValue(x, x) _WheapGetPolicyValue@8 proc near ; CODE XREF: WheapWmiExecutePolicyManagementMethod(x,x,x,x,x)+8Fp ; WheapGetAllPolicyValues(x,x,x)+22p mov edi, edi push esi mov esi, edx cmp ecx, 0Dh jb short loc_A12BB4 mov eax, 0C000000Dh pop esi retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BB4: ; CODE XREF: WheapGetPolicyValue(x,x)+8j jmp ds:off_A12C3F[ecx*4] loc_A12BBB: ; DATA XREF: PAGE:off_A12C3Fo xor eax, eax cmp _WheapPolicyDisableOffline, al loc_A12BC3: ; CODE XREF: WheapGetPolicyValue(x,x)+2Dj ; WheapGetPolicyValue(x,x)+37j ... setnz al jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BC8: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C43o xor eax, eax cmp _WheapPolicyMemPersistOffline, al jmp short loc_A12BC3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BD2: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C47o xor eax, eax cmp _WheapPolicyMemPfaDisable, al jmp short loc_A12BC3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BDC: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C4Bo mov eax, _WheapPolicyMemPfaPageCount jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BE3: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C4Fo mov eax, _WheapPolicyMemPfaThreshold jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12BEA: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C53o push 0 push (offset loc_98967E+2) push dword_6B68EC push _WheapPolicyMemPfaTimeout call __aulldiv jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C04: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C57o xor eax, eax cmp _WheaRegPolicyIgnoreDummyWrite, eax jmp short loc_A12BC3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C0E: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C5Bo xor eax, eax cmp _WheapPolicyRestoreCmciEnabled, al jmp short loc_A12BC3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C18: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C5Fo mov eax, _WheapPolicyRestoreCmciMaxAttempts jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C1F: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C63o mov eax, _WheapPolicyRestoreCmciErrorLimit jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C26: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C67o mov eax, _WheapPolicyCmciThresholdCount jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C2D: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C6Bo mov eax, _WheapPolicyCmciThresholdTime jmp short loc_A12C39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12C34: ; CODE XREF: WheapGetPolicyValue(x,x):loc_A12BB4j ; DATA XREF: PAGE:00A12C6Fo mov eax, _WheapPolicyCmciThresholdPollCount loc_A12C39: ; CODE XREF: WheapGetPolicyValue(x,x)+23j ; WheapGetPolicyValue(x,x)+3Ej ... mov [esi], eax xor eax, eax pop esi retn _WheapGetPolicyValue@8 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� off_A12C3F dd offset loc_A12BBB ; DATA XREF: WheapGetPolicyValue(x,x):loc_A12BB4r dd offset loc_A12BC8 dd offset loc_A12BD2 dd offset loc_A12BDC dd offset loc_A12BE3 dd offset loc_A12BEA dd offset loc_A12C04 dd offset loc_A12C0E dd offset loc_A12C18 dd offset loc_A12C1F dd offset loc_A12C26 dd offset loc_A12C2D dd offset loc_A12C34 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapLogPolicyTelemetry() _WheapLogPolicyTelemetry@0 proc near ; CODE XREF: WheapCommitPolicy():loc_A12B59p var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = byte ptr -14h var_13 = byte ptr -13h var_12 = byte ptr -12h var_11 = dword ptr -11h var_D = dword ptr -0Dh var_9 = dword ptr -9 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 38h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax mov eax, _WheaRegistryKeysPresent and [ebp+var_2C], 0 mov [ebp+var_18], eax mov al, _WheapPolicyDisableOffline mov [ebp+var_14], al mov al, _WheapPolicyMemPersistOffline push 0 mov [ebp+var_13], al mov al, _WheapPolicyMemPfaDisable push 989680h push dword_6B68EC mov [ebp+var_12], al mov eax, _WheapPolicyMemPfaPageCount push _WheapPolicyMemPfaTimeout mov [ebp+var_11], eax mov eax, _WheapPolicyMemPfaThreshold mov [ebp+var_38], 674C6857h mov [ebp+var_34], 1 mov [ebp+var_30], 33h mov [ebp+var_24], 80000008h mov [ebp+var_28], 4C4E524Bh mov [ebp+var_20], 2 mov [ebp+var_1C], 13h mov [ebp+var_D], eax call __aulldiv mov [ebp+var_9], eax lea eax, [ebp+var_38] push eax call WheaLogInternalEvent mov ecx, [ebp+var_4] xor ecx, ebp call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _WheapLogPolicyTelemetry@0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapSetPolicyValue(x, x) _WheapSetPolicyValue@8 proc near ; CODE XREF: WheapWmiExecutePolicyManagementMethod(x,x,x,x,x)+68p mov edi, edi push ebx push esi push edi mov edi, ecx cmp edi, 0Dh jnb loc_A12E09 mov esi, [edx] mov eax, edi shl eax, 4 cmp esi, ds:dword_A41BA0[eax] jb loc_A12E09 cmp esi, ds:dword_A41BA4[eax] ja loc_A12E09 lfence eax mov ebx, ds:off_A41B9C[eax] cmp dword ptr [ebx], 0FFFFFFFFh jnz loc_A12DED jmp ds:off_A12E12[edi*4] loc_A12D62: ; DATA XREF: PAGE:off_A12E12o movzx eax, _WheapPolicyDisableOffline loc_A12D69: ; CODE XREF: WheapSetPolicyValue(x,x)+64j ; WheapSetPolicyValue(x,x)+6Dj xor ecx, ecx test esi, esi setnz cl cmp ecx, eax jmp loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12D77: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E16o movzx eax, _WheapPolicyMemPersistOffline jmp short loc_A12D69 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12D80: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E1Ao movzx eax, _WheapPolicyMemPfaDisable jmp short loc_A12D69 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12D89: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E1Eo cmp esi, _WheapPolicyMemPfaPageCount jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12D91: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E22o cmp esi, _WheapPolicyMemPfaThreshold jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12D99: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E26o push 0 push (offset loc_98967E+2) push dword_6B68EC push _WheapPolicyMemPfaTimeout call __aulldiv cmp esi, eax jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DB5: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E2Ao cmp esi, _WheaRegPolicyIgnoreDummyWrite jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DBD: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E2Eo cmp esi, _WheapRegPolicyRestoreCmciEnabled jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DC5: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E32o cmp esi, _WheapRegPolicyRestoreCmciMaxAttempts jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DCD: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E36o cmp esi, _WheapRegPolicyRestoreCmciErrorLimit jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DD5: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E3Ao cmp esi, _WheapRegPolicyCmciThresholdCount jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DDD: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E3Eo cmp esi, _WheapRegPolicyCmciThresholdTime jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DE5: ; CODE XREF: WheapSetPolicyValue(x,x)+41j ; DATA XREF: PAGE:00A12E42o cmp esi, _WheapRegPolicyCmciThresholdPollCount jmp short loc_A12DF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DED: ; CODE XREF: WheapSetPolicyValue(x,x)+3Bj lfence eax mov ebx, ds:off_A41B9C[eax] cmp [ebx], esi loc_A12DF8: ; CODE XREF: WheapSetPolicyValue(x,x)+58j ; WheapSetPolicyValue(x,x)+75j ... jnz short loc_A12DFE loc_A12DFA: ; CODE XREF: WheapSetPolicyValue(x,x)+EDj xor eax, eax jmp short loc_A12E0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12DFE: ; CODE XREF: WheapSetPolicyValue(x,x):loc_A12DF8j mov [ebx], esi mov ds:_WheaRegPolicyTableChanged[edi], 1 jmp short loc_A12DFA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12E09: ; CODE XREF: WheapSetPolicyValue(x,x)+Aj ; WheapSetPolicyValue(x,x)+1Dj ... mov eax, 0C000000Dh loc_A12E0E: ; CODE XREF: WheapSetPolicyValue(x,x)+E2j pop edi pop esi pop ebx retn _WheapSetPolicyValue@8 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� off_A12E12 dd offset loc_A12D62 ; DATA XREF: WheapSetPolicyValue(x,x)+41r dd offset loc_A12D77 dd offset loc_A12D80 dd offset loc_A12D89 dd offset loc_A12D91 dd offset loc_A12D99 dd offset loc_A12DB5 dd offset loc_A12DBD dd offset loc_A12DC5 dd offset loc_A12DCD dd offset loc_A12DD5 dd offset loc_A12DDD dd offset loc_A12DE5 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapReportDeferredLiveDumps() _WheapReportDeferredLiveDumps@0 proc near ; CODE XREF: WheaCrashDumpInitializationComplete():loc_8B5C55p mov edi, edi push ebx push esi mov ebx, offset _WheapLiveDumpLock xor esi, esi push edi mov ecx, ebx call ExAcquireFastMutex mov eax, _WheapLiveDumpRecordList mov ecx, offset _WheapLiveDumpRecordList cmp eax, ecx jz short loc_A12E81 mov esi, eax cmp [esi+4], ecx jnz loc_A12EF5 mov eax, [esi] cmp [eax+4], esi jnz short loc_A12EF5 mov _WheapLiveDumpRecordList, eax mov [eax+4], ecx loc_A12E81: ; CODE XREF: WheapReportDeferredLiveDumps()+1Fj mov ecx, ebx call @ExReleaseFastMutex@4 ; ExReleaseFastMutex(x) xor bl, bl xor edi, edi jmp short loc_A12EEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12E8E: ; CODE XREF: WheapReportDeferredLiveDumps()+A7j test bl, bl jnz short loc_A12E9B mov ecx, esi call _WheapReportLiveDump@4 ; WheapReportLiveDump(x) mov edi, eax loc_A12E9B: ; CODE XREF: WheapReportDeferredLiveDumps()+4Aj push 61656857h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) test bl, bl jnz short loc_A12EB0 test edi, edi jz short loc_A12EB0 inc bl loc_A12EB0: ; CODE XREF: WheapReportDeferredLiveDumps()+62j ; WheapReportDeferredLiveDumps()+66j mov ecx, offset _WheapLiveDumpLock call ExAcquireFastMutex mov esi, _WheapLiveDumpRecordList mov ecx, offset _WheapLiveDumpRecordList cmp esi, ecx jz short loc_A12EDF cmp [esi+4], ecx jnz short loc_A12EF5 mov eax, [esi] cmp [eax+4], esi jnz short loc_A12EF5 mov _WheapLiveDumpRecordList, eax mov [eax+4], ecx jmp short loc_A12EE1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12EDF: ; CODE XREF: WheapReportDeferredLiveDumps()+81j xor esi, esi loc_A12EE1: ; CODE XREF: WheapReportDeferredLiveDumps()+97j mov ecx, offset _WheapLiveDumpLock call @ExReleaseFastMutex@4 ; ExReleaseFastMutex(x) loc_A12EEB: ; CODE XREF: WheapReportDeferredLiveDumps()+46j test esi, esi jnz short loc_A12E8E mov eax, edi pop edi pop esi pop ebx retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12EF5: ; CODE XREF: WheapReportDeferredLiveDumps()+26j ; WheapReportDeferredLiveDumps()+31j ... push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR _WheapReportDeferredLiveDumps@0 endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapReportLiveDump(x) _WheapReportLiveDump@4 proc near ; CODE XREF: WheapCreateLiveDumpFromPreviousSession(x)+60p ; WheapReportDeferredLiveDumps()+4Ep var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h mov eax, [ecx+8] and [ebp+var_4], 0 and [ebp+var_8], 0 push ebx push esi push edi mov edi, [ecx+0Ch] xor ebx, ebx mov [ebp+var_10], eax movzx eax, word ptr [edi+0Ah] lea esi, [edi+80h] mov [ebp+var_C], eax test eax, eax jz short loc_A12F49 loc_A12F29: ; CODE XREF: WheapReportLiveDump(x)+4Dj push 10h ; size_t lea eax, [esi+10h] push (offset loc_42E096+2) ; void * push eax ; void * call _memcmp add esp, 0Ch test eax, eax jz short loc_A12F67 add esi, 48h inc ebx cmp ebx, [ebp+var_C] jb short loc_A12F29 loc_A12F49: ; CODE XREF: WheapReportLiveDump(x)+2Dj mov ecx, [ebp+var_8] mov eax, [ebp+var_4] loc_A12F4F: ; CODE XREF: WheapReportLiveDump(x)+82j push ecx push eax push edi push [ebp+var_10] call _LkmdTelCreateReport@24 ; LkmdTelCreateReport(x,x,x,x,x,x) mov esi, eax test esi, esi jnz short loc_A12F7E mov edi, 0C000009Ah jmp short loc_A12FBC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12F67: ; CODE XREF: WheapReportLiveDump(x)+44j mov esi, [esi] mov cl, 20h mov eax, [esi+edi+28h] mov edx, [esi+edi+2Ch] call __aullshr mov ecx, [esi+edi+28h] jmp short loc_A12F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A12F7E: ; CODE XREF: WheapReportLiveDump(x)+64j push dword ptr [edi+14h] ; size_t mov edx, edi mov ecx, esi call _LkmdTelInsertTriageDataBlock@12 ; LkmdTelInsertTriageDataBlock(x,x,x) mov edi, eax test edi, edi js short loc_A12F99 mov ecx, esi call _LkmdTelSubmitReport@4 ; LkmdTelSubmitReport(x) mov edi, eax loc_A12F99: ; CODE XREF: WheapReportLiveDump(x)+94j cmp dword ptr [esi+4], 0 mov ebx, 74614454h jbe short loc_A12FB5 mov eax, [esi] test eax, eax jz short loc_A12FB1 push ebx push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A12FB1: ; CODE XREF: WheapReportLiveDump(x)+AEj and dword ptr [esi+4], 0 loc_A12FB5: ; CODE XREF: WheapReportLiveDump(x)+A8j push ebx push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A12FBC: ; CODE XREF: WheapReportLiveDump(x)+6Bj mov eax, edi pop edi pop esi pop ebx leave retn _WheapReportLiveDump@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapPfaLogPageMonitorRemoval(x, x, x, x) _WheapPfaLogPageMonitorRemoval@16 proc near ; CODE XREF: WheapPfaMemoryCheck(x,x)+D4p ; WheapPfaMemoryCheck(x,x)+13Bp ... var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 34h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax and [ebp+var_28], 0 mov eax, [ebp+arg_4] push esi mov esi, ecx mov [ebp+var_34], 674C6857h mov ecx, [ebp+arg_0] push 0 push (offset loc_98967E+2) sub ecx, [esi+10h] mov [ebp+var_30], 1 sbb eax, [esi+14h] push eax push ecx mov [ebp+var_2C], 30h mov [ebp+var_20], 80000007h mov [ebp+var_24], 4C4E524Bh mov [ebp+var_1C], 2 mov [ebp+var_18], 10h mov [ebp+var_14], edx call __aulldiv mov [ebp+var_10], eax movzx eax, word ptr [esi+8] mov [ebp+var_C], eax mov eax, [esi+20h] mov [ebp+var_8], eax lea eax, [ebp+var_34] push eax call WheaLogInternalEvent mov ecx, [ebp+var_4] xor ecx, ebp pop esi call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 _WheapPfaLogPageMonitorRemoval@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapPfaMemoryCheck(x, x) _WheapPfaMemoryCheck@8 proc near ; CODE XREF: WheapPredictiveFailureAnalysis(x)+D2p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch cmp _WheapPolicyMemPfaDisable, 0 push ebx push esi push edi jnz short loc_A130D9 mov eax, [edx] and eax, 2 or eax, 0 jz short loc_A130D9 mov edi, [edx+10h] lea eax, [ebp+var_8] mov esi, [edx+14h] push eax mov [ebp+var_8], edi mov [ebp+var_4], esi call _MmGetPageBadStatus@4 ; MmGetPageBadStatus(x) test eax, eax jnz short loc_A130D9 shrd edi, esi, 0Ch call KeQueryInterruptTime mov ebx, eax mov eax, edx push eax push ebx mov [ebp+var_4], eax call _WheapPfaRetireExpiredMemoryEntries@8 ; WheapPfaRetireExpiredMemoryEntries(x,x) mov esi, _WheapPfaList xor ecx, ecx mov edx, offset _WheapPfaList jmp short loc_A130B9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A130AF: ; CODE XREF: WheapPfaMemoryCheck(x,x)+69j mov eax, [esi] cmp [esi+20h], edi jz short loc_A130DE inc ecx mov esi, eax loc_A130B9: ; CODE XREF: WheapPfaMemoryCheck(x,x)+5Bj cmp esi, edx jnz short loc_A130AF cmp ecx, _WheapPolicyMemPfaPageCount jnb short loc_A130FC push 61656857h push 28h push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A1312B loc_A130D9: ; CODE XREF: WheapPfaMemoryCheck(x,x)+12j ; WheapPfaMemoryCheck(x,x)+1Cj ... pop edi pop esi pop ebx leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A130DE: ; CODE XREF: WheapPfaMemoryCheck(x,x)+62j cmp [eax+4], esi jnz loc_A131AC mov ecx, [esi+4] cmp [ecx], esi jnz loc_A131AC mov [ecx], eax mov [eax+4], ecx mov ecx, [ebp+var_4] jmp short loc_A13153 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A130FC: ; CODE XREF: WheapPfaMemoryCheck(x,x)+71j mov esi, dword_6FD8CC mov eax, [esi] cmp [eax+4], esi jnz loc_A131AC mov ecx, [esi+4] cmp [ecx], esi jnz loc_A131AC push [ebp+var_4] mov [ecx], eax push ebx push 3 mov [eax+4], ecx mov ecx, esi pop edx call _WheapPfaLogPageMonitorRemoval@16 ; WheapPfaLogPageMonitorRemoval(x,x,x,x) loc_A1312B: ; CODE XREF: WheapPfaMemoryCheck(x,x)+85j xor ecx, ecx mov edx, offset _WheapPfaList mov [esi], ecx xor eax, eax mov [esi+4], ecx mov [esi+0Ah], ecx mov [esi+0Eh], ax mov [esi+24h], ecx mov ecx, [ebp+var_4] mov [esi+8], ax mov [esi+10h], ebx mov [esi+14h], ecx mov [esi+20h], edi loc_A13153: ; CODE XREF: WheapPfaMemoryCheck(x,x)+A8j inc word ptr [esi+8] movzx eax, word ptr [esi+8] mov [esi+18h], ebx mov [esi+1Ch], ecx cmp eax, _WheapPolicyMemPfaThreshold jnb short loc_A13186 mov eax, _WheapPfaList cmp [eax+4], edx jnz short loc_A131AC mov [esi], eax mov [esi+4], edx mov [eax+4], esi mov _WheapPfaList, esi jmp loc_A130D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13186: ; CODE XREF: WheapPfaMemoryCheck(x,x)+115j push ecx xor edx, edx mov ecx, esi push ebx inc edx call _WheapPfaLogPageMonitorRemoval@16 ; WheapPfaLogPageMonitorRemoval(x,x,x,x) push 0 push 0 push edi call _WheaAttemptPhysicalPageOffline@12 ; WheaAttemptPhysicalPageOffline(x,x,x) push 61656857h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) jmp loc_A130D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A131AC: ; CODE XREF: WheapPfaMemoryCheck(x,x)+8Fj ; WheapPfaMemoryCheck(x,x)+9Aj ... push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR _WheapPfaMemoryCheck@8 endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapPfaReset() _WheapPfaReset@0 proc near ; CODE XREF: WheapCommitPolicy()+83p mov edi, edi push ebx push esi push edi mov edi, offset _WheapPfaLock xor edx, edx push 0 mov ecx, edi call KeAbPreAcquire mov esi, eax lock bts dword ptr [edi], 0 jnb short loc_A131D9 push edi mov edx, esi mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A131D9: ; CODE XREF: WheapPfaReset()+1Cj test esi, esi jz short loc_A131E1 or byte ptr [esi+0Eh], 1 loc_A131E1: ; CODE XREF: WheapPfaReset()+2Aj call _WheapApplyPolicyChanges@0 ; WheapApplyPolicyChanges() mov esi, _WheapPfaList mov ebx, offset _WheapPfaList jmp short loc_A13215 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A131F3: ; CODE XREF: WheapPfaReset()+66j mov ecx, [esi] mov eax, esi mov esi, ecx cmp [ecx+4], eax jnz short loc_A13237 mov edx, [eax+4] cmp [edx], eax jnz short loc_A13237 push 61656857h mov [edx], ecx push eax mov [ecx+4], edx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A13215: ; CODE XREF: WheapPfaReset()+40j cmp esi, ebx jnz short loc_A131F3 or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1322D mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1322D: ; CODE XREF: WheapPfaReset()+73j mov ecx, edi pop edi pop esi pop ebx jmp KeAbPostRelease ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13237: ; CODE XREF: WheapPfaReset()+4Bj ; WheapPfaReset()+52j push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR _WheapPfaReset@0 endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WheapPfaRetireExpiredMemoryEntries(x, x) _WheapPfaRetireExpiredMemoryEntries@8 proc near ; CODE XREF: WheapPfaMemoryCheck(x,x)+49p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx mov edx, _WheapPolicyMemPfaTimeout mov eax, edx mov ecx, dword_6B68EC or eax, ecx push ebx push esi push edi jz short loc_A132BF cmp [ebp+arg_4], ecx jb short loc_A132BF ja short loc_A13263 cmp [ebp+arg_0], edx jb short loc_A132BF loc_A13263: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+20j mov ebx, [ebp+arg_0] mov esi, _WheapPfaList sub ebx, edx mov edx, [ebp+arg_4] sbb edx, ecx mov [ebp+var_4], edx jmp short loc_A132B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13278: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+81j mov edi, esi mov esi, [esi] cmp [edi+1Ch], edx ja short loc_A132B7 jb short loc_A13288 cmp [edi+18h], ebx ja short loc_A132B7 loc_A13288: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+45j cmp [esi+4], edi jnz short loc_A132C6 mov eax, [edi+4] cmp [eax], edi jnz short loc_A132C6 push [ebp+arg_4] mov [eax], esi mov ecx, edi push [ebp+arg_0] mov [esi+4], eax push 2 pop edx call _WheapPfaLogPageMonitorRemoval@16 ; WheapPfaLogPageMonitorRemoval(x,x,x,x) push 61656857h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edx, [ebp+var_4] loc_A132B7: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+3Aj ; WheapPfaRetireExpiredMemoryEntries(x,x)+43j ... cmp esi, offset _WheapPfaList jnz short loc_A13278 loc_A132BF: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+19j ; WheapPfaRetireExpiredMemoryEntries(x,x)+1Ej ... pop edi pop esi pop ebx leave retn 8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A132C6: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+4Fj ; WheapPfaRetireExpiredMemoryEntries(x,x)+56j push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR ; AL = character to display ; __stdcall WheapPlatformDirectedMemoryOffline(x, x) _WheapPlatformDirectedMemoryOffline@8: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+A0j mov eax, [edx] and eax, 2 or eax, 0 jz short locret_A132E9 mov ecx, [edx+10h] mov eax, [edx+14h] push 0 shrd ecx, eax, 0Ch push 1 push ecx call _WheaAttemptPhysicalPageOffline@12 ; WheaAttemptPhysicalPageOffline(x,x,x) locret_A132E9: ; CODE XREF: WheapPfaRetireExpiredMemoryEntries(x,x)+97j retn _WheapPfaRetireExpiredMemoryEntries@8 endp ; sp = -14h ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall WheapPredictiveFailureAnalysis(x) _WheapPredictiveFailureAnalysis@4 proc near ; CODE XREF: WheapProcessWorkQueueItem(x,x)+61p mov edi, edi push ebx mov ebx, ecx push esi push edi lea esi, [ebx+1Ch] push esi call ds:__imp__PshedDoPfa@4 ; PshedDoPfa(x) cmp eax, 1 jz loc_A133DF cmp _WheapPolicyDisableOffline, 0 jnz loc_A133DF cmp _WheapPfaInitialized, 0 jz loc_A133DF movzx eax, word ptr [esi+0Ah] test ax, ax jz loc_A133DF cmp dword ptr [esi+0Ch], 2 jnz loc_A133DF test byte ptr [esi+68h], 1 jnz loc_A133DF xor ecx, ecx test eax, eax jz short loc_A13359 lea edi, [esi+80h] loc_A1334B: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+6Dj test byte ptr [edi+0Ch], 1 jnz short loc_A1335F inc ecx add edi, 48h cmp ecx, eax jb short loc_A1334B loc_A13359: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+59j lea edi, [esi+80h] loc_A1335F: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+65j push 10h ; size_t lea eax, [edi+10h] push offset _MEMORY_ERROR_SECTION_GUID ; void * push eax ; void * call _memcmp add esp, 0Ch test eax, eax jnz short loc_A133DF mov edi, [edi] mov eax, [ebx+10h] add edi, esi test al, 4 jz short loc_A1338F test al, 8 jz short loc_A133DF mov edx, edi pop edi pop esi pop ebx jmp _WheapPlatformDirectedMemoryOffline@8 ; WheapPlatformDirectedMemoryOffline(x,x) ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1338F: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+95j mov ebx, offset _WheapPfaLock xor edx, edx push 0 mov ecx, ebx call KeAbPreAcquire mov esi, eax lock bts dword ptr [ebx], 0 jnb short loc_A133B2 push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockExclusiveEx loc_A133B2: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+BCj test esi, esi jz short loc_A133BA or byte ptr [esi+0Eh], 1 loc_A133BA: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+CAj mov edx, edi call _WheapPfaMemoryCheck@8 ; WheapPfaMemoryCheck(x,x) or eax, 0FFFFFFFFh lock xadd [ebx], eax and al, 6 cmp al, 2 jnz short loc_A133D5 mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A133D5: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+E2j mov ecx, ebx pop edi pop esi pop ebx jmp KeAbPostRelease ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A133DF: ; CODE XREF: WheapPredictiveFailureAnalysis(x)+14j ; WheapPredictiveFailureAnalysis(x)+21j ... pop edi pop esi pop ebx retn _WheapPredictiveFailureAnalysis@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ApiSetLoadSchemaEx(x, x, x) _ApiSetLoadSchemaEx@12 proc near ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+1Fp ; ApiSetpLoadSchemaExtension+B4p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 10h and [ebp+var_8], 0 lea eax, [ebp+var_8] and [ebp+var_4], 0 push ebx push esi push edi push eax lea eax, [ebp+var_4] mov [ebp+var_C], edx push eax mov edx, ecx call ApiSetpLoadSchemaImage mov edi, [ebp+var_4] mov esi, eax test esi, esi js short loc_A13464 push ecx mov ecx, edi call ApiSetpFindImageSection test eax, eax jnz short loc_A13424 mov esi, 0C000007Bh jmp short loc_A13464 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13424: ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+38j mov ecx, [eax+14h] mov ebx, [eax+10h] add ecx, edi push 68635341h push ebx push 1 mov [ebp+var_8], ecx call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_4], eax test eax, eax jnz short loc_A1344A mov esi, 0C0000017h jmp short loc_A13464 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1344A: ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+5Ej push ebx ; size_t push [ebp+var_8] ; void * push eax ; void * call _memcpy mov ecx, [ebp+var_C] add esp, 0Ch mov eax, [ebp+var_4] mov [ecx], eax mov eax, [ebp+arg_0] mov [eax], ebx loc_A13464: ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+2Cj ; ApiSetLoadSchemaEx(x,x,x)+3Fj ... test edi, edi jz short loc_A13470 push edi push 0FFFFFFFFh call _ZwUnmapViewOfSection@8 ; ZwUnmapViewOfSection(x,x) loc_A13470: ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+83j pop edi mov eax, esi pop esi pop ebx leave retn 4 _ApiSetLoadSchemaEx@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall ApiSetLoadSchemaWithExtensions(x, x, x) _ApiSetLoadSchemaWithExtensions@12 proc near ; CODE XREF: PspSiloLoadApiSets(x)+47p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_C], 0 lea eax, [ebp+var_C] or [ebp+var_8], 0FFFFFFFFh and [ebp+var_4], 0 push esi push edi mov edi, edx lea edx, [ebp+var_4] push eax call _ApiSetLoadSchemaEx@12 ; ApiSetLoadSchemaEx(x,x,x) mov esi, eax test esi, esi js short loc_A134EF mov ecx, [ebp+var_4] call _ApiSetIsSchemaSealed@4 ; ApiSetIsSchemaSealed(x) test al, al jnz short loc_A134DA lea ecx, [ebp+var_8] call ApiSetpOpenSchemaExtensionsRootNode mov esi, eax test esi, esi jns short loc_A134C9 cmp esi, 0C0000034h jnz short loc_A134DA xor esi, esi jmp short loc_A134DA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A134C9: ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+42j mov ecx, [ebp+var_8] lea eax, [ebp+var_C] push eax lea edx, [ebp+var_4] call ApiSetpLoadSchemaExtensions mov esi, eax loc_A134DA: ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+34j ; ApiSetLoadSchemaWithExtensions(x,x,x)+4Aj ... test esi, esi js short loc_A134EF mov eax, [ebp+var_4] mov ecx, [ebp+arg_0] and [ebp+var_4], 0 mov [edi], eax mov eax, [ebp+var_C] mov [ecx], eax loc_A134EF: ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+28j ; ApiSetLoadSchemaWithExtensions(x,x,x)+63j cmp [ebp+var_8], 0FFFFFFFFh jz short loc_A134FD push [ebp+var_8] call _ZwClose@4 ; ZwClose(x) loc_A134FD: ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+7Aj mov ecx, [ebp+var_4] test ecx, ecx jz short loc_A13509 call _ApiSetReleaseSchema@4 ; ApiSetReleaseSchema(x) loc_A13509: ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+89j pop edi mov eax, esi pop esi leave retn 4 _ApiSetLoadSchemaWithExtensions@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpConstructPathToExtension proc near ; CODE XREF: ApiSetpLoadSchemaExtension+96p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_8], 0 lea eax, [edx+2Ch] push esi push edi mov word ptr [ebp+var_8+2], ax mov edi, ecx push 68635341h movzx eax, ax push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov [ebp+var_4], eax test eax, eax jnz short loc_A13545 mov esi, 0C0000017h jmp short loc_A1358A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13545: ; CODE XREF: ApiSetpConstructPathToExtension+2Bj push offset ??_C@_1CM@JIIAJDGD@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs@NNGAKEGL@ ; void * lea eax, [ebp+var_8] push eax ; int call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) mov esi, eax test esi, esi js short loc_A1357B push edi ; void * lea eax, [ebp+var_8] push eax ; int call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) mov esi, eax test esi, esi js short loc_A1357B mov ecx, [ebp+arg_0] mov eax, [ebp+var_8] mov [ecx], eax mov eax, [ebp+var_4] mov [ecx+4], eax xor eax, eax jmp short loc_A1357E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1357B: ; CODE XREF: ApiSetpConstructPathToExtension+46j ; ApiSetpConstructPathToExtension+56j mov eax, [ebp+var_4] loc_A1357E: ; CODE XREF: ApiSetpConstructPathToExtension+68j test eax, eax jz short loc_A1358A push 0 push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1358A: ; CODE XREF: ApiSetpConstructPathToExtension+32j ; ApiSetpConstructPathToExtension+6Fj pop edi mov eax, esi pop esi leave retn 4 ApiSetpConstructPathToExtension endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ApiSetpFindImageSection proc near ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+31p mov edi, edi push ebx push esi push edi push ecx call _RtlImageNtHeader@4 ; RtlImageNtHeader(x) mov edi, eax test edi, edi jz short loc_A135D6 movzx ecx, word ptr [edi+14h] lea esi, [edi+18h] xor eax, eax add esi, ecx xor ebx, ebx cmp ax, [edi+6] jnb short loc_A135D6 loc_A135B6: ; CODE XREF: ApiSetpFindImageSection+42j push 8 ; size_t push offset ??_C@_07LICFLFBF@?4apiset@NNGAKEGL@ ; char * push esi ; char * call _strncmp add esp, 0Ch test eax, eax jz short loc_A135DE movzx eax, word ptr [edi+6] add esi, 28h inc ebx cmp ebx, eax jb short loc_A135B6 loc_A135D6: ; CODE XREF: ApiSetpFindImageSection+Fj ; ApiSetpFindImageSection+22j xor eax, eax loc_A135D8: ; CODE XREF: ApiSetpFindImageSection+4Ej pop edi pop esi pop ebx retn 4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A135DE: ; CODE XREF: ApiSetpFindImageSection+36j mov eax, esi jmp short loc_A135D8 ApiSetpFindImageSection endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpLoadSchemaExtension proc near ; CODE XREF: ApiSetpLoadSchemaExtensions+6Dp var_13C = dword ptr -13Ch var_138 = dword ptr -138h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = dword ptr -120h var_118 = dword ptr -118h var_114 = dword ptr -114h var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 140h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi mov ebx, [ebp+arg_0] mov edi, edx push 10h pop eax push 12h mov word ptr [ebp+var_13C], ax xor edx, edx pop eax mov word ptr [ebp+var_13C+2], ax lea eax, [ebp+var_134] push eax push 114h lea eax, [ebp+var_120] mov [ebp+var_128], edx push eax push 2 lea eax, [ebp+var_13C] mov [ebp+var_124], edx push eax push ecx mov [ebp+var_130], edx mov [ebp+var_12C], edx mov [ebp+var_138], offset ??_C@_1BC@PKFGPGJB@?$AAF?$AAi?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe@NNGAKEGL@ ; "FileName" mov [ebp+var_134], edx call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A136B8 mov edx, [ebp+var_118] lea eax, [ebp+var_130] push eax lea ecx, [ebp+var_114] call ApiSetpConstructPathToExtension mov esi, eax test esi, esi js short loc_A136B8 lea eax, [ebp+var_124] push eax lea edx, [ebp+var_128] lea ecx, [ebp+var_130] call _ApiSetLoadSchemaEx@12 ; ApiSetLoadSchemaEx(x,x,x) mov esi, eax test esi, esi js short loc_A136B8 push [ebp+var_124] mov edx, ebx mov ecx, edi push [ebp+var_128] call _ApiSetComposeSchema@16 ; ApiSetComposeSchema(x,x,x,x) mov esi, eax loc_A136B8: ; CODE XREF: ApiSetpLoadSchemaExtension+81j ; ApiSetpLoadSchemaExtension+9Fj ... cmp [ebp+var_12C], 0 jz short loc_A136CE push 0 push [ebp+var_12C] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A136CE: ; CODE XREF: ApiSetpLoadSchemaExtension+DDj mov ecx, [ebp+var_4] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 4 ApiSetpLoadSchemaExtension endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpLoadSchemaExtensions proc near ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+5Ap var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_18 = dword ptr -18h var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 234h mov eax, ___security_cookie xor eax, esp mov [esp+234h+var_4], eax mov eax, [ebp+arg_0] push ebx push esi push edi mov [esp+240h+var_228], eax mov ebx, ecx lea eax, [esp+240h+var_22C] mov [esp+240h+var_224], edx push eax xor ecx, ecx lea eax, [esp+244h+var_220] push 218h push eax push ecx mov [esp+250h+var_230], ecx mov edi, ecx mov [esp+250h+var_22C], ecx push ecx jmp short loc_A13775 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1372C: ; CODE XREF: ApiSetpLoadSchemaExtensions+9Cj lea eax, [esp+254h+var_244] mov edx, ebx push eax lea ecx, [esp+258h+var_234] call ApiSetpOpenSchemaExtensionNode mov esi, eax test esi, esi js short loc_A1378B push [esp+254h+var_23C] mov edx, [esp+258h+var_238] mov ecx, [esp+258h+var_244] call ApiSetpLoadSchemaExtension push [esp+254h+var_244] mov esi, eax call _ZwClose@4 ; ZwClose(x) test esi, esi js short loc_A1378B lea eax, [esp+254h+var_240] inc edi push eax push 218h lea eax, [esp+25Ch+var_234] push eax push 0 push edi loc_A13775: ; CODE XREF: ApiSetpLoadSchemaExtensions+49j push ebx call _ZwEnumerateKey@24 ; ZwEnumerateKey(x,x,x,x,x,x) test eax, eax jns short loc_A1372C lea esi, [eax+7FFFFFE6h] neg esi sbb esi, esi and esi, eax loc_A1378B: ; CODE XREF: ApiSetpLoadSchemaExtensions+5Fj ; ApiSetpLoadSchemaExtensions+7Fj mov ecx, [esp+254h+var_18] mov eax, esi pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 4 ApiSetpLoadSchemaExtensions endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpLoadSchemaImage proc near ; CODE XREF: ApiSetLoadSchemaEx(x,x,x)+20p var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 4Ch push ebx push esi push edi push 6 xor ebx, ebx mov [ebp+var_48], 18h pop ecx xor eax, eax mov [ebp+var_C], ebx push ebx push 1 lea edi, [ebp+var_30] mov [ebp+var_10], ebx rep stosd lea eax, [ebp+var_18] mov [ebp+var_18], ebx push eax lea eax, [ebp+var_48] mov [ebp+var_14], ebx push eax push 80000000h lea eax, [ebp+var_8] mov [ebp+var_44], ebx or edi, 0FFFFFFFFh mov [ebp+var_3C], 240h push eax mov [ebp+var_8], edi mov [ebp+var_4], edi mov [ebp+var_40], edx mov [ebp+var_38], ebx mov [ebp+var_34], ebx call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A13872 push [ebp+var_8] lea eax, [ebp+var_30] mov [ebp+var_30], 18h push 8000000h push 2 push ebx push eax push 4 lea eax, [ebp+var_4] mov [ebp+var_2C], ebx push eax mov [ebp+var_24], 240h mov [ebp+var_28], ebx mov [ebp+var_20], ebx mov [ebp+var_1C], ebx call _ZwCreateSection@28 ; ZwCreateSection(x,x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A13872 push 2 push ebx push 2 lea eax, [ebp+var_10] push eax push ebx push ebx push ebx lea eax, [ebp+var_C] push eax push edi push [ebp+var_4] call _ZwMapViewOfSection@40 ; ZwMapViewOfSection(x,x,x,x,x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A13872 mov ecx, [ebp+arg_0] mov eax, [ebp+var_C] mov [ecx], eax mov ecx, [ebp+arg_4] mov eax, [ebp+var_10] mov [ecx], eax loc_A13872: ; CODE XREF: ApiSetpLoadSchemaImage+63j ; ApiSetpLoadSchemaImage+9Dj ... cmp [ebp+var_4], edi jz short loc_A1387F push [ebp+var_4] call _ZwClose@4 ; ZwClose(x) loc_A1387F: ; CODE XREF: ApiSetpLoadSchemaImage+D1j cmp [ebp+var_8], edi jz short loc_A1388C push [ebp+var_8] call _ZwClose@4 ; ZwClose(x) loc_A1388C: ; CODE XREF: ApiSetpLoadSchemaImage+DEj pop edi mov eax, esi pop esi pop ebx leave retn 8 ApiSetpLoadSchemaImage endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpOpenSchemaExtensionNode proc near ; CODE XREF: ApiSetpLoadSchemaExtensions+56p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 28h push esi lea eax, [ecx+10h] mov [ebp+var_24], 18h xor esi, esi mov [ebp+var_8], eax mov ax, [ecx+0Ch] mov [ebp+var_C], esi mov word ptr [ebp+var_C], ax mov word ptr [ebp+var_C+2], ax lea eax, [ebp+var_C] mov [ebp+var_1C], eax lea eax, [ebp+var_24] push eax push 20019h push [ebp+arg_0] mov [ebp+var_20], edx mov [ebp+var_18], 240h mov [ebp+var_14], esi mov [ebp+var_10], esi call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) pop esi leave retn 4 ApiSetpOpenSchemaExtensionNode endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ApiSetpOpenSchemaExtensionsRootNode proc near ; CODE XREF: ApiSetLoadSchemaWithExtensions(x,x,x)+39p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 20h lea eax, [ebp+var_8] mov [ebp+var_8], 0B400B2h mov [ebp+var_18], eax xor edx, edx lea eax, [ebp+var_20] mov [ebp+var_4], offset ??_C@_1LE@LDGAKFIO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi@NNGAKEGL@ push eax push 8 push ecx mov [ebp+var_20], 18h mov [ebp+var_1C], edx mov [ebp+var_14], 240h mov [ebp+var_10], edx mov [ebp+var_C], edx call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) leave retn ApiSetpOpenSchemaExtensionsRootNode endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall KIsSideloadingEnabled(x) _KIsSideloadingEnabled@4 proc near ; CODE XREF: SepIsLockedDown(x,x)+25p var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 1Ch push ebx push esi push edi push 74h pop eax push 76h mov word ptr [ebp+var_1C], ax mov edi, ecx pop eax push 26h mov word ptr [ebp+var_1C+2], ax xor ecx, ecx pop eax push 28h mov word ptr [ebp+var_C], ax mov edx, offset ??_C@_1HG@FBAFABN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi@NNGAKEGL@ pop eax mov word ptr [ebp+var_C+2], ax mov ebx, 0FFFFh lea eax, [ebp+var_14] mov [ebp+var_14], ecx mov [ebp+var_10], ecx mov [edi], cl mov ecx, offset ??_C@_1BK@IJBLJGGE@?$AAA?$AAp?$AAp?$AAx?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs@NNGAKEGL@ ; "AppxPolicies" push eax mov [ebp+var_18], edx mov [ebp+var_8], (offset loc_8C2059+1) mov [ebp+var_4], ebx call KGetAppModelStateSeparatedRegKeyPath mov esi, eax test esi, esi js short loc_A139CA lea eax, [ebp+var_4] push eax lea edx, [ebp+var_C] lea ecx, [ebp+var_14] call KGetUnlockSetting mov esi, eax test esi, esi js short loc_A139CA call _CmIsStateSeparationEnabled@0 ; CmIsStateSeparationEnabled() test al, al jz short loc_A139BD cmp [ebp+var_4], ebx jnz short loc_A139BD lea eax, [ebp+var_4] push eax lea edx, [ebp+var_C] lea ecx, [ebp+var_1C] call KGetUnlockSetting mov esi, eax loc_A139BD: ; CODE XREF: KIsSideloadingEnabled(x)+7Aj ; KIsSideloadingEnabled(x)+7Fj test esi, esi js short loc_A139CA cmp [ebp+var_4], 0 jz short loc_A139CA mov byte ptr [edi], 1 loc_A139CA: ; CODE XREF: KIsSideloadingEnabled(x)+5Cj ; KIsSideloadingEnabled(x)+71j ... lea ecx, [ebp+var_14] call _AppModelFreeUnicodeString@4 ; AppModelFreeUnicodeString(x) pop edi mov eax, esi pop esi pop ebx leave retn _KIsSideloadingEnabled@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A139D9 proc near ; CODE XREF: sub_785212+206Bp var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 64h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx mov ebx, [ebp+arg_4] mov eax, ecx push esi push edi xor edi, edi mov [ebp+var_38], edx mov [ebp+var_44], eax mov [ebp+var_60], edi mov [ebp+var_4C], edi mov [ebp+var_48], edi mov [ebp+var_58], edi mov [ebp+var_3C], edi mov [ebp+var_54], edi mov [ebp+var_34], edi mov [ebp+var_50], edi test eax, eax jnz short loc_A13A21 loc_A13A17: ; CODE XREF: sub_A139D9+4Aj ; sub_A139D9+105j ... mov edx, 0C000000Dh jmp loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13A21: ; CODE XREF: sub_A139D9+3Cj test edx, edx jz short loc_A13A17 mov edx, 0C000000Dh test ebx, ebx jz loc_A13F4F mov ecx, [eax+8] mov esi, edi mov [ebp+var_2C], ecx test ecx, ecx jz loc_A13AD4 cmp dword ptr [eax], 3 jbe loc_A13AD4 mov eax, ecx loc_A13A4D: ; CODE XREF: sub_A139D9+ACj mov ecx, [eax] mov [ebp+var_40], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A13A5D xor edx, edx jmp short loc_A13A65 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13A5D: ; CODE XREF: sub_A139D9+7Ej mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13A65: ; CODE XREF: sub_A139D9+82j mov [ebp+var_28], ecx test edx, edx js short loc_A13AAC mov edx, [ebp+var_40] lea eax, [ebp+var_28] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A13AAC mov eax, [ebp+var_28] inc edi cmp edi, 3 jb short loc_A13A4D mov edi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13A94 xor edx, edx jmp short loc_A13A9C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13A94: ; CODE XREF: sub_A139D9+B5j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13A9C: ; CODE XREF: sub_A139D9+B9j test edx, edx js short loc_A13AAC mov esi, edi mov eax, edi neg esi sbb esi, esi and esi, ecx jmp short loc_A13AAE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13AAC: ; CODE XREF: sub_A139D9+91j ; sub_A139D9+A3j ... mov eax, esi loc_A13AAE: ; CODE XREF: sub_A139D9+D1j test edx, edx js short loc_A13ACC cmp eax, 8 jz short loc_A13AC1 loc_A13AB7: ; CODE XREF: sub_A139D9+425j ; sub_A139D9+4B4j ... mov edx, 0C0000023h jmp loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13AC1: ; CODE XREF: sub_A139D9+DCj mov eax, [esi] mov [ebp+var_60], eax mov eax, [esi+4] mov [ebp+var_4C], eax loc_A13ACC: ; CODE XREF: sub_A139D9+D7j mov ecx, [ebp+var_2C] xor edi, edi mov eax, [ebp+var_44] loc_A13AD4: ; CODE XREF: sub_A139D9+63j ; sub_A139D9+6Cj test edx, edx js loc_A13F4F test ecx, ecx jz loc_A13A17 mov eax, [eax] mov [ebp+var_44], eax cmp eax, 4 jbe loc_A13A17 mov eax, ecx mov esi, edi loc_A13AF6: ; CODE XREF: sub_A139D9+159j mov edi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13B03 xor edx, edx jmp short loc_A13B0B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13B03: ; CODE XREF: sub_A139D9+124j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13B0B: ; CODE XREF: sub_A139D9+128j mov [ebp+var_30], ecx test edx, edx js loc_A13F4F lea eax, [ebp+var_30] mov edx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov eax, [ebp+var_30] inc esi cmp esi, 4 jb short loc_A13AF6 mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13B41 xor edx, edx jmp short loc_A13B49 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13B41: ; CODE XREF: sub_A139D9+162j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13B49: ; CODE XREF: sub_A139D9+166j test edx, edx js loc_A13F4F mov eax, esi mov [ebp+var_58], esi neg eax sbb eax, eax and eax, ecx mov [ebp+var_48], eax test edx, edx js loc_A13F4F cmp [ebp+var_44], 5 jbe loc_A13A17 mov eax, [ebp+var_2C] xor esi, esi loc_A13B76: ; CODE XREF: sub_A139D9+1D1j mov edi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13B83 xor edx, edx jmp short loc_A13B8B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13B83: ; CODE XREF: sub_A139D9+1A4j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13B8B: ; CODE XREF: sub_A139D9+1A8j mov [ebp+var_30], ecx test edx, edx js short loc_A13BD2 lea eax, [ebp+var_30] mov edx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A13BD2 mov eax, [ebp+var_30] inc esi cmp esi, 5 jb short loc_A13B76 mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13BB9 xor edx, edx jmp short loc_A13BC1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13BB9: ; CODE XREF: sub_A139D9+1DAj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13BC1: ; CODE XREF: sub_A139D9+1DEj test edx, edx js short loc_A13BD2 mov edi, esi mov [ebp+var_54], esi neg edi sbb edi, edi and edi, ecx jmp short loc_A13BD5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13BD2: ; CODE XREF: sub_A139D9+1B7j ; sub_A139D9+1C8j ... mov edi, [ebp+var_3C] loc_A13BD5: ; CODE XREF: sub_A139D9+1F7j test edx, edx js loc_A13F4F cmp [ebp+var_44], 6 jbe loc_A13A17 mov edx, [ebp+var_2C] xor esi, esi loc_A13BEC: ; CODE XREF: sub_A139D9+249j mov eax, [edx] lea ecx, [edx+4] cmp ecx, edx jb short loc_A13BF9 xor edx, edx jmp short loc_A13C01 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13BF9: ; CODE XREF: sub_A139D9+21Aj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13C01: ; CODE XREF: sub_A139D9+21Ej mov [ebp+var_3C], ecx test edx, edx js short loc_A13C4D lea edx, [ebp+var_3C] push edx mov edx, eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A13C4D inc esi cmp esi, 6 jnb short loc_A13C24 mov edx, [ebp+var_3C] jmp short loc_A13BEC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13C24: ; CODE XREF: sub_A139D9+244j mov eax, [ebp+var_3C] mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13C34 xor edx, edx jmp short loc_A13C3C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13C34: ; CODE XREF: sub_A139D9+255j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13C3C: ; CODE XREF: sub_A139D9+259j test edx, edx js short loc_A13C4D mov eax, esi mov [ebp+var_50], esi neg eax sbb eax, eax and eax, ecx jmp short loc_A13C50 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13C4D: ; CODE XREF: sub_A139D9+22Dj ; sub_A139D9+23Ej ... mov eax, [ebp+var_34] loc_A13C50: ; CODE XREF: sub_A139D9+272j test edx, edx js loc_A13F4F cmp ds:dword_A93EA0, 0 jz short loc_A13C7F push 20h lea ecx, [ebp+var_24] push ecx push [ebp+var_50] push eax push [ebp+var_54] push edi push [ebp+var_58] push [ebp+var_48] call ds:dword_A93EDC mov esi, eax jmp short loc_A13C84 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13C7F: ; CODE XREF: sub_A139D9+286j mov esi, 0C00000BBh loc_A13C84: ; CODE XREF: sub_A139D9+2A4j mov edx, esi test esi, esi js loc_A13F4F and [ebp+var_28], 0 lea eax, [ebp+var_28] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov ecx, [ebp+var_28] lea eax, [ebp+var_28] push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov ecx, [ebp+var_28] lea eax, [ebp+var_28] push eax push 24h pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F push 8 pop ecx xor edi, edi mov [ebp+var_5C], ecx mov edx, [ebp+var_28] lea eax, [ebp+var_5C] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov eax, [ebp+var_5C] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A13D0E mov edx, 0C0000095h jmp short loc_A13D1B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13D0E: ; CODE XREF: sub_A139D9+32Cj lea edi, [ecx+8] cmp edi, ecx jb loc_A13D9E xor edx, edx loc_A13D1B: ; CODE XREF: sub_A139D9+333j test edx, edx js loc_A13F4F mov ecx, [ebp+var_38] mov edx, edi push 4 mov eax, [ecx+10h] mov [ebp+var_40], eax mov eax, [ecx+8] mov [ebp+var_38], eax lea eax, [ebp+var_2C] pop ecx push eax mov [ebp+var_2C], ecx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov eax, [ebp+var_2C] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13D5B xor edx, edx jmp short loc_A13D63 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13D5B: ; CODE XREF: sub_A139D9+37Cj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13D63: ; CODE XREF: sub_A139D9+380j mov [ebp+var_2C], ecx test edx, edx js loc_A13F4F mov edx, [ebp+var_38] lea eax, [ebp+var_2C] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov eax, [ebp+var_2C] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13D9E mov edx, [ebp+var_40] lea eax, [ebp+var_2C] push eax call RtlUIntAdd mov edx, eax jmp short loc_A13DA3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13D9E: ; CODE XREF: sub_A139D9+33Aj ; sub_A139D9+3B3j mov edx, 0C0000095h loc_A13DA3: ; CODE XREF: sub_A139D9+3C3j test edx, edx js loc_A13F4F mov eax, [ebp+var_28] lea edi, [ebx+4] mov [edi], eax test eax, eax jnz short loc_A13DC1 mov edx, 0C000003Eh jmp loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13DC1: ; CODE XREF: sub_A139D9+3DCj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A13DDE mov edx, 0C0000017h jmp loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13DDE: ; CODE XREF: sub_A139D9+3F9j mov [ebx+8], edx and dword ptr [ebx], 0 or esi, 10000000h lea eax, [edx+4] cmp eax, edx jb loc_A13F4A mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A13AB7 mov dword ptr [edx], 4 mov [edx+4], esi inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_38], ecx mov eax, [ebx+8] mov [ebp+var_40], eax test eax, eax jnz short loc_A13E37 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F inc dword ptr [ebx] jmp short loc_A13EAF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13E37: ; CODE XREF: sub_A139D9+443j and [ebp+var_48], 0 mov esi, eax mov [ebp+var_34], esi test ecx, ecx jz short loc_A13E76 loc_A13E44: ; CODE XREF: sub_A139D9+49Bj mov edx, [esi] add edx, 4 cmp edx, 4 jb loc_A13ED4 lea eax, [ebp+var_34] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F mov ecx, [ebp+var_48] mov esi, [ebp+var_34] inc ecx mov [ebp+var_48], ecx cmp ecx, [ebp+var_38] jb short loc_A13E44 loc_A13E76: ; CODE XREF: sub_A139D9+469j lea eax, [esi+4] cmp eax, esi jb loc_A13F4A mov ecx, [edi] lea eax, [esi+0Ch] add ecx, [ebp+var_40] xor edx, edx cmp eax, ecx ja loc_A13AB7 mov eax, [ebp+var_60] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_4C] mov [esi+8], eax inc dword ptr [ebx] loc_A13EA7: ; CODE XREF: sub_A139D9+500j test edx, edx js loc_A13F4F loc_A13EAF: ; CODE XREF: sub_A139D9+45Cj mov eax, [ebx+8] mov [ebp+var_40], eax test eax, eax jnz short loc_A13EDB mov ecx, [edi] push edi push 24h pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A13F4F inc dword ptr [ebx] xor edx, edx jmp short loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13ED4: ; CODE XREF: sub_A139D9+473j mov edx, 0C0000095h jmp short loc_A13EA7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13EDB: ; CODE XREF: sub_A139D9+4DEj mov ecx, [ebx] mov esi, eax and [ebp+var_4C], 0 mov [ebp+var_34], esi mov [ebp+var_38], ecx test ecx, ecx jz short loc_A13F1A loc_A13EED: ; CODE XREF: sub_A139D9+53Cj mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A13F4A lea eax, [ebp+var_34] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A13F4F mov ecx, [ebp+var_4C] mov esi, [ebp+var_34] inc ecx mov [ebp+var_4C], ecx cmp ecx, [ebp+var_38] jb short loc_A13EED mov eax, [ebp+var_40] loc_A13F1A: ; CODE XREF: sub_A139D9+512j lea ecx, [esi+4] mov [ebp+var_38], ecx cmp ecx, esi jb short loc_A13F4A mov ecx, [edi] xor edx, edx add ecx, eax lea eax, [esi+24h] cmp eax, ecx ja loc_A13AB7 mov edi, [ebp+var_38] mov dword ptr [esi], 20h lea esi, [ebp+var_24] push 8 pop ecx rep movsd inc dword ptr [ebx] jmp short loc_A13F4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13F4A: ; CODE XREF: sub_A139D9+416j ; sub_A139D9+4A2j ... mov edx, 0C0000095h loc_A13F4F: ; CODE XREF: sub_A139D9+43j ; sub_A139D9+53j ... mov ecx, [ebp+var_4] mov eax, edx pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 sub_A139D9 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A13F62 proc near ; CODE XREF: sub_785212+2081p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 2Ch and [ebp+var_8], 0 and [ebp+var_1C], 0 and [ebp+var_20], 0 and [ebp+var_10], 0 mov eax, [ecx+8] push ebx push esi xor esi, esi mov [ebp+var_28], edx and [ebp+var_4], esi mov [ebp+var_14], ecx push edi test eax, eax jnz short loc_A13F99 loc_A13F8F: ; CODE XREF: sub_A13F62+3Aj mov ebx, 0C000000Dh jmp loc_A1401D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13F99: ; CODE XREF: sub_A13F62+2Bj cmp dword ptr [ecx], 3 jbe short loc_A13F8F xor edi, edi loc_A13FA0: ; CODE XREF: sub_A13F62+70j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13FAD xor ebx, ebx jmp short loc_A13FB5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13FAD: ; CODE XREF: sub_A13F62+45j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13FB5: ; CODE XREF: sub_A13F62+49j mov [ebp+var_C], ecx test ebx, ebx js short loc_A13FF9 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A13FF9 mov eax, [ebp+var_C] inc edi cmp edi, 3 jb short loc_A13FA0 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A13FE1 xor ebx, ebx jmp short loc_A13FE9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13FE1: ; CODE XREF: sub_A13F62+79j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A13FE9: ; CODE XREF: sub_A13F62+7Dj test ebx, ebx js short loc_A13FF9 mov esi, edx mov eax, edx neg esi sbb esi, esi and esi, ecx jmp short loc_A13FFC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A13FF9: ; CODE XREF: sub_A13F62+58j ; sub_A13F62+67j ... mov eax, [ebp+var_4] loc_A13FFC: ; CODE XREF: sub_A13F62+95j test ebx, ebx js short loc_A1401A cmp eax, 8 jz short loc_A1400F loc_A14005: ; CODE XREF: sub_A13F62+164j mov ebx, 0C0000023h jmp loc_A1453E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1400F: ; CODE XREF: sub_A13F62+A1j mov eax, [esi] mov [ebp+var_1C], eax mov eax, [esi+4] mov [ebp+var_20], eax loc_A1401A: ; CODE XREF: sub_A13F62+9Cj mov ecx, [ebp+var_14] loc_A1401D: ; CODE XREF: sub_A13F62+32j test ebx, ebx js loc_A1453E mov eax, [ecx+8] xor esi, esi and [ebp+var_4], esi test eax, eax jnz short loc_A14058 loc_A14031: ; CODE XREF: sub_A13F62+F9j mov ebx, 0C000000Dh loc_A14036: ; CODE XREF: sub_A13F62+15Bj mov eax, [ebp+var_10] loc_A14039: ; CODE XREF: sub_A13F62+16Cj test ebx, ebx js loc_A1453E mov ecx, 800h cmp eax, ecx jz loc_A140D3 mov ebx, 0C000003Eh jmp loc_A1453E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14058: ; CODE XREF: sub_A13F62+CDj cmp dword ptr [ecx], 4 jbe short loc_A14031 xor edi, edi loc_A1405F: ; CODE XREF: sub_A13F62+12Fj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1406C xor ebx, ebx jmp short loc_A14074 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1406C: ; CODE XREF: sub_A13F62+104j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14074: ; CODE XREF: sub_A13F62+108j mov [ebp+var_C], ecx test ebx, ebx js short loc_A140B8 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A140B8 mov eax, [ebp+var_C] inc edi cmp edi, 4 jb short loc_A1405F mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A140A0 xor ebx, ebx jmp short loc_A140A8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A140A0: ; CODE XREF: sub_A13F62+138j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A140A8: ; CODE XREF: sub_A13F62+13Cj test ebx, ebx js short loc_A140B8 mov esi, edx mov eax, edx neg esi sbb esi, esi and esi, ecx jmp short loc_A140BB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A140B8: ; CODE XREF: sub_A13F62+117j ; sub_A13F62+126j ... mov eax, [ebp+var_4] loc_A140BB: ; CODE XREF: sub_A13F62+154j test ebx, ebx js loc_A14036 cmp eax, 4 jnz loc_A14005 mov eax, [esi] jmp loc_A14039 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A140D3: ; CODE XREF: sub_A13F62+E6j push 20534C53h push ecx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov ecx, eax mov [ebp+var_24], ecx test ecx, ecx jnz short loc_A140F3 mov ebx, 0C0000017h jmp loc_A1453E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A140F3: ; CODE XREF: sub_A13F62+185j mov eax, ds:dword_A93ED8 test eax, eax jz short loc_A14101 push ecx call eax jmp short loc_A14106 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14101: ; CODE XREF: sub_A13F62+198j mov eax, 0C00000BBh loc_A14106: ; CODE XREF: sub_A13F62+19Dj mov [ebp+var_C], eax mov ebx, eax test eax, eax js loc_A14531 and [ebp+var_4], 0 lea eax, [ebp+var_4] xor ecx, ecx push eax push 8 pop edi mov edx, edi call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14175 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14175 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax mov edx, 804h call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14175 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax mov edx, edi call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14175 mov eax, [ebp+var_4] mov [ebp+var_8], eax jmp short loc_A14178 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14175: ; CODE XREF: sub_A13F62+1C9j ; sub_A13F62+1DEj ... mov eax, [ebp+var_8] loc_A14178: ; CODE XREF: sub_A13F62+211j test ebx, ebx js loc_A14531 xor esi, esi mov [ebp+var_18], edi lea ecx, [ebp+var_18] mov edx, eax push ecx mov ecx, edi call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 mov eax, [ebp+var_18] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A141B0 mov ebx, 0C0000095h jmp short loc_A141BD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A141B0: ; CODE XREF: sub_A13F62+245j lea esi, [ecx+8] cmp esi, ecx jb loc_A1423C xor ebx, ebx loc_A141BD: ; CODE XREF: sub_A13F62+24Cj test ebx, ebx js loc_A14531 mov edi, [ebp+var_28] mov edx, esi push 4 pop ecx mov [ebp+var_4], ecx mov eax, [edi+10h] mov edi, [edi+8] mov [ebp+var_28], eax lea eax, [ebp+var_4] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A141FA xor ebx, ebx jmp short loc_A14202 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A141FA: ; CODE XREF: sub_A13F62+292j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14202: ; CODE XREF: sub_A13F62+296j mov [ebp+var_4], ecx test ebx, ebx js loc_A14531 lea eax, [ebp+var_4] mov edx, edi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1423C mov edx, [ebp+var_28] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov ebx, eax jmp short loc_A14241 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1423C: ; CODE XREF: sub_A13F62+253j ; sub_A13F62+2C8j mov ebx, 0C0000095h loc_A14241: ; CODE XREF: sub_A13F62+2D8j test ebx, ebx js loc_A14531 mov esi, [ebp+arg_4] test esi, esi jnz short loc_A1425A mov ebx, 0C000000Dh jmp loc_A14531 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1425A: ; CODE XREF: sub_A13F62+2ECj mov eax, [ebp+var_8] lea edi, [esi+4] xor ebx, ebx mov [ebp+var_4], edi mov [edi], eax test eax, eax jnz short loc_A14272 mov ebx, 0C000003Eh jmp short loc_A1428F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14272: ; CODE XREF: sub_A13F62+307j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A1428A mov ebx, 0C0000017h jmp short loc_A1428F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1428A: ; CODE XREF: sub_A13F62+31Fj mov [esi+8], eax and [esi], ebx loc_A1428F: ; CODE XREF: sub_A13F62+30Ej ; sub_A13F62+326j test ebx, ebx js loc_A14531 mov eax, [esi+8] or [ebp+var_C], 10000000h mov [ebp+var_8], eax test eax, eax jnz short loc_A142C4 mov ecx, [edi] push edi push 8 pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 inc dword ptr [esi] jmp loc_A14345 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A142C4: ; CODE XREF: sub_A13F62+344j mov ecx, [esi] mov edi, eax and [ebp+var_14], 0 mov [ebp+var_10], edi mov [ebp+var_28], ecx test ecx, ecx jz short loc_A14303 loc_A142D6: ; CODE XREF: sub_A13F62+39Cj mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A14326 lea eax, [ebp+var_10] mov ecx, edi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A1433A mov ecx, [ebp+var_14] mov edi, [ebp+var_10] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_28] jb short loc_A142D6 mov eax, [ebp+var_8] loc_A14303: ; CODE XREF: sub_A13F62+372j lea edx, [edi+4] cmp edx, edi jb loc_A1452C mov ecx, [esi+4] xor ebx, ebx add ecx, eax lea eax, [edi+8] cmp eax, ecx jbe short loc_A1432D loc_A1431C: ; CODE XREF: sub_A13F62+460j ; sub_A13F62+512j ... mov ebx, 0C0000023h jmp loc_A14531 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14326: ; CODE XREF: sub_A13F62+37Cj mov ebx, 0C0000095h jmp short loc_A1433A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1432D: ; CODE XREF: sub_A13F62+3B8j mov eax, [ebp+var_C] mov dword ptr [edi], 4 mov [edx], eax inc dword ptr [esi] loc_A1433A: ; CODE XREF: sub_A13F62+38Dj ; sub_A13F62+3C9j lea edi, [esi+4] test ebx, ebx js loc_A14531 loc_A14345: ; CODE XREF: sub_A13F62+35Dj mov eax, [esi+8] mov [ebp+var_C], eax test eax, eax jnz short loc_A14368 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 inc dword ptr [esi] jmp short loc_A143E6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14368: ; CODE XREF: sub_A13F62+3EBj mov ecx, [esi] mov edi, eax and [ebp+var_14], 0 mov [ebp+var_10], edi mov [ebp+var_28], ecx test ecx, ecx jz short loc_A143AB loc_A1437A: ; CODE XREF: sub_A13F62+444j mov edx, [edi] add edx, 4 cmp edx, 4 jb loc_A1440E lea eax, [ebp+var_10] mov ecx, edi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A143DB mov ecx, [ebp+var_14] mov edi, [ebp+var_10] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_28] jb short loc_A1437A mov eax, [ebp+var_C] loc_A143AB: ; CODE XREF: sub_A13F62+416j lea edx, [edi+4] cmp edx, edi jb loc_A1452C mov ecx, [esi+4] xor ebx, ebx add ecx, eax lea eax, [edi+0Ch] cmp eax, ecx ja loc_A1431C mov eax, [ebp+var_1C] mov dword ptr [edi], 8 mov [edx], eax mov eax, [ebp+var_20] mov [edx+4], eax inc dword ptr [esi] loc_A143DB: ; CODE XREF: sub_A13F62+435j ; sub_A13F62+4B1j lea edi, [esi+4] test ebx, ebx js loc_A14531 loc_A143E6: ; CODE XREF: sub_A13F62+404j mov eax, [esi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A14415 mov ecx, [edi] mov edx, 804h push edi call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A14531 inc dword ptr [esi] jmp loc_A1449C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1440E: ; CODE XREF: sub_A13F62+420j mov ebx, 0C0000095h jmp short loc_A143DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14415: ; CODE XREF: sub_A13F62+48Cj mov ecx, [esi] mov edi, eax and [ebp+var_20], 0 mov [ebp+var_10], edi mov [ebp+var_28], ecx test ecx, ecx jz short loc_A14458 loc_A14427: ; CODE XREF: sub_A13F62+4F1j mov edx, [edi] add edx, 4 cmp edx, 4 jb loc_A144BD lea eax, [ebp+var_10] mov ecx, edi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14491 mov ecx, [ebp+var_20] mov edi, [ebp+var_10] inc ecx mov [ebp+var_20], ecx cmp ecx, [ebp+var_28] jb short loc_A14427 mov eax, [ebp+var_1C] loc_A14458: ; CODE XREF: sub_A13F62+4C3j lea edx, [edi+4] cmp edx, edi jb loc_A1452C mov ecx, [ebp+var_4] xor ebx, ebx mov ecx, [ecx] add ecx, eax lea eax, [edi+804h] cmp eax, ecx ja loc_A1431C mov esi, [ebp+var_24] mov ecx, 200h mov dword ptr [edi], 800h mov edi, edx rep movsd mov esi, [ebp+arg_4] inc dword ptr [esi] loc_A14491: ; CODE XREF: sub_A13F62+4E2j ; sub_A13F62+560j lea edi, [esi+4] test ebx, ebx js loc_A14531 loc_A1449C: ; CODE XREF: sub_A13F62+4A7j mov eax, [esi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A144C4 mov ecx, [edi] push edi push 8 pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14531 inc dword ptr [esi] xor ebx, ebx jmp short loc_A14531 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A144BD: ; CODE XREF: sub_A13F62+4CDj mov ebx, 0C0000095h jmp short loc_A14491 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A144C4: ; CODE XREF: sub_A13F62+542j mov ecx, [esi] mov edi, eax and [ebp+var_20], 0 mov [ebp+arg_4], edi mov [ebp+var_28], ecx test ecx, ecx jz short loc_A14503 loc_A144D6: ; CODE XREF: sub_A13F62+59Cj mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A1452C lea eax, [ebp+arg_4] mov ecx, edi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A14531 mov ecx, [ebp+var_20] mov edi, [ebp+arg_4] inc ecx mov [ebp+var_20], ecx cmp ecx, [ebp+var_28] jb short loc_A144D6 mov eax, [ebp+var_1C] loc_A14503: ; CODE XREF: sub_A13F62+572j lea edx, [edi+4] cmp edx, edi jb short loc_A1452C mov ecx, [esi+4] xor ebx, ebx add ecx, eax lea eax, [edi+8] cmp eax, ecx ja loc_A1431C mov dword ptr [edi], 4 mov dword ptr [edx], 800h inc dword ptr [esi] jmp short loc_A14531 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1452C: ; CODE XREF: sub_A13F62+3A6j ; sub_A13F62+44Ej ... mov ebx, 0C0000095h loc_A14531: ; CODE XREF: sub_A13F62+1ABj ; sub_A13F62+218j ... push 20534C53h push [ebp+var_24] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1453E: ; CODE XREF: sub_A13F62+A8j ; sub_A13F62+BDj ... pop edi pop esi mov eax, ebx pop ebx leave retn 8 sub_A13F62 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A14547 proc near ; CODE XREF: sub_785212+1074p var_58 = dword ptr -58h var_54 = dword ptr -54h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_4 = dword ptr 0Ch push 48h push offset dword_6AAAB8 call __SEH_prolog4 mov [ebp+var_3C], edx xor edi, edi mov [ebp+var_58], edi mov [ebp+var_54], edi mov edx, edi mov [ebp+var_28], edx mov [ebp+var_48], edx test ecx, ecx jnz short loc_A14574 loc_A1456A: ; CODE XREF: sub_A14547+30j ; sub_A14547+35j mov esi, 0C000000Dh jmp loc_A14984 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14574: ; CODE XREF: sub_A14547+21j cmp [ebp+var_3C], edx jz short loc_A1456A cmp [ebp+arg_4], edx jz short loc_A1456A mov ebx, edi mov [ebp+var_44], ebx mov eax, edi mov [ebp+var_40], eax mov [ebp+var_1C], edi mov edx, [ecx+8] test edx, edx jnz short loc_A14599 loc_A14592: ; CODE XREF: sub_A14547+55j mov esi, 0C000000Dh jmp short loc_A14614 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14599: ; CODE XREF: sub_A14547+49j cmp dword ptr [ecx], 3 jbe short loc_A14592 mov [ebp+var_1C], edx mov [ebp+var_24], edi loc_A145A4: ; CODE XREF: sub_A14547+95j mov eax, [ebp+var_1C] mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A145B4 mov esi, edi jmp short loc_A145BC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A145B4: ; CODE XREF: sub_A14547+67j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A145BC: ; CODE XREF: sub_A14547+6Bj mov [ebp+var_1C], ecx test esi, esi js short loc_A14612 lea eax, [ebp+var_1C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A14612 mov edx, [ebp+var_24] inc edx mov [ebp+var_24], edx cmp edx, 3 jb short loc_A145A4 mov eax, [ebp+var_1C] mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A145EE mov esi, edi jmp short loc_A145F6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A145EE: ; CODE XREF: sub_A14547+A1j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A145F6: ; CODE XREF: sub_A14547+A5j mov [ebp+var_1C], ecx test esi, esi js short loc_A14612 mov eax, edx mov [ebp+var_40], eax mov ebx, edx neg ebx sbb ebx, ebx and ebx, ecx mov [ebp+var_1C], ebx mov [ebp+var_44], ebx jmp short loc_A14614 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14612: ; CODE XREF: sub_A14547+7Aj ; sub_A14547+89j ... mov eax, edi loc_A14614: ; CODE XREF: sub_A14547+50j ; sub_A14547+C9j test esi, esi js loc_A14984 cmp eax, 8 jz short loc_A14628 mov esi, 0C0000023h jmp short loc_A14633 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14628: ; CODE XREF: sub_A14547+D8j mov eax, [ebx] mov [ebp+var_58], eax mov eax, [ebx+4] mov [ebp+var_54], eax loc_A14633: ; CODE XREF: sub_A14547+DFj test esi, esi js loc_A14984 mov [ebp+ms_exc.disabled], edi push edi push offset unk_6B72E0 call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A14697 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14652: ; DATA XREF: .text:006AAACCo mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_4C], eax mov [ebp+var_2C], eax cmp [ebp+var_2C], 80h jz short loc_A1467A cmp [ebp+var_2C], 0C0000046h jz short loc_A1467A mov [ebp+var_30], 0 jmp short loc_A14681 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1467A: ; CODE XREF: sub_A14547+11Fj ; sub_A14547+128j mov [ebp+var_30], 1 loc_A14681: ; CODE XREF: sub_A14547+131j mov eax, [ebp+var_30] retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14685: ; DATA XREF: .text:006AAAD0o mov esp, [ebp+ms_exc.old_esp] mov [ebp+ms_exc.disabled], 0FFFFFFFEh xor edi, edi mov edx, [ebp+var_48] mov [ebp+var_28], edx loc_A14697: ; CODE XREF: sub_A14547+109j mov ebx, 0C0000095h mov [ebp+var_34], 8 lea eax, [ebp+var_34] push eax push 0Ch pop edx push 8 pop ecx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A146C0 mov eax, [ebp+var_34] mov [ebp+var_28], eax jmp short loc_A146C3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A146C0: ; CODE XREF: sub_A14547+16Fj mov eax, [ebp+var_28] loc_A146C3: ; CODE XREF: sub_A14547+177j test esi, esi js loc_A14984 push 8 pop ecx mov [ebp+var_38], ecx lea edx, [ebp+var_38] push edx mov edx, eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov esi, edi mov eax, [ebp+var_38] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A146F9 mov esi, ebx mov ecx, edi loc_A146F9: ; CODE XREF: sub_A14547+1ACj test esi, esi js short loc_A14717 lea eax, [ecx+8] cmp eax, ecx jb short loc_A14708 mov edx, eax jmp short loc_A1470B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14708: ; CODE XREF: sub_A14547+1BBj or edx, 0FFFFFFFFh loc_A1470B: ; CODE XREF: sub_A14547+1BFj cmp eax, ecx sbb esi, esi and esi, ebx cmp eax, ecx mov ecx, edx jnb short loc_A14719 loc_A14717: ; CODE XREF: sub_A14547+1B4j mov ecx, edi loc_A14719: ; CODE XREF: sub_A14547+1CEj test esi, esi js loc_A14984 mov eax, [ebp+var_3C] mov edx, [eax+10h] mov [ebp+var_3C], edx mov eax, [eax+8] mov [ebp+var_48], eax push 4 pop eax mov [ebp+var_20], eax lea edx, [ebp+var_20] push edx mov edx, ecx mov ecx, eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov eax, [ebp+var_20] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1475B mov esi, edi jmp short loc_A14760 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1475B: ; CODE XREF: sub_A14547+20Ej mov esi, ebx or ecx, 0FFFFFFFFh loc_A14760: ; CODE XREF: sub_A14547+212j mov [ebp+var_20], ecx test esi, esi js loc_A14984 lea eax, [ebp+var_20] push eax mov edx, [ebp+var_48] call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov eax, [ebp+var_20] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1478F mov esi, edi jmp short loc_A14794 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1478F: ; CODE XREF: sub_A14547+242j mov esi, ebx or ecx, 0FFFFFFFFh loc_A14794: ; CODE XREF: sub_A14547+246j test esi, esi js loc_A14984 lea eax, [ebp+var_20] push eax mov edx, [ebp+var_3C] call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov ebx, [ebp+arg_4] lea eax, [ebx+4] mov edx, [ebp+var_28] mov [eax], edx mov esi, edi test edx, edx jnz short loc_A147CA mov esi, 0C000003Eh jmp short loc_A147EA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A147CA: ; CODE XREF: sub_A14547+27Aj push 20534C53h push edx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A147E2 mov esi, 0C0000017h jmp short loc_A147E7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A147E2: ; CODE XREF: sub_A14547+292j mov [ebx+8], eax mov [ebx], edi loc_A147E7: ; CODE XREF: sub_A14547+299j lea eax, [ebx+4] loc_A147EA: ; CODE XREF: sub_A14547+281j test esi, esi js loc_A14984 mov edx, edi mov [ebp+var_3C], edx mov ecx, [ebx+8] mov [ebp+var_34], ecx test ecx, ecx jnz short loc_A1481D push eax push 8 pop edx mov ecx, [eax] call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov esi, edi jmp loc_A148B4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1481D: ; CODE XREF: sub_A14547+2B8j mov [ebp+var_24], ecx mov [ebp+arg_4], edi mov eax, [ebx] mov [ebp+var_48], eax test eax, eax jz short loc_A14874 loc_A1482C: ; CODE XREF: sub_A14547+32Bj mov eax, [ebp+var_24] mov eax, [eax] add eax, 4 cmp eax, 4 jb short loc_A14842 mov edx, eax mov [ebp+var_3C], edx mov esi, edi jmp short loc_A14847 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14842: ; CODE XREF: sub_A14547+2F0j mov esi, 0C0000095h loc_A14847: ; CODE XREF: sub_A14547+2F9j test esi, esi js loc_A14984 lea eax, [ebp+var_24] push eax mov ecx, [ebp+var_24] call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov ecx, [ebp+arg_4] inc ecx mov [ebp+arg_4], ecx cmp ecx, [ebp+var_48] mov edx, [ebp+var_3C] jb short loc_A1482C loc_A14874: ; CODE XREF: sub_A14547+2E3j mov eax, [ebp+var_24] lea edx, [eax+4] cmp edx, eax jb short loc_A14882 mov esi, edi jmp short loc_A1488A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14882: ; CODE XREF: sub_A14547+335j or edx, 0FFFFFFFFh mov esi, 0C0000095h loc_A1488A: ; CODE XREF: sub_A14547+339j test esi, esi js loc_A14984 mov ecx, [ebx+4] add ecx, [ebp+var_34] mov eax, [ebp+var_24] add eax, 8 cmp eax, ecx jbe short loc_A148A9 mov esi, 0C0000023h jmp short loc_A148B6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A148A9: ; CODE XREF: sub_A14547+359j mov eax, [ebp+var_24] mov dword ptr [eax], 4 mov [edx], edi loc_A148B4: ; CODE XREF: sub_A14547+2D1j inc dword ptr [ebx] loc_A148B6: ; CODE XREF: sub_A14547+360j test esi, esi js loc_A14984 mov ecx, edi mov [ebp+var_3C], ecx mov eax, [ebx+8] mov [ebp+var_34], eax test eax, eax jnz short loc_A148EC lea eax, [ebx+4] push eax push 0Ch pop edx mov ecx, [eax] call RtlUIntAdd mov esi, eax test esi, esi js loc_A14984 mov esi, edi jmp loc_A14982 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A148EC: ; CODE XREF: sub_A14547+384j mov [ebp+var_28], eax mov [ebp+arg_4], edi mov eax, [ebx] mov [ebp+var_48], eax test eax, eax jz short loc_A1493D loc_A148FB: ; CODE XREF: sub_A14547+3F4j mov eax, [ebp+var_28] mov eax, [eax] add eax, 4 cmp eax, 4 jb short loc_A14911 mov ecx, eax mov [ebp+var_3C], ecx mov esi, edi jmp short loc_A14916 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14911: ; CODE XREF: sub_A14547+3BFj mov esi, 0C0000095h loc_A14916: ; CODE XREF: sub_A14547+3C8j test esi, esi js short loc_A14984 lea eax, [ebp+var_28] push eax mov edx, ecx mov ecx, [ebp+var_28] call RtlUIntAdd mov esi, eax test esi, esi js short loc_A14984 mov ecx, [ebp+arg_4] inc ecx mov [ebp+arg_4], ecx cmp ecx, [ebp+var_48] mov ecx, [ebp+var_3C] jb short loc_A148FB loc_A1493D: ; CODE XREF: sub_A14547+3B2j mov eax, [ebp+var_28] lea edx, [eax+4] cmp edx, eax jb short loc_A1494B mov esi, edi jmp short loc_A14953 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1494B: ; CODE XREF: sub_A14547+3FEj or edx, 0FFFFFFFFh mov esi, 0C0000095h loc_A14953: ; CODE XREF: sub_A14547+402j test esi, esi js short loc_A14984 mov ecx, [ebx+4] add ecx, [ebp+var_34] mov eax, [ebp+var_28] add eax, 0Ch cmp eax, ecx jbe short loc_A1496E mov esi, 0C0000023h jmp short loc_A14984 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1496E: ; CODE XREF: sub_A14547+41Ej mov eax, [ebp+var_28] mov dword ptr [eax], 8 mov ecx, [ebp+var_58] mov [edx], ecx mov ecx, [ebp+var_54] mov [edx+4], ecx loc_A14982: ; CODE XREF: sub_A14547+3A0j inc dword ptr [ebx] loc_A14984: ; CODE XREF: sub_A14547+28j ; sub_A14547+CFj ... mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 8 sub_A14547 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A14998 proc near ; CODE XREF: sub_785212+1B4Fp var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push ebx mov eax, edx mov [ebp+var_10], ecx xor edx, edx mov [ebp+var_28], eax mov [ebp+var_8], edx mov [ebp+var_1C], edx mov [ebp+var_20], edx mov [ebp+var_14], edx push esi push edi mov edi, edx test eax, eax jnz short loc_A149C9 loc_A149BF: ; CODE XREF: sub_A14998+36j ; sub_A14998+EEj ... mov edx, 0C000000Dh jmp loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A149C9: ; CODE XREF: sub_A14998+25j mov ebx, [ebp+arg_4] test ebx, ebx jz short loc_A149BF mov eax, [ecx+8] mov esi, edx mov [ebp+var_C], edx test eax, eax jnz short loc_A149E6 loc_A149DC: ; CODE XREF: sub_A14998+51j mov edx, 0C000000Dh jmp loc_A14A79 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A149E6: ; CODE XREF: sub_A14998+42j cmp dword ptr [ecx], 3 jbe short loc_A149DC mov [ebp+var_4], edx loc_A149EE: ; CODE XREF: sub_A14998+94j mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jnb short loc_A14A02 mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14A02: ; CODE XREF: sub_A14998+60j mov [ebp+arg_4], ecx test edx, edx js short loc_A14A76 mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A14A76 mov edx, [ebp+var_4] mov eax, [ebp+arg_4] inc edx mov [ebp+var_4], edx cmp edx, 3 jnb short loc_A14A2E xor edx, edx jmp short loc_A149EE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14A2E: ; CODE XREF: sub_A14998+90j mov ecx, [eax] mov [ebp+arg_4], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A14A3E xor edx, edx jmp short loc_A14A46 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14A3E: ; CODE XREF: sub_A14998+A0j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14A46: ; CODE XREF: sub_A14998+A4j test edx, edx js short loc_A14A76 mov eax, [ebp+arg_4] mov esi, eax neg esi mov [ebp+var_C], eax sbb esi, esi and esi, ecx test edx, edx js short loc_A14A76 cmp eax, 8 jz short loc_A14A6B loc_A14A61: ; CODE XREF: sub_A14998+2D2j ; sub_A14998+355j mov edx, 0C0000023h jmp loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14A6B: ; CODE XREF: sub_A14998+C7j mov eax, [esi] mov [ebp+var_1C], eax mov eax, [esi+4] mov [ebp+var_20], eax loc_A14A76: ; CODE XREF: sub_A14998+6Fj ; sub_A14998+81j ... mov ecx, [ebp+var_10] loc_A14A79: ; CODE XREF: sub_A14998+49j test edx, edx js loc_A14D0E mov eax, [ecx+8] test eax, eax jz loc_A149BF cmp dword ptr [ecx], 4 jbe loc_A149BF xor esi, esi loc_A14A97: ; CODE XREF: sub_A14998+13Fj mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A14AA7 xor edx, edx jmp short loc_A14AAF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14AA7: ; CODE XREF: sub_A14998+109j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14AAF: ; CODE XREF: sub_A14998+10Dj mov [ebp+arg_4], ecx test edx, edx js loc_A14D0E mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A14D0E mov eax, [ebp+arg_4] inc esi cmp esi, 4 jb short loc_A14A97 mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14AE6 xor edx, edx jmp short loc_A14AEE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14AE6: ; CODE XREF: sub_A14998+148j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14AEE: ; CODE XREF: sub_A14998+14Cj test edx, edx js loc_A14D0E mov edi, esi mov [ebp+var_14], esi neg edi sbb edi, edi and edi, ecx test edx, edx js loc_A14D0E mov eax, ds:dword_A93EBC test eax, eax jz short loc_A14B18 push esi push edi call eax jmp short loc_A14B1D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14B18: ; CODE XREF: sub_A14998+178j mov eax, 0C00000BBh loc_A14B1D: ; CODE XREF: sub_A14998+17Ej mov [ebp+var_4], eax push 8 pop edi mov [ebp+arg_4], edi lea eax, [ebp+arg_4] mov ecx, edi push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A14B42 mov eax, [ebp+arg_4] mov [ebp+var_8], eax jmp short loc_A14B45 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14B42: ; CODE XREF: sub_A14998+1A0j mov eax, [ebp+var_8] loc_A14B45: ; CODE XREF: sub_A14998+1A8j test edx, edx js loc_A14D0E xor esi, esi mov [ebp+var_18], edi lea ecx, [ebp+var_18] mov edx, eax push ecx mov ecx, edi call RtlUIntAdd mov edx, eax test edx, edx js loc_A14D0E mov eax, [ebp+var_18] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A14B7D mov edx, 0C0000095h jmp short loc_A14B8A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14B7D: ; CODE XREF: sub_A14998+1DCj lea esi, [ecx+8] cmp esi, ecx jb loc_A14C09 xor edx, edx loc_A14B8A: ; CODE XREF: sub_A14998+1E3j test edx, edx js loc_A14D0E mov edi, [ebp+var_28] mov edx, esi push 4 pop ecx mov [ebp+arg_4], ecx mov eax, [edi+10h] mov edi, [edi+8] mov [ebp+var_28], eax lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A14D0E mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14BC7 xor edx, edx jmp short loc_A14BCF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14BC7: ; CODE XREF: sub_A14998+229j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A14BCF: ; CODE XREF: sub_A14998+22Dj mov [ebp+arg_4], ecx test edx, edx js loc_A14D0E lea eax, [ebp+arg_4] mov edx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A14D0E mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14C09 mov edx, [ebp+var_28] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax jmp short loc_A14C0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14C09: ; CODE XREF: sub_A14998+1EAj ; sub_A14998+25Fj mov edx, 0C0000095h loc_A14C0E: ; CODE XREF: sub_A14998+26Fj test edx, edx js loc_A14D0E mov eax, [ebp+var_8] lea edi, [ebx+4] mov [edi], eax test eax, eax jnz short loc_A14C2C mov edx, 0C000003Eh jmp loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14C2C: ; CODE XREF: sub_A14998+288j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A14C49 mov edx, 0C0000017h jmp loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14C49: ; CODE XREF: sub_A14998+2A5j mov [ebx+8], edx and dword ptr [ebx], 0 or [ebp+var_4], 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A14D09 mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A14A61 mov eax, [ebp+var_4] mov dword ptr [edx], 4 mov [esi], eax inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_28], ecx mov eax, [ebx+8] mov [ebp+var_24], eax test eax, eax jnz short loc_A14CA3 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A14D0E inc dword ptr [ebx] xor edx, edx jmp short loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14CA3: ; CODE XREF: sub_A14998+2F2j and [ebp+var_14], 0 mov esi, eax mov [ebp+arg_4], esi test ecx, ecx jz short loc_A14CDA loc_A14CB0: ; CODE XREF: sub_A14998+340j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A14D09 lea eax, [ebp+arg_4] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A14D0E mov ecx, [ebp+var_14] mov esi, [ebp+arg_4] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_28] jb short loc_A14CB0 loc_A14CDA: ; CODE XREF: sub_A14998+316j lea eax, [esi+4] cmp eax, esi jb short loc_A14D09 mov ecx, [edi] lea eax, [esi+0Ch] add ecx, [ebp+var_24] xor edx, edx cmp eax, ecx ja loc_A14A61 mov eax, [ebp+var_1C] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_20] mov [esi+8], eax inc dword ptr [ebx] jmp short loc_A14D0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14D09: ; CODE XREF: sub_A14998+2C3j ; sub_A14998+320j ... mov edx, 0C0000095h loc_A14D0E: ; CODE XREF: sub_A14998+2Cj ; sub_A14998+CEj ... pop edi pop esi mov eax, edx pop ebx leave retn 8 sub_A14998 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A14D17 proc near ; CODE XREF: sub_785212+1AF7p var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 1Ch mov eax, [ecx+8] push ebx xor ebx, ebx mov [ebp+var_1C], edx and [ebp+var_14], ebx mov edx, 0C000000Dh and [ebp+var_18], ebx and [ebp+var_4], ebx push esi push edi xor edi, edi mov [ebp+var_8], ebx test eax, eax jnz short loc_A14D48 loc_A14D41: ; CODE XREF: sub_A14D17+34j mov esi, edx jmp loc_A14DCC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14D48: ; CODE XREF: sub_A14D17+28j cmp dword ptr [ecx], 3 jbe short loc_A14D41 xor ebx, ebx loc_A14D4F: ; CODE XREF: sub_A14D17+6Aj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14D5C xor esi, esi jmp short loc_A14D64 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14D5C: ; CODE XREF: sub_A14D17+3Fj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A14D64: ; CODE XREF: sub_A14D17+43j mov [ebp+var_C], ecx test esi, esi js short loc_A14DA8 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A14DA8 mov eax, [ebp+var_C] inc ebx cmp ebx, 3 jb short loc_A14D4F mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14D90 xor esi, esi jmp short loc_A14D98 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14D90: ; CODE XREF: sub_A14D17+73j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A14D98: ; CODE XREF: sub_A14D17+77j test esi, esi js short loc_A14DA8 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A14DAB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14DA8: ; CODE XREF: sub_A14D17+52j ; sub_A14D17+61j ... mov eax, [ebp+var_4] loc_A14DAB: ; CODE XREF: sub_A14D17+8Fj test esi, esi js short loc_A14DC9 cmp eax, 8 jz short loc_A14DBE loc_A14DB4: ; CODE XREF: sub_A14D17+297j ; sub_A14D17+32Fj mov esi, 0C0000023h jmp loc_A15066 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14DBE: ; CODE XREF: sub_A14D17+9Bj mov eax, [edi] mov [ebp+var_14], eax mov eax, [edi+4] mov [ebp+var_18], eax loc_A14DC9: ; CODE XREF: sub_A14D17+96j mov ebx, [ebp+var_8] loc_A14DCC: ; CODE XREF: sub_A14D17+2Cj test esi, esi js loc_A15066 mov eax, ds:dword_A93E68 test eax, eax jz short loc_A14DE1 call eax jmp short loc_A14DE6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14DE1: ; CODE XREF: sub_A14D17+C4j mov eax, 0C00000BBh loc_A14DE6: ; CODE XREF: sub_A14D17+C8j mov [ebp+var_C], eax mov esi, eax test eax, eax js loc_A15066 push 8 pop ecx mov [ebp+var_4], ecx lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15066 mov ebx, [ebp+var_4] mov [ebp+var_8], ebx push 8 pop ecx xor edi, edi mov [ebp+var_10], ecx lea eax, [ebp+var_10] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15066 mov eax, [ebp+var_10] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A14E46 mov esi, 0C0000095h jmp short loc_A14E53 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14E46: ; CODE XREF: sub_A14D17+126j lea edi, [ecx+8] cmp edi, ecx jb loc_A14ED6 xor esi, esi loc_A14E53: ; CODE XREF: sub_A14D17+12Dj test esi, esi js loc_A15066 mov ebx, [ebp+var_1C] mov edx, edi mov [ebp+var_4], 4 mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_1C], eax lea eax, [ebp+var_4] push eax push 4 pop ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15066 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14E94 xor esi, esi jmp short loc_A14E9C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14E94: ; CODE XREF: sub_A14D17+177j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A14E9C: ; CODE XREF: sub_A14D17+17Bj mov [ebp+var_4], ecx test esi, esi js loc_A15066 lea eax, [ebp+var_4] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15066 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A14ED6 mov edx, [ebp+var_1C] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A14EDB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14ED6: ; CODE XREF: sub_A14D17+134j ; sub_A14D17+1ADj mov esi, 0C0000095h loc_A14EDB: ; CODE XREF: sub_A14D17+1BDj test esi, esi js loc_A15066 mov edi, [ebp+arg_4] test edi, edi jnz short loc_A14EF4 mov esi, 0C000000Dh jmp loc_A15066 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14EF4: ; CODE XREF: sub_A14D17+1D1j mov eax, [ebp+var_8] lea ebx, [edi+4] xor esi, esi mov [ebx], eax test eax, eax jnz short loc_A14F09 mov esi, 0C000003Eh jmp short loc_A14F26 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14F09: ; CODE XREF: sub_A14D17+1E9j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A14F21 mov esi, 0C0000017h jmp short loc_A14F26 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14F21: ; CODE XREF: sub_A14D17+201j mov [edi+8], eax and [edi], esi loc_A14F26: ; CODE XREF: sub_A14D17+1F0j ; sub_A14D17+208j test esi, esi js loc_A15066 mov eax, [edi+8] or [ebp+var_C], 10000000h mov [ebp+var_4], eax test eax, eax jnz short loc_A14F58 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15066 inc dword ptr [edi] jmp short loc_A14FCC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14F58: ; CODE XREF: sub_A14D17+226j mov ecx, [edi] mov ebx, eax and [ebp+var_8], 0 mov [ebp+arg_4], ebx mov [ebp+var_1C], ecx test ecx, ecx jz short loc_A14F97 loc_A14F6A: ; CODE XREF: sub_A14D17+27Bj mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A14FED lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A14FC1 mov ecx, [ebp+var_8] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_8], ecx cmp ecx, [ebp+var_1C] jb short loc_A14F6A mov eax, [ebp+var_4] loc_A14F97: ; CODE XREF: sub_A14D17+251j lea edx, [ebx+4] cmp edx, ebx jb loc_A15061 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+8] cmp eax, ecx ja loc_A14DB4 mov eax, [ebp+var_C] mov dword ptr [ebx], 4 mov [edx], eax inc dword ptr [edi] loc_A14FC1: ; CODE XREF: sub_A14D17+26Cj ; sub_A14D17+2DBj lea ebx, [edi+4] test esi, esi js loc_A15066 loc_A14FCC: ; CODE XREF: sub_A14D17+23Fj mov eax, [edi+8] mov [ebp+var_8], eax test eax, eax jnz short loc_A14FF4 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15066 inc dword ptr [edi] xor esi, esi jmp short loc_A15066 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14FED: ; CODE XREF: sub_A14D17+25Bj mov esi, 0C0000095h jmp short loc_A14FC1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A14FF4: ; CODE XREF: sub_A14D17+2BDj mov ecx, [edi] mov ebx, eax and [ebp+var_C], 0 mov [ebp+arg_4], ebx mov [ebp+var_1C], ecx test ecx, ecx jz short loc_A15033 loc_A15006: ; CODE XREF: sub_A14D17+317j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A15061 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15066 mov ecx, [ebp+var_C] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_C], ecx cmp ecx, [ebp+var_1C] jb short loc_A15006 mov eax, [ebp+var_8] loc_A15033: ; CODE XREF: sub_A14D17+2EDj lea edx, [ebx+4] cmp edx, ebx jb short loc_A15061 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+0Ch] cmp eax, ecx ja loc_A14DB4 mov eax, [ebp+var_14] mov dword ptr [ebx], 8 mov [edx], eax mov eax, [ebp+var_18] mov [edx+4], eax inc dword ptr [edi] jmp short loc_A15066 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15061: ; CODE XREF: sub_A14D17+285j ; sub_A14D17+2F7j ... mov esi, 0C0000095h loc_A15066: ; CODE XREF: sub_A14D17+A2j ; sub_A14D17+B7j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A14D17 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1506F proc near ; CODE XREF: sub_785212+1AE1p var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = dword ptr -120h var_11C = dword ptr -11Ch var_118 = dword ptr -118h var_114 = dword ptr -114h var_110 = dword ptr -110h var_10C = dword ptr -10Ch var_108 = dword ptr -108h var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 134h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax and [ebp+var_134], 0 mov eax, ecx and [ebp+var_124], 0 and [ebp+var_110], 0 and [ebp+var_114], 0 mov [ebp+var_11C], edx mov [ebp+var_120], eax push ebx mov ebx, [ebp+arg_4] push esi push edi test eax, eax jnz short loc_A150C2 loc_A150B8: ; CODE XREF: sub_A1506F+55j ; sub_A1506F+59j ... mov edx, 0C000000Dh jmp loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A150C2: ; CODE XREF: sub_A1506F+47j test edx, edx jz short loc_A150B8 test ebx, ebx jz short loc_A150B8 mov esi, [eax+8] xor edi, edi and [ebp+var_12C], edi test esi, esi jnz short loc_A150E3 loc_A150D9: ; CODE XREF: sub_A1506F+77j mov edx, 0C000000Dh jmp loc_A151A6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A150E3: ; CODE XREF: sub_A1506F+68j cmp dword ptr [eax], 3 jbe short loc_A150D9 and [ebp+var_128], edi mov eax, esi loc_A150F0: ; CODE XREF: sub_A1506F+D8j mov ecx, [eax] mov [ebp+var_118], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A15103 xor edx, edx jmp short loc_A1510B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15103: ; CODE XREF: sub_A1506F+8Ej mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1510B: ; CODE XREF: sub_A1506F+92j mov [ebp+var_10C], ecx test edx, edx js loc_A151A0 mov edx, [ebp+var_118] lea eax, [ebp+var_10C] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A151A0 mov edx, [ebp+var_128] mov eax, [ebp+var_10C] inc edx mov [ebp+var_128], edx cmp edx, 3 jb short loc_A150F0 mov ecx, [eax] mov [ebp+var_118], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A1515C xor edx, edx jmp short loc_A15164 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1515C: ; CODE XREF: sub_A1506F+E7j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A15164: ; CODE XREF: sub_A1506F+EBj test edx, edx js short loc_A151A0 mov eax, [ebp+var_118] mov edi, eax neg edi mov [ebp+var_12C], eax sbb edi, edi and edi, ecx test edx, edx js short loc_A151A0 cmp eax, 8 jz short loc_A1518F loc_A15185: ; CODE XREF: sub_A1506F+3B3j ; sub_A1506F+463j ... mov edx, 0C0000023h jmp loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1518F: ; CODE XREF: sub_A1506F+114j mov eax, [edi] mov [ebp+var_134], eax mov eax, [edi+4] mov [ebp+var_124], eax loc_A151A0: ; CODE XREF: sub_A1506F+A4j ; sub_A1506F+C0j ... mov eax, [ebp+var_120] loc_A151A6: ; CODE XREF: sub_A1506F+6Fj test edx, edx js loc_A155C9 test esi, esi jz loc_A150B8 cmp dword ptr [eax], 4 jbe loc_A150B8 xor edi, edi loc_A151C1: ; CODE XREF: sub_A1506F+191j mov eax, [esi] lea ecx, [esi+4] cmp ecx, esi jb short loc_A151CE xor edx, edx jmp short loc_A151D6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A151CE: ; CODE XREF: sub_A1506F+159j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A151D6: ; CODE XREF: sub_A1506F+15Dj mov [ebp+var_10C], ecx test edx, edx js short loc_A1522B lea edx, [ebp+var_10C] push edx mov edx, eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1522B inc edi cmp edi, 4 jnb short loc_A15202 mov esi, [ebp+var_10C] jmp short loc_A151C1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15202: ; CODE XREF: sub_A1506F+189j mov eax, [ebp+var_10C] mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15215 xor edx, edx jmp short loc_A1521D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15215: ; CODE XREF: sub_A1506F+1A0j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1521D: ; CODE XREF: sub_A1506F+1A4j test edx, edx js short loc_A1522B mov edi, esi neg esi sbb esi, esi and esi, ecx jmp short loc_A15237 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1522B: ; CODE XREF: sub_A1506F+16Fj ; sub_A1506F+183j ... mov esi, [ebp+var_110] mov edi, [ebp+var_114] loc_A15237: ; CODE XREF: sub_A1506F+1BAj test edx, edx js loc_A155C9 mov eax, ds:dword_A93E9C test eax, eax jz short loc_A1525C push 100h lea ecx, [ebp+var_108] push ecx push edi push esi call eax mov esi, eax jmp short loc_A15261 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1525C: ; CODE XREF: sub_A1506F+1D7j mov esi, 0C00000BBh loc_A15261: ; CODE XREF: sub_A1506F+1EBj mov edx, esi test esi, esi js loc_A155C9 and [ebp+var_110], 0 lea eax, [ebp+var_110] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov ecx, [ebp+var_110] lea eax, [ebp+var_110] push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov ecx, [ebp+var_110] lea eax, [ebp+var_110] push eax mov edx, 104h call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 push 8 pop ecx xor edi, edi mov [ebp+var_130], ecx mov edx, [ebp+var_110] lea eax, [ebp+var_130] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov eax, [ebp+var_130] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1530B mov edx, 0C0000095h jmp short loc_A15318 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1530B: ; CODE XREF: sub_A1506F+293j lea edi, [ecx+8] cmp edi, ecx jb loc_A153BF xor edx, edx loc_A15318: ; CODE XREF: sub_A1506F+29Aj test edx, edx js loc_A155C9 mov ecx, [ebp+var_11C] mov edx, edi push 4 mov eax, [ecx+10h] mov [ebp+var_118], eax mov eax, [ecx+8] mov [ebp+var_11C], eax lea eax, [ebp+var_10C] pop ecx push eax mov [ebp+var_10C], ecx call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov eax, [ebp+var_10C] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1536A xor edx, edx jmp short loc_A15372 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1536A: ; CODE XREF: sub_A1506F+2F5j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A15372: ; CODE XREF: sub_A1506F+2F9j mov [ebp+var_10C], ecx test edx, edx js loc_A155C9 mov edx, [ebp+var_11C] lea eax, [ebp+var_10C] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov eax, [ebp+var_10C] lea ecx, [eax+4] cmp ecx, eax jb short loc_A153BF mov edx, [ebp+var_118] lea eax, [ebp+var_10C] push eax call RtlUIntAdd mov edx, eax jmp short loc_A153C4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A153BF: ; CODE XREF: sub_A1506F+2A1j ; sub_A1506F+338j mov edx, 0C0000095h loc_A153C4: ; CODE XREF: sub_A1506F+34Ej test edx, edx js loc_A155C9 mov eax, [ebp+var_110] lea edi, [ebx+4] mov [edi], eax test eax, eax jnz short loc_A153E5 mov edx, 0C000003Eh jmp loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A153E5: ; CODE XREF: sub_A1506F+36Aj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A15402 mov edx, 0C0000017h jmp loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15402: ; CODE XREF: sub_A1506F+387j mov [ebx+8], edx and dword ptr [ebx], 0 or esi, 10000000h lea eax, [edx+4] cmp eax, edx jb loc_A155C4 mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A15185 mov dword ptr [edx], 4 mov [edx+4], esi inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_11C], ecx mov eax, [ebx+8] mov [ebp+var_118], eax test eax, eax jnz short loc_A15464 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 inc dword ptr [ebx] jmp loc_A154FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15464: ; CODE XREF: sub_A1506F+3D7j and [ebp+var_120], 0 mov esi, eax mov [ebp+var_114], esi test ecx, ecx jz short loc_A154B8 loc_A15477: ; CODE XREF: sub_A1506F+447j mov edx, [esi] add edx, 4 cmp edx, 4 jb loc_A15527 lea eax, [ebp+var_114] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 mov ecx, [ebp+var_120] mov esi, [ebp+var_114] inc ecx mov [ebp+var_120], ecx cmp ecx, [ebp+var_11C] jb short loc_A15477 loc_A154B8: ; CODE XREF: sub_A1506F+406j lea eax, [esi+4] cmp eax, esi jb loc_A155C4 mov ecx, [edi] lea eax, [esi+0Ch] add ecx, [ebp+var_118] xor edx, edx cmp eax, ecx ja loc_A15185 mov eax, [ebp+var_134] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_124] mov [esi+8], eax inc dword ptr [ebx] loc_A154F2: ; CODE XREF: sub_A1506F+4BDj test edx, edx js loc_A155C9 loc_A154FA: ; CODE XREF: sub_A1506F+3F0j mov eax, [ebx+8] mov [ebp+var_118], eax test eax, eax jnz short loc_A1552E mov ecx, [edi] mov edx, 104h push edi call RtlUIntAdd mov edx, eax test edx, edx js loc_A155C9 inc dword ptr [ebx] xor edx, edx jmp loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15527: ; CODE XREF: sub_A1506F+410j mov edx, 0C0000095h jmp short loc_A154F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1552E: ; CODE XREF: sub_A1506F+496j mov ecx, [ebx] mov esi, eax and [ebp+var_124], 0 mov [ebp+var_114], esi mov [ebp+var_11C], ecx test ecx, ecx jz short loc_A15588 loc_A15549: ; CODE XREF: sub_A1506F+511j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A155C4 lea eax, [ebp+var_114] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A155C9 mov ecx, [ebp+var_124] mov esi, [ebp+var_114] inc ecx mov [ebp+var_124], ecx cmp ecx, [ebp+var_11C] jb short loc_A15549 mov eax, [ebp+var_118] loc_A15588: ; CODE XREF: sub_A1506F+4D8j lea ecx, [esi+4] mov [ebp+var_11C], ecx cmp ecx, esi jb short loc_A155C4 mov ecx, [edi] xor edx, edx add ecx, eax lea eax, [esi+104h] cmp eax, ecx ja loc_A15185 mov edi, [ebp+var_11C] mov dword ptr [esi], 100h lea esi, [ebp+var_108] push 40h pop ecx rep movsd inc dword ptr [ebx] jmp short loc_A155C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A155C4: ; CODE XREF: sub_A1506F+3A4j ; sub_A1506F+44Ej ... mov edx, 0C0000095h loc_A155C9: ; CODE XREF: sub_A1506F+4Ej ; sub_A1506F+11Bj ... mov ecx, [ebp+var_4] mov eax, edx pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 sub_A1506F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A155DC proc near ; CODE XREF: sub_785212+19FAp var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 3Ch push ebx mov ebx, ecx mov [ebp+var_3C], edx xor ecx, ecx mov [ebp+var_18], ebx push esi push edi mov eax, [ebx+8] mov edi, ecx mov [ebp+var_C], ecx mov [ebp+var_30], ecx mov [ebp+var_34], ecx mov [ebp+var_28], ecx mov [ebp+var_24], ecx mov [ebp+var_20], ecx mov [ebp+var_1C], ecx mov [ebp+var_10], ecx mov [ebp+var_8], ecx mov [ebp+var_38], ecx test eax, eax jnz short loc_A15622 loc_A15618: ; CODE XREF: sub_A155DC+49j mov esi, 0C000000Dh jmp loc_A156A7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15622: ; CODE XREF: sub_A155DC+3Aj cmp dword ptr [ebx], 3 jbe short loc_A15618 mov ebx, ecx loc_A15629: ; CODE XREF: sub_A155DC+7Fj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15636 xor esi, esi jmp short loc_A1563E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15636: ; CODE XREF: sub_A155DC+54j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1563E: ; CODE XREF: sub_A155DC+58j mov [ebp+var_14], ecx test esi, esi js short loc_A15682 lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15682 mov eax, [ebp+var_14] inc ebx cmp ebx, 3 jb short loc_A15629 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1566A xor esi, esi jmp short loc_A15672 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1566A: ; CODE XREF: sub_A155DC+88j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15672: ; CODE XREF: sub_A155DC+8Cj test esi, esi js short loc_A15682 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A15684 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15682: ; CODE XREF: sub_A155DC+67j ; sub_A155DC+76j ... mov eax, edi loc_A15684: ; CODE XREF: sub_A155DC+A4j test esi, esi js short loc_A156A2 cmp eax, 8 jz short loc_A15697 loc_A1568D: ; CODE XREF: sub_A155DC+25Ej mov esi, 0C0000023h jmp loc_A15D1F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15697: ; CODE XREF: sub_A155DC+AFj mov eax, [edi] mov [ebp+var_30], eax mov eax, [edi+4] mov [ebp+var_34], eax loc_A156A2: ; CODE XREF: sub_A155DC+AAj mov ebx, [ebp+var_18] xor ecx, ecx loc_A156A7: ; CODE XREF: sub_A155DC+41j test esi, esi js loc_A15D1F mov eax, [ebx+8] test eax, eax jnz short loc_A156C0 loc_A156B6: ; CODE XREF: sub_A155DC+E7j ; sub_A155DC+15Fj ... mov esi, 0C000000Dh jmp loc_A15D1F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A156C0: ; CODE XREF: sub_A155DC+D8j cmp dword ptr [ebx], 4 jbe short loc_A156B6 mov edi, ecx loc_A156C7: ; CODE XREF: sub_A155DC+125j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A156D4 xor esi, esi jmp short loc_A156DC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A156D4: ; CODE XREF: sub_A155DC+F2j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A156DC: ; CODE XREF: sub_A155DC+F6j mov [ebp+var_14], ecx test esi, esi js loc_A15D1F lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D1F mov eax, [ebp+var_14] inc edi cmp edi, 4 jb short loc_A156C7 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15710 xor esi, esi jmp short loc_A15718 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15710: ; CODE XREF: sub_A155DC+12Ej mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15718: ; CODE XREF: sub_A155DC+132j test esi, esi js loc_A15D1F mov eax, edx mov [ebp+var_24], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_28], eax test esi, esi js loc_A15D1F mov eax, [ebx+8] test eax, eax jz loc_A156B6 cmp dword ptr [ebx], 5 jbe loc_A156B6 xor edi, edi loc_A1574C: ; CODE XREF: sub_A155DC+1AAj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15759 xor esi, esi jmp short loc_A15761 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15759: ; CODE XREF: sub_A155DC+177j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15761: ; CODE XREF: sub_A155DC+17Bj mov [ebp+var_14], ecx test esi, esi js loc_A15D1F lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D1F mov eax, [ebp+var_14] inc edi cmp edi, 5 jb short loc_A1574C mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15795 xor esi, esi jmp short loc_A1579D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15795: ; CODE XREF: sub_A155DC+1B3j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1579D: ; CODE XREF: sub_A155DC+1B7j test esi, esi js loc_A15D1F mov eax, edx mov [ebp+var_1C], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_20], eax test esi, esi js loc_A15D1F mov eax, [ebx+8] xor edi, edi and [ebp+var_4], edi test eax, eax jnz short loc_A157D0 loc_A157C7: ; CODE XREF: sub_A155DC+1F7j mov esi, 0C000000Dh mov ebx, edi jmp short loc_A1584A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A157D0: ; CODE XREF: sub_A155DC+1E9j cmp dword ptr [ebx], 6 jbe short loc_A157C7 xor ebx, ebx loc_A157D7: ; CODE XREF: sub_A155DC+22Dj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A157E4 xor esi, esi jmp short loc_A157EC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A157E4: ; CODE XREF: sub_A155DC+202j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A157EC: ; CODE XREF: sub_A155DC+206j mov [ebp+var_14], ecx test esi, esi js short loc_A15830 lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15830 mov eax, [ebp+var_14] inc ebx cmp ebx, 6 jb short loc_A157D7 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15818 xor esi, esi jmp short loc_A15820 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15818: ; CODE XREF: sub_A155DC+236j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15820: ; CODE XREF: sub_A155DC+23Aj test esi, esi js short loc_A15830 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A15833 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15830: ; CODE XREF: sub_A155DC+215j ; sub_A155DC+224j ... mov eax, [ebp+var_4] loc_A15833: ; CODE XREF: sub_A155DC+252j test esi, esi js short loc_A15847 cmp eax, 4 jnz loc_A1568D mov ebx, [edi] mov [ebp+var_8], ebx jmp short loc_A1584A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15847: ; CODE XREF: sub_A155DC+259j mov ebx, [ebp+var_8] loc_A1584A: ; CODE XREF: sub_A155DC+1F2j ; sub_A155DC+269j test esi, esi js loc_A15D1F xor esi, esi test ebx, ebx jz short loc_A15886 push 20534C53h push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax mov [ebp+var_10], edi test edi, edi jnz short loc_A15878 mov esi, 0C0000017h jmp loc_A15D1F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15878: ; CODE XREF: sub_A155DC+290j push ebx ; size_t push 0 ; int push edi ; void * call _memset add esp, 0Ch jmp short loc_A1588A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15886: ; CODE XREF: sub_A155DC+27Aj mov edi, [ebp+var_10] inc esi loc_A1588A: ; CODE XREF: sub_A155DC+2A8j mov eax, ds:dword_A93EAC test eax, eax jz short loc_A158B1 neg esi lea ecx, [ebp+var_38] push ecx sbb esi, esi push ebx not esi and esi, edi push esi push [ebp+var_1C] push [ebp+var_20] push [ebp+var_24] push [ebp+var_28] call eax jmp short loc_A158B6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A158B1: ; CODE XREF: sub_A155DC+2B5j mov eax, 0C00000BBh loc_A158B6: ; CODE XREF: sub_A155DC+2D3j and [ebp+var_4], 0 mov [ebp+var_14], eax lea eax, [ebp+var_4] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15922 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15922 lea edx, [ebx+4] cmp edx, 4 jb short loc_A1591D mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15922 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15922 mov eax, [ebp+var_4] mov [ebp+var_C], eax jmp short loc_A15925 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1591D: ; CODE XREF: sub_A155DC+310j mov esi, 0C0000095h loc_A15922: ; CODE XREF: sub_A155DC+2F3j ; sub_A155DC+308j ... mov eax, [ebp+var_C] loc_A15925: ; CODE XREF: sub_A155DC+33Fj test esi, esi js loc_A15D0D xor edi, edi mov [ebp+var_2C], 8 lea ecx, [ebp+var_2C] mov edx, eax push ecx push 8 pop ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D mov eax, [ebp+var_2C] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A15962 mov esi, 0C0000095h jmp short loc_A1596F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15962: ; CODE XREF: sub_A155DC+37Dj lea edi, [ecx+8] cmp edi, ecx jb loc_A159EE xor esi, esi loc_A1596F: ; CODE XREF: sub_A155DC+384j test esi, esi js loc_A15D0D mov ebx, [ebp+var_3C] mov edx, edi push 4 pop ecx mov [ebp+var_4], ecx mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_3C], eax lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A159AC xor esi, esi jmp short loc_A159B4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A159AC: ; CODE XREF: sub_A155DC+3CAj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A159B4: ; CODE XREF: sub_A155DC+3CEj mov [ebp+var_4], ecx test esi, esi js loc_A15D0D lea eax, [ebp+var_4] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A159EE mov edx, [ebp+var_3C] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A159F3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A159EE: ; CODE XREF: sub_A155DC+38Bj ; sub_A155DC+400j mov esi, 0C0000095h loc_A159F3: ; CODE XREF: sub_A155DC+410j test esi, esi js loc_A15D0D mov edi, [ebp+arg_4] test edi, edi jnz short loc_A15A0C mov esi, 0C000000Dh jmp loc_A15D0D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15A0C: ; CODE XREF: sub_A155DC+424j mov eax, [ebp+var_C] lea ebx, [edi+4] xor esi, esi mov [ebx], eax test eax, eax jnz short loc_A15A21 mov esi, 0C000003Eh jmp short loc_A15A3E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15A21: ; CODE XREF: sub_A155DC+43Cj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A15A39 mov esi, 0C0000017h jmp short loc_A15A3E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15A39: ; CODE XREF: sub_A155DC+454j mov [edi+8], eax and [edi], esi loc_A15A3E: ; CODE XREF: sub_A155DC+443j ; sub_A155DC+45Bj test esi, esi js loc_A15D0D mov eax, [edi+8] or [ebp+var_14], 10000000h mov [ebp+var_24], eax test eax, eax jnz short loc_A15A73 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D inc dword ptr [edi] jmp loc_A15AF4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15A73: ; CODE XREF: sub_A155DC+479j mov ecx, [edi] mov ebx, eax and [ebp+var_28], 0 mov [ebp+arg_4], ebx mov [ebp+var_3C], ecx test ecx, ecx jz short loc_A15AB2 loc_A15A85: ; CODE XREF: sub_A155DC+4D1j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A15AD5 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15AE9 mov ecx, [ebp+var_28] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_28], ecx cmp ecx, [ebp+var_3C] jb short loc_A15A85 mov eax, [ebp+var_24] loc_A15AB2: ; CODE XREF: sub_A155DC+4A7j lea edx, [ebx+4] cmp edx, ebx jb loc_A15D08 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+8] cmp eax, ecx jbe short loc_A15ADC loc_A15ACB: ; CODE XREF: sub_A155DC+595j ; sub_A155DC+6A1j ... mov esi, 0C0000023h jmp loc_A15D0D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15AD5: ; CODE XREF: sub_A155DC+4B1j mov esi, 0C0000095h jmp short loc_A15AE9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15ADC: ; CODE XREF: sub_A155DC+4EDj mov eax, [ebp+var_14] mov dword ptr [ebx], 4 mov [edx], eax inc dword ptr [edi] loc_A15AE9: ; CODE XREF: sub_A155DC+4C2j ; sub_A155DC+4FEj lea ebx, [edi+4] test esi, esi js loc_A15D0D loc_A15AF4: ; CODE XREF: sub_A155DC+492j mov eax, [edi+8] mov [ebp+var_24], eax test eax, eax jnz short loc_A15B17 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D inc dword ptr [edi] jmp short loc_A15B95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15B17: ; CODE XREF: sub_A155DC+520j mov ecx, [edi] mov ebx, eax and [ebp+var_28], 0 mov [ebp+arg_4], ebx mov [ebp+var_3C], ecx test ecx, ecx jz short loc_A15B5A loc_A15B29: ; CODE XREF: sub_A155DC+579j mov edx, [ebx] add edx, 4 cmp edx, 4 jb loc_A15BE4 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15B8A mov ecx, [ebp+var_28] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_28], ecx cmp ecx, [ebp+var_3C] jb short loc_A15B29 mov eax, [ebp+var_24] loc_A15B5A: ; CODE XREF: sub_A155DC+54Bj lea edx, [ebx+4] cmp edx, ebx jb loc_A15D08 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+0Ch] cmp eax, ecx ja loc_A15ACB mov eax, [ebp+var_30] mov dword ptr [ebx], 8 mov [edx], eax mov eax, [ebp+var_34] mov [edx+4], eax inc dword ptr [edi] loc_A15B8A: ; CODE XREF: sub_A155DC+56Aj ; sub_A155DC+60Dj lea ebx, [edi+4] test esi, esi js loc_A15D0D loc_A15B95: ; CODE XREF: sub_A155DC+539j cmp [ebp+var_10], 0 mov ecx, [ebp+var_8] jnz short loc_A15BEB test ecx, ecx jz short loc_A15BEF loc_A15BA2: ; CODE XREF: sub_A155DC+611j mov esi, 0C000000Dh loc_A15BA7: ; CODE XREF: sub_A155DC+640j ; sub_A155DC+6C0j test esi, esi js loc_A15D0D lea ebx, [edi+4] loc_A15BB2: ; CODE XREF: sub_A155DC+639j mov eax, [ebp+var_38] mov [ebp+var_28], eax mov eax, [edi+8] mov [ebp+var_30], eax test eax, eax jnz loc_A15CA1 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D inc dword ptr [edi] xor esi, esi jmp loc_A15D0D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15BE4: ; CODE XREF: sub_A155DC+555j mov esi, 0C0000095h jmp short loc_A15B8A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15BEB: ; CODE XREF: sub_A155DC+5C0j test ecx, ecx jz short loc_A15BA2 loc_A15BEF: ; CODE XREF: sub_A155DC+5C4j mov eax, [edi+8] mov [ebp+var_30], eax test eax, eax jnz short loc_A15C1E lea edx, [ecx+4] cmp edx, 4 jb short loc_A15C17 mov ecx, [ebx] push ebx call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D inc dword ptr [edi] jmp short loc_A15BB2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15C17: ; CODE XREF: sub_A155DC+623j ; sub_A155DC+65Cj mov esi, 0C0000095h jmp short loc_A15BA7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15C1E: ; CODE XREF: sub_A155DC+61Bj mov ecx, [edi] mov ebx, eax and [ebp+var_34], 0 mov [ebp+arg_4], ebx mov [ebp+var_3C], ecx test ecx, ecx jz short loc_A15C61 loc_A15C30: ; CODE XREF: sub_A155DC+680j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A15C17 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A15D0D mov ecx, [ebp+var_34] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_34], ecx cmp ecx, [ebp+var_3C] jb short loc_A15C30 mov eax, [ebp+var_30] loc_A15C61: ; CODE XREF: sub_A155DC+652j lea edx, [ebx+4] cmp edx, ebx jb loc_A15D08 mov ecx, [edi+4] xor esi, esi add ecx, eax mov eax, [ebp+var_8] add eax, 4 add eax, ebx cmp eax, ecx ja loc_A15ACB mov ecx, [ebp+var_10] mov eax, [ebp+var_8] mov [ebx], eax test ecx, ecx jz short loc_A15C9A push eax ; size_t push ecx ; void * push edx ; void * call _memcpy add esp, 0Ch loc_A15C9A: ; CODE XREF: sub_A155DC+6B1j inc dword ptr [edi] jmp loc_A15BA7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15CA1: ; CODE XREF: sub_A155DC+5E4j mov ecx, [edi] mov ebx, eax and [ebp+var_34], 0 mov [ebp+arg_4], ebx mov [ebp+var_3C], ecx test ecx, ecx jz short loc_A15CE0 loc_A15CB3: ; CODE XREF: sub_A155DC+6FFj mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A15D08 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15D0D mov ecx, [ebp+var_34] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_34], ecx cmp ecx, [ebp+var_3C] jb short loc_A15CB3 mov eax, [ebp+var_30] loc_A15CE0: ; CODE XREF: sub_A155DC+6D5j lea edx, [ebx+4] cmp edx, ebx jb short loc_A15D08 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+8] cmp eax, ecx ja loc_A15ACB mov eax, [ebp+var_28] mov dword ptr [ebx], 4 mov [edx], eax inc dword ptr [edi] jmp short loc_A15D0D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15D08: ; CODE XREF: sub_A155DC+4DBj ; sub_A155DC+583j ... mov esi, 0C0000095h loc_A15D0D: ; CODE XREF: sub_A155DC+34Bj ; sub_A155DC+36Cj ... mov eax, [ebp+var_10] test eax, eax jz short loc_A15D1F push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A15D1F: ; CODE XREF: sub_A155DC+B6j ; sub_A155DC+CDj ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A155DC endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A15D28 proc near ; CODE XREF: sub_785212+20C3p var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 44h mov eax, [ecx+8] push ebx push esi mov [ebp+var_40], edx xor edx, edx mov [ebp+var_4], ecx mov [ebp+var_C], edx mov [ebp+var_34], edx mov [ebp+var_38], edx mov [ebp+var_2C], edx mov [ebp+var_28], edx mov [ebp+var_24], edx mov [ebp+var_20], edx mov [ebp+var_1C], edx mov [ebp+var_10], edx mov [ebp+var_8], edx mov [ebp+var_3C], edx push edi mov edi, edx test eax, eax jnz short loc_A15D6F loc_A15D65: ; CODE XREF: sub_A15D28+4Aj mov esi, 0C000000Dh jmp loc_A15DF4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15D6F: ; CODE XREF: sub_A15D28+3Bj cmp dword ptr [ecx], 3 jbe short loc_A15D65 mov ebx, edx loc_A15D76: ; CODE XREF: sub_A15D28+80j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15D83 xor esi, esi jmp short loc_A15D8B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15D83: ; CODE XREF: sub_A15D28+55j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15D8B: ; CODE XREF: sub_A15D28+59j mov [ebp+var_14], ecx test esi, esi js short loc_A15DCF lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15DCF mov eax, [ebp+var_14] inc ebx cmp ebx, 3 jb short loc_A15D76 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15DB7 xor esi, esi jmp short loc_A15DBF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15DB7: ; CODE XREF: sub_A15D28+89j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15DBF: ; CODE XREF: sub_A15D28+8Dj test esi, esi js short loc_A15DCF mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A15DD1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15DCF: ; CODE XREF: sub_A15D28+68j ; sub_A15D28+77j ... mov eax, edi loc_A15DD1: ; CODE XREF: sub_A15D28+A5j test esi, esi js short loc_A15DEF cmp eax, 8 jz short loc_A15DE4 loc_A15DDA: ; CODE XREF: sub_A15D28+151j ; sub_A15D28+2F7j mov esi, 0C0000023h jmp loc_A16504 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15DE4: ; CODE XREF: sub_A15D28+B0j mov eax, [edi] mov [ebp+var_34], eax mov eax, [edi+4] mov [ebp+var_38], eax loc_A15DEF: ; CODE XREF: sub_A15D28+ABj mov ecx, [ebp+var_4] xor edx, edx loc_A15DF4: ; CODE XREF: sub_A15D28+42j test esi, esi js loc_A16504 mov eax, [ecx+8] mov ebx, edx mov [ebp+var_14], edx test eax, eax jnz short loc_A15E0F loc_A15E08: ; CODE XREF: sub_A15D28+EAj mov esi, 0C000000Dh jmp short loc_A15E89 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15E0F: ; CODE XREF: sub_A15D28+DEj cmp dword ptr [ecx], 4 jbe short loc_A15E08 mov edi, edx loc_A15E16: ; CODE XREF: sub_A15D28+120j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15E23 xor esi, esi jmp short loc_A15E2B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15E23: ; CODE XREF: sub_A15D28+F5j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15E2B: ; CODE XREF: sub_A15D28+F9j mov [ebp+var_18], ecx test esi, esi js short loc_A15E6F lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A15E6F mov eax, [ebp+var_18] inc edi cmp edi, 4 jb short loc_A15E16 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15E57 xor esi, esi jmp short loc_A15E5F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15E57: ; CODE XREF: sub_A15D28+129j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15E5F: ; CODE XREF: sub_A15D28+12Dj test esi, esi js short loc_A15E6F mov ebx, edx mov eax, edx neg ebx sbb ebx, ebx and ebx, ecx jmp short loc_A15E72 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15E6F: ; CODE XREF: sub_A15D28+108j ; sub_A15D28+117j ... mov eax, [ebp+var_14] loc_A15E72: ; CODE XREF: sub_A15D28+145j test esi, esi js short loc_A15E84 cmp eax, 4 jnz loc_A15DDA mov eax, [ebx] mov [ebp+var_2C], eax loc_A15E84: ; CODE XREF: sub_A15D28+14Cj mov ecx, [ebp+var_4] xor edx, edx loc_A15E89: ; CODE XREF: sub_A15D28+E5j test esi, esi js loc_A16504 mov eax, [ecx+8] test eax, eax jnz short loc_A15EA2 loc_A15E98: ; CODE XREF: sub_A15D28+17Dj ; sub_A15D28+1F8j ... mov esi, 0C000000Dh jmp loc_A16504 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15EA2: ; CODE XREF: sub_A15D28+16Ej cmp dword ptr [ecx], 5 jbe short loc_A15E98 mov edi, edx loc_A15EA9: ; CODE XREF: sub_A15D28+1BBj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15EB6 xor esi, esi jmp short loc_A15EBE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15EB6: ; CODE XREF: sub_A15D28+188j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15EBE: ; CODE XREF: sub_A15D28+18Cj mov [ebp+var_18], ecx test esi, esi js loc_A16504 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A16504 mov eax, [ebp+var_18] inc edi cmp edi, 5 jb short loc_A15EA9 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15EF2 xor esi, esi jmp short loc_A15EFA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15EF2: ; CODE XREF: sub_A15D28+1C4j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15EFA: ; CODE XREF: sub_A15D28+1C8j test esi, esi js loc_A16504 mov eax, edx mov [ebp+var_24], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_28], eax test esi, esi js loc_A16504 mov ebx, [ebp+var_4] mov eax, [ebx+8] test eax, eax jz loc_A15E98 cmp dword ptr [ebx], 6 jbe loc_A15E98 xor edi, edi loc_A15F31: ; CODE XREF: sub_A15D28+243j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15F3E xor esi, esi jmp short loc_A15F46 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15F3E: ; CODE XREF: sub_A15D28+210j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15F46: ; CODE XREF: sub_A15D28+214j mov [ebp+var_18], ecx test esi, esi js loc_A16504 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A16504 mov eax, [ebp+var_18] inc edi cmp edi, 6 jb short loc_A15F31 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15F7A xor esi, esi jmp short loc_A15F82 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15F7A: ; CODE XREF: sub_A15D28+24Cj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15F82: ; CODE XREF: sub_A15D28+250j test esi, esi js loc_A16504 mov eax, edx mov [ebp+var_1C], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_20], eax test esi, esi js loc_A16504 mov eax, [ebx+8] xor edi, edi and [ebp+var_14], edi test eax, eax jnz short loc_A15FB5 loc_A15FAC: ; CODE XREF: sub_A15D28+290j mov esi, 0C000000Dh mov ebx, edi jmp short loc_A1602F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15FB5: ; CODE XREF: sub_A15D28+282j cmp dword ptr [ebx], 7 jbe short loc_A15FAC xor ebx, ebx loc_A15FBC: ; CODE XREF: sub_A15D28+2C6j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15FC9 xor esi, esi jmp short loc_A15FD1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15FC9: ; CODE XREF: sub_A15D28+29Bj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A15FD1: ; CODE XREF: sub_A15D28+29Fj mov [ebp+var_18], ecx test esi, esi js short loc_A16015 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16015 mov eax, [ebp+var_18] inc ebx cmp ebx, 7 jb short loc_A15FBC mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A15FFD xor esi, esi jmp short loc_A16005 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A15FFD: ; CODE XREF: sub_A15D28+2CFj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16005: ; CODE XREF: sub_A15D28+2D3j test esi, esi js short loc_A16015 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A16018 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16015: ; CODE XREF: sub_A15D28+2AEj ; sub_A15D28+2BDj ... mov eax, [ebp+var_14] loc_A16018: ; CODE XREF: sub_A15D28+2EBj test esi, esi js short loc_A1602C cmp eax, 4 jnz loc_A15DDA mov ebx, [edi] mov [ebp+var_8], ebx jmp short loc_A1602F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1602C: ; CODE XREF: sub_A15D28+2F2j mov ebx, [ebp+var_8] loc_A1602F: ; CODE XREF: sub_A15D28+28Bj ; sub_A15D28+302j test esi, esi js loc_A16504 xor esi, esi test ebx, ebx jz short loc_A1606B push 20534C53h push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax mov [ebp+var_10], edi test edi, edi jnz short loc_A1605D mov esi, 0C0000017h jmp loc_A16504 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1605D: ; CODE XREF: sub_A15D28+329j push ebx ; size_t push 0 ; int push edi ; void * call _memset add esp, 0Ch jmp short loc_A1606F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1606B: ; CODE XREF: sub_A15D28+313j mov edi, [ebp+var_10] inc esi loc_A1606F: ; CODE XREF: sub_A15D28+341j mov eax, ds:dword_A93EB0 test eax, eax jz short loc_A16099 neg esi lea ecx, [ebp+var_3C] push ecx push ebx sbb esi, esi not esi and esi, edi push esi push [ebp+var_1C] push [ebp+var_20] push [ebp+var_24] push [ebp+var_28] push [ebp+var_2C] call eax jmp short loc_A1609E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16099: ; CODE XREF: sub_A15D28+34Ej mov eax, 0C00000BBh loc_A1609E: ; CODE XREF: sub_A15D28+36Fj and [ebp+var_4], 0 mov [ebp+var_14], eax lea eax, [ebp+var_4] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1610A mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1610A lea edx, [ebx+4] cmp edx, 4 jb short loc_A16105 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1610A mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1610A mov eax, [ebp+var_4] mov [ebp+var_C], eax jmp short loc_A1610D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16105: ; CODE XREF: sub_A15D28+3ACj mov esi, 0C0000095h loc_A1610A: ; CODE XREF: sub_A15D28+38Fj ; sub_A15D28+3A4j ... mov eax, [ebp+var_C] loc_A1610D: ; CODE XREF: sub_A15D28+3DBj test esi, esi js loc_A164F2 xor edi, edi mov [ebp+var_30], 8 lea ecx, [ebp+var_30] mov edx, eax push ecx push 8 pop ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 mov eax, [ebp+var_30] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1614A mov esi, 0C0000095h jmp short loc_A16157 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1614A: ; CODE XREF: sub_A15D28+419j lea edi, [ecx+8] cmp edi, ecx jb loc_A161D6 xor esi, esi loc_A16157: ; CODE XREF: sub_A15D28+420j test esi, esi js loc_A164F2 mov ebx, [ebp+var_40] mov edx, edi push 4 pop ecx mov [ebp+var_4], ecx mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_40], eax lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16194 xor esi, esi jmp short loc_A1619C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16194: ; CODE XREF: sub_A15D28+466j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1619C: ; CODE XREF: sub_A15D28+46Aj mov [ebp+var_4], ecx test esi, esi js loc_A164F2 lea eax, [ebp+var_4] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A161D6 mov edx, [ebp+var_40] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A161DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A161D6: ; CODE XREF: sub_A15D28+427j ; sub_A15D28+49Cj mov esi, 0C0000095h loc_A161DB: ; CODE XREF: sub_A15D28+4ACj test esi, esi js loc_A164F2 mov edi, [ebp+arg_4] test edi, edi jnz short loc_A161F4 mov esi, 0C000000Dh jmp loc_A164F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A161F4: ; CODE XREF: sub_A15D28+4C0j mov eax, [ebp+var_C] lea ebx, [edi+4] xor esi, esi mov [ebx], eax test eax, eax jnz short loc_A16209 mov esi, 0C000003Eh jmp short loc_A16226 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16209: ; CODE XREF: sub_A15D28+4D8j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A16221 mov esi, 0C0000017h jmp short loc_A16226 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16221: ; CODE XREF: sub_A15D28+4F0j mov [edi+8], eax and [edi], esi loc_A16226: ; CODE XREF: sub_A15D28+4DFj ; sub_A15D28+4F7j test esi, esi js loc_A164F2 mov eax, [edi+8] or [ebp+var_14], 10000000h mov [ebp+var_28], eax test eax, eax jnz short loc_A16258 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 inc dword ptr [edi] jmp short loc_A162D7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16258: ; CODE XREF: sub_A15D28+515j and [ebp+var_2C], 0 mov ebx, eax mov eax, [edi] mov [ebp+arg_4], ebx mov [ebp+var_40], eax test eax, eax jz short loc_A16294 loc_A1626A: ; CODE XREF: sub_A15D28+56Aj mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A162B8 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A162CC mov ecx, [ebp+var_2C] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_2C], ecx cmp ecx, [ebp+var_40] jb short loc_A1626A loc_A16294: ; CODE XREF: sub_A15D28+540j lea edx, [ebx+4] cmp edx, ebx jb loc_A164ED mov ecx, [edi+4] lea eax, [ebx+8] add ecx, [ebp+var_28] xor esi, esi cmp eax, ecx jbe short loc_A162BF loc_A162AE: ; CODE XREF: sub_A15D28+62Aj ; sub_A15D28+736j ... mov esi, 0C0000023h jmp loc_A164F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A162B8: ; CODE XREF: sub_A15D28+54Aj mov esi, 0C0000095h jmp short loc_A162CC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A162BF: ; CODE XREF: sub_A15D28+584j mov eax, [ebp+var_14] mov dword ptr [ebx], 4 mov [edx], eax inc dword ptr [edi] loc_A162CC: ; CODE XREF: sub_A15D28+55Bj ; sub_A15D28+595j lea ebx, [edi+4] test esi, esi js loc_A164F2 loc_A162D7: ; CODE XREF: sub_A15D28+52Ej mov eax, [edi+8] mov [ebp+var_28], eax test eax, eax jnz short loc_A162FA mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 inc dword ptr [edi] jmp short loc_A16376 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A162FA: ; CODE XREF: sub_A15D28+5B7j and [ebp+var_2C], 0 mov ebx, eax mov eax, [edi] mov [ebp+arg_4], ebx mov [ebp+var_40], eax test eax, eax jz short loc_A1633A loc_A1630C: ; CODE XREF: sub_A15D28+610j mov edx, [ebx] add edx, 4 cmp edx, 4 jb loc_A163C5 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1636B mov ecx, [ebp+var_2C] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_2C], ecx cmp ecx, [ebp+var_40] jb short loc_A1630C loc_A1633A: ; CODE XREF: sub_A15D28+5E2j lea edx, [ebx+4] cmp edx, ebx jb loc_A164ED mov ecx, [edi+4] lea eax, [ebx+0Ch] add ecx, [ebp+var_28] xor esi, esi cmp eax, ecx ja loc_A162AE mov eax, [ebp+var_34] mov dword ptr [ebx], 8 mov [edx], eax mov eax, [ebp+var_38] mov [edx+4], eax inc dword ptr [edi] loc_A1636B: ; CODE XREF: sub_A15D28+601j ; sub_A15D28+6A2j lea ebx, [edi+4] test esi, esi js loc_A164F2 loc_A16376: ; CODE XREF: sub_A15D28+5D0j cmp [ebp+var_10], 0 mov eax, [ebp+var_8] jnz short loc_A163CC test eax, eax jz short loc_A163D0 loc_A16383: ; CODE XREF: sub_A15D28+6A6j mov esi, 0C000000Dh loc_A16388: ; CODE XREF: sub_A15D28+6D5j ; sub_A15D28+758j test esi, esi js loc_A164F2 lea ebx, [edi+4] loc_A16393: ; CODE XREF: sub_A15D28+6CEj mov edx, [edi+8] mov eax, [ebp+var_3C] mov [ebp+var_2C], eax mov [ebp+var_34], edx test edx, edx jnz loc_A16485 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 inc dword ptr [edi] xor esi, esi jmp loc_A164F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A163C5: ; CODE XREF: sub_A15D28+5ECj mov esi, 0C0000095h jmp short loc_A1636B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A163CC: ; CODE XREF: sub_A15D28+655j test eax, eax jz short loc_A16383 loc_A163D0: ; CODE XREF: sub_A15D28+659j mov edx, [edi+8] mov [ebp+var_34], edx test edx, edx jnz short loc_A163FF lea edx, [eax+4] cmp edx, 4 jb short loc_A163F8 mov ecx, [ebx] push ebx call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 inc dword ptr [edi] jmp short loc_A16393 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A163F8: ; CODE XREF: sub_A15D28+6B8j ; sub_A15D28+6F1j mov esi, 0C0000095h jmp short loc_A16388 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A163FF: ; CODE XREF: sub_A15D28+6B0j mov eax, [edi] mov ebx, edx and [ebp+var_38], 0 mov [ebp+arg_4], ebx mov [ebp+var_40], eax test eax, eax jz short loc_A16442 loc_A16411: ; CODE XREF: sub_A15D28+715j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A163F8 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A164F2 mov ecx, [ebp+var_38] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_38], ecx cmp ecx, [ebp+var_40] jb short loc_A16411 mov edx, [ebp+var_34] loc_A16442: ; CODE XREF: sub_A15D28+6E7j lea eax, [ebx+4] cmp eax, ebx jb loc_A164ED mov ecx, [ebp+var_8] xor esi, esi mov eax, [edi+4] add ecx, 4 add ecx, ebx add eax, edx cmp ecx, eax ja loc_A162AE mov ecx, [ebp+var_10] mov eax, [ebp+var_8] mov [ebx], eax test ecx, ecx jz short loc_A1647E push eax ; size_t push ecx ; void * lea eax, [ebx+4] push eax ; void * call _memcpy add esp, 0Ch loc_A1647E: ; CODE XREF: sub_A15D28+746j inc dword ptr [edi] jmp loc_A16388 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16485: ; CODE XREF: sub_A15D28+679j mov eax, [edi] mov ebx, edx and [ebp+var_38], 0 mov [ebp+arg_4], ebx mov [ebp+var_40], eax test eax, eax jz short loc_A164C4 loc_A16497: ; CODE XREF: sub_A15D28+797j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A164ED lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A164F2 mov ecx, [ebp+var_38] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_38], ecx cmp ecx, [ebp+var_40] jb short loc_A16497 mov edx, [ebp+var_34] loc_A164C4: ; CODE XREF: sub_A15D28+76Dj lea eax, [ebx+4] cmp eax, ebx jb short loc_A164ED mov ecx, [edi+4] lea eax, [ebx+8] add ecx, edx xor esi, esi cmp eax, ecx ja loc_A162AE mov eax, [ebp+var_2C] mov dword ptr [ebx], 4 mov [ebx+4], eax inc dword ptr [edi] jmp short loc_A164F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A164ED: ; CODE XREF: sub_A15D28+571j ; sub_A15D28+617j ... mov esi, 0C0000095h loc_A164F2: ; CODE XREF: sub_A15D28+3E7j ; sub_A15D28+408j ... mov eax, [ebp+var_10] test eax, eax jz short loc_A16504 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A16504: ; CODE XREF: sub_A15D28+B7j ; sub_A15D28+CEj ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A15D28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1650D proc near ; CODE XREF: sub_785212+1B0Dp var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 44h push ebx xor ebx, ebx mov eax, edx mov [ebp+var_40], eax mov edx, ecx mov [ebp+var_C], edx mov [ebp+var_18], ebx mov [ebp+var_34], ebx mov [ebp+var_38], ebx mov [ebp+var_1C], ebx mov [ebp+var_2C], ebx mov [ebp+var_28], ebx mov [ebp+var_10], ebx push esi push edi test eax, eax jnz short loc_A16547 loc_A1653D: ; CODE XREF: sub_A1650D+3Dj mov esi, 0C000000Dh jmp loc_A16A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16547: ; CODE XREF: sub_A1650D+2Ej cmp [ebp+arg_4], ebx jz short loc_A1653D mov eax, [edx+8] mov edi, ebx mov ecx, 0C000000Dh test eax, eax jnz short loc_A16561 loc_A1655A: ; CODE XREF: sub_A1650D+57j mov esi, ecx jmp loc_A165E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16561: ; CODE XREF: sub_A1650D+4Bj cmp dword ptr [edx], 3 jbe short loc_A1655A loc_A16566: ; CODE XREF: sub_A1650D+8Bj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16573 xor esi, esi jmp short loc_A1657B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16573: ; CODE XREF: sub_A1650D+60j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1657B: ; CODE XREF: sub_A1650D+64j mov [ebp+var_4], ecx test esi, esi js short loc_A165BF lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A165BF mov eax, [ebp+var_4] inc ebx cmp ebx, 3 jb short loc_A16566 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A165A7 xor esi, esi jmp short loc_A165AF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A165A7: ; CODE XREF: sub_A1650D+94j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A165AF: ; CODE XREF: sub_A1650D+98j test esi, esi js short loc_A165BF mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A165C1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A165BF: ; CODE XREF: sub_A1650D+73j ; sub_A1650D+82j ... mov eax, edi loc_A165C1: ; CODE XREF: sub_A1650D+B0j test esi, esi js short loc_A165DF cmp eax, 8 jz short loc_A165D4 mov esi, 0C0000023h jmp loc_A16A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A165D4: ; CODE XREF: sub_A1650D+BBj mov eax, [edi] mov [ebp+var_34], eax mov eax, [edi+4] mov [ebp+var_38], eax loc_A165DF: ; CODE XREF: sub_A1650D+B6j mov edx, [ebp+var_C] xor ebx, ebx loc_A165E4: ; CODE XREF: sub_A1650D+4Fj test esi, esi js loc_A16A4F mov eax, [edx+8] xor edi, edi and [ebp+var_24], edi mov ecx, ebx mov [ebp+var_4], ebx mov [ebp+var_3C], ecx test eax, eax jnz short loc_A1660A loc_A16600: ; CODE XREF: sub_A1650D+100j mov esi, 0C000000Dh jmp loc_A166DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1660A: ; CODE XREF: sub_A1650D+F1j cmp dword ptr [edx], 4 jbe short loc_A16600 and [ebp+var_20], edi loc_A16612: ; CODE XREF: sub_A1650D+145j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1661F xor esi, esi jmp short loc_A16627 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1661F: ; CODE XREF: sub_A1650D+10Cj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16627: ; CODE XREF: sub_A1650D+110j mov [ebp+var_8], ecx test esi, esi js loc_A166D8 lea eax, [ebp+var_8] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A166D8 mov edx, [ebp+var_20] mov eax, [ebp+var_8] inc edx mov [ebp+var_20], edx cmp edx, 4 jb short loc_A16612 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16661 xor esi, esi jmp short loc_A16669 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16661: ; CODE XREF: sub_A1650D+14Ej mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16669: ; CODE XREF: sub_A1650D+152j test esi, esi js short loc_A166D8 mov ebx, edx mov edi, edx neg ebx sbb ebx, ebx and ebx, ecx test esi, esi js short loc_A166D8 test edi, edi jnz short loc_A166A4 loc_A1667F: ; CODE XREF: sub_A1650D+19Dj ; sub_A1650D+1AAj ... mov esi, 0C000003Eh loc_A16684: ; CODE XREF: sub_A1650D+1FCj test esi, esi js loc_A16A4F loc_A1668C: ; CODE XREF: sub_A1650D+20Fj mov ebx, [ebp+var_C] mov eax, [ebx+8] test eax, eax jnz loc_A16721 loc_A1669A: ; CODE XREF: sub_A1650D+217j ; sub_A1650D+293j ... mov esi, 0C000000Dh jmp loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A166A4: ; CODE XREF: sub_A1650D+170j test edi, 1 jnz short loc_A1667F mov eax, edi xor ecx, ecx shr eax, 1 cmp cx, [ebx+eax*2-2] jnz short loc_A1667F lea eax, [ebp+var_24] mov edx, edi push eax mov ecx, ebx call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A1667F mov ecx, [ebp+var_24] lea eax, [ecx+2] cmp eax, edi jnz short loc_A1667F shr ecx, 1 jmp short loc_A166DE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A166D8: ; CODE XREF: sub_A1650D+11Fj ; sub_A1650D+132j ... mov ecx, [ebp+var_3C] loc_A166DB: ; CODE XREF: sub_A1650D+F8j mov ebx, [ebp+var_4] loc_A166DE: ; CODE XREF: sub_A1650D+1C9j test esi, esi js loc_A16A4F lea edi, ds:2[ecx*2] test edi, edi jz short loc_A1667F push 20534C53h push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A1670E mov esi, 0C0000017h jmp loc_A16684 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1670E: ; CODE XREF: sub_A1650D+1F5j push edi ; size_t push ebx ; void * push esi ; void * call _memcpy add esp, 0Ch mov [ebp+var_1C], esi jmp loc_A1668C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16721: ; CODE XREF: sub_A1650D+187j cmp dword ptr [ebx], 5 jbe loc_A1669A xor edi, edi loc_A1672C: ; CODE XREF: sub_A1650D+259j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16739 xor esi, esi jmp short loc_A16741 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16739: ; CODE XREF: sub_A1650D+226j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16741: ; CODE XREF: sub_A1650D+22Aj mov [ebp+var_C], ecx test esi, esi js loc_A16A3D lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A16A3D mov eax, [ebp+var_C] inc edi cmp edi, 5 jb short loc_A1672C mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16775 xor esi, esi jmp short loc_A1677D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16775: ; CODE XREF: sub_A1650D+262j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1677D: ; CODE XREF: sub_A1650D+266j test esi, esi js loc_A16A3D mov eax, edx mov [ebp+var_28], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_2C], eax test esi, esi js loc_A16A3D mov eax, [ebx+8] test eax, eax jz loc_A1669A cmp dword ptr [ebx], 6 jbe loc_A1669A xor edi, edi loc_A167B1: ; CODE XREF: sub_A1650D+2D6j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A167BE xor esi, esi jmp short loc_A167C6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A167BE: ; CODE XREF: sub_A1650D+2ABj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A167C6: ; CODE XREF: sub_A1650D+2AFj mov [ebp+var_C], ecx test esi, esi js short loc_A16808 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16808 mov eax, [ebp+var_C] inc edi cmp edi, 6 jb short loc_A167B1 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A167F2 xor esi, esi jmp short loc_A167FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A167F2: ; CODE XREF: sub_A1650D+2DFj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A167FA: ; CODE XREF: sub_A1650D+2E3j test esi, esi js short loc_A16808 mov ebx, edx neg edx sbb edx, edx and edx, ecx jmp short loc_A1680D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16808: ; CODE XREF: sub_A1650D+2BEj ; sub_A1650D+2CDj ... mov edx, [ebp+var_10] mov ebx, edx loc_A1680D: ; CODE XREF: sub_A1650D+2F9j test esi, esi js loc_A16A3D mov eax, ds:dword_A93E98 test eax, eax jz short loc_A1682F push ebx push edx push [ebp+var_28] push [ebp+var_2C] push [ebp+var_1C] call eax mov edi, eax jmp short loc_A16834 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1682F: ; CODE XREF: sub_A1650D+30Fj mov edi, 0C00000BBh loc_A16834: ; CODE XREF: sub_A1650D+320j mov esi, edi test edi, edi js loc_A16A3D push 8 pop ecx mov [ebp+var_2C], ecx lea eax, [ebp+var_2C] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1685E mov eax, [ebp+var_2C] mov [ebp+var_18], eax jmp short loc_A16861 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1685E: ; CODE XREF: sub_A1650D+347j mov eax, [ebp+var_18] loc_A16861: ; CODE XREF: sub_A1650D+34Fj test esi, esi js loc_A16A3D push 8 pop esi xor ebx, ebx mov [ebp+var_30], esi lea ecx, [ebp+var_30] mov edx, eax push ecx mov ecx, esi call RtlUIntAdd mov esi, eax test esi, esi js loc_A16A3D mov eax, [ebp+var_30] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1689C mov esi, 0C0000095h jmp short loc_A168A9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1689C: ; CODE XREF: sub_A1650D+386j lea ebx, [ecx+8] cmp ebx, ecx jb loc_A1692C xor esi, esi loc_A168A9: ; CODE XREF: sub_A1650D+38Dj test esi, esi js loc_A16A3D mov ecx, [ebp+var_40] mov edx, ebx push 4 mov eax, [ecx+10h] mov [ebp+var_3C], eax mov eax, [ecx+8] mov [ebp+var_40], eax lea eax, [ebp+var_4] pop ecx push eax mov [ebp+var_4], ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A16A3D mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A168E9 xor esi, esi jmp short loc_A168F1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A168E9: ; CODE XREF: sub_A1650D+3D6j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A168F1: ; CODE XREF: sub_A1650D+3DAj mov [ebp+var_4], ecx test esi, esi js loc_A16A3D mov edx, [ebp+var_40] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A16A3D mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1692C mov edx, [ebp+var_3C] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A16931 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1692C: ; CODE XREF: sub_A1650D+394j ; sub_A1650D+40Dj mov esi, 0C0000095h loc_A16931: ; CODE XREF: sub_A1650D+41Dj test esi, esi js loc_A16A3D mov esi, [ebp+arg_4] mov eax, [ebp+var_18] lea ebx, [esi+4] mov [ebx], eax test eax, eax jnz short loc_A16952 mov esi, 0C000003Eh jmp loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16952: ; CODE XREF: sub_A1650D+439j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1696F mov esi, 0C0000017h jmp loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1696F: ; CODE XREF: sub_A1650D+456j mov [esi+8], edx and dword ptr [esi], 0 or edi, 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A16A38 mov ecx, [ebx] lea eax, [edx+8] add ecx, edx cmp eax, ecx jbe short loc_A1699B loc_A16991: ; CODE XREF: sub_A1650D+50Dj mov esi, 0C0000023h jmp loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1699B: ; CODE XREF: sub_A1650D+482j mov dword ptr [edx], 4 mov [esi], edi mov edi, [ebp+arg_4] inc dword ptr [edi] mov ecx, [edi] mov [ebp+var_40], ecx mov eax, [edi+8] mov [ebp+var_3C], eax test eax, eax jnz short loc_A169CE mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16A3D inc dword ptr [edi] xor esi, esi jmp short loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A169CE: ; CODE XREF: sub_A1650D+4A8j and [ebp+var_2C], 0 mov edi, eax mov [ebp+var_18], edi test ecx, ecx jz short loc_A16A08 loc_A169DB: ; CODE XREF: sub_A1650D+4F6j mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A16A38 lea eax, [ebp+var_18] mov ecx, edi push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16A3D mov ecx, [ebp+var_2C] mov edi, [ebp+var_18] inc ecx mov [ebp+var_2C], ecx cmp ecx, [ebp+var_40] jb short loc_A169DB mov eax, [ebp+var_3C] loc_A16A08: ; CODE XREF: sub_A1650D+4CCj lea edx, [edi+4] cmp edx, edi jb short loc_A16A38 mov ecx, [ebx] xor esi, esi add ecx, eax lea eax, [edi+0Ch] cmp eax, ecx ja loc_A16991 mov eax, [ebp+var_34] mov dword ptr [edi], 8 mov [edx], eax mov eax, [ebp+var_38] mov [edx+4], eax mov eax, [ebp+arg_4] inc dword ptr [eax] jmp short loc_A16A3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16A38: ; CODE XREF: sub_A1650D+473j ; sub_A1650D+4D6j ... mov esi, 0C0000095h loc_A16A3D: ; CODE XREF: sub_A1650D+192j ; sub_A1650D+239j ... mov eax, [ebp+var_1C] test eax, eax jz short loc_A16A4F push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A16A4F: ; CODE XREF: sub_A1650D+35j ; sub_A1650D+C2j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A1650D endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A16A58 proc near ; CODE XREF: sub_785212+1A46p Source2 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 44h xor edx, edx mov [ebp+var_8], ecx mov [ebp+var_2C], edx mov [ebp+var_30], edx mov [ebp+var_C], edx mov [ebp+var_4], edx push ebx push esi push edi test ecx, ecx jnz short loc_A16A82 loc_A16A78: ; CODE XREF: sub_A16A58+1A7j mov esi, 0C000000Dh jmp loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16A82: ; CODE XREF: sub_A16A58+1Ej mov ebx, [ebp+arg_4] mov esi, 0C000000Dh test ebx, ebx jz loc_A16F73 mov eax, [ecx+8] mov edi, edx test eax, eax jz loc_A16B2F cmp dword ptr [ecx], 3 jbe loc_A16B2F mov [ebp+var_14], edx loc_A16AAB: ; CODE XREF: sub_A16A58+8Bj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16AB8 xor esi, esi jmp short loc_A16AC0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16AB8: ; CODE XREF: sub_A16A58+5Aj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16AC0: ; CODE XREF: sub_A16A58+5Ej mov [ebp+arg_4], ecx test esi, esi js short loc_A16B0A lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16B0A mov edx, [ebp+var_14] mov eax, [ebp+arg_4] inc edx mov [ebp+var_14], edx cmp edx, 3 jb short loc_A16AAB mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16AF2 xor esi, esi jmp short loc_A16AFA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16AF2: ; CODE XREF: sub_A16A58+94j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16AFA: ; CODE XREF: sub_A16A58+98j test esi, esi js short loc_A16B0A mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A16B0C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16B0A: ; CODE XREF: sub_A16A58+6Dj ; sub_A16A58+7Cj ... mov eax, edi loc_A16B0C: ; CODE XREF: sub_A16A58+B0j test esi, esi js short loc_A16B2A cmp eax, 8 jz short loc_A16B1F loc_A16B15: ; CODE XREF: sub_A16A58+475j ; sub_A16A58+501j mov esi, 0C0000023h jmp loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16B1F: ; CODE XREF: sub_A16A58+BBj mov eax, [edi] mov [ebp+var_2C], eax mov eax, [edi+4] mov [ebp+var_30], eax loc_A16B2A: ; CODE XREF: sub_A16A58+B6j mov ecx, [ebp+var_8] xor edx, edx loc_A16B2F: ; CODE XREF: sub_A16A58+41j ; sub_A16A58+4Aj test esi, esi js loc_A16F73 mov eax, [ecx+8] mov edi, edx mov [ebp+var_10], edx test eax, eax jnz short loc_A16B4D loc_A16B43: ; CODE XREF: sub_A16A58+F8j mov esi, 0C000000Dh jmp loc_A16BD8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16B4D: ; CODE XREF: sub_A16A58+E9j cmp dword ptr [ecx], 4 jbe short loc_A16B43 mov [ebp+var_14], edx loc_A16B55: ; CODE XREF: sub_A16A58+135j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16B62 xor esi, esi jmp short loc_A16B6A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16B62: ; CODE XREF: sub_A16A58+104j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16B6A: ; CODE XREF: sub_A16A58+108j mov [ebp+arg_4], ecx test esi, esi js short loc_A16BB4 lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16BB4 mov edx, [ebp+var_14] mov eax, [ebp+arg_4] inc edx mov [ebp+var_14], edx cmp edx, 4 jb short loc_A16B55 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16B9C xor esi, esi jmp short loc_A16BA4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16B9C: ; CODE XREF: sub_A16A58+13Ej mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16BA4: ; CODE XREF: sub_A16A58+142j test esi, esi js short loc_A16BB4 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A16BB7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16BB4: ; CODE XREF: sub_A16A58+117j ; sub_A16A58+126j ... mov eax, [ebp+var_10] loc_A16BB7: ; CODE XREF: sub_A16A58+15Aj test esi, esi js short loc_A16BD6 cmp eax, 8 jz short loc_A16BCA loc_A16BC0: ; CODE XREF: sub_A16A58+438j mov esi, 0C000003Eh jmp loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16BCA: ; CODE XREF: sub_A16A58+166j mov eax, [edi+4] xor edx, edx mov ecx, [edi] mov [ebp+var_3C], eax jmp short loc_A16BDB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16BD6: ; CODE XREF: sub_A16A58+161j xor edx, edx loc_A16BD8: ; CODE XREF: sub_A16A58+F0j mov ecx, [ebp+var_C] loc_A16BDB: ; CODE XREF: sub_A16A58+17Cj test esi, esi js loc_A16F73 mov [ebp+var_10], edx mov edi, edx mov [ebp+var_C], edx mov [ebp+var_1C], edx mov [ebp+var_20], edx mov [ebp+var_24], edx mov [ebp+var_28], edx mov [ebp+Source2], edx mov [ebp+var_3C], edx test ecx, ecx jz loc_A16A78 mov eax, ds:_IoFileObjectType push edx mov [ebp+arg_4], edx lea edx, [ebp+arg_4] push edx push 1 push eax push 0 push ecx call _ObReferenceObjectByHandle@24 ; ObReferenceObjectByHandle(x,x,x,x,x,x) mov esi, eax mov eax, [ebp+arg_4] mov [ebp+arg_4], eax test esi, esi js loc_A16E1D push 20534C53h push 1Fh push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax mov [ebp+var_14], edi test edi, edi jnz short loc_A16C4E mov esi, 0C0000017h jmp loc_A16E1A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16C4E: ; CODE XREF: sub_A16A58+1EAj xor ecx, ecx xor eax, eax mov [edi+5], ecx mov [edi+9], ecx mov [edi+0Dh], ecx mov [edi+11h], ecx mov [edi+15h], ecx mov [edi+19h], ecx mov [edi+1Dh], ax mov [edi], ecx push 6 mov byte ptr [edi+4], 19h add edi, 5 mov esi, ds:off_A42124 pop ecx rep movsd push 20534C53h push 3Ah push 1 movsb call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax mov [ebp+var_10], esi test esi, esi jnz short loc_A16C9E mov esi, 0C0000017h jmp loc_A16E17 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16C9E: ; CODE XREF: sub_A16A58+23Aj push 3Ah ; size_t push 0 ; int push esi ; void * call _memset mov edi, [ebp+var_14] lea eax, [ebp+var_C] add esp, 0Ch push eax push 1 push 0 push 1Fh push edi push 1 push 3Ah push esi push [ebp+arg_4] call FsRtlQueryKernelEaFile mov esi, eax cmp esi, 0C0000225h jnz short loc_A16CDB and [ebp+var_4], 0 loc_A16CD4: ; CODE XREF: sub_A16A58+2C7j xor esi, esi jmp loc_A16E1A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16CDB: ; CODE XREF: sub_A16A58+276j test esi, esi js loc_A16E1A mov ecx, [ebp+var_10] movzx eax, byte ptr [ecx+5] lea edx, [ecx+9] add edx, eax movzx eax, word ptr [ecx+6] movzx ecx, ax mov [ebp+var_8], eax add ecx, edx mov eax, [ebp+var_C] add eax, [ebp+var_10] mov [ebp+var_18], edx cmp ecx, eax jbe short loc_A16D12 loc_A16D08: ; CODE XREF: sub_A16A58+2CDj ; sub_A16A58+2E1j mov esi, 0C000003Eh jmp loc_A16E1A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16D12: ; CODE XREF: sub_A16A58+2AEj mov eax, [ebp+var_8] xor ecx, ecx cmp cx, ax jnz short loc_A16D21 and [ebp+var_4], ecx jmp short loc_A16CD4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16D21: ; CODE XREF: sub_A16A58+2C2j cmp ax, 18h jnz short loc_A16D08 push 8 ; Length lea eax, [ebp+Source2] push eax ; Source2 lea eax, [edx+10h] push eax ; Source1 call _RtlCompareMemory@12 ; RtlCompareMemory(x,x,x) cmp eax, 8 jnz short loc_A16D08 and [ebp+var_8], 0 push 20534C53h push 248h push 1 mov [ebp+var_4], 2 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jz loc_A16E17 lea eax, [ebp+var_8] push eax ; int push 248h ; int push edi ; void * push 0 ; size_t push 0 ; void * push 900F4h ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov [ebp+var_C], eax test eax, eax js short loc_A16DDD cmp [ebp+var_8], 40h jnb short loc_A16D92 loc_A16D89: ; CODE XREF: sub_A16A58+36Bj mov [ebp+var_C], 0C000003Eh jmp short loc_A16DDD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16D92: ; CODE XREF: sub_A16A58+32Fj mov eax, [edi] mov [ebp+var_34], eax mov eax, [edi+4] mov [ebp+var_38], eax lea eax, [ebp+var_8] push eax ; int push 248h ; int push edi ; void * push 0 ; size_t push 0 ; void * push 900EBh ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov [ebp+var_C], eax test eax, eax js short loc_A16DDD cmp [ebp+var_8], 40h jb short loc_A16D89 mov eax, [edi+18h] mov [ebp+var_24], eax mov eax, [edi+1Ch] mov [ebp+var_28], eax mov eax, [ebp+var_34] mov [ebp+var_1C], eax mov eax, [ebp+var_38] mov [ebp+var_20], eax loc_A16DDD: ; CODE XREF: sub_A16A58+329j ; sub_A16A58+338j ... push 20534C53h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) cmp [ebp+var_C], 0 jl short loc_A16E17 mov eax, [ebp+var_18] mov ecx, [ebp+var_1C] cmp ecx, [eax] jnz short loc_A16E17 mov ecx, [ebp+var_20] cmp ecx, [eax+4] jnz short loc_A16E17 mov ecx, [ebp+var_24] cmp ecx, [eax+8] jnz short loc_A16E17 mov ecx, [ebp+var_28] cmp ecx, [eax+0Ch] jnz short loc_A16E17 mov [ebp+var_4], 3 loc_A16E17: ; CODE XREF: sub_A16A58+241j ; sub_A16A58+303j ... mov edi, [ebp+var_14] loc_A16E1A: ; CODE XREF: sub_A16A58+1F1j ; sub_A16A58+27Ej ... mov eax, [ebp+arg_4] loc_A16E1D: ; CODE XREF: sub_A16A58+1CFj test eax, eax jz short loc_A16E28 mov ecx, eax call ObfDereferenceObject loc_A16E28: ; CODE XREF: sub_A16A58+3C7j test edi, edi jz short loc_A16E37 push 20534C53h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A16E37: ; CODE XREF: sub_A16A58+3D2j mov eax, [ebp+var_10] test eax, eax jz short loc_A16E49 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A16E49: ; CODE XREF: sub_A16A58+3E4j test esi, esi js loc_A16F73 and [ebp+arg_4], 0 lea eax, [ebp+arg_4] xor ecx, ecx push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A16F73 mov ecx, [ebp+arg_4] lea eax, [ebp+arg_4] push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A16F73 mov eax, [ebp+arg_4] lea esi, [ebx+4] mov [esi], eax test eax, eax jz loc_A16BC0 push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A16EB3 mov esi, 0C0000017h jmp loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16EB3: ; CODE XREF: sub_A16A58+44Fj mov [ebx+8], edx and dword ptr [ebx], 0 lea edi, [edx+4] cmp edi, edx jb loc_A16F6E mov ecx, [esi] lea eax, [edx+0Ch] add ecx, edx cmp eax, ecx ja loc_A16B15 mov eax, [ebp+var_2C] mov dword ptr [edx], 8 mov [edi], eax mov eax, [ebp+var_30] mov [edi+4], eax inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_38], ecx mov eax, [ebx+8] mov [ebp+var_34], eax test eax, eax jnz short loc_A16F0C mov ecx, [esi] push esi push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16F73 inc dword ptr [ebx] xor esi, esi jmp short loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16F0C: ; CODE XREF: sub_A16A58+49Bj and [ebp+var_30], 0 mov edi, eax mov [ebp+arg_4], edi test ecx, ecx jz short loc_A16F46 loc_A16F19: ; CODE XREF: sub_A16A58+4E9j mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A16F6E lea eax, [ebp+arg_4] mov ecx, edi push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A16F73 mov ecx, [ebp+var_30] mov edi, [ebp+arg_4] inc ecx mov [ebp+var_30], ecx cmp ecx, [ebp+var_38] jb short loc_A16F19 mov eax, [ebp+var_34] loc_A16F46: ; CODE XREF: sub_A16A58+4BFj lea edx, [edi+4] cmp edx, edi jb short loc_A16F6E mov ecx, [ebx+4] xor esi, esi add ecx, eax lea eax, [edi+8] cmp eax, ecx ja loc_A16B15 mov eax, [ebp+var_4] mov dword ptr [edi], 4 mov [edx], eax inc dword ptr [ebx] jmp short loc_A16F73 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16F6E: ; CODE XREF: sub_A16A58+466j ; sub_A16A58+4C9j ... mov esi, 0C0000095h loc_A16F73: ; CODE XREF: sub_A16A58+25j ; sub_A16A58+34j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A16A58 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A16F7C proc near ; CODE XREF: sub_785212+156Cp var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 3Ch xor eax, eax mov [ebp+var_4], ecx and [ebp+var_C], eax mov [ebp+var_1C], eax mov [ebp+var_20], eax mov [ebp+var_24], eax mov [ebp+var_8], eax push ebx push esi push edi test ecx, ecx jnz short loc_A16FA9 loc_A16F9F: ; CODE XREF: sub_A16F7C+32j ; sub_A16F7C+210j ... mov esi, 0C000000Dh jmp loc_A175D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16FA9: ; CODE XREF: sub_A16F7C+21j mov ebx, [ebp+arg_4] test ebx, ebx jz short loc_A16F9F and [ebp+var_10], eax xor edi, edi mov eax, [ecx+8] test eax, eax jnz short loc_A16FC6 loc_A16FBC: ; CODE XREF: sub_A16F7C+4Dj mov esi, 0C000000Dh jmp loc_A1704B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16FC6: ; CODE XREF: sub_A16F7C+3Ej cmp dword ptr [ecx], 3 jbe short loc_A16FBC and [ebp+var_14], edi loc_A16FCE: ; CODE XREF: sub_A16F7C+8Aj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A16FDB xor esi, esi jmp short loc_A16FE3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A16FDB: ; CODE XREF: sub_A16F7C+59j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A16FE3: ; CODE XREF: sub_A16F7C+5Dj mov [ebp+arg_4], ecx test esi, esi js short loc_A1702D lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1702D mov edx, [ebp+var_14] mov eax, [ebp+arg_4] inc edx mov [ebp+var_14], edx cmp edx, 3 jb short loc_A16FCE mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17015 xor esi, esi jmp short loc_A1701D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17015: ; CODE XREF: sub_A16F7C+93j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1701D: ; CODE XREF: sub_A16F7C+97j test esi, esi js short loc_A1702D mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A17030 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1702D: ; CODE XREF: sub_A16F7C+6Cj ; sub_A16F7C+7Bj ... mov eax, [ebp+var_10] loc_A17030: ; CODE XREF: sub_A16F7C+AFj test esi, esi js short loc_A17048 cmp eax, 8 jnz loc_A17585 mov eax, [edi] mov [ebp+var_1C], eax mov eax, [edi+4] mov [ebp+var_14], eax loc_A17048: ; CODE XREF: sub_A16F7C+B6j mov ecx, [ebp+var_4] loc_A1704B: ; CODE XREF: sub_A16F7C+45j test esi, esi js loc_A175D2 mov eax, [ecx+8] xor edi, edi and [ebp+var_10], edi test eax, eax jnz short loc_A17066 loc_A1705F: ; CODE XREF: sub_A16F7C+EDj mov esi, 0C000000Dh jmp short loc_A170E5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17066: ; CODE XREF: sub_A16F7C+E1j cmp dword ptr [ecx], 4 jbe short loc_A1705F and [ebp+var_14], edi loc_A1706E: ; CODE XREF: sub_A16F7C+12Aj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1707B xor esi, esi jmp short loc_A17083 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1707B: ; CODE XREF: sub_A16F7C+F9j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17083: ; CODE XREF: sub_A16F7C+FDj mov [ebp+arg_4], ecx test esi, esi js short loc_A170CD lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A170CD mov edx, [ebp+var_14] mov eax, [ebp+arg_4] inc edx mov [ebp+var_14], edx cmp edx, 4 jb short loc_A1706E mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A170B5 xor esi, esi jmp short loc_A170BD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A170B5: ; CODE XREF: sub_A16F7C+133j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A170BD: ; CODE XREF: sub_A16F7C+137j test esi, esi js short loc_A170CD mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A170D0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A170CD: ; CODE XREF: sub_A16F7C+10Cj ; sub_A16F7C+11Bj ... mov eax, [ebp+var_10] loc_A170D0: ; CODE XREF: sub_A16F7C+14Fj test esi, esi js short loc_A170E2 cmp eax, 4 jnz loc_A17562 mov eax, [edi] mov [ebp+var_20], eax loc_A170E2: ; CODE XREF: sub_A16F7C+156j mov ecx, [ebp+var_4] loc_A170E5: ; CODE XREF: sub_A16F7C+E8j test esi, esi js loc_A175D2 mov eax, [ecx+8] xor edi, edi and [ebp+var_10], edi test eax, eax jnz short loc_A17100 loc_A170F9: ; CODE XREF: sub_A16F7C+187j mov esi, 0C000000Dh jmp short loc_A1717F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17100: ; CODE XREF: sub_A16F7C+17Bj cmp dword ptr [ecx], 5 jbe short loc_A170F9 and [ebp+var_14], edi loc_A17108: ; CODE XREF: sub_A16F7C+1C4j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17115 xor esi, esi jmp short loc_A1711D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17115: ; CODE XREF: sub_A16F7C+193j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1711D: ; CODE XREF: sub_A16F7C+197j mov [ebp+arg_4], ecx test esi, esi js short loc_A17167 lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17167 mov edx, [ebp+var_14] mov eax, [ebp+arg_4] inc edx mov [ebp+var_14], edx cmp edx, 5 jb short loc_A17108 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1714F xor esi, esi jmp short loc_A17157 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1714F: ; CODE XREF: sub_A16F7C+1CDj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17157: ; CODE XREF: sub_A16F7C+1D1j test esi, esi js short loc_A17167 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A1716A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17167: ; CODE XREF: sub_A16F7C+1A6j ; sub_A16F7C+1B5j ... mov eax, [ebp+var_10] loc_A1716A: ; CODE XREF: sub_A16F7C+1E9j test esi, esi js short loc_A1717C cmp eax, 4 jnz loc_A17562 mov eax, [edi] mov [ebp+var_24], eax loc_A1717C: ; CODE XREF: sub_A16F7C+1F0j mov ecx, [ebp+var_4] loc_A1717F: ; CODE XREF: sub_A16F7C+182j test esi, esi js loc_A175D2 mov eax, [ecx+8] test eax, eax jz loc_A16F9F cmp dword ptr [ecx], 6 jbe loc_A16F9F xor edi, edi loc_A1719D: ; CODE XREF: sub_A16F7C+253j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A171AA xor esi, esi jmp short loc_A171B2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A171AA: ; CODE XREF: sub_A16F7C+228j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A171B2: ; CODE XREF: sub_A16F7C+22Cj mov [ebp+arg_4], ecx test esi, esi js short loc_A171F7 lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A171F7 mov eax, [ebp+arg_4] inc edi cmp edi, 6 jb short loc_A1719D mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A171DE xor esi, esi jmp short loc_A171E6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A171DE: ; CODE XREF: sub_A16F7C+25Cj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A171E6: ; CODE XREF: sub_A16F7C+260j test esi, esi js short loc_A171F7 mov eax, edx neg edx sbb edx, edx and edx, ecx mov [ebp+var_8], edx jmp short loc_A171FD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A171F7: ; CODE XREF: sub_A16F7C+23Bj ; sub_A16F7C+24Aj ... mov edx, [ebp+var_8] mov eax, [ebp+var_C] loc_A171FD: ; CODE XREF: sub_A16F7C+279j test esi, esi js loc_A175D2 cmp eax, 10h jnz loc_A16F9F mov ecx, [ebp+var_1C] lea edi, [ebp+var_38] xor eax, eax xor esi, esi stosd mov [ebp+var_4], esi mov [ebp+var_C], esi stosd stosd stosd test ecx, ecx jz loc_A16F9F test edx, edx jz loc_A16F9F mov eax, ds:_IoFileObjectType lea edx, [ebp+arg_4] push esi push edx push 1 push eax push esi push ecx mov [ebp+arg_4], esi call _ObReferenceObjectByHandle@24 ; ObReferenceObjectByHandle(x,x,x,x,x,x) mov esi, eax test esi, esi js loc_A174AE push 20534C53h push 248h xor esi, esi push 1 mov [ebp+var_10], esi call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A17279 loc_A1726F: ; CODE XREF: sub_A16F7C+421j ; sub_A16F7C+4DDj mov esi, 0C0000017h jmp loc_A174AE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17279: ; CODE XREF: sub_A16F7C+2F1j lea eax, [ebp+var_10] push eax ; int push 248h ; int push edi ; void * push esi ; size_t push esi ; void * push 900F4h ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov esi, eax test esi, esi js short loc_A172EF cmp [ebp+var_10], 40h jnb short loc_A172A5 loc_A1729E: ; CODE XREF: sub_A16F7C+359j mov esi, 0C000003Eh jmp short loc_A172EF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A172A5: ; CODE XREF: sub_A16F7C+320j mov eax, [edi] mov [ebp+var_1C], eax mov eax, [edi+4] mov [ebp+var_14], eax lea eax, [ebp+var_10] push eax ; int push 248h ; int push edi ; void * push 0 ; size_t push 0 ; void * push 900EBh ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov esi, eax test esi, esi js short loc_A172EF cmp [ebp+var_10], 40h jb short loc_A1729E mov edx, [ebp+var_1C] mov eax, [edi+18h] mov ecx, [edi+1Ch] mov [ebp+var_38], edx mov edx, [ebp+var_14] mov [ebp+var_34], edx mov [ebp+var_30], eax mov [ebp+var_2C], ecx loc_A172EF: ; CODE XREF: sub_A16F7C+31Aj ; sub_A16F7C+327j ... push 20534C53h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) test esi, esi js loc_A174AE mov edx, [ebp+var_8] mov eax, [ebp+var_38] cmp eax, [edx] jnz loc_A174A9 mov eax, [ebp+var_34] cmp eax, [edx+4] jnz loc_A174A9 mov eax, [ebp+var_30] cmp eax, [edx+8] jnz loc_A174A9 mov eax, [ebp+var_2C] cmp eax, [edx+0Ch] jnz loc_A174A9 cmp [ebp+var_20], 0 push 18h pop edi jnz loc_A17431 lea eax, [ebp+var_C] xor esi, esi push eax push esi push ds:_IoFileObjectType push edi push esi push 200h push [ebp+arg_4] call ObOpenObjectByPointer test eax, eax js short loc_A17385 push [ebp+var_C] lea eax, [ebp+var_C] push 1 push eax mov eax, [ebp+var_24] add eax, 0FFFFFFFEh cmp eax, 1 setnbe al dec al and al, 6 movzx eax, al push eax push 2 call _ZwSetCachedSigningLevel@20 ; ZwSetCachedSigningLevel(x,x,x,x,x) loc_A17385: ; CODE XREF: sub_A16F7C+3E3j push 20534C53h push 248h push 1 mov [ebp+var_10], esi call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jz loc_A1726F lea eax, [ebp+var_10] push eax ; int push 248h ; int push edi ; void * push esi ; size_t push esi ; void * push 900F4h ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov esi, eax test esi, esi js short loc_A17419 cmp [ebp+var_10], 40h jnb short loc_A173CF loc_A173C8: ; CODE XREF: sub_A16F7C+483j mov esi, 0C000003Eh jmp short loc_A17419 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A173CF: ; CODE XREF: sub_A16F7C+44Aj mov eax, [edi] mov [ebp+var_24], eax mov eax, [edi+4] mov [ebp+var_20], eax lea eax, [ebp+var_10] push eax ; int push 248h ; int push edi ; void * push 0 ; size_t push 0 ; void * push 900EBh ; int push [ebp+arg_4] ; int call FsRtlKernelFsControlFile mov esi, eax test esi, esi js short loc_A17419 cmp [ebp+var_10], 40h jb short loc_A173C8 mov edx, [ebp+var_24] mov eax, [edi+18h] mov ecx, [edi+1Ch] mov [ebp+var_38], edx mov edx, [ebp+var_20] mov [ebp+var_34], edx mov [ebp+var_30], eax mov [ebp+var_2C], ecx loc_A17419: ; CODE XREF: sub_A16F7C+444j ; sub_A16F7C+451j ... push 20534C53h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) test esi, esi js loc_A174AE push 18h pop edi jmp short loc_A17444 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17431: ; CODE XREF: sub_A16F7C+3BFj or [ebp+var_38], 0FFFFFFFFh or [ebp+var_34], 0FFFFFFFFh or [ebp+var_30], 0FFFFFFFFh mov [ebp+var_2C], 7FFFFFFFh loc_A17444: ; CODE XREF: sub_A16F7C+4B3j push 20534C53h push 3Ah push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax mov [ebp+var_24], esi test esi, esi jz loc_A1726F push 3Ah ; size_t push 0 ; int push esi ; void * call _memset mov [esi+6], di add esp, 0Ch mov byte ptr [esi+5], 19h lea edi, [esi+8] mov esi, ds:off_A42124 push 6 pop ecx rep movsd mov ecx, [ebp+var_24] movsb lea esi, [ebp+var_38] lea edi, [ecx+22h] movsd movsd movsd movsd and dword ptr [ecx+32h], 0 and dword ptr [ecx+36h], 0 mov edi, ecx push 3Ah push ecx push [ebp+arg_4] call FsRtlSetKernelEaFile mov esi, eax jmp short loc_A174B1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A174A9: ; CODE XREF: sub_A16F7C+38Ej ; sub_A16F7C+39Aj ... mov esi, 0C000003Eh loc_A174AE: ; CODE XREF: sub_A16F7C+2D1j ; sub_A16F7C+2F8j ... mov edi, [ebp+var_4] loc_A174B1: ; CODE XREF: sub_A16F7C+52Bj cmp [ebp+var_C], 0 jz short loc_A174BF push [ebp+var_C] call _ZwClose@4 ; ZwClose(x) loc_A174BF: ; CODE XREF: sub_A16F7C+539j cmp [ebp+arg_4], 0 jz short loc_A174CD mov ecx, [ebp+arg_4] call ObfDereferenceObject loc_A174CD: ; CODE XREF: sub_A16F7C+547j test edi, edi jz short loc_A174DC push 20534C53h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A174DC: ; CODE XREF: sub_A16F7C+553j test esi, esi js loc_A175D2 mov eax, [ebx+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A1750A lea ecx, [ebx+4] push ecx mov ecx, [ecx] push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A175D2 inc dword ptr [ebx] jmp short loc_A1757E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1750A: ; CODE XREF: sub_A16F7C+570j mov ecx, [ebx] mov edi, eax and [ebp+var_24], 0 mov [ebp+arg_4], edi mov [ebp+var_20], ecx test ecx, ecx jz short loc_A1754D loc_A1751C: ; CODE XREF: sub_A16F7C+5CCj mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A17569 lea eax, [ebp+arg_4] mov ecx, edi push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A175D2 mov ecx, [ebp+var_24] mov edi, [ebp+arg_4] inc ecx mov [ebp+var_24], ecx cmp ecx, [ebp+var_20] jb short loc_A1751C mov eax, [ebp+var_1C] loc_A1754D: ; CODE XREF: sub_A16F7C+59Ej lea edx, [edi+4] cmp edx, edi jb short loc_A175CD mov ecx, [ebx+4] xor esi, esi add ecx, eax lea eax, [edi+8] cmp eax, ecx jbe short loc_A17570 loc_A17562: ; CODE XREF: sub_A16F7C+15Bj ; sub_A16F7C+1F5j ... mov esi, 0C0000023h jmp short loc_A175D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17569: ; CODE XREF: sub_A16F7C+5A8j mov esi, 0C0000095h jmp short loc_A1757A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17570: ; CODE XREF: sub_A16F7C+5E4j mov dword ptr [edi], 4 and [edx], esi inc dword ptr [ebx] loc_A1757A: ; CODE XREF: sub_A16F7C+5F2j test esi, esi js short loc_A175D2 loc_A1757E: ; CODE XREF: sub_A16F7C+58Cj mov eax, [ebx+4] test eax, eax jnz short loc_A1758C loc_A17585: ; CODE XREF: sub_A16F7C+BBj mov esi, 0C000003Eh jmp short loc_A175D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1758C: ; CODE XREF: sub_A16F7C+607j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A175A6 mov esi, 0C0000017h jmp short loc_A175D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A175A6: ; CODE XREF: sub_A16F7C+621j mov [ebx+8], edx and dword ptr [ebx], 0 lea edi, [edx+4] cmp edi, edx jb short loc_A175CD mov ecx, [ebx+4] lea eax, [edx+8] add ecx, edx xor esi, esi cmp eax, ecx ja short loc_A17562 mov dword ptr [edx], 4 and [edi], esi inc dword ptr [ebx] jmp short loc_A175D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A175CD: ; CODE XREF: sub_A16F7C+5D6j ; sub_A16F7C+635j mov esi, 0C0000095h loc_A175D2: ; CODE XREF: sub_A16F7C+28j ; sub_A16F7C+D1j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A16F7C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A175DB proc near ; CODE XREF: sub_785212+149Fp var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 34h and [ebp+var_1C], 0 xor eax, eax and [ebp+var_20], 0 and [ebp+var_18], 0 and [ebp+var_14], 0 mov [ebp+var_4], ecx push ebx push esi push edi lea edi, [ebp+var_30] stosd stosd stosd stosd test ecx, ecx jnz short loc_A17610 loc_A17606: ; CODE XREF: sub_A175DB+39j ; sub_A175DB+221j mov ebx, 0C000000Dh jmp loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17610: ; CODE XREF: sub_A175DB+29j cmp [ebp+arg_4], 0 jz short loc_A17606 mov eax, [ecx+8] xor esi, esi and [ebp+var_C], esi test eax, eax jnz short loc_A1762C loc_A17622: ; CODE XREF: sub_A175DB+54j mov ebx, 0C000000Dh jmp loc_A176B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1762C: ; CODE XREF: sub_A175DB+45j cmp dword ptr [ecx], 3 jbe short loc_A17622 xor edi, edi loc_A17633: ; CODE XREF: sub_A175DB+8Aj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17640 xor ebx, ebx jmp short loc_A17648 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17640: ; CODE XREF: sub_A175DB+5Fj mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A17648: ; CODE XREF: sub_A175DB+63j mov [ebp+var_8], ecx test ebx, ebx js short loc_A1768C lea eax, [ebp+var_8] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A1768C mov eax, [ebp+var_8] inc edi cmp edi, 3 jb short loc_A17633 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17674 xor ebx, ebx jmp short loc_A1767C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17674: ; CODE XREF: sub_A175DB+93j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1767C: ; CODE XREF: sub_A175DB+97j test ebx, ebx js short loc_A1768C mov esi, edx mov eax, edx neg esi sbb esi, esi and esi, ecx jmp short loc_A1768F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1768C: ; CODE XREF: sub_A175DB+72j ; sub_A175DB+81j ... mov eax, [ebp+var_C] loc_A1768F: ; CODE XREF: sub_A175DB+AFj test ebx, ebx js short loc_A176AD cmp eax, 8 jz short loc_A176A2 loc_A17698: ; CODE XREF: sub_A175DB+20Fj ; sub_A175DB+3A5j ... mov ebx, 0C0000023h jmp loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A176A2: ; CODE XREF: sub_A175DB+BBj mov eax, [esi] mov [ebp+var_1C], eax mov eax, [esi+4] mov [ebp+var_20], eax loc_A176AD: ; CODE XREF: sub_A175DB+B6j mov ecx, [ebp+var_4] loc_A176B0: ; CODE XREF: sub_A175DB+4Cj test ebx, ebx js loc_A17A2F mov eax, [ecx+8] xor esi, esi and [ebp+var_8], esi test eax, eax jnz short loc_A176CB loc_A176C4: ; CODE XREF: sub_A175DB+F3j mov ebx, 0C000000Dh jmp short loc_A17745 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A176CB: ; CODE XREF: sub_A175DB+E7j cmp dword ptr [ecx], 4 jbe short loc_A176C4 xor edi, edi loc_A176D2: ; CODE XREF: sub_A175DB+129j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A176DF xor ebx, ebx jmp short loc_A176E7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A176DF: ; CODE XREF: sub_A175DB+FEj mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A176E7: ; CODE XREF: sub_A175DB+102j mov [ebp+var_C], ecx test ebx, ebx js short loc_A1772B lea eax, [ebp+var_C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A1772B mov eax, [ebp+var_C] inc edi cmp edi, 4 jb short loc_A176D2 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17713 xor ebx, ebx jmp short loc_A1771B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17713: ; CODE XREF: sub_A175DB+132j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1771B: ; CODE XREF: sub_A175DB+136j test ebx, ebx js short loc_A1772B mov esi, edx mov eax, edx neg esi sbb esi, esi and esi, ecx jmp short loc_A1772E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1772B: ; CODE XREF: sub_A175DB+111j ; sub_A175DB+120j ... mov eax, [ebp+var_8] loc_A1772E: ; CODE XREF: sub_A175DB+14Ej test ebx, ebx js short loc_A17742 cmp eax, 8 jnz short loc_A17772 mov eax, [esi] mov [ebp+var_18], eax mov eax, [esi+4] mov [ebp+var_C], eax loc_A17742: ; CODE XREF: sub_A175DB+155j mov ecx, [ebp+var_4] loc_A17745: ; CODE XREF: sub_A175DB+EEj test ebx, ebx js loc_A17A2F mov eax, [ecx+8] xor esi, esi and [ebp+var_8], esi test eax, eax jnz short loc_A1777C loc_A17759: ; CODE XREF: sub_A175DB+1A4j mov ebx, 0C000000Dh loc_A1775E: ; CODE XREF: sub_A175DB+206j mov eax, [ebp+var_14] loc_A17761: ; CODE XREF: sub_A175DB+217j test ebx, ebx js loc_A17A2F cmp eax, 10h jz loc_A177F7 loc_A17772: ; CODE XREF: sub_A175DB+15Aj ; sub_A175DB+368j mov ebx, 0C000003Eh jmp loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1777C: ; CODE XREF: sub_A175DB+17Cj cmp dword ptr [ecx], 5 jbe short loc_A17759 xor edi, edi loc_A17783: ; CODE XREF: sub_A175DB+1DAj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17790 xor ebx, ebx jmp short loc_A17798 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17790: ; CODE XREF: sub_A175DB+1AFj mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A17798: ; CODE XREF: sub_A175DB+1B3j mov [ebp+var_C], ecx test ebx, ebx js short loc_A177DC lea eax, [ebp+var_C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A177DC mov eax, [ebp+var_C] inc edi cmp edi, 5 jb short loc_A17783 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A177C4 xor ebx, ebx jmp short loc_A177CC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A177C4: ; CODE XREF: sub_A175DB+1E3j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A177CC: ; CODE XREF: sub_A175DB+1E7j test ebx, ebx js short loc_A177DC mov esi, edx mov eax, edx neg esi sbb esi, esi and esi, ecx jmp short loc_A177DF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A177DC: ; CODE XREF: sub_A175DB+1C2j ; sub_A175DB+1D1j ... mov eax, [ebp+var_8] loc_A177DF: ; CODE XREF: sub_A175DB+1FFj test ebx, ebx js loc_A1775E cmp eax, 4 jnz loc_A17698 mov eax, [esi] jmp loc_A17761 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A177F7: ; CODE XREF: sub_A175DB+191j mov ecx, [ebp+var_18] test ecx, ecx jz loc_A17606 mov eax, ds:_IoFileObjectType lea edx, [ebp+var_18] and [ebp+var_18], 0 push 0 push edx push 1 push eax push 0 push ecx call _ObReferenceObjectByHandle@24 ; ObReferenceObjectByHandle(x,x,x,x,x,x) mov edi, [ebp+var_18] mov ebx, eax test ebx, ebx js loc_A178EE and [ebp+var_4], 0 mov ebx, 248h push 20534C53h push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A1784F mov ebx, 0C0000017h jmp loc_A178EE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1784F: ; CODE XREF: sub_A175DB+268j lea eax, [ebp+var_4] push eax ; int push ebx ; int push esi ; void * push 0 ; size_t push 0 ; void * push 900F4h ; int push edi ; int call FsRtlKernelFsControlFile mov ebx, eax test ebx, ebx js short loc_A178E3 cmp [ebp+var_4], 40h jnb short loc_A17877 loc_A17870: ; CODE XREF: sub_A175DB+2D0j ; sub_A175DB+2EEj mov ebx, 0C000003Eh jmp short loc_A178E3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17877: ; CODE XREF: sub_A175DB+293j cmp byte ptr [edi+27h], 0 mov eax, [esi] mov [ebp+var_18], eax mov eax, [esi+4] mov [ebp+var_14], eax lea eax, [ebp+var_4] push eax ; int push 248h ; int push esi ; void * push 0 ; size_t push 0 ; void * jz short loc_A178B4 push 900EFh ; int push edi ; int call FsRtlKernelFsControlFile mov ebx, eax test ebx, ebx js short loc_A178E3 cmp [ebp+var_4], 8 jb short loc_A17870 mov eax, [esi] mov ecx, [esi+4] jmp short loc_A178D1 ; void * ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A178B4: ; CODE XREF: sub_A175DB+2B9j push 900EBh ; int push edi ; int call FsRtlKernelFsControlFile mov ebx, eax test ebx, ebx js short loc_A178E3 cmp [ebp+var_4], 40h jb short loc_A17870 mov eax, [esi+18h] mov ecx, [esi+1Ch] loc_A178D1: ; CODE XREF: sub_A175DB+2D7j mov edx, [ebp+var_18] mov [ebp+var_30], edx mov edx, [ebp+var_14] mov [ebp+var_2C], edx mov [ebp+var_28], eax mov [ebp+var_24], ecx loc_A178E3: ; CODE XREF: sub_A175DB+28Dj ; sub_A175DB+29Aj ... push 20534C53h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A178EE: ; CODE XREF: sub_A175DB+248j ; sub_A175DB+26Fj test edi, edi jz short loc_A178F9 mov ecx, edi call ObfDereferenceObject loc_A178F9: ; CODE XREF: sub_A175DB+315j test ebx, ebx js loc_A17A2F and [ebp+var_4], 0 lea eax, [ebp+var_4] xor ecx, ecx push eax push 0Ch pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A17A2F mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 14h pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A17A2F mov ebx, [ebp+arg_4] mov eax, [ebp+var_4] lea edi, [ebx+4] mov [edi], eax test eax, eax jz loc_A17772 push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A17966 mov ebx, 0C0000017h jmp loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17966: ; CODE XREF: sub_A175DB+37Fj mov [ebx+8], edx and dword ptr [ebx], 0 lea esi, [edx+4] cmp esi, edx jb loc_A17A2A mov ecx, [edi] lea eax, [edx+0Ch] add ecx, edx cmp eax, ecx ja loc_A17698 mov eax, [ebp+var_1C] mov dword ptr [edx], 8 mov [esi], eax mov eax, [ebp+var_20] mov [esi+4], eax inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_1C], ecx mov eax, [ebx+8] mov [ebp+var_18], eax test eax, eax jnz short loc_A179C2 mov ecx, [edi] push edi push 14h pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A17A2F mov eax, [ebp+arg_4] inc dword ptr [eax] xor ebx, ebx jmp short loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A179C2: ; CODE XREF: sub_A175DB+3CBj and [ebp+var_20], 0 mov esi, eax mov [ebp+var_14], esi test ecx, ecx jz short loc_A179FC loc_A179CF: ; CODE XREF: sub_A175DB+41Cj mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A17A2A lea eax, [ebp+var_14] mov ecx, esi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A17A2F mov ecx, [ebp+var_20] mov esi, [ebp+var_14] inc ecx mov [ebp+var_20], ecx cmp ecx, [ebp+var_1C] jb short loc_A179CF mov eax, [ebp+var_18] loc_A179FC: ; CODE XREF: sub_A175DB+3F2j lea edx, [esi+4] cmp edx, esi jb short loc_A17A2A mov ecx, [edi] xor ebx, ebx add ecx, eax lea eax, [esi+14h] cmp eax, ecx ja loc_A17698 mov eax, [ebp+arg_4] mov edi, edx mov dword ptr [esi], 10h lea esi, [ebp+var_30] movsd movsd movsd movsd inc dword ptr [eax] jmp short loc_A17A2F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17A2A: ; CODE XREF: sub_A175DB+396j ; sub_A175DB+3FCj ... mov ebx, 0C0000095h loc_A17A2F: ; CODE XREF: sub_A175DB+30j ; sub_A175DB+C2j ... pop edi pop esi mov eax, ebx pop ebx leave retn 8 sub_A175DB endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A17A38 proc near ; CODE XREF: sub_785212+1A5Cp var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 54h mov [ebp+var_50], edx mov edx, ecx push ebx xor ebx, ebx mov [ebp+var_4], edx push esi mov eax, [edx+8] mov [ebp+var_C], ebx mov [ebp+var_40], ebx mov [ebp+var_44], ebx mov [ebp+var_1C], ebx mov [ebp+var_38], ebx mov [ebp+var_34], ebx mov [ebp+var_30], ebx mov [ebp+var_2C], ebx mov [ebp+var_28], ebx mov [ebp+var_10], ebx mov [ebp+var_8], ebx mov [ebp+var_48], ebx push edi mov edi, ebx test eax, eax jnz short loc_A17A84 loc_A17A7A: ; CODE XREF: sub_A17A38+4Fj mov esi, 0C000000Dh jmp loc_A17B07 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17A84: ; CODE XREF: sub_A17A38+40j cmp dword ptr [edx], 3 jbe short loc_A17A7A loc_A17A89: ; CODE XREF: sub_A17A38+83j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17A96 xor esi, esi jmp short loc_A17A9E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17A96: ; CODE XREF: sub_A17A38+58j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17A9E: ; CODE XREF: sub_A17A38+5Cj mov [ebp+var_14], ecx test esi, esi js short loc_A17AE2 lea eax, [ebp+var_14] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17AE2 mov eax, [ebp+var_14] inc ebx cmp ebx, 3 jb short loc_A17A89 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17ACA xor esi, esi jmp short loc_A17AD2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17ACA: ; CODE XREF: sub_A17A38+8Cj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17AD2: ; CODE XREF: sub_A17A38+90j test esi, esi js short loc_A17AE2 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A17AE4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17AE2: ; CODE XREF: sub_A17A38+6Bj ; sub_A17A38+7Aj ... mov eax, edi loc_A17AE4: ; CODE XREF: sub_A17A38+A8j test esi, esi js short loc_A17B02 cmp eax, 8 jz short loc_A17AF7 loc_A17AED: ; CODE XREF: sub_A17A38+152j mov esi, 0C0000023h jmp loc_A18359 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17AF7: ; CODE XREF: sub_A17A38+B3j mov eax, [edi] mov [ebp+var_40], eax mov eax, [edi+4] mov [ebp+var_44], eax loc_A17B02: ; CODE XREF: sub_A17A38+AEj mov edx, [ebp+var_4] xor ebx, ebx loc_A17B07: ; CODE XREF: sub_A17A38+47j test esi, esi js loc_A18359 mov eax, [edx+8] mov edi, ebx mov [ebp+var_14], ebx test eax, eax jnz short loc_A17B22 loc_A17B1B: ; CODE XREF: sub_A17A38+EDj mov esi, 0C000000Dh jmp short loc_A17B9A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17B22: ; CODE XREF: sub_A17A38+E1j cmp dword ptr [edx], 4 jbe short loc_A17B1B loc_A17B27: ; CODE XREF: sub_A17A38+121j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17B34 xor esi, esi jmp short loc_A17B3C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17B34: ; CODE XREF: sub_A17A38+F6j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17B3C: ; CODE XREF: sub_A17A38+FAj mov [ebp+var_18], ecx test esi, esi js short loc_A17B80 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17B80 mov eax, [ebp+var_18] inc ebx cmp ebx, 4 jb short loc_A17B27 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17B68 xor esi, esi jmp short loc_A17B70 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17B68: ; CODE XREF: sub_A17A38+12Aj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17B70: ; CODE XREF: sub_A17A38+12Ej test esi, esi js short loc_A17B80 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A17B83 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17B80: ; CODE XREF: sub_A17A38+109j ; sub_A17A38+118j ... mov eax, [ebp+var_14] loc_A17B83: ; CODE XREF: sub_A17A38+146j test esi, esi js short loc_A17B95 cmp eax, 4 jnz loc_A17AED mov eax, [edi] mov [ebp+var_38], eax loc_A17B95: ; CODE XREF: sub_A17A38+14Dj mov edx, [ebp+var_4] xor ebx, ebx loc_A17B9A: ; CODE XREF: sub_A17A38+E8j test esi, esi js loc_A18359 and [ebp+var_24], 0 mov ecx, ebx mov eax, [edx+8] mov edi, ebx mov [ebp+var_14], ebx mov [ebp+var_4C], ecx test eax, eax jnz short loc_A17BC1 loc_A17BB7: ; CODE XREF: sub_A17A38+18Cj mov esi, 0C000000Dh jmp loc_A17C95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17BC1: ; CODE XREF: sub_A17A38+17Dj cmp dword ptr [edx], 5 jbe short loc_A17BB7 and [ebp+var_20], 0 loc_A17BCA: ; CODE XREF: sub_A17A38+1D2j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17BD7 xor esi, esi jmp short loc_A17BDF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17BD7: ; CODE XREF: sub_A17A38+199j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17BDF: ; CODE XREF: sub_A17A38+19Dj mov [ebp+var_18], ecx test esi, esi js loc_A17C92 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A17C92 mov edx, [ebp+var_20] mov eax, [ebp+var_18] inc edx mov [ebp+var_20], edx cmp edx, 5 jb short loc_A17BCA mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17C19 xor esi, esi jmp short loc_A17C21 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17C19: ; CODE XREF: sub_A17A38+1DBj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17C21: ; CODE XREF: sub_A17A38+1DFj test esi, esi js short loc_A17C92 mov edi, edx mov ebx, edx neg edi sbb edi, edi and edi, ecx test esi, esi js short loc_A17C92 test ebx, ebx jnz short loc_A17C5C loc_A17C37: ; CODE XREF: sub_A17A38+22Aj ; sub_A17A38+237j ... mov esi, 0C000003Eh loc_A17C3C: ; CODE XREF: sub_A17A38+28Bj test esi, esi js loc_A18359 loc_A17C44: ; CODE XREF: sub_A17A38+29Ej mov ebx, [ebp+var_4] mov eax, [ebx+8] test eax, eax jnz loc_A17CDB loc_A17C52: ; CODE XREF: sub_A17A38+2A6j ; sub_A17A38+322j ... mov esi, 0C000000Dh jmp loc_A18335 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17C5C: ; CODE XREF: sub_A17A38+1FDj test ebx, 1 jnz short loc_A17C37 mov eax, ebx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A17C37 lea eax, [ebp+var_24] mov edx, ebx push eax mov ecx, edi call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A17C37 mov ecx, [ebp+var_24] lea eax, [ecx+2] cmp eax, ebx jnz short loc_A17C37 mov ebx, edi shr ecx, 1 jmp short loc_A17C98 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17C92: ; CODE XREF: sub_A17A38+1ACj ; sub_A17A38+1BFj ... mov ecx, [ebp+var_4C] loc_A17C95: ; CODE XREF: sub_A17A38+184j mov ebx, [ebp+var_14] loc_A17C98: ; CODE XREF: sub_A17A38+258j test esi, esi js loc_A18359 lea edi, ds:2[ecx*2] test edi, edi jz short loc_A17C37 push 20534C53h push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A17CC8 mov esi, 0C0000017h jmp loc_A17C3C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17CC8: ; CODE XREF: sub_A17A38+284j push edi ; size_t push ebx ; void * push esi ; void * call _memcpy add esp, 0Ch mov [ebp+var_1C], esi jmp loc_A17C44 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17CDB: ; CODE XREF: sub_A17A38+214j cmp dword ptr [ebx], 6 jbe loc_A17C52 xor edi, edi loc_A17CE6: ; CODE XREF: sub_A17A38+2E8j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17CF3 xor esi, esi jmp short loc_A17CFB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17CF3: ; CODE XREF: sub_A17A38+2B5j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17CFB: ; CODE XREF: sub_A17A38+2B9j mov [ebp+var_18], ecx test esi, esi js loc_A18335 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov eax, [ebp+var_18] inc edi cmp edi, 6 jb short loc_A17CE6 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17D2F xor esi, esi jmp short loc_A17D37 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17D2F: ; CODE XREF: sub_A17A38+2F1j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17D37: ; CODE XREF: sub_A17A38+2F5j test esi, esi js loc_A18335 mov eax, edx mov [ebp+var_30], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_34], eax test esi, esi js loc_A18335 mov eax, [ebx+8] test eax, eax jz loc_A17C52 cmp dword ptr [ebx], 7 jbe loc_A17C52 xor edi, edi loc_A17D6B: ; CODE XREF: sub_A17A38+36Dj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17D78 xor esi, esi jmp short loc_A17D80 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17D78: ; CODE XREF: sub_A17A38+33Aj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17D80: ; CODE XREF: sub_A17A38+33Ej mov [ebp+var_18], ecx test esi, esi js loc_A18335 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov eax, [ebp+var_18] inc edi cmp edi, 7 jb short loc_A17D6B mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17DB4 xor esi, esi jmp short loc_A17DBC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17DB4: ; CODE XREF: sub_A17A38+376j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17DBC: ; CODE XREF: sub_A17A38+37Aj test esi, esi js loc_A18335 mov eax, edx mov [ebp+var_28], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_2C], eax test esi, esi js loc_A18335 mov eax, [ebx+8] xor edi, edi and [ebp+var_14], edi test eax, eax jnz short loc_A17DF2 loc_A17DE6: ; CODE XREF: sub_A17A38+3BDj mov esi, 0C000000Dh mov ebx, edi jmp loc_A17E72 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17DF2: ; CODE XREF: sub_A17A38+3ACj cmp dword ptr [ebx], 8 jbe short loc_A17DE6 xor ebx, ebx loc_A17DF9: ; CODE XREF: sub_A17A38+3F3j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17E06 xor esi, esi jmp short loc_A17E0E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17E06: ; CODE XREF: sub_A17A38+3C8j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17E0E: ; CODE XREF: sub_A17A38+3CCj mov [ebp+var_18], ecx test esi, esi js short loc_A17E52 lea eax, [ebp+var_18] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17E52 mov eax, [ebp+var_18] inc ebx cmp ebx, 8 jb short loc_A17DF9 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17E3A xor esi, esi jmp short loc_A17E42 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17E3A: ; CODE XREF: sub_A17A38+3FCj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17E42: ; CODE XREF: sub_A17A38+400j test esi, esi js short loc_A17E52 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A17E55 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17E52: ; CODE XREF: sub_A17A38+3DBj ; sub_A17A38+3EAj ... mov eax, [ebp+var_14] loc_A17E55: ; CODE XREF: sub_A17A38+418j test esi, esi js short loc_A17E6F cmp eax, 4 jz short loc_A17E68 loc_A17E5E: ; CODE XREF: sub_A17A38+6BCj ; sub_A17A38+75Dj ... mov esi, 0C0000023h jmp loc_A18335 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17E68: ; CODE XREF: sub_A17A38+424j mov ebx, [edi] mov [ebp+var_8], ebx jmp short loc_A17E72 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17E6F: ; CODE XREF: sub_A17A38+41Fj mov ebx, [ebp+var_8] loc_A17E72: ; CODE XREF: sub_A17A38+3B5j ; sub_A17A38+435j test esi, esi js loc_A18335 xor esi, esi test ebx, ebx jz short loc_A17EAE push 20534C53h push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov ecx, eax mov [ebp+var_10], ecx test ecx, ecx jnz short loc_A17EA0 mov esi, 0C0000017h jmp loc_A18335 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17EA0: ; CODE XREF: sub_A17A38+45Cj push ebx ; size_t push 0 ; int push ecx ; void * call _memset add esp, 0Ch jmp short loc_A17EAF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17EAE: ; CODE XREF: sub_A17A38+446j inc esi loc_A17EAF: ; CODE XREF: sub_A17A38+474j mov eax, ds:dword_A93E88 test eax, eax jz short loc_A17EDD neg esi lea ecx, [ebp+var_48] push ecx push ebx sbb esi, esi not esi and esi, [ebp+var_10] push esi push [ebp+var_28] push [ebp+var_2C] push [ebp+var_30] push [ebp+var_34] push [ebp+var_1C] push [ebp+var_38] call eax jmp short loc_A17EE2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17EDD: ; CODE XREF: sub_A17A38+47Ej mov eax, 0C00000BBh loc_A17EE2: ; CODE XREF: sub_A17A38+4A3j and [ebp+var_4], 0 mov [ebp+var_14], eax lea eax, [ebp+var_4] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17F4E mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17F4E lea edx, [ebx+4] cmp edx, 4 jb short loc_A17F49 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17F4E mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A17F4E mov eax, [ebp+var_4] mov [ebp+var_C], eax jmp short loc_A17F51 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17F49: ; CODE XREF: sub_A17A38+4E0j mov esi, 0C0000095h loc_A17F4E: ; CODE XREF: sub_A17A38+4C3j ; sub_A17A38+4D8j ... mov eax, [ebp+var_C] loc_A17F51: ; CODE XREF: sub_A17A38+50Fj test esi, esi js loc_A18335 xor edi, edi mov [ebp+var_3C], 8 lea ecx, [ebp+var_3C] mov edx, eax push ecx push 8 pop ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov eax, [ebp+var_3C] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A17F8E mov esi, 0C0000095h jmp short loc_A17F9B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17F8E: ; CODE XREF: sub_A17A38+54Dj lea edi, [ecx+8] cmp edi, ecx jb loc_A1801A xor esi, esi loc_A17F9B: ; CODE XREF: sub_A17A38+554j test esi, esi js loc_A18335 mov ebx, [ebp+var_50] mov edx, edi push 4 pop ecx mov [ebp+var_4], ecx mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_50], eax lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A17FD8 xor esi, esi jmp short loc_A17FE0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A17FD8: ; CODE XREF: sub_A17A38+59Aj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A17FE0: ; CODE XREF: sub_A17A38+59Ej mov [ebp+var_4], ecx test esi, esi js loc_A18335 lea eax, [ebp+var_4] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1801A mov edx, [ebp+var_50] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A1801F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1801A: ; CODE XREF: sub_A17A38+55Bj ; sub_A17A38+5D0j mov esi, 0C0000095h loc_A1801F: ; CODE XREF: sub_A17A38+5E0j test esi, esi js loc_A18335 mov edi, [ebp+arg_4] test edi, edi jz loc_A17C52 mov eax, [ebp+var_C] lea ebx, [edi+4] xor esi, esi mov [ebx], eax test eax, eax jnz short loc_A18047 mov esi, 0C000003Eh jmp short loc_A18064 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18047: ; CODE XREF: sub_A17A38+606j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A1805F mov esi, 0C0000017h jmp short loc_A18064 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1805F: ; CODE XREF: sub_A17A38+61Ej mov [edi+8], eax and [edi], esi loc_A18064: ; CODE XREF: sub_A17A38+60Dj ; sub_A17A38+625j test esi, esi js loc_A18335 mov eax, [edi+8] or [ebp+var_14], 10000000h mov [ebp+var_4C], eax test eax, eax jnz short loc_A18096 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 inc dword ptr [edi] jmp short loc_A18110 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18096: ; CODE XREF: sub_A17A38+643j mov ecx, [edi] mov edx, eax and [ebp+var_38], 0 mov [ebp+arg_4], edx mov [ebp+var_50], ecx test ecx, ecx jz short loc_A180DE loc_A180A8: ; CODE XREF: sub_A17A38+6A1j mov edx, [edx] add edx, 4 cmp edx, 4 jb loc_A18136 mov ecx, [ebp+arg_4] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov ecx, [ebp+var_38] mov edx, [ebp+arg_4] inc ecx mov [ebp+var_38], ecx cmp ecx, [ebp+var_50] jb short loc_A180A8 mov eax, [ebp+var_4C] loc_A180DE: ; CODE XREF: sub_A17A38+66Ej lea ecx, [edx+4] cmp ecx, edx jb loc_A18330 mov ecx, [ebx] xor esi, esi add ecx, eax lea eax, [edx+8] cmp eax, ecx ja loc_A17E5E mov eax, [ebp+var_14] mov dword ptr [edx], 4 mov [edx+4], eax inc dword ptr [edi] loc_A18108: ; CODE XREF: sub_A17A38+703j test esi, esi js loc_A18335 loc_A18110: ; CODE XREF: sub_A17A38+65Cj mov eax, [edi+8] mov [ebp+var_4C], eax test eax, eax jnz short loc_A1813D mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 inc dword ptr [edi] jmp loc_A181B9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18136: ; CODE XREF: sub_A17A38+678j mov esi, 0C0000095h jmp short loc_A18108 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1813D: ; CODE XREF: sub_A17A38+6E0j and [ebp+var_38], 0 mov ebx, eax mov eax, [edi] mov [ebp+arg_4], ebx mov [ebp+var_50], eax test eax, eax jz short loc_A1817D loc_A1814F: ; CODE XREF: sub_A17A38+743j mov edx, [ebx] add edx, 4 cmp edx, 4 jb loc_A18208 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A181AE mov ecx, [ebp+var_38] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_38], ecx cmp ecx, [ebp+var_50] jb short loc_A1814F loc_A1817D: ; CODE XREF: sub_A17A38+715j lea edx, [ebx+4] cmp edx, ebx jb loc_A18330 mov ecx, [edi+4] lea eax, [ebx+0Ch] add ecx, [ebp+var_4C] xor esi, esi cmp eax, ecx ja loc_A17E5E mov eax, [ebp+var_40] mov dword ptr [ebx], 8 mov [edx], eax mov eax, [ebp+var_44] mov [edx+4], eax inc dword ptr [edi] loc_A181AE: ; CODE XREF: sub_A17A38+734j ; sub_A17A38+7D5j lea ebx, [edi+4] test esi, esi js loc_A18335 loc_A181B9: ; CODE XREF: sub_A17A38+6F9j cmp [ebp+var_10], 0 mov eax, [ebp+var_8] jnz short loc_A1820F test eax, eax jz short loc_A18213 loc_A181C6: ; CODE XREF: sub_A17A38+7D9j mov esi, 0C000000Dh loc_A181CB: ; CODE XREF: sub_A17A38+808j ; sub_A17A38+88Bj test esi, esi js loc_A18335 lea ebx, [edi+4] loc_A181D6: ; CODE XREF: sub_A17A38+801j mov edx, [edi+8] mov eax, [ebp+var_48] mov [ebp+var_40], eax mov [ebp+var_4C], edx test edx, edx jnz loc_A182C8 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 inc dword ptr [edi] xor esi, esi jmp loc_A18335 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18208: ; CODE XREF: sub_A17A38+71Fj mov esi, 0C0000095h jmp short loc_A181AE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1820F: ; CODE XREF: sub_A17A38+788j test eax, eax jz short loc_A181C6 loc_A18213: ; CODE XREF: sub_A17A38+78Cj mov edx, [edi+8] mov [ebp+var_4C], edx test edx, edx jnz short loc_A18242 lea edx, [eax+4] cmp edx, 4 jb short loc_A1823B mov ecx, [ebx] push ebx call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 inc dword ptr [edi] jmp short loc_A181D6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1823B: ; CODE XREF: sub_A17A38+7EBj ; sub_A17A38+824j mov esi, 0C0000095h jmp short loc_A181CB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18242: ; CODE XREF: sub_A17A38+7E3j mov eax, [edi] mov ebx, edx and [ebp+var_44], 0 mov [ebp+arg_4], ebx mov [ebp+var_50], eax test eax, eax jz short loc_A18285 loc_A18254: ; CODE XREF: sub_A17A38+848j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A1823B lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18335 mov ecx, [ebp+var_44] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_44], ecx cmp ecx, [ebp+var_50] jb short loc_A18254 mov edx, [ebp+var_4C] loc_A18285: ; CODE XREF: sub_A17A38+81Aj lea eax, [ebx+4] cmp eax, ebx jb loc_A18330 mov ecx, [ebp+var_8] xor esi, esi mov eax, [edi+4] add ecx, 4 add ecx, ebx add eax, edx cmp ecx, eax ja loc_A17E5E mov ecx, [ebp+var_10] mov eax, [ebp+var_8] mov [ebx], eax test ecx, ecx jz short loc_A182C1 push eax ; size_t push ecx ; void * lea eax, [ebx+4] push eax ; void * call _memcpy add esp, 0Ch loc_A182C1: ; CODE XREF: sub_A17A38+879j inc dword ptr [edi] jmp loc_A181CB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A182C8: ; CODE XREF: sub_A17A38+7ACj mov eax, [edi] mov ebx, edx and [ebp+var_44], 0 mov [ebp+arg_4], ebx mov [ebp+var_50], eax test eax, eax jz short loc_A18307 loc_A182DA: ; CODE XREF: sub_A17A38+8CAj mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A18330 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18335 mov ecx, [ebp+var_44] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_44], ecx cmp ecx, [ebp+var_50] jb short loc_A182DA mov edx, [ebp+var_4C] loc_A18307: ; CODE XREF: sub_A17A38+8A0j lea eax, [ebx+4] cmp eax, ebx jb short loc_A18330 mov ecx, [edi+4] lea eax, [ebx+8] add ecx, edx xor esi, esi cmp eax, ecx ja loc_A17E5E mov eax, [ebp+var_40] mov dword ptr [ebx], 4 mov [ebx+4], eax inc dword ptr [edi] jmp short loc_A18335 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18330: ; CODE XREF: sub_A17A38+6ABj ; sub_A17A38+74Aj ... mov esi, 0C0000095h loc_A18335: ; CODE XREF: sub_A17A38+21Fj ; sub_A17A38+2C8j ... mov eax, [ebp+var_1C] test eax, eax jz short loc_A18347 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A18347: ; CODE XREF: sub_A17A38+902j mov eax, [ebp+var_10] test eax, eax jz short loc_A18359 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A18359: ; CODE XREF: sub_A17A38+BAj ; sub_A17A38+D1j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A17A38 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A18362 proc near ; CODE XREF: sub_785212+19CDp var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 24h and [ebp+var_8], 0 and [ebp+var_1C], 0 and [ebp+var_20], 0 and [ebp+var_10], 0 mov eax, [ecx+8] push ebx push esi push edi xor edi, edi mov [ebp+var_24], edx and [ebp+var_4], edi mov [ebp+var_14], ecx test eax, eax jnz short loc_A18399 loc_A1838F: ; CODE XREF: sub_A18362+3Aj mov esi, 0C000000Dh jmp loc_A1841D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18399: ; CODE XREF: sub_A18362+2Bj cmp dword ptr [ecx], 3 jbe short loc_A1838F xor ebx, ebx loc_A183A0: ; CODE XREF: sub_A18362+70j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A183AD xor esi, esi jmp short loc_A183B5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A183AD: ; CODE XREF: sub_A18362+45j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A183B5: ; CODE XREF: sub_A18362+49j mov [ebp+var_C], ecx test esi, esi js short loc_A183F9 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A183F9 mov eax, [ebp+var_C] inc ebx cmp ebx, 3 jb short loc_A183A0 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A183E1 xor esi, esi jmp short loc_A183E9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A183E1: ; CODE XREF: sub_A18362+79j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A183E9: ; CODE XREF: sub_A18362+7Dj test esi, esi js short loc_A183F9 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A183FC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A183F9: ; CODE XREF: sub_A18362+58j ; sub_A18362+67j ... mov eax, [ebp+var_4] loc_A183FC: ; CODE XREF: sub_A18362+95j test esi, esi js short loc_A1841A cmp eax, 8 jz short loc_A1840F loc_A18405: ; CODE XREF: sub_A18362+164j mov esi, 0C0000023h jmp loc_A18938 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1840F: ; CODE XREF: sub_A18362+A1j mov eax, [edi] mov [ebp+var_1C], eax mov eax, [edi+4] mov [ebp+var_20], eax loc_A1841A: ; CODE XREF: sub_A18362+9Cj mov ecx, [ebp+var_14] loc_A1841D: ; CODE XREF: sub_A18362+32j test esi, esi js loc_A18938 mov eax, [ecx+8] xor edi, edi and [ebp+var_4], edi test eax, eax jnz short loc_A18458 loc_A18431: ; CODE XREF: sub_A18362+F9j mov esi, 0C000000Dh loc_A18436: ; CODE XREF: sub_A18362+15Bj mov eax, [ebp+var_10] loc_A18439: ; CODE XREF: sub_A18362+16Cj test esi, esi js loc_A18938 mov ecx, 1008h cmp eax, ecx jz loc_A184D3 mov esi, 0C000003Eh jmp loc_A18938 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18458: ; CODE XREF: sub_A18362+CDj cmp dword ptr [ecx], 4 jbe short loc_A18431 xor ebx, ebx loc_A1845F: ; CODE XREF: sub_A18362+12Fj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1846C xor esi, esi jmp short loc_A18474 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1846C: ; CODE XREF: sub_A18362+104j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18474: ; CODE XREF: sub_A18362+108j mov [ebp+var_C], ecx test esi, esi js short loc_A184B8 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A184B8 mov eax, [ebp+var_C] inc ebx cmp ebx, 4 jb short loc_A1845F mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A184A0 xor esi, esi jmp short loc_A184A8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A184A0: ; CODE XREF: sub_A18362+138j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A184A8: ; CODE XREF: sub_A18362+13Cj test esi, esi js short loc_A184B8 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A184BB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A184B8: ; CODE XREF: sub_A18362+117j ; sub_A18362+126j ... mov eax, [ebp+var_4] loc_A184BB: ; CODE XREF: sub_A18362+154j test esi, esi js loc_A18436 cmp eax, 4 jnz loc_A18405 mov eax, [edi] jmp loc_A18439 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A184D3: ; CODE XREF: sub_A18362+E6j push 20534C53h push ecx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov ecx, eax mov [ebp+var_10], ecx test ecx, ecx jnz short loc_A184F3 mov esi, 0C0000017h jmp loc_A18938 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A184F3: ; CODE XREF: sub_A18362+185j mov eax, ds:dword_A93E5C test eax, eax jz short loc_A18501 push ecx call eax jmp short loc_A18506 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18501: ; CODE XREF: sub_A18362+198j mov eax, 0C00000BBh loc_A18506: ; CODE XREF: sub_A18362+19Dj mov [ebp+var_C], eax mov esi, eax test eax, eax js loc_A1892B and [ebp+var_4], 0 lea eax, [ebp+var_4] xor ecx, ecx push eax push 8 pop ebx mov edx, ebx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18575 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18575 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax mov edx, 100Ch call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18575 mov ecx, [ebp+var_4] lea eax, [ebp+var_4] push eax mov edx, ebx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18575 mov eax, [ebp+var_4] mov [ebp+var_8], eax jmp short loc_A18578 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18575: ; CODE XREF: sub_A18362+1C9j ; sub_A18362+1DEj ... mov eax, [ebp+var_8] loc_A18578: ; CODE XREF: sub_A18362+211j test esi, esi js loc_A1892B xor edi, edi mov [ebp+var_18], ebx lea ecx, [ebp+var_18] mov edx, eax push ecx mov ecx, ebx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B mov eax, [ebp+var_18] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A185B0 mov esi, 0C0000095h jmp short loc_A185BD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A185B0: ; CODE XREF: sub_A18362+245j lea edi, [ecx+8] cmp edi, ecx jb loc_A1863C xor esi, esi loc_A185BD: ; CODE XREF: sub_A18362+24Cj test esi, esi js loc_A1892B mov ebx, [ebp+var_24] mov edx, edi push 4 pop ecx mov [ebp+var_4], ecx mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_24], eax lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A185FA xor esi, esi jmp short loc_A18602 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A185FA: ; CODE XREF: sub_A18362+292j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18602: ; CODE XREF: sub_A18362+296j mov [ebp+var_4], ecx test esi, esi js loc_A1892B lea eax, [ebp+var_4] mov edx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1863C mov edx, [ebp+var_24] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A18641 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1863C: ; CODE XREF: sub_A18362+253j ; sub_A18362+2C8j mov esi, 0C0000095h loc_A18641: ; CODE XREF: sub_A18362+2D8j test esi, esi js loc_A1892B mov edi, [ebp+arg_4] test edi, edi jnz short loc_A1865A mov esi, 0C000000Dh jmp loc_A1892B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1865A: ; CODE XREF: sub_A18362+2ECj mov eax, [ebp+var_8] lea ebx, [edi+4] xor esi, esi mov [ebx], eax test eax, eax jnz short loc_A1866F mov esi, 0C000003Eh jmp short loc_A1868C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1866F: ; CODE XREF: sub_A18362+304j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A18687 mov esi, 0C0000017h jmp short loc_A1868C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18687: ; CODE XREF: sub_A18362+31Cj mov [edi+8], eax and [edi], esi loc_A1868C: ; CODE XREF: sub_A18362+30Bj ; sub_A18362+323j test esi, esi js loc_A1892B mov eax, [edi+8] or [ebp+var_C], 10000000h mov [ebp+var_8], eax test eax, eax jnz short loc_A186C1 mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B inc dword ptr [edi] jmp loc_A18742 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A186C1: ; CODE XREF: sub_A18362+341j mov ecx, [edi] mov ebx, eax and [ebp+var_14], 0 mov [ebp+arg_4], ebx mov [ebp+var_24], ecx test ecx, ecx jz short loc_A18700 loc_A186D3: ; CODE XREF: sub_A18362+399j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A18723 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18737 mov ecx, [ebp+var_14] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_24] jb short loc_A186D3 mov eax, [ebp+var_8] loc_A18700: ; CODE XREF: sub_A18362+36Fj lea edx, [ebx+4] cmp edx, ebx jb loc_A18926 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+8] cmp eax, ecx jbe short loc_A1872A loc_A18719: ; CODE XREF: sub_A18362+45Dj ; sub_A18362+50Dj ... mov esi, 0C0000023h jmp loc_A1892B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18723: ; CODE XREF: sub_A18362+379j mov esi, 0C0000095h jmp short loc_A18737 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1872A: ; CODE XREF: sub_A18362+3B5j mov eax, [ebp+var_C] mov dword ptr [ebx], 4 mov [edx], eax inc dword ptr [edi] loc_A18737: ; CODE XREF: sub_A18362+38Aj ; sub_A18362+3C6j lea ebx, [edi+4] test esi, esi js loc_A1892B loc_A18742: ; CODE XREF: sub_A18362+35Aj mov eax, [edi+8] mov [ebp+var_C], eax test eax, eax jnz short loc_A18765 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B inc dword ptr [edi] jmp short loc_A187E3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18765: ; CODE XREF: sub_A18362+3E8j mov ecx, [edi] mov ebx, eax and [ebp+var_14], 0 mov [ebp+arg_4], ebx mov [ebp+var_24], ecx test ecx, ecx jz short loc_A187A8 loc_A18777: ; CODE XREF: sub_A18362+441j mov edx, [ebx] add edx, 4 cmp edx, 4 jb loc_A1880B lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A187D8 mov ecx, [ebp+var_14] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_24] jb short loc_A18777 mov eax, [ebp+var_C] loc_A187A8: ; CODE XREF: sub_A18362+413j lea edx, [ebx+4] cmp edx, ebx jb loc_A18926 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+0Ch] cmp eax, ecx ja loc_A18719 mov eax, [ebp+var_1C] mov dword ptr [ebx], 8 mov [edx], eax mov eax, [ebp+var_20] mov [edx+4], eax inc dword ptr [edi] loc_A187D8: ; CODE XREF: sub_A18362+432j ; sub_A18362+4AEj lea ebx, [edi+4] test esi, esi js loc_A1892B loc_A187E3: ; CODE XREF: sub_A18362+401j mov eax, [edi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A18812 mov ecx, [ebx] mov edx, 100Ch push ebx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1892B inc dword ptr [edi] jmp loc_A18896 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1880B: ; CODE XREF: sub_A18362+41Dj mov esi, 0C0000095h jmp short loc_A187D8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18812: ; CODE XREF: sub_A18362+489j mov ecx, [edi] mov ebx, eax and [ebp+var_20], 0 mov [ebp+arg_4], ebx mov [ebp+var_24], ecx test ecx, ecx jz short loc_A18855 loc_A18824: ; CODE XREF: sub_A18362+4EEj mov edx, [ebx] add edx, 4 cmp edx, 4 jb loc_A188B7 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1888B mov ecx, [ebp+var_20] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_20], ecx cmp ecx, [ebp+var_24] jb short loc_A18824 mov eax, [ebp+var_1C] loc_A18855: ; CODE XREF: sub_A18362+4C0j lea edx, [ebx+4] cmp edx, ebx jb loc_A18926 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+100Ch] cmp eax, ecx ja loc_A18719 mov eax, 1008h push eax ; size_t push [ebp+var_10] ; void * mov [ebx], eax push edx ; void * call _memcpy add esp, 0Ch inc dword ptr [edi] loc_A1888B: ; CODE XREF: sub_A18362+4DFj ; sub_A18362+55Aj lea ebx, [edi+4] test esi, esi js loc_A1892B loc_A18896: ; CODE XREF: sub_A18362+4A4j mov eax, [edi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A188BE mov ecx, [ebx] push ebx push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1892B inc dword ptr [edi] xor esi, esi jmp short loc_A1892B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A188B7: ; CODE XREF: sub_A18362+4CAj mov esi, 0C0000095h jmp short loc_A1888B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A188BE: ; CODE XREF: sub_A18362+53Cj mov ecx, [edi] mov ebx, eax and [ebp+var_20], 0 mov [ebp+arg_4], ebx mov [ebp+var_24], ecx test ecx, ecx jz short loc_A188FD loc_A188D0: ; CODE XREF: sub_A18362+596j mov edx, [ebx] add edx, 4 cmp edx, 4 jb short loc_A18926 lea eax, [ebp+arg_4] mov ecx, ebx push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1892B mov ecx, [ebp+var_20] mov ebx, [ebp+arg_4] inc ecx mov [ebp+var_20], ecx cmp ecx, [ebp+var_24] jb short loc_A188D0 mov eax, [ebp+var_1C] loc_A188FD: ; CODE XREF: sub_A18362+56Cj lea edx, [ebx+4] cmp edx, ebx jb short loc_A18926 mov ecx, [edi+4] xor esi, esi add ecx, eax lea eax, [ebx+8] cmp eax, ecx ja loc_A18719 mov dword ptr [ebx], 4 mov dword ptr [edx], 1008h inc dword ptr [edi] jmp short loc_A1892B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18926: ; CODE XREF: sub_A18362+3A3j ; sub_A18362+44Bj ... mov esi, 0C0000095h loc_A1892B: ; CODE XREF: sub_A18362+1ABj ; sub_A18362+218j ... push 20534C53h push [ebp+var_10] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A18938: ; CODE XREF: sub_A18362+A8j ; sub_A18362+BDj ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A18362 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A18941 proc near ; CODE XREF: sub_785212+1A06p mov edi, edi mov eax, 0C0000002h retn 8 sub_A18941 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1894B proc near ; CODE XREF: sub_785212+14B5p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 24h and [ebp+var_10], 0 mov eax, edx and [ebp+var_14], 0 push ebx xor ebx, ebx mov [ebp+var_24], eax mov [ebp+var_4], ebx push esi push edi test ecx, ecx jnz short loc_A18976 loc_A1896C: ; CODE XREF: sub_A1894B+2Dj ; sub_A1894B+34j mov edx, 0C000000Dh jmp loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18976: ; CODE XREF: sub_A1894B+1Fj test eax, eax jz short loc_A1896C mov edi, [ebp+arg_4] test edi, edi jz short loc_A1896C and [ebp+var_8], ebx xor esi, esi mov eax, [ecx+8] test eax, eax jnz short loc_A18997 loc_A1898D: ; CODE XREF: sub_A1894B+4Fj mov edx, 0C000000Dh jmp loc_A18A21 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18997: ; CODE XREF: sub_A1894B+40j cmp dword ptr [ecx], 3 jbe short loc_A1898D xor ebx, ebx loc_A1899E: ; CODE XREF: sub_A1894B+8Bj mov ecx, [eax] mov [ebp+var_1C], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A189AE xor edx, edx jmp short loc_A189B6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A189AE: ; CODE XREF: sub_A1894B+5Dj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A189B6: ; CODE XREF: sub_A1894B+61j mov [ebp+arg_4], ecx test edx, edx js short loc_A189FD mov edx, [ebp+var_1C] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A189FD mov eax, [ebp+arg_4] inc ebx cmp ebx, 3 jb short loc_A1899E mov ebx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A189E5 xor edx, edx jmp short loc_A189ED ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A189E5: ; CODE XREF: sub_A1894B+94j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A189ED: ; CODE XREF: sub_A1894B+98j test edx, edx js short loc_A189FD mov esi, ebx mov eax, ebx neg esi sbb esi, esi and esi, ecx jmp short loc_A18A00 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A189FD: ; CODE XREF: sub_A1894B+70j ; sub_A1894B+82j ... mov eax, [ebp+var_8] loc_A18A00: ; CODE XREF: sub_A1894B+B0j test edx, edx js short loc_A18A1E cmp eax, 8 jz short loc_A18A13 loc_A18A09: ; CODE XREF: sub_A1894B+2AFj ; sub_A1894B+333j mov edx, 0C0000023h jmp loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18A13: ; CODE XREF: sub_A1894B+BCj mov eax, [esi] mov [ebp+var_10], eax mov eax, [esi+4] mov [ebp+var_14], eax loc_A18A1E: ; CODE XREF: sub_A1894B+B7j mov ebx, [ebp+var_4] loc_A18A21: ; CODE XREF: sub_A1894B+47j test edx, edx js loc_A18C9F or [ebp+var_1C], 0FFFFFFFFh lea eax, [ebp+var_20] push eax xor esi, esi mov [ebp+var_20], 0EFE82080h push esi push 1 push 6 push offset unk_6B72E0 call KeWaitForSingleObject test eax, eax js short loc_A18AC3 cmp eax, 0C0h jz short loc_A18AC3 cmp eax, 102h jz short loc_A18AC3 cmp dword_6B72C4, esi jnz short loc_A18A6B cmp ds:dword_A93F64, esi jnz short loc_A18AB8 loc_A18A6B: ; CODE XREF: sub_A1894B+116j lea eax, [ebp+var_20] mov [ebp+var_20], esi push eax mov [ebp+var_1C], esi call KeQueryTickCount call _KeQueryTimeIncrement@0 ; KeQueryTimeIncrement() push [ebp+var_1C] push [ebp+var_20] push esi push eax call __allmul push esi push 2710h push edx push eax call __alldiv push offset unk_6B72C0 mov ds:dword_A93F20, eax mov ds:dword_A93F24, edx mov ds:dword_A93F64, 1 call _KeResetEvent@4 ; KeResetEvent(x) loc_A18AB8: ; CODE XREF: sub_A1894B+11Ej push esi push offset unk_6B72E0 call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) loc_A18AC3: ; CODE XREF: sub_A1894B+100j ; sub_A1894B+107j ... push 8 pop ecx mov [ebp+arg_4], ecx lea eax, [ebp+arg_4] push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A18C9F mov ebx, [ebp+arg_4] mov [ebp+var_4], ebx push 8 pop ecx mov [ebp+var_C], ecx lea eax, [ebp+var_C] mov edx, ebx push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A18C9F mov eax, [ebp+var_C] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A18B14 mov edx, 0C0000095h jmp short loc_A18B21 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18B14: ; CODE XREF: sub_A1894B+1C0j lea esi, [ecx+8] cmp esi, ecx jb loc_A18BA0 xor edx, edx loc_A18B21: ; CODE XREF: sub_A1894B+1C7j test edx, edx js loc_A18C9F mov ebx, [ebp+var_24] mov edx, esi push 4 pop ecx mov [ebp+arg_4], ecx mov eax, [ebx+10h] mov ebx, [ebx+8] mov [ebp+var_24], eax lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A18C9F mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18B5E xor edx, edx jmp short loc_A18B66 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18B5E: ; CODE XREF: sub_A1894B+20Dj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A18B66: ; CODE XREF: sub_A1894B+211j mov [ebp+arg_4], ecx test edx, edx js loc_A18C9F lea eax, [ebp+arg_4] mov edx, ebx push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A18C9F mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18BA0 mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax jmp short loc_A18BA5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18BA0: ; CODE XREF: sub_A1894B+1CEj ; sub_A1894B+243j mov edx, 0C0000095h loc_A18BA5: ; CODE XREF: sub_A1894B+253j test edx, edx js loc_A18C9F mov eax, [ebp+var_4] lea ebx, [edi+4] mov [ebx], eax test eax, eax jnz short loc_A18BC3 mov edx, 0C000003Eh jmp loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18BC3: ; CODE XREF: sub_A1894B+26Cj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A18BE0 mov edx, 0C0000017h jmp loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18BE0: ; CODE XREF: sub_A1894B+289j mov [edi+8], edx and dword ptr [edi], 0 lea esi, [edx+4] cmp esi, edx jb loc_A18C9A mov ecx, [ebx] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A18A09 mov dword ptr [edx], 4 mov dword ptr [esi], 10000000h inc dword ptr [edi] mov ecx, [edi] mov [ebp+var_24], ecx mov eax, [edi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A18C34 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A18C9F inc dword ptr [edi] xor edx, edx jmp short loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18C34: ; CODE XREF: sub_A1894B+2D0j and [ebp+var_8], 0 mov esi, eax mov [ebp+arg_4], esi test ecx, ecx jz short loc_A18C6B loc_A18C41: ; CODE XREF: sub_A1894B+31Ej mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A18C9A lea eax, [ebp+arg_4] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A18C9F mov ecx, [ebp+var_8] mov esi, [ebp+arg_4] inc ecx mov [ebp+var_8], ecx cmp ecx, [ebp+var_24] jb short loc_A18C41 loc_A18C6B: ; CODE XREF: sub_A1894B+2F4j lea eax, [esi+4] cmp eax, esi jb short loc_A18C9A mov ecx, [ebx] lea eax, [esi+0Ch] add ecx, [ebp+var_1C] xor edx, edx cmp eax, ecx ja loc_A18A09 mov eax, [ebp+var_10] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_14] mov [esi+8], eax inc dword ptr [edi] jmp short loc_A18C9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18C9A: ; CODE XREF: sub_A1894B+2A0j ; sub_A1894B+2FEj ... mov edx, 0C0000095h loc_A18C9F: ; CODE XREF: sub_A1894B+26j ; sub_A1894B+C3j ... pop edi pop esi mov eax, edx pop ebx leave retn 8 sub_A1894B endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A18CA8 proc near ; CODE XREF: sub_785212+19E0p var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 54h push ebx xor ebx, ebx mov eax, edx mov [ebp+var_50], eax mov edx, ecx mov [ebp+var_4], edx mov [ebp+var_18], ebx mov [ebp+var_44], ebx mov [ebp+var_48], ebx mov [ebp+var_1C], ebx mov [ebp+var_20], ebx mov [ebp+var_38], ebx mov [ebp+var_34], ebx mov [ebp+var_30], ebx mov [ebp+var_2C], ebx mov [ebp+var_10], ebx mov [ebp+var_3C], ebx push esi push edi test eax, eax jnz short loc_A18CEE loc_A18CE4: ; CODE XREF: sub_A18CA8+49j mov esi, 0C000000Dh jmp loc_A1945F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18CEE: ; CODE XREF: sub_A18CA8+3Aj cmp [ebp+arg_4], ebx jz short loc_A18CE4 mov eax, [edx+8] mov edi, ebx test eax, eax jnz short loc_A18D06 loc_A18CFC: ; CODE XREF: sub_A18CA8+61j mov esi, 0C000000Dh jmp loc_A18D89 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18D06: ; CODE XREF: sub_A18CA8+52j cmp dword ptr [edx], 3 jbe short loc_A18CFC loc_A18D0B: ; CODE XREF: sub_A18CA8+95j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18D18 xor esi, esi jmp short loc_A18D20 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18D18: ; CODE XREF: sub_A18CA8+6Aj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18D20: ; CODE XREF: sub_A18CA8+6Ej mov [ebp+var_8], ecx test esi, esi js short loc_A18D64 lea eax, [ebp+var_8] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18D64 mov eax, [ebp+var_8] inc ebx cmp ebx, 3 jb short loc_A18D0B mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18D4C xor esi, esi jmp short loc_A18D54 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18D4C: ; CODE XREF: sub_A18CA8+9Ej mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18D54: ; CODE XREF: sub_A18CA8+A2j test esi, esi js short loc_A18D64 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A18D66 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18D64: ; CODE XREF: sub_A18CA8+7Dj ; sub_A18CA8+8Cj ... mov eax, edi loc_A18D66: ; CODE XREF: sub_A18CA8+BAj test esi, esi js short loc_A18D84 cmp eax, 8 jz short loc_A18D79 loc_A18D6F: ; CODE XREF: sub_A18CA8+164j mov esi, 0C0000023h jmp loc_A1945F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18D79: ; CODE XREF: sub_A18CA8+C5j mov eax, [edi] mov [ebp+var_44], eax mov eax, [edi+4] mov [ebp+var_48], eax loc_A18D84: ; CODE XREF: sub_A18CA8+C0j mov edx, [ebp+var_4] xor ebx, ebx loc_A18D89: ; CODE XREF: sub_A18CA8+59j test esi, esi js loc_A1945F mov eax, [edx+8] mov edi, ebx mov [ebp+var_8], ebx test eax, eax jnz short loc_A18DA4 loc_A18D9D: ; CODE XREF: sub_A18CA8+FFj mov esi, 0C000000Dh jmp short loc_A18E1C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18DA4: ; CODE XREF: sub_A18CA8+F3j cmp dword ptr [edx], 4 jbe short loc_A18D9D loc_A18DA9: ; CODE XREF: sub_A18CA8+133j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18DB6 xor esi, esi jmp short loc_A18DBE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18DB6: ; CODE XREF: sub_A18CA8+108j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18DBE: ; CODE XREF: sub_A18CA8+10Cj mov [ebp+var_C], ecx test esi, esi js short loc_A18E02 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A18E02 mov eax, [ebp+var_C] inc ebx cmp ebx, 4 jb short loc_A18DA9 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18DEA xor esi, esi jmp short loc_A18DF2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18DEA: ; CODE XREF: sub_A18CA8+13Cj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18DF2: ; CODE XREF: sub_A18CA8+140j test esi, esi js short loc_A18E02 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A18E05 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18E02: ; CODE XREF: sub_A18CA8+11Bj ; sub_A18CA8+12Aj ... mov eax, [ebp+var_8] loc_A18E05: ; CODE XREF: sub_A18CA8+158j test esi, esi js short loc_A18E17 cmp eax, 4 jnz loc_A18D6F mov eax, [edi] mov [ebp+var_3C], eax loc_A18E17: ; CODE XREF: sub_A18CA8+15Fj mov edx, [ebp+var_4] xor ebx, ebx loc_A18E1C: ; CODE XREF: sub_A18CA8+FAj test esi, esi js loc_A1945F and [ebp+var_28], 0 mov ecx, ebx mov eax, [edx+8] mov edi, ebx mov [ebp+var_8], ebx mov [ebp+var_4C], ecx test eax, eax jnz short loc_A18E43 loc_A18E39: ; CODE XREF: sub_A18CA8+19Ej mov esi, 0C000000Dh jmp loc_A18F27 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18E43: ; CODE XREF: sub_A18CA8+18Fj cmp dword ptr [edx], 5 jbe short loc_A18E39 and [ebp+var_24], 0 loc_A18E4C: ; CODE XREF: sub_A18CA8+1E4j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18E59 xor esi, esi jmp short loc_A18E61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18E59: ; CODE XREF: sub_A18CA8+1ABj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18E61: ; CODE XREF: sub_A18CA8+1AFj mov [ebp+var_C], ecx test esi, esi js loc_A18F24 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A18F24 mov edx, [ebp+var_24] mov eax, [ebp+var_C] inc edx mov [ebp+var_24], edx cmp edx, 5 jb short loc_A18E4C mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18E9B xor esi, esi jmp short loc_A18EA3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18E9B: ; CODE XREF: sub_A18CA8+1EDj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18EA3: ; CODE XREF: sub_A18CA8+1F1j test esi, esi js short loc_A18F24 mov edi, edx mov ebx, edx neg edi sbb edi, edi and edi, ecx test esi, esi js short loc_A18F24 test ebx, ebx jnz short loc_A18EEE loc_A18EB9: ; CODE XREF: sub_A18CA8+24Cj ; sub_A18CA8+259j ... mov esi, 0C000003Eh loc_A18EBE: ; CODE XREF: sub_A18CA8+2B1j test esi, esi js loc_A1945F loc_A18EC6: ; CODE XREF: sub_A18CA8+2C4j mov edx, [ebp+var_4] xor ecx, ecx and [ebp+var_8], 0 xor edi, edi and [ebp+var_24], ecx xor ebx, ebx mov [ebp+var_4C], ecx mov eax, [edx+8] test eax, eax jnz loc_A18F71 loc_A18EE4: ; CODE XREF: sub_A18CA8+2CCj mov esi, 0C000000Dh jmp loc_A19048 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18EEE: ; CODE XREF: sub_A18CA8+20Fj test ebx, 1 jnz short loc_A18EB9 mov eax, ebx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A18EB9 lea eax, [ebp+var_28] mov edx, ebx push eax mov ecx, edi call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A18EB9 mov ecx, [ebp+var_28] lea eax, [ecx+2] cmp eax, ebx jnz short loc_A18EB9 mov ebx, edi shr ecx, 1 jmp short loc_A18F2A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18F24: ; CODE XREF: sub_A18CA8+1BEj ; sub_A18CA8+1D1j ... mov ecx, [ebp+var_4C] loc_A18F27: ; CODE XREF: sub_A18CA8+196j mov ebx, [ebp+var_8] loc_A18F2A: ; CODE XREF: sub_A18CA8+27Aj test esi, esi js loc_A1945F lea edi, ds:2[ecx*2] test edi, edi jz loc_A18EB9 push 20534C53h push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A18F5E mov esi, 0C0000017h jmp loc_A18EBE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18F5E: ; CODE XREF: sub_A18CA8+2AAj push edi ; size_t push ebx ; void * push esi ; void * call _memcpy add esp, 0Ch mov [ebp+var_1C], esi jmp loc_A18EC6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18F71: ; CODE XREF: sub_A18CA8+236j cmp dword ptr [edx], 6 jbe loc_A18EE4 and [ebp+var_28], ecx loc_A18F7D: ; CODE XREF: sub_A18CA8+315j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18F8A xor esi, esi jmp short loc_A18F92 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18F8A: ; CODE XREF: sub_A18CA8+2DCj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18F92: ; CODE XREF: sub_A18CA8+2E0j mov [ebp+var_C], ecx test esi, esi js loc_A19045 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A19045 mov edx, [ebp+var_28] mov eax, [ebp+var_C] inc edx mov [ebp+var_28], edx cmp edx, 6 jb short loc_A18F7D mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A18FCC xor esi, esi jmp short loc_A18FD4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A18FCC: ; CODE XREF: sub_A18CA8+31Ej mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A18FD4: ; CODE XREF: sub_A18CA8+322j test esi, esi js short loc_A19045 mov edi, edx mov ebx, edx neg edi sbb edi, edi and edi, ecx test esi, esi js short loc_A19045 test ebx, ebx jnz short loc_A1900F loc_A18FEA: ; CODE XREF: sub_A18CA8+36Dj ; sub_A18CA8+37Aj ... mov esi, 0C000003Eh loc_A18FEF: ; CODE XREF: sub_A18CA8+3CEj test esi, esi js loc_A1943B loc_A18FF7: ; CODE XREF: sub_A18CA8+3E1j mov ebx, [ebp+var_4] mov eax, [ebx+8] test eax, eax jnz loc_A1908E loc_A19005: ; CODE XREF: sub_A18CA8+3E9j ; sub_A18CA8+465j ... mov esi, 0C000000Dh jmp loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1900F: ; CODE XREF: sub_A18CA8+340j test ebx, 1 jnz short loc_A18FEA mov eax, ebx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A18FEA lea eax, [ebp+var_24] mov edx, ebx push eax mov ecx, edi call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A18FEA mov ecx, [ebp+var_24] lea eax, [ecx+2] cmp eax, ebx jnz short loc_A18FEA mov ebx, edi shr ecx, 1 jmp short loc_A1904B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19045: ; CODE XREF: sub_A18CA8+2EFj ; sub_A18CA8+302j ... mov ecx, [ebp+var_4C] loc_A19048: ; CODE XREF: sub_A18CA8+241j mov ebx, [ebp+var_8] loc_A1904B: ; CODE XREF: sub_A18CA8+39Bj test esi, esi js loc_A1943B lea edi, ds:2[ecx*2] test edi, edi jz short loc_A18FEA push 20534C53h push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jnz short loc_A1907B mov esi, 0C0000017h jmp loc_A18FEF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1907B: ; CODE XREF: sub_A18CA8+3C7j push edi ; size_t push ebx ; void * push esi ; void * call _memcpy add esp, 0Ch mov [ebp+var_20], esi jmp loc_A18FF7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1908E: ; CODE XREF: sub_A18CA8+357j cmp dword ptr [ebx], 7 jbe loc_A19005 xor edi, edi loc_A19099: ; CODE XREF: sub_A18CA8+42Bj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A190A6 xor esi, esi jmp short loc_A190AE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A190A6: ; CODE XREF: sub_A18CA8+3F8j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A190AE: ; CODE XREF: sub_A18CA8+3FCj mov [ebp+var_C], ecx test esi, esi js loc_A1943B lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1943B mov eax, [ebp+var_C] inc edi cmp edi, 7 jb short loc_A19099 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A190E2 xor esi, esi jmp short loc_A190EA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A190E2: ; CODE XREF: sub_A18CA8+434j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A190EA: ; CODE XREF: sub_A18CA8+438j test esi, esi js loc_A1943B mov eax, edx mov [ebp+var_34], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_38], eax test esi, esi js loc_A1943B mov eax, [ebx+8] test eax, eax jz loc_A19005 cmp dword ptr [ebx], 8 jbe loc_A19005 xor edi, edi loc_A1911E: ; CODE XREF: sub_A18CA8+4B0j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1912B xor esi, esi jmp short loc_A19133 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1912B: ; CODE XREF: sub_A18CA8+47Dj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A19133: ; CODE XREF: sub_A18CA8+481j mov [ebp+var_C], ecx test esi, esi js loc_A1943B lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1943B mov eax, [ebp+var_C] inc edi cmp edi, 8 jb short loc_A1911E mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19167 xor esi, esi jmp short loc_A1916F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19167: ; CODE XREF: sub_A18CA8+4B9j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1916F: ; CODE XREF: sub_A18CA8+4BDj test esi, esi js loc_A1943B mov eax, edx mov [ebp+var_2C], edx neg eax sbb eax, eax and eax, ecx mov [ebp+var_30], eax test esi, esi js loc_A1943B mov eax, [ebx+8] test eax, eax jz loc_A19005 cmp dword ptr [ebx], 9 jbe loc_A19005 xor edi, edi loc_A191A3: ; CODE XREF: sub_A18CA8+52Dj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A191B0 xor esi, esi jmp short loc_A191B8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A191B0: ; CODE XREF: sub_A18CA8+502j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A191B8: ; CODE XREF: sub_A18CA8+506j mov [ebp+var_C], ecx test esi, esi js short loc_A191FA lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A191FA mov eax, [ebp+var_C] inc edi cmp edi, 9 jb short loc_A191A3 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A191E4 xor esi, esi jmp short loc_A191EC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A191E4: ; CODE XREF: sub_A18CA8+536j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A191EC: ; CODE XREF: sub_A18CA8+53Aj test esi, esi js short loc_A191FA mov ebx, edx neg edx sbb edx, edx and edx, ecx jmp short loc_A191FF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A191FA: ; CODE XREF: sub_A18CA8+515j ; sub_A18CA8+524j ... mov edx, [ebp+var_10] mov ebx, edx loc_A191FF: ; CODE XREF: sub_A18CA8+550j test esi, esi js loc_A1943B mov eax, ds:dword_A93EB4 test eax, eax jz short loc_A1922D push ebx push edx push [ebp+var_2C] push [ebp+var_30] push [ebp+var_34] push [ebp+var_38] push [ebp+var_20] push [ebp+var_1C] push [ebp+var_3C] call eax mov edi, eax jmp short loc_A19232 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1922D: ; CODE XREF: sub_A18CA8+566j mov edi, 0C00000BBh loc_A19232: ; CODE XREF: sub_A18CA8+583j mov esi, edi test edi, edi js loc_A1943B push 8 pop ecx mov [ebp+var_3C], ecx lea eax, [ebp+var_3C] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1925C mov eax, [ebp+var_3C] mov [ebp+var_18], eax jmp short loc_A1925F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1925C: ; CODE XREF: sub_A18CA8+5AAj mov eax, [ebp+var_18] loc_A1925F: ; CODE XREF: sub_A18CA8+5B2j test esi, esi js loc_A1943B push 8 pop esi xor ebx, ebx mov [ebp+var_40], esi lea ecx, [ebp+var_40] mov edx, eax push ecx mov ecx, esi call RtlUIntAdd mov esi, eax test esi, esi js loc_A1943B mov eax, [ebp+var_40] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1929A mov esi, 0C0000095h jmp short loc_A192A7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1929A: ; CODE XREF: sub_A18CA8+5E9j lea ebx, [ecx+8] cmp ebx, ecx jb loc_A1932A xor esi, esi loc_A192A7: ; CODE XREF: sub_A18CA8+5F0j test esi, esi js loc_A1943B mov ecx, [ebp+var_50] mov edx, ebx push 4 mov eax, [ecx+10h] mov [ebp+var_4C], eax mov eax, [ecx+8] mov [ebp+var_50], eax lea eax, [ebp+var_4] pop ecx push eax mov [ebp+var_4], ecx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1943B mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A192E7 xor esi, esi jmp short loc_A192EF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A192E7: ; CODE XREF: sub_A18CA8+639j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A192EF: ; CODE XREF: sub_A18CA8+63Dj mov [ebp+var_4], ecx test esi, esi js loc_A1943B mov edx, [ebp+var_50] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1943B mov eax, [ebp+var_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1932A mov edx, [ebp+var_4C] lea eax, [ebp+var_4] push eax call RtlUIntAdd mov esi, eax jmp short loc_A1932F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1932A: ; CODE XREF: sub_A18CA8+5F7j ; sub_A18CA8+670j mov esi, 0C0000095h loc_A1932F: ; CODE XREF: sub_A18CA8+680j test esi, esi js loc_A1943B mov esi, [ebp+arg_4] mov eax, [ebp+var_18] lea ebx, [esi+4] mov [ebx], eax test eax, eax jnz short loc_A19350 mov esi, 0C000003Eh jmp loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19350: ; CODE XREF: sub_A18CA8+69Cj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1936D mov esi, 0C0000017h jmp loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1936D: ; CODE XREF: sub_A18CA8+6B9j mov [esi+8], edx and dword ptr [esi], 0 or edi, 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A19436 mov ecx, [ebx] lea eax, [edx+8] add ecx, edx cmp eax, ecx jbe short loc_A19399 loc_A1938F: ; CODE XREF: sub_A18CA8+770j mov esi, 0C0000023h jmp loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19399: ; CODE XREF: sub_A18CA8+6E5j mov dword ptr [edx], 4 mov [esi], edi mov edi, [ebp+arg_4] inc dword ptr [edi] mov ecx, [edi] mov [ebp+var_50], ecx mov eax, [edi+8] mov [ebp+var_4C], eax test eax, eax jnz short loc_A193CC mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1943B inc dword ptr [edi] xor esi, esi jmp short loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A193CC: ; CODE XREF: sub_A18CA8+70Bj and [ebp+var_3C], 0 mov edi, eax mov [ebp+var_18], edi test ecx, ecx jz short loc_A19406 loc_A193D9: ; CODE XREF: sub_A18CA8+759j mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A19436 lea eax, [ebp+var_18] mov ecx, edi push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1943B mov ecx, [ebp+var_3C] mov edi, [ebp+var_18] inc ecx mov [ebp+var_3C], ecx cmp ecx, [ebp+var_50] jb short loc_A193D9 mov eax, [ebp+var_4C] loc_A19406: ; CODE XREF: sub_A18CA8+72Fj lea edx, [edi+4] cmp edx, edi jb short loc_A19436 mov ecx, [ebx] xor esi, esi add ecx, eax lea eax, [edi+0Ch] cmp eax, ecx ja loc_A1938F mov eax, [ebp+var_44] mov dword ptr [edi], 8 mov [edx], eax mov eax, [ebp+var_48] mov [edx+4], eax mov eax, [ebp+arg_4] inc dword ptr [eax] jmp short loc_A1943B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19436: ; CODE XREF: sub_A18CA8+6D6j ; sub_A18CA8+739j ... mov esi, 0C0000095h loc_A1943B: ; CODE XREF: sub_A18CA8+349j ; sub_A18CA8+362j ... mov eax, [ebp+var_1C] test eax, eax jz short loc_A1944D push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1944D: ; CODE XREF: sub_A18CA8+798j mov eax, [ebp+var_20] test eax, eax jz short loc_A1945F push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1945F: ; CODE XREF: sub_A18CA8+41j ; sub_A18CA8+CCj ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A18CA8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A19468 proc near ; CODE XREF: sub_785212+2097p var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 54h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi mov esi, [ebp+arg_4] xor eax, eax push edi lea edi, [ebp+var_14] mov [ebp+var_24], edx stosd xor ebx, ebx mov [ebp+var_28], ecx mov [ebp+var_38], esi mov [ebp+var_34], ebx stosd mov [ebp+var_54], ebx mov [ebp+var_40], ebx mov [ebp+var_48], ebx stosd mov [ebp+var_44], ebx stosd test edx, edx jnz short loc_A194B1 loc_A194A7: ; CODE XREF: sub_A19468+4Bj mov ebx, 0C000000Dh jmp loc_A199F6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A194B1: ; CODE XREF: sub_A19468+3Dj test esi, esi jz short loc_A194A7 mov eax, [ecx+8] mov edi, ebx mov [ebp+var_2C], eax mov edx, 0C000000Dh test eax, eax jnz short loc_A194CD loc_A194C6: ; CODE XREF: sub_A19468+68j mov ebx, edx jmp loc_A19557 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A194CD: ; CODE XREF: sub_A19468+5Cj cmp dword ptr [ecx], 3 jbe short loc_A194C6 mov [ebp+var_3C], ebx loc_A194D5: ; CODE XREF: sub_A19468+A5j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jnb short loc_A194E6 mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A194E6: ; CODE XREF: sub_A19468+74j mov [ebp+var_1C], ecx test ebx, ebx js short loc_A19534 lea eax, [ebp+var_1C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A19534 mov edx, [ebp+var_3C] mov eax, [ebp+var_1C] inc edx mov [ebp+var_3C], edx cmp edx, 3 jnb short loc_A1950F xor ebx, ebx jmp short loc_A194D5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1950F: ; CODE XREF: sub_A19468+A1j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1951C xor ebx, ebx jmp short loc_A19524 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1951C: ; CODE XREF: sub_A19468+AEj mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19524: ; CODE XREF: sub_A19468+B2j test ebx, ebx js short loc_A19534 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A19536 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19534: ; CODE XREF: sub_A19468+83j ; sub_A19468+92j ... mov eax, edi loc_A19536: ; CODE XREF: sub_A19468+CAj test ebx, ebx js short loc_A19554 cmp eax, 8 jz short loc_A19549 mov ebx, 0C0000023h jmp loc_A199F6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19549: ; CODE XREF: sub_A19468+D5j mov eax, [edi] mov [ebp+var_54], eax mov eax, [edi+4] mov [ebp+var_40], eax loc_A19554: ; CODE XREF: sub_A19468+D0j mov eax, [ebp+var_2C] loc_A19557: ; CODE XREF: sub_A19468+60j test ebx, ebx js loc_A199F6 and [ebp+var_4C], 0 xor ecx, ecx and [ebp+var_3C], ecx xor edx, edx xor edi, edi mov [ebp+var_30], ecx mov [ebp+var_18], edx test eax, eax jnz short loc_A19580 loc_A19576: ; CODE XREF: sub_A19468+11Ej mov ebx, 0C000000Dh jmp loc_A19653 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19580: ; CODE XREF: sub_A19468+10Cj mov edx, [ebp+var_28] cmp dword ptr [edx], 4 jbe short loc_A19576 and [ebp+var_2C], ecx loc_A1958B: ; CODE XREF: sub_A19468+15Bj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19598 xor ebx, ebx jmp short loc_A195A0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19598: ; CODE XREF: sub_A19468+12Aj mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A195A0: ; CODE XREF: sub_A19468+12Ej mov [ebp+var_1C], ecx test ebx, ebx js short loc_A195EB lea eax, [ebp+var_1C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A195EB mov edx, [ebp+var_2C] mov eax, [ebp+var_1C] inc edx mov [ebp+var_2C], edx cmp edx, 4 jb short loc_A1958B mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A195D2 xor ebx, ebx jmp short loc_A195DA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A195D2: ; CODE XREF: sub_A19468+164j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A195DA: ; CODE XREF: sub_A19468+168j test ebx, ebx js short loc_A195EB mov edi, edx mov [ebp+var_18], edx neg edi sbb edi, edi and edi, ecx jmp short loc_A195ED ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A195EB: ; CODE XREF: sub_A19468+13Dj ; sub_A19468+14Cj ... mov edx, edi loc_A195ED: ; CODE XREF: sub_A19468+181j test ebx, ebx js short loc_A19650 test edx, edx jnz short loc_A1961A loc_A195F5: ; CODE XREF: sub_A19468+1B8j ; sub_A19468+1C5j ... mov ebx, 0C000003Eh loc_A195FA: ; CODE XREF: sub_A19468+216j test ebx, ebx js loc_A199F6 loc_A19602: ; CODE XREF: sub_A19468+22Bj mov ecx, [ebp+var_28] mov eax, [ecx+8] test eax, eax jnz loc_A19698 loc_A19610: ; CODE XREF: sub_A19468+233j mov ebx, 0C000000Dh jmp loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1961A: ; CODE XREF: sub_A19468+18Bj test edx, 1 jnz short loc_A195F5 mov eax, edx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A195F5 lea eax, [ebp+var_3C] mov ecx, edi push eax call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A195F5 mov ecx, [ebp+var_3C] lea eax, [ecx+2] cmp eax, [ebp+var_18] jnz short loc_A195F5 mov [ebp+var_4C], edi shr ecx, 1 jmp short loc_A19653 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19650: ; CODE XREF: sub_A19468+187j mov ecx, [ebp+var_30] loc_A19653: ; CODE XREF: sub_A19468+113j ; sub_A19468+1E6j test ebx, ebx js loc_A199F6 lea ebx, ds:2[ecx*2] test ebx, ebx jz short loc_A195F5 push 20534C53h push ebx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A19683 mov ebx, 0C0000017h jmp loc_A195FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19683: ; CODE XREF: sub_A19468+20Fj push ebx ; size_t push [ebp+var_4C] ; void * push edi ; void * call _memcpy add esp, 0Ch mov [ebp+var_48], edi jmp loc_A19602 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19698: ; CODE XREF: sub_A19468+1A2j cmp dword ptr [ecx], 5 jbe loc_A19610 xor edi, edi loc_A196A3: ; CODE XREF: sub_A19468+26Dj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A196B0 xor ebx, ebx jmp short loc_A196B8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A196B0: ; CODE XREF: sub_A19468+242j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A196B8: ; CODE XREF: sub_A19468+246j mov [ebp+var_1C], ecx test ebx, ebx js short loc_A196FA lea eax, [ebp+var_1C] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A196FA mov eax, [ebp+var_1C] inc edi cmp edi, 5 jb short loc_A196A3 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A196E4 xor ebx, ebx jmp short loc_A196EC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A196E4: ; CODE XREF: sub_A19468+276j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A196EC: ; CODE XREF: sub_A19468+27Aj test ebx, ebx js short loc_A196FA mov edi, edx neg edx sbb edx, edx and edx, ecx jmp short loc_A196FF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A196FA: ; CODE XREF: sub_A19468+255j ; sub_A19468+264j ... mov edx, [ebp+var_44] mov edi, edx loc_A196FF: ; CODE XREF: sub_A19468+290j test ebx, ebx js loc_A199E4 mov eax, ds:dword_A93E90 test eax, eax jz short loc_A1971D lea ecx, [ebp+var_14] push ecx push edi push edx push [ebp+var_48] call eax jmp short loc_A19722 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1971D: ; CODE XREF: sub_A19468+2A6j mov eax, 0C000A281h loc_A19722: ; CODE XREF: sub_A19468+2B3j mov [ebp+var_1C], eax push 8 pop ecx mov [ebp+var_28], ecx lea eax, [ebp+var_28] push eax push 0Ch pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A19745 mov eax, [ebp+var_28] mov [ebp+var_34], eax jmp short loc_A19748 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19745: ; CODE XREF: sub_A19468+2D3j mov eax, [ebp+var_34] loc_A19748: ; CODE XREF: sub_A19468+2DBj test ebx, ebx js loc_A199E4 lea ecx, [ebp+var_34] push ecx push 14h pop edx mov ecx, eax call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A199E4 push 8 pop ecx xor edi, edi mov [ebp+var_50], ecx mov edx, [ebp+var_34] lea eax, [ebp+var_50] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A199E4 mov eax, [ebp+var_50] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1979A mov ebx, 0C0000095h jmp short loc_A197A7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1979A: ; CODE XREF: sub_A19468+329j lea edi, [ecx+8] cmp edi, ecx jb loc_A1982A xor ebx, ebx loc_A197A7: ; CODE XREF: sub_A19468+330j test ebx, ebx js loc_A199E4 mov ecx, [ebp+var_24] mov edx, edi push 4 mov eax, [ecx+10h] mov [ebp+var_30], eax mov eax, [ecx+8] mov [ebp+var_24], eax lea eax, [ebp+var_18] pop ecx push eax mov [ebp+var_18], ecx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A199E4 mov eax, [ebp+var_18] lea ecx, [eax+4] cmp ecx, eax jb short loc_A197E7 xor ebx, ebx jmp short loc_A197EF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A197E7: ; CODE XREF: sub_A19468+379j mov ebx, 0C0000095h or ecx, 0FFFFFFFFh loc_A197EF: ; CODE XREF: sub_A19468+37Dj mov [ebp+var_18], ecx test ebx, ebx js loc_A199E4 mov edx, [ebp+var_24] lea eax, [ebp+var_18] push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A199E4 mov eax, [ebp+var_18] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1982A mov edx, [ebp+var_30] lea eax, [ebp+var_18] push eax call RtlUIntAdd mov ebx, eax jmp short loc_A1982F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1982A: ; CODE XREF: sub_A19468+337j ; sub_A19468+3B0j mov ebx, 0C0000095h loc_A1982F: ; CODE XREF: sub_A19468+3C0j test ebx, ebx js loc_A199E4 mov eax, [ebp+var_34] lea edi, [esi+4] mov [edi], eax test eax, eax jnz short loc_A1984D mov ebx, 0C000003Eh jmp loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1984D: ; CODE XREF: sub_A19468+3D9j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1986A mov ebx, 0C0000017h jmp loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1986A: ; CODE XREF: sub_A19468+3F6j mov [esi+8], edx and dword ptr [esi], 0 or [ebp+var_1C], 10000000h lea ebx, [edx+4] cmp ebx, edx jb loc_A199DF mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx jbe short loc_A19897 loc_A1988D: ; CODE XREF: sub_A19468+4B4j ; sub_A19468+55Dj mov ebx, 0C0000023h jmp loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19897: ; CODE XREF: sub_A19468+423j mov eax, [ebp+var_1C] mov dword ptr [edx], 4 mov [ebx], eax inc dword ptr [esi] mov ecx, [esi] mov [ebp+var_24], ecx mov eax, [esi+8] mov [ebp+var_30], eax test eax, eax jnz short loc_A198CC mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js loc_A199E4 inc dword ptr [esi] jmp short loc_A1994A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A198CC: ; CODE XREF: sub_A19468+449j and [ebp+var_28], 0 mov esi, eax mov [ebp+var_20], esi test ecx, ecx jz short loc_A19906 loc_A198D9: ; CODE XREF: sub_A19468+499j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A1993A lea eax, [ebp+var_20] mov ecx, esi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A1993F mov ecx, [ebp+var_28] mov esi, [ebp+var_20] inc ecx mov [ebp+var_28], ecx cmp ecx, [ebp+var_24] jb short loc_A198D9 mov eax, [ebp+var_30] loc_A19906: ; CODE XREF: sub_A19468+46Fj lea edx, [esi+4] cmp edx, esi jb loc_A199DF mov ecx, [edi] xor ebx, ebx add ecx, eax lea eax, [esi+0Ch] cmp eax, ecx ja loc_A1988D mov eax, [ebp+var_54] mov dword ptr [esi], 8 mov esi, [ebp+var_38] mov [edx], eax mov eax, [ebp+var_40] mov [edx+4], eax inc dword ptr [esi] jmp short loc_A19942 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1993A: ; CODE XREF: sub_A19468+479j mov ebx, 0C0000095h loc_A1993F: ; CODE XREF: sub_A19468+48Aj mov esi, [ebp+var_38] loc_A19942: ; CODE XREF: sub_A19468+4D0j test ebx, ebx js loc_A199E4 loc_A1994A: ; CODE XREF: sub_A19468+462j mov eax, [esi+8] mov [ebp+var_30], eax test eax, eax jnz short loc_A1996B mov ecx, [edi] push edi push 14h pop edx call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A199E4 inc dword ptr [esi] xor ebx, ebx jmp short loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1996B: ; CODE XREF: sub_A19468+4EAj mov edx, [ebp+var_38] mov esi, eax and [ebp+var_40], 0 mov [ebp+var_20], esi mov ecx, [edx] mov [ebp+var_24], ecx test ecx, ecx jz short loc_A199B0 loc_A19980: ; CODE XREF: sub_A19468+540j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A199DF lea eax, [ebp+var_20] mov ecx, esi push eax call RtlUIntAdd mov ebx, eax test ebx, ebx js short loc_A199E4 mov ecx, [ebp+var_40] mov esi, [ebp+var_20] inc ecx mov [ebp+var_40], ecx cmp ecx, [ebp+var_24] jb short loc_A19980 mov edx, [ebp+var_38] mov eax, [ebp+var_30] loc_A199B0: ; CODE XREF: sub_A19468+516j lea ecx, [esi+4] mov [ebp+var_24], ecx cmp ecx, esi jb short loc_A199DF mov ecx, [edi] xor ebx, ebx add ecx, eax lea eax, [esi+14h] cmp eax, ecx ja loc_A1988D mov edi, [ebp+var_24] mov dword ptr [esi], 10h lea esi, [ebp+var_14] movsd movsd movsd movsd inc dword ptr [edx] jmp short loc_A199E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A199DF: ; CODE XREF: sub_A19468+414j ; sub_A19468+4A3j ... mov ebx, 0C0000095h loc_A199E4: ; CODE XREF: sub_A19468+1ADj ; sub_A19468+299j ... mov eax, [ebp+var_48] test eax, eax jz short loc_A199F6 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A199F6: ; CODE XREF: sub_A19468+44j ; sub_A19468+DCj ... mov ecx, [ebp+var_4] mov eax, ebx pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 sub_A19468 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A19A09 proc near ; CODE XREF: sub_785212+1A1Cp var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push ebx mov eax, edx mov [ebp+var_10], ecx xor edx, edx mov [ebp+var_28], eax mov [ebp+var_8], edx mov [ebp+var_1C], edx mov [ebp+var_20], edx mov [ebp+var_14], edx push esi push edi mov edi, edx test eax, eax jnz short loc_A19A3A loc_A19A30: ; CODE XREF: sub_A19A09+36j ; sub_A19A09+EEj ... mov edx, 0C000000Dh jmp loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19A3A: ; CODE XREF: sub_A19A09+25j mov ebx, [ebp+arg_4] test ebx, ebx jz short loc_A19A30 mov eax, [ecx+8] mov esi, edx mov [ebp+var_C], edx test eax, eax jnz short loc_A19A57 loc_A19A4D: ; CODE XREF: sub_A19A09+51j mov edx, 0C000000Dh jmp loc_A19AEA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19A57: ; CODE XREF: sub_A19A09+42j cmp dword ptr [ecx], 3 jbe short loc_A19A4D mov [ebp+var_4], edx loc_A19A5F: ; CODE XREF: sub_A19A09+94j mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jnb short loc_A19A73 mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19A73: ; CODE XREF: sub_A19A09+60j mov [ebp+arg_4], ecx test edx, edx js short loc_A19AE7 mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A19AE7 mov edx, [ebp+var_4] mov eax, [ebp+arg_4] inc edx mov [ebp+var_4], edx cmp edx, 3 jnb short loc_A19A9F xor edx, edx jmp short loc_A19A5F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19A9F: ; CODE XREF: sub_A19A09+90j mov ecx, [eax] mov [ebp+arg_4], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A19AAF xor edx, edx jmp short loc_A19AB7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19AAF: ; CODE XREF: sub_A19A09+A0j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19AB7: ; CODE XREF: sub_A19A09+A4j test edx, edx js short loc_A19AE7 mov eax, [ebp+arg_4] mov esi, eax neg esi mov [ebp+var_C], eax sbb esi, esi and esi, ecx test edx, edx js short loc_A19AE7 cmp eax, 8 jz short loc_A19ADC loc_A19AD2: ; CODE XREF: sub_A19A09+2D2j ; sub_A19A09+355j mov edx, 0C0000023h jmp loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19ADC: ; CODE XREF: sub_A19A09+C7j mov eax, [esi] mov [ebp+var_1C], eax mov eax, [esi+4] mov [ebp+var_20], eax loc_A19AE7: ; CODE XREF: sub_A19A09+6Fj ; sub_A19A09+81j ... mov ecx, [ebp+var_10] loc_A19AEA: ; CODE XREF: sub_A19A09+49j test edx, edx js loc_A19D7F mov eax, [ecx+8] test eax, eax jz loc_A19A30 cmp dword ptr [ecx], 4 jbe loc_A19A30 xor esi, esi loc_A19B08: ; CODE XREF: sub_A19A09+13Fj mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A19B18 xor edx, edx jmp short loc_A19B20 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19B18: ; CODE XREF: sub_A19A09+109j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19B20: ; CODE XREF: sub_A19A09+10Dj mov [ebp+arg_4], ecx test edx, edx js loc_A19D7F mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A19D7F mov eax, [ebp+arg_4] inc esi cmp esi, 4 jb short loc_A19B08 mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19B57 xor edx, edx jmp short loc_A19B5F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19B57: ; CODE XREF: sub_A19A09+148j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19B5F: ; CODE XREF: sub_A19A09+14Cj test edx, edx js loc_A19D7F mov edi, esi mov [ebp+var_14], esi neg edi sbb edi, edi and edi, ecx test edx, edx js loc_A19D7F mov eax, ds:dword_A93E60 test eax, eax jz short loc_A19B89 push esi push edi call eax jmp short loc_A19B8E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19B89: ; CODE XREF: sub_A19A09+178j mov eax, 0C00000BBh loc_A19B8E: ; CODE XREF: sub_A19A09+17Ej mov [ebp+var_4], eax push 8 pop edi mov [ebp+arg_4], edi lea eax, [ebp+arg_4] mov ecx, edi push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A19BB3 mov eax, [ebp+arg_4] mov [ebp+var_8], eax jmp short loc_A19BB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19BB3: ; CODE XREF: sub_A19A09+1A0j mov eax, [ebp+var_8] loc_A19BB6: ; CODE XREF: sub_A19A09+1A8j test edx, edx js loc_A19D7F xor esi, esi mov [ebp+var_18], edi lea ecx, [ebp+var_18] mov edx, eax push ecx mov ecx, edi call RtlUIntAdd mov edx, eax test edx, edx js loc_A19D7F mov eax, [ebp+var_18] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A19BEE mov edx, 0C0000095h jmp short loc_A19BFB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19BEE: ; CODE XREF: sub_A19A09+1DCj lea esi, [ecx+8] cmp esi, ecx jb loc_A19C7A xor edx, edx loc_A19BFB: ; CODE XREF: sub_A19A09+1E3j test edx, edx js loc_A19D7F mov edi, [ebp+var_28] mov edx, esi push 4 pop ecx mov [ebp+arg_4], ecx mov eax, [edi+10h] mov edi, [edi+8] mov [ebp+var_28], eax lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A19D7F mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19C38 xor edx, edx jmp short loc_A19C40 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19C38: ; CODE XREF: sub_A19A09+229j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19C40: ; CODE XREF: sub_A19A09+22Dj mov [ebp+arg_4], ecx test edx, edx js loc_A19D7F lea eax, [ebp+arg_4] mov edx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A19D7F mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19C7A mov edx, [ebp+var_28] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax jmp short loc_A19C7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19C7A: ; CODE XREF: sub_A19A09+1EAj ; sub_A19A09+25Fj mov edx, 0C0000095h loc_A19C7F: ; CODE XREF: sub_A19A09+26Fj test edx, edx js loc_A19D7F mov eax, [ebp+var_8] lea edi, [ebx+4] mov [edi], eax test eax, eax jnz short loc_A19C9D mov edx, 0C000003Eh jmp loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19C9D: ; CODE XREF: sub_A19A09+288j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A19CBA mov edx, 0C0000017h jmp loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19CBA: ; CODE XREF: sub_A19A09+2A5j mov [ebx+8], edx and dword ptr [ebx], 0 or [ebp+var_4], 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A19D7A mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A19AD2 mov eax, [ebp+var_4] mov dword ptr [edx], 4 mov [esi], eax inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_28], ecx mov eax, [ebx+8] mov [ebp+var_24], eax test eax, eax jnz short loc_A19D14 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A19D7F inc dword ptr [ebx] xor edx, edx jmp short loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19D14: ; CODE XREF: sub_A19A09+2F2j and [ebp+var_14], 0 mov esi, eax mov [ebp+arg_4], esi test ecx, ecx jz short loc_A19D4B loc_A19D21: ; CODE XREF: sub_A19A09+340j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A19D7A lea eax, [ebp+arg_4] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A19D7F mov ecx, [ebp+var_14] mov esi, [ebp+arg_4] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_28] jb short loc_A19D21 loc_A19D4B: ; CODE XREF: sub_A19A09+316j lea eax, [esi+4] cmp eax, esi jb short loc_A19D7A mov ecx, [edi] lea eax, [esi+0Ch] add ecx, [ebp+var_24] xor edx, edx cmp eax, ecx ja loc_A19AD2 mov eax, [ebp+var_1C] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_20] mov [esi+8], eax inc dword ptr [ebx] jmp short loc_A19D7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19D7A: ; CODE XREF: sub_A19A09+2C3j ; sub_A19A09+320j ... mov edx, 0C0000095h loc_A19D7F: ; CODE XREF: sub_A19A09+2Cj ; sub_A19A09+CEj ... pop edi pop esi mov eax, edx pop ebx leave retn 8 sub_A19A09 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A19D88 proc near ; CODE XREF: sub_785212+1B9Bp var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi mov esi, edx push edi test esi, esi jnz short loc_A19DA3 mov edx, 0C000000Dh jmp loc_A19E95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19DA3: ; CODE XREF: sub_A19D88+Fj mov eax, [esi+8] mov [ebp+var_C], eax test eax, eax jnz short loc_A19DC9 lea ecx, [esi+4] push ecx mov ecx, [ecx] push 8 pop edx call RtlUIntAdd mov edx, eax test edx, edx js loc_A19E95 inc dword ptr [esi] jmp short loc_A19E3D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19DC9: ; CODE XREF: sub_A19D88+23j mov ecx, [esi] mov edi, eax xor ebx, ebx mov [ebp+var_4], edi mov [ebp+var_8], ecx test ecx, ecx jz short loc_A19E04 loc_A19DD9: ; CODE XREF: sub_A19D88+77j mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A19E24 lea eax, [ebp+var_4] mov ecx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A19E95 mov edi, [ebp+var_4] inc ebx cmp ebx, [ebp+var_8] jb short loc_A19DD9 mov eax, [ebp+var_C] loc_A19E04: ; CODE XREF: sub_A19D88+4Fj lea ebx, [edi+4] cmp ebx, edi jb loc_A19E90 mov ecx, [esi+4] xor edx, edx add ecx, eax lea eax, [edi+8] cmp eax, ecx jbe short loc_A19E2B loc_A19E1D: ; CODE XREF: sub_A19D88+F6j mov edx, 0C0000023h jmp short loc_A19E95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19E24: ; CODE XREF: sub_A19D88+59j mov edx, 0C0000095h jmp short loc_A19E39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19E2B: ; CODE XREF: sub_A19D88+93j mov dword ptr [edi], 4 mov dword ptr [ebx], 80004001h inc dword ptr [esi] loc_A19E39: ; CODE XREF: sub_A19D88+A1j test edx, edx js short loc_A19E95 loc_A19E3D: ; CODE XREF: sub_A19D88+3Fj mov eax, [esi+4] test eax, eax jnz short loc_A19E4B mov edx, 0C000003Eh jmp short loc_A19E95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19E4B: ; CODE XREF: sub_A19D88+BAj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A19E65 mov edx, 0C0000017h jmp short loc_A19E95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19E65: ; CODE XREF: sub_A19D88+D4j mov [esi+8], edi and dword ptr [esi], 0 lea ebx, [edi+4] cmp ebx, edi jb short loc_A19E90 mov ecx, [esi+4] lea eax, [edi+8] add ecx, edi xor edx, edx cmp eax, ecx ja short loc_A19E1D mov dword ptr [edi], 4 mov dword ptr [ebx], 80004001h inc dword ptr [esi] jmp short loc_A19E95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19E90: ; CODE XREF: sub_A19D88+81j ; sub_A19D88+E8j mov edx, 0C0000095h loc_A19E95: ; CODE XREF: sub_A19D88+16j ; sub_A19D88+37j ... pop edi pop esi mov eax, edx pop ebx leave retn sub_A19D88 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A19E9C proc near ; CODE XREF: sub_785212+1A32p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push ebx mov eax, edx mov [ebp+var_10], ecx xor edx, edx mov [ebp+var_28], eax mov [ebp+var_8], edx mov [ebp+var_1C], edx mov [ebp+var_20], edx mov [ebp+var_14], edx push esi push edi mov edi, edx test eax, eax jnz short loc_A19ECD loc_A19EC3: ; CODE XREF: sub_A19E9C+36j ; sub_A19E9C+EEj ... mov edx, 0C000000Dh jmp loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19ECD: ; CODE XREF: sub_A19E9C+25j mov ebx, [ebp+arg_4] test ebx, ebx jz short loc_A19EC3 mov eax, [ecx+8] mov esi, edx mov [ebp+var_C], edx test eax, eax jnz short loc_A19EEA loc_A19EE0: ; CODE XREF: sub_A19E9C+51j mov edx, 0C000000Dh jmp loc_A19F7D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19EEA: ; CODE XREF: sub_A19E9C+42j cmp dword ptr [ecx], 3 jbe short loc_A19EE0 mov [ebp+var_4], edx loc_A19EF2: ; CODE XREF: sub_A19E9C+94j mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jnb short loc_A19F06 mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19F06: ; CODE XREF: sub_A19E9C+60j mov [ebp+arg_4], ecx test edx, edx js short loc_A19F7A mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A19F7A mov edx, [ebp+var_4] mov eax, [ebp+arg_4] inc edx mov [ebp+var_4], edx cmp edx, 3 jnb short loc_A19F32 xor edx, edx jmp short loc_A19EF2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19F32: ; CODE XREF: sub_A19E9C+90j mov ecx, [eax] mov [ebp+arg_4], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A19F42 xor edx, edx jmp short loc_A19F4A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19F42: ; CODE XREF: sub_A19E9C+A0j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19F4A: ; CODE XREF: sub_A19E9C+A4j test edx, edx js short loc_A19F7A mov eax, [ebp+arg_4] mov esi, eax neg esi mov [ebp+var_C], eax sbb esi, esi and esi, ecx test edx, edx js short loc_A19F7A cmp eax, 8 jz short loc_A19F6F loc_A19F65: ; CODE XREF: sub_A19E9C+2D2j ; sub_A19E9C+355j mov edx, 0C0000023h jmp loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19F6F: ; CODE XREF: sub_A19E9C+C7j mov eax, [esi] mov [ebp+var_1C], eax mov eax, [esi+4] mov [ebp+var_20], eax loc_A19F7A: ; CODE XREF: sub_A19E9C+6Fj ; sub_A19E9C+81j ... mov ecx, [ebp+var_10] loc_A19F7D: ; CODE XREF: sub_A19E9C+49j test edx, edx js loc_A1A212 mov eax, [ecx+8] test eax, eax jz loc_A19EC3 cmp dword ptr [ecx], 4 jbe loc_A19EC3 xor esi, esi loc_A19F9B: ; CODE XREF: sub_A19E9C+13Fj mov ecx, [eax] mov [ebp+var_24], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A19FAB xor edx, edx jmp short loc_A19FB3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19FAB: ; CODE XREF: sub_A19E9C+109j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19FB3: ; CODE XREF: sub_A19E9C+10Dj mov [ebp+arg_4], ecx test edx, edx js loc_A1A212 mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A1A212 mov eax, [ebp+arg_4] inc esi cmp esi, 4 jb short loc_A19F9B mov esi, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A19FEA xor edx, edx jmp short loc_A19FF2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A19FEA: ; CODE XREF: sub_A19E9C+148j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A19FF2: ; CODE XREF: sub_A19E9C+14Cj test edx, edx js loc_A1A212 mov edi, esi mov [ebp+var_14], esi neg edi sbb edi, edi and edi, ecx test edx, edx js loc_A1A212 mov eax, ds:dword_A93E64 test eax, eax jz short loc_A1A01C push esi push edi call eax jmp short loc_A1A021 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A01C: ; CODE XREF: sub_A19E9C+178j mov eax, 0C00000BBh loc_A1A021: ; CODE XREF: sub_A19E9C+17Ej mov [ebp+var_4], eax push 8 pop edi mov [ebp+arg_4], edi lea eax, [ebp+arg_4] mov ecx, edi push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1A046 mov eax, [ebp+arg_4] mov [ebp+var_8], eax jmp short loc_A1A049 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A046: ; CODE XREF: sub_A19E9C+1A0j mov eax, [ebp+var_8] loc_A1A049: ; CODE XREF: sub_A19E9C+1A8j test edx, edx js loc_A1A212 xor esi, esi mov [ebp+var_18], edi lea ecx, [ebp+var_18] mov edx, eax push ecx mov ecx, edi call RtlUIntAdd mov edx, eax test edx, edx js loc_A1A212 mov eax, [ebp+var_18] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1A081 mov edx, 0C0000095h jmp short loc_A1A08E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A081: ; CODE XREF: sub_A19E9C+1DCj lea esi, [ecx+8] cmp esi, ecx jb loc_A1A10D xor edx, edx loc_A1A08E: ; CODE XREF: sub_A19E9C+1E3j test edx, edx js loc_A1A212 mov edi, [ebp+var_28] mov edx, esi push 4 pop ecx mov [ebp+arg_4], ecx mov eax, [edi+10h] mov edi, [edi+8] mov [ebp+var_28], eax lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A1A212 mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A0CB xor edx, edx jmp short loc_A1A0D3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A0CB: ; CODE XREF: sub_A19E9C+229j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A0D3: ; CODE XREF: sub_A19E9C+22Dj mov [ebp+arg_4], ecx test edx, edx js loc_A1A212 lea eax, [ebp+arg_4] mov edx, edi push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A1A212 mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A10D mov edx, [ebp+var_28] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax jmp short loc_A1A112 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A10D: ; CODE XREF: sub_A19E9C+1EAj ; sub_A19E9C+25Fj mov edx, 0C0000095h loc_A1A112: ; CODE XREF: sub_A19E9C+26Fj test edx, edx js loc_A1A212 mov eax, [ebp+var_8] lea edi, [ebx+4] mov [edi], eax test eax, eax jnz short loc_A1A130 mov edx, 0C000003Eh jmp loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A130: ; CODE XREF: sub_A19E9C+288j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1A14D mov edx, 0C0000017h jmp loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A14D: ; CODE XREF: sub_A19E9C+2A5j mov [ebx+8], edx and dword ptr [ebx], 0 or [ebp+var_4], 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A1A20D mov ecx, [edi] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A19F65 mov eax, [ebp+var_4] mov dword ptr [edx], 4 mov [esi], eax inc dword ptr [ebx] mov ecx, [ebx] mov [ebp+var_28], ecx mov eax, [ebx+8] mov [ebp+var_24], eax test eax, eax jnz short loc_A1A1A7 mov ecx, [edi] push edi push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1A212 inc dword ptr [ebx] xor edx, edx jmp short loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A1A7: ; CODE XREF: sub_A19E9C+2F2j and [ebp+var_14], 0 mov esi, eax mov [ebp+arg_4], esi test ecx, ecx jz short loc_A1A1DE loc_A1A1B4: ; CODE XREF: sub_A19E9C+340j mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A1A20D lea eax, [ebp+arg_4] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1A212 mov ecx, [ebp+var_14] mov esi, [ebp+arg_4] inc ecx mov [ebp+var_14], ecx cmp ecx, [ebp+var_28] jb short loc_A1A1B4 loc_A1A1DE: ; CODE XREF: sub_A19E9C+316j lea eax, [esi+4] cmp eax, esi jb short loc_A1A20D mov ecx, [edi] lea eax, [esi+0Ch] add ecx, [ebp+var_24] xor edx, edx cmp eax, ecx ja loc_A19F65 mov eax, [ebp+var_1C] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_20] mov [esi+8], eax inc dword ptr [ebx] jmp short loc_A1A212 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A20D: ; CODE XREF: sub_A19E9C+2C3j ; sub_A19E9C+320j ... mov edx, 0C0000095h loc_A1A212: ; CODE XREF: sub_A19E9C+2Cj ; sub_A19E9C+CEj ... pop edi pop esi mov eax, edx pop ebx leave retn 8 sub_A19E9C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1A21B proc near ; CODE XREF: sub_785212+1AB5p var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 34h push ebx xor ebx, ebx mov [ebp+var_20], ecx mov [ebp+var_28], ebx mov [ebp+var_2C], ebx mov [ebp+var_14], ebx mov [ebp+var_24], ebx mov [ebp+var_4], ebx push esi push edi test ecx, ecx jnz short loc_A1A248 loc_A1A23E: ; CODE XREF: sub_A1A21B+2Fj ; sub_A1A21B+34j mov esi, 0C000000Dh jmp loc_A1A714 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A248: ; CODE XREF: sub_A1A21B+21j test edx, edx jz short loc_A1A23E cmp [ebp+arg_4], ebx jz short loc_A1A23E mov eax, [ecx+8] mov edi, ebx mov edx, 0C000000Dh test eax, eax jnz short loc_A1A266 loc_A1A25F: ; CODE XREF: sub_A1A21B+4Ej mov esi, edx jmp loc_A1A2E6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A266: ; CODE XREF: sub_A1A21B+42j cmp dword ptr [ecx], 3 jbe short loc_A1A25F loc_A1A26B: ; CODE XREF: sub_A1A21B+82j mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A278 xor esi, esi jmp short loc_A1A280 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A278: ; CODE XREF: sub_A1A21B+57j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A280: ; CODE XREF: sub_A1A21B+5Bj mov [ebp+var_8], ecx test esi, esi js short loc_A1A2C4 lea eax, [ebp+var_8] push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1A2C4 mov eax, [ebp+var_8] inc ebx cmp ebx, 3 jb short loc_A1A26B mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A2AC xor esi, esi jmp short loc_A1A2B4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A2AC: ; CODE XREF: sub_A1A21B+8Bj mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A2B4: ; CODE XREF: sub_A1A21B+8Fj test esi, esi js short loc_A1A2C4 mov edi, edx mov eax, edx neg edi sbb edi, edi and edi, ecx jmp short loc_A1A2C6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A2C4: ; CODE XREF: sub_A1A21B+6Aj ; sub_A1A21B+79j ... mov eax, edi loc_A1A2C6: ; CODE XREF: sub_A1A21B+A7j test esi, esi js short loc_A1A2E4 cmp eax, 8 jz short loc_A1A2D9 mov esi, 0C0000023h jmp loc_A1A714 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A2D9: ; CODE XREF: sub_A1A21B+B2j mov eax, [edi] mov [ebp+var_28], eax mov eax, [edi+4] mov [ebp+var_2C], eax loc_A1A2E4: ; CODE XREF: sub_A1A21B+ADj xor ebx, ebx loc_A1A2E6: ; CODE XREF: sub_A1A21B+46j test esi, esi js loc_A1A714 mov edx, [ebp+var_20] mov ecx, ebx and [ebp+var_1C], 0 mov edi, ebx mov [ebp+var_8], ebx mov [ebp+var_10], ecx mov eax, [edx+8] test eax, eax jnz short loc_A1A310 loc_A1A306: ; CODE XREF: sub_A1A21B+F8j mov esi, 0C000000Dh jmp loc_A1A3FB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A310: ; CODE XREF: sub_A1A21B+E9j cmp dword ptr [edx], 4 jbe short loc_A1A306 and [ebp+var_18], 0 loc_A1A319: ; CODE XREF: sub_A1A21B+13Ej mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A326 xor esi, esi jmp short loc_A1A32E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A326: ; CODE XREF: sub_A1A21B+105j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A32E: ; CODE XREF: sub_A1A21B+109j mov [ebp+var_C], ecx test esi, esi js loc_A1A3F8 lea eax, [ebp+var_C] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1A3F8 mov edx, [ebp+var_18] mov eax, [ebp+var_C] inc edx mov [ebp+var_18], edx cmp edx, 4 jb short loc_A1A319 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A368 xor esi, esi jmp short loc_A1A370 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A368: ; CODE XREF: sub_A1A21B+147j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A370: ; CODE XREF: sub_A1A21B+14Bj test esi, esi js loc_A1A3F8 mov edi, edx mov ebx, edx neg edi sbb edi, edi and edi, ecx test esi, esi js short loc_A1A3F8 test ebx, ebx jnz short loc_A1A3BF loc_A1A38A: ; CODE XREF: sub_A1A21B+1AAj ; sub_A1A21B+1B7j ... mov esi, 0C000003Eh loc_A1A38F: ; CODE XREF: sub_A1A21B+212j test esi, esi js loc_A1A714 loc_A1A397: ; CODE XREF: sub_A1A21B+22Bj mov edx, [ebp+var_20] xor ecx, ecx and [ebp+var_C], 0 xor edi, edi and [ebp+var_1C], ecx xor ebx, ebx mov [ebp+var_8], ecx mov eax, [edx+8] test eax, eax jnz loc_A1A44B loc_A1A3B5: ; CODE XREF: sub_A1A21B+233j mov esi, 0C000000Dh jmp loc_A1A557 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A3BF: ; CODE XREF: sub_A1A21B+16Dj test ebx, 1 jnz short loc_A1A38A mov eax, ebx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A1A38A lea eax, [ebp+var_1C] mov edx, ebx push eax mov ecx, edi call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A1A38A mov ecx, [ebp+var_1C] lea eax, [ecx+2] cmp eax, ebx jnz short loc_A1A38A shr ecx, 1 mov ebx, edi mov [ebp+var_10], ecx jmp short loc_A1A3FE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A3F8: ; CODE XREF: sub_A1A21B+118j ; sub_A1A21B+12Bj ... mov ecx, [ebp+var_10] loc_A1A3FB: ; CODE XREF: sub_A1A21B+F0j mov ebx, [ebp+var_8] loc_A1A3FE: ; CODE XREF: sub_A1A21B+1DBj test esi, esi js loc_A1A714 lea esi, ds:2[ecx*2] test esi, esi jz loc_A1A38A push 20534C53h push esi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A1A432 mov esi, 0C0000017h jmp loc_A1A38F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A432: ; CODE XREF: sub_A1A21B+20Bj push esi ; size_t push ebx ; void * push edi ; void * call _memcpy mov eax, [ebp+var_10] add esp, 0Ch mov [ebp+var_14], edi mov [ebp+var_24], eax jmp loc_A1A397 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A44B: ; CODE XREF: sub_A1A21B+194j cmp dword ptr [edx], 5 jbe loc_A1A3B5 and [ebp+var_20], ecx loc_A1A457: ; CODE XREF: sub_A1A21B+27Cj mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A464 xor esi, esi jmp short loc_A1A46C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A464: ; CODE XREF: sub_A1A21B+243j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A46C: ; CODE XREF: sub_A1A21B+247j mov [ebp+var_10], ecx test esi, esi js loc_A1A554 lea eax, [ebp+var_10] push eax call RtlUIntAdd mov esi, eax test esi, esi js loc_A1A554 mov edx, [ebp+var_20] mov eax, [ebp+var_10] inc edx mov [ebp+var_20], edx cmp edx, 5 jb short loc_A1A457 mov edx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A4A6 xor esi, esi jmp short loc_A1A4AE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A4A6: ; CODE XREF: sub_A1A21B+285j mov esi, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A4AE: ; CODE XREF: sub_A1A21B+289j test esi, esi js loc_A1A554 mov edi, edx mov ebx, edx neg edi sbb edi, edi and edi, ecx test esi, esi js loc_A1A554 test ebx, ebx jnz short loc_A1A51B loc_A1A4CC: ; CODE XREF: sub_A1A21B+306j ; sub_A1A21B+313j ... mov esi, 0C000003Eh loc_A1A4D1: ; CODE XREF: sub_A1A21B+36Ej test esi, esi js loc_A1A6F0 mov ebx, [ebp+var_4] mov eax, ebx loc_A1A4DE: ; CODE XREF: sub_A1A21B+386j mov esi, [ebp+var_14] lea eax, ds:2[eax*2] push ebx push eax mov eax, [ebp+var_24] push esi lea eax, ds:2[eax*2] push eax call ds:dword_A93EE8 mov edi, eax test edi, edi js loc_A1A5B7 mov eax, ds:dword_A93EB8 test eax, eax jz loc_A1A5A6 push esi call eax jmp loc_A1A5AB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A51B: ; CODE XREF: sub_A1A21B+2AFj test ebx, 1 jnz short loc_A1A4CC mov eax, ebx xor ecx, ecx shr eax, 1 cmp cx, [edi+eax*2-2] jnz short loc_A1A4CC lea eax, [ebp+var_1C] mov edx, ebx push eax mov ecx, edi call _StringCbLengthW@12 ; StringCbLengthW(x,x,x) test eax, eax js short loc_A1A4CC mov ecx, [ebp+var_1C] lea eax, [ecx+2] cmp eax, ebx jnz short loc_A1A4CC shr ecx, 1 mov ebx, edi mov [ebp+var_8], ecx jmp short loc_A1A55A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A554: ; CODE XREF: sub_A1A21B+256j ; sub_A1A21B+269j ... mov ecx, [ebp+var_8] loc_A1A557: ; CODE XREF: sub_A1A21B+19Fj mov ebx, [ebp+var_C] loc_A1A55A: ; CODE XREF: sub_A1A21B+337j test esi, esi js loc_A1A6F0 lea esi, ds:2[ecx*2] test esi, esi jz loc_A1A4CC push 20534C53h push esi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A1A58E mov esi, 0C0000017h jmp loc_A1A4D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A58E: ; CODE XREF: sub_A1A21B+367j push esi ; size_t push ebx ; void * push edi ; void * call _memcpy mov eax, [ebp+var_8] add esp, 0Ch mov ebx, edi mov [ebp+var_4], edi jmp loc_A1A4DE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A5A6: ; CODE XREF: sub_A1A21B+2F2j mov eax, 0C00000BBh loc_A1A5AB: ; CODE XREF: sub_A1A21B+2FBj lea edi, [eax+3FFFFD8Eh] neg edi sbb edi, edi and edi, eax loc_A1A5B7: ; CODE XREF: sub_A1A21B+2E5j and [ebp+var_8], 0 lea eax, [ebp+var_8] xor ecx, ecx push eax push 8 pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1A6F3 mov ecx, [ebp+var_8] lea eax, [ebp+var_8] push eax push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js loc_A1A6F3 mov esi, [ebp+arg_4] mov eax, [ebp+var_8] lea ebx, [esi+4] mov [ebx], eax test eax, eax jnz short loc_A1A605 mov esi, 0C000003Eh jmp loc_A1A6F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A605: ; CODE XREF: sub_A1A21B+3DEj push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1A622 mov esi, 0C0000017h jmp loc_A1A6F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A622: ; CODE XREF: sub_A1A21B+3FBj mov [esi+8], edx and dword ptr [esi], 0 or edi, 10000000h lea esi, [edx+4] cmp esi, edx jb loc_A1A6EB mov ecx, [ebx] lea eax, [edx+8] add ecx, edx cmp eax, ecx jbe short loc_A1A64E loc_A1A644: ; CODE XREF: sub_A1A21B+4B2j mov esi, 0C0000023h jmp loc_A1A6F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A64E: ; CODE XREF: sub_A1A21B+427j mov dword ptr [edx], 4 mov [esi], edi mov edi, [ebp+arg_4] inc dword ptr [edi] mov ecx, [edi] mov [ebp+var_30], ecx mov eax, [edi+8] mov [ebp+var_20], eax test eax, eax jnz short loc_A1A681 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1A6F0 inc dword ptr [edi] xor esi, esi jmp short loc_A1A6F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A681: ; CODE XREF: sub_A1A21B+44Dj and [ebp+var_24], 0 mov edi, eax mov [ebp+var_10], edi test ecx, ecx jz short loc_A1A6BB loc_A1A68E: ; CODE XREF: sub_A1A21B+49Bj mov edx, [edi] add edx, 4 cmp edx, 4 jb short loc_A1A6EB lea eax, [ebp+var_10] mov ecx, edi push eax call RtlUIntAdd mov esi, eax test esi, esi js short loc_A1A6F0 mov ecx, [ebp+var_24] mov edi, [ebp+var_10] inc ecx mov [ebp+var_24], ecx cmp ecx, [ebp+var_30] jb short loc_A1A68E mov eax, [ebp+var_20] loc_A1A6BB: ; CODE XREF: sub_A1A21B+471j lea edx, [edi+4] cmp edx, edi jb short loc_A1A6EB mov ecx, [ebx] xor esi, esi add ecx, eax lea eax, [edi+0Ch] cmp eax, ecx ja loc_A1A644 mov eax, [ebp+var_28] mov dword ptr [edi], 8 mov [edx], eax mov eax, [ebp+var_2C] mov [edx+4], eax mov eax, [ebp+arg_4] inc dword ptr [eax] jmp short loc_A1A6F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A6EB: ; CODE XREF: sub_A1A21B+418j ; sub_A1A21B+47Bj ... mov esi, 0C0000095h loc_A1A6F0: ; CODE XREF: sub_A1A21B+2B8j ; sub_A1A21B+341j ... mov ebx, [ebp+var_4] loc_A1A6F3: ; CODE XREF: sub_A1A21B+3B2j ; sub_A1A21B+3CBj mov eax, [ebp+var_14] test eax, eax jz short loc_A1A705 push 20534C53h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1A705: ; CODE XREF: sub_A1A21B+4DDj test ebx, ebx jz short loc_A1A714 push 20534C53h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1A714: ; CODE XREF: sub_A1A21B+28j ; sub_A1A21B+B9j ... pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A1A21B endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1A71D proc near ; CODE XREF: sub_785212+14CBp var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 24h and [ebp+var_10], 0 mov eax, edx and [ebp+var_14], 0 and [ebp+var_8], 0 mov [ebp+var_24], eax push ebx push esi push edi test ecx, ecx jnz short loc_A1A747 loc_A1A73D: ; CODE XREF: sub_A1A71D+2Cj ; sub_A1A71D+33j mov edx, 0C000000Dh jmp loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A747: ; CODE XREF: sub_A1A71D+1Ej test eax, eax jz short loc_A1A73D mov edi, [ebp+arg_4] test edi, edi jz short loc_A1A73D mov eax, [ecx+8] xor esi, esi and [ebp+var_4], esi test eax, eax jnz short loc_A1A768 loc_A1A75E: ; CODE XREF: sub_A1A71D+4Ej mov edx, 0C000000Dh jmp loc_A1A7F3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A768: ; CODE XREF: sub_A1A71D+3Fj cmp dword ptr [ecx], 3 jbe short loc_A1A75E xor ebx, ebx loc_A1A76F: ; CODE XREF: sub_A1A71D+8Aj mov ecx, [eax] mov [ebp+var_1C], ecx lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A77F xor edx, edx jmp short loc_A1A787 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A77F: ; CODE XREF: sub_A1A71D+5Cj mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A787: ; CODE XREF: sub_A1A71D+60j mov [ebp+arg_4], ecx test edx, edx js short loc_A1A7CE mov edx, [ebp+var_1C] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1A7CE mov eax, [ebp+arg_4] inc ebx cmp ebx, 3 jb short loc_A1A76F mov ebx, [eax] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A7B6 xor edx, edx jmp short loc_A1A7BE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A7B6: ; CODE XREF: sub_A1A71D+93j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A7BE: ; CODE XREF: sub_A1A71D+97j test edx, edx js short loc_A1A7CE mov esi, ebx mov eax, ebx neg esi sbb esi, esi and esi, ecx jmp short loc_A1A7D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A7CE: ; CODE XREF: sub_A1A71D+6Fj ; sub_A1A71D+81j ... mov eax, [ebp+var_4] loc_A1A7D1: ; CODE XREF: sub_A1A71D+AFj test edx, edx js loc_A1AA61 cmp eax, 8 jz short loc_A1A7E8 loc_A1A7DE: ; CODE XREF: sub_A1A71D+2A2j ; sub_A1A71D+323j mov edx, 0C0000023h jmp loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A7E8: ; CODE XREF: sub_A1A71D+BFj mov eax, [esi] mov [ebp+var_10], eax mov eax, [esi+4] mov [ebp+var_14], eax loc_A1A7F3: ; CODE XREF: sub_A1A71D+46j test edx, edx js loc_A1AA61 or [ebp+var_1C], 0FFFFFFFFh mov [ebp+var_20], 0FDE9F140h loc_A1A806: ; CODE XREF: sub_A1A71D+FEj lea eax, [ebp+var_20] push eax push 1 push 1 call _KeDelayExecutionThread@12 ; KeDelayExecutionThread(x,x,x) mov esi, eax cmp esi, 101h jz short loc_A1A806 test esi, esi js short loc_A1A86F mov ebx, 0C0h cmp esi, ebx jz short loc_A1A86F or [ebp+var_1C], 0FFFFFFFFh mov [ebp+var_20], 0EFE82080h loc_A1A835: ; CODE XREF: sub_A1A71D+134j lea eax, [ebp+var_20] push eax push 1 push 1 push 6 push offset unk_6B72E0 call KeWaitForSingleObject mov esi, eax cmp esi, 101h jz short loc_A1A835 test esi, esi js short loc_A1A86F cmp esi, ebx jz short loc_A1A86F cmp esi, 102h jz short loc_A1A86F push 0 push offset unk_6B72E0 call _KeReleaseMutex@8 ; KeReleaseMutex(x,x) loc_A1A86F: ; CODE XREF: sub_A1A71D+102j ; sub_A1A71D+10Bj ... push 8 pop ecx mov [ebp+arg_4], ecx lea eax, [ebp+arg_4] push eax push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1A88F mov eax, [ebp+arg_4] mov [ebp+var_8], eax jmp short loc_A1A892 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A88F: ; CODE XREF: sub_A1A71D+168j mov eax, [ebp+var_8] loc_A1A892: ; CODE XREF: sub_A1A71D+170j test edx, edx js loc_A1AA61 xor ebx, ebx mov [ebp+var_C], 8 lea ecx, [ebp+var_C] mov edx, eax push ecx push 8 pop ecx call RtlUIntAdd mov edx, eax test edx, edx js loc_A1AA61 mov eax, [ebp+var_C] lea ecx, [eax+7] and ecx, 0FFFFFFF8h cmp ecx, eax jnb short loc_A1A8CF mov edx, 0C0000095h jmp short loc_A1A8DC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A8CF: ; CODE XREF: sub_A1A71D+1A9j lea ebx, [ecx+8] cmp ebx, ecx jb loc_A1A95F xor edx, edx loc_A1A8DC: ; CODE XREF: sub_A1A71D+1B0j test edx, edx js loc_A1AA61 mov ecx, [ebp+var_24] mov edx, ebx push 4 mov eax, [ecx+10h] mov [ebp+var_1C], eax mov eax, [ecx+8] mov [ebp+var_24], eax lea eax, [ebp+arg_4] pop ecx push eax mov [ebp+arg_4], ecx call RtlUIntAdd mov edx, eax test edx, edx js loc_A1AA61 mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A91C xor edx, edx jmp short loc_A1A924 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A91C: ; CODE XREF: sub_A1A71D+1F9j mov edx, 0C0000095h or ecx, 0FFFFFFFFh loc_A1A924: ; CODE XREF: sub_A1A71D+1FDj mov [ebp+arg_4], ecx test edx, edx js loc_A1AA61 mov edx, [ebp+var_24] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax test edx, edx js loc_A1AA61 mov eax, [ebp+arg_4] lea ecx, [eax+4] cmp ecx, eax jb short loc_A1A95F mov edx, [ebp+var_1C] lea eax, [ebp+arg_4] push eax call RtlUIntAdd mov edx, eax jmp short loc_A1A964 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A95F: ; CODE XREF: sub_A1A71D+1B7j ; sub_A1A71D+230j mov edx, 0C0000095h loc_A1A964: ; CODE XREF: sub_A1A71D+240j test edx, edx js loc_A1AA61 mov eax, [ebp+var_8] lea ebx, [edi+4] mov [ebx], eax test eax, eax jnz short loc_A1A982 mov edx, 0C000003Eh jmp loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A982: ; CODE XREF: sub_A1A71D+259j push 20534C53h push eax push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov edx, eax test edx, edx jnz short loc_A1A99F mov edx, 0C0000017h jmp loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A99F: ; CODE XREF: sub_A1A71D+276j mov [edi+8], edx and dword ptr [edi], 0 or esi, 10000000h lea eax, [edx+4] cmp eax, edx jb loc_A1AA5C mov ecx, [ebx] lea eax, [edx+8] add ecx, edx cmp eax, ecx ja loc_A1A7DE mov dword ptr [edx], 4 mov [edx+4], esi inc dword ptr [edi] mov ecx, [edi] mov [ebp+var_24], ecx mov eax, [edi+8] mov [ebp+var_1C], eax test eax, eax jnz short loc_A1A9F6 mov ecx, [ebx] push ebx push 0Ch pop edx call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1AA61 inc dword ptr [edi] xor edx, edx jmp short loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1A9F6: ; CODE XREF: sub_A1A71D+2C0j and [ebp+var_8], 0 mov esi, eax mov [ebp+arg_4], esi test ecx, ecx jz short loc_A1AA2D loc_A1AA03: ; CODE XREF: sub_A1A71D+30Ej mov edx, [esi] add edx, 4 cmp edx, 4 jb short loc_A1AA5C lea eax, [ebp+arg_4] mov ecx, esi push eax call RtlUIntAdd mov edx, eax test edx, edx js short loc_A1AA61 mov ecx, [ebp+var_8] mov esi, [ebp+arg_4] inc ecx mov [ebp+var_8], ecx cmp ecx, [ebp+var_24] jb short loc_A1AA03 loc_A1AA2D: ; CODE XREF: sub_A1A71D+2E4j lea eax, [esi+4] cmp eax, esi jb short loc_A1AA5C mov ecx, [ebx] lea eax, [esi+0Ch] add ecx, [ebp+var_1C] xor edx, edx cmp eax, ecx ja loc_A1A7DE mov eax, [ebp+var_10] mov dword ptr [esi], 8 mov [esi+4], eax mov eax, [ebp+var_14] mov [esi+8], eax inc dword ptr [edi] jmp short loc_A1AA61 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AA5C: ; CODE XREF: sub_A1A71D+293j ; sub_A1A71D+2EEj ... mov edx, 0C0000095h loc_A1AA61: ; CODE XREF: sub_A1A71D+25j ; sub_A1A71D+B6j ... pop edi pop esi mov eax, edx pop ebx leave retn 8 sub_A1A71D endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1AA6A proc near ; CODE XREF: WarbirdKmDecryptPointer+EEp ; WarbirdKmDecryptPointer+11Bp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_8] xor edx, edx push ebx push esi push edi push 3 pop ebx push 0Fh pop ecx div ecx mov eax, [ebp+arg_4] mov edi, [ebp+arg_0] mov esi, [ebp+arg_18] and edi, ebx lea ecx, [edx+1] xor edx, edx div ebx lea eax, [edi+1] ror esi, cl mov ecx, [ebp+arg_14] add eax, edx and eax, ebx movzx eax, word ptr [ecx+eax*2] xor eax, [ebp+arg_18] movzx ecx, word ptr [ecx+edi*2] imul eax, ecx pop edi sub eax, esi pop esi pop ebx pop ebp retn 1Ch sub_A1AA6A endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1AAB4 proc near ; CODE XREF: PAGE:007812CAp var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 20h push offset dword_6AAAD8 call __SEH_prolog4 mov edi, edx mov ebx, ecx mov [ebp+var_24], ebx xor edx, edx mov [ebp+var_1C], edx mov [ebp+var_20], edx test ebx, ebx jz short loc_A1AB48 mov [ebp+ms_exc.disabled], edx cmp edi, 8 jnb short loc_A1AAEF mov esi, 0C000000Dh loc_A1AAE0: ; CODE XREF: sub_A1AAB4+92j mov [ebp+var_28], esi loc_A1AAE3: ; CODE XREF: sub_A1AAB4+5Ej mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp loc_A1AC11 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AAEF: ; CODE XREF: sub_A1AAB4+25j lea ecx, [ebx+edi] mov eax, ds:_MmUserProbeAddress cmp ecx, eax ja short loc_A1AAFF cmp ecx, ebx jnb short loc_A1AB01 loc_A1AAFF: ; CODE XREF: sub_A1AAB4+45j mov [eax], dl loc_A1AB01: ; CODE XREF: sub_A1AAB4+49j lea edx, [ebp+var_20] mov ecx, edi call sub_A1ACD8 mov esi, eax mov [ebp+var_28], esi test esi, esi js short loc_A1AAE3 push edi ; size_t push ebx ; void * mov esi, [ebp+var_20] push esi ; void * call _memcpy add esp, 0Ch mov eax, [esi] mov [ebp+var_2C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1AB4E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AB30: ; DATA XREF: .text:006AAAECo mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_30], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AB40: ; DATA XREF: .text:006AAAF0o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_30] jmp short loc_A1AAE0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AB48: ; CODE XREF: sub_A1AAB4+1Dj push 4 pop eax mov [ebp+var_2C], eax loc_A1AB4E: ; CODE XREF: sub_A1AAB4+7Aj xor ebx, ebx cmp eax, 7 setnz bl mov eax, large fs:124h mov eax, [eax+80h] lea ecx, [ebp+var_1C] push ecx push eax call _PsGetProcessId@4 ; PsGetProcessId(x) mov edx, ebx mov ecx, eax call sub_A1B500 mov esi, eax test esi, esi js loc_A1AC11 mov eax, [ebp+var_2C] dec eax cmp eax, 8 ; switch 9 cases ja loc_A1AC0C ; default jmp ds:off_A1AC34[eax*4] ; switch jump loc_A1AB93: ; DATA XREF: PAGE:off_A1AC34o push edi ; case 0x7 mov edx, [ebp+var_20] mov ecx, [ebp+var_1C] call sub_A1B731 loc_A1AB9F: ; CODE XREF: sub_A1AAB4+FBj ; sub_A1AAB4+109j ... mov esi, eax jmp short loc_A1AC11 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABA3: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o push edi ; case 0x8 mov edx, [ebp+var_20] mov ecx, [ebp+var_1C] call sub_A1B649 jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABB1: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o push edi ; case 0x0 mov edx, [ebp+var_20] mov ecx, [ebp+var_1C] call sub_A1BA08 jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABBF: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o push edi ; case 0x1 mov edx, [ebp+var_20] mov ecx, [ebp+var_1C] call sub_A1C4CE jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABCD: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o push edi ; case 0x2 push [ebp+var_24] ; int mov edx, [ebp+var_20] mov ecx, [ebp+var_1C] call sub_A1D36F jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABDE: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o cmp [ebp+var_20], 0 ; case 0x3 jnz short loc_A1AC0C ; default mov ecx, [ebp+var_1C] call sub_A1D4C6 jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ABEE: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o mov esi, [ebp+var_24] ; case 0x4 neg esi sbb esi, esi and esi, 0FFFFFFF5h add esi, 0C000000Dh jmp short loc_A1AC11 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AC00: ; CODE XREF: sub_A1AAB4+D8j ; DATA XREF: PAGE:off_A1AC34o mov ecx, [ebp+var_1C] ; case 0x6 mov ecx, [ecx] call WbRemoveWarbirdProcess jmp short loc_A1AB9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AC0C: ; CODE XREF: sub_A1AAB4+D2j ; sub_A1AAB4+12Ej mov esi, 0C000000Dh ; default loc_A1AC11: ; CODE XREF: sub_A1AAB4+36j ; sub_A1AAB4+C5j ... mov ecx, [ebp+var_1C] call sub_A1B39D mov ecx, [ebp+var_20] call sub_A1AD19 mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn sub_A1AAB4 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� align 4 off_A1AC34 dd offset loc_A1ABB1 ; DATA XREF: sub_A1AAB4+D8r dd offset loc_A1ABBF ; jump table for switch statement dd offset loc_A1ABCD dd offset loc_A1ABDE dd offset loc_A1ABEE dd offset loc_A1ABEE dd offset loc_A1AC00 dd offset loc_A1AB93 dd offset loc_A1ABA3 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __fastcall sub_A1AC58(int,void *,void *,int,int,int,int,int,int) sub_A1AC58 proc near ; CODE XREF: sub_A1BBB6+E8p ; sub_A1BD0C+121p ... var_B4 = dword ptr -0B4h var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_18 = dword ptr 20h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 0B4h mov eax, ___security_cookie xor eax, esp mov [esp+0B4h+var_4], eax push ebx push esi mov esi, [ebp+arg_10] mov eax, ecx mov ecx, [ebp+arg_18] test eax, eax mov eax, [ebp+arg_8] mov ebx, [ebp+arg_0] push edi push 28h mov [esp+0C4h+var_B4], ecx lea edi, [esp+0C4h+var_AC] pop ecx push [esp+0C0h+var_B4] ; int mov [esp+0C4h+var_B0], (offset loc_404E87+1) push [ebp+arg_C] ; int rep movsd push dword ptr [eax+4] ; int lea ecx, [esp+0CCh+var_B0] push dword ptr [eax] ; int push [ebp+arg_4] ; int push ebx ; void * push edx ; void * jz short loc_A1ACBA call sub_694E72 jmp short loc_A1ACBF ; void * ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ACBA: ; CODE XREF: sub_A1AC58+59j call sub_694B86 loc_A1ACBF: ; CODE XREF: sub_A1AC58+60j mov ecx, [esp+0C0h+var_4] xor eax, eax pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 1Ch sub_A1AC58 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1ACD8 proc near ; CODE XREF: sub_A1AAB4+52p ; sub_A1AD6F+6Ep ... mov edi, edi push ebx push esi xor esi, esi mov ebx, 42524157h mov eax, esi push edi mov edi, edx test ecx, ecx jz short loc_A1AD00 push ebx push ecx push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) test eax, eax jnz short loc_A1AD00 mov esi, 0C0000017h jmp short loc_A1AD13 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AD00: ; CODE XREF: sub_A1ACD8+12j ; sub_A1ACD8+1Fj test edi, edi jz short loc_A1AD08 mov [edi], eax mov eax, esi loc_A1AD08: ; CODE XREF: sub_A1ACD8+2Aj test eax, eax jz short loc_A1AD13 push ebx push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1AD13: ; CODE XREF: sub_A1ACD8+26j ; sub_A1ACD8+32j pop edi mov eax, esi pop esi pop ebx retn sub_A1ACD8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1AD19 proc near ; CODE XREF: sub_A1AAB4+168p test ecx, ecx jz short locret_A1AD28 push 42524157h push ecx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) locret_A1AD28: ; CODE XREF: sub_A1AD19+2j retn sub_A1AD19 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1AD29 proc near ; CODE XREF: sub_A1D36F+A9p mov edi, edi push ecx push esi push edi mov esi, ecx mov edi, edx mov ecx, large fs:124h push 1 push 1 lea edx, [esi+20h] push 0 mov dword ptr [edx], 10001h call PspGetContextThreadInternal test eax, eax js short loc_A1AD6B mov ecx, [esi+0D8h] mov [edi+4], ecx mov ecx, [esi+0E4h] mov [edi], ecx mov ecx, [esi+0E0h] mov [edi+8], ecx loc_A1AD6B: ; CODE XREF: sub_A1AD29+26j pop edi pop esi pop ecx retn sub_A1AD29 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1AD6F proc near ; CODE XREF: sub_A1B127+31p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx xor eax, eax mov ebx, ecx mov ecx, dword_6D6BE0 mov [ebp+var_8], eax mov [ebp+var_C], eax mov [ebp+var_4], eax mov [ebp+var_10], eax push esi push edi mov edi, edx test ecx, ecx jnz short loc_A1ADA0 mov esi, 0C000000Dh jmp loc_A1AE48 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ADA0: ; CODE XREF: sub_A1AD6F+25j sub esp, 0Ch lea edx, [ebp+var_8] push eax push eax call _BCryptCreateHash@28 ; BCryptCreateHash(x,x,x,x,x,x,x) mov esi, eax test esi, esi js loc_A1AE3C push ecx lea eax, [ebp+var_10] mov edx, (offset loc_8C215F+1) push eax push ecx mov ecx, dword_6D6BE0 lea eax, [ebp+var_4] push eax call _BCryptGetProperty@24 ; BCryptGetProperty(x,x,x,x,x,x) mov esi, eax test esi, esi js short loc_A1AE3C mov ecx, [ebp+var_4] lea edx, [ebp+var_C] call sub_A1ACD8 mov esi, eax test esi, esi js short loc_A1AE2A push ecx mov ecx, [ebp+var_8] mov edx, ebx push edi call _BCryptHashData@16 ; BCryptHashData(x,x,x,x) mov esi, eax test esi, esi js short loc_A1AE2A mov edi, [ebp+var_C] mov edx, edi push ecx push [ebp+var_4] mov ecx, [ebp+var_8] call _BCryptFinishHash@16 ; BCryptFinishHash(x,x,x,x) mov esi, eax test esi, esi js short loc_A1AE2D mov eax, [ebp+arg_0] test eax, eax jz short loc_A1AE1C mov [eax], edi xor edi, edi loc_A1AE1C: ; CODE XREF: sub_A1AD6F+A7j mov ecx, [ebp+arg_4] test ecx, ecx jz short loc_A1AE2D mov eax, [ebp+var_4] mov [ecx], eax jmp short loc_A1AE2D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AE2A: ; CODE XREF: sub_A1AD6F+77j ; sub_A1AD6F+89j mov edi, [ebp+var_C] loc_A1AE2D: ; CODE XREF: sub_A1AD6F+A0j ; sub_A1AD6F+B2j ... test edi, edi jz short loc_A1AE3C push 42524157h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1AE3C: ; CODE XREF: sub_A1AD6F+42j ; sub_A1AD6F+66j ... mov ecx, [ebp+var_8] test ecx, ecx jz short loc_A1AE48 call _BCryptDestroyHash@4 ; BCryptDestroyHash(x) loc_A1AE48: ; CODE XREF: sub_A1AD6F+2Cj ; sub_A1AD6F+D2j pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A1AD6F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1AE51 proc near ; CODE XREF: sub_A1BBB6:loc_A1BC30p ; sub_A1BD0C:loc_A1BD86p ... var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push 30h push offset dword_6AAB18 call __SEH_prolog4 mov eax, edx mov [ebp+var_34], eax mov [ebp+var_38], ecx xor esi, esi mov [ebp+var_20], esi xor ebx, ebx mov [ebp+var_24], ebx and [ebp+var_28], ebx mov [ebp+var_30], ecx mov [ebp+var_2C], eax lea eax, [ebp+var_28] push eax push 4 lea eax, [ebp+var_2C] push eax lea eax, [ebp+var_30] push eax push 0FFFFFFFFh call _ZwProtectVirtualMemory@20 ; ZwProtectVirtualMemory(x,x,x,x,x) mov edi, eax test edi, edi js loc_A1AF39 xor eax, eax mov [ebp+ms_exc.disabled], eax push eax push eax push eax push [ebp+var_34] push [ebp+var_38] call IoAllocateMdl mov esi, eax mov [ebp+var_20], esi test esi, esi jnz short loc_A1AEC4 loc_A1AEB3: ; CODE XREF: sub_A1AE51+A3j mov edi, 0C0000017h mov [ebp+var_1C], edi mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1AF39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AEC4: ; CODE XREF: sub_A1AE51+60j push 2 xor ebx, ebx inc ebx push ebx push esi call _MmProbeAndLockPages@12 ; MmProbeAndLockPages(x,x,x) mov [ebp+var_24], ebx test byte ptr [esi+6], 5 jz short loc_A1AEDE mov eax, [esi+0Ch] jmp short loc_A1AEEF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AEDE: ; CODE XREF: sub_A1AE51+86j push 40000020h xor eax, eax push eax push eax push ebx push eax push esi call MmMapLockedPagesSpecifyCache loc_A1AEEF: ; CODE XREF: sub_A1AE51+8Bj mov [ebp+var_3C], eax test eax, eax jz short loc_A1AEB3 mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov ecx, [ebp+arg_4] test ecx, ecx jz short loc_A1AF06 mov [ecx], eax loc_A1AF06: ; CODE XREF: sub_A1AE51+B1j mov eax, [ebp+arg_0] test eax, eax jz short loc_A1AF39 mov [eax], esi xor esi, esi jmp short loc_A1AF39 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AF13: ; DATA XREF: .text:006AAB2Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_40], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AF23: ; DATA XREF: .text:006AAB30o mov esp, [ebp+ms_exc.old_esp] mov edi, [ebp+var_40] mov [ebp+var_1C], edi mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov esi, [ebp+var_20] mov ebx, [ebp+var_24] loc_A1AF39: ; CODE XREF: sub_A1AE51+40j ; sub_A1AE51+71j ... test esi, esi jz short loc_A1AF4D test ebx, ebx jz short loc_A1AF47 push esi call _MmUnlockPages@4 ; MmUnlockPages(x) loc_A1AF47: ; CODE XREF: sub_A1AE51+EEj push esi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1AF4D: ; CODE XREF: sub_A1AE51+EAj mov eax, edi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 8 sub_A1AE51 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1AF61 proc near ; CODE XREF: sub_A1BBB6+73p ; sub_A1BD0C+73p ... var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push 20h push offset dword_6AAAF8 call __SEH_prolog4 xor esi, esi mov [ebp+var_20], esi mov ebx, esi mov [ebp+var_24], ebx mov [ebp+ms_exc.disabled], esi push esi push esi push esi push edx push ecx call IoAllocateMdl mov edi, eax mov [ebp+var_20], edi test edi, edi jnz short loc_A1AF9E loc_A1AF8D: ; CODE XREF: sub_A1AF61+69j mov esi, 0C0000017h mov [ebp+var_1C], esi mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1B00F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AF9E: ; CODE XREF: sub_A1AF61+2Aj mov ecx, edi call _MmProbeAndLockPagesPrivate@8 ; MmProbeAndLockPagesPrivate(x,x) xor ebx, ebx inc ebx mov [ebp+var_24], ebx test byte ptr [edi+6], 5 jz short loc_A1AFB6 mov eax, [edi+0Ch] jmp short loc_A1AFC5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AFB6: ; CODE XREF: sub_A1AF61+4Ej push 40000020h push esi push esi push ebx push esi push edi call MmMapLockedPagesSpecifyCache loc_A1AFC5: ; CODE XREF: sub_A1AF61+53j mov [ebp+var_28], eax test eax, eax jz short loc_A1AF8D mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov ecx, [ebp+arg_4] test ecx, ecx jz short loc_A1AFDC mov [ecx], eax loc_A1AFDC: ; CODE XREF: sub_A1AF61+77j mov eax, [ebp+arg_0] test eax, eax jz short loc_A1B00F mov [eax], edi mov edi, esi jmp short loc_A1B00F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AFE9: ; DATA XREF: .text:006AAB0Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_2C], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1AFF9: ; DATA XREF: .text:006AAB10o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_2C] mov [ebp+var_1C], esi mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov edi, [ebp+var_20] mov ebx, [ebp+var_24] loc_A1B00F: ; CODE XREF: sub_A1AF61+3Bj ; sub_A1AF61+80j ... test edi, edi jz short loc_A1B023 test ebx, ebx jz short loc_A1B01D push edi call _MmUnlockPages@4 ; MmUnlockPages(x) loc_A1B01D: ; CODE XREF: sub_A1AF61+B4j push edi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1B023: ; CODE XREF: sub_A1AF61+B0j mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 8 sub_A1AF61 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B037 proc near ; CODE XREF: sub_A1CAF1+6Ap ; sub_A1DBB6+83p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_4], 0 push ebx push esi push edi mov edi, [ebp+arg_0] mov ebx, ecx mov [ebp+var_8], edx mov ecx, edi lea edx, [ebp+var_4] call sub_A1ACD8 mov esi, [ebp+var_4] mov [ebp+arg_0], eax test eax, eax js short loc_A1B094 test ebx, ebx jz short loc_A1B089 mov eax, [ebp+var_8] test eax, eax jz short loc_A1B07E cmp edi, eax jb short loc_A1B073 mov edi, eax loc_A1B073: ; CODE XREF: sub_A1B037+38j push edi ; size_t push ebx ; void * push esi ; void * call _memcpy add esp, 0Ch loc_A1B07E: ; CODE XREF: sub_A1B037+34j push 42524157h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B089: ; CODE XREF: sub_A1B037+2Dj mov eax, [ebp+arg_4] test eax, eax jz short loc_A1B094 mov [eax], esi xor esi, esi loc_A1B094: ; CODE XREF: sub_A1B037+29j ; sub_A1B037+57j test esi, esi jz short loc_A1B0A3 push 42524157h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B0A3: ; CODE XREF: sub_A1B037+5Fj mov eax, [ebp+arg_0] pop edi pop esi pop ebx leave retn 8 sub_A1B037 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1B0AD proc near ; CODE XREF: sub_A1D36F+109p ; sub_A1D4C6+4Fp mov eax, large fs:124h push ebx push esi push edi dec word ptr [eax+13Eh] mov ebx, edx mov edi, ecx nop mov ecx, large fs:124h lea edx, [edi+20h] push 1 push 1 push 0 mov dword ptr [edi+20h], 10001h call PspGetContextThreadInternal mov esi, eax test esi, esi js short loc_A1B115 mov eax, [ebx+4] lea edx, [edi+20h] mov ecx, large fs:124h push 3 mov [edi+0D8h], eax mov eax, [ebx] push 1 mov [edi+0E4h], eax mov eax, [ebx+8] push 0 mov [edi+0E0h], eax call PspSetContextThreadInternal mov esi, eax loc_A1B115: ; CODE XREF: sub_A1B0AD+35j mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) pop edi mov eax, esi pop esi pop ebx retn sub_A1B0AD endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B127 proc near ; CODE XREF: sub_A1C264+10Bp ; sub_A1CBC6+8Dp ... var_8 = dword ptr -8 Source2 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+Source2], 0 and [ebp+var_8], 0 push ebx mov ebx, ecx push esi test ebx, ebx jnz short loc_A1B145 loc_A1B13E: ; CODE XREF: sub_A1B127+21j mov esi, 0C000000Dh jmp short loc_A1B198 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B145: ; CODE XREF: sub_A1B127+15j cmp edx, 20h jbe short loc_A1B13E lea eax, [ebp+var_8] add edx, 0FFFFFFE0h push eax lea eax, [ebp+Source2] push eax lea ecx, [ebx+20h] call sub_A1AD6F mov esi, eax test esi, esi js short loc_A1B185 cmp [ebp+var_8], 20h jz short loc_A1B170 mov esi, 0C000000Dh jmp short loc_A1B185 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B170: ; CODE XREF: sub_A1B127+40j push 20h ; Length push [ebp+Source2] ; Source2 push ebx ; Source1 call _RtlCompareMemory@12 ; RtlCompareMemory(x,x,x) cmp eax, 20h jz short loc_A1B185 mov esi, 0C0000428h loc_A1B185: ; CODE XREF: sub_A1B127+3Aj ; sub_A1B127+47j ... cmp [ebp+Source2], 0 jz short loc_A1B198 push 42524157h push [ebp+Source2] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B198: ; CODE XREF: sub_A1B127+1Cj ; sub_A1B127+62j mov eax, esi pop esi pop ebx leave retn sub_A1B127 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B19E proc near ; CODE XREF: sub_A1BBB6+4Cp ; sub_A1BD0C+4Cp ... var_34 = dword ptr -34h var_28 = dword ptr -28h var_20 = dword ptr -20h var_18 = dword ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 34h push ebx push esi push edi push 7 xor eax, eax lea edi, [ebp+var_34] mov esi, ecx mov ebx, edx pop ecx rep stosd lea edi, [ebp+var_18] stosd stosd stosd lea eax, [ebp+var_4] push eax push 0Ch lea eax, [ebp+var_18] xor edi, edi push eax push 6 push esi push 0FFFFFFFFh mov [ebp+var_C], edi mov [ebp+var_4], edi call _ZwQueryVirtualMemory@24 ; ZwQueryVirtualMemory(x,x,x,x,x,x) mov edx, eax test edx, edx js short loc_A1B241 mov eax, [ebp+var_10] shr eax, 2 and al, 0Fh mov byte ptr [ebp+var_8], al mov eax, dword_6BEA40 test eax, eax jz short loc_A1B23C push 0Ch push [ebp+var_8] call eax test eax, eax jz short loc_A1B23C mov edx, edi cmp [ebp+arg_0], edx jz short loc_A1B241 lea eax, [ebp+var_C] push eax push 1Ch lea eax, [ebp+var_34] push eax push edi push esi push 0FFFFFFFFh call _ZwQueryVirtualMemory@24 ; ZwQueryVirtualMemory(x,x,x,x,x,x) mov edx, eax test edx, edx js short loc_A1B241 mov ecx, [ebp+var_34] cmp esi, ecx jb short loc_A1B235 add ecx, [ebp+var_28] lea eax, [esi+ebx] cmp eax, ecx ja short loc_A1B235 cmp [ebp+var_20], 20h jz short loc_A1B241 loc_A1B235: ; CODE XREF: sub_A1B19E+85j ; sub_A1B19E+8Fj mov edx, 0C000000Dh jmp short loc_A1B241 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B23C: ; CODE XREF: sub_A1B19E+53j ; sub_A1B19E+5Ej mov edx, 0C0000428h loc_A1B241: ; CODE XREF: sub_A1B19E+3Fj ; sub_A1B19E+65j ... pop edi pop esi mov eax, edx pop ebx leave retn 4 sub_A1B19E endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B24A proc near ; CODE XREF: sub_A1B500+F6p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi push edi mov esi, ecx push 0FFFFFFFFh push 4 mov edx, esi push dword ptr [esi] push ecx mov ecx, offset unk_6D6BC0 call sub_A1DB7E mov edi, eax mov [ebp+var_8], edi test edi, edi js short loc_A1B29E lea edi, [esi+88h] loc_A1B279: ; CODE XREF: sub_A1B24A+4Aj ; sub_A1B24A+4Fj mov esi, [edi] mov ebx, esi mov edx, [edi+4] add ebx, 1 mov ecx, edx mov [ebp+var_4], edx adc ecx, 0 mov eax, esi nop lock cmpxchg8b qword ptr [edi] cmp eax, esi jnz short loc_A1B279 cmp edx, [ebp+var_4] jnz short loc_A1B279 mov edi, [ebp+var_8] loc_A1B29E: ; CODE XREF: sub_A1B24A+27j mov eax, edi pop edi pop esi pop ebx leave retn sub_A1B24A endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B2A5 proc near ; DATA XREF: sub_8820B8+11o ; sub_A1B2D2+8Fo arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp mov ecx, [ebp+arg_0] test ecx, ecx jnz short loc_A1B2BD xor eax, eax cmp [ebp+arg_4], eax jz short loc_A1B2C7 inc eax xor edx, edx jmp short loc_A1B2CE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B2BD: ; CODE XREF: sub_A1B2A5+Aj mov eax, [ebp+arg_4] test eax, eax jnz short loc_A1B2CB or eax, 0FFFFFFFFh loc_A1B2C7: ; CODE XREF: sub_A1B2A5+11j mov edx, eax jmp short loc_A1B2CE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B2CB: ; CODE XREF: sub_A1B2A5+1Dj sub eax, [ecx] cdq loc_A1B2CE: ; CODE XREF: sub_A1B2A5+16j ; sub_A1B2A5+24j pop ebp retn 0Ch sub_A1B2A5 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B2D2 proc near ; CODE XREF: sub_A1B500+B0p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_4], 0 push ebx push esi mov ebx, edx mov [ebp+var_8], ecx mov esi, 90h lea edx, [ebp+var_4] push edi mov ecx, esi call sub_A1ACD8 mov edi, eax test edi, edi js loc_A1B38C push esi ; size_t mov esi, [ebp+var_4] push 0 ; int push esi ; void * call _memset add dword ptr [esi+88h], 1 lea ecx, [esi+4] mov eax, [ebp+var_8] mov edx, offset sub_A1CB98 adc dword ptr [esi+8Ch], 0 add esp, 4 mov [esi], eax mov dword ptr [esi+20h], 3Ch call sub_88247E mov edi, eax test edi, edi js short loc_A1B38F and dword ptr [esi+2Ch], 0 lea eax, [esi+24h] push ecx push ecx lea ecx, [esi+68h] mov [eax+4], eax mov edx, offset sub_A1E19C mov [eax], eax call sub_88247E mov edi, eax test edi, edi js short loc_A1B38F push ecx push ecx lea ecx, [esi+30h] mov edx, offset sub_A1B2A5 call sub_88247E mov edi, eax test edi, edi js short loc_A1B38F push ecx push ecx lea ecx, [esi+4Ch] mov edx, offset sub_A1B90A call sub_88247E mov edi, eax test edi, edi js short loc_A1B38F mov [ebx], esi xor esi, esi jmp short loc_A1B38F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B38C: ; CODE XREF: sub_A1B2D2+27j mov esi, [ebp+var_4] loc_A1B38F: ; CODE XREF: sub_A1B2D2+67j ; sub_A1B2D2+88j ... mov ecx, esi call sub_A1B39D mov eax, edi pop edi pop esi pop ebx leave retn sub_A1B2D2 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B39D proc near ; CODE XREF: WbRemoveWarbirdProcess+17E394p ; sub_A1AAB4+160p ... var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi mov eax, ecx xor esi, esi mov [ebp+var_C], eax push edi mov edi, esi test eax, eax jz short loc_A1B401 add eax, 88h mov [ebp+var_4], eax loc_A1B3BD: ; CODE XREF: sub_A1B39D+48j ; sub_A1B39D+4Cj mov edx, [eax] mov ebx, edx mov edi, [eax+4] sub ebx, 1 mov ecx, edi mov [ebp+var_8], edx mov eax, edx sbb ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] cmp eax, ecx mov eax, [ebp+var_4] push 0 pop esi jnz short loc_A1B3BD cmp edx, edi jnz short loc_A1B3BD mov esi, ecx add esi, 0FFFFFFFFh mov ecx, esi adc edi, 0FFFFFFFFh or ecx, edi jnz short loc_A1B401 mov ecx, [ebp+var_C] call sub_A1B40A loc_A1B401: ; CODE XREF: sub_A1B39D+16j ; sub_A1B39D+5Aj mov edx, edi mov eax, esi pop edi pop esi pop ebx leave retn sub_A1B39D endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B40A proc near ; CODE XREF: sub_A1B39D+5Fp var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ebx push esi mov esi, ecx push edi test esi, esi jz loc_A1B4F4 xor edi, edi lea ecx, [esi+30h] mov ebx, edi cmp [esi+34h], edi jbe short loc_A1B447 loc_A1B429: ; CODE XREF: sub_A1B40A+36j mov eax, [esi+30h] mov ecx, esi mov edx, [esi+3Ch] imul eax, ebx mov edx, [eax+edx] call sub_A1E4FB inc ebx cmp ebx, [esi+34h] jb short loc_A1B429 xor edi, edi lea ecx, [esi+30h] loc_A1B447: ; CODE XREF: sub_A1B40A+1Dj call sub_A1DCA3 mov [ebp+var_4], edi cmp [esi+8], edi jbe short loc_A1B46F loc_A1B454: ; CODE XREF: sub_A1B40A+61j mov eax, [esi+4] mov ecx, esi mov edx, [esi+10h] imul eax, edi mov edx, [eax+edx] call sub_A1D14F inc edi cmp edi, [esi+8] jb short loc_A1B454 xor edi, edi loc_A1B46F: ; CODE XREF: sub_A1B40A+48j lea ecx, [esi+4] call sub_A1DCA3 lea ebx, [esi+24h] loc_A1B47A: ; CODE XREF: sub_A1B40A+8Ej mov edx, [ebx] cmp [edx+4], ebx jnz short loc_A1B4FB mov eax, [edx] cmp [eax+4], edx jnz short loc_A1B4FB mov [ebx], eax mov [eax+4], ebx cmp edx, ebx jz short loc_A1B49A mov ecx, esi call sub_A1D14F jmp short loc_A1B47A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B49A: ; CODE XREF: sub_A1B40A+85j lea ecx, [esi+4Ch] mov ebx, edi cmp [esi+50h], edi jbe short loc_A1B4C0 loc_A1B4A4: ; CODE XREF: sub_A1B40A+AFj mov eax, [esi+4Ch] mov ecx, [esi+58h] imul eax, ebx mov ecx, [eax+ecx] call sub_A1BED9 inc ebx cmp ebx, [esi+50h] jb short loc_A1B4A4 xor edi, edi lea ecx, [esi+4Ch] loc_A1B4C0: ; CODE XREF: sub_A1B40A+98j call sub_A1DCA3 cmp [esi+6Ch], edi jbe short loc_A1B4E1 loc_A1B4CA: ; CODE XREF: sub_A1B40A+D5j mov eax, [esi+68h] mov ecx, [esi+74h] imul eax, edi mov ecx, [eax+ecx] call sub_A1E255 inc edi cmp edi, [esi+6Ch] jb short loc_A1B4CA loc_A1B4E1: ; CODE XREF: sub_A1B40A+BEj lea ecx, [esi+68h] call sub_A1DCA3 push 42524157h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B4F4: ; CODE XREF: sub_A1B40A+Dj pop edi pop esi xor eax, eax pop ebx leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B4FB: ; CODE XREF: sub_A1B40A+75j ; sub_A1B40A+7Cj push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR sub_A1B40A endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B500 proc near ; CODE XREF: sub_A1AAB4+BCp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx mov eax, large fs:124h push ebx push esi push edi xor edi, edi mov [ebp+var_8], edx dec word ptr [eax+13Eh] mov ebx, ecx mov [ebp+var_4], edi nop push edi xor edx, edx mov ecx, offset unk_6D6BD8 call KeAbPreAcquire push 11h mov esi, eax mov edx, offset unk_6D6BD8 pop ecx xor eax, eax lock cmpxchg [edx], ecx test eax, eax jz short loc_A1B54F mov eax, edx mov edx, esi push eax mov ecx, eax call ExfAcquirePushLockSharedEx loc_A1B54F: ; CODE XREF: sub_A1B500+41j test esi, esi jz short loc_A1B557 or byte ptr [esi+0Eh], 1 loc_A1B557: ; CODE XREF: sub_A1B500+51j push ecx lea edx, [ebp+var_4] mov ecx, ebx call WbFindWarbirdProcess push 11h mov esi, eax xor ecx, ecx pop eax mov edx, offset unk_6D6BD8 lock cmpxchg [edx], ecx cmp eax, 11h jz short loc_A1B583 mov ecx, edx call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) mov edx, offset unk_6D6BD8 loc_A1B583: ; CODE XREF: sub_A1B500+75j mov ecx, edx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) cmp esi, 0C0000272h jnz loc_A1B624 cmp [ebp+var_8], edi jz loc_A1B636 lea edx, [ebp+var_4] mov ecx, ebx call sub_A1B2D2 mov esi, eax test esi, esi js short loc_A1B636 mov eax, large fs:124h dec word ptr [eax+13Eh] nop mov ebx, offset unk_6D6BD8 xor edx, edx push edi mov ecx, ebx call KeAbPreAcquire mov esi, eax lock bts dword ptr [ebx], 0 jnb short loc_A1B5EB push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockExclusiveEx loc_A1B5EB: ; CODE XREF: sub_A1B500+DFj test esi, esi jz short loc_A1B5F3 or byte ptr [esi+0Eh], 1 loc_A1B5F3: ; CODE XREF: sub_A1B500+EDj mov ecx, [ebp+var_4] call sub_A1B24A mov esi, eax or eax, 0FFFFFFFFh lock xadd [ebx], eax and al, 6 cmp al, 2 jnz short loc_A1B611 mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1B611: ; CODE XREF: sub_A1B500+108j mov ecx, ebx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) loc_A1B624: ; CODE XREF: sub_A1B500+9Cj test esi, esi js short loc_A1B636 mov ecx, [ebp+arg_0] test ecx, ecx jz short loc_A1B636 mov eax, [ebp+var_4] mov [ecx], eax jmp short loc_A1B639 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B636: ; CODE XREF: sub_A1B500+A5j ; sub_A1B500+B9j ... mov edi, [ebp+var_4] loc_A1B639: ; CODE XREF: sub_A1B500+134j mov ecx, edi call sub_A1B39D pop edi mov eax, esi pop esi pop ebx leave retn 4 sub_A1B500 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B649 proc near ; CODE XREF: sub_A1AAB4+F6p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 14h push offset dword_6AAB58 call __SEH_prolog4 mov esi, edx mov ebx, ecx and [ebp+var_1C], 0 cmp [ebp+arg_0], 10h jb loc_A1B706 cmp dword ptr [esi], 9 jnz loc_A1B706 cmp dword ptr [esi+4], 0 jnz loc_A1B706 lea edx, [ebp+var_1C] push 8 pop ecx call sub_A1ACD8 mov edi, eax mov [ebp+var_20], edi test edi, edi js short loc_A1B70B and [ebp+ms_exc.disabled], 0 mov edx, [esi+8] lea ecx, [edx+8] mov eax, ds:_MmUserProbeAddress cmp ecx, eax ja short loc_A1B6A5 cmp ecx, edx jnb short loc_A1B6AB loc_A1B6A5: ; CODE XREF: sub_A1B649+56j mov byte ptr [eax], 0 mov edx, [esi+8] loc_A1B6AB: ; CODE XREF: sub_A1B649+5Aj mov eax, [edx] mov ecx, [ebp+var_1C] mov [ecx], eax mov eax, [edx+4] mov [ecx+4], eax cmp dword ptr [ecx], 0 jz short loc_A1B6CE mov edi, 0C000000Dh loc_A1B6C2: ; CODE XREF: sub_A1B649+BBj mov [ebp+var_20], edi mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1B70B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B6CE: ; CODE XREF: sub_A1B649+72j mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov esi, [ebp+var_1C] mov edx, [esi+4] mov ecx, ebx call _WbHeapExecutionUnloadModule@8 ; WbHeapExecutionUnloadModule(x,x) mov edx, [esi+4] mov ecx, ebx call sub_A1C136 jmp short loc_A1B70B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B6EE: ; DATA XREF: .text:006AAB6Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_24], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B6FE: ; DATA XREF: .text:006AAB70o mov esp, [ebp+ms_exc.old_esp] mov edi, [ebp+var_24] jmp short loc_A1B6C2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B706: ; CODE XREF: sub_A1B649+18j ; sub_A1B649+21j ... mov edi, 0C000000Dh loc_A1B70B: ; CODE XREF: sub_A1B649+43j ; sub_A1B649+83j ... mov ecx, [ebp+var_1C] test ecx, ecx jz short loc_A1B71D push 42524157h push ecx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B71D: ; CODE XREF: sub_A1B649+C7j mov eax, edi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 sub_A1B649 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B731 proc near ; CODE XREF: sub_A1AAB4+E6p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 1Ch push offset dword_6AAB38 call __SEH_prolog4 mov esi, edx mov [ebp+var_24], ecx and [ebp+var_1C], 0 push 10h pop ecx cmp [ebp+arg_0], ecx jb loc_A1B7E9 cmp dword ptr [esi], 8 jnz loc_A1B7E9 cmp dword ptr [esi+4], 0 jnz loc_A1B7E9 lea edx, [ebp+var_1C] call sub_A1ACD8 mov ebx, eax mov [ebp+var_20], ebx test ebx, ebx js short loc_A1B7EE and [ebp+ms_exc.disabled], 0 mov eax, [esi+8] lea edx, [eax+10h] mov ecx, ds:_MmUserProbeAddress cmp edx, ecx ja short loc_A1B78E cmp edx, eax jnb short loc_A1B794 loc_A1B78E: ; CODE XREF: sub_A1B731+57j mov byte ptr [ecx], 0 mov eax, [esi+8] loc_A1B794: ; CODE XREF: sub_A1B731+5Bj mov esi, eax mov eax, [ebp+var_1C] mov edi, eax movsd movsd movsd movsd cmp dword ptr [eax], 0 jz short loc_A1B7B5 mov ebx, 0C000000Dh loc_A1B7A9: ; CODE XREF: sub_A1B731+B6j mov [ebp+var_20], ebx loc_A1B7AC: ; CODE XREF: sub_A1B731+8Bj ; sub_A1B731+9Ej mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1B7EE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B7B5: ; CODE XREF: sub_A1B731+71j mov ecx, [ebp+var_24] cmp dword ptr [ecx+20h], 0 jz short loc_A1B7AC mov eax, [ebp+var_1C] mov eax, [eax+4] cmp eax, 3Ch jb short loc_A1B7CC push 3Ch pop eax loc_A1B7CC: ; CODE XREF: sub_A1B731+96j mov [ecx+20h], eax jmp short loc_A1B7AC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B7D1: ; DATA XREF: .text:006AAB4Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_28], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B7E1: ; DATA XREF: .text:006AAB50o mov esp, [ebp+ms_exc.old_esp] mov ebx, [ebp+var_28] jmp short loc_A1B7A9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B7E9: ; CODE XREF: sub_A1B731+1Bj ; sub_A1B731+24j ... mov ebx, 0C000000Dh loc_A1B7EE: ; CODE XREF: sub_A1B731+43j ; sub_A1B731+82j mov eax, [ebp+var_1C] test eax, eax jz short loc_A1B800 push 42524157h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1B800: ; CODE XREF: sub_A1B731+C2j mov eax, ebx mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 sub_A1B731 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B814 proc near ; CODE XREF: sub_A1C03B+B4p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 18h mov eax, [edx+14h] mov [ebp+var_14], eax mov eax, [edx+18h] push ebx mov [ebp+var_18], eax mov eax, large fs:124h push esi push edi mov edi, ecx mov [ebp+var_10], edx xor ecx, ecx mov [ebp+var_C], edi dec word ptr [eax+13Eh] mov [ebp+var_4], ecx mov [ebp+var_8], ecx nop lea ebx, [edi+64h] xor edx, edx push ecx mov ecx, ebx call KeAbPreAcquire mov esi, eax lock bts dword ptr [ebx], 0 jnb short loc_A1B869 push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockExclusiveEx loc_A1B869: ; CODE XREF: sub_A1B814+49j test esi, esi jz short loc_A1B871 or byte ptr [esi+0Eh], 1 loc_A1B871: ; CODE XREF: sub_A1B814+57j lea eax, [ebp+var_8] mov ecx, edi push eax lea eax, [ebp+var_4] push eax lea edx, [ebp+var_18] call sub_A1BE9B mov edi, eax test edi, edi jnz short loc_A1B8A1 cmp [ebp+arg_0], eax jz short loc_A1B8D2 mov esi, [ebp+var_4] mov ecx, esi call sub_A1C206 mov eax, [ebp+arg_0] xor ecx, ecx mov [eax], esi jmp short loc_A1B8D5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B8A1: ; CODE XREF: sub_A1B814+73j cmp edi, 0C0000272h jnz short loc_A1B8D2 push [ebp+var_8] mov esi, [ebp+var_10] lea eax, [ebp+var_18] push 8 push eax push ecx mov ecx, [ebp+var_C] mov edx, esi add ecx, 4Ch call sub_A1DB7E mov edi, eax test edi, edi js short loc_A1B8D2 mov ecx, esi call sub_A1C206 mov edi, eax loc_A1B8D2: ; CODE XREF: sub_A1B814+78j ; sub_A1B814+93j ... mov ecx, [ebp+var_4] loc_A1B8D5: ; CODE XREF: sub_A1B814+8Bj call sub_A1B9A1 or eax, 0FFFFFFFFh lock xadd [ebx], eax and al, 6 cmp al, 2 jnz short loc_A1B8EE mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1B8EE: ; CODE XREF: sub_A1B814+D1j mov ecx, ebx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1B814 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B90A proc near ; DATA XREF: sub_A1B2D2+A4o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push esi mov esi, [ebp+arg_4] push edi mov edi, [ebp+arg_0] mov eax, [esi] sub eax, [edi+18h] cdq mov ecx, eax or ecx, edx jnz short loc_A1B92A mov eax, [esi+4] sub eax, [edi+14h] cdq loc_A1B92A: ; CODE XREF: sub_A1B90A+17j pop edi pop esi pop ebp retn 0Ch sub_A1B90A endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B930 proc near ; CODE XREF: sub_A1C03B+9Ep var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi push edi push 40h mov [ebp+var_C], edx xor edi, edi mov [ebp+var_8], ecx lea edx, [ebp+var_4] pop ecx mov [ebp+var_4], edi call sub_A1ACD8 mov ebx, eax test ebx, ebx js short loc_A1B990 mov esi, [ebp+var_4] push 40h ; size_t push edi ; int push esi ; void * call _memset mov ecx, [ebp+var_8] add esp, 0Ch mov dword ptr [esi], 1 mov [esi+4], edi mov [esi+8], edi mov [esi+10h], edi mov [esi+0Ch], edi mov eax, [ecx+4] mov [esi+14h], eax mov eax, [ecx] mov [esi+18h], eax mov eax, [ebp+var_C] mov [esi+1Ch], edi mov [eax], esi jmp short loc_A1B993 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B990: ; CODE XREF: sub_A1B930+25j mov edi, [ebp+var_4] loc_A1B993: ; CODE XREF: sub_A1B930+5Ej mov ecx, edi call sub_A1B9A1 pop edi pop esi mov eax, ebx pop ebx leave retn sub_A1B930 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1B9A1 proc near ; CODE XREF: sub_A1B814:loc_A1B8D5p ; sub_A1B930+65p ... var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi mov eax, ecx xor esi, esi mov [ebp+var_4], eax push edi mov edi, esi test eax, eax jz short loc_A1B9FF jmp short loc_A1B9BE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1B9BB: ; CODE XREF: sub_A1B9A1+42j ; sub_A1B9A1+46j mov eax, [ebp+var_4] loc_A1B9BE: ; CODE XREF: sub_A1B9A1+18j mov edx, [eax] mov ebx, edx mov edi, [eax+4] sub ebx, 1 mov ecx, edi mov [ebp+var_8], edx mov eax, edx sbb ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] push 0 pop esi cmp eax, ecx jnz short loc_A1B9BB cmp edx, edi jnz short loc_A1B9BB mov esi, ecx add esi, 0FFFFFFFFh mov ecx, esi adc edi, 0FFFFFFFFh or ecx, edi jnz short loc_A1B9FF mov ecx, [ebp+var_4] call sub_A1BED9 loc_A1B9FF: ; CODE XREF: sub_A1B9A1+16j ; sub_A1B9A1+54j mov edx, edi mov eax, esi pop edi pop esi pop ebx leave retn sub_A1B9A1 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BA08 proc near ; CODE XREF: sub_A1AAB4+104p var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_4], 0 cmp [ebp+arg_0], 10h push ebx push esi push edi jnb short loc_A1BA23 mov edi, 0C000000Dh jmp short loc_A1BA9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BA23: ; CODE XREF: sub_A1BA08+12j lea eax, [ebp+var_4] push eax push [ebp+arg_0] call sub_A1BF12 mov edi, eax test edi, edi js short loc_A1BA9F mov eax, large fs:124h dec word ptr [eax+13Eh] nop mov ebx, [ebp+var_4] xor edx, edx push 0 lea esi, [ebx+8] mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1BA67 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1BA67: ; CODE XREF: sub_A1BA08+53j test edi, edi jz short loc_A1BA6F or byte ptr [edi+0Eh], 1 loc_A1BA6F: ; CODE XREF: sub_A1BA08+61j mov ecx, ebx call sub_A1BAB0 mov edi, eax or eax, 0FFFFFFFFh lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1BA8C mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1BA8C: ; CODE XREF: sub_A1BA08+7Bj mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) loc_A1BA9F: ; CODE XREF: sub_A1BA08+19j ; sub_A1BA08+2Bj mov ecx, [ebp+var_4] call sub_A1B9A1 mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1BA08 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BAB0 proc near ; CODE XREF: sub_A1BA08+69p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 14h push ebx push esi mov esi, ecx push edi xor edi, edi mov edx, [esi+30h] mov eax, edx mov ecx, [esi+34h] and eax, ecx cmp eax, 0FFFFFFFFh jz loc_A1BBAB add edx, 1 mov [esi+30h], edx adc ecx, edi mov [esi+34h], ecx cmp edx, 1 jnz loc_A1BBAB test ecx, ecx jnz loc_A1BBAB cmp [esi+24h], edx jz short loc_A1BB04 call sub_597FFE cmp [esi+24h], edi jnz loc_A1BBA4 loc_A1BB04: ; CODE XREF: sub_A1BAB0+44j mov eax, [esi+2Ch] mov ebx, [esi+38h] mov eax, [eax+0F0h] mov [esp+20h+var_8], eax cmp ebx, eax jnb loc_A1BBAD mov eax, [esi+3Ch] imul ecx, ebx, 0Ch mov [esp+20h+var_10], ecx mov ecx, ebx shl ecx, 4 mov [esp+20h+var_C], ecx loc_A1BB2F: ; CODE XREF: sub_A1BAB0+F0j cmp ebx, eax sbb edi, edi inc edi cmp dword ptr [esi+24h], 1 mov [esp+20h+var_4], edi jnz short loc_A1BB54 mov eax, [esi+2Ch] mov edx, edi add eax, 0F8h add eax, ecx mov ecx, esi push eax call sub_A1BD0C jmp short loc_A1BB78 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BB54: ; CODE XREF: sub_A1BAB0+8Cj call sub_597FFE cmp dword ptr [esi+24h], 0 jnz short loc_A1BBA4 mov ecx, [esp+20h+var_10] mov edx, edi mov eax, [esi+2Ch] add ecx, 0F4h add eax, ecx mov ecx, esi push eax call sub_A1BBB6 loc_A1BB78: ; CODE XREF: sub_A1BAB0+A2j mov edi, eax test edi, edi js short loc_A1BBAD mov eax, [esp+20h+var_4] add [esi+3Ch], eax inc dword ptr [esi+38h] inc ebx mov ecx, [esp+20h+var_C] add [esp+20h+var_10], 0Ch add ecx, 10h mov eax, [esi+3Ch] mov [esp+20h+var_C], ecx cmp ebx, [esp+20h+var_8] jb short loc_A1BB2F jmp short loc_A1BBAD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BBA4: ; CODE XREF: sub_A1BAB0+4Ej ; sub_A1BAB0+ADj mov edi, 0C000000Dh jmp short loc_A1BBAD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BBAB: ; CODE XREF: sub_A1BAB0+1Fj ; sub_A1BAB0+33j ... xor edi, edi loc_A1BBAD: ; CODE XREF: sub_A1BAB0+66j ; sub_A1BAB0+CCj ... mov eax, edi pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_A1BAB0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BBB6 proc near ; CODE XREF: sub_A1BAB0+C3p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = dword ptr -1 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 18h push ebx xor ebx, ebx mov [ebp+var_14], edx mov [ebp+var_8], ebx mov eax, ecx mov [ebp+var_C], eax mov [ebp+var_10], ebx mov byte ptr [ebp+var_1], bl push esi mov esi, [ebp+arg_0] push edi test edx, edx jz short loc_A1BBE4 test byte ptr [esi], 1 jnz loc_A1BD03 loc_A1BBE4: ; CODE XREF: sub_A1BBB6+23j mov edi, [esi+4] mov ecx, 0FFFFFFFh mov edx, [esi+8] and edi, ecx add edi, [eax+18h] and edx, ecx mov eax, [esi] mov ecx, edi shr eax, 1 not eax and eax, 1 push eax call sub_A1B19E mov ebx, eax test ebx, ebx js loc_A1BD03 mov edx, [esi+8] lea eax, [ebp+var_8] push eax and edx, 0FFFFFFFh lea eax, [ebp+var_10] test byte ptr [esi], 2 mov ecx, edi push eax jnz short loc_A1BC30 call sub_A1AF61 jmp short loc_A1BC35 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BC30: ; CODE XREF: sub_A1BBB6+71j call sub_A1AE51 loc_A1BC35: ; CODE XREF: sub_A1BBB6+78j mov ebx, eax test ebx, ebx js loc_A1BCF0 cmp [ebp+var_14], 0 jz short loc_A1BC73 mov ebx, [ebp+var_C] mov eax, [esi+8] and eax, 0FFFFFFFh push eax mov edx, [ebx+2Ch] push [ebp+var_8] mov ecx, [ebx+18h] push edi mov eax, [edx+38h] mov edx, [edx+30h] sub eax, ecx push eax push ecx mov ecx, [ebx+20h] call sub_695200 mov ebx, eax test ebx, ebx js short loc_A1BCF0 loc_A1BC73: ; CODE XREF: sub_A1BBB6+8Dj mov ecx, [ebp+var_C] lea eax, [ebp+var_1] push eax ; int mov edx, 0FFFFFFFh mov ecx, [ecx+2Ch] push ecx ; int lea eax, [ecx+50h] push eax ; int mov eax, [esi+4] and eax, edx push eax ; int lea eax, [ecx+48h] xor ecx, ecx ; int push eax ; int mov eax, [esi+8] and eax, edx mov edx, edi ; void * push eax ; int push [ebp+var_8] ; void * call sub_A1AC58 mov ebx, eax test ebx, ebx js short loc_A1BCF0 cmp [ebp+var_14], 0 jz short loc_A1BCDD mov ebx, [ebp+var_C] mov eax, [esi+8] and eax, 0FFFFFFFh push eax mov edx, [ebx+2Ch] mov ecx, [ebx+18h] mov eax, ecx push [ebp+var_8] sub eax, [edx+38h] mov edx, [edx+30h] push edi push eax push ecx mov ecx, [ebx+20h] call sub_695200 mov ebx, eax test ebx, ebx js short loc_A1BCF0 loc_A1BCDD: ; CODE XREF: sub_A1BBB6+F7j mov eax, [esi+8] and eax, 0FFFFFFFh push eax push edi push 0FFFFFFFFh call _ZwFlushInstructionCache@12 ; ZwFlushInstructionCache(x,x,x) mov ebx, eax loc_A1BCF0: ; CODE XREF: sub_A1BBB6+83j ; sub_A1BBB6+BBj ... mov esi, [ebp+var_10] test esi, esi jz short loc_A1BD03 push esi call _MmUnlockPages@4 ; MmUnlockPages(x) push esi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1BD03: ; CODE XREF: sub_A1BBB6+28j ; sub_A1BBB6+55j ... pop edi pop esi mov eax, ebx pop ebx leave retn 4 sub_A1BBB6 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BD0C proc near ; CODE XREF: sub_A1BAB0+9Dp var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = dword ptr -1 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 18h push ebx xor ebx, ebx mov [ebp+var_14], edx mov [ebp+var_8], ebx mov eax, ecx mov [ebp+var_C], eax mov [ebp+var_10], ebx mov byte ptr [ebp+var_1], bl push esi mov esi, [ebp+arg_0] push edi test edx, edx jz short loc_A1BD3A test byte ptr [esi], 1 jnz loc_A1BE92 loc_A1BD3A: ; CODE XREF: sub_A1BD0C+23j mov edi, [esi+4] mov ecx, 0FFFFFFFh mov edx, [esi+8] and edi, ecx add edi, [eax+18h] and edx, ecx mov eax, [esi] mov ecx, edi shr eax, 1 not eax and eax, 1 push eax call sub_A1B19E mov ebx, eax test ebx, ebx js loc_A1BE92 mov edx, [esi+8] lea eax, [ebp+var_8] push eax and edx, 0FFFFFFFh lea eax, [ebp+var_10] test byte ptr [esi], 2 mov ecx, edi push eax jnz short loc_A1BD86 call sub_A1AF61 jmp short loc_A1BD8B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BD86: ; CODE XREF: sub_A1BD0C+71j call sub_A1AE51 loc_A1BD8B: ; CODE XREF: sub_A1BD0C+78j mov ebx, eax test ebx, ebx js loc_A1BE7F cmp [ebp+var_14], 0 jz short loc_A1BDCD mov ebx, [ebp+var_C] mov eax, [esi+8] and eax, 0FFFFFFFh push eax mov edx, [ebx+2Ch] push [ebp+var_8] mov ecx, [ebx+18h] push edi mov eax, [edx+38h] mov edx, [edx+30h] sub eax, ecx push eax push ecx mov ecx, [ebx+20h] call sub_695200 mov ebx, eax test ebx, ebx js loc_A1BE7F loc_A1BDCD: ; CODE XREF: sub_A1BD0C+8Dj mov eax, [esi+8] mov ebx, [ebp+var_8] and eax, 0FFFFFFFh push eax ; size_t push edi ; void * push ebx ; void * call _memcpy mov ecx, [esi] add esp, 0Ch mov edx, 0FFFFFFFh and ecx, 2 jnz short loc_A1BE00 mov eax, [esi+8] and eax, edx cmp eax, 4 jnb short loc_A1BE00 mov ebx, 0C000000Dh jmp short loc_A1BE7F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1BE00: ; CODE XREF: sub_A1BD0C+E1j ; sub_A1BD0C+EBj test ecx, ecx jnz short loc_A1BE09 mov eax, [esi+0Ch] mov [ebx], eax loc_A1BE09: ; CODE XREF: sub_A1BD0C+F6j mov ecx, [ebp+var_C] lea eax, [ebp+var_1] push eax ; int mov ecx, [ecx+2Ch] push ecx ; int lea eax, [ecx+50h] push eax ; int mov eax, [esi+4] and eax, edx push eax ; int lea eax, [ecx+48h] xor ecx, ecx ; int push eax ; int mov eax, [esi+8] and eax, edx mov edx, ebx ; void * push eax ; int push ebx ; void * call sub_A1AC58 mov ebx, eax test ebx, ebx js short loc_A1BE7F cmp [ebp+var_14], 0 jz short loc_A1BE6C mov ebx, [ebp+var_C] mov eax, [esi+8] and eax, 0FFFFFFFh push eax mov edx, [ebx+2Ch] mov ecx, [ebx+18h] mov eax, ecx push [ebp+var_8] sub eax, [edx+38h] mov edx, [edx+30h] push edi push eax push ecx mov ecx, [ebx+20h] call sub_695200 mov ebx, eax test ebx, ebx js short loc_A1BE7F loc_A1BE6C: ; CODE XREF: sub_A1BD0C+130j mov eax, [esi+8] and eax, 0FFFFFFFh push eax push edi push 0FFFFFFFFh call _ZwFlushInstructionCache@12 ; ZwFlushInstructionCache(x,x,x) mov ebx, eax loc_A1BE7F: ; CODE XREF: sub_A1BD0C+83j ; sub_A1BD0C+BBj ... mov esi, [ebp+var_10] test esi, esi jz short loc_A1BE92 push esi call _MmUnlockPages@4 ; MmUnlockPages(x) push esi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1BE92: ; CODE XREF: sub_A1BD0C+28j ; sub_A1BD0C+55j ... pop edi pop esi mov eax, ebx pop ebx leave retn 4 sub_A1BD0C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BE9B proc near ; CODE XREF: sub_A1B814+6Ap ; sub_A1C03B+61p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx push [ebp+arg_4] and [ebp+var_4], 0 lea eax, [ebp+var_4] push eax push 8 add ecx, 4Ch call WbFindLookupEntry test eax, eax js short locret_A1BED5 push esi mov esi, [ebp+arg_0] test esi, esi jz short loc_A1BED4 push edi mov edi, [ebp+var_4] mov ecx, edi call sub_A1C206 test eax, eax js short loc_A1BED3 mov [esi], edi loc_A1BED3: ; CODE XREF: sub_A1BE9B+34j pop edi loc_A1BED4: ; CODE XREF: sub_A1BE9B+25j pop esi locret_A1BED5: ; CODE XREF: sub_A1BE9B+1Dj leave retn 8 sub_A1BE9B endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1BED9 proc near ; CODE XREF: sub_A1B40A+A6p ; sub_A1B9A1+59p mov edi, edi push ecx push esi mov esi, ecx push edi test esi, esi jz short loc_A1BF0C mov eax, [esi+20h] mov edi, 42524157h test eax, eax jz short loc_A1BEF7 push edi push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1BEF7: ; CODE XREF: sub_A1BED9+15j mov eax, [esi+2Ch] test eax, eax jz short loc_A1BF05 push edi push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1BF05: ; CODE XREF: sub_A1BED9+23j push edi push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1BF0C: ; CODE XREF: sub_A1BED9+9j pop edi xor eax, eax pop esi pop ecx retn sub_A1BED9 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1BF12 proc near ; CODE XREF: sub_A1BA08+22p ; sub_A1C4CE+22p var_1C = dword ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 1Ch push ebx push esi push edi xor eax, eax mov [ebp+var_8], edx mov edx, [ebp+arg_0] lea edi, [ebp+var_1C] stosd xor esi, esi and [ebp+var_10], esi mov ebx, ecx mov ecx, [ebp+var_8] and [ebp+var_C], esi stosd mov [ebp+var_4], esi stosd lea eax, [ebp+var_10] push eax lea eax, [ebp+var_1C] push eax call sub_A1C7EF mov edi, eax test edi, edi js loc_A1C018 lea eax, [ebp+var_4] mov ecx, ebx push eax lea edx, [ebp+var_10] call sub_A1C03B mov edi, eax test edi, edi js loc_A1C015 mov esi, [ebp+var_4] cmp dword ptr [esi+0Ch], 0 jnz loc_A1C001 mov eax, large fs:124h dec word ptr [eax+13Eh] nop mov ebx, [ebp+var_4] xor edx, edx add ebx, 8 push 0 mov ecx, ebx call KeAbPreAcquire mov [ebp+arg_0], eax lock bts dword ptr [ebx], 0 jnb short loc_A1BFAD push ebx mov edx, eax mov ecx, ebx call ExfAcquirePushLockExclusiveEx mov eax, [ebp+arg_0] loc_A1BFAD: ; CODE XREF: sub_A1BF12+8Cj test eax, eax jz short loc_A1BFB5 or byte ptr [eax+0Eh], 1 loc_A1BFB5: ; CODE XREF: sub_A1BF12+9Dj cmp dword ptr [esi+0Ch], 0 jnz short loc_A1BFD3 mov edx, [ebp+var_4] lea esi, [ebp+var_1C] mov ecx, [ebp+var_8] sub esp, 0Ch ; int mov edi, esp movsd movsd movsd call sub_A1C264 mov edi, eax loc_A1BFD3: ; CODE XREF: sub_A1BF12+A7j or eax, 0FFFFFFFFh lock xadd [ebx], eax and al, 6 cmp al, 2 jnz short loc_A1BFE7 mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1BFE7: ; CODE XREF: sub_A1BF12+CCj mov ecx, ebx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) test edi, edi js short loc_A1C015 mov esi, [ebp+var_4] loc_A1C001: ; CODE XREF: sub_A1BF12+5Fj mov edi, [esi+10h] test edi, edi js short loc_A1C018 mov eax, [ebp+arg_4] test eax, eax jz short loc_A1C018 mov [eax], esi xor esi, esi jmp short loc_A1C018 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C015: ; CODE XREF: sub_A1BF12+52j ; sub_A1BF12+EAj mov esi, [ebp+var_4] loc_A1C018: ; CODE XREF: sub_A1BF12+3Aj ; sub_A1BF12+F4j ... mov ecx, esi call sub_A1B9A1 cmp [ebp+var_14], 0 jz short loc_A1C032 push 42524157h push [ebp+var_14] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1C032: ; CODE XREF: sub_A1BF12+111j mov eax, edi pop edi pop esi pop ebx leave retn 8 sub_A1BF12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C03B proc near ; CODE XREF: sub_A1BF12+49p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 10h mov eax, large fs:124h push ebx mov ebx, ecx mov [ebp+var_C], edx xor ecx, ecx dec word ptr [eax+13Eh] push esi push edi mov [ebp+var_4], ecx mov [ebp+var_8], ecx nop lea esi, [ebx+64h] xor edx, edx push ecx mov ecx, esi call KeAbPreAcquire push 11h mov edi, eax xor eax, eax pop ecx lock cmpxchg [esi], ecx test eax, eax jz short loc_A1C087 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockSharedEx loc_A1C087: ; CODE XREF: sub_A1C03B+40j test edi, edi jz short loc_A1C08F or byte ptr [edi+0Eh], 1 loc_A1C08F: ; CODE XREF: sub_A1C03B+4Ej mov edx, [ebp+var_C] lea eax, [ebp+var_10] push eax lea eax, [ebp+var_4] mov ecx, ebx push eax call sub_A1BE9B push 11h mov edi, eax xor edx, edx pop eax lock cmpxchg [esi], edx cmp eax, 11h jz short loc_A1C0B8 mov ecx, esi call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1C0B8: ; CODE XREF: sub_A1C03B+74j mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) cmp edi, 0C0000272h jnz short loc_A1C10C mov ecx, [ebp+var_C] lea edx, [ebp+var_4] call sub_A1B930 mov esi, [ebp+var_4] mov edi, eax test edi, edi js short loc_A1C11E lea eax, [ebp+var_8] mov edx, esi push eax mov ecx, ebx call sub_A1B814 mov edi, eax test edi, edi js short loc_A1C11E cmp [ebp+var_8], 0 jz short loc_A1C113 mov ecx, esi call sub_A1B9A1 mov esi, [ebp+var_8] jmp short loc_A1C113 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C10C: ; CODE XREF: sub_A1C03B+96j mov esi, [ebp+var_4] test edi, edi js short loc_A1C11E loc_A1C113: ; CODE XREF: sub_A1C03B+C3j ; sub_A1C03B+CFj mov eax, [ebp+arg_0] test eax, eax jz short loc_A1C11E mov [eax], esi xor esi, esi loc_A1C11E: ; CODE XREF: sub_A1C03B+AAj ; sub_A1C03B+BDj ... mov ecx, esi call sub_A1B9A1 mov ecx, [ebp+var_8] call sub_A1B9A1 mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1C03B endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C136 proc near ; CODE XREF: sub_A1B649+9Ep var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h mov eax, large fs:124h and [ebp+var_4], 0 push ebx push esi dec word ptr [eax+13Eh] mov ebx, ecx push edi mov [ebp+var_C], edx nop lea edi, [ebx+64h] xor edx, edx push 0 mov ecx, edi mov [ebp+var_10], edi call KeAbPreAcquire mov esi, eax lock bts dword ptr [edi], 0 jnb short loc_A1C17C push edi mov edx, esi mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A1C17C: ; CODE XREF: sub_A1C136+3Aj test esi, esi jz short loc_A1C184 or byte ptr [esi+0Eh], 1 loc_A1C184: ; CODE XREF: sub_A1C136+48j xor esi, esi cmp [ebx+50h], esi jbe short loc_A1C1D7 lea eax, [ebx+4Ch] mov edi, ebx loc_A1C190: ; CODE XREF: sub_A1C136+9Cj mov ecx, [eax] mov eax, [eax+0Ch] imul ecx, esi mov ebx, [ecx+eax] test ebx, ebx jz short loc_A1C1CB mov eax, [ebx+18h] cmp eax, [ebp+var_C] jnz short loc_A1C1CB cmp dword ptr [ebx+1Ch], 0 jnz short loc_A1C1CB push 0 push esi push 0 xor edx, edx lea ecx, [edi+4Ch] call sub_A1DCCB mov [ebp+var_4], eax test eax, eax js short loc_A1C1CB mov ecx, ebx call sub_A1B9A1 dec esi loc_A1C1CB: ; CODE XREF: sub_A1C136+67j ; sub_A1C136+6Fj ... inc esi lea eax, [edi+4Ch] cmp esi, [edi+50h] jb short loc_A1C190 mov edi, [ebp+var_10] loc_A1C1D7: ; CODE XREF: sub_A1C136+53j or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1C1EB mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1C1EB: ; CODE XREF: sub_A1C136+ACj mov ecx, edi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) mov eax, [ebp+var_4] pop edi pop esi pop ebx leave retn sub_A1C136 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C206 proc near ; CODE XREF: sub_A1B814+7Fp ; sub_A1B814+B7p ... var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx mov edx, ecx push esi xor esi, esi mov [ebp+var_4], edx test edx, edx jz short loc_A1C25F push ebx push edi loc_A1C21B: ; CODE XREF: sub_A1C206+3Dj ; sub_A1C206+41j mov eax, [edx] mov ebx, eax mov edi, [edx+4] add ebx, 1 mov ecx, edi mov [ebp+var_8], eax adc ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] mov ebx, edx mov edx, [ebp+var_4] push 0 pop esi cmp eax, ecx jnz short loc_A1C21B cmp ebx, edi jnz short loc_A1C21B add ecx, 1 adc edi, esi cmp edi, esi pop edi pop ebx ja short loc_A1C25F jb short loc_A1C25A cmp ecx, esi ja short loc_A1C25F loc_A1C25A: ; CODE XREF: sub_A1C206+4Ej mov esi, 0C00000E5h loc_A1C25F: ; CODE XREF: sub_A1C206+11j ; sub_A1C206+4Cj ... mov eax, esi pop esi leave retn sub_A1C206 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall sub_A1C264(int,int,void *Source1) sub_A1C264 proc near ; CODE XREF: sub_A1BF12+BAp var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_34 = dword ptr -34h var_30 = dword ptr -30h Length = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch Source1 = dword ptr 10h push 3Ch push offset dword_6AAB78 call __SEH_prolog4 mov edi, edx mov [ebp+var_48], edi mov [ebp+var_20], ecx and [ebp+var_28], 0 mov ebx, [ebp+arg_0] cmp ebx, 1 jnz short loc_A1C2A9 mov ecx, 0F8h push 10h loc_A1C28B: ; CODE XREF: sub_A1C264+59j mov eax, [ebp+Source1] mov eax, [eax+0F0h] mov [ebp+Length], ecx pop edx mul edx test edx, edx ja short loc_A1C2BF jb short loc_A1C2A5 cmp eax, 0FFFFFFFFh ja short loc_A1C2BF loc_A1C2A5: ; CODE XREF: sub_A1C264+3Aj xor esi, esi jmp short loc_A1C2C7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C2A9: ; CODE XREF: sub_A1C264+1Ej call sub_597FFE test ebx, ebx jnz loc_A1C4B2 mov ecx, 0F4h push 0Ch jmp short loc_A1C28B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C2BF: ; CODE XREF: sub_A1C264+38j ; sub_A1C264+3Fj mov esi, 0C0000095h or eax, 0FFFFFFFFh loc_A1C2C7: ; CODE XREF: sub_A1C264+43j mov [ebp+var_24], eax test esi, esi js loc_A1C4B7 lea edx, [ebp+var_28] push edx mov edx, ecx mov ecx, eax call ?RtlULongAdd@@YGJKKPAK@Z ; RtlULongAdd(ulong,ulong,ulong *) mov esi, eax test esi, esi js loc_A1C4B7 mov [edi+24h], ebx mov eax, [ebp+arg_4] mov [edi+28h], eax lea ebx, [edi+2Ch] mov edx, ebx mov eax, [ebp+var_28] mov [ebp+var_30], eax mov ecx, eax call sub_A1ACD8 mov esi, eax mov [ebp+var_1C], esi test esi, esi js loc_A1C4B7 and [ebp+ms_exc.disabled], 0 mov esi, [ebp+var_30] test esi, esi jz short loc_A1C335 mov ecx, [ebp+var_20] mov ecx, [ecx+8] lea edx, [ecx+esi] mov eax, ds:_MmUserProbeAddress cmp edx, eax ja short loc_A1C332 cmp edx, ecx jnb short loc_A1C335 loc_A1C332: ; CODE XREF: sub_A1C264+C8j mov byte ptr [eax], 0 loc_A1C335: ; CODE XREF: sub_A1C264+B6j ; sub_A1C264+CCj push esi ; size_t mov eax, [ebp+var_20] push dword ptr [eax+8] ; void * push dword ptr [ebx] ; void * call _memcpy add esp, 0Ch push 1 mov edx, esi mov eax, [ebp+var_20] mov ecx, [eax+8] call sub_A1B19E mov esi, eax mov [ebp+var_1C], esi test esi, esi jns short loc_A1C36A loc_A1C35E: ; CODE XREF: sub_A1C264+117j ; sub_A1C264+133j ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp loc_A1C4B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C36A: ; CODE XREF: sub_A1C264+F8j mov edx, [ebp+var_30] mov ecx, [ebx] call sub_A1B127 mov esi, eax mov [ebp+var_1C], esi test esi, esi js short loc_A1C35E push [ebp+Length] ; Length push dword ptr [ebx] ; Source2 push [ebp+Source1] ; Source1 call _RtlCompareMemory@12 ; RtlCompareMemory(x,x,x) cmp eax, [ebp+Length] jz short loc_A1C399 loc_A1C38F: ; CODE XREF: sub_A1C264+166j ; sub_A1C264+18Bj mov esi, 0C000000Dh mov [ebp+var_1C], esi jmp short loc_A1C35E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C399: ; CODE XREF: sub_A1C264+129j cmp dword ptr [edi+24h], 1 jnz short loc_A1C3C1 mov edx, [ebx] mov ecx, [edx+28h] and ecx, 0FFFFFFFh mov eax, [ebp+var_20] mov eax, [eax+8] sub eax, ecx mov [edi+18h], eax and dword ptr [edi+1Ch], 0 mov ebx, [edx+30h] mov eax, [edx+2Ch] jmp short loc_A1C3F9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C3C1: ; CODE XREF: sub_A1C264+139j call sub_597FFE cmp dword ptr [edi+24h], 0 jnz short loc_A1C38F mov eax, [ebx] mov ecx, [eax+28h] and ecx, 0FFFFFFFh mov eax, [ebp+var_20] mov eax, [eax+8] sub eax, ecx mov [edi+18h], eax and dword ptr [edi+1Ch], 0 call sub_597FFE cmp dword ptr [edi+24h], 0 jnz short loc_A1C38F mov eax, [ebx] mov ebx, [eax+30h] mov eax, [eax+2Ch] loc_A1C3F9: ; CODE XREF: sub_A1C264+15Bj mov [ebp+var_34], ebx and eax, 0FFFFFFFh test ebx, ebx jz short loc_A1C481 mov ecx, [edi+18h] add ecx, eax mov [ebp+Source1], ecx mov [ebp+var_4C], ecx mov eax, ebx push 4 pop edx mul edx mov ebx, eax mov [ebp+var_40], ebx mov [ebp+var_3C], edx test edx, edx ja short loc_A1C42E jb short loc_A1C42A cmp ebx, 0FFFFFFFFh ja short loc_A1C42E loc_A1C42A: ; CODE XREF: sub_A1C264+1BFj xor esi, esi jmp short loc_A1C436 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C42E: ; CODE XREF: sub_A1C264+1BDj ; sub_A1C264+1C4j or ebx, 0FFFFFFFFh mov esi, 0C0000095h loc_A1C436: ; CODE XREF: sub_A1C264+1C8j mov [ebp+var_3C], ebx mov [ebp+var_1C], esi test esi, esi js loc_A1C35E test ebx, ebx jz short loc_A1C45B lea edx, [ecx+ebx] mov eax, ds:_MmUserProbeAddress cmp edx, eax ja short loc_A1C458 cmp edx, ecx jnb short loc_A1C45B loc_A1C458: ; CODE XREF: sub_A1C264+1EEj mov byte ptr [eax], 0 loc_A1C45B: ; CODE XREF: sub_A1C264+1E2j ; sub_A1C264+1F2j lea edx, [edi+20h] mov ecx, ebx call sub_A1ACD8 mov esi, eax mov [ebp+var_1C], esi test esi, esi js loc_A1C35E push ebx ; size_t push [ebp+Source1] ; void * push dword ptr [edi+20h] ; void * call _memcpy add esp, 0Ch loc_A1C481: ; CODE XREF: sub_A1C264+19Fj mov dword ptr [edi+0Ch], 1 jmp loc_A1C35E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C48D: ; DATA XREF: .text:006AAB8Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_44], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C49D: ; DATA XREF: .text:006AAB90o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_44] mov [ebp+var_1C], esi mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov edi, [ebp+var_48] jmp short loc_A1C4B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C4B2: ; CODE XREF: sub_A1C264+4Cj mov esi, 0C000000Dh loc_A1C4B7: ; CODE XREF: sub_A1C264+68j ; sub_A1C264+7Fj ... mov [edi+10h], esi mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 0Ch sub_A1C264 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C4CE proc near ; CODE XREF: sub_A1AAB4+112p var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_4], 0 cmp [ebp+arg_0], 10h push ebx push esi push edi jnb short loc_A1C4E9 mov edi, 0C000000Dh jmp short loc_A1C565 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C4E9: ; CODE XREF: sub_A1C4CE+12j lea eax, [ebp+var_4] push eax push [ebp+arg_0] call sub_A1BF12 mov edi, eax test edi, edi js short loc_A1C565 mov eax, large fs:124h dec word ptr [eax+13Eh] nop mov ebx, [ebp+var_4] xor edx, edx push 0 lea esi, [ebx+8] mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1C52D push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1C52D: ; CODE XREF: sub_A1C4CE+53j test edi, edi jz short loc_A1C535 or byte ptr [edi+0Eh], 1 loc_A1C535: ; CODE XREF: sub_A1C4CE+61j mov ecx, ebx call sub_A1C576 mov edi, eax or eax, 0FFFFFFFFh lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1C552 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1C552: ; CODE XREF: sub_A1C4CE+7Bj mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) loc_A1C565: ; CODE XREF: sub_A1C4CE+19j ; sub_A1C4CE+2Bj mov ecx, [ebp+var_4] call sub_A1B9A1 mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1C4CE endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C576 proc near ; CODE XREF: sub_A1C4CE+69p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ebx push esi mov esi, ecx xor ecx, ecx push edi mov edx, [esi+30h] mov eax, edx mov edi, [esi+34h] or eax, edi jnz short loc_A1C593 loc_A1C58F: ; CODE XREF: sub_A1C576+2Bj xor ecx, ecx jmp short loc_A1C60A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C593: ; CODE XREF: sub_A1C576+17j add edx, 0FFFFFFFFh mov [esi+30h], edx adc edi, 0FFFFFFFFh or edx, edi mov [esi+34h], edi jnz short loc_A1C58F mov edi, [esi+38h] sub edi, 1 js short loc_A1C60A imul eax, edi, 0Ch mov ebx, edi shl ebx, 4 mov [ebp+var_4], eax loc_A1C5B6: ; CODE XREF: sub_A1C576+8Bj cmp dword ptr [esi+24h], 1 jnz short loc_A1C5D0 mov edx, [esi+2Ch] mov ecx, esi add edx, 0F8h add edx, ebx call sub_A1C6ED jmp short loc_A1C5EE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C5D0: ; CODE XREF: sub_A1C576+44j call sub_597FFE cmp dword ptr [esi+24h], 0 jnz short loc_A1C605 mov edx, [ebp+var_4] mov ecx, esi add edx, 0F4h add edx, [esi+2Ch] call sub_A1C611 loc_A1C5EE: ; CODE XREF: sub_A1C576+58j mov ecx, eax test ecx, ecx js short loc_A1C60A dec dword ptr [esi+38h] sub ebx, 10h sub [ebp+var_4], 0Ch sub edi, 1 jns short loc_A1C5B6 jmp short loc_A1C60A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C605: ; CODE XREF: sub_A1C576+63j mov ecx, 0C000000Dh loc_A1C60A: ; CODE XREF: sub_A1C576+1Bj ; sub_A1C576+33j ... pop edi pop esi mov eax, ecx pop ebx leave retn sub_A1C576 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C611 proc near ; CODE XREF: sub_A1C576+73p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = byte ptr -1 mov edi, edi push ebp mov ebp, esp sub esp, 14h and [ebp+var_8], 0 mov eax, ecx and [ebp+var_C], 0 mov ecx, 0FFFFFFFh push ebx push esi push edi mov edi, edx mov [ebp+var_10], eax mov esi, [edi+4] mov edx, [edi+8] and esi, ecx add esi, [eax+18h] and edx, ecx mov eax, [edi] mov ecx, esi shr eax, 1 not eax mov [ebp+var_14], esi and eax, 1 push eax call sub_A1B19E mov ebx, eax test ebx, ebx js loc_A1C6E6 mov edx, [edi+8] lea eax, [ebp+var_8] push eax and edx, 0FFFFFFFh lea eax, [ebp+var_C] test byte ptr [edi], 2 mov ecx, esi push eax jnz short loc_A1C67A call sub_A1AF61 jmp short loc_A1C67F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C67A: ; CODE XREF: sub_A1C611+60j call sub_A1AE51 loc_A1C67F: ; CODE XREF: sub_A1C611+67j mov ebx, eax test ebx, ebx js short loc_A1C6D3 mov esi, [ebp+var_10] lea eax, [ebp-1] push eax ; int mov edx, [ebp+var_14] ; void * push ecx ; int mov esi, [esi+2Ch] mov ecx, 0FFFFFFFh mov [ebp+var_1], 0 lea eax, [esi+50h] push eax ; int mov eax, [edi+4] and eax, ecx push eax ; int lea eax, [esi+48h] push eax ; int mov eax, [edi+8] and eax, ecx xor ecx, ecx push eax ; int push [ebp+var_8] ; void * inc ecx ; int call sub_A1AC58 mov ebx, eax test ebx, ebx js short loc_A1C6D3 mov eax, [edi] movzx ecx, [ebp+var_1] and eax, 0FFFFFC03h shl ecx, 2 or ecx, eax mov [edi], ecx loc_A1C6D3: ; CODE XREF: sub_A1C611+72j ; sub_A1C611+AEj mov esi, [ebp+var_C] test esi, esi jz short loc_A1C6E6 push esi call _MmUnlockPages@4 ; MmUnlockPages(x) push esi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1C6E6: ; CODE XREF: sub_A1C611+44j ; sub_A1C611+C7j pop edi pop esi mov eax, ebx pop ebx leave retn sub_A1C611 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C6ED proc near ; CODE XREF: sub_A1C576+53p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = byte ptr -1 mov edi, edi push ebp mov ebp, esp sub esp, 14h and [ebp+var_8], 0 mov eax, ecx and [ebp+var_C], 0 mov ecx, 0FFFFFFFh push ebx push esi push edi mov edi, edx mov [ebp+var_10], eax mov ebx, [edi+4] mov edx, [edi+8] and ebx, ecx add ebx, [eax+18h] and edx, ecx mov eax, [edi] mov ecx, ebx shr eax, 1 not eax and eax, 1 push eax call sub_A1B19E mov esi, eax test esi, esi js loc_A1C7E8 mov edx, [edi+8] lea eax, [ebp+var_8] push eax and edx, 0FFFFFFFh lea eax, [ebp+var_C] test byte ptr [edi], 2 mov ecx, ebx push eax jnz short loc_A1C753 call sub_A1AF61 jmp short loc_A1C758 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C753: ; CODE XREF: sub_A1C6ED+5Dj call sub_A1AE51 loc_A1C758: ; CODE XREF: sub_A1C6ED+64j mov esi, eax test esi, esi js short loc_A1C7D5 mov esi, [ebp+var_10] lea eax, [ebp-1] push eax ; int push ecx ; int mov ecx, 0FFFFFFFh mov [ebp+var_1], 0 mov esi, [esi+2Ch] mov edx, ebx ; void * lea eax, [esi+50h] push eax ; int mov eax, [edi+4] and eax, ecx push eax ; int lea eax, [esi+48h] push eax ; int mov eax, [edi+8] and eax, ecx xor ecx, ecx push eax ; int push [ebp+var_8] ; void * inc ecx ; int call sub_A1AC58 mov esi, eax test esi, esi js short loc_A1C7D5 mov eax, [edi] movzx ecx, [ebp+var_1] and eax, 0FFFFFC03h shl ecx, 2 or ecx, eax mov [edi], ecx test cl, 2 jnz short loc_A1C7D5 mov eax, [edi+8] and eax, 0FFFFFFFh cmp eax, 4 jnb short loc_A1C7C4 mov esi, 0C000000Dh jmp short loc_A1C7D5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C7C4: ; CODE XREF: sub_A1C6ED+CEj mov eax, [ebp+var_10] mov ecx, [ebp+var_8] mov eax, [eax+2Ch] mov eax, [eax+0F4h] mov [ecx], eax loc_A1C7D5: ; CODE XREF: sub_A1C6ED+6Fj ; sub_A1C6ED+AAj ... mov edi, [ebp+var_C] test edi, edi jz short loc_A1C7E8 push edi call _MmUnlockPages@4 ; MmUnlockPages(x) push edi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1C7E8: ; CODE XREF: sub_A1C6ED+41j ; sub_A1C6ED+EDj pop edi mov eax, esi pop esi pop ebx leave retn sub_A1C6ED endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C7EF proc near ; CODE XREF: sub_A1BF12+31p var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push 20h push offset dword_6AAB98 call __SEH_prolog4 mov esi, ecx mov [ebp+var_1C], esi xor eax, eax lea edi, [ebp+var_30] stosd stosd stosd cmp edx, 10h jnb short loc_A1C817 loc_A1C80D: ; CODE XREF: sub_A1C7EF+106j mov ebx, 0C000000Dh jmp loc_A1C949 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C817: ; CODE XREF: sub_A1C7EF+1Cj lea edx, [ebp+var_28] mov ecx, 0F4h call sub_A1ACD8 mov ebx, eax test ebx, ebx js loc_A1C949 and [ebp+ms_exc.disabled], 0 mov esi, [esi+8] lea ecx, [esi+0F4h] mov eax, ds:_MmUserProbeAddress cmp ecx, eax ja short loc_A1C848 cmp ecx, esi jnb short loc_A1C851 loc_A1C848: ; CODE XREF: sub_A1C7EF+53j mov byte ptr [eax], 0 mov eax, [ebp+var_1C] mov esi, [eax+8] loc_A1C851: ; CODE XREF: sub_A1C7EF+57j push 3Dh pop ecx mov edx, [ebp+var_28] mov edi, edx rep movsd mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, [edx+24h] mov esi, eax and esi, 0Fh mov [ebp+var_30], esi shr eax, 4 and eax, 0Fh mov [ebp+var_2C], eax xor edi, edi inc edi cmp esi, edi jnz short loc_A1C8EE push 42524157h push edx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and [ebp+var_28], 0 lea edx, [ebp+var_28] mov ecx, 0F8h call sub_A1ACD8 mov ebx, eax test ebx, ebx js loc_A1C949 mov [ebp+ms_exc.disabled], edi mov eax, [ebp+var_1C] mov esi, [eax+8] lea edx, [esi+0F8h] mov ecx, ds:_MmUserProbeAddress cmp edx, ecx ja short loc_A1C8C0 cmp edx, esi jnb short loc_A1C8C6 loc_A1C8C0: ; CODE XREF: sub_A1C7EF+CBj mov byte ptr [ecx], 0 mov esi, [eax+8] loc_A1C8C6: ; CODE XREF: sub_A1C7EF+CFj push 3Eh pop ecx mov edx, [ebp+var_28] mov edi, edx rep movsd mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A1C8FE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C8D9: ; DATA XREF: .text:006AABB8o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_20], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C8E9: ; DATA XREF: .text:006AABBCo mov ebx, [ebp+var_20] jmp short loc_A1C93F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C8EE: ; CODE XREF: sub_A1C7EF+8Cj call sub_597FFE test esi, esi jnz loc_A1C80D mov edx, [ebp+var_28] loc_A1C8FE: ; CODE XREF: sub_A1C7EF+E8j mov esi, [ebp+arg_4] mov eax, [edx+40h] mov [esi+4], eax mov eax, [edx+28h] mov ecx, [ebp+var_1C] and eax, 0FFFFFFFh mov ecx, [ecx+8] sub ecx, eax mov [esi], ecx mov edi, [ebp+arg_0] test edi, edi jz short loc_A1C949 lea esi, [ebp+var_30] movsd movsd movsd and [ebp+var_28], 0 jmp short loc_A1C949 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C92C: ; DATA XREF: .text:006AABACo mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_24], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C93C: ; DATA XREF: .text:006AABB0o mov ebx, [ebp+var_24] loc_A1C93F: ; CODE XREF: sub_A1C7EF+FDj mov esp, [ebp+ms_exc.old_esp] mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A1C949: ; CODE XREF: sub_A1C7EF+23j ; sub_A1C7EF+39j ... mov edx, [ebp+var_28] test edx, edx jz short loc_A1C95B push 42524157h push edx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1C95B: ; CODE XREF: sub_A1C7EF+15Fj mov eax, ebx mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 8 sub_A1C7EF endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1C96F proc near ; CODE XREF: sub_A1D230+BBp var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 10h mov eax, large fs:124h push ebx mov ebx, edx mov [ebp+var_4], ecx xor edx, edx dec word ptr [eax+13Eh] push esi push edi mov [ebp+var_C], edx mov [ebp+var_8], edx nop lea edi, [ecx+1Ch] push edx mov ecx, edi call KeAbPreAcquire mov esi, eax lock bts dword ptr [edi], 0 jnb short loc_A1C9B3 push edi mov edx, esi mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A1C9B3: ; CODE XREF: sub_A1C96F+38j test esi, esi jz short loc_A1C9BB or byte ptr [esi+0Eh], 1 loc_A1C9BB: ; CODE XREF: sub_A1C96F+46j mov edx, [ebx+18h] lea eax, [ebp+var_C] mov ecx, [ebp+var_4] push eax lea eax, [ebp+var_8] push eax call sub_A1D1C0 mov esi, eax test esi, esi js short loc_A1C9E2 mov eax, [ebp+arg_0] test eax, eax jz short loc_A1CA29 mov ecx, [ebp+var_8] mov [eax], ecx jmp short loc_A1CA29 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1C9E2: ; CODE XREF: sub_A1C96F+63j cmp esi, 0C0000272h jnz short loc_A1CA29 push [ebp+var_C] mov edx, ebx push 4 push dword ptr [ebx+18h] push ecx mov ecx, [ebp+var_4] lea ecx, [ecx+4] call sub_A1DB7E mov esi, eax test esi, esi js short loc_A1CA29 mov ecx, ebx call sub_A1D601 mov esi, eax test esi, esi js short loc_A1CA29 mov eax, [ebp+arg_0] test eax, eax jz short loc_A1CA1D and dword ptr [eax], 0 loc_A1CA1D: ; CODE XREF: sub_A1C96F+A9j mov ecx, [ebp+var_4] mov edx, ebx call sub_A1CA59 mov esi, eax loc_A1CA29: ; CODE XREF: sub_A1C96F+6Aj ; sub_A1C96F+71j ... or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1CA3D mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1CA3D: ; CODE XREF: sub_A1C96F+C5j mov ecx, edi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) pop edi mov eax, esi pop esi pop ebx leave retn 4 sub_A1C96F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1CA59 proc near ; CODE XREF: sub_A1C96F+B3p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx mov eax, large fs:124h push ebx push esi push edi dec word ptr [eax+13Eh] mov ebx, edx mov [ebp+var_4], ecx nop lea esi, [ecx+2Ch] xor edx, edx push 0 mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1CA96 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1CA96: ; CODE XREF: sub_A1CA59+31j test edi, edi jz short loc_A1CA9E or byte ptr [edi+0Eh], 1 loc_A1CA9E: ; CODE XREF: sub_A1CA59+3Fj mov eax, [ebp+var_4] add eax, 24h mov ecx, [eax+4] cmp [ecx], eax jz short loc_A1CAB0 push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR ; AL = character to display loc_A1CAB0: ; CODE XREF: sub_A1CA59+50j mov [ebx], eax mov [ebx+4], ecx mov [ecx], ebx mov [eax+4], ebx or eax, 0FFFFFFFFh or dword ptr [ebx+8], 1 lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1CAD2 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1CAD2: ; CODE XREF: sub_A1CA59+70j mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) mov ecx, ebx call sub_A1D601 pop edi pop esi pop ebx leave retn sub_A1CA59 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1CAF1 proc near ; CODE XREF: sub_A1D36F+C8p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 10h push ebx push esi xor eax, eax mov esi, ecx push edi mov [ebp+var_C], eax mov ebx, edx mov [ebp+var_8], eax mov edi, [esi+14h] mov ecx, edi mov [ebp+var_4], eax lea eax, [ebp+var_C] push eax push 10h pop edx call ?RtlULongMult@@YGJKKPAK@Z ; RtlULongMult(ulong,ulong,ulong *) test eax, eax js short loc_A1CB91 mov edx, [esi+1Ch] lea eax, [ebp+var_4] push eax mov ecx, edi call ?RtlULongAdd@@YGJKKPAK@Z ; RtlULongAdd(ulong,ulong,ulong *) test eax, eax js short loc_A1CB91 mov ecx, [ebp+var_4] lea eax, [ebp+var_8] push eax push 10h pop edx call ?RtlULongMult@@YGJKKPAK@Z ; RtlULongMult(ulong,ulong,ulong *) test eax, eax js short loc_A1CB91 mov ecx, [esi+10h] lea eax, [ecx+1] cmp eax, edi jb short loc_A1CB6D mov edx, [ebp+var_C] lea ecx, [esi+18h] push ecx push [ebp+var_8] mov ecx, [ecx] call sub_A1B037 test eax, eax js short loc_A1CB91 mov eax, [esi+1Ch] add [esi+14h], eax mov ecx, [esi+10h] loc_A1CB6D: ; CODE XREF: sub_A1CAF1+5Cj mov eax, [ebp+arg_0] shl ecx, 4 add ecx, [esi+18h] mov [ecx+4], eax mov eax, [ebp+arg_4] mov [ecx+8], eax mov eax, [ebp+arg_8] mov [ecx], ebx mov [ecx+0Ch], eax mov ecx, ebx inc dword ptr [esi+10h] call sub_A1D601 loc_A1CB91: ; CODE XREF: sub_A1CAF1+2Dj ; sub_A1CAF1+3Fj ... pop edi pop esi pop ebx leave retn 0Ch sub_A1CAF1 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1CB98 proc near ; DATA XREF: sub_A1B2D2+46o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp mov ecx, [ebp+arg_0] test ecx, ecx jnz short loc_A1CBB0 xor eax, eax cmp [ebp+arg_4], eax jz short loc_A1CBBA inc eax xor edx, edx jmp short loc_A1CBC2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CBB0: ; CODE XREF: sub_A1CB98+Aj mov eax, [ebp+arg_4] test eax, eax jnz short loc_A1CBBE or eax, 0FFFFFFFFh loc_A1CBBA: ; CODE XREF: sub_A1CB98+11j mov edx, eax jmp short loc_A1CBC2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CBBE: ; CODE XREF: sub_A1CB98+1Dj sub eax, [ecx+18h] cdq loc_A1CBC2: ; CODE XREF: sub_A1CB98+16j ; sub_A1CB98+24j pop ebp retn 0Ch sub_A1CB98 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1CBC6 proc near ; CODE XREF: sub_A1D230+A5p var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_19 = dword ptr -19h arg_0 = dword ptr 8 push 64h push offset dword_6AABE0 call __SEH_prolog4 mov edi, edx mov [ebp+var_5C], ecx xor ebx, ebx mov [ebp+var_30], ebx mov [ebp+var_4C], ebx mov [ebp+var_50], ebx mov byte ptr [ebp+var_19], bl mov eax, ebx mov [ebp+var_28], eax mov [ebp+var_2C], eax mov [ebp+var_20], eax mov [ebp+var_34], eax mov [ebp+var_38], eax mov [ebp+var_40], eax mov [ebp+var_3C], eax mov [ebp+var_44], eax mov [ebp+var_48], ebx mov [ebp+var_54], ebx mov [ebp+var_58], ebx mov eax, dword_6D6BDC mov [ebp+var_68], eax lea edx, [ebp+var_30] push 38h pop ecx call sub_A1ACD8 mov esi, eax test esi, esi js loc_A1D0D1 push 38h ; size_t push ebx ; int mov ebx, [ebp+var_30] push ebx ; void * call _memset add esp, 0Ch and dword ptr [ebx+8], 0FFFFFFFEh xor eax, eax inc eax mov [ebx+30h], eax and dword ptr [ebx+34h], 0 cmp [edi+8], eax jnz loc_A1CCF5 lea ecx, [edi+10h] mov edx, 0F8h call sub_A1B127 mov esi, eax test esi, esi js loc_A1D0D4 xor eax, eax mov [ebp-4], eax push eax push eax push eax push 0F8h push dword ptr [edi+140h] call IoAllocateMdl mov esi, eax mov [ebp+var_20], esi mov [ebp+var_34], esi test esi, esi jnz short loc_A1CC9A loc_A1CC86: ; CODE XREF: sub_A1CBC6+17Bj ; sub_A1CBC6+28Ej ... mov esi, 0C0000017h loc_A1CC8B: ; CODE XREF: sub_A1CBC6+24Ej mov [ebp+var_24], esi loc_A1CC8E: ; CODE XREF: sub_A1CBC6+2D2j ; sub_A1CBC6+2F2j ... mov dword ptr [ebp-4], 0FFFFFFFEh jmp loc_A1D0D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CC9A: ; CODE XREF: sub_A1CBC6+BEj mov ecx, esi call _MmProbeAndLockPagesPrivate@8 ; MmProbeAndLockPagesPrivate(x,x) xor eax, eax inc eax mov [ebp+var_48], eax mov dword ptr [ebp-4], 0FFFFFFFEh mov edx, 0F8h jmp loc_A1CD60 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CCB8: ; DATA XREF: .text:006AABF4o mov eax, [ebp-14h] mov eax, [eax] mov eax, [eax] mov [ebp+var_60], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CCC8: ; DATA XREF: .text:006AABF8o mov esi, [ebp+var_60] loc_A1CCCB: ; CODE XREF: sub_A1CBC6+4DFj ; sub_A1CBC6+4FFj mov esp, [ebp+var_19+1] mov [ebp+var_24], esi mov dword ptr [ebp-4], 0FFFFFFFEh mov ebx, [ebp+var_30] mov eax, [ebp+var_2C] mov [ebp+var_28], eax mov edi, [ebp+var_34] mov eax, [ebp+var_40] mov [ebp+var_38], eax mov eax, [ebp+var_44] mov [ebp+var_3C], eax jmp loc_A1D0D7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CCF5: ; CODE XREF: sub_A1CBC6+7Fj call sub_597FFE cmp dword ptr [edi+8], 0 jnz loc_A1D0CA lea ecx, [edi+10h] mov edx, 0F0h call sub_A1B127 mov esi, eax test esi, esi js loc_A1D0D4 mov dword ptr [ebp-4], 1 xor eax, eax push eax push eax push eax push 0F0h push dword ptr [edi+140h] call IoAllocateMdl mov esi, eax mov [ebp+var_20], esi mov [ebp+var_34], esi test esi, esi jz loc_A1CC86 mov ecx, esi call _MmProbeAndLockPagesPrivate@8 ; MmProbeAndLockPagesPrivate(x,x) xor eax, eax inc eax mov [ebp+var_48], eax mov dword ptr [ebp-4], 0FFFFFFFEh mov edx, 0F0h loc_A1CD60: ; CODE XREF: sub_A1CBC6+EDj push eax mov ecx, [edi+140h] call sub_A1B19E mov esi, eax test esi, esi js loc_A1D0D4 lea eax, [ebp+var_50] push eax lea eax, [ebp+var_4C] push eax mov edx, [edi+138h] mov ecx, [ebp+var_5C] call sub_A1DFF5 mov esi, eax test esi, esi js loc_A1D0D4 lea edx, [ebp+var_2C] mov ecx, [edi+138h] call sub_A1ACD8 mov esi, eax mov [ebp+var_24], esi test esi, esi js loc_A1D0AA mov dword ptr [ebp-4], 2 mov eax, [edi+118h] test eax, eax jz short loc_A1CDE2 mov edx, [edi+110h] lea esi, [edx+eax] mov ecx, ds:_MmUserProbeAddress cmp esi, ecx ja short loc_A1CDD9 cmp esi, edx jnb short loc_A1CDE2 loc_A1CDD9: ; CODE XREF: sub_A1CBC6+20Dj mov byte ptr [ecx], 0 mov eax, [edi+118h] loc_A1CDE2: ; CODE XREF: sub_A1CBC6+1FAj ; sub_A1CBC6+211j push eax ; size_t push dword ptr [edi+110h] ; void * mov eax, [edi+11Ch] mov esi, [ebp+var_2C] mov [ebp+var_28], esi add eax, esi push eax ; void * call _memcpy add esp, 0Ch cmp dword ptr [edi+8], 1 jnz short loc_A1CE2A cmp dword ptr [edi+118h], 4 jnb short loc_A1CE19 loc_A1CE0F: ; CODE XREF: sub_A1CBC6+26Dj ; sub_A1CBC6+35Dj ... mov esi, 0C000000Dh jmp loc_A1CC8B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CE19: ; CODE XREF: sub_A1CBC6+247j mov ecx, [edi+11Ch] mov eax, [edi+120h] mov [esi+ecx], eax jmp short loc_A1CE35 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CE2A: ; CODE XREF: sub_A1CBC6+23Ej call sub_597FFE cmp dword ptr [edi+8], 0 jnz short loc_A1CE0F loc_A1CE35: ; CODE XREF: sub_A1CBC6+262j push 0 push 0 push 0 push dword ptr [edi+118h] push dword ptr [edi+110h] call IoAllocateMdl mov [ebp+var_38], eax mov [ebp+var_40], eax test eax, eax jz loc_A1CC86 mov ecx, eax call _MmProbeAndLockPagesPrivate@8 ; MmProbeAndLockPagesPrivate(x,x) mov [ebp+var_54], 1 lea ecx, [edi+60h] mov edx, [edi+11Ch] add edx, esi ; void * lea eax, [ebp+var_19] push eax ; int push ecx ; int push ecx ; int push dword ptr [edi+114h] ; int lea eax, [edi+58h] push eax ; int push dword ptr [edi+118h] ; int push edx ; void * xor ecx, ecx ; int call sub_A1AC58 mov esi, eax mov [ebp+var_24], esi test esi, esi js loc_A1CC8E push 1 mov edx, [edi+118h] mov ecx, [edi+110h] call sub_A1B19E mov esi, eax mov [ebp+var_24], esi test esi, esi js loc_A1CC8E mov eax, [edi+124h] test eax, eax jz loc_A1CFD2 mov ecx, [edi+12Ch] mov edx, eax test ecx, ecx jz short loc_A1CF00 lea esi, [ecx+eax] mov edx, ds:_MmUserProbeAddress mov [ebp+var_64], edx cmp esi, edx ja short loc_A1CEF1 mov edx, eax cmp esi, eax jnb short loc_A1CF00 mov edx, [ebp+var_64] loc_A1CEF1: ; CODE XREF: sub_A1CBC6+320j mov byte ptr [edx], 0 mov ecx, [edi+12Ch] mov edx, [edi+124h] loc_A1CF00: ; CODE XREF: sub_A1CBC6+310j ; sub_A1CBC6+326j push ecx ; size_t push edx ; void * mov eax, [edi+130h] mov esi, [ebp+var_28] add eax, esi push eax ; void * call _memcpy add esp, 0Ch cmp dword ptr [edi+8], 1 jnz short loc_A1CF3A cmp dword ptr [edi+12Ch], 4 jb loc_A1CE0F mov ecx, [edi+130h] mov eax, [edi+134h] mov [esi+ecx], eax jmp short loc_A1CF49 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1CF3A: ; CODE XREF: sub_A1CBC6+354j call sub_597FFE cmp dword ptr [edi+8], 0 jnz loc_A1CE0F loc_A1CF49: ; CODE XREF: sub_A1CBC6+372j push 0 push 0 push 0 push dword ptr [edi+12Ch] push dword ptr [edi+124h] call IoAllocateMdl mov [ebp+var_3C], eax mov [ebp+var_44], eax test eax, eax jz loc_A1CC86 mov ecx, eax call _MmProbeAndLockPagesPrivate@8 ; MmProbeAndLockPagesPrivate(x,x) mov [ebp+var_58], 1 mov edx, [edi+130h] add edx, esi ; void * lea eax, [ebp+var_19] push eax ; int push ecx ; int lea eax, [edi+60h] push eax ; int push dword ptr [edi+128h] ; int lea eax, [edi+58h] push eax ; int push dword ptr [edi+12Ch] ; int push edx ; void * xor ecx, ecx ; int call sub_A1AC58 mov esi, eax mov [ebp+var_24], esi test esi, esi js loc_A1CC8E push 1 mov edx, [edi+12Ch] mov ecx, [edi+124h] call sub_A1B19E mov esi, eax mov [ebp+var_24], esi test esi, esi js loc_A1CC8E loc_A1CFD2: ; CODE XREF: sub_A1CBC6+300j push dword ptr [edi+138h] ; size_t mov eax, [ebp+var_28] push eax ; void * mov esi, [ebp+var_4C] push esi ; void * call _memcpy add esp, 0Ch mov dword ptr [ebp-4], 0FFFFFFFEh mov eax, [edi] mov [ebx+28h], eax mov [ebx+14h], esi mov eax, [edi+11Ch] mov ecx, [ebp+var_50] add eax, ecx mov [ebx+0Ch], eax mov eax, [edi+130h] test eax, eax jz short loc_A1D016 add eax, ecx mov [ebx+10h], eax jmp short loc_A1D01A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D016: ; CODE XREF: sub_A1CBC6+447j and dword ptr [ebx+10h], 0 loc_A1D01A: ; CODE XREF: sub_A1CBC6+44Ej mov eax, [edi+138h] mov [ebx+2Ch], eax mov eax, [edi+110h] mov [ebx+18h], eax mov eax, [edi+110h] sub eax, [ebx+0Ch] mov [ebx+20h], eax and dword ptr [ebx+24h], 0 mov ecx, esi mov eax, [ebx+28h] mov [ecx], eax mov eax, [ebx+14h] mov ecx, [ebp+var_68] mov [eax+8], ecx and dword ptr [eax+0Ch], 0 push dword ptr [edi+118h] push dword ptr [ebx+0Ch] push 0FFFFFFFFh call _ZwFlushInstructionCache@12 ; ZwFlushInstructionCache(x,x,x) mov esi, eax test esi, esi js short loc_A1D0D4 cmp dword ptr [edi+124h], 0 jz short loc_A1D085 push dword ptr [edi+12Ch] push dword ptr [ebx+10h] push 0FFFFFFFFh call _ZwFlushInstructionCache@12 ; ZwFlushInstructionCache(x,x,x) mov esi, eax test esi, esi js short loc_A1D0D4 loc_A1D085: ; CODE XREF: sub_A1CBC6+4A7j mov eax, [ebp+arg_0] test eax, eax jz short loc_A1D0D4 mov [eax], ebx xor ebx, ebx jmp short loc_A1D0D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D092: ; DATA XREF: .text:006AAC0Co mov eax, [ebp-14h] mov eax, [eax] mov eax, [eax] mov [ebp+var_6C], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0A2: ; DATA XREF: .text:006AAC10o mov esi, [ebp+var_6C] jmp loc_A1CCCB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0AA: ; CODE XREF: sub_A1CBC6+1E5j mov eax, [ebp+var_2C] mov [ebp+var_28], eax jmp short loc_A1D0D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0B2: ; DATA XREF: .text:006AAC00o mov eax, [ebp-14h] mov eax, [eax] mov eax, [eax] mov [ebp+var_70], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0C2: ; DATA XREF: .text:006AAC04o mov esi, [ebp+var_70] jmp loc_A1CCCB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0CA: ; CODE XREF: sub_A1CBC6+138j mov esi, 0C000000Dh jmp short loc_A1D0D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D0D1: ; CODE XREF: sub_A1CBC6+59j mov ebx, [ebp+var_30] loc_A1D0D4: ; CODE XREF: sub_A1CBC6+96j ; sub_A1CBC6+CFj ... mov edi, [ebp+var_20] loc_A1D0D7: ; CODE XREF: sub_A1CBC6+12Aj test edi, edi jz short loc_A1D0ED cmp [ebp+var_48], 0 jz short loc_A1D0E7 push edi call _MmUnlockPages@4 ; MmUnlockPages(x) loc_A1D0E7: ; CODE XREF: sub_A1CBC6+519j push edi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1D0ED: ; CODE XREF: sub_A1CBC6+513j mov edi, [ebp+var_38] test edi, edi jz short loc_A1D106 cmp [ebp+var_54], 0 jz short loc_A1D100 push edi call _MmUnlockPages@4 ; MmUnlockPages(x) loc_A1D100: ; CODE XREF: sub_A1CBC6+532j push edi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1D106: ; CODE XREF: sub_A1CBC6+52Cj mov edi, [ebp+var_3C] test edi, edi jz short loc_A1D11F cmp [ebp+var_58], 0 jz short loc_A1D119 push edi call _MmUnlockPages@4 ; MmUnlockPages(x) loc_A1D119: ; CODE XREF: sub_A1CBC6+54Bj push edi call _IoFreeMdl@4 ; IoFreeMdl(x) loc_A1D11F: ; CODE XREF: sub_A1CBC6+545j mov edx, ebx mov ecx, [ebp+var_5C] call sub_A1D14F mov eax, [ebp+var_28] test eax, eax jz short loc_A1D13B push 42524157h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1D13B: ; CODE XREF: sub_A1CBC6+568j mov eax, esi mov ecx, [ebp-10h] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 sub_A1CBC6 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D14F proc near ; CODE XREF: sub_A1B40A+58p ; sub_A1B40A+89p ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx push esi mov eax, edx mov [ebp+var_10], ecx xor esi, esi mov [ebp+var_C], eax push edi mov edi, esi test eax, eax jz short loc_A1D1B7 add eax, 30h mov [ebp+var_4], eax loc_A1D170: ; CODE XREF: sub_A1D14F+49j ; sub_A1D14F+4Dj mov edx, [eax] mov ebx, edx mov edi, [eax+4] sub ebx, 1 mov ecx, edi mov [ebp+var_8], edx mov eax, edx sbb ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] cmp eax, ecx mov eax, [ebp+var_4] push 0 pop esi jnz short loc_A1D170 cmp edx, edi jnz short loc_A1D170 mov esi, ecx add esi, 0FFFFFFFFh mov ecx, esi adc edi, 0FFFFFFFFh or ecx, edi jnz short loc_A1D1B7 mov edx, [ebp+var_C] mov ecx, [ebp+var_10] call sub_A1D1FE loc_A1D1B7: ; CODE XREF: sub_A1D14F+19j ; sub_A1D14F+5Bj mov edx, edi mov eax, esi pop edi pop esi pop ebx leave retn sub_A1D14F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D1C0 proc near ; CODE XREF: sub_A1C96F+5Ap ; sub_A1D230+6Cp var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx push [ebp+arg_4] and [ebp+var_4], 0 lea eax, [ebp+var_4] push eax push 4 add ecx, 4 call WbFindLookupEntry test eax, eax js short locret_A1D1FA push esi mov esi, [ebp+arg_0] test esi, esi jz short loc_A1D1F9 push edi mov edi, [ebp+var_4] mov ecx, edi call sub_A1D601 test eax, eax js short loc_A1D1F8 mov [esi], edi loc_A1D1F8: ; CODE XREF: sub_A1D1C0+34j pop edi loc_A1D1F9: ; CODE XREF: sub_A1D1C0+25j pop esi locret_A1D1FA: ; CODE XREF: sub_A1D1C0+1Dj leave retn 8 sub_A1D1C0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1D1FE proc near ; CODE XREF: sub_A1D14F+63p mov edi, edi push esi mov esi, edx test esi, esi jz short loc_A1D22C mov edx, [esi+14h] test edx, edx jz short loc_A1D221 call sub_A1E37F xor eax, eax mov [esi+14h], eax mov [esi+0Ch], eax mov [esi+10h], eax mov [esi+2Ch], eax loc_A1D221: ; CODE XREF: sub_A1D1FE+Ej push 42524157h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1D22C: ; CODE XREF: sub_A1D1FE+7j xor eax, eax pop esi retn sub_A1D1FE endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D230 proc near ; CODE XREF: sub_A1D36F+7Ep var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 10h and [ebp+var_4], 0 xor eax, eax push ebx mov ebx, ecx mov [ebp+var_10], edx push esi push edi mov [ebp+var_8], eax mov edx, [ebx+8] sub edx, [ebx+20h] mov [ebp+var_C], eax call sub_A1D767 call _KeEnterGuardedRegion@0 ; KeEnterGuardedRegion() lea esi, [ebx+1Ch] xor edx, edx push 0 mov ecx, esi call KeAbPreAcquire push 11h mov edi, eax xor eax, eax pop ecx lock cmpxchg [esi], ecx test eax, eax jz short loc_A1D283 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockSharedEx loc_A1D283: ; CODE XREF: sub_A1D230+47j test edi, edi jz short loc_A1D28B or byte ptr [edi+0Eh], 1 loc_A1D28B: ; CODE XREF: sub_A1D230+55j mov edx, [ebp+var_10] lea eax, [ebp+var_4] push 0 push eax mov ecx, ebx mov edx, [edx+110h] call sub_A1D1C0 push 11h mov edi, eax xor edx, edx pop eax lock cmpxchg [esi], edx cmp eax, 11h jz short loc_A1D2B8 mov ecx, esi call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1D2B8: ; CODE XREF: sub_A1D230+7Fj mov ecx, esi call KeAbPostRelease call _KeLeaveGuardedRegion@0 ; KeLeaveGuardedRegion() cmp edi, 0C0000272h jnz short loc_A1D312 mov edx, [ebp+var_10] lea eax, [ebp+var_4] push eax mov ecx, ebx call sub_A1CBC6 mov esi, [ebp+var_4] mov edi, eax test edi, edi js short loc_A1D32D lea eax, [ebp+var_C] mov edx, esi push eax mov ecx, ebx call sub_A1C96F mov edi, eax mov eax, [ebp+var_C] mov [ebp+var_8], eax test edi, edi js short loc_A1D32D test eax, eax jz short loc_A1D319 mov edx, esi mov ecx, ebx call sub_A1D14F mov esi, [ebp+var_8] and [ebp+var_8], 0 jmp short loc_A1D319 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D312: ; CODE XREF: sub_A1D230+9Aj mov esi, [ebp+var_4] test edi, edi js short loc_A1D32D loc_A1D319: ; CODE XREF: sub_A1D230+CEj ; sub_A1D230+E0j mov edx, esi mov ecx, ebx call sub_A1D660 mov eax, [ebp+arg_0] test eax, eax jz short loc_A1D32D mov [eax], esi xor esi, esi loc_A1D32D: ; CODE XREF: sub_A1D230+B1j ; sub_A1D230+CAj ... mov edx, esi mov ecx, ebx call sub_A1D14F mov edx, [ebp+var_8] mov ecx, ebx call sub_A1D14F mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1D230 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1D349 proc near ; CODE XREF: sub_A1D4C6+29p mov edi, edi push esi mov esi, [ecx+10h] xor eax, eax test esi, esi jnz short loc_A1D35C mov eax, 0C000000Dh pop esi retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D35C: ; CODE XREF: sub_A1D349+Aj test edx, edx jz short loc_A1D36D mov ecx, [ecx+18h] shl esi, 4 add ecx, 0FFFFFFF0h add ecx, esi mov [edx], ecx loc_A1D36D: ; CODE XREF: sub_A1D349+15j pop esi retn sub_A1D349 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall sub_A1D36F(int,size_t) sub_A1D36F proc near ; CODE XREF: sub_A1AAB4+123p var_170 = dword ptr -170h var_16C = dword ptr -16Ch var_168 = dword ptr -168h var_164 = dword ptr -164h var_160 = dword ptr -160h var_15C = dword ptr -15Ch var_158 = dword ptr -158h var_154 = dword ptr -154h var_150 = dword ptr -150h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 174h mov eax, ___security_cookie xor eax, esp mov [esp+174h+var_4], eax mov eax, [ebp+arg_0] push ebx push esi push edi mov [esp+180h+var_158], eax lea edi, [esp+180h+var_168] xor eax, eax mov [esp+180h+var_15C], ecx stosd xor ebx, ebx push 148h ; size_t mov esi, edx mov [esp+184h+var_170], ebx push ebx ; int stosd mov [esp+188h+var_154], esi mov [esp+188h+var_16C], ebx stosd lea eax, [esp+188h+var_150] push eax ; void * call _memset mov edx, [ebp+arg_4] lea eax, [esp+18Ch+var_150] add esp, 0Ch mov ecx, esi push eax ; void * call sub_A1D969 mov esi, eax test esi, esi js loc_A1D493 mov ebx, [esp+180h+var_15C] lea eax, [esp+180h+var_170] push eax lea edx, [esp+184h+var_150] mov ecx, ebx call sub_A1D230 mov esi, eax test esi, esi js loc_A1D48F lea eax, [esp+180h+var_16C] mov ecx, ebx push eax call sub_A1E613 mov edi, [esp+180h+var_16C] mov esi, eax test esi, esi js short loc_A1D489 lea edx, [esp+180h+var_168] mov ecx, edi call sub_A1AD29 mov ebx, [esp+180h+var_170] mov esi, eax test esi, esi js short loc_A1D497 push [esp+180h+var_160] mov edx, ebx mov ecx, edi push [esp+184h+var_168] push [esp+188h+var_164] call sub_A1CAF1 mov esi, eax test esi, esi js short loc_A1D497 push [ebp+arg_4] ; size_t lea eax, [esp+184h+var_168] mov edx, ebx push [esp+184h+var_158] ; void * lea ecx, [esp+188h+var_150] push [esp+188h+var_154] ; void * push eax ; int call sub_A1D8A2 mov esi, eax test esi, esi js short loc_A1D497 and [esp+180h+var_160], 0FFFFFEFFh mov eax, [ebx+0Ch] lea edx, [esp+180h+var_168] mov ecx, edi mov [esp+180h+var_164], eax call sub_A1B0AD mov esi, eax test esi, esi js short loc_A1D497 mov esi, [esp+180h+var_164] jmp short loc_A1D497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D489: ; CODE XREF: sub_A1D36F+A1j mov ebx, [esp+180h+var_170] jmp short loc_A1D497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D48F: ; CODE XREF: sub_A1D36F+87j mov ebx, [esp+180h+var_170] loc_A1D493: ; CODE XREF: sub_A1D36F+69j mov edi, [esp+180h+var_16C] loc_A1D497: ; CODE XREF: sub_A1D36F+B6j ; sub_A1D36F+D1j ... mov ecx, [esp+180h+var_15C] mov edx, edi call sub_A1E4FB mov ecx, [esp+180h+var_15C] mov edx, ebx call sub_A1D14F mov ecx, [esp+180h+var_4] mov eax, esi pop edi pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 8 sub_A1D36F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D4C6 proc near ; CODE XREF: sub_A1AAB4+133p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 18h and [ebp+var_4], 0 lea eax, [ebp+var_4] and [ebp+var_8], 0 push ebx push esi push eax mov ebx, ecx call sub_A1E613 mov esi, eax test esi, esi js short loc_A1D52E mov ecx, [ebp+var_4] lea edx, [ebp+var_8] call sub_A1D349 mov esi, eax test esi, esi js short loc_A1D52E mov ecx, [ebp+var_8] lea edx, [ebp+var_14] mov eax, [ecx+4] mov [ebp+var_10], eax mov eax, [ecx+8] mov [ebp+var_14], eax mov eax, [ecx+0Ch] mov ecx, [ebp+var_4] mov [ebp+var_C], eax call sub_A1B0AD mov esi, eax test esi, esi js short loc_A1D52E mov edx, [ebp+var_4] mov ecx, ebx push 1 call sub_A1D706 mov esi, eax loc_A1D52E: ; CODE XREF: sub_A1D4C6+21j ; sub_A1D4C6+32j ... mov edx, [ebp+var_4] mov ecx, ebx call sub_A1E4FB mov eax, esi pop esi pop ebx leave retn sub_A1D4C6 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall WbHeapExecutionUnloadModule(x, x) _WbHeapExecutionUnloadModule@8 proc near ; CODE XREF: sub_A1B649+94p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h mov eax, large fs:124h and [ebp+var_4], 0 push ebx push esi dec word ptr [eax+13Eh] mov ebx, ecx push edi mov [ebp+var_8], edx nop lea edi, [ebx+1Ch] xor edx, edx push 0 mov ecx, edi call KeAbPreAcquire mov esi, eax lock bts dword ptr [edi], 0 jnb short loc_A1D581 push edi mov edx, esi mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A1D581: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+37j test esi, esi jz short loc_A1D589 or byte ptr [esi+0Eh], 1 loc_A1D589: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+45j xor esi, esi cmp [ebx+8], esi jbe short loc_A1D5D2 loc_A1D590: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+92j mov ecx, [ebx+4] mov eax, [ebx+10h] imul ecx, esi mov eax, [ecx+eax] mov [ebp+var_C], eax test eax, eax jz short loc_A1D5CC mov ecx, [ebp+var_8] cmp [eax+28h], ecx jnz short loc_A1D5CC push 0 push esi push 0 xor edx, edx lea ecx, [ebx+4] call sub_A1DCCB mov [ebp+var_4], eax test eax, eax js short loc_A1D5CC mov edx, [ebp+var_C] mov ecx, ebx call sub_A1D14F dec esi loc_A1D5CC: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+63j ; WbHeapExecutionUnloadModule(x,x)+6Bj ... inc esi cmp esi, [ebx+8] jb short loc_A1D590 loc_A1D5D2: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+50j or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1D5E6 mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1D5E6: ; CODE XREF: WbHeapExecutionUnloadModule(x,x)+9Fj mov ecx, edi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) mov eax, [ebp+var_4] pop edi pop esi pop ebx leave retn _WbHeapExecutionUnloadModule@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D601 proc near ; CODE XREF: sub_A1C96F+99p ; sub_A1CA59+8Ep ... var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx push esi xor esi, esi test ecx, ecx jz short loc_A1D65B lea edx, [ecx+30h] push ebx mov [ebp+var_4], edx push edi loc_A1D617: ; CODE XREF: sub_A1D601+3Ej ; sub_A1D601+42j mov eax, [edx] mov ebx, eax mov edi, [edx+4] add ebx, 1 mov ecx, edi mov [ebp+var_8], eax adc ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] mov ebx, edx mov edx, [ebp+var_4] push 0 pop esi cmp eax, ecx jnz short loc_A1D617 cmp ebx, edi jnz short loc_A1D617 add ecx, 1 adc edi, esi cmp edi, esi pop edi pop ebx ja short loc_A1D65B jb short loc_A1D656 cmp ecx, esi ja short loc_A1D65B loc_A1D656: ; CODE XREF: sub_A1D601+4Fj mov esi, 0C00000E5h loc_A1D65B: ; CODE XREF: sub_A1D601+Cj ; sub_A1D601+4Dj ... mov eax, esi pop esi leave retn sub_A1D601 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D660 proc near ; CODE XREF: sub_A1D230+EDp var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx mov eax, large fs:124h push ebx push esi push edi dec word ptr [eax+13Eh] mov esi, edx mov [ebp+var_4], ecx nop lea edi, [ecx+2Ch] xor edx, edx push 0 mov ecx, edi call KeAbPreAcquire mov ebx, eax lock bts dword ptr [edi], 0 jnb short loc_A1D69D push edi mov edx, ebx mov ecx, edi call ExfAcquirePushLockExclusiveEx loc_A1D69D: ; CODE XREF: sub_A1D660+31j test ebx, ebx jz short loc_A1D6A5 or byte ptr [ebx+0Eh], 1 loc_A1D6A5: ; CODE XREF: sub_A1D660+3Fj test byte ptr [esi+8], 1 jz short loc_A1D6D5 mov eax, [esi] cmp [eax+4], esi jnz short loc_A1D701 mov ecx, [esi+4] cmp [ecx], esi jnz short loc_A1D701 mov [ecx], eax mov [eax+4], ecx mov eax, [ebp+var_4] add eax, 24h mov ecx, [eax+4] cmp [ecx], eax jnz short loc_A1D701 mov [esi], eax mov [esi+4], ecx mov [ecx], esi mov [eax+4], esi loc_A1D6D5: ; CODE XREF: sub_A1D660+49j or eax, 0FFFFFFFFh lock xadd [edi], eax and al, 6 cmp al, 2 jnz short loc_A1D6E9 mov ecx, edi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1D6E9: ; CODE XREF: sub_A1D660+80j mov ecx, edi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) pop edi pop esi pop ebx leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D701: ; CODE XREF: sub_A1D660+50j ; sub_A1D660+57j ... push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR sub_A1D660 endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D706 proc near ; CODE XREF: sub_A1D4C6+61p ; sub_A1E5D7+11p var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi mov esi, [ebp+arg_0] xor eax, eax mov [ebp+var_4], ecx mov ebx, edx push edi cmp esi, 0FFFFFFFFh jg short loc_A1D726 mov esi, [ebx+10h] mov ecx, esi jmp short loc_A1D729 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D726: ; CODE XREF: sub_A1D706+17j mov ecx, [ebx+10h] loc_A1D729: ; CODE XREF: sub_A1D706+1Ej cmp esi, ecx jbe short loc_A1D734 mov eax, 0C000000Dh jmp short loc_A1D760 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D734: ; CODE XREF: sub_A1D706+25j test esi, esi jle short loc_A1D760 loc_A1D738: ; CODE XREF: sub_A1D706+56j mov ecx, [ebx+10h] mov edi, [ebx+18h] shl ecx, 4 add edi, 0FFFFFFF0h add edi, ecx mov ecx, [ebp+var_4] mov edx, [edi] call sub_A1D14F xor eax, eax stosd stosd stosd stosd dec dword ptr [ebx+10h] sub esi, 1 jnz short loc_A1D738 xor eax, eax loc_A1D760: ; CODE XREF: sub_A1D706+2Cj ; sub_A1D706+30j pop edi pop esi pop ebx leave retn 4 sub_A1D706 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1D767 proc near ; CODE XREF: sub_A1D230+22p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi push edi mov edi, ecx test edx, edx jle loc_A1D898 lea ebx, [edi+2Ch] loc_A1D77F: ; CODE XREF: sub_A1D767+12Bj mov eax, large fs:124h lea ecx, [edi+1Ch] dec edx mov [ebp+var_8], edx dec word ptr [eax+13Eh] nop push 0 xor edx, edx call KeAbPreAcquire mov esi, eax lea eax, [edi+1Ch] lock bts dword ptr [eax], 0 jnb short loc_A1D7B3 push eax mov edx, esi mov ecx, eax call ExfAcquirePushLockExclusiveEx loc_A1D7B3: ; CODE XREF: sub_A1D767+40j test esi, esi jz short loc_A1D7BB or byte ptr [esi+0Eh], 1 loc_A1D7BB: ; CODE XREF: sub_A1D767+4Ej push 0 xor edx, edx mov ecx, ebx call KeAbPreAcquire mov esi, eax lock bts dword ptr [ebx], 0 jnb short loc_A1D7D9 push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockExclusiveEx loc_A1D7D9: ; CODE XREF: sub_A1D767+66j test esi, esi jz short loc_A1D7E1 or byte ptr [esi+0Eh], 1 loc_A1D7E1: ; CODE XREF: sub_A1D767+74j lea edx, [edi+24h] mov eax, [edx] cmp eax, edx jz short loc_A1D805 cmp [eax+4], edx jnz loc_A1D89D mov ecx, [eax] cmp [ecx+4], eax jnz loc_A1D89D mov [edx], ecx mov [ecx+4], edx jmp short loc_A1D807 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D805: ; CODE XREF: sub_A1D767+81j xor eax, eax loc_A1D807: ; CODE XREF: sub_A1D767+9Cj xor esi, esi test eax, eax jz short loc_A1D813 and dword ptr [eax+8], 0FFFFFFFEh mov esi, eax loc_A1D813: ; CODE XREF: sub_A1D767+A4j or eax, 0FFFFFFFFh lock xadd [ebx], eax and al, 6 cmp al, 2 jnz short loc_A1D827 mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1D827: ; CODE XREF: sub_A1D767+B7j mov ecx, ebx call KeAbPostRelease test esi, esi jz short loc_A1D857 mov edx, [esi+18h] lea eax, [ebp+var_4] and [ebp+var_4], 0 lea ecx, [edi+4] push eax push 0FFFFFFFFh push 4 call sub_A1DCCB test eax, eax js short loc_A1D857 mov edx, [ebp+var_4] mov ecx, edi call sub_A1D14F loc_A1D857: ; CODE XREF: sub_A1D767+C9j ; sub_A1D767+E4j or eax, 0FFFFFFFFh lea ecx, [edi+1Ch] lock xadd [ecx], eax and al, 6 cmp al, 2 jnz short loc_A1D86F call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) lea ecx, [edi+1Ch] loc_A1D86F: ; CODE XREF: sub_A1D767+FEj call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) test esi, esi jz short loc_A1D898 mov edx, esi mov ecx, edi call sub_A1D14F mov edx, [ebp+var_8] test edx, edx jg loc_A1D77F loc_A1D898: ; CODE XREF: sub_A1D767+Fj ; sub_A1D767+11Bj pop edi pop esi pop ebx leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D89D: ; CODE XREF: sub_A1D767+86j ; sub_A1D767+91j push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR sub_A1D767 endp ; AL = character to display ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall sub_A1D8A2(int,void *,void *,size_t) sub_A1D8A2 proc near ; CODE XREF: sub_A1D36F+E9p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push 18h push offset dword_6AABC0 call __SEH_prolog4 mov eax, ecx mov [ebp+var_1C], eax xor esi, esi cmp [eax+124h], esi jz short loc_A1D8DD cmp [ebp+arg_C], 20h jnb short loc_A1D8CD mov esi, 80000005h jmp loc_A1D955 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D8CD: ; CODE XREF: sub_A1D8A2+1Fj mov eax, [edx+10h] cdq mov ecx, [ebp+arg_4] mov [ecx+18h], eax mov [ecx+1Ch], edx mov eax, [ebp+var_1C] loc_A1D8DD: ; CODE XREF: sub_A1D8A2+19j mov [ebp+ms_exc.disabled], esi mov edi, esi mov ebx, [ebp+arg_0] loc_A1D8E5: ; CODE XREF: sub_A1D8A2+6Bj mov [ebp+var_20], edi mov eax, [eax+13Ch] shr eax, 0Ah inc eax cmp edi, eax jnb short loc_A1D90F push 1 push 4 mov ecx, edi shl ecx, 0Ah mov eax, [ebx] sub eax, ecx push eax call _ProbeForWrite@12 ; ProbeForWrite(x,x,x) inc edi mov eax, [ebp+var_1C] jmp short loc_A1D8E5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D90F: ; CODE XREF: sub_A1D8A2+52j add dword ptr [ebx], 0FFFFFFF0h mov edx, [ebx] add edx, 0FFFFFFF0h mov [ebx], edx mov [ebp+var_28], esi mov ecx, [ebp+arg_8] lea eax, [ecx+10h] mov [edx], eax push [ebp+arg_C] ; size_t push [ebp+arg_4] ; void * push ecx ; void * call _memcpy add esp, 0Ch jmp short loc_A1D94E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D935: ; DATA XREF: .text:006AABD4o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_24], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D945: ; DATA XREF: .text:006AABD8o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_24] mov [ebp+var_28], esi loc_A1D94E: ; CODE XREF: sub_A1D8A2+91j mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A1D955: ; CODE XREF: sub_A1D8A2+26j mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 10h sub_A1D8A2 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall sub_A1D969(void *) sub_A1D969 proc near ; CODE XREF: sub_A1D36F+60p var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 1Ch push offset dword_6AAC18 call __SEH_prolog4 mov esi, edx mov edi, ecx mov [ebp+var_1C], edi mov ebx, [ebp+arg_0] push 148h ; size_t push 0 ; int push ebx ; void * call _memset add esp, 0Ch cmp esi, 18h jnb short loc_A1D99E loc_A1D994: ; CODE XREF: sub_A1D969+38j ; sub_A1D969+CDj ... mov edx, 0C000000Dh jmp loc_A1DB6A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1D99E: ; CODE XREF: sub_A1D969+29j cmp dword ptr [edi], 3 jnz short loc_A1D994 xor edx, edx mov [ebp+ms_exc.disabled], edx mov esi, [edi+8] lea ecx, [esi+0F0h] mov eax, ds:_MmUserProbeAddress cmp ecx, eax ja short loc_A1D9BE cmp ecx, esi jnb short loc_A1D9C3 loc_A1D9BE: ; CODE XREF: sub_A1D969+4Fj mov [eax], dl mov esi, [edi+8] loc_A1D9C3: ; CODE XREF: sub_A1D969+53j lea edi, [ebx+10h] push 3Ch pop ecx rep movsd mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov esi, [ebp+var_1C] mov eax, [esi+8] mov [ebx+140h], eax mov eax, [ebx+34h] mov ecx, eax and ecx, 0Fh mov [ebx+8], ecx shr eax, 4 and eax, 0Fh mov [ebx+0Ch], eax xor eax, eax inc eax cmp ecx, eax jnz loc_A1DAC9 mov [ebp+ms_exc.disabled], eax mov eax, [esi+8] lea edi, [eax+0F8h] mov ecx, ds:_MmUserProbeAddress cmp edi, ecx ja short loc_A1DA17 cmp edi, eax jnb short loc_A1DA1C loc_A1DA17: ; CODE XREF: sub_A1D969+A8j mov [ecx], dl mov eax, [esi+8] loc_A1DA1C: ; CODE XREF: sub_A1D969+ACj push 3Eh pop ecx mov esi, eax lea edi, [ebx+10h] rep movsd mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov edi, [ebx+48h] and edi, 0FFFFFFFh jbe loc_A1D994 mov esi, [ebp+var_1C] loc_A1DA3F: ; CODE XREF: sub_A1D969+179j mov eax, [esi+8] mov ecx, [eax+28h] mov esi, 0FFFFFFFh and ecx, esi mov eax, [ebx+140h] sub eax, ecx mov [ebx], eax mov [ebx+4], edx mov eax, [ebx+3Ch] mov ecx, 1000h cmp eax, ecx ja short loc_A1DA67 mov eax, ecx loc_A1DA67: ; CODE XREF: sub_A1D969+FAj mov [ebx+13Ch], eax mov ecx, [ebx+4Ch] mov eax, [ebx] mov [ebp+var_1C], eax mov eax, [ebx+44h] and eax, esi mov [ebp+var_24], eax and ecx, esi jz short loc_A1DAED mov eax, [ebx+50h] and eax, esi mov [ebp+var_28], eax add eax, 10h mov [ebx+130h], eax mov [ebx+12Ch], edi mov eax, [ebp+var_24] mov [ebx+128h], eax add eax, [ebp+var_1C] mov [ebx+124h], eax mov eax, ecx mov edi, [ebp+var_28] jmp short loc_A1DAEF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DAB1: ; DATA XREF: .text:006AAC38o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_20], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DAC1: ; DATA XREF: .text:006AAC3Co mov edx, [ebp+var_20] jmp loc_A1DB60 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DAC9: ; CODE XREF: sub_A1D969+8Ej call sub_597FFE xor edx, edx cmp [ebx+8], edx jnz loc_A1D994 mov edi, [ebx+48h] and edi, 0FFFFFFFh ja loc_A1DA3F jmp loc_A1D994 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DAED: ; CODE XREF: sub_A1D969+116j mov ecx, eax loc_A1DAEF: ; CODE XREF: sub_A1D969+146j add eax, [ebp+var_1C] mov ebx, [ebp+arg_0] mov dword ptr [ebx+11Ch], 10h mov [ebx+118h], edi mov [ebx+114h], ecx mov [ebx+110h], eax cmp dword ptr [ebx+8], 1 jnz short loc_A1DB3C mov ecx, [ebx+100h] test [ebx+4Ch], esi jz short loc_A1DB36 mov eax, [ebx+104h] mov [ebx+120h], eax mov [ebx+134h], ecx jmp short loc_A1DB3C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DB36: ; CODE XREF: sub_A1D969+1B7j mov [ebx+120h], ecx loc_A1DB3C: ; CODE XREF: sub_A1D969+1ACj ; sub_A1D969+1CBj lea eax, [edi+10h] add eax, [ebx+12Ch] mov [ebx+138h], eax jmp short loc_A1DB6A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DB4D: ; DATA XREF: .text:006AAC2Co mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_2C], eax call _ExSystemExceptionFilter@0 ; ExSystemExceptionFilter() retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DB5D: ; DATA XREF: .text:006AAC30o mov edx, [ebp+var_2C] loc_A1DB60: ; CODE XREF: sub_A1D969+15Bj mov esp, [ebp+ms_exc.old_esp] mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A1DB6A: ; CODE XREF: sub_A1D969+30j ; sub_A1D969+1E2j mov eax, edx mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 sub_A1D969 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DB7E proc near ; CODE XREF: sub_A1B24A+1Bp ; sub_A1B814+AAp ... arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_C] push esi mov esi, ecx push edi mov edi, edx cmp eax, 0FFFFFFFFh jnz short loc_A1DBA5 mov edx, [ebp+arg_4] lea eax, [ebp+arg_C] push eax push 0 push [ebp+arg_8] call WbFindLookupEntry mov eax, [ebp+arg_C] loc_A1DBA5: ; CODE XREF: sub_A1DB7E+11j push eax push ecx mov edx, edi mov ecx, esi call sub_A1DBB6 pop edi pop esi pop ebp retn 10h sub_A1DB7E endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DBB6 proc near ; CODE XREF: sub_A1DB7E+2Dp var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 1Ch push ebx push esi mov esi, ecx mov [ebp+var_18], edx xor eax, eax lea ecx, [ebp+var_C] push edi mov [ebp+var_C], eax mov ebx, [esi+8] mov [ebp+var_8], eax mov [ebp+var_4], eax mov eax, [esi] mov edx, eax push ecx mov ecx, ebx mov [ebp+var_10], eax mov [ebp+var_14], ebx call ?RtlULongMult@@YGJKKPAK@Z ; RtlULongMult(ulong,ulong,ulong *) mov edi, eax test edi, edi js loc_A1DC9A mov edx, [esi+10h] lea eax, [ebp+var_4] push eax mov ecx, ebx call ?RtlULongAdd@@YGJKKPAK@Z ; RtlULongAdd(ulong,ulong,ulong *) mov edi, eax test edi, edi js loc_A1DC9A mov edx, [ebp+var_10] lea eax, [ebp+var_8] mov ecx, [ebp+var_4] push eax call ?RtlULongMult@@YGJKKPAK@Z ; RtlULongMult(ulong,ulong,ulong *) mov edi, eax test edi, edi js short loc_A1DC9A mov ebx, [esi+4] mov ecx, [ebp+var_14] lea eax, [ebx+1] cmp eax, ecx jb short loc_A1DC50 mov edx, [ebp+var_C] lea ecx, [esi+0Ch] push ecx push [ebp+var_8] mov ecx, [ecx] call sub_A1B037 mov edi, eax test edi, edi js short loc_A1DC9A mov eax, [esi+10h] add [esi+8], eax mov ecx, [esi+8] mov ebx, [esi+4] loc_A1DC50: ; CODE XREF: sub_A1DBB6+75j mov eax, [ebp+arg_4] cmp eax, ebx ja short loc_A1DC95 test ecx, ecx jz short loc_A1DC95 mov edx, [esi] sub ebx, eax mov ecx, [esi+0Ch] mov eax, edx imul ebx, edx push ebx ; size_t mov ebx, [ebp+arg_4] imul eax, ebx add eax, ecx push eax ; void * lea eax, [ebx+1] imul eax, edx add eax, ecx push eax ; void * call _memmove mov ecx, [esi] add esp, 0Ch inc dword ptr [esi+4] mov eax, [esi+0Ch] mov edx, [ebp+var_18] imul ecx, ebx mov [ecx+eax], edx jmp short loc_A1DC9A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DC95: ; CODE XREF: sub_A1DBB6+9Fj ; sub_A1DBB6+A3j mov edi, 0C000000Dh loc_A1DC9A: ; CODE XREF: sub_A1DBB6+37j ; sub_A1DBB6+4Fj ... mov eax, edi pop edi pop esi pop ebx leave retn 8 sub_A1DBB6 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1DCA3 proc near ; CODE XREF: sub_A1B40A:loc_A1B447p ; sub_A1B40A+68p ... mov edi, edi push esi mov esi, ecx test esi, esi jz short loc_A1DCC9 mov eax, [esi+0Ch] test eax, eax jz short loc_A1DCBE push 42524157h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1DCBE: ; CODE XREF: sub_A1DCA3+Ej xor eax, eax mov [esi+0Ch], eax mov [esi+4], eax mov [esi+8], eax loc_A1DCC9: ; CODE XREF: sub_A1DCA3+7j pop esi retn sub_A1DCA3 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DCCB proc near ; CODE XREF: WbRemoveWarbirdProcess+17E363p ; sub_A1C136+81p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp push ebx push esi mov esi, [ebp+arg_4] xor ebx, ebx push edi mov edi, ecx cmp esi, 0FFFFFFFFh jnz short loc_A1DCF7 lea eax, [ebp+arg_4] push eax push [ebp+arg_8] push [ebp+arg_0] call WbFindLookupEntry mov ebx, eax test ebx, ebx js short loc_A1DD20 mov esi, [ebp+arg_4] loc_A1DCF7: ; CODE XREF: sub_A1DCCB+12j mov eax, [edi+4] mov edx, [edi] sub eax, esi mov ecx, [edi+0Ch] dec eax imul eax, edx push eax ; size_t lea eax, [esi+1] imul eax, edx imul edx, esi add eax, ecx push eax ; void * add edx, ecx push edx ; void * call _memmove add esp, 0Ch dec dword ptr [edi+4] loc_A1DD20: ; CODE XREF: sub_A1DCCB+27j pop edi pop esi mov eax, ebx pop ebx pop ebp retn 0Ch sub_A1DCCB endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DD29 proc near ; CODE XREF: sub_A1DFF5+E2p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx push esi mov ebx, edx xor esi, esi push edi lea edx, [ebp+var_4] mov [ebp+var_4], esi mov ecx, 420h call sub_A1ACD8 mov edi, eax test edi, edi js loc_A1DE02 mov eax, [ebp+var_4] push 400h ; size_t push 0 ; int mov [eax], esi lea ecx, [eax+4] mov dword ptr [ecx], 10000h lea edi, [eax+41Ch] mov [ebp+var_8], ecx lea ecx, [eax+0Ch] mov [ecx], esi mov [ebp+var_14], ecx lea ecx, [eax+10h] mov eax, large fs:124h mov [ecx], esi mov [edi], esi mov esi, [ebp+var_4] mov eax, [eax+80h] mov [ebp+var_10], ecx mov [ebp+var_C], edi mov [esi+8], eax lea eax, [esi+18h] and dword ptr [esi+418h], 0 push eax ; void * call _memset add esp, 0Ch xor eax, eax mov edx, esi or ecx, 0FFFFFFFFh push edi push 2 push 20000000h push eax push eax push eax push 20h push 1000h push [ebp+var_8] call MmAllocateVirtualMemory mov edi, eax test edi, edi js short loc_A1DE05 mov eax, [ebp+var_C] cmp dword ptr [eax], 0 jnz short loc_A1DDE0 mov edi, 0C00000E5h jmp short loc_A1DE05 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DDE0: ; CODE XREF: sub_A1DD29+AEj mov eax, [ebp+var_8] mov ecx, [esi] mov edx, [eax] push [ebp+var_10] push [ebp+var_14] call sub_A1AF61 mov edi, eax test edi, edi js short loc_A1DE05 test ebx, ebx jz short loc_A1DE05 mov [ebx], esi xor esi, esi jmp short loc_A1DE05 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DE02: ; CODE XREF: sub_A1DD29+23j mov esi, [ebp+var_4] loc_A1DE05: ; CODE XREF: sub_A1DD29+A6j ; sub_A1DD29+B5j ... mov ecx, esi call sub_A1E255 mov eax, edi pop edi pop esi pop ebx leave retn sub_A1DD29 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DE13 proc near ; CODE XREF: sub_A1DFF5+90p ; sub_A1DFF5+FDp var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi xor esi, esi push edi mov edi, ecx test edx, edx jz short loc_A1DE69 lea ebx, [edx+3Fh] xor ecx, ecx shr ebx, 6 mov esi, 3FFh inc ecx sub esi, ebx call ExGenRandom and eax, 7FFFFFFFh lea ecx, [esi+1] xor edx, edx div ecx push ebx mov eax, edx mov ecx, edi push esi mov [ebp+var_4], eax call sub_A1DE7B mov esi, eax test esi, esi jnz short loc_A1DE69 push ebx push [ebp+var_4] xor edx, edx mov ecx, edi call sub_A1DE7B mov esi, eax loc_A1DE69: ; CODE XREF: sub_A1DE13+10j ; sub_A1DE13+45j mov eax, [ebp+arg_0] test eax, eax jz short loc_A1DE72 mov [eax], esi loc_A1DE72: ; CODE XREF: sub_A1DE13+5Bj pop edi pop esi xor eax, eax pop ebx leave retn 4 sub_A1DE13 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DE7B proc near ; CODE XREF: sub_A1DE13+3Cp ; sub_A1DE13+4Fp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch mov eax, large fs:124h push ebx push esi push edi dec word ptr [eax+13Eh] mov edi, edx mov [ebp+var_4], ecx nop lea ebx, [ecx+418h] xor edx, edx push 0 mov ecx, ebx mov [ebp+var_8], ebx call KeAbPreAcquire push 11h mov esi, eax xor eax, eax pop ecx lock cmpxchg [ebx], ecx test eax, eax jz short loc_A1DEC6 push ebx mov edx, esi mov ecx, ebx call ExfAcquirePushLockSharedEx loc_A1DEC6: ; CODE XREF: sub_A1DE7B+3Fj test esi, esi jz short loc_A1DECE or byte ptr [esi+0Eh], 1 loc_A1DECE: ; CODE XREF: sub_A1DE7B+4Dj mov eax, [ebp+arg_0] mov ecx, [ebp+var_4] inc eax mov ebx, [ebp+arg_4] or esi, 0FFFFFFFFh mov [ebp+arg_0], eax jmp short loc_A1DEE8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DEE0: ; CODE XREF: sub_A1DE7B+6Fj cmp byte ptr [ecx+edi+18h], 0 jz short loc_A1DEEE inc edi loc_A1DEE8: ; CODE XREF: sub_A1DE7B+63j ; sub_A1DE7B+8Dj cmp edi, eax jb short loc_A1DEE0 mov edi, esi loc_A1DEEE: ; CODE XREF: sub_A1DE7B+6Aj cmp edi, esi jz short loc_A1DF0A lea eax, [ebx-1] push eax lea edx, [edi+1] call sub_A1E232 cmp eax, esi jz short loc_A1DF0A lea edi, [eax+1] mov eax, [ebp+arg_0] jmp short loc_A1DEE8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DF0A: ; CODE XREF: sub_A1DE7B+75j ; sub_A1DE7B+85j mov ebx, [ebp+var_8] xor ecx, ecx push 11h pop eax lock cmpxchg [ebx], ecx cmp eax, 11h jz short loc_A1DF22 mov ecx, ebx call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1DF22: ; CODE XREF: sub_A1DE7B+9Ej mov ecx, ebx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) cmp edi, esi jz loc_A1DFEA mov eax, large fs:124h dec word ptr [eax+13Eh] nop xor esi, esi xor edx, edx push esi mov ecx, ebx call KeAbPreAcquire mov [ebp+arg_0], eax lock bts dword ptr [ebx], 0 jnb short loc_A1DF6E push ebx mov edx, eax mov ecx, ebx call ExfAcquirePushLockExclusiveEx mov eax, [ebp+arg_0] loc_A1DF6E: ; CODE XREF: sub_A1DE7B+E4j test eax, eax jz short loc_A1DF76 or byte ptr [eax+0Eh], 1 loc_A1DF76: ; CODE XREF: sub_A1DE7B+F5j push [ebp+arg_4] mov ecx, [ebp+var_4] mov edx, edi call sub_A1E232 or ecx, 0FFFFFFFFh cmp eax, ecx jnz short loc_A1DFC2 mov esi, [ebp+var_4] mov eax, edi shl eax, 6 add eax, [esi+10h] mov [ebp+arg_0], eax mov eax, [ebp+arg_4] test eax, eax jz short loc_A1DFB4 dec eax push eax ; size_t lea eax, [esi+18h] add eax, edi push 2 ; int push eax ; void * call _memset add esp, 0Ch or ecx, 0FFFFFFFFh loc_A1DFB4: ; CODE XREF: sub_A1DE7B+122j mov edx, [ebp+arg_4] lea eax, [edi+esi] mov esi, [ebp+arg_0] mov byte ptr [eax+edx+17h], 1 loc_A1DFC2: ; CODE XREF: sub_A1DE7B+10Dj lock xadd [ebx], ecx and cl, 6 cmp cl, 2 jnz short loc_A1DFD5 mov ecx, ebx call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1DFD5: ; CODE XREF: sub_A1DE7B+151j mov ecx, ebx call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) jmp short loc_A1DFEC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1DFEA: ; CODE XREF: sub_A1DE7B+BCj xor esi, esi loc_A1DFEC: ; CODE XREF: sub_A1DE7B+16Dj pop edi mov eax, esi pop esi pop ebx leave retn 8 sub_A1DE7B endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1DFF5 proc near ; CODE XREF: sub_A1CBC6+1C1p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 1Ch push ebx push esi mov esi, ecx mov eax, edx xor ecx, ecx mov [ebp+var_14], eax and [ebp+var_4], ecx xor ebx, ebx push edi xor edi, edi mov [ebp+var_8], esi mov [ebp+var_18], ecx mov [ebp+var_C], ebx cmp eax, 10000h jbe short loc_A1E02A mov edi, 0C000000Dh jmp loc_A1E18C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E02A: ; CODE XREF: sub_A1DFF5+29j call _KeEnterGuardedRegion@0 ; KeEnterGuardedRegion() sub esi, 0FFFFFF80h xor edx, edx push 0 mov ecx, esi call KeAbPreAcquire mov edx, eax xor eax, eax push 11h mov [ebp+var_10], edx pop ecx lock cmpxchg [esi], ecx test eax, eax jz short loc_A1E05A push esi mov ecx, esi call ExfAcquirePushLockSharedEx mov edx, [ebp+var_10] loc_A1E05A: ; CODE XREF: sub_A1DFF5+58j test edx, edx jz short loc_A1E062 or byte ptr [edx+0Eh], 1 loc_A1E062: ; CODE XREF: sub_A1DFF5+67j mov edx, [ebp+var_8] xor eax, eax mov [ebp+var_10], eax cmp [edx+6Ch], eax jbe short loc_A1E0A8 loc_A1E06F: ; CODE XREF: sub_A1DFF5+B1j mov ecx, [edx+68h] imul ecx, eax mov eax, [edx+74h] mov edx, [ebp+var_14] mov ecx, [ecx+eax] lea eax, [ebp+var_4] push eax mov [ebp+var_18], ecx call sub_A1DE13 mov edi, eax test edi, edi js loc_A1E18C cmp [ebp+var_4], ebx jnz short loc_A1E0A8 mov eax, [ebp+var_10] mov edx, [ebp+var_8] inc eax mov [ebp+var_10], eax cmp eax, [edx+6Ch] jb short loc_A1E06F loc_A1E0A8: ; CODE XREF: sub_A1DFF5+78j ; sub_A1DFF5+A2j push 11h xor ecx, ecx pop eax lock cmpxchg [esi], ecx cmp eax, 11h jz short loc_A1E0BD mov ecx, esi call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1E0BD: ; CODE XREF: sub_A1DFF5+BFj mov ecx, esi call KeAbPostRelease call _KeLeaveGuardedRegion@0 ; KeLeaveGuardedRegion() mov ecx, [ebp+var_4] test ecx, ecx jnz loc_A1E170 lea edx, [ebp+var_C] call sub_A1DD29 mov ebx, [ebp+var_C] mov edi, eax test edi, edi js loc_A1E18C mov edx, [ebp+var_14] lea eax, [ebp+var_4] push eax mov ecx, ebx call sub_A1DE13 mov edi, eax test edi, edi js loc_A1E18C call _KeEnterGuardedRegion@0 ; KeEnterGuardedRegion() push 0 xor edx, edx mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1E124 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1E124: ; CODE XREF: sub_A1DFF5+123j test edi, edi jz short loc_A1E12C or byte ptr [edi+0Eh], 1 loc_A1E12C: ; CODE XREF: sub_A1DFF5+131j push 0FFFFFFFFh push 4 push dword ptr [ebx+10h] mov edx, ebx push ecx mov ecx, [ebp+var_8] add ecx, 68h call sub_A1DB7E mov edi, eax or eax, 0FFFFFFFFh lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1E157 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1E157: ; CODE XREF: sub_A1DFF5+159j mov ecx, esi call KeAbPostRelease call _KeLeaveGuardedRegion@0 ; KeLeaveGuardedRegion() test edi, edi js short loc_A1E18C mov ecx, [ebp+var_4] mov edx, ebx xor ebx, ebx jmp short loc_A1E173 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E170: ; CODE XREF: sub_A1DFF5+D9j mov edx, [ebp+var_18] loc_A1E173: ; CODE XREF: sub_A1DFF5+179j mov eax, [ebp+arg_0] test eax, eax jz short loc_A1E17C mov [eax], ecx loc_A1E17C: ; CODE XREF: sub_A1DFF5+183j mov esi, [ebp+arg_4] test esi, esi jz short loc_A1E18C mov eax, [edx] sub eax, [edx+10h] add eax, ecx mov [esi], eax loc_A1E18C: ; CODE XREF: sub_A1DFF5+30j ; sub_A1DFF5+99j ... mov ecx, ebx call sub_A1E255 mov eax, edi pop edi pop esi pop ebx leave retn 8 sub_A1DFF5 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E19C proc near ; DATA XREF: sub_A1B2D2+78o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_0] test eax, eax jnz short loc_A1E1B2 cmp [ebp+arg_4], eax jz short loc_A1E1D0 inc eax xor edx, edx jmp short loc_A1E1DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E1B2: ; CODE XREF: sub_A1E19C+Aj mov ecx, [ebp+arg_4] test ecx, ecx jnz short loc_A1E1C0 or eax, 0FFFFFFFFh mov edx, eax jmp short loc_A1E1DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E1C0: ; CODE XREF: sub_A1E19C+1Bj mov edx, [eax+10h] cmp ecx, edx jb short loc_A1E1D6 mov eax, [eax+4] add eax, edx cmp ecx, eax jnb short loc_A1E1D6 loc_A1E1D0: ; CODE XREF: sub_A1E19C+Fj xor edx, edx mov eax, edx jmp short loc_A1E1DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E1D6: ; CODE XREF: sub_A1E19C+29j ; sub_A1E19C+32j sub ecx, edx mov eax, ecx cdq loc_A1E1DB: ; CODE XREF: sub_A1E19C+14j ; sub_A1E19C+22j ... pop ebp retn 0Ch sub_A1E19C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E1DF proc near ; CODE XREF: sub_A1E2D0+5Fp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push esi mov esi, ecx mov ecx, [ebp+arg_0] sub edx, [esi+10h] shr edx, 6 test edx, edx jz short loc_A1E212 lea eax, [edx-1] test eax, eax js short loc_A1E20F push edi mov edi, eax loc_A1E1FE: ; CODE XREF: sub_A1E1DF+2Dj cmp byte ptr [esi+edi+18h], 2 jnz short loc_A1E20E lea eax, [edi-1] mov edi, eax test eax, eax jns short loc_A1E1FE loc_A1E20E: ; CODE XREF: sub_A1E1DF+24j pop edi loc_A1E20F: ; CODE XREF: sub_A1E1DF+1Aj inc eax jmp short loc_A1E214 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E212: ; CODE XREF: sub_A1E1DF+13j mov eax, edx loc_A1E214: ; CODE XREF: sub_A1E1DF+31j mov [ecx], eax cmp byte ptr [edx+esi+18h], 2 mov ecx, [ebp+arg_4] mov [ecx], edx jnz short loc_A1E22D loc_A1E222: ; CODE XREF: sub_A1E1DF+4Cj inc dword ptr [ecx] mov eax, [ecx] cmp byte ptr [eax+esi+18h], 2 jz short loc_A1E222 loc_A1E22D: ; CODE XREF: sub_A1E1DF+41j pop esi pop ebp retn 8 sub_A1E1DF endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E232 proc near ; CODE XREF: sub_A1DE7B+7Ep ; sub_A1DE7B+103p arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_0] add eax, edx jmp short loc_A1E246 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E23E: ; CODE XREF: sub_A1E232+16j cmp byte ptr [ecx+edx+18h], 0 jnz short loc_A1E251 inc edx loc_A1E246: ; CODE XREF: sub_A1E232+Aj cmp edx, eax jb short loc_A1E23E or eax, 0FFFFFFFFh loc_A1E24D: ; CODE XREF: sub_A1E232+21j pop ebp retn 4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E251: ; CODE XREF: sub_A1E232+11j mov eax, edx jmp short loc_A1E24D sub_A1E232 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1E255 proc near ; CODE XREF: sub_A1B40A+CCp ; sub_A1DD29+DEp ... mov edi, edi push ebx push esi mov esi, ecx push edi test esi, esi jz short loc_A1E2CC mov edx, large fs:124h xor ebx, ebx mov eax, [esi+8] cmp eax, [edx+80h] jnz short loc_A1E285 mov eax, [esi+41Ch] inc ebx test eax, eax jz short loc_A1E285 push eax call _MmUnsecureVirtualMemory@4 ; MmUnsecureVirtualMemory(x) loc_A1E285: ; CODE XREF: sub_A1E255+1Dj ; sub_A1E255+28j mov edi, [esi+0Ch] test edi, edi jz short loc_A1E29C push edi call _MmUnlockPages@4 ; MmUnlockPages(x) push edi call _IoFreeMdl@4 ; IoFreeMdl(x) and dword ptr [esi+0Ch], 0 loc_A1E29C: ; CODE XREF: sub_A1E255+35j and dword ptr [esi+10h], 0 cmp dword ptr [esi], 0 jz short loc_A1E2C1 test ebx, ebx jz short loc_A1E2BA push 8000h lea eax, [esi+4] push eax push esi push 0FFFFFFFFh call _ZwFreeVirtualMemory@16 ; ZwFreeVirtualMemory(x,x,x,x) loc_A1E2BA: ; CODE XREF: sub_A1E255+52j and dword ptr [esi], 0 and dword ptr [esi+4], 0 loc_A1E2C1: ; CODE XREF: sub_A1E255+4Ej push 42524157h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1E2CC: ; CODE XREF: sub_A1E255+9j pop edi pop esi pop ebx retn sub_A1E255 endp ; sp = -4 ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E2D0 proc near ; CODE XREF: sub_A1E37F+A7p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch mov eax, large fs:124h push ebx push esi push edi dec word ptr [eax+13Eh] mov ebx, ecx mov [ebp+var_C], edx nop lea esi, [ebx+418h] xor edx, edx push 0 mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1E312 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1E312: ; CODE XREF: sub_A1E2D0+36j test edi, edi jz short loc_A1E31A or byte ptr [edi+0Eh], 1 loc_A1E31A: ; CODE XREF: sub_A1E2D0+44j mov edx, [ebp+var_C] lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] xor edi, edi push eax mov ecx, ebx mov [ebp+var_4], edi mov [ebp+var_8], edi call sub_A1E1DF mov ecx, [ebp+var_4] mov eax, [ebp+var_8] cmp ecx, eax jg short loc_A1E351 sub eax, ecx inc eax push eax ; size_t lea eax, [ecx+18h] add eax, ebx push edi ; int push eax ; void * call _memset add esp, 0Ch loc_A1E351: ; CODE XREF: sub_A1E2D0+6Cj or eax, 0FFFFFFFFh lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1E365 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1E365: ; CODE XREF: sub_A1E2D0+8Cj mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) pop edi pop esi xor eax, eax pop ebx leave retn sub_A1E2D0 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E37F proc near ; CODE XREF: sub_A1D1FE+10p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h mov eax, large fs:124h push ebx push esi xor ebx, ebx mov [ebp+var_8], edx dec word ptr [eax+13Eh] push edi mov [ebp+var_C], ecx nop lea esi, [ecx+80h] xor edx, edx push ebx mov ecx, esi call KeAbPreAcquire push 11h mov edi, eax xor eax, eax pop ecx lock cmpxchg [esi], ecx test eax, eax jz short loc_A1E3C9 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockSharedEx loc_A1E3C9: ; CODE XREF: sub_A1E37F+3Ej test edi, edi jz short loc_A1E3D1 or byte ptr [edi+0Eh], 1 loc_A1E3D1: ; CODE XREF: sub_A1E37F+4Cj mov ecx, [ebp+var_C] lea eax, [ebp+var_10] mov edx, [ebp+var_8] add ecx, 68h push eax lea eax, [ebp+var_4] mov [ebp+var_4], ebx push eax push 4 call WbFindLookupEntry mov edi, eax test edi, edi js short loc_A1E3F5 mov ebx, [ebp+var_4] loc_A1E3F5: ; CODE XREF: sub_A1E37F+71j push 11h xor edx, edx pop eax lock cmpxchg [esi], edx cmp eax, 11h jz short loc_A1E40A mov ecx, esi call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1E40A: ; CODE XREF: sub_A1E37F+82j mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) test edi, edi js short loc_A1E42D mov edx, [ebp+var_8] mov ecx, ebx call sub_A1E2D0 mov edi, eax loc_A1E42D: ; CODE XREF: sub_A1E37F+A0j mov eax, edi pop edi pop esi pop ebx leave retn sub_A1E37F endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E434 proc near ; CODE XREF: sub_A1E613+E5p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi push 0FFFFFFFFh mov esi, edx push 4 push dword ptr [esi] push ecx add ecx, 30h call sub_A1DB7E mov edi, eax mov [ebp+var_8], edi test edi, edi js short loc_A1E480 lea edi, [esi+8] loc_A1E45B: ; CODE XREF: sub_A1E434+42j ; sub_A1E434+47j mov esi, [edi] mov ebx, esi mov edx, [edi+4] add ebx, 1 mov ecx, edx mov [ebp+var_4], edx adc ecx, 0 mov eax, esi nop lock cmpxchg8b qword ptr [edi] cmp eax, esi jnz short loc_A1E45B cmp edx, [ebp+var_4] jnz short loc_A1E45B mov edi, [ebp+var_8] loc_A1E480: ; CODE XREF: sub_A1E434+22j mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1E434 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E489 proc near ; CODE XREF: sub_A1E613+A0p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 10h push ebx push esi push edi mov [ebp+var_8], edx mov esi, 2F0h mov [ebp+var_C], ecx lea edx, [ebp+var_4] xor edi, edi mov ecx, esi mov [ebp+var_4], edi call sub_A1ACD8 mov ebx, eax test ebx, ebx js short loc_A1E4E5 push esi ; size_t mov esi, [ebp+var_4] push edi ; int push esi ; void * call _memset mov eax, [ebp+var_8] add esp, 0Ch add dword ptr [esi+8], 1 adc [esi+0Ch], edi mov [esi], eax mov eax, [ebp+arg_0] mov [esi+10h], edi mov [esi+14h], edi mov [esi+18h], edi mov dword ptr [esi+1Ch], 0Ah mov [eax], esi jmp short loc_A1E4E8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E4E5: ; CODE XREF: sub_A1E489+29j mov edi, [ebp+var_4] loc_A1E4E8: ; CODE XREF: sub_A1E489+5Aj mov ecx, [ebp+var_C] mov edx, edi call sub_A1E4FB pop edi pop esi mov eax, ebx pop ebx leave retn 4 sub_A1E489 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E4FB proc near ; CODE XREF: sub_A1B40A+2Dp ; sub_A1D36F+12Ep ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx push esi mov eax, edx mov [ebp+var_10], ecx xor esi, esi mov [ebp+var_C], eax push edi mov edi, esi test eax, eax jz short loc_A1E563 add eax, 8 mov [ebp+var_4], eax loc_A1E51C: ; CODE XREF: sub_A1E4FB+49j ; sub_A1E4FB+4Dj mov edx, [eax] mov ebx, edx mov edi, [eax+4] sub ebx, 1 mov ecx, edi mov [ebp+var_8], edx mov eax, edx sbb ecx, esi mov edx, edi nop mov esi, [ebp+var_4] lock cmpxchg8b qword ptr [esi] mov ecx, [ebp+var_8] cmp eax, ecx mov eax, [ebp+var_4] push 0 pop esi jnz short loc_A1E51C cmp edx, edi jnz short loc_A1E51C mov esi, ecx add esi, 0FFFFFFFFh mov ecx, esi adc edi, 0FFFFFFFFh or ecx, edi jnz short loc_A1E563 mov edx, [ebp+var_C] mov ecx, [ebp+var_10] call sub_A1E5D7 loc_A1E563: ; CODE XREF: sub_A1E4FB+19j ; sub_A1E4FB+5Bj mov edx, edi mov eax, esi pop edi pop esi pop ebx leave retn sub_A1E4FB endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E56C proc near ; CODE XREF: sub_A1E613+60p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_4], 0 lea eax, [ebp+var_4] push 0 push eax push 4 add ecx, 30h call WbFindLookupEntry mov [ebp+var_C], eax test eax, eax js short locret_A1E5D3 push edi mov edi, [ebp+arg_0] test edi, edi jz short loc_A1E5D2 mov ecx, [ebp+var_4] test ecx, ecx jz short loc_A1E5D0 push ebx lea edi, [ecx+8] push esi loc_A1E5A3: ; CODE XREF: sub_A1E56C+52j ; sub_A1E56C+57j mov esi, [edi] mov ebx, esi mov edx, [edi+4] add ebx, 1 mov ecx, edx mov [ebp+var_8], edx adc ecx, 0 mov eax, esi nop lock cmpxchg8b qword ptr [edi] cmp eax, esi jnz short loc_A1E5A3 cmp edx, [ebp+var_8] jnz short loc_A1E5A3 mov ecx, [ebp+var_4] mov edi, [ebp+arg_0] mov eax, [ebp+var_C] pop esi pop ebx loc_A1E5D0: ; CODE XREF: sub_A1E56C+30j mov [edi], ecx loc_A1E5D2: ; CODE XREF: sub_A1E56C+29j pop edi locret_A1E5D3: ; CODE XREF: sub_A1E56C+21j leave retn 8 sub_A1E56C endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� sub_A1E5D7 proc near ; CODE XREF: sub_A1E4FB+63p mov edi, edi push ebx push esi mov esi, edx push edi test esi, esi jnz short loc_A1E5E6 xor edi, edi jmp short loc_A1E60D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E5E6: ; CODE XREF: sub_A1E5D7+9j push 0FFFFFFFFh call sub_A1D706 mov edi, eax test edi, edi js short loc_A1E60D mov eax, [esi+18h] mov ebx, 42524157h test eax, eax jz short loc_A1E606 push ebx push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1E606: ; CODE XREF: sub_A1E5D7+26j push ebx push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1E60D: ; CODE XREF: sub_A1E5D7+Dj ; sub_A1E5D7+1Aj mov eax, edi pop edi pop esi pop ebx retn sub_A1E5D7 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame sub_A1E613 proc near ; CODE XREF: sub_A1D36F+94p ; sub_A1D4C6+18p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx mov eax, large fs:124h push ebx mov [ebp+var_8], eax mov ebx, ecx mov eax, large fs:124h xor ecx, ecx push esi push edi mov [ebp+var_4], ecx dec word ptr [eax+13Eh] nop lea esi, [ebx+48h] xor edx, edx push ecx mov ecx, esi call KeAbPreAcquire push 11h mov edi, eax xor eax, eax pop ecx lock cmpxchg [esi], ecx test eax, eax jz short loc_A1E661 push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockSharedEx loc_A1E661: ; CODE XREF: sub_A1E613+42j test edi, edi jz short loc_A1E669 or byte ptr [edi+0Eh], 1 loc_A1E669: ; CODE XREF: sub_A1E613+50j mov edx, [ebp+var_8] lea eax, [ebp+var_4] push ecx push eax mov ecx, ebx call sub_A1E56C push 11h mov edi, eax xor ecx, ecx pop eax lock cmpxchg [esi], ecx cmp eax, 11h jz short loc_A1E68F mov ecx, esi call @ExfReleasePushLockShared@4 ; ExfReleasePushLockShared(x) loc_A1E68F: ; CODE XREF: sub_A1E613+73j mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) cmp edi, 0C0000272h jnz short loc_A1E726 mov edx, [ebp+var_8] lea eax, [ebp+var_4] push eax mov ecx, ebx call sub_A1E489 mov edi, eax test edi, edi js short loc_A1E73A mov eax, large fs:124h dec word ptr [eax+13Eh] nop push 0 xor edx, edx mov ecx, esi call KeAbPreAcquire mov edi, eax lock bts dword ptr [esi], 0 jnb short loc_A1E6EA push esi mov edx, edi mov ecx, esi call ExfAcquirePushLockExclusiveEx loc_A1E6EA: ; CODE XREF: sub_A1E613+CBj test edi, edi jz short loc_A1E6F2 or byte ptr [edi+0Eh], 1 loc_A1E6F2: ; CODE XREF: sub_A1E613+D9j mov edx, [ebp+var_4] push ecx mov ecx, ebx call sub_A1E434 mov edi, eax or eax, 0FFFFFFFFh lock xadd [esi], eax and al, 6 cmp al, 2 jnz short loc_A1E713 mov ecx, esi call @ExfTryToWakePushLock@4 ; ExfTryToWakePushLock(x) loc_A1E713: ; CODE XREF: sub_A1E613+F7j mov ecx, esi call KeAbPostRelease mov ecx, large fs:124h call _KiLeaveGuardedRegionUnsafe@4 ; KiLeaveGuardedRegionUnsafe(x) loc_A1E726: ; CODE XREF: sub_A1E613+95j test edi, edi js short loc_A1E73A mov ecx, [ebp+arg_0] test ecx, ecx jz short loc_A1E73A mov eax, [ebp+var_4] mov [ecx], eax xor eax, eax jmp short loc_A1E73D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E73A: ; CODE XREF: sub_A1E613+A9j ; sub_A1E613+115j ... mov eax, [ebp+var_4] loc_A1E73D: ; CODE XREF: sub_A1E613+125j mov edx, eax mov ecx, ebx call sub_A1E4FB mov eax, edi pop edi pop esi pop ebx leave retn 4 sub_A1E613 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbOpenDatabaseEx(x, x, x, x) _SdbOpenDatabaseEx@16 proc near ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+F2p var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h xor eax, eax push ebx push esi push edi lea edi, [ebp+var_10] mov ebx, ecx stosd stosd stosd mov eax, ebx test ebx, ebx jnz short loc_A1E76F mov eax, offset ??_C@_11LOCGONAA@@NNGAKEGL@ loc_A1E76F: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+19j push eax xor edi, edi push edi push (offset loc_8C2487+1) push 382h push offset ??_C@_0BC@OLOFFDGE@SdbOpenDatabaseEx@NNGAKEGL@ push 3 call AslLogCallPrintf add esp, 14h mov edx, 0A58h call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax mov [ebp+var_4], esi test esi, esi jnz short loc_A1E7BD push offset ??_C@_0CA@IINJBIKG@Failed?5to?5allocate?5DB?5structure@NNGAKEGL@ push 38Ah push offset ??_C@_0BC@OLOFFDGE@SdbOpenDatabaseEx@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1E900 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E7BD: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+4Ej push 0A58h ; size_t push edi ; int push esi ; void * call _memset add esp, 0Ch mov edx, ebx mov ecx, esi push edi push edi push edi call AslFileMappingCreate test eax, eax jns short loc_A1E7FB push eax push (offset loc_8C23D9+7) push 395h loc_A1E7E7: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+EBj ; SdbOpenDatabaseEx(x,x,x,x)+13Dj push offset ??_C@_0BC@OLOFFDGE@SdbOpenDatabaseEx@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A1E8EA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E7FB: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+8Bj mov ecx, [esi] mov eax, [ecx+14h] mov ebx, [ecx+10h] cmp eax, edi ja loc_A1E8D1 jb short loc_A1E81D cmp ebx, 7FFFFFFFh ja loc_A1E8D1 cmp eax, edi ja short loc_A1E826 loc_A1E81D: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+BCj cmp ebx, 2Ah jb loc_A1E8D1 loc_A1E826: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+CCj call _AslFileMappingEnsureMappedAs@8 ; AslFileMappingEnsureMappedAs(x,x) test eax, eax jns short loc_A1E83C push eax push offset ??_C@_0BH@KGGJNBJB@Failed?5to?5map?5SDB?5?$FL?$CFx?$FN@NNGAKEGL@ push 3A4h jmp short loc_A1E7E7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E83C: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+DEj mov [esi+8], edi mov [esi+0Ch], ebx mov eax, [esi] test eax, eax jz short loc_A1E84B mov edi, [eax+18h] loc_A1E84B: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+F7j push 0Ch ; size_t lea eax, [ebp+var_10] mov [esi+4], edi push eax ; void * xor edx, edx mov ecx, esi call SdbpReadMappedData test eax, eax jnz short loc_A1E86D push offset ??_C@_0BP@DEIGBGOF@Failed?5to?5read?5database?5header@NNGAKEGL@ push 3B1h jmp short loc_A1E8DB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E86D: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+110j cmp [ebp+var_8], 66626473h jz short loc_A1E8BE cmp [ebp+var_8], 6662647Ah jz short loc_A1E891 push [ebp+var_8] push (offset loc_8C256B+1) push 3BEh jmp loc_A1E7E7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E891: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+12Ej push ecx lea ecx, [ebp+var_4] call _SdbpOpenCompressedDatabase@12 ; SdbpOpenCompressedDatabase(x,x,x) test eax, eax jnz short loc_A1E8B9 push offset ??_C@_0DP@MOGONKPB@SdbpOpenCompressedDatabase?5fail@NNGAKEGL@ push 3C4h push offset ??_C@_0BC@OLOFFDGE@SdbOpenDatabaseEx@NNGAKEGL@ push 1 call AslLogCallPrintf mov esi, [ebp+var_4] jmp short loc_A1E8E7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E8B9: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+14Dj mov esi, [ebp+var_4] jmp short loc_A1E8CD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E8BE: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+125j push ecx lea edx, [ebp+var_10] mov ecx, esi call SdbpValidateAndApplyCompatFlags test eax, eax jz short loc_A1E8EA loc_A1E8CD: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+16Dj mov eax, esi jmp short loc_A1E902 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E8D1: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+B6j ; SdbOpenDatabaseEx(x,x,x,x)+C4j ... push offset ??_C@_0DD@LMDIBKL@Failed?5to?5open?5SDB?5?9?5File?5size?5@NNGAKEGL@ push 39Eh loc_A1E8DB: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+11Cj push offset ??_C@_0BC@OLOFFDGE@SdbOpenDatabaseEx@NNGAKEGL@ push 1 call AslLogCallPrintf loc_A1E8E7: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+168j add esp, 10h loc_A1E8EA: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+A7j ; SdbOpenDatabaseEx(x,x,x,x)+17Cj test esi, esi jz short loc_A1E900 mov ecx, [esi] call AslFileMappingDelete push 74705041h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1E900: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+69j ; SdbOpenDatabaseEx(x,x,x,x)+19Dj xor eax, eax loc_A1E902: ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+180j pop edi pop esi pop ebx leave retn 8 _SdbOpenDatabaseEx@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbGetKShimTagRef(x, x) _SdbGetKShimTagRef@8 proc near ; CODE XREF: KsepDbGetShimInfo(x,x)+7Fp var_30 = dword ptr -30h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 34h and [ebp+var_4], 0 xor eax, eax push ebx push esi push edi push 0Ah mov ebx, ecx lea edi, [ebp+var_30] pop ecx rep stosd mov esi, [ebx+4] lea eax, [ebp+var_30] push eax push edx push 6001h mov edx, 7025h mov ecx, esi call SdbFindFirstStringIndexedTag lea ecx, [ebp+var_4] mov edx, esi push ecx push eax mov ecx, ebx call SdbTagIDToTagRef neg eax pop edi sbb eax, eax and eax, [ebp+var_4] pop esi pop ebx leave retn _SdbGetKShimTagRef@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbQueryDataEx(x, x, x, x, x, x, x) _SdbQueryDataEx@28 proc near ; CODE XREF: PiIsDriverBlocked+AFE7Dp var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp sub esp, 10h xor eax, eax push esi mov [ebp+var_8], eax mov esi, edx mov [ebp+var_4], eax mov [ebp+var_C], eax lea eax, [ebp+var_4] push eax lea eax, [ebp+var_8] push eax call SdbTagRefToTagID test eax, eax jnz short loc_A1E99D push esi push offset ??_C@_0CH@KHIGAPEJ@Failed?5to?5convert?5tagref?50x?$CFx?5t@NNGAKEGL@ push 1AB1h push (offset loc_8C34A8+2) push 1 call AslLogCallPrintf add esp, 14h push 57h pop eax jmp short loc_A1E9B6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1E99D: ; CODE XREF: SdbQueryDataEx(x,x,x,x,x,x,x)+25j mov edx, [ebp+var_4] lea eax, [ebp+var_C] push eax ; int push [ebp+arg_C] ; int push [ebp+arg_8] ; void * push [ebp+arg_4] ; int push ecx ; int mov ecx, [ebp+var_8] call _SdbQueryDataExTagID@28 ; SdbQueryDataExTagID(x,x,x,x,x,x,x) loc_A1E9B6: ; CODE XREF: SdbQueryDataEx(x,x,x,x,x,x,x)+44j pop esi leave retn 14h _SdbQueryDataEx@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbQueryDataExTagID(int,int,void *,int,int) _SdbQueryDataExTagID@28 proc near ; CODE XREF: SdbQueryDataEx(x,x,x,x,x,x,x)+5Ap var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h mov edi, edi push ebp mov ebp, esp sub esp, 20h push ebx push esi xor esi, esi mov [ebp+var_4], ecx mov ebx, edx mov [ebp+var_14], esi push edi mov edi, offset ??_C@_1O@MPKBHDFA@?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy@NNGAKEGL@ mov [ebp+var_20], esi mov [ebp+var_1C], esi cmp [ebp+arg_8], esi jnz short loc_A1EA06 cmp [ebp+arg_C], esi jnz short loc_A1EA06 push offset ??_C@_0DF@DOHFJIJC@One?5of?5lpBuffer?5or?5lpcbBufferSi@NNGAKEGL@ push 19CAh push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h push 57h loc_A1EA00: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+91j pop esi jmp loc_A1ECD9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EA06: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+23j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+28j mov ecx, edi lea edx, [ecx+2] loc_A1EA0B: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+59j mov ax, [ecx] add ecx, 2 cmp ax, si jnz short loc_A1EA0B sub ecx, edx sar ecx, 1 push ecx lea eax, [ecx+1] lea edx, [eax+eax] mov [ebp+var_10], eax call _AslAlloc@12 ; AslAlloc(x,x,x) mov [ebp+var_C], eax test eax, eax jnz short loc_A1EA4E push edi push offset ??_C@_0DM@EFDBMOEF@Cannot?5allocate?5temporary?5buffe@NNGAKEGL@ push 19D6h push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h push 8 jmp short loc_A1EA00 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EA4E: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+73j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+10Aj push 5Ch ; wchar_t push edi ; wchar_t * call _wcschr mov edx, [ebp+var_10] mov [ebp+var_18], eax pop ecx pop ecx test eax, eax jnz short loc_A1EA77 mov ecx, [ebp+var_C] push edi call RtlStringCchCopyW test eax, eax js loc_A1ECC9 mov edi, esi jmp short loc_A1EAA1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EA77: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+A5j sub eax, edi sar eax, 1 push eax push edi mov edi, [ebp+var_C] mov ecx, edi mov [ebp+var_8], eax call RtlStringCchCopyNW test eax, eax js loc_A1ECC9 mov eax, [ebp+var_8] xor ecx, ecx mov [edi+eax*2], cx mov edi, [ebp+var_18] add edi, 2 loc_A1EAA1: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+BAj push [ebp+var_C] ; wchar_t * mov ecx, [ebp+var_4] mov edx, ebx push 6001h ; int push 700Fh ; __int16 call _SdbFindFirstNamedTag@20 ; SdbFindFirstNamedTag(x,x,x,x,x) mov ebx, eax test edi, edi jz short loc_A1EAC9 cmp [edi], si jz short loc_A1EAC9 test ebx, ebx jnz short loc_A1EA4E jmp short loc_A1EACD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EAC9: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+101j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+106j test ebx, ebx jnz short loc_A1EAD7 loc_A1EACD: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+10Cj ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+1EEj ... mov esi, 490h jmp loc_A1ECCC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EAD7: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+110j mov edi, [ebp+var_4] mov edx, ebx push 4018h mov ecx, edi mov [ebp+var_8], esi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A1EB0D push ebx push offset ??_C@_0DD@OJKICILA@The?5entry?50x?$CFx?5does?5not?5have?5va@NNGAKEGL@ push 1A07h push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h mov ecx, esi jmp short loc_A1EB1C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EB0D: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+132j push esi mov edx, eax mov ecx, edi call SdbReadDWORDTag mov ecx, eax mov [ebp+var_8], ecx loc_A1EB1C: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+150j mov edi, esi mov edx, esi test ecx, ecx jz loc_A1EC81 mov eax, ecx sub eax, 1 jz short loc_A1EB79 dec eax sub eax, 1 jz short loc_A1EB72 sub eax, 1 jz short loc_A1EB6B sub eax, 7 jz short loc_A1EB64 push ecx push ebx push offset ??_C@_0DH@CJPEJPEJ@The?5entry?50x?$CFx?5contains?5bad?5val@NNGAKEGL@ push 1A2Ch push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 18h mov esi, 54Eh jmp loc_A1ECCC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EB64: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+182j mov eax, 5007h jmp short loc_A1EB7E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EB6B: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+17Dj mov eax, 4019h jmp short loc_A1EB7E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EB72: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+178j mov eax, 9005h jmp short loc_A1EB7E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EB79: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+172j mov eax, 601Eh loc_A1EB7E: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+1AEj ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+1B5j ... mov ecx, [ebp+var_4] mov edx, ebx push eax call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov edi, eax test edi, edi jnz short loc_A1EBAE push ebx push offset ??_C@_0CB@GDMDDNIA@The?5entry?50x?$CFx?5contains?5no?5valu@NNGAKEGL@ push 1A38h push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A1EACD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EBAE: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+1D2j mov eax, [ebp+var_8] sub eax, 1 jz short loc_A1EC2B dec eax sub eax, 1 jz short loc_A1EC00 sub eax, 1 jz short loc_A1EBE7 sub eax, 7 jnz loc_A1EC78 mov ecx, [ebp+var_4] mov edx, edi push esi push esi call SdbReadQWORDTag push 8 mov [ebp+var_1C], edx lea edx, [ebp+var_20] mov [ebp+var_20], eax pop edi jmp loc_A1EC81 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EBE7: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+204j mov ecx, [ebp+var_4] mov edx, edi push esi call SdbReadDWORDTag push 4 mov [ebp+var_14], eax lea edx, [ebp+var_14] pop edi jmp loc_A1EC85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EC00: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+1FFj mov ecx, [ebp+var_4] mov edx, edi call SdbGetTagDataSize mov ecx, [ebp+var_4] mov edx, edi mov [ebp+var_10], eax call SdbpGetMappedTagData mov edx, eax test edx, edx jnz short loc_A1EC7E push edi push ebx push (offset loc_8C34D1+1) push 1A56h jmp short loc_A1EC47 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EC2B: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+1F9j mov ecx, [ebp+var_4] mov edx, edi call SdbGetStringTagPtr mov edx, eax test edx, edx jnz short loc_A1EC5B push edi push ebx push offset ??_C@_0CO@JGKJJPEB@The?5entry?50x?$CFx?5contains?5bad?5str@NNGAKEGL@ push 1A48h loc_A1EC47: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+26Ej push offset ??_C@_0BE@BDIMHFPA@SdbQueryDataExTagID@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 18h jmp loc_A1EACD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EC5B: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+27Ej mov ecx, edx lea edi, [ecx+2] loc_A1EC60: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+2AEj mov ax, [ecx] add ecx, 2 cmp ax, si jnz short loc_A1EC60 sub ecx, edi sar ecx, 1 lea edi, ds:2[ecx*2] jmp short loc_A1EC81 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EC78: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+209j mov edi, esi mov edx, esi jmp short loc_A1EC81 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EC7E: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+260j mov edi, [ebp+var_10] loc_A1EC81: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+167j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+227j ... test edi, edi jz short loc_A1ECA9 loc_A1EC85: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+240j cmp [ebp+arg_8], esi jz short loc_A1ECA6 mov eax, [ebp+arg_C] test eax, eax jz short loc_A1ECA6 mov eax, [eax] cmp eax, edi jb short loc_A1ECA6 push eax ; size_t push edx ; void * push [ebp+arg_8] ; void * call _memmove add esp, 0Ch jmp short loc_A1ECA9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ECA6: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+2CDj ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+2D4j ... push 7Ah pop esi loc_A1ECA9: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+2C8j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+2E9j mov eax, [ebp+arg_C] test eax, eax jz short loc_A1ECB2 mov [eax], edi loc_A1ECB2: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+2F3j mov eax, [ebp+arg_4] test eax, eax jz short loc_A1ECBE mov ecx, [ebp+var_8] mov [eax], ecx loc_A1ECBE: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+2FCj mov eax, [ebp+arg_10] test eax, eax jz short loc_A1ECCC mov [eax], ebx jmp short loc_A1ECCC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ECC9: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+B2j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+D1j push 7Ah pop esi loc_A1ECCC: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+117j ; SdbQueryDataExTagID(x,x,x,x,x,x,x)+1A4j ... push 74705041h push [ebp+var_C] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1ECD9: ; CODE XREF: SdbQueryDataExTagID(x,x,x,x,x,x,x)+46j pop edi mov eax, esi pop esi pop ebx leave retn 14h _SdbQueryDataExTagID@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbReadEntryInformation(x, x, x) _SdbReadEntryInformation@12 proc near ; CODE XREF: PiIsDriverBlocked+AFEF6p var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_8 = dword ptr -8 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 40h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_8], eax mov eax, [ebp+arg_0] and [ebp+var_34], 0 and [ebp+var_38], 0 push ebx push esi push edi push 0Ah mov esi, ecx mov [ebp+var_3C], eax pop ecx xor eax, eax lea edi, [ebp+var_30] rep stosd lea eax, [ebp+var_34] mov ecx, esi push eax lea eax, [ebp+var_38] mov ebx, edx push eax call SdbTagRefToTagID mov esi, eax test esi, esi jnz short loc_A1ED47 push ebx push offset ??_C@_0CH@KHIGAPEJ@Failed?5to?5convert?5tagref?50x?$CFx?5t@NNGAKEGL@ push 1AE9h loc_A1ED33: ; CODE XREF: SdbReadEntryInformation(x,x,x)+C0j push offset ??_C@_0BI@PGDCLLBH@SdbReadEntryInformation@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A1EE05 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ED47: ; CODE XREF: SdbReadEntryInformation(x,x,x)+44j mov edi, [ebp+var_38] mov ecx, edi mov edx, [ebp+var_34] push 9004h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov ebx, eax test ebx, ebx jnz short loc_A1ED82 push [ebp+var_34] push offset ??_C@_0CJ@GFAHPFCA@Failed?5to?5read?5TAG_EXE_ID?5for?5t@NNGAKEGL@ push 1AF3h push offset ??_C@_0BI@PGDCLLBH@SdbReadEntryInformation@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A1ED7B: ; CODE XREF: SdbReadEntryInformation(x,x,x)+E9j xor esi, esi jmp loc_A1EE05 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1ED82: ; CODE XREF: SdbReadEntryInformation(x,x,x)+7Bj push 10h ; int lea eax, [ebp+var_30] mov edx, ebx push eax ; void * mov ecx, edi call SdbReadBinaryTag mov esi, eax test esi, esi jnz short loc_A1EDA4 push ebx push offset ??_C@_0CH@LFOAJKPD@Failed?5to?5read?5GUID?5referenced?5@NNGAKEGL@ push 1AFDh jmp short loc_A1ED33 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EDA4: ; CODE XREF: SdbReadEntryInformation(x,x,x)+B3j lea edx, [ebp+var_18] mov ecx, edi call SdbGetDatabaseID test eax, eax jnz short loc_A1EDCD push offset ??_C@_0CE@IBKPPHLF@Failed?5to?5read?5GUID?5of?5the?5data@NNGAKEGL@ push 1B05h push offset ??_C@_0BI@PGDCLLBH@SdbReadEntryInformation@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1ED7B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EDCD: ; CODE XREF: SdbReadEntryInformation(x,x,x)+CEj lea edx, [ebp+var_20] lea ecx, [ebp+var_30] ; int call SdbGetEntryFlags mov edx, [ebp+var_34] neg eax push 700Fh sbb eax, eax mov ecx, edi and [ebp+var_20], eax call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov [ebp+var_1C], eax mov eax, [ebp+var_3C] test eax, eax jz short loc_A1EE02 push 0Ah pop ecx lea esi, [ebp+var_30] mov edi, eax rep movsd loc_A1EE02: ; CODE XREF: SdbReadEntryInformation(x,x,x)+114j xor esi, esi inc esi loc_A1EE05: ; CODE XREF: SdbReadEntryInformation(x,x,x)+60j ; SdbReadEntryInformation(x,x,x)+9Bj mov ecx, [ebp+var_8] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 4 _SdbReadEntryInformation@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbpCheckExe(int,int,int,int,int,void *) _SdbpCheckExe@32 proc near ; CODE XREF: SdbpSearchDB+AF6FAp ; SdbpSearchDB+AF79Ep ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi push edi push 2 pop edi lea eax, [ebp+var_8] mov [ebp+var_4], edi push eax lea eax, [ebp+var_4] xor esi, esi push eax push [ebp+arg_8] mov [ebp+var_8], esi push [ebp+arg_0] call SdbpCheckForMatch test eax, eax jz short loc_A1EE97 cmp [ebp+arg_C], 1 mov ebx, [ebp+var_4] jnz short loc_A1EE52 cmp ebx, edi jnz short loc_A1EE97 loc_A1EE52: ; CODE XREF: SdbpCheckExe(x,x,x,x,x,x,x,x)+34j cmp [ebp+arg_C], edi jnz short loc_A1EE5B cmp ebx, edi jz short loc_A1EE97 loc_A1EE5B: ; CODE XREF: SdbpCheckExe(x,x,x,x,x,x,x,x)+3Dj mov edi, [ebp+arg_4] cmp ebx, 1 jnz short loc_A1EEA0 push 80h ; size_t push esi ; int push [ebp+arg_14] ; void * call _memset add esp, 0Ch mov ecx, esi loc_A1EE76: ; CODE XREF: SdbpCheckExe(x,x,x,x,x,x,x,x)+8Dj mov edx, [ebp+arg_14] xor esi, esi mov eax, [ebp+arg_0] inc esi mov [edx+ecx*8], eax mov eax, [ebp+var_8] mov [edx+ecx*8+4], eax lea eax, [ecx+1] mov [edi], eax mov eax, [ebp+arg_10] test eax, eax jz short loc_A1EE97 mov [eax], ebx loc_A1EE97: ; CODE XREF: SdbpCheckExe(x,x,x,x,x,x,x,x)+2Bj ; SdbpCheckExe(x,x,x,x,x,x,x,x)+38j ... pop edi mov eax, esi pop esi pop ebx leave retn 18h ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EEA0: ; CODE XREF: SdbpCheckExe(x,x,x,x,x,x,x,x)+49j mov ecx, [edi] cmp ecx, 10h jb short loc_A1EE76 push (offset loc_8C30BD+5) push 0FE8h push offset ??_C@_0N@CCNBMNPH@SdbpCheckExe@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h inc dword ptr [edi] jmp short loc_A1EE97 _SdbpCheckExe@32 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingDevice(x, x, x, x, x, x, x) _SdbpCheckMatchingDevice@28 proc near ; DATA XREF: .text:00404614o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_4] push ebx mov ebx, [ebp+arg_0] push esi push edi mov edi, [eax+3ECh] xor esi, esi mov [ebx], esi test edi, edi jnz short loc_A1EEFB push offset ??_C@_0CD@LALAIDGB@No?5device?5query?5callback?5specif@NNGAKEGL@ push 89Bh loc_A1EEEA: ; CODE XREF: SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+55j ; SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+6Fj push offset ??_C@_0BI@KHBGCKAO@SdbpCheckMatchingDevice@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1EF47 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EEFB: ; CODE XREF: SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+1Aj mov edx, [ebp+arg_10] mov ecx, [ebp+arg_8] push 6001h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A1EF1B push offset ??_C@_0BO@FMBINIHJ@Failed?5to?5read?5HWID?5attribute@NNGAKEGL@ push 8A1h jmp short loc_A1EEEA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EF1B: ; CODE XREF: SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+49j mov ecx, [ebp+arg_8] mov edx, eax call SdbGetStringTagPtr test eax, eax jnz short loc_A1EF35 push (offset loc_8C2F8B+5) push 8A7h jmp short loc_A1EEEA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EF35: ; CODE XREF: SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+63j push eax call edi mov ecx, [ebp+arg_14] xor esi, esi inc esi mov [ebx], eax test ecx, ecx jz short loc_A1EF47 mov [ecx+28h], esi loc_A1EF47: ; CODE XREF: SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+35j ; SdbpCheckMatchingDevice(x,x,x,x,x,x,x)+7Ej pop edi mov eax, esi pop esi pop ebx pop ebp retn 1Ch _SdbpCheckMatchingDevice@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingDir(x, x, x, x, x, x, x) _SdbpCheckMatchingDir@28 proc near ; DATA XREF: .text:004046A4o var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 1Ch mov edx, [ebp+arg_10] mov ecx, [ebp+arg_8] push ebx push esi push edi xor edi, edi push 6001h mov [esp+2Ch+var_C], edi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz loc_A1F082 mov ecx, [ebp+arg_8] mov edx, eax call SdbGetStringTagPtr mov ecx, eax mov [esp+28h+var_10], ecx test ecx, ecx jnz short loc_A1EFAE push offset ??_C@_0CL@CODINPLA@Failed?5to?5get?5the?5string?5from?5t@NNGAKEGL@ push 0AE2h loc_A1EF9A: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+8Fj ; SdbpCheckMatchingDir(x,x,x,x,x,x,x)+168j push offset ??_C@_0BF@OIHNIAP@SdbpCheckMatchingDir@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1F082 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EFAE: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+3Ej mov esi, ecx lea edx, [esi+2] loc_A1EFB3: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+6Cj mov ax, [esi] add esi, 2 cmp ax, di jnz short loc_A1EFB3 mov ebx, [ebp+arg_14] sub esi, edx sar esi, 1 test byte ptr [ebx], 1 jnz short loc_A1EFE5 mov ecx, ebx call SdbpInitializeSearchDBContext test eax, eax jnz short loc_A1EFE1 push offset ??_C@_0CF@DDPIMIDA@Failed?5to?5initialize?5SEARCHDBCO@NNGAKEGL@ push 0AEFh jmp short loc_A1EF9A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1EFE1: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+83j mov ecx, [esp+28h+var_10] loc_A1EFE5: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+78j mov edx, [ebx+24h] mov [esp+28h+var_4], edx mov [esp+28h+var_14], edi cmp [edx], edi jle short loc_A1F062 add edx, 4 mov [esp+28h+var_8], edx loc_A1EFFB: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+110j lea eax, [esp+28h+var_18] mov [esp+28h+var_18], edi push eax ; int push edx ; int push esi ; int push ecx ; void * mov ecx, [ebp+arg_4] mov edx, ebx call SdbpResolveMatchingFile test eax, eax jz loc_A1F0AE mov ecx, [esp+28h+var_18] call _AslDoesDirectoryExistNtPath@4 ; AslDoesDirectoryExistNtPath(x) mov [esp+28h+var_C], eax cmp [esp+28h+var_18], edi jz short loc_A1F03E push 74705041h push [esp+2Ch+var_18] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov eax, [esp+28h+var_C] loc_A1F03E: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+DAj test eax, eax mov eax, [esp+28h+var_14] jnz short loc_A1F0A1 mov ecx, [esp+28h+var_4] inc eax mov edx, [esp+28h+var_8] add edx, 18h mov [esp+28h+var_14], eax mov [esp+28h+var_8], edx cmp eax, [ecx] mov ecx, [esp+28h+var_10] jl short loc_A1EFFB loc_A1F062: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+A2j ; SdbpCheckMatchingDir(x,x,x,x,x,x,x)+153j ... mov eax, [esp+28h+var_10] movzx eax, word ptr [eax] cmp eax, 25h jz short loc_A1F078 cmp eax, 5Ch jz short loc_A1F078 cmp eax, 2Eh jnz short loc_A1F07F loc_A1F078: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+11Cj ; SdbpCheckMatchingDir(x,x,x,x,x,x,x)+121j mov dword ptr [ebx+28h], 1 loc_A1F07F: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+126j xor edi, edi inc edi loc_A1F082: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+26j ; SdbpCheckMatchingDir(x,x,x,x,x,x,x)+59j mov ecx, [ebp+arg_0] mov esi, [esp+28h+var_C] mov [ecx], esi call _Feature_CompatBuildInVb__private_IsEnabledDeviceUsage@0 ; Feature_CompatBuildInVb__private_IsEnabledDeviceUsage() test eax, eax mov eax, edi jnz short loc_A1F098 mov eax, esi loc_A1F098: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+144j pop edi pop esi pop ebx mov esp, ebp pop ebp retn 1Ch ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F0A1: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+F4j test eax, eax jle short loc_A1F062 mov dword ptr [ebx+28h], 1 jmp short loc_A1F062 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F0AE: ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+C3j push (offset loc_8C309E+4) push 0B07h jmp loc_A1EF9A _SdbpCheckMatchingDir@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingRegistry(x, x, x, x, x, x, x) _SdbpCheckMatchingRegistry@28 proc near ; DATA XREF: .text:004045F4o var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp sub esp, 28h push esi push edi mov edi, [ebp+arg_0] lea eax, [ebp+var_4] push eax mov edx, [ebp+arg_10] lea eax, [ebp+var_8] mov ecx, [ebp+arg_8] xor esi, esi push eax lea eax, [ebp+var_28] mov [ebp+var_20], esi push eax lea eax, [ebp+var_C] mov dword ptr [ebp+var_1C], esi push eax lea eax, [ebp+var_10] mov [ebp+var_18], esi push eax lea eax, [ebp+var_14] mov [ebp+var_14], esi push eax lea eax, [ebp+var_18] mov [ebp+var_10], esi push eax lea eax, [ebp+var_1C] mov [ebp+var_C], esi push eax mov [ebp+var_28], esi mov [ebp+var_24], esi mov [ebp+var_8], esi mov [ebp+var_4], esi mov [edi], esi call _SdbpGetRegistryMatchingAttributes@40 ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x) test eax, eax jnz short loc_A1F136 push offset ??_C@_0CC@POBNGMOF@Failed?5to?5read?5MATCHING_REG?5ent@NNGAKEGL@ push 678h loc_A1F125: ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+ABj push offset ??_C@_0BK@HKIGDGDG@SdbpCheckMatchingRegistry@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1F178 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F136: ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+5Cj mov edx, [ebp+var_18] ; int lea eax, [ebp+var_20] mov ecx, dword ptr [ebp+var_1C] ; char push eax ; int push [ebp+var_4] ; int push [ebp+var_8] ; int push [ebp+var_24] ; int push [ebp+var_28] ; int push [ebp+var_C] ; int push [ebp+var_10] ; int push [ebp+var_14] ; int call _SdbpCheckMatchingRegistryEntry@40 ; SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x) test eax, eax jnz short loc_A1F16A push offset ??_C@_0CD@CMJHNGOF@Failed?5to?5check?5MATCHING_REG?5en@NNGAKEGL@ push 689h jmp short loc_A1F125 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F16A: ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+9Fj mov ecx, [ebp+arg_14] xor esi, esi inc esi mov [ecx+28h], esi mov ecx, [ebp+var_20] mov [edi], ecx loc_A1F178: ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+77j pop edi mov eax, esi pop esi leave retn 1Ch _SdbpCheckMatchingRegistry@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __fastcall SdbpCheckMatchingRegistryEntry(char,int,int,int,int,int,int,int,int,int) _SdbpCheckMatchingRegistryEntry@40 proc near ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+98p var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_20C = word ptr -20Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h mov edi, edi push ebp mov ebp, esp sub esp, 244h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax mov eax, [ebp+arg_4] push ebx mov ebx, [ebp+arg_1C] push esi push edi push 6 mov [ebp+var_220], eax lea edi, [ebp+var_244] xor eax, eax mov [ebp+var_224], edx mov edx, ecx mov [ebp+var_20C], ax pop ecx rep stosd lea edi, [ebp+var_218] xor esi, esi stosd push edx ; char push (offset loc_8C2B93+1) ; wchar_t * push 104h ; int stosd mov [ebx], esi mov [ebp+var_22C], esi mov [ebp+var_228], esi stosd lea eax, [ebp+var_20C] push eax ; wchar_t * mov [ebp+var_21C], esi call RtlStringCchPrintfW add esp, 10h test eax, eax jns short loc_A1F21B push (offset loc_8C2BBD+1) push 591h push (offset loc_8C2B49+1) push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1F304 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F21B: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+7Bj lea eax, [ebp+var_20C] push eax lea eax, [ebp+var_22C] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) lea eax, [ebp+var_22C] mov [ebp+var_244], 18h mov [ebp+var_23C], eax lea eax, [ebp+var_244] push eax push 20019h lea eax, [ebp+var_21C] mov [ebp+var_240], esi push eax mov [ebp+var_238], 240h mov [ebp+var_234], esi mov [ebp+var_230], esi call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) test eax, eax jns short loc_A1F2D8 push esi push 0Ch lea eax, [ebp+var_218] xor edi, edi push eax inc edi push edi call _ZwQuerySystemInformation@16 ; ZwQuerySystemInformation(x,x,x,x) test eax, eax jns short loc_A1F2AE push eax push offset ??_C@_0CK@OOILAFO@Failed?5to?5get?5processor?5archite@NNGAKEGL@ push 5B4h push (offset loc_8C2B49+1) push edi call AslLogCallPrintf add esp, 14h jmp short loc_A1F304 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F2AE: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+111j cmp word ptr [ebp+var_218], 9 jz short loc_A1F2BC loc_A1F2B8: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+156j mov esi, edi jmp short loc_A1F304 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F2BC: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+136j lea eax, [ebp+var_244] push eax push 20119h lea eax, [ebp+var_21C] push eax call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) test eax, eax js short loc_A1F2B8 loc_A1F2D8: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+FAj mov edx, [ebp+var_224] ; wchar_t * mov ecx, [ebp+var_21C] ; int push ebx ; int push [ebp+arg_18] ; size_t push [ebp+arg_14] ; void * push [ebp+arg_10] ; int push [ebp+arg_C] ; int push [ebp+arg_8] ; int push [ebp+var_220] ; int push [ebp+arg_0] ; void * call _SdbpCheckMatchingRegistryValue@40 ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x) mov esi, eax loc_A1F304: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+96j ; SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+12Cj ... cmp [ebp+var_21C], 0 jz short loc_A1F318 push [ebp+var_21C] call _ZwClose@4 ; ZwClose(x) loc_A1F318: ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+18Bj mov ecx, [ebp+var_4] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 20h _SdbpCheckMatchingRegistryEntry@40 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __fastcall SdbpCheckMatchingRegistryValue(int,wchar_t *,void *,int,int,int,int,void *,size_t,int) _SdbpCheckMatchingRegistryValue@40 proc near ; CODE XREF: SdbpCheckMatchingRegistryEntry(x,x,x,x,x,x,x,x,x,x)+17Dp ; SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+4Bp var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h mov edi, edi push ebp mov ebp, esp sub esp, 18h push ebx push esi xor esi, esi mov [ebp+var_C], ecx mov eax, edx mov [ebp+var_8], esi mov [ebp+var_10], eax mov ebx, esi mov [ebp+var_18], esi mov [ebp+var_14], esi mov [ebp+var_4], esi push edi mov edi, esi test eax, eax jz loc_A1F514 cmp [eax], si jz loc_A1F514 push (offset loc_8C2A4C+2) ; wchar_t * push eax ; wchar_t * call __wcsicmp pop ecx pop ecx test eax, eax jnz short loc_A1F375 push esi jmp short loc_A1F38B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F375: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+45j mov edx, [ebp+var_10] lea ecx, [ebp+var_8] call AslStringDuplicate test eax, eax js loc_A1F53A push [ebp+var_8] loc_A1F38B: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+48j lea eax, [ebp+var_18] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) lea eax, [ebp+var_4] push eax push esi push esi push 1 lea eax, [ebp+var_18] push eax push [ebp+var_C] call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) test eax, eax jns short loc_A1F3C2 cmp eax, 80000005h jz short loc_A1F3C2 cmp eax, 0C0000023h jz short loc_A1F3C2 xor esi, esi inc esi jmp loc_A1F53A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F3C2: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+7Fj ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+86j ... mov edx, [ebp+var_4] push ecx call _AslAlloc@12 ; AslAlloc(x,x,x) mov edi, eax test edi, edi jnz short loc_A1F3EF push offset ??_C@_0BK@JNHKJALB@Failed?5to?5allocate?5memory@NNGAKEGL@ ; "Failed to allocate memory" push 475h push offset ??_C@_0BP@IOIMNEOA@SdbpCheckMatchingRegistryValue@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1F53A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F3EF: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+A4j lea eax, [ebp+var_4] push eax push [ebp+var_4] lea eax, [ebp+var_18] push edi push 1 push eax push [ebp+var_C] call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) test eax, eax jns short loc_A1F427 push offset ??_C@_0BF@JLNLEIIN@Failed?5to?5read?5value@NNGAKEGL@ ; "Failed to read value" push 480h loc_A1F413: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+184j ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+263j ... push offset ??_C@_0BP@IOIMNEOA@SdbpCheckMatchingRegistryValue@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1F51C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F427: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+DCj mov eax, [edi+4] cmp [ebp+arg_0], ebx jnz short loc_A1F43E mov eax, [ebp+arg_1C] xor ecx, ecx inc ecx mov esi, ecx mov [eax], ecx jmp loc_A1F51C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F43E: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+102j cmp eax, [ebp+arg_0] jz short loc_A1F44B loc_A1F443: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+15Ej ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x):loc_A1F50Ej ... xor esi, esi inc esi jmp loc_A1F51C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F44B: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+116j mov ecx, [edi+8] add ecx, edi mov [ebp+arg_0], ecx test eax, eax jz loc_A1F5C4 cmp eax, 2 jbe loc_A1F572 cmp eax, 3 jz loc_A1F555 cmp eax, 4 jz loc_A1F509 cmp eax, 7 jz short loc_A1F493 cmp eax, 0Bh jnz loc_A1F5C4 mov eax, [ebp+arg_C] cmp eax, [ecx] jnz short loc_A1F443 mov eax, [ebp+arg_10] cmp eax, [ecx+4] jmp short loc_A1F50E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F493: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+14Ej mov edx, [edi+0Ch] push ecx add edx, 2 call _AslAlloc@12 ; AslAlloc(x,x,x) mov ebx, eax test ebx, ebx jnz short loc_A1F4B4 push offset ??_C@_0BK@JNHKJALB@Failed?5to?5allocate?5memory@NNGAKEGL@ ; "Failed to allocate memory" push 4BCh jmp loc_A1F413 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F4B4: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+178j push dword ptr [edi+0Ch] ; size_t push [ebp+arg_0] ; void * push ebx ; void * call _memmove mov eax, [edi+0Ch] xor ecx, ecx shr eax, 1 add esp, 0Ch mov [ebx+eax*2], cx mov ecx, ebx mov eax, [edi+0Ch] and eax, 0FFFFFFFEh add eax, ebx cmp ebx, eax jnb loc_A1F5AD loc_A1F4E0: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+1D7j cmp [ecx], si jnz short loc_A1F4F5 cmp [ecx+2], si jz loc_A1F5AD push 3Bh pop eax mov [ecx], ax loc_A1F4F5: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+1B8j mov eax, [edi+0Ch] add ecx, 2 and eax, 0FFFFFFFEh add eax, ebx cmp ecx, eax jb short loc_A1F4E0 jmp loc_A1F5AD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F509: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+145j mov eax, [ebp+arg_8] cmp eax, [ecx] loc_A1F50E: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+166j ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+245j jnz loc_A1F443 loc_A1F514: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+27j ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+30j ... mov eax, [ebp+arg_1C] xor esi, esi inc esi mov [eax], esi loc_A1F51C: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+F7j ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+10Ej ... test edi, edi jz short loc_A1F52B push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F52B: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+1F3j test ebx, ebx jz short loc_A1F53A push 74705041h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F53A: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+57j ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+92j ... mov eax, [ebp+var_8] test eax, eax jz short loc_A1F54C push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F54C: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+214j pop edi mov eax, esi pop esi pop ebx leave retn 20h ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F555: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+13Cj mov eax, [ebp+arg_18] cmp eax, [edi+0Ch] jnz loc_A1F443 push eax ; size_t push ecx ; void * push [ebp+arg_14] ; void * call _memcmp add esp, 0Ch test eax, eax jmp short loc_A1F50E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F572: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+133j mov edx, [edi+0Ch] push ecx add edx, 2 call _AslAlloc@12 ; AslAlloc(x,x,x) mov ebx, eax test ebx, ebx jnz short loc_A1F593 push offset ??_C@_0BK@JNHKJALB@Failed?5to?5allocate?5memory@NNGAKEGL@ ; "Failed to allocate memory" push 4A5h jmp loc_A1F413 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F593: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+257j push dword ptr [edi+0Ch] ; size_t push [ebp+arg_0] ; void * push ebx ; void * call _memmove mov eax, [edi+0Ch] add esp, 0Ch shr eax, 1 xor ecx, ecx mov [ebx+eax*2], cx loc_A1F5AD: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+1AFj ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+1BEj ... mov ecx, [ebp+arg_4] mov edx, ebx call AslStringPatternMatchW test eax, eax jnz loc_A1F514 jmp loc_A1F443 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F5C4: ; CODE XREF: SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+12Aj ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x)+153j push offset ??_C@_0CB@NOENIKHC@Unknown?5registry?5value?5data?5typ@NNGAKEGL@ push 507h jmp loc_A1F413 _SdbpCheckMatchingRegistryValue@40 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingText(x, x, x, x, x, x, x) _SdbpCheckMatchingText@28 proc near ; DATA XREF: .text:00404604o var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp sub esp, 1Ch mov eax, [ebp+arg_0] mov edx, [ebp+arg_10] mov ecx, [ebp+arg_8] push esi xor esi, esi mov [ebp+var_8], 2000h mov [eax], esi lea eax, [ebp+var_8] push eax lea eax, [ebp+var_C] mov [ebp+var_1C], esi push eax lea eax, [ebp+var_10] mov [ebp+var_18], esi push eax lea eax, [ebp+var_4] mov [ebp+var_14], esi push eax lea eax, [ebp+var_14] mov [ebp+var_4], esi push eax mov [ebp+var_10], esi mov [ebp+var_C], esi call _SdbpGetMatchingTextAttributes@28 ; SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x) test eax, eax jnz short loc_A1F63A push (offset loc_8C2E8B+3) push 846h push offset ??_C@_0BG@PMEDILFH@SdbpCheckMatchingText@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1F690 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F63A: ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+4Aj mov ecx, [ebp+arg_4] lea eax, [ebp+var_18] push ebx mov ebx, [ebp+arg_14] mov edx, ebx push eax ; int lea eax, [ebp+var_1C] push eax ; int push [ebp+var_8] ; int push [ebp+var_C] ; int push [ebp+var_10] ; int push [ebp+var_4] ; int push [ebp+var_14] ; void * call _SdbpCheckMatchingTextEntry@36 ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x) test eax, eax jnz short loc_A1F67E push (offset loc_8C3000+6) push 857h push offset ??_C@_0BG@PMEDILFH@SdbpCheckMatchingText@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1F68F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F67E: ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+8Ej mov ecx, [ebp+arg_0] xor esi, esi mov eax, [ebp+var_18] inc esi or [ebx+28h], eax mov eax, [ebp+var_1C] mov [ecx], eax loc_A1F68F: ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+A9j pop ebx loc_A1F690: ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+65j cmp [ebp+var_4], 0 jz short loc_A1F6A3 push 74705041h push [ebp+var_4] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F6A3: ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+C1j mov eax, esi pop esi leave retn 1Ch _SdbpCheckMatchingText@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbpCheckMatchingTextEntry(void *,int,int,int,int,int,int) _SdbpCheckMatchingTextEntry@36 proc near ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+87p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 2Ch mov eax, [ebp+arg_14] push ebx push esi xor esi, esi mov [esp+34h+var_14], edx test byte ptr [edx], 1 mov ebx, esi mov [eax], esi mov eax, [ebp+arg_18] push edi mov [esp+38h+var_8], ecx mov [esp+38h+var_18], esi mov [esp+38h+var_1C], ebx mov [esp+38h+var_10], esi mov [esp+38h+var_28], esi mov [eax], esi jnz short loc_A1F712 mov ecx, edx call SdbpInitializeSearchDBContext test eax, eax jnz short loc_A1F70E push offset ??_C@_0CF@DDPIMIDA@Failed?5to?5initialize?5SEARCHDBCO@NNGAKEGL@ xor edi, edi push 741h inc edi loc_A1F6FB: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+301j ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+310j ... push offset ??_C@_0BL@EOPMKEHA@SdbpCheckMatchingTextEntry@NNGAKEGL@ push edi call AslLogCallPrintf add esp, 10h jmp loc_A1F7E2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F70E: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+42j mov edx, [esp+38h+var_14] loc_A1F712: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+37j mov ecx, [edx+24h] xor edi, edi inc edi mov [esp+38h+var_4], ecx mov [esp+38h+var_24], esi cmp [ecx], esi jle loc_A1F7DB lea ebx, [ecx+4] mov [esp+38h+var_20], ebx jmp short loc_A1F735 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F731: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+12Bj mov ebx, [esp+38h+var_20] loc_A1F735: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+85j mov ecx, [ebp+arg_0] lea eax, [ecx+2] mov [esp+38h+var_C], eax loc_A1F73F: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+9Ej mov ax, [ecx] add ecx, 2 cmp ax, si jnz short loc_A1F73F sub ecx, [esp+38h+var_C] lea eax, [esp+38h+var_1C] push eax ; int sar ecx, 1 push ebx ; int push ecx ; int push [ebp+arg_0] ; void * mov ecx, [esp+48h+var_8] call SdbpResolveMatchingFile test eax, eax jz loc_A1F9CE mov ebx, [esp+38h+var_1C] lea ecx, [esp+38h+var_28] push esi push esi push esi mov edx, ebx call AslFileMappingCreate mov ecx, eax test ecx, ecx js short loc_A1F78E mov ecx, [esp+38h+var_28] call _AslFileMappingEnsureMappedAs@8 ; AslFileMappingEnsureMappedAs(x,x) mov ecx, eax loc_A1F78E: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+D7j call AslFileNotFound test eax, eax jz loc_A1F825 mov ecx, [esp+38h+var_28] call AslFileMappingDelete mov [esp+38h+var_28], esi test ebx, ebx jz short loc_A1F7B7 push 74705041h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F7B7: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+100j mov eax, [esp+38h+var_24] mov ebx, esi mov ecx, [esp+38h+var_4] inc eax add [esp+38h+var_20], 18h mov edx, [esp+38h+var_14] mov [esp+38h+var_1C], ebx mov [esp+38h+var_24], eax cmp eax, [ecx] jl loc_A1F731 loc_A1F7DB: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+78j ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1B0j ... mov eax, [ebp+arg_14] mov [eax], esi loc_A1F7E0: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+2F2j mov esi, edi loc_A1F7E2: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+5Fj ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+19Bj ... mov eax, [ebp+arg_0] movzx eax, word ptr [eax] cmp eax, 25h jz short loc_A1F7F7 cmp eax, 5Ch jz short loc_A1F7F7 cmp eax, 2Eh jnz short loc_A1F7FC loc_A1F7F7: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+141j ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+146j mov eax, [ebp+arg_18] mov [eax], edi loc_A1F7FC: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+14Bj test ebx, ebx jz short loc_A1F80B push 74705041h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1F80B: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+154j mov eax, [esp+38h+var_28] test eax, eax jz short loc_A1F81A mov ecx, eax call AslFileMappingDelete loc_A1F81A: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+167j pop edi mov eax, esi pop esi pop ebx mov esp, ebp pop ebp retn 1Ch ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F825: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+EBj test ecx, ecx jns short loc_A1F847 push ecx push (offset loc_8C2EFA+4) push 779h xor edi, edi push offset ??_C@_0BL@EOPMKEHA@SdbpCheckMatchingTextEntry@NNGAKEGL@ inc edi push edi call AslLogCallPrintf add esp, 14h jmp short loc_A1F7E2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F847: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+17Dj mov eax, [esp+38h+var_24] test eax, eax jle short loc_A1F854 mov eax, [ebp+arg_18] mov [eax], edi loc_A1F854: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1A3j mov ecx, [esp+38h+var_28] test ecx, ecx jz loc_A1F7DB mov eax, [ecx+10h] mov edx, esi mov [esp+38h+var_14], eax mov eax, [ecx+14h] mov ecx, [ecx+18h] mov [esp+38h+var_8], ecx mov [esp+38h+var_20], edx cmp esi, eax jb short loc_A1F88F mov eax, [esp+38h+var_14] ja short loc_A1F888 mov ecx, [ebp+arg_10] cmp ecx, eax jb short loc_A1F892 loc_A1F888: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1D5j mov ecx, eax mov [ebp+arg_10], ecx jmp short loc_A1F892 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F88F: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1CFj mov ecx, [ebp+arg_10] loc_A1F892: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1DCj ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+1E3j cmp [ebp+arg_8], ecx ja loc_A1F7DB xor eax, eax cmp [ebp+arg_C], 3 setz al inc eax mov [esp+38h+var_C], eax test ecx, ecx jz loc_A1F993 mov [esp+38h+var_4], 1000h loc_A1F8B9: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+2E3j cmp edx, [ebp+arg_8] jbe short loc_A1F8C7 sub eax, [ebp+arg_8] add edx, eax mov [esp+38h+var_20], edx loc_A1F8C7: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+212j mov eax, ecx mov ecx, [esp+38h+var_4] sub eax, edx mov [esp+38h+var_24], eax cmp eax, ecx jbe short loc_A1F8DD mov eax, ecx mov [esp+38h+var_24], ecx loc_A1F8DD: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+22Bj push ecx lea edx, [eax+2] call _AslAlloc@12 ; AslAlloc(x,x,x) mov [esp+38h+var_1C], eax test eax, eax jz loc_A1F9BF mov edx, [esp+38h+var_20] lea eax, [esp+38h+var_10] mov ecx, [esp+38h+var_8] push eax call _RtlULongPtrAdd@12 ; RtlULongPtrAdd(x,x,x) test eax, eax js loc_A1F9B0 push [esp+38h+var_24] ; size_t push [esp+3Ch+var_10] ; void * push [esp+40h+var_1C] ; void * call _memcpy mov eax, [ebp+arg_C] add esp, 0Ch test eax, eax jz short loc_A1F9A1 cmp eax, 2 jbe short loc_A1F94B cmp eax, 3 jnz short loc_A1F9A1 mov eax, [ebp+arg_8] mov edx, [esp+38h+var_24] mov ecx, [esp+38h+var_1C] shr eax, 1 push eax push [ebp+arg_4] shr edx, 1 call _AslStringSearchW@16 ; AslStringSearchW(x,x,x,x) jmp short loc_A1F95E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F94B: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+280j push [ebp+arg_8] mov ecx, [esp+3Ch+var_1C] push [ebp+arg_4] mov edx, [esp+40h+var_24] call _AslStringSearchA@16 ; AslStringSearchA(x,x,x,x) loc_A1F95E: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+29Fj test eax, eax jz short loc_A1F966 mov [esp+38h+var_18], edi loc_A1F966: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+2B6j mov eax, [esp+38h+var_20] add eax, [esp+38h+var_24] push 74705041h push [esp+3Ch+var_1C] mov [esp+40h+var_20], eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov ecx, [ebp+arg_10] mov edx, [esp+38h+var_20] mov eax, [esp+38h+var_C] cmp edx, ecx jb loc_A1F8B9 loc_A1F993: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+201j mov eax, [ebp+arg_14] mov ecx, [esp+38h+var_18] mov [eax], ecx jmp loc_A1F7E0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F9A1: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+27Bj ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+285j push (offset loc_8C2EE0+8) push 7E9h jmp loc_A1F6FB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F9B0: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+25Cj push (offset loc_8C2EC7+1) push 7C7h jmp loc_A1F6FB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F9BF: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+242j push offset ??_C@_0BP@JNLJBLGM@Failed?5to?5allocate?5temp?5buffer@NNGAKEGL@ push 7C0h jmp loc_A1F6FB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1F9CE: ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+BBj push offset ??_C@_0CF@OMCJMENO@Failed?5to?5resolve?5matching?5text@NNGAKEGL@ push 759h xor edi, edi push offset ??_C@_0BL@EOPMKEHA@SdbpCheckMatchingTextEntry@NNGAKEGL@ inc edi push edi call AslLogCallPrintf mov ebx, [esp+48h+var_1C] add esp, 10h jmp loc_A1F7E2 _SdbpCheckMatchingTextEntry@36 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingWildcardFiles(x, x, x, x, x, x, x) _SdbpCheckMatchingWildcardFiles@28 proc near ; DATA XREF: .text:00404684o var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = dword ptr -214h var_210 = dword ptr -210h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 244h mov eax, ___security_cookie xor eax, esp mov [esp+244h+var_4], eax mov eax, [ebp+arg_0] push ebx mov ebx, [ebp+arg_14] push esi xor esi, esi mov [esp+24Ch+var_214], eax mov eax, [ebp+arg_4] push edi mov [esp+250h+var_228], eax mov edi, esi mov eax, [ebp+arg_8] mov [esp+250h+var_22C], eax mov [esp+250h+var_240], ebx mov [esp+250h+var_230], esi mov [esp+250h+var_238], edi mov [esp+250h+var_23C], esi mov [esp+250h+var_234], esi call _Feature_CompatBuildInVb__private_IsEnabledDeviceUsage@0 ; Feature_CompatBuildInVb__private_IsEnabledDeviceUsage() test eax, eax jnz short loc_A1FA59 cmp [ebx+2Ch], esi jz short loc_A1FA59 inc esi mov [esp+250h+var_230], esi jmp loc_A1FBFC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FA59: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+56j ; SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+5Bj mov ebx, [esp+250h+var_22C] mov ecx, ebx mov edx, [ebp+arg_10] push 6001h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz loc_A1FBFC mov edx, eax mov ecx, ebx call SdbGetStringTagPtr mov [esp+250h+var_21C], eax test eax, eax jnz short loc_A1FAA3 push offset ??_C@_0CL@CODINPLA@Failed?5to?5get?5the?5string?5from?5t@NNGAKEGL@ push 0C5Dh loc_A1FA8F: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+E3j push (offset loc_8C314D+5) push 1 call AslLogCallPrintf add esp, 10h jmp loc_A1FBFC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FAA3: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+91j mov ebx, eax lea ecx, [ebx+2] loc_A1FAA8: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+BFj mov ax, [ebx] add ebx, 2 cmp ax, si jnz short loc_A1FAA8 mov eax, [esp+250h+var_240] sub ebx, ecx sar ebx, 1 test byte ptr [eax], 1 jnz short loc_A1FADB mov ecx, eax call SdbpInitializeSearchDBContext test eax, eax jnz short loc_A1FAD7 push offset ??_C@_0CF@DDPIMIDA@Failed?5to?5initialize?5SEARCHDBCO@NNGAKEGL@ push 0C6Bh jmp short loc_A1FA8F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FAD7: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+D7j mov eax, [esp+250h+var_240] loc_A1FADB: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+CCj mov ecx, [eax+24h] mov [esp+250h+var_218], ecx mov [esp+250h+var_224], esi cmp [ecx], esi jle loc_A1FBF6 lea edx, [ecx+4] mov [esp+250h+var_220], edx loc_A1FAF5: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+1FEj lea ecx, [esp+250h+var_238] push ecx ; int mov ecx, [esp+254h+var_228] push edx ; int push ebx ; int push [esp+25Ch+var_21C] ; void * mov edx, eax call SdbpResolveMatchingFile test eax, eax jz loc_A1FC46 lea ecx, [esp+250h+var_234] call _AslPathWildcardFindClose@4 ; AslPathWildcardFindClose(x) push 208h ; size_t lea eax, [esp+254h+var_210] push esi ; int push eax ; void * call _memset mov edi, [esp+25Ch+var_238] lea eax, [esp+25Ch+var_234] add esp, 0Ch lea ecx, [esp+250h+var_210] push eax ; int push edi ; void * call _AslPathWildcardFindFirst@16 ; AslPathWildcardFindFirst(x,x,x,x) jmp short loc_A1FB98 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FB44: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+1A8j mov eax, [esp+250h+var_23C] test eax, eax jz short loc_A1FB57 mov ecx, eax call AslFileMappingDelete mov [esp+250h+var_23C], esi loc_A1FB57: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+158j push esi push esi push esi lea edx, [esp+25Ch+var_210] lea ecx, [esp+25Ch+var_23C] call AslFileMappingCreate test eax, eax js short loc_A1FB9C push [esp+250h+var_23C] mov edx, [esp+254h+var_228] lea ecx, [esp+254h+var_230] push [ebp+arg_10] push [esp+258h+var_22C] call _SdbpCheckAllAttributes@20 ; SdbpCheckAllAttributes(x,x,x,x,x) test eax, eax jns loc_A1FC40 push [esp+250h+var_234] lea ecx, [esp+254h+var_210] call _AslPathWildcardFindNext@12 ; AslPathWildcardFindNext(x,x,x) loc_A1FB98: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+150j test eax, eax jns short loc_A1FB44 loc_A1FB9C: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+177j cmp eax, 80000006h jz short loc_A1FBBD push eax push offset ??_C@_0DJ@BEFCHLOA@AslPathWildcardFindFirst?1Next?5f@NNGAKEGL@ push 0CB9h push (offset loc_8C314D+5) push 3 call AslLogCallPrintf add esp, 14h loc_A1FBBD: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+1AFj test edi, edi jz short loc_A1FBD2 push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, esi mov [esp+250h+var_238], edi loc_A1FBD2: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+1CDj mov eax, [esp+250h+var_218] mov ecx, [esp+250h+var_224] mov edx, [esp+250h+var_220] inc ecx add edx, 18h mov [esp+250h+var_224], ecx cmp ecx, [eax] mov eax, [esp+250h+var_240] mov [esp+250h+var_220], edx jl loc_A1FAF5 loc_A1FBF6: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+F6j ; SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+252j xor esi, esi inc esi mov [eax+28h], esi loc_A1FBFC: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+62j ; SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+7Cj ... lea ecx, [esp+250h+var_234] call _AslPathWildcardFindClose@4 ; AslPathWildcardFindClose(x) mov ecx, [esp+250h+var_23C] call AslFileMappingDelete test edi, edi jz short loc_A1FC1D push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A1FC1D: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+21Ej mov eax, [esp+250h+var_214] mov ecx, [esp+250h+var_230] pop edi mov [eax], ecx mov eax, esi mov ecx, [esp+24Ch+var_4] pop esi pop ebx xor ecx, esp call @__security_check_cookie@4 ; __security_check_cookie(x) mov esp, ebp pop ebp retn 1Ch ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FC40: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+193j mov eax, [esp+250h+var_240] jmp short loc_A1FBF6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FC46: ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+11Bj push offset ??_C@_0CA@GEALLKGN@Failed?5to?5resolve?5matching?5file@NNGAKEGL@ push 0C83h push (offset loc_8C314D+5) push 1 call AslLogCallPrintf mov edi, [esp+260h+var_238] add esp, 10h jmp short loc_A1FBFC _SdbpCheckMatchingWildcardFiles@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckMatchingWildcardRegistry(x, x, x, x, x, x, x) _SdbpCheckMatchingWildcardRegistry@28 proc near ; DATA XREF: .text:00404694o var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp sub esp, 28h push esi push edi mov edi, [ebp+arg_0] lea eax, [ebp+var_4] push eax mov edx, [ebp+arg_10] lea eax, [ebp+var_8] mov ecx, [ebp+arg_8] xor esi, esi push eax lea eax, [ebp+var_28] mov [ebp+var_20], esi push eax lea eax, [ebp+var_C] mov [ebp+var_1C], esi push eax lea eax, [ebp+var_10] mov [ebp+var_18], esi push eax lea eax, [ebp+var_14] mov [ebp+var_14], esi push eax lea eax, [ebp+var_18] mov [ebp+var_10], esi push eax lea eax, [ebp+var_1C] mov [ebp+var_C], esi push eax mov [ebp+var_28], esi mov [ebp+var_24], esi mov [ebp+var_8], esi mov [ebp+var_4], esi mov [edi], esi call _SdbpGetRegistryMatchingAttributes@40 ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x) test eax, eax jnz short loc_A1FCDE push offset ??_C@_0DA@IPBPJHH@Failed?5to?5read?5MATCHING_WILDCAR@NNGAKEGL@ push 621h loc_A1FCCD: ; CODE XREF: SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+ABj push offset ??_C@_0CC@GNBGCCDF@SdbpCheckMatchingWildcardRegist@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1FD20 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FCDE: ; CODE XREF: SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+5Cj mov edx, [ebp+var_18] lea eax, [ebp+var_20] mov ecx, [ebp+var_1C] push eax ; int push [ebp+var_4] ; size_t push [ebp+var_8] ; void * push [ebp+var_24] ; int push [ebp+var_28] ; int push [ebp+var_C] ; int push [ebp+var_10] ; int push [ebp+var_14] ; void * call _SdbpCheckMatchingWildcardRegistryEntry@40 ; SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x) test eax, eax jnz short loc_A1FD12 push offset ??_C@_0DB@EIHOIBJC@Failed?5to?5check?5MATCHING_WILDCA@NNGAKEGL@ push 632h jmp short loc_A1FCCD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FD12: ; CODE XREF: SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+9Fj mov ecx, [ebp+arg_14] xor esi, esi inc esi mov [ecx+28h], esi mov ecx, [ebp+var_20] mov [edi], ecx loc_A1FD20: ; CODE XREF: SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+77j pop edi mov eax, esi pop esi leave retn 1Ch _SdbpCheckMatchingWildcardRegistry@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbpCheckMatchingWildcardRegistryEntry(void *,int,int,int,int,void *,size_t,int) _SdbpCheckMatchingWildcardRegistryEntry@40 proc near ; CODE XREF: SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+98p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 0Ch push ebx push esi mov esi, [ebp+arg_1C] xor ebx, ebx push edi mov edi, edx mov [esp+18h+var_4], ebx push ecx lea edx, [esp+1Ch+var_4] mov [esp+1Ch+var_8], ebx lea ecx, [esp+1Ch+var_8] mov [esi], ebx call _AslRegWildcardFindFirst@12 ; AslRegWildcardFindFirst(x,x,x) jmp short loc_A1FD8D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FD57: ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+67j mov ecx, [esp+18h+var_8] ; int mov edx, edi ; wchar_t * push esi ; int push [ebp+arg_18] ; size_t push [ebp+arg_14] ; void * push [ebp+arg_10] ; int push [ebp+arg_C] ; int push [ebp+arg_8] ; int push [ebp+arg_4] ; int push [ebp+arg_0] ; void * call _SdbpCheckMatchingRegistryValue@40 ; SdbpCheckMatchingRegistryValue(x,x,x,x,x,x,x,x,x,x) test eax, eax jz short loc_A1FD80 cmp [esi], ebx jnz short loc_A1FD91 loc_A1FD80: ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+52j mov edx, [esp+18h+var_4] lea ecx, [esp+18h+var_8] call _AslRegWildcardFindNext@8 ; AslRegWildcardFindNext(x,x) loc_A1FD8D: ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+2Dj test eax, eax jns short loc_A1FD57 loc_A1FD91: ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+56j mov ecx, [esp+18h+var_4] call _AslRegWildcardFindClose@4 ; AslRegWildcardFindClose(x) pop edi xor eax, eax pop esi inc eax pop ebx mov esp, ebp pop ebp retn 20h _SdbpCheckMatchingWildcardRegistryEntry@40 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckOSKind(x, x, x, x, x, x, x) _SdbpCheckOSKind@28 proc near ; DATA XREF: .text:00404644o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h mov edi, edi push ebp mov ebp, esp mov edx, [ebp+arg_10] mov ecx, [ebp+arg_8] push 0 call SdbReadDWORDTag mov ecx, [ebp+arg_4] mov ecx, [ecx+1A0h] and ecx, eax mov eax, [ebp+arg_0] neg ecx sbb ecx, ecx neg ecx mov [eax], ecx xor eax, eax inc eax pop ebp retn 1Ch _SdbpCheckOSKind@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckPackageAttributes(x, x, x, x, x, x, x) _SdbpCheckPackageAttributes@28 proc near ; DATA XREF: .text:00404654o ; .text:00404664o ... var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp sub esp, 18h mov eax, [ebp+arg_14] push ebx push esi mov esi, [ebp+arg_4] xor ebx, ebx mov eax, [eax+2Ch] inc ebx mov [ebp+var_8], eax mov eax, [ebp+arg_0] push edi xor edi, edi mov [ebp+var_10], ebx mov [eax], edi mov eax, edi mov [ebp+var_4], eax loc_A1FDFE: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+1F8j movzx eax, word_6B68F4[eax] mov edx, [ebp+arg_10] mov ecx, [esi+4] push eax call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov [ebp+arg_14], eax test eax, eax jz loc_A1FFC1 mov edx, [ebp+var_8] mov ebx, edi mov eax, [edx+8] mov [ebp+var_18], eax test eax, eax jz loc_A1FFE4 mov ecx, [ebp+var_4] movzx esi, word_6B68F6[ecx] mov [ebp+var_C], esi mov ecx, esi loc_A1FE3E: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+A6j mov esi, edi cmp ebx, eax jnb short loc_A1FE71 mov eax, [edx+4] lea ecx, [ebp+var_14] mul ebx mov [ebp+var_14], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) mov edx, [ebp+var_8] test eax, eax js short loc_A1FE69 mov ecx, [edx+14h] mov esi, [ebp+var_14] add esi, ecx cmp esi, ecx jnb short loc_A1FE6B loc_A1FE69: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+86j mov esi, edi loc_A1FE6B: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+92j mov ecx, [ebp+var_C] mov eax, [ebp+var_18] loc_A1FE71: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+6Dj cmp [esi], cx jz short loc_A1FE7D inc ebx mov esi, edi cmp ebx, eax jb short loc_A1FE3E loc_A1FE7D: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+9Fj test esi, esi jz loc_A1FFE4 mov eax, [ebp+var_4] mov ecx, 5017h movzx eax, word_6B68F4[eax] cmp eax, ecx ja loc_A1FF45 jz short loc_A1FF17 sub eax, 4045h jz short loc_A1FEEF sub eax, 0FCFh jz short loc_A1FF17 sub eax, 1 jz loc_A1FF83 sub eax, 1 jnz loc_A1FFDB loc_A1FEBE: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+17Cj mov eax, [ebp+arg_4] mov edx, [ebp+arg_14] push 0FFFFFFFFh push 0FFFFFFFFh mov ecx, [eax+4] call SdbReadQWORDTag mov ecx, eax and eax, edx cmp eax, 0FFFFFFFFh jz loc_A1FFDB push dword ptr [esi+0Ch] push dword ptr [esi+8] push edx push ecx call _SdbpCheckUptoVersion@16 ; SdbpCheckUptoVersion(x,x,x,x) jmp loc_A1FFAB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FEEF: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+CEj mov eax, [ebp+arg_4] mov edx, [ebp+arg_14] push 0FFFFFFFFh mov ecx, [eax+4] call SdbReadDWORDTag mov ecx, eax cmp ecx, 0FFFFFFFFh jz loc_A1FFDB xor eax, eax cmp ecx, [esi+8] setz al jmp loc_A1FFAB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FF17: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+C7j ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+D5j mov eax, [ebp+arg_4] mov edx, [ebp+arg_14] push 0FFFFFFFFh push 0FFFFFFFFh mov ecx, [eax+4] call SdbReadQWORDTag mov ecx, eax and eax, edx cmp eax, 0FFFFFFFFh jz loc_A1FFDB push dword ptr [esi+0Ch] push dword ptr [esi+8] push edx push ecx call _SdbpCheckVersion@16 ; SdbpCheckVersion(x,x,x,x) jmp short loc_A1FFAB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FF45: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+C1j cmp eax, 5018h jz short loc_A1FF83 cmp eax, 5019h jz loc_A1FEBE cmp eax, 6028h jbe short loc_A1FFDB cmp eax, 602Bh ja short loc_A1FFDB mov eax, [ebp+arg_4] mov edx, [ebp+arg_14] mov ecx, [eax+4] call SdbGetStringTagPtr test eax, eax jz short loc_A1FFDB mov edx, [esi+8] mov ecx, eax call AslStringPatternMatchW jmp short loc_A1FFAB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FF83: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+DAj ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+175j mov eax, [ebp+arg_4] mov edx, [ebp+arg_14] push 0FFFFFFFFh push 0FFFFFFFFh mov ecx, [eax+4] call SdbReadQWORDTag mov ecx, eax and eax, edx cmp eax, 0FFFFFFFFh jz short loc_A1FFDB push dword ptr [esi+0Ch] push dword ptr [esi+8] push edx push ecx call _SdbpCheckFromVersion@16 ; SdbpCheckFromVersion(x,x,x,x) loc_A1FFAB: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+115j ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+13Dj ... cmp [ebp+var_10], edi jz short loc_A1FFB9 test eax, eax jz short loc_A1FFB9 xor ebx, ebx inc ebx jmp short loc_A1FFBB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FFB9: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+1D9j ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+1DDj mov ebx, edi loc_A1FFBB: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+1E2j mov esi, [ebp+arg_4] mov [ebp+var_10], ebx loc_A1FFC1: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+41j mov eax, [ebp+var_4] add eax, 4 mov [ebp+var_4], eax cmp eax, 28h jb loc_A1FDFE mov eax, [ebp+arg_0] xor edi, edi inc edi mov [eax], ebx loc_A1FFDB: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+E3j ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+102j ... mov eax, edi pop edi pop esi pop ebx leave retn 1Ch ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A1FFE4: ; CODE XREF: SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+54j ; SdbpCheckPackageAttributes(x,x,x,x,x,x,x)+AAj push offset ??_C@_0CM@KNENAJOM@Failed?5to?5find?5Attribute?5to?5use@NNGAKEGL@ push 13E2h push offset ??_C@_0BL@IBJIFFMD@SdbpCheckPackageAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A1FFDB _SdbpCheckPackageAttributes@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckRuntimePlatform(x, x, x, x, x, x, x) _SdbpCheckRuntimePlatform@28 proc near ; DATA XREF: .text:00404634o arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h mov edi, edi push ebp mov ebp, esp mov eax, [ebp+arg_4] mov edx, [ebp+arg_10] push esi mov esi, [ebp+arg_8] mov ecx, esi push edi mov edi, [eax+194h] push 0FFh call SdbReadDWORDTag mov edx, [esi+0A28h] mov ecx, [ebp+arg_0] push eax push edi call _SdbpCheckRuntimePlatformImpl@16 ; SdbpCheckRuntimePlatformImpl(x,x,x,x) pop edi pop esi pop ebp retn 1Ch _SdbpCheckRuntimePlatform@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckRuntimePlatformImpl(x, x, x, x) _SdbpCheckRuntimePlatformImpl@16 proc near ; CODE XREF: SdbpCheckRuntimePlatform(x,x,x,x,x,x,x)+2Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp test dl, 2 jz short loc_A2004E push [ebp+arg_4] mov edx, [ebp+arg_0] call _SdbpCheckRuntimePlatformV2Impl@12 ; SdbpCheckRuntimePlatformV2Impl(x,x,x) jmp short loc_A2005F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2004E: ; CODE XREF: SdbpCheckRuntimePlatformImpl(x,x,x,x)+8j mov eax, [ebp+arg_0] and eax, [ebp+arg_4] neg eax sbb eax, eax neg eax mov [ecx], eax xor eax, eax inc eax loc_A2005F: ; CODE XREF: SdbpCheckRuntimePlatformImpl(x,x,x,x)+15j pop ebp retn 8 _SdbpCheckRuntimePlatformImpl@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckRuntimePlatformV2Impl(x, x, x) _SdbpCheckRuntimePlatformV2Impl@12 proc near ; CODE XREF: SdbpCheckRuntimePlatformImpl(x,x,x,x)+10p arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ebx push esi xor eax, eax xor esi, esi cmp [ebp+arg_0], 0C0000000h mov ebx, edx push edi mov edi, ecx jnz short loc_A2008A inc esi loc_A2007D: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+72j mov eax, esi loc_A2007F: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+2Cj ; SdbpCheckRuntimePlatformV2Impl(x,x,x)+78j ... mov [edi], eax mov eax, esi pop edi pop esi pop ebx pop ebp retn 4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2008A: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+17j xor ecx, ecx inc esi loc_A2008D: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+80j test eax, eax jnz short loc_A2007F mov edx, [ebp+arg_0] shr edx, cl test dl, 40h jz short loc_A200DD and edx, 3Fh sub edx, eax jz short loc_A200D2 sub edx, 5 jz short loc_A200CB sub edx, 4 jz short loc_A200BC dec edx sub edx, 1 jz short loc_A200C4 sub edx, 1 jz short loc_A200C4 sub edx, 1 jnz short loc_A200D7 loc_A200BC: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+47j mov eax, ebx shr eax, 1 loc_A200C0: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+66j ; SdbpCheckRuntimePlatformV2Impl(x,x,x)+6Dj and eax, esi jmp short loc_A200D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A200C4: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+4Dj ; SdbpCheckRuntimePlatformV2Impl(x,x,x)+52j mov eax, ebx shr eax, 2 jmp short loc_A200C0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A200CB: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+42j mov eax, ebx shr eax, 3 jmp short loc_A200C0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A200D2: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+3Dj test bl, 1 jnz short loc_A2007D loc_A200D7: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+57j xor eax, eax loc_A200D9: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+5Fj test eax, eax jnz short loc_A2007F loc_A200DD: ; CODE XREF: SdbpCheckRuntimePlatformV2Impl(x,x,x)+36j add ecx, 8 cmp ecx, 18h jl short loc_A2008D jmp short loc_A2007F _SdbpCheckRuntimePlatformV2Impl@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetDeviceDWORD(x, x, x) _SdbpGetDeviceDWORD@12 proc near ; CODE XREF: SdbpMatchDeviceDWORD(x,x,x,x,x,x)+14p ; SdbpMatchDeviceDWORD(x,x,x,x,x,x)+2Cp ... arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ebx mov ebx, [ebp+arg_0] push esi push edi push ebx mov edi, ecx or esi, 0FFFFFFFFh call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov edx, eax test edx, edx jz short loc_A20110 movzx eax, bx mov ecx, edi push eax call SdbReadDWORDTag mov esi, eax loc_A20110: ; CODE XREF: SdbpGetDeviceDWORD(x,x,x)+1Aj pop edi mov eax, esi pop esi pop ebx pop ebp retn 4 _SdbpGetDeviceDWORD@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetMatchingTextAttributes(x, x, x, x, x, x, x) _SdbpGetMatchingTextAttributes@28 proc near ; CODE XREF: SdbpCheckMatchingText(x,x,x,x,x,x,x)+43p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h mov edi, edi push ebp mov ebp, esp sub esp, 10h push ebx mov ebx, ecx mov eax, edx mov ecx, [ebp+arg_0] push esi xor esi, esi mov [ebp+var_4], eax push edi mov [ecx], esi mov edi, esi mov ecx, [ebp+arg_4] push 6001h mov [ecx], esi mov ecx, [ebp+arg_8] mov [ecx], esi mov ecx, [ebp+arg_C] mov [ecx], esi mov ecx, [ebp+arg_10] mov dword ptr [ecx], 2000h mov ecx, ebx call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A2017A push offset ??_C@_0CG@JELBPBFJ@Failed?5to?5get?5MATCHING_TEXT?5fil@NNGAKEGL@ ; "Failed to get MATCHING_TEXT file path" push 6C7h loc_A20166: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+9Ej ; SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+BAj ... push offset ??_C@_0BO@OFDLBECN@SdbpGetMatchingTextAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A202C5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2017A: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+41j mov edx, eax mov ecx, ebx call SdbGetStringTagPtr mov [ebp+var_10], eax test eax, eax jz loc_A2029B cmp [eax], si jz loc_A2029B mov edx, [ebp+var_4] mov ecx, ebx push 9013h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov [ebp+var_C], eax test eax, eax jnz short loc_A201B9 push offset ??_C@_0BN@IOMIMCFC@Failed?5to?5read?5text?5to?5match@NNGAKEGL@ push 6D6h jmp short loc_A20166 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A201B9: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+92j mov edx, eax mov ecx, ebx call SdbGetTagDataSize mov [ebp+var_8], eax test eax, eax jnz short loc_A201D5 push (offset loc_8C2DF9+5) push 6DCh jmp short loc_A20166 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A201D5: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+AEj push ecx lea edx, [eax+2] call _AslAlloc@12 ; AslAlloc(x,x,x) mov edi, eax test edi, edi jnz short loc_A201F3 push offset ??_C@_0CI@OJKHAKHB@Failed?5to?5allocate?5memory?5for?5t@NNGAKEGL@ push 6E2h jmp loc_A20166 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A201F3: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+C9j push [ebp+var_8] ; int mov edx, [ebp+var_C] mov ecx, ebx push edi ; void * call SdbReadBinaryTag test eax, eax jnz short loc_A20214 mov eax, 6E7h mov ecx, offset ??_C@_0CC@MGLCBEGO@Failed?5to?5read?5matching?5text?5bl@NNGAKEGL@ jmp loc_A202A5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20214: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+EAj mov edx, [ebp+var_4] mov ecx, ebx push 4053h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A20233 mov eax, 6F0h mov ecx, offset ??_C@_0BN@CECBNFLP@Failed?5to?5read?5text?5encoding@NNGAKEGL@ jmp short loc_A202A5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20233: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+10Cj push esi mov edx, eax mov ecx, ebx call SdbReadDWORDTag mov [ebp+var_C], eax test eax, eax jnz short loc_A20250 mov eax, 6F6h mov ecx, (offset loc_8C2D72+8) jmp short loc_A202A5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20250: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+129j mov edx, [ebp+var_4] mov ecx, ebx push 4001h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov ecx, 2000h test eax, eax jz short loc_A20274 push ecx mov edx, eax mov ecx, ebx call SdbReadDWORDTag mov ecx, eax loc_A20274: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+14Dj mov edx, [ebp+arg_0] xor esi, esi mov eax, [ebp+var_10] inc esi mov [edx], eax mov eax, [ebp+arg_4] mov edx, [ebp+arg_8] mov [eax], edi mov eax, [ebp+var_8] mov [edx], eax mov edx, [ebp+arg_C] mov eax, [ebp+var_C] mov [edx], eax mov eax, [ebp+arg_10] mov [eax], ecx jmp short loc_A202C5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2029B: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+6Fj ; SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+78j mov eax, 6CDh mov ecx, offset ??_C@_0CH@DKPEDAPC@Failed?5to?5read?5MATCHING_TEXT?5fi@NNGAKEGL@ loc_A202A5: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+F6j ; SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+118j ... push ecx push eax push offset ??_C@_0BO@OFDLBECN@SdbpGetMatchingTextAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h test edi, edi jz short loc_A202C5 push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A202C5: ; CODE XREF: SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+5Cj ; SdbpGetMatchingTextAttributes(x,x,x,x,x,x,x)+180j ... pop edi mov eax, esi pop esi pop ebx leave retn 14h _SdbpGetMatchingTextAttributes@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetRegistryMatchingAttributes(x, x, x, x, x, x, x, x, x, x) _SdbpGetRegistryMatchingAttributes@40 proc near ; CODE XREF: SdbpCheckMatchingRegistry(x,x,x,x,x,x,x)+55p ; SdbpCheckMatchingWildcardRegistry(x,x,x,x,x,x,x)+55p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h mov edi, edi push ebp mov ebp, esp sub esp, 24h push ebx push esi xor esi, esi mov eax, edx push edi mov edi, ecx mov [ebp+var_8], eax mov ecx, [ebp+arg_0] mov ebx, esi push 6001h mov [ebp+var_C], esi mov [ebp+var_10], esi mov [ecx], esi mov ecx, [ebp+arg_4] mov [ebp+var_14], esi mov [ebp+var_18], esi mov [ebp+var_1C], esi mov [ecx], esi mov ecx, [ebp+arg_8] mov [ebp+var_20], esi mov [ebp+var_4], esi mov [ecx], esi mov ecx, [ebp+arg_C] mov [ecx], esi mov ecx, [ebp+arg_10] mov [ecx], esi mov ecx, [ebp+arg_14] mov [ecx], esi mov [ecx+4], esi mov ecx, [ebp+arg_18] mov [ecx], esi mov ecx, [ebp+arg_1C] mov [ecx], esi mov ecx, edi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A20343 push offset ??_C@_0BL@MDKIPEHO@Failed?5to?5get?5key?5path?5tag@NNGAKEGL@ push 3C5h jmp loc_A20558 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20343: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+64j mov edx, eax mov ecx, edi call SdbGetStringTagPtr mov [ebp+var_24], eax test eax, eax jz loc_A2054E cmp [eax], si jz loc_A2054E mov edx, [ebp+var_8] mov ecx, edi push 6030h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz short loc_A2037F mov edx, eax mov ecx, edi call SdbGetStringTagPtr mov [ebp+var_C], eax loc_A2037F: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+A3j mov edx, [ebp+var_8] mov ecx, edi push 4051h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz loc_A20420 push esi mov edx, eax mov ecx, edi call SdbReadDWORDTag mov ebx, eax test ebx, ebx jnz short loc_A203C3 push offset ??_C@_0BK@FFANNGGM@Failed?5to?5read?5value?5type@NNGAKEGL@ push 3DEh loc_A203B0: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+13Fj ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1B7j ... push offset ??_C@_0CC@CENPHDLK@SdbpGetRegistryMatchingAttribut@NNGAKEGL@ push 1 call AslLogCallPrintf mov eax, esi jmp loc_A20566 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A203C3: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+D6j cmp ebx, 2 jbe loc_A204EF cmp ebx, 3 jz loc_A20499 cmp ebx, 4 jz loc_A20468 cmp ebx, 7 jz loc_A204EF cmp ebx, 0Bh jnz loc_A2053F mov edx, [ebp+var_8] mov ecx, edi push 501Bh call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A2040F push offset ??_C@_0CH@ENLBMAPM@Failed?5to?5get?5TAG_REG_VALUE_DAT@NNGAKEGL@ ; "Failed to get TAG_REG_VALUE_DATA_QWORD" push 403h jmp short loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2040F: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+133j push esi push esi mov edx, eax mov ecx, edi call SdbReadQWORDTag mov [ebp+var_14], eax mov [ebp+var_18], edx loc_A20420: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+C2j ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1C9j ... mov edx, [ebp+arg_0] xor eax, eax mov ecx, [ebp+var_24] inc eax mov [edx], ecx mov edx, [ebp+arg_4] mov ecx, [ebp+var_C] mov [edx], ecx mov ecx, [ebp+arg_8] mov edx, [ebp+arg_10] mov [ecx], ebx mov ecx, [ebp+arg_C] mov [ecx], esi mov ecx, [ebp+var_10] mov [edx], ecx mov ecx, [ebp+arg_14] mov edx, [ebp+var_14] mov [ecx], edx mov edx, [ebp+var_18] mov [ecx+4], edx mov edx, [ebp+arg_18] mov ecx, [ebp+var_1C] mov [edx], ecx mov edx, [ebp+arg_1C] mov ecx, [ebp+var_20] mov [edx], ecx jmp loc_A20569 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20468: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+10Aj mov edx, [ebp+var_8] mov ecx, edi push 4052h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A2048A push (offset loc_8C2AE3+1) push 3F9h jmp loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2048A: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1ABj push esi mov edx, eax mov ecx, edi call SdbReadDWORDTag mov [ebp+var_10], eax jmp short loc_A20420 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20499: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+101j mov edx, [ebp+var_8] mov ecx, edi push 9012h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov [ebp+var_20], eax test eax, eax jnz short loc_A204BE push offset ??_C@_0CI@NHLCACFB@Failed?5to?5get?5TAG_REG_VALUE_DAT@NNGAKEGL@ push 40Dh jmp loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A204BE: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1DFj mov edx, eax mov ecx, edi call _SdbGetBinaryTagData@8 ; SdbGetBinaryTagData(x,x) mov [ebp+var_1C], eax test eax, eax jnz short loc_A204DD push (offset loc_8C2AC9+1) push 413h jmp loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A204DD: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1FEj mov edx, [ebp+var_20] mov ecx, edi call SdbGetTagDataSize mov [ebp+var_20], eax jmp loc_A20420 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A204EF: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+F8j ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+113j mov edx, [ebp+var_8] mov ecx, edi push 6031h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jnz short loc_A20511 push (offset loc_8C2B24+2) push 3EBh jmp loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20511: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+232j mov edx, eax mov ecx, edi call SdbGetStringTagPtr mov esi, eax test esi, esi jnz loc_A20420 push (offset loc_8C2AC9+1) push 3F1h push offset ??_C@_0CC@CENPHDLK@SdbpGetRegistryMatchingAttribut@NNGAKEGL@ push 1 call AslLogCallPrintf mov eax, [ebp+var_4] jmp short loc_A20566 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2053F: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+11Cj push (offset loc_8C2A31+1) push 41Ah jmp loc_A203B0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2054E: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+83j ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+8Cj push offset ??_C@_0BI@KFGKGOFP@Failed?5to?5read?5key?5path@NNGAKEGL@ push 3CBh loc_A20558: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+70j push offset ??_C@_0CC@CENPHDLK@SdbpGetRegistryMatchingAttribut@NNGAKEGL@ push 1 call AslLogCallPrintf mov eax, ebx loc_A20566: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+F0j ; SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+26Fj add esp, 10h loc_A20569: ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+195j pop edi pop esi pop ebx leave retn 20h _SdbpGetRegistryMatchingAttributes@40 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpMatchDeviceDWORD(x, x, x, x, x, x) _SdbpMatchDeviceDWORD@24 proc near ; CODE XREF: SdbpCheckKObject+8A606p ; SdbpCheckKObject+8A629p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push ebx push esi push edi push [ebp+arg_4] mov edi, edx mov ebx, ecx mov edx, [ebp+arg_0] xor esi, esi call _SdbpGetDeviceDWORD@12 ; SdbpGetDeviceDWORD(x,x,x) cmp eax, 0FFFFFFFFh jz short loc_A20594 cmp eax, edi jnz short loc_A205C3 jmp short loc_A205C0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20594: ; CODE XREF: SdbpMatchDeviceDWORD(x,x,x,x,x,x)+1Cj push [ebp+arg_8] mov edx, [ebp+arg_0] mov ecx, ebx call _SdbpGetDeviceDWORD@12 ; SdbpGetDeviceDWORD(x,x,x) cmp eax, 0FFFFFFFFh jz short loc_A205AA cmp eax, edi jb short loc_A205C3 loc_A205AA: ; CODE XREF: SdbpMatchDeviceDWORD(x,x,x,x,x,x)+34j push [ebp+arg_C] mov edx, [ebp+arg_0] mov ecx, ebx call _SdbpGetDeviceDWORD@12 ; SdbpGetDeviceDWORD(x,x,x) cmp eax, 0FFFFFFFFh jz short loc_A205C0 cmp eax, edi ja short loc_A205C3 loc_A205C0: ; CODE XREF: SdbpMatchDeviceDWORD(x,x,x,x,x,x)+22j ; SdbpMatchDeviceDWORD(x,x,x,x,x,x)+4Aj xor esi, esi inc esi loc_A205C3: ; CODE XREF: SdbpMatchDeviceDWORD(x,x,x,x,x,x)+20j ; SdbpMatchDeviceDWORD(x,x,x,x,x,x)+38j ... pop edi mov eax, esi pop esi pop ebx pop ebp retn 10h _SdbpMatchDeviceDWORD@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpMatchDeviceString(x, x, x, x) _SdbpMatchDeviceString@16 proc near ; CODE XREF: SdbpCheckKObject+8A5CAp ; SdbpCheckKObject+8A5E3p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx push ebx push esi push edi push [ebp+arg_4] mov edi, edx mov ebx, ecx mov edx, [ebp+arg_0] xor esi, esi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz short loc_A20608 mov edx, eax mov ecx, ebx call SdbGetStringTagPtr test eax, eax jz short loc_A2060B test edi, edi jz short loc_A2060B push edi ; wchar_t * push eax ; wchar_t * call __wcsicmp pop ecx pop ecx test eax, eax jnz short loc_A2060B loc_A20608: ; CODE XREF: SdbpMatchDeviceString(x,x,x,x)+1Cj xor esi, esi inc esi loc_A2060B: ; CODE XREF: SdbpMatchDeviceString(x,x,x,x)+29j ; SdbpMatchDeviceString(x,x,x,x)+2Dj ... pop edi mov eax, esi pop esi pop ebx pop ecx pop ebp retn 8 _SdbpMatchDeviceString@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpMatchOne(x, x, x, x, x, x, x) _SdbpMatchOne@28 proc near ; DATA XREF: .text:00404624o var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 0Ch push esi call _Feature_CompatBuildInVb__private_IsEnabledDeviceUsage@0 ; Feature_CompatBuildInVb__private_IsEnabledDeviceUsage() lea edx, [esp+10h+var_8] push ecx push 1 push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_8] push [ebp+arg_4] test eax, eax jz short loc_A20683 and [esp+28h+var_4], 0 lea ecx, [esp+28h+var_4] and [esp+28h+var_8], 0 call _SdbpMatchList@32 ; SdbpMatchList(x,x,x,x,x,x,x,x) mov esi, eax test esi, esi jz short loc_A20676 cmp [esp+10h+var_8], 0 jnz short loc_A20676 mov edx, [ebp+arg_10] mov ecx, [ebp+arg_8] push 1003h call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov ecx, eax neg ecx sbb ecx, ecx inc ecx jmp short loc_A2067A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20676: ; CODE XREF: SdbpMatchOne(x,x,x,x,x,x,x)+3Fj ; SdbpMatchOne(x,x,x,x,x,x,x)+46j mov ecx, [esp+10h+var_4] loc_A2067A: ; CODE XREF: SdbpMatchOne(x,x,x,x,x,x,x)+5Fj mov eax, [ebp+arg_0] mov [eax], ecx mov eax, esi jmp short loc_A2068B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20683: ; CODE XREF: SdbpMatchOne(x,x,x,x,x,x,x)+26j mov ecx, [ebp+arg_0] call _SdbpMatchList@32 ; SdbpMatchList(x,x,x,x,x,x,x,x) loc_A2068B: ; CODE XREF: SdbpMatchOne(x,x,x,x,x,x,x)+6Cj pop esi mov esp, ebp pop ebp retn 1Ch _SdbpMatchOne@28 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbFindFirstNamedTag(__int16,int,wchar_t *) _SdbFindFirstNamedTag@20 proc near ; CODE XREF: SdbpSearchDB+AF77Fp ; SdbpSearchDB+AF856p ... var_4 = dword ptr -4 arg_0 = word ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi mov eax, edx xor ebx, ebx push edi mov [ebp+var_4], eax mov edi, ecx call _SdbGetFirstChild@8 ; SdbGetFirstChild(x,x) jmp short loc_A206F2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A206AC: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+64j mov edx, esi mov ecx, edi call SdbGetTagFromTagID cmp ax, [ebp+arg_0] jnz short loc_A206E7 push [ebp+arg_4] mov edx, esi mov ecx, edi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz short loc_A206E7 mov edx, eax mov ecx, edi call SdbGetStringTagPtr test eax, eax jz short loc_A206FE push eax ; wchar_t * push [ebp+arg_8] ; wchar_t * call __wcsicmp pop ecx pop ecx test eax, eax jz short loc_A206FA loc_A206E7: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+27j ; SdbFindFirstNamedTag(x,x,x,x,x)+37j mov edx, [ebp+var_4] mov ecx, edi push esi call SdbGetNextChild loc_A206F2: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+18j mov esi, eax test esi, esi jnz short loc_A206AC jmp short loc_A20717 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A206FA: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+53j mov ebx, esi jmp short loc_A20717 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A206FE: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+44j push offset ??_C@_0BK@BHKCJLNO@Can?8t?5get?5the?5name?5string@NNGAKEGL@ push 98h push (offset loc_8C360A+2) push 1 call AslLogCallPrintf add esp, 10h loc_A20717: ; CODE XREF: SdbFindFirstNamedTag(x,x,x,x,x)+66j ; SdbFindFirstNamedTag(x,x,x,x,x)+6Aj pop edi pop esi mov eax, ebx pop ebx leave retn 0Ch _SdbFindFirstNamedTag@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbpFindNextNamedTag(int,int,wchar_t *) _SdbpFindNextNamedTag@20 proc near ; CODE XREF: SdbpSearchDB+AF7E1p ; SdbpSearchDB+AF8B5p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi mov esi, edx mov edx, [ebp+arg_0] push edi mov [ebp+var_8], esi mov edi, ecx call SdbGetTagFromTagID push [ebp+arg_0] movzx ebx, ax mov [ebp+var_4], ebx test bx, bx jnz short loc_A20764 push (offset loc_8C3524+4) push 0C6h push offset ??_C@_0BF@FGMJDGGO@SdbpFindNextNamedTag@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h xor eax, eax jmp short loc_A207D8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20764: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+25j mov edx, esi jmp short loc_A207AB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20768: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+96j mov edx, esi mov ecx, edi call SdbGetTagFromTagID cmp ax, bx jnz short loc_A207A7 push [ebp+arg_4] mov edx, esi mov ecx, edi call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) mov ebx, eax test ebx, ebx jz short loc_A207A4 mov edx, ebx mov ecx, edi call SdbGetStringTagPtr test eax, eax jz short loc_A207BA push eax ; wchar_t * push [ebp+arg_8] ; wchar_t * call __wcsicmp pop ecx pop ecx test eax, eax jz short loc_A207D6 loc_A207A4: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+66j mov ebx, [ebp+var_4] loc_A207A7: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+54j mov edx, [ebp+var_8] push esi loc_A207AB: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+46j mov ecx, edi call SdbGetNextChild mov esi, eax test esi, esi jnz short loc_A20768 jmp short loc_A207D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A207BA: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+73j push ebx push offset ??_C@_0CG@ILCHFAAO@Can?8t?5get?5the?5name?5string?5tagid@NNGAKEGL@ push 0D7h push offset ??_C@_0BF@FGMJDGGO@SdbpFindNextNamedTag@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A207D4: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+98j xor esi, esi loc_A207D6: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+82j mov eax, esi loc_A207D8: ; CODE XREF: SdbpFindNextNamedTag(x,x,x,x,x)+42j pop edi pop esi pop ebx leave retn 0Ch _SdbpFindNextNamedTag@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall SdbGetBinaryTagData(x, x) _SdbGetBinaryTagData@8 proc near ; CODE XREF: SdbpGetRegistryMatchingAttributes(x,x,x,x,x,x,x,x,x,x)+1F4p mov edi, edi push esi push edi mov esi, edx mov edi, ecx call SdbGetTagFromTagID mov ecx, 0F000h mov edx, esi and ax, cx mov ecx, 9000h cmp ax, cx mov ecx, edi jz short loc_A2082A call SdbGetTagFromTagID movzx eax, ax push eax push esi push (offset loc_8C39D7+1) push 3B4h push offset ??_C@_0BE@GHDFKEEC@SdbGetBinaryTagData@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 18h xor eax, eax pop edi pop esi retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2082A: ; CODE XREF: SdbGetBinaryTagData(x,x)+21j pop edi pop esi jmp SdbpGetMappedTagData _SdbGetBinaryTagData@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbReadGUIDTag(void *,int,int,int,int) _SdbReadGUIDTag@24 proc near ; CODE XREF: KsepDbGetDriverShimsInternal+AFCD8p ; KsepDbGetShimInfo(x,x)+D3p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push edi mov edi, [ebp+arg_0] xor eax, eax push 10h ; int push [ebp+arg_0] ; void * stosd stosd stosd stosd call SdbReadBinaryTag test eax, eax jnz short loc_A20873 push esi push (offset loc_8C3675+1) push 0A7h push (offset loc_8C3689+1) push 1 call AslLogCallPrintf mov edi, [ebp+arg_0] lea esi, [ebp+arg_4] add esp, 10h movsd movsd movsd movsd pop esi loc_A20873: ; CODE XREF: SdbReadGUIDTag(x,x,x,x,x,x)+1Bj mov eax, [ebp+arg_0] pop edi pop ebp retn 14h _SdbReadGUIDTag@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall SdbpGetProcessHistory(void *) _SdbpGetProcessHistory@12 proc near ; CODE XREF: SdbpInitializeSearchDBContext+91F50p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx mov eax, edx mov [ebp+var_8], ecx push esi mov esi, eax mov [ebp+var_14], eax xor edx, edx push edi mov [ebp+var_4], edx lea edi, [esi+2] loc_A20898: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+26j mov ax, [esi] add esi, 2 cmp ax, dx jnz short loc_A20898 mov ebx, [ebp+arg_0] sub esi, edi sar esi, 1 lea ecx, [ebx+2] loc_A208AD: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+3Bj mov ax, [ebx] add ebx, 2 cmp ax, dx jnz short loc_A208AD lea eax, [ebp+var_4] sub ebx, ecx mov ecx, [ebp+var_8] push eax ; int push edx ; int push edx ; void * push 11h ; int mov edx, offset ??_C@_1CE@DAGHINBE@?$AA_?$AA_?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAH?$AAI?$AAS?$AAT?$AAO@NNGAKEGL@ sar ebx, 1 call AslEnvVarQuery mov [ebp+var_10], eax cmp eax, 0C0000023h jnz short loc_A208EB mov ecx, [ebp+var_4] add ecx, ebx add ecx, esi lea edx, ds:4[ecx*2] jmp short loc_A208F5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A208EB: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+5Ej lea eax, [ebx+esi] lea edx, ds:2[eax*2] loc_A208F5: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+6Ej push ecx mov [ebp+var_4], edx call _AslAlloc@12 ; AslAlloc(x,x,x) mov [ebp+var_C], eax mov edi, eax test eax, eax jnz short loc_A20924 push offset ??_C@_0CK@DJJDHFIA@Unable?5to?5allocate?5process?5hist@NNGAKEGL@ push 8CCh push offset ??_C@_0BG@JPAHFGJG@SdbpGetProcessHistory@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h xor eax, eax jmp short loc_A20996 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20924: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+8Aj xor ecx, ecx cmp [ebp+var_10], 0C0000023h mov [eax], cx jnz short loc_A2096F mov ecx, [ebp+var_4] lea edx, [ebp+var_4] push edx ; int mov [ebp+var_4], ecx mov edx, offset ??_C@_1CE@DAGHINBE@?$AA_?$AA_?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAH?$AAI?$AAS?$AAT?$AAO@NNGAKEGL@ shr ecx, 1 push ecx ; int mov ecx, [ebp+var_8] push eax ; void * push 11h ; int call AslEnvVarQuery test eax, eax js short loc_A2096F mov ecx, [ebp+var_C] mov eax, [ebp+var_4] push 3Bh lea eax, [ecx+eax*2] lea edi, [eax-2] pop ecx cmp [edi], cx jz short loc_A2096C mov edi, eax mov [edi], cx loc_A2096C: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+EAj add edi, 2 loc_A2096F: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+B5j ; SdbpGetProcessHistory(x,x,x)+D6j add esi, esi push esi ; size_t push [ebp+var_14] ; void * push edi ; void * call _memmove add edi, esi lea esi, [ebx+ebx] push esi ; size_t push [ebp+arg_0] ; void * push edi ; void * call _memmove add esp, 18h xor eax, eax mov [esi+edi], ax mov eax, [ebp+var_C] loc_A20996: ; CODE XREF: SdbpGetProcessHistory(x,x,x)+A7j pop edi pop esi pop ebx leave retn 4 _SdbpGetProcessHistory@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbGuestHostArchsToRuntimePlatformFlag(x, x) _SdbGuestHostArchsToRuntimePlatformFlag@8 proc near ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+62p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push esi mov si, cx mov ecx, 0FFFFh cmp si, cx jz short loc_A209F0 mov [ebp+var_4], ecx test edx, edx jz short loc_A209C5 movzx eax, word ptr [edx] mov edx, eax mov [ebp+var_4], edx cmp ax, cx jnz short loc_A209F8 loc_A209C5: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+19j sub esp, 0Ch lea ecx, [ebp+var_4] xor edx, edx call AslEnvGetProcessWowInfo test eax, eax jns short loc_A209F5 push eax push offset ??_C@_0EA@NDEIOECD@AslEnvGetProcessWowInfo?5failed?5@NNGAKEGL@ push 0F9h push offset ??_C@_0CH@COPFLLI@SdbGuestHostArchsToRuntimePlatf@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A209F0: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+12j ; SdbGuestHostArchsToRuntimePlatformFlag(x,x)+76j xor eax, eax loc_A209F2: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+81j pop esi leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A209F5: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+37j mov edx, [ebp+var_4] loc_A209F8: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+26j xor eax, eax mov ecx, offset word_42E9E6 loc_A209FF: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+74j cmp si, [ecx-2] jnz short loc_A20A0A cmp dx, [ecx] jz short loc_A20A15 loc_A20A0A: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+66j inc eax add ecx, 10h cmp eax, 8 jb short loc_A209FF jmp short loc_A209F0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20A15: ; CODE XREF: SdbGuestHostArchsToRuntimePlatformFlag(x,x)+6Bj shl eax, 4 mov eax, ds:dword_42E9E8[eax] jmp short loc_A209F2 _SdbGuestHostArchsToRuntimePlatformFlag@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x) _SdbGuestTargetPlatformFlagsToRuntimePlatformFlags@4 proc near ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+116p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push edi sub esp, 0Ch lea ecx, [ebp+var_4] xor edi, edi xor edx, edx mov [ebp+var_4], edi call AslEnvGetProcessWowInfo test eax, eax jns short loc_A20A59 push eax push offset ??_C@_0EA@NDEIOECD@AslEnvGetProcessWowInfo?5failed?5@NNGAKEGL@ push 146h push offset ??_C@_0DC@EODMJGNB@SdbGuestTargetPlatformFlagsToRu@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A20A92 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20A59: ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+1Bj push esi mov esi, edi loc_A20A5C: ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+6Fj test ds:byte_42EA68[esi], 1Fh jz short loc_A20A89 mov dx, ds:word_42EA64[esi] lea ecx, [ebp+var_4] call _AslEnvVerifyGuestProcessorSupport@8 ; AslEnvVerifyGuestProcessorSupport(x,x) test eax, eax js short loc_A20A89 mov cx, ds:word_42EA64[esi] lea edx, [ebp+var_4] call _SdbGuestHostArchsToRuntimePlatformFlag@8 ; SdbGuestHostArchsToRuntimePlatformFlag(x,x) or edi, eax loc_A20A89: ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+43j ; SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+56j add esi, 0Ch cmp esi, 3Ch jb short loc_A20A5C pop esi loc_A20A92: ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+37j mov eax, edi pop edi leave retn _SdbGuestTargetPlatformFlagsToRuntimePlatformFlags@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCloseLocalDatabaseEx(x, x, x) _SdbpCloseLocalDatabaseEx@12 proc near ; CODE XREF: SdbpCleanupLocalDatabaseSupport+AF369p ; SdbpCleanupLocalDatabaseSupport+AF37Dp ... arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ebx mov ebx, [ebp+arg_0] push esi mov esi, ecx push edi cmp ebx, 10h jnb short loc_A20AEC xor eax, eax mov ecx, ebx inc eax shl eax, cl test [esi+10h], eax jz short loc_A20AEC imul eax, ebx, 18h lea edi, [esi+14h] add edi, eax test byte ptr [edi+14h], 2 jz short loc_A20ACF mov ecx, [edi+10h] test ecx, ecx jz short loc_A20ACF call SdbCloseDatabaseRead loc_A20ACF: ; CODE XREF: SdbpCloseLocalDatabaseEx(x,x,x)+2Aj ; SdbpCloseLocalDatabaseEx(x,x,x)+31j push 6 xor eax, eax pop ecx rep stosd mov ecx, [esi+10h] btr ecx, ebx mov [esi+10h], ecx cmp ebx, 1 jnz short loc_A20AE7 and [esi+8], eax loc_A20AE7: ; CODE XREF: SdbpCloseLocalDatabaseEx(x,x,x)+4Bj xor eax, eax inc eax jmp short loc_A20AEE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20AEC: ; CODE XREF: SdbpCloseLocalDatabaseEx(x,x,x)+10j ; SdbpCloseLocalDatabaseEx(x,x,x)+1Cj xor eax, eax loc_A20AEE: ; CODE XREF: SdbpCloseLocalDatabaseEx(x,x,x)+53j pop edi pop esi pop ebx pop ebp retn 4 _SdbpCloseLocalDatabaseEx@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpOpenLocalDatabaseEx(x, x, x, x, x) _SdbpOpenLocalDatabaseEx@20 proc near ; CODE XREF: SdbTagRefToTagID+8453Bp var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_214 = dword ptr -214h var_8 = dword ptr -8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 240h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_8], eax mov eax, [ebp+arg_4] push ebx mov [ebp+var_23C], eax xor eax, eax push esi push edi lea edi, [ebp+var_224] mov [ebp+var_230], edx stosd mov esi, ecx mov ecx, [ebp+arg_8] mov [ebp+var_234], esi mov [ebp+var_238], ecx stosd mov ebx, [ecx] stosd stosd xor eax, eax mov [ebp+var_228], eax mov [ebp+var_22C], eax test ebx, 0F0000000h jz short loc_A20B54 shr ebx, 1Ch loc_A20B54: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+5Aj push ebx cmp ebx, 10h jb short loc_A20B69 push offset ??_C@_0BA@FCOGLIBF@Bad?5index?50x?$CFlx@NNGAKEGL@ push 3FBh jmp loc_A20C89 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20B69: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+63j mov ecx, esi call _SdbpCloseLocalDatabaseEx@12 ; SdbpCloseLocalDatabaseEx(x,x,x) mov edx, [ebp+var_230] ; void * lea eax, [ebp+var_214] push ecx ; int push eax ; int lea eax, [ebp+var_22C] mov ecx, esi ; int push eax ; int lea eax, [ebp+var_228] push eax ; int call _SdbResolveDatabaseEx@24 ; SdbResolveDatabaseEx(x,x,x,x,x,x) test eax, eax jz loc_A20C7E cmp eax, 104h jnb loc_A20C7E mov eax, 7FFFh cmp [esi+1A8h], ax jz short loc_A20BDF mov eax, [esi+194h] test [ebp+var_22C], eax jnz short loc_A20BDF lea eax, [ebp+var_214] push eax push (offset loc_8C3B47+1) push 432h push offset ??_C@_0BI@JKJMGENA@SdbpOpenLocalDatabaseEx@NNGAKEGL@ push 3 jmp loc_A20C90 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20BDF: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+BDj ; SdbpOpenLocalDatabaseEx(x,x,x,x,x)+CBj push ecx push ecx lea ecx, [ebp+var_214] call _SdbOpenDatabaseEx@16 ; SdbOpenDatabaseEx(x,x,x,x) mov ecx, eax test ecx, ecx jnz short loc_A20C10 push offset ??_C@_0BI@GIECIBFC@Failed?5to?5open?5database@NNGAKEGL@ push 442h push offset ??_C@_0BI@JKJMGENA@SdbpOpenLocalDatabaseEx@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A20C98 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20C10: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+FBj imul edx, ebx, 18h lea edi, [esi+14h] add edi, edx mov [ebp+var_228], edx mov [edx+esi+24h], ecx mov dword ptr [edx+esi+28h], 2 xor edx, edx mov eax, [esi+10h] inc edx bts eax, ebx mov [esi+10h], eax mov eax, [ebp+var_230] test eax, eax jz short loc_A20C58 mov esi, eax mov eax, [ebp+var_228] movsd movsd movsd movsd mov esi, [ebp+var_234] or [eax+esi+28h], edx jmp short loc_A20C5E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20C58: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+149j xor eax, eax stosd stosd stosd stosd loc_A20C5E: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+161j cmp ebx, edx jnz short loc_A20C65 mov [esi+8], ecx loc_A20C65: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+16Bj mov eax, [ebp+var_238] shl ebx, 1Ch mov [eax], ebx mov eax, [ebp+var_23C] test eax, eax jz short loc_A20C9A mov [eax], ecx jmp short loc_A20C9A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20C7E: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+A0j ; SdbpOpenLocalDatabaseEx(x,x,x,x,x)+ABj push eax push offset ??_C@_0DC@EIBCFMBP@Cannot?5resolve?5database?0?5the?5pa@NNGAKEGL@ push 41Dh loc_A20C89: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+6Fj push offset ??_C@_0BI@JKJMGENA@SdbpOpenLocalDatabaseEx@NNGAKEGL@ push 1 loc_A20C90: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+E5j call AslLogCallPrintf add esp, 14h loc_A20C98: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+116j xor edx, edx loc_A20C9A: ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+183j ; SdbpOpenLocalDatabaseEx(x,x,x,x,x)+187j mov ecx, [ebp+var_8] mov eax, edx pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 0Ch _SdbpOpenLocalDatabaseEx@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbGetPathCustomSdb(x, x, x, x) _SdbGetPathCustomSdb@16 proc near ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+261p var_5C = dword ptr -5Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 5Ch mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx mov ebx, [ebp+arg_4] lea eax, [ebp+var_5C] push esi mov esi, [ebp+arg_0] push edi push 56h ; size_t push 0 ; int push eax ; void * mov edi, ecx call _memset add esp, 0Ch test esi, esi jz short loc_A20D09 push esi lea ecx, [ebp+var_5C] call _SdbpGetCustomSdbFileName@12 ; SdbpGetCustomSdbFileName(x,x,x) mov esi, eax test esi, esi jns short loc_A20D09 push esi push (offset loc_8C3F1F+3) push 5F8h loc_A20CF8: ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+7Cj push offset ??_C@_0BE@MNHDHJED@SdbGetPathCustomSdb@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A20D2D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20D09: ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+2Fj ; SdbGetPathCustomSdb(x,x,x,x)+3Ej push ebx lea eax, [ebp+var_5C] push eax push ecx push 7 mov ecx, edi call _SdbpGetSystemSdbFilePath@24 ; SdbpGetSystemSdbFilePath(x,x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A20D2B push esi push (offset loc_8C3E63+1) push 604h jmp short loc_A20CF8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20D2B: ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+6Fj xor esi, esi loc_A20D2D: ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+5Aj mov ecx, [ebp+var_4] not esi shr esi, 1Fh xor ecx, ebp pop edi mov eax, esi pop esi pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 _SdbGetPathCustomSdb@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __fastcall SdbResolveDatabaseEx(int,void *,int,int,int,int) _SdbResolveDatabaseEx@24 proc near ; CODE XREF: SdbpOpenLocalDatabaseEx(x,x,x,x,x)+99p var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 44h push ebx push esi xor esi, esi mov [ebp+var_C], edx push edi mov edi, [ebp+arg_8] xor eax, eax mov [ebp+var_14], ecx mov [ebp+var_8], esi mov [ebp+var_10], esi mov [ebp+var_18], esi mov [ebp+var_4], esi mov [ebp+var_20], esi mov [ebp+var_1C], esi mov [ebp+var_28], esi mov [ebp+var_24], esi test edi, edi jz loc_A2100E mov [edi], ax mov ebx, esi mov eax, offset off_6B37B8 mov [ebp+arg_8], eax loc_A20D8A: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+66j push 10h ; size_t push edx ; void * push dword ptr [eax] ; void * call _memcmp add esp, 0Ch test eax, eax jz short loc_A20DDF mov eax, [ebp+arg_8] inc ebx mov edx, [ebp+var_C] add eax, 10h mov [ebp+arg_8], eax cmp ebx, 3 jb short loc_A20D8A loc_A20DAD: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+B7j mov edx, [ebp+var_C] lea ecx, [ebp+var_28] call _AslGuidToString_UStr@8 ; AslGuidToString_UStr(x,x) test eax, eax jns loc_A20E74 push eax push offset ??_C@_0CG@CEIAABEP@Failed?5to?5convert?5guid?5to?5strin@NNGAKEGL@ push 7D4h loc_A20DCB: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+153j push (offset loc_8C40DC+6) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A20FDE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20DDF: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+54j shl ebx, 4 mov eax, dword_6B37BC[ebx] mov ecx, dword_6B37C4[ebx] mov ebx, dword_6B37C0[ebx] mov [ebp+arg_8], eax mov [ebp+var_8], eax test ecx, ecx jz short loc_A20DAD mov eax, [ebp+var_14] add eax, 1A8h push eax push esi push ecx push ecx mov ecx, edi call _SdbpGetSystemSdbFilePath@24 ; SdbpGetSystemSdbFilePath(x,x,x,x,x,x) test eax, eax js short loc_A20E2B lea ecx, [edi+2] loc_A20E18: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+DCj mov ax, [edi] add edi, 2 cmp ax, si jnz short loc_A20E18 mov esi, edi sub esi, ecx sar esi, 1 jmp short loc_A20E44 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20E2B: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+CEj push (offset loc_8C40C5+1) push 7BDh push (offset loc_8C40DC+6) push 1 call AslLogCallPrintf add esp, 10h loc_A20E44: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+E4j mov eax, [ebp+arg_0] test eax, eax jz short loc_A20E50 mov ecx, [ebp+arg_8] mov [eax], ecx loc_A20E50: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+104j mov edi, [ebp+arg_4] test edi, edi jz loc_A2100C call _SdbGuestTargetPlatformFlagsToRuntimePlatformFlags@4 ; SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x) mov [edi], eax test ebx, ebx jz loc_A2100C and eax, 1Bh mov [edi], eax jmp loc_A2100C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20E74: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+75j movzx ebx, word ptr [ebp+var_28] add ebx, 0B8h push ecx mov edx, ebx call _AslAlloc@12 ; AslAlloc(x,x,x) mov [ebp+var_18], eax test eax, eax jnz short loc_A20E9D push ebx push (offset loc_8C409B+1) push 7E9h jmp loc_A20DCB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20E9D: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+146j mov [ebp+var_1C], eax xor eax, eax mov word ptr [ebp+var_20], ax lea eax, [ebp+var_20] push (offset loc_8C3FA1+1) ; void * push eax ; int mov word ptr [ebp+var_20+2], bx call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) push offset ??_C@_13FPGAJAPJ@?$AA?2@NNGAKEGL@ ; void * lea eax, [ebp+var_20] push eax ; int call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) lea eax, [ebp+var_28] push eax lea eax, [ebp+var_20] push eax call _RtlAppendUnicodeStringToString@8 ; RtlAppendUnicodeStringToString(x,x) lea eax, [ebp+var_20] mov [ebp+var_40], 18h mov [ebp+var_38], eax lea eax, [ebp+var_40] push eax push 80000100h lea eax, [ebp+var_4] mov [ebp+var_3C], esi push eax mov [ebp+var_34], 240h mov [ebp+var_30], esi mov [ebp+var_2C], esi call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) test eax, eax jns short loc_A20F28 push eax push [ebp+var_1C] push offset ??_C@_0BO@OHGFJCDI@Failed?5to?5open?5Key?5?$CC?$CFws?$CC?5?$FL?$CFx?$FN@NNGAKEGL@ ; "Failed to open Key \"%ws\" [%x]" push 7F9h push (offset loc_8C40DC+6) push 1 call AslLogCallPrintf add esp, 18h jmp loc_A20FDE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20F28: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+1BFj mov ebx, [ebp+arg_0] test ebx, ebx jz short loc_A20F6B mov edx, [ebp+var_4] lea ecx, [ebp+var_8] push offset _g_ustrDatabaseType call _AslRegistryGetUInt32_UStr@12 ; AslRegistryGetUInt32_UStr(x,x,x) test eax, eax jns short loc_A20F61 push eax push offset ??_C@_0CB@HAJBCKAO@Failed?5to?5get?5database?5type?5?$FL?$CFx@NNGAKEGL@ push 805h loc_A20F4E: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+24Cj push (offset loc_8C40DC+6) push 1 call AslLogCallPrintf add esp, 14h mov [ebx], esi jmp short loc_A20FDE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20F61: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+1FCj mov eax, [ebp+var_8] and eax, 7FFFFFFFh mov [ebx], eax loc_A20F6B: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+1E8j mov ebx, [ebp+arg_4] test ebx, ebx jz short loc_A20F98 mov edx, [ebp+var_4] lea ecx, [ebp+var_10] push offset _g_ustrRuntimePlatform call _AslRegistryGetUInt32_UStr@12 ; AslRegistryGetUInt32_UStr(x,x,x) test eax, eax jns short loc_A20F93 push eax push offset ??_C@_0CE@HLHNCJNF@Failed?5to?5get?5runtime?5platform?5@NNGAKEGL@ push 815h jmp short loc_A20F4E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20F93: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+23Fj mov eax, [ebp+var_10] mov [ebx], eax loc_A20F98: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+22Bj mov eax, [ebp+var_14] mov ecx, edi add eax, 1A8h push eax push [ebp+var_C] call _SdbGetPathCustomSdb@16 ; SdbGetPathCustomSdb(x,x,x,x) test eax, eax jnz short loc_A20FCA push offset ??_C@_0DF@OGEFBPKL@SdbGetPathCustomSdb?5failed?5to?5g@NNGAKEGL@ push 81Eh push (offset loc_8C40DC+6) push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A20FDE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A20FCA: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+268j lea ecx, [edi+2] loc_A20FCD: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+291j mov ax, [edi] add edi, 2 cmp ax, si jnz short loc_A20FCD mov esi, edi sub esi, ecx sar esi, 1 loc_A20FDE: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+95j ; SdbResolveDatabaseEx(x,x,x,x,x,x)+1DEj ... cmp [ebp+var_4], 0 jz short loc_A20FEC push [ebp+var_4] call _ZwClose@4 ; ZwClose(x) loc_A20FEC: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+29Dj mov eax, [ebp+var_18] test eax, eax jz short loc_A20FFE push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A20FFE: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+2ACj cmp [ebp+var_24], 0 jz short loc_A2100C lea ecx, [ebp+var_28] call _AslUnicodeStringFree@4 ; AslUnicodeStringFree(x) loc_A2100C: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+110j ; SdbResolveDatabaseEx(x,x,x,x,x,x)+11Fj ... mov eax, esi loc_A2100E: ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+32j pop edi pop esi pop ebx leave retn 10h _SdbResolveDatabaseEx@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetCustomSdbFileName(x, x, x) _SdbpGetCustomSdbFileName@12 proc near ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+35p arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push esi push edi push [ebp+arg_0] ; int mov edi, ecx xor eax, eax push 2Bh pop edx mov [edi], ax call AslGuidToString mov esi, eax test esi, esi jns short loc_A21050 push esi push offset ??_C@_0BM@KAMLNOAN@AslGuidToString?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ ; "AslGuidToString failed [%x]" push 32Bh loc_A2103F: ; CODE XREF: SdbpGetCustomSdbFileName(x,x,x)+5Bj push offset ??_C@_0BJ@GFHGNMMI@SdbpGetCustomSdbFileName@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A21074 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21050: ; CODE XREF: SdbpGetCustomSdbFileName(x,x,x)+1Dj push offset ??_C@_19GNHEEAFN@?$AA?4?$AAs?$AAd?$AAb@NNGAKEGL@ push 2Bh pop edx mov ecx, edi call _RtlStringCchCatW@12 ; RtlStringCchCatW(x,x,x) mov esi, eax test esi, esi jns short loc_A21072 push esi push offset ??_C@_0BN@IGBCHOAA@RtlStringCchCatW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 331h jmp short loc_A2103F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21072: ; CODE XREF: SdbpGetCustomSdbFileName(x,x,x)+4Ej xor esi, esi loc_A21074: ; CODE XREF: SdbpGetCustomSdbFileName(x,x,x)+39j pop edi mov eax, esi pop esi pop ebp retn 4 _SdbpGetCustomSdbFileName@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetPathAppPatch(x, x, x, x) _SdbpGetPathAppPatch@16 proc near ; CODE XREF: SdbpGetPathAppPatchPreRS3(x,x,x,x)+129p ; SdbpGetPathCustomSdbPreRS3(x,x,x,x)+109p ... var_220 = dword ptr -220h var_18 = dword ptr -18h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 220h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax cmp [ebp+arg_4], 0Ah mov edx, [ebp+arg_8] push ebx mov ebx, [ebp+arg_0] push esi push edi push 5 pop ecx mov esi, offset ??_C@_1BE@MMECJMEH@?$AA?2?$AAA?$AAp?$AAp?$AAP?$AAa?$AAt?$AAc?$AAh@NNGAKEGL@ lea edi, [ebp+var_18] rep movsd jnb short loc_A210B4 mov eax, 0C0000023h jmp short loc_A21123 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A210B4: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+2Fj xor eax, eax mov word ptr [ebp+var_220], ax mov [ebx], ax test edx, edx jnz short loc_A210C9 mov edx, offset ??_C@_11LOCGONAA@@NNGAKEGL@ loc_A210C9: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+46j push 104h lea eax, [ebp+var_220] push eax lea ecx, [ebp+var_18] call _AslPathCombine@16 ; AslPathCombine(x,x,x,x) mov esi, eax test esi, esi jns short loc_A210F0 push esi push offset ??_C@_0BL@IPDIPDIN@AslPathCombine?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 3ABh jmp short loc_A21112 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A210F0: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+65j mov edx, [ebp+arg_4] ; int lea eax, [ebp+var_220] push eax ; int mov ecx, ebx ; void * call _AslPathToSystemPathBuf@12 ; AslPathToSystemPathBuf(x,x,x) mov esi, eax test esi, esi jns short loc_A21121 push esi push offset ??_C@_0CD@JEFPKOCA@AslPathToSystemPathBuf?5failed?5?$FL@NNGAKEGL@ push 3B1h loc_A21112: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+72j push offset ??_C@_0BE@MLFMMAEH@SdbpGetPathAppPatch@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A21121: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+89j mov eax, esi loc_A21123: ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+36j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 10h _SdbpGetPathAppPatch@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetPathAppraiser(x, x, x, x) _SdbpGetPathAppraiser@16 proc near ; DATA XREF: .text:00404EF8o ; .text:00404EFCo var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_1C = dword ptr -1Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp sub esp, 230h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax cmp [ebp+arg_4], 0Bh push ebx push esi push edi mov eax, [ebp+arg_C] lea edi, [ebp+var_1C] push 5 mov ebx, [ebp+arg_0] mov esi, offset ??_C@_1BG@KDDEGGCL@?$AA?2?$AAa?$AAp?$AAp?$AAr?$AAa?$AAi?$AAs?$AAe?$AAr@NNGAKEGL@ mov edx, [ebp+arg_8] pop ecx rep movsd mov [ebp+var_230], eax movsw jnb short loc_A2117A mov eax, 0C0000023h jmp loc_A21222 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2117A: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+3Aj xor eax, eax mov [ebx], ax mov word ptr [ebp+var_224], ax mov eax, 0FFFFh mov [ebp+var_22C], eax mov [ebp+var_228], eax test edx, edx jnz short loc_A211A0 mov edx, offset ??_C@_11LOCGONAA@@NNGAKEGL@ loc_A211A0: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+65j push 104h lea eax, [ebp+var_224] push eax lea ecx, [ebp+var_1C] call _AslPathCombine@16 ; AslPathCombine(x,x,x,x) mov esi, eax test esi, esi jns short loc_A211D6 push esi push offset ??_C@_0BL@IPDIPDIN@AslPathCombine?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 4BBh loc_A211C5: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+CAj push (offset loc_8C3ED4+2) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A21220 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A211D6: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+84j push [ebp+var_230] lea edx, [ebp+var_228] lea ecx, [ebp+var_22C] call _SdbpGetProcessHostGuestArchitectures@12 ; SdbpGetProcessHostGuestArchitectures(x,x,x) mov esi, eax test esi, esi jns short loc_A21200 push esi push offset ??_C@_0DB@LPCMCBIC@SdbpGetProcessHostGuestArchitec@NNGAKEGL@ push 4C1h jmp short loc_A211C5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21200: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+BDj mov edx, [ebp+arg_4] lea eax, [ebp+var_228] push eax push [ebp+var_22C] lea eax, [ebp+var_224] mov ecx, ebx push eax call _AslEnvGetSysNativeDirPathForGuestBuf@20 ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x) mov esi, eax loc_A21220: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+A0j mov eax, esi loc_A21222: ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+41j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 10h _SdbpGetPathAppraiser@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetPathCustomSdb(x, x, x, x) _SdbpGetPathCustomSdb@16 proc near ; DATA XREF: .text:00404F08o var_224 = dword ptr -224h var_1C = dword ptr -1Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 224h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax cmp [ebp+arg_4], 0Bh push ebx push esi push edi push 5 mov ebx, [ebp+arg_0] lea edi, [ebp+var_1C] mov edx, [ebp+arg_8] mov esi, offset ??_C@_1BG@GDIBOBAP@?$AA?2?$AAC?$AAu?$AAs?$AAt?$AAo?$AAm?$AAS?$AAD?$AAB@NNGAKEGL@ pop ecx rep movsd movsw jnb short loc_A2126D mov eax, 0C0000023h jmp short loc_A212CE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2126D: ; CODE XREF: SdbpGetPathCustomSdb(x,x,x,x)+31j xor eax, eax mov word ptr [ebp+var_224], ax mov [ebx], ax test edx, edx jnz short loc_A21282 mov edx, offset ??_C@_11LOCGONAA@@NNGAKEGL@ loc_A21282: ; CODE XREF: SdbpGetPathCustomSdb(x,x,x,x)+48j push 104h lea eax, [ebp+var_224] push eax lea ecx, [ebp+var_1C] call _AslPathCombine@16 ; AslPathCombine(x,x,x,x) mov esi, eax test esi, esi jns short loc_A212B8 push esi push offset ??_C@_0BL@IPDIPDIN@AslPathCombine?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 44Ah push offset ??_C@_0BF@OKGMJLIO@SdbpGetPathCustomSdb@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A212CC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A212B8: ; CODE XREF: SdbpGetPathCustomSdb(x,x,x,x)+67j push 0 lea eax, [ebp+var_224] push eax push [ebp+arg_4] push ebx call _SdbpGetPathAppPatch@16 ; SdbpGetPathAppPatch(x,x,x,x) mov esi, eax loc_A212CC: ; CODE XREF: SdbpGetPathCustomSdb(x,x,x,x)+83j mov eax, esi loc_A212CE: ; CODE XREF: SdbpGetPathCustomSdb(x,x,x,x)+38j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 10h _SdbpGetPathCustomSdb@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetPathSystem(x, x, x, x) _SdbpGetPathSystem@16 proc near ; DATA XREF: .text:00404F28o var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_8], 0 lea edx, [ebp+var_4] and [ebp+var_4], 0 lea ecx, [ebp+var_8] push esi push [ebp+arg_C] call _SdbpGetProcessHostGuestArchitectures@12 ; SdbpGetProcessHostGuestArchitectures(x,x,x) mov esi, eax test esi, esi jns short loc_A21310 push esi push offset ??_C@_0DB@LPCMCBIC@SdbpGetProcessHostGuestArchitec@NNGAKEGL@ push 410h jmp short loc_A21336 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21310: ; CODE XREF: SdbpGetPathSystem(x,x,x,x)+22j mov edx, [ebp+arg_4] lea eax, [ebp+var_4] mov ecx, [ebp+arg_0] push eax push [ebp+var_8] push [ebp+arg_8] call _AslEnvGetSystem32DirPathBuf@20 ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A21345 push esi push (offset loc_8C3DDD+1) push 416h loc_A21336: ; CODE XREF: SdbpGetPathSystem(x,x,x,x)+2Fj push offset ??_C@_0BC@FMFCMILN@SdbpGetPathSystem@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A21345: ; CODE XREF: SdbpGetPathSystem(x,x,x,x)+4Aj mov eax, esi pop esi leave retn 10h _SdbpGetPathSystem@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetProcessHostGuestArchitectures(x, x, x) _SdbpGetProcessHostGuestArchitectures@12 proc near ; CODE XREF: SdbpGetPathAppPatchPreRS3(x,x,x,x)+73p ; SdbpGetPathCustomSdbPreRS3(x,x,x,x)+84p ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi mov eax, 0FFFFh sub esp, 0Ch mov edi, edx mov [ebp+var_4], eax mov ebx, ecx mov [ebp+var_8], eax lea edx, [ebp+var_4] lea ecx, [ebp+var_8] call AslEnvGetProcessWowInfo mov esi, eax test esi, esi jns short loc_A21395 push esi push offset ??_C@_0CE@JCOOOONA@AslEnvGetProcessWowInfo?5failed?5@NNGAKEGL@ push 369h push offset ??_C@_0CF@OLEHGKON@SdbpGetProcessHostGuestArchitec@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A213C1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21395: ; CODE XREF: SdbpGetProcessHostGuestArchitectures(x,x,x)+2Bj mov eax, [ebp+arg_0] test eax, eax jz short loc_A213B1 mov cx, [eax] call AslImageFileToArchitecture movzx ecx, ax mov eax, 0FFFFh cmp cx, ax jnz short loc_A213B5 loc_A213B1: ; CODE XREF: SdbpGetProcessHostGuestArchitectures(x,x,x)+4Ej movzx ecx, word ptr [ebp+var_4] loc_A213B5: ; CODE XREF: SdbpGetProcessHostGuestArchitectures(x,x,x)+63j mov ax, word ptr [ebp+var_8] xor esi, esi mov [ebx], ax mov [edi], cx loc_A213C1: ; CODE XREF: SdbpGetProcessHostGuestArchitectures(x,x,x)+47j pop edi mov eax, esi pop esi pop ebx leave retn 4 _SdbpGetProcessHostGuestArchitectures@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpGetSystemSdbFilePath(x, x, x, x, x, x) _SdbpGetSystemSdbFilePath@24 proc near ; CODE XREF: SdbGetPathCustomSdb(x,x,x,x)+66p ; SdbResolveDatabaseEx(x,x,x,x,x,x)+C7p arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push esi mov esi, ecx xor eax, eax push edi mov edi, [ebp+arg_0] mov [esi], ax test edi, edi jz loc_A21492 cmp edi, 0Ah jge loc_A21492 inc eax mov ecx, offset dword_404EA0 loc_A213F2: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+33j cmp [ecx], edi jz short loc_A21401 inc eax add ecx, 10h cmp eax, 0Ah jb short loc_A213F2 jmp short loc_A2140B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21401: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+2Aj shl eax, 4 add eax, offset dword_404E90 jnz short loc_A2142C loc_A2140B: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+35j push edi push (offset loc_8C3EE6+6) push 501h push offset ??_C@_0BJ@HFHDPNEL@SdbpGetSystemSdbFilePath@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h mov esi, 0C0000225h jmp short loc_A21497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2142C: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+3Fj mov edx, [eax+8] test edx, edx jnz short loc_A21453 push offset ??_C@_0DC@PFAPBPOE@SdbFileDetails?5missing?5function@NNGAKEGL@ push 50Fh push offset ??_C@_0BJ@HFHDPNEL@SdbpGetSystemSdbFilePath@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h mov esi, 0C00000E5h jmp short loc_A21497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21453: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+67j mov ecx, [ebp+arg_8] test ecx, ecx jnz short loc_A2145D mov ecx, [eax+4] loc_A2145D: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+8Ej push [ebp+arg_C] push ecx push 104h push esi call edx mov esi, eax test esi, esi jns short loc_A2148E push esi push 0 push edi push offset ??_C@_0DO@KLLBMCFK@GetPathFunction?5?$CIfor?5SdbFileTyp@NNGAKEGL@ push 519h push offset ??_C@_0BJ@HFHDPNEL@SdbpGetSystemSdbFilePath@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 1Ch jmp short loc_A21497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2148E: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+A3j xor esi, esi jmp short loc_A21497 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21492: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+13j ; SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+1Cj mov esi, 0C00000F1h loc_A21497: ; CODE XREF: SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+60j ; SdbpGetSystemSdbFilePath(x,x,x,x,x,x)+87j ... pop edi mov eax, esi pop esi pop ebp retn 10h _SdbpGetSystemSdbFilePath@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall SdbpRemoveSDBLookupEntry(x, x) _SdbpRemoveSDBLookupEntry@8 proc near ; CODE XREF: SdbReleaseDatabase+8Fp mov edi, edi push esi mov esi, [edx+4] cmp esi, edx jnz short loc_A214B2 and dword ptr [ecx+1A4h], 0 jmp short loc_A214D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A214B2: ; CODE XREF: SdbpRemoveSDBLookupEntry(x,x)+8j cmp [ecx+1A4h], edx jnz short loc_A214C5 mov eax, [edx] mov [ecx+1A4h], eax mov esi, [edx+4] loc_A214C5: ; CODE XREF: SdbpRemoveSDBLookupEntry(x,x)+19j mov eax, [edx] mov [esi], eax mov ecx, [edx] mov eax, [edx+4] mov [ecx+4], eax loc_A214D1: ; CODE XREF: SdbpRemoveSDBLookupEntry(x,x)+11j push 74705041h push edx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) pop esi retn _SdbpRemoveSDBLookupEntry@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpOpenCompressedDatabase(x, x, x) _SdbpOpenCompressedDatabase@12 proc near ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x)+146p var_24 = dword ptr -24h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 28h and [ebp+var_4], 0 mov eax, ecx and [ebp+var_8], 0 push ebx xor ebx, ebx mov [ebp+var_10], eax mov eax, [eax] push esi push edi mov [ebp+var_C], eax cmp _g_ExpandCallback, ebx jnz short loc_A21526 push (offset loc_8C4161+3) push 93h loc_A2150F: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+58j ; SdbpOpenCompressedDatabase(x,x,x)+78j ... push offset ??_C@_0BL@JHLABFDA@SdbpOpenCompressedDatabase@NNGAKEGL@ push 1 call AslLogCallPrintf mov esi, [ebp+var_4] add esp, 10h jmp loc_A21634 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21526: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+25j cmp dword ptr [eax+0Ch], 14h jnb short loc_A21538 push offset ??_C@_0BP@FEFPKLNB@SDB?5file?5too?5small?5to?5be?5valid@NNGAKEGL@ push 98h jmp short loc_A2150F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21538: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+4Cj mov esi, [eax+4] lea edi, [ebp+var_24] push 5 pop ecx rep movsd cmp [ebp+var_1C], 6662647Ah jz short loc_A21558 push (offset loc_8C414A+4) push 9Fh jmp short loc_A2150F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21558: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+6Cj mov eax, [ebp+var_18] cmp eax, _g_ExpectedAlgorithm jz short loc_A2156F push offset ??_C@_0DN@KMAJDPML@SDB?5compression?5algorithm?5does?5@NNGAKEGL@ push 0A4h jmp short loc_A2150F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2156F: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+83j mov edx, [ebp+var_14] mov [ebp+var_8], edx cmp edx, 7FFFFFFFh jbe short loc_A2158E cmp edx, 2Ah jnb short loc_A2158E push offset ??_C@_0DG@DAKFPAHP@Expanded?5SDB?5file?5too?5small?5or?5@NNGAKEGL@ push 0ADh jmp short loc_A2150F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2158E: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+9Dj ; SdbpOpenCompressedDatabase(x,x,x)+A2j push ecx call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax test esi, esi jnz short loc_A215A9 push offset ??_C@_0EO@JMMLLMHM@SdbpOpenCompressedDatabase?5fail@NNGAKEGL@ push 0B7h jmp loc_A2150F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A215A9: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+BAj mov eax, [ebp+var_C] mov ecx, [eax+4] mov eax, [eax+0Ch] add ecx, 14h sub eax, 14h push eax push ecx lea eax, [ebp+var_8] push eax push esi call _g_ExpandCallback test eax, eax jnz short loc_A215E4 push (offset loc_8C4205+1) push 0C1h push offset ??_C@_0BL@JHLABFDA@SdbpOpenCompressedDatabase@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp short loc_A21605 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A215E4: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+E9j mov edx, [ebp+var_8] push ecx mov ecx, esi call SdbpOpenDatabaseInMemory mov ebx, eax test ebx, ebx jz short loc_A21605 or dword ptr [ebx+10h], 0Ch xor esi, esi and [ebp+var_8], esi mov [ebp+var_4], 1 loc_A21605: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+104j ; SdbpOpenCompressedDatabase(x,x,x)+115j test esi, esi jz short loc_A21620 push 74705041h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and [ebp+var_8], 0 test ebx, ebx jz short loc_A21620 and dword ptr [ebx+4], 0 loc_A21620: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+129j ; SdbpOpenCompressedDatabase(x,x,x)+13Cj mov esi, [ebp+var_4] test esi, esi jnz short loc_A21634 test ebx, ebx jz short loc_A21634 mov ecx, ebx call SdbCloseDatabaseRead xor ebx, ebx loc_A21634: ; CODE XREF: SdbpOpenCompressedDatabase(x,x,x)+43j ; SdbpOpenCompressedDatabase(x,x,x)+147j ... mov edi, [ebp+var_10] mov ecx, [edi] call SdbCloseDatabaseRead mov [edi], ebx mov eax, esi pop edi pop esi pop ebx leave retn 4 _SdbpOpenCompressedDatabase@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckAllAttributes(x, x, x, x, x) _SdbpCheckAllAttributes@20 proc near ; CODE XREF: SdbpCheckMatchingFiles(x,x,x,x,x,x,x)+A3p ; SdbpCheckMatchingFiles(x,x,x,x,x,x,x)+1ADp ... var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 30h push ebx mov ebx, [ebp+arg_8] mov eax, ecx push esi push edi xor ecx, ecx mov [ebp+var_20], edx xor edi, edi mov [ebp+var_24], eax inc edi mov [ebp+var_10], ecx mov [ebp+var_30], ecx mov [ebp+var_2C], ecx mov [eax], ecx mov [ebp+var_14], edi test ebx, ebx jz loc_A21857 cmp [ebx+30h], ecx jz short loc_A21689 xor eax, eax cmp [ebx+18h], ecx setnz al jmp short loc_A21690 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21689: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+34j cmp [ebx+8], ecx jnz short loc_A21698 mov eax, ecx loc_A21690: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+3Ej test eax, eax jz loc_A21857 loc_A21698: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+43j push ecx mov edx, 348h call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax mov [ebp+var_1C], esi test esi, esi jnz short loc_A216B6 mov esi, 0C0000017h jmp loc_A21859 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A216B6: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+61j mov eax, offset unk_6B6924 xor ecx, ecx mov [ebp+var_8], eax mov [ebp+var_18], ecx loc_A216C3: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+1A4j movzx eax, word ptr [eax-4] mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push eax mov [ebp+var_C], eax call _SdbFindFirstTag@12 ; SdbFindFirstTag(x,x,x) test eax, eax jz loc_A217D5 mov ecx, [ebp+var_C] xor edx, edx and ecx, 0F000h mov [ebp+arg_8], edx mov edi, edx mov [ebp+var_4], edi cmp ecx, 4000h jz short loc_A2174C cmp ecx, 5000h jz short loc_A21733 cmp ecx, 6000h jnz short loc_A21766 mov ecx, [ebp+arg_0] mov edx, eax call SdbGetStringTagPtr mov edx, eax mov [ebp+arg_8], eax lea eax, [edx+2] loc_A2171B: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+DBj mov cx, [edx] add edx, 2 cmp cx, di jnz short loc_A2171B sub edx, eax sar edx, 1 lea edi, ds:2[edx*2] jmp short loc_A21763 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21733: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+B6j mov ecx, [ebp+arg_0] push edx push edx mov edx, eax call SdbReadQWORDTag mov [ebp+var_30], eax lea eax, [ebp+var_30] mov [ebp+var_2C], edx push 8 jmp short loc_A2175F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2174C: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+AEj mov ecx, [ebp+arg_0] push edx mov edx, eax call SdbReadDWORDTag mov [ebp+var_10], eax lea eax, [ebp+var_10] push 4 loc_A2175F: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+101j pop edi mov [ebp+arg_8], eax loc_A21763: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+E8j mov [ebp+var_4], edi loc_A21766: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+BEj mov ecx, [ebp+var_8] xor eax, eax inc eax xor edx, edx mov ecx, [ecx] call __allshl push edx push eax mov edx, ebx mov ecx, esi call _AslFileAllocAndGetAttributes@16 ; AslFileAllocAndGetAttributes(x,x,x,x) mov esi, eax mov eax, [ebp+var_8] mov eax, [eax] test esi, esi js loc_A2183A mov esi, [ebp+var_1C] imul eax, 18h add eax, esi test byte ptr [eax+10h], 1 jz loc_A21834 mov edx, [ebp+var_C] lea ecx, [ebp+var_14] push eax push edi push [ebp+arg_8] call _SdbpCheckAttribute@20 ; SdbpCheckAttribute(x,x,x,x,x) test eax, eax jz short loc_A21813 mov eax, [ebp+var_20] mov edi, [ebp+var_14] mov eax, [eax+3F0h] test eax, eax jz short loc_A217D1 push edi push [ebp+var_4] push [ebp+arg_8] push [ebp+var_C] call eax loc_A217D1: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+17Aj test edi, edi jz short loc_A217F3 loc_A217D5: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+8Fj mov ecx, [ebp+var_18] mov eax, [ebp+var_8] add ecx, 8 add eax, 8 mov [ebp+var_18], ecx mov [ebp+var_8], eax cmp ecx, 130h jb loc_A216C3 loc_A217F3: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+18Aj xor eax, eax mov esi, eax mov eax, [ebp+var_24] mov [eax], edi loc_A217FC: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+1E9j ; SdbpCheckAllAttributes(x,x,x,x,x)+1EFj ... mov edi, [ebp+var_1C] mov ecx, edi call _AslFileFreeAttributes@4 ; AslFileFreeAttributes(x) push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) jmp short loc_A21859 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21813: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+16Aj mov esi, 0C00000E5h push esi push offset ??_C@_0BP@NLPCOOD@SdbpCheckAttribute?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 359h push offset ??_C@_0BH@LGBLGPBK@SdbpCheckAllAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A217FC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21834: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+152j xor eax, eax mov esi, eax jmp short loc_A217FC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2183A: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+140j push esi push eax push offset ??_C@_0CA@NOHMNGME@Failed?5to?5get?5attribute?5?$CFd?5?$FL?$CFx?$FN@NNGAKEGL@ push 342h push offset ??_C@_0BH@LGBLGPBK@SdbpCheckAllAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 18h jmp short loc_A217FC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21857: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+2Bj ; SdbpCheckAllAttributes(x,x,x,x,x)+49j mov esi, ecx loc_A21859: ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+68j ; SdbpCheckAllAttributes(x,x,x,x,x)+1C8j pop edi mov eax, esi pop esi pop ebx leave retn 0Ch _SdbpCheckAllAttributes@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckAttribute(x, x, x, x, x) _SdbpCheckAttribute@20 proc near ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+163p var_6 = word ptr -6 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp and esp, 0FFFFFFF8h sub esp, 0Ch push ebx push esi xor esi, esi mov [esp+14h+var_4], ecx push edi mov ax, dx mov [ecx], esi xor edi, edi movzx ebx, ax mov ecx, 5006h mov [esp+18h+var_6], ax inc edi cmp ebx, ecx ja loc_A21940 jz loc_A21AC0 cmp ebx, 401Eh jz short loc_A2191E cmp ebx, 4033h jz short loc_A218F7 lea eax, [ebx-5002h] cmp eax, edi ja loc_A21A21 cmp [ebp+arg_4], 8 jnb short loc_A218DC push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 238h loc_A218C7: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+1F1j ; SdbpCheckAttribute(x,x,x,x,x)+219j ... push offset ??_C@_0BD@EDJAJPBP@SdbpCheckAttribute@NNGAKEGL@ push edi loc_A218CD: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+19Fj call AslLogCallPrintf add esp, 10h mov edi, esi jmp loc_A21AF3 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A218DC: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+59j mov eax, [ebp+arg_8] push dword ptr [eax+0Ch] push dword ptr [eax+8] mov eax, [ebp+arg_0] push dword ptr [eax+4] push dword ptr [eax] call _SdbpCheckVersion@16 ; SdbpCheckVersion(x,x,x,x) jmp loc_A21AEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A218F7: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+45j cmp [ebp+arg_4], 4 jnb short loc_A2190C push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 261h jmp loc_A219FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2190C: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+99j mov eax, [ebp+arg_0] mov ecx, [eax] mov eax, [ebp+arg_8] cmp [eax+8], ecx loc_A21917: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+DCj sbb esi, esi jmp loc_A21ABD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2191E: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+3Dj cmp [ebp+arg_4], 4 jnb short loc_A21933 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 26Eh jmp loc_A219FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21933: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+C0j mov eax, [ebp+arg_0] mov ecx, [eax] mov eax, [ebp+arg_8] cmp ecx, [eax+8] jmp short loc_A21917 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21940: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+2Bj cmp ebx, 500Dh jz loc_A21AC0 cmp ebx, 5011h jbe loc_A21A21 cmp ebx, 5013h jbe loc_A219EA cmp ebx, 6043h jbe loc_A21A21 mov ecx, 6047h cmp ax, cx ja loc_A21A21 call _Feature_CompatBuildInVb__private_IsEnabledDeviceUsage@0 ; Feature_CompatBuildInVb__private_IsEnabledDeviceUsage() test eax, eax jz loc_A21A21 mov ax, [esp+18h+var_6] mov ecx, 6046h cmp ax, cx jz short loc_A219C5 inc ecx cmp ax, cx jz short loc_A219C5 cmp [ebp+arg_4], 2 jnb short loc_A219B2 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 28Fh jmp short loc_A219FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A219B2: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+142j mov edx, [ebp+arg_8] mov ecx, [ebp+arg_0] mov edx, [edx+8] call _SdbpCheckUptoStringVersion@8 ; SdbpCheckUptoStringVersion(x,x) jmp loc_A21AEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A219C5: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+136j ; SdbpCheckAttribute(x,x,x,x,x)+13Cj cmp [ebp+arg_4], 2 jnb short loc_A219D7 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 281h jmp short loc_A219FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A219D7: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+167j mov edx, [ebp+arg_8] mov ecx, [ebp+arg_0] mov edx, [edx+8] call _SdbpCheckFromStringVersion@8 ; SdbpCheckFromStringVersion(x,x) jmp loc_A21AEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A219EA: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+FCj cmp [ebp+arg_4], 8 jnb short loc_A21A06 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 246h loc_A219FA: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+A5j ; SdbpCheckAttribute(x,x,x,x,x)+CCj ... push offset ??_C@_0BD@EDJAJPBP@SdbpCheckAttribute@NNGAKEGL@ push 1 jmp loc_A218CD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A06: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+18Cj mov eax, [ebp+arg_8] push dword ptr [eax+0Ch] push dword ptr [eax+8] mov eax, [ebp+arg_0] push dword ptr [eax+4] push dword ptr [eax] call _SdbpCheckFromVersion@16 ; SdbpCheckFromVersion(x,x,x,x) jmp loc_A21AEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A21: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+4Fj ; SdbpCheckAttribute(x,x,x,x,x)+F0j ... and ebx, 0F000h cmp ebx, 4000h jz short loc_A21A99 cmp ebx, 5000h jz short loc_A21A6B cmp ebx, 6000h jnz loc_A21AED cmp [ebp+arg_4], 2 jnb short loc_A21A58 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 2B6h jmp loc_A218C7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A58: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+1E5j mov edx, [ebp+arg_8] mov ecx, [ebp+arg_0] mov edx, [edx+8] call AslStringPatternMatchW jmp loc_A21AEB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A6B: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+1D3j cmp [ebp+arg_4], 8 jnb short loc_A21A80 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 2C4h jmp loc_A218C7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A80: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+20Dj mov ecx, [ebp+arg_0] mov edx, [ebp+arg_8] mov eax, [ecx] cmp eax, [edx+8] jnz short loc_A21AED mov eax, [ecx+4] cmp eax, [edx+0Ch] jnz short loc_A21AED mov esi, edi jmp short loc_A21AED ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21A99: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+1CBj cmp [ebp+arg_4], 4 jnb short loc_A21AAE push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 2A6h jmp loc_A218C7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21AAE: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+23Bj mov eax, [ebp+arg_0] mov esi, [eax] mov eax, [ebp+arg_8] sub esi, [eax+8] neg esi sbb esi, esi loc_A21ABD: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+B7j inc esi jmp short loc_A21AED ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21AC0: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+31j ; SdbpCheckAttribute(x,x,x,x,x)+E4j cmp [ebp+arg_4], 8 jnb short loc_A21AD5 push offset ??_C@_0BN@MAJDMDHG@Attribute?5size?5doesn?8t?5match@NNGAKEGL@ ; "Attribute size doesn't match" push 254h jmp loc_A219FA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21AD5: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+262j mov eax, [ebp+arg_8] mov ecx, [ebp+arg_0] push dword ptr [eax+0Ch] push dword ptr [eax+8] push dword ptr [ecx+4] push dword ptr [ecx] call _SdbpCheckUptoVersion@16 ; SdbpCheckUptoVersion(x,x,x,x) loc_A21AEB: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+90j ; SdbpCheckAttribute(x,x,x,x,x)+15Ej ... mov esi, eax loc_A21AED: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+1DBj ; SdbpCheckAttribute(x,x,x,x,x)+229j ... mov eax, [esp+18h+var_4] mov [eax], esi loc_A21AF3: ; CODE XREF: SdbpCheckAttribute(x,x,x,x,x)+75j mov eax, edi pop edi pop esi pop ebx mov esp, ebp pop ebp retn 0Ch _SdbpCheckAttribute@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckFromVersion(x, x, x, x) _SdbpCheckFromVersion@16 proc near ; CODE XREF: SdbpCheckApplicationTypeAttributes(x,x,x,x)+162p ; SdbpMatchOsVersion+8A5CFp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push ebx push esi push edi xor esi, esi push 30h inc esi pop edi loc_A21B0C: ; CODE XREF: SdbpCheckFromVersion(x,x,x,x)+40j mov eax, [ebp+arg_0] mov ecx, edi mov edx, [ebp+arg_4] call __aullshr mov edx, [ebp+arg_C] mov ecx, edi movzx ebx, ax mov eax, [ebp+arg_8] call __aullshr movzx eax, ax cmp bx, ax jz short loc_A21B3B mov ecx, 0FFFFh cmp bx, cx jnz short loc_A21B42 loc_A21B3B: ; CODE XREF: SdbpCheckFromVersion(x,x,x,x)+31j sub edi, 10h jns short loc_A21B0C jmp short loc_A21B49 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21B42: ; CODE XREF: SdbpCheckFromVersion(x,x,x,x)+3Bj cmp bx, ax sbb esi, esi neg esi loc_A21B49: ; CODE XREF: SdbpCheckFromVersion(x,x,x,x)+42j pop edi mov eax, esi pop esi pop ebx pop ebp retn 10h _SdbpCheckFromVersion@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckUptoVersion(x, x, x, x) _SdbpCheckUptoVersion@16 proc near ; CODE XREF: SdbpCheckApplicationTypeAttributes(x,x,x,x)+130p ; SdbpMatchOsVersion+8A600p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push ebx push esi push edi xor esi, esi push 30h inc esi pop edi loc_A21B60: ; CODE XREF: SdbpCheckUptoVersion(x,x,x,x)+40j mov eax, [ebp+arg_0] mov ecx, edi mov edx, [ebp+arg_4] call __aullshr mov edx, [ebp+arg_C] mov ecx, edi movzx ebx, ax mov eax, [ebp+arg_8] call __aullshr movzx eax, ax cmp bx, ax jz short loc_A21B8F mov ecx, 0FFFFh cmp bx, cx jnz short loc_A21B96 loc_A21B8F: ; CODE XREF: SdbpCheckUptoVersion(x,x,x,x)+31j sub edi, 10h jns short loc_A21B60 jmp short loc_A21B9D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21B96: ; CODE XREF: SdbpCheckUptoVersion(x,x,x,x)+3Bj cmp ax, bx sbb esi, esi neg esi loc_A21B9D: ; CODE XREF: SdbpCheckUptoVersion(x,x,x,x)+42j pop edi mov eax, esi pop esi pop ebx pop ebp retn 10h _SdbpCheckUptoVersion@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall SdbpCheckVersion(x, x, x, x) _SdbpCheckVersion@16 proc near ; CODE XREF: SdbpCheckApplicationTypeAttributes(x,x,x,x)+194p ; SdbpMatchOsVersion+8A5A4p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp push esi push edi push 30h pop esi loc_A21BB0: ; CODE XREF: SdbpCheckVersion(x,x,x,x)+39j mov eax, [ebp+arg_0] mov ecx, esi mov edx, [ebp+arg_4] call __aullshr mov edx, [ebp+arg_C] mov ecx, esi movzx edi, ax mov eax, [ebp+arg_8] call __aullshr cmp di, ax jz short loc_A21BDC mov eax, 0FFFFh cmp di, ax jnz short loc_A21BEA loc_A21BDC: ; CODE XREF: SdbpCheckVersion(x,x,x,x)+2Aj sub esi, 10h jns short loc_A21BB0 xor eax, eax inc eax loc_A21BE4: ; CODE XREF: SdbpCheckVersion(x,x,x,x)+46j pop edi pop esi pop ebp retn 10h ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21BEA: ; CODE XREF: SdbpCheckVersion(x,x,x,x)+34j xor eax, eax jmp short loc_A21BE4 _SdbpCheckVersion@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall SdbFindNextStringIndexedTag(x, x) _SdbFindNextStringIndexedTag@8 proc near ; CODE XREF: SdbGetDatabaseMatchEx+AFC55p ; SdbpSearchDB+AF7C9p ... mov edi, edi push ecx push esi mov esi, edx push edi push esi mov edi, ecx mov edx, [esi] call SdbpGetNextIndexedRecord test eax, eax jz short loc_A21C0D push esi mov edx, eax mov ecx, edi call SdbpFindMatchingName loc_A21C0D: ; CODE XREF: SdbFindNextStringIndexedTag(x,x)+13j pop edi pop esi pop ecx retn _SdbFindNextStringIndexedTag@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslGuidToString_UStr(x, x) _AslGuidToString_UStr@8 proc near ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+6Ep mov edi, edi push ebx push esi push edi push 4Ch pop eax mov ebx, ecx mov edi, edx push 4Eh pop edx push ecx mov [ebx], ax mov [ebx+2], dx call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax test esi, esi jnz short loc_A21C56 push offset ??_C@_0O@NALGGDJF@Out?5of?5memory@NNGAKEGL@ push 0F1h push (offset loc_8C4836+4) push 1 call AslLogCallPrintf add esp, 10h mov edi, 0C0000017h jmp loc_A21CD7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21C56: ; CODE XREF: AslGuidToString_UStr(x,x)+20j movzx eax, byte ptr [edi+0Fh] push eax movzx eax, byte ptr [edi+0Eh] push eax movzx eax, byte ptr [edi+0Dh] push eax movzx eax, byte ptr [edi+0Ch] push eax movzx eax, byte ptr [edi+0Bh] push eax movzx eax, byte ptr [edi+0Ah] push eax movzx eax, byte ptr [edi+9] push eax movzx eax, byte ptr [edi+8] push eax movzx eax, word ptr [edi+6] push eax movzx eax, word ptr [edi+4] push eax push dword ptr [edi] ; char movzx eax, word ptr [ebx+2] push offset ??_C@_1HM@GHDLPNLE@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAl?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAh?$AAx?$AA?9?$AA?$CF?$AA0@NNGAKEGL@ ; "{%08lx-%04hx-%04hx-%02hx%02hx-%02hx%02h"... shr eax, 1 push eax ; int push esi ; wchar_t * call RtlStringCchPrintfW mov edi, eax add esp, 38h test edi, edi jns short loc_A21CC1 push edi push offset ??_C@_0CA@FFNDHPE@RtlStringCchPrintfW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 105h push (offset loc_8C4836+4) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A21CC8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21CC1: ; CODE XREF: AslGuidToString_UStr(x,x)+92j mov [ebx+4], esi xor esi, esi mov edi, esi loc_A21CC8: ; CODE XREF: AslGuidToString_UStr(x,x)+AEj test esi, esi jz short loc_A21CD7 push 74705041h push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A21CD7: ; CODE XREF: AslGuidToString_UStr(x,x)+40j ; AslGuidToString_UStr(x,x)+B9j mov eax, edi pop edi pop esi pop ebx retn _AslGuidToString_UStr@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslStringAnsiToUnicode(x, x) _AslStringAnsiToUnicode@8 proc near ; CODE XREF: AslpFileGet16BitDescription(x,x)+69p ; AslpFileGet16BitModuleName(x,x)+69p ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 10h push ebx push esi push edi push edx lea eax, [ebp+var_10] xor esi, esi push eax mov ebx, ecx mov [ebp+var_10], esi mov [ebp+var_C], esi call _RtlInitString@8 ; RtlInitString(x,x) lea eax, [ebp+var_10] push eax call _RtlxAnsiStringToUnicodeSize@4 ; RtlxAnsiStringToUnicodeSize(x) mov edi, eax mov [ebp+var_8], esi mov [ebp+var_4], esi mov [ebx], esi cmp edi, 0FFFFh jbe short loc_A21D38 push edi push offset ??_C@_0CJ@FKBOKAKO@Ansi?5string?5is?5too?5long?5to?5conv@NNGAKEGL@ mov esi, 0C000000Dh push 188h loc_A21D27: ; CODE XREF: AslStringAnsiToUnicode(x,x)+B3j push (offset loc_8C47ED+5) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A21D9D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21D38: ; CODE XREF: AslStringAnsiToUnicode(x,x)+38j push ecx mov edx, edi call _AslAlloc@12 ; AslAlloc(x,x,x) mov [ebp+var_4], eax test eax, eax jnz short loc_A21D67 push offset ??_C@_0O@NALGGDJF@Out?5of?5memory@NNGAKEGL@ push 18Fh push (offset loc_8C47ED+5) push 1 mov esi, 0C0000017h call AslLogCallPrintf add esp, 10h jmp short loc_A21D9D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21D67: ; CODE XREF: AslStringAnsiToUnicode(x,x)+68j xor eax, eax mov word ptr [ebp+var_8+2], di mov word ptr [ebp+var_8], ax lea eax, [ebp+var_10] push esi push eax lea eax, [ebp+var_8] push eax call RtlAnsiStringToUnicodeString mov esi, eax test esi, esi jns short loc_A21D92 push esi push offset ??_C@_0CJ@JMPLFPEH@RtlAnsiStringToUnicodeString?5fa@NNGAKEGL@ push 198h jmp short loc_A21D27 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21D92: ; CODE XREF: AslStringAnsiToUnicode(x,x)+A6j mov eax, [ebp+var_4] and [ebp+var_4], 0 xor esi, esi mov [ebx], eax loc_A21D9D: ; CODE XREF: AslStringAnsiToUnicode(x,x)+59j ; AslStringAnsiToUnicode(x,x)+88j cmp [ebp+var_4], 0 jz short loc_A21DB0 push 74705041h push [ebp+var_4] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A21DB0: ; CODE XREF: AslStringAnsiToUnicode(x,x)+C4j pop edi mov eax, esi pop esi pop ebx leave retn _AslStringAnsiToUnicode@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslStringHasWildcard(x) _AslStringHasWildcard@4 proc near ; CODE XREF: AslpPathWildcardMakeLeaves(x)+136p mov edi, edi push esi xor esi, esi test ecx, ecx jz short loc_A21DE8 movzx eax, word ptr [ecx] test ax, ax jz short loc_A21DE8 mov edx, eax loc_A21DCA: ; CODE XREF: AslStringHasWildcard(x)+2Aj cmp dx, 2Ah jz short loc_A21DE5 cmp dx, 3Fh jz short loc_A21DE5 add ecx, 2 movzx eax, word ptr [ecx] mov edx, eax test ax, ax jnz short loc_A21DCA jmp short loc_A21DE8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21DE5: ; CODE XREF: AslStringHasWildcard(x)+17j ; AslStringHasWildcard(x)+1Dj xor esi, esi inc esi loc_A21DE8: ; CODE XREF: AslStringHasWildcard(x)+7j ; AslStringHasWildcard(x)+Fj ... mov eax, esi pop esi retn _AslStringHasWildcard@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslStringSearchA(x, x, x, x) _AslStringSearchA@16 proc near ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+2AFp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx push ecx push edi xor edi, edi mov [ebp+var_8], ecx test edx, edx jz short loc_A21E5A push esi mov esi, [ebp+arg_4] cmp esi, edx ja short loc_A21E59 push ebx mov ebx, edi loc_A21E08: ; CODE XREF: AslStringSearchA(x,x,x,x)+63j mov eax, edi mov ecx, ebx mov [ebp+var_4], eax test esi, esi jz short loc_A21E45 loc_A21E13: ; CODE XREF: AslStringSearchA(x,x,x,x)+57j cmp ecx, edx jnb short loc_A21E45 mov eax, [ebp+var_8] cmp byte ptr [ecx+eax], 0 jnz short loc_A21E25 inc ecx cmp ecx, edx jnb short loc_A21E58 loc_A21E25: ; CODE XREF: AslStringSearchA(x,x,x,x)+32j mov esi, [ebp+var_4] mov edi, [ebp+arg_0] mov al, [ecx+eax] push 0 cmp al, [esi+edi] mov esi, [ebp+arg_4] mov eax, [ebp+var_4] pop edi jnz short loc_A21E45 inc eax inc ecx mov [ebp+var_4], eax cmp eax, esi jb short loc_A21E13 loc_A21E45: ; CODE XREF: AslStringSearchA(x,x,x,x)+25j ; AslStringSearchA(x,x,x,x)+29j ... cmp eax, esi jz short loc_A21E53 inc ebx lea eax, [ebx+esi] cmp eax, edx jbe short loc_A21E08 jmp short loc_A21E58 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21E53: ; CODE XREF: AslStringSearchA(x,x,x,x)+5Bj mov edi, [ebp+var_8] add edi, ebx loc_A21E58: ; CODE XREF: AslStringSearchA(x,x,x,x)+37j ; AslStringSearchA(x,x,x,x)+65j pop ebx loc_A21E59: ; CODE XREF: AslStringSearchA(x,x,x,x)+17j pop esi loc_A21E5A: ; CODE XREF: AslStringSearchA(x,x,x,x)+Fj mov eax, edi pop edi leave retn 8 _AslStringSearchA@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslStringSearchW(x, x, x, x) _AslStringSearchW@16 proc near ; CODE XREF: SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+29Ap var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp push ecx push ecx push esi xor esi, esi mov [ebp+var_8], ecx test edx, edx jz short loc_A21ED2 push edi mov edi, [ebp+arg_4] cmp edi, edx ja short loc_A21ED1 push ebx mov ebx, esi loc_A21E7D: ; CODE XREF: AslStringSearchW(x,x,x,x)+65j mov eax, esi mov ecx, ebx mov [ebp+var_4], eax test edi, edi jz short loc_A21EBC loc_A21E88: ; CODE XREF: AslStringSearchW(x,x,x,x)+59j cmp ecx, edx jnb short loc_A21EBC mov eax, [ebp+var_8] cmp [eax+ecx*2], si jnz short loc_A21E9A inc ecx cmp ecx, edx jnb short loc_A21ED0 loc_A21E9A: ; CODE XREF: AslStringSearchW(x,x,x,x)+32j mov edi, [ebp+var_4] mov esi, [ebp+arg_0] mov ax, [eax+ecx*2] push 0 cmp ax, [esi+edi*2] mov edi, [ebp+arg_4] mov eax, [ebp+var_4] pop esi jnz short loc_A21EBC inc eax inc ecx mov [ebp+var_4], eax cmp eax, edi jb short loc_A21E88 loc_A21EBC: ; CODE XREF: AslStringSearchW(x,x,x,x)+25j ; AslStringSearchW(x,x,x,x)+29j ... cmp eax, edi jz short loc_A21ECA inc ebx lea eax, [ebx+edi] cmp eax, edx jbe short loc_A21E7D jmp short loc_A21ED0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21ECA: ; CODE XREF: AslStringSearchW(x,x,x,x)+5Dj mov ecx, [ebp+var_8] lea esi, [ecx+ebx*2] loc_A21ED0: ; CODE XREF: AslStringSearchW(x,x,x,x)+37j ; AslStringSearchW(x,x,x,x)+67j pop ebx loc_A21ED1: ; CODE XREF: AslStringSearchW(x,x,x,x)+17j pop edi loc_A21ED2: ; CODE XREF: AslStringSearchW(x,x,x,x)+Fj mov eax, esi pop esi leave retn 8 _AslStringSearchW@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslStringXmlSanitize(x) _AslStringXmlSanitize@4 proc near ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+108p ; AslpFileGetHeaderAttributesNE(x,x)+ADp ... mov edx, ecx test edx, edx jnz short loc_A21EE5 mov eax, 0C000000Dh retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A21EE5: ; CODE XREF: AslStringXmlSanitize(x)+4j push ebx xor ebx, ebx cmp [edx], bx jz short loc_A21F33 push esi lea esi, [ecx+2] loc_A21EF1: ; CODE XREF: AslStringXmlSanitize(x)+21j mov ax, [ecx] add ecx, 2 cmp ax, bx jnz short loc_A21EF1 sub ecx, esi mov eax, ebx sar ecx, 1 jz short loc_A21F32 push edi loc_A21F05: ; CODE XREF: AslStringXmlSanitize(x)+56j movzx edi, word ptr [edx+eax*2] mov esi, ebx loc_A21F0B: ; CODE XREF: AslStringXmlSanitize(x)+4Aj cmp di, ds:word_42EAE8[esi] jb short loc_A21F1D cmp di, ds:word_42EAEA[esi] jbe short loc_A21F2C loc_A21F1D: ; CODE XREF: AslStringXmlSanitize(x)+39j add esi, 4 cmp esi, 14h jb short loc_A21F0B push 40h pop esi mov [edx+eax*2], si loc_A21F2C: ; CODE XREF: AslStringXmlSanitize(x)+42j inc eax cmp eax, ecx jb short loc_A21F05 pop edi loc_A21F32: ; CODE XREF: AslStringXmlSanitize(x)+29j pop esi loc_A21F33: ; CODE XREF: AslStringXmlSanitize(x)+12j xor eax, eax pop ebx retn _AslStringXmlSanitize@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslUnicodeStringFree(x) _AslUnicodeStringFree@4 proc near ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+2C2p mov edi, edi push esi mov esi, ecx test esi, esi jz short loc_A21F70 mov ecx, [esi+4] test ecx, ecx jz short loc_A21F69 movzx eax, word ptr [esi+2] push eax ; size_t push 42h ; int push ecx ; void * call _memset mov eax, [esi+4] add esp, 0Ch test eax, eax jz short loc_A21F69 push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A21F69: ; CODE XREF: AslUnicodeStringFree(x)+Ej ; AslUnicodeStringFree(x)+25j and dword ptr [esi], 0 and dword ptr [esi+4], 0 loc_A21F70: ; CODE XREF: AslUnicodeStringFree(x)+7j pop esi retn _AslUnicodeStringFree@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslComputeCrc32(x, x, x) _AslComputeCrc32@12 proc near ; CODE XREF: AslpFileGetCrcChecksum(x,x)+3Ep ; AslpFileGetCrcChecksum(x,x):loc_A24CF9p ... arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push esi xor esi, esi not ecx cmp [ebp+arg_0], esi jbe short loc_A21F9A loc_A21F81: ; CODE XREF: AslComputeCrc32(x,x,x)+26j movzx eax, byte ptr [esi+edx] xor eax, ecx shr ecx, 8 movzx eax, al xor ecx, ds:_AslpCrc32Table[eax*4] inc esi cmp esi, [ebp+arg_0] jb short loc_A21F81 loc_A21F9A: ; CODE XREF: AslComputeCrc32(x,x,x)+Dj not ecx mov eax, ecx pop esi pop ebp retn 4 _AslComputeCrc32@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslDoesDirectoryExistNtPath(x) _AslDoesDirectoryExistNtPath@4 proc near ; CODE XREF: SdbpCheckMatchingDir(x,x,x,x,x,x,x)+CDp var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push esi xor esi, esi lea eax, [ebp+var_C] push ecx push eax mov [ebp+var_C], esi mov [ebp+var_8], esi mov [ebp+var_4], esi mov [ebp+var_14], esi mov [ebp+var_10], esi call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push 1 lea eax, [ebp+var_C] mov [ebp+var_2C], 18h mov [ebp+var_24], eax lea eax, [ebp+var_14] push 3 push eax lea eax, [ebp+var_2C] mov [ebp+var_28], esi push eax push 100080h lea eax, [ebp+var_4] mov [ebp+var_20], 240h push eax mov [ebp+var_1C], esi mov [ebp+var_18], esi call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) test eax, eax js short loc_A2200C push [ebp+var_4] call _ZwClose@4 ; ZwClose(x) jmp short loc_A2201A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2200C: ; CODE XREF: AslDoesDirectoryExistNtPath(x)+5Dj cmp eax, 0C0000022h jz short loc_A2201A cmp eax, 0C0000043h jnz short loc_A2201D loc_A2201A: ; CODE XREF: AslDoesDirectoryExistNtPath(x)+67j ; AslDoesDirectoryExistNtPath(x)+6Ej xor esi, esi inc esi loc_A2201D: ; CODE XREF: AslDoesDirectoryExistNtPath(x)+75j mov eax, esi pop esi leave retn _AslDoesDirectoryExistNtPath@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslDoesFileExistNtPath(x) _AslDoesFileExistNtPath@4 proc near ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+159p var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push esi xor esi, esi lea eax, [ebp+var_C] push ecx push eax mov [ebp+var_C], esi mov [ebp+var_8], esi mov [ebp+var_4], esi mov [ebp+var_14], esi mov [ebp+var_10], esi call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push esi lea eax, [ebp+var_C] mov [ebp+var_2C], 18h mov [ebp+var_24], eax lea eax, [ebp+var_14] push 1 push eax lea eax, [ebp+var_2C] mov [ebp+var_28], esi push eax push 100080h lea eax, [ebp+var_4] mov [ebp+var_20], 240h push eax mov [ebp+var_1C], esi mov [ebp+var_18], esi call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) test eax, eax jns short loc_A22093 cmp eax, 0C0000043h jz short loc_A2208E cmp eax, 0C0000022h jnz short loc_A2209E loc_A2208E: ; CODE XREF: AslDoesFileExistNtPath(x)+63j xor esi, esi inc esi jmp short loc_A2209E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22093: ; CODE XREF: AslDoesFileExistNtPath(x)+5Cj push [ebp+var_4] xor esi, esi inc esi call _ZwClose@4 ; ZwClose(x) loc_A2209E: ; CODE XREF: AslDoesFileExistNtPath(x)+6Aj ; AslDoesFileExistNtPath(x)+6Fj mov eax, esi pop esi leave retn _AslDoesFileExistNtPath@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslFileResourceNotFound(x) _AslFileResourceNotFound@4 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+18Cp ; AslpFileGetVersionAttributes(x,x)+2Cp ... cmp ecx, 0C0000089h jz short loc_A220BE cmp ecx, 0C000008Ah jz short loc_A220BE cmp ecx, 0C000008Bh jz short loc_A220BE xor eax, eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A220BE: ; CODE XREF: AslFileResourceNotFound(x)+6j ; AslFileResourceNotFound(x)+Ej ... xor eax, eax inc eax retn _AslFileResourceNotFound@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslFree(x, x) _AslFree@8 proc near ; CODE XREF: SdbpCreateSearchDBContext(x,x,x,x,x,x)+151p ; SdbpCreateSearchDBContext(x,x,x,x,x,x)+15Cp ... test edx, edx jz short locret_A220D1 push 74705041h push edx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) locret_A220D1: ; CODE XREF: AslFree(x,x)+2j retn _AslFree@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslRegistryEnumKey(x, x, x, x) _AslRegistryEnumKey@16 proc near ; CODE XREF: AslpProcessMatchRegNode(x,x)+91p var_214 = dword ptr -214h var_210 = dword ptr -210h var_204 = dword ptr -204h var_200 = dword ptr -200h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 214h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax mov eax, [ebp+arg_0] and [ebp+var_214], 0 push ebx push edi mov ebx, ecx lea ecx, [ebp+var_214] push ecx push 20Ch lea ecx, [ebp+var_210] push ecx push 0 push [ebp+arg_4] push eax call _ZwEnumerateKey@24 ; ZwEnumerateKey(x,x,x,x,x,x) mov edi, eax test edi, edi js short loc_A22151 push esi mov esi, [ebp+var_204] shr esi, 1 lea ecx, [esi+1] cmp ecx, 104h jb short loc_A22134 mov edi, 0C0000023h jmp short loc_A22150 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22134: ; CODE XREF: AslRegistryEnumKey(x,x,x,x)+59j push [ebp+var_204] ; size_t lea eax, [ebp+var_200] push eax ; void * push ebx ; void * call _memcpy add esp, 0Ch xor eax, eax mov [ebx+esi*2], ax loc_A22150: ; CODE XREF: AslRegistryEnumKey(x,x,x,x)+60j pop esi loc_A22151: ; CODE XREF: AslRegistryEnumKey(x,x,x,x)+45j mov ecx, [ebp+var_4] mov eax, edi pop edi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 8 _AslRegistryEnumKey@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslRegistryGetUInt32(x, x, x) _AslRegistryGetUInt32@12 proc near ; CODE XREF: SdbpQueryAppCompatFlagsByExeID+8A4BDp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_8], 0 lea eax, [ebp+var_8] and [ebp+var_4], 0 push ebx push esi push edi push [ebp+arg_0] mov edi, edx mov ebx, ecx push eax call _RtlInitUnicodeStringEx@8 ; RtlInitUnicodeStringEx(x,x) mov esi, eax test esi, esi jns short loc_A221A7 push esi push offset ??_C@_0CD@LDGCFCIP@RtlInitUnicodeStringEx?5failed?5?$FL@NNGAKEGL@ push 3DAh push offset ??_C@_0BF@GLMGGLJH@AslRegistryGetUInt32@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A221B6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A221A7: ; CODE XREF: AslRegistryGetUInt32(x,x,x)+26j lea eax, [ebp+var_8] mov edx, edi push eax mov ecx, ebx call _AslRegistryGetUInt32_UStr@12 ; AslRegistryGetUInt32_UStr(x,x,x) mov esi, eax loc_A221B6: ; CODE XREF: AslRegistryGetUInt32(x,x,x)+42j pop edi mov eax, esi pop esi pop ebx leave retn 4 _AslRegistryGetUInt32@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslRegistryGetUInt32_UStr(x, x, x) _AslRegistryGetUInt32_UStr@12 proc near ; CODE XREF: SdbResolveDatabaseEx(x,x,x,x,x,x)+1F5p ; SdbResolveDatabaseEx(x,x,x,x,x,x)+238p ... var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 1Ch mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi xor eax, eax mov esi, [ebp+arg_0] lea edi, [ebp+var_18] and [ebp+var_1C], 0 stosd mov ebx, ecx stosd and dword ptr [ebx], 0 stosd stosd stosd lea eax, [ebp+var_1C] push eax push 14h lea eax, [ebp+var_18] push eax push 2 push esi push edx call _ZwQueryValueKey@24 ; ZwQueryValueKey(x,x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A22227 cmp esi, 0C0000034h jz short loc_A2225A push esi push offset ??_C@_0BP@PMIDEKOL@Failed?5to?5query?5key?5value?5?$FL?$CFx?$FN@NNGAKEGL@ ; "Failed to query key value [%x]" push 3A1h push offset ??_C@_0BK@GEIFCLB@AslRegistryGetUInt32_UStr@NNGAKEGL@ ; "AslRegistryGetUInt32_UStr" push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A2225A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22227: ; CODE XREF: AslRegistryGetUInt32_UStr(x,x,x)+42j cmp [ebp+var_14], 4 jnz short loc_A2223C cmp [ebp+var_10], 4 jnz short loc_A2223C mov eax, [ebp+var_C] xor esi, esi mov [ebx], eax jmp short loc_A2225A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2223C: ; CODE XREF: AslRegistryGetUInt32_UStr(x,x,x)+6Cj ; AslRegistryGetUInt32_UStr(x,x,x)+72j push offset ??_C@_0BD@BBKBCNOK@Invalid?5value?5type@NNGAKEGL@ ; "Invalid value type" push 3A8h push offset ??_C@_0BK@GEIFCLB@AslRegistryGetUInt32_UStr@NNGAKEGL@ ; "AslRegistryGetUInt32_UStr" push 1 call AslLogCallPrintf add esp, 10h mov esi, 0C0000024h loc_A2225A: ; CODE XREF: AslRegistryGetUInt32_UStr(x,x,x)+4Aj ; AslRegistryGetUInt32_UStr(x,x,x)+66j ... mov ecx, [ebp+var_4] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 4 _AslRegistryGetUInt32_UStr@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslRegistryOpenSubKey(x, x, x, x) _AslRegistryOpenSubKey@16 proc near ; CODE XREF: AslpProcessMatchRegNode(x,x)+105p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 24h push ebx push esi push edi push [ebp+arg_0] mov edi, ecx xor eax, eax mov [ebp+var_8], eax mov ebx, edx mov [ebp+var_4], eax mov [edi], eax lea eax, [ebp+var_8] push eax call _RtlInitUnicodeStringEx@8 ; RtlInitUnicodeStringEx(x,x) mov esi, eax test esi, esi jns short loc_A222B6 push esi push offset ??_C@_0CL@KEPLONEJ@AslRegistryOpenSubKey?5passed?5ba@NNGAKEGL@ ; "AslRegistryOpenSubKey passed bad Path ["... push 31Ch push offset ??_C@_0BG@KMCFDHP@AslRegistryOpenSubKey@NNGAKEGL@ ; "AslRegistryOpenSubKey" push 1 call AslLogCallPrintf add esp, 14h mov eax, esi jmp short loc_A222E4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A222B6: ; CODE XREF: AslRegistryOpenSubKey(x,x,x,x)+29j and [ebp+var_10], 0 lea eax, [ebp+var_8] and [ebp+var_C], 0 mov [ebp+var_18], eax lea eax, [ebp+var_20] push eax push 20019h push edi mov [ebp+var_20], 18h mov [ebp+var_1C], ebx mov [ebp+var_14], 240h call _ZwOpenKey@12 ; ZwOpenKey(x,x,x) loc_A222E4: ; CODE XREF: AslRegistryOpenSubKey(x,x,x,x)+47j pop edi pop esi pop ebx leave retn 8 _AslRegistryOpenSubKey@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslFileMappingEnsure(x) _AslFileMappingEnsure@4 proc near ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+30p ; AslFileMappingGetImageTypeEx(x,x,x,x,x)+3Ap ... mov edi, edi push ebx push esi mov esi, ecx push edi xor edi, edi cmp [esi+30h], edi jz short loc_A22312 cmp dword ptr [esi+28h], 1 jz short loc_A2231F mov eax, [esi+18h] neg eax sbb eax, eax and eax, 3FFFFB93h add eax, 0C000046Dh jmp short loc_A22378 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22312: ; CODE XREF: AslFileMappingEnsure(x)+Cj cmp [esi+18h], edi jnz short loc_A22376 lea ebx, [esi+28h] cmp dword ptr [ebx], 1 jnz short loc_A22326 loc_A2231F: ; CODE XREF: AslFileMappingEnsure(x)+12j mov eax, 0C000011Eh jmp short loc_A22378 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22326: ; CODE XREF: AslFileMappingEnsure(x)+32j lea ecx, [esi+8] xor dl, dl call _RtlFileMapMapView@8 ; RtlFileMapMapView(x,x) mov edi, eax test edi, edi js short loc_A22376 cmp byte ptr [esi+27h], 0 jz short loc_A22344 mov dword ptr [ebx], 6 jmp short loc_A22376 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22344: ; CODE XREF: AslFileMappingEnsure(x)+4Fj mov edx, ebx lea ecx, [esi+8] call AslpFileMappingGetFileKind mov edi, eax test edi, edi jns short loc_A22376 push edi push dword ptr [esi] push offset ??_C@_0CK@IADOKJDF@AslpFileMappingGetFileKind?5fail@NNGAKEGL@ push 24Fh push offset ??_C@_0BF@GCAEIEGC@AslFileMappingEnsure@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 18h mov dword ptr [ebx], 3 loc_A22376: ; CODE XREF: AslFileMappingEnsure(x)+2Aj ; AslFileMappingEnsure(x)+49j ... mov eax, edi loc_A22378: ; CODE XREF: AslFileMappingEnsure(x)+25j ; AslFileMappingEnsure(x)+39j pop edi pop esi pop ebx retn _AslFileMappingEnsure@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslFileMappingEnsureMappedAs(x, x) _AslFileMappingEnsureMappedAs@8 proc near ; CODE XREF: SdbOpenDatabaseEx(x,x,x,x):loc_A1E826p ; SdbpCheckMatchingTextEntry(x,x,x,x,x,x,x,x,x)+DDp ... mov edi, edi push ebx push esi push edi mov edi, ecx cmp dword ptr [edi+30h], 0 lea ebx, [edi+28h] mov eax, [ebx] jz short loc_A2239A cmp eax, 1 jz short loc_A2239F mov eax, 0C000046Dh jmp short loc_A2240A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2239A: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+10j cmp eax, 1 jnz short loc_A223A6 loc_A2239F: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+15j mov eax, 0C000011Eh jmp short loc_A2240A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A223A6: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+21j lea ecx, [edi+8] xor dl, dl call _RtlFileMapMapView@8 ; RtlFileMapMapView(x,x) mov esi, eax test esi, esi jns short loc_A223C8 cmp esi, 0C000010Eh jnz short loc_A22408 cmp byte ptr [edi+27h], 0 jnz short loc_A22408 xor esi, esi jmp short loc_A22408 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A223C8: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+38j cmp byte ptr [edi+27h], 0 jz short loc_A223D6 mov dword ptr [ebx], 6 jmp short loc_A22408 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A223D6: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+50j mov edx, ebx lea ecx, [edi+8] call AslpFileMappingGetFileKind mov esi, eax test esi, esi jns short loc_A22408 push esi push dword ptr [edi] push offset ??_C@_0CK@IADOKJDF@AslpFileMappingGetFileKind?5fail@NNGAKEGL@ push 1F7h push (offset loc_8C4C8A+4) push 1 call AslLogCallPrintf add esp, 18h mov dword ptr [ebx], 3 loc_A22408: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+40j ; AslFileMappingEnsureMappedAs(x,x)+46j ... mov eax, esi loc_A2240A: ; CODE XREF: AslFileMappingEnsureMappedAs(x,x)+1Cj ; AslFileMappingEnsureMappedAs(x,x)+28j pop edi pop esi pop ebx retn _AslFileMappingEnsureMappedAs@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslFileMappingGetFileKindDetail(x, x) _AslFileMappingGetFileKindDetail@8 proc near ; CODE XREF: AslpFileGetFileKindDetailAttribute(x,x)+12p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 14h push ebx push esi push edi xor eax, eax mov [ebp+var_14], ecx mov edi, edx mov [ebp+var_8], eax mov ebx, eax mov [ebp+var_4], eax mov [ebp+var_10], eax mov [ebp+var_C], eax cmp dword ptr [edi+28h], 1 jnz short loc_A2243C inc ebx mov esi, eax jmp loc_A2255D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2243C: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+24j mov ecx, edi call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov esi, eax test esi, esi jns short loc_A22468 push esi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 550h loc_A22454: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+91j ; AslFileMappingGetFileKindDetail(x,x)+B8j push offset ??_C@_0CA@FHIHKCPF@AslFileMappingGetFileKindDetail@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A2255D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22468: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+39j mov ecx, [edi+28h] mov eax, ecx sub eax, 3 jz loc_A22558 sub eax, 1 jz loc_A22554 sub eax, 1 jz loc_A22550 sub eax, 1 jz short loc_A224A1 push ecx push offset ??_C@_0BM@LFKGHHKF@Unhandled?5ASL_FILE_KIND?3?5?$CFd@NNGAKEGL@ xor ebx, ebx mov esi, 0C0000001h push 573h jmp short loc_A22454 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A224A1: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+7Dj push edi lea eax, [ebp+var_10] push eax lea eax, [ebp+var_C] push eax lea edx, [ebp+var_4] lea ecx, [ebp+var_8] call _AslFileMappingGetImageTypeEx@20 ; AslFileMappingGetImageTypeEx(x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A224C8 push esi push (offset loc_8C4DF9+3) push 57Dh jmp short loc_A22454 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A224C8: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+ABj mov eax, 20Bh cmp [ebp+var_C], ebx jz short loc_A22500 cmp word ptr [ebp+var_4], ax jnz short loc_A224DC push 0Fh jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A224DC: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+C8j mov ebx, [ebp+var_10] mov ecx, 20002h mov eax, ebx and eax, ecx cmp eax, ecx jnz short loc_A224F0 push 0Eh jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A224F0: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+DCj and ebx, 20003h dec ebx neg ebx sbb ebx, ebx add ebx, 0Dh jmp short loc_A2255B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22500: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+C2j cmp word ptr [ebp+var_4], ax movzx eax, word ptr [ebp+var_8] jnz short loc_A22533 cmp eax, 200h jz short loc_A2252F cmp eax, 8664h jz short loc_A2252B xor ebx, ebx cmp eax, 0AA64h setz bl lea ebx, ds:8[ebx*2] jmp short loc_A2255B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2252B: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+108j push 9 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2252F: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+101j push 0Bh jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22533: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+FAj sub eax, 14Ch jz short loc_A2254C sub eax, 74h jz short loc_A22548 sub eax, 4 jz short loc_A22548 push 5 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22548: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+12Fj ; AslFileMappingGetFileKindDetail(x,x)+134j push 7 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2254C: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+12Aj push 6 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22550: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+74j push 4 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22554: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+6Bj push 3 jmp short loc_A2255A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22558: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+62j push 2 loc_A2255A: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+CCj ; AslFileMappingGetFileKindDetail(x,x)+E0j ... pop ebx loc_A2255B: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+F0j ; AslFileMappingGetFileKindDetail(x,x)+11Bj xor esi, esi loc_A2255D: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+29j ; AslFileMappingGetFileKindDetail(x,x)+55j mov eax, [ebp+var_14] test eax, eax jz short loc_A22566 mov [eax], ebx loc_A22566: ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+154j pop edi mov eax, esi pop esi pop ebx leave retn _AslFileMappingGetFileKindDetail@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslFileMappingGetImageTypeEx(x, x, x, x, x) _AslFileMappingGetImageTypeEx@20 proc near ; CODE XREF: AslFileMappingGetFileKindDetail(x,x)+A2p var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push 2Ch push offset dword_6AAC40 call __SEH_prolog4 mov [ebp+var_3C], edx mov [ebp+var_38], ecx xor eax, eax mov [ebp+var_1C], eax mov ebx, eax mov [ebp+var_24], eax mov [ebp+var_28], eax mov [ebp+var_2C], eax mov [ebp+var_30], eax mov edi, [ebp+arg_8] cmp dword ptr [edi+28h], 1 jnz short loc_A225A5 loc_A2259B: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+68j mov esi, 0C000007Bh jmp loc_A226BB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A225A5: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+2Cj mov ecx, edi call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov esi, eax test esi, esi jns short loc_A225D1 push esi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 44Eh loc_A225BD: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+85j push offset ??_C@_0BN@BGNMOAPO@AslFileMappingGetImageTypeEx@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A226BB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A225D1: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+43j cmp dword ptr [edi+28h], 6 jnz short loc_A2259B mov edx, edi lea ecx, [ebp+var_1C] call _AslpFileGetImageNtHeader@8 ; AslpFileGetImageNtHeader(x,x) mov esi, eax test esi, esi jns short loc_A225F4 push esi push offset ??_C@_0CF@GGCNCAGG@AslpFileGetImageNtHeader?5failed@NNGAKEGL@ push 462h jmp short loc_A225BD ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A225F4: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+78j mov ecx, [ebp+var_1C] movzx eax, word ptr [ecx+4] mov [ebp+var_24], eax movzx edx, word ptr [ecx+18h] mov eax, edx mov [ebp+var_28], eax cmp [edi+30h], ebx jz short loc_A22613 loc_A2260C: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+AEj ; AslFileMappingGetImageTypeEx(x,x,x,x,x)+D4j xor esi, esi jmp loc_A226BB ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22613: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+9Dj cmp [ebp+arg_0], ebx jnz short loc_A2261D cmp [ebp+arg_4], ebx jz short loc_A2260C loc_A2261D: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+A9j mov eax, 10Bh cmp dx, ax jnz short loc_A2262F mov ebx, [ecx+0E8h] jmp short loc_A2263F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2262F: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+B8j mov eax, 20Bh cmp dx, ax jnz short loc_A2263F mov ebx, [ecx+0F8h] loc_A2263F: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+C0j ; AslFileMappingGetImageTypeEx(x,x,x,x,x)+CAj test ebx, ebx jz short loc_A2260C and [ebp+ms_exc.disabled], 0 push ebx lea edx, [edi+8] call _AslpImageRvaToVa@12 ; AslpImageRvaToVa(x,x,x) test eax, eax jnz short loc_A2266F push offset ??_C@_0BP@GNNEOEPF@Failed?5to?5find?5the?5Cor20Header@NNGAKEGL@ push 498h push offset ??_C@_0BN@BGNMOAPO@AslFileMappingGetImageTypeEx@NNGAKEGL@ push 2 call AslLogCallPrintf add esp, 10h jmp short loc_A2267C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2266F: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+E5j mov [ebp+var_2C], 1 mov eax, [eax+10h] mov [ebp+var_30], eax loc_A2267C: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+100j xor esi, esi mov [ebp+var_20], esi jmp short loc_A226B4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22683: ; DATA XREF: .text:006AAC54o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_34], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22691: ; DATA XREF: .text:006AAC58o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_34] mov [ebp+var_20], esi push esi push (offset loc_8C4D43+3) push 4A5h push offset ??_C@_0BN@BGNMOAPO@AslFileMappingGetImageTypeEx@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A226B4: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+114j mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A226BB: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+33j ; AslFileMappingGetImageTypeEx(x,x,x,x,x)+5Fj ... mov ecx, [ebp+var_38] test ecx, ecx jz short loc_A226C9 mov ax, word ptr [ebp+var_24] mov [ecx], ax loc_A226C9: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+153j mov ecx, [ebp+var_3C] test ecx, ecx jz short loc_A226D7 mov ax, word ptr [ebp+var_28] mov [ecx], ax loc_A226D7: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+161j mov ecx, [ebp+arg_0] test ecx, ecx jz short loc_A226E3 mov eax, [ebp+var_2C] mov [ecx], eax loc_A226E3: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+16Fj mov ecx, [ebp+arg_4] test ecx, ecx jz short loc_A226EF mov eax, [ebp+var_30] mov [ecx], eax loc_A226EF: ; CODE XREF: AslFileMappingGetImageTypeEx(x,x,x,x,x)+17Bj mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 0Ch _AslFileMappingGetImageTypeEx@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslHashFree(x) _AslHashFree@4 proc near ; CODE XREF: SdbpReleaseSearchDBContext(x)+5Ep ; SdbpReleaseSearchDBContext(x)+6Ep ... mov edi, edi push edi mov edi, ecx test edi, edi jz short loc_A22760 mov eax, [edi+4] test eax, eax jz short loc_A22755 push ebx xor ebx, ebx cmp [edi], ebx jle short loc_A22745 push esi loc_A2271B: ; CODE XREF: AslHashFree(x)+3Dj mov ecx, [eax+ebx*4] mov edx, eax test ecx, ecx jz short loc_A2273D loc_A22724: ; CODE XREF: AslHashFree(x)+33j mov esi, [ecx+8] push 74705041h push ecx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov ecx, esi test esi, esi jnz short loc_A22724 mov eax, [edi+4] mov edx, eax loc_A2273D: ; CODE XREF: AslHashFree(x)+1Fj inc ebx cmp ebx, [edi] jl short loc_A2271B mov eax, edx pop esi loc_A22745: ; CODE XREF: AslHashFree(x)+15j pop ebx test eax, eax jz short loc_A22755 push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A22755: ; CODE XREF: AslHashFree(x)+Ej ; AslHashFree(x)+45j push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A22760: ; CODE XREF: AslHashFree(x)+7j pop edi retn _AslHashFree@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslPathCleanUstr(x) _AslPathCleanUstr@4 proc near ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+A2p var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 1Ch push ebx mov ebx, ecx push esi push edi push 2 movzx eax, word ptr [ebx] mov cx, ax shr cx, 1 movzx edx, cx mov [ebp+var_8], edx pop edx cmp ax, dx jb loc_A22A15 mov eax, [ebx+4] xor edx, edx cmp [eax], dx jz loc_A22A15 movzx edi, cx push 8 pop ecx cmp di, cx jb short loc_A227BA push ecx ; size_t push (offset loc_5A7307+1) ; wchar_t * push eax ; wchar_t * call __wcsnicmp add esp, 0Ch test eax, eax jnz short loc_A227BA push 5 jmp short loc_A227D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A227BA: ; CODE XREF: AslPathCleanUstr(x)+3Fj ; AslPathCleanUstr(x)+52j push 4 pop esi cmp di, si jb short loc_A22806 push esi ; size_t push offset ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2@FNODOBFM@ ; wchar_t * push dword ptr [ebx+4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jnz short loc_A227DC push 3 loc_A227D9: ; CODE XREF: AslPathCleanUstr(x)+56j pop esi jmp short loc_A22826 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A227DC: ; CODE XREF: AslPathCleanUstr(x)+73j push esi ; size_t push (offset loc_5A72FD+1) ; wchar_t * push dword ptr [ebx+4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jz short loc_A22826 push esi ; size_t push (offset loc_5A7319+1) ; wchar_t * push dword ptr [ebx+4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jz short loc_A22826 loc_A22806: ; CODE XREF: AslPathCleanUstr(x)+5Ej push 2 pop eax cmp di, ax jbe short loc_A22823 push eax ; size_t push (offset loc_5A7323+1) ; wchar_t * push dword ptr [ebx+4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jz short loc_A22826 loc_A22823: ; CODE XREF: AslPathCleanUstr(x)+AAj xor esi, esi inc esi loc_A22826: ; CODE XREF: AslPathCleanUstr(x)+78j ; AslPathCleanUstr(x)+8Dj ... movzx edx, word ptr [ebx] xor eax, eax push 5Ch mov [ebp+var_4], eax pop edi mov [ebp+var_14], 2Fh loc_A22838: ; CODE XREF: AslPathCleanUstr(x)+FDj movzx ecx, ax add ecx, ecx cmp ecx, edx jnb short loc_A22861 mov eax, [ebx+4] movzx eax, word ptr [ecx+eax] cmp ax, di jz short loc_A22855 push 2Fh pop ecx cmp ax, cx jnz short loc_A22856 loc_A22855: ; CODE XREF: AslPathCleanUstr(x)+E9j dec esi loc_A22856: ; CODE XREF: AslPathCleanUstr(x)+F1j mov eax, [ebp+var_4] inc eax mov [ebp+var_4], eax test esi, esi jg short loc_A22838 loc_A22861: ; CODE XREF: AslPathCleanUstr(x)+DDj movzx edi, ax movzx esi, ax mov [ebp+var_10], edi cmp ax, word ptr [ebp+var_8] jnb loc_A229DF mov [ebp+var_18], 2Eh loc_A2287B: ; CODE XREF: AslPathCleanUstr(x)+277j cmp di, si jb loc_A229F5 mov edx, [ebx+4] movzx eax, di push 5Ch mov [ebp+var_C], eax pop ecx movzx eax, word ptr [edx+eax*2] cmp ax, cx jz loc_A229B3 cmp ax, word ptr [ebp+var_14] jz loc_A229B3 cmp ax, word ptr [ebp+var_18] jnz loc_A229A5 mov eax, [ebp+var_8] movzx eax, ax mov [ebp+var_1C], eax mov eax, [ebp+var_C] inc eax cmp eax, [ebp+var_1C] jz loc_A229DF mov eax, [ebp+var_C] movzx eax, word ptr [edx+eax*2+2] cmp ax, cx mov ecx, [ebp+var_4] jz loc_A22974 cmp ax, word ptr [ebp+var_14] jz loc_A22974 cmp ax, word ptr [ebp+var_18] jnz loc_A229D1 mov eax, [ebp+var_C] add eax, 2 cmp eax, [ebp+var_1C] jz short loc_A22912 movzx eax, word ptr [edx+eax*2] push 5Ch pop edx cmp ax, dx jz short loc_A22912 push 2Fh pop edx cmp ax, dx jnz loc_A229D1 loc_A22912: ; CODE XREF: AslPathCleanUstr(x)+196j ; AslPathCleanUstr(x)+1A2j cmp si, cx jb short loc_A22973 loc_A22917: ; CODE XREF: AslPathCleanUstr(x)+1D9j mov ecx, [ebx+4] xor edi, edi movzx edx, si push 5Ch movzx eax, word ptr [ecx+edx*2] mov [ecx+edx*2], di mov edi, [ebp+var_4] pop ecx cmp ax, cx jz short loc_A2293D add esi, 0FFFFh cmp si, di jnb short loc_A22917 loc_A2293D: ; CODE XREF: AslPathCleanUstr(x)+1CEj cmp si, di mov edi, [ebp+var_10] jb short loc_A22973 loc_A22945: ; CODE XREF: AslPathCleanUstr(x)+207j mov ecx, [ebx+4] xor edi, edi movzx edx, si push 5Ch movzx eax, word ptr [ecx+edx*2] mov [ecx+edx*2], di mov edi, [ebp+var_4] pop ecx cmp ax, cx jz short loc_A2296B add esi, 0FFFFh cmp si, di jnb short loc_A22945 loc_A2296B: ; CODE XREF: AslPathCleanUstr(x)+1FCj cmp si, di mov edi, [ebp+var_10] jnb short loc_A22974 loc_A22973: ; CODE XREF: AslPathCleanUstr(x)+1B3j ; AslPathCleanUstr(x)+1E1j inc esi loc_A22974: ; CODE XREF: AslPathCleanUstr(x)+173j ; AslPathCleanUstr(x)+17Dj ... inc edi jmp short loc_A229D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22977: ; CODE XREF: AslPathCleanUstr(x)+247j mov edx, [ebx+4] movzx eax, di mov [ebp+var_1C], edx push 5Ch movzx edx, word ptr [edx+eax*2] pop eax cmp dx, ax jz short loc_A229AB push 2Fh pop eax cmp dx, ax jz short loc_A229AB cmp di, si jz short loc_A229A3 mov ecx, [ebp+var_1C] movzx eax, si mov [ecx+eax*2], dx loc_A229A3: ; CODE XREF: AslPathCleanUstr(x)+235j inc esi inc edi loc_A229A5: ; CODE XREF: AslPathCleanUstr(x)+149j cmp di, word ptr [ebp+var_8] jb short loc_A22977 loc_A229AB: ; CODE XREF: AslPathCleanUstr(x)+228j ; AslPathCleanUstr(x)+230j add edi, 0FFFFh jmp short loc_A229D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A229B3: ; CODE XREF: AslPathCleanUstr(x)+135j ; AslPathCleanUstr(x)+13Fj test si, si jz short loc_A229C7 movzx eax, si push 5Ch pop ecx cmp [edx+eax*2-2], cx jz short loc_A229D1 jmp short loc_A229C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A229C7: ; CODE XREF: AslPathCleanUstr(x)+254j xor eax, eax loc_A229C9: ; CODE XREF: AslPathCleanUstr(x)+263j push 5Ch pop ecx mov [edx+eax*2], cx inc esi loc_A229D1: ; CODE XREF: AslPathCleanUstr(x)+187j ; AslPathCleanUstr(x)+1AAj ... inc edi mov [ebp+var_10], edi cmp di, word ptr [ebp+var_8] jb loc_A2287B loc_A229DF: ; CODE XREF: AslPathCleanUstr(x)+10Cj ; AslPathCleanUstr(x)+15Fj mov eax, [ebx+4] xor edx, edx movzx ecx, si mov [eax+ecx*2], dx lea eax, [esi+esi] mov [ebx], ax xor eax, eax jmp short loc_A22A38 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A229F5: ; CODE XREF: AslPathCleanUstr(x)+11Cj push (offset loc_8C4E7A+4) push 2E9h push (offset loc_8C4EED+1) push 1 call AslLogCallPrintf add esp, 10h mov eax, 0C00000E5h jmp short loc_A22A38 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22A15: ; CODE XREF: AslPathCleanUstr(x)+22j ; AslPathCleanUstr(x)+30j push 0C00000F2h push (offset loc_8C4ECB+1) push 2DDh push (offset loc_8C4EED+1) push 1 call AslLogCallPrintf add esp, 14h mov eax, 0C00000F2h loc_A22A38: ; CODE XREF: AslPathCleanUstr(x)+291j ; AslPathCleanUstr(x)+2B1j pop edi pop esi pop ebx leave retn _AslPathCleanUstr@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslPathCombine(x, x, x, x) _AslPathCombine@16 proc near ; CODE XREF: SdbpGetPathAppPatchPreRS3(x,x,x,x)+F8p ; SdbpGetPathCustomSdbPreRS3(x,x,x,x)+DBp ... var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_8], 0 mov eax, ecx and [ebp+var_4], 0 push ebx mov ebx, [ebp+arg_4] mov [ebp+var_C], eax push edi mov edi, edx test ebx, ebx jnz short loc_A22A67 mov eax, 0C0000023h jmp loc_A22B4D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22A67: ; CODE XREF: AslPathCombine(x,x,x,x)+1Ej push esi lea ecx, [ebp+var_8] mov edx, 7FFFFFFFh push ecx mov ecx, eax call _RtlStringCchLengthW@12 ; RtlStringCchLengthW(x,x,x) mov esi, eax test esi, esi js loc_A22B30 lea eax, [ebp+var_4] mov edx, 7FFFFFFFh push eax mov ecx, edi call _RtlStringCchLengthW@12 ; RtlStringCchLengthW(x,x,x) mov esi, eax test esi, esi js loc_A22B30 mov ecx, [ebp+var_8] test ecx, ecx jnz short loc_A22AC4 cmp [ebp+var_4], ecx jnz short loc_A22AB5 mov eax, [ebp+arg_0] xor esi, esi mov [eax], cx jmp loc_A22B4A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22AB5: ; CODE XREF: AslPathCombine(x,x,x,x)+69j push edi loc_A22AB6: ; CODE XREF: AslPathCombine(x,x,x,x)+91j mov ecx, [ebp+arg_0] mov edx, ebx call RtlStringCchCopyW mov esi, eax jmp short loc_A22B2C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22AC4: ; CODE XREF: AslPathCombine(x,x,x,x)+64j cmp [ebp+var_4], 0 mov eax, [ebp+var_C] jnz short loc_A22AD0 push eax jmp short loc_A22AB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22AD0: ; CODE XREF: AslPathCombine(x,x,x,x)+8Ej push 5Ch xor ebx, ebx pop edx cmp [eax+ecx*2-2], dx setz bl cmp [edi], dx jnz short loc_A22AE3 inc ebx loc_A22AE3: ; CODE XREF: AslPathCombine(x,x,x,x)+A3j cmp ebx, 1 jbe short loc_A22AEC add edi, 2 dec ebx loc_A22AEC: ; CODE XREF: AslPathCombine(x,x,x,x)+A9j mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push eax call RtlStringCchCopyW mov esi, eax test esi, esi js short loc_A22B30 test ebx, ebx jnz short loc_A22B18 mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push offset ??_C@_13FPGAJAPJ@?$AA?2@NNGAKEGL@ call _RtlStringCchCatW@12 ; RtlStringCchCatW(x,x,x) mov esi, eax test esi, esi js short loc_A22B30 loc_A22B18: ; CODE XREF: AslPathCombine(x,x,x,x)+C3j mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push edi call _RtlStringCchCatW@12 ; RtlStringCchCatW(x,x,x) mov esi, eax test esi, esi js short loc_A22B30 xor esi, esi loc_A22B2C: ; CODE XREF: AslPathCombine(x,x,x,x)+85j test esi, esi jns short loc_A22B4A loc_A22B30: ; CODE XREF: AslPathCombine(x,x,x,x)+3Fj ; AslPathCombine(x,x,x,x)+59j ... push esi push offset ??_C@_0BN@EJJJFBGC@An?5RtlString?5API?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 593h push offset ??_C@_0P@HNMKLMPG@AslPathCombine@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A22B4A: ; CODE XREF: AslPathCombine(x,x,x,x)+73j ; AslPathCombine(x,x,x,x)+F1j mov eax, esi pop esi loc_A22B4D: ; CODE XREF: AslPathCombine(x,x,x,x)+25j pop edi pop ebx leave retn 8 _AslPathCombine@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __fastcall AslPathToSystemPathBuf(void *,int,int) _AslPathToSystemPathBuf@12 proc near ; CODE XREF: SdbpGetPathAppPatch(x,x,x,x)+80p ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+66p ... arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ebx push esi push edi mov edi, edx mov ebx, ecx lea eax, [edi+edi] push eax ; size_t push 0 ; int push ebx ; void * call _memset add esp, 0Ch mov edx, edi mov ecx, ebx push offset ??_C@_1BI@OMNCDEIM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt@NNGAKEGL@ call RtlStringCchCopyW mov esi, eax test esi, esi jns short loc_A22B9B push esi push (offset loc_8C4F19+1) push 5C6h push offset ??_C@_0BH@FBHBCBNC@AslPathToSystemPathBuf@NNGAKEGL@ push 1 call AslLogCallPrintf jmp short loc_A22BC9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22B9B: ; CODE XREF: AslPathToSystemPathBuf(x,x,x)+2Dj push [ebp+arg_0] mov edx, edi mov ecx, ebx call _RtlStringCchCatW@12 ; RtlStringCchCatW(x,x,x) mov esi, eax test esi, esi jns short loc_A22BCC push esi push offset ??_C@_0BK@PABECCHN@Failed?5to?5cat?5string?5?$FL?$CFx?$FN@NNGAKEGL@ push 5D7h push offset ??_C@_0BH@FBHBCBNC@AslPathToSystemPathBuf@NNGAKEGL@ push 1 call AslLogCallPrintf mov esi, 0C000000Dh loc_A22BC9: ; CODE XREF: AslPathToSystemPathBuf(x,x,x)+46j add esp, 14h loc_A22BCC: ; CODE XREF: AslPathToSystemPathBuf(x,x,x)+58j pop edi mov eax, esi pop esi pop ebx pop ebp retn 4 _AslPathToSystemPathBuf@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslPathWildcardFindClose(x) _AslPathWildcardFindClose@4 proc near ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+125p ; SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+20Ep var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push esi mov esi, ecx test esi, esi jz short loc_A22BFB mov eax, [esi] test eax, eax jz short loc_A22BFB cmp eax, 0FFFFFFFFh jz short loc_A22BF8 lea ecx, [ebp+var_4] mov [ebp+var_4], eax call _AslpPathWildcardFreeFindContext@4 ; AslpPathWildcardFreeFindContext(x) loc_A22BF8: ; CODE XREF: AslPathWildcardFindClose(x)+16j and dword ptr [esi], 0 loc_A22BFB: ; CODE XREF: AslPathWildcardFindClose(x)+Bj ; AslPathWildcardFindClose(x)+11j pop esi leave retn _AslPathWildcardFindClose@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; int __stdcall AslPathWildcardFindFirst(void *,int) _AslPathWildcardFindFirst@16 proc near ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+14Bp var_3C = dword ptr -3Ch var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 3Ch push ebx mov edx, ecx mov [ebp+var_10], edx push esi push edi test edx, edx jnz short loc_A22C1C mov eax, 0C00000EFh jmp loc_A2310F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22C1C: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+12j mov ebx, [ebp+arg_0] test ebx, ebx jz loc_A2310A xor eax, eax cmp [ebx], ax jz loc_A2310A mov ecx, [ebp+arg_4] test ecx, ecx jnz short loc_A22C43 mov eax, 0C00000F2h jmp loc_A2310F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22C43: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+39j and dword ptr [ecx], 0 lea edi, [ebp+var_3C] mov [ebp+var_14], eax mov [ebp+var_24], eax mov [ebp+var_20], eax mov [ebp+var_4], eax mov [ebp+var_8], eax mov [ebp+var_2C], eax mov [ebp+var_28], eax xor eax, eax stosd push ebx ; void * stosd stosd stosd xor eax, eax mov [edx], ax lea eax, [ebp+var_24] push eax ; int call RtlCreateUnicodeString test al, al jnz short loc_A22C9D push offset ??_C@_0BO@PAMJCGGK@RtlCreateUnicodeString?5failed@NNGAKEGL@ mov esi, 0C0000017h push 8C3h loc_A22C86: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+146j push (offset loc_8C4FB3+1) push 1 call AslLogCallPrintf add esp, 10h loc_A22C95: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+C7j ; AslPathWildcardFindFirst(x,x,x,x)+105j mov edi, [ebp+arg_4] jmp loc_A230D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22C9D: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+77j lea ecx, [ebp+var_24] call _AslPathCleanUstr@4 ; AslPathCleanUstr(x) mov esi, eax test esi, esi jns short loc_A22CC7 push esi push offset ??_C@_0BN@CGGIFPNM@AslPathCleanUstr?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 8D8h loc_A22CB6: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+E9j ; AslPathWildcardFindFirst(x,x,x,x)+127j ... push (offset loc_8C4FB3+1) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A22C95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22CC7: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+ABj mov ecx, [ebp+var_24] lea eax, [ebp+var_8] push eax push 4 pop edx call _RtlUShortAdd@12 ; RtlUShortAdd(x,x,x) mov esi, eax test esi, esi jns short loc_A22CE9 push esi push offset ??_C@_0BJ@MDGLKPJG@RtlUShortAdd?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 8DEh jmp short loc_A22CB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22CE9: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+DCj movzx esi, word ptr [ebp+var_8] push ecx mov edx, esi call _AslAlloc@12 ; AslAlloc(x,x,x) mov ecx, eax mov [ebp+var_4], ecx test ecx, ecx jnz short loc_A22D05 loc_A22CFE: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+1B6j mov esi, 0C0000017h jmp short loc_A22C95 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22D05: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+FEj movzx eax, word ptr [ebp+var_24] mov edx, esi push eax push [ebp+var_20] call _RtlStringCbCopyNW@16 ; RtlStringCbCopyNW(x,x,x,x) mov esi, eax test esi, esi jns short loc_A22D27 push esi push offset ??_C@_0BO@EGIGDNGO@RtlStringCbCopyNW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 8EAh jmp short loc_A22CB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22D27: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+11Aj mov esi, [ebp+var_4] mov ecx, esi call _AslpPathWildcardMakeLeaves@4 ; AslpPathWildcardMakeLeaves(x) test eax, eax jnz short loc_A22D49 push offset ??_C@_0CC@NDNNDPAJ@Failed?5to?5split?5the?5wildcard?5pa@NNGAKEGL@ mov esi, 0C0000039h push 8FCh jmp loc_A22C86 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22D49: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+135j cmp eax, 1 jnz short loc_A22DA4 mov edi, [ebp+arg_4] mov ecx, [ebp+var_20] or dword ptr [edi], 0FFFFFFFFh call _AslDoesFileExistNtPath@4 ; AslDoesFileExistNtPath(x) test eax, eax jnz short loc_A22D6A mov esi, 80000006h jmp loc_A230D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22D6A: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+160j mov ecx, [ebp+var_10] mov edx, 104h push ebx call RtlStringCchCopyW mov esi, eax test esi, esi jns short loc_A22D9D push esi push offset ??_C@_0BO@EGIGDNGO@RtlStringCbCopyNW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 90Eh push (offset loc_8C4FB3+1) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A230D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22D9D: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+17Ej xor esi, esi jmp loc_A230D4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22DA4: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+14Ej push ecx push 20h pop edx call _AslAlloc@12 ; AslAlloc(x,x,x) mov ebx, eax mov [ebp+var_14], ebx test ebx, ebx jz loc_A22CFE push 4 ; size_t push offset ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2@NNGAKEGL@ ; "\\??\\" push [ebp+arg_0] ; wchar_t * call _wcsncmp add esp, 0Ch lea edi, [ebx+8] neg eax sbb eax, eax neg eax mov [ebx], eax xor eax, eax mov [ebx+4], esi xor esi, esi push 6 pop ecx rep stosd lea edi, [ebx+8] mov [ebp+var_4], esi and [edi], eax and [edi+0Ch], esi and [edi+8], esi and [edi+14h], esi push 10h pop eax mov [edi+10h], eax mov [edi+4], eax mov eax, [edi+0Ch] cmp eax, 8 jb short loc_A22E0F mov esi, 80070057h jmp loc_A22EF2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22E0F: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+205j mov esi, [edi+10h] lea ecx, [esi+7] cmp ecx, 8 jb loc_A22EED and [ebp+var_8], 0 neg esi and [ebp+arg_0], 0 and esi, ecx mov ecx, [edi+4] mul ecx mov [ebp+var_C], ecx lea ecx, [ebp+var_8] push edx push eax mov [ebp+var_18], esi call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax jns short loc_A22E4D loc_A22E43: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+260j mov esi, 8000000Bh jmp loc_A22EE7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22E4D: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+243j mov eax, [ebp+var_C] lea ecx, [ebp+arg_0] mul esi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A22E43 mov eax, [edi+14h] mov [ebp+var_C], eax push 72615452h push [ebp+arg_0] push 1 test eax, eax jnz short loc_A22E8F call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A22EE2 push [ebp+arg_0] ; size_t push 0 ; int push esi ; void * call _memset add esp, 0Ch jmp short loc_A22ED1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22E8F: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+274j call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A22EE2 push [ebp+arg_0] ; size_t push 0 ; int push esi ; void * call _memset add esp, 0Ch test esi, esi jz short loc_A22EE2 mov eax, [ebp+var_8] cmp eax, [ebp+arg_0] jb short loc_A22EB7 mov eax, [ebp+arg_0] loc_A22EB7: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+2B4j push eax ; size_t push [ebp+var_C] ; void * push esi ; void * call _memcpy add esp, 0Ch push 72615452h push [ebp+var_C] call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A22ED1: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+28Fj test esi, esi jz short loc_A22EE2 mov eax, [ebp+var_18] mov [edi+14h], esi xor esi, esi mov [edi+0Ch], eax jmp short loc_A22EE7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22EE2: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+27Fj ; AslPathWildcardFindFirst(x,x,x,x)+29Aj ... mov esi, 8007000Eh loc_A22EE7: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+24Aj ; AslPathWildcardFindFirst(x,x,x,x)+2E2j test esi, esi jnz short loc_A22EF2 jmp short loc_A22F29 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22EED: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+21Aj mov esi, 8000000Bh loc_A22EF2: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+20Cj ; AslPathWildcardFindFirst(x,x,x,x)+2EBj mov eax, [edi+14h] test eax, eax jz short loc_A22F04 push 72615452h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A22F04: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+2F9j push 6 xor eax, eax pop ecx rep stosd test esi, esi jns short loc_A22F3D push esi push offset ??_C@_0BP@JCGJLENG@RtlArrayInitialize?5failed?5?$FL?$CFx?$FN@FNODOBFM@ push 86Bh push (offset loc_5A738F+3) push 1 call AslLogCallPrintf add esp, 14h loc_A22F29: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+2EDj test esi, esi jns short loc_A22F3D push esi push (offset loc_8C512D+1) push 934h jmp loc_A22CB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22F3D: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+30Fj ; AslPathWildcardFindFirst(x,x,x,x)+32Dj push dword ptr [ebx+4] lea eax, [ebp+var_2C] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) push 0 push 0 push 1 push dword ptr [ebx+4] lea edx, [ebp+var_2C] lea ecx, [ebp+var_3C] call _AslpPathWildcardAllocMatchNode@24 ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A22F73 push esi push (offset loc_8C50A3+1) push 941h jmp loc_A22CB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22F73: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+363j mov eax, [ebx+10h] mov edx, [ebx+14h] mov [ebp+var_1C], eax cmp eax, edx jb loc_A23070 lea ecx, [eax+1] cmp ecx, edx ja short loc_A22F95 mov esi, 80070057h jmp loc_A230A7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22F95: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+38Bj mov edi, [ebx+18h] dec edi lea eax, [edi+ecx] cmp eax, ecx jb loc_A230A2 mov esi, [ebx+0Ch] lea ecx, [ebp+var_C] and [ebp+var_C], 0 not edi and [ebp+arg_0], 0 and edi, eax mov eax, edx mov [ebp+var_8], edi mul esi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax jns short loc_A22FD2 loc_A22FC8: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+3E4j mov esi, 8000000Bh jmp loc_A2306C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A22FD2: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+3C8j mov eax, esi lea ecx, [ebp+arg_0] mul edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A22FC8 mov eax, [ebx+1Ch] mov [ebp+var_18], eax push 72615452h test eax, eax jnz short loc_A23013 push [ebp+arg_0] push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A23067 push [ebp+arg_0] ; size_t push 0 ; int push esi ; void * call _memset add esp, 0Ch jmp short loc_A23059 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23013: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+3F3j mov edi, [ebp+arg_0] push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A23067 push edi ; size_t push 0 ; int push esi ; void * call _memset add esp, 0Ch test esi, esi jz short loc_A23067 mov eax, [ebp+var_C] cmp eax, edi jb short loc_A2303D mov eax, edi loc_A2303D: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+43Bj mov edi, [ebp+var_18] push eax ; size_t push edi ; void * push esi ; void * call _memcpy add esp, 0Ch push 72615452h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [ebp+var_8] loc_A23059: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+413j test esi, esi jz short loc_A23067 mov [ebx+1Ch], esi xor esi, esi mov [ebx+14h], edi jmp short loc_A2306C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23067: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+403j ; AslPathWildcardFindFirst(x,x,x,x)+424j ... mov esi, 8007000Eh loc_A2306C: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+3CFj ; AslPathWildcardFindFirst(x,x,x,x)+467j test esi, esi jnz short loc_A230A9 loc_A23070: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+380j mov eax, [ebx+0Ch] lea ecx, [ebp+arg_0] mul [ebp+var_1C] and [ebp+arg_0], 0 push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A230A2 mov ecx, [ebx+1Ch] mov edi, [ebp+arg_0] add edi, ecx cmp edi, ecx jb short loc_A230A2 lea esi, [ebp+var_3C] movsd movsd movsd movsd inc dword ptr [ebx+10h] xor esi, esi jmp short loc_A230A7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A230A2: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+3A0j ; AslPathWildcardFindFirst(x,x,x,x)+488j ... mov esi, 8000000Bh loc_A230A7: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+392j ; AslPathWildcardFindFirst(x,x,x,x)+4A2j test esi, esi loc_A230A9: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+470j jns short loc_A230BB push esi push (offset loc_8C50E5+1) push 947h jmp loc_A22CB6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A230BB: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x):loc_A230A9j mov ecx, [ebp+var_10] lea edi, [ebp+var_3C] xor eax, eax stosd push ebx stosd stosd stosd mov edi, [ebp+arg_4] mov [edi], ebx call _AslPathWildcardFindNext@12 ; AslPathWildcardFindNext(x,x,x) mov esi, eax loc_A230D4: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+9Aj ; AslPathWildcardFindFirst(x,x,x,x)+167j ... lea eax, [ebp+var_24] push eax call _RtlFreeUTF8String@4 ; RtlFreeUTF8String(x) mov eax, [ebp+var_4] test eax, eax jz short loc_A230EF push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A230EF: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+4E4j test esi, esi jns short loc_A23106 lea ecx, [ebp+var_14] call _AslpPathWildcardFreeFindContext@4 ; AslpPathWildcardFreeFindContext(x) lea ecx, [ebp+var_3C] call _AslpPathWildcardFreeMatchNode@4 ; AslpPathWildcardFreeMatchNode(x) and dword ptr [edi], 0 loc_A23106: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+4F3j mov eax, esi jmp short loc_A2310F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2310A: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+23j ; AslPathWildcardFindFirst(x,x,x,x)+2Ej mov eax, 0C00000F1h loc_A2310F: ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+19j ; AslPathWildcardFindFirst(x,x,x,x)+40j ... pop edi pop esi pop ebx leave retn 8 _AslPathWildcardFindFirst@16 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslPathWildcardFindNext(x, x, x) _AslPathWildcardFindNext@12 proc near ; CODE XREF: SdbpCheckMatchingWildcardFiles(x,x,x,x,x,x,x)+1A1p ; AslPathWildcardFindFirst(x,x,x,x)+4CFp var_3C = dword ptr -3Ch var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp sub esp, 40h push ebx mov ebx, [ebp+arg_0] mov eax, ecx mov [ebp+var_1C], eax push esi push edi cmp ebx, 0FFFFFFFFh jnz short loc_A23138 mov eax, 80000006h jmp loc_A23294 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23138: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+16j test eax, eax jnz short loc_A23146 mov eax, 0C00000EFh jmp loc_A23294 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23146: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+24j test ebx, ebx jnz short loc_A23154 mov eax, 0C00000F1h jmp loc_A23294 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23154: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+32j xor eax, eax lea edi, [ebp+var_3C] mov [ebp+var_2C], eax mov edx, 268h mov [ebp+var_28], eax mov [ebp+var_24], eax mov [ebp+var_20], eax stosd push ecx stosd stosd stosd call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax mov [ebp+arg_0], esi test esi, esi jnz short loc_A23187 mov esi, 0C0000017h jmp loc_A23292 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23187: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+65j mov eax, [ebx+10h] cmp eax, 1 jb loc_A2327F mov edx, eax loc_A23195: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+163j lea ecx, [eax-1] xor eax, eax mov edi, eax cmp ecx, edx jnb short loc_A231CA mov [ebp+var_8], eax mov eax, [ebx+0Ch] mul ecx lea ecx, [ebp+var_8] push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A231C6 mov ecx, [ebx+1Ch] mov edi, [ebp+var_8] add edi, ecx cmp edi, ecx jb short loc_A231C6 xor eax, eax jmp short loc_A231CA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A231C6: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+9Ej ; AslPathWildcardFindNext(x,x,x)+AAj xor eax, eax mov edi, eax loc_A231CA: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+88j ; AslPathWildcardFindNext(x,x,x)+AEj test edi, edi jz loc_A23852 cmp [edi+0Ch], eax jnz loc_A233DC push (offset loc_8C5005+5) push 9CEh push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 1 call AslLogCallPrintf mov ecx, [ebx+10h] add esp, 10h cmp ecx, 1 jnb short loc_A23203 loc_A231FC: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+347j mov esi, 8000001Ah jmp short loc_A23254 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23203: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+E4j lea edx, [ecx-1] xor edi, edi mov eax, edi cmp edx, ecx jnb short loc_A23232 mov eax, [ebx+0Ch] lea ecx, [ebp+var_8] mul edx mov [ebp+var_8], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A23230 mov ecx, [ebx+1Ch] mov eax, [ebp+var_8] add eax, ecx cmp eax, ecx jnb short loc_A23232 loc_A23230: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+10Cj mov eax, edi loc_A23232: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+F6j ; AslPathWildcardFindNext(x,x,x)+118j test eax, eax jnz short loc_A2329B loc_A23236: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+37Ej push offset ??_C@_0CI@FJNDACIF@RtlArrayGet?5failed?5to?5get?5the?5n@FNODOBFM@ push 826h push offset ??_C@_0BJ@GPOAMCLL@AslpPathWildcardPeekNode@FNODOBFM@ push 1 mov esi, 0C00000E5h call AslLogCallPrintf add esp, 10h loc_A23254: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+EBj push esi push offset ??_C@_0CF@FHOJMFII@AslpPathWildcardPeekNode?5failed@FNODOBFM@ push 841h push offset ??_C@_0BI@JOOHLFOI@AslpPathWildcardPopNode@FNODOBFM@ push 1 call AslLogCallPrintf add esp, 14h loc_A2326E: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+1ACj ; AslPathWildcardFindNext(x,x,x)+1B8j ... mov esi, [ebp+arg_0] loc_A23271: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+194j ; AslPathWildcardFindNext(x,x,x)+393j ... mov eax, [ebx+10h] mov edx, eax cmp eax, 1 jnb loc_A23195 loc_A2327F: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+77j mov esi, 80000006h loc_A23284: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+67Dj mov edi, [ebp+arg_0] loc_A23287: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+72Ej ; AslPathWildcardFindNext(x,x,x)+737j push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A23292: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+6Cj mov eax, esi loc_A23294: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+1Dj ; AslPathWildcardFindNext(x,x,x)+2Bj ... pop edi pop esi pop ebx leave retn 4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2329B: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+11Ej mov ecx, eax call _AslpPathWildcardFreeMatchNode@4 ; AslpPathWildcardFreeMatchNode(x) mov eax, [ebx+10h] lea ecx, [eax-1] cmp ecx, eax jnb short loc_A23271 mov esi, [ebx+0Ch] mov eax, esi mul ecx lea ecx, [ebp+var_8] mov [ebp+var_8], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A2326E mov ecx, [ebx+1Ch] mov eax, [ebp+var_8] add eax, ecx cmp eax, ecx jb short loc_A2326E push esi ; size_t add eax, edi push edi ; int push eax ; void * call _memset add esp, 0Ch dec dword ptr [ebx+10h] mov edi, [ebx+10h] cmp edi, 10h jbe short loc_A2326E mov edx, [ebx+14h] mov eax, edx mov esi, [ebx+0Ch] imul eax, esi cmp eax, 400h jb loc_A2326E mov ecx, edx shr ecx, 2 cmp edi, ecx jnb loc_A2326E xor eax, eax lea ecx, [ebp+var_C] mov [ebp+var_C], eax mov edi, edx mov [ebp+var_8], eax mov eax, edx mul esi shr edi, 1 push edx push eax mov [ebp+var_14], edi call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js loc_A2326E mov eax, esi lea ecx, [ebp+var_8] mul edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js loc_A2326E mov eax, [ebx+1Ch] mov [ebp+var_10], eax push 72615452h test eax, eax jnz short loc_A2337A loc_A23355: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+44Cj push [ebp+var_8] push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz loc_A2326E push [ebp+var_8] ; size_t xor eax, eax push eax ; int push esi ; void * call _memset add esp, 0Ch jmp short loc_A233C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2337A: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+23Dj mov edi, [ebp+var_8] push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz loc_A2326E push edi ; size_t xor eax, eax push eax ; int push esi ; void * call _memset add esp, 0Ch test esi, esi jz loc_A2326E mov eax, [ebp+var_C] cmp eax, edi jb short loc_A233AD mov eax, edi loc_A233AD: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+293j mov edi, [ebp+var_10] push eax ; size_t push edi ; void * push esi ; void * call _memcpy add esp, 0Ch push 72615452h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [ebp+var_14] loc_A233C9: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+262j ; AslPathWildcardFindNext(x,x,x)+4A1j test esi, esi jz loc_A2326E mov [ebx+1Ch], esi mov [ebx+14h], edi jmp loc_A2326E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A233DC: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+BFj push dword ptr [edi+8] lea eax, [ebp+var_24] push eax call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) xor ecx, ecx lea eax, [ebp+var_24] push ecx push eax push 1 push 3 push 268h push esi lea eax, [ebp+var_2C] push eax push ecx push ecx push ecx push dword ptr [edi+0Ch] call _ZwQueryDirectoryFile@44 ; ZwQueryDirectoryFile(x,x,x,x,x,x,x,x,x,x,x) test eax, eax jns loc_A235BC cmp eax, 80000006h jz short loc_A23457 cmp eax, 0C000000Fh jz short loc_A23457 push eax push offset ??_C@_0DE@OOMHCHCG@NtQueryDirectoryFile?5failed?5to?5@NNGAKEGL@ push 9E6h push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h push [ebp+var_20] push dword ptr [edi+4] push offset ??_C@_0CA@NNDPHLIO@FilePath?3?5?8?$CFws?8?5?5Pattern?3?5?8?$CFws?8@NNGAKEGL@ push 9E7h push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 2 call AslLogCallPrintf add esp, 18h loc_A23457: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+2FFj ; AslPathWildcardFindNext(x,x,x)+306j mov ecx, [ebx+10h] cmp ecx, 1 jb loc_A231FC lea edx, [ecx-1] xor edi, edi mov eax, edi cmp edx, ecx jnb short loc_A23492 mov eax, [ebx+0Ch] lea ecx, [ebp+var_C] mul edx mov [ebp+var_C], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A23490 mov ecx, [ebx+1Ch] mov eax, [ebp+var_C] add eax, ecx cmp eax, ecx jnb short loc_A23492 loc_A23490: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+36Cj mov eax, edi loc_A23492: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+356j ; AslPathWildcardFindNext(x,x,x)+378j test eax, eax jz loc_A23236 mov ecx, eax call _AslpPathWildcardFreeMatchNode@4 ; AslpPathWildcardFreeMatchNode(x) mov eax, [ebx+10h] lea ecx, [eax-1] cmp ecx, eax jnb loc_A23271 mov esi, [ebx+0Ch] mov eax, esi mul ecx lea ecx, [ebp+var_C] mov [ebp+var_C], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js loc_A2326E mov ecx, [ebx+1Ch] mov eax, [ebp+var_C] add eax, ecx cmp eax, ecx jb loc_A2326E push esi ; size_t add eax, edi push edi ; int push eax ; void * call _memset add esp, 0Ch dec dword ptr [ebx+10h] mov edi, [ebx+10h] cmp edi, 10h jbe loc_A2326E mov edx, [ebx+14h] mov eax, edx mov esi, [ebx+0Ch] imul eax, esi cmp eax, 400h jb loc_A2326E mov ecx, edx shr ecx, 2 cmp edi, ecx jnb loc_A2326E xor eax, eax lea ecx, [ebp+var_C] mov [ebp+var_C], eax mov edi, edx mov [ebp+var_8], eax mov eax, edx mul esi shr edi, 1 push edx push eax mov [ebp+var_10], edi call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js loc_A2326E mov eax, esi lea ecx, [ebp+var_8] mul edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js loc_A2326E mov eax, [ebx+1Ch] mov [ebp+var_14], eax push 72615452h test eax, eax jz loc_A23355 mov edi, [ebp+var_8] push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz loc_A2326E push edi ; size_t xor eax, eax push eax ; int push esi ; void * call _memset add esp, 0Ch test esi, esi jz loc_A2326E mov eax, [ebp+var_C] cmp eax, edi jb short loc_A2359B mov eax, edi loc_A2359B: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+481j mov edi, [ebp+var_14] push eax ; size_t push edi ; void * push esi ; void * call _memcpy add esp, 0Ch push 72615452h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [ebp+var_10] jmp loc_A233C9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A235BC: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+2F4j mov eax, [esi+3Ch] push 2Eh pop edx cmp eax, 4 jnz short loc_A235D9 lea ecx, [esi+5Eh] cmp [ecx], dx jnz short loc_A235EE cmp [esi+60h], dx jz loc_A23271 loc_A235D9: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+4AFj lea ecx, [esi+5Eh] mov [ebp+var_C], ecx cmp eax, 2 jnz short loc_A235EE cmp [ecx], dx jnz short loc_A235F1 jmp loc_A23271 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A235EE: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+4B7j ; AslPathWildcardFindNext(x,x,x)+4CCj mov [ebp+var_C], ecx loc_A235F1: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+4D1j movzx eax, ax mov edx, edi push eax mov eax, [esi+38h] push ecx shr eax, 4 lea ecx, [ebp+var_3C] and eax, 1 push eax push dword ptr [edi+8] call _AslpPathWildcardAllocMatchNode@24 ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x) cmp eax, 0C0000273h jz loc_A237B7 cmp eax, 0C0000103h jz loc_A23271 cmp eax, 0C00000BAh jz loc_A23271 test eax, eax js loc_A23798 mov eax, [ebx+10h] mov edx, [ebx+14h] mov [ebp+var_18], eax cmp eax, edx jb loc_A23737 lea ecx, [eax+1] cmp ecx, edx ja short loc_A23658 mov esi, 80070057h jmp loc_A23771 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23658: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+536j mov edi, [ebx+18h] dec edi lea eax, [edi+ecx] cmp eax, ecx jb loc_A2376C mov esi, [ebx+0Ch] lea ecx, [ebp+var_C] not edi and edi, eax xor eax, eax mov [ebp+var_C], eax mov [ebp+var_8], eax mov eax, edx mul esi mov [ebp+var_10], edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax jns short loc_A23695 loc_A2368B: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+58Fj mov esi, 8000000Bh jmp loc_A23733 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23695: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+573j mov eax, esi lea ecx, [ebp+var_8] mul edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A2368B mov eax, [ebx+1Ch] mov [ebp+var_14], eax push 72615452h test eax, eax jnz short loc_A236D7 push [ebp+var_8] push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A2372E push [ebp+var_8] ; size_t xor eax, eax push eax ; int push esi ; void * call _memset add esp, 0Ch jmp short loc_A2371E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A236D7: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+59Ej mov edi, [ebp+var_8] push edi push 1 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x) mov esi, eax test esi, esi jz short loc_A2372E push edi ; size_t xor eax, eax push eax ; int push esi ; void * call _memset add esp, 0Ch test esi, esi jz short loc_A2372E mov eax, [ebp+var_C] cmp eax, edi jb short loc_A23702 mov eax, edi loc_A23702: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+5E8j mov edi, [ebp+var_14] push eax ; size_t push edi ; void * push esi ; void * call _memcpy add esp, 0Ch push 72615452h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov edi, [ebp+var_10] loc_A2371E: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+5BFj test esi, esi jz short loc_A2372E xor eax, eax mov [ebx+1Ch], esi mov [ebx+14h], edi mov esi, eax jmp short loc_A23733 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2372E: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+5AEj ; AslPathWildcardFindNext(x,x,x)+5D0j ... mov esi, 8007000Eh loc_A23733: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+57Aj ; AslPathWildcardFindNext(x,x,x)+616j test esi, esi jnz short loc_A23773 loc_A23737: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+52Bj xor eax, eax lea ecx, [ebp+var_C] mov [ebp+var_C], eax mov eax, [ebx+0Ch] mul [ebp+var_18] push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A2376C mov ecx, [ebx+1Ch] mov edi, [ebp+var_C] add edi, ecx cmp edi, ecx jb short loc_A2376C lea esi, [ebp+var_3C] movsd movsd movsd movsd inc dword ptr [ebx+10h] xor eax, eax mov esi, eax jmp short loc_A23771 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2376C: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+54Bj ; AslPathWildcardFindNext(x,x,x)+638j ... mov esi, 8000000Bh loc_A23771: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+53Dj ; AslPathWildcardFindNext(x,x,x)+654j test esi, esi loc_A23773: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+61Fj jns loc_A2326E push esi push (offset loc_8C50E5+1) push 0A18h loc_A23784: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+6C8j ; AslPathWildcardFindNext(x,x,x)+6F9j ... push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A23284 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23798: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+51Aj push eax push offset ??_C@_0CL@HJAMGFDB@AslpPathWildcardAllocMatchNode?5@NNGAKEGL@ push 0A20h push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A23271 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A237B7: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+4FCj movzx eax, word ptr [edi] mov edx, 208h mov ebx, [ebp+var_1C] mov ecx, ebx push eax push dword ptr [edi+4] call _RtlStringCbCopyNW@16 ; RtlStringCbCopyNW(x,x,x,x) mov esi, eax test esi, esi jns short loc_A237E0 push esi push offset ??_C@_0BO@EGIGDNGO@RtlStringCbCopyNW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 0A30h jmp short loc_A23784 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A237E0: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+6BBj movzx ecx, word ptr [edi] mov eax, [edi+4] shr ecx, 1 cmp word ptr [eax+ecx*2-2], 5Ch jz short loc_A23814 push 2 push offset ??_C@_13FPGAJAPJ@?$AA?2@NNGAKEGL@ mov ecx, ebx call _RtlStringCbCatNW@16 ; RtlStringCbCatNW(x,x,x,x) mov esi, eax test esi, esi jns short loc_A23814 push esi push (offset loc_8C51DD+1) push 0A37h jmp loc_A23784 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23814: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+6D8j ; AslPathWildcardFindNext(x,x,x)+6ECj mov edi, [ebp+arg_0] mov ecx, ebx push dword ptr [edi+3Ch] push [ebp+var_C] call _RtlStringCbCatNW@16 ; RtlStringCbCatNW(x,x,x,x) mov esi, eax test esi, esi jns short loc_A23849 push esi push (offset loc_8C51DD+1) push 0A3Eh push offset ??_C@_0BI@KNFLDNF@AslPathWildcardFindNext@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A23287 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23849: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+712j xor eax, eax mov esi, eax jmp loc_A23287 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23852: ; CODE XREF: AslPathWildcardFindNext(x,x,x)+B6j push offset ??_C@_0CI@FJNDACIF@RtlArrayGet?5failed?5to?5get?5the?5n@FNODOBFM@ push 826h push offset ??_C@_0BJ@GPOAMCLL@AslpPathWildcardPeekNode@FNODOBFM@ push 1 call AslLogCallPrintf add esp, 10h mov esi, 0C00000E5h push esi push (offset loc_8C5065+1) push 9C9h jmp loc_A23784 _AslPathWildcardFindNext@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslRegWildcardFindClose(x) _AslRegWildcardFindClose@4 proc near ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+6Dp ; AslRegWildcardFindFirst(x,x,x)+74p mov edi, edi push edi mov edi, ecx test edi, edi jz short loc_A238D4 push ebx mov ebx, [edi] cmp ebx, edi jz short loc_A238B6 push esi loc_A23891: ; CODE XREF: AslRegWildcardFindClose(x)+33j mov eax, [ebx+10h] test eax, eax jz short loc_A238A2 push eax call _ZwClose@4 ; ZwClose(x) and dword ptr [ebx+10h], 0 loc_A238A2: ; CODE XREF: AslRegWildcardFindClose(x)+16j mov esi, [ebx] push 74705041h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) mov ebx, esi cmp esi, edi jnz short loc_A23891 pop esi loc_A238B6: ; CODE XREF: AslRegWildcardFindClose(x)+Ej mov eax, [edi+0Ch] pop ebx test eax, eax jz short loc_A238C9 push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A238C9: ; CODE XREF: AslRegWildcardFindClose(x)+3Cj push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A238D4: ; CODE XREF: AslRegWildcardFindClose(x)+7j pop edi retn _AslRegWildcardFindClose@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslRegWildcardFindFirst(x, x, x) _AslRegWildcardFindFirst@12 proc near ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+28p var_4 = dword ptr -4 arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi mov ebx, edx mov [ebp+var_4], ecx push ecx push 10h xor edi, edi pop edx mov [ebx], edi call _AslAlloc@12 ; AslAlloc(x,x,x) mov esi, eax test esi, esi jnz short loc_A238FF mov eax, 0C0000017h jmp short loc_A23951 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A238FF: ; CODE XREF: AslRegWildcardFindFirst(x,x,x)+20j mov edx, [ebp+arg_0] lea ecx, [esi+0Ch] mov [esi+8], edi mov [esi+0Ch], edi mov [esi+4], esi mov [esi], esi call AslStringDuplicate mov edi, eax test edi, edi js short loc_A23944 mov ecx, [esi+0Ch] mov edx, esi call _AslpParsePattern@8 ; AslpParsePattern(x,x) mov edi, eax test edi, edi js short loc_A23944 mov eax, [esi] mov edx, esi mov ecx, [ebp+var_4] mov [esi+8], eax call _AslRegWildcardFindNext@8 ; AslRegWildcardFindNext(x,x) mov edi, eax test edi, edi js short loc_A23944 mov [ebx], esi xor esi, esi loc_A23944: ; CODE XREF: AslRegWildcardFindFirst(x,x,x)+43j ; AslRegWildcardFindFirst(x,x,x)+53j ... test esi, esi jz short loc_A2394F mov ecx, esi call _AslRegWildcardFindClose@4 ; AslRegWildcardFindClose(x) loc_A2394F: ; CODE XREF: AslRegWildcardFindFirst(x,x,x)+70j mov eax, edi loc_A23951: ; CODE XREF: AslRegWildcardFindFirst(x,x,x)+27j pop edi pop esi pop ebx leave retn 4 _AslRegWildcardFindFirst@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslRegWildcardFindNext(x, x) _AslRegWildcardFindNext@8 proc near ; CODE XREF: SdbpCheckMatchingWildcardRegistryEntry(x,x,x,x,x,x,x,x,x,x)+60p ; AslRegWildcardFindFirst(x,x,x)+5Fp mov edi, edi push ebx push esi push edi mov edi, edx mov ebx, ecx mov esi, [edi+8] test esi, esi jnz short loc_A2398D mov eax, 8000001Ah loc_A2396D: ; CODE XREF: AslRegWildcardFindNext(x,x)+45j pop edi pop esi pop ebx retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23971: ; CODE XREF: AslRegWildcardFindNext(x,x)+37j mov edx, edi mov ecx, esi call _AslpProcessMatchRegNode@8 ; AslpProcessMatchRegNode(x,x) mov ecx, eax test ecx, ecx js short loc_A2398A mov eax, [esi] cmp eax, edi jz short loc_A2399F mov esi, eax jmp short loc_A2398D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2398A: ; CODE XREF: AslRegWildcardFindNext(x,x)+26j mov esi, [esi+4] loc_A2398D: ; CODE XREF: AslRegWildcardFindNext(x,x)+Ej ; AslRegWildcardFindNext(x,x)+30j cmp esi, edi jnz short loc_A23971 mov ecx, 8000001Ah xor esi, esi loc_A23998: ; CODE XREF: AslRegWildcardFindNext(x,x)+4Cj mov [edi+8], esi mov eax, ecx jmp short loc_A2396D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2399F: ; CODE XREF: AslRegWildcardFindNext(x,x)+2Cj mov eax, [esi+10h] mov [ebx], eax jmp short loc_A23998 _AslRegWildcardFindNext@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpAllocMatchNode(x, x, x) _AslpAllocMatchNode@12 proc near ; CODE XREF: AslpParsePattern(x,x)+43p ; AslpParsePattern(x,x)+74p arg_0 = dword ptr 8 mov edi, edi push ebp mov ebp, esp push esi push edi push ecx push 18h mov esi, edx mov edi, ecx pop edx call _AslAlloc@12 ; AslAlloc(x,x,x) test eax, eax jnz short loc_A239C5 mov ecx, 0C0000017h jmp short loc_A239F1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A239C5: ; CODE XREF: AslpAllocMatchNode(x,x,x)+16j mov edx, [ebp+arg_0] xor ecx, ecx mov [eax+4], eax mov [eax], eax mov [eax+14h], ecx mov [eax+10h], ecx mov [eax+0Ch], esi mov [eax+8], edi mov esi, [edx] cmp [esi+4], edx jz short loc_A239E7 push 3 pop ecx int 29h ; DOS 2+ internal - FAST PUTCHAR ; AL = character to display loc_A239E7: ; CODE XREF: AslpAllocMatchNode(x,x,x)+3Aj mov [eax], esi mov [eax+4], edx mov [esi+4], eax mov [edx], eax loc_A239F1: ; CODE XREF: AslpAllocMatchNode(x,x,x)+1Dj pop edi mov eax, ecx pop esi pop ebp retn 4 _AslpAllocMatchNode@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpParsePattern(x, x) _AslpParsePattern@8 proc near ; CODE XREF: AslRegWildcardFindFirst(x,x,x)+4Ap mov edi, edi push ebx push esi push edi mov edi, ecx mov ebx, edx mov esi, edi xor edx, edx lea ecx, [esi+2] loc_A23A09: ; CODE XREF: AslpParsePattern(x,x)+19j mov ax, [esi] add esi, 2 cmp ax, dx jnz short loc_A23A09 sub esi, ecx sar esi, 1 xor al, al lea edx, [edi+esi*2] lea esi, [edx-2] jmp short loc_A23A59 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23A22: ; CODE XREF: AslpParsePattern(x,x)+62j movzx ecx, word ptr [esi] cmp ecx, 2Ah jz short loc_A23A54 cmp ecx, 3Fh jz short loc_A23A54 cmp ecx, 5Ch jnz short loc_A23A56 test al, al jz short loc_A23A50 push ebx lea ecx, [esi+2] call _AslpAllocMatchNode@12 ; AslpAllocMatchNode(x,x,x) test eax, eax js short loc_A23A72 xor eax, eax mov edx, esi mov [esi], ax xor al, al jmp short loc_A23A56 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23A50: ; CODE XREF: AslpParsePattern(x,x)+3Dj mov edx, esi jmp short loc_A23A56 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23A54: ; CODE XREF: AslpParsePattern(x,x)+2Fj ; AslpParsePattern(x,x)+34j mov al, 1 loc_A23A56: ; CODE XREF: AslpParsePattern(x,x)+39j ; AslpParsePattern(x,x)+55j ... sub esi, 2 loc_A23A59: ; CODE XREF: AslpParsePattern(x,x)+27j cmp esi, edi ja short loc_A23A22 test al, al jnz short loc_A23A63 mov edx, esi loc_A23A63: ; CODE XREF: AslpParsePattern(x,x)+66j movzx ecx, al neg ecx push ebx sbb ecx, ecx and ecx, esi call _AslpAllocMatchNode@12 ; AslpAllocMatchNode(x,x,x) loc_A23A72: ; CODE XREF: AslpParsePattern(x,x)+4Aj pop edi pop esi pop ebx retn _AslpParsePattern@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpPathWildcardAllocMatchNode(x, x, x, x, x, x) _AslpPathWildcardAllocMatchNode@24 proc near ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+35Ap ; AslPathWildcardFindNext(x,x,x)+4F2p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h mov edi, edi push ebp mov ebp, esp sub esp, 24h push ebx push esi push edi xor eax, eax mov [ebp+var_4], edx mov ebx, ecx lea edi, [ebp+var_24] push 6 pop ecx rep stosd mov edi, ebx xor ecx, ecx mov [ebp+var_C], ecx mov [ebp+var_8], ecx stosd stosd stosd stosd mov eax, [ebp+arg_0] jmp short loc_A23AA6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23AA3: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+36j add eax, 2 loc_A23AA6: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+2Bj mov [ebx+8], eax cmp [eax], cx jnz short loc_A23AA3 add eax, 2 mov [ebx+8], eax cmp [eax], cx jnz short loc_A23AD1 mov esi, [ebp+arg_4] neg esi sbb esi, esi and esi, 0FFFFFE47h add esi, 0C0000273h jmp loc_A23C24 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23AD1: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+41j cmp [ebp+arg_4], ecx jnz short loc_A23AE0 mov esi, 0C0000103h jmp loc_A23C28 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23AE0: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+5Ej movzx ecx, word ptr [edx] lea eax, [ebp+arg_4] mov edi, [ebp+arg_C] mov edx, edi push eax mov [ebp+arg_4], ecx call _RtlUShortAdd@12 ; RtlUShortAdd(x,x,x) mov esi, eax test esi, esi jns short loc_A23B0A push esi push offset ??_C@_0BJ@MDGLKPJG@RtlUShortAdd?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 0B4Dh jmp loc_A23C15 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23B0A: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+82j mov ecx, [ebp+arg_4] lea eax, [ebp+arg_4] push eax push 4 pop edx call _RtlUShortAdd@12 ; RtlUShortAdd(x,x,x) mov esi, eax test esi, esi jns short loc_A23B2F push esi push offset ??_C@_0BJ@MDGLKPJG@RtlUShortAdd?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 0B53h jmp loc_A23C15 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23B2F: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+A7j mov eax, [ebp+arg_4] xor ecx, ecx push ecx movzx edx, ax mov [ebx+2], ax mov [ebx], cx call _AslAlloc@12 ; AslAlloc(x,x,x) mov [ebx+4], eax test eax, eax jnz short loc_A23B55 mov esi, 0C0000017h jmp loc_A23C28 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23B55: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+D3j mov edx, [ebp+var_4] mov ecx, ebx call _RtlUnicodeStringCopy@8 ; RtlUnicodeStringCopy(x,x) mov esi, eax test esi, esi jns short loc_A23B75 push esi push (offset loc_8C5195+1) push 0B62h jmp loc_A23C15 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23B75: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+EDj movzx ecx, word ptr [ebx] mov eax, [ebx+4] shr ecx, 1 cmp word ptr [eax+ecx*2-2], 5Ch jz short loc_A23BA4 mov edx, offset ??_C@_13FPGAJAPJ@?$AA?2@NNGAKEGL@ mov ecx, ebx call _RtlUnicodeStringCatString@8 ; RtlUnicodeStringCatString(x,x) mov esi, eax test esi, esi jns short loc_A23BA4 push esi push offset ??_C@_0CG@LPADCGAM@RtlUnicodeStringCatString?5faile@NNGAKEGL@ push 0B72h jmp short loc_A23C15 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23BA4: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+10Dj ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+11Fj mov edx, [ebp+arg_8] test edx, edx jz short loc_A23BCE test di, di jz short loc_A23BCE movzx eax, di mov ecx, ebx push eax call _RtlUnicodeStringCbCatStringN@12 ; RtlUnicodeStringCbCatStringN(x,x,x) mov esi, eax test esi, esi jns short loc_A23BCE push esi push (offset loc_8C5153+1) push 0B7Ah jmp short loc_A23C15 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23BCE: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+133j ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+138j ... xor eax, eax mov [ebp+var_24], 18h push 21h mov [ebp+var_20], eax mov [ebp+var_14], eax mov [ebp+var_10], eax lea eax, [ebp+var_C] push 1 push eax lea eax, [ebp+var_24] mov [ebp+var_18], 240h push eax push 100001h lea eax, [ebx+0Ch] mov [ebp+var_1C], ebx push eax call _ZwOpenFile@24 ; ZwOpenFile(x,x,x,x,x,x) mov esi, eax test esi, esi jns short loc_A23C2F push esi push offset ??_C@_0BI@LPPODAJD@Failed?5to?5open?5dir?5?$FL?$CFx?$FN@NNGAKEGL@ push 0B88h loc_A23C15: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+8Fj ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+B4j ... push offset ??_C@_0BP@NAHNFMLD@AslpPathWildcardAllocMatchNode@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A23C24: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+56j test esi, esi jns short loc_A23C2F loc_A23C28: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+65j ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+DAj mov ecx, ebx call _AslpPathWildcardFreeMatchNode@4 ; AslpPathWildcardFreeMatchNode(x) loc_A23C2F: ; CODE XREF: AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+192j ; AslpPathWildcardAllocMatchNode(x,x,x,x,x,x)+1B0j pop edi mov eax, esi pop esi pop ebx leave retn 10h _AslpPathWildcardAllocMatchNode@24 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpPathWildcardFreeFindContext(x) _AslpPathWildcardFreeFindContext@4 proc near ; CODE XREF: AslPathWildcardFindClose(x)+1Ep ; AslPathWildcardFindFirst(x,x,x,x)+4F8p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ebx mov ebx, ecx test ebx, ebx jz loc_A23CD6 push esi mov esi, [ebx] test esi, esi jz loc_A23CD5 mov ecx, [esi+10h] push edi xor edi, edi test ecx, ecx jz short loc_A23C97 loc_A23C5E: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+5Dj xor eax, eax cmp edi, ecx jnb short loc_A23C88 and [ebp+var_4], eax lea ecx, [ebp+var_4] mov eax, [esi+0Ch] mul edi push edx push eax call _ULongLongToULong@12 ; ULongLongToULong(x,x,x) test eax, eax js short loc_A23C86 mov ecx, [esi+1Ch] mov eax, [ebp+var_4] add eax, ecx cmp eax, ecx jnb short loc_A23C88 loc_A23C86: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+40j xor eax, eax loc_A23C88: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+2Aj ; AslpPathWildcardFreeFindContext(x)+4Cj mov ecx, eax call _AslpPathWildcardFreeMatchNode@4 ; AslpPathWildcardFreeMatchNode(x) mov ecx, [esi+10h] inc edi cmp edi, ecx jb short loc_A23C5E loc_A23C97: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+24j lea edi, [esi+8] mov eax, [edi+14h] test eax, eax jz short loc_A23CAC push 72615452h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A23CAC: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+67j push 6 xor eax, eax pop ecx rep stosd mov eax, [esi+4] mov edi, 74705041h test eax, eax jz short loc_A23CCA push edi push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and dword ptr [esi+4], 0 loc_A23CCA: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+85j push edi push esi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and dword ptr [ebx], 0 pop edi loc_A23CD5: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+16j pop esi loc_A23CD6: ; CODE XREF: AslpPathWildcardFreeFindContext(x)+Bj pop ebx leave retn _AslpPathWildcardFreeFindContext@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpPathWildcardFreeMatchNode(x) _AslpPathWildcardFreeMatchNode@4 proc near ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+500p ; AslPathWildcardFindNext(x,x,x)+187p ... mov edi, edi push esi mov esi, ecx test esi, esi jz short loc_A23D0D mov eax, [esi+0Ch] test eax, eax jz short loc_A23CF3 push eax call _ZwClose@4 ; ZwClose(x) and dword ptr [esi+0Ch], 0 loc_A23CF3: ; CODE XREF: AslpPathWildcardFreeMatchNode(x)+Ej mov eax, [esi+4] test eax, eax jz short loc_A23D09 push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) and dword ptr [esi+4], 0 loc_A23D09: ; CODE XREF: AslpPathWildcardFreeMatchNode(x)+1Fj and dword ptr [esi+8], 0 loc_A23D0D: ; CODE XREF: AslpPathWildcardFreeMatchNode(x)+7j pop esi retn _AslpPathWildcardFreeMatchNode@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpPathWildcardMakeLeaves(x) _AslpPathWildcardMakeLeaves@4 proc near ; CODE XREF: AslPathWildcardFindFirst(x,x,x,x)+12Ep var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi mov edi, ecx test edi, edi jz loc_A23E87 xor ebx, ebx cmp [edi], bx jz loc_A23E87 push edi lea eax, [ebp+var_8] mov [ebp+var_8], ebx push eax mov [ebp+var_4], ebx call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x) mov ecx, [ebp+var_8] push 2 pop eax cmp cx, ax jb loc_A23E69 mov eax, [ebp+var_4] cmp [eax], bx jz loc_A23E69 shr cx, 1 movzx esi, cx push 8 pop ecx cmp si, cx jb short loc_A23D81 push ecx ; size_t push (offset loc_5A7307+1) ; wchar_t * push eax ; wchar_t * call __wcsnicmp add esp, 0Ch test eax, eax jnz short loc_A23D7E push 0FFFFFFFCh jmp short loc_A23DEC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23D7E: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+69j mov eax, [ebp+var_4] loc_A23D81: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+56j push 4 pop ecx cmp si, cx jb short loc_A23DCF push ecx ; size_t push offset ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2@FNODOBFM@ ; wchar_t * push eax ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jnz short loc_A23DA0 push 0FFFFFFFEh jmp short loc_A23DEC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23DA0: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+8Bj push 4 ; size_t push (offset loc_5A72FD+1) ; wchar_t * push [ebp+var_4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jz short loc_A23DEA push 4 ; size_t push (offset loc_5A7319+1) ; wchar_t * push [ebp+var_4] ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jz short loc_A23DEA mov eax, [ebp+var_4] loc_A23DCF: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+78j push 2 pop ecx cmp si, cx jbe short loc_A23DEF push ecx ; size_t push (offset loc_5A7323+1) ; wchar_t * push eax ; wchar_t * call _wcsncmp add esp, 0Ch test eax, eax jnz short loc_A23DEF loc_A23DEA: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+A5j ; AslpPathWildcardMakeLeaves(x)+BBj push 0FFFFFFFDh loc_A23DEC: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+6Dj ; AslpPathWildcardMakeLeaves(x)+8Fj pop esi jmp short loc_A23DF1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23DEF: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+C6j ; AslpPathWildcardMakeLeaves(x)+D9j mov esi, ebx loc_A23DF1: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+DEj movzx eax, word ptr [edi] mov ecx, edi test ax, ax jz short loc_A23E1E push 5Ch mov edx, eax pop ebx loc_A23E00: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+10Bj cmp dx, bx jnz short loc_A23E0F test esi, esi js short loc_A23E0E xor eax, eax mov [ecx], ax loc_A23E0E: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+F8j inc esi loc_A23E0F: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+F4j add ecx, 2 movzx eax, word ptr [ecx] mov edx, eax test ax, ax jnz short loc_A23E00 xor ebx, ebx loc_A23E1E: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+EAj xor eax, eax mov [ecx+2], ax movzx eax, word ptr [edi] test ax, ax jz short loc_A23E60 loc_A23E2C: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+14Fj test ax, ax jz short loc_A23E39 loc_A23E31: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+128j add edi, 2 cmp [edi], bx jnz short loc_A23E31 loc_A23E39: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+120j lea ebx, [edi+2] xor eax, eax cmp [ebx], ax jz short loc_A23E60 mov ecx, ebx call _AslStringHasWildcard@4 ; AslStringHasWildcard(x) test eax, eax jnz short loc_A23E60 push 5Ch pop edx xor ecx, ecx mov [edi], dx dec esi mov eax, edx cmp [ebx], cx push ecx pop ebx jnz short loc_A23E2C loc_A23E60: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+11Bj ; AslpPathWildcardMakeLeaves(x)+132j ... add esi, 1 js short loc_A23E87 mov eax, esi jmp short loc_A23E89 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23E69: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+38j ; AslpPathWildcardMakeLeaves(x)+44j push 0C00000F2h push (offset loc_8C4ECB+1) push 0BE5h push offset ??_C@_0BL@DFNMDNKJ@AslpPathWildcardMakeLeaves@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A23E87: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+Ej ; AslpPathWildcardMakeLeaves(x)+19j ... xor eax, eax loc_A23E89: ; CODE XREF: AslpPathWildcardMakeLeaves(x)+158j pop edi pop esi pop ebx leave retn _AslpPathWildcardMakeLeaves@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpProcessMatchRegNode(x, x) _AslpProcessMatchRegNode@8 proc near ; CODE XREF: AslRegWildcardFindNext(x,x)+1Dp var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx mov ebx, ecx push esi push edi cmp [ebx+4], edx jnz short loc_A23ED5 lea esi, [ebx+10h] mov eax, [esi] test eax, eax jnz short loc_A23EC2 mov edx, [ebx+0Ch] push ecx push 1 push 20019h mov ecx, esi call AslRegistryGetKey mov esi, eax jmp loc_A23FBA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23EC2: ; CODE XREF: AslpProcessMatchRegNode(x,x)+19j push eax call _ZwClose@4 ; ZwClose(x) and dword ptr [esi], 0 mov esi, 8000001Ah jmp loc_A23FBA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23ED5: ; CODE XREF: AslpProcessMatchRegNode(x,x)+10j mov ecx, [ebx+0Ch] xor eax, eax mov word ptr [ebp+var_C], ax xor esi, esi lea edx, [ecx+2] loc_A23EE3: ; CODE XREF: AslpProcessMatchRegNode(x,x)+5Ej mov ax, [ecx] add ecx, 2 cmp ax, si jnz short loc_A23EE3 sub ecx, edx sar ecx, 1 push ecx lea eax, ds:20Ah[ecx*2] movzx edx, ax mov word ptr [ebp+var_C+2], ax call _AslAlloc@12 ; AslAlloc(x,x,x) mov ecx, [ebx+4] mov edi, eax mov [ebp+var_8], edi mov eax, [ecx+10h] mov [ebp+var_4], eax loc_A23F14: ; CODE XREF: AslpProcessMatchRegNode(x,x)+BFj ; AslpProcessMatchRegNode(x,x)+113j xor ecx, ecx mov [edi], cx mov ecx, edi push dword ptr [ebx+14h] push eax call _AslRegistryEnumKey@16 ; AslRegistryEnumKey(x,x,x,x) mov esi, eax test esi, esi js short loc_A23FA6 mov eax, [ebx+0Ch] xor ecx, ecx inc dword ptr [ebx+14h] mov edx, edi movzx esi, word ptr [eax] mov [eax], cx mov ecx, [ebx+8] call AslStringPatternMatchW mov ecx, [ebx+0Ch] test eax, eax mov eax, [ebp+var_4] mov [ecx], si jz short loc_A23F14 lea ecx, [edi+2] xor edx, edx loc_A23F54: ; CODE XREF: AslpProcessMatchRegNode(x,x)+CFj mov ax, [edi] add edi, 2 cmp ax, dx jnz short loc_A23F54 push dword ptr [ebx+0Ch] ; void * sub edi, ecx sar edi, 1 lea eax, [edi+edi] mov word ptr [ebp+var_C], ax lea eax, [ebp+var_C] push eax ; int call _RtlAppendUnicodeToString@8 ; RtlAppendUnicodeToString(x,x) lea esi, [ebx+10h] mov eax, [esi] test eax, eax jz short loc_A23F89 push eax call _ZwClose@4 ; ZwClose(x) xor eax, eax mov [esi], eax loc_A23F89: ; CODE XREF: AslpProcessMatchRegNode(x,x)+EFj mov edi, [ebp+var_8] mov edx, [ebp+var_4] push ecx push edi mov ecx, esi call _AslRegistryOpenSubKey@16 ; AslRegistryOpenSubKey(x,x,x,x) mov esi, eax test esi, esi jns short loc_A23FAB mov eax, [ebp+var_4] jmp loc_A23F14 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A23FA6: ; CODE XREF: AslpProcessMatchRegNode(x,x)+9Aj xor eax, eax mov [ebx+14h], eax loc_A23FAB: ; CODE XREF: AslpProcessMatchRegNode(x,x)+10Ej test edi, edi jz short loc_A23FBA push 74705041h push edi call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A23FBA: ; CODE XREF: AslpProcessMatchRegNode(x,x)+2Fj ; AslpProcessMatchRegNode(x,x)+42j ... pop edi mov eax, esi pop esi pop ebx leave retn _AslpProcessMatchRegNode@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslEnvGetSysNativeDirPathForGuestBuf(x, x, x, x, x) _AslEnvGetSysNativeDirPathForGuestBuf@20 proc near ; CODE XREF: SdbpGetPathAppraiser(x,x,x,x)+E5p var_88 = dword ptr -88h var_84 = dword ptr -84h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 88h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi mov edi, [ebp+arg_0] xor eax, eax push 80h ; size_t push eax ; int lea eax, [ebp+var_84] mov esi, edx push eax ; void * mov [ebp+var_88], esi mov ebx, ecx call _memset mov ecx, [ebp+arg_4] xor eax, eax mov [ebx], ax add esp, 0Ch mov eax, [ebp+arg_8] test eax, eax jz loc_A240A9 cmp [eax], cx jz loc_A240A9 push offset ??_C@_1BG@LEIPKKKH@?$AA?2?$AAS?$AAy?$AAs?$AAN?$AAa?$AAt?$AAi?$AAv?$AAe@NNGAKEGL@ ; int push 40h pop edx lea ecx, [ebp+var_84] ; void * call _AslPathToSystemPathBuf@12 ; AslPathToSystemPathBuf(x,x,x) mov esi, eax test esi, esi jns short loc_A2403F push esi push offset ??_C@_0CD@JEFPKOCA@AslPathToSystemPathBuf?5failed?5?$FL@NNGAKEGL@ push 696h jmp short loc_A24096 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2403F: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+6Fj test edi, edi jz short loc_A24071 xor eax, eax cmp [edi], ax jz short loc_A24071 push [ebp+var_88] mov edx, edi lea ecx, [ebp+var_84] push ebx call _AslPathCombine@16 ; AslPathCombine(x,x,x,x) mov esi, eax test esi, esi jns short loc_A240A5 push esi push offset ??_C@_0BL@IPDIPDIN@AslPathCombine?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 6A0h jmp short loc_A24096 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24071: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+80j ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+87j mov edx, [ebp+var_88] lea eax, [ebp+var_84] push eax mov ecx, ebx call RtlStringCchCopyW mov esi, eax test esi, esi jns short loc_A240A5 push esi push offset ??_C@_0BO@LFCDCAJH@RtlStringCchCopyW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 6A8h loc_A24096: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+7Cj ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+AEj push (offset loc_8C54C4+4) push 1 call AslLogCallPrintf add esp, 14h loc_A240A5: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+A1j ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+C8j mov eax, esi jmp short loc_A240B5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A240A9: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+49j ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+52j push eax push ecx push edi mov edx, esi mov ecx, ebx call _AslEnvGetSystem32DirPathBuf@20 ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x) loc_A240B5: ; CODE XREF: AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+E6j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 0Ch _AslEnvGetSysNativeDirPathForGuestBuf@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslEnvGetSystem32DirPathBuf(x, x, x, x, x) _AslEnvGetSystem32DirPathBuf@20 proc near ; CODE XREF: SdbpGetPathSystem(x,x,x,x)+41p ; AslEnvGetSysNativeDirPathForGuestBuf(x,x,x,x,x)+EFp var_88 = dword ptr -88h var_84 = dword ptr -84h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = word ptr 0Ch arg_8 = dword ptr 10h mov edi, edi push ebp mov ebp, esp sub esp, 88h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi mov edi, [ebp+arg_0] lea eax, [ebp+var_84] push 80h ; size_t xor esi, esi mov [ebp+var_88], edx push esi ; int push eax ; void * mov ebx, ecx call _memset mov dx, [ebp+arg_4] xor eax, eax mov [ebx], ax add esp, 0Ch mov eax, [ebp+arg_8] test eax, eax jz short loc_A24115 movzx ecx, word ptr [eax] jmp short loc_A24118 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24115: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+48j movzx ecx, dx loc_A24118: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+4Dj mov eax, esi loc_A2411A: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+6Cj cmp word_6B3470[eax*8], dx jnz short loc_A2412E cmp word_6B3472[eax*8], cx jz short loc_A2414C loc_A2412E: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+5Cj inc eax cmp eax, 7 jb short loc_A2411A mov esi, 0C00000BBh loc_A24139: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+BBj ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+11Aj mov ecx, [ebp+var_4] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn 0Ch ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2414C: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+66j push off_6B3474[eax*8] ; int lea ecx, [ebp+var_84] ; void * push 40h pop edx call _AslPathToSystemPathBuf@12 ; AslPathToSystemPathBuf(x,x,x) mov esi, eax test esi, esi jns short loc_A24183 push esi push offset ??_C@_0CD@JEFPKOCA@AslPathToSystemPathBuf?5failed?5?$FL@NNGAKEGL@ push 586h loc_A24172: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+EDj ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+114j push offset ??_C@_0BM@NMMIKIII@AslEnvGetSystem32DirPathBuf@NNGAKEGL@ ; "AslEnvGetSystem32DirPathBuf" push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A24139 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24183: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+9Fj test edi, edi jz short loc_A241B5 xor eax, eax cmp [edi], ax jz short loc_A241B5 push [ebp+var_88] mov edx, edi lea ecx, [ebp+var_84] push ebx call _AslPathCombine@16 ; AslPathCombine(x,x,x,x) mov esi, eax test esi, esi jns short loc_A241DC push esi push offset ??_C@_0BL@IPDIPDIN@AslPathCombine?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 590h jmp short loc_A24172 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A241B5: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+BFj ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+C6j mov edx, [ebp+var_88] lea eax, [ebp+var_84] push eax mov ecx, ebx call RtlStringCchCopyW mov esi, eax test esi, esi jns short loc_A241DC push esi push offset ??_C@_0BO@LFCDCAJH@RtlStringCchCopyW?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 598h jmp short loc_A24172 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A241DC: ; CODE XREF: AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+E0j ; AslEnvGetSystem32DirPathBuf(x,x,x,x,x)+107j xor eax, eax mov esi, eax jmp loc_A24139 _AslEnvGetSystem32DirPathBuf@20 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslEnvVerifyGuestProcessorSupport(x, x) _AslEnvVerifyGuestProcessorSupport@8 proc near ; CODE XREF: SdbGuestTargetPlatformFlagsToRuntimePlatformFlags(x)+4Fp var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx and [ebp+var_4], 0 push esi push edi mov di, dx test ecx, ecx jz short loc_A241FD movzx ecx, word ptr [ecx] jmp short loc_A2422F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A241FD: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+11j sub esp, 0Ch lea ecx, [ebp+var_4] xor edx, edx call AslEnvGetProcessWowInfo mov esi, eax test esi, esi jns short loc_A2422C push esi push offset ??_C@_0CE@JCOOOONA@AslEnvGetProcessWowInfo?5failed?5@NNGAKEGL@ push 74Bh push offset ??_C@_0CC@BMJNLKJB@AslEnvVerifyGuestProcessorSuppo@NNGAKEGL@ ; "AslEnvVerifyGuestProcessorSupport" push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A24250 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2422C: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+29j mov ecx, [ebp+var_4] loc_A2422F: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+16j xor eax, eax loc_A24231: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+64j cmp word_6B3470[eax], cx jnz short loc_A24243 cmp word_6B3472[eax], di jz short loc_A24256 loc_A24243: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+53j add eax, 8 cmp eax, 38h jb short loc_A24231 mov esi, 0C00000BBh loc_A24250: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+45j ; AslEnvVerifyGuestProcessorSupport(x,x)+73j pop edi mov eax, esi pop esi leave retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24256: ; CODE XREF: AslEnvVerifyGuestProcessorSupport(x,x)+5Cj xor esi, esi jmp short loc_A24250 _AslEnvVerifyGuestProcessorSupport@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslFileAllocAndGetAttributes(x, x, x, x) _AslFileAllocAndGetAttributes@16 proc near ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+132p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch mov edi, edi push ebp mov ebp, esp sub esp, 0Ch mov eax, [ebp+arg_0] and [ebp+var_8], 0 or eax, [ebp+arg_4] push ebx push esi push edi mov ebx, edx mov edi, ecx jz short loc_A242DF xor esi, esi inc esi cmp [ebx+28h], esi jnz short loc_A242EA push 2 pop edx push 4 xor ecx, ecx pop ebx loc_A24285: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+83j imul eax, ecx, 18h test ecx, ecx jz short loc_A242C7 cmp ecx, 11h jz short loc_A242B1 cmp ecx, 1Ch jz short loc_A2429C or [eax+edi+10h], edx jmp short loc_A242D9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2429C: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+3Aj and dword ptr [edi+2ACh], 0 or [edi+2B0h], esi mov [edi+2A8h], esi jmp short loc_A242D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A242B1: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+35j and dword ptr [edi+1A0h], 0 and dword ptr [edi+1A4h], 0 or [edi+1A8h], esi jmp short loc_A242D2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A242C7: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+30j and dword ptr [edi+8], 0 and dword ptr [edi+0Ch], 0 or [edi+10h], esi loc_A242D2: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+55j ; AslFileAllocAndGetAttributes(x,x,x,x)+6Bj mov [eax+edi], edx mov [eax+edi+4], ebx loc_A242D9: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+40j inc ecx cmp ecx, 23h jl short loc_A24285 loc_A242DF: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+19j ; AslFileAllocAndGetAttributes(x,x,x,x)+2D7j xor esi, esi loc_A242E1: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+FEj ; AslFileAllocAndGetAttributes(x,x,x,x)+309j pop edi mov eax, esi pop esi pop ebx leave retn 8 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A242EA: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+21j cmp dword ptr [ebx+30h], 0 jz short loc_A24318 push 23h or edx, 0FFFFFFFFh lea ecx, [edi+10h] pop esi loc_A242F9: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+BCj cmp edx, 21h ja short loc_A2430C movzx eax, ds:byte_A24576[edx] jmp ds:off_A2456A[eax*4] loc_A2430C: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+A2j ; DATA XREF: PAGE:00A2456Eo ... or dword ptr [ecx], 2 loc_A2430F: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+ABj ; DATA XREF: PAGE:off_A2456Ao inc edx add ecx, 18h sub esi, 1 jnz short loc_A242F9 loc_A24318: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+94j mov ecx, ebx call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov esi, eax cmp esi, 0C0000017h jnz short loc_A2435A cmp dword ptr [ebx+30h], 0 jnz short loc_A2435E mov edx, ebx mov ecx, edi call _AslpFileLargeEnsureLargeFileMapping@8 ; AslpFileLargeEnsureLargeFileMapping(x,x) mov esi, eax test esi, esi jns short loc_A2436B push esi push offset ??_C@_0DA@KDDLGLDA@AslpFileLargeEnsureLargeFileMap@NNGAKEGL@ push 2A2h loc_A24349: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+10Fj ; AslFileAllocAndGetAttributes(x,x,x,x)+174j ... push (offset loc_8C5651+1) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A242E1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2435A: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+CDj test esi, esi jns short loc_A2436B loc_A2435E: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+D3j push esi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 2A6h jmp short loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2436B: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+E2j ; AslFileAllocAndGetAttributes(x,x,x,x)+102j xor esi, esi mov [ebp+var_4], esi loc_A24370: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+2DFj mov eax, [ebp+arg_0] mov ecx, esi mov edx, [ebp+arg_4] call __aullshr and eax, 1 xor edx, edx or eax, edx jz loc_A24527 imul eax, esi, 18h test byte ptr [eax+edi+10h], 3 jnz loc_A24527 cmp esi, 21h ja loc_A2455E movzx eax, ds:byte_A245C2[esi] jmp ds:off_A2459A[eax*4] loc_A243AF: ; DATA XREF: PAGE:off_A2459Ao lea edx, [ebx+8] mov ecx, edi call _AslpFileGetSizeAttributes@8 ; AslpFileGetSizeAttributes(x,x) mov esi, eax test esi, esi jns loc_A24527 push esi push offset ??_C@_0CG@NCLAMMOD@AslpFileGetSizeAttributes?5faile@NNGAKEGL@ push 2CDh jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A243D3: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245A6o mov edx, ebx mov ecx, edi call _AslpFileGetVersionAttributes@8 ; AslpFileGetVersionAttributes(x,x) mov ecx, eax test ecx, ecx jns loc_A24527 call _AslFileResourceNotFound@4 ; AslFileResourceNotFound(x) test eax, eax jnz loc_A24527 push ecx push (offset loc_8C55F7+1) push 2E5h push (offset loc_8C5651+1) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A24527 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24412: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245AAo mov edx, ebx lea ecx, [ebp+var_8] call _AslpFileGetModuleType@8 ; AslpFileGetModuleType(x,x) mov esi, eax test esi, esi js loc_A2453E mov eax, [ebp+var_8] and dword ptr [edi+1A4h], 0 or dword ptr [edi+1A8h], 1 mov dword ptr [edi+198h], 2 mov dword ptr [edi+19Ch], 4 mov [edi+1A0h], eax jmp loc_A24527 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24456: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245BEo mov edx, ebx mov ecx, edi call _AslpFileGetFileKindDetailAttribute@8 ; AslpFileGetFileKindDetailAttribute(x,x) mov esi, eax test esi, esi jns loc_A24527 push esi push offset ??_C@_0CP@DAOJOCEB@AslpFileGetFileKindDetailAttrib@NNGAKEGL@ push 301h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24479: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A2459Eo mov edx, ebx mov ecx, edi call _AslpFileGetHeaderAttributesPE@8 ; AslpFileGetHeaderAttributesPE(x,x) mov esi, eax test esi, esi jns loc_A24527 push esi push (offset loc_8C56EF+1) push 311h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2449C: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245B2o mov edx, ebx mov ecx, edi call _AslpFileGetPeExportNameExeWrapper@8 ; AslpFileGetPeExportNameExeWrapper(x,x) mov esi, eax test esi, esi jns short loc_A24527 push esi push (offset loc_8C5719+1) push 326h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A244BB: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245B6o mov edx, ebx mov ecx, edi call _AslpFileGetPeExportNameExeWrapper@8 ; AslpFileGetPeExportNameExeWrapper(x,x) mov esi, eax test esi, esi jns short loc_A24527 push esi push (offset loc_8C5719+1) push 33Ch jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A244DA: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245BAo mov edx, ebx mov ecx, edi call _AslpFileGetClrVersionAttribute@8 ; AslpFileGetClrVersionAttribute(x,x) mov esi, eax test esi, esi jns short loc_A24527 push esi push (offset loc_8C5699+1) push 346h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A244F9: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245AEo mov edx, ebx mov ecx, edi call _AslpFileGetHeaderAttributesNE@8 ; AslpFileGetHeaderAttributesNE(x,x) mov esi, eax test esi, esi jns short loc_A24527 push esi push offset ??_C@_0CK@JGKPMHMO@AslpFileGetHeaderAttributesNE?5f@NNGAKEGL@ push 350h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24518: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Ej ; DATA XREF: PAGE:00A245A2o mov edx, ebx mov ecx, edi call _AslpFileGetChecksumAttributes@8 ; AslpFileGetChecksumAttributes(x,x) mov esi, eax test esi, esi js short loc_A2454E loc_A24527: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+12Aj ; AslFileAllocAndGetAttributes(x,x,x,x)+138j ... mov eax, [ebp+var_4] inc eax mov [ebp+var_4], eax cmp eax, 23h jge loc_A242DF mov esi, eax jmp loc_A24370 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2453E: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+1C6j push esi push offset ??_C@_0CC@BEMDKDC@AslpFileGetModuleType?5failed?5?$FL?$CF@NNGAKEGL@ ; "AslpFileGetModuleType failed [%x]" push 2F2h jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2454E: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+2CBj push esi push offset ??_C@_0CK@CHCIOBLK@AslpFileGetChecksumAttributes?5f@NNGAKEGL@ push 35Ah jmp loc_A24349 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2455E: ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+141j mov esi, 0C00000E5h jmp loc_A242E1 _AslFileAllocAndGetAttributes@16 endp ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� db 8Bh, 0FFh off_A2456A dd offset loc_A2430F ; DATA XREF: AslFileAllocAndGetAttributes(x,x,x,x)+ABr dd offset loc_A2430C dd offset loc_A2430C byte_A24576 db 0 ; DATA XREF: AslFileAllocAndGetAttributes(x,x,x,x)+A4r db 2 dd 3 dup(1010101h), 101h, 20200h, 2020101h, 2, 1010200h db 8Bh, 0FFh off_A2459A dd offset loc_A243AF ; DATA XREF: AslFileAllocAndGetAttributes(x,x,x,x)+14Er dd offset loc_A24479 dd offset loc_A24518 dd offset loc_A243D3 dd offset loc_A24412 dd offset loc_A244F9 dd offset loc_A2449C dd offset loc_A244BB dd offset loc_A244DA dd offset loc_A24456 byte_A245C2 db 0 ; DATA XREF: AslFileAllocAndGetAttributes(x,x,x,x)+147r ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� add [edx], eax add eax, [ebx] add eax, [ebx] add eax, [ebx] add eax, [ebx] add eax, [ebx] add eax, [ebx] add eax, [ebx] add al, 1 add ds:3060105h, eax pop es add cl, [eax] or [ecx], eax add [ecx], eax add [ecx], al ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslFileFreeAttributes(x) _AslFileFreeAttributes@4 proc near ; CODE XREF: SdbpCheckAllAttributes(x,x,x,x,x)+1B8p mov edi, edi push edi mov edi, ecx test edi, edi jz short loc_A24630 push ebx push esi push 23h lea esi, [edi+8] pop ebx loc_A245F5: ; CODE XREF: AslFileFreeAttributes(x)+39j mov eax, [esi+8] test al, 1 jz short loc_A24617 cmp dword ptr [esi-8], 4 jnz short loc_A24617 test al, 4 jz short loc_A24617 mov eax, [esi] test eax, eax jz short loc_A24617 push 74705041h push eax call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A24617: ; CODE XREF: AslFileFreeAttributes(x)+16j ; AslFileFreeAttributes(x)+1Cj ... add esi, 18h sub ebx, 1 jnz short loc_A245F5 push 348h ; size_t push ebx ; int push edi ; void * call _memset add esp, 0Ch pop esi pop ebx loc_A24630: ; CODE XREF: AslFileFreeAttributes(x)+7j pop edi retn _AslFileFreeAttributes@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGet16BitDescription(x, x) _AslpFileGet16BitDescription@8 proc near ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+A1p var_104 = dword ptr -104h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 104h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push esi mov esi, edx push edi mov edi, ecx cmp dword ptr [esi+28h], 5 jz short loc_A2465D and dword ptr [edi], 0 mov eax, 0C00000BBh jmp short loc_A246C2 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2465D: ; CODE XREF: AslpFileGet16BitDescription(x,x)+1Fj push 100h ; size_t lea eax, [ebp+var_104] push 0 ; int push eax ; void * call _memset add esp, 0Ch lea ecx, [ebp+var_104] mov edx, esi call _AslpFileQuery16BitDescription@8 ; AslpFileQuery16BitDescription(x,x) mov esi, eax test esi, esi jns short loc_A24693 push esi push offset ??_C@_0CK@NDCMLJOK@AslpFileQuery16BitDescription?5f@NNGAKEGL@ push 11C9h jmp short loc_A246B1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24693: ; CODE XREF: AslpFileGet16BitDescription(x,x)+52j lea edx, [ebp+var_104] mov ecx, edi call _AslStringAnsiToUnicode@8 ; AslStringAnsiToUnicode(x,x) mov esi, eax test esi, esi jns short loc_A246C0 push esi push offset ??_C@_0CD@HDIACEIF@AslStringAnsiToUnicode?5failed?5?$FL@NNGAKEGL@ push 11CFh loc_A246B1: ; CODE XREF: AslpFileGet16BitDescription(x,x)+5Fj push (offset loc_8C609F+1) push 1 call AslLogCallPrintf add esp, 14h loc_A246C0: ; CODE XREF: AslpFileGet16BitDescription(x,x)+72j mov eax, esi loc_A246C2: ; CODE XREF: AslpFileGet16BitDescription(x,x)+29j mov ecx, [ebp+var_4] pop edi xor ecx, ebp pop esi call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _AslpFileGet16BitDescription@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGet16BitModuleName(x, x) _AslpFileGet16BitModuleName@8 proc near ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+115p var_104 = dword ptr -104h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 104h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push esi mov esi, edx push edi mov edi, ecx cmp dword ptr [esi+28h], 5 jz short loc_A246FB and dword ptr [edi], 0 mov eax, 0C00000BBh jmp short loc_A24760 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A246FB: ; CODE XREF: AslpFileGet16BitModuleName(x,x)+1Fj push 100h ; size_t lea eax, [ebp+var_104] push 0 ; int push eax ; void * call _memset add esp, 0Ch lea ecx, [ebp+var_104] mov edx, esi call _AslpFileQuery16BitModuleName@8 ; AslpFileQuery16BitModuleName(x,x) mov esi, eax test esi, esi jns short loc_A24731 push esi push (offset loc_8C602C+4) push 11F7h jmp short loc_A2474F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24731: ; CODE XREF: AslpFileGet16BitModuleName(x,x)+52j lea edx, [ebp+var_104] mov ecx, edi call _AslStringAnsiToUnicode@8 ; AslStringAnsiToUnicode(x,x) mov esi, eax test esi, esi jns short loc_A2475E push esi push offset ??_C@_0CD@HDIACEIF@AslStringAnsiToUnicode?5failed?5?$FL@NNGAKEGL@ push 11FDh loc_A2474F: ; CODE XREF: AslpFileGet16BitModuleName(x,x)+5Fj push offset ??_C@_0BL@EJPFEEEP@AslpFileGet16BitModuleName@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A2475E: ; CODE XREF: AslpFileGet16BitModuleName(x,x)+72j mov eax, esi loc_A24760: ; CODE XREF: AslpFileGet16BitModuleName(x,x)+29j mov ecx, [ebp+var_4] pop edi xor ecx, ebp pop esi call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _AslpFileGet16BitModuleName@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetChecksum(x, x) _AslpFileGetChecksum@8 proc near ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+C7p var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 24h push offset dword_6AACA0 call __SEH_prolog4 mov eax, edx mov [ebp+var_24], eax mov [ebp+var_2C], ecx mov ebx, 1000h mov edx, 200h xor edi, edi mov esi, edi mov eax, [eax+8] cmp eax, ebx jnb short loc_A2479D mov edx, edi mov ebx, eax jmp short loc_A247AA ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2479D: ; CODE XREF: AslpFileGetChecksum(x,x)+27j cmp eax, 1200h jnb short loc_A247AA lea edx, [eax-1000h] loc_A247AA: ; CODE XREF: AslpFileGetChecksum(x,x)+2Dj ; AslpFileGetChecksum(x,x)+34j mov [ebp+ms_exc.disabled], edi cmp ebx, 4 jb short loc_A247F1 mov ecx, [ebp+var_24] mov ecx, [ecx+10h] add ecx, edx mov [ebp+var_20], ecx mov edx, edi loc_A247BF: ; CODE XREF: AslpFileGetChecksum(x,x)+7Ej mov [ebp+var_28], edx mov eax, ebx shr eax, 2 cmp edx, eax jnb short loc_A247EE add esi, [ecx] mov [ebp+var_1C], esi add ecx, 4 mov [ebp+var_20], ecx mov eax, esi shr esi, 1 mov [ebp+var_1C], esi and eax, 1 jz short loc_A247EB or esi, 80000000h mov [ebp+var_1C], esi loc_A247EB: ; CODE XREF: AslpFileGetChecksum(x,x)+72j inc edx jmp short loc_A247BF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A247EE: ; CODE XREF: AslpFileGetChecksum(x,x)+5Bj mov ecx, [ebp+var_2C] loc_A247F1: ; CODE XREF: AslpFileGetChecksum(x,x)+42j mov [ecx], esi mov [ebp+var_34], edi jmp short loc_A24829 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A247F8: ; DATA XREF: .text:006AACB4o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_30], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24806: ; DATA XREF: .text:006AACB8o mov esp, [ebp+ms_exc.old_esp] mov edi, [ebp+var_30] mov [ebp+var_34], edi push edi push (offset loc_8C4D43+3) push 1390h push (offset loc_8C60FD+1) push 1 call AslLogCallPrintf add esp, 14h loc_A24829: ; CODE XREF: AslpFileGetChecksum(x,x)+88j mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, edi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _AslpFileGetChecksum@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetChecksumAttributes(x, x) _AslpFileGetChecksumAttributes@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+2C2p var_28 = dword ptr -28h var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 2Ch push ebx push esi push edi mov ebx, ecx mov [ebp+var_8], edx push 8 xor eax, eax lea edi, [ebp+var_28] pop ecx rep stosd cmp [edx+34h], eax jz short loc_A24896 push offset ??_C@_0FA@BMENCCAD@AslpFileGetChecksumAttributes?5c@NNGAKEGL@ push 12B7h push offset ??_C@_0BO@PDLAAKIB@AslpFileGetChecksumAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h mov esi, 0C0000001h push 2 pop edi or [ebx+40h], edi or [ebx+280h], edi or [ebx+340h], edi jmp loc_A24990 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24896: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+1Dj mov ecx, edx call _AslFileMappingEnsureMappedAs@8 ; AslFileMappingEnsureMappedAs(x,x) mov esi, eax mov ecx, 0C000010Eh test esi, esi jns short loc_A248CB cmp esi, ecx jz short loc_A248CB push esi push offset ??_C@_0CJ@NGKNMDF@AslFileMappingEnsureMappedAs?5fa@NNGAKEGL@ push 1300h loc_A248B7: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+B6j ; AslpFileGetChecksumAttributes(x,x)+DDj ... push offset ??_C@_0BO@PDLAAKIB@AslpFileGetChecksumAttributes@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A24990 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A248CB: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+64j ; AslpFileGetChecksumAttributes(x,x)+68j mov eax, [ebp+var_8] add eax, 8 mov [ebp+var_8], eax cmp esi, ecx jnz short loc_A24900 mov eax, [eax] lea ecx, [ebp+var_28] xor dl, dl mov [ebp+var_28], eax call _RtlFileMapMapView@8 ; RtlFileMapMapView(x,x) mov esi, eax test esi, esi jns short loc_A248FA push esi push (offset loc_8C58AE+2) push 1312h jmp short loc_A248B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A248FA: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+A9j lea eax, [ebp+var_28] mov [ebp+var_8], eax loc_A24900: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+94j and [ebp+var_4], 0 lea ecx, [ebp+var_4] mov edx, eax call _AslpFileGetChecksum@8 ; AslpFileGetChecksum(x,x) mov esi, eax test esi, esi jns short loc_A24921 push esi push offset ??_C@_0CA@ECIAAMCP@AslpFileGetChecksum?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 1324h jmp short loc_A248B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24921: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+D0j mov eax, [ebp+var_4] lea ecx, [ebp+var_4] mov edx, [ebp+var_8] and dword ptr [ebx+3Ch], 0 or dword ptr [ebx+40h], 1 and [ebp+var_4], 0 push 2 pop edi mov [ebx+30h], edi mov dword ptr [ebx+34h], 4 mov [ebx+38h], eax call _AslpFileGetCrcChecksum@8 ; AslpFileGetCrcChecksum(x,x) mov esi, eax test esi, esi jns short loc_A24961 push esi push (offset loc_8C6149+1) push 1335h jmp loc_A248B7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24961: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+10Dj mov eax, [ebp+var_4] and dword ptr [ebx+27Ch], 0 or dword ptr [ebx+280h], 1 or [ebx+340h], edi xor esi, esi mov [ebx+270h], edi mov dword ptr [ebx+274h], 4 mov [ebx+278h], eax loc_A24990: ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+4Fj ; AslpFileGetChecksumAttributes(x,x)+84j lea ecx, [ebp+var_28] call RtlFileMapFree pop edi mov eax, esi pop esi pop ebx leave retn _AslpFileGetChecksumAttributes@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetClrVersion(x, x) _AslpFileGetClrVersion@8 proc near ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+C0p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 18h push offset dword_6AAC60 call __SEH_prolog4 mov eax, edx mov [ebp+var_24], eax mov ebx, ecx and [ebp+var_20], 0 xor edi, edi mov byte ptr [ebx], 0 lea ecx, [ebp+var_20] call _AslpFileGetImageNtHeader@8 ; AslpFileGetImageNtHeader(x,x) mov esi, eax test esi, esi jns short loc_A249E8 push esi push offset ??_C@_0CF@GGCNCAGG@AslpFileGetImageNtHeader?5failed@NNGAKEGL@ push 156Bh push offset ??_C@_0BG@BCKDAEDA@AslpFileGetClrVersion@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A24B22 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A249E8: ; CODE XREF: AslpFileGetClrVersion(x,x)+28j and [ebp+ms_exc.disabled], edi mov esi, [ebp+var_20] movzx eax, word ptr [esi+18h] mov ecx, 10Bh cmp ax, cx jnz short loc_A24A04 lea edi, [esi+0E8h] jmp short loc_A24A14 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24A04: ; CODE XREF: AslpFileGetClrVersion(x,x)+5Bj mov ecx, 20Bh cmp ax, cx jnz short loc_A24A14 lea edi, [esi+0F8h] loc_A24A14: ; CODE XREF: AslpFileGetClrVersion(x,x)+63j ; AslpFileGetClrVersion(x,x)+6Dj test edi, edi jz loc_A24AE0 mov eax, [edi] test eax, eax jz loc_A24AE0 cmp dword ptr [edi+4], 48h jb loc_A24AE0 mov edi, [ebp+var_24] push eax lea edx, [edi+8] mov ecx, esi call _AslpImageRvaToVa@12 ; AslpImageRvaToVa(x,x,x) test eax, eax jnz short loc_A24A68 push (offset loc_8C62A0+4) push 1588h loc_A24A4C: ; CODE XREF: AslpFileGetClrVersion(x,x)+F4j ; AslpFileGetClrVersion(x,x)+13Cj mov esi, 0C000007Bh loc_A24A51: ; CODE XREF: AslpFileGetClrVersion(x,x)+10Dj mov [ebp+var_1C], esi push offset ??_C@_0BG@BCKDAEDA@AslpFileGetClrVersion@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 10h jmp loc_A24B1B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24A68: ; CODE XREF: AslpFileGetClrVersion(x,x)+A1j cmp word ptr [eax+4], 2 jz short loc_A24A76 mov esi, 0C00000BBh jmp short loc_A24AE5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24A76: ; CODE XREF: AslpFileGetClrVersion(x,x)+CEj push dword ptr [eax+8] lea edx, [edi+8] mov ecx, esi call _AslpImageRvaToVa@12 ; AslpImageRvaToVa(x,x,x) mov ecx, eax test ecx, ecx jnz short loc_A24A95 push offset ??_C@_0DD@FHOOCCGJ@Invalid?5COR20?5Metadata?5virtual?5@NNGAKEGL@ push 159Ch jmp short loc_A24A4C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24A95: ; CODE XREF: AslpFileGetClrVersion(x,x)+E8j cmp dword ptr [ecx], 424A5342h jz short loc_A24AAE mov esi, 0C00000BBh push offset ??_C@_0CN@DHBHKMFP@Invalid?5COR20?5Metadata?5signatur@NNGAKEGL@ push 15A6h jmp short loc_A24A51 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24AAE: ; CODE XREF: AslpFileGetClrVersion(x,x)+FCj mov esi, [ecx+0Ch] lea eax, [esi-1] cmp eax, 0FEh ja short loc_A24AD1 push esi ; size_t lea eax, [ecx+10h] push eax ; void * push ebx ; void * call _memcpy add esp, 0Ch mov byte ptr [esi+ebx], 0 xor esi, esi jmp short loc_A24AE5 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24AD1: ; CODE XREF: AslpFileGetClrVersion(x,x)+11Aj push offset ??_C@_0CE@HKAOIBJK@CLR?5version?5string?5null?5or?5too?5@NNGAKEGL@ push 15B2h jmp loc_A24A4C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24AE0: ; CODE XREF: AslpFileGetClrVersion(x,x)+77j ; AslpFileGetClrVersion(x,x)+81j ... mov esi, 0C000007Bh loc_A24AE5: ; CODE XREF: AslpFileGetClrVersion(x,x)+D5j ; AslpFileGetClrVersion(x,x)+130j mov [ebp+var_1C], esi jmp short loc_A24B1B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24AEA: ; DATA XREF: .text:006AAC74o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_28], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24AF8: ; DATA XREF: .text:006AAC78o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_28] mov [ebp+var_1C], esi push esi push (offset loc_8C4D43+3) push 15C9h push offset ??_C@_0BG@BCKDAEDA@AslpFileGetClrVersion@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A24B1B: ; CODE XREF: AslpFileGetClrVersion(x,x)+C4j ; AslpFileGetClrVersion(x,x)+149j mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A24B22: ; CODE XREF: AslpFileGetClrVersion(x,x)+44j mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _AslpFileGetClrVersion@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetClrVersionAttribute(x, x) _AslpFileGetClrVersionAttribute@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+284p var_10C = dword ptr -10Ch var_108 = dword ptr -108h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 10Ch mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi push 100h ; size_t xor esi, esi lea eax, [ebp+var_108] push esi ; int push eax ; void * mov ebx, edx mov edi, ecx call _memset add esp, 0Ch mov [ebp+var_10C], esi mov ecx, ebx call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov esi, eax test esi, esi jns short loc_A24B99 push esi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 150Dh loc_A24B85: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+9Cj ; AslpFileGetClrVersionAttribute(x,x)+D6j ... push (offset loc_8C60B8+4) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A24C9B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24B99: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+44j cmp dword ptr [ebx+28h], 6 jz short loc_A24BAD loc_A24B9F: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+B6j or dword ptr [edi+298h], 2 xor esi, esi jmp loc_A24C9B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24BAD: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+69j test byte ptr [edi+2B0h], 1 jnz short loc_A24BD2 mov edx, ebx mov ecx, edi call _AslpFileGetFileKindDetailAttribute@8 ; AslpFileGetFileKindDetailAttribute(x,x) mov esi, eax test esi, esi jns short loc_A24BD2 push esi push offset ??_C@_0CP@DAOJOCEB@AslpFileGetFileKindDetailAttrib@NNGAKEGL@ push 151Eh jmp short loc_A24B85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24BD2: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+80j ; AslpFileGetClrVersionAttribute(x,x)+8Fj mov eax, [edi+2A8h] cmp eax, 0Ch jz short loc_A24BEC cmp eax, 0Dh jz short loc_A24BEC cmp eax, 0Eh jz short loc_A24BEC cmp eax, 0Fh jnz short loc_A24B9F loc_A24BEC: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+A7j ; AslpFileGetClrVersionAttribute(x,x)+ACj ... mov edx, ebx lea ecx, [ebp+var_108] call _AslpFileGetClrVersion@8 ; AslpFileGetClrVersion(x,x) mov esi, eax test esi, esi jns short loc_A24C0F push esi push offset ??_C@_0CC@HLMBHAHE@AslpFileGetClrVersion?5failed?5?$FL?$CF@NNGAKEGL@ push 1531h jmp loc_A24B85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24C0F: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+C9j lea edx, [ebp+var_108] lea ecx, [ebp+var_10C] call _AslStringAnsiToUnicode@8 ; AslStringAnsiToUnicode(x,x) mov esi, eax test esi, esi jns short loc_A24C36 push esi push offset ??_C@_0CD@HDIACEIF@AslStringAnsiToUnicode?5failed?5?$FL@NNGAKEGL@ push 1537h jmp loc_A24B85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24C36: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+F0j mov ecx, [ebp+var_10C] call _AslStringXmlSanitize@4 ; AslStringXmlSanitize(x) mov esi, eax test esi, esi jns short loc_A24C57 push esi push offset ??_C@_0CB@KOMIGNHG@AslStringXmlSanitize?5failed?5?$FL?$CFx@NNGAKEGL@ push 153Dh jmp loc_A24B85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24C57: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+111j mov edx, [ebp+var_10C] xor esi, esi mov dword ptr [edi+288h], 4 lea eax, [edx+2] loc_A24C6C: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+141j mov cx, [edx] add edx, 2 cmp cx, si jnz short loc_A24C6C sub edx, eax mov eax, [ebp+var_10C] sar edx, 1 or dword ptr [edi+298h], 5 mov [edi+28Ch], edx cdq mov [edi+290h], eax mov [edi+294h], edx loc_A24C9B: ; CODE XREF: AslpFileGetClrVersionAttribute(x,x)+60j ; AslpFileGetClrVersionAttribute(x,x)+74j mov ecx, [ebp+var_4] mov eax, esi pop edi pop esi xor ecx, ebp pop ebx call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _AslpFileGetClrVersionAttribute@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetCrcChecksum(x, x) _AslpFileGetCrcChecksum@8 proc near ; CODE XREF: AslpFileGetChecksumAttributes(x,x)+104p var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 10h push offset dword_6AAC80 call __SEH_prolog4 mov eax, edx mov ebx, ecx xor edi, edi mov [ebp+ms_exc.disabled], edi cmp [eax+0Ch], edi ja short loc_A24CDB jb short loc_A24CD1 cmp dword ptr [eax+8], 2000h jnb short loc_A24CDB loc_A24CD1: ; CODE XREF: AslpFileGetCrcChecksum(x,x)+1Aj push dword ptr [eax+14h] mov edx, [eax+10h] xor ecx, ecx jmp short loc_A24CF9 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24CDB: ; CODE XREF: AslpFileGetCrcChecksum(x,x)+18j ; AslpFileGetCrcChecksum(x,x)+23j mov edx, [eax+10h] mov ecx, 1000h push ecx mov esi, [eax+8] push ecx xor ecx, ecx call _AslComputeCrc32@12 ; AslComputeCrc32(x,x,x) add edx, 0FFFFF000h add edx, esi mov ecx, eax loc_A24CF9: ; CODE XREF: AslpFileGetCrcChecksum(x,x)+2Dj call _AslComputeCrc32@12 ; AslComputeCrc32(x,x,x) mov [ebx], eax mov [ebp+var_1C], edi jmp short loc_A24D36 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24D05: ; DATA XREF: .text:006AAC94o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_20], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24D13: ; DATA XREF: .text:006AAC98o mov esp, [ebp+ms_exc.old_esp] mov edi, [ebp+var_20] mov [ebp+var_1C], edi push edi push (offset loc_8C4D43+3) push 13F6h push (offset loc_8C6111+1) push 1 call AslLogCallPrintf add esp, 14h loc_A24D36: ; CODE XREF: AslpFileGetCrcChecksum(x,x)+57j mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, edi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _AslpFileGetCrcChecksum@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetExeWrapper(x, x) _AslpFileGetExeWrapper@8 proc near ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+63p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 18h push offset dword_6AAD40 call __SEH_prolog4 mov ebx, edx mov edi, ecx xor eax, eax mov [ebp+var_20], eax mov [edi], eax mov [ebp+var_1C], eax cmp dword ptr [ebx+14h], 1 jb short loc_A24D7D ja short loc_A24D76 cmp [ebx+10h], eax jb short loc_A24D7D loc_A24D76: ; CODE XREF: AslpFileGetExeWrapper(x,x)+20j xor eax, eax jmp loc_A24E87 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24D7D: ; CODE XREF: AslpFileGetExeWrapper(x,x)+1Ej ; AslpFileGetExeWrapper(x,x)+25j lea ecx, [ebp+var_1C] call _AslpFileGetImageNtHeader@8 ; AslpFileGetImageNtHeader(x,x) mov esi, eax test esi, esi jns short loc_A24DAA push esi push offset ??_C@_0CF@GGCNCAGG@AslpFileGetImageNtHeader?5failed@NNGAKEGL@ push 0F90h push offset ??_C@_0BG@HGDCKIPM@AslpFileGetExeWrapper@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A24E85 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24DAA: ; CODE XREF: AslpFileGetExeWrapper(x,x)+3Aj and [ebp+ms_exc.disabled], 0 mov ecx, [ebp+var_1C] call _AslpFileHasSecuromWrapper@4 ; AslpFileHasSecuromWrapper(x) test eax, eax jz short loc_A24DC5 mov dword ptr [edi], 1 jmp loc_A24E46 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24DC5: ; CODE XREF: AslpFileGetExeWrapper(x,x)+69j push ebx mov edx, [ebp+var_1C] lea ecx, [ebp+var_20] call _AslpFileHasActiveMarkWrapper@12 ; AslpFileHasActiveMarkWrapper(x,x,x) mov esi, eax mov [ebp+var_24], esi test esi, esi jns short loc_A24E12 mov eax, 0C0000225h cmp esi, eax jnz short loc_A24E05 push eax push dword ptr [ebx+14h] push dword ptr [ebx+10h] push offset ??_C@_0DL@MCGFOHLO@AslpFileHasActiveMarkWrapper?5fa@NNGAKEGL@ push 0FA9h push offset ??_C@_0BG@HGDCKIPM@AslpFileGetExeWrapper@NNGAKEGL@ push 2 call AslLogCallPrintf add esp, 1Ch jmp short loc_A24E7E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E05: ; CODE XREF: AslpFileGetExeWrapper(x,x)+92j push esi push offset ??_C@_0CJ@OLKHAPFK@AslpFileHasActiveMarkWrapper?5fa@NNGAKEGL@ ; "AslpFileHasActiveMarkWrapper failed [%x"... push 0FABh jmp short loc_A24E6F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E12: ; CODE XREF: AslpFileGetExeWrapper(x,x)+89j cmp [ebp+var_20], 0 jz short loc_A24E20 mov dword ptr [edi], 2 jmp short loc_A24E46 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E20: ; CODE XREF: AslpFileGetExeWrapper(x,x)+C7j mov ecx, [ebp+var_1C] call _AslpFileHasArmadilloWrapper@4 ; AslpFileHasArmadilloWrapper(x) test eax, eax jz short loc_A24E34 mov dword ptr [edi], 3 jmp short loc_A24E46 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E34: ; CODE XREF: AslpFileGetExeWrapper(x,x)+DBj mov ecx, [ebp+var_1C] call _AslpHasStarForceWrapper@4 ; AslpHasStarForceWrapper(x) test eax, eax jz short loc_A24E46 mov dword ptr [edi], 4 loc_A24E46: ; CODE XREF: AslpFileGetExeWrapper(x,x)+71j ; AslpFileGetExeWrapper(x,x)+CFj ... xor esi, esi mov [ebp+var_24], esi jmp short loc_A24E7E ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E4D: ; DATA XREF: .text:006AAD54o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_28], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24E5B: ; DATA XREF: .text:006AAD58o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_28] mov [ebp+var_24], esi push esi push (offset loc_8C4D43+3) push 0FBFh loc_A24E6F: ; CODE XREF: AslpFileGetExeWrapper(x,x)+C1j push offset ??_C@_0BG@HGDCKIPM@AslpFileGetExeWrapper@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A24E7E: ; CODE XREF: AslpFileGetExeWrapper(x,x)+B4j ; AslpFileGetExeWrapper(x,x)+FCj mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A24E85: ; CODE XREF: AslpFileGetExeWrapper(x,x)+56j mov eax, esi loc_A24E87: ; CODE XREF: AslpFileGetExeWrapper(x,x)+29j mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _AslpFileGetExeWrapper@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetExportName(x, x) _AslpFileGetExportName@8 proc near ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+A4p var_104 = dword ptr -104h var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 104h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push esi push edi push 100h ; size_t lea eax, [ebp+var_104] mov esi, edx push 0 ; int push eax ; void * mov edi, ecx call _memset add esp, 0Ch lea ecx, [ebp+var_104] mov edx, esi call _AslpFileQueryExportName_Vb@8 ; AslpFileQueryExportName_Vb(x,x) mov esi, eax test esi, esi jns short loc_A24F07 cmp esi, 0C0000225h jz short loc_A24F29 cmp esi, 0C000007Bh jz short loc_A24F29 push esi push offset ??_C@_0CE@GHMPLADB@AslpFileQueryExportName?5failed?5@NNGAKEGL@ push 10C6h loc_A24EF6: ; CODE XREF: AslpFileGetExportName(x,x)+8Ej push (offset loc_8C5F77+1) push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A24F29 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24F07: ; CODE XREF: AslpFileGetExportName(x,x)+42j lea edx, [ebp+var_104] mov ecx, edi call _AslStringAnsiToUnicode@8 ; AslStringAnsiToUnicode(x,x) mov esi, eax test esi, esi jns short loc_A24F27 push esi push offset ??_C@_0CD@HDIACEIF@AslStringAnsiToUnicode?5failed?5?$FL@NNGAKEGL@ push 10CDh jmp short loc_A24EF6 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24F27: ; CODE XREF: AslpFileGetExportName(x,x)+81j xor esi, esi loc_A24F29: ; CODE XREF: AslpFileGetExportName(x,x)+4Aj ; AslpFileGetExportName(x,x)+52j ... mov ecx, [ebp+var_4] mov eax, esi pop edi xor ecx, ebp pop esi call @__security_check_cookie@4 ; __security_check_cookie(x) leave retn _AslpFileGetExportName@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetFileKindDetailAttribute(x, x) _AslpFileGetFileKindDetailAttribute@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+200p ; AslpFileGetClrVersionAttribute(x,x)+86p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push ecx and [ebp+var_4], 0 push esi mov esi, ecx lea ecx, [ebp+var_4] push edi call _AslFileMappingGetFileKindDetail@8 ; AslFileMappingGetFileKindDetail(x,x) mov edi, eax test edi, edi jns short loc_A24F72 push edi push (offset loc_8C61FC+2) push 15ECh push offset ??_C@_0CD@IEAEKNMD@AslpFileGetFileKindDetailAttrib@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A24F9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24F72: ; CODE XREF: AslpFileGetFileKindDetailAttribute(x,x)+1Bj mov eax, [ebp+var_4] or dword ptr [esi+2B0h], 1 xor edi, edi cdq mov dword ptr [esi+2A0h], 2 mov dword ptr [esi+2A4h], 4 mov [esi+2A8h], eax mov [esi+2ACh], edx loc_A24F9F: ; CODE XREF: AslpFileGetFileKindDetailAttribute(x,x)+37j mov eax, edi pop edi pop esi leave retn _AslpFileGetFileKindDetailAttribute@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetHeaderAttributesNE(x, x) _AslpFileGetHeaderAttributesNE@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+2A3p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi mov ebx, edx xor eax, eax mov esi, ecx mov [ebp+var_C], ebx push edi mov ecx, ebx mov [ebp+var_4], eax mov [ebp+var_8], eax call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov edi, eax test edi, edi jns short loc_A24FEB push edi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 0E58h loc_A24FD7: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+C3j ; AslpFileGetHeaderAttributesNE(x,x)+137j push offset ??_C@_0BO@ECMFKLEM@AslpFileGetHeaderAttributesNE@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A25126 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A24FEB: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+25j cmp dword ptr [ebx+28h], 5 push 2 pop ebx jz short loc_A25007 or [esi+1F0h], ebx or [esi+208h], ebx xor edi, edi jmp loc_A25126 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25007: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+4Dj mov edx, [ebp+var_C] lea ecx, [ebp+var_4] or [esi+1C0h], ebx or [esi+1D8h], ebx or [esi+220h], ebx or [esi+28h], ebx or [esi+268h], ebx or [esi+238h], ebx or [esi+2C8h], ebx or [esi+2E0h], ebx or [esi+2F8h], ebx or [esi+328h], ebx call _AslpFileGet16BitDescription@8 ; AslpFileGet16BitDescription(x,x) test eax, eax js short loc_A250AC mov ecx, [ebp+var_4] call _AslStringXmlSanitize@4 ; AslStringXmlSanitize(x) mov edi, eax test edi, edi jns short loc_A2506D push edi push offset ??_C@_0CB@KOMIGNHG@AslStringXmlSanitize?5failed?5?$FL?$CFx@NNGAKEGL@ push 0E7Ch jmp loc_A24FD7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2506D: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+B6j mov edx, [ebp+var_4] xor edi, edi mov dword ptr [esi+1E0h], 4 lea eax, [edx+2] loc_A2507F: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+E2j mov cx, [edx] add edx, ebx cmp cx, di jnz short loc_A2507F sub edx, eax mov eax, [ebp+var_4] sar edx, 1 or dword ptr [esi+1F0h], 5 mov [esi+1E4h], edx cdq mov [esi+1E8h], eax mov [esi+1ECh], edx jmp short loc_A250B4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A250AC: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+A8j or [esi+1F0h], ebx xor edi, edi loc_A250B4: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+105j mov edx, [ebp+var_C] lea ecx, [ebp+var_8] call _AslpFileGet16BitModuleName@8 ; AslpFileGet16BitModuleName(x,x) test eax, eax js short loc_A25120 mov ecx, [ebp+var_8] call _AslStringXmlSanitize@4 ; AslStringXmlSanitize(x) mov edi, eax test edi, edi jns short loc_A250E1 push edi push offset ??_C@_0CB@KOMIGNHG@AslStringXmlSanitize?5failed?5?$FL?$CFx@NNGAKEGL@ push 0E91h jmp loc_A24FD7 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A250E1: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+12Aj mov edx, [ebp+var_8] xor edi, edi mov dword ptr [esi+1F8h], 4 lea eax, [edx+2] loc_A250F3: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+156j mov cx, [edx] add edx, ebx cmp cx, di jnz short loc_A250F3 sub edx, eax mov eax, [ebp+var_8] sar edx, 1 or dword ptr [esi+208h], 5 mov [esi+1FCh], edx cdq mov [esi+200h], eax mov [esi+204h], edx jmp short loc_A25126 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25120: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+11Cj or [esi+208h], ebx loc_A25126: ; CODE XREF: AslpFileGetHeaderAttributesNE(x,x)+41j ; AslpFileGetHeaderAttributesNE(x,x)+5Dj ... mov eax, edi pop edi pop esi pop ebx leave retn _AslpFileGetHeaderAttributesNE@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetHeaderAttributesPE(x, x) _AslpFileGetHeaderAttributesPE@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+223p var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 3Ch xor eax, eax push ebx push esi mov ebx, edx mov [ebp+var_14], eax mov esi, ecx mov [ebp+var_18], eax push edi mov ecx, ebx mov [ebp+var_1C], eax mov [ebp+var_4], eax mov [ebp+var_8], eax mov [ebp+var_C], eax mov [ebp+var_10], eax call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov edi, eax test edi, edi jns short loc_A2517F push edi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 0DCFh push offset ??_C@_0BO@FEHNCFDG@AslpFileGetHeaderAttributesPE@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A25376 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2517F: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+31j cmp dword ptr [ebx+28h], 6 push 2 pop edi jz short loc_A251BA or [esi+1C0h], edi or [esi+1D8h], edi or [esi+220h], edi or [esi+28h], edi or [esi+2F8h], edi or [esi+2C8h], edi or [esi+2E0h], edi or [esi+328h], edi jmp loc_A25374 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A251BA: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+59j or [esi+1F0h], edi lea eax, [ebp+var_1C] or [esi+208h], edi lea edx, [ebp+var_8] push ebx push ecx push eax lea eax, [ebp+var_18] push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_C] push eax lea ecx, [ebp+var_4] call _AslpFileGetNtHeaderAttributes@36 ; AslpFileGetNtHeaderAttributes(x,x,x,x,x,x,x,x,x) mov ecx, [esi+1C0h] mov edx, [esi+2F8h] mov [ebp+var_20], ecx mov ecx, [esi+1D8h] mov [ebp+var_24], ecx mov ecx, [esi+220h] mov [ebp+var_28], ecx mov ecx, [esi+28h] mov [ebp+var_2C], ecx mov ecx, [esi+2C8h] mov [ebp+var_30], ecx mov ecx, [esi+328h] mov [ebp+var_34], edx mov [ebp+var_38], ecx test eax, eax js loc_A25325 mov eax, [ebp+var_4] xor ecx, ecx mov [esi+1B8h], eax inc ecx mov eax, [ebp+var_20] or eax, ecx and dword ptr [esi+1BCh], 0 mov [esi+1C0h], eax mov eax, [ebp+var_8] mov [esi+1D0h], eax mov eax, [ebp+var_24] or eax, ecx and dword ptr [esi+1D4h], 0 mov [esi+1D8h], eax mov eax, [ebp+var_C] and dword ptr [esi+21Ch], 0 and dword ptr [esi+24h], 0 mov [esi+218h], eax mov eax, [ebp+var_28] or eax, ecx mov [esi+1B0h], edi mov [esi+220h], eax mov eax, [ebp+var_10] mov [esi+20h], eax mov eax, [ebp+var_2C] or eax, ecx mov [esi+1C8h], edi mov [esi+28h], eax movzx eax, word ptr [ebp+var_14] push 4 pop edx mov [esi+1B4h], edx mov [esi+1CCh], edx mov [esi+214h], edx mov [esi+1Ch], edx cdq mov [esi+2C0h], eax mov eax, [ebp+var_30] or eax, ecx mov [esi+2C4h], edx mov [esi+2C8h], eax movzx eax, word ptr [ebp+var_18] cdq mov [esi+2D8h], eax movzx eax, word ptr [ebp+var_1C] mov [esi+2DCh], edx cdq mov [esi+2F4h], edx mov edx, [ebp+var_34] mov [esi+210h], edi mov [esi+18h], edi mov [esi+2B8h], ecx mov [esi+2BCh], edi mov [esi+2D0h], ecx mov [esi+2D4h], edi mov [esi+2E8h], ecx mov [esi+2ECh], edi mov [esi+2F0h], eax jmp short loc_A2535B ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25325: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+F8j mov eax, [ebp+var_20] mov ecx, edi or eax, edi mov [esi+1C0h], eax mov eax, [ebp+var_24] or eax, edi mov [esi+1D8h], eax mov eax, [ebp+var_28] or eax, edi mov [esi+220h], eax mov eax, [ebp+var_2C] or eax, edi mov [esi+28h], eax mov eax, [ebp+var_30] or eax, edi mov [esi+2C8h], eax loc_A2535B: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+1F6j mov eax, [ebp+var_38] or edx, ecx or [esi+2E0h], ecx or eax, edi mov [esi+2F8h], edx mov [esi+328h], eax loc_A25374: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+88j xor edi, edi loc_A25376: ; CODE XREF: AslpFileGetHeaderAttributesPE(x,x)+4Dj mov eax, edi pop edi pop esi pop ebx leave retn _AslpFileGetHeaderAttributesPE@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetImageNtHeader(x, x) _AslpFileGetImageNtHeader@8 proc near ; CODE XREF: AslpFileGetNtHeaderAttributes(x,x,x,x,x,x,x,x,x)+1Ap ; AslpFileQueryExportName_Vb(x,x)+20p ... var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 10h push offset dword_6AADA0 call __SEH_prolog4 mov edi, ecx cmp dword ptr [edx+28h], 6 jz short loc_A253B2 mov esi, 0C00000BBh push esi push offset ??_C@_0BL@MMANKHCP@File?5mapping?5not?5a?5PE?5?$FL?$CFx?$FN@NNGAKEGL@ push 0F50h push offset ??_C@_0BJ@PNILLELB@AslpFileGetImageNtHeader@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A25428 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A253B2: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+12j xor esi, esi mov [ebp+ms_exc.disabled], esi mov eax, [edx+18h] mov ecx, [eax+3Ch] lea ebx, [ecx+eax] add ecx, 0F8h cmp [edx+14h], esi jb short loc_A253DE ja short loc_A253D2 cmp [edx+10h], ecx jb short loc_A253DE loc_A253D2: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+4Ej cmp [edx+1Ch], ecx jb short loc_A253DE mov [edi], ebx mov [ebp+var_1C], esi jmp short loc_A25421 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A253DE: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+4Cj ; AslpFileGetImageNtHeader(x,x)+53j ... mov esi, 0C000007Bh push esi push offset ??_C@_0BK@JBDFECNJ@File?5mapping?5invalid?5?$FL?$CFx?$FN@NNGAKEGL@ push 0F5Ch jmp short loc_A2540F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A253F0: ; DATA XREF: .text:006AADB4o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_20], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A253FE: ; DATA XREF: .text:006AADB8o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_20] push esi push (offset loc_8C4D43+3) push 0F65h loc_A2540F: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+71j push offset ??_C@_0BJ@PNILLELB@AslpFileGetImageNtHeader@NNGAKEGL@ push 1 mov [ebp+var_1C], esi call AslLogCallPrintf add esp, 14h loc_A25421: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+5Fj mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_A25428: ; CODE XREF: AslpFileGetImageNtHeader(x,x)+33j mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn _AslpFileGetImageNtHeader@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpFileGetModuleType(x, x) _AslpFileGetModuleType@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+1BDp mov eax, [edx+28h] sub eax, 4 jz short loc_A25461 sub eax, 1 jz short loc_A25459 sub eax, 1 jz short loc_A25451 and dword ptr [ecx], 0 jmp short loc_A25467 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25451: ; CODE XREF: AslpFileGetModuleType(x,x)+10j mov dword ptr [ecx], 3 jmp short loc_A25467 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25459: ; CODE XREF: AslpFileGetModuleType(x,x)+Bj mov dword ptr [ecx], 2 jmp short loc_A25467 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25461: ; CODE XREF: AslpFileGetModuleType(x,x)+6j mov dword ptr [ecx], 1 loc_A25467: ; CODE XREF: AslpFileGetModuleType(x,x)+15j ; AslpFileGetModuleType(x,x)+1Dj ... xor eax, eax retn _AslpFileGetModuleType@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetPeExportNameExeWrapper(x, x) _AslpFileGetPeExportNameExeWrapper@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+246p ; AslFileAllocAndGetAttributes(x,x,x,x)+265p var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch push ebx push esi mov ebx, edx xor eax, eax mov esi, ecx mov [ebp+var_8], eax push edi mov ecx, ebx mov [ebp+var_4], eax call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov edi, eax test edi, edi jns short loc_A254AD push edi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 0CE6h loc_A25499: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+C6j push offset ??_C@_0CC@HPCEKKIJ@AslpFileGetPeExportNameExeWrapp@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp loc_A2557C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A254AD: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+22j cmp dword ptr [ebx+28h], 6 jz short loc_A254C8 or dword ptr [esi+268h], 2 or dword ptr [esi+238h], 2 xor edi, edi jmp loc_A2557C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A254C8: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+47j mov edx, ebx lea ecx, [ebp+var_8] call _AslpFileGetExeWrapper@8 ; AslpFileGetExeWrapper(x,x) xor edi, edi test eax, eax js short loc_A25500 mov eax, [ebp+var_8] mov [esi+260h], eax xor eax, eax mov dword ptr [esi+258h], 2 inc eax mov dword ptr [esi+25Ch], 4 mov [esi+264h], edi jmp short loc_A25503 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25500: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+6Cj push 2 pop eax loc_A25503: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+94j or [esi+268h], eax lea ecx, [ebp+var_4] mov edx, ebx call _AslpFileGetExportName@8 ; AslpFileGetExportName(x,x) test eax, eax js short loc_A25575 mov ecx, [ebp+var_4] call _AslStringXmlSanitize@4 ; AslStringXmlSanitize(x) mov edi, eax test edi, edi jns short loc_A25535 push edi push offset ??_C@_0CB@KOMIGNHG@AslStringXmlSanitize?5failed?5?$FL?$CFx@NNGAKEGL@ push 0D09h jmp loc_A25499 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25535: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+B9j mov edx, [ebp+var_4] xor edi, edi mov dword ptr [esi+228h], 4 lea eax, [edx+2] loc_A25547: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+E6j mov cx, [edx] add edx, 2 cmp cx, di jnz short loc_A25547 sub edx, eax mov eax, [ebp+var_4] sar edx, 1 or dword ptr [esi+238h], 5 mov [esi+22Ch], edx cdq mov [esi+230h], eax mov [esi+234h], edx jmp short loc_A2557C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25575: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+ABj or dword ptr [esi+238h], 2 loc_A2557C: ; CODE XREF: AslpFileGetPeExportNameExeWrapper(x,x)+3Ej ; AslpFileGetPeExportNameExeWrapper(x,x)+59j ... mov eax, edi pop edi pop esi pop ebx leave retn _AslpFileGetPeExportNameExeWrapper@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpFileGetSizeAttributes(x, x) _AslpFileGetSizeAttributes@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+15Ap mov eax, [edx+0Ch] push esi mov esi, [edx+8] or dword ptr [ecx+310h], 1 and dword ptr [ecx+0Ch], 0 or dword ptr [ecx+10h], 1 mov [ecx+308h], esi mov [ecx+30Ch], eax xor eax, eax mov [ecx+8], esi mov dword ptr [ecx+300h], 3 mov dword ptr [ecx+304h], 8 mov dword ptr [ecx], 2 mov dword ptr [ecx+4], 4 pop esi retn _AslpFileGetSizeAttributes@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetVersionAttributes(x, x) _AslpFileGetVersionAttributes@8 proc near ; CODE XREF: AslFileAllocAndGetAttributes(x,x,x,x)+17Dp var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 0Ch and [ebp+var_4], 0 and [ebp+var_8], 0 push ebx push esi push edi mov edi, ecx lea ecx, [ebp+var_4] push edx lea edx, [ebp+var_8] call _AslpFileGetVersionBlock@12 ; AslpFileGetVersionBlock(x,x,x) mov ecx, eax mov ebx, (offset loc_8C5747+1) test ecx, ecx jns short loc_A2561E call _AslFileResourceNotFound@4 ; AslFileResourceNotFound(x) test eax, eax jnz short loc_A25618 push ecx push (offset loc_8C5795+1) push 604h push ebx push 3 call AslLogCallPrintf add esp, 14h loc_A25618: ; CODE XREF: AslpFileGetVersionAttributes(x,x)+33j xor esi, esi xor edx, edx jmp short loc_A25624 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2561E: ; CODE XREF: AslpFileGetVersionAttributes(x,x)+2Aj mov esi, [ebp+var_4] mov edx, [ebp+var_8] loc_A25624: ; CODE XREF: AslpFileGetVersionAttributes(x,x)+4Fj mov ecx, edi call _AslpFileMakeBinVersionAttributes@8 ; AslpFileMakeBinVersionAttributes(x,x) mov edx, esi mov ecx, edi call _AslpFileMakeStringVersionAttributes@8 ; AslpFileMakeStringVersionAttributes(x,x) mov esi, eax test esi, esi jns short loc_A25652 push esi push offset ??_C@_0DA@JAHKPBMF@AslpFileMakeStringVersionAttrib@NNGAKEGL@ push 61Ch push ebx push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A25654 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25652: ; CODE XREF: AslpFileGetVersionAttributes(x,x)+6Bj xor esi, esi loc_A25654: ; CODE XREF: AslpFileGetVersionAttributes(x,x)+83j pop edi mov eax, esi pop esi pop ebx leave retn _AslpFileGetVersionAttributes@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileGetVersionBlock(x, x, x) _AslpFileGetVersionBlock@12 proc near ; CODE XREF: AslpFileGetVersionAttributes(x,x)+1Cp var_194 = dword ptr -194h var_190 = dword ptr -190h var_18C = dword ptr -18Ch var_74 = dword ptr -74h var_70 = dword ptr -70h var_64 = dword ptr -64h var_60 = dword ptr -60h var_58 = byte ptr -58h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 184h push offset dword_6AAD80 call __SEH_prolog4 mov [ebp+var_3C], edx mov esi, ecx mov [ebp+var_40], esi xor eax, eax mov [ebp+var_2C], eax mov [ebp+var_28], eax mov ebx, eax mov [ebp+var_30], ebx mov [ebp+var_24], eax push 8 pop ecx lea edi, [ebp+var_74] rep stosd mov edi, [ebp+arg_0] mov eax, [edi+2Ch] test eax, eax jz short loc_A256B2 lea ecx, [eax+28h] cmp word ptr [eax+2], 34h sbb eax, eax not eax and eax, ecx mov [edx], eax mov eax, [edi+2Ch] mov [esi], eax xor edx, edx mov esi, edx jmp loc_A25A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A256B2: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+37j mov ecx, edi call _AslFileMappingEnsure@4 ; AslFileMappingEnsure(x) mov esi, eax test esi, esi jns short loc_A256DE push esi push offset ??_C@_0CB@GHEHFDAF@AslFileMappingEnsure?5failed?5?$FL?$CFx@NNGAKEGL@ push 66Ah push (offset loc_8C5897+1) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A25A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A256DE: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+62j cmp dword ptr [edi+28h], 6 jz short loc_A256EE mov esi, 0C0000089h jmp loc_A25A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A256EE: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+87j xor edx, edx mov [ebp+ms_exc.disabled], edx mov [ebp+var_50], 10h mov [ebp+var_4C], 1 mov [ebp+var_48], edx mov eax, [edi+18h] mov [ebp+var_34], eax mov ecx, [edi+1Ch] mov [ebp+var_38], ecx cmp [edi+27h], dl mov ecx, edx jnz short loc_A2571C mov ecx, 200h loc_A2571C: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+BAj push edx push edx lea edx, [ebp+var_24] push edx lea edx, [ebp+var_28] push edx push ecx push 3 lea ecx, [ebp+var_50] push ecx push eax call _LdrResSearchResource@32 ; LdrResSearchResource(x,x,x,x,x,x,x,x) mov esi, eax mov [ebp+var_20], esi test esi, esi jns loc_A2589B mov ecx, esi call _AslFileResourceNotFound@4 ; AslFileResourceNotFound(x) test eax, eax jnz loc_A25A06 cmp esi, 0C000007Bh jnz loc_A258C0 cmp [edi+27h], al jnz loc_A258C0 xor edx, edx cmp [edi+34h], edx jnz loc_A258C0 mov esi, 11Ch push esi ; size_t push edx ; int lea eax, [ebp+var_194] push eax ; void * call _memset add esp, 0Ch mov [ebp+var_194], esi mov [ebp+var_190], 6 push 2 pop eax mov [ebp+var_18C], eax push 3 push 1 push 3 push eax xor eax, eax push eax push eax call _VerSetConditionMask@16 ; VerSetConditionMask(x,x,x,x) push edx push eax call _VerSetConditionMask@16 ; VerSetConditionMask(x,x,x,x) push edx push eax push 3 lea eax, [ebp+var_194] push eax call RtlVerifyVersionInfo mov [ebp+var_20], eax test eax, eax jns short loc_A257D9 loc_A257CC: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+260j mov esi, 0C0000089h loc_A257D1: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+374j mov [ebp+var_20], esi jmp loc_A25A06 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A257D9: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+16Fj mov eax, [edi+8] xor edx, edx mov [ebp+var_58], dl mov [ebp+var_74], eax mov [ebp+var_20], edx mov dl, 1 lea ecx, [ebp+var_74] call _RtlFileMapMapView@8 ; RtlFileMapMapView(x,x) mov esi, eax mov [ebp+var_20], esi test esi, esi jns short loc_A25819 push esi push (offset loc_8C58AE+2) push 6C6h loc_A25805: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+235j push (offset loc_8C5897+1) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A25A06 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25819: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+19Dj push dword ptr [edi] push offset ??_C@_0DC@DPKBOOEO@Re?9mapped?5file?5as?5image?5to?5get?5@NNGAKEGL@ push 6CFh push (offset loc_8C5897+1) push 3 call AslLogCallPrintf add esp, 14h xor ecx, ecx push ecx push ecx lea eax, [ebp+var_24] push eax lea eax, [ebp+var_28] push eax push ecx push 3 lea eax, [ebp+var_50] push eax mov eax, [ebp+var_64] mov [ebp+var_34], eax push eax call _LdrResSearchResource@32 ; LdrResSearchResource(x,x,x,x,x,x,x,x) mov esi, eax mov [ebp+var_20], esi test esi, esi mov eax, (offset loc_8C5887+5) jns short loc_A25866 mov eax, offset ??_C@_1BK@GKLIJHC@?$AAD?$AAi?$AAd?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAf?$AAi?$AAn?$AAd@NNGAKEGL@ loc_A25866: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+204j push esi push eax push offset ??_C@_0DB@HCBHNBKL@?$CFls?5version?5block?5after?5re?9mapp@NNGAKEGL@ ; "%ls version block after re-mapping as i"... push 6DCh push (offset loc_8C5897+1) push 2 call AslLogCallPrintf add esp, 18h test esi, esi jns short loc_A25895 push esi push offset ??_C@_0BP@PMJGBMEO@LdrResFindResource?5failed?5?$FL?$CFx?$FN@NNGAKEGL@ push 6DFh jmp loc_A25805 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25895: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+228j mov eax, [ebp+var_60] mov [ebp+var_38], eax loc_A2589B: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+DFj cmp [ebp+var_28], 0 jnz short loc_A258E1 push esi push offset ??_C@_0EB@PANFBJOL@LdrResFindResource?5returned?5nul@NNGAKEGL@ push 6EEh push (offset loc_8C5897+1) push 1 call AslLogCallPrintf add esp, 14h jmp loc_A257CC ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A258C0: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+FAj ; AslpFileGetVersionBlock(x,x,x)+103j ... push esi push dword ptr [edi] push offset ??_C@_0CD@MLDHNGPC@LdrResFindResource?5failed?5?$CFls?5?$FL@NNGAKEGL@ push 6E7h push (offset loc_8C5897+1) push 1 call AslLogCallPrintf add esp, 18h jmp loc_A25A06 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A258E1: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+244j lea eax, [ebp+var_2C] push eax mov edx, [ebp+var_24] mov esi, [ebp+var_28] mov ecx, esi call _RtlULongPtrAdd@12 ; RtlULongPtrAdd(x,x,x) mov [ebp+var_20], eax test eax, eax jns short loc_A25908 push offset ??_C@_0BL@MHNFPBOP@Version?5block?5has?5bad?5size@NNGAKEGL@ push 6FCh jmp loc_A259EF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25908: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+29Cj mov ecx, [ebp+var_34] cmp esi, ecx jb loc_A259E5 mov eax, [ebp+var_38] add eax, ecx cmp [ebp+var_2C], eax ja loc_A259E5 cmp byte ptr [edi+27h], 0 jnz short loc_A25951 cmp [ebp+var_70], 0 jnz short loc_A25951 xor eax, eax add ecx, [edi+10h] adc eax, [edi+14h] xor edx, edx cmp edx, eax jb short loc_A25951 ja short loc_A25942 cmp [ebp+var_2C], ecx jbe short loc_A25951 loc_A25942: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+2E0j push offset ??_C@_0BL@FACOOBH@Version?5block?5out?5of?5range@NNGAKEGL@ push 71Ah jmp loc_A259EF ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25951: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+2CAj ; AslpFileGetVersionBlock(x,x,x)+2D0j ... cmp [ebp+var_24], 26h jb short loc_A259D4 push offset ??_C@_1CA@FOECMPGO@?$AAV?$AAS?$AA_?$AAV?$AAE?$AAR?$AAS?$AAI?$AAO?$AAN?$AA_?$AAI?$AAN?$AAF?$AAO@NNGAKEGL@ ; wchar_t * lea eax, [esi+6] push eax ; wchar_t * call __wcsicmp pop ecx pop ecx test eax, eax jnz short loc_A259D4 push ecx mov edx, [ebp+var_24] call _AslAlloc@12 ; AslAlloc(x,x,x) mov ebx, eax mov [ebp+var_30], ebx test ebx, ebx jnz short loc_A2598E mov esi, 0C0000017h push offset ??_C@_0O@NALGGDJF@Out?5of?5memory@NNGAKEGL@ push 730h jmp short loc_A259F4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A2598E: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+320j push [ebp+var_24] ; size_t push [ebp+var_28] ; void * push ebx ; void * call _memmove add esp, 0Ch movzx eax, word ptr [ebx] mov ecx, [ebp+var_24] cmp ecx, eax jnb short loc_A259AA mov [ebx], cx loc_A259AA: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+34Aj mov [edi+2Ch], ebx xor eax, eax mov ebx, eax mov [ebp+var_30], ebx mov ecx, [edi+2Ch] mov edx, [ebp+var_3C] cmp word ptr [ecx+2], 34h jb short loc_A259C4 lea eax, [ecx+28h] loc_A259C4: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+364j mov [edx], eax mov eax, [ebp+var_40] mov [eax], ecx xor edx, edx mov esi, edx jmp loc_A257D1 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A259D4: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+2FAj ; AslpFileGetVersionBlock(x,x,x)+30Ej mov esi, 0C00000E5h push offset ??_C@_0BG@NGDGBFBB@Version?5block?5invalid@NNGAKEGL@ ; "Version block invalid" push 725h jmp short loc_A259F4 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A259E5: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+2B2j ; AslpFileGetVersionBlock(x,x,x)+2C0j push offset ??_C@_0BL@FACOOBH@Version?5block?5out?5of?5range@NNGAKEGL@ push 708h loc_A259EF: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+2A8j ; AslpFileGetVersionBlock(x,x,x)+2F1j mov esi, 0C0000089h loc_A259F4: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+331j ; AslpFileGetVersionBlock(x,x,x)+388j push (offset loc_8C5897+1) push 1 mov [ebp+var_20], esi call AslLogCallPrintf add esp, 10h loc_A25A06: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+EEj ; AslpFileGetVersionBlock(x,x,x)+179j ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A25A4F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25A0F: ; DATA XREF: .text:006AAD94o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_44], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25A1D: ; DATA XREF: .text:006AAD98o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_44] mov [ebp+var_20], esi mov eax, [ebp+arg_0] push dword ptr [eax] push esi push offset ??_C@_0DC@KHINOBN@Exception?5retrieving?5version?5bl@NNGAKEGL@ push 756h push (offset loc_8C5897+1) push 1 call AslLogCallPrintf add esp, 18h mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov ebx, [ebp+var_30] loc_A25A4F: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+52j ; AslpFileGetVersionBlock(x,x,x)+7Ej ... test ebx, ebx jz short loc_A25A5E push 74705041h push ebx call _ExFreePoolWithTag@8 ; ExFreePoolWithTag(x,x) loc_A25A5E: ; CODE XREF: AslpFileGetVersionBlock(x,x,x)+3F6j lea ecx, [ebp+var_74] call RtlFileMapFree mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 _AslpFileGetVersionBlock@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileHasActiveMarkWrapper(x, x, x) _AslpFileHasActiveMarkWrapper@12 proc near ; CODE XREF: AslpFileGetExeWrapper(x,x)+7Dp var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 1Ch push offset dword_6AAD20 call __SEH_prolog4 mov [ebp+var_1C], edx mov eax, ecx mov [ebp+var_24], eax xor esi, esi mov edi, esi mov [eax], esi mov ebx, [ebp+arg_0] mov ecx, [ebx+1Ch] mov edx, [ebx+10h] mov eax, [ebx+14h] cmp eax, esi ja short loc_A25AAA jb short loc_A25AB2 cmp edx, ecx jb short loc_A25AAE loc_A25AAA: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+28j mov edx, ecx mov eax, esi loc_A25AAE: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+2Ej cmp eax, esi ja short loc_A25ABE loc_A25AB2: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+2Aj cmp edx, 400h jbe loc_A25BDB loc_A25ABE: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+36j xor ecx, ecx inc ecx cmp eax, ecx ja loc_A25BDB jb short loc_A25AD3 cmp edx, esi jnb loc_A25BDB loc_A25AD3: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+4Fj cmp [ebx+34h], esi jnz loc_A25BDB cmp [ebx+30h], esi jnz loc_A25BDB mov [ebp+ms_exc.disabled], esi mov ecx, [ebp+var_1C] movzx ecx, word ptr [ecx+18h] mov [ebp+arg_0], 10Bh cmp cx, word ptr [ebp+arg_0] jnz short loc_A25B07 mov edi, [ebp+var_1C] add edi, 98h jmp short loc_A25B1D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25B07: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+80j mov [ebp+arg_0], 20Bh cmp cx, word ptr [ebp+arg_0] jnz short loc_A25B1D mov edi, [ebp+var_1C] add edi, 0A8h loc_A25B1D: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+8Bj ; AslpFileHasActiveMarkWrapper(x,x,x)+98j test edi, edi jz short loc_A25B97 mov ecx, [edi+4] lea edi, [ecx+400h] cmp eax, esi jb short loc_A25B97 ja short loc_A25B34 cmp edx, edi jbe short loc_A25B97 loc_A25B34: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+B4j mov eax, [ebx+18h] sub eax, ecx lea ebx, [edx-400h] add ebx, eax lea edi, [ebx+3E6h] loc_A25B47: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+11Bj mov [ebp+var_28], edi cmp edi, ebx jb short loc_A25B9C push 8 ; size_t push offset aTmsamvof ; "TMSAMVOF" push edi ; void * call _memcmp add esp, 0Ch test eax, eax jnz short loc_A25B94 inc eax cmp ax, [edi+8] jnz short loc_A25B94 mov ecx, [edi+12h] xor edx, edx add ecx, [edi+0Eh] adc edx, esi add ecx, [edi+0Ah] adc edx, esi add ecx, 26Eh adc edx, esi cmp ecx, [edi+16h] jnz short loc_A25B94 cmp edx, esi jnz short loc_A25B94 mov eax, [ebp+var_24] mov dword ptr [eax], 1 jmp short loc_A25B9C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25B94: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+E6j ; AslpFileHasActiveMarkWrapper(x,x,x)+EDj ... dec edi jmp short loc_A25B47 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25B97: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+A5j ; AslpFileHasActiveMarkWrapper(x,x,x)+B2j ... mov esi, 0C0000225h loc_A25B9C: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+D2j ; AslpFileHasActiveMarkWrapper(x,x,x)+118j mov [ebp+var_20], esi loc_A25B9F: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+15Fj mov [ebp+ms_exc.disabled], 0FFFFFFFEh jmp short loc_A25BE0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25BA8: ; DATA XREF: .text:006AAD34o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_2C], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25BB6: ; DATA XREF: .text:006AAD38o mov esp, [ebp+ms_exc.old_esp] mov esi, [ebp+var_2C] mov [ebp+var_20], esi push esi push (offset loc_8C4D43+3) push 106Dh push offset ??_C@_0BN@JELEGGGH@AslpFileHasActiveMarkWrapper@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h jmp short loc_A25B9F ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25BDB: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+3Ej ; AslpFileHasActiveMarkWrapper(x,x,x)+49j ... mov esi, 0C0000225h loc_A25BE0: ; CODE XREF: AslpFileHasActiveMarkWrapper(x,x,x)+12Cj mov eax, esi mov ecx, [ebp+ms_exc.prev_er] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx leave retn 4 _AslpFileHasActiveMarkWrapper@12 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpFileHasArmadilloWrapper(x) _AslpFileHasArmadilloWrapper@4 proc near ; CODE XREF: AslpFileGetExeWrapper(x,x)+D4p cmp dword ptr [ecx], 4550h jnz short loc_A25C0C cmp byte ptr [ecx+1Ah], 53h jnz short loc_A25C0C cmp byte ptr [ecx+1Bh], 52h jnz short loc_A25C0C xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25C0C: ; CODE XREF: AslpFileHasArmadilloWrapper(x)+6j ; AslpFileHasArmadilloWrapper(x)+Cj ... xor eax, eax retn _AslpFileHasArmadilloWrapper@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileHasSecuromWrapper(x) _AslpFileHasSecuromWrapper@4 proc near ; CODE XREF: AslpFileGetExeWrapper(x,x)+62p var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp push ecx movzx eax, word ptr [ecx+14h] push ebx push esi push edi lea edi, [ecx+18h] mov [ebp+var_4], ecx add edi, eax xor esi, esi xor eax, eax mov ebx, esi cmp ax, [ecx+6] jnb short loc_A25C62 loc_A25C30: ; CODE XREF: AslpFileHasSecuromWrapper(x)+4Cj cmp [edi+0Ch], esi jz short loc_A25C51 cmp [edi+8], esi jz short loc_A25C51 push 8 ; size_t push offset ??_C@_08EFCIKEPK@?4securom@NNGAKEGL@ ; char * push edi ; char * call _strncmp add esp, 0Ch test eax, eax jz short loc_A25C5F mov ecx, [ebp+var_4] loc_A25C51: ; CODE XREF: AslpFileHasSecuromWrapper(x)+24j ; AslpFileHasSecuromWrapper(x)+29j movzx eax, word ptr [ecx+6] inc ebx add edi, 28h cmp ebx, eax jb short loc_A25C30 jmp short loc_A25C62 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25C5F: ; CODE XREF: AslpFileHasSecuromWrapper(x)+3Dj xor esi, esi inc esi loc_A25C62: ; CODE XREF: AslpFileHasSecuromWrapper(x)+1Fj ; AslpFileHasSecuromWrapper(x)+4Ej pop edi mov eax, esi pop esi pop ebx leave retn _AslpFileHasSecuromWrapper@4 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; __stdcall AslpFileMakeBinVersionAttributes(x, x) _AslpFileMakeBinVersionAttributes@8 proc near ; CODE XREF: AslpFileGetVersionAttributes(x,x)+59p mov edi, edi push esi mov esi, ecx test edx, edx jnz short loc_A25C95 push 2 pop ecx or [esi+148h], ecx or [esi+160h], ecx or [esi+178h], ecx or [esi+190h], ecx or [esi+70h], ecx or [esi+58h], ecx pop esi retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25C95: ; CODE XREF: AslpFileMakeBinVersionAttributes(x,x)+7j push ebx push edi push 2 pop ecx push 4 pop ebx mov [esi+13Ch], ebx xor edi, edi mov [esi+138h], ecx mov eax, [edx+2Ch] or dword ptr [esi+148h], 1 mov [esi+144h], edi mov [esi+154h], ebx mov [esi+140h], eax mov [esi+150h], ecx mov eax, [edx+30h] or dword ptr [esi+160h], 1 mov [esi+15Ch], edi mov [esi+16Ch], ebx mov [esi+158h], eax mov [esi+168h], ecx mov eax, [edx+20h] or dword ptr [esi+178h], 1 mov [esi+184h], ebx push 3 mov [esi+174h], edi pop ebx mov [esi+170h], eax mov [esi+180h], ecx mov eax, [edx+24h] or dword ptr [esi+190h], 1 mov [esi+18Ch], edi push 8 mov [esi+188h], eax mov eax, [edx+14h] mov ecx, [edx+10h] or dword ptr [esi+70h], 1 pop edi mov [esi+60h], ebx mov [esi+64h], edi mov [esi+68h], eax mov [esi+6Ch], ecx mov eax, [edx+0Ch] mov ecx, [edx+8] or dword ptr [esi+58h], 1 mov [esi+4Ch], edi pop edi mov [esi+48h], ebx pop ebx mov [esi+50h], eax mov [esi+54h], ecx pop esi retn _AslpFileMakeBinVersionAttributes@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileMakeStringVersionAttributes(x, x) _AslpFileMakeStringVersionAttributes@8 proc near ; CODE XREF: AslpFileGetVersionAttributes(x,x)+62p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 mov edi, edi push ebp mov ebp, esp sub esp, 20h push ebx xor ebx, ebx mov eax, edx mov [ebp+var_18], eax mov [ebp+var_20], ebx mov [ebp+var_C], ebx mov [ebp+var_1C], ebx mov [ebp+var_10], ebx mov [ebp+var_8], ebx mov [ebp+var_14], ebx push esi mov esi, ecx push edi test eax, eax jnz short loc_A25DC9 push 2 pop ebx or [esi+88h], ebx or [esi+0A0h], ebx or [esi+0B8h], ebx or [esi+0D0h], ebx or [esi+0E8h], ebx or [esi+100h], ebx or [esi+118h], ebx or [esi+130h], ebx loc_A25DBA: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+189j ; AslpFileMakeStringVersionAttributes(x,x)+193j or [esi+250h], ebx loc_A25DC0: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+1C0j xor eax, eax mov edi, eax jmp loc_A25F3C ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25DC9: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+28j lea ecx, [ebp+var_8] mov edx, offset ??_C@_1DC@HCLBMGIA@?$AA?2?$AAV?$AAa?$AAr?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?2?$AAT?$AAr@NNGAKEGL@ push ecx lea ecx, [ebp+var_10] push ecx mov ecx, eax call _AslpFileVerQueryBlock@16 ; AslpFileVerQueryBlock(x,x,x,x) mov edi, eax cmp edi, 0C0000225h jnz short loc_A25DF0 mov eax, ebx mov edi, ebx mov [ebp+var_4], eax jmp short loc_A25E36 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25DF0: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+88j test edi, edi jns short loc_A25E04 push edi push offset ??_C@_0CC@NIKDGGIJ@AslpFileVerQueryBlock?5failed?5?$FL?$CF@NNGAKEGL@ push 0A51h jmp loc_A25F2D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25E04: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+95j push [ebp+var_8] mov [ebp+var_4], ebx lea ecx, [ebp+var_14] mov edi, ebx mov ebx, [ebp+var_10] mov edx, ebx call _AslpFileVerBlockGetValueOffset@12 ; AslpFileVerBlockGetValueOffset(x,x,x) test eax, eax js short loc_A25E32 mov ecx, [ebp+var_14] cmp [ebp+var_8], ecx jbe short loc_A25E32 mov edi, [ebp+var_8] lea eax, [ecx+ebx] mov [ebp+var_4], eax sub edi, ecx jmp short loc_A25E34 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25E32: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+BEj ; AslpFileMakeStringVersionAttributes(x,x)+C6j mov eax, edi loc_A25E34: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+D3j xor ebx, ebx loc_A25E36: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+91j mov ecx, ebx shr edi, 2 push 2 mov [ebp+var_8], edi mov [ebp+var_10], ecx pop ebx loc_A25E44: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+175j push ds:off_404204[ecx] mov edx, ds:dword_404200[ecx] lea ecx, [ebp+var_C] push edi push eax push [ebp+var_18] mov [ebp+var_14], edx lea edx, [ebp+var_1C] call _AslpFileQueryVersionString@24 ; AslpFileQueryVersionString(x,x,x,x,x,x) mov edi, eax test edi, edi js short loc_A25EAE mov ecx, [ebp+var_C] call _AslStringXmlSanitize@4 ; AslStringXmlSanitize(x) mov edi, eax test edi, edi js short loc_A25ED7 imul edi, [ebp+var_14], 18h mov edx, [ebp+var_C] lea eax, [edx+2] mov dword ptr [edi+esi], 4 loc_A25E88: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+134j mov cx, [edx] add edx, ebx cmp cx, word ptr [ebp+var_20] jnz short loc_A25E88 sub edx, eax mov eax, [ebp+var_C] sar edx, 1 or dword ptr [edi+esi+10h], 1 mov [edi+esi+4], edx cdq mov [edi+esi+8], eax mov [edi+esi+0Ch], edx jmp short loc_A25EBE ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25EAE: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+10Aj cmp edi, 0C0000225h jnz short loc_A25F22 imul eax, [ebp+var_14], 18h or [eax+esi+10h], ebx loc_A25EBE: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+14Fj mov ecx, [ebp+var_10] mov eax, [ebp+var_4] add ecx, 8 mov [ebp+var_10], ecx cmp ecx, 40h jnb short loc_A25EE4 mov edi, [ebp+var_8] jmp loc_A25E44 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25ED7: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+118j push edi push offset ??_C@_0CB@KOMIGNHG@AslStringXmlSanitize?5failed?5?$FL?$CFx@NNGAKEGL@ push 0A7Bh jmp short loc_A25F2D ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25EE4: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+170j test eax, eax jz loc_A25DBA cmp [ebp+var_8], 1 jnz loc_A25DBA mov [esi+240h], ebx mov dword ptr [esi+244h], 4 movzx eax, word ptr [eax] or dword ptr [esi+250h], 1 cdq mov [esi+248h], eax mov [esi+24Ch], edx jmp loc_A25DC0 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25F22: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+157j push edi push (offset loc_8C5B81+3) push 0A88h loc_A25F2D: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+A2j ; AslpFileMakeStringVersionAttributes(x,x)+185j push offset ??_C@_0CE@OAAMAOIJ@AslpFileMakeStringVersionAttrib@NNGAKEGL@ push 1 call AslLogCallPrintf add esp, 14h loc_A25F3C: ; CODE XREF: AslpFileMakeStringVersionAttributes(x,x)+67j mov eax, edi pop edi pop esi pop ebx leave retn _AslpFileMakeStringVersionAttributes@8 endp ; 栢栢栢栢栢栢栢� S U B R O U T I N E 栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢� ; Attributes: bp-based frame ; __stdcall AslpFileQuery16BitDescription(x, x) _AslpFileQuery16BitDescription@8 proc near ; CODE XREF: AslpFileGet16BitDescription(x,x)+49p var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 20h push offset dword_6AACE0 call __SEH_prolog4 mov edi, ecx xor ebx, ebx mov [edi], bl cmp dword ptr [edx+28h], 5 jz short loc_A25F65 mov ebx, 0C00000BBh jmp loc_A26051 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25F65: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+16j mov [ebp+ms_exc.disabled], ebx mov esi, [edx+18h] mov [ebp+var_24], esi mov eax, [esi+3Ch] mov [ebp+var_28], eax mov eax, [edx+10h] mov [ebp+var_2C], eax mov ecx, [edx+14h] mov [ebp+var_20], ecx mov edx, [ebp+var_28] cmp ecx, ebx jb short loc_A25FF6 ja short loc_A25F90 lea ecx, [edx+40h] cmp eax, ecx jb short loc_A25FF6 loc_A25F90: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+44j mov ecx, [edx+esi+2Ch] lea edx, [ecx+1] cmp [ebp+var_20], ebx jb short loc_A25FF6 ja short loc_A25FA2 cmp eax, edx jb short loc_A25FF6 loc_A25FA2: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+59j movzx esi, byte ptr [ecx+esi] test esi, esi jz short loc_A25FEA lea eax, [esi+1] cmp eax, 100h ja short loc_A25FEA lea eax, [ecx+1] add eax, esi cmp [ebp+var_20], ebx ja short loc_A25FD1 jb short loc_A25FC5 cmp [ebp+var_2C], eax jnb short loc_A25FD1 loc_A25FC5: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+7Bj push (offset loc_8C5FF9+3) push 123Ch jmp short loc_A26000 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25FD1: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+79j ; AslpFileQuery16BitDescription(x,x)+80j push esi ; size_t mov eax, [ebp+var_24] inc eax add eax, ecx push eax ; void * push edi ; void * call _memcpy add esp, 0Ch mov [esi+edi], bl mov [ebp+var_1C], ebx jmp short loc_A2604A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25FEA: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+65j ; AslpFileQuery16BitDescription(x,x)+6Fj push (offset loc_8C5FF9+3) push 1236h jmp short loc_A26000 ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A25FF6: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+42j ; AslpFileQuery16BitDescription(x,x)+4Bj ... push (offset loc_8C5FF9+3) push 122Dh loc_A26000: ; CODE XREF: AslpFileQuery16BitDescription(x,x)+8Cj ; AslpFileQuery16BitDescription(x,x)+B1j push (offset loc_8C600E+4) mov ebx, 0C000007Bh push 1 mov [ebp+var_1C], ebx call AslLogCallPrintf add esp, 10h jmp short loc_A2604A ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A26019: ; DATA XREF: .text:006AACF4o mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_30], eax xor eax, eax inc eax retn ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� loc_A26027: ; DATA XREF: .text:006AACF8o mov esp, [ebp+ms_exc.old_esp] mov ebx, [ebp+var_30] mov [ebp+var_1C], ebx push ebx push (offset loc_8C4D43+3) push 1247h push (offset loc_8C600E+4) push 1 call AslLogCallPrintf add esp, 14h loc_A2604A: ; CODE XREF: AslpFileQuery