// File: DimitriFourny[P]uaf_replacer/main.cc
// Function: dump_members(rapidjson::GenericDocument<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator>, rapidjson::CrtAllocator> const&, rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator>> const&, rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator>> const&, unsigned long, unsigned int)
void dump_members(const rapidjson::Document& document, 
                  const rapidjson::Value& current_element, 
                  const rapidjson::Value& members, uint64_t base_offset, 
                  unsigned int deep_size) {
  // Dealing with the parents right now
  struct parent {
    size_t offset;
    const char* id;
  };
  std::vector<parent> parents;
  if (current_element.HasMember("parents")) {
    for (size_t i = 0; i < current_element["parents"].Size(); i++) {
      parents.push_back({
        current_element["parents"][i]["offset"].GetUint(),
        current_element["parents"][i]["id"].GetString()
      });
    }

    std::sort(parents.begin(), parents.end(), [](const parent& a, 
                                                 const parent& b) {
      return a.offset < b.offset;
    });
  }

  for (size_t i = 0; i < members.Size(); i++) {
    if (parents.size() > 0 && members[i].HasMember("offset")) {
      if (parents[0].offset < members[i]["offset"].GetUint()) {
        dump_parent(document, parents[0].id, base_offset + parents[0].offset, 
          deep_size);
        parents.erase(parents.begin());
      }
    }

    dump_member(document, members[i], base_offset, deep_size);
  }
}

// Assembly:
subq $0x1a8, %rsp            # imm = 0x1A8
movq %rdi, 0x1a0(%rsp)
movq %rsi, 0x198(%rsp)
movq %rdx, 0x190(%rsp)
movq %rcx, 0x188(%rsp)
movl %r8d, 0x184(%rsp)
leaq 0x168(%rsp), %rdi
callq 0x3a60
movq 0x198(%rsp), %rdi
leaq 0xad55(%rip), %rsi      # 0xe130
callq 0x6c50
movb %al, 0x107(%rsp)
jmp 0x33e9
movb 0x107(%rsp), %al
testb $0x1, %al
jne 0x33f9
jmp 0x362e
movq $0x0, 0x150(%rsp)
movq 0x150(%rsp), %rax
movq %rax, 0xf0(%rsp)
movq 0x198(%rsp), %rdi
leaq 0xad0c(%rip), %rsi      # 0xe130
callq 0x6ca0
movq %rax, 0xf8(%rsp)
jmp 0x3433
movq 0xf8(%rsp), %rdi
callq 0x6f70
movl %eax, 0xec(%rsp)
jmp 0x3449
movq 0xf0(%rsp), %rax
movl 0xec(%rsp), %ecx
movl %ecx, %ecx
cmpq %rcx, %rax
jae 0x35e3
leaq 0x140(%rsp), %rax
movq %rax, 0xd8(%rsp)
movq 0x198(%rsp), %rdi
leaq 0xacae(%rip), %rsi      # 0xe130
callq 0x6ca0
movq %rax, 0xe0(%rsp)
jmp 0x3491
movq 0xe0(%rsp), %rdi
movl 0x150(%rsp), %esi
callq 0x6fc0
movq %rax, 0xd0(%rsp)
jmp 0x34af
movq 0xd0(%rsp), %rdi
leaq 0xac35(%rip), %rsi      # 0xe0f3
callq 0x6ca0
movq %rax, 0xc8(%rsp)
jmp 0x34cd
movq 0xc8(%rsp), %rdi
callq 0x6fe0
movl %eax, 0xc4(%rsp)
jmp 0x34e3
movq 0xd8(%rsp), %rax
movl 0xc4(%rsp), %ecx
movl %ecx, %ecx
movq %rcx, (%rax)
leaq 0x148(%rsp), %rax
movq %rax, 0xb0(%rsp)
movq 0x198(%rsp), %rdi
leaq 0xac1a(%rip), %rsi      # 0xe130
callq 0x6ca0
movq %rax, 0xb8(%rsp)
jmp 0x3525
movq 0xb8(%rsp), %rdi
movl 0x150(%rsp), %esi
callq 0x6fc0
movq %rax, 0xa8(%rsp)
jmp 0x3543
movq 0xa8(%rsp), %rdi
leaq 0xab7e(%rip), %rsi      # 0xe0d0
callq 0x6ca0
movq %rax, 0xa0(%rsp)
jmp 0x3561
movq 0xa0(%rsp), %rdi
callq 0x6cd0
movq %rax, 0x98(%rsp)
jmp 0x3578
movq 0xb0(%rsp), %rax
movq 0x98(%rsp), %rcx
movq %rcx, (%rax)
leaq 0x168(%rsp), %rdi
leaq 0x140(%rsp), %rsi
callq 0x3a70
jmp 0x35a2
jmp 0x35a4
movq 0x150(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x150(%rsp)
jmp 0x3405
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x160(%rsp)
movl %eax, 0x15c(%rsp)
leaq 0x168(%rsp), %rdi
callq 0x3c30
jmp 0x387f
leaq 0x168(%rsp), %rdi
movq %rdi, 0x90(%rsp)
callq 0x3ae0
movq 0x90(%rsp), %rdi
movq %rax, 0x138(%rsp)
callq 0x3b10
movq %rax, 0x130(%rsp)
movq 0x138(%rsp), %rdi
movq 0x130(%rsp), %rsi
callq 0x3aa0
jmp 0x362c
jmp 0x362e
movq $0x0, 0x120(%rsp)
movq 0x120(%rsp), %rax
movq %rax, 0x80(%rsp)
movq 0x190(%rsp), %rdi
callq 0x6f70
movl %eax, 0x8c(%rsp)
jmp 0x3660
movq 0x80(%rsp), %rax
movl 0x8c(%rsp), %ecx
movl %ecx, %ecx
cmpq %rcx, %rax
jae 0x386a
leaq 0x168(%rsp), %rdi
callq 0x3b40
cmpq $0x0, %rax
jbe 0x3807
movq 0x190(%rsp), %rdi
movl 0x120(%rsp), %esi
callq 0x6fc0
movq %rax, 0x78(%rsp)
jmp 0x36ac
movq 0x78(%rsp), %rdi
leaq 0xaa3b(%rip), %rsi      # 0xe0f3
callq 0x6c50
movb %al, 0x77(%rsp)
jmp 0x36c3
movb 0x77(%rsp), %al
testb $0x1, %al
jne 0x36d0
jmp 0x3807
xorl %eax, %eax
movl %eax, %esi
leaq 0x168(%rsp), %rdi
callq 0x3b60
movq (%rax), %rax
movq %rax, 0x60(%rsp)
movq 0x190(%rsp), %rdi
movl 0x120(%rsp), %esi
callq 0x6fc0
movq %rax, 0x68(%rsp)
jmp 0x3704
movq 0x68(%rsp), %rdi
leaq 0xa9e3(%rip), %rsi      # 0xe0f3
callq 0x6ca0
movq %rax, 0x58(%rsp)
jmp 0x371c
movq 0x58(%rsp), %rdi
callq 0x6fe0
movl %eax, 0x54(%rsp)
jmp 0x372c
movq 0x60(%rsp), %rax
movl 0x54(%rsp), %ecx
movl %ecx, %ecx
cmpq %rcx, %rax
jae 0x3805
movq 0x1a0(%rsp), %rax
movq %rax, 0x40(%rsp)
xorl %eax, %eax
movl %eax, %esi
movq %rsi, 0x30(%rsp)
leaq 0x168(%rsp), %rdi
movq %rdi, 0x28(%rsp)
callq 0x3b60
movq 0x28(%rsp), %rdi
movq 0x30(%rsp), %rsi
movq 0x8(%rax), %rax
movq %rax, 0x48(%rsp)
movq 0x188(%rsp), %rax
movq %rax, 0x38(%rsp)
callq 0x3b60
movq 0x38(%rsp), %rdx
movq 0x40(%rsp), %rdi
movq 0x48(%rsp), %rsi
movq (%rax), %rax
addq %rax, %rdx
movl 0x184(%rsp), %ecx
callq 0x3890
jmp 0x37b0
leaq 0x168(%rsp), %rdi
movq %rdi, 0x18(%rsp)
callq 0x3ae0
movq %rax, 0x110(%rsp)
leaq 0x118(%rsp), %rdi
leaq 0x110(%rsp), %rsi
callq 0x3bf0
movq 0x18(%rsp), %rdi
movq 0x118(%rsp), %rsi
callq 0x3b80
movq %rax, 0x20(%rsp)
jmp 0x37f8
movq 0x20(%rsp), %rax
movq %rax, 0x108(%rsp)
jmp 0x3807
movq 0x1a0(%rsp), %rax
movq %rax, 0x8(%rsp)
movq 0x190(%rsp), %rdi
movl 0x120(%rsp), %esi
callq 0x6fc0
movq %rax, 0x10(%rsp)
jmp 0x382f
movq 0x10(%rsp), %rsi
movq 0x8(%rsp), %rdi
movq 0x188(%rsp), %rdx
movl 0x184(%rsp), %ecx
callq 0x3030
jmp 0x384f
jmp 0x3851
movq 0x120(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x120(%rsp)
jmp 0x363a
leaq 0x168(%rsp), %rdi
callq 0x3c30
addq $0x1a8, %rsp            # imm = 0x1A8
retq
movq 0x160(%rsp), %rdi
callq 0x2340
nopl (%rax)