// File: DimitriFourny[P]uaf_replacer/main.cc
// Function: dump_member(rapidjson::GenericDocument<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator>, rapidjson::CrtAllocator> const&, rapidjson::GenericValue<rapidjson::UTF8<char>, rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator>> const&, unsigned long, unsigned int)
void dump_member(const rapidjson::Document& document,   
                 const rapidjson::Value& member, uint64_t base_offset, 
                 unsigned int deep_size) {
  if (!member.HasMember("name")) {
    return; 
  }

  // Dumped format: offset type name
  uint64_t offset = member["offset"].GetUint64() + base_offset;
  printf("    +0x%-3lx ", offset);
  for (size_t j = 0; j < deep_size; j++) {
    printf("    ");
  }

  const char* type_id = "";
  std::string type_name = "";
  if (member.HasMember("type_id")) {
    type_id = member["type_id"].GetString();
    type_name = get_type_name(document, type_id);
  }
  printf("%s %s\n", type_name.c_str(), member["name"].GetString());

  // Show the submembers
  if (document.HasMember(type_id)) {
    if (document[type_id].HasMember("members")) {
      dump_members(document, document[type_id], document[type_id]["members"], 
        offset, deep_size+1);
    }
  }
}

// Assembly:
subq $0x108, %rsp            # imm = 0x108
movq %rdi, 0x100(%rsp)
movq %rsi, 0xf8(%rsp)
movq %rdx, 0xf0(%rsp)
movl %ecx, 0xec(%rsp)
movq 0xf8(%rsp), %rdi
leaq 0xb054(%rip), %rsi      # 0xe0b9
callq 0x6c50
testb $0x1, %al
jne 0x3073
jmp 0x3375
movq 0xf8(%rsp), %rdi
leaq 0xb071(%rip), %rsi      # 0xe0f3
callq 0x6ca0
movq %rax, %rdi
callq 0x6dd0
addq 0xf0(%rsp), %rax
movq %rax, 0xe0(%rsp)
movq 0xe0(%rsp), %rsi
leaq 0xb04c(%rip), %rdi      # 0xe0fa
movb $0x0, %al
callq 0x2050
movq $0x0, 0xd8(%rsp)
movq 0xd8(%rsp), %rax
movl 0xec(%rsp), %ecx
cmpq %rcx, %rax
jae 0x30f9
leaq 0xb02c(%rip), %rdi      # 0xe108
movb $0x0, %al
callq 0x2050
movq 0xd8(%rsp), %rax
addq $0x1, %rax
movq %rax, 0xd8(%rsp)
jmp 0x30c1
leaq 0xafb6(%rip), %rax      # 0xe0b6
movq %rax, 0x68(%rsp)
movq %rax, 0xd0(%rsp)
leaq 0xaf(%rsp), %rdi
movq %rdi, 0x70(%rsp)
callq 0x2350
movq 0x68(%rsp), %rsi
movq 0x70(%rsp), %rdx
leaq 0xb0(%rsp), %rdi
callq 0x6b90
jmp 0x3138
leaq 0xaf(%rsp), %rdi
callq 0x2210
movq 0xf8(%rsp), %rdi
leaq 0xaf77(%rip), %rsi      # 0xe0cb
callq 0x6c50
movb %al, 0x67(%rsp)
jmp 0x315f
movb 0x67(%rsp), %al
testb $0x1, %al
jne 0x316c
jmp 0x322b
movq 0xf8(%rsp), %rdi
leaq 0xaf50(%rip), %rsi      # 0xe0cb
callq 0x6ca0
movq %rax, 0x58(%rsp)
jmp 0x3187
movq 0x58(%rsp), %rdi
callq 0x6cd0
movq %rax, 0x50(%rsp)
jmp 0x3198
movq 0x50(%rsp), %rax
movq %rax, 0xd0(%rsp)
movq 0x100(%rsp), %rsi
movq 0xd0(%rsp), %rdx
leaq 0x78(%rsp), %rdi
callq 0x2630
jmp 0x31c1
leaq 0xb0(%rsp), %rdi
leaq 0x78(%rsp), %rsi
callq 0x2290
leaq 0x78(%rsp), %rdi
callq 0x2130
jmp 0x322b
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0xa0(%rsp)
movl %eax, 0x9c(%rsp)
leaq 0xaf(%rsp), %rdi
callq 0x2210
jmp 0x337d
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0xa0(%rsp)
movl %eax, 0x9c(%rsp)
leaq 0xb0(%rsp), %rdi
callq 0x2130
jmp 0x337d
leaq 0xb0(%rsp), %rdi
callq 0x20c0
movq %rax, 0x40(%rsp)
movq 0xf8(%rsp), %rdi
leaq 0xae6d(%rip), %rsi      # 0xe0b9
callq 0x6ca0
movq %rax, 0x48(%rsp)
jmp 0x3258
movq 0x48(%rsp), %rdi
callq 0x6cd0
movq %rax, 0x38(%rsp)
jmp 0x3269
movq 0x38(%rsp), %rdx
movq 0x40(%rsp), %rsi
leaq 0xaeaf(%rip), %rdi      # 0xe129
xorl %eax, %eax
callq 0x2050
jmp 0x3283
movq 0x100(%rsp), %rdi
movq 0xd0(%rsp), %rsi
callq 0x6c50
movb %al, 0x37(%rsp)
jmp 0x329e
movb 0x37(%rsp), %al
testb $0x1, %al
jne 0x32ab
jmp 0x3368
movq 0x100(%rsp), %rdi
movq 0xd0(%rsp), %rsi
callq 0x6ca0
movq %rax, 0x28(%rsp)
jmp 0x32c7
movq 0x28(%rsp), %rdi
leaq 0xae3a(%rip), %rsi      # 0xe10d
callq 0x6c50
movb %al, 0x27(%rsp)
jmp 0x32de
movb 0x27(%rsp), %al
testb $0x1, %al
jne 0x32e8
jmp 0x3366
movq 0x100(%rsp), %rdi
movq %rdi, 0x10(%rsp)
movq 0xd0(%rsp), %rsi
callq 0x6ca0
movq %rax, 0x18(%rsp)
jmp 0x3309
movq 0x100(%rsp), %rdi
movq 0xd0(%rsp), %rsi
callq 0x6ca0
movq %rax, 0x8(%rsp)
jmp 0x3325
movq 0x8(%rsp), %rdi
leaq 0xaddc(%rip), %rsi      # 0xe10d
callq 0x6ca0
movq %rax, (%rsp)
jmp 0x333c
movq (%rsp), %rdx
movq 0x18(%rsp), %rsi
movq 0x10(%rsp), %rdi
movq 0xe0(%rsp), %rcx
movl 0xec(%rsp), %r8d
incl %r8d
callq 0x3390
jmp 0x3364
jmp 0x3366
jmp 0x3368
leaq 0xb0(%rsp), %rdi
callq 0x2130
addq $0x108, %rsp            # imm = 0x108
retq
movq 0xa0(%rsp), %rdi
callq 0x2340
nopw (%rax,%rax)