Function at 0x1400087a0
Capabilities:
Connect pipe
Create pipe
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x958]
sub rsp, 0xa58
mov r14, rcx
xor esi, esi
mov r15d, esi
mov dword [rbp + 0x9b0], esi
lea r12, [rcx + 0x44c8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm0
movups xmmword [r12 + 0x20], xmm0
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x40], xmm0
mov qword [r12 + 0x50], rax
mov dword [r12], 0x58
mov dword [rcx + 0x4518], 0x7d0
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
lea edx, [rsi + 3]
mov r9d, 0xff
lea r8d, [rsi + 6]
mov rcx, qword [rcx + 0x418]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b0f2
movsxd r13, dword [rbp + 0x9a0]
lea rdi, [0x140056dc8]
nop dword [rax]
test rbx, rbx
je 0x14000b0f2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x14000b0b0
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x9b8]
mov r8d, 0x100
lea rdx, [rbp + 0x450]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000b0b0
mov r8d, dword [rbp + 0x9b8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], rsi
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x120]
call fcn.140014220
nop
xor edx, edx
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::Value::constructor_enum_Json::ValueType____ptr64]
nop
lea rcx, [rbp + 0x310]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::CharReaderBuilder::constructor_void____ptr64]
nop
mov qword [rbp + 0x220], rdi
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts r15d, 8
mov dword [rbp + 0x9a8], r15d
mov dword [rbp + 0x9b0], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x220]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x220], rax
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x21c], edx
lea rax, [rbp + 0x230]
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x230], rax
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rdx, qword [rbp + 0x120]
mov r9d, 2
mov r8, qword [rbp + 0x130]
lea rcx, [rbp + 0x230]
call fcn.140010ff0
nop
xor r9d, r9d
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x310]
call qword [sym.imp.jsoncpp.dll_bool___cdecl_Json::parseFromStream_class_Json::CharReader::Factory_const____ptr64__class_std::basic_istream_char__struct_std::char_traits_char______ptr64__class_Json::Value____ptr64__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64_]
test al, al
je 0x14000affd
cmp dword [r14 + 0x420], 0
je 0x140008a7f
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rbx, rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::toStyledString_void____ptr64]
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140008a28
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140015860
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140008a7f
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b126
call fcn.140045f24
lea rdx, [0x1400560e4]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x140008ec7
lea rdx, [0x1400560e4]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0x10
cmovae rbx, qword [rbp + 0x1b8]
mov dword [rax], esi
mov r8d, 0x10
lea rdx, [rbp + 0x190]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
cmp rbx, qword [rbp + 0x190]
je 0x14000b157
cmp dword [rdi], 0x22
je 0x14000b149
mov rcx, qword [r14 + 0x458]
mov rdx, rsi
movsxd r8, dword [rcx + 0x423c]
test r8, r8
jle 0x140008b43
add rcx, 0x3138
cmp rax, qword [rcx - 0x1000]
jb 0x140008b37
cmp rax, qword [rcx]
jbe 0x140008c7f
inc rdx
add rcx, 8
cmp rdx, r8
jl 0x140008b25
mov eax, esi
test eax, eax
jne 0x140008e86
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov ecx, 0x20
call fcn.140045f2c
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x1b
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.Indirect_Syscall_Detected__]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400560f8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056100]
mov word [rax + 0x18], cx
movzx ecx, byte [0x140056102]
mov byte [rax + 0x1a], cl
mov byte [rax + 0x1b], 0
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x30]
call fcn.140010120
mov rcx, rax
call fcn.140003f20
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov ecx, 0x50
call fcn.140045f2c
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x78], 0x4f
movaps xmm0, xmmword [str.Indirect_Syscalls_detection_through_stack_pointers_health_Check.]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140056120]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140056130]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140056140]
movups xmmword [rax + 0x30], xmm1
mov byte [rax + 0x40], 0
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
bts r15d, 0xe
mov dword [rbp + 0x9a8], r15d
mov r9d, 0x104
lea r8, [rbp + 0x340]
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x40], xmm0
test eax, eax
jne 0x140008c89
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], al
jmp 0x140008cc2
mov eax, 1
jmp 0x140008b45
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x340]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008ca0
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x40]
call fcn.140014220
mov dword [rbp + 0x9a8], r15d
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rbp + 0x1b8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.140005ca0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140008d2b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b12d
call fcn.140045f24
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008d7b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b134
call fcn.140045f24
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rax
call fcn.140015860
lea rdx, [0x140055bc8]
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [r14 + 8]
mov rcx, r14
call fcn.1400086d0
call qword [r14 + 0x448]
call qword [r14 + 0x450]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140008e30
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b13b
call fcn.140045f24
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140008e86
inc rdx
mov qword [rbp + 0x9b0], rdx
mov rcx, qword [rbp - 0x60]
mov qword [rbp - 0x38], rcx
cmp rdx, 0x1000
jb 0x140008e80
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp - 0x38]
call fcn.140001780
mov rdx, qword [rbp + 0x9b0]
mov rcx, qword [rbp - 0x38]
call fcn.140045f24
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x140008ec7
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ec2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b142
call fcn.140045f24
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x140009050
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
or r15d, 1
mov dword [rbp + 0x9a8], r15d
mov dword [rbp + 0x9b0], r15d
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140008f1f
mov rax, qword [rax]
cmp r8, 0x10
jne 0x140008f3c
lea rdx, str.00007FFA71EEC5F4
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140009050
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
or r15d, 2
mov dword [rbp + 0x9a8], r15d
mov dword [rbp + 0x9b0], r15d
lea rdx, str.00007FFA71EEACF4
mov rcx, rax
call fcn.140012630
test al, al
je 0x140009050
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
or r15d, 4
mov dword [rbp + 0x9a8], r15d
mov dword [rbp + 0x9b0], r15d
lea rdx, str.00007FF83EE4ACF4
mov rcx, rax
call fcn.140012630
test al, al
je 0x140009050
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
or r15d, 8
mov dword [rbp + 0x9a8], r15d
mov dword [rbp + 0x9b0], r15d
lea rdx, str.00007FF83EE4C5F4
mov rcx, rax
call fcn.140012630
test al, al
je 0x140009050
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
or r15d, 0x10
mov dword [rbp + 0x9a8], r15d
lea rdx, str.00007FF83EE4A034
mov rcx, rax
call fcn.140012630
test al, al
je 0x140009050
mov bl, 1
jmp 0x140009052
xor bl, bl
test r15b, 0x10
je 0x1400090ae
and r15d, 0xffffffef
mov dword [rbp + 0x9a8], r15d
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000909e
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b165
call fcn.140045f24
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
test r15b, 8
je 0x14000910a
and r15d, 0xfffffff7
mov dword [rbp + 0x9a8], r15d
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400090fa
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b16c
call fcn.140045f24
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
test r15b, 4
je 0x140009166
and r15d, 0xfffffffb
mov dword [rbp + 0x9a8], r15d
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140009156
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b173
call fcn.140045f24
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
test r15b, 2
je 0x1400091c2
and r15d, 0xfffffffd
mov dword [rbp + 0x9a8], r15d
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400091b2
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b17a
call fcn.140045f24
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
test r15b, 1
je 0x14000921e
and r15d, 0xfffffffe
mov dword [rbp + 0x9a8], r15d
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000920e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b181
call fcn.140045f24
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
test bl, bl
je 0x1400094e4
lea rsi, [r14 + 8]
mov rcx, qword [rsi]
call qword [0x1400633c0]
lea rdx, [0x140056154]
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp + 0x198]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
mov eax, dword [0x1400633f0]
mov dword [r14 + 0x4538], eax
test eax, eax
je 0x140009271
mov rdx, qword [rsi]
mov rcx, r14
call fcn.14000b2b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0x10
cmovae rbx, qword [rbp + 0x198]
xor eax, eax
mov dword [rdi], eax
lea r8d, [rax + 0x10]
lea rdx, [rbp + 0x188]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
mov r14, rax
cmp rbx, qword [rbp + 0x188]
je 0x14000b19d
cmp dword [rdi], 0x22
je 0x14000b18f
mov ecx, 0x12
call qword [sym.imp.dbghelp.dll_SymSetOptions]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rsi]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov rcx, qword [rbp + 0x9a0]
cmp dword [rcx + 0x453c], 0
je 0x140009490
lea r8, [rcx + 0x4520]
mov r9, r12
mov rdx, r14
mov rcx, qword [rsi]
call qword [sym.imp.dbghelp.dll_SymFromAddr]
test eax, eax
jne 0x140009439
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea r8, [rbp + 0x198]
lea rdx, str.Direct_Syscall_stub_at
lea rcx, [rbp + 0x30]
call fcn.140012680
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xc8]
call fcn.140010120
mov rcx, rax
call fcn.140003f20
lea rdx, str.Direct_Syscall_detection_through_callbacks_interceptions.
lea rcx, [rbp - 0x10]
call fcn.1400100e0
mov rdi, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8, rsi
lea rcx, [rbp + 0xc8]
call fcn.140005620
mov rbx, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rbp + 0x198]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov edx, eax
lea rcx, [rbp + 0x1f8]
call fcn.140005ca0
nop
lea rcx, [rbp + 0xc8]
call fcn.1400038c0
nop
lea rcx, [rbp - 0x10]
call fcn.1400038c0
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rcx, rax
lea rdx, [rbp + 0x1f8]
call fcn.1400118f0
mov rcx, rax
lea rdx, [0x140055bc8]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsi]
mov r14, qword [rbp + 0x9a0]
mov rcx, r14
call fcn.1400086d0
call qword [r14 + 0x448]
call qword [r14 + 0x450]
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400038c0
nop
lea rcx, [rbp + 0x30]
call fcn.1400038c0
jmp 0x140009497
mov rcx, qword [rsi]
call qword [0x1400633c0]
mov r14, qword [rbp + 0x9a0]
cmp dword [r14 + 0x420], 0
je 0x140009485
lea rdx, str._t___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rcx, rax
lea rdx, [r14 + 0x451c]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsi]
call qword [0x1400634b0]
jmp 0x140009497
mov r14, qword [rbp + 0x9a0]
mov rcx, qword [rsi]
call qword [0x1400634b0]
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x1400094e2
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b188
call fcn.140045f24
xor esi, esi
lea rdx, str.Thread
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x14000951c
lea rdx, str.Thread_Created
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Function
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x14000aff6
mov rcx, qword [r14 + 8]
call qword [0x1400633c0]
mov rdi, qword [r14 + 0x458]
mov r9d, 0x30
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400095aa
lea rbx, [rdi + 0x8258]
nop dword [rax + rax]
mov rax, qword [rbp + 0x30]
mov qword [rbx - 0x4000], rax
mov rcx, qword [rbp + 0x48]
lea rdx, [rcx + rax]
mov qword [rbx], rdx
mov qword [rbx + 0x4000], rcx
lea rbx, [rbx + 8]
mov r9d, 0x30
lea r8, [rbp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x140009570
lea rdx, str.Hexdump
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
jne 0x14000afc3
cmp dword [r14 + 0x4540], 0
jne 0x1400096b5
mov edx, dword [r14 + 0x420]
mov rcx, qword [r14 + 0x458]
call fcn.140002bb0
mov rbx, qword [r14 + 0x458]
lea rdx, str.C:WindowsSYSTEM32_amsi.dll
lea rcx, [rbp + 0x30]
call fcn.1400100e0
mov rdx, rax
mov rcx, rbx
call fcn.140002ab0
test eax, eax
je 0x1400096b5
mov dword [r14 + 0x4540], 1
lea r8, str.amsi.dll
mov rdx, qword [r14 + 8]
mov rcx, qword [r14 + 0x458]
call fcn.1400032d0
lea rdx, str.AmsiScanBuffer
mov rcx, qword [r14 + 0x458]
call fcn.1400027e0
mov rsi, rax
lea rdx, str.AmsiOpenSession
mov rcx, qword [r14 + 0x458]
call fcn.1400027e0
mov rdi, rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtTraceEvent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.EtwEventWrite
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r14 + 0x4550], rdi
mov qword [r14 + 0x4558], rsi
mov qword [r14 + 0x4560], rax
mov qword [r14 + 0x4568], rbx
lea rcx, [r14 + 0x4548]
mov edx, dword [r14 + 0x4540]
call fcn.140007300
test eax, eax
jne 0x14000971d
lea rdx, str.Malicious_process_detected____Patch_._Killing_it...
lea rcx, [rbp + 0x30]
call fcn.1400100e0
mov rcx, rax
call fcn.140003f20
mov r9d, 0x30
lea r8, str.Best_Edr_Of_The_Market
lea rdx, str.Malicious_process_detected____Patching_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0xffffffff
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
movsxd rax, dword [rbp + 0x9a0]
test rax, rax
je 0x140009735
movsxd rax, dword [rbp + 0x9a0]
test rax, rax
jne 0x140009786
lea rdx, str.Malicious_process_detected____AMSI_Patch_._Killing_it...
lea rcx, [rbp + 0x30]
call fcn.1400100e0
mov rcx, rax
call fcn.140003f20
mov r9d, 0x30
lea r8, str.Best_Edr_Of_The_Market
lea rdx, str.Malicious_process_detected____AMSI_Patching_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0xffffffff
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
test r13, r13
je 0x140009797
movsxd rax, dword [rbp + 0x9a0]
test rax, rax
jne 0x1400097e8
lea rdx, str.Malicious_process_detected____ETW_Patch_._Killing_it...
lea rcx, [rbp + 0x30]
call fcn.1400100e0
mov rcx, rax
call fcn.140003f20
mov r9d, 0x30
lea r8, str.Best_Edr_Of_The_Market
lea rdx, str.Malicious_process_detected____ETW_Patching_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0xffffffff
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
cmp dword [r14 + 0x4530], 0
je 0x140009925
lea rbx, [r14 + 0x460]
mov qword [rbp + 0xf8], rbx
mov edx, dword [r14 + 0x420]
mov rcx, rbx
call fcn.140003b10
xor ecx, ecx
mov dword [rbp + 0x9b0], ecx
cmp qword [r14 + 0x44b8], rcx
jbe 0x140009925
lea r13, [r14 + 0x4b8]
mov edi, 0x1ba0
sub rdi, r14
mov qword [rbp + 0x180], rdi
nop
mov edx, ecx
mov rcx, rbx
call fcn.140003a50
mov r12, rax
cmp dword [r14 + 0x4534], 0
je 0x14000986e
lea rcx, [rbx + rdi]
mov r8, qword [rcx + r13]
mov rdx, rax
mov rcx, qword [0x1400634a8]
call fcn.1400162e0
mov rcx, qword [r14 + 0x440]
mov rax, qword [rcx + 8]
mov qword [rbp - 0x38], rax
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400098fc
mov rcx, rax
nop dword [rax + rax]
mov rax, qword [rbx + 0x18]
mov r14, qword [rbx + 0x10]
mov rsi, qword [r13 + 0x2000]
test r12, r12
je 0x1400098e3
test r14, r14
je 0x1400098e3
cmp rax, rsi
ja 0x1400098e3
xor edi, edi
sub rsi, rax
lea r15, [rax - 1]
nop word [rax + rax]
lea rcx, [rdi + r12]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400099d0
inc rdi
cmp rdi, rsi
jbe 0x1400098c0
mov rcx, qword [rbp - 0x38]
mov r14, qword [rbp + 0x9a0]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rcx
jne 0x140009890
mov rdi, qword [rbp + 0x180]
mov ecx, dword [rbp + 0x9b0]
inc ecx
mov dword [rbp + 0x9b0], ecx
add r13, 8
movsxd rax, ecx
cmp rax, qword [r14 + 0x44b8]
mov rbx, qword [rbp + 0xf8]
jb 0x140009840
lea rdx, str.Function
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
mov r14, qword [rbp + 0x98]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xc
jb 0x14000b29b
lea r15, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0x10
cmovae r15, qword [rbp + 0x88]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rsi, [r14 + 0xc]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp rsi, rbx
jbe 0x140009d88
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140009d30
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140009d57
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xor esi, esi
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], 0xf
lea ecx, [rsi + 0x40]
call fcn.140045f2c
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], 0x34
mov qword [rbp + 0x178], 0x3f
movups xmm0, xmmword [str.Malicious_process_detected______Heap_._Killing_it...]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400563b8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400563c8]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x1400563d8]
mov dword [rax + 0x30], ecx
mov byte [rax + 0x34], sil
lea rcx, [rbp + 0x160]
call fcn.140003f20
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
call fcn.1400021f0
mov rdi, rax
mov rcx, qword [r13]
mov qword [rbp + 0xf0], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
lea ecx, [rsi + 0x20]
call fcn.140045f2c
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0x15
mov qword [rsp + 0x78], 0x1f
movups xmm0, xmmword [str.Heap_Regions_Analysis]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400563f0]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400563f4]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], sil
mov r14, qword [rbp + 0x9a0]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r15d, dword [rbp + 0x9a8]
bts r15d, 9
mov dword [rbp + 0x9a8], r15d
mov r9d, 0x104
lea r8, [rbp + 0x340]
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x40], xmm0
test eax, eax
jne 0x140009b1e
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], al
jmp 0x140009b53
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x340]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140009b31
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x40]
call fcn.140014220
mov dword [rbp + 0x9a8], r15d
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x1d8]
call fcn.1400061f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140009bc4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1ab
call fcn.140045f24
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140009c14
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1b2
call fcn.140045f24
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140009c62
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1b9
call fcn.140045f24
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
lea rdx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 0x10
cmovae rdx, qword [rbp + 0x1d8]
mov r8, qword [rbp + 0x1e8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015860
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x30
lea r8, str.Best_Edr_Of_The_Market
lea rdx, str.Malicious_process_detected____Heap_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0xffffffff
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
nop
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0x10
jb 0x140009d27
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1c0
call fcn.140045f24
mov rcx, qword [rbp - 0x38]
jmp 0x1400098ea
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140009d76
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b1c7
mov rcx, rax
call fcn.140045f2c
test rax, rax
je 0x14000b1cd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009d83
test rcx, rcx
je 0x140009d80
call fcn.140045f2c
mov rdi, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
movsd xmm0, qword [str.Intercepted]
movsd qword [rdi], xmm0
mov eax, dword [0x140056428]
mov dword [rdi + 8], eax
lea rcx, [rdi + 0xc]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
or dword [rbp + 0x9a8], 0x2000
lea rax, [rsp + 0x40]
mov qword [rbp + 0x9b0], rax
lea rdx, str.e_48_5_4m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rcx, rax
lea rdx, [0x140055c30]
call fcn.140011ae0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.140015860
lea rdx, str.e_0m
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140009e6d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1cd
call fcn.140045f24
lea rdx, str.Size
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x140009edb
lea rdx, str.Size
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140009edb
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1d4
call fcn.140045f24
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], 0xf
mov byte [rbp + 0xa8], sil
lea rdx, str.RawData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x140009fc1
lea rdx, str.RawData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140009f40
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140011150
lea rdx, str.RawData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140009f80
mov qword [rbp + 0x9b0], rcx
test rcx, rcx
je 0x140009fc1
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0xa8]
call fcn.1400025e0
mov r9d, 8
mov r8d, r9d
mov rdx, rax
lea rcx, [rbp + 0xe8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__memccpy]
mov r14, qword [rbp + 0x9a0]
mov rcx, qword [r14 + 8]
call qword [0x1400633c0]
lea rdx, str.StringData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Value::isMember_char_const____ptr64_const___ptr64]
test al, al
je 0x14000a09e
lea rdx, str.StringData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a010
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140011150
lea rdx, str.StringData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000a050
test rcx, rcx
je 0x14000a09e
lea rdx, str.StringData
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400100e0
nop
lea rcx, [rbp + 0x30]
call fcn.140001f80
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0x30]
call fcn.1400038c0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
lea r8, [rbp + 0x550]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000a1f9
cmp dword [r14 + 0x4534], 0
je 0x14000a10c
mov r8, qword [rbp - 0x40]
lea rdx, [rbp + 0x550]
mov rcx, qword [0x1400634a8]
call fcn.1400162e0
test eax, eax
je 0x14000a10c
mov rdx, qword [r14 + 8]
mov rcx, r14
call fcn.1400086d0
call qword [r14 + 0x448]
call qword [r14 + 0x450]
mov rax, qword [r14 + 0x428]
mov r13, qword [rax + 8]
mov rbx, qword [r13]
mov r12, qword [rbp - 0x40]
cmp rbx, r13
je 0x14000a189
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x18]
mov r14, qword [rbx + 0x10]
test r14, r14
je 0x14000a177
cmp rax, r12
ja 0x14000a177
mov rdi, rsi
mov rsi, r12
sub rsi, rax
lea r15, [rax - 1]
nop
lea rcx, [rbp + 0x550]
add rcx, rdi
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000a2ba
inc rdi
cmp rdi, rsi
jbe 0x14000a150
xor esi, esi
mov r14, qword [rbp + 0x9a0]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r13
jne 0x14000a130
mov rax, qword [r14 + 0x430]
mov r13, qword [rax + 8]
mov rbx, qword [r13]
cmp rbx, r13
je 0x14000a1f9
nop dword [rax]
mov rax, qword [rbx + 0x18]
mov r14, qword [rbx + 0x10]
test r14, r14
je 0x14000a1e7
cmp rax, r12
ja 0x14000a1e7
mov rdi, rsi
mov rsi, r12
sub rsi, rax
lea r15, [rax - 1]
nop
lea rcx, [rbp + 0x550]
add rcx, rdi
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000a933
inc rdi
cmp rdi, rsi
jbe 0x14000a1c0
xor esi, esi
mov r14, qword [rbp + 0x9a0]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r13
jne 0x14000a1a0
mov rcx, qword [r14 + 8]
call qword [0x1400634b0]
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14000a246
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a240
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b28d
call fcn.140045f24
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x14000a287
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a282
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b294
call fcn.140045f24
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], 0xf
mov byte [rbp + 0x88], 0
mov r15d, dword [rbp + 0x9a8]
lea r12, [r14 + 0x44c8]
movsxd r13, dword [rbp + 0x9a0]
jmp 0x14000afec
mov rcx, qword [rbp + 0x9a0]
mov rdx, qword [rcx + 8]
call fcn.1400086d0
mov r8, qword [rbp - 0x40]
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x30]
call fcn.1400021f0
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0xc
mov qword [rbp - 0x18], 0xf
movsd xmm0, qword [str.DLL_Patterns]
movsd qword [rbp - 0x30], xmm0
mov ecx, dword [0x140056458]
mov dword [rbp - 0x28], ecx
mov byte [rbp - 0x24], 0
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0xc8]
call fcn.1400021f0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 2
mov qword [rbp - 0x48], 0xf
mov eax, 0x7830
mov word [rbp - 0x60], ax
mov byte [rbp - 0x5e], 0
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb8]
lea rcx, [rbp - 0x60]
call fcn.140010d30
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor edx, edx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rdx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], 0xf
mov byte [rax], dl
mov edi, dword [rbp + 0x9a8]
bts edi, 0xc
mov dword [rbp + 0x9a8], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov rsi, qword [rbp + 0x98]
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0x10
cmovae r14, qword [rbp + 0x88]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14000b22e
mov qword [rsp + 0x78], 0xf
cmp rsi, 0x10
jae 0x14000a417
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x60], xmm0
jmp 0x14000a4b2
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x14000a436
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000a45d
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000a47f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b1e2
mov rcx, rax
call fcn.140045f2c
mov rcx, rax
test rax, rax
je 0x14000b1db
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000a48e
test rcx, rcx
je 0x14000a48b
call fcn.140045f2c
jmp 0x14000a48e
mov rax, rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rbp + 0x9a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x68], 0xf
mov rax, qword [str.Hooked]
mov dword [rbp - 0x80], eax
movzx eax, word [0x140056464]
mov word [rbp - 0x7c], ax
movzx eax, byte [0x140056466]
mov byte [rbp - 0x7a], al
mov byte [rbp - 0x79], 0
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.140014f90
bts edi, 0xb
mov r14, qword [rbp + 0x9a0]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
bts edi, 0xa
mov dword [rbp + 0x9a8], edi
mov r9d, 0x104
lea r8, [rbp + 0x340]
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
test eax, eax
jne 0x14000a559
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], sil
jmp 0x14000a590
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x340]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x14000a570
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x40]
call fcn.140014220
mov dword [rbp + 0x9a8], edi
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x140]
call fcn.1400056a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000a60b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a606
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1e8
call fcn.140045f24
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000a659
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a654
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1ef
call fcn.140045f24
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000a6a5
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a69f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1f6
call fcn.140045f24
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000a6e3
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a6dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1fd
call fcn.140045f24
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000a71e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a719
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b204
call fcn.140045f24
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000a769
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a764
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b20b
call fcn.140045f24
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x14000a7ba
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a7b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b212
call fcn.140045f24
mov qword [rbp + 0xd8], rsi
mov qword [rbp + 0xe0], 0xf
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a80e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b219
call fcn.140045f24
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000a859
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a854
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b220
call fcn.140045f24
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rdx, qword [rbp + 0x140]
mov r8, qword [rbp + 0x150]
mov rcx, rax
call fcn.140015860
lea rdx, [0x140055bc8]
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14000a911
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a90c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b227
call fcn.140045f24
mov qword [rbp + 0x150], rsi
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov r12, qword [rbp - 0x40]
jmp 0x14000a17e
mov rcx, qword [rbp + 0x9a0]
mov rdx, qword [rcx + 8]
call fcn.1400086d0
mov r8, qword [rbp - 0x40]
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0xc8]
call fcn.1400021f0
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0xf
lea ecx, [rax + 0x20]
call fcn.140045f2c
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], 0x10
mov qword [rbp - 0x18], 0x1f
movups xmm0, xmmword [str.General_Patterns]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x30]
call fcn.1400021f0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 2
mov qword [rbp - 0x68], 0xf
mov eax, 0x7830
mov word [rbp - 0x80], ax
mov byte [rbp - 0x7e], 0
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb8]
lea rcx, [rbp - 0x80]
call fcn.140010d30
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor edx, edx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rdx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], 0xf
mov byte [rax], dl
mov edi, dword [rbp + 0x9a8]
bts edi, 7
mov dword [rbp + 0x9a8], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov rsi, qword [rbp + 0x98]
lea r14, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0x10
cmovae r14, qword [rbp + 0x88]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14000b287
mov qword [rsp + 0x78], 0xf
cmp rsi, 0x10
jae 0x14000aa9e
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x60], xmm0
jmp 0x14000ab39
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x14000aabd
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000aae4
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000ab06
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b23b
mov rcx, rax
call fcn.140045f2c
mov rcx, rax
test rax, rax
je 0x14000b234
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000ab15
test rcx, rcx
je 0x14000ab12
call fcn.140045f2c
jmp 0x14000ab15
mov rax, rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rbp + 0x9a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0xf
mov qword [rbp - 0x48], 0xf
movsd xmm0, qword [str.DLL_Hooking_on]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x140056488]
mov dword [rbp - 0x58], eax
movzx eax, word [0x14005648c]
mov word [rbp - 0x54], ax
movzx eax, byte [0x14005648e]
mov byte [rbp - 0x52], al
mov byte [rbp - 0x51], 0
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x10]
call fcn.140014f90
or edi, 0x40
mov r14, qword [rbp + 0x9a0]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
or edi, 0x20
mov dword [rbp + 0x9a8], edi
mov r9d, 0x104
lea r8, [rbp + 0x340]
xor edx, edx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
test eax, eax
jne 0x14000abea
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], sil
jmp 0x14000ac20
mov qword [rsp + 0x58], rsi
lea rax, [rbp + 0x340]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x14000ac00
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x40]
call fcn.140014220
mov dword [rbp + 0x9a8], edi
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x100]
call fcn.1400056a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000ac9b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b241
call fcn.140045f24
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000ace9
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ace4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b248
call fcn.140045f24
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000ad35
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b24f
call fcn.140045f24
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000ad73
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b256
call fcn.140045f24
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000adae
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ada9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b25d
call fcn.140045f24
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000adf9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b264
call fcn.140045f24
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000ae44
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b26b
call fcn.140045f24
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000ae8f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b272
call fcn.140045f24
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x14000aee0
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aedb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b279
call fcn.140045f24
mov qword [rbp + 0xd8], rsi
mov qword [rbp + 0xe0], 0xf
mov byte [rbp + 0xc8], 0
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
mov rcx, rax
call fcn.140015860
lea rdx, [0x140055bc8]
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [r14 + 0x448]
call qword [r14 + 0x450]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x14000afa1
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b280
call fcn.140045f24
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov r12, qword [rbp - 0x40]
jmp 0x14000a1ee
lea rdx, str.Hexdump
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_char_const____ptr64___cdecl_Json::Value::asCString_void_const___ptr64]
mov rdx, rax
lea rcx, [0x140056490]
call fcn.140001580
mov rcx, qword [r14 + 8]
call qword [0x1400634b0]
lea rdi, [0x140056dc8]
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x220], rax
mov rax, qword [rbp + 0x220]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x21c], edx
lea rcx, [rbp + 0x230]
call fcn.140010020
lea rcx, [rbp + 0x238]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x310]
call qword [sym.imp.jsoncpp.dll_public_virtual:_void___cdecl_Json::CharReaderBuilder::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x60]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::Value::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x14000b0b0
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2a1
call fcn.140045f24
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov edx, 3
mov r9d, 0xff
lea r8d, [rdx + 3]
mov rcx, qword [r14 + 0x418]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140008860
lea rdx, str.Error_when_initializing_BEOTM_pipe.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400039a0
mov ecx, 0xffffffe7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400016e0
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400016e0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400017b0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400016e0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400017b0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400017b0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3