Function at 0x140011988
Capabilities:
Enumerate process modules
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
jmp 0x14002a230
push rbp
push rdi
mov eax, 0x6518
call fcn.1400112b2
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x17ba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140044018]
xor rax, rbp
mov qword [rbp + 0x64d8], rax
lea rcx, [0x14004c104]
call fcn.140011e0b
lea rcx, [rbp + 8]
call fcn.1400240a0
nop
lea rdx, str.Windows10Universal.exe
lea rcx, [rbp + 8]
call fcn.1400115af
movzx eax, al
test eax, eax
je 0x14002b1ce
call fcn.1400282c0
lea rdx, str._NEZY_CHECKER__initializing_for_UWP...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
lea rcx, [rbp + 0x48]
call fcn.1400115e1
lea rdx, [0x14003c728]
lea rcx, [rbp + 0x6068]
call fcn.140011497
nop
lea rdx, [rbp + 0x6068]
lea rcx, [rbp + 0x48]
call fcn.140011b22
nop
lea rcx, [rbp + 0x6068]
call fcn.140011bf4
lea rdx, str..text
lea rcx, [rbp + 0x60a8]
call fcn.14001165e
nop
lea r8, [rbp + 0x60a8]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.140011406
nop
lea rcx, [rbp + 0x60a8]
call fcn.1400112c1
mov eax, dword [rbp + 0x70]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xf8], rax
lea rdx, str._NEZY_SEGMENT__segment_size:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_SEGMENT__segment_start:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_SEGMENT__segment_end:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x60e8], rax
mov rcx, qword [rbp + 0x60e8]
call fcn.140011627
mov qword [rbp + 0x6108], rax
cmp qword [rbp + 0x6108], 0
je 0x14002a4a4
mov rdi, qword [rbp + 0x6108]
xor eax, eax
mov rcx, qword [rbp + 0x60e8]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x6108]
mov qword [rbp + 0x64b8], rax
jmp 0x14002a4af
mov qword [rbp + 0x64b8], 0
mov rax, qword [rbp + 0x64b8]
mov qword [0x140044750], rax
mov dword [rbp + 0x114], 0
mov dword [rbp + 0x134], 0
mov edx, 0x20
lea rcx, [rbp + 0x158]
call fcn.1400111a4
lea rcx, [rbp + 0x158]
call fcn.140011028
nop
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0xf8]
cmp qword [rbp + 0x198], rax
jae 0x14002a6c3
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x48]
call fcn.140011e9c
cmp eax, 1
jne 0x14002a57a
lea rdx, str._PAGES__got_encrypted_page_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x158]
call fcn.140011ab4
mov eax, dword [rbp + 0x114]
inc eax
mov dword [rbp + 0x114], eax
jmp 0x14002a65d
lea rdx, str._PAGES__got_decrypted_page_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x48]
call fcn.140011005
lea r9, [rbp + 0x1c0]
mov r8d, 0x1000
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x48]
call fcn.140011dde
mov qword [rbp + 0x11d8], 0
jmp 0x14002a5ff
mov rax, qword [rbp + 0x11d8]
inc rax
mov qword [rbp + 0x11d8], rax
cmp qword [rbp + 0x11d8], 0x1000
jae 0x14002a63b
mov rax, qword [rbp + 0x11d8]
mov rcx, qword [0x140044758]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140044750]
mov rdx, qword [rbp + 0x11d8]
movzx edx, byte [rbp + rdx + 0x1c0]
mov byte [rcx + rax], dl
jmp 0x14002a5ee
mov rax, qword [0x140044758]
add rax, 0x1000
mov qword [0x140044758], rax
mov eax, dword [rbp + 0x134]
inc eax
mov dword [rbp + 0x134], eax
xor edx, edx
mov rax, qword [rbp + 0xb8]
mov ecx, 0x1000
div rcx
mov qword [rbp + 0x64b8], rax
xor edx, edx
mov rax, qword [0x140044758]
mov ecx, 0x1000
div rcx
inc rax
mov rcx, qword [rbp + 0x64b8]
cmp rax, rcx
jne 0x14002a6aa
lea rdx, str._PAGES__all_pages_done_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
jmp 0x14002a6c3
mov rax, qword [rbp + 0x198]
add rax, 0x1000
mov qword [rbp + 0x198], rax
jmp 0x14002a4fd
lea rdx, str._PAGES__total_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov eax, dword [rbp + 0x134]
mov ecx, dword [rbp + 0x114]
add ecx, eax
mov eax, ecx
mov edx, eax
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._PAGES__encrypted_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x114]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._PAGES__decrypted_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x134]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x11f4], 0
mov edx, 0x20
lea rcx, [rbp + 0x1218]
call fcn.1400111a4
lea rcx, [rbp + 0x1218]
call fcn.140011028
nop
mov edx, 0x20
lea rcx, [rbp + 0x1258]
call fcn.1400110cd
lea rcx, [rbp + 0x1258]
call fcn.1400119a6
nop
mov edx, 0x20
lea rcx, [rbp + 0x1298]
call fcn.1400110cd
lea rcx, [rbp + 0x1298]
call fcn.1400119a6
nop
mov dword [rbp + 0x12d4], 0
xor eax, eax
cmp eax, 1
je 0x14002ab4f
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x14002a84e
lea rcx, [rbp + 0x158]
call fcn.140011708
test rax, rax
jne 0x14002a89b
lea rdx, str._PAGE_DECRYPTOR__total_got_decrypted:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x11f4]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14002ab4f
cmp dword [rbp + 0x12d4], 0x3e8
jne 0x14002a8be
lea rcx, [0x14003cb08]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x12d4], 0
mov dword [rbp + 0x12f4], 0
jmp 0x14002a8d8
mov eax, dword [rbp + 0x12f4]
inc eax
mov dword [rbp + 0x12f4], eax
lea rcx, [rbp + 0x158]
call fcn.140011708
movsxd rcx, dword [rbp + 0x12f4]
cmp rcx, rax
jae 0x14002aab7
movsxd rax, dword [rbp + 0x12f4]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011e9c
cmp eax, 1
je 0x14002aab2
lea r9, [rbp + 0x1320]
mov r8d, 0x1000
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x48]
call fcn.140011dde
mov qword [rbp + 0x2338], 0
jmp 0x14002a95a
mov rax, qword [rbp + 0x2338]
inc rax
mov qword [rbp + 0x2338], rax
cmp qword [rbp + 0x2338], 0x1000
jae 0x14002a996
mov rax, qword [rbp + 0x2338]
mov rcx, qword [0x140044760]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140044750]
mov rdx, qword [rbp + 0x2338]
movzx edx, byte [rbp + rdx + 0x1320]
mov byte [rcx + rax], dl
jmp 0x14002a949
movsxd rax, dword [rbp + 0x12f4]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov rdx, rax
lea rcx, [rbp + 0x1218]
call fcn.140011ab4
mov eax, 1
imul rax, rax, 0x1000
lea rax, [rbp + rax + 0x1320]
mov rdx, rax
lea rcx, [rbp + 0x1258]
call fcn.14001191f
mov rax, qword [0x140044760]
add rax, 0x1000
mov qword [0x140044760], rax
mov eax, dword [rbp + 0x11f4]
inc eax
mov dword [rbp + 0x11f4], eax
lea rax, [rbp + 0x6128]
mov qword [rbp + 0x6158], rax
lea rdx, [rbp + 0x6178]
lea rcx, [rbp + 0x158]
call fcn.140011cbc
mov qword [rbp + 0x64b8], rax
mov rax, qword [rbp + 0x64b8]
mov qword [rbp + 0x64c0], rax
movsxd rax, dword [rbp + 0x12f4]
mov r8, rax
lea rdx, [rbp + 0x61a8]
mov rcx, qword [rbp + 0x64c0]
call fcn.140011b45
mov qword [rbp + 0x64c8], rax
mov rdx, qword [rbp + 0x64c8]
mov rcx, qword [rbp + 0x6158]
call fcn.1400114e7
mov qword [rbp + 0x64d0], rax
mov r8, qword [rbp + 0x64d0]
lea rdx, [rbp + 0x61d8]
lea rcx, [rbp + 0x158]
call fcn.140011226
lea rcx, [rbp + 0x61d8]
call fcn.140011a37
lea rcx, [rbp + 0x61a8]
call fcn.140011a37
lea rcx, [rbp + 0x6178]
call fcn.140011a37
jmp 0x14002a8ca
lea rdx, str._PAGE_DECRYPTOR__got_decrypted:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x11f4]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, str._encrypted_in_array:
mov rcx, rax
call fcn.1400111b8
mov qword [rbp + 0x64c0], rax
lea rcx, [rbp + 0x158]
call fcn.140011708
mov qword [rbp + 0x64c8], rax
mov rdx, qword [rbp + 0x64c8]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64d0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, dword [rbp + 0x12d4]
inc eax
mov dword [rbp + 0x12d4], eax
jmp 0x14002a822
mov dword [rbp + 0x2354], 0
jmp 0x14002ab69
mov eax, dword [rbp + 0x2354]
inc eax
mov dword [rbp + 0x2354], eax
lea rcx, [rbp + 0x158]
call fcn.140011708
movsxd rcx, dword [rbp + 0x2354]
cmp rcx, rax
jae 0x14002ac21
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011ca8
mov byte [rbp + 0x6204], al
lea rdx, [rbp + 0x6204]
lea rcx, [rbp + 0x1298]
call fcn.140011ee7
movsxd rax, dword [rbp + 0x2354]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov r9d, 1
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
jmp 0x14002ab5b
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._PAGE_DECRYPTOR__writing_to_file...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x118
lea rcx, [rbp + 0x2380]
call fcn.140011c4e
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
lea rdx, str..text.bin
lea rcx, [rbp + 0x2380]
call fcn.140011c9e
nop
lea rax, [rbp + 0x2390]
mov qword [rbp + 0x64b8], rax
mov r8, qword [rbp + 0xb8]
mov rdx, qword [0x140044750]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x2380]
call fcn.140011267
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._NEZY_MAGIC__freezing_roblox_and_threads...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14003c728]
lea rcx, [rbp + 0x6228]
call fcn.140011497
nop
lea rdx, [rbp + 0x6228]
lea rcx, [rbp + 0x48]
call fcn.140011db1
mov ecx, eax
call fcn.140011118
nop
lea rcx, [rbp + 0x6228]
call fcn.140011bf4
mov edx, 0x20
lea rcx, [rbp + 0x24b8]
call fcn.14001185c
lea rdx, [rbp + 0x24b8]
lea rcx, [rbp + 0x48]
call fcn.1400113de
nop
mov dword [rbp + 0x24f4], 0
jmp 0x14002ad79
mov eax, dword [rbp + 0x24f4]
inc eax
mov dword [rbp + 0x24f4], eax
lea rcx, [rbp + 0x24b8]
call fcn.1400113fc
movsxd rcx, dword [rbp + 0x24f4]
cmp rcx, rax
jae 0x14002adb8
movsxd rax, dword [rbp + 0x24f4]
mov rdx, rax
lea rcx, [rbp + 0x24b8]
call fcn.140011221
mov rcx, rax
call fcn.140011843
nop
jmp 0x14002adb2
jmp 0x14002adb6
jmp 0x14002ad6b
lea rdx, str._NEZY_MAGIC__hooking_pages...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x2514], 0
jmp 0x14002ae00
mov eax, dword [rbp + 0x2514]
inc eax
mov dword [rbp + 0x2514], eax
lea rcx, [rbp + 0x1218]
call fcn.140011708
movsxd rcx, dword [rbp + 0x2514]
cmp rcx, rax
jae 0x14002af3a
lea rdx, str._NEZY_MAGIC__writing_page_memory:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x2514]
mov rdx, rax
lea rcx, [rbp + 0x1218]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov rdx, qword [rbp + 0x64c0]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd rax, dword [rbp + 0x2514]
mov rdx, rax
lea rcx, [rbp + 0x1218]
call fcn.140011e33
mov r9d, 8
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
movsxd rax, dword [rbp + 0x2514]
mov rdx, rax
lea rcx, [rbp + 0x1258]
call fcn.140011dd9
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x2514]
mov rdx, rax
lea rcx, [rbp + 0x1218]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov r8, qword [rbp + 0x64b8]
mov rdx, qword [rbp + 0x64c0]
lea rcx, [rbp + 0x48]
call fcn.140011140
movsxd rax, dword [rbp + 0x2514]
mov rdx, rax
lea rcx, [rbp + 0x1218]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
jmp 0x14002adf2
mov dword [rbp + 0x2534], 0
jmp 0x14002af54
mov eax, dword [rbp + 0x2534]
inc eax
mov dword [rbp + 0x2534], eax
lea rcx, [rbp + 0x158]
call fcn.140011708
movsxd rcx, dword [rbp + 0x2534]
cmp rcx, rax
jae 0x14002b08e
lea rdx, str._NEZY_MAGIC__writing_recovered_page:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x2534]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov rdx, qword [rbp + 0x64c0]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd rax, dword [rbp + 0x2534]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov r9d, 8
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
movsxd rax, dword [rbp + 0x2534]
mov rdx, rax
lea rcx, [rbp + 0x1298]
call fcn.140011dd9
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x2534]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov r8, qword [rbp + 0x64b8]
mov rdx, qword [rbp + 0x64c0]
lea rcx, [rbp + 0x48]
call fcn.140011140
movsxd rax, dword [rbp + 0x2534]
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.140011005
jmp 0x14002af46
lea rdx, str._NEZY_DUMPER__ready_for_dumping_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140011230
lea rdx, str._NEZY_DUMPER__roblox_dumped_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_DUMPER__terminating_roblox...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._DONE__decryptor_work_done_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 0x24b8]
call fcn.140011429
nop
lea rcx, [rbp + 0x2380]
call fcn.140011bbd
nop
lea rcx, [rbp + 0x1298]
call fcn.140011447
nop
lea rcx, [rbp + 0x1258]
call fcn.140011447
nop
lea rcx, [rbp + 0x1218]
call fcn.1400116fe
nop
lea rcx, [rbp + 0x158]
call fcn.1400116fe
nop
lea rcx, [rbp + 0x68]
call fcn.140011942
jmp 0x14002c25a
call fcn.1400282c0
lea rdx, str._NEZY_CHECKER__initializing_for_Web_Client...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 8
lea rcx, [rbp + 0x2558]
call fcn.1400115e1
lea rdx, [0x14003c780]
lea rcx, [rbp + 0x6268]
call fcn.140011497
nop
lea rdx, [rbp + 0x6268]
lea rcx, [rbp + 0x2558]
call fcn.140011b22
nop
lea rcx, [rbp + 0x6268]
call fcn.140011bf4
lea rdx, str..text
lea rcx, [rbp + 0x62a8]
call fcn.14001165e
nop
lea r8, [rbp + 0x62a8]
lea rdx, [rbp + 0x2578]
lea rcx, [rbp + 0x2558]
call fcn.140011406
nop
lea rcx, [rbp + 0x62a8]
call fcn.1400112c1
mov eax, dword [rbp + 0x2580]
mov qword [rbp + 0x25c8], rax
mov rax, qword [rbp + 0x2578]
mov qword [rbp + 0x25e8], rax
mov rax, qword [rbp + 0x25c8]
mov rcx, qword [rbp + 0x25e8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2608], rax
lea rdx, str._NEZY_SEGMENT__segment_size:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0x25c8]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_SEGMENT__segment_start:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0x25e8]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_SEGMENT__segment_end:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov rdx, qword [rbp + 0x2608]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov rax, qword [rbp + 0x25c8]
mov qword [rbp + 0x62e8], rax
mov rcx, qword [rbp + 0x62e8]
call fcn.140011627
mov qword [rbp + 0x6308], rax
cmp qword [rbp + 0x6308], 0
je 0x14002b3ec
mov rdi, qword [rbp + 0x6308]
xor eax, eax
mov rcx, qword [rbp + 0x62e8]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x6308]
mov qword [rbp + 0x64b8], rax
jmp 0x14002b3f7
mov qword [rbp + 0x64b8], 0
mov rax, qword [rbp + 0x64b8]
mov qword [0x140044750], rax
mov dword [rbp + 0x2624], 0
mov dword [rbp + 0x2644], 0
mov edx, 0x20
lea rcx, [rbp + 0x2668]
call fcn.1400111a4
lea rcx, [rbp + 0x2668]
call fcn.140011028
nop
mov rax, qword [rbp + 0x25e8]
mov qword [rbp + 0x26a8], rax
mov rax, qword [rbp + 0x2608]
cmp qword [rbp + 0x26a8], rax
jae 0x14002b614
mov rdx, qword [rbp + 0x26a8]
lea rcx, [rbp + 0x2558]
call fcn.140011e9c
cmp eax, 1
jne 0x14002b4c5
lea rdx, str._PAGES__got_encrypted_page_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x26a8]
lea rcx, [rbp + 0x2668]
call fcn.140011ab4
mov eax, dword [rbp + 0x2624]
inc eax
mov dword [rbp + 0x2624], eax
jmp 0x14002b5ae
lea rdx, str._PAGES__got_decrypted_page_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rbp + 0x26a8]
lea rcx, [rbp + 0x2558]
call fcn.140011005
lea r9, [rbp + 0x26d0]
mov r8d, 0x1000
mov rdx, qword [rbp + 0x26a8]
lea rcx, [rbp + 0x2558]
call fcn.140011dde
mov qword [rbp + 0x36e8], 0
jmp 0x14002b550
mov rax, qword [rbp + 0x36e8]
inc rax
mov qword [rbp + 0x36e8], rax
cmp qword [rbp + 0x36e8], 0x1000
jae 0x14002b58c
mov rax, qword [rbp + 0x36e8]
mov rcx, qword [0x140044758]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140044750]
mov rdx, qword [rbp + 0x36e8]
movzx edx, byte [rbp + rdx + 0x26d0]
mov byte [rcx + rax], dl
jmp 0x14002b53f
mov rax, qword [0x140044758]
add rax, 0x1000
mov qword [0x140044758], rax
mov eax, dword [rbp + 0x2644]
inc eax
mov dword [rbp + 0x2644], eax
xor edx, edx
mov rax, qword [rbp + 0x25c8]
mov ecx, 0x1000
div rcx
mov qword [rbp + 0x64b8], rax
xor edx, edx
mov rax, qword [0x140044758]
mov ecx, 0x1000
div rcx
inc rax
mov rcx, qword [rbp + 0x64b8]
cmp rax, rcx
jne 0x14002b5fb
lea rdx, str._PAGES__all_pages_done_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
jmp 0x14002b614
mov rax, qword [rbp + 0x26a8]
add rax, 0x1000
mov qword [rbp + 0x26a8], rax
jmp 0x14002b445
lea rdx, str._PAGES__total_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov eax, dword [rbp + 0x2644]
mov ecx, dword [rbp + 0x2624]
add ecx, eax
mov eax, ecx
mov edx, eax
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._PAGES__encrypted_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x2624]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._PAGES__decrypted_pages:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x2644]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x3704], 0
mov edx, 0x20
lea rcx, [rbp + 0x3728]
call fcn.1400111a4
lea rcx, [rbp + 0x3728]
call fcn.140011028
nop
mov edx, 0x20
lea rcx, [rbp + 0x3768]
call fcn.1400110cd
lea rcx, [rbp + 0x3768]
call fcn.1400119a6
nop
mov edx, 0x20
lea rcx, [rbp + 0x37a8]
call fcn.1400110cd
lea rcx, [rbp + 0x37a8]
call fcn.1400119a6
nop
mov dword [rbp + 0x37e4], 0
xor eax, eax
cmp eax, 1
je 0x14002baa6
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x14002b79f
lea rcx, [rbp + 0x2668]
call fcn.140011708
test rax, rax
jne 0x14002b7ec
lea rdx, str._PAGE_DECRYPTOR__total_got_decrypted:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x3704]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov qword [rbp + 0x64c0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14002baa6
cmp dword [rbp + 0x37e4], 0x3e8
jne 0x14002b80f
lea rcx, [0x14003cb08]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x37e4], 0
mov dword [rbp + 0x3804], 0
jmp 0x14002b829
mov eax, dword [rbp + 0x3804]
inc eax
mov dword [rbp + 0x3804], eax
lea rcx, [rbp + 0x2668]
call fcn.140011708
movsxd rcx, dword [rbp + 0x3804]
cmp rcx, rax
jae 0x14002ba0e
movsxd rax, dword [rbp + 0x3804]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011e9c
cmp eax, 1
je 0x14002ba09
lea r9, [rbp + 0x3830]
mov r8d, 0x1000
mov rdx, qword [rbp + 0x26a8]
lea rcx, [rbp + 0x2558]
call fcn.140011dde
mov qword [rbp + 0x4848], 0
jmp 0x14002b8b1
mov rax, qword [rbp + 0x4848]
inc rax
mov qword [rbp + 0x4848], rax
cmp qword [rbp + 0x4848], 0x1000
jae 0x14002b8ed
mov rax, qword [rbp + 0x4848]
mov rcx, qword [0x140044760]
add rcx, rax
mov rax, rcx
mov rcx, qword [0x140044750]
mov rdx, qword [rbp + 0x4848]
movzx edx, byte [rbp + rdx + 0x3830]
mov byte [rcx + rax], dl
jmp 0x14002b8a0
movsxd rax, dword [rbp + 0x3804]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov rdx, rax
lea rcx, [rbp + 0x3728]
call fcn.140011ab4
mov eax, 1
imul rax, rax, 0x1000
lea rax, [rbp + rax + 0x3830]
mov rdx, rax
lea rcx, [rbp + 0x3768]
call fcn.14001191f
mov rax, qword [0x140044760]
add rax, 0x1000
mov qword [0x140044760], rax
mov eax, dword [rbp + 0x3704]
inc eax
mov dword [rbp + 0x3704], eax
lea rax, [rbp + 0x6328]
mov qword [rbp + 0x6358], rax
lea rdx, [rbp + 0x6378]
lea rcx, [rbp + 0x2668]
call fcn.140011cbc
mov qword [rbp + 0x64b8], rax
mov rax, qword [rbp + 0x64b8]
mov qword [rbp + 0x64c0], rax
movsxd rax, dword [rbp + 0x3804]
mov r8, rax
lea rdx, [rbp + 0x63a8]
mov rcx, qword [rbp + 0x64c0]
call fcn.140011b45
mov qword [rbp + 0x64c8], rax
mov rdx, qword [rbp + 0x64c8]
mov rcx, qword [rbp + 0x6358]
call fcn.1400114e7
mov qword [rbp + 0x64d0], rax
mov r8, qword [rbp + 0x64d0]
lea rdx, [rbp + 0x63d8]
lea rcx, [rbp + 0x2668]
call fcn.140011226
lea rcx, [rbp + 0x63d8]
call fcn.140011a37
lea rcx, [rbp + 0x63a8]
call fcn.140011a37
lea rcx, [rbp + 0x6378]
call fcn.140011a37
jmp 0x14002b81b
lea rdx, str._PAGE_DECRYPTOR__got_decrypted:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
mov edx, dword [rbp + 0x3704]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, str._encrypted_in_array:
mov rcx, rax
call fcn.1400111b8
mov qword [rbp + 0x64c0], rax
lea rcx, [rbp + 0x2668]
call fcn.140011708
mov qword [rbp + 0x64c8], rax
mov rdx, qword [rbp + 0x64c8]
mov rcx, qword [rbp + 0x64c0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64d0], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, dword [rbp + 0x37e4]
inc eax
mov dword [rbp + 0x37e4], eax
jmp 0x14002b773
mov dword [rbp + 0x4864], 0
jmp 0x14002bac0
mov eax, dword [rbp + 0x4864]
inc eax
mov dword [rbp + 0x4864], eax
lea rcx, [rbp + 0x2668]
call fcn.140011708
movsxd rcx, dword [rbp + 0x4864]
cmp rcx, rax
jae 0x14002bb81
movsxd rax, dword [rbp + 0x4864]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
movsxd rax, dword [rbp + 0x4864]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011ca8
mov byte [rbp + 0x6404], al
lea rdx, [rbp + 0x6404]
lea rcx, [rbp + 0x37a8]
call fcn.140011ee7
movsxd rax, dword [rbp + 0x4864]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov r9d, 1
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
jmp 0x14002bab2
lea rdx, str._PAGE_DECRYPTOR__done_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str._NEZY_MAGIC__freezing_roblox_and_threads...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14003c780]
lea rcx, [rbp + 0x6428]
call fcn.140011497
nop
lea rdx, [rbp + 0x6428]
lea rcx, [rbp + 0x2558]
call fcn.140011db1
mov ecx, eax
call fcn.140011118
nop
lea rcx, [rbp + 0x6428]
call fcn.140011bf4
mov edx, 0x20
lea rcx, [rbp + 0x4888]
call fcn.14001185c
lea rdx, [rbp + 0x4888]
lea rcx, [rbp + 0x2558]
call fcn.1400113de
nop
mov dword [rbp + 0x48c4], 0
jmp 0x14002bc64
mov eax, dword [rbp + 0x48c4]
inc eax
mov dword [rbp + 0x48c4], eax
lea rcx, [rbp + 0x4888]
call fcn.1400113fc
movsxd rcx, dword [rbp + 0x48c4]
cmp rcx, rax
jae 0x14002bca3
movsxd rax, dword [rbp + 0x48c4]
mov rdx, rax
lea rcx, [rbp + 0x4888]
call fcn.140011221
mov rcx, rax
call fcn.140011843
nop
jmp 0x14002bc9d
jmp 0x14002bca1
jmp 0x14002bc56
lea rdx, str._NEZY_MAGIC__hooking_pages...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x48e4], 0
jmp 0x14002bceb
mov eax, dword [rbp + 0x48e4]
inc eax
mov dword [rbp + 0x48e4], eax
lea rcx, [rbp + 0x3728]
call fcn.140011708
movsxd rcx, dword [rbp + 0x48e4]
cmp rcx, rax
jae 0x14002be2e
lea rdx, str._NEZY_MAGIC__writing_page_memory:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x48e4]
mov rdx, rax
lea rcx, [rbp + 0x3728]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov rdx, qword [rbp + 0x64c0]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd rax, dword [rbp + 0x48e4]
mov rdx, rax
lea rcx, [rbp + 0x3728]
call fcn.140011e33
mov r9d, 8
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
movsxd rax, dword [rbp + 0x48e4]
mov rdx, rax
lea rcx, [rbp + 0x3768]
call fcn.140011dd9
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x48e4]
mov rdx, rax
lea rcx, [rbp + 0x3728]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov r8, qword [rbp + 0x64b8]
mov rdx, qword [rbp + 0x64c0]
lea rcx, [rbp + 0x2558]
call fcn.140011140
movsxd rax, dword [rbp + 0x48e4]
mov rdx, rax
lea rcx, [rbp + 0x3728]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
jmp 0x14002bcdd
mov dword [rbp + 0x4904], 0
jmp 0x14002be48
mov eax, dword [rbp + 0x4904]
inc eax
mov dword [rbp + 0x4904], eax
lea rcx, [rbp + 0x2668]
call fcn.140011708
movsxd rcx, dword [rbp + 0x4904]
cmp rcx, rax
jae 0x14002bf8b
lea rdx, str._NEZY_MAGIC__writing_recovered_page:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x4904]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov rdx, qword [rbp + 0x64c0]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x64c8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd rax, dword [rbp + 0x4904]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov r9d, 8
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
movsxd rax, dword [rbp + 0x4904]
mov rdx, rax
lea rcx, [rbp + 0x37a8]
call fcn.140011dd9
mov qword [rbp + 0x64b8], rax
movsxd rax, dword [rbp + 0x4904]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov rax, qword [rax]
mov qword [rbp + 0x64c0], rax
mov r8, qword [rbp + 0x64b8]
mov rdx, qword [rbp + 0x64c0]
lea rcx, [rbp + 0x2558]
call fcn.140011140
movsxd rax, dword [rbp + 0x4904]
mov rdx, rax
lea rcx, [rbp + 0x2668]
call fcn.140011e33
mov r9d, 0x20
mov r8d, 8
mov rdx, qword [rax]
lea rcx, [rbp + 0x2558]
call fcn.140011005
jmp 0x14002be3a
lea rdx, str._NEZY_DUMPER__ready_for_dumping_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x4928]
call fcn.140011ded
nop
lea r8, [rbp + 0x5984]
mov edx, 0x1000
lea rcx, [rbp + 0x4970]
call fcn.1400115e6
test eax, eax
jne 0x14002c025
lea rdx, str.____EnumProcesses_failed.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x5984]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x5984], eax
mov dword [rbp + 0x59c4], 0
jmp 0x14002c055
mov eax, dword [rbp + 0x59c4]
inc eax
mov dword [rbp + 0x59c4], eax
mov eax, dword [rbp + 0x5984]
cmp dword [rbp + 0x59c4], eax
jae 0x14002c10d
mov eax, dword [rbp + 0x59c4]
mov eax, dword [rbp + rax*4 + 0x4970]
mov dword [rbp + 0x59a4], eax
cmp dword [rbp + 0x59a4], 0
jne 0x14002c085
jmp 0x14002c047
mov edx, dword [rbp + 0x59a4]
lea rcx, [rbp + 0x59e8]
call fcn.1400114ec
nop
lea rcx, [rbp + 0x59e8]
call fcn.140011343
movzx eax, al
test eax, eax
jne 0x14002c0fc
xor r8d, r8d
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rbp + 0x59e8]
call fcn.14001151e
cmp rax, 0xffffffffffffffff
je 0x14002c0fc
lea rdx, [rbp + 0x59e8]
lea rcx, [rbp + 0x5a28]
call fcn.140011f23
nop
lea rdx, [rbp + 0x5a28]
lea rcx, [rbp + 0x4928]
call fcn.140011b63
nop
lea rcx, [rbp + 0x5a28]
call fcn.1400112c1
nop
lea rcx, [rbp + 0x59e8]
call fcn.1400112c1
jmp 0x14002c047
lea rax, [rbp + 0x6468]
mov qword [rbp + 0x64a8], rax
lea r8, str..exe
lea rdx, [rbp + 0x4928]
mov rcx, qword [rbp + 0x64a8]
call fcn.140011af5
mov qword [rbp + 0x64b8], rax
mov rcx, qword [rbp + 0x64b8]
call fcn.140011e74
lea rdx, str._NEZY_DUMPER__roblox_dumped_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._NEZY_DUMPER__terminating_roblox...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 1
mov rcx, qword [rbp + 0x2558]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x2558]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._DONE__decryptor_work_done_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400111b8
mov qword [rbp + 0x64b8], rax
lea rdx, [0x140011096]
mov rcx, qword [rbp + 0x64b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 0x4928]
call fcn.1400112c1
nop
lea rcx, [rbp + 0x4888]
call fcn.140011429
nop
lea rcx, [rbp + 0x37a8]
call fcn.140011447
nop
lea rcx, [rbp + 0x3768]
call fcn.140011447
nop
lea rcx, [rbp + 0x3728]
call fcn.1400116fe
nop
lea rcx, [rbp + 0x2668]
call fcn.1400116fe
nop
lea rcx, [rbp + 0x2578]
call fcn.140011942
nop
lea rcx, [rbp + 8]
call fcn.1400112c1
jmp 0x14002c267
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14003acd0]
call fcn.140011b90
mov rax, rdi
mov rcx, qword [rbp + 0x64d8]
xor rcx, rbp
call fcn.1400116ef
lea rsp, [rbp + 0x64e8]
pop rdi
pop rbp
ret