Function at 0x14000b2b0
Capabilities:
Enumerate threads
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7c8]
sub rsp, 0x8c8
mov r14, rdx
mov r15, rcx
xor r13d, r13d
mov dword [rbp + 0x828], r13d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
test rdx, rdx
je 0x14000c0be
mov dword [rbp + 0x90], 0x1c
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rbp + 0x28], rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
cmp rbx, 0xffffffffffffffff
jne 0x14000b362
lea rdx, str._ERROR__INVALID_HANDLE_VALUE_returned_by_CreateToolhelp32Snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rbp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000c0be
nop word [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp dword [rbp + 0x9c], eax
jne 0x14000b6ed
mov r8d, dword [rbp + 0x98]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14000b6ed
mov dword [rbp + 0x320], 0x100001
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000b6ed
mov rcx, qword [rbp + 0x3e8]
mov qword [rbp + 0xd0], rcx
mov dword [rbp + 0xdc], 3
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xfc], 3
mov rax, qword [rbp + 0x388]
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x10c], 3
cmp dword [r15 + 0x420], 0
je 0x14000b450
lea rdx, str._n_n___Captured_Stack_Trace_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x40], r13
mov rax, qword [sym.imp.dbghelp.dll_SymGetModuleBase64]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
mov r8, r12
mov rdx, r14
mov ecx, 0x8664
call qword [sym.imp.dbghelp.dll_StackWalk64]
test eax, eax
je 0x14000b6ed
lea rbx, [r15 + 0x44c8]
lea rdi, [r15 + 0x4520]
nop dword [rax]
mov ecx, 0x12
call qword [sym.imp.dbghelp.dll_SymSetOptions]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov eax, dword [0x1400633b0]
mov dword [r15 + 0x4534], eax
mov ecx, 0x420
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rbx
mov r8, rdi
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [r15 + 8]
call qword [sym.imp.dbghelp.dll_SymFromAddr]
test eax, eax
je 0x14000bcb6
lea rbx, [r15 + 0x451c]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000b694
mov eax, dword [0x1400633b0]
mov dword [r15 + 0x4534], eax
cmp dword [r15 + 0x420], 0
je 0x14000b579
lea rdx, [0x140056510]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rdx, qword [rbp + 0xd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str.___
call fcn.140011ae0
mov rcx, rax
mov rdx, rbx
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r12d, r12d
mov edi, r12d
mov qword [rbp - 0x58], r12
mov ecx, 0x400
call fcn.1400461b8
mov r13, rax
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8, r13
mov rdx, qword [rbp + rdi*8 + 0x128]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000b675
cmp dword [r15 + 0x4534], 0
je 0x14000b5de
mov r8, qword [rsp + 0x78]
mov rdx, r13
mov rcx, qword [0x1400634a8]
call fcn.1400162e0
mov rax, qword [r15 + 0x438]
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov rbx, qword [rax]
cmp rbx, rax
je 0x14000b675
mov rcx, rax
nop dword [rax]
mov r15, qword [rbx + 0x18]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [r15 + rsi], 0
jne 0x14000b610
test r15, r15
je 0x14000b65f
mov r14, qword [rsp + 0x78]
cmp rsi, r14
ja 0x14000b658
mov rdi, r12
sub r14, rsi
nop
lea rcx, [rdi + r13]
lea r8, [rsi - 1]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000b70a
inc rdi
cmp rdi, r14
jbe 0x14000b630
mov rcx, qword [rsp + 0x70]
xor r12d, r12d
mov r14, qword [rbp + 0x818]
mov r15, qword [rbp + 0x810]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rcx
jne 0x14000b600
mov rdi, qword [rbp - 0x58]
inc rdi
mov qword [rbp - 0x58], rdi
cmp rdi, 5
jl 0x14000b583
mov r12, qword [rbp + 0x20]
lea rdi, [r15 + 0x4520]
xor r13d, r13d
lea rbx, [r15 + 0x44c8]
mov qword [rsp + 0x40], r13
mov rax, qword [sym.imp.dbghelp.dll_SymGetModuleBase64]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
mov r8, r12
mov rdx, r14
mov ecx, 0x8664
call qword [sym.imp.dbghelp.dll_StackWalk64]
test eax, eax
jne 0x14000b4b0
mov rbx, qword [rbp + 0x28]
lea rdx, [rbp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14000b380
jmp 0x14000c0be
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor edi, edi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 0xf
lea ecx, [rdi + 0x60]
call fcn.140045f2c
mov rcx, rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], 0x52
mov qword [rbp + 0x48], 0x5f
movaps xmm0, xmmword [str.Malicious_Process_Detected____Stacked_Functions_Arguments_Analysis_._Killing_it...]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140056530]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140056540]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140056550]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140056560]
movups xmmword [rax + 0x40], xmm0
movzx eax, word [0x140056570]
mov word [rcx + 0x50], ax
mov byte [rcx + 0x52], dil
lea rcx, [rbp + 0x30]
call fcn.140003f20
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], dil
mov r8, 0xffffffffffffffff
mov rax, qword [rbp + 0x10]
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000b7b0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140011150
mov r8, qword [rsp + 0x78]
mov rdx, r13
lea rcx, [rbp + 0x70]
call fcn.1400021f0
mov r12, rax
mov r8, rsi
mov rdx, r15
lea rcx, [rbp + 0x50]
call fcn.1400021f0
mov r15, rax
mov rcx, qword [rbp + 0xd0]
mov qword [rbp + 0x18], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea r14, [rbp - 0x30]
mov rdi, qword [rbp - 0x18]
cmp rdi, 0x10
setae byte [rbp + 0x820]
mov r13, qword [rbp - 0x30]
cmovae r14, r13
mov rsi, qword [rbp - 0x20]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14000c0d2
mov qword [rbp - 0x68], 0xf
cmp rsi, 0x10
jae 0x14000b857
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x80], xmm0
jmp 0x14000b8ec
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x14000b876
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000b89d
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000b8bf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000c0d8
mov rcx, rax
call fcn.140045f2c
mov rcx, rax
test rax, rax
je 0x14000c078
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000b8cd
test rcx, rcx
je 0x14000b8cb
call fcn.140045f2c
jmp 0x14000b8cd
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0xf
mov ecx, 0x40
call fcn.140045f2c
mov rcx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x36
mov qword [rbp - 0x38], 0x3f
movups xmm0, xmmword [str.Stacked_Functions_Arguments_Analysis__Normal_patterns_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140056588]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140056598]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [0x1400565a8]
mov dword [rcx + 0x30], eax
movzx eax, word [0x1400565ac]
mov word [rcx + 0x34], ax
mov byte [rcx + 0x36], 0
mov r14, qword [rbp + 0x818]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, dword [rbp + 0x828]
or esi, 1
mov dword [rbp + 0x828], esi
mov r9d, 0x104
lea r8, [rbp + 0x1e0]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
test eax, eax
jne 0x14000b9b7
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], al
jmp 0x14000b9ed
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x1e0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000b9d1
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x50]
call fcn.140014220
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140006780
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000ba64
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c07f
call fcn.140045f24
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r12b
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000bab5
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c086
call fcn.140045f24
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000bb00
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bafb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c08d
call fcn.140045f24
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x14000bb4b
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c094
call fcn.140045f24
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14000bb99
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c09b
call fcn.140045f24
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov r9d, 0x30
lea r8, str.Best_Edr_Of_The_Market
lea rdx, str.Malicious_process_detected____Stack_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015860
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r15, qword [rbp + 0x810]
call qword [r15 + 0x448]
call qword [r15 + 0x450]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000bc58
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0a2
call fcn.140045f24
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
cmp byte [rbp + 0x820], 0
je 0x14000bca8
lea rdx, [rdi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000bc9a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0a9
mov rcx, r13
call fcn.140045f24
mov dword [rbp + 0x828], esi
mov r13, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x70]
jmp 0x14000b666
cmp dword [r15 + 0x420], 0
je 0x14000bd03
lea rdx, [0x140056510]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140001f60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0xd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [r15 + 0x458]
mov rdx, r13
movsxd r8, dword [rax + 0x423c]
mov rcx, qword [rbp + 0xd0]
test r8, r8
jle 0x14000bd44
add rax, 0x3138
cmp rcx, qword [rax - 0x1000]
jb 0x14000bd38
cmp rcx, qword [rax]
jbe 0x14000bf46
inc rdx
add rax, 8
cmp rdx, r8
jl 0x14000bd26
cmp dword [r15 + 0x420], 0
je 0x14000be52
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov ecx, 0x30
call fcn.140045f2c
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x20
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.Code_injection_may_be_occuring__]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140056618]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
lea rax, [rsp + 0x50]
mov qword [rbp + 0x820], rax
lea rdx, str.e_48_5_208m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rcx, rax
lea rdx, [0x140055c30]
call fcn.140011ae0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.140015860
lea rdx, str.e_0m
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000be4b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b7
call fcn.140045f24
mov rcx, qword [rbp + 0xd0]
cmp dword [r15 + 0x4534], 0
je 0x14000b69b
mov r8, qword [r15 + 0x458]
mov rdx, r13
lea rax, [r8 + 0x8258]
cmp rcx, qword [rax - 0x4000]
jb 0x14000be7f
cmp rcx, qword [rax]
jbe 0x14000be96
inc rdx
add rax, 8
cmp rdx, 0x200
jl 0x14000be71
mov rdx, 0xffffffffffffffff
lea r14, [rdx*8 + 0x4258]
cmp qword [r14 + r8], 0
je 0x14000c06c
cmp qword [r8 + rdx*8 + 0x8258], 0
je 0x14000c06c
lea rsi, [rdx*8 + 0xc258]
mov rax, qword [rsi + r8]
test eax, eax
jle 0x14000c06c
movsxd rbx, eax
mov rcx, rbx
call fcn.1400461b8
mov rdi, rax
mov rcx, qword [r15 + 0x458]
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, qword [r14 + rcx]
mov r14, qword [rbp + 0x818]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000bf25
mov rcx, qword [r15 + 0x458]
mov r8, qword [rsi + rcx]
mov rdx, rdi
mov rcx, qword [0x1400634a8]
call fcn.1400162e0
mov rcx, rdi
call fcn.140045f24
mov eax, dword [0x1400633b0]
mov dword [r15 + 0x4534], eax
lea rdi, [r15 + 0x4520]
jmp 0x14000b694
cmp dword [r15 + 0x420], 0
je 0x14000b69b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov ecx, 0x30
call fcn.140045f2c
mov rcx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x29
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.Resolved_address_in_modules_memory_pools.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400565e8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400565f8]
movsd qword [rax + 0x20], xmm0
movzx eax, byte [0x140056600]
mov byte [rcx + 0x28], al
mov byte [rcx + 0x29], 0
lea rax, [rsp + 0x50]
mov qword [rbp + 0x820], rax
lea rdx, str.e_42m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rcx, rax
lea rdx, [0x140055c30]
call fcn.140011ae0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.140015860
lea rdx, str.e_0m
mov rcx, rax
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000b69b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b0
call fcn.140045f24
jmp 0x14000b69b
mov r14, qword [rbp + 0x818]
jmp 0x14000b69b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
add rsp, 0x8c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400017b0
nop
call fcn.1400016e0
int3