Function at 0x14004fb40
Capabilities:
Acquire debug privileges
Authenticate hmac
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov rax, qword [0x140152040]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.14000b7a0
call fcn.14000b0b0
call fcn.14000b8a0
call fcn.14000b650
call fcn.14000b210
call fcn.14000b360
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14004fbe1
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14004fbe1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x11]
call rbx
call fcn.14000bee0
call fcn.14000bc90
call fcn.14000bdf0
call fcn.14000c0c0
call fcn.14000c1f0
nop
mov qword [rbp - 0x20], r15
lea rax, [0x1401520b8]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003110
mov dword [rsp + 0x30], 1
cmp dword [rbp - 0x20], 0
jne 0x140051050
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x18], rax
call fcn.14005846c
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x88]
call fcn.140007dd0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14004fcae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fca9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fca9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
movdqa xmm0, xmmword [0x140146540]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r15w
mov dword [rsp + 0x30], 0x2e734d76
mov dword [rsp + 0x34], 0x6e6962
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14004fce0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x88]
call fcn.140007470
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x48]
call fcn.140005d40
nop
lea rcx, [rbp + 0x68]
call fcn.14000ad20
nop
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rcx, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x58]
cmp rbx, qword [rbp + 0x78]
jne 0x14004fd4b
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004fd52
mov dword [0x14016b3b0], r15d
test rbx, rbx
je 0x140050ee5
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140007590
mov rcx, rax
call fcn.140009f80
test al, al
jne 0x14004fdbb
mov dword [rsp + 0x30], 0x72724574
movdqa xmm0, xmmword [0x140146930]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140146980]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x140146950]
movdqu xmmword [rbp], xmm0
mov word [rbp + 0x10], 0x2e59
mov byte [rbp + 0x12], al
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0x1f]
jmp 0x140050f2d
lea rbx, [0x14016a7b8]
cmp qword [0x14016a7d0], 0xf
cmova rbx, qword [0x14016a7b8]
movdqa xmm0, xmmword [0x140146660]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1f]
call fcn.14000af80
mov rdx, rsi
lea rcx, [0x140146238]
call fcn.14004fa50
lea rcx, [0x14005c5a0]
call fcn.14000af80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140050e64
test al, 0x10
jne 0x140050e64
mov r14d, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140050e17
mov dword [rbp + 0xb0], 0x238
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004fe91
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rbp + 0xdc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004fe8a
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004fe60
jmp 0x14004fe91
mov r14d, dword [rbp + 0xb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140050e17
mov edx, r14d
lea rcx, [0x14004fab0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x20], r15d
lea rdx, [rbp + 0x20]
mov rcx, qword [0x14016b3f0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
jne 0x1400500a2
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140051220
mov r8, rax
movdqa xmm0, xmmword [0x1401468b0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140146f50]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [str..___.z_34_5_tz]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x131b1c7a
mov dword [rsp + 0x6c], 0x7a1e1f16
mov word [rsp + 0x70], 7
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x43], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x44], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x45], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x46], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x47], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x48], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x49], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x50], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x54], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x14004ff30
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x39]
mov rcx, r8
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724559
movdqa xmm0, xmmword [0x140146e90]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140146df0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x20746567
mov dword [rsp + 0x5c], 0x646e6977
mov dword [rsp + 0x60], 0x2e776f
lea rdx, [rsp + 0x39]
jmp 0x140050ec4
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400500c0
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140008ed0
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
jne 0x14005012f
movups xmmword [rbp + 0x28], xmm0
movdqu xmmword [rbp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x140146234]
lea rcx, [rbp + 0x28]
call fcn.140008ab0
jmp 0x14005018d
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140051910
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x38], xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400501cd
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400501c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400501c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
movdqa xmm0, xmmword [0x140146550]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x14005029b
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140051220
movdqa xmm0, xmmword [0x140146ce0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140146960]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272457d
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], sil
movdqa xmm0, xmmword [0x140146d60]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x2e64
mov byte [rbp - 6], sil
lea rdx, [rbp - 0x1f]
jmp 0x140050da9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140050bef
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140050a76
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400502fc
mov dword [rbp - 0x14], 2
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400508d9
mov cl, 0x78
mov word [rbp - 0x80], 0x78
movsx ebx, cl
movzx eax, bx
xor ax, 0x28
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0xa
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0x11
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0xe
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0x14
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 0x1d
mov word [rbp - 0x72], r10w
movzx eax, bx
xor ax, 0x1f
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0xb
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x58
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 0x19
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 0x1c
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0x12
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0xd
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0xc
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 0x1b
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 0x1e
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 1
mov word [rbp - 0x40], ax
xor bx, 0x56
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140051370
lea rdx, [0x140051550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x2f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x14005062a
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14016b674], eax
jle 0x14005052b
lea rcx, [0x14016b674]
call fcn.1400591d8
cmp dword [0x14016b674], 0xffffffff
jne 0x14005052b
xor ecx, ecx
call fcn.14000aea0
mov word [0x14016b680], ax
lea rcx, [0x14016b674]
call fcn.14005916c
mov eax, dword [rbx]
cmp dword [0x14016b684], eax
jle 0x14005056c
lea rcx, [0x14016b684]
call fcn.1400591d8
cmp dword [0x14016b684], 0xffffffff
jne 0x14005056c
movzx eax, word [0x14016b680]
mov edx, 0xf0
and ax, dx
mov word [0x14016b670], ax
lea rcx, [0x14016b684]
call fcn.14005916c
mov eax, dword [rbx]
cmp dword [0x14016b67c], eax
jle 0x1400505a9
lea rcx, [0x14016b67c]
call fcn.1400591d8
cmp dword [0x14016b67c], 0xffffffff
jne 0x1400505a9
movzx eax, word [0x14016b680]
and ax, 0xf
mov word [0x14016b678], ax
lea rcx, [0x14016b67c]
call fcn.14005916c
movzx ebx, r15w
mov ecx, 7
call fcn.14000aea0
test al, 0xf0
je 0x1400505ce
mov word [0x14016b670], ax
movzx ebx, ax
or bx, word [0x14016b678]
jmp 0x1400505e3
test al, 0xf
je 0x1400505e3
mov word [0x14016b678], ax
movzx ebx, ax
or bx, word [0x14016b670]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rdi
call fcn.140051590
mov rcx, rax
lea rdx, [rbp + 0x2f0]
call fcn.140051370
lea rdx, [0x140051550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1400506e2
lea edx, [rax + 4]
call fcn.140051220
movdqa xmm0, xmmword [0x140146a90]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140146970]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724545
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], bl
movdqa xmm0, xmmword [0x140146a80]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140146970]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x140050da9
mov edx, 7
call fcn.140051220
movdqa xmm0, xmmword [0x140146aa0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140146790]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r14d
mov r8, rsi
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1400507e5
lea edx, [rax + 4]
call fcn.140051220
movdqa xmm0, xmmword [0x140146be0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140146940]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x5d20
mov byte [rbp + 2], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724562
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140146bd0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140146940]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x58], 0x5d20
mov byte [rsp + 0x5a], 0
lea rdx, [rsp + 0x39]
jmp 0x140050da9
mov edx, 7
call fcn.140051220
movdqa xmm0, xmmword [0x140146f00]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x1401520d8], 0
movdqa xmm0, xmmword [0x140146e40]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.14000af80
mov dword [rbp - 0x30], 0x63755312
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x140146c90]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140051060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1401520d8], 0
jmp 0x140050dbd
mov cl, 0x16
mov word [rbp - 0x80], 0x16
movsx r11d, cl
movzx eax, r11w
xor ax, 0x53
mov word [rbp - 0x7e], ax
movzx r9d, r11w
xor r9w, 0x64
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx eax, r11w
xor ax, 0x79
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r9w
movzx r10d, r11w
xor r10w, 0x36
mov word [rbp - 0x74], r10w
movzx eax, r11w
xor ax, 0x77
mov word [rbp - 0x72], ax
movzx eax, r11w
xor ax, 0x72
mov word [rbp - 0x70], ax
movzx eax, r11w
xor ax, 0x7c
mov word [rbp - 0x6e], ax
movzx eax, r11w
xor ax, 0x63
mov word [rbp - 0x6c], ax
movzx r8d, r11w
xor r8w, 0x65
mov word [rbp - 0x6a], r8w
movzx eax, r11w
xor ax, 0x62
mov word [rbp - 0x68], ax
movzx ecx, r11w
xor cx, 0x7f
mov word [rbp - 0x66], cx
movzx eax, r11w
xor ax, 0x78
mov word [rbp - 0x64], ax
movzx edx, r11w
xor dx, 0x71
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r10w
movzx eax, r11w
xor ax, 0x66
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r9w
mov word [rbp - 0x5a], cx
movzx eax, r11w
xor ax, 0x60
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r11w
xor ax, 0x7a
mov word [rbp - 0x54], ax
movzx eax, r11w
xor ax, 0x73
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r11w, 0x2c
mov word [rbp - 0x4a], r11w
mov word [rbp - 0x48], r10w
mov word [rbp - 0x46], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051370
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724518
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140146bb0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
jmp 0x140050dae
mov cl, 0x35
mov word [rbp - 0x80], 0x35
movsx ebx, cl
movzx eax, bx
xor ax, 0x70
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x47
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x5a
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 0x15
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x45
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x50
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x5b
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x5c
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x52
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x56
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x46
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x41
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x5e
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0xf
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051370
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724538
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140146db0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x140050da9
mov cl, 0xc
mov word [rbp - 0x80], 0xc
movsx ebx, cl
movzx eax, bx
xor ax, 0x49
mov word [rbp - 0x7e], ax
movzx r11d, bx
xor r11w, 0x7e
mov word [rbp - 0x7c], r11w
mov word [rbp - 0x7a], r11w
movzx r8d, bx
xor r8w, 0x63
mov word [rbp - 0x78], r8w
mov word [rbp - 0x76], r11w
movzx r10d, bx
xor r10w, 0x2c
mov word [rbp - 0x74], r10w
mov word [rbp - 0x72], r8w
movzx edx, bx
xor dx, 0x7c
mov word [rbp - 0x70], dx
movzx r9d, bx
xor r9w, 0x69
mov word [rbp - 0x6e], r9w
movzx ecx, bx
xor cx, 0x62
mov word [rbp - 0x6c], cx
movzx eax, bx
xor ax, 0x65
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], cx
movzx eax, bx
xor ax, 0x6b
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r10w
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r11w
mov word [rbp - 0x5e], r8w
movzx eax, bx
xor ax, 0x6f
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r9w
movzx eax, bx
xor ax, 0x7f
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r10w
movzx eax, bx
xor ax, 0x78
mov word [rbp - 0x52], ax
movzx eax, bx
xor ax, 0x64
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r11w
mov word [rbp - 0x4c], r9w
movzx eax, bx
xor ax, 0x6d
mov word [rbp - 0x4a], ax
movzx eax, bx
xor ax, 0x68
mov word [rbp - 0x48], ax
xor bx, 0x36
mov word [rbp - 0x46], bx
mov word [rbp - 0x44], r10w
mov word [rbp - 0x42], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051370
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724510
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140146dc0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x61657268
mov word [rsp + 0x54], 0x2e64
mov byte [rsp + 0x56], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x30], 0x72724516
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140050e00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050dfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
movdqa xmm0, xmmword [0x140146540]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r15w
jmp 0x140050f4e
movdqa xmm0, xmmword [0x140146f20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724567
movdqa xmm0, xmmword [0x140146f10]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x140050ebb
movdqa xmm0, xmmword [0x140146d70]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov dword [rbp - 8], 0xa2e64
lea rcx, [rbp - 0x1f]
call fcn.14000af80
mov rcx, rbx
call fcn.14000af80
mov dword [rsp + 0x30], 0x7272453a
movdqa xmm0, xmmword [0x140146d50]
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x64
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140050f4e
mov dword [rsp + 0x30], 0x7272455f
movdqa xmm0, xmmword [0x140146920]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140146980]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140146950]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x68], 0x2e59
mov byte [rsp + 0x6a], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14016b3b0], r15d
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140050f90
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050f8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050f8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140050fce
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050fc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050fc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140051022
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005101d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005101d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058ef8
xor al, al
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140058c00
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x20]
call fcn.140002ce0
int3