Function at 0x1400014c0
Capabilities:
Empty recycle bin quietly
Empty the recycle bin
Enumerate process modules
Execute command
Log keystrokes via polling
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1250
call fcn.140003150
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1240], rax
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1400015e5
mov ebp, dword [rsp + 0x28]
xor edi, edi
shr ebp, 2
test ebp, ebp
je 0x1400015e5
lea rsi, [rsp + 0x30]
mov r8d, dword [rsi]
test r8d, r8d
je 0x1400015d7
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400015d7
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x1400044b0]
lea rcx, [rsp + 0x1044]
xor edx, edx
mov dword [rsp + 0x1040], eax
mov r8d, 0x1f4
movaps xmmword [rsp + 0x1030], xmm0
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400015ce
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rdx, str.Hider.exe
lea rcx, [rsp + 0x1030]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001661
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, ebp
jb 0x140001522
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, [0x1400045e8]
call fcn.140001e90
mov rcx, rax
lea rdx, str.Hider.exe
call fcn.140001e90
mov rcx, rax
lea rdx, [0x140004590]
call fcn.140001e90
mov rcx, rax
lea rdx, [0x140002070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.taskkill__IM_In_depth.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.140002300
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, str.attrib_s_h__C:Users_username_DesktopWexside.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopDeadCode.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopSk3dGuard.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopDelta.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopCelka.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopCelestial.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_Desktoploader.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopExpensive.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopExcellent.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DesktopNursultan.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsWexside.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsDeadCode.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsSk3dGuard.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsDelta.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsCelka.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsCelestial.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_Downloadsloader.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsExpensive.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsExcellent.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_DownloadsNursultan.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:GamesMinecraft_baritone___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Sk3dGuard___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Delta___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.wex___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__q__C:WindowsSystem32SRU___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__q__C:WindowsPrefetch___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerTypedPaths___v__url1___f__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_explorer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_explorer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140004e00]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140004e30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AExcellent.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AExpensive.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AWild.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:GamesMinecraft___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:GamesMinecraft_versions___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameWintWare___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameCelestialconfigs___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameCelestialconfigs___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameevolutionconfigs___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameNeverHook___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameNeverHook___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:OsiumClientgameconfigsconfigs___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:MoonHackFree___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgamemetaconfigs___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:DeadCode__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:WexSide__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:HIDER_nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Carbonara___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:CarbonaraAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVendex___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsVerist___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsWissend___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar_Free___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsFPDCLEINT_1.8___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameRockstar_Free___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameFPDCLEINT_1.8___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameGothaj___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameInertia___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameImpact___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameStarLine___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameRise___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_arbuz___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameExclusive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameEpfirium___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgameDark___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsGothaj___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsInertia___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsImpact___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsStarLine___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRise___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Users_username_AppDataRoaming.tlauncherlegacyMinecraftgame_versionsRockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:GamesMinecraft_versionsRockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Rockstar___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:RockAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Celestial___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Nurik___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:_baritone___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AMinecraft_1.16.5.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:WILD___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Expensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Celka___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Excellent___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AkrienAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Nurik___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:_baritone___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AMinecraft_1.16.5.exe___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:WILD___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Expensive___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Celka___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:Excellent___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_s_h__C:AkrienAntiLeak___nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_SystemInformer.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_ProcessHacker.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_Everything.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_taskmgr.exe__nul_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400011c0
test al, al
je 0x140001bb1
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v_Hidden__t_REG_DWORD__d_2__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001b42
mov ecx, 0x47
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001b42
lea rcx, str.explorer
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140006050]
call fcn.140001c80
mov rcx, rax
lea rdx, [0x140001e50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140001638