Function at 0x140001090
Capabilities:
Allocate or change rwx memory
Execute command
Resume thread

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x50
xor edi, edi
mov r13d, 1
mov ebx, edi
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
je 0x1400010d3
cmp rbx, 0x20
jae 0x1400010ba
xor ecx, ecx
jmp 0x1400010bd
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
jne 0x1400010b0
cmp qword [0x1400068a0], rdi
jne 0x1400015d4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400068a0], rax
mov ecx, edi
xchg dword [0x140006898], ecx
test rax, rax
je 0x1400015da
call fcn.140001f00
test eax, eax
je 0x14000113d
lea rdx, str.Errore_durante_la_creazione_dellhook.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001660
mov rcx, rax
lea rdx, [0x140001830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, r13d
add rsp, 0x50
pop r13
pop rdi
pop rbx
ret
mov rbx, rdi
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
je 0x140001173
nop dword [rax]
cmp rbx, 0x20
jae 0x14000115a
xor ecx, ecx
jmp 0x14000115d
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
jne 0x140001150
cmp qword [0x1400068a0], rdi
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
je 0x1400015a6
mov ecx, dword [0x1400068cc]
lea rsi, section..text
mov ebx, edi
mov r15d, 4
test ecx, ecx
je 0x1400011cf
mov r8, qword [0x1400068c0]
mov rax, r8
nop word [rax + rax]
cmp rsi, qword [rax]
je 0x140001241
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1400011c0
mov r14d, r15d
mov eax, edi
xchg dword [0x140006898], eax
test r14d, r14d
jne 0x1400015ac
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Funzione_originale_chiamata_con_argomento:
call fcn.140001660
mov rcx, rax
lea edx, [r14 + 0x2a]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rbx, rdi
lock cmpxchg dword [0x140006898], r13d
je 0x140001319
nop word [rax + rax]
cmp rbx, 0x20
jae 0x1400012fc
xor ecx, ecx
jmp 0x1400012ff
cmp ebx, 0xffffffff
je 0x1400011cf
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x1400012f1
mov r8d, r13d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.140001940
mov r14d, eax
test eax, eax
jne 0x1400011d2
mov edx, r13d
mov ecx, ebx
call fcn.140001cec
mov r14d, eax
cmp qword [rsp + 0x20], rdi
je 0x1400011d2
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400012d8
mov rsi, qword [rsp + 0x20]
mov ebp, eax
nop dword [rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400012c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, r15
sub rbp, 1
jne 0x1400012a0
lea rsi, section..text
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1400068a0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400011d2
mov r14d, 5
jmp 0x1400011d2
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
jne 0x140001230
cmp qword [0x1400068a0], rdi
je 0x140001597
mov ecx, dword [0x1400068cc]
mov edx, edi
test ecx, ecx
je 0x14000148c
mov r8, qword [0x1400068c0]
mov rax, r8
cmp rsi, qword [rax]
je 0x140001354
inc edx
add rax, 0x38
cmp edx, ecx
jb 0x140001340
jmp 0x14000148c
cmp edx, 0xffffffff
je 0x14000148c
mov eax, edx
imul rbx, rax, 0x38
test byte [rbx + r8 + 0x20], 2
je 0x140001486
mov r8d, r13d
lea rcx, [rsp + 0x30]
call fcn.140001940
mov r15d, eax
test eax, eax
jne 0x14000148c
add rbx, qword [0x1400068c0]
lea r9, [rsp + 0x70]
lea r8d, [r15 + 0x40]
mov rdx, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, r13b
movzx ecx, al
lea rsi, [rdx - 5]
cmove rsi, rdx
lea rbp, [rcx*2 + 5]
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400013ca
lea r15d, [rax + 0xa]
jmp 0x14000141f
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], r13b
mov dword [rsi], eax
je 0x1400013e6
movzx eax, word [rbx + 0x1c]
mov word [rsi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rsi + 6], al
jmp 0x1400013ed
movzx eax, byte [rbx + 0x1c]
mov byte [rsi + 4], al
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xf9
mov r15d, edi
mov r14, qword [rsp + 0x30]
test r14, r14
je 0x14000148c
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x140001472
mov rsi, r14
mov ebp, eax
nop word [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140001468
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
sub rbp, 1
jne 0x140001440
mov rcx, qword [0x1400068a0]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000148c
mov r15d, 6
mov eax, edi
xchg dword [0x140006898], eax
test r15d, r15d
jne 0x14000159d
mov rbx, rdi
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
je 0x1400014d3
nop dword [rax]
cmp rbx, 0x20
jae 0x1400014ba
xor ecx, ecx
jmp 0x1400014bd
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006898], r13d
jne 0x1400014b0
cmp qword [0x1400068a0], rdi
je 0x140001588
xor ecx, ecx
call fcn.140001dfc
test eax, eax
jne 0x140001588
mov rcx, qword [0x1400068b8]
mov qword [0x1400068b8], rdi
test rcx, rcx
je 0x14000151b
mov rbx, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
test rbx, rbx
jne 0x140001502
mov r8, qword [0x1400068c0]
xor edx, edx
mov rcx, qword [0x1400068a0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400068a0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x1400068a0], rdi
lea rcx, str.pause
mov qword [0x1400068c0], rdi
mov qword [0x1400068c8], rdi
xchg dword [0x140006898], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r13
pop rdi
pop rbx
ret
xchg dword [0x140006898], edi
lea rdx, str.Errore_durante_la_disinizializzazione_di_MinHook.
jmp 0x1400015b3
xchg dword [0x140006898], edi
lea rdx, str.Errore_durante_la_disabilitazione_dellhook.
jmp 0x1400015b3
xchg dword [0x140006898], edi
lea rdx, str.Errore_durante_labilitazione_dellhook.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001660
mov rcx, rax
lea rdx, [0x140001830]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, r13d
jmp 0x140001568
xchg dword [0x140006898], edi
lea rdx, str.Errore_durante_linizializzazione_di_MinHook.
jmp 0x140001115