Function at 0x14000c810
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21dd0]
mov eax, 0x21ed0
call fcn.1400467c0
sub rsp, rax
xor r12d, r12d
mov dword [rbp + 0x21e10], r12d
call fcn.14000e570
lea rdx, [0x140062678]
cmp qword [0x140062690], 0x10
cmovae rdx, qword [0x140062678]
mov r8, qword [0x140062688]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015860
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._n_t_t_tMy_PID_is
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x20]
call fcn.14000f2a0
nop
cmp qword [rbp + 0xb0], r12
je 0x14000d504
lea rax, [0x140056cd0]
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x21e10], 0x20
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x130], r13
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x1a0], r12
mov dword [rbp + 0x1a8], 4
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov r14d, r12d
mov qword [rbp - 0x50], r12
mov esi, 0xf
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x60], r14b
mov dword [rbp + 0x21e10], 0xa0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov ecx, dword [rbp + 0x1a8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000ca23
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000ca1d
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbase_void_const___ptr64]
mov rdi, rax
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov rbx, rax
mov qword [rbp + 0x21e18], rax
cmp rax, qword [rbp + 0x1a0]
cmovb rbx, qword [rbp + 0x1a0]
sub rbx, rdi
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
jmp 0x14000ca67
mov ecx, dword [rbp + 0x1a8]
test cl, 4
jne 0x14000ca5f
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
test rax, rax
je 0x14000ca5f
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
mov rdi, rax
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::egptr_void_const___ptr64]
mov rbx, rax
sub rbx, rdi
jmp 0x14000ca67
mov rbx, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x14000ca83
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140011150
mov rsi, qword [rbp - 0x48]
mov r14, qword [rbp - 0x50]
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::Value::constructor_enum_Json::ValueType____ptr64]
nop
lea rcx, [rbp + 0x49d0]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::Reader::constructor_void____ptr64]
nop
mov rbx, 0xffffffffffffffff
cmp r14, 3
jb 0x14000cb2f
lea rax, [rbp - 0x60]
cmp rsi, 0x10
setae r9b
mov rcx, qword [rbp - 0x60]
cmovae rax, rcx
cmp byte [rax], 0xef
jne 0x14000cb2f
lea rax, [rbp - 0x60]
test r9b, r9b
cmovne rax, rcx
cmp byte [rax + 1], 0xbb
jne 0x14000cb2f
lea rax, [rbp - 0x60]
test r9b, r9b
cmovne rax, rcx
cmp byte [rax + 2], 0xbf
jne 0x14000cb2f
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov qword [rbp + 0x21e10], rbx
lea rax, [r14 - 3]
mov qword [rbp + 0x21e10], rax
mov r8, rbx
cmp rax, rbx
cmovb r8, rax
lea rdx, [rbp - 0x60]
test r9b, r9b
cmovne rdx, rcx
add rdx, 3
lea rcx, [rbp - 0x80]
call fcn.140014220
jmp 0x14000cb3c
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.140010120
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000cb7a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cb75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045f24
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x50], xmm1
lea rdx, [rbp - 0x60]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rdx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14000cbb4
mov r8, rbx
lea rcx, [rbp - 0x80]
call fcn.140014220
nop
xor r9d, r9d
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x49d0]
call qword [sym.imp.jsoncpp.dll_public:_bool___cdecl_Json::Reader::parse_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_Json::Value____ptr64__bool____ptr64]
movzx ebx, al
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000cc23
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045f24
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test bl, bl
jne 0x14000cc94
lea rdx, str._n_X__Invalid_YaroRules.json___Please_check_the_validity_of_the_file.
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x49d0]
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Reader::getFormattedErrorMessages_void____ptr64]
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400118f0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x40]
call fcn.1400038c0
mov ecx, 0xffffffe9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.___Successfully_parsed_YaroRules.json
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140011cb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.StackPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000cea0
mov r14d, r12d
lea rdx, str.StackPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000cea0
nop dword [rax + rax]
lea rdx, str.StackPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___int____ptr64]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
lea rdx, [rbp + 0x21e10]
lea rcx, [rbp - 0x40]
call fcn.140002410
mov r15, rax
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x10]
call fcn.140012950
cmp dword [0x140063488], 0
je 0x14000ce3f
lea rdx, str._DEBUG__Loaded_Stack_Pattern_:__n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, r12
mov rsi, qword [rbp + 0x21e10]
test rsi, rsi
je 0x14000ce1b
nop word [rax + rax]
lea rdx, [0x140001f60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov edx, 2
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rbx + 0x58], 0x30
movzx edx, byte [rdi + r15]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140055a64]
call fcn.140011ae0
inc rdi
cmp rdi, rsi
jb 0x14000cdb0
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000ce7a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d491
call fcn.140045f24
inc r14d
lea rdx, str.StackPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
cmp r14d, eax
jb 0x14000cd10
lea rdx, str.HeapPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d080
mov r15d, r12d
lea rdx, str.HeapPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d080
nop word [rax + rax]
lea rdx, str.HeapPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___int____ptr64]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
lea rdx, [rbp + 0x21e10]
lea rcx, [rbp - 0x40]
call fcn.140002410
mov r14, rax
mov qword [rsp + 0x70], rax
mov rsi, qword [rbp + 0x21e10]
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
lea rcx, [0x140063520]
call fcn.140012c40
cmp dword [0x140063488], 0
je 0x14000d01f
lea rdx, str._DEBUG__Loaded_Heap_Pattern_:__n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, r12
test rsi, rsi
je 0x14000cffb
nop dword [rax]
lea rdx, [0x140001f60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rbx + 0x58], 0x30
movzx edx, byte [rdi + r14]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140055a64]
call fcn.140011ae0
inc rdi
cmp rdi, rsi
jb 0x14000cf90
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000d05a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d055
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d498
call fcn.140045f24
inc r15d
lea rdx, str.HeapPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
cmp r15d, eax
jb 0x14000cef0
lea rdx, str.DllHookingPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d260
mov r15d, r12d
lea rdx, str.DllHookingPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d260
nop word [rax + rax]
lea rdx, str.DllHookingPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___int____ptr64]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
lea rdx, [rbp + 0x21e10]
lea rcx, [rbp - 0x40]
call fcn.140002410
mov r14, rax
mov qword [rsp + 0x70], rax
mov rsi, qword [rbp + 0x21e10]
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
lea rcx, [0x140063590]
call fcn.140012c40
cmp dword [0x140063488], 0
je 0x14000d1ff
lea rdx, str._DEBUG__Loaded_Dll_Hooking_Pattern_:__n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, r12
test rsi, rsi
je 0x14000d1db
nop dword [rax]
lea rdx, [0x140001f60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rbx + 0x58], 0x30
movzx edx, byte [rdi + r14]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140055a64]
call fcn.140011ae0
inc rdi
cmp rdi, rsi
jb 0x14000d170
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000d23a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d235
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d49f
call fcn.140045f24
inc r15d
lea rdx, str.DllHookingPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
cmp r15d, eax
jb 0x14000d0d0
lea rdx, str.GeneralPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d440
mov r15d, r12d
lea rdx, str.GeneralPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
test eax, eax
je 0x14000d440
nop word [rax + rax]
lea rdx, str.GeneralPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___int____ptr64]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::Value::asString_void____ptr64]
nop
lea rdx, [rbp + 0x21e10]
lea rcx, [rbp - 0x40]
call fcn.140002410
mov r14, rax
mov qword [rsp + 0x70], rax
mov rsi, qword [rbp + 0x21e10]
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
lea rcx, [0x1400634c0]
call fcn.140012c40
cmp dword [0x140063488], 0
je 0x14000d3df
lea rdx, str._DEBUG__Loaded_General_Pattern_:__n_t
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, r12
test rsi, rsi
je 0x14000d3bb
nop dword [rax]
lea rdx, [0x140001f60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x10]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rbx + 0x58], 0x30
movzx edx, byte [rdi + r14]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140055a64]
call fcn.140011ae0
inc rdi
cmp rdi, rsi
jb 0x14000d350
lea rdx, [0x140055bc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000d41a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d415
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d4a6
call fcn.140045f24
inc r15d
lea rdx, str.GeneralPatterns
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_class_Json::Value____ptr64___cdecl_Json::Value::operator___char_const____ptr64____ptr64]
mov rcx, rax
call qword [sym.imp.jsoncpp.dll_public:_unsigned_int___cdecl_Json::Value::size_void_const___ptr64]
cmp r15d, eax
jb 0x14000d2b0
lea rcx, [rbp + 0x49d0]
call fcn.14000e350
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.jsoncpp.dll_public:_void___cdecl_Json::Value::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000d4b3
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d4ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140045f24
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], r13
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x138]
call fcn.140010020
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x30]
call fcn.140010690
test rax, rax
jne 0x14000d52e
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov edx, 1
lea rcx, [0x14000c1f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
cmp dword [0x1400634a0], 0
jne 0x14000d570
lea rdx, str._n___Choose_the_PID_to_monitor_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140063394]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
mov r8d, dword [0x140063394]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400633e8], rax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400633e8]
call qword [0x1400633c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp qword [0x1400633e8], 0
jne 0x14000d5d7
lea rdx, str._X__Cant_find_that_PID___Give_me_a_valid_one_please___._n
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14000c810
jmp 0x14000d5f3
lea rdx, str.___Here_we_go___n
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne 0x14000d64d
lea rdx, str.SymInitialize_failed._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011ae0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xffffff22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x11b70]
call fcn.140002880
nop
lea rax, [rbp + 0x11b70]
mov qword [0x140063490], rax
mov edx, dword [0x1400633d4]
lea rcx, [rbp + 0x11b70]
call fcn.140002bb0
mov r9d, 0x30
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp + 0x11b78]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14000d6dd
lea rbx, [rbp + 0x19dc8]
nop
mov rax, qword [rbp - 0x20]
mov qword [rbx - 0x4000], rax
mov rcx, qword [rbp - 8]
lea rdx, [rcx + rax]
mov qword [rbx], rdx
mov qword [rbx + 0x4000], rcx
lea rbx, [rbx + 8]
mov r9d, 0x30
lea r8, [rbp - 0x20]
mov rcx, qword [rbp + 0x11b78]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x14000d6a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DLLsiat.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ebx, eax
mov dword [rbp + 0x21e10], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DLLs_ntdII.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, eax
mov dword [rbp + 0x21e18], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DLLsKerneI32.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r15d, eax
mov dword [rbp + 0x21e20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DLLscallbacks.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r12d, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DLLsmagicbp.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r13d, eax
mov ecx, ebx
call fcn.1400461b8
mov rsi, rax
mov ecx, edi
call fcn.1400461b8
mov r14, rax
mov ecx, r15d
call fcn.1400461b8
mov r15, rax
mov ecx, r12d
call fcn.1400461b8
mov rbx, rax
mov ecx, r13d
call fcn.1400461b8
mov rdi, rax
cmp dword [0x140063390], 0
jne 0x14000d7ad
cmp dword [0x140063484], 0
je 0x14000d80a
xor r9d, r9d
mov r8, rbx
mov edx, r12d
lea rcx, str.DLLscallbacks.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [0x1400633d4], 0
je 0x14000d7ef
lea rdx, str._INFO__Injected_callbacks.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov r8, rbx
call fcn.140003d70
test eax, eax
je 0x14000d7c3
cmp dword [0x1400633f4], 0
je 0x14000d877
xor r9d, r9d
mov r8, rdi
mov edx, r13d
lea rcx, str.DLLsmagicbp.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
nop dword [rax]
cmp dword [0x1400633d4], 0
je 0x14000d85c
lea rdx, str._INFO__In_tjected_magicbp.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov r8, rdi
call fcn.140003d70
test eax, eax
je 0x14000d830
cmp dword [0x140063400], 0
je 0x14000d8e7
xor r9d, r9d
mov r8, rsi
mov edx, dword [rbp + 0x21e10]
lea rcx, str.DLLsiat.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
nop dword [rax]
cmp dword [0x1400633d4], 0
je 0x14000d8cc
lea rdx, str._INFO__Injected_iat.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov r8, rsi
call fcn.140003d70
test eax, eax
je 0x14000d8a0
cmp dword [0x14006340c], 0
je 0x14000d95b
xor r9d, r9d
mov r8, r14
mov edx, dword [rbp + 0x21e18]
lea rcx, str.DLLs_ntdII.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [0x1400633d4], 0
je 0x14000d935
lea rdx, str._INFO__Injected_hooked_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov r8, r14
call fcn.140003d70
test eax, eax
je 0x14000d940
cmp dword [0x140063408], 0
je 0x14000d9c7
xor r9d, r9d
mov r8, r15
mov edx, dword [rbp + 0x21e20]
lea rcx, str.DLLsKerneI32.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
nop dword [rax]
cmp dword [0x1400633d4], 0
je 0x14000d9ac
lea rdx, str._INFO__Injected_hooked_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x1400633e8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov r8, r15
call fcn.140003d70
test eax, eax
je 0x14000d980
mov rbx, qword [0x1400633e8]
lea rcx, [0x140055a30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400633f8], rax
xor r12d, r12d
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 0x30]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rbx
call rax
mov ebx, r12d
test eax, eax
cmovns rbx, qword [rbp - 0x18]
cmp dword [0x1400633d4], r12d
je 0x14000da4c
lea rdx, str._INFO__Process_PEB_at
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140063400], r12d
je 0x14000daa3
lea rcx, [rbp + 0x11b70]
call fcn.140002ed0
lea rdx, str.__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011ae0
mov rdx, qword [rbp + 0x13bb8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._imported_functions
call fcn.140011ae0
lea rdx, [0x140011cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x140063630]
test rcx, rcx
je 0x14000db49
mov rax, qword [0x140063658]
shr rax, 3
cmp rax, rcx
jbe 0x14000dad7
mov rdx, qword [0x140063628]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140010750
jmp 0x14000db49
mov rcx, qword [0x140063628]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000db05
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.140045f24
mov rcx, rbx
test rbx, rbx
jne 0x14000daf0
mov rax, qword [0x140063628]
mov qword [rax], rax
mov rax, qword [0x140063628]
mov qword [rax + 8], rax
mov qword [0x140063630], r12
mov rax, qword [0x140063628]
mov qword [rbp + 0x21e10], rax
lea r8, [rbp + 0x21e10]
mov rdx, qword [0x140063640]
mov rcx, qword [0x140063638]
call fcn.1400128c0
lea rcx, [rbp + 0x13c28]
call fcn.14000f8e0
lea r8, str.ntdll.dll
mov rdx, qword [0x1400633e8]
lea rcx, [rbp + 0x11b70]
call fcn.1400032d0
lea r8, str.kernel32.dll
mov rdx, qword [0x1400633e8]
lea rcx, [rbp + 0x11b70]
call fcn.1400032d0
lea r8, str.KERNELBASE.dll
mov rdx, qword [0x1400633e8]
lea rcx, [rbp + 0x11b70]
call fcn.1400032d0
lea rcx, str.amsi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r8, str.win32u.dll
mov rdx, qword [0x1400633e8]
lea rcx, [rbp + 0x11b70]
call fcn.1400032d0
lea r8, str.user32.dll
mov rdx, qword [0x1400633e8]
lea rcx, [rbp + 0x11b70]
call fcn.1400032d0
mov qword [rbp + 0x9270], r12
mov qword [rbp + 0x9290], r12
mov qword [rbp + 0xd2c8], r12
mov rbx, qword [0x1400633e8]
mov qword [rbp + 0x9288], rbx
lea rcx, [0x140055a30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400633f8], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x30
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, r12
test eax, eax
cmovns rcx, qword [rbp - 0x18]
mov qword [rbp + 0x9280], rcx
cmp dword [0x14006340c], r12d
jne 0x14000dc8c
cmp dword [0x140063408], r12d
jne 0x14000dc8c
cmp dword [0x140063400], r12d
jne 0x14000dc8c
cmp dword [0x140063484], r12d
jne 0x14000dc8c
cmp dword [0x140063390], r12d
jne 0x14000dc8c
cmp dword [0x1400633f4], r12d
je 0x14000e08c
lea rax, [rbp + 0x9270]
mov qword [rsp + 0x48], rax
lea rdx, str..pipe_beotm_ch1
lea rcx, [rbp + 0x130]
call fcn.140008450
mov rbx, qword [rbp + 0x558]
lea r15, [0x140063590]
cmp rbx, r15
je 0x14000dcfb
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x140063590]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x140063598]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
mov rbx, qword [rbp + 0x560]
lea r14, [0x1400634c0]
cmp rbx, r14
je 0x14000dd4b
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x1400634c0]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x1400634c8]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
lea rsi, [0x1400636a0]
mov qword [rbp + 0x568], rsi
lea r13, [0x140063520]
mov qword [rbp + 0x570], r13
mov ecx, 0x10
call fcn.140045f2c
mov rbx, rax
mov qword [rbp + 0x21e10], rax
mov ecx, 8
call fcn.140045f2c
lea rcx, [rbp + 0x130]
mov qword [rax], rcx
mov qword [rbp + 0x21e18], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140015e20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000e27f
mov qword [rbp + 0x21e10], rbx
mov rdx, qword [0x140063568]
cmp rdx, qword [0x140063570]
je 0x14000dde8
mov qword [rdx], rbx
add qword [0x140063568], 8
jmp 0x14000ddf4
lea r8, [rbp + 0x21e10]
call fcn.140015b70
lea rax, [rbp + 0x9270]
mov qword [rsp + 0x48], rax
lea rdx, str..pipe_beotm_ch2
lea rcx, [rbp + 0x49d0]
call fcn.140008450
mov rbx, qword [rbp + 0x4df8]
cmp rbx, r15
je 0x14000de5c
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x140063590]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x140063598]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
mov rbx, qword [rbp + 0x4e00]
cmp rbx, r14
je 0x14000dea5
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x1400634c0]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x1400634c8]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
mov qword [rbp + 0x4e08], rsi
mov qword [rbp + 0x4e10], r13
mov ecx, 0x10
call fcn.140045f2c
mov rbx, rax
mov qword [rbp + 0x21e10], rax
mov ecx, 8
call fcn.140045f2c
lea rcx, [rbp + 0x49d0]
mov qword [rax], rcx
mov qword [rbp + 0x21e18], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140015e20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000e270
mov qword [rbp + 0x21e10], rbx
mov rdx, qword [0x140063568]
cmp rdx, qword [0x140063570]
je 0x14000df34
mov qword [rdx], rbx
add qword [0x140063568], 8
jmp 0x14000df40
lea r8, [rbp + 0x21e10]
call fcn.140015b70
lea rax, [rbp + 0x9270]
mov qword [rsp + 0x48], rax
lea rdx, str..pipe_beotm_ch3
lea rcx, [rbp + 0xd2d0]
call fcn.140008450
mov rbx, qword [rbp + 0xd6f8]
cmp rbx, r15
je 0x14000dfa8
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x140063590]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x140063598]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
mov rbx, qword [rbp + 0xd700]
cmp rbx, r14
je 0x14000dff1
mov qword [rbp + 0x21e10], rbx
mov eax, dword [0x1400634c0]
mov dword [rbx], eax
lea rcx, [rbx + 8]
mov rdx, qword [0x1400634c8]
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140014330
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400114a0
mov rdx, rax
mov rcx, rbx
call fcn.1400112c0
nop
mov qword [rbp + 0xd708], rsi
mov qword [rbp + 0xd710], r13
mov ecx, 0x10
call fcn.140045f2c
mov rbx, rax
mov qword [rbp + 0x21e10], rax
mov ecx, 8
call fcn.140045f2c
lea rcx, [rbp + 0xd2d0]
mov qword [rax], rcx
mov qword [rbp + 0x21e18], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140015e20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000e261
mov qword [rbp + 0x21e10], rbx
mov rdx, qword [0x140063568]
cmp rdx, qword [0x140063570]
je 0x14000e080
mov qword [rdx], rbx
add qword [0x140063568], 8
jmp 0x14000e08c
lea r8, [rbp + 0x21e10]
call fcn.140015b70
cmp dword [0x1400633d0], 0
je 0x14000e22b
mov r15d, r12d
mov rdx, qword [0x140063580]
mov rax, rdx
mov r8, qword [0x140063578]
sub rax, r8
sar rax, 5
test rax, rax
je 0x14000e22b
mov rsi, r12
mov r14, r12
movabs rax, 0xcbf29ce484222325
movabs r13, 0x100000001b3
nop word [rax + rax]
sub rdx, r8
sar rdx, 5
cmp rdx, rsi
jbe 0x14000e25b
add r8, r14
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14000e104
mov rdx, qword [r8]
mov r9, rax
mov rcx, r12
test r10, r10
je 0x14000e123
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r10
jb 0x14000e110
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x13c28]
call fcn.140013230
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14000e24d
mov rbx, qword [rbx + 0x30]
mov rdi, qword [0x1400633e8]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400633b8], rax
mov dword [rbp + 0x21e18], r12d
mov byte [rbp + 0x21e10], 0x21
add rbx, 4
lea rax, [rbp + 0x21e18]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000e1f3
mov rax, qword [0x1400633b8]
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0x21e10]
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
jne 0x14000e1f3
lea rax, [rbp + 0x21e18]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x21e18]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
inc rsi
add r14, 0x20
mov rdx, qword [0x140063580]
mov rcx, rdx
mov r8, qword [0x140063578]
sub rcx, r8
sar rcx, 5
movsxd rax, r15d
cmp rax, rcx
movabs rax, 0xcbf29ce484222325
jb 0x14000e0e0
mov rcx, qword [0x1400633e8]
call qword [0x1400634b0]
nop dword [rax + rax]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000e240
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
call fcn.140010920
nop
mov dword [rdi], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rdi], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rdi], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3