Function at 0x14004fd40
Capabilities:
Acquire debug privileges
Authenticate hmac
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.14000b9a0
call fcn.14000b2b0
call fcn.14000baa0
call fcn.14000b850
call fcn.14000b410
call fcn.14000b560
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14004fde1
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14004fde1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x11]
call rbx
call fcn.14000c0e0
call fcn.14000be90
call fcn.14000bff0
call fcn.14000c2c0
call fcn.14000c3f0
nop
mov qword [rbp - 0x20], r15
lea rax, [0x1401530b8]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003110
mov dword [rsp + 0x30], 1
cmp dword [rbp - 0x20], 0
jne 0x140051250
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x18], rax
call fcn.140058a8c
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x88]
call fcn.140007dd0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14004feae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fea9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fea9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
movdqa xmm0, xmmword [0x140147560]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r15w
mov dword [rsp + 0x30], 0x2e734d76
mov dword [rsp + 0x34], 0x6e6962
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14004fee0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x88]
call fcn.140007470
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x48]
call fcn.140005d40
nop
lea rcx, [rbp + 0x68]
call fcn.14000af20
nop
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rcx, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x58]
cmp rbx, qword [rbp + 0x78]
jne 0x14004ff4b
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004ff52
mov dword [0x14016c3b0], r15d
test rbx, rbx
je 0x1400510e5
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140007590
mov rcx, rax
call fcn.14000a100
test al, al
jne 0x14004ffbb
mov dword [rsp + 0x30], 0x72724574
movdqa xmm0, xmmword [0x140147930]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140147990]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x140147960]
movdqu xmmword [rbp], xmm0
mov word [rbp + 0x10], 0x2e59
mov byte [rbp + 0x12], al
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0x1f]
jmp 0x14005112d
lea rbx, [0x14016b7b8]
cmp qword [0x14016b7d0], 0xf
cmova rbx, qword [0x14016b7b8]
movdqa xmm0, xmmword [0x1401476f0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1f]
call fcn.14000b180
mov rdx, rsi
lea rcx, [0x140147238]
call fcn.14004fc50
lea rcx, [0x14005d5a0]
call fcn.14000b180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140051064
test al, 0x10
jne 0x140051064
mov r14d, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140051017
mov dword [rbp + 0xb0], 0x238
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140050091
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rbp + 0xdc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14005008a
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140050060
jmp 0x140050091
mov r14d, dword [rbp + 0xb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140051017
mov edx, r14d
lea rcx, [0x14004fcb0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x20], r15d
lea rdx, [rbp + 0x20]
mov rcx, qword [0x14016c3f0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
jne 0x1400502a2
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140051420
mov r8, rax
movdqa xmm0, xmmword [0x140147850]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140147fd0]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [str..___.z_34_5_tz]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x131b1c7a
mov dword [rsp + 0x6c], 0x7a1e1f16
mov word [rsp + 0x70], 7
mov rcx, r15
nop dword [rax]
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x43], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x44], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x45], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x46], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x47], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x48], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x49], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x50], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x54], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x140050130
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x39]
mov rcx, r8
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724559
movdqa xmm0, xmmword [0x140147ec0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140147e20]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x20746567
mov dword [rsp + 0x5c], 0x646e6977
mov dword [rsp + 0x60], 0x2e776f
lea rdx, [rsp + 0x39]
jmp 0x1400510c4
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400502c0
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140008ed0
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
jne 0x14005032f
movups xmmword [rbp + 0x28], xmm0
movdqu xmmword [rbp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x140147234]
lea rcx, [rbp + 0x28]
call fcn.140008ab0
jmp 0x14005038d
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140051b10
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x38], xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400503cd
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400503c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400503c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
movdqa xmm0, xmmword [0x140147570]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x14005049b
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140051420
movdqa xmm0, xmmword [0x140147d10]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140147970]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272457d
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], sil
movdqa xmm0, xmmword [0x140147d70]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x2e64
mov byte [rbp - 6], sil
lea rdx, [rbp - 0x1f]
jmp 0x140050fa9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140050def
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140050c76
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400504fc
mov dword [rbp - 0x14], 2
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140050ad9
mov cl, 0x78
mov word [rbp - 0x80], 0x78
movsx ebx, cl
movzx eax, bx
xor ax, 0x28
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0xa
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0x11
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0xe
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0x14
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 0x1d
mov word [rbp - 0x72], r10w
movzx eax, bx
xor ax, 0x1f
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0xb
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x58
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 0x19
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 0x1c
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0x12
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0xd
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0xc
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 0x1b
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 0x1e
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 1
mov word [rbp - 0x40], ax
xor bx, 0x56
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140051570
lea rdx, [0x140051750]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x2f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x14005082a
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14016c674], eax
jle 0x14005072b
lea rcx, [0x14016c674]
call fcn.1400597f8
cmp dword [0x14016c674], 0xffffffff
jne 0x14005072b
xor ecx, ecx
call fcn.14000b0a0
mov word [0x14016c680], ax
lea rcx, [0x14016c674]
call fcn.14005978c
mov eax, dword [rbx]
cmp dword [0x14016c684], eax
jle 0x14005076c
lea rcx, [0x14016c684]
call fcn.1400597f8
cmp dword [0x14016c684], 0xffffffff
jne 0x14005076c
movzx eax, word [0x14016c680]
mov edx, 0xf0
and ax, dx
mov word [0x14016c670], ax
lea rcx, [0x14016c684]
call fcn.14005978c
mov eax, dword [rbx]
cmp dword [0x14016c67c], eax
jle 0x1400507a9
lea rcx, [0x14016c67c]
call fcn.1400597f8
cmp dword [0x14016c67c], 0xffffffff
jne 0x1400507a9
movzx eax, word [0x14016c680]
and ax, 0xf
mov word [0x14016c678], ax
lea rcx, [0x14016c67c]
call fcn.14005978c
movzx ebx, r15w
mov ecx, 7
call fcn.14000b0a0
test al, 0xf0
je 0x1400507ce
mov word [0x14016c670], ax
movzx ebx, ax
or bx, word [0x14016c678]
jmp 0x1400507e3
test al, 0xf
je 0x1400507e3
mov word [0x14016c678], ax
movzx ebx, ax
or bx, word [0x14016c670]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rdi
call fcn.140051790
mov rcx, rax
lea rdx, [rbp + 0x2f0]
call fcn.140051570
lea rdx, [0x140051750]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1400508e2
lea edx, [rax + 4]
call fcn.140051420
movdqa xmm0, xmmword [0x140147a40]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140147980]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724545
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], bl
movdqa xmm0, xmmword [0x140147a30]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140147980]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x140050fa9
mov edx, 7
call fcn.140051420
movdqa xmm0, xmmword [0x140147a50]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401477f0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r14d
mov r8, rsi
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1400509e5
lea edx, [rax + 4]
call fcn.140051420
movdqa xmm0, xmmword [0x140147ba0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140147950]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x5d20
mov byte [rbp + 2], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724562
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140147b90]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140147950]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x58], 0x5d20
mov byte [rsp + 0x5a], 0
lea rdx, [rsp + 0x39]
jmp 0x140050fa9
mov edx, 7
call fcn.140051420
movdqa xmm0, xmmword [0x140147f40]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x1401530d8], 0
movdqa xmm0, xmmword [0x140147e70]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.14000b180
mov dword [rbp - 0x30], 0x63755312
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x140147cc0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140051260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1401530d8], 0
jmp 0x140050fbd
mov cl, 0x16
mov word [rbp - 0x80], 0x16
movsx r11d, cl
movzx eax, r11w
xor ax, 0x53
mov word [rbp - 0x7e], ax
movzx r9d, r11w
xor r9w, 0x64
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx eax, r11w
xor ax, 0x79
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r9w
movzx r10d, r11w
xor r10w, 0x36
mov word [rbp - 0x74], r10w
movzx eax, r11w
xor ax, 0x77
mov word [rbp - 0x72], ax
movzx eax, r11w
xor ax, 0x72
mov word [rbp - 0x70], ax
movzx eax, r11w
xor ax, 0x7c
mov word [rbp - 0x6e], ax
movzx eax, r11w
xor ax, 0x63
mov word [rbp - 0x6c], ax
movzx r8d, r11w
xor r8w, 0x65
mov word [rbp - 0x6a], r8w
movzx eax, r11w
xor ax, 0x62
mov word [rbp - 0x68], ax
movzx ecx, r11w
xor cx, 0x7f
mov word [rbp - 0x66], cx
movzx eax, r11w
xor ax, 0x78
mov word [rbp - 0x64], ax
movzx edx, r11w
xor dx, 0x71
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r10w
movzx eax, r11w
xor ax, 0x66
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r9w
mov word [rbp - 0x5a], cx
movzx eax, r11w
xor ax, 0x60
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r11w
xor ax, 0x7a
mov word [rbp - 0x54], ax
movzx eax, r11w
xor ax, 0x73
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r11w, 0x2c
mov word [rbp - 0x4a], r11w
mov word [rbp - 0x48], r10w
mov word [rbp - 0x46], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051570
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051750]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724518
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140147b40]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
jmp 0x140050fae
mov cl, 0x35
mov word [rbp - 0x80], 0x35
movsx ebx, cl
movzx eax, bx
xor ax, 0x70
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x47
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x5a
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 0x15
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x45
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x50
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x5b
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x5c
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x52
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x56
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x46
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x41
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x5e
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0xf
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051570
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051750]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724538
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140147dd0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x140050fa9
mov cl, 0xc
mov word [rbp - 0x80], 0xc
movsx ebx, cl
movzx eax, bx
xor ax, 0x49
mov word [rbp - 0x7e], ax
movzx r11d, bx
xor r11w, 0x7e
mov word [rbp - 0x7c], r11w
mov word [rbp - 0x7a], r11w
movzx r8d, bx
xor r8w, 0x63
mov word [rbp - 0x78], r8w
mov word [rbp - 0x76], r11w
movzx r10d, bx
xor r10w, 0x2c
mov word [rbp - 0x74], r10w
mov word [rbp - 0x72], r8w
movzx edx, bx
xor dx, 0x7c
mov word [rbp - 0x70], dx
movzx r9d, bx
xor r9w, 0x69
mov word [rbp - 0x6e], r9w
movzx ecx, bx
xor cx, 0x62
mov word [rbp - 0x6c], cx
movzx eax, bx
xor ax, 0x65
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], cx
movzx eax, bx
xor ax, 0x6b
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r10w
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r11w
mov word [rbp - 0x5e], r8w
movzx eax, bx
xor ax, 0x6f
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r9w
movzx eax, bx
xor ax, 0x7f
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r10w
movzx eax, bx
xor ax, 0x78
mov word [rbp - 0x52], ax
movzx eax, bx
xor ax, 0x64
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r11w
mov word [rbp - 0x4c], r9w
movzx eax, bx
xor ax, 0x6d
mov word [rbp - 0x4a], ax
movzx eax, bx
xor ax, 0x68
mov word [rbp - 0x48], ax
xor bx, 0x36
mov word [rbp - 0x46], bx
mov word [rbp - 0x44], r10w
mov word [rbp - 0x42], r15w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140051570
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140051750]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724510
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140147de0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x61657268
mov word [rsp + 0x54], 0x2e64
mov byte [rsp + 0x56], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x30], 0x72724516
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140051000
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050ffb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
movdqa xmm0, xmmword [0x140147560]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r15w
jmp 0x14005114e
movdqa xmm0, xmmword [0x140147f60]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400082a0
lea rdx, [0x140008470]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724567
movdqa xmm0, xmmword [0x140147f50]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x1400510bb
movdqa xmm0, xmmword [0x140147d80]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov dword [rbp - 8], 0xa2e64
lea rcx, [rbp - 0x1f]
call fcn.14000b180
mov rcx, rbx
call fcn.14000b180
mov dword [rsp + 0x30], 0x7272453a
movdqa xmm0, xmmword [0x140147d60]
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x64
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14005114e
mov dword [rsp + 0x30], 0x7272455f
movdqa xmm0, xmmword [0x140147920]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140147990]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140147960]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x68], 0x2e59
mov byte [rsp + 0x6a], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14016c3b0], r15d
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140051190
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005118a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005118a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400511ce
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400511c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400511c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140051222
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005121d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005121d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059518
xor al, al
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140059220
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x20]
call fcn.140002ce0
int3