Function at 0x14001c060
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x78], r14d
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rsi, [0x1404ac930]
mov eax, dword [rcx + rax]
cmp dword [0x1404ac928], eax
jle 0x14001c11e
lea rcx, [0x1404ac928]
call fcn.1402b61fc
cmp dword [0x1404ac928], 0xffffffff
jne 0x14001c11e
xorps xmm0, xmm0
movups xmmword [0x1404ac930], xmm0
mov qword [0x1404ac940], r14
mov qword [0x1404ac948], r14
mov r8d, 0x781
lea rdx, str.__xml_version_1.0__encoding_utf_8____n_configuration__n_____startup__n_________supportedRuntime_version_v4.0__sku_.NETFramework_Versionv4.5.2____n______startup__n_____appSettings__n______appSettings__n_____runtime__n_________assemblyBinding_xmlns_urn:schemas_microsoft_com:asm.v1___n_____________dependentAssembly__n_________________assemblyIdentity_name_System.Runtime__publicKeyToken_b03f5f7f11d50a3a__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_2.6.10.0__newVersion_2.6.10.0_____n______________dependentAssembly__n_____________dependentAssembly__n_________________assemblyIdentity_name_System.Threading.Tasks__publicKeyToken_b03f5f7f11d50a3a__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_2.6.10.0__newVersion_2.6.10.0_____n______________dependentAssembly__n_____________dependentAssembly__n_________________assemblyIdentity_name_Newtonsoft.Json__publicKeyToken_30ad4fe6b2a6aeed__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_13.0.3.9__newVersion_13.0.3.9_____n______________dependentAssembly__n_____________dependentAssembly__n_________________assemblyIdentity_name_System.Data.SQLite__publicKeyToken_db937bc2d44ff139__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_1.0.109.0__newVersion_1.0.109.0_____n______________dependentAssembly__n_____________dependentAssembly__n_________________assemblyIdentity_name_log4net__publicKeyToken_669E0DDF0BB1AA2A__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_2.0.12.0__newVersion_2.0.12.0_____n______________dependentAssembly__n_____________dependentAssembly__n_________________assemblyIdentity_name_Quartz__publicKeyToken_f6b8c98a402cc8a4__culture_neutral_____n_________________bindingRedirect_oldVersion_0.0.0.0_3.0.7.0__newVersion_3.0.7.0_____n______________dependentAssembly__n__________assemblyBinding__n______runtime__n__configuration__n
mov rcx, rsi
call fcn.140015370
lea rcx, [0x14032b720]
call fcn.1402b613c
nop
lea rcx, [0x1404ac928]
call fcn.1402b6190
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c170
mov rax, qword [rcx]
mov r10, qword [rax + 0x18]
lea rax, [rdi + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14001c13c
mov rax, qword [rax]
lea rdx, str.Attempting_to_reset_config_file_for_MBCloudEA
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, 0x28b
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call r10
mov rcx, qword [rdi + 8]
cmp qword [0x1404ac948], 0xf
cmova rsi, qword [0x1404ac930]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov r8d, dword [0x1404ac940]
mov rdx, rsi
mov rcx, rbx
call fcn.14009de00
test al, al
jne 0x14001c1fd
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c1fd
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
cmp qword [rbx + 0x18], 7
jbe 0x14001c1ba
mov rbx, qword [rbx]
lea rax, [rdi + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14001c1c8
mov rax, qword [rax]
mov qword [rsp + 0x38], rbx
lea rdx, str.Failed_to_write_config_file__ls._Continuing.
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 0x292
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call r10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], r14
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r14w
mov rax, qword [rdi]
lea r8, [rbp + 0x18]
lea rdx, [0x1403de9a8]
mov rcx, rdi
call qword [rax + 0x68]
test al, al
je 0x14001c49c
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
mov r8d, 0x1f
lea rdx, str.Microsoft.NET_assemblyGAC_MSIL
lea rcx, [rbp - 0x80]
call fcn.140030be0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x10]
call fcn.14009b580
nop
lea rcx, [rbp - 0x80]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov r8d, 0x30
lea rdx, str.Quartz_v4.0_3.0.7.0__f6b8c98a402cc8a4Quartz.dll
lea rcx, [rsp + 0x58]
call fcn.140030be0
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.14009b580
nop
lea rcx, [rsp + 0x58]
call fcn.1400166f0
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400b21a0
test al, al
je 0x14001c489
cmp dword [rsp + 0x50], 0
jne 0x14001c489
lea r8, str..tmp
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x38]
call fcn.14001e470
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rdx, qword [rbp + 0x38]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14001c3b2
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14001c47f
mov rax, qword [rbx]
mov rsi, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
lea rdx, [rdi + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001c372
mov rdx, qword [rdx]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
lea rax, str.Failed_to_rename__ls._Error__u
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 2
mov r9d, 0x2ab
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
mov rcx, rbx
call rsi
jmp 0x14001c47f
mov ecx, 0x40
call fcn.1402b5c5c
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.140030a90
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x30]
call fcn.140030a90
nop
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x78], 2
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [rbp - 0x50]
je 0x14001c404
mov qword [rsp + 0x50], r14
mov qword [rdx], rbx
add qword [rbp - 0x58], 8
jmp 0x14001c412
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.140020bd0
mov eax, 2
and eax, 0xfffffffd
mov dword [rsp + 0x78], eax
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14001c47f
mov qword [rbp - 0x80], rbx
cmp qword [rbx + 0x10], 0
je 0x14001c45f
cmp qword [rbx + 0x30], 0
je 0x14001c45f
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x14001c448
mov rdx, qword [rdx]
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001c455
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbx + 0x20]
call fcn.1400166f0
nop
mov rcx, rbx
call fcn.1400166f0
mov edx, 0x40
mov rcx, rbx
call fcn.1402b5c4c
nop
lea rcx, [rbp + 0x38]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x30]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x10]
call fcn.1400166f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea r12, vtable.mb::common::system::ScopedAny_struct_HKEY______ptr64__long_int____cdecl___struct_HKEY______ptr64___long_int___cdecl_RegCloseKey_struct_HKEY______ptr64___0__0__0_.0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x40], r14
mov rax, qword [rdi]
mov rsi, qword [rax + 0x30]
mov rbx, qword [rax + 0x60]
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov r8d, 0x26
lea rdx, str.939C59AB_5380_43CF_B906_9BCCCC59943A
lea rcx, [rsp + 0x58]
call fcn.140030be0
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call rbx
nop
cmp qword [rax + 0x18], 7
jbe 0x14001c501
mov rax, qword [rax]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xf003f
mov r9d, 1
mov r8, rax
mov rdx, 0xffffffff80000002
mov rcx, rdi
call rsi
mov ebx, eax
lea rcx, [rbp - 0x10]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x58]
call fcn.1400166f0
test ebx, ebx
je 0x14001c58f
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c58f
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
lea rax, [rdi + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14001c55f
mov rax, qword [rax]
lea rdx, str.Failed_to_create_volatile_key
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 0x2b7
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call r10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
mov rbx, qword [rdi + 8]
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea r8d, [rax + 0xf]
lea r15, str.MBEndpointAgent
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140030be0
nop
lea rsi, [rdi + 0x10]
mov r9, rsi
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x60]
call fcn.1400b8e30
nop
lea rcx, [rsp + 0x58]
call fcn.1400166f0
mov edx, reloc.WS2_32.dll_setsockopt
lea rcx, [rbp + 0x60]
call fcn.1400b8e90
test al, al
jne 0x14001c682
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14001c93c
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rsi + 0x18], 7
jbe 0x14001c644
mov rsi, qword [rsi]
mov dword [rsp + 0x38], eax
lea rax, str.Failed_to_open_MBEndpointAgent_service._Error__u.
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 2
mov r9d, 0x2be
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
mov rcx, rbx
call rdi
xor sil, sil
jmp 0x14001c9a3
lea rcx, [rbp + 0x60]
call fcn.1400b9860
test eax, eax
je 0x14001c767
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140030be0
nop
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400192d0
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.1400166f0
mov rcx, qword [rdi + 8]
test ebx, ebx
jne 0x14001c721
test rcx, rcx
je 0x14001c767
mov rax, qword [rcx]
cmp qword [rsi + 0x18], 7
jbe 0x14001c6ef
mov rsi, qword [rsi]
lea rdx, str.Successfully_removed_protection
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 3
mov r9d, 0x2cb
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call qword [rax + 0x18]
jmp 0x14001c767
test rcx, rcx
je 0x14001c767
mov rax, qword [rcx]
cmp qword [rsi + 0x18], 7
jbe 0x14001c733
mov rsi, qword [rsi]
mov dword [rsp + 0x38], ebx
lea rdx, str.Failed_to_remove_protection.__08X.
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 2
mov r9d, 0x2cf
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call qword [rax + 0x20]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov dword [rbp + 0x10], eax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x60]
call fcn.1400b96d0
mov ecx, r14d
test al, al
cmovne ecx, dword [rbp - 0xc]
cmp ecx, 1
je 0x14001c823
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov r8d, reloc.WS2_32.dll_ntohs
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140030be0
nop
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140019000
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.1400166f0
test ebx, ebx
jne 0x14001c823
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x50]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x54]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.14001cae0
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x60]
call fcn.1400b92e0
nop
lea rcx, [rbp - 0x80]
call fcn.14001cc20
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov dword [rbp + 0x10], eax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x60]
call fcn.1400b96d0
test al, al
je 0x14001c8d3
cmp dword [rbp - 0xc], 1
je 0x14001c8d3
mov ebx, dword [rbp + 0xc]
test ebx, ebx
je 0x14001c8d6
mov edx, 0x2710
mov ecx, ebx
call fcn.140018d50
test eax, eax
je 0x14001c8d6
mov r10, qword [rdi + 8]
test r10, r10
je 0x14001c93c
mov rcx, qword [r10]
mov r11, qword [rcx + 0x20]
add rdi, 0x10
cmp qword [rdi + 0x18], 7
jbe 0x14001c88b
mov rdi, qword [rdi]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], r15
lea rax, str.Failed_to_terminate__ls___u_._Result:__u
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
mov r9d, 0x2e6
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
mov rcx, r10
call r11
xor sil, sil
jmp 0x14001c9a3
mov ebx, r14d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x60]
call fcn.1400b9020
test al, al
jne 0x14001c941
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c93c
mov rax, qword [rcx]
add rdi, 0x10
cmp qword [rdi + 0x18], 7
jbe 0x14001c908
mov rdi, qword [rdi]
mov dword [rsp + 0x38], ebx
lea rdx, str.Failed_to_start_service_within_timeout._PID__u
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
mov r9d, 0x2f1
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call qword [rax + 0x20]
xor sil, sil
jmp 0x14001c9a3
mov rax, qword [rbp - 0x58]
cmp qword [rbp - 0x60], rax
je 0x14001c956
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001c9a0
mov rax, qword [rcx]
add rdi, 0x10
cmp qword [rdi + 0x18], 7
jbe 0x14001c970
mov rdi, qword [rdi]
lea rdx, str.Successfully_reset_config_for_MBCloudEA_and_restarted_service.
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
mov r9d, 0x2fc
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::RepairCTSDK1336
call qword [rax + 0x18]
mov sil, 1
lea rbx, vtable.mb::common::system::ScopedAny_struct_SC_HANDLE______ptr64__int____cdecl___struct_SC_HANDLE______ptr64___int___cdecl_CloseServiceHandle_struct_SC_HANDLE______ptr64___0__0__0_.0
mov qword [rbp + 0xb8], rbx
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x14001c9c3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa8], rbx
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x14001c9e3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0xb0], r14
lea rcx, [rbp + 0x88]
call fcn.1400166f0
nop
lea rcx, [rbp + 0x68]
call fcn.1400166f0
nop
mov qword [rbp - 0x48], r12
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001ca14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x40], r14
lea rcx, [rbp + 0x18]
call fcn.1400166f0
nop
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14001ca89
mov rdi, qword [rbp - 0x58]
cmp rbx, rdi
je 0x14001ca49
mov rcx, rbx
call fcn.14001cc80
add rbx, 8
cmp rbx, rdi
jne 0x14001ca34
mov rbx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x50]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001ca75
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cab8
mov rcx, rbx
call fcn.1402b5c4c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
movzx eax, sil
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1402c5d0c
int3