Function at 0x1400026f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 ksa
Enumerate processes
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15d0]
mov eax, 0x16d0
call fcn.140004ad0
sub rsp, rax
movaps xmmword [rsp + 0x16c0], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x15b0], rax
lea rdx, str.Starting_memory_extraction...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x1400027a1
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140002fe1
mov dword [rbp - 0x20], 0x238
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400027ef
lea rdx, str.Failed_to_retrieve_process_information.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140002fe1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
xor edi, edi
mov qword [rbp - 0x48], rdi
mov r14, qword [rbp - 0x50]
cmp r14, rdi
je 0x140002816
mov eax, dword [rbp - 0x18]
mov dword [r14], eax
add r14, 4
mov qword [rbp - 0x50], r14
jmp 0x14000282e
lea r8, [rbp - 0x18]
mov rdx, r14
lea rcx, [rbp - 0x58]
call fcn.1400037c0
mov rdi, qword [rbp - 0x48]
mov r14, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002801
mov qword [rsp + 0x40], rdi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x15a4], 0xffffffff
mov dword [rbp + 0x224], eax
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x224], eax
inc rdx
cmp rdx, 0x270
jb 0x140002860
mov dword [rbp + 0x220], 0x270
mov r15, qword [rbp - 0x58]
sub r14, r15
sar r14, 2
dec r14d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
xor edi, edi
mov qword [rbp - 0x60], rdi
xor r13d, r13d
btc r14d, 0x1f
movsd xmm6, qword [0x1400055c8]
mov rsi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
lea rcx, [rbp + 0x220]
cmp r14d, 0x7fffffff
jne 0x1400028d9
call fcn.1400039c0
mov ecx, eax
jmp 0x14000291e
lea ebx, [r14 - 0x7fffffff]
call fcn.1400039c0
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x140002916
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140002916
nop
lea rcx, [rbp + 0x220]
call fcn.1400039c0
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140002900
shr rcx, 0x20
mov rdi, qword [rbp - 0x60]
lea eax, [rcx - 0x80000000]
movsxd rcx, eax
xor rcx, 0xffffffff80000000
mov ebx, dword [r15 + rcx*4]
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x14000298c
lea rdx, str.Failed_to_open_selected_process__PID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003150
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005498]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002b1f
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov ecx, 0x20
call fcn.140003b80
mov rdi, rax
mov qword [rsp + 0x78], rax
lea rsi, [rax + 0x20]
mov qword [rbp - 0x78], rsi
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbp - 0x80], rsi
mov r9d, 0x30
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140002a7b
nop dword [rax + rax]
cmp dword [rsp + 0x68], 0x1000
jne 0x140002a50
mov eax, dword [rsp + 0x6c]
add eax, 0xfffffffe
cmp eax, 0x3e
ja 0x140002a50
movabs rcx, 0x4000000040000045
bt rcx, rax
jae 0x140002a50
mov rbx, rsi
sub rbx, rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002a50
cmp qword [rbp - 0x28], rbx
jne 0x140002a50
lea rcx, [rsp + 0x78]
call fcn.1400023e0
mov rsi, qword [rbp - 0x80]
comisd xmm0, xmm6
jae 0x140002b31
mov rdi, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
add rdx, qword [rsp + 0x48]
mov r9d, 0x30
lea r8, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x1400029e0
mov rsi, qword [rbp - 0x78]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
test rdi, rdi
je 0x140002abb
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x140002ab0
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b3c
mov rdx, rsi
mov rcx, rdi
call fcn.140003bbc
xor ebx, ebx
mov rdi, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x38]
test r12, r12
je 0x140002b02
mov rcx, qword [rbp - 0x60]
sub rcx, r12
mov rax, r12
cmp rcx, 0x1000
jb 0x140002af7
add rcx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f50
mov rdx, rcx
mov rcx, r12
call fcn.140003bbc
mov r12, rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rdi
cmp rbx, rsi
jne 0x140002b43
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
cmp r13d, 0xa
jge 0x140002b6f
mov r15, qword [rbp - 0x58]
jmp 0x1400028c0
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x78]
jmp 0x140002ac5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Memory_extraction_completed_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12, rsi
jne 0x140002bac
lea rdx, str.Memory_extraction_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, 1
jmp 0x140002f60
lea rdx, str.Using_extracted_memory_as_the_AES_256_encryption_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
mov rcx, rax
lea rdx, [0x140003330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov ecx, 0x100
call fcn.140003b80
mov r14, rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + 0x100]
mov qword [rbp - 0x78], rbx
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x80], rbx
xor esi, esi
mov r15, r14
nop dword [rax]
test sil, sil
jne 0x140002c1a
xor r9b, r9b
jmp 0x140002c86
movzx r9d, sil
mov edi, 0xfd
nop dword [rax]
nop word [rax + rax]
movzx r10d, sil
movzx r8d, r9b
xor r11b, r11b
mov ebx, 8
movzx eax, r11b
xor al, r8b
movzx r9d, al
movzx eax, r11b
test r10b, 1
cmove r9d, eax
movzx eax, r8b
add al, al
movzx edx, al
shr r10b, 1
movzx r11d, r9b
movzx ecx, r8b
movzx eax, dl
xor al, 0x1b
movzx r8d, al
test cl, cl
cmovns r8d, edx
sub rbx, 1
jne 0x140002c40
sub rdi, 1
jne 0x140002c30
movzx eax, r9b
add al, al
xor al, r9b
add al, al
xor al, r9b
add al, al
xor al, r9b
add al, al
xor al, r9b
xor al, 0x63
mov byte [r15], al
inc esi
inc r15
cmp esi, 0x100
jl 0x140002c10
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov ecx, 0x100
call fcn.140003b80
mov rdi, rax
mov qword [rbp - 0x40], rax
lea rbx, [rax + 0x100]
mov qword [rbp - 0x30], rbx
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x38], rbx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r14]
mov byte [rcx + rdi], dl
inc edx
lea r14, [r14 + 1]
cmp edx, 0x100
jl 0x140002cf0
mov dword [rsp + 0x30], 0x73696854
mov dword [rsp + 0x34], 0x20736920
mov dword [rsp + 0x38], 0x65732061
mov dword [rsp + 0x3c], 0x74657263
lea rdx, str.Original_input:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
xor edi, edi
nop word [rax + rax]
movzx ebx, byte [rsp + rdi + 0x30]
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140005564]
call fcn.140003150
inc rdi
cmp rdi, 0x10
jl 0x140002d40
lea rdx, [0x140003330]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rsp + 0x78]
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140001be0
lea rdx, str.Encrypted_output:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
xor edi, edi
nop word [rax + rax]
movzx ebx, byte [rsp + rdi + 0x30]
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140005564]
call fcn.140003150
inc rdi
cmp rdi, 0x10
jl 0x140002dc0
lea rdx, [0x140003330]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r9, [rbp - 0x40]
lea r8, [rsp + 0x78]
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140002000
lea rdx, str.Decrypted_output:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
xor edi, edi
nop dword [rax + rax]
movzx ebx, byte [rsp + rdi + 0x30]
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140005564]
call fcn.140003150
inc rdi
cmp rdi, 0x10
jl 0x140002e40
lea rdx, [0x140003330]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Decrypted_string:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003150
xor ebx, ebx
nop word [rax + rax]
movzx edx, byte [rsp + rbx + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003370
inc rbx
cmp rbx, 0x10
jl 0x140002eb0
lea rdx, [0x140003330]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ebx, ebx
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140002f1e
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003bbc
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002f5c
mov rdx, qword [rbp - 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003bbc
mov rdi, qword [rbp - 0x60]
test r12, r12
je 0x140002f9d
sub rdi, r12
mov rax, r12
cmp rdi, 0x1000
jb 0x140002f91
add rdi, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r12
call fcn.140003bbc
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140002fdf
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003bbc
mov eax, ebx
mov rcx, qword [rbp + 0x15b0]
xor rcx, rsp
call fcn.140003b60
lea r11, [rsp + 0x16d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret