Function at 0x401c80
Capabilities:
Get hostname
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x448
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov qword [r11 - 0x30], r15
mov rax, qword [0x004131d8]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov rsi, rdx
movsxd rdi, ecx
xor bx, bx
xor r15b, r15b
mov word [rsp + 0x72], 1
xor r8w, r8w
mov word [rsp + 0x76], r8w
mov word [rsp + 0x78], bx
xor r12w, r12w
mov word [rsp + 0x74], r12w
xor al, al
mov byte [rsp + 0x70], al
lea rax, str.DefaultInstance
mov qword [rsp + 0x88], rax
xor r14d, r14d
mov r13, r14
mov qword [rsp + 0x80], r14
mov r8d, 0x104
lea rdx, [r11 - 0x158]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test ax, ax
jne 0x401d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor r8d, r8d
lea rdx, str.GetModuleFileName
call fcn.00401260
movzx eax, ax
jmp 0x402a56
movzx eax, ax
lea rcx, [rsp + rax + 0x2f0]
lea rax, [rsp + 0x2f0]
cmp rcx, rax
je 0x401db1
nop
nop
sub rcx, 1
cmp byte [rcx], 0x5c
je 0x401d88
lea rax, [rsp + 0x2f0]
cmp rcx, rax
jne 0x401d70
jmp 0x401db1
lea rax, [rsp + 0x2f0]
cmp rcx, rax
je 0x401db1
sub rcx, 1
movzx eax, byte [rcx]
cmp al, 0x5c
je 0x401db1
cmp al, 0x3a
je 0x401db1
lea rax, [rsp + 0x2f0]
cmp rcx, rax
jne 0x401d95
mov byte [rcx], r12b
lea rbp, [rsi + rdi*8]
add rsi, 8
cmp rsi, rbp
jae 0x402a50
lea rax, str.INSTALL
lea rdi, [0x00400000]
mov r12, qword [str.INSTALL]
nop
nop
mov r11, qword [rsi]
cmp byte [r11], 0x2d
je 0x401e83
mov r10, r14
mov r8, r12
test r12, r12
je 0x402018
mov r9, rax
nop
mov rdi, r11
mov rdx, r8
movzx eax, byte [r11]
test al, al
je 0x401e3f
nop
cmp al, 0x61
jl 0x401e20
cmp al, 0x7a
jg 0x401e20
movsx ecx, al
sub ecx, 0x20
jmp 0x401e23
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
jne 0x401e3a
add rdi, 1
add rdx, 1
mov al, byte [rdi]
test al, al
jne 0x401e10
jmp 0x401e3f
cmp byte [rdi], r14b
jne 0x401e4a
sub dx, r8w
cmp word [r9 + 8], dx
jbe 0x401e60
add r10, 1
add r9, 0x10
mov r8, qword [r9]
test r8, r8
je 0x402018
jmp 0x401e00
test r8, r8
je 0x402018
add r10, r10
lea rax, str.INSTALL
movzx ebx, word [rax + r10*8 + 0xa]
movzx edi, byte [rsp + 0x70]
jmp 0x402003
lea rdx, [r11 + 1]
movzx eax, byte [rdx]
cmp al, 0x61
jl 0x401e9a
cmp al, 0x7a
jg 0x401e9a
movsx eax, al
sub eax, 0x20
jmp 0x401e9d
movsx eax, al
sub eax, 0x3f
cmp eax, 0x1b
ja case.0x401eb5.64
cdqe
mov ecx, dword [rdi + rax*4 + 0x2ab0]
add rcx, rdi
jmp rcx
mov word [rsp + 0x72], 1
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x72], r14w
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x76], 2
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov r15b, 1
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x78], 1
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x74], r14w
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x74], 1
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov word [rsp + 0x74], 2
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
add rsi, 8
cmp rsi, rbp
jae 0x401f7d
mov r13, qword [rsi]
add rsi, 8
cmp rsi, rbp
jae 0x401fe9
mov rax, qword [rsi]
cmp byte [rax], 0x2d
jne 0x401fa0
sub rsi, 8
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov qword [rsp + 0x80], rax
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov dil, 1
mov byte [rsp + 0x70], dil
lea rax, str.INSTALL
jmp 0x402003
add rsi, 8
cmp rsi, rbp
jae 0x401ff7
mov rax, qword [rsi]
mov qword [rsp + 0x88], rax
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
jmp 0x402003
mov dil, byte [rsp + 0x70]
lea rax, str.INSTALL
add rsi, 8
cmp rsi, rbp
jae 0x40202e
lea rdi, [0x00400000]
jmp 0x401de0
mov rdx, r11
lea rcx, str.Unknown_command___s__n
call qword [sym.imp.MSVCR80.dll_printf]
call fcn.00401350
int3
test r15b, r15b
je 0x402047
lea rdx, str.WI_V2.5.0.26074_Firebird_2.5
lea rcx, str.instsvc_version__s_n
call qword [sym.imp.MSVCR80.dll_printf]
test bx, bx
je 0x402a50
lea r15, [fcn.00401260]
test r13, r13
je 0x40227e
cmp bx, 1
jne 0x402a50
test dil, dil
je 0x402088
lea rcx, str._Interact_with_desktop__mode_can_be_set_for_LocalSystem_account_only
call qword [sym.imp.MSVCR80.dll_printf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
int3
mov rcx, r13
movzx eax, byte [r13]
test al, al
je 0x4020a4
cmp al, 0x5c
je 0x4020a4
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x402094
jmp 0x4020a9
cmp byte [rcx], r14b
jne 0x402105
mov dword [rsp + 0x7c], 0x7f
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdi, [rsp + 0x1f0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x0040ee94]
mov word [rdi - 1], ax
mov ecx, dword [rsp + 0x7c]
add ecx, 1
mov r8d, 0x80
sub r8, rcx
mov rdx, r13
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.MSVCR80.dll_strncat]
jmp 0x40211c
mov r8d, 0x80
mov rdx, r13
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.MSVCR80.dll_strncpy]
mov byte [rsp + 0x26f], r14b
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.USER32.dll_CharToOemA]
lea r13, [rsp + 0x1f0]
mov rbp, qword [rsp + 0x80]
test rbp, rbp
jne 0x4021ca
lea rdx, [rsp + 0x270]
lea rcx, str.Enter__s_user_password_:
call qword [sym.imp.MSVCR80.dll_printf]
lea rdi, [rsp + 0x1b0]
nop
call qword [sym.imp.MSVCR80.dll__getch]
mov byte [rdi], al
add rdi, 1
cmp al, 0xd
je 0x402198
mov ecx, 0x2a
call qword [sym.imp.MSVCR80.dll__putch]
lea r11, [rsp + 0x1ef]
cmp rdi, r11
jb 0x402170
mov byte [rdi - 1], r14b
lea rcx, [0x0040ea0c]
call qword [sym.imp.MSVCR80.dll_printf]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_OemToCharA]
lea rax, [rsp + 0x1b0]
mov rbp, rax
lea r8, str.SeServiceLogonRight
mov rdx, r15
lea rcx, [rsp + 0x1f0]
call fcn.00403450
movzx edx, ax
test edx, edx
je 0x40220e
cmp edx, 0x66
je 0x402223
lea rdx, [rsp + 0x270]
lea rcx, str.Failed_granting_the_Logon_as_a_Service_right_to__s_n
call qword [sym.imp.MSVCR80.dll_printf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
int3
lea rdx, [rsp + 0x270]
lea rcx, str.The_Logon_as_a_Service_right_has_been_granted_to__s_n
call qword [sym.imp.MSVCR80.dll_printf]
lea r8, str.SeIncreaseQuotaPrivilege
mov rdx, r15
lea rcx, [rsp + 0x1f0]
call fcn.00403450
movzx edx, ax
test edx, edx
je 0x402267
cmp edx, 0x66
je 0x402286
lea rdx, [rsp + 0x270]
lea rcx, str.Failed_granting_the_Adjust_memory_quotas_for_a_process_right_to__s_n
call qword [sym.imp.MSVCR80.dll_printf]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
int3
lea rdx, [rsp + 0x270]
lea rcx, str.The_Adjust_memory_quotas_for_a_process_right_has_been_granted_to__s_n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402286
mov rbp, qword [rsp + 0x80]
mov r8d, 0xf003f
movzx edi, bx
test edi, edi
jle 0x4022b6
cmp edi, 2
jle 0x4022b0
cmp edi, 4
jle 0x4022a8
cmp edi, 6
jne 0x4022b6
lea r8d, [rdi - 2]
jmp 0x4022b6
mov r8d, 1
jmp 0x4022b6
mov r8d, 2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x4022e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor r8d, r8d
lea rdx, str.OpenSCManager
call fcn.00401260
lea ecx, [rbx + 1]
call qword [sym.imp.MSVCR80.dll_exit]
int3
call fcn.00404e40
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov word [rsp + 0xc8], r14w
mov word [rsp + 0xca], 0x20
mov byte [rsp + 0xa0], r14b
call fcn.00404e40
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x168], rax
mov word [rsp + 0x170], 0
mov word [rsp + 0x172], 0x20
mov byte [rsp + 0x148], 0
mov rsi, qword [rsp + 0x88]
mov r8, rsi
lea rdx, str.FirebirdGuardian_s
lea rcx, [rsp + 0x98]
call fcn.00409ee0
mov r8, rsi
lea rdx, str.Firebird_Guardian____s
lea rcx, [rsp + 0x140]
call fcn.00409ee0
call fcn.00404e40
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x130], rax
mov word [rsp + 0x138], 0
mov word [rsp + 0x13a], 0x20
mov byte [rsp + 0x110], 0
call fcn.00404e40
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
mov word [rsp + 0x102], 0x20
mov byte [rsp + 0xd8], 0
mov r8, rsi
lea rdx, str.FirebirdServer_s
lea rcx, [rsp + 0x108]
call fcn.00409ee0
mov r8, rsi
lea rdx, str.Firebird_Server____s
lea rcx, [rsp + 0xd0]
call fcn.00409ee0
call fcn.00404e40
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x1a0], rax
mov word [rsp + 0x1a8], 0
mov word [rsp + 0x1aa], 0x20
mov byte [rsp + 0x180], 0
mov edx, 0x20
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
je 0x402495
mov r8, rsi
lea rdx, str._s___s_
lea rcx, [rsp + 0x178]
call fcn.00409ee0
jmp 0x4024ac
mov r8, rsi
lea rdx, str._s__s
lea rcx, [rsp + 0x178]
call fcn.00409ee0
movzx r12d, word [rsp + 0x74]
cmp r12w, 2
jne 0x4024e2
mov edx, 3
lea rcx, [rsp + 0x178]
call fcn.00409990
mov rdx, rax
movzx eax, word [0x0040ece4]
mov word [rdx], ax
movzx eax, byte [0x0040ece6]
mov byte [rdx + 2], al
sub edi, 1
je 0x4027e0
sub edi, 1
je 0x40269f
sub edi, 1
je 0x4025f4
sub edi, 1
je 0x402555
sub edi, 2
je 0x40250f
xor di, di
jmp 0x402960
mov rcx, rbx
call fcn.00401960
cmp ax, 1
jne 0x40254d
mov r8, rbx
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0xc0]
call fcn.004015c0
mov r8, rbx
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x130]
call fcn.004015c0
xor di, di
jmp 0x402960
mov r8d, 0x20
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
je 0x4025b3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, r15
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.00403200
mov di, ax
test ax, ax
jne 0x402960
mov rdx, qword [rsp + 0x168]
lea rcx, str.Service___s__successfully_stopped._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402960
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, r15
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call fcn.00403200
mov di, ax
test ax, ax
jne 0x402960
mov rdx, qword [rsp + 0xf8]
lea rcx, str.Service___s__successfully_stopped._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402960
mov r8d, 0x10
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
je 0x402658
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r9, r15
movzx r8d, word [rsp + 0x76]
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.004030b0
mov di, ax
test ax, ax
jne 0x402960
mov rdx, qword [rsp + 0x168]
lea rcx, str.Service___s__successfully_started._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402960
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r9, r15
mov r8w, word [rsp + 0x76]
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call fcn.004030b0
mov di, ax
test ax, ax
jne 0x402960
mov rdx, qword [rsp + 0xf8]
lea rcx, str.Service___s__successfully_started._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402960
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
je 0x402720
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, r15
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.00402f90
mov di, ax
test ax, ax
jne 0x4026f6
mov rdx, qword [rsp + 0x168]
lea rcx, str.Service___s__successfully_deleted._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402732
cmp di, 0x65
jne 0x402732
mov rdx, qword [rsp + 0x168]
lea rcx, str.Service___s__not_deleted._n
call qword [sym.imp.MSVCR80.dll_printf]
lea rcx, str.You_must_stop_it_before_attempting_to_delete_it._n_n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x402732
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r14d
cmp eax, 0x424
setne dil
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
je 0x4027b3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, r15
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call fcn.00402f90
mov si, ax
test ax, ax
jne 0x402789
mov rdx, qword [rsp + 0xf8]
lea rcx, str.Service___s__successfully_deleted._n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x4027c5
cmp si, 0x65
jne 0x4027c5
mov rdx, qword [rsp + 0xf8]
lea rcx, str.Service___s__not_deleted._n
call qword [sym.imp.MSVCR80.dll_printf]
lea rcx, str.You_must_stop_it_before_attempting_to_delete_it._n_n
call qword [sym.imp.MSVCR80.dll_printf]
jmp 0x4027c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, r14d
cmp eax, 0x424
setne sil
test di, di
je 0x402960
test si, si
je 0x402960
mov di, 1
jmp 0x402960
movzx esi, word [rsp + 0x78]
test si, si
je 0x40289f
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r13
movzx eax, word [rsp + 0x72]
mov word [rsp + 0x40], ax
mov qword [rsp + 0x38], r14
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
lea rax, str.bin_fbguard
mov qword [rsp + 0x20], rax
lea r9, str.Firebird_Server_Guardian___www.firebirdsql.org
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.00402bd0
movzx edi, ax
xor ax, ax
test r13, r13
je 0x402879
mov r8, r15
mov rdx, r13
mov rcx, qword [rsp + 0xc0]
call fcn.004037e0
test di, di
jne 0x402898
test ax, ax
jne 0x402898
mov rdx, qword [rsp + 0x168]
lea rcx, str.Service___s__successfully_created._n
call qword [sym.imp.MSVCR80.dll_printf]
mov word [rsp + 0x72], 0
test si, si
sete al
lea rdx, str.bin_fbserver
lea rcx, str.bin_fb_inet_server
test r12w, r12w
cmove rcx, rdx
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x60], al
mov al, byte [rsp + 0x70]
mov byte [rsp + 0x58], al
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r13
mov ax, word [rsp + 0x72]
mov word [rsp + 0x40], ax
mov qword [rsp + 0x38], r14
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.Firebird_Database_Server___www.firebirdsql.org
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x130]
mov rcx, rbx
call fcn.00402bd0
mov di, ax
xor ax, ax
test r13, r13
je 0x402941
mov r8, r15
mov rdx, r13
mov rcx, qword [rsp + 0x130]
call fcn.004037e0
test di, di
jne 0x402960
test ax, ax
jne 0x402960
mov rdx, qword [rsp + 0xf8]
lea rcx, str.Service___s__successfully_created._n
call qword [sym.imp.MSVCR80.dll_printf]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test di, di
setne r14b
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rax
je 0x402997
test rcx, rcx
je 0x402997
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
nop
lea rax, [rsp + 0xd8]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x4029be
test rcx, rcx
je 0x4029be
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
nop
lea rax, [rsp + 0x110]
mov rcx, qword [rsp + 0x130]
cmp rcx, rax
je 0x4029e5
test rcx, rcx
je 0x4029e5
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
nop
lea rax, [rsp + 0x148]
mov rcx, qword [rsp + 0x168]
cmp rcx, rax
je 0x402a0c
test rcx, rcx
je 0x402a0c
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
nop
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x402a32
test rcx, rcx
je 0x402a32
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
mov eax, r14d
jmp 0x402a56
call fcn.00401350
int3
lea rcx, str.Unknown_switch___s__n
call qword [sym.imp.MSVCR80.dll_printf]
call fcn.00401350
int3
call fcn.00401350
int3
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.0040cd40
mov rbx, qword [rsp + 0x460]
mov rbp, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x440]
mov rdi, qword [rsp + 0x438]
mov r12, qword [rsp + 0x430]
mov r13, qword [rsp + 0x428]
mov r14, qword [rsp + 0x420]
mov r15, qword [rsp + 0x418]
add rsp, 0x448
ret