Function at 0x180018b00
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1800dfab0
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x12c0], rbx
movaps xmmword [rsp + 0x1270], xmm6
movaps xmmword [rsp + 0x1260], xmm7
mov rax, qword [0x1801a3080]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r14, r8
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x60], esi
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
cmp qword [0x1801ab190], rsi
je 0x180018c75
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], sil
je 0x180018c75
cmp dword [rax + 0x80], 4
jb 0x180018c75
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180018bc9
mov r9, qword [r14]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180018bd6
mov r8, qword [r15]
lea rdx, str.iePathName
lea rcx, [rbp + 0x10]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x26d
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x180018c24
lea rdx, [rbp + 0x10]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180018c64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a40a
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
lea rdi, [r15 + 0x10]
cmp qword [rdi], 0
jne 0x180018c86
xor al, al
jmp 0x18001a3d0
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180018c93
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
jne 0x180018cae
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x180018cae
mov rbx, qword [r15]
lea rdx, [0x180153d50]
mov rcx, rbx
call fcn.180100d08
mov r13d, 1
test eax, eax
je 0x180018d1b
lea rdx, [0x180153d30]
mov rcx, rbx
call fcn.180100d08
test eax, eax
je 0x180018d1b
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.180100d08
test eax, eax
je 0x180018d1b
lea rdx, [0x180153db0]
mov rcx, rbx
call fcn.180100d08
test eax, eax
je 0x180018d1b
lea rdx, str.360chromeX.exe
mov rcx, rbx
call fcn.180100d08
test eax, eax
je 0x180018d1b
mov r12d, esi
jmp 0x1800196f6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movdqu xmmword [rbp + 0xa0], xmm0
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], si
mov r8d, 0xe
lea rdx, str.2345SafeCenter
lea rcx, [rbp + 0x90]
call fcn.18000c0a0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call fcn.18000c0a0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x180018dd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018dce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a410
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.180038c20
nop
cmp qword [rbp + 0x80], 0
jne 0x180018ea5
lea rcx, [rbp + 0xd0]
call fcn.1800204d0
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180018e48
lea rcx, [rbp + 0x70]
call fcn.18000c030
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180018e8e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018e89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a416
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
mov r8d, 0x12
lea rdx, str.2345SFWebShell.exe
lea rcx, [rbp + 0xd0]
call fcn.18000c0a0
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.18009bc70
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180018f2b
lea rcx, [rbp + 0x70]
call fcn.18000c030
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180018f6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018f66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a41c
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180018fc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018fbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a422
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
cmp qword [0x1801ab190], 0
je 0x1800190e1
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], 0
je 0x1800190e1
cmp dword [rax + 0x80], 4
jb 0x1800190e1
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str.mid_fpath___ws
lea rcx, [rbp + 0x10]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x27f
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x180019090
lea rdx, [rbp + 0x10]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800190d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800190cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a428
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
xor sil, sil
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.1800fe490
xor edx, edx
mov r8d, 0x804
lea rcx, [rbp + 0x940]
call fcn.1800fe490
lea rdx, [rbp + 0x140]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x140]
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180019221
xor edx, edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180019221
lea r8, [rbp + 0x140]
mov edx, 0x402
lea rcx, [rbp + 0x940]
call fcn.180104000
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xd0]
call fcn.1800fe490
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._d.exe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180019221
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180019203
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x70]
call fcn.18000c0a0
mov sil, 1
lea rcx, [rbp + 0x70]
call fcn.1800920b0
test al, al
je 0x18001968f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm1
xor r12d, r12d
mov word [rbp + 0x10], r12w
mov r13d, 1
mov r8d, r13d
lea rdx, [0x1801556c0]
lea rcx, [rbp + 0x10]
call fcn.18000c0a0
nop
cmp qword [r15 + 0x18], 8
jb 0x180019273
mov r15, qword [r15]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800192b5
lea rdi, [rdx + rcx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r15
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x1800192c6
mov qword [rsp + 0x20], rdx
mov r9, r15
lea rcx, [rbp + 0x10]
call fcn.18000cac0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001930c
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801557b8]
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180019324
mov qword [rsp + 0x20], r13
lea r9, [0x1801557b8]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000cac0
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180019331
mov r9, qword [r14]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180019374
lea rdi, [rcx + rdx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x180019382
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x10]
call fcn.18000cac0
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x28]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x1800193c8
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r9, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801556c0]
call fcn.1800fe030
mov word [rbx + rdi*2], r12w
jmp 0x1800193e0
mov qword [rsp + 0x20], r13
lea r9, [0x1801556c0]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000cac0
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180019535
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], r12w
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str._vz_:N
lea rcx, [rbp + 0xd0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2a2
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800194d7
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001951d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a42e
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r12w
test sil, sil
je 0x1800195cb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800195cb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor edx, edx
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rbp + 0xd8], 3
mov dword [rbp + 0xf0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0xd0], r12
lea rax, [rbp + 0x940]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov eax, 0x614
mov dword [rbp + 0xf4], r13d
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rdi, 0x20
seta bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019612
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001960d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a434
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019667
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a43a
call fcn.1800dedc4
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x50]
call fcn.18000c030
movzx eax, bl
jmp 0x18001a3d0
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1800196d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800196cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a440
call fcn.1800dedc4
xor esi, esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rcx, [rbp + 0x50]
call fcn.18000c030
mov r12d, r13d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, r15
lea rdx, [0x1801556c0]
lea rcx, [rbp + 0xd0]
call fcn.180012720
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x18001976f
lea rsi, [rcx + 2]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x18001974f
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 4
lea rdx, [0x1801557e8]
call fcn.1800fe030
xor eax, eax
mov word [rdi + rsi*2], ax
xor esi, esi
jmp 0x18001978f
mov qword [rsp + 0x20], 2
lea r9, [0x1801557e8]
mov edx, 2
mov rcx, rbx
call fcn.18000cac0
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm7, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm7
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp + 0x60], xmm6
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x60], r13d
lea rcx, [rbp + 0x30]
call fcn.18000c030
movups xmmword [rbp + 0x30], xmm7
movups xmmword [rbp + 0x40], xmm6
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov eax, r13d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019836
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a446
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.180011440
nop
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x180019938
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1800198c8
lea rax, [rdi + rsi]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x30]
lea r8, [rdi + rdi]
lea rcx, [rbx + rsi*2]
mov rdx, r9
call fcn.1800fe030
lea rax, [rdi + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x1800198db
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.18000cac0
xor esi, esi
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019920
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180152f2c]
call fcn.1800fe030
mov word [rbx + rdi*2], si
jmp 0x180019938
mov qword [rsp + 0x20], r13
lea r9, [0x180152f2c]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cac0
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180019a3f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0xd0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2c7
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800199e2
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019a28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019a23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a44c
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.18000bd10
nop
lea rcx, [rbp + 0x10]
call fcn.180090790
lea r10, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r10, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp rax, 0x11
jb 0x180019ad2
lea r11, [rax - 0x10]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rbx, str.2345explorer.exe
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x180019ad2
cmp word [rcx], 0x5c
je 0x180019a9b
add rcx, 2
sub rax, 1
jmp 0x180019a89
test rcx, rcx
je 0x180019ad2
mov r8d, 0x11
mov rdx, rbx
mov r9, rcx
sub r9, rbx
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x180019acc
add rdx, 2
sub r8, 1
jne 0x180019ab0
sub rcx, r10
sar rcx, 1
jmp 0x180019ad9
add rcx, 2
jmp 0x180019a80
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x180019b9d
mov r8, qword [r14 + 0x10]
test r8, r8
jne 0x180019b82
mov r8, qword [rbp + 0x40]
mov rdi, r8
cmp r8, 1
jb 0x180019b6d
mov rbx, rsi
test r8, r8
je 0x180019b3b
cmp r8, rbx
jbe 0x18001a404
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
movzx edx, word [rax + rbx*2]
lea rcx, [0x180152f2c]
call fcn.1800fd940
mov r8, qword [rbp + 0x40]
test rax, rax
je 0x180019b3b
inc rbx
cmp rbx, rdi
jb 0x180019b03
test rbx, rbx
je 0x180019b6d
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
sub r8, rbx
mov qword [rbp + 0x40], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.1800fe030
lea rdx, [0x180152f2c]
lea rcx, [rbp + 0x30]
call fcn.180090600
jmp 0x180019c7c
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x180019b8f
mov rdx, qword [r14]
lea rcx, [rbp + 0x30]
call fcn.18000c360
jmp 0x180019c7c
cmp qword [r14 + 0x10], 0
je 0x180019c7c
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019bed
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801556c0]
call fcn.1800fe030
mov word [rbx + rdi*2], si
jmp 0x180019c05
mov qword [rsp + 0x20], r13
lea r9, [0x1801556c0]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cac0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x180019c12
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp + 0x30]
call fcn.18000c360
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019c64
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801556c0]
call fcn.1800fe030
mov word [rbx + rdi*2], si
jmp 0x180019c7c
mov qword [rsp + 0x20], r13
lea r9, [0x1801556c0]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cac0
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180019d1d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2e1
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180019d14
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x60]
call fcn.1800fe490
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], r13d
mov word [rbp - 0x20], r13w
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x180019d6e
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180019e13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
cmp qword [r14 + 0x18], 8
jb 0x180019dac
mov r14, qword [r14]
mov r9, r14
mov r8d, r12d
lea rdx, [0x180155810]
lea rcx, [rbp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2f2
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180019e08
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
jmp 0x180019e1a
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r14d, esi
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.18000bd10
nop
lea rcx, [rbp + 0xd0]
call fcn.180090790
lea r10, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae r10, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
cmp rax, 0xc
jb 0x180019ed2
lea r11, [rax - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rdi, str.iexplore.exe
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x180019ed2
cmp word [rcx], 0x69
je 0x180019e9b
add rcx, 2
sub rax, 1
jmp 0x180019e89
test rcx, rcx
je 0x180019ed2
mov r8d, 0xc
mov rdx, rdi
mov r9, rcx
sub r9, rdi
nop
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x180019ecc
add rdx, 2
sub r8, 1
jne 0x180019eb0
sub rcx, r10
sar rcx, 1
jmp 0x180019ed9
add rcx, 2
jmp 0x180019e80
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a1b7
call fcn.18001c630
lea rdx, [rbp - 0x70]
call fcn.18001c6e0
nop
lea rcx, [rsp + 0x70]
cmp rcx, rax
je 0x180019f05
mov rbx, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180019f16
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 4
lea rcx, [0x1801ab190]
test al, al
jne 0x180019fd6
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x180019fb5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0x1e
lea rdx, str.ShellExecuteLoadWeb:
lea rcx, [rbp + 0x50]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x2ff
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x180019fac
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
mov rcx, rbx
mov rbx, rsi
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a1b7
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
jmp 0x18001a1b7
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18001a058
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0xc
lea rdx, [0x1801558f0]
lea rcx, [rbp + 0x50]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x304
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18001a04f
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x18001a070
mov r15, qword [r15]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9b, 1
movzx r8d, r9b
mov rdx, r15
mov rcx, rbx
call qword [rax + 0x18]
mov r14d, eax
mov edx, 4
lea rcx, [0x1801ab190]
test eax, eax
jne 0x18001a126
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18001a1b7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.isDriverProtectOk___d_err___x
lea rcx, [rbp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x308
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r14 + 4]
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18001a121
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
jmp 0x18001a1ae
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x18001a1b7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r9, qword [rbp + 0x30]
mov r8d, r14d
lea rdx, str.isDriverProtectOk___d_cmd___ws
lea rcx, [rbp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x18001a1ae
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
cmp qword [rsp + 0x68], 0
je 0x18001a257
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001a1f7
cmp byte [rax], 0xe9
jne 0x18001a1f7
mov edx, 0x14
mov rcx, rax
call fcn.180128060
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x18001a29e
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test dil, dil
je 0x18001a2c4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x18001a2d4
mov edx, 0x2710
jmp 0x18001a2cb
test r14d, r14d
je 0x18001a2d4
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov esi, eax
xor r15d, r15d
test eax, eax
je 0x18001a366
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r15w
movzx r9d, dil
mov r8d, r14d
lea rdx, str.JumpToProtectMainPage___
lea rcx, [rbp + 0x50]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r15 + 4]
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp esi, 1
jbe 0x18001a35d
lea rdx, [rbp + 0x50]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x50]
call fcn.18000c030
test rbx, rbx
je 0x18001a38d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, r15
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a38d
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
nop
lea rcx, [rbp + 0xd0]
call fcn.18000c030
nop
test rbx, rbx
je 0x18001a3ac
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rbx
call qword [r8]
nop
lea rcx, [rbp + 0x10]
call fcn.18000c030
nop
lea rcx, [rbp + 0xb0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x30]
call fcn.18000c030
movzx eax, dil
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1800deda0
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800125b0
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3