Function at 0x14035b630
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x58], rcx
mov rax, qword [0x140b74de8]
xor rax, rbp
mov qword [rbp + 0x30], rax
mov eax, dword [0x140b7e8d0]
mov ecx, dword [0x140b7e8d4]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x2f]
cmp ecx, 0xa
setl byte [rbp + 0x2e]
mov eax, 0x9b6e38be
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14035b6dd
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov r9, qword [rbp + 0x18]
sub rsp, 0x20
mov ecx, ntohs
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp - 0x24], eax
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x83c4fb40
mov ecx, 0xe835953a
nop dword [rax]
cmove eax, ecx
cmp dword [0x140b7e8d4], 0xa
cmovl eax, ecx
cmp eax, 0xfb67a603
jle 0x14035b740
cmp eax, 0x3c5d8191
jle 0x14035b7a0
cmp eax, 0x567131ab
jg 0x14035b848
cmp eax, 0x48559e1d
jle 0x14035b9a8
cmp eax, 0x4e632554
jle 0x14035bbba
cmp eax, 0x4e632555
je 0x14035be77
cmp eax, 0x5072d3f1
je 0x14035be81
cmp eax, 0x53fad701
je 0x14035be6b
jmp 0x14035b6dd
cmp eax, 0xbaf6f731
jg 0x14035b7f0
cmp eax, 0x9b6e38bd
jg 0x14035b8a7
cmp eax, 0x8aadc549
jle 0x14035b9f0
cmp eax, 0x915ea897
jle 0x14035bbe5
cmp eax, 0x915ea898
je 0x14035be6b
cmp eax, 0x949d97a0
je 0x14035bea8
cmp eax, 0x9a7ff902
jne 0x14035b6dd
mov eax, 0xd39a3112
jmp 0x14035b6dd
cmp eax, 0xe0fc4b3
jle 0x14035b8e1
cmp eax, 0x25059bbd
jle 0x14035ba40
cmp eax, 0x2fc25f2d
jle 0x14035bc1b
cmp eax, 0x2fc25f2e
je 0x14035beb2
cmp eax, 0x35010059
je 0x14035bec0
cmp eax, 0x3afdfe08
jne 0x14035b6dd
mov eax, 0xa5d8ece
jmp 0x14035b6dd
cmp eax, 0xdaed54c1
jle 0x14035b92b
cmp eax, 0xe9ba4593
jle 0x14035ba97
cmp eax, 0xeba44a45
jle 0x14035bc3e
cmp eax, 0xeba44a46
je 0x14035beca
cmp eax, 0xf4254069
je 0x14035bee0
cmp eax, 0xf7b85ec1
jne 0x14035b6dd
cmp byte [rbp + 0x2a], 0
mov eax, 0x915ea898
mov ecx, 0xcc2d420a
cmovne eax, ecx
jmp 0x14035b6dd
cmp eax, 0x5f5c49d9
jle 0x14035bacc
cmp eax, 0x77ef477c
jle 0x14035bc72
cmp eax, 0x77ef477d
je 0x14035bf0c
cmp eax, 0x7a05457b
je 0x14035bf2a
cmp eax, 0x7da9c287
jne 0x14035b6dd
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x20], rax
mov eax, dword [rbp + 4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cmp eax, 0xc0000004
mov eax, 0x87f7152f
mov ecx, 0xba650e3
cmove eax, ecx
jmp 0x14035b6dd
cmp eax, 0xa251bb6d
jle 0x14035baf7
cmp eax, 0xb6b532ed
jg 0x14035bcb2
cmp eax, 0xa251bb6e
je 0x14035bf40
cmp eax, 0xaef33597
jne 0x14035c3bc
mov rax, qword [rbp + 0x20]
mov eax, 0x3dde8c56
jmp 0x14035b6dd
cmp eax, 0xa5d8ecd
jg 0x14035bb36
cmp eax, 0x6bb99c6
jg 0x14035bcef
cmp eax, 0xfb67a604
je 0x14035bf5e
cmp eax, 0xfc41ff99
jne 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x567131ac
mov ecx, 0x6bb99c7
jmp 0x14035b6d0
cmp eax, 0xcc2d4209
jg 0x14035bb8b
cmp eax, 0xbfe07b70
jg 0x14035bd0f
cmp eax, 0xbaf6f732
je 0x14035bf7c
cmp eax, 0xbe281cf9
jne 0x14035b6dd
mov rdx, qword [rbp - 0x78]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov r8d, dword [rax]
mov r9, qword [rbp + 0x18]
sub rsp, 0x20
mov ecx, ntohs
mov qword [rbp - 0x30], rdx
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp + 4], eax
mov eax, 0x7da9c287
jmp 0x14035b6dd
cmp eax, 0x46d9861c
jg 0x14035bd43
cmp eax, 0x3c5d8192
je 0x14035bf9a
cmp eax, 0x3dde8c56
jne 0x14035b6dd
cmp qword [rbp + 0x20], 0
setne byte [rbp + 0x2d]
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaef33597
mov ecx, 0x9a7ff902
jmp 0x14035b6d0
cmp eax, 0x87b7c5d0
jg 0x14035bd63
cmp eax, 0x81ae99a1
je 0x14035bfb0
cmp eax, 0x83c4fb40
jne 0x14035b6dd
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov r9, qword [rbp + 0x18]
sub rsp, 0x20
mov ecx, ntohs
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov eax, 0x87b7c5d1
jmp 0x14035b6dd
cmp eax, 0x1492ccb5
jg 0x14035bd8b
cmp eax, 0xe0fc4b4
je 0x14035bffe
cmp eax, 0xf6fcaa9
jne 0x14035b6dd
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.14029aff0
add rsp, 0x20
mov rax, qword [rbp - 0x40]
test r13d, r13d
mov eax, 0x8aadc54a
mov ecx, 0x5cdd8435
cmove eax, ecx
mov r14, qword [rbp - 0x50]
mov dword [rbp], r13d
jmp 0x14035b6dd
cmp eax, 0xe7833faf
jg 0x14035bdab
cmp eax, 0xdaed54c2
je 0x14035c01e
cmp eax, 0xe2de7bd2
jne 0x14035b6dd
mov eax, 0xf6fcaa9
mov r13d, 1
mov rbx, qword [rbp - 0x80]
jmp 0x14035b6dd
cmp eax, 0x5a915646
jg 0x14035bdcb
cmp eax, 0x567131ac
je 0x14035c040
cmp eax, 0x59750f02
jne 0x14035b6dd
mov eax, 0x2c6d6e6b
jmp 0x14035b6dd
cmp eax, 0x9f5ba7d5
jg 0x14035bdf4
cmp eax, 0x9b6e38be
je 0x14035c04e
cmp eax, 0x9d26f8fd
jne 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5a915647
mov ecx, 0xd711a144
jmp 0x14035b6d0
cmp eax, 0xba650e2
jg 0x14035be17
cmp eax, 0xa5d8ece
je 0x14035c06c
cmp eax, 0xb2ac724
jne 0x14035b6dd
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8c6d378d
mov ecx, 0x3afdfe08
jmp 0x14035b6d0
cmp eax, 0xd39a3111
jg 0x14035be37
cmp eax, 0xcc2d420a
je 0x14035c076
cmp eax, 0xce351f98
jne 0x14035b6dd
mov rax, qword [rbp + 8]
mov eax, 0x67109c49
jmp 0x14035b6dd
cmp eax, 0x48559e1e
je 0x14035c094
cmp eax, 0x4c0dc4b6
jne 0x14035b6dd
mov eax, 0x8aadc54a
mov dword [rbp], 4
mov r14, qword [rbp - 0x48]
jmp 0x14035b6dd
cmp eax, 0x8aadc54a
je 0x14035c0a5
cmp eax, 0x8c6d378d
jne 0x14035b6dd
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0xb2ac724
jmp 0x14035b6dd
cmp eax, 0x25059bbe
je 0x14035c0be
cmp eax, 0x2c6d6e6b
jne 0x14035b6dd
mov eax, 0x5072d3f1
xor r12d, r12d
jmp 0x14035b6dd
cmp eax, 0xe9ba4594
je 0x14035c0d4
cmp eax, 0xeb022206
jne 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x46eb73e3
mov ecx, 0x59750f02
jmp 0x14035b6d0
cmp eax, 0x5f5c49da
je 0x14035c0ea
cmp eax, 0x67109c49
jne 0x14035b6dd
mov rax, qword [rbp + 8]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce351f98
mov ecx, 0xcea5fc5
jmp 0x14035b6d0
cmp eax, 0xb6b532ee
je 0x14035c0fe
cmp eax, 0xba5ab10f
jne 0x14035b6dd
cmp qword [rbp - 0x10], 0
setne byte [rbp + 0x2a]
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2fc25f2e
mov ecx, 0xf7b85ec1
jmp 0x14035b6d0
cmp eax, 0x6bb99c7
je 0x14035c108
cmp eax, 0xa10b23e
jne 0x14035b6dd
mov eax, 0xc0caaaba
jmp 0x14035b6dd
cmp eax, 0xbfe07b71
je 0x14035c12f
cmp eax, 0xc0caaaba
jne 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa10b23e
mov ecx, 0x7a05457b
jmp 0x14035b6d0
cmp eax, 0x46d9861d
je 0x14035c14f
cmp eax, 0x46eb73e3
jne 0x14035b6dd
mov eax, 0xeb022206
jmp 0x14035b6dd
cmp eax, 0x87b7c5d1
je 0x14035b68b
cmp eax, 0x87f7152f
jne 0x14035b6dd
cmp dword [rbp - 4], 0
setns byte [rbp + 0x2c]
mov eax, 0x3c5d8192
jmp 0x14035b6dd
cmp eax, 0x1492ccb6
je 0x14035c161
cmp eax, 0x189fd484
jne 0x14035b6dd
mov eax, 0xe7833fb0
jmp 0x14035b6dd
cmp eax, 0xe7833fb0
je 0x14035c17f
cmp eax, 0xe835953a
jne 0x14035b6dd
mov eax, 0x9d26f8fd
jmp 0x14035b6dd
cmp eax, 0x5a915647
je 0x14035c18c
cmp eax, 0x5cdd8435
jne 0x14035b6dd
mov eax, dword [rbp + 0x14]
add eax, 1
mov dword [rbp - 0x28], eax
mov eax, 0x25059bbe
jmp 0x14035b6dd
cmp eax, 0x9f5ba7d6
je 0x14035c196
cmp eax, 0xa22c95ce
jne 0x14035b6dd
mov eax, 0xac0f23ad
mov r15, rdi
jmp 0x14035b6dd
cmp eax, 0xba650e3
je 0x14035c276
cmp eax, 0xcea5fc5
jne 0x14035b6dd
mov eax, 0x9f5ba7d6
jmp 0x14035b6dd
cmp eax, 0xd39a3112
je 0x14035c294
cmp eax, 0xd711a144
jne 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5a915647
mov ecx, 0xeba44a46
jmp 0x14035b6d0
mov eax, 0xa22c95ce
xor edi, edi
jmp 0x14035b6dd
mov eax, 0xe9ba4594
jmp 0x14035b6dd
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x48], rax
mov dword [rbp + 0x14], r12d
mov rax, qword [rbp - 0x10]
mov ecx, dword [rbp + 0x14]
cmp ecx, dword [rax]
mov eax, 0x4c0dc4b6
mov ecx, 0xfb67a604
cmovb eax, ecx
jmp 0x14035b6dd
mov eax, 0x81ae99a1
jmp 0x14035b6dd
mov rax, qword [rbp - 0x10]
mov eax, 0xba5ab10f
jmp 0x14035b6dd
mov eax, 0xdaed54c2
jmp 0x14035b6dd
mov eax, 0x7da9c287
mov ecx, dword [rbp - 0x24]
mov dword [rbp + 4], ecx
xor ecx, ecx
mov qword [rbp - 0x30], rcx
jmp 0x14035b6dd
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0xe2de7bd2
jmp 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2fc25f2e
mov ecx, 0xba5ab10f
jmp 0x14035b6d0
cmp byte [rbp + 0x2d], 0
mov eax, 0x5f5c49da
mov ecx, 0xa251bb6e
cmovne eax, ecx
jmp 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8c6d378d
mov ecx, 0xb2ac724
jmp 0x14035b6d0
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce351f98
mov ecx, 0x67109c49
jmp 0x14035b6d0
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb6b532ee
mov ecx, 0x1492ccb6
jmp 0x14035b6d0
cmp byte [rbp + 0x2c], 0
mov eax, 0xfc41ff99
mov ecx, 0x46d9861d
cmovne eax, ecx
jmp 0x14035b6dd
mov eax, reloc.WS2_32.dll_recv
call fcn.1406ad960
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x18], rax
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1406ad960
sub rsp, rax
mov rax, rsp
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x38], rax
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x949d97a0
mov ecx, 0x35010059
jmp 0x14035b6d0
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0x189fd484
jmp 0x14035b6dd
mov rax, qword [rbp - 0x38]
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x83c4fb40
mov ecx, 0x87b7c5d1
jmp 0x14035b6d0
mov rax, qword [rbp + 0x20]
mov eax, 0x6bb99c7
jmp 0x14035b6dd
mov cl, byte [rbp + 0x2f]
cmp byte [rbp + 0x2e], 0
mov eax, 0x949d97a0
mov edx, 0x81ae99a1
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14035b6dd
mov eax, 0x5f5c49da
jmp 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x46eb73e3
mov ecx, 0xeb022206
jmp 0x14035b6d0
mov eax, 0xf6fcaa9
xor r13d, r13d
mov rbx, qword [rbp - 0x48]
jmp 0x14035b6dd
cmp dword [rbp], 4
mov eax, 0xa22c95ce
mov ecx, 0xbfe07b71
cmove eax, ecx
mov rdi, r14
jmp 0x14035b6dd
mov r12d, dword [rbp - 0x28]
mov eax, 0x5072d3f1
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x60], rcx
jmp 0x14035b6dd
cmp byte [rbp + 0x2b], 0
mov eax, 0xe7833fb0
mov ecx, 0xe0fc4b4
cmovne eax, ecx
jmp 0x14035b6dd
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov qword [rbp - 0x78], rax
mov eax, 0xbe281cf9
jmp 0x14035b6dd
mov eax, 0x1492ccb6
jmp 0x14035b6dd
cmp qword [rbp + 0x20], 0
setne byte [rbp + 0x2b]
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x567131ac
mov ecx, 0x4e632555
jmp 0x14035b6d0
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0xbaf6f732
jmp 0x14035b6dd
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x10], rax
mov eax, 0x77ef477d
jmp 0x14035b6dd
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb6b532ee
mov ecx, 0x53fad701
jmp 0x14035b6d0
mov eax, 0xac0f23ad
xor r15d, r15d
jmp 0x14035b6dd
mov eax, 0xd711a144
jmp 0x14035b6dd
mov rax, qword [rbp - 0x10]
mov ecx, dword [rbp + 0x14]
imul rcx, rcx, 0x128
add rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x18]
movzx ecx, word [rcx + 0x26]
lea rdx, [rax + rcx]
add rdx, 0x28
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.14028dbd0
add rsp, 0x20
mov eax, dword [0x140b7de20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140b7de24], 0xa
setl cl
or cl, al
mov eax, 0xc58852c7
mov ecx, 0x135c0437
cmovne eax, ecx
mov ecx, 0xc58852c7
mov edx, 0x9c499287
cmovne ecx, edx
mov edx, 0xe322d0d3
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp edx, 0xe322d0d2
jle 0x14035c250
cmp edx, 0xe322d0d3
je 0x14035c267
cmp edx, 0x135c0437
je 0x14035c26b
cmp edx, 0x15ec88c6
jne 0x14035c220
jmp 0x14035c2b2
cmp edx, 0x9c499287
je 0x14035c272
cmp edx, 0xc58852c7
jne 0x14035c220
mov edx, 0x9c499287
jmp 0x14035c220
mov edx, ecx
jmp 0x14035c220
mov edx, 0x15ec88c6
jmp 0x14035c220
mov edx, eax
jmp 0x14035c220
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaef33597
mov ecx, 0x3dde8c56
jmp 0x14035b6d0
mov eax, dword [0x140b7e8d0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa10b23e
mov ecx, 0xc0caaaba
jmp 0x14035b6d0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x70], rdi
mov r14d, r12d
mov r12d, r13d
mov r13, rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x20], rax
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.14028f8b0
add rsp, 0x20
mov rdi, rax
mov rax, qword [rbp + 8]
mov ecx, dword [0x140b7de20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140b7de24], 0xa
setl dl
or dl, cl
mov esi, 0xc58852c7
mov ecx, 0x135c0437
cmovne esi, ecx
mov edx, 0xc58852c7
mov ecx, 0x9c499287
cmovne edx, ecx
mov ecx, 0xe322d0d3
cmp ecx, 0xe322d0d2
jle 0x14035c350
cmp ecx, 0xe322d0d3
je 0x14035c367
cmp ecx, 0x135c0437
je 0x14035c36b
cmp ecx, 0x15ec88c6
jne 0x14035c320
jmp 0x14035c376
cmp ecx, 0x9c499287
je 0x14035c372
cmp ecx, 0xc58852c7
jne 0x14035c320
mov ecx, 0x9c499287
jmp 0x14035c320
mov ecx, edx
jmp 0x14035c320
mov ecx, 0x15ec88c6
jmp 0x14035c320
mov ecx, esi
jmp 0x14035c320
mov qword [rbp - 0x20], rax
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.14028f8b0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add rsp, 0x20
test eax, eax
mov eax, 0x48559e1e
mov ecx, 0xf4254069
cmove eax, ecx
mov rsi, r13
mov r13d, r12d
mov r12d, r14d
mov rdi, qword [rbp - 0x70]
mov r14, qword [rbp - 0x68]
jmp 0x14035b6dd
cmp eax, 0xac0f23ad
jne 0x14035b6dd
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp + 0x30]
xor rcx, rbp
sub rsp, 0x20
call fcn.1406ad9c0
add rsp, 0x20
mov rax, r15
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret