Function at 0x140043a50
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverride___t_REG_DWORD__d_2__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
lea rdx, str.runas
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverrideMask___t_REG_DWORD__d_2__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__NetworkThrottlingIndex___t_REG_DWORD__d__4294967295___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__SystemResponsiveness___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__Background_Only___t_REG_SZ__d__True___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__Priority___t_REG_DWORD__d__6___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__Scheduling_Category___t_REG_SZ__d__Medium___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksAudio___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__Affinity___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__Background_Only___t_REG_SZ__d__True___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__Priority___t_REG_DWORD__d__5___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__Scheduling_Category___t_REG_SZ__d__Medium___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksCapture___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__Background_Only___t_REG_SZ__d__True___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__BackgroundPriority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__Priority___t_REG_DWORD__d__8___f
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__Scheduling_Category___t_REG_SZ__d__High___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDisplayPostProcessing___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__Background_Only___t_REG_SZ__d__True___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__Priority___t_REG_DWORD__d__4___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__Scheduling_Category___t_REG_SZ__d__Medium___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksDistribution___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__Background_Only___t_REG_SZ__d__False___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__BackgroundPriority___t_REG_DWORD__d__4___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__Priority___t_REG_DWORD__d__3___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__Scheduling_Category___t_REG_SZ__d__Medium___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPlayback___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__Background_Only___t_REG_SZ__d__False___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__Priority___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__Scheduling_Category___t_REG_SZ__d__High___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksPro_Audio___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__Affinity___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__Background_Only___t_REG_SZ__d__True___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__Clock_Rate___t_REG_DWORD__d__10000___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__GPU_Priority___t_REG_DWORD__d__8___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__Priority___t_REG_DWORD__d__5___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__Scheduling_Category___t_REG_SZ__d__Medium___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksWindow_Manager___v__SFIO_Priority___t_REG_SZ__d__Normal___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionDriverSearching___v__SearchOrderConfig___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerPower___v__HiberbootEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.reg_add__HKCUSystemGameConfigStore___v__Win32_AutoGameModeDefaultProfile___t_REG_BINARY__d__01000100000000000000000000000000000000000000000000000000000000000000000000000000___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKCUSystemGameConfigStore____v__Win32_GameModeRelatedProcesses____t_REG_BINARY___d__010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000____f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKCUSystemGameConfigStore___v__GameDVR_HonorUserFSEBehaviorMode___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKCUSystemGameConfigStore___v__GameDVR_DXGIHonorFSEWindowsCompatible___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d00943c8cb6_6f93_4227_ad87_e9a3feec08d1___v__Attributes___t_REG_DWORD__d__2___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings2a737441_1930_4402_8d77_b2bebba308a3d4e98f31_5ffe_4ce1_be31_1b38b384c009DefaultPowerSchemeValues381b4222_f694_41f0_9685_ff5bb260df2e___v__ACSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings2a737441_1930_4402_8d77_b2bebba308a3d4e98f31_5ffe_4ce1_be31_1b38b384c009DefaultPowerSchemeValues381b4222_f694_41f0_9685_ff5bb260df2e___v__DCSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings2a737441_1930_4402_8d77_b2bebba308a3d4e98f31_5ffe_4ce1_be31_1b38b384c009DefaultPowerSchemeValues8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c___v__ACSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d003b04d4fd_1cc7_4f23_ab1c_d1337819c4bbDefaultPowerSchemeValues381b4222_f694_41f0_9685_ff5bb260df2e___v__ACSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d003b04d4fd_1cc7_4f23_ab1c_d1337819c4bbDefaultPowerSchemeValues381b4222_f694_41f0_9685_ff5bb260df2e___v__DCSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d003b04d4fd_1cc7_4f23_ab1c_d1337819c4bbDefaultPowerSchemeValues8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c___v__ACSettingIndex___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKCUSoftwareMicrosoftWindowsDWM___v__Composition___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__LargeSystemCache___t_REG_DWORD__d__1___f
xor ecx, ecx
lea r8, str.cmd.exe
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__ClearPageFileAtShutdown___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePagingExecutive___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__NonPagedPoolQuota___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__NonPagedPoolSize___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PagedPoolQuota___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PagedPoolSize___t_REG_DWORD__d__192___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SecondLevelDataCache___t_REG_DWORD__d__1024___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SessionPoolSize___t_REG_DWORD__d__192___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SessionViewSize___t_REG_DWORD__d__192___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__SystemPages___t_REG_DWORD__d__4294967295___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PhysicalAddressExtension___t_REG_DWORD__d__1___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettings___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__PoolUsageMaximum___t_REG_DWORD__d__96___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnablePrefetcher___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnableSuperfetch___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePagingExecutive___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSystemCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePageCombining___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKLMSoftwareMicrosoftFTH___v__Enabled___t_Reg_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSystemCurrentControlSetControlSession_Manager___v__HeapDeCommitFreeBlockThreshold___t_REG_DWORD__d__262144___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.PowerShell__Command__Disable_MMAgent__PageCombining_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.PowerShell__Command__Disable_MMAgent__MemoryCompression_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.C:WindowsSystem32_fsutil.exe
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004495a
mov dword [rsp + 0x28], ebx
lea r9, str.fsutil_behavior_set_memoryusage_2
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_mftzone_2
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_disablelastaccess_1
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_encryptpagingfile_0
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_disable8dot3_1
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_disablecompression_1
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_disabledeletenotify_0
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_disablewriteautotiering_1
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.fsutil_behavior_set_quotanotify_5400
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Settings_applied_successfully.
jmp 0x140044968
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.fsutil.exe_not_found_in_System32_directory.
call fcn.14004eef0
lea rdx, [0x14004f0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
mov dword [rsp + 0x40], ebx
xor edx, edx
lea rcx, str.TotalVisibleMemorySize
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x1400449d3
mov ecx, edi
call fcn.1400bd9ac
mov r8d, edi
lea rcx, str.TotalVisibleMemorySize
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor edx, edx
mov r8d, 0xa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov rcx, rbx
mov dword [rsp + 0x40], eax
call fcn.1400bd908
add dword [rsp + 0x40], 0xfa000
lea rax, [rsp + 0x48]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140044a70
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.SvcHostSplitThresholdInKB
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140044a5a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_updating_registry_key.
call fcn.14004eef0
lea rdx, [0x14004f0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_opening_registry_key.
call fcn.14004eef0
lea rdx, [0x14004f0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
jmp 0x140043a50