Function at 0x180011360
Capabilities:
Encode data using xor
Hash data with crc32
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_domain_get
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_domain_get_assemblies
xor r13d, r13d
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x30], r13
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call rax
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_domain_get_assemblies
mov rdi, rax
mov qword [rbp + 0x48], rax
mov esi, r13d
mov dword [rbp + 0xc8], r13d
mov qword [rbp + 0xd0], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call rax
cmp qword [rbp + 0xd0], rsi
jbe 0x180011fa6
mov qword [rsp + 0x188], r12
mov ebx, r13d
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x178], r15
mov qword [rbp - 8], rbx
nop dword [rax + rax]
mov rax, qword [rdi + rbx*8]
lea rdx, str.il2cpp_image_get_class_count
mov rcx, qword [0x1802e0e30]
mov edi, r13d
mov dword [rbp + 0xc0], r13d
mov r12, qword [rax]
mov qword [rbp + 0x38], r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
call rax
test rax, rax
je 0x180011f26
nop word [rax + rax]
mov rdx, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x48], r13
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180011480
lea rcx, [rsp + 0x30]
call fcn.1800429a0
mov r15, qword [rsp + 0x48]
lea rbx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
cmp r15, 0xf
mov rsi, qword [rsp + 0x40]
cmova rbx, r14
cmp rsi, 4
jb 0x180011512
lea rdi, [rbx + rsi]
mov edx, 0x2e
lea r8, [rdi - 3]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x18001150c
nop word [rax + rax]
cmp dword [r9], 0x6c6c642e
je 0x180011679
inc r9
lea r8, [rdi - 3]
sub r8, r9
mov rcx, r9
mov edx, 0x2e
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1800114e0
mov edi, dword [rbp + 0xc0]
mov r9, 0xffffffffffffffff
cmp rsi, r9
jb 0x180011fb4
mov rax, rsi
lea rcx, [rsp + 0x30]
sub rax, r9
mov edx, 4
cmp rax, rdx
cmovb rdx, rax
cmp r15, 0xf
cmova rcx, r14
sub rsi, rdx
add rcx, r9
mov r8, rsi
sub r8, r9
add rdx, rcx
inc r8
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_image_get_class
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsxd rdx, edi
mov rcx, r12
call rax
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r8, 0xffffffffffffffff
mov r12, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
mov qword [rsp + 0x68], r13
nop
inc r8
cmp byte [rsi + r8], 0
jne 0x1800115a0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1800429a0
cmp qword [rsp + 0x60], 0
mov rdx, qword [rsp + 0x68]
sete bl
cmp rdx, 0xf
jbe 0x1800115fd
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800115f8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f87
call fcn.1800813bc
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
test bl, bl
je 0x1800117e8
mov rsi, qword [rsp + 0x40]
sub rax, rsi
cmp rax, 2
jb 0x180011fc0
cmp qword [rsp + 0x48], 0xf
lea r15, [rsp + 0x30]
lea r14, [rsi + 2]
mov qword [rbp - 0x40], r13
cmova r15, qword [rsp + 0x30]
lea rdi, [rbp - 0x50]
mov ebx, 0xf
mov qword [rbp - 0x38], r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
cmp r14, rbx
jbe 0x1800116e3
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x180011687
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x1800116b8
mov edi, dword [rbp + 0xc0]
sub r9, rbx
jmp 0x180011519
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1800116a2
mov rdi, r13
jmp 0x1800116df
cmp rcx, 0x1000
jb 0x1800116d7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011fba
mov rcx, rax
call fcn.180081380
test rax, rax
je 0x180011f72
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800116df
call fcn.180081380
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov r8, rsi
mov qword [rbp - 0x40], r14
mov rdx, r15
mov qword [rbp - 0x38], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x3a3a
mov r8, 0xffffffffffffffff
mov byte [rdi + r14], 0
nop dword [rax + rax]
inc r8
cmp byte [r12 + r8], 0
jne 0x180011710
mov rdx, r12
lea rcx, [rbp - 0x50]
call fcn.180040800
xor r12d, r12d
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmmword [rsp + 0x70], xmm1
cmp rdx, 0xf
jbe 0x18001178e
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011780
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f72
call fcn.1800813bc
movups xmm0, xmmword [rbp]
movups xmm1, xmmword [rsp + 0x70]
mov rdx, qword [rbp - 0x38]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
cmp rdx, 0xf
jbe 0x1800117d3
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800117ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f72
call fcn.1800813bc
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
jmp 0x180011b04
mov r14, qword [rsp + 0x40]
sub rax, r14
cmp rax, 2
jb 0x180011fde
cmp qword [rsp + 0x48], 0xf
lea r13, [rsp + 0x30]
lea r15, [r14 + 2]
mov ebx, 0xf
cmova r13, qword [rsp + 0x30]
lea rdi, [rbp - 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x30], xmm0
cmp r15, rbx
jbe 0x1800118a4
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x18001184d
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
jmp 0x180011879
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x18001189d
cmp rcx, 0x1000
jb 0x180011898
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011fc6
mov rcx, rax
call fcn.180081380
test rax, rax
je 0x180011f79
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800118a0
call fcn.180081380
mov rdi, rax
mov qword [rbp - 0x30], rdi
mov r8, r14
mov qword [rbp - 0x20], r15
mov rdx, r13
mov qword [rbp - 0x18], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r13d, 0x3a3a
mov r8, 0xffffffffffffffff
mov word [rdi + r14], r13w
mov byte [rdi + r15], 0
inc r8
cmp byte [rsi + r8], 0
jne 0x1800118d1
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.180040800
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x18001194d
lea rax, [rcx + 2]
cmp rdx, 0xf
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
cmova rax, qword [rbp - 0x70]
mov word [rax + rcx], r13w
mov byte [rax + rcx + 2], bl
lea rax, [rbp - 0x70]
jmp 0x18001196b
lea r9, [0x18026dad4]
mov qword [rsp + 0x20], 2
mov edx, 2
lea rcx, [rbp - 0x70]
call fcn.180042810
mov qword [rbp + 0x20], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x28], rbx
mov r8, 0xffffffffffffffff
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
nop
inc r8
cmp byte [r12 + r8], bl
jne 0x1800119a0
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.180040800
xor r12d, r12d
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x48]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp], xmm1
cmp rdx, 0xf
jbe 0x180011a1c
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011a0e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f79
call fcn.1800813bc
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp]
mov rdx, qword [rbp + 0x28]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
cmp rdx, 0xf
jbe 0x180011a61
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011a5c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f79
call fcn.1800813bc
mov rdx, qword [rbp - 0x58]
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], bl
cmp rdx, 0xf
jbe 0x180011aab
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011aa6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f79
call fcn.1800813bc
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], bl
cmp rdx, 0xf
jbe 0x180011af5
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011af0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f79
call fcn.1800813bc
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_class_get_fields
mov qword [rbp + 0xd8], r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0xd8]
call rax
mov r13, rax
test rax, rax
je 0x180011e8f
nop dword [rax + rax]
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_field_get_name
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
call rax
mov r15, qword [rsp + 0x40]
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
mov rsi, rax
sub rcx, r15
cmp rcx, 2
jb 0x180011fd8
cmp qword [rsp + 0x48], 0xf
lea r12, [rsp + 0x30]
lea r14, [r15 + 2]
mov ebx, 0xf
cmova r12, qword [rsp + 0x30]
lea rdi, [rsp + 0x50]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x50], xmm0
cmp r14, rbx
jbe 0x180011c2a
mov rbx, r14
or rbx, 0xf
cmp rbx, rdx
jbe 0x180011bd2
movabs rax, 0x8000000000000000
mov rbx, rdx
add rax, 0x27
jmp 0x180011bfe
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x180011c22
cmp rcx, 0x1000
jb 0x180011c1d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180011fcc
mov rcx, rax
call fcn.180081380
test rax, rax
je 0x180011f80
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180011c25
call fcn.180081380
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov r8, r15
mov qword [rsp + 0x60], r14
mov rdx, r12
mov qword [rsp + 0x68], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + r15], 0x3a3a
mov r8, 0xffffffffffffffff
mov byte [rdi + r14], 0
inc r8
cmp byte [rsi + r8], 0
jne 0x180011c55
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.180040800
xor r12d, r12d
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x68]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x60], xmm0
cmp rdx, 0xf
jbe 0x180011cd3
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011cce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f80
call fcn.1800813bc
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_field_get_offset
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r12b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r13
call rax
movups xmm0, xmmword [rbp]
mov rsi, qword [rsp + 0x70]
lea rdx, [rbp + 0x50]
mov r15d, eax
mov rcx, 0xffffffffffffffff
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova rdx, rsi
nop dword [rax + rax]
inc rcx
cmp byte [rdx + rcx], r12b
jne 0x180011d30
cmp r14, 0xf
lea rdx, [rbp + 0x50]
mov ebx, 0xffffffff
cmova rdx, rsi
test ecx, ecx
je 0x180011d7f
mov r8d, ecx
lea r12, [0x180244010]
nop dword [rax + rax]
movsx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [r12 + rax*4]
sub r8, 1
jne 0x180011d60
xor r12d, r12d
mov rdi, qword [0x1802e0ea0]
not ebx
mov dword [rsp + 0x78], r12d
mov rcx, rdi
mov rax, qword [rdi + 8]
mov qword [rsp + 0x70], rax
cmp byte [rax + 0x19], 0
jne 0x180011dc9
nop
mov qword [rsp + 0x70], rax
cmp dword [rax + 0x20], ebx
jae 0x180011db5
mov rax, qword [rax + 0x10]
mov dword [rsp + 0x78], r12d
jmp 0x180011dc3
mov rcx, rax
mov dword [rsp + 0x78], 1
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180011da0
cmp byte [rcx + 0x19], 0
jne 0x180011dd4
cmp ebx, dword [rcx + 0x20]
jae 0x180011e2b
movabs rax, 0x555555555555555
cmp qword [0x1802e0ea8], rax
je 0x180011fd2
mov ecx, 0x30
call fcn.180081380
movups xmm0, xmmword [rsp + 0x70]
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [0x1802e0ea0]
mov dword [rax + 0x20], ebx
mov qword [rax + 0x28], r15
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
movaps xmmword [rsp + 0x70], xmm0
call fcn.180042df0
cmp r14, 0xf
jbe 0x180011e62
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180011e5a
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f87
mov rcx, rsi
call fcn.1800813bc
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_class_get_fields
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0xd8]
call rax
mov r13, rax
test rax, rax
jne 0x180011b40
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180011ecc
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011ec7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011f87
call fcn.1800813bc
mov edi, dword [rbp + 0xc0]
lea rdx, str.il2cpp_image_get_class_count
mov rcx, qword [0x1802e0e30]
inc edi
mov dword [rbp + 0xc0], edi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, qword [rbp + 0x38]
mov rcx, r12
call rax
movsxd rcx, edi
mov r13d, 0
cmp rcx, rax
jb 0x180011460
mov rbx, qword [rbp - 8]
mov esi, dword [rbp + 0xc8]
mov rcx, qword [0x1802e0e30]
lea rdx, str.il2cpp_domain_get_assemblies
inc esi
mov qword [rbp + 0xd0], r13
inc rbx
mov dword [rbp + 0xc8], esi
mov qword [rbp - 8], rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp + 0xd0]
call rax
movsxd rax, esi
cmp rax, qword [rbp + 0xd0]
jae 0x180011f8e
mov rdi, qword [rbp + 0x48]
jmp 0x180011420
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14, qword [rsp + 0x180]
mov r12, qword [rsp + 0x188]
mov r15, qword [rsp + 0x178]
add rsp, 0x190
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800414f0
int3
call fcn.180003ff0
int3
call fcn.18000b150
int3
call fcn.180003ff0
int3
call fcn.180003ff0
int3
call fcn.18000be20
int3
call fcn.18000b150
int3
call fcn.18000b150
int3