Function at 0x140034430
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
xor esi, esi
mov dword [rbp + 0x180], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [str.die.exe]
mov dword [rbp + 0x20], eax
movzx eax, word [0x1400c888c]
mov word [rbp + 0x24], ax
movzx eax, byte [0x1400c888e]
mov byte [rbp + 0x26], al
mov byte [rbp + 0x27], sil
mov ebx, 1
mov dword [rbp + 0x180], ebx
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033b3a
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033b2d
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033b00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], reloc.WS2_32.dll_select
mov qword [rbp - 8], Ordinal_32
movups xmm0, xmmword [str.KsDumperClient.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400c88a0]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
mov ebx, 3
mov dword [rbp + 0x180], ebx
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033bfa
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033bed
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033bc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], reloc.WS2_32.dll_select
mov qword [rbp - 0x28], Ordinal_32
movups xmm0, xmmword [str.HTTPDebuggerUI.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400c88b8]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
mov ebx, 7
mov dword [rbp + 0x180], ebx
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033cba
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033cad
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033c80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], reloc.WS2_32.dll_send
mov qword [rbp - 0x48], Ordinal_32
movups xmm0, xmmword [str.HTTPDebuggerSvc.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400c88d0]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400c88d2]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov ebx, reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033d79
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033d6c
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], rbx
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033d40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 9
mov qword [rbp - 0x68], rbx
movsd xmm0, qword [str.dnSpy.exe]
movsd qword [rbp - 0x80], xmm0
movzx eax, byte [0x1400c88e0]
mov byte [rbp - 0x78], al
mov byte [rbp - 0x77], 0
mov ebx, Ordinal_32
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033e1a
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033e0d
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033de0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 9
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.dnspy.exe]
movsd qword [rsp + 0x60], xmm0
movzx eax, byte [0x1400c88f0]
mov byte [rsp + 0x68], al
mov byte [rsp + 0x69], 0
mov ebx, 0x3f
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033ec0
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033eb3
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033e83
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 9
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.pepsi.exe]
movsd qword [rsp + 0x40], xmm0
movzx eax, byte [0x1400c8900]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0
mov ebx, 0x7f
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033f6d
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140033f60
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033f30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [str.pd.exe]
mov dword [rsp + 0x20], eax
movzx eax, word [0x1400c8908]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], 0
mov ebx, 0xff
mov dword [rbp + 0x180], ebx
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003401d
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140034010
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140033fe0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 8], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp], rax
mov qword [rbp + reloc.WS2_32.dll_recv], 0x10
mov qword [rbp + 0x18], Ordinal_32
movups xmm0, xmmword [str.pepsi_dumper.exe]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov ebx, 0x1ff
mov dword [rbp + 0x40], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140034089
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1400340e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
bt ebx, 8
jae 0x140034131
btr ebx, 8
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140034121
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003411c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003411c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rdi
test eax, eax
je 0x14003410e
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14003407c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
jmp 0x14003408c
call fcn.1400ac500
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
test bl, bl
jns 0x14003418c
btr ebx, 7
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140034179
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034174
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
test bl, 0x40
je 0x1400341e7
and ebx, 0xffffffbf
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400341d4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400341cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400341cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
test bl, 0x20
je 0x140034242
and ebx, 0xffffffdf
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14003422f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003422a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003422a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
test bl, 0x10
je 0x140034298
and ebx, 0xffffffef
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140034288
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034283
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
test bl, 8
je 0x1400342ee
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400342de
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400342d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400342d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
test bl, 4
je 0x140034344
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140034334
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003432f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003432f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
test bl, 2
je 0x14003439a
and ebx, 0xfffffffd
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14003438a
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
test bl, 1
je 0x1400343dd
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400343dd
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400343d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400343d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac500
test dil, dil
je 0x140034411
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140033830
call fcn.140033780
call fcn.140033720
call fcn.1400338d0
call fcn.1400338d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
lea rax, str..KsDumper
xor edi, edi
mov qword [rsp + 0x50], rax
mov ebx, edi
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140034564
inc rbx
cmp rbx, 1
jl 0x140034450
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400344db
lea rdx, str.DbgBreakPoint
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400344db
lea r9, [rsp + 0x50]
mov edx, 1
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400344db
mov byte [rbx], 0xc3
lea rdx, str.IDA:_Quick_start
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140034564
mov rbx, qword [rsp + 0x48]
mov byte [rsp + 0x50], 0x90
cmp byte [rbx], 0xcc
jne 0x140034555
lea r9, [rsp + 0x58]
mov edx, 1
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140034555
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp 0x140033a60
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3