Function at 0x1800182f0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1800e3a10
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x12c0], rbx
movaps xmmword [rsp + 0x1270], xmm6
movaps xmmword [rsp + 0x1260], xmm7
mov rax, qword [0x1801a8080]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r14, r8
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x60], esi
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
cmp qword [0x1801b0198], rsi
je 0x180018465
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], sil
je 0x180018465
cmp dword [rax + 0x80], 4
jb 0x180018465
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1800183b9
mov r9, qword [r14]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x1800183c6
mov r8, qword [r15]
lea rdx, str.iePathName
lea rcx, [rbp + 0x10]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x26d
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x180018414
lea rdx, [rbp + 0x10]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180018454
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001844f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019bfa
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
lea rdi, [r15 + 0x10]
cmp qword [rdi], 0
jne 0x180018476
xor al, al
jmp 0x180019bc0
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180018483
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
jne 0x18001849e
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x18001849e
mov rbx, qword [r15]
lea rdx, [0x180157d50]
mov rcx, rbx
call fcn.180104c68
mov r13d, 1
test eax, eax
je 0x18001850b
lea rdx, [0x180157d30]
mov rcx, rbx
call fcn.180104c68
test eax, eax
je 0x18001850b
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.180104c68
test eax, eax
je 0x18001850b
lea rdx, [0x180157db0]
mov rcx, rbx
call fcn.180104c68
test eax, eax
je 0x18001850b
lea rdx, str.360chromeX.exe
mov rcx, rbx
call fcn.180104c68
test eax, eax
je 0x18001850b
mov r12d, esi
jmp 0x180018ee6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movdqu xmmword [rbp + 0xa0], xmm0
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], si
mov r8d, 0xe
lea rdx, str.2345SafeCenter
lea rcx, [rbp + 0x90]
call fcn.18000c0b0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call fcn.18000c0b0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1800185c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800185be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c00
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.180038450
nop
cmp qword [rbp + 0x80], 0
jne 0x180018695
lea rcx, [rbp + 0xd0]
call fcn.18001fcc0
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180018638
lea rcx, [rbp + 0x70]
call fcn.18000c040
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001867e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c06
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
mov r8d, 0x12
lea rdx, str.2345SFWebShell.exe
lea rcx, [rbp + 0xd0]
call fcn.18000c0b0
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.18009fbd0
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x18001871b
lea rcx, [rbp + 0x70]
call fcn.18000c040
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18001875b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c0c
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x1800187b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800187ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c12
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
cmp qword [0x1801b0198], 0
je 0x1800188d1
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], 0
je 0x1800188d1
cmp dword [rax + 0x80], 4
jb 0x1800188d1
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str.mid_fpath___ws
lea rcx, [rbp + 0x10]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x27f
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x180018880
lea rdx, [rbp + 0x10]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800188c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800188bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c18
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
xor sil, sil
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.1801023f0
xor edx, edx
mov r8d, 0x804
lea rcx, [rbp + 0x940]
call fcn.1801023f0
lea rdx, [rbp + 0x140]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x140]
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180018a11
xor edx, edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180018a11
lea r8, [rbp + 0x140]
mov edx, 0x402
lea rcx, [rbp + 0x940]
call fcn.180107f60
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xd0]
call fcn.1801023f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._d.exe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180018a11
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800189f3
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x70]
call fcn.18000c0b0
mov sil, 1
lea rcx, [rbp + 0x70]
call fcn.180096010
test al, al
je 0x180018e7f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm1
xor r12d, r12d
mov word [rbp + 0x10], r12w
mov r13d, 1
mov r8d, r13d
lea rdx, [0x180159520]
lea rcx, [rbp + 0x10]
call fcn.18000c0b0
nop
cmp qword [r15 + 0x18], 8
jb 0x180018a63
mov r15, qword [r15]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180018aa5
lea rdi, [rdx + rcx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r15
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180018ab6
mov qword [rsp + 0x20], rdx
mov r9, r15
lea rcx, [rbp + 0x10]
call fcn.18000cad0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180018afc
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180159618]
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180018b14
mov qword [rsp + 0x20], r13
lea r9, [0x180159618]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000cad0
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180018b21
mov r9, qword [r14]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180018b64
lea rdi, [rcx + rdx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180018b72
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x10]
call fcn.18000cad0
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x28]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x180018bb8
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r9, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180159520]
call fcn.180101f90
mov word [rbx + rdi*2], r12w
jmp 0x180018bd0
mov qword [rsp + 0x20], r13
lea r9, [0x180159520]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000cad0
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180018d25
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], r12w
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str._vz_:N
lea rcx, [rbp + 0xd0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2a2
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180018cc7
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180018d0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018d08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c1e
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r12w
test sil, sil
je 0x180018dbb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180018dbb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor edx, edx
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rbp + 0xd8], 3
mov dword [rbp + 0xf0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0xd0], r12
lea rax, [rbp + 0x940]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov eax, 0x614
mov dword [rbp + 0xf4], r13d
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rdi, 0x20
seta bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180018e02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018dfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c24
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180018e57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018e52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c2a
call fcn.1800e2d24
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x50]
call fcn.18000c040
movzx eax, bl
jmp 0x180019bc0
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180018ec2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018ebd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c30
call fcn.1800e2d24
xor esi, esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rcx, [rbp + 0x50]
call fcn.18000c040
mov r12d, r13d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, r15
lea rdx, [0x180159520]
lea rcx, [rbp + 0xd0]
call fcn.180012730
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180018f5f
lea rsi, [rcx + 2]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x180018f3f
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 4
lea rdx, [0x180159648]
call fcn.180101f90
xor eax, eax
mov word [rdi + rsi*2], ax
xor esi, esi
jmp 0x180018f7f
mov qword [rsp + 0x20], 2
lea r9, [0x180159648]
mov edx, 2
mov rcx, rbx
call fcn.18000cad0
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm7, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm7
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp + 0x60], xmm6
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x60], r13d
lea rcx, [rbp + 0x30]
call fcn.18000c040
movups xmmword [rbp + 0x30], xmm7
movups xmmword [rbp + 0x40], xmm6
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov eax, r13d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019026
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019021
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c36
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.180011450
nop
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x180019128
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1800190b8
lea rax, [rdi + rsi]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x30]
lea r8, [rdi + rdi]
lea rcx, [rbx + rsi*2]
mov rdx, r9
call fcn.180101f90
lea rax, [rdi + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x1800190cb
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.18000cad0
xor esi, esi
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019110
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180156f2c]
call fcn.180101f90
mov word [rbx + rdi*2], si
jmp 0x180019128
mov qword [rsp + 0x20], r13
lea r9, [0x180156f2c]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cad0
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x18001922f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0xd0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2c7
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800191d2
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019c3c
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.18000bd20
nop
lea rcx, [rbp + 0x10]
call fcn.1800946f0
lea r10, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r10, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp rax, 0x11
jb 0x1800192c2
lea r11, [rax - 0x10]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rbx, str.2345explorer.exe
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x1800192c2
cmp word [rcx], 0x5c
je 0x18001928b
add rcx, 2
sub rax, 1
jmp 0x180019279
test rcx, rcx
je 0x1800192c2
mov r8d, 0x11
mov rdx, rbx
mov r9, rcx
sub r9, rbx
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x1800192bc
add rdx, 2
sub r8, 1
jne 0x1800192a0
sub rcx, r10
sar rcx, 1
jmp 0x1800192c9
add rcx, 2
jmp 0x180019270
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001938d
mov r8, qword [r14 + 0x10]
test r8, r8
jne 0x180019372
mov r8, qword [rbp + 0x40]
mov rdi, r8
cmp r8, 1
jb 0x18001935d
mov rbx, rsi
test r8, r8
je 0x18001932b
cmp r8, rbx
jbe 0x180019bf4
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
movzx edx, word [rax + rbx*2]
lea rcx, [0x180156f2c]
call fcn.1801018a0
mov r8, qword [rbp + 0x40]
test rax, rax
je 0x18001932b
inc rbx
cmp rbx, rdi
jb 0x1800192f3
test rbx, rbx
je 0x18001935d
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
sub r8, rbx
mov qword [rbp + 0x40], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.180101f90
lea rdx, [0x180156f2c]
lea rcx, [rbp + 0x30]
call fcn.180094560
jmp 0x18001946c
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001937f
mov rdx, qword [r14]
lea rcx, [rbp + 0x30]
call fcn.18000c370
jmp 0x18001946c
cmp qword [r14 + 0x10], 0
je 0x18001946c
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1800193dd
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180159520]
call fcn.180101f90
mov word [rbx + rdi*2], si
jmp 0x1800193f5
mov qword [rsp + 0x20], r13
lea r9, [0x180159520]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cad0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x180019402
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp + 0x30]
call fcn.18000c370
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019454
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180159520]
call fcn.180101f90
mov word [rbx + rdi*2], si
jmp 0x18001946c
mov qword [rsp + 0x20], r13
lea r9, [0x180159520]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000cad0
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x18001950d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2e1
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180019504
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x60]
call fcn.1801023f0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], r13d
mov word [rbp - 0x20], r13w
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x18001955e
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180019603
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
cmp qword [r14 + 0x18], 8
jb 0x18001959c
mov r14, qword [r14]
mov r9, r14
mov r8d, r12d
lea rdx, [0x180159670]
lea rcx, [rbp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2f2
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800195f8
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
jmp 0x18001960a
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r14d, esi
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.18000bd20
nop
lea rcx, [rbp + 0xd0]
call fcn.1800946f0
lea r10, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae r10, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
cmp rax, 0xc
jb 0x1800196c2
lea r11, [rax - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rdi, str.iexplore.exe
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x1800196c2
cmp word [rcx], 0x69
je 0x18001968b
add rcx, 2
sub rax, 1
jmp 0x180019679
test rcx, rcx
je 0x1800196c2
mov r8d, 0xc
mov rdx, rdi
mov r9, rcx
sub r9, rdi
nop
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x1800196bc
add rdx, 2
sub r8, 1
jne 0x1800196a0
sub rcx, r10
sar rcx, 1
jmp 0x1800196c9
add rcx, 2
jmp 0x180019670
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x1800199a7
call fcn.18001be20
lea rdx, [rbp - 0x70]
call fcn.18001bed0
nop
lea rcx, [rsp + 0x70]
cmp rcx, rax
je 0x1800196f5
mov rbx, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180019706
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 4
lea rcx, [0x1801b0198]
test al, al
jne 0x1800197c6
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x1800197a5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0x1e
lea rdx, str.ShellExecuteLoadWeb:
lea rcx, [rbp + 0x50]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x2ff
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18001979c
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
mov rcx, rbx
mov rbx, rsi
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x1800199a7
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
jmp 0x1800199a7
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x180019848
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0xc
lea rdx, [0x180159750]
lea rcx, [rbp + 0x50]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x304
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18001983f
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x180019860
mov r15, qword [r15]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9b, 1
movzx r8d, r9b
mov rdx, r15
mov rcx, rbx
call qword [rax + 0x18]
mov r14d, eax
mov edx, 4
lea rcx, [0x1801b0198]
test eax, eax
jne 0x180019916
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x1800199a7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.isDriverProtectOk___d_err___x
lea rcx, [rbp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x308
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r14 + 4]
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x180019911
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
jmp 0x18001999e
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x1800199a7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r9, qword [rbp + 0x30]
mov r8d, r14d
lea rdx, str.isDriverProtectOk___d_cmd___ws
lea rcx, [rbp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x18001999e
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
cmp qword [rsp + 0x68], 0
je 0x180019a47
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800199e7
cmp byte [rax], 0xe9
jne 0x1800199e7
mov edx, 0x14
mov rcx, rax
call fcn.18012bfc0
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x180019a8e
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test dil, dil
je 0x180019ab4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x180019ac4
mov edx, 0x2710
jmp 0x180019abb
test r14d, r14d
je 0x180019ac4
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov esi, eax
xor r15d, r15d
test eax, eax
je 0x180019b56
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r15w
movzx r9d, dil
mov r8d, r14d
lea rdx, str.JumpToProtectMainPage___
lea rcx, [rbp + 0x50]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r15 + 4]
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp esi, 1
jbe 0x180019b4d
lea rdx, [rbp + 0x50]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x50]
call fcn.18000c040
test rbx, rbx
je 0x180019b7d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, r15
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x180019b7d
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
nop
lea rcx, [rbp + 0xd0]
call fcn.18000c040
nop
test rbx, rbx
je 0x180019b9c
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rbx
call qword [r8]
nop
lea rcx, [rbp + 0x10]
call fcn.18000c040
nop
lea rcx, [rbp + 0xb0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x30]
call fcn.18000c040
movzx eax, dil
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1800e2d00
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800125c0
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3