Function at 0x1400115e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Encode data using xor
Hash data using fnv
Read file on windows
Run powershell expression

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1280]
mov eax, 0x1380
call fcn.140049430
sub rsp, rax
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x1270], rax
mov ebx, ecx
mov dword [rsp + 0x60], ecx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x190], xmm1
lea r8d, [r14 + 0x11]
lea rdx, str.Invoke_RestMethod
lea rcx, [rbp + 0x180]
call fcn.140006d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1b0], xmm1
lea r8d, [r14 + 0x31]
lea rdx, str.____Found_ImportCode_string:_Invoke_RestMethod.
lea rcx, [rbp + 0x1a0]
call fcn.140006d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1d0], xmm1
lea r8d, [r14 + 0x11]
lea rdx, str.Invoke_Expression
lea rcx, [rbp + 0x1c0]
call fcn.140006d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
lea r8d, [r14 + 0x31]
lea rdx, str.____Found_ImportCode_string:_Invoke_Expression.
lea rcx, [rbp + 0x1e0]
call fcn.140006d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x210], xmm1
lea r8d, [r14 + 0xd]
lea rdx, str.import_base64
lea rcx, [rbp + 0x200]
call fcn.140006d20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x230], xmm1
lea r8d, [r14 + 0x2d]
lea rdx, str.____Found_ImportCode_string:_import_base64.
lea rcx, [rbp + 0x220]
call fcn.140006d20
nop
lea rax, [rbp + 0x180]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140012380
nop
lea r9, [0x140012340]
lea edx, [r14 + 0x40]
lea r8d, [r14 + 3]
lea rcx, [rbp + 0x180]
call fcn.140048c88
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.140011520
nop
lea r9d, [r14 + 0x16]
lea r8, str.memory_scanner.exe__p
mov rcx, rax
call fcn.1400125a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x14001182c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011827
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011827
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
movdqa xmm0, xmmword [0x14005c320]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r14w
mov qword [rbp - 0x58], 0x18
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x50], r14
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x38], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x1c], eax
mov word [rbp + 0x20], r14w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001221a
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x270]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x270]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
test eax, eax
je 0x1400121f5
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1400121f5
mov r9d, eax
shr r9, 1
lea r8, [rbp + 0x270]
add r8, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r14
lea rax, [rbp + 0x270]
cmp rax, r8
jne 0x1400119c4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r14w
jmp 0x1400119d8
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xe0]
call fcn.1400126c0
nop
mov r13, qword [rbp - 0x78]
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x60], rax
cmp r13, rax
je 0x140012166
nop dword [rax]
lea rsi, [r13 + 0x20]
mov rax, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 8
jb 0x140011a0c
mov rcx, qword [r13]
mov rdx, rcx
lea r8, [rcx + rax*2]
jmp 0x140011a1a
lea r8, [rax*2]
add r8, r13
mov rdx, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
cmp rdx, r8
jne 0x140011a57
mov r12, r14
mov qword [rbp + 0x90], r14
mov eax, 7
mov qword [rbp + 0x98], rax
mov word [rbp + 0x80], r14w
jmp 0x140011a77
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0x80]
call fcn.140006d20
mov rax, qword [rbp + 0x98]
mov r12, qword [rbp + 0x90]
mov qword [rsp + 0x70], rax
lea r9, [rbp + 0x26a]
mov r8d, ebx
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140011a90
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], r14
lea rax, [rbp + 0x26a]
cmp r9, rax
jne 0x140011b04
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r14w
jmp 0x140011b26
lea r8, ds:[rbp + 0x26a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x140]
call fcn.140006d20
nop
mov r15, qword ds:[rsi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 0x16
jb 0x140012329
cmp qword [rsi + 0x18], 8
jb 0x140011b54
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r14
lea r14, [r15 + 0x16]
mov ebx, 7
lea rdi, [rbp + 0x120]
cmp r14, rbx
jbe 0x140011bf1
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x140011ba2
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x140011bc9
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001232f
lfence
add rcx, rcx
call fcn.140006ee0
mov rdi, rax
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x70], rax
mov r12, qword [rbp + 0x90]
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._on_process_with_pid:]
movups xmmword ds:[rdi + rbx], xmm0
movups xmm1, xmmword [0x1400527b8]
movups xmmword [rdi + rbx + 0x10], xmm1
movsd xmm0, qword [0x1400527c8]
movsd qword [rdi + rbx + 0x20], xmm0
mov eax, dword [0x1400527d0]
mov dword [rdi + rbx + 0x28], eax
xor esi, esi
mov word [rdi + r14*2], si
lea r9, [rbp + 0x140]
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0xa0]
call fcn.1400108c0
nop
mov rdi, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
sub rax, rdi
cmp rax, 0x13
jb 0x140011ccb
lea rax, [rdi + 0x13]
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xa0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0xa0]
lea rcx, [rbx + rdi*2]
lea r8d, [rsi + 0x26]
lea rdx, str.._This_is_bannable_
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x26], si
lea rax, [rbp + 0xa0]
mov r15, qword [rsp + 0x70]
jmp 0x140011cfd
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str.._This_is_bannable_
mov edx, 0x13
lea rcx, [rbp + 0xa0]
call fcn.140009140
mov r15, qword [rbp + 0x98]
mov r12, qword [rbp + 0x90]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140011d70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121ba
call fcn.140048710
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], si
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x140011dd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011dca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121c7
call fcn.140048710
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x140011e16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011e11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121ce
call fcn.140048710
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], rsi
mov r8, qword [rbp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140006d20
lea r8, [rbp + 0xc0]
mov r14, qword [rbp + 0xd8]
cmp r14, 8
setae dil
mov r11, qword [rbp + 0xc0]
cmovae r8, r11
movabs rcx, 0xcbf29ce484222325
mov r10, qword [rbp + 0xd0]
lea r9, [r10 + r10]
mov rdx, rsi
test r9, r9
je 0x140011ebb
movabs r14, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r14
inc rdx
cmp rdx, r9
jb 0x140011ea0
mov r14, qword [rbp + 0xd8]
and rcx, qword [0x14006e910]
add rcx, rcx
mov rax, qword [0x14006e8f8]
mov r9, qword [rax + rcx*8 + 8]
mov rsi, qword [0x14006e8e8]
cmp r9, rsi
je 0x140011f33
mov rbx, qword [rax + rcx*8]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140011ef3
mov rax, qword [rax]
lea r8, [rbp + 0xc0]
test dil, dil
cmovne r8, r11
cmp r10, rcx
jne 0x140011f28
mov rdx, r10
test r10, r10
je 0x140011f36
sub r8, rax
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x140011f28
add rax, 2
sub rdx, 1
je 0x140011f36
jmp 0x140011f11
cmp r9, rbx
je 0x140011f33
mov r9, qword [r9 + 8]
jmp 0x140011ee1
xor r9d, r9d
mov rbx, rsi
test r9, r9
cmovne rbx, r9
test dil, dil
je 0x140011f7a
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140011f72
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121d5
mov rcx, r11
call fcn.140048710
xor r14d, r14d
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r14w
mov rdi, qword [rbp + 0x80]
cmp rbx, rsi
jne 0x1400120bb
lea r11, [rbp + 0x80]
cmp r15, 8
cmovae r11, rdi
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rbx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xf0]
cmp r12, rax
ja 0x1400120bb
sub rax, r12
test r12, r12
je 0x140012074
lea rsi, [rbx + 2]
lea rsi, [rsi + rax*2]
mov rcx, rbx
movzx r10d, word [r11]
nop word [rax + rax]
mov rax, rsi
sub rax, rcx
sar rax, 1
mov rdx, r14
je 0x14001202a
cmp word [rcx], r10w
je 0x140012027
cmp rax, 1
je 0x14001202a
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140012014
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x1400120bb
mov r8, r12
mov rdx, r11
test r12, r12
je 0x140012068
mov r9, rcx
sub r9, r11
nop dword [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x1400121b1
add rdx, 2
sub r8, 1
jne 0x140012050
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x1400120bb
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x50]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
nop
mov rdx, qword ds:[rbp + 0x78]
cmp rdx, 8
jb 0x1400120fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121dc
call fcn.140048710
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r14w
cmp r15, 8
jb 0x140012152
lea rdx, ds:[r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001214a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121e7
mov rcx, rdi
call fcn.140048710
add r13, 0x40
cmp r13, qword [rbp - 0x60]
mov ebx, dword [rsp + 0x60]
jne 0x1400119f0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14001193d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400121a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400121ee
call fcn.140048710
jmp 0x14001193d
add rcx, 2
jmp 0x140012000
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword ds:[rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 8
jb 0x140012272
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001226d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001226d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
movdqa xmm0, xmmword [0x14005c320]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], r14w
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x1400122f9
mov rdi, qword [rbp - 0x70]
cmp rbx, rdi
je 0x1400122be
nop dword [rax]
lea rcx, [rbx + 0x20]
call fcn.140005e00
mov rcx, rbx
call fcn.140005e00
add rbx, 0x40
cmp rbx, rdi
jne 0x1400122a0
mov rbx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x68]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400122f1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400122f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140048710
mov rcx, qword [rbp + 0x1270]
xor rcx, rsp
call fcn.1400486f0
lea r11, [rsp + 0x1380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004080
nop
call fcn.140003fd0
int3