Function at 0x140007df1
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x2b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x240], rcx
mov qword [rbp + 0x248], rdx
mov qword [rbp + 0x250], r8
mov qword [rbp + 0x228], 0
call fcn.14008fb90
mov rdx, qword [rbp + 0x250]
lea rax, [rbp + 0x250]
mov rcx, rax
call fcn.140090140
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x58], 0
mov qword [rbp + 0x208], 0
mov qword [rbp - 0x60], 0
cmp qword [rbp + 0x240], 0
jne 0x140007ff1
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x200], rax
lea rax, str.0419
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x220], 0
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
jne 0x140007efe
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x1f0], rax
lea rax, [0x1402ea976]
mov qword [rbp + 0x1e8], rax
mov rdx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
je 0x140007f0c
jmp 0x140007eff
nop
mov qword [rbp + 0x220], 1
jmp 0x140007f0d
nop
mov qword [rbp + 0x218], 0
cmp qword [rbp + 0x220], 0
jne 0x140007f5a
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x1e0], rax
lea rax, [0x1402ea970]
mov qword [rbp + 0x1d8], rax
mov rdx, qword [rbp + 0x1e0]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
je 0x140007f68
jmp 0x140007f5b
nop
mov qword [rbp + 0x218], 1
jmp 0x140007f69
nop
cmp qword [rbp + 0x218], 0
je 0x140007f88
lea rax, [rbp - 0x58]
lea rdx, [0x1402f5e80]
mov rcx, rax
call fcn.140090050
jmp 0x140007f9c
nop
lea rax, [rbp - 0x58]
lea rdx, str.Disabling_Defender_in_this_version_of_the_program_requires_a_system_restart._Perform_Defender_Switch__
mov rcx, rax
call fcn.140090050
mov rax, qword [rbp - 0x58]
mov rdx, qword [rbp + 0x248]
mov r9, rdx
mov r8d, reloc.WS2_32.dll_gethostbyname
mov rdx, rax
lea rax, str.Defender_Tools
mov rcx, rax
call fcn.140005840
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 7
jne 0x140007ff4
mov qword [rbp + 0x228], 0
jmp 0x1400089ba
nop
jmp 0x140007ff5
nop
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov edx, eax
mov ecx, 0xc8
call fcn.14008d4a0
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.14008feb0
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov edx, eax
mov ecx, 0xc8
call fcn.14008d4a0
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14008feb0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x1c8], rax
lea rax, str.PROCESSOR_ARCHITECTURE
mov rdx, qword [rbp + 0x1c8]
mov r8d, 0xc8
mov rcx, rax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov qword [rbp + 0x1c0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x1b8], rax
lea rax, str.PROCESSOR_ARCHITEW6432
mov rdx, qword [rbp + 0x1b8]
mov r8d, 0xc8
mov rcx, rax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x1a8], rax
lea rax, str.AMD64
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x210], 0
mov rdx, qword [rbp + 0x1a8]
mov rax, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
jne 0x140008120
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x198], rax
lea rax, str.AMD64
mov qword [rbp + 0x190], rax
mov rdx, qword [rbp + 0x198]
mov rax, qword [rbp + 0x190]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
je 0x14000812e
jmp 0x140008121
nop
mov qword [rbp + 0x210], 1
jmp 0x14000812f
nop
cmp qword [rbp + 0x210], 0
je 0x14000814e
lea rax, [rbp - 0x48]
lea rdx, [0x1402f2388]
mov rcx, rax
call fcn.140090050
jmp 0x140008162
nop
lea rax, [rbp - 0x48]
lea rdx, [0x1402f50d0]
mov rcx, rax
call fcn.140090050
call fcn.140014199
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0
je 0x1400081a3
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov ecx, eax
call fcn.140073300
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x38]
mov rcx, rax
call fcn.14008feb0
jmp 0x1400081f9
nop
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov ecx, eax
call fcn.1400623f8
call fcn.14008fdb0
mov qword [rbp + 0x180], rax
call fcn.14008fc60
mov edx, eax
mov rax, qword [rbp + 0x180]
mov rcx, rax
call fcn.140072c4c
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x38]
mov rcx, rax
call fcn.14008feb0
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp + 0x170], rax
call fcn.14008fcd0
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Disable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp + 0x160], rax
call fcn.14008fcd0
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Enable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x158]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp + 0x150], rax
call fcn.14008fcd0
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x148], rax
lea rax, [0x1402f2388]
mov qword [rbp + 0x140], rax
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x140]
mov rcx, rax
call fcn.14008ffc0
test eax, eax
je 0x1400083dd
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0x130], rax
call fcn.14008fcd0
cmp qword [rbp + 0x130], 0
je 0x1400083d7
lea rax, [0x140106f8a]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x120], 0x27600
mov rdx, qword [rbp + 0x120]
mov rax, qword [rbp + 0x128]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0x118], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0x110], rax
jmp 0x140008490
nop
jmp 0x140008490
nop
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0x100], rax
call fcn.14008fcd0
cmp qword [rbp + 0x100], 0
je 0x14000848f
lea rax, [0x1400e738a]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0xf0], 0x1fc00
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0xe8], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0xe0], rax
jmp 0x140008490
nop
cmp qword [rbp + 0x240], 0
jne 0x14000868b
mov rax, qword [0x140300d18]
test rax, rax
jne 0x14000857b
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Disable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0xd0], rax
call fcn.14008fcd0
cmp qword [rbp + 0xd0], 0
je 0x140008575
lea rax, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xc0], 0x46a
mov rdx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xc8]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0xb8], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0xb0], rax
lea rax, [rbp - 0x50]
lea rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Disable.cmd
mov rcx, rax
call fcn.140090050
jmp 0x140008686
nop
jmp 0x140008686
nop
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Disable.ps1
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0xa0], rax
call fcn.14008fcd0
cmp qword [rbp + 0xa0], 0
je 0x140008685
lea rax, [0x14012f25c]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x90], 0x3f1
mov rdx, qword [rbp + 0x90]
mov rax, qword [rbp + 0x98]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0x88], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0x80], rax
call fcn.14008fc00
lea rax, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
mov rcx, rax
call fcn.14008fe40
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov ecx, eax
call fcn.140073300
call fcn.14008fc60
lea rax, str.Disable.ps1_
mov rcx, rax
call fcn.14008fe40
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.14008feb0
jmp 0x140008835
nop
jmp 0x140008835
nop
mov rax, qword [0x140300d18]
test rax, rax
jne 0x14000874b
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Enable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0x70], rax
call fcn.14008fcd0
cmp qword [rbp + 0x70], 0
je 0x140008745
lea rax, [0x14012e9f4]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], 0x426
mov rdx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x68]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0x58], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0x50], rax
lea rax, [rbp - 0x50]
lea rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Enable.cmd
mov rcx, rax
call fcn.140090050
jmp 0x140008835
nop
jmp 0x140008835
nop
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Enable.ps1
mov rcx, rax
call fcn.14008fe40
call fcn.14008ff90
call fcn.14008fdb0
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073be0
mov qword [rbp + 0x40], rax
call fcn.14008fcd0
cmp qword [rbp + 0x40], 0
je 0x140008834
lea rax, [0x14012f25c]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x30], 0x3f1
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov r8, rdx
mov rdx, rax
mov ecx, WSAStartup
call fcn.140073f20
mov qword [rbp + 0x28], rax
mov ecx, WSAStartup
call fcn.140073fb0
mov qword [rbp + 0x20], rax
call fcn.14008fc00
lea rax, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
mov rcx, rax
call fcn.14008fe40
call fcn.14008fc00
call fcn.14008fc00
call fcn.14008fc60
mov ecx, eax
call fcn.140073300
call fcn.14008fc60
lea rax, str.Enable.ps1_
mov rcx, rax
call fcn.14008fe40
call fcn.14008fc60
mov edx, eax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.14008feb0
jmp 0x140008835
nop
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.140072d0c
mov qword [rbp + 0x10], rax
call fcn.14008fcd0
cmp qword [rbp + 0x10], 0
jle 0x1400088d5
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp + 8], rax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp + 8]
mov r9d, 3
mov r8, rcx
mov rcx, rax
call fcn.140062524
mov qword [rbp], rax
call fcn.14008fcd0
jmp 0x1400088d6
nop
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.loader.exe
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp - 0x10], rax
call fcn.14008fcd0
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Disable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp - 0x20], rax
call fcn.14008fcd0
call fcn.14008fc00
call fcn.14008fc00
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.14008fe40
lea rax, str.Enable.cmd
mov rcx, rax
call fcn.14008fe40
call fcn.14008fdb0
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov edx, 2
mov rcx, rax
call fcn.1400733b0
mov qword [rbp - 0x30], rax
call fcn.14008fcd0
mov qword [rbp + 0x228], 1
nop
mov rax, qword [rbp + 0x250]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x48]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x50]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp - 0x60]
mov rcx, rax
call fcn.140090020
mov rax, qword [rbp + 0x228]
add rsp, 0x2b0
pop rbp
ret