Function at 0x140016c70
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x358
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x2f0], xmm6
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 8
mov qword [rsp + 0xf8], 0
mov dword [rsp + 0xc0], 0
mov r13d, 8
lea r9, [rsp + 0xc0]
mov edx, 8
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x140017b44
lea rsi, [rsp + 0xe8]
lea rdi, [rsp + 0xc0]
xor ebx, ebx
xor r15d, r15d
jmp 0x140016d68
mov rbx, r15
mov qword [rsp + 0xf8], rbx
mov rcx, 0xffffffffffffffff
mov rdx, r13
mov r8d, ebx
mov r9, rdi
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x1400179d5
mov eax, r15d
mov r15d, dword [rsp + 0xc0]
cmp r15d, eax
jbe 0x140016e1f
mov r14, r15
sub r14, rbx
jbe 0x140016d40
mov rax, qword [rsp + 0xe8]
sub rax, rbx
mov r12, rbx
cmp rax, r14
jb 0x140016dee
lea rcx, [r12*8]
add rcx, r13
cmp r14, 2
jb 0x140016dd4
mov r8, rbx
not r8
add r8, r15
shl r8, 3
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [r12 + r15]
sub rax, rbx
lea rcx, [rax*8 - 8]
add rcx, r13
add r12, r14
dec r12
mov qword [rcx], 0
inc r12
mov r13, qword [rsp + 0xf0]
mov rbx, r12
jmp 0x140016d43
mov rcx, rsi
mov rdx, rbx
mov r8, r14
call fcn.14004a4b0
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xf8]
lea rcx, [r12*8]
add rcx, r13
cmp r14, 2
jae 0x140016da8
jmp 0x140016dd4
mov qword [rsp + 0x50], r13
mov rax, qword [rsp + 0xe8]
movabs r15, 0x8000000000000000
mov qword [rsp + 0x68], rax
cmp rax, r15
je 0x140017a0a
test rbx, rbx
je 0x1400178c4
mov rbp, qword [rsp + 0x50]
lea rax, [rbx*8]
add rax, rbp
mov qword [rsp + 0xe0], rax
movabs rcx, 0x7fffffffffffffe0
mov rax, qword [rsp + 0x60]
mov rdx, rax
and rdx, rcx
mov qword [rsp + 0x38], rdx
movabs rcx, 0x7ffffffffffffff8
and rax, rcx
mov qword [rsp + 0x70], rax
lea r14, [rsp + 0xe8]
movdqa xmm6, xmmword [0x140052600]
movdqa xmm7, xmmword [0x140052610]
movdqa xmm8, xmmword [str.]
movdqa xmm9, xmmword [0x1400525d0]
movdqa xmm10, xmmword [0x1400525e0]
movdqa xmm11, xmmword [0x1400525f0]
jmp 0x140016efa
mov r12, r13
mov rbx, qword [rsp + 0x40]
lea r14, [rsp + 0xe8]
add rbp, 8
mov r13, r12
mov qword [rsp + 0x40], rbx
cmp rbp, qword [rsp + 0xe0]
je 0x1400178c4
mov rdi, qword [rbp]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r8, r14
mov r9d, 0x104
call sub.psapi.dll_GetModuleBaseNameW
test eax, eax
je 0x140016fd0
mov r8d, eax
cmp eax, 0x105
jae 0x140017a42
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r14
call fcn.140025400
mov rcx, rsi
call fcn.140036e30
mov r8, rdx
lea rcx, [rsp + 0xa8]
mov rdx, rax
call fcn.140037070
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb8]
cmp rbx, r15
mov qword [rsp + 0x28], rax
jne 0x140017023
test rax, rax
je 0x140016ff6
js 0x140017a8d
movzx eax, byte [0x140064141]
mov esi, 1
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.140009c00
test rax, rax
je 0x140017a70
mov rbx, rax
jmp 0x140016ffb
call fcn.1400191d0
mov eax, eax
movabs rcx, 0xffffffff00000000
mov rdx, qword [rsp + 0x30]
and rdx, rcx
or rdx, rax
mov qword [rsp + 0x30], rdx
mov rbx, r15
jmp 0x140017043
mov ebx, 1
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rbx, rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x140017043
mov rcx, qword [rsp + 0xc8]
mov r8d, 1
call fcn.140009c10
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r8, r14
mov r9d, 0x104
call sub.psapi.dll_GetModuleFileNameExW
test eax, eax
je 0x140017110
mov r8d, eax
cmp eax, 0x105
jae 0x140017a59
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r14
call fcn.140025400
mov rcx, rsi
call fcn.140036e30
mov r8, rdx
lea rcx, [rsp + 0xa8]
mov rdx, rax
call fcn.140037070
mov rax, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
cmp rax, r15
jne 0x140017168
test r14, r14
je 0x140017142
js 0x140017ab7
movzx eax, byte [0x140064141]
mov esi, 1
mov edx, 1
mov rcx, r14
call fcn.140009c00
test rax, rax
jne 0x140017147
jmp 0x140017a9f
call fcn.1400191d0
lea rax, [rbx*2]
test rax, rax
je 0x140017135
mov r8d, 1
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.140009c10
mov r12, r13
mov rbx, qword [rsp + 0x40]
jmp 0x140016ee0
mov eax, 1
mov rcx, rax
mov rsi, rax
mov rdx, r12
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x88], rsi
mov r12, rsi
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x140017188
mov rcx, qword [rsp + 0xc8]
mov r8d, 1
call fcn.140009c10
cmp rbx, r15
jne 0x1400171b0
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140016ed0
mov r8d, 1
mov rcx, r12
call fcn.140009c10
jmp 0x140016ed0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x98], rdi
mov r12d, 1
mov r15, qword [rsp + 0x28]
test r15, r15
je 0x14001722d
js 0x140017adb
movzx eax, byte [0x140064141]
mov esi, 1
mov edx, 1
mov rcx, r15
call fcn.140009c00
mov rdi, r15
test rax, rax
je 0x140017ac9
mov r15, rax
mov rsi, rax
mov rcx, r15
mov rdx, qword [rsp + 0x30]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
cmp rdi, 8
jb 0x14001733f
mov rax, qword [rsp + 0x28]
cmp rax, 0x20
jae 0x140017256
xor eax, eax
jmp 0x1400172df
mov esi, 1
mov edi, 1
cmp qword [rsp + 0x60], 0
jne 0x140017383
mov r13, qword [rsp + 0x60]
cmp r15, r13
je 0x1400174e9
jmp 0x1400174ff
movabs rcx, 0x7fffffffffffffe0
and rax, rcx
xor ecx, ecx
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rsi + rcx]
movdqu xmm1, xmmword [rsi + rcx + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm9
movdqa xmm3, xmm1
paddb xmm3, xmm9
movdqa xmm4, xmm2
pminub xmm4, xmm10
pcmpeqb xmm4, xmm2
pand xmm4, xmm11
movdqa xmm2, xmm3
pminub xmm2, xmm10
pcmpeqb xmm2, xmm3
pand xmm2, xmm11
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [rsi + rcx], xmm4
movdqu xmmword [rsi + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x140017270
cmp qword [rsp + 0x28], rax
je 0x14001736f
test byte [rsp + 0x28], 0x18
je 0x140017339
mov rdx, qword [rsp + 0x28]
movabs rcx, 0x7ffffffffffffff8
and rdx, rcx
lea rcx, [r15 + rdx]
nop word cs:[rax + rax]
movq xmm0, qword [rsi + rax]
movdqa xmm1, xmm0
paddb xmm1, xmm6
movdqa xmm2, xmm1
pmaxub xmm2, xmm7
pcmpeqb xmm2, xmm1
pandn xmm2, xmm8
por xmm2, xmm0
movq qword [rsi + rax], xmm2
add rax, 8
cmp rdx, rax
jne 0x140017300
cmp qword [rsp + 0x28], rdx
jne 0x14001733f
jmp 0x14001736f
add rax, r15
mov rcx, rax
add r15, qword [rsp + 0x28]
nop word cs:[rax + rax]
movzx eax, byte [rcx]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
mov byte [rcx], dl
lea rax, [rcx + 1]
mov rcx, rax
cmp rax, r15
jne 0x140017350
mov rdi, rsi
mov r15, qword [rsp + 0x28]
cmp qword [rsp + 0x60], 0
je 0x140017243
js 0x140017aea
movzx eax, byte [0x140064141]
mov r12d, 1
mov edx, 1
mov r13, qword [rsp + 0x60]
mov rcx, r13
call fcn.140009c00
test rax, rax
je 0x140017aed
mov r15, rax
mov r12, rax
mov rcx, r15
mov rdx, qword [rsp + 0xa0]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rax, r15
cmp r13, 8
jb 0x1400174b1
cmp r13, 0x20
jae 0x1400173e4
xor ecx, ecx
jmp 0x140017465
xor eax, eax
mov rcx, qword [rsp + 0x38]
nop dword [rax + rax]
movdqu xmm0, xmmword [r12 + rax]
movdqu xmm1, xmmword [r12 + rax + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm9
movdqa xmm3, xmm1
paddb xmm3, xmm9
movdqa xmm4, xmm2
pminub xmm4, xmm10
pcmpeqb xmm4, xmm2
pand xmm4, xmm11
movdqa xmm2, xmm3
pminub xmm2, xmm10
pcmpeqb xmm2, xmm3
pand xmm2, xmm11
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [r12 + rax], xmm4
movdqu xmmword [r12 + rax + 0x10], xmm2
add rax, 0x20
cmp rcx, rax
jne 0x1400173f0
cmp rcx, r13
je 0x1400174df
mov rcx, qword [rsp + 0x38]
test r13b, 0x18
je 0x1400174a9
mov rdx, qword [rsp + 0x70]
lea rax, [r15 + rdx]
nop
movq xmm0, qword [r12 + rcx]
movdqa xmm1, xmm0
paddb xmm1, xmm6
movdqa xmm2, xmm1
pmaxub xmm2, xmm7
pcmpeqb xmm2, xmm1
pandn xmm2, xmm8
por xmm2, xmm0
movq qword [r12 + rcx], xmm2
add rcx, 8
cmp rdx, rcx
jne 0x140017470
cmp rdx, r13
jne 0x1400174b1
jmp 0x1400174df
mov rax, qword [rsp + 0x38]
add rax, r15
add r15, r13
nop word cs:[rax + rax]
movzx ecx, byte [rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov byte [rax], dl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, r15
jne 0x1400174c0
mov r15, qword [rsp + 0x28]
cmp r15, r13
jne 0x1400174ff
mov rcx, rsi
mov rdx, r12
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001792f
test r13, r13
je 0x140017515
mov r8d, 1
mov rcx, r12
mov rdx, r13
call fcn.140009c10
test r15, r15
je 0x14001752b
mov r8d, 1
mov rcx, rsi
mov rdx, r15
call fcn.140009c10
test rbx, rbx
je 0x140017543
mov r8d, 1
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.140009c10
mov ebx, 1
test r14, r14
je 0x1400175a6
js 0x140017b10
movzx eax, byte [0x140064141]
mov r15d, 1
mov edx, 1
mov rcx, r14
call fcn.140009c00
test rax, rax
je 0x140017af8
mov rsi, rax
mov r15, rax
mov rcx, rsi
mov rdx, qword [rsp + 0x58]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
cmp r14, 8
jb 0x1400176af
cmp r14, 0x20
jae 0x1400175c7
xor eax, eax
jmp 0x140017650
mov r15d, 1
mov eax, 1
test r13, r13
mov qword [rsp + 0x80], rax
jne 0x1400176f3
jmp 0x14001784f
mov rax, r14
movabs rcx, 0x7fffffffffffffe0
and rax, rcx
xor ecx, ecx
nop dword [rax]
movdqu xmm0, xmmword [r15 + rcx]
movdqu xmm1, xmmword [r15 + rcx + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm9
movdqa xmm3, xmm1
paddb xmm3, xmm9
movdqa xmm4, xmm2
pminub xmm4, xmm10
pcmpeqb xmm4, xmm2
pand xmm4, xmm11
movdqa xmm2, xmm3
pminub xmm2, xmm10
pcmpeqb xmm2, xmm3
pand xmm2, xmm11
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [r15 + rcx], xmm4
movdqu xmmword [r15 + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x1400175e0
cmp r14, rax
je 0x1400176df
test r14b, 0x18
je 0x1400176a9
mov rdx, r14
movabs rcx, 0x7ffffffffffffff8
and rdx, rcx
lea rcx, [rsi + rdx]
nop word cs:[rax + rax]
movq xmm0, qword [r15 + rax]
movdqa xmm1, xmm0
paddb xmm1, xmm6
movdqa xmm2, xmm1
pmaxub xmm2, xmm7
pcmpeqb xmm2, xmm1
pandn xmm2, xmm8
por xmm2, xmm0
movq qword [r15 + rax], xmm2
add rax, 8
cmp rdx, rax
jne 0x140017670
cmp r14, rdx
jne 0x1400176af
jmp 0x1400176df
add rax, rsi
mov rcx, rax
add rsi, r14
nop word cs:[rax + rax]
movzx eax, byte [rcx]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
mov byte [rcx], dl
lea rax, [rcx + 1]
mov rcx, rax
cmp rax, rsi
jne 0x1400176c0
mov rax, r15
test r13, r13
mov qword [rsp + 0x80], rax
je 0x14001784f
js 0x140017b35
movzx eax, byte [0x140064141]
mov ebx, 1
mov edx, 1
mov rcx, r13
call fcn.140009c00
test rax, rax
je 0x140017b23
mov rsi, rax
mov rbx, rax
mov rcx, rsi
mov rdx, qword [rsp + 0xa0]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rax, rsi
cmp r13, 8
jb 0x14001781f
cmp r13, 0x20
jae 0x14001774e
xor ecx, ecx
jmp 0x1400177d1
xor eax, eax
mov rcx, qword [rsp + 0x38]
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rbx + rax]
movdqu xmm1, xmmword [rbx + rax + 0x10]
movdqa xmm2, xmm0
paddb xmm2, xmm9
movdqa xmm3, xmm1
paddb xmm3, xmm9
movdqa xmm4, xmm2
pminub xmm4, xmm10
pcmpeqb xmm4, xmm2
pand xmm4, xmm11
movdqa xmm2, xmm3
pminub xmm2, xmm10
pcmpeqb xmm2, xmm3
pand xmm2, xmm11
por xmm4, xmm0
por xmm2, xmm1
movdqu xmmword [rbx + rax], xmm4
movdqu xmmword [rbx + rax + 0x10], xmm2
add rax, 0x20
cmp rcx, rax
jne 0x140017760
cmp rcx, r13
je 0x14001784f
mov rcx, qword [rsp + 0x38]
test r13b, 0x18
je 0x140017817
mov rdx, qword [rsp + 0x70]
lea rax, [rsi + rdx]
nop word [rax + rax]
movq xmm0, qword [rbx + rcx]
movdqa xmm1, xmm0
paddb xmm1, xmm6
movdqa xmm2, xmm1
pmaxub xmm2, xmm7
pcmpeqb xmm2, xmm1
pandn xmm2, xmm8
por xmm2, xmm0
movq qword [rbx + rcx], xmm2
add rcx, 8
cmp rdx, rcx
jne 0x1400177e0
cmp rdx, r13
jne 0x14001781f
jmp 0x14001784f
mov rax, qword [rsp + 0x38]
add rax, rsi
add rsi, r13
nop word cs:[rax + rax]
movzx ecx, byte [rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov byte [rax], dl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, rsi
jne 0x140017830
cmp r14, r13
jne 0x14001786a
mov rcx, r15
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140017975
test r13, r13
je 0x140017880
mov r8d, 1
mov rcx, rbx
mov rdx, r13
call fcn.140009c10
test r14, r14
je 0x140017896
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.140009c10
mov rdx, qword [rsp + 0x48]
test rdx, rdx
mov qword [rsp + 0x78], rdi
je 0x1400178b5
mov r8d, 1
mov rcx, qword [rsp + 0x58]
call fcn.140009c10
movabs r15, 0x8000000000000000
jmp 0x140016ed8
xor edi, edi
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1400178e4
shl rdx, 3
mov r8d, 8
mov rcx, qword [rsp + 0x50]
call fcn.140009c10
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x2f0]
movaps xmm7, xmmword [rsp + 0x300]
movaps xmm8, xmmword [rsp + 0x310]
movaps xmm9, xmmword [rsp + 0x320]
movaps xmm10, xmmword [rsp + 0x330]
movaps xmm11, xmmword [rsp + 0x340]
add rsp, 0x358
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r13, r13
je 0x140017956
mov r8d, 1
mov rcx, r12
mov rdx, r13
call fcn.140009c10
mov r8d, 1
mov rcx, rsi
mov rdx, r13
call fcn.140009c10
test rbx, rbx
mov r14, qword [rsp + 0x48]
je 0x1400179a1
mov r8d, 1
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.140009c10
jmp 0x1400179a1
test r13, r13
je 0x14001799c
mov r8d, 1
mov rcx, rbx
mov rdx, r13
call fcn.140009c10
mov r8d, 1
mov rcx, r15
mov rdx, r13
call fcn.140009c10
mov r14, qword [rsp + 0x48]
test r14, r14
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
je 0x1400178cb
mov r8d, 1
mov rsi, rdx
mov rdx, r14
call fcn.140009c10
mov rdx, rsi
jmp 0x1400178cb
mov rdi, qword [rsp + 0xe8]
call fcn.1400191d0
mov esi, eax
test rdi, rdi
je 0x140017a03
mov rcx, qword [rsp + 0xf0]
shl rdi, 3
mov r8d, 8
mov rdx, rdi
call fcn.140009c10
mov eax, esi
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0xe8], eax
lea rax, [0x140052748]
mov qword [rsp + 0x20], rax
lea rcx, [0x140052670]
lea r9, [0x140052650]
lea r8, [rsp + 0xe8]
mov edx, 0x2b
call fcn.14004c2e0
lea rax, [0x140052760]
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.14004c3e0
lea rax, [0x140052778]
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.14004c3e0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x90], rax
mov rcx, rsi
mov rdx, qword [rsp + 0x90]
call fcn.14004be60
xor esi, esi
mov rcx, rsi
mov rdx, qword [rsp + 0x90]
call fcn.14004be60
mov qword [rsp + 0x88], r14
mov rcx, rsi
mov rdx, qword [rsp + 0x88]
call fcn.14004be60
xor esi, esi
mov rcx, rsi
mov rdx, qword [rsp + 0x88]
call fcn.14004be60
mov qword [rsp + 0x78], rdi
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
call fcn.14004be60
xor esi, esi
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
call fcn.14004be60
xor r12d, r12d
mov rcx, r12
mov rdx, r13
call fcn.14004be60
mov qword [rsp + 0x80], r14
mov rcx, r15
mov rdx, qword [rsp + 0x80]
call fcn.14004be60
xor r15d, r15d
mov rcx, r15
mov rdx, qword [rsp + 0x80]
call fcn.14004be60
mov qword [rsp + 0x40], r13
mov rcx, rbx
mov rdx, qword [rsp + 0x40]
call fcn.14004be60
xor ebx, ebx
mov rcx, rbx
mov rdx, qword [rsp + 0x40]
call fcn.14004be60
call fcn.1400191d0
mov esi, eax
jmp 0x140017a03