Function at 0x1400031b0
Capabilities:
Create process on windows
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xcb0]
sub rsp, 0xdb0
mov rax, qword [0x14000f040]
xor rax, rsp
mov qword [rbp + 0xca0], rax
xor r14d, r14d
lea rcx, str.taskkill__f__im_vgtray.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_vgc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.sc_start_vgc__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rbp + 0xa90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rbp + 0xa90]
mov edx, 0x104
lea rcx, [rbp + 0x880]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x104
lea rcx, [rbp + 0x880]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp + 0x880]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x140003284
lea rdx, [rbp + 0x880]
lea rcx, [rbp + 0x40]
call fcn.140006e20
nop
mov rsi, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
sub rax, rsi
cmp rax, 0x1d
jb 0x1400032ea
lea rax, [rsi + 0x1d]
mov qword [rbp + 0x50], rax
lea rbx, [rbp + 0x40]
cmp rcx, 7
cmova rbx, qword [rbp + 0x40]
lea rcx, [rbx + rsi*2]
mov r8d, 0x3a
lea rdx, str.PopupPastedkoreathebest.sys
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0x3a], r14w
lea rax, [rbp + 0x40]
jmp 0x140003308
mov qword [rsp + 0x20], 0x1d
lea r9, str.PopupPastedkoreathebest.sys
mov edx, 0x1d
lea rcx, [rbp + 0x40]
call fcn.1400070c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140003379
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003374
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003374
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
movdqa xmm0, xmmword [0x14000b480]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x880]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400033b0
lea rdx, [rbp + 0x880]
lea rcx, [rsp + 0x30]
call fcn.140006e20
nop
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rax, 0x22
jb 0x14000341e
lea rax, [rsi + 0x22]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rsi*2]
mov r8d, 0x44
lea rdx, str.PopupPastedejlalsjdlajldkada.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0x44], r14w
lea rax, [rsp + 0x30]
jmp 0x14000343d
mov qword [rsp + 0x20], 0x22
lea r9, str.PopupPastedejlalsjdlajldkada.exe
mov edx, 0x22
lea rcx, [rsp + 0x30]
call fcn.1400070c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400034bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
movdqa xmm0, xmmword [0x14000b480]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.140006610
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xa0], r15
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x9c], edx
cmp qword [rbp + 0x130], 0
jne 0x140003562
lea rdx, str._n____Popup_Bypass_Missing.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400037e2
lea rcx, [rbp + 0xb0]
call fcn.140006550
test rax, rax
jne 0x140003596
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x60], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
lea rax, str.open
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rax, qword [rbp + 0x80]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x70], 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x880]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140003640
mov r8, rdi
lea rdx, [rbp + 0x880]
lea rcx, [rsp + 0x30]
call fcn.140006e20
nop
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x22
jb 0x1400036b0
lea rax, [rdi + 0x22]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi*2]
mov r8d, 0x44
lea rdx, str.PopupPastedejlalsjdIajldkada.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x44], r14w
lea rax, [rsp + 0x30]
jmp 0x1400036cf
mov qword [rsp + 0x20], 0x22
lea r9, str.PopupPastedejlalsjdIajldkada.exe
mov edx, 0x22
lea rcx, [rsp + 0x30]
call fcn.1400070c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003742
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000373d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000373d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
mov dword [rbp - 0x30], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], eax
lea rax, str.runas
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rax, qword [rbp + 0x40]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], r14
mov dword [rbp], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1400037e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
call fcn.140001d80
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rsi, [0x14000a8a0]
cmp rax, 0xffffffffffffffff
je 0x1400038af
mov dword [rbp + 0x1b0], 0x238
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140003831
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400038af
mov edi, r14d
nop dword [rax]
nop dword [rax + rax]
mov rcx, r14
lea rdx, [rbp + 0x1dc]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [rsi + rcx*2 - 2]
jne 0x140003918
cmp rcx, 8
jne 0x140003850
mov edi, dword [rbp + 0x1b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400038af
mov dword [rbp + 0x870], 0xff20
mov dword [rbp + 0x874], 0xf7df
lea rbx, [rbp + 0x870]
mov edx, dword [rbx]
mov ecx, edi
call fcn.140001be0
add rbx, 4
lea rax, [rbp + 0x878]
cmp rbx, rax
jne 0x140003896
lea rdx, str._n____Open_Valorant._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003b3e
mov dword [rbp + 0x3f0], 0x238
lea rdx, [rbp + 0x3f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140003935
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003b3e
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003840
jmp 0x14000386e
mov edi, r14d
nop dword [rax + rax]
mov rcx, r14
lea rdx, [rbp + 0x41c]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [rsi + rcx*2 - 2]
jne 0x1400039af
cmp rcx, 8
jne 0x140003950
mov edi, dword [rbp + 0x3f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140003b3e
nop dword [rax + rax]
mov edx, 0x1010
mov ecx, edi
call fcn.140001a50
mov ebx, eax
mov edx, 0xe2f0
mov ecx, edi
call fcn.140001a50
test ebx, ebx
je 0x1400039a2
test eax, eax
jne 0x1400039c9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003980
lea rdx, [rbp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003940
jmp 0x14000396a
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002fc0
mov edx, 0x1010
mov ecx, edi
call fcn.140001be0
mov edx, 0xe2f0
mov ecx, edi
call fcn.140001be0
mov edx, 0xb7a0
mov ecx, edi
call fcn.140001be0
mov edx, 0x6040
mov ecx, edi
call fcn.140001be0
mov edx, 0xdfb0
mov ecx, edi
call fcn.140001be0
mov edx, 0xd110
mov ecx, edi
call fcn.140001be0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002340
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003b0f
mov dword [rbp + 0x630], 0x238
lea rdx, [rbp + 0x630]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140003a82
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003b0f
mov edi, r14d
lea rsi, str.VALORANT_Win64_Shipping.exe
nop dword [rax]
lea rdx, [rbp + 0x65c]
mov rax, r14
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
jne 0x140003c3c
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140003c3c
add rax, 2
cmp rax, 0x1c
jne 0x140003aa0
mov edi, dword [rbp + 0x638]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140003b0f
mov dword [rbp + 0x878], 0x1b70
mov dword [rbp + 0x87c], 0x92a0
lea rbx, [rbp + 0x878]
mov edx, dword [rbx]
mov ecx, edi
call fcn.140001be0
add rbx, 4
lea rax, [rbp + 0x880]
cmp rbx, rax
jne 0x140003af6
lea rdx, str.____BYPASSED__Inject_cheat_and_play_now._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xa0], r15
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x9c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xb0], rax
cmp qword [rbp + 0x130], 0
je 0x140003bba
lea rcx, [rbp + 0x120]
mov rax, qword [rbp + 0xc8]
cmp qword [rax], rcx
jne 0x140003bba
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x138]
mov qword [rax], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x100]
mov dword [rax], edx
cmp byte [rbp + 0x12c], 0
je 0x140003bcf
lea rcx, [rbp + 0xb0]
call fcn.140006550
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x140003c5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp + 0x630]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003a90
jmp 0x140003ace
call fcn.1400083f0
movdqa xmm0, xmmword [0x14000b480]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], r14w
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140003cb9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003cb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
mov rcx, qword [rbp + 0xca0]
xor rcx, rsp
call fcn.1400083d0
lea r11, [rsp + 0xdb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret