Function at 0x140343460
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov rax, qword [0x14057b900]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov rsi, r9
mov rdi, r8
mov r14d, edx
xor r12d, r12d
xor r15b, r15b
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x40], r12
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x100]
call fcn.1403ec370
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [0x140516800]
movdqu xmmword [rbp + 0xc0], xmm1
mov word [rbp + 0xb0], r12w
test r14d, r14d
jne 0x14034359d
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140343502
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x3f
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, str.:_Not_starting_program_in_session_0
call fcn.140021910
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140344179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140344174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403441e9
jmp 0x140344174
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x48]
mov edx, 0x20028
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140343693
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1403435d6
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x47
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_OpenProcessToken:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140344179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140344174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403441ef
jmp 0x140344174
lea r8, [rbp + 0xd0]
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1403437d4
mov dword [rbp + 0x70], 1
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0x74], rax
mov dword [rbp + 0x7c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x70]
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1403438b1
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140343708
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x52
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_AdjustTokenPrivileges:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
lea rdx, str.._Continuing...
call fcn.140021910
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x1403438b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403438ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403441f5
jmp 0x1403438ac
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1403437ed
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x56
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_LookupPrivilegeValue:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
lea rdx, str.._Continuing...
call fcn.140021910
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x1403438b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403438ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344207
call fcn.14014f510
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x50]
mov ecx, r14d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x140343fd8
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140343fd8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov dword [rbp], 0x68
lea rax, str.winsta0default
mov qword [rbp + 0x10], rax
mov qword [rbp - 0x30], r12
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140343a27
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14034396a
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x7c
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_DuplicateTokenEx:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140344179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140344174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403441fb
jmp 0x140344174
xor r8d, r8d
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x40]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140343ef1
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x140516800]
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], r12w
movups xmmword [rbp + 0xd8], xmm0
movdqu xmmword [rbp + 0xe8], xmm1
mov word [rbp + 0xd8], r12w
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0x90]
mov rcx, rdi
call fcn.140085b60
mov rcx, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x14034420d
cmp qword [rdi + 0x18], 7
jbe 0x140343ab4
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea r9, [0x1404df774]
lea rcx, [rbp + 0x70]
call fcn.14001d800
nop
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140343b1d
lea rax, [rcx + 2]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x70]
cmp rdx, 7
cmova rax, qword [rbp + 0x70]
mov dword [rax + rcx*2], 0x200022
mov word [rax + rcx*2 + 4], r12w
lea rax, [rbp + 0x70]
jmp 0x140343b41
mov qword [rsp + 0x20], 2
lea r9, [0x1404df778]
movzx r8d, byte [rsp + 0x60]
mov edx, 2
lea rcx, [rbp + 0x70]
call fcn.14001da20
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x140343b7d
mov rsi, qword [rsi]
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14001dc00
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb0]
call fcn.14001f2e0
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140343bfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343bf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344213
call fcn.14014f510
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140343c3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343c38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344219
call fcn.14014f510
movdqa xmm0, xmmword [0x140516800]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140343c92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343c8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14034421f
call fcn.14014f510
lea r8, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r8, qword [rbp + 0xb0]
mov edx, 0x208
lea rcx, [rbp + 0x100]
call fcn.1401694d0
lea rax, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rax, qword [rbp + 0x90]
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r12d
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x100]
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140343d3e
mov r15b, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140343e0c
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140343d57
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0xa8
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_CreateProcessAsUser:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140343e0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343e07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344225
call fcn.14014f510
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140343e1b
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x140343e76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14034422b
call fcn.14014f510
movdqa xmm0, xmmword [0x140516800]
movdqu xmmword [rbp + 0xe8], xmm0
mov word [rbp + 0xd8], r12w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x140343ed4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343ecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344231
call fcn.14014f510
movdqa xmm0, xmmword [0x140516800]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r12w
jmp 0x14034417c
lea rcx, [rsp + 0x68]
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140343f0a
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x87
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_CreateEnvironmentBlock:
call fcn.140021910
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140343fbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140343fba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344237
call fcn.14014f510
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140344179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x68]
cmp eax, 0x3f0
jne 0x1403440b9
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140344004
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x60
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.No_User_logged_on_for_session
call fcn.140021910
mov edx, r14d
mov rcx, rax
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140344179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140344174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140344201
jmp 0x140344174
call fcn.140067d40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1403440cd
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x140594d50]
call fcn.14001df00
lea rdx, str.D:JenkinsworkspaceN_MB5_InstallerService_srcAppStarter.cpp
mov rcx, rax
call fcn.140021910
mov rcx, rax
lea rdx, [0x1404df780]
call fcn.140021910
mov edx, 0x64
mov rcx, rax
call fcn.140020fa0
mov rcx, rax
lea rdx, [0x1404dec48]
call fcn.140021910
mov rcx, rax
lea rdx, str.Error_calling_WTSQueryUserToken:
call fcn.140021910
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
mov rcx, rax
call fcn.14001d5c0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140344179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140344174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14034423d
call fcn.14014f510
xor r15b, r15b
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x1403441be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1403441b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1403441e3
call fcn.14014f510
movzx eax, r15b
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.14014f4f0
add rsp, 0x620
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14015fa1c
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
int3
call fcn.14015fa1c
int3
call fcn.14015fa1c
int3
call fcn.14015fa1c
int3
call fcn.14015fa1c
nop
call fcn.14001cc60
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
int3
call fcn.14015fa1c
nop
call fcn.14015fa1c
nop
call fcn.14015fa1c
int3
call fcn.14015fa1c
int3
call fcn.14015fa1c
int3