Function at 0x14017d490
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rbx
lea rbp, [rax - 0x288]
sub rsp, 0x378
mov qword [rax + 8], rsi
mov ebx, 1
mov qword [rax - 0x18], rdi
mov rsi, rdx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov r14, rcx
mov qword [rax - 0x38], r15
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
mov eax, dword [0x1402e4068]
mov qword [rsp + 0x30], 0
mov dword [rbp + 0x2a8], ebx
cmp eax, 0xffffffff
jne 0x14017d562
lea rcx, str.MONERO_USE_SOFTWARE_AES
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14017d548
cmp byte [rax], 0x30
jne 0x14017d533
cmp byte [rax + 1], 0
je 0x14017d548
cmp byte [rax], 0x6e
jne 0x14017d544
cmp byte [rax + 1], 0x6f
jne 0x14017d544
cmp byte [rax + 2], 0
je 0x14017d548
mov edx, ebx
jmp 0x14017d54a
xor edx, edx
lea rcx, str.AES:__d_n
mov dword [0x1402e4068], edx
call fcn.14017e1d0
mov eax, dword [0x1402e4068]
test eax, eax
jne 0x14017d597
mov ecx, dword [0x1402e406c]
test ecx, ecx
jns 0x14017d595
xor ecx, ecx
mov eax, ebx
cpuid
and ecx, 0x2000000
mov dword [rsp + 0x54], ebx
mov dword [0x1402e406c], ecx
test ecx, ecx
mov dword [rsp + 0x50], eax
mov ebx, 1
mov dword [rsp + 0x5c], edx
jne 0x14017d59f
xor ebx, ebx
mov dword [rbp + 0x2a8], ebx
mov rax, qword gs:[0x58]
mov ecx, dword [0x1402f5608]
mov edx, 8
mov rdi, qword [rax + rcx*8]
add rdi, rdx
mov qword [rbp - 0x18], rdi
mov rax, qword [rdi]
mov qword [rbp - 0x20], rax
mov r15, rax
test rax, rax
jne 0x14017d5de
mov ecx, 0x40000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
mov r15, rax
movaps xmmword [rsp + 0x2c0], xmm14
lea rcx, [rbp - 0x10]
mov r8, rsi
movaps xmmword [rsp + 0x2b0], xmm15
mov rdx, r14
call fcn.14017c6a0
movups xmm6, xmmword [rbp + 0x30]
movups xmm7, xmmword [rbp + 0x40]
movups xmm8, xmmword [rbp + 0x50]
movups xmm9, xmmword [rbp + 0x60]
movups xmm10, xmmword [rbp + 0x70]
movups xmm11, xmmword [rbp + 0x80]
movups xmm12, xmmword [rbp + 0x90]
movups xmm13, xmmword [rbp + 0xa0]
movdqu xmmword [rsp + 0x60], xmm6
movdqu xmmword [rsp + 0x70], xmm7
movdqu xmmword [rbp - 0x80], xmm8
movdqu xmmword [rbp - 0x70], xmm9
movdqu xmmword [rbp - 0x60], xmm10
movdqu xmmword [rbp - 0x50], xmm11
movdqu xmmword [rbp - 0x40], xmm12
movdqu xmmword [rbp - 0x30], xmm13
test ebx, ebx
je 0x14017d90f
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x10]
call fcn.14017c850
movdqa xmm0, xmmword [rbp + 0x150]
mov r14d, 0x800
movdqa xmm1, xmmword [rbp + 0x140]
mov ecx, r14d
movdqa xmm2, xmmword [rbp + 0x130]
mov rax, r15
movdqa xmm3, xmmword [rbp + 0x120]
movdqa xmm4, xmmword [rbp + 0x110]
movdqa xmm5, xmmword [rbp + 0x100]
movdqa xmm14, xmmword [rbp + 0xf0]
movdqa xmm15, xmmword [rbp + 0xe0]
aesenc xmm6, xmmword [rbp + 0xc0]
aesenc xmm7, xmmword [rbp + 0xc0]
aesenc xmm8, xmmword [rbp + 0xc0]
aesenc xmm9, xmmword [rbp + 0xc0]
aesenc xmm10, xmmword [rbp + 0xc0]
aesenc xmm11, xmmword [rbp + 0xc0]
aesenc xmm12, xmmword [rbp + 0xc0]
aesenc xmm13, xmmword [rbp + 0xc0]
aesenc xmm6, xmmword [rbp + 0xd0]
aesenc xmm7, xmmword [rbp + 0xd0]
aesenc xmm8, xmmword [rbp + 0xd0]
aesenc xmm9, xmmword [rbp + 0xd0]
aesenc xmm10, xmmword [rbp + 0xd0]
aesenc xmm11, xmmword [rbp + 0xd0]
aesenc xmm12, xmmword [rbp + 0xd0]
aesenc xmm13, xmmword [rbp + 0xd0]
aesenc xmm6, xmm15
aesenc xmm7, xmm15
aesenc xmm8, xmm15
aesenc xmm9, xmm15
aesenc xmm10, xmm15
aesenc xmm11, xmm15
aesenc xmm12, xmm15
aesenc xmm13, xmm15
aesenc xmm6, xmm14
aesenc xmm7, xmm14
aesenc xmm8, xmm14
aesenc xmm9, xmm14
aesenc xmm10, xmm14
aesenc xmm11, xmm14
aesenc xmm12, xmm14
aesenc xmm13, xmm14
aesenc xmm6, xmm5
aesenc xmm7, xmm5
aesenc xmm8, xmm5
aesenc xmm9, xmm5
aesenc xmm10, xmm5
aesenc xmm11, xmm5
aesenc xmm12, xmm5
aesenc xmm13, xmm5
aesenc xmm6, xmm4
aesenc xmm7, xmm4
aesenc xmm8, xmm4
aesenc xmm9, xmm4
aesenc xmm10, xmm4
aesenc xmm11, xmm4
aesenc xmm12, xmm4
aesenc xmm13, xmm4
aesenc xmm6, xmm3
aesenc xmm7, xmm3
aesenc xmm8, xmm3
aesenc xmm9, xmm3
aesenc xmm10, xmm3
aesenc xmm11, xmm3
aesenc xmm12, xmm3
aesenc xmm13, xmm3
aesenc xmm6, xmm2
aesenc xmm7, xmm2
aesenc xmm8, xmm2
aesenc xmm9, xmm2
aesenc xmm10, xmm2
aesenc xmm11, xmm2
aesenc xmm12, xmm2
aesenc xmm13, xmm2
aesenc xmm6, xmm1
aesenc xmm6, xmm0
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenc xmm10, xmm1
aesenc xmm11, xmm1
aesenc xmm12, xmm1
aesenc xmm13, xmm1
movups xmmword [rax], xmm6
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
aesenc xmm10, xmm0
aesenc xmm11, xmm0
aesenc xmm12, xmm0
aesenc xmm13, xmm0
movups xmmword [rax + 0x10], xmm7
movups xmmword [rax + 0x20], xmm8
movups xmmword [rax + 0x30], xmm9
movups xmmword [rax + 0x40], xmm10
movups xmmword [rax + 0x50], xmm11
movups xmmword [rax + 0x60], xmm12
movups xmmword [rax + 0x70], xmm13
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x14017d6c4
jmp 0x14017d9d0
call fcn.14017ea90
mov r8d, 0x20
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x10]
mov rcx, rax
call fcn.14017ec40
mov r14d, 0x800
mov rdi, r15
mov r12d, r14d
nop word [rax + rax]
lea rbx, [rsp + 0x60]
mov esi, 8
nop word [rax + rax]
mov rax, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [rax]
mov r8, qword [r8 + 0x18]
call fcn.14017ca80
add rbx, 0x10
sub rsi, 1
jne 0x14017d950
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rdi + 0x10], xmm1
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rdi + 0x50], xmm1
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm1
sub rdi, 0xffffffffffffff80
sub r12, 1
jne 0x14017d940
mov ebx, dword [rbp + 0x2a8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp + 0x20]
lea rdi, [0x140000000]
xor rax, qword [rbp]
mov r12, qword [rbp - 0x10]
xor r12, qword [rbp + 0x10]
mov r13, qword [rbp + 0x18]
xor r13, qword [rbp - 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 8]
xor rax, qword [rbp + 0x28]
mov qword [rsp + 0x48], rax
movdqa xmm3, xmmword [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
test ebx, ebx
je 0x14017ddd0
movdqa xmm0, xmmword [rsp + 0x20]
mov r8d, 0x10000
nop word [rax + rax]
mov rax, r12
and eax, 0x3fff0
movdqu xmm1, xmmword [rax + r15]
aesenc xmm1, xmm0
movq rdx, xmm1
movdqa xmm0, xmm1
pxor xmm0, xmm3
mov rbx, rdx
movdqu xmmword [rax + r15], xmm0
and ebx, 0x3fff0
add rbx, r15
movdqa xmm3, xmm1
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x40], rax
mul rdx
mov qword [rsp + 0x48], rcx
add r12, rdx
add r13, rax
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x40]
mov qword [rbx], r12
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rbx + 8], r13
sub r8, 1
je 0x14017dab8
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
jmp 0x14017da30
movups xmm6, xmmword [rbp + 0x30]
lea rdx, [rbp + 0xc0]
movups xmm7, xmmword [rbp + 0x40]
lea rcx, [rbp + 0x10]
movups xmm8, xmmword [rbp + 0x50]
movups xmm9, xmmword [rbp + 0x60]
movups xmm10, xmmword [rbp + 0x70]
movups xmm11, xmmword [rbp + 0x80]
movups xmm12, xmmword [rbp + 0x90]
movups xmm13, xmmword [rbp + 0xa0]
call fcn.14017c850
movdqa xmm1, xmmword [rbp + 0x150]
add r15, 0x20
movdqa xmm2, xmmword [rbp + 0x140]
movdqa xmm3, xmmword [rbp + 0x130]
movdqa xmm4, xmmword [rbp + 0x120]
movdqa xmm5, xmmword [rbp + 0x110]
movdqa xmm14, xmmword [rbp + 0x100]
movdqa xmm15, xmmword [rbp + 0xf0]
movdqu xmm0, xmmword [r15 - 0x20]
pxor xmm6, xmm0
aesenc xmm6, xmmword [rbp + 0xc0]
aesenc xmm6, xmmword [rbp + 0xd0]
aesenc xmm6, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15 - 0x10]
aesenc xmm6, xmm15
pxor xmm7, xmm0
aesenc xmm7, xmmword [rbp + 0xc0]
aesenc xmm7, xmmword [rbp + 0xd0]
aesenc xmm7, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15]
aesenc xmm7, xmm15
pxor xmm8, xmm0
aesenc xmm8, xmmword [rbp + 0xc0]
aesenc xmm8, xmmword [rbp + 0xd0]
aesenc xmm8, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15 + 0x10]
aesenc xmm8, xmm15
pxor xmm9, xmm0
aesenc xmm9, xmmword [rbp + 0xc0]
aesenc xmm9, xmmword [rbp + 0xd0]
aesenc xmm9, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15 + 0x20]
aesenc xmm9, xmm15
pxor xmm10, xmm0
aesenc xmm10, xmmword [rbp + 0xc0]
aesenc xmm10, xmmword [rbp + 0xd0]
aesenc xmm10, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15 + 0x30]
aesenc xmm10, xmm15
pxor xmm11, xmm0
aesenc xmm11, xmmword [rbp + 0xc0]
aesenc xmm11, xmmword [rbp + 0xd0]
aesenc xmm11, xmmword [rbp + 0xe0]
movdqu xmm0, xmmword [r15 + 0x40]
aesenc xmm11, xmm15
pxor xmm12, xmm0
aesenc xmm12, xmmword [rbp + 0xc0]
aesenc xmm12, xmmword [rbp + 0xd0]
aesenc xmm12, xmmword [rbp + 0xe0]
aesenc xmm11, xmm14
aesenc xmm6, xmm14
aesenc xmm7, xmm14
aesenc xmm8, xmm14
aesenc xmm9, xmm14
aesenc xmm10, xmm14
aesenc xmm11, xmm5
aesenc xmm6, xmm5
aesenc xmm7, xmm5
aesenc xmm8, xmm5
aesenc xmm9, xmm5
aesenc xmm10, xmm5
aesenc xmm11, xmm4
aesenc xmm6, xmm4
aesenc xmm7, xmm4
aesenc xmm8, xmm4
aesenc xmm9, xmm4
aesenc xmm10, xmm4
aesenc xmm12, xmm15
aesenc xmm11, xmm3
aesenc xmm6, xmm3
aesenc xmm7, xmm3
aesenc xmm8, xmm3
aesenc xmm9, xmm3
aesenc xmm10, xmm3
aesenc xmm12, xmm14
aesenc xmm11, xmm2
aesenc xmm6, xmm2
aesenc xmm7, xmm2
aesenc xmm8, xmm2
aesenc xmm9, xmm2
aesenc xmm10, xmm2
aesenc xmm12, xmm5
aesenc xmm11, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenc xmm10, xmm1
aesenc xmm12, xmm4
movdqu xmm0, xmmword [r15 + 0x50]
lea r15, [r15 + 0x80]
aesenc xmm12, xmm3
pxor xmm13, xmm0
aesenc xmm13, xmmword [rbp + 0xc0]
aesenc xmm13, xmmword [rbp + 0xd0]
aesenc xmm13, xmmword [rbp + 0xe0]
aesenc xmm13, xmm15
aesenc xmm13, xmm14
aesenc xmm13, xmm5
aesenc xmm13, xmm4
aesenc xmm13, xmm3
aesenc xmm13, xmm2
aesenc xmm12, xmm2
aesenc xmm13, xmm1
aesenc xmm12, xmm1
sub r14, 1
jne 0x14017db35
jmp 0x14017e0bd
movdqa xmm2, xmmword [rsp + 0x20]
mov qword [rbp + 0x2a8], 0x10000
lea rbx, [0x140000000]
mov r14, r12
and r14d, 0x3fff0
movdqu xmm0, xmmword [r14 + r15]
pextrd edi, xmm0, 3
pextrd r11d, xmm0, 1
pextrd r10d, xmm0, 2
movq rax, xmm0
movd r8d, xmm0
movzx ecx, al
movdqa xmmword [rsp + 0x50], xmm0
movzx edx, r11b
mov eax, edi
mov esi, dword [rbx + rcx*4 + 0x272fa0]
shr rax, 0x18
mov r9d, dword [rbx + rdx*4 + 0x272fa0]
xor esi, dword [rbx + rax*4 + 0x273ba0]
mov eax, r10d
shr eax, 0x10
movzx ecx, al
mov eax, r11d
shr eax, 8
xor esi, dword [rbx + rcx*4 + 0x2737a0]
movzx ecx, al
movd eax, xmm2
xor esi, dword [rbx + rcx*4 + 0x2733a0]
xor esi, eax
mov eax, edi
shr eax, 0x10
movzx ecx, al
mov eax, r10d
shr eax, 8
mov dword [rsp + 0x50], esi
xor r9d, dword [rbx + rcx*4 + 0x2737a0]
movzx ecx, al
mov eax, r8d
shr rax, 0x18
xor r9d, dword [rbx + rcx*4 + 0x2733a0]
xor r9d, dword [rbx + rax*4 + 0x273ba0]
pextrd eax, xmm2, 1
xor r9d, eax
pextrq rax, xmm0, 1
movzx edx, al
mov eax, edi
shr eax, 8
movzx ecx, al
mov eax, r11d
mov ebx, dword [rbx + rdx*4 + 0x272fa0]
lea rdx, [0x140000000]
shr rax, 0x18
xor ebx, dword [rdx + rcx*4 + 0x2733a0]
shr r11d, 0x10
mov dword [rsp + 0x54], r9d
xor ebx, dword [rdx + rax*4 + 0x273ba0]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
pextrd eax, xmm2, 2
shr r8d, 8
xor ebx, dword [rdx + rcx*4 + 0x2737a0]
xor ebx, eax
movzx ecx, dil
mov dword [rsp + 0x58], ebx
mov eax, r10d
shr rax, 0x18
mov edx, dword [rdx + rcx*4 + 0x272fa0]
lea rcx, [0x140000000]
xor edx, dword [rcx + rax*4 + 0x273ba0]
movzx eax, r11b
xor edx, dword [rcx + rax*4 + 0x2737a0]
movzx eax, r8b
xor edx, dword [rcx + rax*4 + 0x2733a0]
pextrd eax, xmm2, 3
xor edx, eax
mov dword [rsp + 0x5c], edx
movdqa xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
movq rdx, xmm1
pxor xmm0, xmm3
mov rbx, rdx
movdqu xmmword [r14 + r15], xmm0
and ebx, 0x3fff0
movdqa xmm3, xmm1
add rbx, r15
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x40], rax
mul rdx
mov qword [rsp + 0x48], rcx
add r12, rdx
add r13, rax
sub qword [rbp + 0x2a8], 1
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
movdqa xmm2, xmmword [rsp + 0x20]
pxor xmm2, xmmword [rsp + 0x40]
mov qword [rbx], r12
movdqa xmmword [rsp + 0x20], xmm2
mov qword [rbx + 8], r13
je 0x14017dfc1
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
jmp 0x14017dde1
movups xmm0, xmmword [rbp + 0x30]
lea rdx, [rbp + 0x10]
movups xmm1, xmmword [rbp + 0x40]
mov r8d, 0x20
mov rcx, qword [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rsp + 0x70], xmm1
movups xmm1, xmmword [rbp + 0x60]
movups xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp - 0x70], xmm1
movups xmm1, xmmword [rbp + 0x80]
movups xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rbp - 0x50], xmm1
movups xmm1, xmmword [rbp + 0xa0]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm1
call fcn.14017ec40
lea rax, [rsp + 0x68]
mov esi, 0x800
sub r15, rax
nop dword [rax]
lea rbx, [rsp + 0x60]
mov edi, 8
nop word [rax + rax]
mov rax, qword [r15 + rbx + 8]
mov rdx, rbx
xor qword [rbx], rax
mov rcx, rbx
mov rax, qword [r15 + rbx + 0x10]
xor qword [rbx + 8], rax
mov rax, qword [rsp + 0x30]
mov r8, qword [rax]
mov r8, qword [r8 + 0x18]
call fcn.14017ca80
add rbx, 0x10
sub rdi, 1
jne 0x14017e040
sub r15, 0xffffffffffffff80
sub rsi, 1
jne 0x14017e030
lea rcx, [rsp + 0x30]
call fcn.14017eb70
movdqu xmm13, xmmword [rbp - 0x30]
lea rdi, [0x140000000]
movdqu xmm12, xmmword [rbp - 0x40]
movdqu xmm11, xmmword [rbp - 0x50]
movdqu xmm10, xmmword [rbp - 0x60]
movdqu xmm9, xmmword [rbp - 0x70]
movdqu xmm8, xmmword [rbp - 0x80]
movdqu xmm7, xmmword [rsp + 0x70]
movdqu xmm6, xmmword [rsp + 0x60]
lea rcx, [rbp - 0x10]
movups xmmword [rbp + 0x30], xmm6
movups xmmword [rbp + 0x40], xmm7
movups xmmword [rbp + 0x50], xmm8
movups xmmword [rbp + 0x60], xmm9
movups xmmword [rbp + 0x70], xmm10
movups xmmword [rbp + 0x80], xmm11
movups xmmword [rbp + 0x90], xmm12
movups xmmword [rbp + 0xa0], xmm13
call fcn.14017c690
movzx eax, byte [rbp - 0x10]
lea rcx, [rbp - 0x10]
mov r8, qword [rbp + 0x2a0]
and eax, 3
mov edx, 0xc8
call qword [rdi + rax*8 + 0x273fa0]
cmp qword [rbp - 0x20], 0
movaps xmm15, xmmword [rsp + 0x2b0]
movaps xmm14, xmmword [rsp + 0x2c0]
movaps xmm13, xmmword [rsp + 0x2d0]
movaps xmm12, xmmword [rsp + 0x2e0]
movaps xmm11, xmmword [rsp + 0x2f0]
movaps xmm10, xmmword [rsp + 0x300]
movaps xmm9, xmmword [rsp + 0x310]
movaps xmm8, xmmword [rsp + 0x320]
movaps xmm7, xmmword [rsp + 0x330]
movaps xmm6, xmmword [rsp + 0x340]
mov r15, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov r13, qword [rsp + 0x360]
mov r12, qword [rsp + 0x368]
mov rdi, qword [rsp + 0x370]
mov rsi, qword [rsp + 0x390]
jne 0x14017e1bb
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14017e1bb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], 0
add rsp, 0x378
pop rbx
pop rbp
ret