Function at 0x180018fc0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1800ed9d0
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x12c0], rbx
movaps xmmword [rsp + 0x1270], xmm6
movaps xmmword [rsp + 0x1260], xmm7
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r14, r8
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x60], esi
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
cmp qword [0x1801c12b8], rsi
je 0x180019135
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], sil
je 0x180019135
cmp dword [rax + 0x80], 4
jb 0x180019135
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180019089
mov r9, qword [r14]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180019096
mov r8, qword [r15]
lea rdx, str.iePathName
lea rcx, [rbp + 0x10]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x26d
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x1800190e4
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019124
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001911f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8ca
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
lea rdi, [r15 + 0x10]
cmp qword [rdi], 0
jne 0x180019146
xor al, al
jmp 0x18001a890
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180019153
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
jne 0x18001916e
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x18001916e
mov rbx, qword [r15]
lea rdx, [0x180161fa8]
mov rcx, rbx
call fcn.18010e9d0
mov r13d, 1
test eax, eax
je 0x1800191db
lea rdx, [0x180161f88]
mov rcx, rbx
call fcn.18010e9d0
test eax, eax
je 0x1800191db
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.18010e9d0
test eax, eax
je 0x1800191db
lea rdx, [0x180162008]
mov rcx, rbx
call fcn.18010e9d0
test eax, eax
je 0x1800191db
lea rdx, str.360chromeX.exe
mov rcx, rbx
call fcn.18010e9d0
test eax, eax
je 0x1800191db
mov r12d, esi
jmp 0x180019bb6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movdqu xmmword [rbp + 0xa0], xmm0
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], si
mov r8d, 0xe
lea rdx, str.2345SafeCenter
lea rcx, [rbp + 0x90]
call fcn.180004930
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call fcn.180004930
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x180019293
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001928e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8d0
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.180040570
nop
cmp qword [rbp + 0x80], 0
jne 0x180019365
lea rcx, [rbp + 0xd0]
call fcn.180020a70
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180019308
lea rcx, [rbp + 0x70]
call fcn.1800048a0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001934e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8d6
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
mov r8d, 0x12
lea rdx, str.2345SFWebShell.exe
lea rcx, [rbp + 0xd0]
call fcn.180004930
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.1800a8830
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x1800193eb
lea rcx, [rbp + 0x70]
call fcn.1800048a0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18001942b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019426
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8dc
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019482
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001947d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8e2
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
cmp qword [0x1801c12b8], 0
je 0x1800195a1
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], 0
je 0x1800195a1
cmp dword [rax + 0x80], 4
jb 0x1800195a1
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str.mid_fpath___ws
lea rcx, [rbp + 0x10]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x27f
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x180019550
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019590
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001958b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8e8
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
xor sil, sil
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.18010be50
xor edx, edx
mov r8d, 0x804
lea rcx, [rbp + 0x940]
call fcn.18010be50
lea rdx, [rbp + 0x140]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x140]
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800196e1
xor edx, edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800196e1
lea r8, [rbp + 0x140]
mov edx, 0x402
lea rcx, [rbp + 0x940]
call fcn.180111a24
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xd0]
call fcn.18010be50
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._d.exe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800196e1
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800196c3
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x70]
call fcn.180004930
mov sil, 1
lea rcx, [rbp + 0x70]
call fcn.18009eca0
test al, al
je 0x180019b4f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm1
xor r12d, r12d
mov word [rbp + 0x10], r12w
mov r13d, 1
mov r8d, r13d
lea rdx, [0x180163780]
lea rcx, [rbp + 0x10]
call fcn.180004930
nop
cmp qword [r15 + 0x18], 8
jb 0x180019733
mov r15, qword [r15]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180019775
lea rdi, [rdx + rcx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r15
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x180019786
mov qword [rsp + 0x20], rdx
mov r9, r15
lea rcx, [rbp + 0x10]
call fcn.18000d4b0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1800197cc
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180163878]
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x1800197e4
mov qword [rsp + 0x20], r13
lea r9, [0x180163878]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d4b0
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1800197f1
mov r9, qword [r14]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180019834
lea rdi, [rcx + rdx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x180019842
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x10]
call fcn.18000d4b0
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x28]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x180019888
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r9, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180163780]
call fcn.18010b9f0
mov word [rbx + rdi*2], r12w
jmp 0x1800198a0
mov qword [rsp + 0x20], r13
lea r9, [0x180163780]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d4b0
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x1800199f5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], r12w
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str._vz_:N
lea rcx, [rbp + 0xd0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2a2
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180019997
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x1800199dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800199d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8ee
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r12w
test sil, sil
je 0x180019a8b
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180019a8b
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor edx, edx
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rbp + 0xd8], 3
mov dword [rbp + 0xf0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0xd0], r12
lea rax, [rbp + 0x940]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov eax, 0x614
mov dword [rbp + 0xf4], r13d
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rdi, 0x20
seta bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019ad2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019acd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8f4
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019b27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019b22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8fa
call fcn.1800ecd20
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x50]
call fcn.1800048a0
movzx eax, bl
jmp 0x18001a890
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019b92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019b8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a900
call fcn.1800ecd20
xor esi, esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rcx, [rbp + 0x50]
call fcn.1800048a0
mov r12d, r13d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, r15
lea rdx, [0x180163780]
lea rcx, [rbp + 0xd0]
call fcn.1800130f0
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180019c2f
lea rsi, [rcx + 2]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x180019c0f
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 4
lea rdx, [0x1801638a8]
call fcn.18010b9f0
xor eax, eax
mov word [rdi + rsi*2], ax
xor esi, esi
jmp 0x180019c4f
mov qword [rsp + 0x20], 2
lea r9, [0x1801638a8]
mov edx, 2
mov rcx, rbx
call fcn.18000d4b0
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm7, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm7
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp + 0x60], xmm6
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x60], r13d
lea rcx, [rbp + 0x30]
call fcn.1800048a0
movups xmmword [rbp + 0x30], xmm7
movups xmmword [rbp + 0x40], xmm6
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov eax, r13d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019cf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019cf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a906
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.180011e10
nop
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x180019df8
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x180019d88
lea rax, [rdi + rsi]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x30]
lea r8, [rdi + rdi]
lea rcx, [rbx + rsi*2]
mov rdx, r9
call fcn.18010b9f0
lea rax, [rdi + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x180019d9b
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.18000d4b0
xor esi, esi
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019de0
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x18016164c]
call fcn.18010b9f0
mov word [rbx + rdi*2], si
jmp 0x180019df8
mov qword [rsp + 0x20], r13
lea r9, [0x18016164c]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d4b0
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180019eff
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0xd0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2c7
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180019ea2
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019ee8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a90c
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.18000cae0
nop
lea rcx, [rbp + 0x10]
call fcn.18009d380
lea r10, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r10, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp rax, 0x11
jb 0x180019f92
lea r11, [rax - 0x10]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rbx, str.2345explorer.exe
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x180019f92
cmp word [rcx], 0x5c
je 0x180019f5b
add rcx, 2
sub rax, 1
jmp 0x180019f49
test rcx, rcx
je 0x180019f92
mov r8d, 0x11
mov rdx, rbx
mov r9, rcx
sub r9, rbx
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x180019f8c
add rdx, 2
sub r8, 1
jne 0x180019f70
sub rcx, r10
sar rcx, 1
jmp 0x180019f99
add rcx, 2
jmp 0x180019f40
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a05d
mov r8, qword [r14 + 0x10]
test r8, r8
jne 0x18001a042
mov r8, qword [rbp + 0x40]
mov rdi, r8
cmp r8, 1
jb 0x18001a02d
mov rbx, rsi
test r8, r8
je 0x180019ffb
cmp r8, rbx
jbe 0x18001a8c4
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
movzx edx, word [rax + rbx*2]
lea rcx, [0x18016164c]
call fcn.18010b3b8
mov r8, qword [rbp + 0x40]
test rax, rax
je 0x180019ffb
inc rbx
cmp rbx, rdi
jb 0x180019fc3
test rbx, rbx
je 0x18001a02d
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
sub r8, rbx
mov qword [rbp + 0x40], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010b9f0
lea rdx, [0x18016164c]
lea rcx, [rbp + 0x30]
call fcn.18009d1f0
jmp 0x18001a13c
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a04f
mov rdx, qword [r14]
lea rcx, [rbp + 0x30]
call fcn.18000ce30
jmp 0x18001a13c
cmp qword [r14 + 0x10], 0
je 0x18001a13c
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a0ad
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180163780]
call fcn.18010b9f0
mov word [rbx + rdi*2], si
jmp 0x18001a0c5
mov qword [rsp + 0x20], r13
lea r9, [0x180163780]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d4b0
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a0d2
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp + 0x30]
call fcn.18000ce30
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a124
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180163780]
call fcn.18010b9f0
mov word [rbx + rdi*2], si
jmp 0x18001a13c
mov qword [rsp + 0x20], r13
lea r9, [0x180163780]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d4b0
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18001a1dd
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0x50]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2e1
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x18001a1d4
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x60]
call fcn.18010be50
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], r13d
mov word [rbp - 0x20], r13w
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x18001a22e
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18001a2d3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
cmp qword [r14 + 0x18], 8
jb 0x18001a26c
mov r14, qword [r14]
mov r9, r14
mov r8d, r12d
lea rdx, [0x1801638d0]
lea rcx, [rbp + 0x50]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2f2
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x18001a2c8
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
jmp 0x18001a2da
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r14d, esi
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.18000cae0
nop
lea rcx, [rbp + 0xd0]
call fcn.18009d380
lea r10, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae r10, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
cmp rax, 0xc
jb 0x18001a392
lea r11, [rax - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rdi, str.iexplore.exe
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x18001a392
cmp word [rcx], 0x69
je 0x18001a35b
add rcx, 2
sub rax, 1
jmp 0x18001a349
test rcx, rcx
je 0x18001a392
mov r8d, 0xc
mov rdx, rdi
mov r9, rcx
sub r9, rdi
nop
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x18001a38c
add rdx, 2
sub r8, 1
jne 0x18001a370
sub rcx, r10
sar rcx, 1
jmp 0x18001a399
add rcx, 2
jmp 0x18001a340
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a677
call fcn.18001caf0
lea rdx, [rbp - 0x70]
call fcn.18001cba0
nop
lea rcx, [rsp + 0x70]
cmp rcx, rax
je 0x18001a3c5
mov rbx, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x18001a3d6
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 4
lea rcx, [0x1801c12b8]
test al, al
jne 0x18001a496
call fcn.1800ce980
mov edi, eax
test eax, eax
je 0x18001a475
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0x1e
lea rdx, str.ShellExecuteLoadWeb:
lea rcx, [rbp + 0x50]
call fcn.180004930
mov dword [rsp + 0x28], 0x2ff
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp edi, 1
jbe 0x18001a46c
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
mov rcx, rbx
mov rbx, rsi
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a677
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
jmp 0x18001a677
call fcn.1800ce980
mov edi, eax
test eax, eax
je 0x18001a518
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0xc
lea rdx, [0x1801639b0]
lea rcx, [rbp + 0x50]
call fcn.180004930
mov dword [rsp + 0x28], 0x304
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp edi, 1
jbe 0x18001a50f
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x18001a530
mov r15, qword [r15]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9b, 1
movzx r8d, r9b
mov rdx, r15
mov rcx, rbx
call qword [rax + 0x18]
mov r14d, eax
mov edx, 4
lea rcx, [0x1801c12b8]
test eax, eax
jne 0x18001a5e6
call fcn.1800ce980
mov edi, eax
test eax, eax
je 0x18001a677
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.isDriverProtectOk___d_err___x
lea rcx, [rbp + 0x50]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x308
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r14 + 4]
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp edi, 1
jbe 0x18001a5e1
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
jmp 0x18001a66e
call fcn.1800ce980
mov edi, eax
test eax, eax
je 0x18001a677
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r9, qword [rbp + 0x30]
mov r8d, r14d
lea rdx, str.isDriverProtectOk___d_cmd___ws
lea rcx, [rbp + 0x50]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp edi, 1
jbe 0x18001a66e
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
cmp qword [rsp + 0x68], 0
je 0x18001a717
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001a6b7
cmp byte [rax], 0xe9
jne 0x18001a6b7
mov edx, 0x14
mov rcx, rax
call fcn.180134d00
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x18001a75e
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test dil, dil
je 0x18001a784
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x18001a794
mov edx, 0x2710
jmp 0x18001a78b
test r14d, r14d
je 0x18001a794
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov esi, eax
xor r15d, r15d
test eax, eax
je 0x18001a826
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r15w
movzx r9d, dil
mov r8d, r14d
lea rdx, str.JumpToProtectMainPage___
lea rcx, [rbp + 0x50]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r15 + 4]
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp esi, 1
jbe 0x18001a81d
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x50]
call fcn.1800048a0
test rbx, rbx
je 0x18001a84d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, r15
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a84d
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
nop
lea rcx, [rbp + 0xd0]
call fcn.1800048a0
nop
test rbx, rbx
je 0x18001a86c
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rbx
call qword [r8]
nop
lea rcx, [rbp + 0x10]
call fcn.1800048a0
nop
lea rcx, [rbp + 0xb0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x30]
call fcn.1800048a0
movzx eax, dil
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1800eccc0
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180012f80
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3