Function at 0x1400a1ef0
Capabilities:
Check if file exists
Encrypt data using dpapi
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2420
call fcn.1400a7800
sub rsp, rax
xor r12d, r12d
test r9, r9
mov rbp, r8
mov rsi, rdx
mov r15, rcx
mov dword [rcx + 8], r12d
je 0x1400a1f2f
mov rdx, r9
jmp 0x1400a2467
lea rcx, [rsp + 0xc22]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0xc20], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1422]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x1420], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1c22]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x1c20], r12w
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0xc20]
mov rdx, rsi
sub rbx, rsi
nop
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rbx + rdx - 2], ax
jne 0x1400a1fa0
lea rcx, [rsp + 0xc20]
mov dx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400a1fd2
mov word [rsp + 0xc20], r12w
jmp 0x1400a1fd6
mov word [rax], r12w
lea rcx, [rsp + 0xc20]
mov dx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x1400a1ff0
mov word [rax], r12w
lea rcx, [rsp + 0x422]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x420], r12w
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xc20]
repne scasw ax, word [rdi]
not rcx
add rcx, 0xb
cmp rcx, 0x3ff
jae 0x1400a20d1
xor ecx, ecx
nop
nop
nop
movzx eax, word [rsp + rcx + 0xc20]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x41e], ax
jne 0x1400a2040
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x420]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400a209d
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x41e], 0x5c
je 0x1400a209d
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Local_State]
mov qword [rdi - 2], rax
mov rax, qword [0x1400a8ab8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400a8ac0]
mov qword [rdi + 0xe], rax
jmp 0x1400a20d9
mov word [rsp + 0x420], ax
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a2459
mov rcx, rsi
nop
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rbx + rcx - 2], ax
jne 0x1400a2100
lea rcx, [rsp + 0xc20]
mov dx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400a2132
mov word [rsp + 0xc20], r12w
jmp 0x1400a2136
mov word [rax], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xc20]
repne scasw ax, word [rdi]
not rcx
add rcx, 0xb
cmp rcx, 0x3ff
jae 0x1400a21f1
xor ecx, ecx
nop
movzx eax, word [rsp + rcx + 0xc20]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x41e], ax
jne 0x1400a2160
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x420]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400a21bd
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x41e], 0x5c
je 0x1400a21bd
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Local_State]
mov qword [rdi - 2], rax
mov rax, qword [0x1400a8ab8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400a8ac0]
mov qword [rdi + 0xe], rax
jmp 0x1400a21f9
mov word [rsp + 0x420], ax
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a2459
xor ecx, ecx
nop
nop
nop
nop
movzx eax, word [rsp + rcx + 0xc20]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x141e], ax
jne 0x1400a2220
lea rcx, [rsp + 0x1420]
mov dx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400a225a
mov word [rsp + 0x1420], r12w
jmp 0x1400a225e
mov word [rax], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1420]
repne scasw ax, word [rdi]
not rcx
add rcx, 0xb
cmp rcx, 0x3ff
jae 0x1400a2321
xor ecx, ecx
nop
nop
nop
movzx eax, word [rsp + rcx + 0x1420]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x41e], ax
jne 0x1400a2290
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x420]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400a22ed
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x41e], 0x5c
je 0x1400a22ed
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Local_State]
mov qword [rdi - 2], rax
mov rax, qword [0x1400a8ab8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400a8ac0]
mov qword [rdi + 0xe], rax
jmp 0x1400a2329
mov word [rsp + 0x420], ax
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a2459
xor ecx, ecx
nop
nop
nop
nop
movzx eax, word [rsp + rcx + 0x1420]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x1c1e], ax
jne 0x1400a2350
lea rcx, [rsp + 0x1c20]
mov dx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x1400a238a
mov word [rsp + 0x1c20], r12w
jmp 0x1400a238e
mov word [rax], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1c20]
repne scasw ax, word [rdi]
not rcx
add rcx, 0xb
cmp rcx, 0x3ff
jae 0x1400a2451
xor ecx, ecx
nop
nop
nop
movzx eax, word [rsp + rcx + 0x1c20]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x41e], ax
jne 0x1400a23c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x420]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400a241d
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x41e], 0x5c
je 0x1400a241d
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400a9734]
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x420]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Local_State]
mov qword [rdi - 2], rax
mov rax, qword [0x1400a8ab8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400a8ac0]
mov qword [rdi + 0xe], rax
jmp 0x1400a2459
mov word [rsp + 0x420], ax
mov r8, rbp
lea rdx, [rsp + 0x420]
mov rcx, r15
call fcn.1400a18b0
xor ebp, ebp
lea rcx, [rsp + 0x311]
xor edx, edx
mov r8d, 0x104
mov r13, rbp
mov qword [rsp + 0xa8], rbp
mov dword [rsp + 0xb0], ebp
mov dword [rsp + 0xb4], 0x1388
mov byte [rsp + 0x310], bpl
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x310]
mov qword [rsp + 0x30], rbp
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8d, [rbp + 6]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x310]
xor r9d, r9d
mov qword [rsp + 0x160], rbp
call fcn.140071d20
mov r14, qword [rsp + 0x160]
test r14, r14
je 0x1400a387b
mov eax, dword [r14 + 0x5c]
lea ebx, [rbp + 1]
mov qword [rsp + 0x2478], rbp
cmp eax, 0xa029a697
je 0x1400a2573
cmp eax, 0x4b771290
je 0x1400a2538
cmp eax, 0xf03b7906
lea r8, str.invalid
jne 0x1400a253f
lea r8, str.unopened
lea rdx, str.API_call_with__s_database_connection_pointer
mov ecx, 0x15
call fcn.140034d20
lea r9, [0x1400b0b4c]
lea rdx, str.misuse_at_line__d_of___.10s_
mov r8d, 0x1a404
mov ecx, 0x15
call fcn.140034d20
jmp 0x1400a2618
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a2582
call qword [0x1400bf098]
lea rax, [rsp + 0x48]
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__is_secure__is_httponly__last_access_utc__encrypted_value_FROM_cookies
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2478]
or r8d, 0xffffffff
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rbp
call fcn.140077770
cmp eax, 0x11
jne 0x1400a25f8
mov rcx, qword [rsp + 0x2478]
call fcn.140077d10
lea rcx, [rsp + 0x48]
lea rax, [rsp + 0x2478]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__is_secure__is_httponly__last_access_utc__encrypted_value_FROM_cookies
mov rcx, r14
xor r9d, r9d
or r8d, 0xffffffff
mov qword [rsp + 0x20], rbp
call fcn.140077770
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a2607
call qword [0x1400bf0a8]
mov rdi, qword [rsp + 0x2478]
test rdi, rdi
jne 0x1400a282a
mov eax, dword [r14 + 0x5c]
mov qword [rsp + 0x2478], rbp
cmp eax, 0xa029a697
je 0x1400a267b
cmp eax, 0x4b771290
je 0x1400a2640
cmp eax, 0xf03b7906
lea r8, str.invalid
jne 0x1400a2647
lea r8, str.unopened
lea rdx, str.API_call_with__s_database_connection_pointer
mov ecx, 0x15
call fcn.140034d20
lea r9, [0x1400b0b4c]
lea rdx, str.misuse_at_line__d_of___.10s_
mov r8d, 0x1a404
mov ecx, 0x15
call fcn.140034d20
jmp 0x1400a2720
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a268a
call qword [0x1400bf098]
lea rax, [rsp + 0x48]
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__secure__httponly__last_access_utc__encrypted_value_FROM_cookies
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2478]
or r8d, 0xffffffff
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rbp
call fcn.140077770
cmp eax, 0x11
jne 0x1400a2700
mov rcx, qword [rsp + 0x2478]
call fcn.140077d10
lea rcx, [rsp + 0x48]
lea rax, [rsp + 0x2478]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__secure__httponly__last_access_utc__encrypted_value_FROM_cookies
mov rcx, r14
xor r9d, r9d
or r8d, 0xffffffff
mov qword [rsp + 0x20], rbp
call fcn.140077770
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a270f
call qword [0x1400bf0a8]
mov rdi, qword [rsp + 0x2478]
test rdi, rdi
jne 0x1400a282a
mov eax, dword [r14 + 0x5c]
mov ebx, ebp
mov qword [rsp + 0x2478], rbp
cmp eax, 0xa029a697
je 0x1400a2785
cmp eax, 0x4b771290
je 0x1400a274a
cmp eax, 0xf03b7906
lea r8, str.invalid
jne 0x1400a2751
lea r8, str.unopened
lea rdx, str.API_call_with__s_database_connection_pointer
mov ecx, 0x15
call fcn.140034d20
lea r9, [0x1400b0b4c]
lea rdx, str.misuse_at_line__d_of___.10s_
mov r8d, 0x1a404
mov ecx, 0x15
call fcn.140034d20
jmp 0x1400a3864
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a2794
call qword [0x1400bf098]
lea rax, [rsp + 0x48]
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__secure__httponly__last_access_utc_FROM_cookies
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2478]
or r8d, 0xffffffff
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], rbp
call fcn.140077770
cmp eax, 0x11
jne 0x1400a280a
mov rcx, qword [rsp + 0x2478]
call fcn.140077d10
lea rcx, [rsp + 0x48]
lea rax, [rsp + 0x2478]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, str.SELECT_creation_utc__host_key__name__value__path__expires_utc__secure__httponly__last_access_utc_FROM_cookies
mov rcx, r14
xor r9d, r9d
or r8d, 0xffffffff
mov qword [rsp + 0x20], rbp
call fcn.140077770
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1400a2819
call qword [0x1400bf0a8]
mov rdi, qword [rsp + 0x2478]
test rdi, rdi
je 0x1400a3864
movsxd r12, ebx
mov rcx, rdi
mov dword [rsp + 0x2460], 1
mov qword [rsp + 0x40], r12
call fcn.14007d1b0
cmp eax, 0x64
jne 0x1400a3854
lea rsi, [0x1400abe78]
test rdi, rdi
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xd8], rbp
mov dword [rsp + 0xe0], ebp
mov dword [rsp + 0xe4], ebp
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xec], ebp
mov dword [rsp + 0xf0], ebp
mov dword [rsp + 0xf4], ebp
mov dword [rsp + 0xf8], ebp
mov dword [rsp + 0xfc], ebp
mov qword [rsp + 0x100], rbp
je 0x1400a292e
cmp qword [rdi + 0x28], 0
je 0x1400a28ec
cmp word [rdi + 0x88], 1
jbe 0x1400a28ec
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a28dd
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x38
jne 0x1400a2931
mov rbx, rbp
jmp 0x1400a2962
mov rax, qword [rdi]
test rax, rax
je 0x1400a292e
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2903
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a292e
test word [rcx + 8], 0x2460
je 0x1400a2928
call fcn.1400198b0
jmp 0x1400a292e
mov word [rcx + 8], 1
mov rcx, rsi
movzx edx, word [rcx + 8]
movzx eax, dx
and ax, 0x202
cmp ax, 0x202
jne 0x1400a294e
cmp byte [rcx + 0xa], 1
jne 0x1400a294e
mov rbx, qword [rcx + 0x10]
jmp 0x1400a2962
test dl, 1
je 0x1400a2958
mov rbx, rbp
jmp 0x1400a2962
mov dl, 1
call fcn.14002c9a0
mov rbx, rax
test rdi, rdi
je 0x1400a29a2
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2985
cmp edx, 0xc0a
je 0x1400a2985
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a298a
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a29a2
call qword [0x1400bf0a8]
test rdi, rdi
mov qword [rsp + 0xd0], rbx
je 0x1400a2a23
cmp qword [rdi + 0x28], 0
je 0x1400a29e1
cmp word [rdi + 0x88], 2
jbe 0x1400a29e1
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a29d2
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x70
jne 0x1400a2a26
mov rbx, rbp
jmp 0x1400a2a57
mov rax, qword [rdi]
test rax, rax
je 0x1400a2a23
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a29f8
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2a23
test word [rcx + 8], 0x2460
je 0x1400a2a1d
call fcn.1400198b0
jmp 0x1400a2a23
mov word [rcx + 8], 1
mov rcx, rsi
movzx edx, word [rcx + 8]
movzx eax, dx
and ax, 0x202
cmp ax, 0x202
jne 0x1400a2a43
cmp byte [rcx + 0xa], 1
jne 0x1400a2a43
mov rbx, qword [rcx + 0x10]
jmp 0x1400a2a57
test dl, 1
je 0x1400a2a4d
mov rbx, rbp
jmp 0x1400a2a57
mov dl, 1
call fcn.14002c9a0
mov rbx, rax
test rdi, rdi
je 0x1400a2a97
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2a7a
cmp edx, 0xc0a
je 0x1400a2a7a
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2a7f
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2a97
call qword [0x1400bf0a8]
test rdi, rdi
mov qword [rsp + 0xc0], rbx
je 0x1400a2b1b
cmp qword [rdi + 0x28], 0
je 0x1400a2ad9
cmp word [rdi + 0x88], 3
jbe 0x1400a2ad9
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2ac7
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0xa8
jne 0x1400a2b1e
mov rbx, rbp
jmp 0x1400a2b4f
mov rax, qword [rdi]
test rax, rax
je 0x1400a2b1b
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2af0
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2b1b
test word [rcx + 8], 0x2460
je 0x1400a2b15
call fcn.1400198b0
jmp 0x1400a2b1b
mov word [rcx + 8], 1
mov rcx, rsi
movzx edx, word [rcx + 8]
movzx eax, dx
and ax, 0x202
cmp ax, 0x202
jne 0x1400a2b3b
cmp byte [rcx + 0xa], 1
jne 0x1400a2b3b
mov rbx, qword [rcx + 0x10]
jmp 0x1400a2b4f
test dl, 1
je 0x1400a2b45
mov rbx, rbp
jmp 0x1400a2b4f
mov dl, 1
call fcn.14002c9a0
mov rbx, rax
test rdi, rdi
je 0x1400a2b8f
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2b72
cmp edx, 0xc0a
je 0x1400a2b72
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2b77
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2b8f
call qword [0x1400bf0a8]
test rdi, rdi
mov qword [rsp + 0xc8], rbx
je 0x1400a2c13
cmp qword [rdi + 0x28], 0
je 0x1400a2bd1
cmp word [rdi + 0x88], 4
jbe 0x1400a2bd1
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2bbf
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0xe0
jne 0x1400a2c16
mov rbx, rbp
jmp 0x1400a2c47
mov rax, qword [rdi]
test rax, rax
je 0x1400a2c13
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2be8
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2c13
test word [rcx + 8], 0x2460
je 0x1400a2c0d
call fcn.1400198b0
jmp 0x1400a2c13
mov word [rcx + 8], 1
mov rcx, rsi
movzx edx, word [rcx + 8]
movzx eax, dx
and ax, 0x202
cmp ax, 0x202
jne 0x1400a2c33
cmp byte [rcx + 0xa], 1
jne 0x1400a2c33
mov rbx, qword [rcx + 0x10]
jmp 0x1400a2c47
test dl, 1
je 0x1400a2c3d
mov rbx, rbp
jmp 0x1400a2c47
mov dl, 1
call fcn.14002c9a0
mov rbx, rax
test rdi, rdi
je 0x1400a2c87
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2c6a
cmp edx, 0xc0a
je 0x1400a2c6a
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2c6f
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2c87
call qword [0x1400bf0a8]
test rdi, rdi
mov qword [rsp + 0xd8], rbx
je 0x1400a2d06
cmp qword [rdi + 0x28], 0
je 0x1400a2cc4
cmp word [rdi + 0x88], 6
jbe 0x1400a2cc4
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2cb7
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x150
jmp 0x1400a2d09
mov rax, qword [rdi]
test rax, rax
je 0x1400a2d06
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2cdb
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2d06
test word [rcx + 8], 0x2460
je 0x1400a2d00
call fcn.1400198b0
jmp 0x1400a2d06
mov word [rcx + 8], 1
mov rcx, rsi
movzx eax, word [rcx + 8]
test al, 4
je 0x1400a2d16
mov rbx, qword [rcx]
jmp 0x1400a2d52
test al, 8
je 0x1400a2d1f
mov rbx, qword [rcx]
jmp 0x1400a2d52
test al, 0x12
je 0x1400a2d4f
movzx r9d, byte [rcx + 0xa]
mov r8d, dword [rcx + 0xc]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x138]
mov qword [rsp + 0x138], rbp
call fcn.14000d740
mov rbx, qword [rsp + 0x138]
jmp 0x1400a2d52
mov rbx, rbp
test rdi, rdi
je 0x1400a2d92
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2d75
cmp edx, 0xc0a
je 0x1400a2d75
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2d7a
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2d92
call qword [0x1400bf0a8]
test ebx, ebx
mov eax, ebp
setne al
test rdi, rdi
mov dword [rsp + 0xe0], eax
je 0x1400a2e17
cmp qword [rdi + 0x28], 0
je 0x1400a2dd5
cmp word [rdi + 0x88], 7
jbe 0x1400a2dd5
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2dc8
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x188
jmp 0x1400a2e1a
mov rax, qword [rdi]
test rax, rax
je 0x1400a2e17
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2dec
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2e17
test word [rcx + 8], 0x2460
je 0x1400a2e11
call fcn.1400198b0
jmp 0x1400a2e17
mov word [rcx + 8], 1
mov rcx, rsi
movzx eax, word [rcx + 8]
test al, 4
je 0x1400a2e27
mov rbx, qword [rcx]
jmp 0x1400a2e63
test al, 8
je 0x1400a2e30
mov rbx, qword [rcx]
jmp 0x1400a2e63
test al, 0x12
je 0x1400a2e60
movzx r9d, byte [rcx + 0xa]
mov r8d, dword [rcx + 0xc]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x128]
mov qword [rsp + 0x128], rbp
call fcn.14000d740
mov rbx, qword [rsp + 0x128]
jmp 0x1400a2e63
mov rbx, rbp
test rdi, rdi
je 0x1400a2ea3
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2e86
cmp edx, 0xc0a
je 0x1400a2e86
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2e8b
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2ea3
call qword [0x1400bf0a8]
test ebx, ebx
mov eax, ebp
setne al
test rdi, rdi
mov dword [rsp + 0xe4], eax
je 0x1400a2f21
cmp qword [rdi + 0x28], 0
je 0x1400a2edf
cmp word [rdi + 0x88], 0
jbe 0x1400a2edf
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2ed9
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
jmp 0x1400a2f24
mov rax, qword [rdi]
test rax, rax
je 0x1400a2f21
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2ef6
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a2f21
test word [rcx + 8], 0x2460
je 0x1400a2f1b
call fcn.1400198b0
jmp 0x1400a2f21
mov word [rcx + 8], 1
mov rcx, rsi
movzx eax, word [rcx + 8]
test al, 4
je 0x1400a2f31
mov rbp, qword [rcx]
jmp 0x1400a2f68
test al, 8
je 0x1400a2f3a
mov rbp, qword [rcx]
jmp 0x1400a2f68
test al, 0x12
je 0x1400a2f68
movzx r9d, byte [rcx + 0xa]
mov r8d, dword [rcx + 0xc]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x110], rbp
call fcn.14000d740
mov rbp, qword [rsp + 0x110]
test rdi, rdi
je 0x1400a301e
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a2f8f
cmp edx, 0xc0a
je 0x1400a2f8f
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a2f94
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2fac
call qword [0x1400bf0a8]
cmp qword [rdi + 0x28], 0
je 0x1400a2fdc
cmp word [rdi + 0x88], 8
jbe 0x1400a2fdc
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2fcf
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x1c0
jmp 0x1400a3021
mov rax, qword [rdi]
test rax, rax
je 0x1400a301e
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a2ff3
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a301e
test word [rcx + 8], 0x2460
je 0x1400a3018
call fcn.1400198b0
jmp 0x1400a301e
mov word [rcx + 8], 1
mov rcx, rsi
movzx eax, word [rcx + 8]
test al, 4
je 0x1400a302e
mov rsi, qword [rcx]
jmp 0x1400a306d
test al, 8
je 0x1400a3037
mov rsi, qword [rcx]
jmp 0x1400a306d
test al, 0x12
je 0x1400a306b
movzx r9d, byte [rcx + 0xa]
mov r8d, dword [rcx + 0xc]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x130], 0
call fcn.14000d740
mov rsi, qword [rsp + 0x130]
jmp 0x1400a306d
xor esi, esi
test rdi, rdi
je 0x1400a3123
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a3094
cmp edx, 0xc0a
je 0x1400a3094
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a3099
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a30b1
call qword [0x1400bf0a8]
cmp qword [rdi + 0x28], 0
je 0x1400a30e1
cmp word [rdi + 0x88], 5
jbe 0x1400a30e1
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a30d4
call qword [0x1400bf098]
mov rcx, qword [rdi + 0x28]
add rcx, 0x118
jmp 0x1400a312a
mov rax, qword [rdi]
test rax, rax
je 0x1400a3123
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a30f8
call qword [0x1400bf098]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x130]
mov dword [rax + 0x44], 0x19
test rcx, rcx
je 0x1400a3123
test word [rcx + 8], 0x2460
je 0x1400a311d
call fcn.1400198b0
jmp 0x1400a3123
mov word [rcx + 8], 1
lea rcx, [0x1400abe78]
movzx eax, word [rcx + 8]
test al, 4
je 0x1400a3137
mov rbx, qword [rcx]
jmp 0x1400a3176
test al, 8
je 0x1400a3140
mov rbx, qword [rcx]
jmp 0x1400a3176
test al, 0x12
je 0x1400a3174
movzx r9d, byte [rcx + 0xa]
mov r8d, dword [rcx + 0xc]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x158]
mov qword [rsp + 0x158], 0
call fcn.14000d740
mov rbx, qword [rsp + 0x158]
jmp 0x1400a3176
xor ebx, ebx
test rdi, rdi
je 0x1400a31b6
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
cmp byte [rcx + 0x51], 0
jne 0x1400a3199
cmp edx, 0xc0a
je 0x1400a3199
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x1400a319e
call fcn.140022000
mov dword [rdi + 0x84], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400a31b6
call qword [0x1400bf0a8]
xor eax, eax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x100], rbp
mov word [rsp + 0x68], 0x641
mov word [rsp + 0x6e], 1
mov word [rsp + 0x6a], 1
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x140]
mov edx, dword [rsp + 0x144]
mov word [rsp + 0x98], 0x641
shl rdx, 0x20
or rdx, rax
lea rax, [rbp + rbp*4]
lea rcx, [rdx + rax*2]
xor eax, eax
lea rdx, [rsp + 0x148]
mov dword [rsp + 0xf0], ecx
shr rcx, 0x20
mov qword [rsp + 0x9a], rax
mov dword [rsp + 0xf4], ecx
lea rcx, [rsp + 0x98]
mov dword [rsp + 0xa2], eax
mov word [rsp + 0xa6], ax
mov word [rsp + 0x9e], 1
mov word [rsp + 0x9a], 1
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x148]
mov edx, dword [rsp + 0x14c]
shl rdx, 0x20
mov word [rsp + 0x78], 0x641
or rdx, rax
lea rax, [rsi + rsi*4]
lea rcx, [rdx + rax*2]
xor eax, eax
lea rdx, [rsp + 0x150]
mov dword [rsp + 0xf8], ecx
shr rcx, 0x20
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0xfc], ecx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov word [rsp + 0x7e], 1
mov word [rsp + 0x7a], 1
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x150]
mov edx, dword [rsp + 0x154]
shl rdx, 0x20
or rdx, rax
lea rax, [rbx + rbx*4]
lea rcx, [rdx + rax*2]
mov dword [rsp + 0xe8], ecx
shr rcx, 0x20
test r12, r12
mov dword [rsp + 0xec], ecx
je 0x1400a382a
mov edx, 9
mov rcx, rdi
call fcn.140033ff0
cmp eax, 0xf
mov r12d, eax
jle 0x1400a3825
mov edx, 9
mov rcx, rdi
call fcn.14002fbd0
test rax, rax
mov rsi, rax
je 0x1400a3825
mov dx, word [rax]
lea rcx, [0x1400a8c50]
cmp dx, word [rcx]
jne 0x1400a3365
mov dl, byte [rax + 2]
cmp dl, byte [rcx + 2]
jne 0x1400a3365
xor eax, eax
jmp 0x1400a336a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1400a373c
cmp dword [r15 + 8], eax
je 0x1400a3825
mov byte [rsp + 0x168], al
xor eax, eax
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x190
mov qword [rsp + 0x169], rax
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
mov byte [rsp + 0x88], al
mov qword [rsp + 0x89], rax
mov dword [rsp + 0x91], eax
mov word [rsp + 0x95], ax
mov byte [rsp + 0x97], al
call sub.msvcrt.dll_memset
mov rcx, qword [0x1400ab738]
lea rdx, [0x1400ab730]
test rcx, rcx
je 0x1400a351b
mov rax, qword [rcx + 0x28]
cmp dword [rax], 2
jne 0x1400a340c
cmp dword [rcx + 8], 0x100
jne 0x1400a340c
cmp dword [rcx + 4], 1
je 0x1400a341e
mov rcx, qword [rdx + 0x18]
add rdx, 0x10
test rcx, rcx
jne 0x1400a33f4
jmp 0x1400a351b
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x1400a351b
cmp dword [rbx + 0x20], 0x10
jne 0x1400a351b
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x1400a3451
mov rax, qword [rsp + 0x180]
mov rdx, qword [rax + 0x28]
call qword [rdx + 0x28]
mov eax, 0x48
lea rcx, [rsp + 0x180]
nop
mov byte [rcx], 0
add rcx, 1
sub rax, 1
jne 0x1400a3460
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rax
mov rax, qword [rbx + 0x28]
call qword [rax + 0x20]
test rax, rax
mov rcx, rax
mov qword [rsp + 0x1c0], rax
je 0x1400a351b
mov qword [rsp + 0x180], rbx
test byte [rbx + 0x1c], 2
jne 0x1400a34e3
cmp dword [rbx + 8], 0x100
jne 0x1400a351b
mov dword [rsp + 0x188], 0x100
mov dword [rsp + 0x18c], 1
mov rax, qword [rbx + 0x28]
lea rdx, [r15 + 0xc]
mov r8d, 0x100
call qword [rax + InitCommonControls]
test eax, eax
jne 0x1400a351b
lea rcx, [rsp + 0x180]
call fcn.1400031f0
lea ebx, [r12 - 0xf]
cmp ebx, 0x10
jle 0x1400a3825
lea edx, [rbx + 0xa]
lea rcx, [rsp + 0xa8]
call fcn.140090d20
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x2f0], rax
xor ebp, ebp
mov qword [rsp + 0x2e8], rax
mov qword [rsp + 0x2f8], rax
mov qword [rsp + 0x300], rax
mov rax, qword [rsi + 3]
mov qword [rsp + 0x2e8], rax
mov eax, dword [rsi + 0xb]
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x2f0], eax
lea rax, [rsp + 0x180]
mov dword [rsp + 0x308], ebp
test rax, rax
mov qword [rsp + 0x2c8], rbp
mov qword [rsp + 0x2d0], rbp
mov byte [rsp + 0x2f7], 1
je 0x1400a368c
mov rax, qword [rsp + 0x180]
test rax, rax
je 0x1400a3694
lea rcx, [rsp + 0x50]
test rcx, rcx
je 0x1400a3694
mov ecx, dword [rax + 4]
mov qword [rsp + 0x50], rbp
cmp ecx, 1
jne 0x1400a361b
cmp dword [rax + 0x20], 0x10
jne 0x1400a3694
mov rax, qword [rax + 0x28]
mov edx, dword [rsp + 0x18c]
mov rcx, qword [rsp + 0x1c0]
lea r9, [rsp + 0x2d8]
lea r8, [rsp + 0x2e8]
mov qword [rsp + 0x50], InitCommonControls
call qword [rax + 8]
test eax, eax
je 0x1400a364d
jmp 0x1400a3649
cmp ecx, 6
jne 0x1400a3694
lea edx, [rcx + 0xa]
mov rcx, qword [rsp + 0x1c0]
lea r9, [rsp + 0x2d8]
lea r8, [rsp + 0x2e8]
mov qword [rsp + 0x50], InitCommonControls
call fcn.140002ff0
test eax, eax
jne 0x1400a368c
lea eax, [rbx - 0x10]
lea r8, [rsi + 0xf]
lea rcx, [rsp + 0x180]
mov r9, r13
movsxd rdx, eax
mov qword [rsp + 0x2d0], rbp
call fcn.140002ff0
test eax, eax
jne 0x1400a368c
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x180]
call fcn.140002ea0
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x1400a36a8
mov rax, qword [rax + 0x28]
call qword [rax + 0x28]
mov eax, 0x48
lea rcx, [rsp + 0x180]
nop
nop
nop
mov byte [rcx], bpl
add rcx, 1
sub rax, 1
jne 0x1400a36c0
mov eax, 0x190
lea rcx, [rsp + 0x180]
nop
nop
mov byte [rcx], bpl
add rcx, 1
sub rax, 1
jne 0x1400a36e0
lea eax, [r12 - 0x10]
movsxd rcx, eax
lea rax, [rsp + 0x88]
mov rdx, qword [rax]
cmp rdx, qword [rcx + rsi]
jne 0x1400a3715
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + rsi + 8]
jne 0x1400a3715
mov eax, ebp
jmp 0x1400a371a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov r12, qword [rsp + 0x40]
jne 0x1400a382c
movsxd rax, ebx
mov byte [rax + r13 - 0x10], bpl
mov qword [rsp + 0xc8], r13
jmp 0x1400a382c
mov rbp, qword [rsp + 0x2470]
xor eax, eax
mov dword [rsp + 0x118], r12d
test rbp, rbp
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x120], rsi
je 0x1400a379d
lea rdx, [rsp + 0x118]
mov rcx, rbp
call fcn.140099130
test eax, eax
je 0x1400a3825
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x118]
mov rcx, rbp
call fcn.14009cb60
xor ebp, ebp
jmp 0x1400a37c8
xor ebp, ebp
lea rax, [rsp + 0x58]
lea rcx, [rsp + 0x118]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1400a381e
cmp qword [rsp + 0x60], 0
je 0x1400a381e
mov edx, dword [rsp + 0x58]
lea rcx, [rsp + 0xa8]
add edx, 0xa
call fcn.140090d20
mov r13, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov edx, dword [rsp + 0x58]
mov byte [rdx + r13], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xc8], r13
mov r12, qword [rsp + 0x40]
jmp 0x1400a382c
mov r12, qword [rsp + 0x40]
xor ebp, ebp
mov rax, qword [r15]
lea rdx, [rsp + 0xc0]
mov rcx, r15
call qword [rax]
mov rcx, rdi
call fcn.14007d1b0
lea rsi, [0x1400abe78]
cmp eax, 0x64
je 0x1400a2855
mov rcx, rdi
call fcn.140077d10
mov r12d, dword [rsp + 0x2460]
xor edx, edx
mov rcx, r14
call fcn.140070150
test r13, r13
je 0x1400a387b
mov rcx, r13
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, r12d
mov rbx, qword [rsp + 0x2468]
add rsp, 0x2420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret