Function at 0x140049b50
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20e0]
mov eax, 0x21e0
call fcn.1400d6730
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2218], rbx
mov qword [rsp + 0x2220], rsi
mov qword [rsp + 0x2228], rdi
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x20d0], rax
mov byte [rsp + 0x40], dl
mov r13, rcx
mov qword [rbp - 0x70], rcx
xor esi, esi
mov dword [rsp + 0x5c], esi
mov eax, dword [0x1401cde68]
test al, 1
jne 0x140049bf3
or eax, 1
mov dword [0x1401cde68], eax
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde70], rax
lea rcx, [0x1401276e0]
call fcn.1400d1d90
nop
mov eax, dword [0x1401cde68]
test al, 2
jne 0x140049c2f
or eax, 2
mov dword [0x1401cde68], eax
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde60], rax
lea rcx, [0x1401276a0]
call fcn.1400d1d90
nop
mov eax, dword [0x1401cde68]
test al, 4
jne 0x140049c6b
or eax, 4
mov dword [0x1401cde68], eax
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde58], rax
lea rcx, [0x140127660]
call fcn.1400d1d90
nop
mov eax, dword [0x1401cde68]
test al, 8
jne 0x140049ca1
or eax, 8
mov dword [0x1401cde68], eax
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde78], rax
lea rcx, [0x140127620]
call fcn.1400d1d90
nop
mov rax, qword [0x1401cde60]
mov ecx, dword [rax - 0x10]
mov ebx, 1
mov rax, qword [0x1401cde78]
mov rdx, qword [0x1401cd180]
test ecx, ecx
je 0x140049d0c
mov ecx, esi
test rdx, rdx
setne cl
test ecx, ecx
jne 0x140049cd9
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, rax
mov r9, rdx
sub r9, rax
movzx r8d, word [rcx]
cmp r8w, word [rcx + r9]
jne 0x140049cfb
add rcx, 2
test r8w, r8w
jne 0x140049ce2
mov ecx, esi
jmp 0x140049cff
sbb ecx, ecx
or ecx, ebx
test ecx, ecx
setne cl
test cl, cl
je 0x14004b211
lea rcx, [rdx - 0x18]
lea rbx, [rax - 0x18]
or r12, 0xffffffffffffffff
cmp rcx, rbx
je 0x140049d64
cmp dword [rbx + 0x10], 0
jl 0x140049d54
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140049d54
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], r12d
jg 0x140049d47
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401cde78], rax
jmp 0x140049d64
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401cde78]
call fcn.1400022c0
mov rax, qword [0x1401cde70]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140049dc2
cmp dword [rdx + 0x10], 0
jge 0x140049d9e
cmp dword [rax - 0xc], 0
jge 0x140049d8f
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401cde70]
mov word [rax], si
jmp 0x140049dc2
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049dae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde70], rax
mov rax, qword [0x1401cde60]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140049e27
cmp dword [rdx + 0x10], 0
jge 0x140049e03
cmp dword [rax - 0xc], 0
jge 0x140049ded
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401cde60]
mov dword [rax - 0x10], esi
mov rax, qword [0x1401cde60]
mov word [rax], si
jmp 0x140049e27
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049e13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde60], rax
mov rax, qword [0x1401cde58]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140049e85
cmp dword [rdx + 0x10], 0
jge 0x140049e61
cmp dword [rax - 0xc], 0
jge 0x140049e52
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401cde58]
mov word [rax], si
jmp 0x140049e85
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049e71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde58], rax
mov r15d, esi
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, 0x104
test eax, eax
jne 0x14004a261
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004a200
mov dword [rsp + 0x30], r14d
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x140049f58
mov edx, 0x82
lea rcx, [rsp + 0x50]
call fcn.1400023b0
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140049fb0
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d226c
test eax, eax
js 0x140049fa5
cmp eax, dword [rdi - 0xc]
jg 0x140049fa5
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x140049ffe
mov ecx, 0x80070057
call fcn.140001920
int3
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140049ffe
cmp dword [rdx + 0x10], 0
jge 0x140049fdc
cmp dword [rdi - 0xc], 0
jge 0x140049fd4
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], esi
mov word [rdi], si
jmp 0x140049ffe
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140049fec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x30], r14d
mov rax, qword [0x1401cde70]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x82
or ecx, edx
jge 0x14004a037
mov edx, 0x82
lea rcx, [0x1401cde70]
call fcn.1400023b0
mov rax, qword [0x1401cde70]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004a0a5
mov rcx, qword [0x1401cde70]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d226c
mov rcx, rax
test eax, eax
js 0x14004a09a
mov rax, qword [0x1401cde70]
cmp ecx, dword [rax - 0xc]
jg 0x14004a09a
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401cde70]
mov word [rax + rcx*2], si
jmp 0x14004a108
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401cde70]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004a108
cmp dword [rdx + 0x10], 0
jge 0x14004a0df
cmp dword [rax - 0xc], 0
jge 0x14004a0d0
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rax - 0x10], esi
mov rax, qword [0x1401cde70]
mov word [rax], si
jmp 0x14004a108
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004a0ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde70], rax
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0x38]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004a135
mov edx, 0x82
lea rcx, [rsp + 0x38]
call fcn.1400023b0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004a192
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d226c
test eax, eax
js 0x14004a187
cmp eax, dword [rbx - 0xc]
jg 0x14004a187
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x14004a1f3
mov ecx, 0x80070057
call fcn.140001920
int3
mov rdx, qword [0x1401cde70]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004a1f3
cmp dword [rbx + 0x10], 0
jl 0x14004a1e5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004a1e5
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004a1d5
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x50]
jmp 0x14004a1f3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400022c0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004a261
mov rdx, qword [0x1401cde70]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004a261
cmp dword [rbx + 0x10], 0
jl 0x14004a253
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004a253
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004a243
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x50]
jmp 0x14004a261
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400022c0
call fcn.140049830
test al, al
je 0x14004a7c7
mov sil, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004a597
mov dword [rsp + 0x30], r14d
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x82
or eax, ecx
jge 0x14004a2cd
mov edx, 0x82
lea rcx, [rsp + 0x50]
call fcn.1400023b0
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
jne 0x14004a432
mov ecx, dword [0x1401cbd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0x10
jne 0x14004a3b3
mov word [rbp + 0x2c0], bx
xor edx, edx
mov r8d, 0x1e06
lea rcx, [rbp + 0x2c2]
call fcn.1400d6ac0
mov r10d, ebx
mov r9d, ebx
mov r8, rbx
nop dword [rax]
test r10, r10
je 0x14004a38d
test r8, r8
je 0x14004a38d
lea rdx, [r8 + r9]
lea rax, [r8 + r9]
movzx ecx, word [rbp + rax*2 + 0x244]
inc cx
add cx, word [rbp + rdx*2 + 0x2be]
mov word [rbp + rdx*2 + 0x2c0], cx
inc r8
cmp r8, 0x3e
jl 0x14004a360
inc r10
add r9, 0x3e
cmp r9, 0xf04
jl 0x14004a356
movsx eax, word [rbp + 0x20c6]
mov dword [0x1401cbd80], eax
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d226c
test eax, eax
js 0x14004a427
cmp eax, dword [rdi - 0xc]
jg 0x14004a427
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], bx
mov ecx, dword [0x1401cbd80]
mov eax, ecx
imul eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x14004a3ed
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xc
jne 0x14004a3fa
dec ecx
mov dword [0x1401cbd80], ecx
xor sil, sil
cmp dword [rdi - 0x10], 0
jl 0x14004a432
lea rdx, str.PMIL
mov rcx, rdi
call fcn.1400d243c
test rax, rax
je 0x14004a432
sub rax, rdi
sar rax, 1
test eax, eax
jne 0x14004a432
lea r15d, [rax + 1]
jmp 0x14004a432
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401cbd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14004a58e
nop word [rax + rax]
call fcn.1400d2038
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 - 0x60], xmm0
inc rbx
cmp rbx, 0x63
jb 0x14004a470
xor ecx, ecx
mov r10d, ecx
lea ebx, [rcx + 0x63]
lea r11d, [rcx + 0x62]
nop dword [rax + rax]
mov edx, 0x62
cmp r10, rdx
jge 0x14004a578
cmp r11, 4
jl 0x14004a54d
lea rcx, [rbp + 0x2a0]
mov r8d, 0x5e
sub r8, r10
shr r8, 2
inc r8
lea rax, [r8*4]
sub rdx, rax
nop word [rax + rax]
movsd xmm0, qword [rcx + 0x10]
movsd xmm1, qword [rcx + 8]
comisd xmm0, xmm1
jbe 0x14004a4fa
movsd qword [rcx + 0x10], xmm1
movsd qword [rcx + 8], xmm0
movsd xmm0, qword [rcx + 8]
movsd xmm1, qword [rcx]
comisd xmm0, xmm1
jbe 0x14004a512
movsd qword [rcx + 8], xmm1
movsd qword [rcx], xmm0
movsd xmm0, qword [rcx]
movsd xmm1, qword [rcx - 8]
comisd xmm0, xmm1
jbe 0x14004a52a
movsd qword [rcx], xmm1
movsd qword [rcx - 8], xmm0
movsd xmm0, qword [rcx - 8]
movsd xmm1, qword [rcx - 0x10]
comisd xmm0, xmm1
jbe 0x14004a544
movsd qword [rcx - 8], xmm1
movsd qword [rcx - 0x10], xmm0
sub rcx, 0x20
dec r8
jne 0x14004a4e0
cmp rdx, r10
jle 0x14004a578
movsd xmm0, qword [rbp + rdx*8 - 0x60]
movsd xmm1, qword [rbp + rdx*8 - 0x68]
comisd xmm0, xmm1
jbe 0x14004a570
movsd qword [rbp + rdx*8 - 0x60], xmm1
movsd qword [rbp + rdx*8 - 0x68], xmm0
dec rdx
cmp rdx, r10
jg 0x14004a552
inc r10
dec r11
dec rbx
jne 0x14004a4a0
mov r8d, dword [0x1401cbd80]
test sil, sil
je 0x14004a759
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r8d, dword [0x1401cbd80]
test eax, eax
jne 0x14004a753
mov dword [rsp + 0x30], r14d
mov ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 6
jne 0x14004a639
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
mov r14d, dword [rsp + 0x30]
shr r14d, 1
jns 0x14004a649
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14004a66d
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.1400023b0
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d226c
test eax, eax
js 0x14004a748
cmp eax, dword [rdi - 0xc]
jg 0x14004a748
mov dword [rdi - 0x10], eax
cdqe
xor esi, esi
mov word [rdi + rax*2], si
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401cbd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x14004a718
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401cbd80]
cmp dword [rdi - 0x10], esi
jl 0x14004a75b
lea rdx, str.PMIL
mov rcx, rdi
call fcn.1400d243c
test rax, rax
je 0x14004a73f
sub rax, rdi
sar rax, 1
test eax, eax
jne 0x14004a73f
lea r15d, [rax + 1]
mov r8d, dword [0x1401cbd80]
jmp 0x14004a75b
mov ecx, 0x80070057
call fcn.140001920
int3
mov r15d, 1
xor esi, esi
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x14004a7cd
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
jmp 0x14004a7cd
mov r15d, 1
lea rdi, str.Software_
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
cmp qword [0x1401c6d48], 0xffffffff80000002
jne 0x14004aac9
mov r14, qword [0x1401cd180]
lea rcx, [r14 - 0x18]
mov rbx, qword [0x1401cde60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004a94d
cmp dword [rbx + 0x10], 0
jl 0x14004a83d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004a83d
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004a834
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
jmp 0x14004a946
movsxd rdi, dword [r14 - 0x10]
test edi, edi
jne 0x14004a8ae
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14004a94d
cmp dword [rbx + 0x10], 0
jge 0x14004a889
mov rax, qword [0x1401cde60]
cmp dword [rax - 0xc], 0
jge 0x14004a870
mov ecx, 0x80070057
call fcn.140001920
int3
mov rax, qword [0x1401cde60]
mov dword [rax - 0x10], esi
mov rax, qword [0x1401cde60]
mov word [rax], si
jmp 0x14004a94d
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004a89c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x14004a946
mov rcx, qword [0x1401cde60]
mov r15d, dword [rcx - 0x10]
mov rsi, r14
sub rsi, rcx
sar rsi, 1
test edi, edi
jns 0x14004a8d1
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, ecx
jge 0x14004a8f0
mov edx, edi
lea rcx, [0x1401cde60]
call fcn.1400023b0
mov rcx, qword [0x1401cde60]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r15
ja 0x14004a915
lea r8, [rcx + rsi*2]
call fcn.1400d1ea4
jmp 0x14004a91d
mov r8, r14
call fcn.1400d2064
mov rax, qword [0x1401cde60]
cmp edi, dword [rax - 0xc]
jg 0x14004a93b
mov dword [rax - 0x10], edi
mov rax, qword [0x1401cde60]
xor esi, esi
mov word [rbx + rax], si
jmp 0x14004a94d
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [0x1401cde60], rax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov rcx, qword [0x1401cde70]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x14004aab2
cmp dword [rbx + 0x10], 0
jl 0x14004a9ad
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x14004a9ad
mov rcx, rdx
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004a996
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401cde70], rax
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
jmp 0x14004ade5
mov rax, qword [rsp + 0x38]
movsxd rdi, dword [rax - 0x10]
test edi, edi
jne 0x14004aa2a
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14004aab2
cmp dword [rbx + 0x10], 0
jge 0x14004a9f7
cmp dword [rcx - 0xc], 0
jge 0x14004a9de
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rcx - 0x10], esi
mov rax, qword [0x1401cde70]
mov word [rax], si
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
jmp 0x14004ade5
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004aa0a
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde70], rax
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
jmp 0x14004ade5
mov r14d, dword [rcx - 0x10]
mov rsi, qword [rsp + 0x38]
sub rsi, rcx
sar rsi, 1
test edi, edi
jns 0x14004aa48
mov ecx, 0x80070057
call fcn.140001920
int3
mov edx, 1
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x14004aa6e
mov edx, edi
lea rcx, [0x1401cde70]
call fcn.1400023b0
mov rcx, qword [0x1401cde70]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r14
ja 0x14004aa8c
lea r8, [rcx + rsi*2]
call fcn.1400d1ea4
jmp 0x14004aa96
mov r8, qword [rsp + 0x38]
call fcn.1400d2064
mov rax, qword [0x1401cde70]
cmp edi, dword [rax - 0xc]
jg 0x14004aabe
mov dword [rax - 0x10], edi
mov rax, qword [0x1401cde70]
xor esi, esi
mov word [rbx + rax], si
lea r14, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
jmp 0x14004ade5
mov ecx, 0x80070057
call fcn.140001920
int3
test r15d, r15d
je 0x14004ac98
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x14004abc4
cmp byte [0x1401cbea4], 0
jne 0x14004abc4
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
test rdi, 0xffffffffffff0000
jne 0x14004ab36
movzx edi, di
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ab4e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400025b0
jmp 0x14004ab49
mov r8d, 9
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400022c0
mov rbx, qword [rsp + 0x70]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401cde60]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004abaf
cmp dword [rsi + 0x10], 0
jl 0x14004ab9b
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004ab9b
mov rcx, rdi
call fcn.140002410
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004ab8e
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [0x1401cde60], rax
jmp 0x14004abaf
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401cde60]
call fcn.1400022c0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004ac25
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004ac25
mov rdx, qword [0x1401cd180]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1401cde60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004ac25
cmp dword [rbx + 0x10], 0
jl 0x14004ac15
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ac15
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004ac08
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401cde60], rax
jmp 0x14004ac25
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401cde60]
call fcn.1400022c0
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
mov rbx, qword [0x1401cde70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004ade3
cmp dword [rbx + 0x10], 0
jl 0x14004ac7b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ac7b
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004ac6b
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [0x1401cde70], rax
jmp 0x14004ade3
mov rbx, qword [rsp + 0x38]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401cde70]
call fcn.1400022c0
jmp 0x14004ade3
call fcn.1400498a0
test al, al
jne 0x14004acba
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401cde70]
call fcn.140010fc0
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
test r14, 0xffffffffffff0000
jne 0x14004acff
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004ad17
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400025b0
jmp 0x14004ad12
mov r8d, 0x7a
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.1400022c0
mov rbx, qword [rsp + 0x60]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401cde60]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004ad78
cmp dword [rsi + 0x10], 0
jl 0x14004ad64
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004ad64
mov rcx, rdi
call fcn.140002410
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004ad57
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [0x1401cde60], rax
jmp 0x14004ad78
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401cde60]
call fcn.1400022c0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004ad8c
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov ecx, dword [0x1401cbd80]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xe
jne 0x14004ade3
mov eax, 1
lea edx, [r8 + 0x7c]
mov r8d, eax
nop dword [rax]
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
dec edx
jns 0x14004add0
mov dword [0x1401cbd80], ecx
xor esi, esi
mov rcx, qword [0x1401cde60]
cmp dword [rcx - 0x10], 0
jl 0x14004af77
lea rdx, str.windows_ie_ac_001
call fcn.1400d243c
test rax, rax
je 0x14004af77
sub rax, qword [0x1401cde60]
sar rax, 1
test eax, eax
jle 0x14004af77
mov r14, qword [0x1401cd180]
lea rdx, [r14 - 0x18]
mov rcx, qword [0x1401cde58]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x14004b130
cmp dword [rbx + 0x10], 0
jl 0x14004ae79
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x14004ae79
mov rcx, rdx
call fcn.140002410
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004ae69
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1401cde58], rax
jmp 0x14004b130
movsxd rdi, dword [r14 - 0x10]
test edi, edi
jne 0x14004aee3
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14004b130
cmp dword [rbx + 0x10], 0
jge 0x14004aeb7
cmp dword [rcx - 0xc], 0
jge 0x14004aea5
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rcx - 0x10], esi
mov rax, qword [0x1401cde58]
mov word [rax], si
jmp 0x14004b130
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14004aeca
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401cde58], rax
jmp 0x14004b130
mov r15d, dword [rcx - 0x10]
mov rsi, r14
sub rsi, rcx
sar rsi, 1
test edi, edi
jns 0x14004aeff
mov ecx, 0x80070057
call fcn.140001920
int3
mov edx, 1
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x14004af25
mov edx, edi
lea rcx, [0x1401cde58]
call fcn.1400023b0
mov rcx, qword [0x1401cde58]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r15
ja 0x14004af43
lea r8, [rcx + rsi*2]
call fcn.1400d1ea4
jmp 0x14004af4b
mov r8, r14
call fcn.1400d2064
mov rax, qword [0x1401cde58]
cmp edi, dword [rax - 0xc]
jg 0x14004af6c
mov dword [rax - 0x10], edi
mov rax, qword [0x1401cde58]
xor ecx, ecx
mov word [rbx + rax], cx
jmp 0x14004b130
mov ecx, 0x80070057
call fcn.140001920
int3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
je 0x14004b05e
cmp byte [0x1401cbea4], 0
jne 0x14004b05e
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
lea rdx, str.Software_
test rdx, 0xffffffffffff0000
jne 0x14004afe2
movzx edi, dx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004aff7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400025b0
jmp 0x14004aff2
mov r8d, 9
lea rcx, [rsp + 0x68]
call fcn.1400022c0
mov rbx, qword [rsp + 0x68]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401cde58]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004b059
cmp dword [rsi + 0x10], 0
jl 0x14004b045
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004b045
mov rcx, rdi
call fcn.140002410
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004b038
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401cde58], rax
jmp 0x14004b059
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401cde58]
call fcn.1400022c0
nop
jmp 0x14004b11d
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
test r14, 0xffffffffffff0000
jne 0x14004b0a3
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14004b0bb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400025b0
jmp 0x14004b0b6
mov r8d, 0x7a
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.1400022c0
mov rbx, qword [rsp + 0x78]
lea rdi, [rbx - 0x18]
mov rsi, qword [0x1401cde58]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x14004b11d
cmp dword [rsi + 0x10], 0
jl 0x14004b109
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14004b109
mov rcx, rdi
call fcn.140002410
mov rbx, rax
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14004b0fc
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [0x1401cde58], rax
jmp 0x14004b11d
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [0x1401cde58]
call fcn.1400022c0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004b130
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401c6d48], 0xffffffff80000002
je 0x14004b1b2
cmp byte [0x1401c6c12], 0
je 0x14004b1b2
lea rcx, [rbp - 0x78]
call fcn.140049670
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401cde60]
call fcn.140010fc0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b17c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x80]
call fcn.140049670
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401cde58]
call fcn.140010fc0
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b1b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401c6d48]
lea rcx, [0x1401cde60]
call fcn.14004b2a0
mov rdx, qword [0x1401c6d48]
lea rcx, [0x1401cde58]
call fcn.14004b2a0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b1f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004b20c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, 1
cmp byte [rsp + 0x40], 0
je 0x14004b24c
call fcn.1400495f0
test al, al
jne 0x14004b232
mov eax, dword [0x1401cbd80]
test eax, eax
cmove eax, ebx
mov dword [0x1401cbd80], eax
mov rcx, qword [0x1401cde58]
add rcx, 0xffffffffffffffe8
call fcn.140002410
add rax, 0x18
mov qword [r13], rax
jmp 0x14004b264
mov rcx, qword [0x1401cde60]
add rcx, 0xffffffffffffffe8
call fcn.140002410
add rax, 0x18
mov qword [r13], rax
mov dword [rsp + 0x5c], ebx
mov rax, r13
mov rcx, qword [rbp + 0x20d0]
xor rcx, rsp
call fcn.1400d1680
lea r11, [rsp + 0x21e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret