Function at 0x180019100
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1800edb30
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x12c0], rbx
movaps xmmword [rsp + 0x1270], xmm6
movaps xmmword [rsp + 0x1260], xmm7
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r14, r8
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x60], esi
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
cmp qword [0x1801c12f8], rsi
je 0x180019275
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], sil
je 0x180019275
cmp dword [rax + 0x80], 4
jb 0x180019275
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1800191c9
mov r9, qword [r14]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x1800191d6
mov r8, qword [r15]
lea rdx, str.iePathName
lea rcx, [rbp + 0x10]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x26d
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x180019224
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019264
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001925f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa0a
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
lea rdi, [r15 + 0x10]
cmp qword [rdi], 0
jne 0x180019286
xor al, al
jmp 0x18001a9d0
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180019293
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
jne 0x1800192ae
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800192ae
mov rbx, qword [r15]
lea rdx, [0x180161fa8]
mov rcx, rbx
call fcn.18010eb30
mov r13d, 1
test eax, eax
je 0x18001931b
lea rdx, [0x180161f88]
mov rcx, rbx
call fcn.18010eb30
test eax, eax
je 0x18001931b
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.18010eb30
test eax, eax
je 0x18001931b
lea rdx, [0x180162008]
mov rcx, rbx
call fcn.18010eb30
test eax, eax
je 0x18001931b
lea rdx, str.360chromeX.exe
mov rcx, rbx
call fcn.18010eb30
test eax, eax
je 0x18001931b
mov r12d, esi
jmp 0x180019cf6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movdqu xmmword [rbp + 0xa0], xmm0
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], si
mov r8d, 0xe
lea rdx, str.2345SafeCenter
lea rcx, [rbp + 0x90]
call fcn.1800049a0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call fcn.1800049a0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1800193d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800193ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa10
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.1800406d0
nop
cmp qword [rbp + 0x80], 0
jne 0x1800194a5
lea rcx, [rbp + 0xd0]
call fcn.180020bd0
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180019448
lea rcx, [rbp + 0x70]
call fcn.180004910
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001948e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019489
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa16
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
mov r8d, 0x12
lea rdx, str.2345SFWebShell.exe
lea rcx, [rbp + 0xd0]
call fcn.1800049a0
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.1800a8990
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x18001952b
lea rcx, [rbp + 0x70]
call fcn.180004910
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18001956b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019566
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa1c
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x1800195c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800195bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa22
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
cmp qword [0x1801c12f8], 0
je 0x1800196e1
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], 0
je 0x1800196e1
cmp dword [rax + 0x80], 4
jb 0x1800196e1
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str.mid_fpath___ws
lea rcx, [rbp + 0x10]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x27f
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x180019690
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800196d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800196cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa28
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
xor sil, sil
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.18010bfb0
xor edx, edx
mov r8d, 0x804
lea rcx, [rbp + 0x940]
call fcn.18010bfb0
lea rdx, [rbp + 0x140]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x140]
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180019821
xor edx, edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180019821
lea r8, [rbp + 0x140]
mov edx, 0x402
lea rcx, [rbp + 0x940]
call fcn.180111b84
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xd0]
call fcn.18010bfb0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._d.exe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180019821
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180019803
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x70]
call fcn.1800049a0
mov sil, 1
lea rcx, [rbp + 0x70]
call fcn.18009ee00
test al, al
je 0x180019c8f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm1
xor r12d, r12d
mov word [rbp + 0x10], r12w
mov r13d, 1
mov r8d, r13d
lea rdx, [0x1801637c0]
lea rcx, [rbp + 0x10]
call fcn.1800049a0
nop
cmp qword [r15 + 0x18], 8
jb 0x180019873
mov r15, qword [r15]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800198b5
lea rdi, [rdx + rcx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r15
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x1800198c6
mov qword [rsp + 0x20], rdx
mov r9, r15
lea rcx, [rbp + 0x10]
call fcn.18000d530
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001990c
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801638b8]
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180019924
mov qword [rsp + 0x20], r13
lea r9, [0x1801638b8]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d530
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180019931
mov r9, qword [r14]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180019974
lea rdi, [rcx + rdx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x180019982
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x10]
call fcn.18000d530
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x28]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x1800199c8
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r9, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801637c0]
call fcn.18010bb50
mov word [rbx + rdi*2], r12w
jmp 0x1800199e0
mov qword [rsp + 0x20], r13
lea r9, [0x1801637c0]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d530
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180019b35
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], r12w
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str._vz_:N
lea rcx, [rbp + 0xd0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2a2
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180019ad7
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019b1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019b18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa2e
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r12w
test sil, sil
je 0x180019bcb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180019bcb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor edx, edx
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rbp + 0xd8], 3
mov dword [rbp + 0xf0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0xd0], r12
lea rax, [rbp + 0x940]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov eax, 0x614
mov dword [rbp + 0xf4], r13d
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rdi, 0x20
seta bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019c12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa34
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019c67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019c62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa3a
call fcn.1800ece80
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x50]
call fcn.180004910
movzx eax, bl
jmp 0x18001a9d0
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019cd2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019ccd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa40
call fcn.1800ece80
xor esi, esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rcx, [rbp + 0x50]
call fcn.180004910
mov r12d, r13d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, r15
lea rdx, [0x1801637c0]
lea rcx, [rbp + 0xd0]
call fcn.180013230
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180019d6f
lea rsi, [rcx + 2]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x180019d4f
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 4
lea rdx, [0x1801638e8]
call fcn.18010bb50
xor eax, eax
mov word [rdi + rsi*2], ax
xor esi, esi
jmp 0x180019d8f
mov qword [rsp + 0x20], 2
lea r9, [0x1801638e8]
mov edx, 2
mov rcx, rbx
call fcn.18000d530
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm7, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm7
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp + 0x60], xmm6
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x60], r13d
lea rcx, [rbp + 0x30]
call fcn.180004910
movups xmmword [rbp + 0x30], xmm7
movups xmmword [rbp + 0x40], xmm6
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov eax, r13d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019e36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019e31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa46
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.180011f50
nop
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x180019f38
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x180019ec8
lea rax, [rdi + rsi]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x30]
lea r8, [rdi + rdi]
lea rcx, [rbx + rsi*2]
mov rdx, r9
call fcn.18010bb50
lea rax, [rdi + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x180019edb
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.18000d530
xor esi, esi
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019f20
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x18016164c]
call fcn.18010bb50
mov word [rbx + rdi*2], si
jmp 0x180019f38
mov qword [rsp + 0x20], r13
lea r9, [0x18016164c]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d530
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18001a03f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0xd0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2c7
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180019fe2
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001a028
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001a023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aa4c
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x10]
call fcn.18009d4e0
lea r10, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r10, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp rax, 0x11
jb 0x18001a0d2
lea r11, [rax - 0x10]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rbx, str.2345explorer.exe
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x18001a0d2
cmp word [rcx], 0x5c
je 0x18001a09b
add rcx, 2
sub rax, 1
jmp 0x18001a089
test rcx, rcx
je 0x18001a0d2
mov r8d, 0x11
mov rdx, rbx
mov r9, rcx
sub r9, rbx
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x18001a0cc
add rdx, 2
sub r8, 1
jne 0x18001a0b0
sub rcx, r10
sar rcx, 1
jmp 0x18001a0d9
add rcx, 2
jmp 0x18001a080
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a19d
mov r8, qword [r14 + 0x10]
test r8, r8
jne 0x18001a182
mov r8, qword [rbp + 0x40]
mov rdi, r8
cmp r8, 1
jb 0x18001a16d
mov rbx, rsi
test r8, r8
je 0x18001a13b
cmp r8, rbx
jbe 0x18001aa04
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
movzx edx, word [rax + rbx*2]
lea rcx, [0x18016164c]
call fcn.18010b518
mov r8, qword [rbp + 0x40]
test rax, rax
je 0x18001a13b
inc rbx
cmp rbx, rdi
jb 0x18001a103
test rbx, rbx
je 0x18001a16d
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
sub r8, rbx
mov qword [rbp + 0x40], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010bb50
lea rdx, [0x18016164c]
lea rcx, [rbp + 0x30]
call fcn.18009d350
jmp 0x18001a27c
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a18f
mov rdx, qword [r14]
lea rcx, [rbp + 0x30]
call fcn.18000ceb0
jmp 0x18001a27c
cmp qword [r14 + 0x10], 0
je 0x18001a27c
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a1ed
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801637c0]
call fcn.18010bb50
mov word [rbx + rdi*2], si
jmp 0x18001a205
mov qword [rsp + 0x20], r13
lea r9, [0x1801637c0]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d530
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a212
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp + 0x30]
call fcn.18000ceb0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a264
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1801637c0]
call fcn.18010bb50
mov word [rbx + rdi*2], si
jmp 0x18001a27c
mov qword [rsp + 0x20], r13
lea r9, [0x1801637c0]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d530
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18001a31d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0x50]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2e1
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x18001a314
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x60]
call fcn.18010bfb0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], r13d
mov word [rbp - 0x20], r13w
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x18001a36e
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18001a413
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
cmp qword [r14 + 0x18], 8
jb 0x18001a3ac
mov r14, qword [r14]
mov r9, r14
mov r8d, r12d
lea rdx, [0x180163910]
lea rcx, [rbp + 0x50]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2f2
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x18001a408
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
jmp 0x18001a41a
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r14d, esi
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.18000cb60
nop
lea rcx, [rbp + 0xd0]
call fcn.18009d4e0
lea r10, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae r10, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
cmp rax, 0xc
jb 0x18001a4d2
lea r11, [rax - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rdi, str.iexplore.exe
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x18001a4d2
cmp word [rcx], 0x69
je 0x18001a49b
add rcx, 2
sub rax, 1
jmp 0x18001a489
test rcx, rcx
je 0x18001a4d2
mov r8d, 0xc
mov rdx, rdi
mov r9, rcx
sub r9, rdi
nop
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x18001a4cc
add rdx, 2
sub r8, 1
jne 0x18001a4b0
sub rcx, r10
sar rcx, 1
jmp 0x18001a4d9
add rcx, 2
jmp 0x18001a480
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a7b7
call fcn.18001cc30
lea rdx, [rbp - 0x70]
call fcn.18001cce0
nop
lea rcx, [rsp + 0x70]
cmp rcx, rax
je 0x18001a505
mov rbx, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x18001a516
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 4
lea rcx, [0x1801c12f8]
test al, al
jne 0x18001a5d6
call fcn.1800ceae0
mov edi, eax
test eax, eax
je 0x18001a5b5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0x1e
lea rdx, str.ShellExecuteLoadWeb:
lea rcx, [rbp + 0x50]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x2ff
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp edi, 1
jbe 0x18001a5ac
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
mov rcx, rbx
mov rbx, rsi
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a7b7
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
jmp 0x18001a7b7
call fcn.1800ceae0
mov edi, eax
test eax, eax
je 0x18001a658
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0xc
lea rdx, [0x1801639f0]
lea rcx, [rbp + 0x50]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x304
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp edi, 1
jbe 0x18001a64f
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x18001a670
mov r15, qword [r15]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9b, 1
movzx r8d, r9b
mov rdx, r15
mov rcx, rbx
call qword [rax + 0x18]
mov r14d, eax
mov edx, 4
lea rcx, [0x1801c12f8]
test eax, eax
jne 0x18001a726
call fcn.1800ceae0
mov edi, eax
test eax, eax
je 0x18001a7b7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.isDriverProtectOk___d_err___x
lea rcx, [rbp + 0x50]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x308
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r14 + 4]
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp edi, 1
jbe 0x18001a721
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
jmp 0x18001a7ae
call fcn.1800ceae0
mov edi, eax
test eax, eax
je 0x18001a7b7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r9, qword [rbp + 0x30]
mov r8d, r14d
lea rdx, str.isDriverProtectOk___d_cmd___ws
lea rcx, [rbp + 0x50]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp edi, 1
jbe 0x18001a7ae
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
cmp qword [rsp + 0x68], 0
je 0x18001a857
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001a7f7
cmp byte [rax], 0xe9
jne 0x18001a7f7
mov edx, 0x14
mov rcx, rax
call fcn.180134e60
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x18001a89e
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test dil, dil
je 0x18001a8c4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x18001a8d4
mov edx, 0x2710
jmp 0x18001a8cb
test r14d, r14d
je 0x18001a8d4
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov esi, eax
xor r15d, r15d
test eax, eax
je 0x18001a966
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r15w
movzx r9d, dil
mov r8d, r14d
lea rdx, str.JumpToProtectMainPage___
lea rcx, [rbp + 0x50]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r15 + 4]
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp esi, 1
jbe 0x18001a95d
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x50]
call fcn.180004910
test rbx, rbx
je 0x18001a98d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, r15
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a98d
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
nop
lea rcx, [rbp + 0xd0]
call fcn.180004910
nop
test rbx, rbx
je 0x18001a9ac
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rbx
call qword [r8]
nop
lea rcx, [rbp + 0x10]
call fcn.180004910
nop
lea rcx, [rbp + 0xb0]
call fcn.180004910
nop
lea rcx, [rbp + 0x30]
call fcn.180004910
movzx eax, dil
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1800ece20
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800130c0
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3