Function at 0x14000ffe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x1400a7700]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov r13, rdx
mov qword [rbp - 0x18], rdx
mov rdi, rcx
mov qword [rbp - 0x40], rcx
xor esi, esi
mov r12d, esi
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x58], esi
lea rdx, str.__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140017b10
lea rdx, [0x140017ce0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400117c8
lea rcx, [rbp + 0x3b0]
call fcn.140011a00
lea rcx, [rbp + 0x3b0]
call fcn.1400125e0
nop
lea rdx, str.https:__animeworld.space_downloads_cfg_blacklist.txt
lea rcx, [rbp + 0x400]
call fcn.14000e920
nop
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x438]
call fcn.140004c20
nop
lea rcx, [rbp + 0x400]
call fcn.140014960
lea rcx, [rbp + 0x458]
call fcn.140004930
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x458]
call fcn.140004970
nop
mov dword [rbp + 0x150], 0x238
lea rdx, [rbp + 0x150]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140011727
invalid
mov r8, 0xffffffffffffffff
lea r10d, [r8 + 0xb]
movabs r9, 0x7ffffffffffffffe
movabs rcx, 0x7fffffffffffffff
mov r15, qword [rdi]
mov qword [rbp - 0x10], r15
mov rax, qword [rdi + 8]
mov qword [rbp + 0x20], rax
cmp r15, rax
je 0x140010dc4
cmp qword [r15 + 0x18], 0x10
jb 0x140010155
mov r14, qword [r15]
mov rdi, r14
add r14, qword [r15 + 0x10]
movabs rcx, 0x7fffffffffffffff
jmp 0x14001015f
mov r14, qword [r15 + 0x10]
add r14, r15
mov rdi, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xor edx, edx
mov esi, edx
mov qword [rbp - 0x68], rdx
cmp rdi, r14
jne 0x140010185
mov edi, 7
mov qword [rbp - 0x60], rdi
mov word [rbp - 0x78], dx
jmp 0x140010287
mov rax, r14
sub rax, rdi
mov ebx, 7
mov qword [rbp - 0x60], rbx
cmp rax, r9
ja 0x1400117f8
cmp rax, 8
jb 0x140010240
mov rbx, rax
or rbx, 7
cmp rbx, r9
jbe 0x1400101b8
mov rbx, r9
jmp 0x1400101c0
cmp rbx, 0xa
cmovb rbx, r10
mov rax, rbx
add rax, 1
cmovb rax, r8
cmp rax, rcx
ja 0x1400117fe
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140010216
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400117fe
mov rcx, rax
call fcn.140081140
mov rcx, rax
test rax, rax
je 0x140010f41
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor edx, edx
lea r8, [rdx - 1]
jmp 0x14001022b
test rcx, rcx
je 0x140010228
call fcn.140081140
xor edx, edx
lea r8, [rdx - 1]
jmp 0x14001022b
mov rax, rdx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 0x78]
cmp rbx, 8
cmovae rcx, qword [rbp - 0x78]
movsx eax, byte [rdi]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp - 0x68]
inc rsi
mov qword [rbp - 0x68], rsi
inc rdi
cmp rdi, r14
je 0x14001026d
mov rbx, qword [rbp - 0x60]
jmp 0x140010240
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
mov word [rax + rsi*2], dx
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
lea rax, [rbp + 0x17c]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400102a0
lea rdx, [rbp + 0x17c]
lea rcx, [rsp + 0x60]
call fcn.140018440
lea rcx, [rbp - 0x78]
cmp rdi, 8
setae r14b
mov rbx, qword [rbp - 0x78]
cmovae rcx, rbx
lea r8, [rsp + 0x60]
mov r10, qword [rsp + 0x78]
cmp r10, 8
setae r11b
mov r9, qword [rsp + 0x60]
cmovae r8, r9
mov rdx, qword [rsp + 0x70]
cmp rdx, rsi
jne 0x140010319
test rdx, rdx
je 0x140010314
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140010319
add rcx, 2
sub rdx, 1
jne 0x140010300
mov sil, 1
jmp 0x14001031c
xor sil, sil
test r11b, r11b
je 0x140010357
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14001034e
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f3a
mov rcx, r9
call fcn.1400814a4
nop
test r14b, r14b
je 0x140010391
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140010389
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f41
mov rcx, rbx
call fcn.1400814a4
test sil, sil
je 0x140010d8b
mov r8d, dword [rbp + 0x158]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140010d8b
xor esi, esi
mov qword [rbp - 0x80], rsi
lea r9d, [rsi + 0x30]
lea r8, [rbp + 0x110]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140010d73
nop dword [rax]
nop word [rax + rax]
cmp dword [rbp + 0x130], 0x1000
jne 0x140010d3f
mov rdi, qword [rbp + 0x128]
test rdi, rdi
je 0x140010d46
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c0], xmm0
xor r15d, r15d
mov qword [rbp + 0x3d0], r15
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140011810
cmp rdi, 0x1000
jb 0x14001046d
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140011804
call fcn.140081140
mov rcx, rax
test rax, rax
je 0x140010f64
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010475
mov rcx, rdi
call fcn.140081140
mov qword [rbp + 0x3c0], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x3d0], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c8], rbx
lea rax, [rbp + 0x3f8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x128]
mov r8, qword [rbp + 0x3c0]
mov rdx, qword [rbp + 0x110]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140010cff
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], r15
mov qword [rbp + 0x3f0], r15
mov r8, qword [rbp + 0x3f8]
mov rdx, qword [rbp + 0x3c0]
lea rcx, [rbp + 0x3d8]
call fcn.14000e980
nop
mov rax, qword [r13]
mov qword [rbp - 0x20], rax
mov rcx, qword [r13 + 8]
mov qword [rbp + 0x18], rcx
cmp rax, rcx
je 0x140010bad
mov rsi, qword [rbp + 0x3e8]
mov rdi, qword [rax + 0x10]
mov r14, rax
cmp qword [rax + 0x18], 0x10
jb 0x140010531
mov r14, qword [rax]
lea r15, [rbp + 0x3d8]
cmp qword [rbp + 0x3f0], 0x10
setae cl
mov byte [rsp + 0x30], cl
cmovae r15, qword [rbp + 0x3d8]
cmp rdi, rsi
ja 0x1400105ce
mov rax, rsi
sub rax, rdi
test rdi, rdi
jne 0x140010567
xor r15d, r15d
mov ebx, r15d
jmp 0x1400105d8
lea r12, [r15 + rax]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400105c4
nop word [rax + rax]
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140010673
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140010590
movzx ecx, byte [rsp + 0x30]
mov r12d, dword [rsp + 0x34]
mov rbx, 0xffffffffffffffff
xor r15d, r15d
cmp rbx, 0xffffffffffffffff
je 0x140010b8f
lea r8, [rdi + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], r15
mov qword [rbp + 0x3a8], r15
cmp rsi, rbx
jb 0x14001180a
sub rsi, rbx
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0x3d8]
test cl, cl
cmovne rdx, qword [rbp + 0x3d8]
add rdx, rbx
lea rcx, [rbp + 0x390]
call fcn.14000e980
or r12d, 1
lea r11, [rbp + 0x390]
mov r9, qword [rbp + 0x3a8]
cmp r9, 0x10
setae al
mov r10, qword [rbp + 0x390]
cmovae r11, r10
mov rsi, qword [rbp + 0x3a0]
add r11, rsi
lea rcx, [rbp + 0x390]
test al, al
je 0x140010685
mov rax, r10
lea r8, [r10 + rsi]
jmp 0x140010690
sub rbx, r15
movzx ecx, byte [rsp + 0x30]
mov r12d, dword [rsp + 0x34]
jmp 0x1400105d5
lea r8, [rcx + rsi]
lea rax, [rbp + 0x390]
cmp rax, r8
je 0x1400106e7
movzx ecx, byte [rax]
cmp cl, 0x22
je 0x1400106aa
cmp cl, 0x27
je 0x1400106aa
inc rax
cmp rax, r8
jne 0x140010695
cmp rax, r8
je 0x1400106e7
lea rcx, [rax + 1]
cmp rcx, r8
je 0x1400106e7
movzx edx, byte [rcx]
cmp dl, 0x22
je 0x1400106ca
cmp dl, 0x27
je 0x1400106ca
mov byte [rax], dl
inc rax
inc rcx
cmp rcx, r8
jne 0x1400106b8
mov r9, qword [rbp + 0x3a8]
mov rsi, qword [rbp + 0x3a0]
mov r10, qword [rbp + 0x390]
lea rcx, [rbp + 0x390]
cmp r9, 0x10
setae dl
cmovae rcx, r10
mov r9, rax
sub r9, rcx
sub r11, rax
mov rax, rsi
sub rax, r9
cmp rax, r11
cmovb r11, rax
lea rcx, [rbp + 0x390]
test dl, dl
cmovne rcx, r10
add rcx, r9
sub rsi, r11
mov r8, rsi
sub r8, r9
inc r8
lea rdx, [rcx + r11]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x3a0], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x38], 0
or r12d, 2
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x58], r12d
lea rdi, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0x10
setae dl
cmovae rdi, qword [rbp + 0x390]
lea r15, [rbp + 0x390]
test dl, dl
cmovne r15, qword [rbp + 0x390]
add r15, rsi
cmp rdi, r15
je 0x1400107f7
nop dword [rax]
movsx esi, byte [rdi]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
test eax, eax
je 0x1400107ef
cmp rbx, r14
jae 0x1400107d7
lea rax, [rbx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp r14, 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rbx], sil
mov byte [rax + rbx + 1], 0
jmp 0x1400107e5
movzx r9d, sil
lea rcx, [rsp + 0x38]
call fcn.140019040
mov rbx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
inc rdi
cmp rdi, r15
jne 0x1400107a0
mov r13, qword [rbp + 0x3b0]
mov rdi, qword [r13 + 8]
mov r15, r13
mov r12, qword [rsp + 0x38]
cmp byte [rdi + 0x19], 0
jne 0x14001086b
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x38]
cmp r14, 0x10
cmovae rdx, r12
mov rsi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14001082f
mov rcx, qword [rcx]
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140010848
jns 0x140010853
mov al, 0xff
jmp 0x140010855
cmp rsi, rbx
jae 0x140010851
mov al, 0xff
jmp 0x140010855
jbe 0x14001085f
mov al, 1
test al, al
jns 0x14001085f
mov rdi, qword [rdi + 0x10]
jmp 0x140010865
mov r15, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x140010810
cmp byte [r15 + 0x19], 0
jne 0x140010884
lea r8, [r15 + 0x20]
lea rdx, [rsp + 0x38]
call fcn.14001c910
test al, al
je 0x140010887
mov r15, r13
mov rbx, r13
and dword [rsp + 0x34], 0xfffffffd
cmp r14, 0x10
jb 0x1400108ce
lea rdx, [r14 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400108bf
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f4f
mov rcx, r12
call fcn.1400814a4
mov r13, qword [rbp + 0x3b0]
cmp r15, rbx
jne 0x140010beb
lea rdx, [0x140096a38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140017b10
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor r15d, r15d
mov r8d, r15d
mov qword [rsp + 0x48], r15
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r9
mov byte [rsp + 0x38], r8b
mov r12d, dword [rsp + 0x34]
bts r12d, 9
mov dword [rsp + 0x58], r12d
lea rbx, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0x10
setae dl
cmovae rbx, qword [rbp + 0x390]
lea rsi, [rbp + 0x390]
test dl, dl
cmovne rsi, qword [rbp + 0x390]
add rsi, qword [rbp + 0x3a0]
cmp rbx, rsi
je 0x1400109c1
nop word [rax + rax]
movsx edi, byte [rbx]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
test eax, eax
je 0x1400109af
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x1400109a1
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], r15b
jmp 0x1400109af
movzx r9d, dil
lea rcx, [rsp + 0x38]
call fcn.140019040
inc rbx
cmp rbx, rsi
jne 0x140010960
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x38]
cmp r9, 0x10
cmovae rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.14001a750
lea rdx, [0x140017ce0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
btr r12d, 9
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140010a2b
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f48
call fcn.1400814a4
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x38], 0
bts r12d, 0xa
mov dword [rsp + 0x58], r12d
lea rbx, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 0x10
setae r8b
cmovae rbx, qword [rbp + 0x390]
lea r14, [rbp + 0x390]
test r8b, r8b
cmovne r14, qword [rbp + 0x390]
add r14, qword [rbp + 0x3a0]
cmp rbx, r14
je 0x140010ae7
nop word [rax + rax]
movsx esi, byte [rbx]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
test eax, eax
je 0x140010adf
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
jae 0x140010acc
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdi, 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rcx], sil
mov byte [rax + rcx + 1], 0
jmp 0x140010ada
movzx r9d, sil
lea rcx, [rsp + 0x38]
call fcn.140019040
mov rdi, qword [rsp + 0x50]
inc rbx
cmp rbx, r14
jne 0x140010a90
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x3b0]
call fcn.14001aec0
btr r12d, 0xa
mov dword [rsp + 0x34], r12d
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140010b47
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f4f
call fcn.1400814a4
nop
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x140010b88
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f56
call fcn.1400814a4
mov rsi, qword [rbp + 0x3e8]
mov rax, qword [rbp - 0x20]
add rax, 0x20
mov qword [rbp - 0x20], rax
cmp rax, qword [rbp + 0x18]
jne 0x140010520
mov r14, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x80]
mov r13, qword [rbp + 0x3b0]
mov rbx, qword [r13]
cmp byte [rbx + 0x19], 0
jne 0x140010cb9
lea r8, [rbx + 0x20]
mov rax, qword [0x1400a8da8]
cmp rax, qword [0x1400a8db0]
je 0x140010c48
mov rdx, r8
mov rcx, rax
call fcn.1400149c0
add qword [0x1400a8da8], 0x20
jmp 0x140010c57
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x140010c36
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010c27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f56
call fcn.1400814a4
mov r12d, dword [rsp + 0x34]
jmp 0x140010ba5
mov r12d, dword [rsp + 0x34]
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x58]
jmp 0x140010bb4
mov rdx, rax
lea rcx, [0x1400a8da0]
call fcn.14001b570
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140010c88
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140010c83
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140010c83
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140010c70
mov rbx, rax
jmp 0x140010caf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140010caf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140010ca0
cmp byte [rbx + 0x19], 0
je 0x140010bc2
mov rax, qword [rbp + 0x3f0]
cmp rax, 0x10
jb 0x140010cfb
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x3d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010cf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f5d
call fcn.1400814a4
mov r13, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x3c0]
test rcx, rcx
je 0x140010d3f
mov rdx, qword [rbp + 0x3d0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f64
call fcn.1400814a4
mov rdi, qword [rbp + 0x128]
add rsi, rdi
mov qword [rbp - 0x80], rsi
mov r9d, Ordinal_50
lea r8, [rbp + 0x110]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x1400103f0
mov r15, qword [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010d8f
mov rbx, qword [rbp - 0x50]
add r15, 0x20
mov qword [rbp - 0x10], r15
cmp r15, qword [rbp + 0x20]
movabs rcx, 0x7fffffffffffffff
mov r8, 0xffffffffffffffff
movabs r9, 0x7ffffffffffffffe
lea r10d, [r8 + 0xb]
jne 0x140010138
mov rdi, qword [rbp - 0x40]
lea rdx, [rbp + 0x150]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010101
lea r8, str.APPDATA
xor edx, edx
lea rcx, [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
test eax, eax
jne 0x140011049
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x140011049
lea rcx, [rbp + 0x400]
call fcn.14000e920
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x420]
call fcn.140004930
lea rdx, str.Chieftain
lea rcx, [rbp + 0x110]
call fcn.14000e920
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, 6
lea rdx, str.Onetap
lea rcx, [rbp + 0x130]
call fcn.14000e980
nop
lea rax, [rbp + 0x110]
mov qword [rbp - 0x40], rax
lea rax, [rbp + 0x150]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x420]
call fcn.1400138f0
nop
lea r9, [fcn.140014960]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x110]
call fcn.14008117c
lea rcx, [rbp + 0x3c0]
call fcn.140004930
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c0], xmm0
xor edi, edi
mov qword [rbp + 0x3d0], rdi
lea r9, [rbp + 0x3c0]
lea r8, [rbp + 0x420]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x48]
call fcn.14000dcf0
nop
mov rdx, qword [0x1400a8da8]
cmp rdx, qword [0x1400a8db0]
je 0x140010f6b
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
add qword [0x1400a8da8], 0x20
jmp 0x140010f74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, rax
call fcn.14001b2b0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140010fb2
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010fad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010fad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x110]
call fcn.14000e420
nop
mov rdx, qword [0x1400a8da8]
cmp rdx, qword [0x1400a8db0]
je 0x14001100b
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
add qword [0x1400a8da8], 0x20
jmp 0x140011014
mov r8, rax
call fcn.14001b2b0
nop
lea rcx, [rbp + 0x110]
call fcn.140014960
nop
lea rcx, [rbp + 0x3c0]
call fcn.140016010
nop
lea rcx, [rbp + 0x420]
call fcn.140016010
nop
lea rcx, [rbp + 0x400]
call fcn.140014960
jmp 0x14001104b
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov r8, qword [0x1400a8da8]
mov rdx, qword [0x1400a8da0]
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.140017d20
mov rbx, rax
lea r12, [0x1400a77d8]
cmp r12, rax
je 0x140011114
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x1400110d7
mov rcx, qword [0x1400a77d8]
inc rdx
cmp rdx, 0x1000
jb 0x1400110d2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011146
mov rcx, r8
call fcn.1400814a4
mov qword [0x1400a77e8], rdi
mov qword [reloc.WS2_32.dll_ntohs], 0xf
mov byte [0x1400a77d8], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1400a77d8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400a77e8], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140011152
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001114d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001114d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
cmp qword [0x1400a77e8], 0
je 0x140011702
lea rcx, [rbp + 0xe8]
call fcn.14000ea80
mov r13, rax
lea rcx, [rbp + 0xc8]
call fcn.140008000
nop
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140004c20
mov rsi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 4
jb 0x14001121f
lea rax, [r8 + 4]
mov qword [rsi + 0x10], rax
mov rbx, rsi
cmp rcx, 0x10
jb 0x1400111b6
mov rbx, qword [rsi]
lea rax, [0x140096a94]
mov r15d, 4
lea r14, str.IP:
cmp rax, rbx
jbe 0x1400111e5
lea rax, [rbx + r8]
cmp r14, rax
ja 0x1400111e5
cmp rbx, r14
jbe 0x1400111e8
mov rdi, rbx
sub rdi, r14
jmp 0x1400111e8
mov rdi, r15
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rdi
lea rdx, [r14 + 4]
add rdx, rdi
lea rcx, [rbx + rdi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
jmp 0x140011244
mov r15d, 4
mov qword [rsp + 0x28], r15
lea r14, str.IP:
mov qword [rsp + 0x20], r14
mov edx, r15d
mov rcx, rsi
call fcn.14001c140
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov r8d, 7
lea rdx, str._nHWID:
lea rcx, [rsp + 0x60]
call fcn.1400148e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r13
lea r8, [rbp + 0x88]
lea rcx, [rbp + 0x28]
call fcn.140019ef0
nop
mov r8d, recv
lea rdx, str._nSteaminfo:
lea rcx, [rbp + 0x28]
call fcn.1400148e0
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x1400a8d60]
cmp qword [0x1400a8d78], 0x10
cmovae rdx, qword [0x1400a8d60]
mov r8, qword [0x1400a8d70]
lea rcx, [rbp - 8]
call fcn.1400148e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 7
lea rdx, str._nfind:
lea rcx, [rbp - 0x40]
call fcn.1400148e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r12, qword [0x1400a77d8]
mov r8, qword [0x1400a77e8]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.1400148e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp + 0x68]
call fcn.14000fc60
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140011430
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001142a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001142a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140011470
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001146b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001146b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400114c1
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400114bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400114bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140011510
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001150b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001150b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14001155f
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001155a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001155a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x1400115b5
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400115af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400115af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400115f5
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400115f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400115f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14001164c
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011647
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x1400116a7
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400116a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp + 0xd8], xmm0
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140011702
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400116fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
lea rdx, str.___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140017b10
lea rdx, [0x140017ce0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011731
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x458]
call fcn.140016010
nop
mov rdx, qword [rbp + 0x450]
cmp rdx, 0x10
jb 0x140011782
inc rdx
mov rcx, qword [rbp + 0x438]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001177d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001177d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400814a4
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp + 0x448], xmm0
mov byte [rbp + 0x438], 0
mov r8, qword [rbp + 0x3b0]
mov r8, qword [r8 + 8]
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x3b0]
call fcn.14001b060
mov edx, 0x40
mov rcx, qword [rbp + 0x3b0]
call fcn.1400814a4
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140081120
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001570
nop
call fcn.1400014d0
int3
call fcn.1400014d0
nop
call fcn.140016d00
nop
call fcn.140017000
int3