Function at 0x140018dd0
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [rdx + 0x300]
mov rdi, rdx
lea rdx, [rcx + 0x3788]
mov r10, qword [rax + 0x10]
mov rbx, rcx
xor r9d, r9d
mov rcx, r10
mov r8d, 0x1000
call qword [r10 + 8]
test eax, eax
jns 0x140018e35
mov r9, qword [rdi + 0x10]
lea r8, str._s:_Error_reading_image_header:__Rrc
mov edx, 0xffffea09
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140016330
add rsp, 0xe8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0x5a4d
mov qword [rsp + 0xd8], r13
xor r13d, r13d
cmp word [rbx + 0x3788], ax
jne 0x140018e86
mov r13d, dword [rbx + 0x37c4]
cmp r13d, 0x200
ja 0x140018e64
cmp r13d, 0x40
jae 0x140018e86
mov r9, qword [rdi + 0x10]
lea r8, str._s:_Unexpected_e_lfanew_value:__x
mov edx, 0xffffea18
mov rcx, rbx
mov dword [rsp + 0x20], r13d
call fcn.140016330
jmp 0x140019967
mov esi, r13d
mov eax, dword [rsi + rbx + 0x3788]
cmp eax, 0x4550
je 0x140018ebd
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x28], eax
lea r8, str._s:_No_PE_signature_at__x:__x
mov edx, 0xffffea1a
mov rcx, rbx
mov dword [rsp + 0x20], r13d
call fcn.140016330
jmp 0x140019967
movzx eax, word [rsi + rbx + 0x378c]
mov ecx, 0x8664
cmp ax, cx
je 0x140018efc
cmp byte [rdi + 0x2fb], 0
jne 0x140018efc
mov r9, qword [rdi + 0x10]
movzx eax, ax
lea r8, str._s:_Unexpected_machine:__x
mov edx, 0xffffe9f1
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140016330
jmp 0x140019967
mov ecx, 0x14c
mov qword [rsp + 0xe0], r12
mov edx, 0xe0
cmp ax, cx
movzx ecx, word [rsi + rbx + 0x379c]
mov eax, 0xf0
sete r12b
test r12b, r12b
cmovne eax, edx
cmp rcx, rax
je 0x140018f4e
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str._s:_Unexpected_optional_header_size:__x
mov edx, 0xffffea17
mov rcx, rbx
call fcn.140016330
jmp 0x14001995f
movzx ecx, word [rsi + rbx + 0x37a0]
test r12b, r12b
mov eax, 0x20b
mov edx, 0x10b
cmovne eax, edx
cmp ecx, eax
je 0x140018f8b
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x20], ecx
lea r8, str._s:_Unexpected_optional_header_magic:__x
mov edx, 0xffffea17
mov rcx, rbx
call fcn.140016330
jmp 0x14001995f
test r12b, r12b
je 0x140018f99
mov eax, dword [rsi + rbx + 0x37fc]
jmp 0x140018fa0
mov eax, dword [rsi + rbx + 0x380c]
cmp eax, 0x10
je 0x140018fc6
mov r9, qword [rdi + 0x10]
lea r8, str._s:_Unexpected_data_dirs:__x
mov edx, 0xffffea17
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140016330
jmp 0x14001995f
mov qword [rsp + 0xc8], r15
movzx r15d, word [rsi + rbx + 0x378e]
mov dword [rbp + 0x7f], r15d
cmp r15d, 0x10
jbe 0x140019003
mov r9, qword [rdi + 0x10]
lea r8, str._s:_Too_many_section_headers:__x
mov edx, 0xffffe9f2
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call fcn.140016330
jmp 0x140019957
lea rdx, [rsi + rbx + 0x3880]
test r12b, r12b
jne 0x140019018
lea rdx, [rsi + rbx + 0x3890]
lea r8, [r15 + r15*4]
lea rcx, [rbx + 0x4788]
shl r8, 3
call fcn.140016090
test r12b, r12b
je 0x14001903a
mov eax, dword [rsi + rbx + 0x37bc]
jmp 0x140019042
mov rax, qword [rsi + rbx + 0x37b8]
test rax, 0xfff
je 0x14001906c
mov r9, qword [rdi + 0x10]
lea r8, str._s:_Invalid_image_base:__p
mov edx, 0xffffea1b
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140016330
jmp 0x140019957
mov eax, dword [rdi + 8]
mov qword [rsp + 0xd0], r14
mov r14d, dword [rsi + rbx + 0x37d8]
add eax, 0xfff
lea ecx, [r14 + 0xfff]
mov dword [rbp - 0x59], r14d
xor ecx, eax
test ecx, 0xfffff000
je 0x1400190cd
cmp byte [rdi + 0x2fa], 0
jne 0x1400190cd
mov rax, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
lea r8, str._s:_SizeOfImage___x__isnt_close_enough_to_the_mapping_size___x_
mov qword [rsp + 0x28], rax
mov edx, 0xffffea19
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call fcn.140016330
jmp 0x14001994f
mov rcx, qword [rdi + 0x300]
mov rcx, qword [rcx + 8]
call fcn.140013740
mov ecx, r14d
cmp rcx, rax
je 0x14001911c
mov rcx, qword [rdi + 0x300]
mov rcx, qword [rcx + 8]
call fcn.140013740
mov r9, qword [rdi + 0x10]
lea r8, str._s:_SizeOfImage___x__differs_from_what_RTLdrSize_returns___zx_
mov qword [rsp + 0x28], rax
mov edx, 0xffffea19
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call fcn.140016330
jmp 0x14001994f
mov ecx, dword [rsi + rbx + 0x37c0]
mov dword [rbp + 0x67], ecx
lea eax, [rcx - 1]
mov dword [rbp - 0x41], eax
test ecx, eax
jne 0x140019933
cmp ecx, 0x1000
jb 0x140019933
movzx r9d, byte [rdi + 0x2fa]
mov eax, 0x1000
mov edx, 0x10000
test r9b, r9b
cmovne eax, edx
cmp ecx, eax
ja 0x140019933
mov r10d, dword [rsi + rbx + 0x37c4]
mov dword [rbp - 0x49], r10d
lea r11d, [r10 - 1]
test r10d, r11d
jne 0x140019910
lea eax, [r10 - 0x200]
cmp eax, 0xe00
ja 0x140019910
cmp r10d, ecx
ja 0x140019910
mov edx, dword [rsi + rbx + 0x37dc]
mov ecx, 0xf8
test r12b, r12b
mov eax, 0x108
cmovne eax, ecx
lea ecx, [r15 + r15*4]
add eax, r13d
lea r8d, [rax + rcx*8]
cmp edx, r8d
jae 0x1400191e6
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], edx
lea r8, str._s:_Headers_are_too_small:__x____x__cSections_x_
mov rcx, rbx
mov edx, 0xffffea12
call fcn.140016330
jmp 0x14001994f
not r11d
lea r14d, [rdx + r10 - 1]
and r14d, r11d
mov dword [rbp - 0x31], r11d
cmp r14d, 0x1000
jbe 0x14001922d
mov r9, qword [rdi + 0x10]
mov qword [rsp + 0x30], 0x1000
lea r8, str._s:_Headers_are_larger_than_expected:__x__x__expected_max__zx_
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov rcx, rbx
mov edx, 0xffffea12
call fcn.140016330
jmp 0x14001994f
movzx eax, word [rsi + rbx + 0x379e]
mov word [rdi + 0x2f4], ax
movzx eax, word [rsi + rbx + 0x37e6]
mov word [rdi + 0x2f6], ax
test r9b, r9b
je 0x14001926f
mov eax, dword [rbx + 0x4794]
sub qword [rdi], rax
mov eax, dword [rbx + 0x4794]
add qword [rdi + 8], rax
mov eax, dword [rbx + 0x4794]
mov dword [rdi + 0x234], eax
cmp dword [rbx], 2
mov rax, qword [rbx + 0x4a08]
mov r8, qword [rdi]
mov rcx, qword [rdi + 0x300]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x51]
mov qword [rsp + 0x20], rbx
jne 0x140019298
xor r9d, r9d
jmp 0x14001929f
lea r9, [0x140016c10]
call fcn.140018450
test eax, eax
js 0x14001994f
cmp dword [0x1400cae78], 0x60000000
jb 0x1400192d4
test r12b, r12b
mov r12, qword [rbp - 0x51]
je 0x1400192ca
mov eax, dword [rdi]
mov dword [rsi + r12 + 0x34], eax
jmp 0x1400192d8
mov rax, qword [rdi]
mov qword [rsi + r12 + 0x30], rax
jmp 0x1400192d8
mov r12, qword [rbp - 0x51]
xor esi, esi
mov dword [rbp + 0x6f], esi
cmp byte [rdi + 0x2f9], sil
je 0x1400194fd
cmp dword [rbx], 1
jne 0x14001939c
mov rcx, qword [rdi + 0x300]
lea rax, [rbp + 0x77]
or r9d, 0xffffffff
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
lea rax, str.NtCreateSection
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.1400137f0
test eax, eax
jns 0x140019338
mov dword [rsp + 0x20], eax
lea r8, str._s:_Failed_to_find_NtCreateSection:__Rrc
mov edx, eax
jmp 0x140019943
mov eax, dword [rbp + 0x77]
mov rcx, qword [rdi + 0x300]
or r9d, 0xffffffff
mov rcx, qword [rcx + 8]
mov dword [rbp - 0x29], eax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, str.LdrLoadDll
xor r8d, r8d
mov rdx, r12
mov dword [rbp - 0x25], 0xc
mov qword [rsp + 0x20], rax
call fcn.1400137f0
test eax, eax
jns 0x14001938a
mov dword [rsp + 0x20], eax
lea r8, str._s:_Failed_to_find_LdrLoadDll:__Rrc
mov edx, eax
jmp 0x140019943
mov eax, dword [rbp + 0x77]
mov dword [rbp - 0x1d], 0xc
mov esi, 2
mov dword [rbp - 0x21], eax
mov rcx, qword [rdi + 0x300]
lea rax, [rbp + 0x77]
or r9d, 0xffffffff
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
lea rax, str.LdrInitializeThunk
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.1400137f0
test eax, eax
jns 0x1400193e1
mov dword [rsp + 0x20], eax
lea r8, str._s:_Failed_to_find_LdrInitializeThunk:__Rrc
mov edx, eax
jmp 0x140019943
mov eax, dword [rbp + 0x77]
mov ecx, esi
or r9d, 0xffffffff
mov dword [rbp + rcx*8 - 0x29], eax
mov dword [rbp + rcx*8 - 0x25], 0xe
mov rcx, qword [rdi + 0x300]
mov rcx, qword [rcx + 8]
lea rax, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, str.KiUserApcDispatcher
mov rdx, r12
inc esi
mov qword [rsp + 0x20], rax
call fcn.1400137f0
test eax, eax
jns 0x140019439
mov dword [rsp + 0x20], eax
lea r8, str._s:_Failed_to_find_KiUserApcDispatcher:__Rrc
mov edx, eax
jmp 0x140019943
mov eax, dword [rbp + 0x77]
mov rcx, qword [rdi + 0x300]
or r9d, 0xffffffff
mov rcx, qword [rcx + 8]
mov dword [rbp + rsi*8 - 0x29], eax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, str.KiUserExceptionDispatcher
xor r8d, r8d
mov rdx, r12
mov dword [rbp + rsi*8 - 0x25], 0xe
mov qword [rsp + 0x20], rax
inc esi
call fcn.1400137f0
test eax, eax
jns 0x14001948f
mov dword [rsp + 0x20], eax
lea r8, str._s:_Failed_to_find_KiUserExceptionDispatcher:__Rrc
mov edx, eax
jmp 0x140019943
mov eax, dword [rbp + 0x77]
mov rcx, qword [rdi + 0x300]
mov dword [rbp + rsi*8 - 0x25], 0xd
mov rcx, qword [rcx + 8]
inc eax
or r9d, 0xffffffff
mov dword [rbp + rsi*8 - 0x29], eax
lea rax, [rbp + 0x77]
inc esi
mov qword [rsp + 0x28], rax
lea rax, str.LdrSystemDllInitBlock
xor r8d, r8d
mov rdx, r12
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x20], rax
call fcn.1400137f0
test eax, eax
js 0x1400194fd
mov rax, qword [rbp + 0x77]
mov dword [rbp + rsi*8 - 0x29], eax
mov eax, eax
movzx ecx, byte [rax + r12]
movzx eax, cl
cmp cl, 0x50
jae 0x1400194f4
mov eax, 0x50
mov dword [rbp + rsi*8 - 0x25], eax
inc esi
mov dword [rbp + 0x6f], esi
cmp byte [rdi + 0x2fa], 0
jne 0x140019566
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov r9d, r14d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], r12
call fcn.1400164a0
test eax, eax
js 0x14001994f
mov r9d, r14d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], 2
call fcn.140016950
test eax, eax
js 0x14001994f
xor r15d, r15d
mov r10d, 2
mov dword [rbp + 0x77], r10d
cmp dword [rbp + 0x7f], r15d
jbe 0x140019832
lea rsi, [rbx + 0x47ac]
lea r9d, [r10 + 0x3e]
mov qword [rbp - 0x39], rsi
nop dword [rax]
mov r12d, dword [rsi - 0x18]
mov ecx, dword [rbp - 0x59]
mov r8d, dword [rbp + 0x67]
cmp r12d, r14d
jb 0x1400198de
cmp r12d, ecx
ja 0x1400198de
mov edx, dword [rbp - 0x41]
lea eax, [r12 + r8 - 1]
not edx
and eax, edx
cmp eax, r12d
jne 0x1400198de
mov r13d, dword [rsi - 0x1c]
cmp r13d, ecx
ja 0x1400198ac
lea eax, [r13 + r14]
cmp eax, ecx
ja 0x1400198ac
mov ecx, dword [rsi - 0x14]
mov eax, dword [rbp - 0x49]
lea eax, [rcx + rax - 1]
and eax, dword [rbp - 0x31]
cmp ecx, eax
jne 0x14001987c
lea eax, [r13 + r8 - 1]
and eax, edx
mov dword [rbp - 0x45], eax
cmp ecx, eax
ja 0x14001987c
cmp byte [rdi + 0x2fa], 0
je 0x140019615
test r15d, r15d
jne 0x140019819
mov eax, dword [rsi]
and eax, 0xe0000000
cmp eax, 0x20000000
je 0x1400196a1
cmp eax, 0x40000000
je 0x140019693
cmp eax, 0x60000000
je 0x14001969a
cmp eax, 0xc0000000
je 0x14001965e
cmp eax, 0xe0000000
jne 0x140019839
cmp byte [rdi + 0x2f8], 0
jne 0x140019839
cmp dword [rbx], 2
mov esi, 0x20
cmove esi, r9d
jmp 0x1400196a6
mov eax, dword [rbx]
mov esi, 4
cmp eax, 1
je 0x1400196a6
cmp eax, 2
je 0x1400196a6
lea rcx, [r15 + r15*4]
lea r8d, [rsi + 4]
lea rdx, str..mrdata
lea rcx, [rbx + rcx*8 + 0x4788]
call fcn.140016030
mov r10d, dword [rbp + 0x77]
test eax, eax
jne 0x1400196a6
mov esi, 2
jmp 0x1400196a6
mov esi, 0x20
jmp 0x1400196a6
mov esi, 0x10
mov rax, qword [rbp - 0x39]
mov eax, dword [rax]
test eax, 0x20000020
je 0x1400196b7
test eax, eax
jns 0x1400196dc
and eax, 0xc0000000
cmp eax, 0x40000000
je 0x1400196dc
mov eax, dword [rbx]
cmp eax, 1
jne 0x1400196d3
cmp byte [rdi + 0x2f8], 0
jne 0x1400196dc
cmp eax, 2
jne 0x1400197de
cmp r14d, r12d
jae 0x140019733
cmp byte [rdi + 0x2fa], 0
jne 0x140019733
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], 0
lea eax, [r15 - 1]
mov r9d, r12d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov ecx, r14d
mov r8d, r14d
mov rdx, rdi
add rcx, qword [rbp - 0x51]
sub r9d, r14d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1400164a0
mov r11d, eax
test eax, eax
js 0x140019874
mov ecx, dword [rbp + 0x6f]
mov dword [rsp + 0x40], esi
mov rax, r12
add rax, qword [rbp - 0x51]
mov dword [rsp + 0x38], ecx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x30], rcx
mov r9d, r13d
mov r8d, r12d
mov rcx, rbx
mov rdx, rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.1400164a0
mov r11d, eax
test eax, eax
js 0x140019874
lea eax, [r15 + 1]
cmp eax, dword [rbp + 0x7f]
jae 0x14001978c
cmp byte [rdi + 0x2fa], 0
jne 0x14001978c
mov r9d, dword [rbp - 0x45]
jmp 0x14001979a
lea r9d, [r13 + 0xfff]
and r9d, 0xfffff000
cmp r9d, r13d
jbe 0x1400197d5
xor eax, eax
mov dword [rsp + 0x40], esi
lea r8d, [r13 + r12]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
lea rax, [sym.VBoxNetNAT.exe_g_abRTZero16K]
sub r9d, r13d
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.1400164a0
mov r11d, eax
test r11d, r11d
js 0x140019874
lea r9d, [r13 + 0xfff]
mov r8d, r12d
mov rdx, rdi
mov rcx, rbx
and r9d, 0xfffff000
mov dword [rsp + 0x20], esi
call fcn.140016950
test eax, eax
js 0x14001994f
mov eax, dword [rbp - 0x45]
mov r10d, esi
mov dword [rbp + 0x77], esi
mov rsi, qword [rbp - 0x39]
mov r9d, 0x40
add rsi, 0x28
inc r15d
lea r14d, [rax + r12]
mov qword [rbp - 0x39], rsi
cmp r15d, dword [rbp + 0x7f]
jb 0x140019590
xor eax, eax
jmp 0x14001994f
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x38], r13d
lea rcx, [r15 + r15*4]
mov eax, dword [rbx + rcx*8 + 0x47ac]
mov dword [rsp + 0x30], r12d
lea r8, str._s:_Section__u:_Unexpected_characteristics:__x__uSectRva_x__cbMap_x_
mov dword [rsp + 0x28], eax
mov edx, 0xffffe9f0
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call fcn.140016330
jmp 0x14001994f
mov eax, r11d
jmp 0x14001994f
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ecx
lea r8, str._s:_Section__u:_Invalid_file_size:__x__cbMap_x__uSectRva_x_
mov edx, 0xffffea15
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call fcn.140016330
jmp 0x14001994f
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r12d
lea r8, str._s:_Section__u:_Invalid_virtual_size:__x__uSectRva_x__uRva_x__cbImage_x_
mov edx, 0xffffea13
mov rcx, rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
call fcn.140016330
jmp 0x14001994f
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r14d
lea r8, str._s:_Section__u:_Invalid_virtual_address:__x__uRva_x__cbImage_x__cbSectAlign_x_
mov edx, 0xffffea14
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r15d
call fcn.140016330
jmp 0x14001994f
mov r9, qword [rdi + 0x10]
mov dword [rsp + 0x28], ecx
lea r8, str._s:_Unexpected_FileAlignment_value:__x__cbSectAlign_x_
mov edx, 0xffffea1c
mov rcx, rbx
mov dword [rsp + 0x20], r10d
call fcn.140016330
jmp 0x14001994f
mov dword [rsp + 0x20], ecx
lea r8, str._s:_Unexpected_SectionAlignment_value:__x
mov edx, 0xffffea16
mov r9, qword [rdi + 0x10]
mov rcx, rbx
call fcn.140016330
mov r14, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xd8]
add rsp, 0xe8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rdx + 0x300]
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
je 0x1400199fa
cmp qword [rbx + 8], 0
je 0x1400199fa
mov rcx, qword [rcx + 0x4a08]
xor eax, eax
cmp byte [rbx + 0x28], al
jne 0x1400199dc
mov r8, qword [rbx + 0x10]
mov rdx, qword [rdx + 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.140012370
test eax, eax
setns cl
mov byte [rbx + 0x28], cl
test eax, eax
js 0x140019a0b
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140018dd0
lea r8, str.pCacheEntry_hLdrMod_is_NIL__Impossible_
mov edx, 0xffffff9b
call fcn.140016330
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret