Function at 0x180019230
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.1800f0120
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x12c0], rbx
movaps xmmword [rsp + 0x1270], xmm6
movaps xmmword [rsp + 0x1260], xmm7
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r14, r8
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x60], esi
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
cmp qword [0x1801c5328], rsi
je 0x1800193a5
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], sil
je 0x1800193a5
cmp dword [rax + 0x80], 4
jb 0x1800193a5
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1800192f9
mov r9, qword [r14]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180019306
mov r8, qword [r15]
lea rdx, str.iePathName
lea rcx, [rbp + 0x10]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x26d
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x180019354
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019394
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001938f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab3a
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
lea rdi, [r15 + 0x10]
cmp qword [rdi], 0
jne 0x1800193b6
xor al, al
jmp 0x18001ab00
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800193c3
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
jne 0x1800193de
mov rbx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800193de
mov rbx, qword [r15]
lea rdx, [0x180164f20]
mov rcx, rbx
call fcn.180111120
mov r13d, 1
test eax, eax
je 0x18001944b
lea rdx, [0x180164f00]
mov rcx, rbx
call fcn.180111120
test eax, eax
je 0x18001944b
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.180111120
test eax, eax
je 0x18001944b
lea rdx, [0x180164f80]
mov rcx, rbx
call fcn.180111120
test eax, eax
je 0x18001944b
lea rdx, str.360chromeX.exe
mov rcx, rbx
call fcn.180111120
test eax, eax
je 0x18001944b
mov r12d, esi
jmp 0x180019e26
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movdqu xmmword [rbp + 0xa0], xmm0
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], si
mov r8d, 0xe
lea rdx, str.2345SafeCenter
lea rcx, [rbp + 0x90]
call fcn.180004aa0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call fcn.180004aa0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x180019503
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800194fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab40
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.180040970
nop
cmp qword [rbp + 0x80], 0
jne 0x1800195d5
lea rcx, [rbp + 0xd0]
call fcn.180020d00
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x180019578
lea rcx, [rbp + 0x70]
call fcn.180004a10
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x1800195be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800195b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab46
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
mov r8d, 0x12
lea rdx, str.2345SFWebShell.exe
lea rcx, [rbp + 0xd0]
call fcn.180004aa0
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.1800aaf80
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x18001965b
lea rcx, [rbp + 0x70]
call fcn.180004a10
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18001969b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019696
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab4c
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x1800196f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800196ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab52
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
cmp qword [0x1801c5328], 0
je 0x180019811
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], 0
je 0x180019811
cmp dword [rax + 0x80], 4
jb 0x180019811
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str.mid_fpath___ws
lea rcx, [rbp + 0x10]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x27f
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x10]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x1800197c0
lea rdx, [rbp + 0x10]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019800
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800197fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab58
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
xor sil, sil
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x140]
call fcn.18010e5a0
xor edx, edx
mov r8d, 0x804
lea rcx, [rbp + 0x940]
call fcn.18010e5a0
lea rdx, [rbp + 0x140]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x140]
xor r8d, r8d
lea rdx, [0x180163950]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180019951
xor edx, edx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180019951
lea r8, [rbp + 0x140]
mov edx, 0x402
lea rcx, [rbp + 0x940]
call fcn.180114174
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xd0]
call fcn.18010e5a0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str._d.exe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180019951
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180019933
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x70]
call fcn.180004aa0
mov sil, 1
lea rcx, [rbp + 0x70]
call fcn.1800a13f0
test al, al
je 0x180019dbf
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm1
xor r12d, r12d
mov word [rbp + 0x10], r12w
mov r13d, 1
mov r8d, r13d
lea rdx, [0x180166770]
lea rcx, [rbp + 0x10]
call fcn.180004aa0
nop
cmp qword [r15 + 0x18], 8
jb 0x1800199a3
mov r15, qword [r15]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800199e5
lea rdi, [rdx + rcx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r15
call fcn.18010e140
mov word [rbx + rdi*2], r12w
jmp 0x1800199f6
mov qword [rsp + 0x20], rdx
mov r9, r15
lea rcx, [rbp + 0x10]
call fcn.18000d480
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180019a3c
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180166868]
call fcn.18010e140
mov word [rbx + rdi*2], r12w
jmp 0x180019a54
mov qword [rsp + 0x20], r13
lea r9, [0x180166868]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d480
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x180019a61
mov r9, qword [r14]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x28]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180019aa4
lea rdi, [rcx + rdx]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r8, 8
cmovae rbx, qword [rbp + 0x10]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18010e140
mov word [rbx + rdi*2], r12w
jmp 0x180019ab2
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x10]
call fcn.18000d480
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x28]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x180019af8
lea rdi, [rcx + 1]
mov qword [rbp + 0x20], rdi
lea rbx, [rbp + 0x10]
cmp r9, 8
cmovae rbx, qword [rbp + 0x10]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180166770]
call fcn.18010e140
mov word [rbx + rdi*2], r12w
jmp 0x180019b10
mov qword [rsp + 0x20], r13
lea r9, [0x180166770]
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.18000d480
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180019c65
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], r12w
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
lea rdx, str._vz_:N
lea rcx, [rbp + 0xd0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2a2
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180019c07
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019c4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019c48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab5e
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r12w
test sil, sil
je 0x180019cfb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180019cfb
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
xor edx, edx
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rbp + 0xd8], 3
mov dword [rbp + 0xf0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0xd0], r12
lea rax, [rbp + 0x940]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], r12
mov eax, 0x614
mov dword [rbp + 0xf4], r13d
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rdi, 0x20
seta bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180019d42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019d3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab64
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019d97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab6a
call fcn.1800ef470
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x50]
call fcn.180004a10
movzx eax, bl
jmp 0x18001ab00
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x180019e02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019dfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800ef470
xor esi, esi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rcx, [rbp + 0x50]
call fcn.180004a10
mov r12d, r13d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, r15
lea rdx, [0x180166770]
lea rcx, [rbp + 0xd0]
call fcn.180013240
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180019e9f
lea rsi, [rcx + 2]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 8
jb 0x180019e7f
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 4
lea rdx, [0x180166898]
call fcn.18010e140
xor eax, eax
mov word [rdi + rsi*2], ax
xor esi, esi
jmp 0x180019ebf
mov qword [rsp + 0x20], 2
lea r9, [0x180166898]
mov edx, 2
mov rcx, rbx
call fcn.18000d480
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movups xmm7, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm7
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp + 0x60], xmm6
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x60], r13d
lea rcx, [rbp + 0x30]
call fcn.180004a10
movups xmmword [rbp + 0x30], xmm7
movups xmmword [rbp + 0x40], xmm6
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov eax, r13d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180019f66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180019f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab76
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.180011f60
nop
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x18001a068
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x180019ff8
lea rax, [rdi + rsi]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x30]
lea r8, [rdi + rdi]
lea rcx, [rbx + rsi*2]
mov rdx, r9
call fcn.18010e140
lea rax, [rdi + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x18001a00b
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.18000d480
xor esi, esi
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a050
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x18016463c]
call fcn.18010e140
mov word [rbx + rdi*2], si
jmp 0x18001a068
mov qword [rsp + 0x20], r13
lea r9, [0x18016463c]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d480
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18001a16f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xd0], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0xd0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2c7
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0xd0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x18001a112
lea rdx, [rbp + 0xd0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x18001a158
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001a153
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab7c
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], si
mov rdx, r15
lea rcx, [rbp + 0x10]
call fcn.18000cab0
nop
lea rcx, [rbp + 0x10]
call fcn.18009fad0
lea r10, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r10, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp rax, 0x11
jb 0x18001a202
lea r11, [rax - 0x10]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rbx, str.2345explorer.exe
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x18001a202
cmp word [rcx], 0x5c
je 0x18001a1cb
add rcx, 2
sub rax, 1
jmp 0x18001a1b9
test rcx, rcx
je 0x18001a202
mov r8d, 0x11
mov rdx, rbx
mov r9, rcx
sub r9, rbx
nop
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x18001a1fc
add rdx, 2
sub r8, 1
jne 0x18001a1e0
sub rcx, r10
sar rcx, 1
jmp 0x18001a209
add rcx, 2
jmp 0x18001a1b0
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a2cd
mov r8, qword [r14 + 0x10]
test r8, r8
jne 0x18001a2b2
mov r8, qword [rbp + 0x40]
mov rdi, r8
cmp r8, 1
jb 0x18001a29d
mov rbx, rsi
test r8, r8
je 0x18001a26b
cmp r8, rbx
jbe 0x18001ab34
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
movzx edx, word [rax + rbx*2]
lea rcx, [0x18016463c]
call fcn.18010db08
mov r8, qword [rbp + 0x40]
test rax, rax
je 0x18001a26b
inc rbx
cmp rbx, rdi
jb 0x18001a233
test rbx, rbx
je 0x18001a29d
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
sub r8, rbx
mov qword [rbp + 0x40], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010e140
lea rdx, [0x18016463c]
lea rcx, [rbp + 0x30]
call fcn.18009f940
jmp 0x18001a3ac
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a2bf
mov rdx, qword [r14]
lea rcx, [rbp + 0x30]
call fcn.18000ce00
jmp 0x18001a3ac
cmp qword [r14 + 0x10], 0
je 0x18001a3ac
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a31d
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180166770]
call fcn.18010e140
mov word [rbx + rdi*2], si
jmp 0x18001a335
mov qword [rsp + 0x20], r13
lea r9, [0x180166770]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d480
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x18001a342
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp + 0x30]
call fcn.18000ce00
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18001a394
lea rdi, [rcx + 1]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x180166770]
call fcn.18010e140
mov word [rbx + rdi*2], si
jmp 0x18001a3ac
mov qword [rsp + 0x20], r13
lea r9, [0x180166770]
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.18000d480
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18001a44d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rdx, str.commandLine:__s
lea rcx, [rbp + 0x50]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2e1
lea rax, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x18001a444
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x60]
call fcn.18010e5a0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], r13d
mov word [rbp - 0x20], r13w
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x18001a49e
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18001a543
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
cmp qword [r14 + 0x18], 8
jb 0x18001a4dc
mov r14, qword [r14]
mov r9, r14
mov r8d, r12d
lea rdx, [0x1801668c0]
lea rcx, [rbp + 0x50]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2f2
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x18001a538
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
jmp 0x18001a54a
lea r12, str.RC::RCRemoteMonitorClient::ShellExecuteLoadWeb
mov rbx, rsi
mov qword [rsp + 0x70], rbx
mov r14d, esi
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.18000cab0
nop
lea rcx, [rbp + 0xd0]
call fcn.18009fad0
lea r10, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae r10, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
cmp rax, 0xc
jb 0x18001a602
lea r11, [rax - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
lea rdi, str.iexplore.exe
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x18001a602
cmp word [rcx], 0x69
je 0x18001a5cb
add rcx, 2
sub rax, 1
jmp 0x18001a5b9
test rcx, rcx
je 0x18001a602
mov r8d, 0xc
mov rdx, rdi
mov r9, rcx
sub r9, rdi
nop
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x18001a5fc
add rdx, 2
sub r8, 1
jne 0x18001a5e0
sub rcx, r10
sar rcx, 1
jmp 0x18001a609
add rcx, 2
jmp 0x18001a5b0
mov rcx, 0xffffffffffffffff
test ecx, ecx
js 0x18001a8e7
call fcn.18001cd60
lea rdx, [rbp - 0x70]
call fcn.18001ce10
nop
lea rcx, [rsp + 0x70]
cmp rcx, rax
je 0x18001a635
mov rbx, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x18001a646
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov edx, 4
lea rcx, [0x1801c5328]
test al, al
jne 0x18001a706
call fcn.1800d10d0
mov edi, eax
test eax, eax
je 0x18001a6e5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0x1e
lea rdx, str.ShellExecuteLoadWeb:
lea rcx, [rbp + 0x50]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x2ff
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp edi, 1
jbe 0x18001a6dc
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
mov rcx, rbx
mov rbx, rsi
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001a8e7
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
jmp 0x18001a8e7
call fcn.1800d10d0
mov edi, eax
test eax, eax
je 0x18001a788
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
mov r8d, 0xc
lea rdx, [0x1801669a0]
lea rcx, [rbp + 0x50]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x304
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp edi, 1
jbe 0x18001a77f
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x18001a7a0
mov r15, qword [r15]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9b, 1
movzx r8d, r9b
mov rdx, r15
mov rcx, rbx
call qword [rax + 0x18]
mov r14d, eax
mov edx, 4
lea rcx, [0x1801c5328]
test eax, eax
jne 0x18001a856
call fcn.1800d10d0
mov edi, eax
test eax, eax
je 0x18001a8e7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.isDriverProtectOk___d_err___x
lea rcx, [rbp + 0x50]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x308
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r14 + 4]
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp edi, 1
jbe 0x18001a851
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
jmp 0x18001a8de
call fcn.1800d10d0
mov edi, eax
test eax, eax
je 0x18001a8e7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r9, qword [rbp + 0x30]
mov r8d, r14d
lea rdx, str.isDriverProtectOk___d_cmd___ws
lea rcx, [rbp + 0x50]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp edi, 1
jbe 0x18001a8de
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
cmp qword [rsp + 0x68], 0
je 0x18001a987
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001a927
cmp byte [rax], 0xe9
jne 0x18001a927
mov edx, 0x14
mov rcx, rax
call fcn.180137450
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x18001a9ce
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test dil, dil
je 0x18001a9f4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x18001aa04
mov edx, 0x2710
jmp 0x18001a9fb
test r14d, r14d
je 0x18001aa04
xor edx, edx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov esi, eax
xor r15d, r15d
test eax, eax
je 0x18001aa96
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r15w
movzx r9d, dil
mov r8d, r14d
lea rdx, str.JumpToProtectMainPage___
lea rcx, [rbp + 0x50]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], r12
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea r8, [rbp + 0x50]
lea edx, [r15 + 4]
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp esi, 1
jbe 0x18001aa8d
lea rdx, [rbp + 0x50]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x50]
call fcn.180004a10
test rbx, rbx
je 0x18001aabd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, r15
mov qword [rsp + 0x70], rbx
test rcx, rcx
je 0x18001aabd
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
nop
lea rcx, [rbp + 0xd0]
call fcn.180004a10
nop
test rbx, rbx
je 0x18001aadc
mov r8, qword [rbx]
mov edx, r13d
mov rcx, rbx
call qword [r8]
nop
lea rcx, [rbp + 0x10]
call fcn.180004a10
nop
lea rcx, [rbp + 0xb0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x30]
call fcn.180004a10
movzx eax, dil
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.1800ef410
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800130d0
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3