Function at 0x18001e400
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1260]
mov eax, 0x1360
call fcn.18006ece0
sub rsp, rax
lea eax, [r8 + 0x13]
mov r15, rdx
mov dword [rbp - 0x40], eax
mov edi, r8d
mov rdx, rcx
cmp r8d, eax
jae 0x18001f13f
movzx eax, word [rbp + 0x1290]
lea r11, [0x180000000]
mov qword [rsp + 0x1358], rbx
xor r8d, r8d
mov ebx, dword [rbp + 0x1290]
mov qword [rsp + 0x1350], rsi
mov qword [rsp + 0x1348], r12
mov r12, qword [rsp + 0x78]
lea esi, [r8 + 1]
mov qword [rsp + 0x1340], r13
lea r10d, [r8 + 2]
mov r13, qword [rbp - 0x28]
mov qword [rsp + 0x1338], r14
mov r14d, dword [rbp + 0x1290]
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x70], eax
mov qword [rbp - 0x68], rbx
nop word [rax + rax]
lea eax, [rdi - 0x3f]
cmp eax, 0x3c
ja case.0x18001e4d0.82
movzx eax, byte [r11 + rax + 0x1f19c]
mov ecx, dword [r11 + rax*4 + 0x1f14c]
add rcx, r11
jmp rcx
mov rsi, qword [rbp + 0x12a0]
mov word [0x1800d5918], r8w
test rsi, rsi
je 0x18001e4ec
mov dword [rsi], 5
mov rax, qword [rbp + 0x12a8]
lea r8, [rbp - 0x70]
mov edx, 0x16
xor ecx, ecx
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
call fcn.18004b3a0
cmp eax, 2
jne 0x18001e830
mov r12, qword [rbp + 0x1288]
mov r15d, 0xdb
mov rbx, qword [rbp + 0x12a8]
xor r13d, r13d
nop word [rax + rax]
cmp r15d, 0xdb
je 0x18001e7f8
cmp r15d, 0x160
je 0x18001e6a0
cmp r15d, 0x1e5
jne 0x18001e7fd
test rsi, rsi
je 0x18001e7fd
cmp r14d, 0x23
ja case.0x18001e586.5
lea rdx, [0x180000000]
movsxd rax, r14d
movzx eax, byte [rdx + rax + 0x1f204]
mov ecx, dword [rdx + rax*4 + 0x1f1dc]
add rcx, rdx
jmp rcx
mov edi, 0x3f
mov dword [rsi], 0x21
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 1
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 0xa
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 4
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 6
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 8
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 9
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 0xb
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov edi, 0x3f
mov dword [rsi], 0x1e
mov dword [rbp + 0x1290], edi
mov r15d, 0x1e5
jmp 0x18001e803
mov dword [rsi], 5
mov edi, 0x3f
mov r15d, 0x1e5
mov dword [rbp + 0x1290], edi
jmp 0x18001e803
mov rax, qword [rbx]
mov edi, 0x105
mov dword [rsp + 0x5c], 0xffffffff
movzx esi, word [rax + 4]
movzx r14d, word [rax + 2]
mov word [rbp - 0x58], si
nop dword [rax]
cmp edi, 0xc7d4
ja 0x18001e71f
je 0x18001e709
mov eax, edi
sub eax, 0x5d
je 0x18001e7b4
sub eax, 0x8f
je 0x18001e7a0
sub eax, 0x19
je 0x18001e6f5
sub eax, 0xb3ab
je 0x18001e7d6
jmp 0x18001e7a0
mov word [rbp + 0xa98], si
mov word [rbp + 0xa9a], r14w
jmp 0x18001e7a0
mov dword [rbp + 0xbac], 0xffffffff
mov dword [rbp + 0xbb0], r13d
jmp 0x18001e7a0
cmp edi, 0x18ea3
je 0x18001e78c
cmp edi, 0x25572
je 0x18001e759
cmp edi, 0x31c41
je 0x18001e74c
cmp edi, 0x3e310
jne 0x18001e7a0
movzx eax, word [rbp + 0xbb0]
mov dword [rsp + 0x70], eax
jmp 0x18001e7a0
movsx ecx, word [rbp + 0xbac]
mov dword [rsp + 0x5c], ecx
jmp 0x18001e7a0
xor eax, eax
lea rdx, [rbp + 0x650]
mov qword [rbp + 0xba2], rax
mov word [rbp + 0xbaa], ax
lea ecx, [rax - 0xc]
call qword [0x1800d5910]
movzx eax, word [rbp + 0xbaa]
xor r13d, r13d
mov word [0x1800d5918], ax
jmp 0x18001e7a0
movsx eax, word [0x1800d591c]
mov dword [rbp + 0xbb8], eax
mov dword [rbp + 0xbb4], r13d
add edi, 0xc6cf
cmp edi, 0x6fd47
jbe 0x18001e6c0
jmp 0x18001e7d6
movsx eax, byte [rbp - 0x58]
lea rdx, [rsp + 0x50]
mov r9d, 0x143
mov dword [rsp + 0x50], eax
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor ecx, ecx
call fcn.180024e20
mov rsi, qword [rbp + 0x12a0]
mov edi, dword [rbp + 0x1290]
mov r14d, dword [rsp + 0x5c]
test r12, r12
je 0x18001e803
mov eax, dword [rsp + 0x70]
cwde
mov dword [r12], eax
jmp 0x18001e803
mov dword [rsp + 0x70], r13d
mov edi, dword [rbp + 0x1290]
add r15d, 0x85
cmp r15d, 0x26a
jb 0x18001e530
mov rbx, qword [rbp - 0x68]
mov r13, qword [rbp - 0x28]
mov r12, qword [rsp + 0x78]
mov r15, qword [rbp + 0x1288]
jmp 0x18001f0de
mov rax, qword [rbp + 0x12a8]
cmp qword [rax], 0
je 0x18001f0de
mov rbx, qword [rbp + 0x12b0]
mov edi, 0x8e
mov r12, rax
xor r14d, r14d
mov eax, edi
sub eax, 0x8e
je 0x18001e8b1
sub eax, 0x44
je 0x18001e883
cmp eax, 0x44
jne 0x18001e8db
test r15, r15
je 0x18001e874
mov eax, dword [rbp + 0x11a0]
mov dword [r15], eax
test rbx, rbx
je 0x18001e8db
mov eax, dword [rbp + 0x11a4]
mov dword [rbx], eax
jmp 0x18001e8db
test rsi, rsi
je 0x18001e8db
movsx eax, word [rbp + 0x119c]
lea rdx, [rsp + 0x50]
mov r9d, 0x143
mov dword [rsp + 0x50], eax
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.180024e20
mov dword [rsi], eax
jmp 0x18001e8db
mov eax, dword [r12]
lea rdx, [rbp + 0xc40]
mov ecx, 0xfffffd6a
mov dword [rbp + 0x119c], eax
call qword [0x1800d5910]
movzx eax, word [rbp + 0x119a]
mov word [0x1800d5918], ax
add edi, 0x44
cmp edi, 0x15a
jb 0x18001e853
mov rbx, qword [rbp - 0x68]
mov r12, qword [rsp + 0x78]
mov edi, dword [rbp + 0x1290]
jmp 0x18001f0de
mov rsi, qword [rbp + 0x12a8]
test dword [rsi + 0x40], 0x400
je case.0x18001e4d0.82
mov byte [rsi + 0xbe], 1
jmp case.0x18001e4d0.82
mov rcx, r12
call fcn.180073cf4
jmp 0x18001f0de
mov rsi, qword [rbp + 0x12a8]
mov byte [rsi + 0xf0], 1
mov byte [rsi + 0xb6], 1
jmp case.0x18001e4d0.82
mov rax, qword [rbp + 0x12a8]
mov byte [rax + 0xeb], 1
jmp case.0x18001e4d0.82
mov rax, qword [rbp + 0x12a8]
mov byte [rax + 0xcb], 1
jmp case.0x18001e4d0.82
mov ecx, 0xfffffe58
lea rdx, [rbp + 0x60]
call qword [0x1800d5910]
jmp 0x18001f0de
mov rax, qword [rbp + 0x12a8]
mov dword [rbp + 0x5c4], eax
mov rax, qword [rbp + 0x12b0]
mov dword [rbp + 0x5c8], eax
mov word [rbp + 0x5ba], r8w
jmp case.0x18001e4d0.82
mov rsi, qword [rbp + 0x12a8]
mov byte [rsi + 0xcc], 1
mov byte [rsi + 0xce], 1
jmp case.0x18001e4d0.82
mov ecx, ebx
call fcn.180073cfc
mov qword [rsp + 0x78], rax
lea r9, [rbp - 0x70]
mov eax, 2
lea rdx, [rsp + 0x60]
mov word [rsp + 0x60], ax
mov r8d, 0x10c
mov rax, qword [rbp + 0x12a8]
mov rcx, qword [rax]
mov qword [rbp - 0x70], rcx
mov rcx, qword [rsp + 0x78]
call fcn.180059270
mov rbx, rax
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x12a0]
cmp dword [rax], 0
je 0x18001ea3f
mov rax, qword [rbp - 0x20]
xor r14d, r14d
mov dword [rbp - 0x50], eax
xor r9d, r9d
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov ecx, 0xb4
mov qword [rsp + 0x20], r14
call fcn.180052ca0
mov r15, rax
jmp 0x18001ea43
mov r15, qword [rbp - 0x20]
mov rcx, r15
mov qword [rbp - 0x70], r15
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18001ee7b
mov rbx, qword [rbp + 0x30]
mov r12d, 0xf8
mov dword [rsp + 0x50], r12d
cmp r12d, 0xf8
je 0x18001ea9b
cmp r12d, 0x4a98
jne 0x18001ee47
mov rdx, qword [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x18001ee47
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, r15
mov qword [rbp + 0x20], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov qword [rbp - 0x30], rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp - 0x60], rax
mov r14, rax
test rax, rax
je 0x18001ee43
mov r12d, dword [rbp - 0x48]
mov esi, 0x1b
mov dword [rsp + 0x60], esi
nop dword [rax]
cmp esi, 0x1b
je 0x18001edfe
cmp esi, 0x41d
je 0x18001edd4
cmp esi, 0x81f
jne 0x18001ee1d
test rbx, rbx
je 0x18001edc1
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [rbp - 0x7c]
xor r8d, r8d
mov eax, dword [rbp - 0x80]
mov edx, dword [rbp - 0x74]
mov r9d, dword [rbp - 0x78]
sub edx, ecx
mov dword [rsp + 0x40], 0xcc0020
sub r9d, eax
mov dword [rsp + 0x38], ecx
mov rcx, r14
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x18001eda5
mov r15d, dword [rbp - 0x44]
mov edi, 0x6f
mov r14, qword [rbp + 0x28]
lea esi, [rdi - 0x4f]
nop word [rax + rax]
cmp edi, 0x37b
ja 0x18001ecbd
je 0x18001ecab
cmp edi, 0x6f
je 0x18001ec84
cmp edi, 0x10b
je 0x18001ec77
cmp edi, 0x1a7
je 0x18001ec68
cmp edi, 0x243
je 0x18001ec20
cmp edi, 0x2df
jne 0x18001ed5f
mov r9d, dword [rbp + 0x48]
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rcx, qword [rsp + 0x78]
mov eax, 2
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r12d, [r15 + 0x36]
mov dword [rbp + 0x1a], 0x36
mov r13, rax
jmp 0x18001ed5f
xor eax, eax
mov ecx, 0x42
mov dword [rbp + 0xc], eax
movzx eax, word [rbp - 0xa]
imul eax, dword [rbp + 0x44]
add eax, 0x1f
cdq
and edx, 0x1f
lea r15d, [rdx + rax]
sar r15d, 5
imul r15d, dword [rbp + 0x48]
shl r15d, 2
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
jmp 0x18001ed5f
xor eax, eax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
jmp 0x18001ed5f
mov qword [rbp - 0xc], 0x200001
jmp 0x18001ed5f
lea r8, [rbp + 0x40]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [rbp + 0x44]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp + 0x48]
mov dword [rbp - 0x10], eax
mov dword [rbp - 0x18], 0x28
jmp 0x18001ed5f
mov eax, 0x4d42
mov dword [rbp + 0x12], r12d
mov word [rbp + 0x10], ax
jmp 0x18001ed5f
cmp edi, 0x417
je 0x18001ed59
cmp edi, 0x4b3
je 0x18001ed3a
cmp edi, 0x54f
je 0x18001ecec
cmp edi, 0x5eb
jne 0x18001ed5f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001ed5f
xor eax, eax
lea r9, [rsp + 0x74]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
lea r9, [rsp + 0x74]
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x18001ed5f
xor eax, eax
lea r9, [rsp + 0x74]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18001ed5f
xor eax, eax
mov dword [rsp + 0x74], eax
add edi, 0x9c
cmp edi, 0x687
jb 0x18001eb70
mov esi, dword [rsp + 0x60]
mov rcx, rbx
mov rdi, qword [rbp - 0x30]
mov qword [rbp + 0x28], r14
mov r14, qword [rbp - 0x60]
mov dword [rbp - 0x44], r15d
mov r15, qword [rbp - 0x70]
mov dword [rbp - 0x48], r12d
mov qword [rbp - 0x28], r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x18001ee1d
mov rcx, rbx
mov dword [rsp + 0x58], 3
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x18001ee1d
mov rcx, r14
mov dword [rsp + 0x58], 2
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x18001ee1d
mov edx, dword [rbp - 0x78]
mov rcx, rdi
mov eax, dword [rbp - 0x80]
add edx, 5
mov r8d, dword [rbp - 0x74]
sub eax, 5
sub r8d, dword [rbp - 0x7c]
mov dword [rbp - 0x78], edx
sub edx, eax
mov dword [rbp - 0x80], eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rbx, rax
jmp 0x18001ee1d
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, 4
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub dword [rbp - 0x7c], eax
add dword [rbp - 0x74], 5
add esi, 0x402
mov dword [rsp + 0x60], esi
cmp esi, 0xc06
jbe 0x18001eae0
mov r12d, dword [rsp + 0x50]
mov esi, 1
mov qword [rbp + 0x30], rbx
jmp 0x18001ee47
mov dword [rsp + 0x58], esi
add r12d, 0x49a0
mov dword [rsp + 0x50], r12d
cmp r12d, 0x9340
jbe 0x18001ea67
mov rbx, qword [rbp - 0x68]
mov r12, qword [rsp + 0x78]
mov edi, dword [rbp + 0x1290]
mov r15, qword [rbp + 0x1288]
jmp 0x18001f0de
mov r12, qword [rsp + 0x78]
mov r15, qword [rbp + 0x1288]
mov dword [rsp + 0x58], 4
jmp 0x18001f0de
mov eax, dword [r15]
mov dword [rbp + 0x5bc], 4
test eax, eax
jne 0x18001eeba
cmp dword [rdx], 1
jne case.0x18001e4d0.82
mov dword [rbp + 0x5bc], r10d
jmp case.0x18001e4d0.82
cmp eax, 1
jne case.0x18001e4d0.82
cmp dword [rdx], 0
jne case.0x18001e4d0.82
mov dword [rbp + 0x5bc], 3
jmp case.0x18001e4d0.82
mov rsi, qword [rbp + 0x12a8]
mov byte [rsi + 0xb1], 1
mov byte [rsi + 0xed], 1
mov byte [rsi + 0x90], 1
test dword [rsi + 0x40], 0x200
je case.0x18001e4d0.82
mov byte [rsi + 0x10e], 1
jmp case.0x18001e4d0.82
movzx eax, word [rbp + 0x5ba]
mov word [0x1800d5918], ax
jmp case.0x18001e4d0.82
mov rsi, qword [rbp + 0x12a8]
mov eax, dword [rsi + 0x40]
bt eax, 8
jae 0x18001ef3a
mov byte [rsi + 0x10c], 1
test al, 1
je case.0x18001e4d0.82
mov ecx, r8d
lea rdx, [rsi + 0x90]
movabs r11, 0x100001a00
cmp ecx, 0x20
ja 0x18001ef64
bt r11, rcx
jae 0x18001ef64
mov byte [rdx], 1
inc ecx
inc rdx
cmp ecx, 0x100
jb 0x18001ef56
jmp 0x18001f0ee
mov rax, qword [rbp + 0x12a0]
mov dword [rbp + 0x5c0], 0xffffffff
mov eax, dword [rax]
test eax, eax
jne 0x18001efbb
mov eax, dword [r9]
test eax, eax
jne 0x18001efa3
mov dword [rbp + 0x5c0], 4
jmp case.0x18001e4d0.82
cmp eax, 1
jne case.0x18001e4d0.82
mov dword [rbp + 0x5c0], 3
jmp case.0x18001e4d0.82
cmp eax, 1
jne case.0x18001e4d0.82
mov eax, dword [r9]
test eax, eax
jne 0x18001efd7
mov dword [rbp + 0x5c0], r10d
jmp case.0x18001e4d0.82
cmp eax, 1
jne case.0x18001e4d0.82
mov dword [rbp + 0x5c0], esi
jmp case.0x18001e4d0.82
mov rbx, qword [rbp + 0x12a8]
lea r9, [rsp + 0x68]
xor edx, edx
mov dword [rsp + 0x58], r8d
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x38]
mov word [rsp + 0x68], si
mov rax, qword [rbx]
lea r8d, [rdx + 0x28]
mov qword [rbp + 0x38], rax
call fcn.180068730
cdqe
lea r9, [rbp - 0x60]
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x1290]
mov eax, 2
mov r8d, 0x10c
mov word [rbp + 0x1290], ax
xor ecx, ecx
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
call fcn.180059270
mov ebx, eax
mov qword [rbp - 0x68], rbx
jmp 0x18001f0de
mov rsi, qword [rbp + 0x12a8]
mov eax, dword [rsi + 0x40]
test al, 8
je 0x18001f06d
mov byte [rsi + 0xd0], 1
test al, 4
je case.0x18001e4d0.82
mov byte [rsi + 0xca], 1
jmp case.0x18001e4d0.82
mov eax, dword [rsp + 0x58]
lea rdx, [rbp + 0x1290]
mov dword [rbp + 0x1290], eax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x12a8]
mov r8d, 0x92
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
call fcn.18004ff10
jmp 0x18001f0de
mov rsi, qword [rbp + 0x12a8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rsi + 0x90]
call fcn.180070440
mov byte [rsi + 0xec], 1
mov byte [rsi + 0xba], 1
mov byte [rsi + 0xef], 1
mov r9, qword [rbp + 0x1298]
mov r10d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x1280]
lea r11, [0x180000000]
mov r14d, dword [rsp + 0x5c]
inc edi
mov esi, 1
mov dword [rbp + 0x1290], edi
cmp edi, dword [rbp - 0x40]
jb 0x18001e4b0
mov r14, qword [rsp + 0x1338]
mov r13, qword [rsp + 0x1340]
mov r12, qword [rsp + 0x1348]
mov rsi, qword [rsp + 0x1350]
mov rbx, qword [rsp + 0x1358]
add rsp, 0x1360
pop r15
pop rdi
pop rbp
ret