Function at 0x4c0be0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11, rsp
sub rsp, 0x1e8
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov esi, r9d
mov r15, r8
mov qword [rsp + 0x70], rdx
mov r12, rcx
mov qword [rsp + 0xd0], rcx
mov qword [r11 - 0x128], rdx
xor edi, edi
mov r13d, edi
mov dword [rsp + 0x64], edi
cmp qword [rcx + 8], rdi
je 0x4c0c7d
call fcn.00473e00
mov r10, qword [rax]
lea rcx, str.mData__0
mov qword [rsp + 0x20], rcx
lea r9, str.FileAccess::BasicFile::Open
lea r8d, [rdi + 0x65]
lea rdx, str..File.cpp
mov rcx, rax
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r14, qword [rsp + 0x230]
test r14, r14
je 0x4c0cdb
mov byte [r12 + 0x58], dil
mov rax, qword [r14]
mov qword [r12 + 0x18], rax
mov rax, qword [r14 + 8]
mov qword [r12 + 0x20], rax
mov rax, qword [r14 + 0x10]
mov qword [r12 + 0x28], rax
mov rax, qword [r14 + 0x18]
mov qword [r12 + 0x30], rax
mov rax, qword [r14 + 0x20]
mov qword [r12 + 0x38], rax
mov rax, qword [r14 + 0x28]
mov qword [r12 + 0x40], rax
mov rax, qword [r14 + 0x30]
mov qword [r12 + 0x48], rax
mov rax, qword [r14 + 0x38]
mov qword [r12 + 0x50], rax
jmp 0x4c0d87
mov rcx, r12
call fcn.004bf480
mov byte [r12 + 0x58], 1
mov r8d, 0xc0
lea rdx, [rsp + 0x128]
mov rcx, r15
call fcn.00485b10
nop
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.004726c0
nop
mov rdx, rax
mov rcx, r12
call fcn.004c0230
nop
cmp qword [rsp + 0x120], 0x10
jb 0x4c0d35
mov rcx, qword [rsp + 0x108]
call fcn.00568830
mov qword [rsp + 0x120], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x118], rdi
mov byte [rsp + 0x108], 0
cmp qword [rsp + 0x148], 8
jb 0x4c0d69
mov rcx, qword [rsp + 0x130]
call fcn.00568830
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rdi
mov word [rsp + 0x130], 0
mov rbx, qword [r12 + 0x18]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x158], rbx
mov dword [rsp + 0x160], 0x72
lea rax, str..File.cpp
mov qword [rsp + 0x168], rax
test rbx, rbx
je 0x4c0dff
cmp dword [rbx + 0x88], 0
je 0x4c0de5
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.two_calls_to_Start_without_a_call_to_Stop
lea rdx, str.m_uStartCnt__0
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rbx + 0x80], rax
mov dword [rbx + 0x88], 1
mov rcx, r15
call fcn.00481e30
test rax, rax
jne 0x4c0f9c
mov r8d, 0x3003fd
lea rdx, [rsp + 0x178]
mov rcx, r15
call fcn.00485b10
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.00467ad0
nop
mov r9, qword [0x00640e40]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x80]
mov edx, 0xe7d10003
lea rcx, [rsp + 0x78]
call fcn.00465350
mov r13, rax
mov rsi, qword [r12 + 0x10]
cmp rsi, qword [rax]
je 0x4c0eb6
test rsi, rsi
je 0x4c0ea0
add dword [rsi], 0xffffffff
jne 0x4c0ea0
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
mov rax, qword [r13]
test rax, rax
je 0x4c0eae
add dword [rax], 1
jmp 0x4c0eb1
mov rax, rdi
mov qword [r12 + 0x10], rax
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x4c0ec5
add dword [rax], 1
jmp 0x4c0ec8
mov rax, rdi
mov r12, qword [rsp + 0x70]
mov qword [r12], rax
mov dword [rsp + 0x64], 1
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x4c0efc
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c0efc
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
lea rcx, [rsp + 0x80]
call fcn.004679c0
nop
cmp qword [rsp + 0x198], 8
jb 0x4c0f22
mov rcx, qword [rsp + 0x180]
call fcn.00568830
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], 0
test rbx, rbx
je 0x4c0f94
cmp dword [rbx + 0x88], 1
je 0x4c0f76
lea rax, str..File.cpp
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.Stop_called_without_corresponding_call_to_Start__m_uStartCnt__0__or_ReentrantStop_should_have_been_called__m_uStartCnt___1_
lea rdx, str.m_uStartCnt__1
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, qword [rbx + 0x80]
add qword [rbx + 0x18], rax
add dword [rbx + 8], 1
mov dword [rbx + 0x88], edi
mov rax, r12
jmp 0x4c18e5
mov qword [rsp + 0x68], rdi
mov rcx, r15
call fcn.00481e30
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x220]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x218]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x210]
mov r8d, esi
mov rdx, r15
mov rcx, rax
call fcn.004c48a0
mov rsi, rax
test rax, rax
jne 0x4c12ae
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x4c10ff
mov eax, dword [rsi + 4]
test eax, eax
je 0x4c10ff
test eax, 0xffff0000
jg 0x4c10ff
mov r13, qword [r12 + 0x10]
cmp r13, rsi
je 0x4c105d
test r13, r13
je 0x4c1043
add dword [r13], 0xffffffff
jne 0x4c103e
mov rcx, r13
call fcn.0045f110
mov rcx, r13
call fcn.00568830
mov rsi, qword [rsp + 0x68]
jmp 0x4c1043
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x4c1055
add dword [rsi], 1
mov rax, rsi
mov rsi, qword [rsp + 0x68]
jmp 0x4c1058
mov rax, rdi
mov qword [r12 + 0x10], rax
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x4c1071
add dword [rax], 1
mov rsi, qword [rsp + 0x68]
jmp 0x4c1074
mov rax, rdi
mov r12, qword [rsp + 0x70]
mov qword [r12], rax
mov dword [rsp + 0x64], 1
test rsi, rsi
je 0x4c10a3
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c10a3
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
test rbx, rbx
je 0x4c10f7
cmp dword [rbx + 0x88], 1
je 0x4c10d9
lea rax, str..File.cpp
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.Stop_called_without_corresponding_call_to_Start__m_uStartCnt__0__or_ReentrantStop_should_have_been_called__m_uStartCnt___1_
lea rdx, str.m_uStartCnt__1
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, qword [rbx + 0x80]
add qword [rbx + 0x18], rax
add dword [rbx + 8], 1
mov dword [rbx + 0x88], edi
mov rax, r12
jmp 0x4c18e5
mov r8d, 0x3003fd
lea rdx, [rsp + 0x178]
mov rcx, r15
call fcn.00485b10
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.00467ad0
nop
mov r9, qword [0x00640e40]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x80]
mov edx, 0xe7d1001d
lea rcx, [rsp + 0x78]
call fcn.00465350
mov r13, rax
mov rsi, qword [r12 + 0x10]
cmp rsi, qword [rax]
je 0x4c11a5
test rsi, rsi
je 0x4c118f
add dword [rsi], 0xffffffff
jne 0x4c118f
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
mov rax, qword [r13]
test rax, rax
je 0x4c119d
add dword [rax], 1
jmp 0x4c11a0
mov rax, rdi
mov qword [r12 + 0x10], rax
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x4c11b4
add dword [rax], 1
jmp 0x4c11b7
mov rax, rdi
mov r12, qword [rsp + 0x70]
mov qword [r12], rax
mov dword [rsp + 0x64], 1
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x4c11eb
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c11eb
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
lea rcx, [rsp + 0x80]
call fcn.004679c0
nop
cmp qword [rsp + 0x198], 8
jb 0x4c1211
mov rcx, qword [rsp + 0x180]
call fcn.00568830
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], 0
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x4c1252
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c1252
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
test rbx, rbx
je 0x4c12a6
cmp dword [rbx + 0x88], 1
je 0x4c1288
lea rax, str..File.cpp
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.Stop_called_without_corresponding_call_to_Start__m_uStartCnt__0__or_ReentrantStop_should_have_been_called__m_uStartCnt___1_
lea rdx, str.m_uStartCnt__1
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, qword [rbx + 0x80]
add qword [rbx + 0x18], rax
add dword [rbx + 8], 1
mov dword [rbx + 0x88], edi
mov rax, r12
jmp 0x4c18e5
mov dword [rsp + 0x20], edi
lea r9, [0x00641d88]
lea r8, [0x00641d50]
xor edx, edx
mov rcx, rax
call fcn.0056bc80
mov qword [r12 + 8], rax
test rax, rax
je 0x4c12d8
add dword [rsi + 8], 1
add dword [rsi + 8], 0xffffffff
jne 0x4c12ec
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp qword [r12 + 8], 0
jne 0x4c1528
lea rdx, [0x00648a58]
lea rcx, [0x00641d88]
call fcn.00568840
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.00472540
nop
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.00467ad0
nop
mov r8d, 0x3003fd
lea rdx, [rsp + 0x178]
mov rcx, r15
call fcn.00485b10
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.00467ad0
nop
mov rax, qword [0x00640e40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x80]
mov edx, 0xe7d10005
lea rcx, [rsp + 0x78]
call fcn.00465350
mov r13, rax
mov rsi, qword [r12 + 0x10]
cmp rsi, qword [rax]
je 0x4c13db
test rsi, rsi
je 0x4c13c5
add dword [rsi], 0xffffffff
jne 0x4c13c5
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
mov rax, qword [r13]
test rax, rax
je 0x4c13d3
add dword [rax], 1
jmp 0x4c13d6
mov rax, rdi
mov qword [r12 + 0x10], rax
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x4c13ea
add dword [rax], 1
jmp 0x4c13ed
mov rax, rdi
mov r12, qword [rsp + 0x70]
mov qword [r12], rax
mov dword [rsp + 0x64], 1
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x4c1421
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c1421
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
lea rcx, [rsp + 0x80]
call fcn.004679c0
nop
cmp qword [rsp + 0x198], 8
jb 0x4c1447
mov rcx, qword [rsp + 0x180]
call fcn.00568830
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], 0
lea rcx, [rsp + 0xd8]
call fcn.004679c0
nop
cmp qword [rsp + 0xb8], 8
jb 0x4c148b
mov rcx, qword [rsp + 0xa0]
call fcn.00568830
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], 0
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x4c14cc
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c14cc
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
test rbx, rbx
je 0x4c1520
cmp dword [rbx + 0x88], 1
je 0x4c1502
lea rax, str..File.cpp
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.Stop_called_without_corresponding_call_to_Start__m_uStartCnt__0__or_ReentrantStop_should_have_been_called__m_uStartCnt___1_
lea rdx, str.m_uStartCnt__1
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, qword [rbx + 0x80]
add qword [rbx + 0x18], rax
add dword [rbx + 8], 1
mov dword [rbx + 0x88], edi
mov rax, r12
jmp 0x4c18e5
test r14, r14
jne 0x4c15b1
mov r8d, 0xc0
lea rdx, [rsp + 0x178]
mov rcx, r15
call fcn.00485b10
nop
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.004726c0
nop
mov rdx, rax
mov rcx, r12
call fcn.004c06a0
nop
cmp qword [rsp + 0xb8], 0x10
jb 0x4c157d
mov rcx, qword [rsp + 0xa0]
call fcn.00568830
mov qword [rsp + 0xb8], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0xb0], rdi
mov byte [rsp + 0xa0], 0
cmp qword [rsp + 0x198], 8
jb 0x4c15b1
mov rcx, qword [rsp + 0x180]
call fcn.00568830
cmp byte [rsp + 0x228], 0
je 0x4c17b3
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], 0
xor r8d, r8d
lea edx, [r8 + 0x12]
lea rcx, [rsp + 0x178]
call fcn.005118a0
lea rcx, [rsp + 0x180]
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x180]
add rdx, rdx
mov r9d, SafeArrayAllocDescriptorEx
lea r8, str.unthrottled_volume
call fcn.00568a50
mov qword [rsp + 0x190], SafeArrayUnlock
lea rax, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rax, qword [rsp + 0x180]
mov word [rax + 0x24], 0
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, 0xbab01f9
lea rdx, [rsp + 0x80]
mov rcx, r15
call fcn.00481e60
nop
cmp byte [rsp + 0x60], 0
je 0x4c16b8
mov edx, 1
lea rcx, [rsp + 0xd8]
call fcn.004678e0
nop
mov r13d, 2
mov dword [rsp + 0x64], r13d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.00507210
test al, al
je 0x4c16b8
mov sil, 1
jmp 0x4c16bb
xor sil, sil
test r13b, 2
je 0x4c16d7
and r13d, 0xfffffffd
mov dword [rsp + 0x64], r13d
lea rcx, [rsp + 0xd8]
call fcn.004679c0
test sil, sil
je 0x4c1778
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0xd8]
mov rcx, r15
call fcn.00485b10
nop
mov r8, rax
lea rdx, [0x005cbdd0]
lea rcx, [rsp + 0x98]
call fcn.0040ccb0
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.00546900
nop
cmp qword [rsp + 0xb8], 8
jb 0x4c1742
mov rcx, qword [rsp + 0xa0]
call fcn.00568830
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], 0
cmp qword [rsp + 0xf8], 8
jb 0x4c1778
mov rcx, qword [rsp + 0xe0]
call fcn.00568830
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x178]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x80]
call fcn.004679c0
nop
cmp qword [rsp + 0x198], 8
jb 0x4c17b3
mov rcx, qword [rsp + 0x180]
call fcn.00568830
nop
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x4c17d6
add dword [rsi], 0xffffffff
cmp dword [rsi], 0
jne 0x4c17d6
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
nop
mov qword [rsp + 0xc8], rdi
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x4c1802
add dword [rsi], 0xffffffff
jne 0x4c17fd
mov rcx, rsi
call fcn.0045f110
mov rcx, rsi
call fcn.00568830
mov qword [r12 + 0x10], rdi
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x4c1811
add dword [rax], 1
jmp 0x4c1814
mov rax, rdi
mov r12, qword [rsp + 0x70]
mov qword [r12], rax
or r13d, 1
mov dword [rsp + 0x64], r13d
test rbx, rbx
je 0x4c187a
cmp dword [rbx + 0x88], 1
je 0x4c185c
lea rax, str..File.cpp
mov qword [rsp + 0x20], rax
mov r9d, 0x72
lea r8, str.Stop_called_without_corresponding_call_to_Start__m_uStartCnt__0__or_ReentrantStop_should_have_been_called__m_uStartCnt___1_
lea rdx, str.m_uStartCnt__1
mov rcx, rbx
call fcn.004a4dc0
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, qword [rbx + 0x80]
add qword [rbx + 0x18], rax
add dword [rbx + 8], 1
mov dword [rbx + 0x88], edi
mov rax, r12
jmp 0x4c18e5
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.00568fb0
mov rbx, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1d8]
mov rdi, qword [rsp + 0x1d0]
mov r12, qword [rsp + 0x1c8]
mov r13, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x1b8]
mov r15, qword [rsp + 0x1b0]
add rsp, 0x1e8
ret