Function at 0x14000e9d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [0x14003fb68]
call fcn.1400130e0
test rax, rax
je 0x14000edcc
call fcn.140017370
ucomisd xmm0, qword [0x1400353e8]
jp 0x14000eb9f
jne 0x14000eb9f
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x19], rax
lea rbx, vtable.CVolObject.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r14
lea rcx, vtable.CWString.0
mov qword [rbp - 0x19], rcx
lea rdx, [rbp + 7]
mov qword [rbp + 0x67], rdx
mov qword [rbp + 7], rax
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
lea rdi, vtable.CVolMem.0
mov qword [rbp + 7], rdi
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x37], 0x40
mov qword [rbp - 1], r14
mov qword [rbp + 0x37], 0xfe
lea r8, vtable.CWConstString.0
mov qword [rbp - 0x19], r8
lea rdx, [0x140033898]
mov qword [rbp - 1], rdx
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x79], rcx
lea rcx, [rbp - 0x59]
mov qword [rbp + 0x67], rcx
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], 0x40
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x29], 0xfe
mov qword [rbp - 0x79], r8
lea rax, str.error_systemtime
mov qword [rbp - 0x61], rax
lea rdx, [0x1400338a0]
mov r8, rdx
mov rax, qword [rbp - 1]
test rax, rax
cmovne r8, rax
mov rax, qword [rbp - 0x61]
test rax, rax
cmovne rdx, rax
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rax, [rbp - 0x59]
mov qword [rbp + 0x67], rax
mov qword [rbp - 0x59], rdi
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14000eb52
lea rcx, [rbp - 0x59]
mov rax, qword [rbp - 0x59]
call qword [rax + 0x18]
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x79], rbx
lea rax, [rbp + 7]
mov qword [rbp + 0x67], rax
mov qword [rbp + 7], rdi
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
je 0x14000eb86
lea rcx, [rbp + 7]
mov rax, qword [rbp + 7]
call qword [rax + 0x18]
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x27], r14
mov qword [rbp + 7], rbx
mov qword [rbp - 0x19], rbx
jmp 0x14000edc7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 1
je 0x14000edc7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov dword [rbp + 0x67], r14d
lea rdx, [rbp + 0x67]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x67], 0xffffffff
je 0x14000ed92
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x79], rax
lea rbx, vtable.CVolObject.0
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], r14
lea rcx, vtable.CWString.0
mov qword [rbp - 0x79], rcx
lea rcx, [rbp - 0x59]
mov qword [rbp + 0x67], rcx
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
lea rdi, vtable.CVolMem.0
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], 0x40
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x29], 0xfe
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], r14
mov edx, 0x20a
lea rcx, [rbp - 0x59]
call fcn.140014b30
mov rcx, rax
lea rdx, str.76440000EC4E8DE56FDF987FC813230392245614D7F75960282E97295599C6BDA6F63E95A3E69FF8DF9E765D9AE45A702E1D99EB581B05403F60E00EB4D0B71A818EB21FF9F86971E05719D8651FE3EA7C887340FA9B6E58FC558552983F99F64010F9F4D0DEDE76786D234679158CA82FE84413BC9959C438211A94642BAF32BD01
mov eax, 4
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x14000ec90
mov rax, qword [rdx]
mov qword [rcx], rax
movzx eax, word [rdx + 8]
mov word [rcx + 8], ax
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.14000dd50
mov rsi, rax
mov dword [rsp + 0x20], 1
lea rax, [rbp - 0x59]
mov qword [rbp + 0x67], rax
mov qword [rbp - 0x59], rdi
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14000ed28
lea rcx, [rbp - 0x59]
mov rax, qword [rbp - 0x59]
call qword [rax + 0x18]
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x79], rbx
mov edx, 0x14
mov rcx, rsi
call fcn.140001260
cmp eax, 1
sete sil
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x20], eax
mov qword [rbp - 0x19], rdi
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x14000ed74
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 7], r14
mov qword [rbp - 0x19], rbx
test sil, sil
je 0x14000edc7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
jne 0x14000eda2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret