Function at 0x140024060
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x15f0]
mov eax, 0x16f0
call fcn.1400a5130
sub rsp, rax
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rbp + 0x15e0], rax
mov rbx, rcx
lea rcx, [rbp + 0x592]
xor r14d, r14d
xor edx, edx
mov r8d, 0x1046
mov word [rbp + 0x590], r14w
call fcn.1400a4ea0
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], r14w
call fcn.1400a4ea0
lea rcx, [rbp + 0x382]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x380], r14w
call fcn.1400a4ea0
lea r13d, [r14 + 1]
call fcn.140019370
mov r12d, 0x104
lea rdx, [rbp + 0x380]
xor ecx, ecx
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [r14 + 0x5c]
lea rcx, [rbp + 0x380]
call fcn.1400a6680
test rax, rax
je 0x140024130
mov word [rax + 2], r14w
lea rdi, str.donate
mov rsi, rbx
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002418e
lea rdi, str.Donation.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024160
jmp 0x140024d88
lea rdi, str.main
mov rsi, rbx
mov ecx, 5
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024206
lea rdi, str.https:__www.idrix.fr_
lea rax, [rbp + 0x590]
mov ecx, 0x824
sub rdi, rax
lea rdx, [rbp + 0x590]
nop
lea rax, [rcx + 0x7ffff7da]
test rax, rax
je 0x1400241f1
movzx eax, word [rdx + rdi]
test ax, ax
je 0x1400241f1
mov word [rdx], ax
add rdx, 2
dec rcx
jne 0x1400241c0
sub rdx, 2
mov r13d, r14d
mov word [rdx], r14w
jmp 0x140024def
test rcx, rcx
jne 0x1400241fa
sub rdx, 2
mov word [rdx], r14w
mov r13d, r14d
jmp 0x140024def
lea rdi, str.localizations
mov rsi, rbx
mov ecx, 0xe
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002425e
lea rdi, str.Language_20Packs.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024230
jmp 0x140024d88
lea rdi, str.beginnerstutorial
mov rsi, rbx
mov ecx, 0x12
repe cmpsb byte [rsi], byte [rdi]
je 0x140024d43
lea rdi, str.tutorial
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
je 0x140024d43
lea rdi, str.releasenotes
mov rsi, rbx
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
je 0x140024d06
lea rdi, str.history
mov rsi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
je 0x140024d06
lea rdi, str.hwacceleration
mov rsi, rbx
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002431e
lea rdi, str.Hardware_20Acceleration.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400242f0
jmp 0x140024d88
lea rdi, str.parallelization
mov rsi, rbx
mov ecx, 0x10
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002437e
lea rdi, str.Parallelization.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024350
jmp 0x140024d88
lea rdi, str.help
mov rsi, rbx
mov ecx, 5
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400243de
lea rdi, str.Documentation.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400243b0
jmp 0x140024d88
lea rdi, str.onlinehelp
mov rsi, rbx
mov ecx, 0xb
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024456
lea rdi, str.https:__www.veracrypt.fr_en_Documentation.html
lea rax, [rbp + 0x590]
mov ecx, 0x824
sub rdi, rax
lea rdx, [rbp + 0x590]
nop
lea rax, [rcx + 0x7ffff7da]
test rax, rax
je 0x140024441
movzx eax, word [rdx + rdi]
test ax, ax
je 0x140024441
mov word [rdx], ax
add rdx, 2
dec rcx
jne 0x140024410
sub rdx, 2
mov r13d, r14d
mov word [rdx], r14w
jmp 0x140024def
test rcx, rcx
jne 0x14002444a
sub rdx, 2
mov word [rdx], r14w
mov r13d, r14d
jmp 0x140024def
lea rdi, str.keyfiles
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400244ae
lea rdi, str.Keyfiles.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024480
jmp 0x140024d88
lea rdi, str.introcontainer
mov rsi, rbx
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002450e
lea rdi, str.Creating_20New_20Volumes.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400244e0
jmp 0x140024d88
lea rdi, str.introsysenc
mov rsi, rbx
mov ecx, 0xc
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002456e
lea rdi, str.System_20Encryption.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024540
jmp 0x140024d88
lea rdi, str.hiddensysenc
mov rsi, rbx
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400245ce
lea rdi, str.VeraCrypt_20Hidden_20Operating_20System.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400245a0
jmp 0x140024d88
lea rdi, str.sysencprogressinfo
mov rsi, rbx
mov ecx, 0x13
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002462e
lea rdi, str.System_20Encryption.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024600
jmp 0x140024d88
lea rdi, str.hiddenvolume
mov rsi, rbx
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002468e
lea rdi, [0x1400d0050]
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024660
jmp 0x140024d88
lea rdi, [0x1400d004c]
mov rsi, rbx
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400246ee
lea rdi, str.AES.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400246c0
jmp 0x140024d88
lea rdi, str.serpent
mov rsi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002474e
lea rdi, str.Serpent.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024720
jmp 0x140024d88
lea rdi, str.twofish
mov rsi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400247ae
lea rdi, str.Twofish.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024780
jmp 0x140024d88
lea rdi, str.kuznyechik
mov rsi, rbx
mov ecx, 0xb
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002480e
lea rdi, str.Kuznyechik.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400247e0
jmp 0x140024d88
lea rdi, str.camellia
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002486e
lea rdi, str.Camellia.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024840
jmp 0x140024d88
lea rdi, str.cascades
mov rsi, rbx
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400248ce
lea rdi, str.Cascades.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400248a0
jmp 0x140024d88
lea rdi, str.hashalgorithms
mov rsi, rbx
mov ecx, 0xf
repe cmpsb byte [rsi], byte [rdi]
jne 0x14002492e
lea rdi, str.Hash_20Algorithms.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024900
jmp 0x140024d88
lea rdi, str.isoburning
mov rsi, rbx
mov ecx, 0xb
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400249a6
lea rdi, str.https:__cdburnerxp.se_en_home
lea rax, [rbp + 0x590]
mov ecx, 0x824
sub rdi, rax
lea rdx, [rbp + 0x590]
nop
lea rax, [rcx + 0x7ffff7da]
test rax, rax
je 0x140024991
movzx eax, word [rdi + rdx]
test ax, ax
je 0x140024991
mov word [rdx], ax
add rdx, 2
dec rcx
jne 0x140024960
sub rdx, 2
mov r13d, r14d
mov word [rdx], r14w
jmp 0x140024def
test rcx, rcx
jne 0x14002499a
sub rdx, 2
mov word [rdx], r14w
mov r13d, r14d
jmp 0x140024def
lea rdi, str.sysfavorites
mov rsi, rbx
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400249fe
lea rdi, str.System_20Favorite_20Volumes.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400249d0
jmp 0x140024d88
lea rdi, str.favorites
mov rsi, rbx
mov ecx, 0xa
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024a5e
lea rdi, str.Favorite_20Volumes.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024a30
jmp 0x140024d88
lea rdi, str.hiddenvolprotection
mov rsi, rbx
mov ecx, 0x14
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024abe
lea rdi, [0x1400cfdc0]
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024a90
jmp 0x140024d88
lea rdi, [0x1400cfdbc]
mov rsi, rbx
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024b1e
lea rdi, str.FAQ.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024af0
jmp 0x140024d88
lea rdi, str.downloads
mov rsi, rbx
mov ecx, 0xa
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024b7e
lea rdi, str.Downloads.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024b50
jmp 0x140024d88
lea rdi, str.news
mov rsi, rbx
mov ecx, 5
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024bde
lea rdi, str.News.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024bb0
jmp 0x140024d88
lea rdi, str.contact
mov rsi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024c3e
lea rdi, str.Contact.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024c10
jmp 0x140024d88
lea rdi, [0x1400cfd28]
mov rsi, rbx
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
jne 0x140024c9e
lea rdi, str.Personal_20Iterations_20Multiplier_20_28PIM_29.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024c70
jmp 0x140024d88
lea rdi, str.https:__www.veracrypt.fr
lea rax, [rbp + 0x590]
mov ecx, 0x824
sub rdi, rax
lea rdx, [rbp + 0x590]
nop dword [rax + rax]
lea rax, [rcx + 0x7ffff7da]
test rax, rax
je 0x140024cf1
movzx eax, word [rdx + rdi]
test ax, ax
je 0x140024cf1
mov word [rdx], ax
add rdx, 2
dec rcx
jne 0x140024cc0
sub rdx, 2
mov r13d, r14d
mov word [rdx], r14w
jmp 0x140024def
test rcx, rcx
jne 0x140024cfa
sub rdx, 2
mov word [rdx], r14w
mov r13d, r14d
jmp 0x140024def
lea rdi, str.Release_20Notes.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024d20
jmp 0x140024d88
lea rdi, str.Beginner_27s_20Tutorial.html
lea rax, [rsp + 0x60]
mov rdx, r12
sub rdi, rax
lea rcx, [rsp + 0x60]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140024d83
movzx eax, word [rdi + rcx]
test ax, ax
je 0x140024d83
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140024d60
jmp 0x140024d88
test rdx, rdx
jne 0x140024d8c
sub rcx, 2
mov word [rcx], r14w
lea rax, [rsp + 0x60]
lea r9, [rbp + 0x380]
lea rcx, [rbp + 0x590]
lea r8, str.file:____sdocs_html_en__s
mov edx, 0x1048
mov qword [rsp + 0x20], rax
call section..text
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x590]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x140024def
lea edx, [rax + 0x2f]
cmp word [rbp + rax*2 + 0x590], 0x5c
jne 0x140024de7
mov word [rbp + rax*2 + 0x590], dx
inc rax
cmp rax, rcx
jb 0x140024dd4
mov eax, dword [0x140196f30]
test eax, eax
jg 0x140024e07
mov byte [0], r14b
mov eax, dword [0x140196f30]
shl eax, 8
or eax, dword [0x140196f34]
shl eax, 8
or eax, dword [0x140196f38]
cmp eax, 0x60000
jl 0x140024fc3
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140024fc3
mov esi, r14d
test r13d, r13d
je 0x140024fb5
lea rcx, [rbp + 0x172]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x170], r14w
call fcn.1400a4ea0
lea rdx, [rsp + 0x60]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x30], r12d
lea rcx, [rbp + 0x170]
sub rdx, rax
nop word [rax + rax]
lea rax, [r12 + 0x7ffffefa]
test rax, rax
je 0x140024ea4
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140024ea4
mov word [rcx], ax
add rcx, 2
dec r12
jne 0x140024e80
jmp 0x140024ea9
test r12, r12
jne 0x140024ead
sub rcx, 2
mov word [rcx], r14w
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x170]
mov r9d, 0x100000
call qword [0x140197380]
test eax, eax
jne 0x140024fb5
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x380]
repne scasw ax, word [rdi]
lea rdx, [rbp + 0x380]
mov qword [rsp + 0x50], 7
not rcx
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140006260
lea rdx, str.docshtmlen_
lea rcx, [rsp + 0x38]
mov r8d, 0xd
call fcn.14000b850
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x170]
lea rdx, [rbp + 0x170]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.14000b850
cmp qword [rsp + 0x50], 8
lea rcx, [rsp + 0x38]
cmovae rcx, qword [rsp + 0x38]
call fcn.14001c430
test eax, eax
jne 0x140024f9b
lea r9, [rsp + 0x60]
lea r8, str.https:__www.veracrypt.fr_en__s
lea rcx, [rbp + 0x590]
mov edx, 0x1048
call section..text
lea rcx, [rbp + 0x590]
call fcn.140020aa0
mov esi, 1
cmp qword [rsp + 0x50], 8
jb 0x140024fad
mov rcx, qword [rsp + 0x38]
call fcn.1400a58b8
test esi, esi
jne 0x14002503b
lea rcx, [rbp + 0x590]
call fcn.140020aa0
jmp 0x14002503b
lea r8, [rbp + 0x590]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 2
je 0x140024ff3
cmp eax, 3
jne 0x14002503b
test r13d, r13d
je 0x14002503b
lea r9, [rsp + 0x60]
lea r8, str.https:__www.veracrypt.fr_en__s
lea rcx, [rbp + 0x590]
mov edx, 0x1048
call section..text
lea r8, [rbp + 0x590]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x140197428]
test rax, rax
jne 0x140025066
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x140197428], rax
mov ecx, dword [0x1401973cc]
test ecx, ecx
jle 0x14002507a
dec ecx
mov dword [0x1401973cc], ecx
test ecx, ecx
jne 0x140025095
cmp dword [0x140196ef0], r14d
jne 0x14002508e
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [0x1401971c8], r14
mov rcx, qword [rbp + 0x15e0]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x16f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret