Function at 0x18003fca0
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rdi, r8
mov r15, rdx
mov r14, qword [rbp + 0x1c8]
xor r12d, r12d
mov rsi, qword [rbp + 0x1c0]
test rsi, rsi
je 0x18003fd09
mov qword [rsi + 0x18], r12
mov rdx, qword [rsi + 0x38]
test rdx, rdx
je 0x18003fcfd
mov rax, qword [rsi + 0x20]
lea rcx, [rsi + 0x20]
call qword [rax + Ordinal_26]
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x48], r12
mov qword [rsi + 0x40], r12
test r14, r14
je 0x18003fd32
mov qword [r14 + 0x18], r12
mov rdx, qword [r14 + 0x38]
test rdx, rdx
je 0x18003fd26
mov rax, qword [r14 + 0x20]
lea rcx, [r14 + 0x20]
call qword [rax + Ordinal_26]
mov qword [r14 + 0x38], r12
mov qword [r14 + 0x48], r12
mov qword [r14 + 0x40], r12
mov rax, qword [rbp + 0x1d8]
test rax, rax
je 0x18003fd44
mov dword [rax], 0xffffffff
test r15, r15
je 0x180040b69
cmp word [r15], r12w
je 0x180040b69
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x20], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov r13, qword [rbp + 0x1e0]
test r13, r13
je 0x18003fdbb
cmp qword [r13], rax
jne 0x18003fda3
mov r13, r12
mov ecx, dword [rbp + 0x1b8]
mov dword [rbp + 0x1a8], ecx
mov edx, dword [rbp + 0x1b8]
mov dword [rbp + 0x1d0], edx
jmp 0x18003fdd3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x1a8], eax
mov edx, dword [r13 + 8]
mov dword [rbp + 0x1d0], edx
jmp 0x18003fdd9
mov eax, dword [rbp + 0x1b8]
mov dword [rbp + 0x1a8], eax
mov eax, dword [rbp + 0x1b8]
mov dword [rbp + 0x1d0], eax
mov eax, dword [rbp + 0x1b8]
mov dword [rbp + 0x1c8], eax
mov r12, 0xffffffffffffffff
mov dword [rbp + 0x1b8], r12d
xor eax, eax
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0xa0], Ordinal_27
mov dword [rbp + 0xb0], 1
test rsi, rsi
je 0x18003fe46
xor r9d, r9d
lea r8, [rbp + 0xa0]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18003fe46
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x20], rax
jmp 0x180040abe
test r14, r14
je 0x18003fe76
xor r9d, r9d
lea r8, [rbp + 0xa0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18003fe76
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x18], rax
jmp 0x180040abe
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movaps xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0xf0], WSAGetLastError
mov dword [rbp + 0x12c], 0x101
xor edx, edx
mov word [rbp + 0x130], dx
psrldq xmm0, 8
movq rax, xmm0
test rsi, rsi
cmovne rax, qword [rbp - 0x38]
mov qword [rbp + 0x148], rax
test r14, r14
cmovne rcx, qword [rbp - 0x30]
mov qword [rbp + 0x150], rcx
mov ebx, 1
mov qword [rbp - 0x40], rbx
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x40], rcx
lea r8, vtable.CVolObject.0
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rdx
lea rax, vtable.CWString.0
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x60]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x70], rdx
lea r9, vtable.CVolMem.0
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x80], rdx
mov eax, 0x40
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x90], 0xfe
mov qword [rbp + 8], rcx
mov qword [rbp + 8], r8
mov qword [rbp + 0x10], rdx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 8], r9
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], rax
mov rdx, r15
lea rcx, [rbp + 8]
call fcn.1800419e0
test rdi, rdi
jne 0x18003ffaa
xor eax, eax
mov edi, eax
jmp 0x18003ffc1
cmp word [rdi], 0
jne 0x18003ffbf
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.18003fab0
mov rdi, rax
xor eax, eax
mov rdx, qword [rbp + 0x20]
cmp qword [rbp + 0x30], 0
cmove rdx, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180040089
mov qword [rbp - 0x10], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp + 8], r14
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x180040030
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + Ordinal_26]
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x28], rdi
lea rsi, vtable.CVolObject.0
mov qword [rbp + 8], rsi
lea rax, [rbp + 0x60]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x60], r14
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x18004006a
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x60]
call qword [rax + Ordinal_26]
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x40], rsi
jmp 0x180040abe
test rsi, rsi
je 0x1800400a0
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov qword [rbp - 0x38], rbx
jmp 0x1800400a2
xor ebx, ebx
test r14, r14
je 0x1800400b5
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], rbx
mov dword [rbp + 0x1b8], ebx
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x78], rax
lea rcx, vtable.CVolObject.0
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rdx, vtable.CVolMem.0
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x58], rbx
mov r8d, 0x40
mov qword [rbp - 0x48], r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], r8
test rsi, rsi
jne 0x180040130
test r13, r13
je 0x1800401aa
mov rax, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x50]
sub rax, rdi
cmp rax, 2
jl 0x180040150
mov rax, qword [rbp - 0x60]
mov word [rdi + rax], bx
add qword [rbp - 0x50], 2
jmp 0x1800401aa
lea rsi, [rdi + 2]
cmp rsi, rdi
jne 0x18004015f
mov rax, qword [rbp - 0x60]
jmp 0x1800401a6
test rsi, rsi
jne 0x180040175
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x58], rbx
mov rax, rbx
jmp 0x1800401a6
mov rbx, qword [rbp - 0x48]
mov rax, rsi
cqo
idiv rbx
sub rbx, rdx
add rbx, rsi
mov rdx, rbx
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rsi
xor ebx, ebx
lea r8d, [rbx + 0x40]
mov word [rax + rdi], bx
test r14, r14
jne 0x1800401b8
test r13, r13
je 0x1800402a6
mov rdx, qword [rsp + 0x70]
mov rax, rdx
mov rsi, qword [rsp + 0x78]
sub rax, rsi
cmp rax, 2
jl 0x1800401e2
mov rax, qword [rsp + 0x68]
mov word [rsi + rax], bx
add qword [rsp + 0x78], 2
jmp 0x1800402a6
lea rdi, [rsi + 2]
cmp rdi, rsi
jne 0x1800401f5
mov rcx, qword [rsp + 0x68]
jmp 0x1800402a2
test rdi, rdi
jne 0x180040225
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x180040211
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + Ordinal_26]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov rcx, rbx
jmp 0x1800402a2
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rbp - 0x80]
test rcx, rcx
jne 0x180040259
test rbx, rbx
cmovle rbx, r8
mov rax, rdi
cqo
idiv rbx
sub rbx, rdx
add rbx, rdi
mov rdx, rbx
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax]
jmp 0x18004028e
test rbx, rbx
cmovle rbx, r8
cmp rdx, rdi
jl 0x18004026d
sub rdx, rdi
cmp rdx, rbx
jle 0x18004029b
mov rax, rdi
cqo
idiv rbx
sub rbx, rdx
add rbx, rdi
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, rax
mov qword [rsp + 0x78], rdi
xor ebx, ebx
mov word [rcx + rsi], bx
mov dword [rbp + 0x1a0], ebx
test r13, r13
je 0x1800402ec
mov qword [rbp + 0xc8], r15
lea rax, [rbp - 0x78]
mov qword [rbp + 0xd0], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0xd8], rax
mov rax, qword [r13 + 0x10]
mov qword [rbp + 0xe0], rax
mov rax, qword [r13 + 0x18]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xc0], rbx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x40]
jmp 0x1800402f9
xor ebx, ebx
test rsi, rsi
je 0x180040324
mov edx, 0x64
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x180040555
mov rsi, rbx
mov qword [rbp - 0x40], rbx
mov rdi, qword [rsp + 0x68]
mov r15d, dword [rbp + 0x1a0]
mov qword [rbp - 0x28], rbx
cmp qword [rbp + 0x1c0], 0
je 0x180040353
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x78]
mov rcx, qword [rbp - 0x20]
call fcn.18003f3b0
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rbp - 0x28]
xor ecx, ecx
mov eax, ecx
mov qword [rbp - 0x28], rcx
test r14, r14
je 0x18004037d
lea r9, [rbp - 0x28]
lea r8, [rsp + 0x50]
mov rcx, qword [rbp - 0x18]
call fcn.18003f3b0
mov rdi, qword [rsp + 0x68]
mov rax, qword [rbp - 0x28]
xor ecx, ecx
test rbx, rbx
jg 0x1800402f7
test rax, rax
jg 0x1800402f7
test rsi, rsi
jne 0x1800402f7
mov dword [rbp + 0x1b8], ecx
mov qword [rbp - 0x40], rsi
mov rbx, rsi
test r13, r13
je 0x1800403f2
mov dword [rbp + 0x1b8], ecx
mov qword [rbp - 0x40], rbx
test r15d, r15d
jne 0x1800403f2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x1a8]
mov dword [rbp + 0xb8], eax
mov qword [rbp + 0xc0], 1
lea rcx, [rbp + 0xb8]
call qword [r13]
xor ecx, ecx
mov dword [rbp + 0x1b8], ecx
mov qword [rbp - 0x40], rbx
mov rdi, qword [rsp + 0x68]
mov r13d, ecx
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1800404ad
mov rbx, qword [rbp - 0x60]
cmp qword [rbp - 0x50], 0
cmove rbx, rcx
mov rax, qword [rdx + 0x18]
test rax, rax
jne 0x18004042c
cmp qword [rdx + 0x48], rax
lea rax, [0x1800f7c64]
je 0x18004042c
mov rax, qword [rdx + 0x38]
cmp rbx, rax
je 0x1800404ad
mov qword [rdx + 0x18], rcx
lea rsi, [rdx + 0x20]
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x180040452
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + Ordinal_26]
mov rdi, qword [rsp + 0x68]
xor ecx, ecx
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x28], rcx
mov qword [rsi + 0x20], rcx
test rbx, rbx
je 0x1800404a6
cmp word [rbx], 0
je 0x1800404a6
mov rax, r12
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x180040470
lea r15, [rax*2 + 2]
test r15, r15
jle 0x1800404a6
mov rdx, r15
mov rcx, rsi
call fcn.1800418f0
mov r8, r15
mov rdx, rbx
mov rcx, rax
call fcn.18009d4b0
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rbp + 0x1c0]
test r14, r14
je 0x1800408c6
cmp r14, rdx
jne 0x180040938
mov rcx, r14
call fcn.18001e300
test rax, rax
jne 0x1800404dd
lea rdx, [0x1800f8f58]
call fcn.180043170
mov rdi, qword [rsp + 0x68]
cmp qword [rsp + 0x78], 0
je 0x1800408c6
test rdi, rdi
je 0x1800408c6
cmp word [rdi], 0
je 0x1800408c6
mov rbx, qword [r14 + 0x18]
test rbx, rbx
je 0x180040866
mov rax, r12
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x180040510
lea rsi, [rax*2 + 2]
lea rcx, [r14 + 0x20]
xor r15d, r15d
mov qword [r14 + 0x48], r15
cmp qword [r14 + 0x40], rsi
jl 0x180040847
cmp rsi, 2
jne 0x18004081d
mov rcx, qword [r14 + 0x38]
movzx eax, word [rbx]
mov word [rcx], ax
add qword [r14 + 0x48], rsi
jmp 0x180040862
test r13, r13
je 0x18004031f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rbp + 0x1c8]
cmp ecx, dword [rbp + 0x1d0]
jb 0x18004031f
mov dword [rbp + 0x1c8], eax
sub eax, dword [rbp + 0x1a8]
mov dword [rbp + 0xb8], eax
lea rcx, [rbp + 0xb8]
call qword [r13]
mov r15d, eax
mov dword [rbp + 0x1a0], eax
mov rcx, qword [rbp - 0x50]
mov rdx, rcx
and edx, 1
je 0x1800405b9
sub rcx, rdx
mov rdx, rcx
lea rcx, [rbp - 0x78]
call fcn.1800418f0
mov rcx, qword [rsp + 0x78]
mov rax, rcx
and eax, 1
je 0x1800405d6
sub rcx, rax
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1800418f0
mov rcx, qword [rbp - 0x50]
cmp rcx, 2
jb 0x1800405f0
mov rax, qword [rbp - 0x60]
cmp word [rcx + rax - 2], 0
je 0x1800406d6
mov rdx, qword [rbp - 0x58]
mov rax, rdx
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 2
jl 0x180040616
mov rax, qword [rbp - 0x60]
mov word [rcx + rax], bx
add qword [rbp - 0x50], 2
jmp 0x1800406d6
mov rsi, qword [rbp - 0x50]
lea rdi, [rsi + 2]
cmp rdi, rsi
jne 0x18004062c
mov rax, qword [rbp - 0x60]
jmp 0x1800406d2
test rdi, rdi
jne 0x180040656
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x180040645
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax + Ordinal_26]
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x58], rbx
mov rax, rbx
jmp 0x1800406d2
mov rbx, qword [rbp - 0x48]
mov eax, 0x40
cmp qword [rbp - 0x60], 0
jne 0x18004068a
test rbx, rbx
cmovle rbx, rax
mov rax, rdi
cqo
idiv rbx
sub rbx, rdx
add rbx, rdi
mov rdx, rbx
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax]
jmp 0x1800406c4
test rbx, rbx
cmovle rbx, rax
cmp rdx, rdi
jl 0x1800406a4
sub rdx, rdi
cmp rdx, rbx
jg 0x1800406a4
mov rax, qword [rbp - 0x60]
jmp 0x1800406cc
mov rax, rdi
cqo
idiv rbx
sub rbx, rdx
add rbx, rdi
mov r8, rbx
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rdi
xor ebx, ebx
mov word [rax + rsi], bx
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
cmp rcx, 2
jb 0x1800406f2
cmp word [rcx + rdi - 2], 0
je 0x1800407e5
mov rdx, qword [rsp + 0x70]
mov rax, rdx
mov rcx, qword [rsp + 0x78]
sub rax, rcx
cmp rax, 2
jl 0x180040717
mov word [rcx + rdi], bx
add qword [rsp + 0x78], 2
jmp 0x1800407e0
mov r15, qword [rsp + 0x78]
lea rsi, [r15 + 2]
cmp rsi, r15
je 0x1800407d4
test rsi, rsi
jne 0x180040757
test rdi, rdi
je 0x180040743
mov rdx, rdi
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + Ordinal_26]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov rdi, rbx
jmp 0x1800407d4
mov rbx, qword [rbp - 0x80]
mov eax, 0x40
test rdi, rdi
jne 0x18004078b
test rbx, rbx
cmovle rbx, rax
mov rax, rsi
cqo
idiv rbx
sub rbx, rdx
add rbx, rsi
mov rdx, rbx
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax]
jmp 0x1800407c0
test rbx, rbx
cmovle rbx, rax
cmp rdx, rsi
jl 0x18004079f
sub rdx, rsi
cmp rdx, rbx
jle 0x1800407cd
mov rax, rsi
cqo
idiv rbx
sub rbx, rdx
add rbx, rsi
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rdi, rax
mov qword [rsp + 0x78], rsi
xor ebx, ebx
mov word [rdi + r15], bx
mov r15d, dword [rbp + 0x1a0]
mov rdi, qword [rsp + 0x68]
cmp r15d, 1
je 0x18004080f
cmp r15d, 2
je 0x1800407fa
mov rsi, qword [rbp - 0x40]
jmp 0x18004032b
mov dword [rbp + 0x1b8], 0xfffffffe
xor ecx, ecx
lea r13d, [rcx - 2]
jmp 0x1800403f5
mov r13d, dword [rbp + 0x1b8]
xor ecx, ecx
jmp 0x1800403f5
cmp rsi, 4
jne 0x180040831
mov rcx, qword [r14 + 0x38]
mov eax, dword [rbx]
mov dword [rcx], eax
add qword [r14 + 0x48], rsi
jmp 0x180040862
cmp rsi, 8
jne 0x180040847
mov rcx, qword [r14 + 0x38]
mov rax, qword [rbx]
mov qword [rcx], rax
add qword [r14 + 0x48], rsi
jmp 0x180040862
test rsi, rsi
jle 0x180040862
mov rdx, rsi
call fcn.1800418f0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18009d4b0
mov qword [r14 + 0x18], r15
lea rcx, [r14 + 0x20]
mov rbx, qword [r14 + 0x48]
cmp rbx, 2
jb 0x180040890
mov rax, qword [r14 + 0x38]
cmp word [rax + rbx - 2], 0
jne 0x180040890
add rbx, 0xfffffffffffffffe
mov qword [r14 + 0x48], rbx
nop dword [rax + rax]
lea r12, [r12 + 1]
cmp word [rdi + r12*2], 0
jne 0x180040890
lea rsi, [r12*2 + 2]
mov rax, qword [r14 + 0x40]
sub rax, rbx
cmp rax, rsi
jl 0x180040919
cmp rsi, 2
jne 0x1800408ed
movzx ecx, word [rdi]
mov rax, qword [r14 + 0x38]
mov word [rbx + rax], cx
add qword [r14 + 0x48], rsi
xor esi, esi
mov rbx, qword [rbp + 0x1d8]
test rbx, rbx
je 0x1800409ef
cmp r13d, 0xfffffffe
jne 0x1800409dc
mov dword [rbx], 0xffffffff
jmp 0x1800409ef
cmp rsi, 4
jne 0x180040902
mov ecx, dword [rdi]
mov rax, qword [r14 + 0x38]
mov dword [rbx + rax], ecx
add qword [r14 + 0x48], rsi
jmp 0x1800408c6
cmp rsi, 8
jne 0x180040919
mov rcx, qword [rdi]
mov rax, qword [r14 + 0x38]
mov qword [rbx + rax], rcx
add qword [r14 + 0x48], rsi
jmp 0x1800408c6
test rsi, rsi
jle 0x1800408c6
lea rdx, [rsi + rbx]
call fcn.1800418f0
lea rcx, [rbx + rax]
mov r8, rsi
mov rdx, rdi
call fcn.18009d4b0
jmp 0x1800408c6
cmp qword [rsp + 0x78], 0
mov esi, 0
cmove rdi, rsi
mov rax, qword [r14 + 0x18]
test rax, rax
jne 0x180040961
cmp qword [r14 + 0x48], rsi
lea rax, [0x1800f7c64]
je 0x180040961
mov rax, qword [r14 + 0x38]
cmp rdi, rax
je 0x1800408c8
mov qword [r14 + 0x18], rsi
mov rdx, qword [r14 + 0x38]
test rdx, rdx
je 0x180040982
mov rax, qword [r14 + 0x20]
lea rcx, [r14 + 0x20]
call qword [rax + Ordinal_26]
mov qword [r14 + 0x38], rsi
mov qword [r14 + 0x48], rsi
mov qword [r14 + 0x40], rsi
test rdi, rdi
je 0x1800408c8
cmp word [rdi], si
je 0x1800408c8
lea r12, [r12 + 1]
cmp word [rdi + r12*2], si
jne 0x1800409a0
lea rbx, [r12*2 + 2]
test rbx, rbx
jle 0x1800408c8
mov rdx, rbx
lea rcx, [r14 + 0x20]
call fcn.1800418f0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.18009d4b0
jmp 0x1800408c8
mov rdx, rbx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1800409ef
mov dword [rbx], esi
lea rdi, vtable.CVolMem.0
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x180040a12
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + Ordinal_26]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
lea rbx, vtable.CVolObject.0
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x78], rdi
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x180040a45
lea rcx, [rbp - 0x78]
mov rax, qword [rbp - 0x78]
call qword [rax + Ordinal_26]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x78], rbx
mov qword [rbp + 8], rdi
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x180040a6d
lea rcx, [rbp + 8]
mov rax, qword [rbp + 8]
call qword [rax + Ordinal_26]
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x28], rsi
mov qword [rbp + 8], rbx
lea rax, [rbp + 0x60]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x60], rdi
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x180040aa0
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x60]
call qword [rax + Ordinal_26]
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x40], rbx
mov rbx, qword [rbp - 0x40]
cmp qword [rbp - 0x10], 0
je 0x180040b25
test rbx, rbx
je 0x180040b11
mov edx, dword [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov edx, dword [rbp]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov r8d, dword [rbp]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180040b11
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x180040b34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x180040b43
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180040b52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180040b61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x1b8]
jmp 0x180040b70
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret