Function at 0x1400035d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
lea rsi, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp], rsi
lea r15, vtable.CVolObject.0
mov qword [rbp], r15
xor r13d, r13d
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], r13
lea rax, vtable.rg_n1::rg_n2366.0
mov qword [rbp], rax
lea rax, vtable.rg_n1::rg_n1941.0
mov qword [rbp], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x18], rsi
lea rax, vtable.CMStringArray.0
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
lea r12, vtable.CVolMem.0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x50], 0x40
mov qword [rbp + 0x50], 0x100
lea rcx, [rbp + 0x18]
call fcn.14000d990
mov rcx, qword [rbp + 0x48]
mov rax, rcx
shr rax, 3
lea r14, vtable.CWString.0
lea rbx, [0x1400370c8]
test eax, eax
jle 0x1400037d1
mov rax, qword [rbp + 0x38]
test rcx, rcx
cmove rax, r13
mov rdx, qword [rax]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], 0x40
mov qword [rsp + 0x60], r13
mov qword [rbp - 0x68], 0xfe
mov qword [rsp + 0x48], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000f8c0
nop
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x14000375b
mov rdx, rbx
cmp qword [rbp - 0x70], r13
cmovne rdx, qword [rbp - 0x80]
mov rcx, r13
lea r8, [0x140036f90]
nop word [rax + rax]
movzx edi, word [rdx + rcx*2]
inc rcx
movzx eax, word [r8 + rcx*2 - 2]
sub edi, eax
jne 0x140003787
cmp rcx, 4
jne 0x140003770
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], r12
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x1400037aa
lea rcx, [rsp + 0x68]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x48], r15
test edi, edi
jne 0x1400037cd
lea rcx, [rbp + 0x18]
call fcn.140009e40
mov rcx, qword [rbp + 0x48]
mov rax, rcx
shr rax, 3
test eax, eax
jle 0x140004785
mov rax, qword [rbp + 0x38]
test rcx, rcx
cmove rax, r13
mov rdx, qword [rax]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], 0x40
mov qword [rsp + 0x60], r13
mov qword [rbp - 0x68], 0xfe
mov qword [rsp + 0x48], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000f8c0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140003879
mov rcx, rbx
cmp qword [rbp - 0x70], 0
cmovne rcx, qword [rbp - 0x80]
movzx edi, word [rcx]
sub edi, 0x30
jne 0x14000388b
movzx edi, word [rcx + 2]
movzx eax, r13w
sub edi, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], r12
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x1400038ae
lea rcx, [rsp + 0x68]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x48], r15
mov rax, qword [rbp + 0x38]
test edi, edi
jne 0x140003e34
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax + 0x28]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x60], r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x10], 0xfe
mov qword [rbp - 0x60], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.14000f8c0
nop
mov rax, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax + 0x20]
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x60], r14
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xb0], 0x40
mov qword [rbp + 0x78], r13
mov qword [rbp + 0xb0], 0xfe
mov qword [rbp + 0x60], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.14000f8c0
nop
mov rax, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax + 0x18]
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x120], r14
lea rax, [rbp + 0x140]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x170], 0x40
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x170], 0xfe
mov qword [rbp + 0x120], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x120]
call fcn.14000f8c0
nop
mov rax, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax + 0x10]
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xc8], r14
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x118], 0x40
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0x118], 0xfe
mov qword [rbp + 0xc8], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0xc8]
call fcn.14000f8c0
nop
mov rax, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], 0x40
mov qword [rsp + 0x60], r13
mov qword [rbp - 0x68], 0xfe
mov qword [rsp + 0x48], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000f8c0
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140003bd6
mov rcx, rbx
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
mov r15, qword [rbp + 0x78]
test r15, r15
jne 0x140003bf2
mov r15, rbx
cmp qword [rbp + 0xa8], 0
cmovne r15, qword [rbp + 0x98]
mov r14, qword [rbp + 0x138]
test r14, r14
jne 0x140003c11
mov r14, rbx
cmp qword [rbp + 0x168], 0
cmovne r14, qword [rbp + 0x158]
mov rsi, qword [rbp + 0xe0]
test rsi, rsi
jne 0x140003c30
mov rsi, rbx
cmp qword [rbp + 0x110], 0
cmovne rsi, qword [rbp + 0x100]
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x140003c46
cmp qword [rbp - 0x70], rdi
cmovne rbx, qword [rbp - 0x80]
mov rdi, rbx
call fcn.1400164e8
movsxd r12, eax
mov rcx, r15
call fcn.1400164e8
movsxd r15, eax
mov rcx, r14
call fcn.1400164e8
movsxd r14, eax
mov rcx, rsi
call fcn.1400164e8
movsxd rsi, eax
mov rcx, rdi
call fcn.1400164e8
mov edi, eax
lea rcx, str.Settings.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140003c93
lea edi, [rax - 0xa]
jmp 0x140003cca
lea rdx, str.Specifyrecoverycolor
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140003cad
lea edi, [rax - 0x14]
jmp 0x140003cca
mov dword [rsp + 0x20], r12d
mov r9d, r15d
mov r8d, r14d
mov edx, esi
mov ecx, edi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea r12, vtable.CVolMem.0
mov qword [rsp + 0x68], r12
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x140003cf4
lea rcx, [rsp + 0x68]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
lea r15, vtable.CVolObject.0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xe8], r12
mov rdx, qword [rbp + 0x100]
test rdx, rdx
je 0x140003d3d
lea rcx, [rbp + 0xe8]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xc8], r15
lea rax, [rbp + 0x140]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x140], r12
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140003d8c
lea rcx, [rbp + 0x140]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x120], r15
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], r12
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x140003ddb
lea rcx, [rbp + 0x80]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x60], r15
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], r12
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140003e1b
lea rcx, [rbp - 0x40]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x60], r15
jmp 0x140004788
cmp qword [rbp + 0x48], 0
cmove rax, r13
mov rdx, qword [rax]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x60], r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x10], 0xfe
mov qword [rbp - 0x60], r14
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.14000f8c0
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140003ebc
mov rcx, rbx
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
movzx edi, word [rcx]
sub edi, 0x31
jne 0x140003ece
movzx edi, word [rcx + 2]
movzx eax, r13w
sub edi, eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], r12
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x140003eee
lea rcx, [rbp - 0x40]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x60], r15
test edi, edi
jne 0x140004785
mov rcx, qword [rbp + 0x48]
mov rax, rcx
shr rax, 3
cmp eax, 4
jle 0x140004785
mov rax, qword [rbp + 0x38]
test rcx, rcx
cmove rax, r13
mov rdx, qword [rax + 0x40]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x180]
call fcn.140001f40
mov r15, rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x38]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x248]
call fcn.140001f40
mov rdi, rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x30]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x1f0]
call fcn.140001f40
mov rsi, rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x28]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001f40
mov r14, rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x20]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0xc8]
call fcn.140001f40
mov qword [rbp + 0x178], rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x18]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x120]
call fcn.140001f40
mov qword [rbp + 0xc0], rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 0x10]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140001f40
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp + 0x38]
cmp qword [rbp + 0x48], 0
cmove rcx, r13
mov rdx, qword [rcx + 8]
test rdx, rdx
cmove rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140001f40
mov rcx, rax
mov rdx, qword [r15 + 0x18]
test rdx, rdx
jne 0x14000406c
cmp qword [r15 + 0x48], rdx
mov rdx, rbx
je 0x14000406c
mov rdx, qword [r15 + 0x38]
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0xb8], rax
test rax, rax
jne 0x140004096
cmp qword [rdi + 0x48], rax
jne 0x14000408b
mov qword [rbp + 0xb8], rbx
jmp 0x140004096
mov rax, qword [rdi + 0x38]
mov qword [rbp + 0xb8], rax
mov r13, qword [rsi + 0x18]
test r13, r13
jne 0x1400040ac
cmp qword [rsi + 0x48], r13
mov r13, rbx
je 0x1400040ac
mov r13, qword [rsi + 0x38]
mov r12, qword [r14 + 0x18]
test r12, r12
jne 0x1400040c2
cmp qword [r14 + 0x48], r12
mov r12, rbx
je 0x1400040c2
mov r12, qword [r14 + 0x38]
mov rax, qword [rbp + 0x178]
mov r15, qword [rax + 0x18]
test r15, r15
jne 0x1400040df
cmp qword [rax + 0x48], r15
mov r15, rbx
je 0x1400040df
mov r15, qword [rax + 0x38]
mov rax, qword [rbp + 0xc0]
mov r14, qword [rax + 0x18]
test r14, r14
jne 0x1400040fc
cmp qword [rax + 0x48], r14
mov r14, rbx
je 0x1400040fc
mov r14, qword [rax + 0x38]
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + 0x18]
test rsi, rsi
jne 0x140004117
cmp qword [rax + 0x48], rsi
mov rsi, rbx
je 0x140004117
mov rsi, qword [rax + 0x38]
mov rdi, qword [rcx + 0x18]
test rdi, rdi
jne 0x14000412d
cmp qword [rcx + 0x48], rdi
mov rdi, rbx
je 0x14000412d
mov rdi, qword [rcx + 0x38]
mov rcx, rdx
call fcn.1400164e8
cdqe
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp + 0xb8]
call fcn.1400164e8
cdqe
mov qword [rbp + 0xc0], rax
mov rcx, r13
call fcn.1400164e8
movsxd r13, eax
mov rcx, r12
call fcn.1400164e8
movsxd r12, eax
mov rcx, r15
call fcn.1400164e8
mov r15d, eax
mov rcx, r14
call fcn.1400164e8
mov r14d, eax
mov rcx, rsi
call fcn.1400164e8
mov dword [rbp + 0xb8], eax
mov rcx, rdi
call fcn.1400164e8
mov edi, eax
lea rcx, str.Settings.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x1400041af
lea edi, [rax - 0xa]
jmp 0x140004203
lea rdx, str.Setbackgroundcolor
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400041c9
lea edi, [rax - 0x14]
jmp 0x140004203
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rbp + 0xc0]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r12d
mov r9d, r15d
mov r8d, r14d
mov edx, dword [rbp + 0xb8]
mov ecx, edi
call rax
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea r12, vtable.CVolMem.0
mov qword [rbp - 0x40], r12
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14000422a
lea rcx, [rbp - 0x40]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
lea r15, vtable.CVolObject.0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x60], r15
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], r12
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x140004274
lea rcx, [rbp + 0x80]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x60], r15
lea rax, [rbp + 0x140]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x140], r12
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x1400042c0
lea rcx, [rbp + 0x140]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x120], r15
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xe8], r12
mov rdx, qword [rbp + 0x100]
test rdx, rdx
je 0x14000430f
lea rcx, [rbp + 0xe8]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xc8], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], r12
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x140004355
lea rcx, [rsp + 0x68]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x210]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x210], r12
mov rdx, qword [rbp + 0x228]
test rdx, rdx
je 0x140004397
lea rcx, [rbp + 0x210]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x238], r13
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x1f0], r15
lea rax, [rbp + 0x268]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x268], r12
mov rdx, qword [rbp + 0x280]
test rdx, rdx
je 0x1400043e6
lea rcx, [rbp + 0x268]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x280], r13
mov qword [rbp + 0x290], r13
mov qword [rbp + 0x288], r13
mov qword [rbp + 0x268], r15
mov qword [rbp + 0x248], r15
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x1a0], r12
mov rdx, qword [rbp + 0x1b8]
test rdx, rdx
je 0x140004435
lea rcx, [rbp + 0x1a0]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x1b8], r13
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x180], r15
cmp edi, 0xfffffbaa
jne 0x140004788
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], r13
lea r8, vtable.CWString.0
mov qword [rbp + 0x60], r8
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], rdx
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xb0], 0x40
mov qword [rbp + 0x78], r13
mov qword [rbp + 0xb0], 0xfe
lea rcx, vtable.CWConstString.0
mov qword [rbp + 0x60], rcx
lea rax, [0x140036f98]
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x60], r8
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x10], 0xfe
mov qword [rbp - 0x60], rcx
lea rax, [0x140036fa0]
mov qword [rbp - 0x48], rax
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
test rax, rax
jne 0x14000457a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rax, qword [rbp + 0x78]
test rax, rax
jne 0x140004596
mov rax, rbx
cmp qword [rbp + 0xa8], 0
cmovne rax, qword [rbp + 0x98]
mov rdx, qword [rbp - 0x48]
test rdx, rdx
jne 0x1400045ab
cmp qword [rbp - 0x18], rdx
cmovne rbx, qword [rbp - 0x28]
mov rdx, rbx
mov r9d, 1
mov r8, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
test rsi, rsi
je 0x1400045d7
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400045d7
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
cmp ebx, 1
sete bl
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], r12
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400045fd
lea rcx, [rbp - 0x40]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x60], r15
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], r12
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x14000463d
lea rcx, [rbp + 0x80]
call qword [method.CVolCommonBaseWithMemManager.virtual_24]
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x60], r15
test bl, bl
je 0x140004788
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x180], WSACleanup
mov dword [rbp + 0x184], 0x40
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], r13
lea rax, str.cmd.exe
mov qword [rbp + 0x198], rax
lea rax, str._c_taskkill__im_explorer.exe__f
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], r13
mov dword [rbp + 0x1b0], r13d
mov qword [rbp + 0x1b8], r13
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a0]
call fcn.140011dd0
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140004756
movups xmm0, xmmword [str.C:WINDOWS]
movaps xmmword [rbp + 0x2a0], xmm0
mov eax, dword [0x140036df0]
mov dword [rbp + 0x2b0], eax
movzx eax, word [0x140036df4]
mov word [rbp + 0x2b4], ax
mov dword [rsp + 0x28], 1
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.explorer.exe
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140004788
mov edi, r13d
lea rax, [rbp + 0x18]
mov qword [rsp + 0x40], rax
lea rax, vtable.CMStringArray.0
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp + 0x38]
mov r14, rdx
mov rsi, qword [rbp + 0x48]
test rsi, rsi
cmove r14, r13
shr rsi, 3
mov rbx, r13
test rsi, rsi
je 0x1400047e0
nop word [rax + rax]
mov rdx, qword [r14 + rbx*8]
test rdx, rdx
je 0x1400047d4
lea rcx, [rbp + 0x18]
mov rax, qword [rbp + 0x18]
call qword [rax + 0x18]
inc rbx
cmp rbx, rsi
jl 0x1400047c0
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x1400047f0
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x20]
call qword [rax + 0x18]
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x40], r13
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x20], r15
mov qword [rbp], r15
mov eax, edi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14000fca0
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret