Function at 0x14000a9d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x140070070]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov ebx, r8d
mov dword [rsp + 0x40], ebx
mov r14, rdx
mov qword [rsp + 0x58], rdx
mov r13, rcx
mov qword [rbp - 0x10], rdx
xor esi, esi
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0x108], rsi
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], sil
mov r8, qword [rcx + 8]
mov r8, qword [r8 + 0x7c0]
lea rdx, str.GetLogInfo__dwGetLogInfoOff_d
lea rcx, str.bugreport
call fcn.140025b7c
mov rcx, qword [r13 + 8]
cmp qword [rcx + 0x7c0], rsi
je 0x14000ac9d
add rcx, 0x5b8
cmp word [rcx], si
je 0x14000ac9d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
xor r12d, r12d
test rax, rax
je 0x14000ac9b
mov rax, qword [r13 + 8]
mov rdi, qword [rax + 0x7c0]
add rdi, rsi
je 0x14000ac6c
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x40], r12d
mov eax, dword [0x1400733e8]
mov r12d, 1
test r12b, al
jne 0x14000aad5
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov r8d, r12d
lea rdx, [rbp + 0x40]
lea rcx, [0x140073350]
call fcn.14000bb38
mov rbx, rax
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x14000ab10
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov r8d, 0x20
mov rdx, qword [0x140073358]
mov rdx, qword [rdx + 0x860]
lea rcx, [rbp - 0x58]
call fcn.140020118
nop
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x14000ab53
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rdx, [0x140073398]
lea rcx, [rbp + 0xf0]
call fcn.14000d848
nop
xor r12d, r12d
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x58]
lea r8, [0x140061042]
mov rbx, qword [rbp + 0xf0]
mov rdx, rbx
mov rcx, qword [r13 + 8]
call rdi
mov edi, eax
lea rdx, [rbx - 0x18]
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000abc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000abea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ac0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test edi, edi
je 0x14000ac6c
mov r9, qword [rsp + 0x58]
test r9, r9
je 0x14000ac6c
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000ac6c
mov edi, eax
cmp rax, qword [rbp + 0x110]
ja 0x14000ac5d
lea rbx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae rbx, qword [rbp + 0xf8]
mov qword [rbp + 0x108], rax
mov r8d, eax
mov rdx, r9
mov rcx, rbx
call fcn.14002d5d0
mov byte [rbx + rdi], r12b
jmp 0x14000ac6c
mov rdx, rdi
lea rcx, [rbp + 0xf8]
call fcn.14000f314
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r14], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
mov r8d, 0x20
lea rdx, [rbp + 0xf8]
mov rcx, r14
call fcn.14002d5d0
nop
jmp 0x14000b9fc
xor esi, esi
mov eax, dword [0x140073480]
mov r12d, 1
test r12b, al
jne 0x14000acc9
or eax, r12d
mov dword [0x140073480], eax
call fcn.140015060
lea rcx, [0x140053460]
call fcn.14002bb88
nop
mov qword [rbp + 0x140], rsi
movdqa xmm0, xmmword [0x140067230]
movdqa xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], sil
mov qword [rbp + 0x160], rsi
movdqa xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], sil
mov dword [rbp + 0x180], esi
mov rdx, qword [r13 + 8]
mov rdx, qword [rdx + 0x840]
lea rcx, [rsp + 0x70]
call fcn.14000d338
nop
lea rax, str.MidDump.dmp
lea r8, str..dmp
cmp ebx, 0x960
cmove r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x48]
call fcn.14000ceb0
nop
mov r8, qword [rax]
mov edi, 0x7fffffff
mov edx, edi
lea rcx, [rbp - 0x48]
call fcn.140025498
nop
mov rdx, qword [r13 + 8]
mov r8d, ebx
mov rdx, qword [rdx + 0x860]
lea rcx, [rbp - 0x50]
call fcn.140020118
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x140]
call fcn.140021b0c
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ada6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000adc7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ade7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, str..txt
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x58]
call fcn.14000ceb0
nop
mov r8, qword [rax]
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.140025498
nop
mov r8d, r12d
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.14000bb38
nop
lea r8, [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140021b0c
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ae51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ae72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000ae92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp dword [0x140073330], esi
je 0x14000aee0
mov edx, 0x1d4c0
mov rcx, qword [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x140073330], esi
je 0x14000aecd
mov dword [0x140073330], esi
mov dword [0x140073334], r12d
mov edx, 0x7d0
mov rcx, qword [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r13 + 0x68]
test rcx, rcx
je 0x14000aee0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x68], rsi
mov edi, 2
mov r8d, edi
lea rdx, [rbp + 0x60]
mov rcx, r13
call fcn.14000bb38
mov rcx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000af20
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test ebx, ebx
je 0x14000afd6
lea r8, str.FMD5.txt
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x70]
call fcn.14000ceb0
nop
mov r8, qword [rax]
mov edx, 0x7fffffff
lea rcx, [rbp - 0x38]
call fcn.140025498
nop
mov r8d, edi
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.14000bb38
nop
lea r8, [rbp - 0x38]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140021b0c
nop
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000af95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000afb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000afd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r13
call fcn.14000c508
test eax, eax
je 0x14000b68d
test byte [0x140073404], r12b
je 0x14000b68d
mov rax, qword [0x140073408]
mov qword [rbp + 0xc8], rax
mov r14, qword [rax]
cmp r14, rax
je 0x14000b688
lea rdi, [r13 + 0x48]
lea rdx, [r14 + 0x10]
lea rcx, [rbp]
call fcn.14000d848
nop
mov eax, dword [r14 + 0x18]
mov dword [rbp + 8], eax
lea rdx, [r14 + 0x20]
lea rcx, [rbp + 0x10]
call fcn.14000cb0c
nop
lea rdx, [r14 + 0x30]
lea rcx, [rbp + 0x20]
call fcn.14000cb0c
nop
lea rdx, [r14 + 0x40]
lea rcx, [rbp + 0x30]
call fcn.14000cb0c
nop
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000d848
nop
lea rcx, [rsp + 0x60]
call fcn.14000d5f0
mov rdi, qword [rbp + 0x10]
mov qword [rbp - 0x78], rdi
mov rsi, qword [rdi]
cmp rsi, rdi
je 0x14000b155
lea rdx, [rsi + 0x10]
lea rcx, [rbp - 0x80]
call fcn.14000d848
nop
lea rcx, [rbp - 0x80]
call fcn.14000d5f0
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x78]
call fcn.140025354
mov r8, qword [rax]
lea rdx, str.IsValidLogFilter:_ModName__s_
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b0d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x14000b102
mov rdi, qword [rsp + 0x60]
cmp dword [rdi - 0x10], 0
jl 0x14000b0fe
mov rdx, rbx
mov rcx, rdi
call fcn.14003f538
test rax, rax
je 0x14000b0fe
cmp eax, edi
jns 0x14000b12c
mov rdi, qword [rbp - 0x78]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b11e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rdi
jmp 0x14000b076
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
xor esi, esi
test eax, eax
jg 0x14000b14b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
jmp 0x14000b44a
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b176
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [r13 + 0x30]
lea rcx, [rsp + 0x68]
call fcn.14000d3c8
nop
lea rcx, [rsp + 0x68]
call fcn.14000d1d8
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b212
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp - 0x30]
call fcn.140025354
nop
lea rcx, [rbp - 0x30]
call fcn.14000d1d8
mov rbx, qword [rbp - 0x30]
mov r8, rbx
lea rdx, str.IsValidLogFilter:_CrashInfo__s_
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000ba2f
mov rcx, rbx
call fcn.14003f094
nop
lea rdx, [rbx - 0x18]
test eax, eax
mov eax, r15d
je 0x14000b40e
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b207
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x14000b19b
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b233
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r13 + 8]
mov r8, qword [rax + 0x50]
lea rdx, [0x140060cc0]
lea rcx, [rsp + 0x48]
call fcn.140021938
nop
lea rcx, [rsp + 0x48]
call fcn.14000d5f0
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b350
lea rdx, [rdi + 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d848
nop
lea rcx, [rbp - 0x70]
call fcn.14000d5f0
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.140025354
mov rbx, rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x80]
call fcn.140025354
mov r9, qword [rbx]
mov r8, qword [rax]
lea rdx, str.IsValidLogFilter:_ErrAdd__s____s_
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b2df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b302
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000ba40
mov rbx, qword [rbp - 0x70]
mov rcx, rbx
call fcn.14003f63c
nop
lea rdx, [rbx - 0x18]
test eax, eax
mov eax, r15d
je 0x14000b42d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b341
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x14000b267
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
xor esi, esi
test eax, eax
jg 0x14000b373
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp]
lea rcx, [rbp + 0xc0]
call fcn.140025354
mov r9d, dword [rbp + 8]
mov r8, qword [rax]
lea rdx, str.GetDetail2:_invalid_filter._FilterName__s__LogCount__d_
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b3c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x30]
call fcn.14000ca94
lea rcx, [rbp + 0x20]
call fcn.14000ca94
lea rcx, [rbp + 0x10]
call fcn.14000ca94
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b3fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r14]
mov r14, rax
cmp rax, qword [rbp + 0xc8]
jmp 0x14000b007
lock xadd dword [rdx + 0x10], eax
add eax, r15d
xor esi, esi
test eax, eax
jg 0x14000b426
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
jmp 0x14000b44a
lock xadd dword [rdx + 0x10], eax
add eax, r15d
xor esi, esi
test eax, eax
jg 0x14000b445
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b466
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r13 + 8]
mov ebx, dword [rax + 0x30]
mov rdx, qword [rbp]
lea rcx, [rbp + 0x98]
call fcn.140025354
mov rdi, rax
mov ecx, dword [0x1400733e8]
test r12b, cl
jne 0x14000b4a5
or ecx, r12d
mov dword [0x1400733e8], ecx
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rdx, [rbp + 0x90]
lea rcx, [0x140073350]
call fcn.14000bc3c
nop
mov ecx, dword [rbp + 8]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140027b68
nop
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b4fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b51d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rbp + 0x128], rsi
je 0x14000b5ec
lea rdx, [rbp]
lea rcx, [rbp + 0xd0]
call fcn.14000d45c
nop
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae rdx, qword [rbp + 0x118]
mov r9, qword [rax]
mov r8d, dword [rbp + 0x128]
lea rcx, [rbp + 0x140]
call fcn.140023c2c
mov bl, al
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000b58e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rdx, qword [rbp]
test bl, bl
je 0x14000b5c1
lea rcx, [rbp + 0xa8]
call fcn.140025354
mov r8, qword [rax]
lea rdx, str.add__s.tlg_to_zip_success
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0xa8]
jmp 0x14000b621
lea rcx, [rbp + 0xb0]
call fcn.140025354
mov r8, qword [rax]
lea rdx, str.add__s.tlg_to_zip_failed
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0xb0]
jmp 0x14000b621
mov rdx, qword [rbp]
lea rcx, [rbp + 0xb8]
call fcn.140025354
mov dword [rsp + 0x20], ebx
mov r9d, dword [rbp + 8]
mov r8, qword [rax]
lea rdx, str.filter___s__max_item__lu__session__lu__log_is_null
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b63e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x14000b3c1
inc rdx
mov rcx, qword [rbp + 0x118]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000b67e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba3a
call fcn.14002bbcc
jmp 0x14000b3c1
mov r14, qword [rsp + 0x58]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rsi
mov rax, qword [r13 + 8]
mov rdx, qword [rax + 0x840]
test rdx, rdx
je 0x14000b8f6
lea rcx, [rbp - 0x10]
call fcn.1400224ec
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14000b701
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test ebx, ebx
jne 0x14000b8f6
xor edx, edx
mov r8d, 0x61a
lea rcx, [rbp + 0x190]
call fcn.14002dc80
mov dword [rsp + 0x7c], r12d
mov dword [rsp + 0x78], 0x30c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.ExtRptFile
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000b76c
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000b8f6
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x20]
call fcn.14000d338
nop
lea rdx, [0x140060fac]
lea rcx, [rbp - 0x28]
call fcn.14000d338
nop
lea r8, [rbp + 0xd8]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.1400257a8
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b7ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b7ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp + 0xe0]
mov rdi, qword [rbp + 0xd8]
cmp rdi, rsi
je 0x14000b8f4
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14000d3c8
nop
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000b8cf
mov edx, 0x5c
mov rcx, rbx
call fcn.14002de38
test rax, rax
jne 0x14000b840
mov eax, r15d
jmp 0x14000b846
sub rax, rbx
sar rax, 1
lea r8d, [rax + 1]
mov r9d, dword [rbx - 0x10]
sub r9d, r8d
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.14000da04
nop
mov r8, qword [rbp - 0x60]
mov edx, 0x7fffffff
lea rcx, [rbp - 0x18]
call fcn.140025498
nop
lea r8, [rbp - 0x18]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.140021b0c
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b8aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b8ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b8eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rdi, 8
jmp 0x14000b7fc
xor esi, esi
xor r8d, r8d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x140]
call fcn.140023f90
mov r8, qword [rbp + 0x108]
cmp r8, 0xaf000
jb 0x14000b934
mov r9d, dword [rsp + 0x40]
lea rdx, str.detail2_over_FILE_MAX_SIZE__lu__08X
lea rcx, [0x14005f4e0]
call fcn.140025b7c
mov r8b, r12b
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x140]
call fcn.140023f90
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rsi
mov r8d, 0x20
lea rdx, [rbp + 0xf8]
mov rcx, r14
call fcn.14002d5d0
mov qword [rbp + 0x108], rsi
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], sil
lea rcx, [rbp + 0xd8]
call fcn.14000c6c4
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000b9b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x140]
call fcn.14000ba4c
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x14000b9fc
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba29
call fcn.14002bbcc
mov rax, r14
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14002b930
mov rbx, qword [rsp + 0x918]
add rsp, 0x8c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14003274c
nop
mov ecx, 0x80004005
call fcn.140006280
nop
call fcn.14003274c
nop
mov ecx, 0x80004005
call fcn.140006280
int3