Function at 0x14005df2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r14, rcx
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
mov eax, 1
cmp rcx, rdx
je 0x14005df9c
test byte [rcx + 0x1c], al
je 0x14005df9c
cmp byte [rcx + 0x19], 4
jb 0x14005df9c
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x52]
lea r8, [0x14015b360]
call fcn.140006b98
mov eax, dword [r14 + 0x110]
lea rcx, [rbp - 0x10]
xor esi, esi
xor edx, edx
mov dil, sil
mov dword [rbp - 0x70], esi
mov r8d, 0xd0
mov qword [rbp - 0x58], rsi
lea r12, [rax + rax*2]
mov qword [rbp - 0x78], rsi
shl r12, 6
mov r15d, esi
add r12, qword [r14 + 0x108]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x68], rsi
mov dword [rsp + 0x74], esi
mov dword [rbp - 0x60], edi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rsi
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x78], sil
mov qword [rbp - 0x38], rsi
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
call sub.msvcrt.dll_memset
lea rcx, [r14 + 8]
call fcn.140006190
mov rbx, rax
test rax, rax
jne 0x14005e036
lea r8, str.pCatalogSystem
mov edx, 0x8bd
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov rcx, qword [rbx]
movups xmm0, xmmword [r14 + 0xd0]
mov rax, qword [rcx + 0x58]
movdqu xmmword [rbp - 0x20], xmm0
movabs r10, 0xf81d3e6538d5fb70
mov r9d, 1
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [vtable.H_MA8HI.0]
mov esi, eax
test eax, eax
js 0x14005e191
mov edx, dword [rbp + 0xb4]
lea r9, [rsp + 0x70]
mov ecx, dword [rbp + 0xb0]
lea r8, [rbp - 0x38]
mov ebx, 1
mov byte [rsp + 0x78], bl
call fcn.140119bd0
mov esi, eax
test eax, eax
js 0x14005ee48
mov r13, qword [rbp - 0x38]
test r13, r13
jne 0x14005e0c3
lea r8, str.wszVhdExtension___NULL
mov edx, 0x8cf
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
lea rdx, [rbp - 0x58]
mov rcx, r12
call fcn.14005b1c0
mov esi, eax
test eax, eax
js 0x14005ee44
mov r8d, dword [r12 + 0x4c]
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x20], rcx
lea rdx, [r12 + 0x3c]
mov rcx, qword [r14 + 0xc8]
mov r9, r13
call fcn.140117a3c
mov esi, eax
test eax, eax
js 0x14005ee44
test byte [r12 + 0x4c], 8
je 0x14005e11d
test byte [r12 + 0x4c], 0x20
movzx edi, dil
cmove edi, ebx
mov dword [rbp - 0x60], edi
lea r13, [r14 + 0x18]
xor edx, edx
mov rcx, r13
call fcn.1401029b4
mov esi, eax
test eax, eax
js 0x14005ee44
mov rbx, qword [rbp - 0x68]
xor r8d, r8d
mov rcx, rbx
call fcn.1401072e4
mov esi, eax
test eax, eax
jns 0x14005e304
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e18d
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x14005e18d
cmp byte [rcx + 0x19], 2
jb 0x14005e18d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
mov edx, 0x54
mov dword [rsp + 0x20], esi
mov r9, rbx
call fcn.140011330
mov r15, qword [rbp - 0x58]
mov edi, 1
lea rbx, [0x14017a048]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14005e22c
test byte [r14 + 0x148], 2
je 0x14005e1d0
lea r8, str._CHUNKED_m_ulFeatures_
mov edx, 0xa2d
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov rcx, qword [rbp - 0x80]
test esi, esi
jns 0x14005e216
call fcn.14011e760
test eax, eax
jns 0x14005e212
mov rcx, qword [0x14017a048]
cmp rcx, rbx
je 0x14005e212
test byte [rcx + 0x1c], dil
je 0x14005e212
cmp byte [rcx + 0x19], 2
jb 0x14005e212
mov r9, qword [rbp - 0x80]
lea r8, [0x14015b360]
mov rcx, qword [rcx + 0x10]
mov edx, 0x68
mov dword [rsp + 0x20], eax
call fcn.140011330
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14005e22c
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
and qword [rbp - 0x80], 0
lea rcx, [r14 + 0x18]
call fcn.1401031a0
lea rcx, [r14 + 0x48]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
add dword [r14 + 0x118], edi
lea rcx, [r14 + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r14 + 0x11c]
cmp dword [r14 + 0x118], eax
jbe 0x14005e284
lea r8, str.m_ulBagsProcessed___m_cBags
mov edx, 0xa41
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
test esi, esi
jns 0x14005eebe
cmp esi, 0x80780118
je 0x14005ee4f
test r15, r15
je 0x14005ee4f
mov rdx, qword [r14 + 0x164]
mov rcx, r15
call fcn.1401168e8
test eax, eax
jns 0x14005ee4f
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x14005ee56
test byte [rcx + 0x1c], dil
je 0x14005ee56
cmp byte [rcx + 0x19], 2
jb 0x14005ee56
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
mov edx, 0x69
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.140011330
jmp 0x14005ee56
mov rcx, r13
call fcn.1401031a0
mov edi, 1
mov rcx, r14
mov r8b, dil
lea edx, [rdi + 2]
call fcn.14005f3ec
mov r15, qword [rbp - 0x58]
lea rdx, [rbp - 0x78]
mov rcx, r15
call fcn.14008c314
mov esi, eax
test eax, eax
js 0x14005e196
mov edi, dword [r12 + 0x4c]
and edi, 2
cmp qword [r14 + 0x158], 0
jne 0x14005e71b
lea rcx, [r14 + 0x48]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r14 + 0x110]
lea rcx, [r14 + 0x48]
lea rdx, [rax + rax*2]
shl rdx, 6
add rdx, qword [r14 + 0x108]
and qword [rdx], 0
and qword [rdx + 8], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x14005e3d4
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x14005e3d4
cmp byte [rcx + 0x19], 4
jb 0x14005e3d4
mov eax, dword [r14 + 0x110]
lea r8, [0x14015b360]
mov rcx, qword [rcx + 0x10]
mov edx, 0x55
mov r9, r15
mov dword [rsp + 0x20], eax
call fcn.14003d5bc
test edi, edi
jne 0x14005e3ea
mov rcx, r14
call fcn.14005b430
mov esi, eax
test eax, eax
js 0x14005ed22
mov rdi, qword [rbp - 0x78]
lea r8, [r12 + 0xb0]
mov rcx, rdi
lea rdx, [rsp + 0x74]
call fcn.1400ca764
mov ebx, eax
test eax, eax
je 0x14005e464
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e44e
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005e44e
cmp byte [rcx + 0x19], 2
jb 0x14005e44e
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x55]
mov eax, dword [rsp + 0x74]
lea r8, [0x14015b360]
mov dword [rsp + 0x28], eax
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.14003d0e0
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x70]
mov ecx, ebx
call fcn.140107054
mov esi, eax
jmp 0x14005e191
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e4a8
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005e4a8
cmp byte [rcx + 0x19], 4
mov rbx, qword [rbp - 0x68]
jb 0x14005e4ac
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x56]
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, [0x14015b360]
call fcn.1400113b0
jmp 0x14005e4ac
mov rbx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
test byte [r14 + 0x148], 2
mov edi, eax
jne 0x14005e628
cmp byte [rsp + 0x70], 0
jne 0x14005e628
lea rax, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, r13
call fcn.1401205bc
mov esi, eax
test eax, eax
jns 0x14005e548
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
mov edi, 1
cmp rcx, rbx
je 0x14005e19d
test byte [rcx + 0x1c], dil
je 0x14005e19d
cmp byte [rcx + 0x19], 2
jb 0x14005e19d
lea edx, [rdi + 0x57]
mov r9, qword [rbp - 0x80]
lea r8, [0x14015b360]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.140011330
jmp 0x14005e19d
mov r10, qword [rbp - 0x80]
test r10, r10
jne 0x14005e56d
lea r8, str.wszMountedVhdPath___NULL
mov edx, 0x947
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov r10, qword [rbp - 0x80]
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e5af
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005e5af
cmp byte [rcx + 0x19], 4
jb 0x14005e5af
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x58]
mov r9, rbx
mov qword [rsp + 0x20], r10
lea r8, [0x14015b360]
call fcn.1400113b0
mov r10, qword [rbp - 0x80]
mov eax, dword [r12 + 0x4c]
lea rcx, [rsp + 0x74]
mov r8b, byte [r14 + 0x161]
mov ebx, 1
mov dl, byte [r14 + 0x160]
mov r9b, bl
mov qword [rsp + 0x68], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x60], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x50], rcx
lea rcx, [r14 + 0x158]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x40], rcx
mov rcx, r10
shr eax, 0xd
and al, bl
mov byte [rsp + 0x38], al
lea rax, [fcn.1400593c0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1400c9944
jmp 0x14005e665
mov r9, qword [r13]
cmp r9, 0xffffffffffffffff
jne 0x14005e63f
or r9, r9
cmp qword [r13 + 8], 0xffffffffffffffff
cmovne r9, qword [r13 + 8]
mov r8b, byte [rbp - 0x60]
lea rax, [rsp + 0x74]
lea rcx, [r14 + 0x158]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rdx, rbx
mov rcx, qword [rbp - 0x78]
call fcn.1400c9b9c
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov r9d, dword [r14 + 0x16c]
sub r9d, edi
add r9d, eax
mov dword [r14 + 0x16c], r9d
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
mov edi, 1
cmp rcx, rax
je 0x14005e6cc
test byte [rcx + 0x1c], dil
je 0x14005e6cc
cmp byte [rcx + 0x19], 4
jb 0x14005e6cc
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x59]
lea r8, [0x14015b360]
call fcn.140006cec
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
test ebx, ebx
je 0x14005e724
cmp rcx, rax
je 0x14005e705
test byte [rcx + 0x1c], dil
je 0x14005e705
cmp byte [rcx + 0x19], 2
jb 0x14005e705
mov edx, 0x5b
mov eax, dword [rsp + 0x74]
lea r8, [0x14015b360]
mov rcx, qword [rcx + 0x10]
mov r9, r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call fcn.14003d0e0
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x70]
mov ecx, ebx
call fcn.140107054
mov esi, eax
jmp 0x14005e196
mov rcx, qword [0x14017a048]
jmp 0x14005e728
mov rbx, qword [rbp - 0x68]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e765
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005e765
cmp byte [rcx + 0x19], 4
mov rdi, qword [rbp - 0x78]
jb 0x14005e769
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x5b]
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, [0x14015b360]
call fcn.1400113b0
jmp 0x14005e769
mov rdi, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
test byte [r14 + 0x148], 2
mov ebx, eax
jne 0x14005e7f5
xor ecx, ecx
cmp byte [rsp + 0x70], cl
jne 0x14005e7f5
movups xmm0, xmmword [0x14015f068]
lea rax, [rsp + 0x74]
mov r9, rdi
mov qword [rsp + 0x60], rax
lea rdx, [fcn.1400593c0]
mov qword [rsp + 0x58], rcx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov r8, r14
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [r14 + 0x158]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.1400c817c
jmp 0x14005e853
mov rax, qword [r13]
cmp rax, 0xffffffffffffffff
jne 0x14005e80c
or rax, rax
cmp qword [r13 + 8], 0xffffffffffffffff
cmovne rax, qword [r13 + 8]
mov rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x40], rcx
lea r8, [fcn.1400593c0]
lea rcx, [rbp - 0x40]
mov r9, r14
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [r14 + 0x158]
mov qword [rsp + 0x20], rax
call fcn.1400caa4c
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
sub eax, ebx
add dword [r14 + 0x170], eax
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14005e8a8
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005e8a8
cmp byte [rcx + 0x19], 4
jb 0x14005e8a8
mov r9d, dword [r14 + 0x16c]
lea edx, [rax + 0x5c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
call fcn.140006cec
mov rdi, qword [rbp - 0x48]
lea r13, [r14 + 0x48]
mov rbx, qword [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r14 + 0x110]
lea rcx, [rax + rax*2]
shl rcx, 6
add rcx, qword [r14 + 0x108]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test r12d, r12d
je 0x14005e9a5
cmp r12d, 1
je 0x14005e960
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
mov edi, 1
cmp rcx, rbx
je 0x14005e945
test byte [rcx + 0x1c], dil
je 0x14005e945
cmp byte [rcx + 0x19], 2
jb 0x14005e945
mov eax, dword [rsp + 0x74]
lea edx, [rdi + 0x5d]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
mov dword [rsp + 0x28], eax
mov r9, r15
mov dword [rsp + 0x20], r12d
call fcn.14003d0e0
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x70]
mov ecx, r12d
call fcn.140107054
mov r12, qword [rbp - 0x50]
mov esi, eax
jmp 0x14005e19d
lea rcx, [r14 + 8]
mov rax, qword [rcx]
movabs r10, 0xb0e41f4d3e5c9b70
mov rax, qword [rax + 0x10]
call qword [vtable.H_MA8HI.0]
test al, al
jne 0x14005e997
lea r8, str.IsAborted__
mov edx, 0x999
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov r12, qword [rbp - 0x50]
mov esi, 0x80780167
jmp 0x14005e191
mov ecx, dword [r14 + 0x118]
mov r9, qword [r14 + 0x120]
mov edx, ecx
mov rax, qword [rbp + 0xc0]
imul r8, rcx, 0x6c
cmp rax, qword [r8 + r9 + 0x50]
jne 0x14005e9d9
mov rax, qword [rbp + 0xc8]
cmp rax, qword [r8 + r9 + 0x58]
je 0x14005ea6b
cmp byte [rbp - 0x60], 0
je 0x14005ea6b
mov rbx, qword [0x14017a048]
lea rax, [0x14017a048]
mov edi, 1
cmp rbx, rax
je 0x14005ea77
test byte [rbx + 0x1c], dil
je 0x14005ea77
cmp byte [rbx + 0x19], 3
jb 0x14005ea77
mov eax, dword [rbp + 0xcc]
lea edx, [rdi + 0x5e]
mov rcx, qword [rbx + 0x10]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp + 0xc8]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0xc4]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0xc0]
mov dword [rsp + 0x38], eax
mov eax, dword [r8 + r9 + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [r8 + r9 + 0x58]
mov dword [rsp + 0x28], eax
mov eax, dword [r8 + r9 + 0x54]
mov r9d, dword [r8 + r9 + 0x50]
lea r8, [0x14015b360]
mov dword [rsp + 0x20], eax
call fcn.14005fda0
mov edx, dword [r14 + 0x118]
jmp 0x14005ea70
mov edi, 1
mov rbx, qword [0x14017a048]
mov r12, qword [rbp - 0x50]
inc edx
cmp edx, dword [r14 + 0x11c]
je 0x14005eab5
mov r9d, dword [r12 + 0x4c]
lea r8, [r12 + 0x3c]
mov eax, edx
imul rdx, rax, 0x6c
mov rax, qword [r14 + 0x120]
lea rcx, [rax + 0x2c]
add rcx, rdx
mov edx, dword [rdx + rax + 0x3c]
call fcn.14008ef74
test al, al
jne 0x14005ed65
lea rax, [0x14017a048]
cmp rbx, rax
je 0x14005eaf0
test byte [rbx + 0x1c], dil
je 0x14005eaf0
cmp byte [rbx + 0x19], 4
jb 0x14005eaf0
mov eax, dword [r14 + 0x110]
lea r8, [0x14015b360]
mov rcx, qword [rbx + 0x10]
mov edx, 0x60
mov r9, r15
mov dword [rsp + 0x20], eax
call fcn.14003d5bc
test byte [r14 + 0x148], 2
jne 0x14005eb01
cmp byte [rsp + 0x70], 0
je 0x14005eb15
lea rbx, [r14 + 0x158]
mov rcx, r12
mov rdx, qword [rbx]
call fcn.14005f030
jmp 0x14005eb1c
lea rbx, [r14 + 0x158]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14005eb43
lea r8, str.m_pCurrentRestoreContext
mov edx, 0x9cd
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov rcx, qword [r14 + 0x158]
call fcn.1400c732c
and qword [rbx], 0
test byte [r12 + 0x4c], dil
jne 0x14005ed2c
cmp byte [r14 + 0x180], 0
jne 0x14005ec98
mov rdi, qword [rbp - 0x78]
lea rdx, [r12 + 0xb0]
mov rcx, rdi
mov byte [rsp + 0x70], 0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x74]
call fcn.1400c7e3c
mov ebx, eax
test eax, eax
je 0x14005ebc6
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
mov edi, 1
cmp rcx, rax
je 0x14005e705
test byte [rcx + 0x1c], dil
je 0x14005e705
cmp byte [rcx + 0x19], 2
jb 0x14005e705
lea edx, [rdi + 0x60]
jmp 0x14005e6e6
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
mov bl, byte [rsp + 0x70]
cmp rcx, rax
mov eax, 1
je 0x14005ec20
test byte [rcx + 0x1c], al
je 0x14005ec20
cmp byte [rcx + 0x19], 4
jb 0x14005ec20
mov rcx, qword [rcx + 0x10]
lea rax, [0x14015b1f0]
test bl, bl
mov qword [rsp + 0x20], rdi
lea r9, [0x14015a528]
mov edx, 0x62
cmove r9, rax
lea r8, [0x14015b360]
call fcn.1400113b0
mov eax, 1
test bl, bl
je 0x14005ecd2
mov r8b, al
mov edx, 0xc
mov rcx, r14
call fcn.14005f3ec
mov rdx, rdi
mov rcx, r12
call fcn.14005dc7c
mov esi, eax
test eax, eax
jns 0x14005ecd2
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
mov edi, 1
cmp rcx, rbx
je 0x14005e19d
test byte [rcx + 0x1c], dil
je 0x14005e19d
cmp byte [rcx + 0x19], 2
jb 0x14005e19d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x62]
mov r9d, eax
lea r8, [0x14015b360]
call fcn.140006bc4
jmp 0x14005e19d
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x14005eccc
test byte [rcx + 0x1c], dil
je 0x14005eccc
cmp byte [rcx + 0x19], 4
jb 0x14005eccc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
mov edx, 0x64
call fcn.140006b98
mov rdi, qword [rbp - 0x78]
jmp 0x14005ecd9
lea rbx, [0x14017a048]
mov rcx, rdi
call fcn.140104e84
mov esi, eax
test eax, eax
jns 0x14005ed3b
mov rcx, qword [0x14017a048]
cmp rcx, rbx
je 0x14005ed1d
mov eax, 1
test byte [rcx + 0x1c], al
je 0x14005ed1d
cmp byte [rcx + 0x19], 2
jb 0x14005ed1d
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x64]
mov r9, rdi
mov dword [rsp + 0x20], esi
lea r8, [0x14015b360]
call fcn.140011330
mov esi, 0x80780124
mov edi, 1
jmp 0x14005e19d
mov edx, 9
mov rcx, r12
call fcn.14005f4a0
jmp 0x14005ed40
mov edi, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
add dword [r14 + 0x150], edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
add dword [r12 + 0x10], edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14005e22c
test byte [r14 + 0x148], 2
je 0x14005edbb
lea r8, str._CHUNKED_m_ulFeatures_
mov edx, 0xa1b
lea rcx, str.base_stor_blbengine_service_restore.cpp
call fcn.14008ac24
mov rcx, qword [rbp - 0x80]
call fcn.14011e760
mov esi, eax
test eax, eax
jns 0x14005edfb
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x14005e19d
test byte [rcx + 0x1c], dil
je 0x14005e19d
cmp byte [rcx + 0x19], 2
jb 0x14005e19d
mov edx, 0x66
jmp 0x14005e52b
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x14005e19d
test byte [rcx + 0x1c], dil
je 0x14005e19d
cmp byte [rcx + 0x19], 4
jb 0x14005e19d
mov r9, qword [rbp - 0x80]
lea r8, [0x14015b360]
mov rcx, qword [rcx + 0x10]
mov edx, 0x67
call fcn.1400112c8
jmp 0x14005e19d
mov r15, qword [rbp - 0x58]
mov edi, ebx
jmp 0x14005e196
lea rbx, [0x14017a048]
mov rcx, qword [r14 + 0x158]
test rcx, rcx
je 0x14005ee6f
call fcn.1400c732c
and qword [r14 + 0x158], 0
mov r8d, dword [rbp - 0x70]
mov edx, esi
mov rcx, r12
call fcn.14005efbc
mov rcx, qword [0x14017a048]
cmp rcx, rbx
je 0x14005eecc
test byte [rcx + 0x1c], dil
je 0x14005eecc
cmp byte [rcx + 0x19], 2
jb 0x14005eecc
mov rcx, qword [rcx + 0x10]
lea r9, [0x14015b218]
test r15, r15
mov dword [rsp + 0x20], esi
mov edx, 0x6a
lea r8, [0x14015b360]
cmovne r9, r15
call fcn.140011330
jmp 0x14005eec5
lea rbx, [0x14017a048]
mov rcx, qword [0x14017a048]
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x14005eeeb
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x14005ef0a
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
test r15, r15
je 0x14005ef25
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14005ef44
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp byte [rsp + 0x78], 0
je 0x14005ef5b
lea rcx, [rbp - 0x10]
call fcn.14009dfe0
mov rcx, qword [0x14017a048]
cmp rcx, rbx
je 0x14005ef81
test byte [rcx + 0x1c], dil
je 0x14005ef81
cmp byte [rcx + 0x19], 4
jb 0x14005ef81
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015b360]
mov edx, 0x6b
call fcn.140006b98
mov eax, esi
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140001d90
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret