Function at 0x1400145a0
Capabilities:
Access peb ldr_data
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword gs:[0x58]
mov rsi, rcx
mov r13, rdx
mov dword [rsp + 0x44], r8d
mov edx, 8
mov rbx, r9
xor r15d, r15d
mov qword [rsp + 0x48], rbx
mov rcx, qword [rax]
mov r14d, r8d
lea rax, str.CTieredVolume::InitializeJetInstance
mov edi, r15d
mov qword [rdx + rcx], rax
lea rcx, [rsp + 0x50]
call fcn.140008d4c
mov rcx, qword [rsi + 0x258]
mov byte [rsp + 0x34], r15b
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x3c], r15d
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
lea rcx, [0x14003c2c0]
mov qword [rsp + 0x60], rcx
cmp eax, 0xffffffff
jne 0x1400147ea
lea r12, [rsi + 0x2a0]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlCreateSystemVolumeInformationFolder]
xor r8d, r8d
mov ebx, eax
test eax, eax
jns 0x1400146bb
lea r14d, [r15 + 1]
bts ebx, 0x1c
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140045158]
lea r15, [0x140045158]
cmp rcx, r15
je 0x140015937
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0x25]
lea r8, [0x14003ce68]
mov dword [rsp + 0x20], ebx
mov r9, r12
call fcn.140009248
mov rcx, qword [0x140045158]
mov eax, edi
jmp 0x1400158fe
mov rcx, qword [rsi + 0x270]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
mov ebx, 0xb7
cmp eax, 0xffffffff
jne 0x140014768
mov rcx, qword [rsi + 0x270]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
jne 0x140014768
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, ebx
je 0x140014768
mov dword [rsp + 0x38], 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140045158]
lea r15, [0x140045158]
cmp rcx, r15
je 0x1400147dd
mov r14d, 1
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
lea r9, [rsi + 0x268]
lea edx, [r14 + 0x25]
mov rcx, qword [rcx + 0x10]
lea rax, [rsi + 0x288]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.140013190
jmp 0x1400146ad
mov rcx, qword [rsi + 0x258]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
jne 0x1400147e5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, ebx
je 0x1400147e5
mov dword [rsp + 0x38], 3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140045158]
lea r15, [0x140045158]
cmp rcx, r15
je 0x1400147dd
mov r14d, 1
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
lea r9, [rsi + 0x250]
lea edx, [r14 + 0x26]
jmp 0x14001474a
xor r8d, r8d
jmp 0x140015937
mov rbx, qword [rsp + 0x48]
mov dword [rsp + 0x30], r15d
test r14d, r14d
lea r15, [0x140045158]
mov r14d, 1
je 0x140014e45
lea r12d, [r14 + 6]
mov dword [rsp + 0x38], r12d
xor edx, edx
cmp byte [rsi + 0xa5], dl
jne 0x140014da9
cmp byte [rsi + 0xa6], dl
jne 0x140014da9
mov rcx, qword [rsi + 0x2e8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140014da9
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140014da9
mov r9, qword [rsp + 0x48]
mov rdx, r13
mov r8d, dword [rsp + 0x44]
mov rcx, rsi
call fcn.14001329c
xor r8d, r8d
mov edi, eax
test eax, eax
jne 0x140014d24
xor edx, edx
mov byte [rsp + 0x34], r14b
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor edx, edx
mov ebx, eax
test eax, eax
je 0x1400149da
cmp eax, 0xfffffbc6
je 0x1400149da
cmp eax, 0xfffffbfa
je 0x1400149da
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x1400148e1
test byte [rcx + 0x1c], r14b
je 0x1400148e1
cmp byte [rcx + 0x19], 2
jb 0x1400148e1
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x2a]
mov r9, r13
mov dword [rsp + 0x20], eax
lea r8, [0x14003ce68]
call fcn.1400042f4
xor edx, edx
cmp dword [0x140045020], 5
jbe 0x1400149da
movabs r8, 0x400000000000
test qword [0x140045030], r8
je 0x140014917
mov rax, qword [0x140045038]
and rax, r8
cmp rax, qword [0x140045038]
mov al, r14b
je 0x140014919
mov al, dl
test al, al
je 0x1400149da
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003c2c0]
mov rax, qword [rsi + 0x2a8]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2a0]
mov dword [rbp - 0x58], eax
mov rax, rdx
mov dword [rbp - 0x54], edx
test r13, r13
je 0x14001496a
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], dx
jne 0x14001495f
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x3c]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x44], edx
mov dword [rsp + 0x3c], ebx
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x40], 6
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003eb05]
mov dword [rsp + 0x20], 8
call fcn.1400010dc
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ESENT.dll_JetInit3W]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor r8d, r8d
test edi, edi
je 0x140014d18
cmp edi, 0xfffffbfa
je 0x140014cc7
cmp edi, 0xfffffdef
je 0x140014c72
cmp edi, 0xfffffbbc
je 0x140014c72
cmp edi, 0xfffff8f0
je 0x140014c72
cmp edi, 0xfffffc0d
jne 0x140014a43
mov ebx, 0x8007000e
jmp 0x140014a5f
mov eax, edi
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r8d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140014a97
test byte [rcx + 0x1c], r14b
je 0x140014a97
cmp byte [rcx + 0x19], 2
jb 0x140014a97
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov edx, 0x2d
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.1400042f4
mov rax, qword [rsp + 0x48]
mov r8d, 8
mov rcx, rsi
mov rdx, qword [rax]
call fcn.1400142ec
xor r8d, r8d
mov byte [rsp + 0x34], r8b
cmp byte [rsi + 0xa5], r8b
jne 0x140014c2d
cmp byte [rsi + 0xa6], r8b
jne 0x140014c2d
mov rcx, qword [rsi + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140014c2a
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140014c2a
cmp dword [0x140045020], 5
jbe 0x140014bff
movabs rdx, 0x400000000000
test qword [0x140045030], rdx
je 0x140014b3d
mov rax, qword [0x140045038]
and rax, rdx
cmp rax, qword [0x140045038]
jne 0x140014b3d
mov al, r14b
xor edx, edx
jmp 0x140014b41
xor edx, edx
mov al, dl
test al, al
je 0x140014bff
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003c2c0]
mov rax, qword [rsi + 0x2a8]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2a0]
mov dword [rbp - 0x58], eax
mov rax, rdx
mov dword [rbp - 0x54], edx
test r13, r13
je 0x140014b92
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], dx
jne 0x140014b87
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x3c]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x44], edx
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x3c], r12d
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003eb05]
mov dword [rsp + 0x20], 8
call fcn.1400010dc
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov eax, dword [rsp + 0x30]
add eax, r14d
mov dword [rsp + 0x30], eax
cmp eax, 5
jb 0x14001480e
mov rcx, qword [0x140045158]
jmp 0x1400158fe
xor r8d, r8d
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140015933
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 5
jb 0x1400158fa
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
jmp 0x1400158f3
mov ecx, 0x70
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140015933
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
mov edx, 0x2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov r9, r13
mov dword [rsp + 0x20], edi
call fcn.1400042f4
jmp 0x1400158f3
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140014d09
test byte [rcx + 0x1c], r14b
je 0x140014d09
cmp byte [rcx + 0x19], 2
jb 0x140014d09
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov edx, 0x2b
mov dword [rsp + 0x20], 0xfffffbfa
mov r9, r13
call fcn.1400042f4
mov rcx, qword [0x140045158]
xor r8d, r8d
mov ebx, r8d
mov edi, r8d
mov dword [rsp + 0x58], ebx
jmp 0x1400158fa
mov ebx, r8d
mov dword [rsp + 0x58], ebx
jmp 0x1400158f3
mov dword [rsp + 0x38], 5
cmp eax, 0xfffffdef
je 0x140014d6b
cmp eax, 0xfffffbbc
je 0x140014d6b
cmp eax, 0xfffff8f0
je 0x140014d6b
cmp eax, 0xfffffc0d
jne 0x140014d4f
mov ebx, 0x8007000e
jmp 0x140014d77
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r8d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x140014d77
mov ecx, 0x70
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140015933
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
mov edx, 0x29
jmp 0x140014cab
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140014de4
test byte [rcx + 0x1c], r14b
je 0x140014de4
cmp byte [rcx + 0x19], 5
jb 0x140014de4
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
mov rcx, qword [0x140045158]
mov eax, 0x80830002
mov r12d, 4
mov dword [rsp + 0x38], r12d
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x140014e3d
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 2
jb 0x1400158fa
mov r9d, dword [rsi + 0x80]
lea edx, [r12 + 0x24]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov dword [rsp + 0x20], eax
call fcn.1400016d8
jmp 0x1400158f3
xor r8d, r8d
jmp 0x140015944
mov rcx, qword [0x140045158]
xor eax, eax
mov r12d, 0x102
cmp byte [rsi + 0xa5], al
jne 0x1400157fa
cmp byte [rsi + 0xa6], al
jne 0x1400157fa
mov rcx, qword [rsi + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x1400157f3
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x1400157f3
mov r9, rbx
xor r8d, r8d
mov rdx, r13
mov rcx, rsi
call fcn.14001329c
xor r8d, r8d
mov edi, eax
test eax, eax
jne 0x14001576e
xor edx, edx
mov byte [rsp + 0x34], r14b
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor edi, edi
mov ebx, eax
test eax, eax
je 0x14001501e
cmp eax, 0xfffffbc6
je 0x14001501e
cmp eax, 0xfffffbfa
je 0x14001501e
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x140014f24
test byte [rcx + 0x1c], r14b
je 0x140014f24
cmp byte [rcx + 0x19], 2
jb 0x140014f24
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x30]
mov r9, r13
mov dword [rsp + 0x20], eax
lea r8, [0x14003ce68]
call fcn.1400042f4
mov rcx, qword [0x140045158]
cmp dword [0x140045020], 5
jbe 0x140015025
movabs r8, 0x400000000000
test qword [0x140045030], r8
je 0x140014f5a
mov rax, qword [0x140045038]
and rax, r8
cmp rax, qword [0x140045038]
mov al, r14b
je 0x140014f5d
mov al, dil
test al, al
je 0x140015025
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003c2c0]
mov rax, qword [rsi + 0x2a8]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2a0]
mov dword [rbp - 0x58], eax
mov rax, rdi
mov dword [rbp - 0x54], edi
test r13, r13
je 0x140014fae
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], di
jne 0x140014fa3
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x44], edi
mov dword [rsp + 0x40], ebx
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x44], 0xa
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003eb05]
mov dword [rsp + 0x20], 8
call fcn.1400010dc
mov rcx, qword [0x140045158]
cmp byte [rsi + 0xa5], dil
jne 0x1400156fb
cmp byte [rsi + 0xa6], dil
jne 0x1400156fb
mov rcx, qword [rsi + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x1400156f4
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x1400156f4
mov r8d, dword [rsp + 0x3c]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ESENT.dll_JetInit3W]
xor ecx, ecx
mov edi, eax
mov ebx, ecx
test eax, eax
je 0x1400150d5
cmp eax, 0xfffffdef
je 0x1400150c9
cmp eax, 0xfffffbbc
je 0x1400150c9
cmp eax, 0xfffff8f0
je 0x1400150c9
cmp eax, 0xfffffc0d
jne 0x1400150ae
mov ebx, 0x8007000e
jmp 0x1400150d5
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, ecx
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x1400150d5
mov ecx, 0x70
call fcn.140003e60
mov ebx, eax
xor r8d, r8d
mov dword [rsp + 0x58], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor r8d, r8d
mov dword [rsp + 0x38], 0xc
test edi, edi
je 0x1400156e8
cmp edi, 0xfffffbfa
je 0x140015697
cmp edi, 0xfffffdef
je 0x140015659
cmp edi, 0xfffffbbc
je 0x140015659
cmp edi, 0xfffff8f0
je 0x140015659
lea eax, [rdi + 0x21f]
cmp eax, 0x2a
ja 0x14001527b
movabs rcx, 0x40000000011
bt rcx, rax
jae 0x14001527b
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001517f
test byte [rcx + 0x1c], r14b
je 0x14001517f
cmp byte [rcx + 0x19], 2
jb 0x14001517f
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0x34]
lea r8, [0x14003ce68]
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.1400042f4
mov rax, qword [rsp + 0x48]
mov r12d, 0xd
mov rcx, rsi
mov dword [rsp + 0x38], r12d
mov rdx, qword [rax]
lea r8d, [r12 - 5]
call fcn.1400142ec
xor r8d, r8d
mov byte [rsp + 0x34], r8b
cmp byte [rsi + 0xa5], r8b
jne 0x140015519
cmp byte [rsi + 0xa6], r8b
jne 0x140015519
mov rcx, qword [rsi + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140015519
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140015519
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea r9, str.edb.log
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400305cc
lea r9, str.edbtmp.log
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400305cc
lea r9, str.edb.chk
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400305cc
lea rax, str..log
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
call fcn.140030b74
lea rax, str..jrs
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
call fcn.140030b74
jmp 0x1400153f1
cmp edi, 0xfffffb40
jne 0x140015325
mov rax, qword [rsp + 0x48]
mov r8d, 8
mov rcx, rsi
mov rdx, qword [rax]
call fcn.1400142ec
xor r8d, r8d
mov byte [rsp + 0x34], r8b
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x1400152e6
test byte [rcx + 0x1c], r14b
je 0x1400152e6
cmp byte [rcx + 0x19], 2
jb 0x1400152e6
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0x35]
lea r8, [0x14003ce68]
mov dword [rsp + 0x20], 0xfffffb40
mov r9, r13
call fcn.1400042f4
mov rcx, qword [0x140045158]
xor r8d, r8d
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x140015304
lea r12d, [rax + 0xe]
mov dword [rsp + 0x3c], 0x80
mov dword [rsp + 0x38], r12d
jmp 0x1400153fb
cmp eax, 0x80
jne 0x14001555e
lea r12d, [rax - 0x71]
mov dword [rsp + 0x3c], 0x84
mov dword [rsp + 0x38], r12d
jmp 0x1400153fb
cmp edi, 0xfffffddf
je 0x140015339
cmp edi, 0xfffffbc3
jne 0x1400155a8
mov rax, qword [rsp + 0x48]
mov r12d, 0x11
mov rcx, rsi
mov dword [rsp + 0x38], r12d
mov rdx, qword [rax]
lea r8d, [r12 - 9]
call fcn.1400142ec
xor eax, eax
mov byte [rsp + 0x34], al
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001539a
test byte [rcx + 0x1c], r14b
je 0x14001539a
cmp byte [rcx + 0x19], 2
jb 0x14001539a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x37]
mov r9, r13
mov dword [rsp + 0x20], edi
lea r8, [0x14003ce68]
call fcn.1400042f4
mov rcx, qword [0x140045158]
xor eax, eax
cmp byte [rsi + 0xa5], al
jne 0x1400155e6
cmp byte [rsi + 0xa6], al
jne 0x1400155e6
mov rcx, qword [rsi + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400155df
mov rcx, qword [rsi + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400155df
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rcx, qword [0x140045158]
xor r8d, r8d
cmp dword [0x140045020], 5
jbe 0x1400154fb
movabs r9, 0x400000000000
test qword [0x140045030], r9
je 0x140015431
mov rax, qword [0x140045038]
and rax, r9
cmp rax, qword [0x140045038]
mov al, r14b
je 0x140015434
mov al, r8b
test al, al
je 0x1400154fb
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003c2c0]
mov rax, qword [rsi + 0x2a8]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2a0]
mov dword [rbp - 0x58], eax
mov rax, r8
mov dword [rbp - 0x54], r8d
test r13, r13
je 0x140015486
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], r8w
jne 0x14001547b
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x44], r8d
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x44], r12d
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003eb05]
mov dword [rsp + 0x20], 8
call fcn.1400010dc
mov rcx, qword [0x140045158]
mov eax, dword [rsp + 0x30]
add eax, r14d
mov dword [rsp + 0x30], eax
cmp eax, 5
jae 0x140015882
mov rbx, qword [rsp + 0x48]
jmp 0x140014e4c
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 5
jb 0x14001587e
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
jmp 0x140015877
mov dword [rsp + 0x38], 0x10
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x36
mov dword [rsp + 0x20], 0xfffffb40
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov r9, r13
call fcn.1400042f4
jmp 0x140015877
mov dword [rsp + 0x38], 0x13
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x39
mov dword [rsp + 0x20], edi
jmp 0x140015590
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001561a
test byte [rcx + 0x1c], r14b
je 0x14001561a
cmp byte [rcx + 0x19], 5
jb 0x14001561a
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
mov rcx, qword [0x140045158]
mov eax, 0x80830002
mov dword [rsp + 0x38], 0x12
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x38
jmp 0x14001585c
mov ecx, 0x70
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x33
jmp 0x1400155d9
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x1400156d9
test byte [rcx + 0x1c], r14b
je 0x1400156d9
cmp byte [rcx + 0x19], 2
jb 0x1400156d9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov edx, 0x32
mov dword [rsp + 0x20], 0xfffffbfa
mov r9, r13
call fcn.1400042f4
mov rcx, qword [0x140045158]
xor r8d, r8d
mov ebx, r8d
mov edi, r8d
mov dword [rsp + 0x58], ebx
jmp 0x14001587e
mov ebx, r8d
mov dword [rsp + 0x58], ebx
jmp 0x140015877
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001572f
test byte [rcx + 0x1c], r14b
je 0x14001572f
cmp byte [rcx + 0x19], 5
jb 0x14001572f
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
mov rcx, qword [0x140045158]
mov eax, 0x80830002
mov dword [rsp + 0x38], 0xb
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x31
jmp 0x14001585c
mov dword [rsp + 0x38], 9
cmp eax, 0xfffffdef
je 0x1400157b5
cmp eax, 0xfffffbbc
je 0x1400157b5
cmp eax, 0xfffff8f0
je 0x1400157b5
cmp eax, 0xfffffc0d
jne 0x140015799
mov ebx, 0x8007000e
jmp 0x1400157c1
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r8d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x1400157c1
mov ecx, 0x70
call fcn.140003e60
mov ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x2f
jmp 0x1400155d9
mov rcx, qword [0x140045158]
cmp rcx, r15
je 0x14001582e
test byte [rcx + 0x1c], r14b
je 0x14001582e
cmp byte [rcx + 0x19], 5
jb 0x14001582e
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
mov rcx, qword [0x140045158]
mov eax, 0x80830002
mov dword [rsp + 0x38], 8
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x14001587e
test byte [rcx + 0x1c], r14b
je 0x14001587e
cmp byte [rcx + 0x19], 2
jb 0x14001587e
mov edx, 0x2e
mov r9d, dword [rsi + 0x80]
lea r8, [0x14003ce68]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400016d8
mov rcx, qword [0x140045158]
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x3c], 0x84
jne 0x1400158fe
xor edx, edx
test ebx, ebx
jne 0x1400158fe
test byte [0x140045c80], 2
je 0x1400158c3
movzx r8d, word [rsi + 0x2a0]
lea rdx, [0x14003c158]
mov r9, qword [rsi + 0x2a8]
shr r8w, 1
call fcn.140009f04
mov rcx, qword [0x140045158]
jmp 0x1400158c5
mov eax, edx
cmp rcx, r15
je 0x140015930
test byte [rcx + 0x1c], r14b
je 0x1400158fa
cmp byte [rcx + 0x19], 4
jb 0x1400158fa
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov edx, 0x3a
mov qword [rsp + 0x20], r13
mov r9d, eax
call fcn.140003f38
mov rcx, qword [0x140045158]
mov eax, dword [rsp + 0x30]
cmp rcx, r15
je 0x140015930
test byte [rcx + 0x1c], r14b
je 0x140015930
cmp byte [rcx + 0x19], 2
jb 0x140015930
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003ce68]
mov edx, 0x3b
mov dword [rsp + 0x28], ebx
mov r9d, eax
mov qword [rsp + 0x20], r13
call fcn.140012fd8
xor r8d, r8d
test edi, edi
jne 0x14001593f
test ebx, ebx
je 0x140015a6c
mov r12d, dword [rsp + 0x38]
cmp dword [0x140045020], 5
jbe 0x140015a4c
movabs rcx, 0x400000000000
test qword [0x140045030], rcx
je 0x140015a4c
mov rax, qword [0x140045038]
and rax, rcx
cmp rax, qword [0x140045038]
jne 0x140015a4c
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
mov rax, qword [rsi + 0x2a8]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2a0]
mov dword [rbp - 0x58], eax
mov rax, r8
mov dword [rbp - 0x54], r8d
test r13, r13
je 0x1400159c4
mov qword [rsp + 0x60], r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], r8w
jne 0x1400159b9
mov rcx, qword [rsp + 0x60]
lea eax, [rax*2 + 2]
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rbp - 0x20], rax
lea rax, [rsp + 0x3c]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x44], r8d
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x44], r12d
mov qword [rbp - 0x18], 4
mov dword [rsp + 0x3c], ebx
mov qword [rbp - 8], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x14003ea93]
mov dword [rsp + 0x20], 9
call fcn.1400010dc
xor eax, eax
test edi, edi
je 0x140015a6c
cmp byte [rsp + 0x34], al
je 0x140015a6c
lea r8d, [rax + 8]
mov rcx, rsi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
call fcn.1400142ec
lea rcx, [rsp + 0x50]
call fcn.140008b88
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140039130
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret