Function at 0x140110df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x160
mov rsi, r8
mov rbx, rcx
lea rax, [0x14017a048]
mov rcx, qword [0x14017a048]
cmp rcx, rax
je 0x140110e51
test byte [rcx + 0x1c], 1
je 0x140110e51
cmp byte [rcx + 0x19], 4
jb 0x140110e51
mov edx, 0xa
lea r8, [0x140167348]
mov rcx, qword [rcx + 0x10]
call fcn.140006b98
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x78], rax
mov r12d, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x28], rax
mov r13d, eax
mov qword [rbp - 0x48], rax
mov r15d, eax
mov qword [rbp - 0x50], rax
mov edi, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x60], rax
cmp qword [rbx], rax
je 0x140110ea0
lea r8, str.m_wszSpecsXML__NULL
mov edx, 0xc1
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008ac24
xor eax, eax
cmp qword [rbx + 8], rax
je 0x140110ebe
lea r8, str.m_spBackupItemsRoot__NULL
mov edx, 0xc2
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008ac24
mov ecx, 0x38
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp - 0x30], rax
xor ecx, ecx
test rax, rax
jne 0x140110eeb
mov ebx, 0x8007000e
lea rsi, [0x14017a048]
jmp 0x1401118bd
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov r9d, 1
lea r8, str._BackupSpecs_Version__u__
lea edx, [r9 + 0x19]
mov rcx, rax
call fcn.1400102c4
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x14011180c
or rdi, 0xffffffffffffffff
mov rax, rdi
mov rcx, qword [rbp - 0x30]
xor ebx, ebx
inc rax
cmp word [rcx + rax*2], bx
jne 0x140110f2f
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111921
lea rdx, str._FileSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x140110f59
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111929
mov eax, ebx
mov dword [rbp - 0x58], ebx
mov ecx, dword [rbp + 0x48]
test ecx, ecx
je 0x1401112c8
add rsi, 0x18
cmp byte [rsi + 0x3c], bl
je 0x1401112b3
test r14, r14
je 0x140110fab
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x78], rbx
test r12, r12
je 0x140110fc4
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov r12, rbx
jmp 0x140110fc8
mov r12, qword [rbp - 0x70]
lea rcx, [rsi - 0x18]
xor r9d, r9d
lea r8, [rbp - 0x78]
mov edx, dword [rsi + 0x40]
call fcn.14008f47c
mov ebx, eax
xor r8d, r8d
test eax, eax
js 0x140111387
mov rax, qword [rsi - 8]
test rax, rax
je 0x140111000
mov rdx, rdi
inc rdx
cmp word [rax + rdx*2], r8w
jne 0x140110ff4
jmp 0x140111003
mov rdx, r8
mov rax, qword [rsi]
test rax, rax
je 0x14011101a
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], r8w
jne 0x14011100e
jmp 0x14011101d
mov rcx, r8
mov rax, rdi
mov r15, qword [rbp - 0x78]
inc rax
cmp word [r15 + rax*2], r8w
jne 0x140111024
lea r14, [rax + 0x63]
add r14, rcx
add r14, rdx
mov r14d, r14d
lea rax, [r14 + r14]
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140111382
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r12, rax
mov qword [rbp - 0x70], rax
xor eax, eax
test r12, r12
je 0x14011136d
mov r8d, ebx
xor edx, edx
mov rcx, r12
call sub.msvcrt.dll_memset
lea r8, [0x14015a528]
mov rcx, r8
xor edx, edx
cmp qword [rsi], rdx
cmovne rcx, qword [rsi]
mov rax, r8
cmp qword [rsi - 8], rdx
cmovne rax, qword [rsi - 8]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r15
lea r8, str._Volume_Name__ws__AccessPath__ws__OriginalAccessPath__ws__Label__ws__OriginalLabel__ws___
mov edx, r14d
mov rcx, r12
call fcn.1400102c4
mov ebx, eax
xor r14d, r14d
test eax, eax
js 0x140111359
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r14w
jne 0x1401110d4
mov r8d, eax
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111949
test byte [rsi + 0x40], 1
jne 0x140111289
mov r12d, r14d
cmp dword [rsi + 0x50], r14d
jbe 0x140111285
mov eax, r12d
lea r14, [rax + rax*2]
mov r15, qword [rsi + 0x58]
test r13, r13
je 0x140111132
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor r13d, r13d
mov qword [rbp - 0x48], r13
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x14011114e
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x80], r13
lea rdx, [rbp - 0x80]
mov rcx, qword [r15 + r14*8]
call fcn.14008c48c
mov ebx, eax
test eax, eax
js 0x140111355
mov rax, qword [r15 + r14*8 + 8]
mov rdx, rdi
inc rdx
cmp word [rax + rdx*2], r13w
jne 0x14011116d
mov rax, rdi
mov rcx, qword [rbp - 0x80]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14011117e
lea r13, [rax + rdx]
mov al, byte [r15 + r14*8 + 0x11]
neg al
sbb rcx, rcx
add rcx, 5
add r13, rcx
mov al, byte [r15 + r14*8 + 0x10]
neg al
sbb rcx, rcx
add rcx, 0x56
add r13, rcx
mov r13d, r13d
lea rax, [r13*2]
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140111350
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp - 0x48], rax
xor ecx, ecx
test rax, rax
je 0x140111334
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, str.true
mov rcx, rax
xor edx, edx
cmp byte [r15 + r14*8 + 0x11], dl
lea r8, str.false
cmove rcx, r8
cmp byte [r15 + r14*8 + 0x10], dl
cmove rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [r15 + r14*8 + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x80]
lea r8, str._FileSpec_FilePath__ws__FileName__ws__IsRecursive__ws__IsInclude__ws____
mov edx, r13d
mov r13, qword [rbp - 0x48]
mov rcx, r13
call fcn.1400102c4
mov ebx, eax
xor r14d, r14d
test eax, eax
js 0x1401117fa
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x140111256
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111939
inc r12d
cmp r12d, dword [rsi + 0x50]
jb 0x14011110c
mov r12, qword [rbp - 0x70]
mov r8d, 9
lea rdx, str.__Volume_
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111941
mov r14, qword [rbp - 0x78]
mov eax, dword [rbp - 0x58]
mov ecx, dword [rbp + 0x48]
xor ebx, ebx
inc eax
mov dword [rbp - 0x58], eax
sub rsi, 0xffffffffffffff80
cmp eax, ecx
jb 0x140110f8a
mov r15, qword [rbp - 0x50]
lea rdx, str.__FileSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x1401112d2
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111931
mov sil, byte [rbp + 0x68]
mov al, sil
neg al
sbb rbx, rbx
add rbx, 0x29
lea r14, [rbx + rbx]
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r13, rax
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x14011139a
mov ebx, 0x8007000e
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
jmp 0x140111812
mov ebx, 0x8007000e
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r15, rcx
mov rdi, qword [rbp - 0x80]
mov r13, rcx
jmp 0x140111812
mov ebx, 0x80070216
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x78]
mov r15, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x80]
mov r13, r15
jmp 0x140111812
mov ebx, 0x8007000e
mov r14, qword [rbp - 0x78]
mov r15, rax
mov rdi, qword [rbp - 0x80]
jmp 0x14011180f
mov ebx, 0x80070216
mov r14, qword [rbp - 0x78]
mov r15, r8
mov rdi, qword [rbp - 0x80]
mov r13, r8
jmp 0x140111812
mov r8, r14
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
lea r12, str.true
mov r9, r12
xor r14d, r14d
test sil, sil
lea rax, str.false
cmove r9, rax
lea r8, str._SystemState_IsPresent__ws____
mov rdx, rbx
mov rcx, r13
call fcn.1400102c4
mov ebx, eax
test eax, eax
js 0x140111323
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x1401113e1
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111951
mov sil, byte [rbp + 0x70]
mov al, sil
neg al
sbb rbx, rbx
add rbx, 0x29
lea r14, [rbx + rbx]
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r13, rax
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x14011144c
mov ebx, 0x8007000e
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
mov r13, qword [rbp - 0x68]
jmp 0x140111812
mov r8, r14
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
xor r14d, r14d
test sil, sil
lea rax, str.false
cmove r12, rax
mov r9, r12
lea r8, str._AllCritical_IsPresent__ws____
mov rdx, rbx
mov rcx, r13
call fcn.1400102c4
mov ebx, eax
test eax, eax
js 0x140111437
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r14w
jne 0x140111488
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111959
lea rdx, str._ComponentSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x1401114b4
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111961
mov dword [rbp - 0x58], r14d
cmp dword [rbp + 0x58], r14d
jbe 0x140111754
mov r13, qword [rbp + 0x60]
add r13, 8
mov qword [rbp - 0x38], r13
test r15, r15
je 0x140111503
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov r15, r14
mov rax, qword [r13]
test rax, rax
je 0x14011151b
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x14011150f
jmp 0x14011151e
mov rcx, r14
mov rdx, qword [r13 - 8]
test rdx, rdx
je 0x140111536
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14011152a
jmp 0x140111539
mov rax, r14
mov rdx, qword [r13 + 0x28]
test rdx, rdx
je 0x14011154e
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x140111542
jmp 0x140111551
mov rdi, r14
add rax, rdi
add rcx, 0x10f
add rax, rcx
mov eax, eax
mov qword [rbp - 8], rax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140111802
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov r15, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140111432
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rcx, [0x14015a528]
mov rax, rcx
cmp qword [r13 + 0x28], r14
cmovne rax, qword [r13 + 0x28]
mov qword [rbp - 0x20], rax
mov rax, rcx
cmp qword [r13 - 8], r14
cmovne rax, qword [r13 - 8]
mov qword [rbp - 0x18], rax
mov rax, rcx
cmp qword [r13], r14
cmovne rax, qword [r13]
mov qword [rbp - 0x10], rax
movzx eax, byte [r13 + 0x27]
movzx ecx, byte [r13 + 0x26]
movzx edx, byte [r13 + 0x25]
movzx r8d, byte [r13 + 0x24]
movzx r9d, byte [r13 + 0x23]
movzx r10d, byte [r13 + 0x22]
movzx r11d, byte [r13 + 0x21]
movzx ebx, byte [r13 + 0x20]
movzx edi, word [r13 + 0x1e]
movzx esi, word [r13 + 0x1c]
movzx r14d, byte [r13 + 0x17]
mov dword [rbp - 0x40], r14d
movzx r15d, byte [r13 + 0x16]
movzx r12d, byte [r13 + 0x15]
movzx r13d, byte [r13 + 0x14]
mov r14, qword [rbp - 0x20]
mov qword [rsp + 0xd8], r14
mov r14, qword [rbp - 0x18]
mov qword [rsp + 0xd0], r14
mov r14, qword [rbp - 0x10]
mov qword [rsp + 0xc8], r14
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xb8], ecx
mov dword [rsp + 0xb0], edx
mov dword [rsp + 0xa8], r8d
mov dword [rsp + 0xa0], r9d
mov dword [rsp + 0x98], r10d
mov dword [rsp + 0x90], r11d
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x78], esi
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x70], eax
mov r14d, dword [rbp - 0x40]
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov r13, qword [rbp - 0x38]
movzx eax, byte [r13 + 0x13]
mov dword [rsp + 0x48], eax
movzx eax, byte [r13 + 0x12]
mov dword [rsp + 0x40], eax
movzx eax, byte [r13 + 0x11]
mov dword [rsp + 0x38], eax
movzx eax, byte [r13 + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, word [r13 + 0xe]
mov dword [rsp + 0x28], eax
movzx eax, word [r13 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r13 + 8]
lea r8, str._ComponentSpec_WriterId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__InstanceId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__ComponentName__ws__LogicalPath__ws__Caption__ws____
mov rdx, qword [rbp - 8]
mov r15, qword [rbp - 0x50]
mov rcx, r15
call fcn.1400102c4
mov ebx, eax
xor r14d, r14d
test eax, eax
js 0x140111437
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r14w
jne 0x14011171a
mov r8d, eax
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111971
mov ecx, dword [rbp - 0x58]
inc ecx
mov dword [rbp - 0x58], ecx
add r13, 0x48
mov qword [rbp - 0x38], r13
cmp ecx, dword [rbp + 0x58]
jb 0x1401114ec
lea rdx, str.__ComponentSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14011175e
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111969
lea rdx, str.__BackupSpecs_
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x140111783
mov r8d, edi
lea rcx, [rbp - 0x60]
call fcn.140069534
test eax, eax
js 0x140111919
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x1401117d9
test byte [rcx + 0x1c], 1
je 0x1401117d9
cmp byte [rcx + 0x19], 4
jb 0x1401117d9
mov edx, 0xb
mov r9, qword [rbp - 0x60]
lea r8, [0x140167348]
mov rcx, qword [rcx + 0x10]
call fcn.1400112c8
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x40]
call fcn.140110cf4
mov ebx, eax
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x80]
mov r13, qword [rbp - 0x68]
jmp 0x140111819
mov r15, r14
jmp 0x140111437
mov ebx, 0x80070216
jmp 0x140111437
mov r12, rax
mov r13, rax
lea rsi, [0x14017a048]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test r12, r12
je 0x14011183d
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140111855
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test r15, r15
je 0x140111869
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test rdi, rdi
je 0x14011187d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test r13, r13
je 0x140111891
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1401118a9
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test r14, r14
je 0x1401118bd
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x1401118eb
test byte [rcx + 0x1c], 1
je 0x1401118eb
cmp byte [rcx + 0x19], 4
jb 0x1401118eb
mov edx, 0xc
lea r8, [0x140167348]
mov rcx, qword [rcx + 0x10]
call fcn.140006b98
nop
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3
mov ecx, eax
call fcn.140003714
int3