Function at 0x140025024
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rax, qword [0x14017b608]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov ebx, r9d
mov dword [rbp - 0x50], ebx
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x78], rdx
mov r15, rcx
mov qword [rbp + 0xa0], rcx
mov r14, qword [rbp + 0x188]
mov qword [rbp - 0x68], r14
mov r13, qword [rbp + 0x180]
mov qword [rbp - 0x30], r13
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x70], rax
xor ecx, ecx
mov dword [rbp - 0x20], ecx
mov dword [rbp - 0x5c], ecx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x40], rcx
mov r12d, ecx
mov qword [rbp - 0x38], rcx
mov esi, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x10], rcx
mov dword [rsp + 0x74], ecx
mov qword [rbp - 0x18], rcx
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x7e], cl
mov byte [rbp - 0x5f], cl
mov edi, ecx
mov byte [rbp - 0x53], cl
mov byte [rbp - 0x70], cl
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x18], rcx
lea rax, [0x14017b048]
mov rcx, qword [0x14017b048]
cmp rcx, rax
je 0x14002511e
test byte [rcx + 0x1c], 1
je 0x14002511e
cmp byte [rcx + 0x19], 4
jb 0x14002511e
mov edx, 0x1fc
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c10
cmp ebx, dword [r15 + 0x170]
je 0x14002513f
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov rax, qword [rbp + 0x28]
mov byte [rax], sil
mov rax, qword [rbp + 0x70]
and dword [rax], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe0]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe0]
mov dword [r14 + 0x10], eax
lea rcx, [rbp - 0x53]
call fcn.140092088
mov ebx, eax
test eax, eax
jns 0x1400251d5
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140027526
test byte [rcx + 0x1c], 1
je 0x140027526
cmp byte [rcx + 0x19], 2
jb 0x140027526
mov edx, 0x1fd
mov r9d, ebx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
jmp 0x140027526
lea r8, [rbp + 8]
lea rdx, [0x140153978]
mov rcx, qword [r15 + 0x158]
call fcn.140088abc
mov ebx, eax
test eax, eax
js 0x140027526
mov esi, dword [rbp - 0x50]
shl rsi, 4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x14002521f
mov ebx, 0x8007000e
jmp 0x140027522
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x50]
shl eax, 4
mov esi, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140025215
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov esi, dword [r14 + 8]
mov r12d, dword [rbp - 0x50]
cmp esi, r12d
jae 0x140027400
xor eax, eax
mov byte [rsp + 0x70], al
mov byte [rbp - 0x7f], al
neg byte [rbp - 0x7e]
sbb r12d, r12d
and r12d, edi
mov dword [rbp - 0x58], r12d
mov byte [rbp - 0x7e], al
mov eax, esi
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x38]
mov r13, qword [rcx + rax*8]
mov qword [rsp + 0x78], r13
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov dword [r15 + 0x174], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
je 0x14002538d
mov ecx, dword [r14 + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + rcx*8]
lea rdx, [rbp - 0x38]
call fcn.140088864
test eax, eax
mov edi, r12d
mov r13d, eax
js 0x14002701e
test byte [rsi + 0x54], 0x40
je 0x1400254b1
mov rdx, rsi
mov rcx, r15
call fcn.1400239cc
mov ebx, eax
test eax, eax
js 0x140027502
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [r14 + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
mov ecx, dword [r14 + 8]
inc ecx
mov dword [r14 + 8], ecx
mov edi, r12d
xor eax, eax
jmp 0x1400273a4
xor edi, edi
mov rcx, qword [r15 + 0x1b0]
cmp dword [rcx + 0x50], edi
jbe 0x1400253d2
mov eax, edi
imul r14, rax, 0x38
add r14, qword [rcx + 0x58]
mov qword [rbp + 0x40], r14
mov rdx, r13
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400253ce
inc edi
mov rcx, qword [r15 + 0x1b0]
cmp edi, dword [rcx + 0x50]
jb 0x14002539b
mov r14, qword [rbp - 0x68]
mov rax, qword [r15 + 0x1b0]
cmp edi, dword [rax + 0x50]
jne 0x140025439
mov r13d, dword [rsi + 0x20]
test r13d, r13d
js 0x140025426
mov r13d, 0x80780020
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x14002542d
test byte [rcx + 0x1c], 1
je 0x14002542d
cmp byte [rcx + 0x19], 2
jb 0x14002542d
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
mov rcx, qword [0x14017b048]
mov byte [rbp - 0x7f], 1
mov edi, r12d
jmp 0x140027025
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140025457
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400252f7
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x1400254a6
test byte [rcx + 0x1c], 1
je 0x1400254a6
cmp byte [rcx + 0x19], 2
jb 0x1400254a6
mov edx, 0x1ff
mov r9, r13
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
mov rcx, qword [0x14017b048]
mov r13d, 0x80780020
jmp 0x14002542d
mov edi, 8
test byte [rsi + 0x54], dil
jne 0x14002555b
test byte [rsi + 0x54], 0x20
jne 0x1400254de
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov rax, qword [0x14017b048]
lea rcx, [0x14017b048]
cmp rax, rcx
je 0x140025532
test byte [rax + 0x1c], 1
je 0x140025532
cmp byte [rax + 0x19], 4
jb 0x140025532
lea rdx, [rsi + 0x44]
lea rcx, [rbp + 0x80]
call fcn.14001020c
nop
or dword [rbp - 0x20], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x1401563e0]
mov rcx, qword [0x14017b048]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
nop
mov eax, dword [rbp - 0x20]
test al, 1
je 0x140025379
and eax, 0xfffffffe
mov dword [rbp - 0x20], eax
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
jmp 0x140025379
mov r8b, 1
mov edx, edi
mov rcx, r15
call fcn.14002d55c
mov dword [r14 + 0x2c], edi
mov eax, dword [r14 + 8]
mov rdi, qword [rbp - 0x30]
cmp eax, dword [rdi + 8]
jne 0x14002558d
cmp qword [rdi + 0x30], 0
je 0x14002558d
mov rbx, qword [rdi + 0x30]
mov qword [rbp - 0x48], rbx
jmp 0x140025b67
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1400255aa
cmp rax, qword [r14 + 0x30]
je 0x1400255aa
cmp rax, qword [rdi + 0x30]
je 0x1400255aa
mov rcx, rax
call fcn.1400c15c8
xor edi, edi
mov eax, edi
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test byte [rsi + 0x54], 1
je 0x14002561a
mov rcx, r15
call fcn.14002e68c
mov r13d, eax
test eax, eax
jns 0x14002561a
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025431
test byte [rcx + 0x1c], 1
je 0x140025431
cmp byte [rcx + 0x19], 2
jb 0x140025431
mov edx, 0x201
mov r9d, ebx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
mov rcx, qword [0x14017b048]
jmp 0x140025431
lea r14, [r15 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test byte [r15 + 0x154], 0x10
jne 0x14002568c
cmp byte [r15 + 0x17c], dil
jne 0x140025674
cmp byte [r15 + 0x17d], dil
je 0x14002568c
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x1400256d0
test byte [rcx + 0x1c], 1
je 0x1400256d0
mov rbx, qword [rbp - 0x38]
cmp byte [rcx + 0x19], 4
jb 0x1400256d4
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005dc4
jmp 0x1400256d4
mov rbx, qword [rbp - 0x38]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x8c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [r15 + 0x154]
mov r8b, byte [r15 + 0x17d]
mov dl, byte [r15 + 0x17c]
test al, 2
je 0x140025932
shr eax, 4
and al, 1
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], r15
mov r9b, r8b
mov r8b, dl
mov dl, al
mov rcx, rbx
call fcn.1400b9654
mov esi, eax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x48], rax
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x14017b048]
lea rax, [0x14017b048]
cmp r10, rax
je 0x140025829
test byte [r10 + 0x1c], 1
je 0x140025829
cmp byte [r10 + 0x19], 4
jb 0x140025829
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0x50], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0x54], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0x48], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0x4c], eax
mov rcx, qword [rbp + 0x48]
sub rcx, qword [rbp + 0x50]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x1401563e0]
mov rcx, qword [r10 + 0x10]
call fcn.140010518
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 0x20], rax
mov rax, qword [rbp]
mov qword [r14 + 0x18], rax
mov ecx, esi
test esi, esi
je 0x140025b5b
sub ecx, 1
je 0x140025b3a
sub ecx, 3
je 0x140025aa8
sub ecx, 1
je 0x140025a4a
sub ecx, 1
je 0x140025aa8
sub ecx, 1
je 0x140025a4a
sub ecx, 0xf
je 0x140025aa8
cmp ecx, 9
je 0x140025aa8
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x14002590d
test byte [rcx + 0x1c], 1
je 0x14002590d
cmp byte [rcx + 0x19], 2
jb 0x14002590d
mov edx, 0x208
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
mov ecx, esi
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x5c]
call fcn.140100cac
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x14017b048]
mov rsi, qword [rbp - 0x78]
jmp 0x140027025
lea rax, [rsp + 0x74]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x28], r15
lea rax, [0x140020b00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, rbx
call fcn.1400b9870
mov esi, eax
test eax, eax
jne 0x140025768
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x48], rbx
test rbx, rbx
jne 0x1400259bc
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.140087b08
cmp byte [rbx + 0xb8], dil
je 0x140025a18
mov edx, 0x2000
mov rcx, qword [rbp - 0x78]
call fcn.140012d68
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025770
test byte [rcx + 0x1c], 1
je 0x140025770
cmp byte [rcx + 0x19], 4
jb 0x140025770
mov edx, 0x203
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c10
jmp 0x140025770
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025770
test byte [rcx + 0x1c], 1
je 0x140025770
cmp byte [rcx + 0x19], 4
jb 0x140025770
mov edx, 0x204
jmp 0x140025a03
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025a8f
test byte [rcx + 0x1c], 1
je 0x140025a8f
cmp byte [rcx + 0x19], 2
jb 0x140025a8f
mov edx, 0x207
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.140100cac
mov byte [rsp + 0x70], 1
jmp 0x14002591c
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025aed
test byte [rcx + 0x1c], 1
je 0x140025aed
cmp byte [rcx + 0x19], 2
jb 0x140025aed
mov edx, 0x206
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.140100cac
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140025b27
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024d94
test eax, eax
js 0x140025b27
cmp byte [rbp - 0x70], 0
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, r12d
mov rcx, qword [0x14017b048]
jmp 0x140027025
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005bb3.0]
test al, al
mov eax, 0x80780167
cmovne r13d, eax
jmp 0x14002591f
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x30]
mov qword [r14 + 0x30], rbx
mov ecx, dword [r14 + 8]
mov eax, ecx
cmp ecx, dword [rdi + 8]
jne 0x140025b8b
cmp qword [rdi + 0x30], 0
jne 0x140025b8b
test byte [rsi + 0x54], 1
jne 0x140025b8b
mov qword [rdi + 0x30], rbx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025ba5
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140025ba5
mov qword [rbp - 0x10], rcx
mov edx, dword [rdi + 0x40]
jmp 0x140025c4d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140025bc6
cmp rcx, qword [r14 + 0x38]
je 0x140025bc6
cmp rcx, qword [rdi + 0x38]
je 0x140025bc6
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rbp - 0x10], rcx
xor edx, edx
mov dword [rbp - 0x28], edx
test byte [r15 + 0x154], 2
je 0x140025c4d
lea r9, [rsp + 0x74]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400bd844
mov ebx, eax
test eax, eax
je 0x140025c42
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025c3b
test byte [rcx + 0x1c], 1
je 0x140025c3b
cmp byte [rcx + 0x19], 2
jb 0x140025c3b
mov edx, 0x209
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
mov ecx, ebx
jmp 0x14002590f
mov rcx, qword [rbp - 0x10]
mov edx, dword [rbp - 0x28]
mov rbx, qword [rbp - 0x48]
mov qword [r14 + 0x38], rcx
mov dword [r14 + 0x40], edx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025c72
cmp qword [rdi + 0x38], 0
jne 0x140025c72
test byte [rsi + 0x54], 1
jne 0x140025c72
mov qword [rdi + 0x38], rcx
mov dword [rdi + 0x40], edx
mov r8b, 1
mov edi, 9
mov edx, edi
mov rcx, r15
call fcn.14002d55c
mov edx, edi
mov rcx, r14
call fcn.140014b18
test byte [r15 + 0x154], 2
je 0x140025ce4
lea r9, [rsp + 0x74]
mov rdx, qword [rbp - 0x10]
mov rcx, rbx
call fcn.1400bda1c
mov ebx, eax
test eax, eax
je 0x140025ce4
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025c3b
test byte [rcx + 0x1c], 1
je 0x140025c3b
cmp byte [rcx + 0x19], 2
jb 0x140025c3b
mov edx, 0x20a
jmp 0x140025c1a
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140025d01
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
and qword [rbp - 0x18], 0
lea rdx, [rsi + 0x44]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rsi + 0x54]
mov rcx, qword [r15 + 0x1d8]
call fcn.14011251c
mov r13d, eax
mov edi, r12d
test eax, eax
js 0x140025922
lea r14, [r15 + 0x28]
mov rcx, r14
call fcn.1400fe164
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
mov rcx, r15
call fcn.140020ed4
mov r13d, eax
test eax, eax
jns 0x140025da6
mov byte [rsp + 0x70], 1
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025d9d
test byte [rcx + 0x1c], 1
je 0x140025d9d
cmp byte [rcx + 0x19], 2
jb 0x140025d9d
mov edx, 0x20b
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
mov rcx, qword [0x14017b048]
mov r14, qword [rbp - 0x68]
jmp 0x140025929
xor edx, edx
mov rcx, r14
call fcn.1400fdfb8
mov ebx, eax
test eax, eax
js 0x1400274f9
xor ebx, ebx
xor edi, edi
lea r9, [rbp + 0xd0]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x98]
mov rsi, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025df7
mov rcx, rsi
call fcn.140137834
mov r13d, eax
jmp 0x140025e08
mov rbx, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x98]
xor r13d, r13d
and qword [rbp + 0x30], 0
xor sil, sil
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswbengine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025f2a
and dword [rbp - 0x28], eax
mov dword [rbp - 0x40], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025e9a
mov eax, dword [rbp - 0x28]
shl rax, 0x14
test rax, rax
je 0x140025ed5
cmp rax, rdi
jae 0x140025ed5
mov rdi, rax
mov sil, 1
jmp 0x140025ed5
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025f18
test byte [rcx + 0x1c], 1
je 0x140025ee3
cmp byte [rcx + 0x19], 5
jb 0x140025ee3
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025f18
test byte [rcx + 0x1c], 1
je 0x140025f18
cmp byte [rcx + 0x19], 4
jb 0x140025f18
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.1400112a0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140025f65
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025f73
test byte [rcx + 0x1c], 1
je 0x140025f73
cmp byte [rcx + 0x19], 5
jb 0x140025f73
mov edx, 0x20e
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
lea rax, [0x14017b048]
mov rcx, qword [0x14017b048]
test r13d, r13d
jns 0x140025f85
mov byte [rsp + 0x70], 1
mov edi, r12d
jmp 0x140025d9d
cmp rcx, rax
je 0x140025fb3
test byte [rcx + 0x1c], 1
je 0x140025fb3
cmp byte [rcx + 0x19], 4
jb 0x140025fb3
mov edx, 0x20f
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004db8
mov rcx, r14
call fcn.1400fe164
test byte [r15 + 0x154], 2
je 0x140026177
mov r8, qword [rbp - 0x68]
mov eax, dword [r8 + 0xc]
mov r9, qword [rbp - 0x30]
cmp eax, dword [r9 + 0xc]
jne 0x140026002
mov bl, 1
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x14002606d
test byte [rcx + 0x1c], bl
je 0x14002606d
cmp byte [rcx + 0x19], 4
jb 0x14002606d
mov edx, 0x210
jmp 0x14002604e
ja 0x140026024
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x30]
xor bl, bl
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026074
test byte [rcx + 0x1c], 1
je 0x140026074
cmp byte [rcx + 0x19], 4
jb 0x140026074
mov edx, 0x211
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r9 + 0xc]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010290
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
mov edx, 0x1400000
cmp rdi, rdx
ja 0x1400260d4
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025f7d
test byte [rcx + 0x1c], 1
je 0x140025f7d
cmp byte [rcx + 0x19], 3
jb 0x140025f7d
mov edx, 0x212
mov r9, rdi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010518
mov rcx, qword [0x14017b048]
jmp 0x140025f7d
test sil, sil
jne 0x14002612f
mov r8d, 0x40000000
cmp rdi, r8
ja 0x14002612f
test bl, bl
je 0x14002612f
mov r13d, 0x80780080
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025f7d
test byte [rcx + 0x1c], 1
je 0x140025f7d
cmp byte [rcx + 0x19], 3
jb 0x140025f7d
mov edx, 0x213
mov qword [rsp + 0x20], r8
mov r9, rdi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004db8
jmp 0x1400260c8
sub rdi, rdx
cmp rdi, 0x1100000
ja 0x140026177
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025f7d
test byte [rcx + 0x1c], 1
je 0x140025f7d
cmp byte [rcx + 0x19], 3
jb 0x140025f7d
mov edx, 0x214
jmp 0x1400260b5
mov bl, 1
mov byte [rbp - 0x60], bl
test byte [r15 + 0x154], 4
je 0x1400261b2
mov r9d, dword [r15 + 0x174]
shl r9d, 4
add r9, qword [rbp + 0x10]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x78]
mov rcx, r15
call fcn.14001f5a4
mov ebx, eax
test eax, eax
js 0x1400274f9
mov bl, byte [rbp - 0x60]
mov byte [rbp - 0x80], bl
lea rsi, [r15 + 0x58]
mov qword [rbp - 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
and qword [rcx], 0
and qword [rcx + 8], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026269
test byte [rcx + 0x1c], 1
je 0x14002623e
cmp byte [rcx + 0x19], 4
jb 0x14002623e
mov edx, 0x215
mov r9, rdi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010518
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026269
test byte [rcx + 0x1c], 1
je 0x140026269
cmp byte [rcx + 0x19], 4
jb 0x140026269
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x9c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
test byte [r15 + 0x154], 2
je 0x14002633b
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x1400262b7
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
cmp dword [r15 + 0x150], 4
sete r8b
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r15
lea rax, [0x140020b00]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x48]
call fcn.1400ba66c
mov r12d, eax
jmp 0x140026826
and qword [rbp - 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
cmp byte [rbp - 0x80], 0
jne 0x1400263f5
xor edx, edx
mov rcx, r14
call fcn.1400fdfb8
mov ebx, eax
test eax, eax
js 0x1400274f9
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call fcn.14008f5c8
mov bl, al
mov rcx, r14
call fcn.1400fe164
test bl, bl
je 0x1400263f5
mov dword [rbp + 0xa8], 2
lea r8, [rbp + 0xa8]
mov rdx, rsi
mov rcx, r14
call fcn.1401228f4
test eax, eax
jns 0x1400263f5
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140025f7d
test byte [rcx + 0x1c], 1
je 0x140025f7d
cmp byte [rcx + 0x19], 2
jb 0x140025f7d
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
jmp 0x1400260c8
lea r9, [rbp - 0x40]
mov r8, qword [rbp + 0x58]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r15
call fcn.140022fe0
test eax, eax
jns 0x140026426
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x14017b048]
mov r14, qword [rbp - 0x68]
jmp 0x140027025
xor edx, edx
mov rcx, r14
call fcn.1400fdfb8
mov ebx, eax
test eax, eax
js 0x1400274f9
lea rdx, [rbp + 0x18]
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call fcn.14011e988
mov ebx, eax
mov rcx, r14
call fcn.1400fe164
test ebx, ebx
jns 0x1400264a5
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x14002649a
test byte [rcx + 0x1c], 1
je 0x14002649a
cmp byte [rcx + 0x19], 2
jb 0x14002649a
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
mov rcx, qword [0x14017b048]
mov r13d, ebx
mov edi, r12d
jmp 0x14002641d
movups xmm0, xmmword [rbp + 0xb0]
movdqu xmmword [rbp + 0xe0], xmm0
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x58], rax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rdi, qword [rbp + 0x18]
mov qword [rsp + 0x38], rdi
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r15
lea rdx, [0x140020b00]
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call fcn.1400bc2b8
mov r12d, eax
test eax, eax
jne 0x140026655
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
jne 0x1400265b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140026598
test byte [rcx + 0x1c], 1
je 0x140026598
cmp byte [rcx + 0x19], 2
jb 0x140026598
mov edx, 0x219
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
mov rcx, qword [0x14017b048]
mov eax, dword [rsp + 0x74]
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x14002641d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
test eax, eax
je 0x1400265f7
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140026598
test byte [rcx + 0x1c], 1
je 0x140026598
cmp byte [rcx + 0x19], 2
jb 0x140026598
mov edx, 0x21a
jmp 0x14002657e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002664f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140026598
test byte [rcx + 0x1c], 1
je 0x140026598
cmp byte [rcx + 0x19], 2
jb 0x140026598
mov edx, 0x21b
jmp 0x14002657e
xor edi, edi
mov qword [rbp + 0x18], rdi
mov r15, qword [0x14017b048]
lea rdi, [0x14017b048]
cmp r15, rdi
je 0x140026729
test byte [r15 + 0x1c], 4
je 0x140026729
cmp byte [r15 + 0x19], 4
jb 0x140026729
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + 0x138]
lea r8, [0x1401563e0]
mov rcx, qword [r15 + 0x10]
call fcn.1400102e0
mov rbx, qword [rbp - 0x48]
lea rdi, [0x14017b048]
test rbx, rbx
jne 0x140026746
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.140087b08
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r15, qword [0x14017b048]
cmp r15, rdi
je 0x140026814
test byte [r15 + 0x1c], 4
je 0x140026814
cmp byte [r15 + 0x19], 4
jb 0x140026814
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + 0x148]
lea r8, [0x1401563e0]
mov rcx, qword [r15 + 0x10]
call fcn.1400102e0
mov byte [rbp - 0x54], 1
mov bl, byte [rbp - 0x60]
mov rsi, qword [rbp - 0x28]
mov r15, qword [rbp + 0xa0]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x14017b048]
lea rax, [0x14017b048]
cmp r10, rax
je 0x1400268df
test byte [r10 + 0x1c], 1
je 0x1400268df
cmp byte [r10 + 0x19], 4
jb 0x1400268df
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x68], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x6c], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x60], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x60]
sub rcx, qword [rbp + 0x68]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x1401563e0]
mov rcx, qword [r10 + 0x10]
call fcn.140010518
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, qword [rbp - 0x78]
cmp byte [rbp - 0x5f], r14b
je 0x140026914
mov byte [rdi + 0x84], 1
cmp byte [rbp - 0x80], r14b
jne 0x140026914
lea edx, [r14 + 0x10]
mov rcx, rdi
call fcn.140012d68
test bl, bl
jne 0x140026964
cmp byte [rbp - 0x80], r14b
je 0x140026964
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026952
test byte [rcx + 0x1c], 1
je 0x140026952
cmp byte [rcx + 0x19], 4
jb 0x140026952
mov edx, 0x21f
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c10
mov rax, qword [r15 + 0x188]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r14d
mov byte [rbp - 0x5e], 1
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov rdi, qword [rbp - 0x68]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp]
mov qword [rdi + 0x18], rax
mov ecx, r12d
test r12d, r12d
je 0x140026dfe
sub ecx, 1
je 0x140026dd6
sub ecx, 3
je 0x140026d34
sub ecx, 1
je 0x140026ca1
sub ecx, 1
je 0x140026d34
sub ecx, 1
je 0x140026ace
cmp ecx, 0xd
je 0x140026a6c
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026a51
test byte [rcx + 0x1c], 1
je 0x140026a51
cmp byte [rcx + 0x19], 2
jb 0x140026a51
mov edx, 0x227
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.140100cac
mov r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x140025d96
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026ab5
test byte [rcx + 0x1c], 1
je 0x140026ab5
cmp byte [rcx + 0x19], 2
jb 0x140026ab5
mov edx, 0x222
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 0x14
call fcn.140100cac
mov byte [rsp + 0x70], 1
jmp 0x140026a61
mov rcx, qword [0x14017b048]
lea rbx, [0x14017b048]
cmp rcx, rbx
je 0x140026b17
test byte [rcx + 0x1c], 1
je 0x140026b17
cmp byte [rcx + 0x19], 2
jb 0x140026b17
mov edx, 0x223
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 7
call fcn.140100cac
mov r13d, eax
mov byte [rbp - 0x5e], r14b
cmp eax, 0x8078002a
jne 0x140026c80
cmp dword [rsp + 0x74], 0x70
jne 0x140026c7a
mov rcx, qword [0x14017b048]
cmp rcx, rbx
je 0x140026b7c
test byte [rcx + 0x1c], 1
je 0x140026b7c
mov r12, qword [rbp + 8]
cmp byte [rcx + 0x19], 4
jb 0x140026b80
mov edx, 0x224
mov r9, r12
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
jmp 0x140026b80
mov r12, qword [rbp + 8]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x40], r14d
mov r14d, dword [rbp - 0x58]
test r14d, r14d
je 0x140026ba9
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400b9fe0
test eax, eax
jne 0x140026c8d
mov rbx, qword [rbp - 0x28]
mov rdx, rbx
cmp byte [r15 + 0x428], al
je 0x140026be0
mov rcx, qword [r15 + 0x158]
call fcn.140117ac8
jmp 0x140026be8
mov rcx, r15
call fcn.14001c618
test eax, eax
js 0x140026c49
xor r13d, r13d
mov byte [rbp - 0x7e], 1
lea edi, [r14 + 1]
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140025d9d
test byte [rcx + 0x1c], 1
je 0x140025d9d
cmp byte [rcx + 0x19], 4
jb 0x140025d9d
mov edx, 0x225
mov qword [rsp + 0x20], r12
mov rbx, qword [rsp + 0x78]
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005dc4
jmp 0x140026d20
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140026c94
test byte [rcx + 0x1c], 1
je 0x140026c94
cmp byte [rcx + 0x19], 2
jb 0x140026c94
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14001055c
jmp 0x140026c84
mov r14d, dword [rbp - 0x58]
jmp 0x140026c8d
mov r14d, dword [rbp - 0x58]
test r13d, r13d
jns 0x140026e02
mov rcx, qword [0x14017b048]
mov byte [rsp + 0x70], 1
mov edi, r14d
jmp 0x140025d9d
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026cef
test byte [rcx + 0x1c], 1
je 0x140026cef
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026cf4
mov edx, 0x221
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 5
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
jmp 0x140026cf4
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 5
call fcn.140100cac
mov r13d, eax
cmp dword [rbp - 0x5c], r14d
jne 0x140026d18
mov dword [rbp - 0x5c], eax
mov r13d, 0x80780166
mov byte [rsp + 0x70], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x14017b048]
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
jmp 0x14002702a
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026d7f
test byte [rcx + 0x1c], 1
je 0x140026d7f
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026d84
mov edx, 0x220
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140010a44
jmp 0x140026d84
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.140100cac
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140026dbf
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024d94
test eax, eax
js 0x140026dbf
cmp byte [rbp - 0x70], r14b
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x14017b048]
mov r14, qword [rbp - 0x68]
jmp 0x14002702a
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005bb3.0]
test al, al
mov r13d, 0x80780167
jne 0x140026a64
mov r13d, dword [r15 + 0x20]
jmp 0x140026a64
mov r14d, dword [rbp - 0x58]
lea rbx, [r15 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r12, qword [rbp - 0x78]
inc dword [r12 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r12 + 0x10]
mov dword [rdi + 0x28], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [rdi + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r15 + 0x154], 2
jne 0x140026eaf
mov rcx, r12
call fcn.140014408
test eax, eax
jns 0x140026eaf
mov r8d, eax
mov edx, 0x80780151
mov rsi, r12
mov rcx, r12
call fcn.140012cf8
mov edi, r14d
jmp 0x140026416
cmp byte [rbp - 0x54], 0
jne 0x140026f01
mov rax, qword [rbp - 0x10]
cmp qword [rdi + 0x38], rax
je 0x140026ed7
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
and qword [rdi + 0x38], 0
and dword [rdi + 0x40], 0
mov r13d, 0x80780030
mov byte [rsp + 0x70], 1
mov edi, r14d
mov rcx, qword [0x14017b048]
mov r14, qword [rbp - 0x68]
mov rsi, r12
jmp 0x140027025
and qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400c2788
test eax, eax
je 0x140026f2f
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140026f79
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x140026f79
test byte [rcx + 0x1c], 1
je 0x140026f79
cmp byte [rcx + 0x19], 2
jb 0x140026f79
mov edx, 0x228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.1400112a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [r12 + 0x28], rbx
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test rbx, rbx
jle 0x140026fd2
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, r12
call fcn.140012cf8
mov ebx, 0xe
mov edx, ebx
mov rcx, r12
call fcn.140012e58
mov edx, ebx
mov rcx, rdi
call fcn.140014b18
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov edi, r14d
mov rsi, r12
test byte [r15 + 0x154], 2
jne 0x140026416
mov rdx, r12
mov rcx, r15
call fcn.14002f1a8
jmp 0x140026416
mov rcx, qword [0x14017b048]
mov rbx, qword [rsp + 0x78]
mov r12, qword [rbp + 0x18]
test r12, r12
je 0x1400270ea
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
test eax, eax
je 0x140027086
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x140027086
test byte [rcx + 0x1c], 1
je 0x140027086
cmp byte [rcx + 0x19], 3
jb 0x140027086
mov edx, 0x229
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x1400270dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14017b048]
lea rdx, [0x14017b048]
cmp rcx, rdx
je 0x1400270e3
test byte [rcx + 0x1c], 1
je 0x1400270e3
cmp byte [rcx + 0x19], 3
jb 0x1400270e3
mov edx, 0x22a
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
mov rcx, qword [0x14017b048]
xor r12d, r12d
mov qword [rbp + 0x18], r12
cmp r13d, 0x80780030
je 0x14002710b
cmp r13d, 0x8078002a
jne 0x1400271d6
cmp dword [rsp + 0x74], 0x70
jne 0x1400271fa
test byte [r15 + 0x154], 2
jne 0x14002715a
mov rcx, rsi
call fcn.140014408
test eax, eax
jns 0x14002715a
mov rcx, qword [0x14017b048]
lea r12, [0x14017b048]
cmp rcx, r12
je 0x140027161
test byte [rcx + 0x1c], 1
je 0x140027161
cmp byte [rcx + 0x19], 3
jb 0x140027161
mov edx, 0x22b
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
jmp 0x140027161
lea r12, [0x14017b048]
lea rax, [0x1400dfba0]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x188]
mov edx, dword [r15 + 0x150]
mov rcx, qword [r15 + 0x158]
call fcn.14010f5bc
test eax, eax
jns 0x1400271cf
mov rcx, qword [0x14017b048]
cmp rcx, r12
je 0x1400271d6
test byte [rcx + 0x1c], 1
je 0x1400271d6
cmp byte [rcx + 0x19], 2
jb 0x1400271d6
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r15 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x158]
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005e80
mov rcx, qword [0x14017b048]
cmp r13d, 0x80780030
jne 0x1400271fa
test byte [r15 + 0x154], 2
je 0x1400271fa
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0xc]
cmp dword [r14 + 0xc], eax
ja 0x1400273b4
mov r12, qword [rsp + 0x78]
mov rbx, r12
cmp qword [rsi + 0x58], 0
cmovne rbx, qword [rsi + 0x58]
test r13d, r13d
jns 0x1400272f6
mov edx, 0xc
mov rcx, r14
call fcn.140014b18
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x14002725e
test byte [rcx + 0x1c], 1
je 0x14002725e
cmp byte [rcx + 0x19], 2
jb 0x14002725e
mov edx, 0x22e
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call fcn.140035858
mov ebx, eax
test eax, eax
jns 0x1400272b3
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x1400272b1
test byte [rcx + 0x1c], 1
je 0x1400272b1
cmp byte [rcx + 0x19], 3
jb 0x1400272b1
mov edx, 0x22f
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
xor ebx, ebx
mov r8d, dword [rbp - 0x5c]
mov edx, r13d
mov rcx, rsi
call fcn.140012f54
xor eax, eax
cmp byte [rbp - 0x7f], al
je 0x1400272db
cmp byte [rbp - 0x53], al
je 0x140027372
cmp byte [rsi + 0x68], al
je 0x140027372
mov al, byte [rsp + 0x70]
mov rcx, qword [rbp + 0x28]
mov byte [rcx], al
mov eax, dword [rbp - 0x5c]
mov rcx, qword [rbp + 0x70]
mov dword [rcx], eax
mov ebx, r13d
jmp 0x140027502
lea rsi, [0x14017b048]
cmp rcx, rsi
je 0x140027326
test byte [rcx + 0x1c], 1
je 0x140027326
cmp byte [rcx + 0x19], 4
jb 0x140027326
mov edx, 0x230
mov r9, r12
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r15
call fcn.140035858
mov ebx, eax
test eax, eax
jns 0x140027372
mov rcx, qword [0x14017b048]
cmp rcx, rsi
je 0x140027372
test byte [rcx + 0x1c], 1
je 0x140027372
cmp byte [rcx + 0x19], 3
jb 0x140027372
mov edx, 0x231
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d40
mov ecx, dword [r14 + 8]
cmp byte [rbp - 0x7e], 0
jne 0x140027382
inc ecx
mov dword [r14 + 8], ecx
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x28], eax
mov dword [r14 + 0x2c], 0xf
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rax
mov dword [r14 + 0x40], eax
mov esi, ecx
mov r12d, dword [rbp - 0x50]
cmp ecx, r12d
jae 0x1400273fc
jmp 0x14002526b
mov edx, 4
mov rcx, r14
call fcn.140014b18
mov rcx, qword [0x14017b048]
lea rax, [0x14017b048]
cmp rcx, rax
je 0x1400273f8
test byte [rcx + 0x1c], 1
je 0x1400273f8
cmp byte [rcx + 0x19], 4
jb 0x1400273f8
mov edx, 0x22d
mov r9, rbx
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cd0
mov r12d, dword [rbp - 0x50]
mov r13, qword [rbp - 0x30]
mov rdx, qword [rbp + 0x28]
mov rcx, r15
call fcn.1400215d8
mov ebx, eax
test eax, eax
js 0x140027502
lea rcx, [r15 + 0x28]
xor edx, edx
call fcn.1400fdfb8
mov ebx, eax
test eax, eax
js 0x140027502
mov r14d, dword [r13 + 0xc]
xor edi, edi
test r12d, r12d
je 0x1400274d7
xor esi, esi
mov r13, qword [rbp + 0x20]
mov ecx, edi
mov edx, edi
shl rdx, 4
add rdx, r13
mov rax, qword [rdx]
cmp rax, qword [0x14015af68]
jne 0x140027464
mov rax, qword [rdx + 8]
cmp rax, qword [0x14015af70]
je 0x1400274c5
mov r11, qword [r15 + 0xd8]
imul r8, rcx, 0x170
lea r10, [r11 + 0x78]
add r10, r8
mov ecx, edi
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea r9, [r11 + 0x44]
add r9, r8
mov eax, dword [r11 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rcx
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [r11 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r15
call fcn.14001f974
mov ebx, eax
inc r14d
test eax, eax
js 0x1400274f9
inc edi
add rsi, 0x170
cmp edi, r12d
jb 0x140027440
mov rax, qword [rbp - 0x68]
cmp r14d, dword [rax + 0xc]
je 0x1400274ff
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140087b08
mov r14, qword [rbp - 0x68]
jmp 0x140027502
mov r14, rax
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x14002751a
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov r13, qword [rbp - 0x30]
mov r12, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140027547
cmp rcx, qword [r14 + 0x38]
je 0x140027547
cmp rcx, qword [r13 + 0x38]
je 0x140027547
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140027560
cmp rsi, qword [r14 + 0x30]
je 0x140027560
cmp rsi, qword [r13 + 0x30]
je 0x140027560
mov rcx, rsi
call fcn.1400c15c8
test r12, r12
je 0x140027574
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x14002758c
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x1400275a4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
test rax, rax
je 0x1400275bc
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rdi, [r15 + 0x28]
mov rcx, rdi
call fcn.1400fe164
test ebx, ebx
jns 0x1400276c2
mov rcx, qword [0x14017b048]
lea rsi, [0x14017b048]
cmp rcx, rsi
je 0x140027620
test byte [rcx + 0x1c], 1
je 0x140027620
cmp byte [rcx + 0x19], 2
jb 0x140027620
lea r8, [0x1401563a8]
lea rax, [0x1401556c8]
mov rdx, qword [rbp + 0x28]
cmp byte [rdx], 0
cmovne rax, r8
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.14001071c
mov rcx, qword [0x14017b048]
cmp byte [rbp - 0x5e], 0
jne 0x1400276d0
test byte [r15 + 0x154], 4
je 0x1400276d0
xor edx, edx
mov rcx, rdi
call fcn.1400fdfb8
test eax, eax
jns 0x14002767c
mov rcx, qword [0x14017b048]
cmp rcx, rsi
je 0x1400276f6
test byte [rcx + 0x1c], 1
je 0x1400276d0
cmp byte [rcx + 0x19], 2
jb 0x1400276d0
mov edx, 0x233
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
jmp 0x1400276c9
mov rcx, r15
call fcn.14001d4ec
test eax, eax
jns 0x1400276b8
mov rcx, qword [0x14017b048]
cmp rcx, rsi
je 0x1400276b8
test byte [rcx + 0x1c], 1
je 0x1400276b8
cmp byte [rcx + 0x19], 2
jb 0x1400276b8
mov edx, 0x234
mov r9d, eax
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c3c
mov rcx, rdi
call fcn.1400fe164
jmp 0x1400276c9
lea rsi, [0x14017b048]
mov rcx, qword [0x14017b048]
cmp rcx, rsi
je 0x1400276f6
test byte [rcx + 0x1c], 1
je 0x1400276f6
cmp byte [rcx + 0x19], 4
jb 0x1400276f6
mov edx, 0x235
lea r8, [0x1401563e0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c10
mov eax, ebx
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14014bb60
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret