Function at 0x1400fac00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x160
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, r8
mov rbx, rcx
lea rax, [0x14016d090]
mov rcx, qword [0x14016d090]
cmp rcx, rax
je 0x1400fac69
test byte [rcx + 0x1c], 1
je 0x1400fac69
cmp byte [rcx + 0x19], 4
jb 0x1400fac69
mov edx, 0xa
lea r8, [0x140153fe8]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
xor eax, eax
mov r12d, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov r14d, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rax
mov r13d, eax
mov qword [rbp - 0x58], rax
mov edi, eax
mov qword [rbp - 0x70], rax
mov r15d, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x60], rax
cmp qword [rbx], rax
je 0x1400facbc
lea r8, str.m_wszSpecsXML__NULL
mov edx, 0xc1
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.140081b60
xor eax, eax
cmp qword [rbx + 8], rax
je 0x1400facda
lea r8, str.m_spBackupItemsRoot__NULL
mov edx, 0xc2
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.140081b60
mov edx, 0x1c
lea r8d, [rdx - 0x1a]
lea rcx, [rbp - 0x38]
call fcn.14000f570
mov ebx, eax
test eax, eax
js 0x1400fb549
mov r9d, 1
lea r8, str._BackupSpecs_Version__u__
lea edx, [r9 + 0x19]
mov rcx, qword [rbp - 0x38]
call fcn.14000f4f8
mov ebx, eax
test eax, eax
js 0x1400fb549
or rdi, 0xffffffffffffffff
mov rcx, qword [rbp - 0x38]
xor ebx, ebx
test rcx, rcx
je 0x1400fad46
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400fad2c
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400fad48
mov eax, ebx
test eax, eax
jns 0x1400fad54
mov ecx, eax
call fcn.140001ae4
int3
lea rdx, str._FileSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400fad5e
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
jns 0x1400fad7f
mov ecx, eax
call fcn.140001ae4
int3
mov eax, ebx
mov dword [rbp - 0x50], ebx
lea r13, str.false
mov ecx, dword [rbp + 0x48]
test ecx, ecx
je 0x1400fb0b7
add rsi, 0x18
cmp byte [rsi + 0x3c], bl
je 0x1400fb064
test r12, r12
je 0x1400fadb8
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r12d, r12d
mov qword [rbp - 0x40], r12
test r14, r14
je 0x1400fadcf
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r14, r12
mov qword [rbp - 0x80], r12
jmp 0x1400fadd3
mov r14, qword [rbp - 0x80]
lea rcx, [rsi - 0x18]
xor r9d, r9d
lea r8, [rbp - 0x40]
mov edx, dword [rsi + 0x40]
call fcn.140085570
mov ebx, eax
test eax, eax
js 0x1400fb09b
mov rax, qword [rsi - 8]
test rax, rax
je 0x1400fae08
mov rdx, rdi
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x1400fadfc
jmp 0x1400fae0b
mov rdx, r12
mov rax, qword [rsi]
test rax, rax
je 0x1400fae22
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400fae16
jmp 0x1400fae25
mov rcx, r12
mov rax, rdi
mov r12, qword [rbp - 0x40]
xor r15d, r15d
inc rax
cmp word [r12 + rax*2], r15w
jne 0x1400fae2f
add eax, edx
lea r14d, [rcx + 0x63]
add r14d, eax
mov r8d, 2
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.14000f570
mov ebx, eax
test eax, eax
js 0x1400fb541
lea r8, [0x140147168]
mov rcx, r8
cmp qword [rsi], r15
cmovne rcx, qword [rsi]
mov rax, r8
cmp qword [rsi - 8], r15
cmovne rax, qword [rsi - 8]
mov edx, r14d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, str._Volume_Name__ws__AccessPath__ws__OriginalAccessPath__ws__Label__ws__OriginalLabel__ws___
mov r14, qword [rbp - 0x80]
mov rcx, r14
call fcn.14000f4f8
mov ebx, eax
test eax, eax
js 0x1400fb541
xor ebx, ebx
test r14, r14
je 0x1400faed7
mov rax, rdi
inc rax
cmp word [r14 + rax*2], bx
jne 0x1400faebc
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400faed9
mov eax, ebx
test eax, eax
js 0x1400fb093
test byte [rsi + 0x40], 1
jne 0x1400fb044
mov r13d, ebx
cmp dword [rsi + 0x50], ebx
jbe 0x1400fb044
mov r14, qword [rbp - 0x70]
mov eax, r13d
lea r15, [rax + rax*2]
mov r12, qword [rsi + 0x58]
test r14, r14
je 0x1400faf18
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x70], rbx
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400faf2b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x78], rbx
lea rdx, [rbp - 0x78]
mov rcx, qword [r12 + r15*8]
call fcn.1400826fc
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400fb541
mov rax, qword [r12 + r15*8 + 8]
mov r14, rdi
inc r14
cmp word [rax + r14*2], dx
jne 0x1400faf4c
mov rax, rdi
mov rcx, qword [rbp - 0x78]
inc rax
cmp word [rcx + rax*2], dx
jne 0x1400faf5d
add r14d, eax
mov al, byte [r12 + r15*8 + 0x10]
neg al
sbb ecx, ecx
add ecx, 0x56
add r14d, ecx
mov al, byte [r12 + r15*8 + 0x11]
neg al
sbb ecx, ecx
add ecx, 5
add r14d, ecx
mov r8d, 2
mov edx, r14d
lea rcx, [rbp - 0x70]
call fcn.14000f570
mov ebx, eax
xor edx, edx
test eax, eax
js 0x1400fb541
lea rax, str.false
mov rcx, rax
cmp byte [r12 + r15*8 + 0x11], dl
lea r8, str.true
cmovne rcx, r8
cmp byte [r12 + r15*8 + 0x10], dl
cmovne rax, r8
mov edx, r14d
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x20], rax
mov r15, qword [rbp - 0x78]
mov r9, r15
lea r8, str._FileSpec_FilePath__ws__FileName__ws__IsRecursive__ws__IsInclude__ws____
mov r14, qword [rbp - 0x70]
mov rcx, r14
call fcn.14000f4f8
mov ebx, eax
xor r12d, r12d
test eax, eax
js 0x1400fb07e
test r14, r14
je 0x1400fb025
mov rax, rdi
inc rax
cmp word [r14 + rax*2], r12w
jne 0x1400fb00a
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400fb028
mov eax, r12d
test eax, eax
js 0x1400fb076
inc r13d
cmp r13d, dword [rsi + 0x50]
mov rbx, r12
jb 0x1400faefb
mov r14, qword [rbp - 0x80]
mov r12, qword [rbp - 0x40]
mov r8d, 9
lea rdx, str.__Volume_
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
js 0x1400fb08b
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp + 0x48]
inc eax
mov dword [rbp - 0x50], eax
sub rsi, 0xffffffffffffff80
cmp eax, ecx
jae 0x1400fb0ac
jmp 0x1400fad9a
mov ecx, eax
call fcn.140001ae4
int3
mov rdi, qword [rbp - 0x70]
mov r13, qword [rbp - 0x58]
jmp 0x1400fb54d
mov ecx, eax
call fcn.140001ae4
int3
mov ecx, eax
call fcn.140001ae4
int3
mov rdi, qword [rbp - 0x70]
mov r13, qword [rbp - 0x58]
mov r15, qword [rbp - 0x78]
jmp 0x1400fb551
mov r15, qword [rbp - 0x48]
lea r13, str.false
lea rdx, str.__FileSpecs_
mov rax, rdi
xor r12d, r12d
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400fb0c4
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
jns 0x1400fb0e6
mov ecx, eax
call fcn.140001ae4
int3
mov r14b, byte [rbp + 0x68]
mov al, r14b
neg al
sbb esi, esi
add esi, 0x29
mov r8d, 2
mov edx, esi
lea rcx, [rbp - 0x68]
call fcn.14000f570
mov ebx, eax
test eax, eax
js 0x1400fb541
mov r9, r13
test r14b, r14b
lea rax, str.true
cmovne r9, rax
mov edx, esi
lea r8, str._SystemState_IsPresent__ws____
mov rsi, qword [rbp - 0x68]
mov rcx, rsi
call fcn.14000f4f8
mov ebx, eax
test eax, eax
js 0x1400fb52f
test rsi, rsi
je 0x1400fb162
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r12w
jne 0x1400fb147
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400fb165
mov eax, r12d
test eax, eax
jns 0x1400fb171
mov ecx, eax
call fcn.140001ae4
int3
mov r14b, byte [rbp + 0x70]
mov al, r14b
neg al
sbb esi, esi
add esi, 0x29
mov r8d, 2
mov edx, esi
lea rcx, [rbp - 0x58]
call fcn.14000f570
mov ebx, eax
test eax, eax
js 0x1400fb541
test r14b, r14b
lea rax, str.true
cmovne r13, rax
mov edx, esi
mov r9, r13
lea r8, str._AllCritical_IsPresent__ws____
mov r13, qword [rbp - 0x58]
mov rcx, r13
call fcn.14000f4f8
mov ebx, eax
test eax, eax
js 0x1400fb545
test r13, r13
je 0x1400fb1ee
mov rax, rdi
inc rax
cmp word [r13 + rax*2], r12w
jne 0x1400fb1d2
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400fb1f1
mov eax, r12d
test eax, eax
jns 0x1400fb1fd
mov ecx, eax
call fcn.140001ae4
int3
lea rdx, str._ComponentSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400fb207
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
jns 0x1400fb229
mov ecx, eax
call fcn.140001ae4
int3
mov dword [rbp - 0x50], r12d
cmp dword [rbp + 0x58], r12d
jbe 0x1400fb491
mov r13, qword [rbp + 0x60]
add r13, 8
mov qword [rbp - 0x28], r13
test r15, r15
je 0x1400fb255
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x48], r12
mov rax, qword [r13]
test rax, rax
je 0x1400fb26d
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400fb261
jmp 0x1400fb270
mov rcx, r12
mov rdx, qword [r13 - 8]
test rdx, rdx
je 0x1400fb288
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400fb27c
jmp 0x1400fb28b
mov rax, r12
lea edx, [rax + 0x10f]
mov rax, qword [r13 + 0x28]
test rax, rax
je 0x1400fb2a6
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x1400fb29a
jmp 0x1400fb2a9
mov rdi, r12
lea eax, [rdx + rcx]
add eax, edi
mov dword [rbp - 0x30], eax
mov r8d, 2
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.14000f570
mov ebx, eax
test eax, eax
js 0x1400fb541
lea rcx, [0x140147168]
mov rax, rcx
cmp qword [r13 + 0x28], r12
cmovne rax, qword [r13 + 0x28]
mov qword [rbp - 0x20], rax
mov rax, rcx
cmp qword [r13 - 8], r12
cmovne rax, qword [r13 - 8]
mov qword [rbp - 0x18], rax
mov rax, rcx
cmp qword [r13], r12
cmovne rax, qword [r13]
mov qword [rbp - 0x10], rax
movzx eax, byte [r13 + 0x27]
movzx ecx, byte [r13 + 0x26]
movzx r8d, byte [r13 + 0x25]
movzx r9d, byte [r13 + 0x24]
movzx r10d, byte [r13 + 0x23]
movzx r11d, byte [r13 + 0x22]
movzx ebx, byte [r13 + 0x21]
movzx edi, byte [r13 + 0x20]
movzx esi, word [r13 + 0x1e]
movzx r14d, word [r13 + 0x1c]
movzx r15d, byte [r13 + 0x17]
mov dword [rbp - 0x2c], r15d
movzx r12d, byte [r13 + 0x16]
movzx r13d, byte [r13 + 0x15]
mov edx, dword [rbp - 0x30]
mov r15, qword [rbp - 0x20]
mov qword [rsp + 0xd8], r15
mov r15, qword [rbp - 0x18]
mov qword [rsp + 0xd0], r15
mov r15, qword [rbp - 0x10]
mov qword [rsp + 0xc8], r15
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xb8], ecx
mov dword [rsp + 0xb0], r8d
mov dword [rsp + 0xa8], r9d
mov dword [rsp + 0xa0], r10d
mov dword [rsp + 0x98], r11d
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x80], esi
mov dword [rsp + 0x78], r14d
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x70], eax
mov r15d, dword [rbp - 0x2c]
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov r13, qword [rbp - 0x28]
movzx eax, byte [r13 + 0x14]
mov dword [rsp + 0x50], eax
movzx eax, byte [r13 + 0x13]
mov dword [rsp + 0x48], eax
movzx eax, byte [r13 + 0x12]
mov dword [rsp + 0x40], eax
movzx eax, byte [r13 + 0x11]
mov dword [rsp + 0x38], eax
movzx eax, byte [r13 + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, word [r13 + 0xe]
mov dword [rsp + 0x28], eax
movzx eax, word [r13 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r13 + 8]
lea r8, str._ComponentSpec_WriterId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__InstanceId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__ComponentName__ws__LogicalPath__ws__Caption__ws____
mov r15, qword [rbp - 0x48]
mov rcx, r15
call fcn.14000f4f8
mov ebx, eax
xor r12d, r12d
test eax, eax
js 0x1400fb541
or rdi, 0xffffffffffffffff
test r15, r15
je 0x1400fb463
mov rax, rdi
inc rax
cmp word [r15 + rax*2], r12w
jne 0x1400fb448
mov r8d, eax
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.140069304
jmp 0x1400fb466
mov eax, r12d
test eax, eax
js 0x1400fb489
mov ecx, dword [rbp - 0x50]
inc ecx
mov dword [rbp - 0x50], ecx
add r13, 0x48
mov qword [rbp - 0x28], r13
cmp ecx, dword [rbp + 0x58]
jb 0x1400fb243
mov r13, qword [rbp - 0x58]
jmp 0x1400fb491
mov ecx, eax
call fcn.140001ae4
int3
lea rdx, str.__ComponentSpecs_
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400fb49b
mov r8d, eax
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
jns 0x1400fb4bd
mov ecx, eax
call fcn.140001ae4
int3
lea rdx, str.__BackupSpecs_
inc rdi
cmp word [rdx + rdi*2], r12w
jne 0x1400fb4c4
mov r8d, edi
lea rcx, [rbp - 0x60]
call fcn.140069304
test eax, eax
jns 0x1400fb4e6
mov ecx, eax
call fcn.140001ae4
int3
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400fb51e
test byte [rcx + 0x1c], 1
je 0x1400fb51e
cmp byte [rcx + 0x19], 4
jb 0x1400fb51e
mov edx, 0xb
mov r9, qword [rbp - 0x60]
lea r8, [0x140153fe8]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x40]
call fcn.1400fb628
mov ebx, eax
jmp 0x1400fb545
mov r14, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x70]
mov r13, qword [rbp - 0x58]
mov r15, qword [rbp - 0x78]
jmp 0x1400fb555
mov r13, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov r14, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x68]
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x1400fb567
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x1400fb575
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rdi, rdi
je 0x1400fb583
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400fb592
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x1400fb5a0
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
je 0x1400fb5ae
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x1400fb5bc
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400fb5cb
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400fb600
test byte [rcx + 0x1c], 1
je 0x1400fb600
cmp byte [rcx + 0x19], 4
jb 0x1400fb600
mov edx, 0xc
lea r8, [0x140153fe8]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
nop
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret