Function at 0x140002e00
Capabilities:
Check if file exists

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2870
call fcn.1400247a0
sub rsp, rax
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov qword [rsp + 0x28b0], rbx
mov qword [rsp + 0x28b8], rsi
mov rax, qword [0x1400cabe8]
xor rax, rsp
mov qword [rsp + 0x2860], rax
mov rdi, rdx
mov r15d, ecx
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
movups xmm0, xmmword [str.FmtFile.txt]
movaps xmmword [rsp + 0x1860], xmm0
movsd xmm1, qword [0x140029480]
movsd qword [rsp + 0x1870], xmm1
xor edx, edx
mov r8d, 0x7e8
lea rcx, [rsp + 0x1878]
call sub.msvcrt.dll_memset
movups xmm0, xmmword [str.FmtSum.txt]
movaps xmmword [rsp + 0x1060], xmm0
mov eax, dword [0x140029498]
mov dword [rsp + 0x1070], eax
movzx eax, word [0x14002949c]
mov word [rsp + 0x1074], ax
xor edx, edx
mov r8d, 0x7ea
lea rcx, [rsp + 0x1076]
call sub.msvcrt.dll_memset
xor esi, esi
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rsi
lea eax, [rsi + 7]
mov qword [rsp + 0x258], rax
mov qword [rsp + 0x250], rsi
mov word [rsp + 0x240], si
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rsi
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x1f0], rsi
mov word [rsp + 0x1e0], si
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x230], rsi
mov word [rsp + 0x220], si
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], rsi
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x210], rsi
mov word [rsp + 0x200], si
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rsi
movdqu xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], rsi
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rsi
lea rax, [0x1400058f0]
mov qword [rsp + 0x20], rax
lea r9, [0x140005920]
lea r13d, [r14 + 0xf]
mov r8d, r13d
lea r12d, [r14 + 7]
mov edx, r12d
lea rcx, [rsp + 0x7e0]
call fcn.140023e78
nop
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x1d8], eax
mov ebx, esi
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0xd8], rsi
mov word [rsp + 0xe0], si
mov byte [rsp + 0xb5], sil
mov byte [rsp + 0xb6], sil
lea rcx, [rsp + 0x360]
call fcn.1400193b8
mov dword [rsp + 0x578], esi
mov qword [rsp + 0x57c], rsi
mov qword [rsp + 0x584], rsi
mov qword [rsp + 0x58c], rsi
mov dword [rsp + 0x594], esi
lea rax, [rsp + 0x5a8]
mov qword [rsp + 0x598], rax
lea rax, [rsp + 0x5a8]
mov qword [rsp + 0x5a0], rax
mov word [rsp + 0x5a8], si
lea rax, [rsp + 0x5c8]
mov qword [rsp + 0x5b8], rax
lea rax, [rsp + 0x5c8]
mov qword [rsp + 0x5c0], rax
mov word [rsp + 0x5c8], si
mov byte [rsp + 0xb4], sil
mov byte [rsp + 0xb7], sil
mov byte [rsp + 0xb8], sil
lea rax, [0x1400056e0]
mov qword [rsp + 0x20], rax
lea r9, [0x140005710]
mov r8d, r13d
mov edx, r12d
lea rcx, [rsp + 0x2e0]
call fcn.140023e78
nop
lea rax, [0x140005b00]
mov qword [rsp + 0x20], rax
lea r9, [0x140005b40]
mov r8d, r13d
lea edx, [rsi + 0x20]
lea rcx, [rsp + 0x5e0]
call fcn.140023e78
nop
mov r8d, 0x400
lea rdx, [rsp + 0x860]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
cmp eax, 0x400
jne 0x140003135
mov word [rsp + 0x105e], si
jmp 0x14000313d
test eax, eax
je 0x1400033a2
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0x860]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140003151
lea rcx, [rsp + 0x860]
lea rcx, [rcx + rax*2]
mov qword [rsp + 0x110], rcx
cmp rcx, rdx
jbe 0x140003189
cmp word [rcx], 0x5c
jne 0x140003391
add rcx, 2
mov qword [rsp + 0x110], rcx
mov rax, rcx
sub rax, rdx
add rax, 0x18
and rax, 0xfffffffffffffffe
cmp rax, 0x800
jle 0x140003378
lea r9, [0x140005b00]
mov r8, r13
mov edx, 0x20
lea rcx, [rsp + 0x5e0]
call fcn.140023c80
nop
lea r9, [0x1400056e0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x2e0]
call fcn.140023c80
nop
lea rax, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
je 0x1400031fd
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rax, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x598]
cmp rcx, rax
je 0x14000321f
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rcx, [rsp + 0x360]
call fcn.14001934c
nop
cmp byte [rsp + 0xe0], sil
je 0x14000324c
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
nop
lea r9, [0x1400058f0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x7e0]
call fcn.140023c80
nop
lea rcx, [rsp + 0xf8]
call fcn.140005720
nop
lea rcx, [rsp + 0x118]
call fcn.140005720
nop
lea rcx, [rsp + 0x130]
call fcn.140005720
nop
cmp qword [rsp + 0x218], r12
jb 0x1400032af
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov ebx, 7
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x210], rsi
mov word [rsp + 0x200], si
cmp qword [rsp + 0x238], r12
jb 0x1400032ea
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x230], rsi
mov word [rsp + 0x220], si
cmp qword [rsp + 0x1f8], r12
jb 0x140003320
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x1f0], rsi
mov word [rsp + 0x1e0], si
cmp qword [rsp + 0x258], r12
jb 0x140003356
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x250], rsi
mov word [rsp + 0x240], si
mov eax, 0x7a
jmp 0x140005649
movups xmm0, xmmword [str.default.tmf]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x14002cee0]
movsd qword [rcx + 0x10], xmm1
jmp 0x1400033c2
sub rcx, 2
mov qword [rsp + 0x110], rcx
jmp 0x14000316e
movups xmm0, xmmword [str.default.tmf]
movaps xmmword [rsp + 0x860], xmm0
movsd xmm1, qword [0x14002cee0]
movsd qword [rsp + 0x870], xmm1
mov edx, 0x2d
mov r8d, 0xfffd
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
test r15d, r15d
jle 0x14000490a
add rdi, r12
mov qword [rsp + 0xc0], rdi
mov rcx, qword [rdi]
movzx eax, word [rcx]
sub ax, dx
test r8w, ax
je 0x140003687
cmp ebx, r13d
jb 0x14000341c
lea rcx, str.Too_many_log_files_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400054dc
cmp byte [rsp + 0xb8], sil
jne 0x1400039e4
lea rdx, [0x1400278bf]
mov ecx, 0x1c0
call fcn.140023c58
mov qword [rsp + 0xd0], rax
lea r13, [rsp + 0x2e0]
lea r13, [r13 + rbx*8]
mov rcx, qword [r13]
cmp rax, rcx
je 0x140003479
test rcx, rcx
je 0x140003472
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov rax, qword [rsp + 0xd0]
mov qword [r13], rax
mov rcx, rax
test rcx, rcx
jne 0x14000349c
lea rcx, str.Allocation_Failure_EVENT_TRACE_LOGFILE__n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r13d, 0x10
jmp 0x1400054dc
xor edx, edx
mov r8d, 0x1c0
call sub.msvcrt.dll_memset
mov rax, qword [r13]
mov qword [rax + 8], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop dword [rax + rax]
mov ecx, eax
mov dword [rsp + 0xc8], ecx
test eax, eax
je 0x14000367b
mov edx, ecx
shl rbx, 5
lea rax, [rsp + 0x5e0]
add rbx, rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xd0], rax
cmp rax, rcx
ja 0x140003535
cmp qword [rbx + 0x18], rcx
je 0x140003535
mov r8b, r14b
mov rcx, rbx
call fcn.140005cfc
test al, al
je 0x14000352e
mov rax, qword [rsp + 0xd0]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x18], r12
jb 0x140003527
mov rcx, qword [rbx]
jmp 0x14000352a
mov rcx, rbx
mov word [rcx + rax*2], si
mov ecx, dword [rsp + 0xc8]
cmp qword [rbx + 0x18], r12
jb 0x140003540
mov r8, qword [rbx]
jmp 0x140003543
mov r8, rbx
xor r9d, r9d
mov edx, ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
je 0x14000367b
cmp qword [rbx + 0x18], r12
jb 0x140003568
mov rbx, qword [rbx]
mov rax, qword [r13]
mov qword [rax], rbx
mov rdx, qword [r13]
mov rdx, qword [rdx]
lea rcx, str.Setting_log_file_to:__s_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rax, qword [r13]
mov rdx, qword [rax]
mov qword [rsp + 0x2d0], rsi
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2d8], 7
mov qword [rsp + 0x2d0], rsi
mov word [rsp + 0x2c0], si
lea rcx, [rsp + 0x2c0]
call fcn.1400059cc
nop
lea rcx, [rsp + 0x2c0]
call fcn.140002a58
mov bl, al
xor r8d, r8d
mov dl, r14b
lea rcx, [rsp + 0x2c0]
call fcn.140005c84
test bl, bl
jne 0x1400035fc
lea rcx, str.Cannot_open_log_file_for_reading_n
jmp 0x140003485
mov rax, qword [r13]
lea rcx, [rsp + 0x360]
mov qword [rax + 0x1b8], rcx
mov rax, qword [r13]
lea rcx, [0x140002440]
mov qword [rax + 0x190], rcx
mov rax, qword [r13]
mov dword [rax + 0x18], esi
mov rax, qword [r13]
mov qword [rax + 0x10], rsi
mov rax, qword [r13]
lea rcx, [0x14001a990]
mov qword [rax + 0x1a8], rcx
mov rax, qword [r13]
mov dword [rax + 0x1c], 0x10000000
mov ebx, dword [rsp + 0xb0]
add ebx, r14d
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xf4], ebx
mov r13d, 0x10
mov r8d, 0xfffd
mov edx, 0x2d
jmp 0x1400033cd
lea rcx, str.Log_file_path_is_invalid_n
jmp 0x140003485
cmp word [rcx], 0x2f
jne 0x140003693
mov word [rcx], dx
mov rcx, qword [rdi]
lea rdx, [0x1400294a0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140004675
mov rcx, qword [rdi]
cmp word [rcx + 2], 0x3f
je 0x140004675
lea rdx, str._debug
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400036dd
mov byte [rsp + 0x57a], r14b
jmp 0x14000366b
lea rdx, str._display
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400036d3
lea rdx, str._displayonly
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003727
mov al, r14b
mov byte [rsp + 0xb7], al
mov byte [rsp + 0xe8], al
jmp 0x14000366b
lea rdx, str._summary
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000374e
mov byte [rsp + 0x579], r14b
jmp 0x14000366b
lea rdx, str._seq
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000366b
lea rdx, str._gmt
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003793
mov byte [rsp + 0x573], r14b
jmp 0x14000366b
lea rdx, str._utc
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140003786
lea rdx, str._hires
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400037d1
mov byte [rsp + 0x574], r14b
jmp 0x14000378e
lea rdx, str._timeZoneSuffix
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400037f5
mov byte [rsp + 0x575], r14b
jmp 0x14000378e
lea rdx, str._sortableTime
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000381c
mov byte [rsp + 0x572], r14b
jmp 0x14000378e
lea rdx, str._noFileTimeUtc
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003843
mov byte [rsp + 0x576], sil
jmp 0x14000378e
lea rdx, str._nosummary
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003869
mov dword [0x1400d5f64], r14d
jmp 0x14000366b
lea rdx, str._csv
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003892
mov word [rsp + 0x56f], 0x101
jmp 0x14000378e
lea rdx, str._csvheader
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400038b9
mov byte [rsp + 0x578], r14b
jmp 0x14000366b
lea rdx, str._csvquote
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000366b
lea rdx, str._noprefix
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400038fe
mov byte [rsp + 0x571], sil
jmp 0x14000378e
lea rdx, str._trace
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003933
mov byte [0x1400d5f60], r14b
mov rax, qword [sym.imp.msvcrt.dll_wprintf]
mov qword [rsp + 0x3e8], rax
jmp 0x14000378e
lea rdx, str._wpponly
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000395a
mov byte [rsp + 0x56d], r14b
jmp 0x14000378e
lea rdx, str._skipNoFormat
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000394d
lea rdx, str._skipTmfWpp
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000399b
mov byte [rsp + 0x56e], r14b
jmp 0x14000378e
lea rdx, str._preferJson
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400039c2
mov byte [rsp + 0x56c], r14b
jmp 0x14000378e
lea rdx, [0x14002b9d0]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003b90
test ebx, ebx
je 0x1400039f0
lea rcx, str.The__rt_file_cannot_be_used_together_with_any_log_files._n
jmp 0x14000340b
mov al, r14b
mov byte [rsp + 0xb8], al
mov byte [rsp + 0xf0], al
lea rdx, str.NT_Kernel_Logger
lea rcx, [rsp + 0x5e0]
call fcn.1400059cc
cmp r15d, r14d
jle 0x140003a7b
lea rcx, [rdi + 8]
mov rdx, qword [rcx]
movzx eax, word [rdx]
sub ax, 0x2d
mov r8d, 0xfffd
test r8w, ax
je 0x140003a7b
mov rdi, rcx
mov qword [rsp + 0xc0], rcx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140003a4e
add rax, r14
cmp rax, 0x3ff
jbe 0x140003a6e
lea rcx, str.Logger_name_too_large_n
jmp 0x14000340b
lea rcx, [rsp + 0x5e0]
call fcn.1400059cc
lea rdx, [0x1400278bf]
mov ecx, 0x1c0
call fcn.140023c58
mov rbx, rax
mov rcx, qword [rsp + 0x2e0]
cmp rax, rcx
je 0x140003ab8
test rcx, rcx
je 0x140003aad
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x2e0], rbx
mov rcx, rbx
test rcx, rcx
je 0x140004a99
xor edx, edx
mov r8d, 0x1c0
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x2e0]
mov qword [rax], rsi
lea rdx, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], r12
cmovae rdx, qword [rsp + 0x5e0]
mov rax, qword [rsp + 0x2e0]
mov qword [rax + 8], rdx
lea rcx, str.Setting_RealTime_mode_for___ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, [rsp + 0x360]
mov rax, qword [rsp + 0x2e0]
mov qword [rax + 0x1b8], rcx
mov rax, qword [rsp + 0x2e0]
lea rcx, [0x140002440]
mov qword [rax + 0x190], rcx
mov rax, qword [rsp + 0x2e0]
mov dword [rax + 0x18], esi
mov rax, qword [rsp + 0x2e0]
mov qword [rax + 0x10], rsi
mov rax, qword [rsp + 0x2e0]
lea rcx, [0x14001a990]
mov qword [rax + 0x1a8], rcx
mov rax, qword [rsp + 0x2e0]
mov dword [rax + 0x1c], 0x10000100
mov ebx, r14d
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xf4], ebx
jmp 0x14000366b
lea rdx, str._guid
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003c47
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp word [rdx + rax*2], si
jne 0x140003bdc
add rax, r14
cmp rax, 0x400
jbe 0x140003bfc
lea rcx, str.parameter_too_large_:__guid__n
jmp 0x14000340b
mov r8, rcx
inc r8
cmp word [rdx + r8*2], si
jne 0x140003bff
lea r8, [r8*2 + 2]
lea rcx, [rsp + 0x860]
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xc0], rbx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
mov dword [0x1400d63e0], r14d
mov rdi, rbx
mov ebx, dword [rsp + 0xb0]
jmp 0x14000366b
lea rdx, str._tmf
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003cc1
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp word [rdx + rax*2], si
jne 0x140003c8f
add rax, r14
cmp rax, 0x400
jbe 0x140003caf
lea rcx, str.parameter_too_large_:__tmf__n
jmp 0x14000340b
mov r8, rcx
inc r8
cmp word [rdx + r8*2], si
jne 0x140003cb2
jmp 0x140003c09
lea rdx, str._pdb
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003d47
lea edx, [rax + 0x2d]
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003676
lea rbx, [rdi + 8]
mov rax, qword [rbx]
movzx ecx, word [rax]
sub cx, dx
test r8w, cx
je 0x140004669
mov rdx, qword [rbx]
lea rcx, [rsp + 0x200]
call fcn.1400059cc
nop
mov qword [rsp + 0xc0], rbx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
mov dword [0x1400d63d0], r14d
jmp 0x140003c38
lea rdx, str._manpath
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003e3a
cmp r15d, r14d
jle 0x140003e2e
add rdi, 8
mov rdx, qword [rdi]
movzx eax, word [rdx]
sub ax, 0x2d
mov r8d, 0xfffd
test r8w, ax
je 0x140003e2e
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x278], 7
mov qword [rsp + 0x270], rsi
mov word [rsp + 0x260], si
lea rcx, [rsp + 0x260]
call fcn.1400059cc
nop
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x130]
call fcn.1400057b4
nop
cmp qword [rsp + 0x278], r12
jb 0x140003dfa
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x278], 7
mov qword [rsp + 0x270], rsi
mov word [rsp + 0x260], si
mov qword [rsp + 0xc0], rdi
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
jmp 0x14000366b
lea rcx, str.Expected_path_after__manpath_parameter._n
jmp 0x14000340b
lea rdx, str._man
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003f1a
cmp r15d, r14d
jle 0x140003f0e
add rdi, 8
mov rdx, qword [rdi]
movzx eax, word [rdx]
sub ax, 0x2d
mov r8d, 0xfffd
test r8w, ax
je 0x140003f0e
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x298], 7
mov qword [rsp + 0x290], rsi
mov word [rsp + 0x280], si
lea rcx, [rsp + 0x280]
call fcn.1400059cc
nop
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x118]
call fcn.1400057b4
nop
cmp qword [rsp + 0x298], r12
jb 0x140003eed
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x298], 7
mov qword [rsp + 0x290], rsi
mov word [rsp + 0x280], si
jmp 0x140003e16
lea rcx, str.Expected_filename_after__man_parameter._n
jmp 0x14000340b
lea rdx, str._bin
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003ffa
cmp r15d, r14d
jle 0x140003fee
add rdi, 8
mov rdx, qword [rdi]
movzx eax, word [rdx]
sub ax, 0x2d
mov r8d, 0xfffd
test r8w, ax
je 0x140003fee
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2b8], 7
mov qword [rsp + 0x2b0], rsi
mov word [rsp + 0x2a0], si
lea rcx, [rsp + 0x2a0]
call fcn.1400059cc
nop
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xf8]
call fcn.1400057b4
nop
cmp qword [rsp + 0x2b8], r12
jb 0x140003fcd
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x2b8], 7
mov qword [rsp + 0x2b0], rsi
mov word [rsp + 0x2a0], si
jmp 0x140003e16
lea rcx, str.Expected_filename_after__bin_parameter._n
jmp 0x14000340b
lea rdx, [0x14002bd84]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140004063
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
lea rcx, [rsp + 0x220]
call fcn.1400059cc
mov rdi, rbx
mov qword [rsp + 0xc0], rbx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
jmp 0x140003c3b
lea rdx, [0x14002bd8c]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000411b
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1400040ac
add rax, r14
cmp rax, 0x400
jbe 0x1400040cc
lea rcx, str.image_path_parameter_too_large_:__i__n
jmp 0x14000340b
lea rcx, [rsp + 0x240]
call fcn.1400059cc
mov rdi, rbx
mov qword [rsp + 0xc0], rbx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
cmp byte [rsp + 0xb6], sil
je 0x140004105
lea rcx, str.Can_not_use__i_option_with__bt_option_n
jmp 0x14000340b
mov al, r14b
mov byte [rsp + 0xb5], al
mov byte [rsp + 0xe9], al
jmp 0x140003c3b
lea rdx, [0x14002be40]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400041d3
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140004164
add rax, r14
cmp rax, 0x400
jbe 0x140004184
lea rcx, str.image_tool_path_parameter_too_large_:__bt_n
jmp 0x14000340b
lea rcx, [rsp + 0x240]
call fcn.1400059cc
mov rdi, rbx
mov qword [rsp + 0xc0], rbx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
cmp byte [rsp + 0xb5], sil
je 0x1400041bd
lea rcx, str.Can_not_use__bt_option_with__i_option_n
jmp 0x14000340b
mov al, r14b
mov byte [rsp + 0xb6], al
mov byte [rsp + 0xea], al
jmp 0x140003c3b
lea rdx, [0x14002bf00]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140004244
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rbx, [rdi + 8]
mov rdx, qword [rbx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x14000465d
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140004218
add rax, r14
cmp rax, 0x104
jbe 0x140004238
lea rcx, str.Symbol_Server_path_parameter_too_large_:__r__n
jmp 0x14000340b
lea rcx, [0x1400cb528]
jmp 0x140004043
lea rdx, [0x14002bf6c]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000426a
mov dword [0x1400cbb3c], r14d
jmp 0x14000366b
lea rdx, str._ods
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140004291
mov byte [rsp + 0x57b], r14b
jmp 0x14000366b
lea rdx, [0x14002bf84]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140004548
mov r8d, 0xfffd
cmp r15d, r14d
jle 0x140003671
lea rcx, [rdi + 8]
mov rdx, qword [rcx]
movzx eax, word [rdx]
sub ax, 0x2d
test r8w, ax
je 0x140003671
mov rdi, rcx
mov qword [rsp + 0xc0], rcx
sub r15d, r14d
mov dword [rsp + 0x28a0], r15d
mov r8d, 0x400
lea rcx, [rsp + 0x1860]
call qword [sym.imp.msvcrt.dll__wfullpath]
nop dword [rax + rax]
lea rcx, [rsp + 0x1060]
lea rdx, [rsp + 0x1860]
mov r8d, 0x800
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x1060]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x14000432d
lea rax, [rcx*2 + 0xa]
and rax, 0xfffffffffffffffe
cmp rax, 0x800
jle 0x140004523
lea r9, [0x140005b00]
mov r8, r13
mov edx, 0x20
lea rcx, [rsp + 0x5e0]
call fcn.140023c80
nop
lea r9, [0x1400056e0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x2e0]
call fcn.140023c80
nop
lea rax, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
je 0x1400043a8
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rax, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x598]
cmp rcx, rax
je 0x1400043ca
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rcx, [rsp + 0x360]
call fcn.14001934c
nop
cmp byte [rsp + 0xe0], sil
je 0x1400043f7
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
nop
lea r9, [0x1400058f0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x7e0]
call fcn.140023c80
nop
lea rcx, [rsp + 0xf8]
call fcn.140005720
nop
lea rcx, [rsp + 0x118]
call fcn.140005720
nop
lea rcx, [rsp + 0x130]
call fcn.140005720
nop
cmp qword [rsp + 0x218], r12
jb 0x14000445a
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov ebx, 7
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x210], rsi
mov word [rsp + 0x200], si
cmp qword [rsp + 0x238], r12
jb 0x140004495
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x230], rsi
mov word [rsp + 0x220], si
cmp qword [rsp + 0x1f8], r12
jb 0x1400044cb
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x1f0], rsi
mov word [rsp + 0x1e0], si
cmp qword [rsp + 0x258], r12
jb 0x140004501
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x250], rsi
mov word [rsp + 0x240], si
mov eax, 0x7a
jmp 0x140005649
movsd xmm0, qword [str..sum]
movsd qword [rsp + rcx*2 + 0x1060], xmm0
movzx eax, word [0x14002cec8]
mov word [rsp + rcx*2 + 0x1068], ax
jmp 0x14000366b
lea rdx, str._jsonMeta
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400045f1
cmp r15d, r14d
jle 0x1400045e5
add rdi, 8
mov rax, qword [rdi]
movzx ecx, word [rax]
sub cx, 0x2d
mov r8d, 0xfffd
test r8w, cx
je 0x1400045e5
call qword [sym.imp.msvcrt.dll__errno]
nop dword [rax + rax]
mov dword [rax], esi
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll_wcstoul]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.msvcrt.dll__errno]
nop dword [rax + rax]
cmp dword [rax], esi
jne 0x1400045e5
mov rcx, qword [rsp + 0x170]
cmp rcx, qword [rdi]
je 0x1400045e5
cmp word [rcx], si
jne 0x1400045e5
mov dword [rsp + 0x568], ebx
mov qword [rsp + 0xc0], rdi
jmp 0x140004053
lea rcx, str.Expected_numeric_flags_after__jsonMeta_parameter._n
jmp 0x14000340b
lea rdx, [0x14002c018]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000366b
cmp r15d, r14d
jle 0x14000366b
lea rbx, [rdi + 8]
mov rcx, qword [rbx]
movzx eax, word [rcx]
mov edx, 0x2d
sub ax, dx
mov r8d, 0xfffd
test r8w, ax
je 0x140004669
call fcn.1400012b0
mov byte [rsp + 0xb4], al
mov byte [rsp + 0xeb], al
cmp al, 3
jne 0x140004048
lea rcx, str.Unrecognized_code_page_n
jmp 0x14000340b
mov ebx, dword [rsp + 0xb0]
jmp 0x140003671
mov ebx, dword [rsp + 0xb0]
jmp 0x140003676
call fcn.140002b8c
mov dword [rsp + 0xa8], 0x80000
mov dword [rsp + 0xa0], 0x40000
mov dword [rsp + 0x98], 0x20000
mov dword [rsp + 0x90], 0x10000
mov dword [rsp + 0x88], 0x8000
mov dword [rsp + 0x80], 0x4000
mov dword [rsp + 0x78], 0x2000
mov dword [rsp + 0x70], 0x1000
mov dword [rsp + 0x68], 0x800
mov dword [rsp + 0x60], 0x400
mov dword [rsp + 0x58], 0x200
mov dword [rsp + 0x50], 0x100
mov dword [rsp + 0x48], 0x80
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 4
mov r9d, 2
mov r8d, r14d
mov edx, 0xff3f
lea rcx, str._nUsage:_n_ntracefmt___EtlFiles..._____rt___SessionName___n_nParameters:_n_n_EtlFiles...________Format_a_ETW_trace_file__.etl_._Can_specify_multiple_files_n____________________separated_by_spaces._n_rt__SessionName____Format_messages_from_the_named_real_time_trace_session._n____________________Default_session_name_NT_Kernel_Logger_._n_tmf__TMFFiles______Trace_message_format_file._Default_Default.tmf_._n_i__ImageFiles______Finds_PDBs_for_the_images_and_creates_TMFs._n____________________Separate_images_with__._n_r__SymbolPath______Path_to_private_PDB_symbol_files._Default_is_n________________________NT_SYMBOL_PATH_____if_defined__or_n____________________srv_symbols_symbols_otherwise._n_p__TmfPath_________TMF_file_directory._Without__i__its_an_existing_directory._n____________________With__i__its_the_path_for_the_TMF_that_tracefmt_creates._n_pdb__PdbPath_______Path_to_one_more_more_PDB_files._Multiple_files_should_be_n____________________seperated_by__._n_manpath__Path______Path_to_one_or_more_manifest_repository_folders._Manifests_n____________________will_be_automatically_loaded_from_these_folders_as_needed._n____________________Multiple_folders_should_be_separated_by__._The_files_in_n____________________the_folder_must_be_named_GUID.man__using_the_providers_n____________________decode_GUID_with_no_____or___characters.__Use_the_n____________________traceman_tool_to_import_manifests_into_the_repository.__n_man_ManFile________Path_to_an_XML_manifest_from_which_to_load_decoding_data_n____________________for_manifest_based_ETW_events__TdhLoadManifest_._n_bin_DllFile________Path_to_a_DLL_file_from_which_to_load_decoding_data_for_n____________________manifest_based_ETW_events__TdhLoadManifestFromBinary_._n_h_________________Displays_help._n_nOptions:_n_n_o__________________Output_file_name__e.g.__FormattedData.txt_._n_csv________________Output_in_CSV_format._n_csvheader__________Adds_columns_headings_to_CSV_file._n_hires______________High_resolution_timestamp._n_utc___gmt_________Do_not_convert_UTC_timestamps_to_local_time._n_____________________Affects_timestamps_in_event_header_and_event_content.__n_timeZoneSuffix_____Include_a_suffix_on_timestamps_with_a_known_time_zone._n_sortableTime_______Use__yyyy_mm_ddThh:mm:ss__format_for_time_stamps._n_noFileTimeUtc______Treat_event_content_FILETIME_values_as_having_an_unknown_n____________________time_zone.__Default_assumes_FILETIME_is_always_UTC.__n_display____________Print_formatted_traces_messages_to_console_and_output_file._n_displayonly________Print_formatted_traces_messages_only_to_console__no_output_n____________________file_._n_nosummary__________Suppress_summary_file._n_summaryonly________Suppress_output_file._n_noprefix___________Omit_the_trace_message_prefix._n_ods________________Send_trace_messages_to_the_OutputDebugString._n_trace______________Print_tracefmt_actions_to_the_console_as_they_occur._n_v__________________Verbose_console_output._n_cp__codepage_______Generated_text_files_should_use_the_specified_encoding._n____________________Valid_codepage_names_include__utf8____utf16____ansi_._n____________________Default_is_the_current_ANSI_code_page._n_skipNoFormat_______Filter_out_events_without_format_strings._n_skipTmfWpp_________Filter_out_TMF_based_WPP_events._n_preferJson_________When_possible__decode_events_as_JSON._n____________________TMF_based_WPP_will_still_decode_as_text._n_jsonMeta__flags____Control_which_values_to_include_in_the_JSON__meta__suffix._n____________________Default_is_0x_x._Set_to_0_to_disable_the__meta__suffix._n____________________Values_will_often_be_omitted_from_suffix_if_zero_or_null._n____________________Flags__in_hex_:_provider_x__event_x__time_x__cpu_x__n____________________pid_x__tid_x__id_x__version_x__channel_x__level_x__n____________________opcode_x__task_x__keywords_x__tags_x__n____________________activity_x__relatedActivity_x__ktime_x__n____________________utime_x__ptime_x__attribs_x._n_nDefault_values:_n_n_________EtlFile_______C:Logfile.Etl_n_________SessionName____NT_Kernel_Logger__n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
nop
lea r9, [0x140005b00]
mov r8, r13
mov edx, 0x20
lea rcx, [rsp + 0x5e0]
call fcn.140023c80
nop
lea r9, [0x1400056e0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x2e0]
call fcn.140023c80
nop
lea rax, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
je 0x140004792
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rax, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x598]
cmp rcx, rax
je 0x1400047b4
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rcx, [rsp + 0x360]
call fcn.14001934c
nop
cmp byte [rsp + 0xe0], sil
je 0x1400047e1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
nop
lea r9, [0x1400058f0]
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x7e0]
call fcn.140023c80
nop
lea rcx, [rsp + 0xf8]
call fcn.140005720
nop
lea rcx, [rsp + 0x118]
call fcn.140005720
nop
lea rcx, [rsp + 0x130]
call fcn.140005720
nop
cmp qword [rsp + 0x218], r12
jb 0x140004844
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov ebx, 7
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x210], rsi
mov word [rsp + 0x200], si
cmp qword [rsp + 0x238], r12
jb 0x14000487f
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x230], rsi
mov word [rsp + 0x220], si
cmp qword [rsp + 0x1f8], r12
jb 0x1400048b5
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x1f0], rsi
mov word [rsp + 0x1e0], si
cmp qword [rsp + 0x258], r12
jb 0x1400048eb
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x250], rsi
mov word [rsp + 0x240], si
xor eax, eax
jmp 0x140005649
mov rbx, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov qword [rsp + 0x178], rbx
cmp rbx, rdi
je 0x140004970
cmp qword [rbx + 0x18], r12
jb 0x140004932
mov rdx, qword [rbx]
jmp 0x140004935
mov rdx, rbx
lea rcx, [rsp + 0x398]
call fcn.14001b4e8
test eax, eax
je 0x14000496a
cmp qword [rbx + 0x18], r12
jb 0x140004951
mov rdx, qword [rbx]
jmp 0x140004954
mov rdx, rbx
mov r8d, eax
lea rcx, str.WARNING:_AddManifestSearchPath___ls___returned_error_code__u_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
add rbx, 0x20
jmp 0x14000491a
mov rbx, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x120]
mov qword [rsp + 0x168], rbx
cmp rbx, rdi
je 0x1400049d5
cmp qword [rbx + 0x18], r12
jb 0x140004998
mov rcx, qword [rbx]
jmp 0x14000499b
mov rcx, rbx
call qword [sym.imp.tdh.dll_TdhLoadManifest]
nop dword [rax + rax]
test eax, eax
je 0x1400049cf
cmp qword [rbx + 0x18], r12
jb 0x1400049b6
mov rdx, qword [rbx]
jmp 0x1400049b9
mov rdx, rbx
mov r8d, eax
lea rcx, str.WARNING:_TdhLoadManifest___ls___returned_error_code__u_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
add rbx, 0x20
jmp 0x140004980
mov rax, qword [rsp + 0x100]
cmp qword [rsp + 0xf8], rax
je 0x140004a71
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0xd0], rsi
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0xd0], rsi
test rcx, rcx
je 0x140004a1c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
lea r8, [rsp + 0xd0]
lea rdx, [0x14002c290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
jne 0x140004aa5
lea rcx, str.WARNING:_GetModuleHandleExW_tdh.dll__failed__skipping_TdhLoadManifestFromBinary._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov qword [rsp + 0x148], rsi
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140004a71
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
lea rax, [0x140001a00]
mov qword [0x1400d63c8], rax
call fcn.140017704
lea rcx, [rsp + 0x360]
call fcn.140019634
test al, al
jne 0x140004b4e
lea rcx, str.Allocation_Failure_n
jmp 0x14000340b
lea rdx, [0x14002c348]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [rsp + 0x148], rax
test rax, rax
jne 0x140004ae5
lea rcx, str.WARNING:_GetProcAddress_tdh.dll__TdhLoadManifestFromBinary__failed__skipping_TdhLoadManifestFromBinary._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140004a58
mov rbx, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x100]
mov qword [rsp + 0x150], rbx
cmp rbx, rdi
je 0x140004a58
cmp qword [rbx + 0x18], r12
jb 0x140004b11
mov rcx, qword [rbx]
jmp 0x140004b14
mov rcx, rbx
call qword [sym.imp.tdh.dll_TdhLoadManifestFromBinary]
nop dword [rax + rax]
test eax, eax
je 0x140004b48
cmp qword [rbx + 0x18], r12
jb 0x140004b2f
mov rdx, qword [rbx]
jmp 0x140004b32
mov rdx, rbx
mov r8d, eax
lea rcx, str.WARNING:_TdhLoadManifestFromBinary___ls___returned_error_code__u_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
add rbx, 0x20
jmp 0x140004af5
mov r15, qword [rsp + 0x558]
cmp qword [rsp + 0x230], rsi
je 0x140004b86
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], r12
cmovae rdx, qword [rsp + 0x220]
mov r8, r15
mov ecx, 3
call fcn.140009234
lea rbx, [0x1400cb528]
mov rcx, rbx
cmp qword [0x1400cb538], rsi
je 0x140004baf
cmp qword [0x1400cb540], r12
cmovae rcx, qword [0x1400cb528]
call fcn.140018554
jmp 0x140004c1e
mov eax, 0x104
mov dword [rsp + 0xc8], eax
mov edx, eax
call fcn.140006254
mov rcx, rbx
cmp qword [0x1400cb540], r12
cmovae rcx, qword [0x1400cb528]
lea rdx, [rsp + 0xc8]
call fcn.140018948
mov edx, dword [rsp + 0xc8]
mov rax, qword [0x1400cb538]
cmp rdx, rax
ja 0x140004c13
mov qword [0x1400cb538], rdx
mov rax, rbx
cmp qword [0x1400cb540], r12
cmovae rax, qword [0x1400cb528]
mov word [rax + rdx*2], si
jmp 0x140004c1e
sub rdx, rax
mov rcx, rbx
call fcn.140006254
cmp dword [0x1400cbb3c], esi
je 0x140004c4b
cmp qword [0x1400cb540], r12
cmovae rbx, qword [0x1400cb528]
mov rdx, rbx
lea rcx, str.WPPSYM:_Setting_SymbolPath_to:__s_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
call fcn.14000964c
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call fcn.1400059cc
or rbx, 0xffffffffffffffff
cmp byte [rsp + 0xb5], sil
je 0x140004cdb
lea rax, [rsp + 0x180]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rsi
mov word [rsp + 0x180], si
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x180]
call fcn.140005ddc
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x180]
call fcn.140001c00
cmp byte [rsp + 0xb6], sil
je 0x140004cfa
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x240]
call fcn.140001fe4
lea rcx, [rsp + 0x860]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x140004d05
test rax, rax
je 0x140004e0d
lea rdx, [rsp + 0x860]
lea rcx, str.Examining__s_for_message_formats_
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r8d, 0x400
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0x2060]
call qword [sym.imp.msvcrt.dll__wfullpath]
nop dword [rax + rax]
lea rax, [rsp + 0x2060]
mov r8, rbx
inc r8
cmp word [rax + r8*2], si
jne 0x140004d5f
lea r8, [r8*2 + 2]
lea rdx, [rsp + 0x2060]
lea rcx, [rsp + 0x860]
call sub.msvcrt.dll_memcpy
mov rdx, r15
lea rcx, [rsp + 0x860]
call fcn.140008b04
test eax, eax
jne 0x140004df8
lea rcx, str._none_found
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x140004dd3
lea rcx, str.__file_not_found_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140004e0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x140004e0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str.__Error__0x_08X_n
jmp 0x140004dff
lea rcx, str.__d_found._n
mov edx, eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp qword [rsp + 0x210], rsi
je 0x140004eaa
lea rcx, [rsp + 0x200]
cmp qword [rsp + 0x218], r12
cmovae rcx, qword [rsp + 0x200]
lea r8, [rsp + 0x158]
lea rdx, [0x1400284fc]
call qword [sym.imp.msvcrt.dll_wcstok_s]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140004eaa
mov rdx, rax
lea rcx, str.Examining__s_for_message_formats_
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rdx, r15
mov rcx, rbx
call fcn.14000915c
test eax, eax
je 0x140004e93
mov edx, eax
lea rcx, str._none_found__Error__0x_08x_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140004ea6
lea rcx, str.PDB_loaded_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
xor ecx, ecx
jmp 0x140004e34
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], r12
cmovae rdx, qword [rsp + 0x1e0]
lea rcx, str.Searching_for_TMF_files_on_path:__ws_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rsp + 0xb0]
test eax, eax
jne 0x140004fde
lea rdx, [0x1400278bf]
mov edi, 0x1c0
mov ecx, edi
call fcn.140023c58
mov rbx, rax
mov rcx, qword [rsp + 0x2e0]
cmp rax, rcx
je 0x140004f24
test rcx, rcx
je 0x140004f19
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov rcx, rbx
mov qword [rsp + 0x2e0], rbx
test rcx, rcx
je 0x140004a99
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x360]
mov rax, qword [rsp + 0x2e0]
mov qword [rax + 0x1b8], rcx
mov rax, qword [rsp + 0x2e0]
mov qword [rax + 8], rsi
lea rdx, str.C:Logfile.Etl
lea rcx, [rsp + 0x5e0]
call fcn.1400059cc
lea rcx, [rsp + 0x5e0]
cmp qword [rsp + 0x5f8], r12
cmovae rcx, qword [rsp + 0x5e0]
mov rax, qword [rsp + 0x2e0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e0]
lea rcx, [0x14001a990]
mov qword [rax + 0x1a8], rcx
mov rax, qword [rsp + 0x2e0]
lea rcx, [0x140002440]
mov qword [rax + 0x190], rcx
mov rax, qword [rsp + 0x2e0]
mov dword [rax + 0x1c], 0x10000000
mov eax, r14d
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xf4], eax
mov ebx, esi
mov dword [rsp + 0xec], ebx
cmp ebx, eax
jae 0x1400050a2
mov edi, ebx
mov rcx, qword [rsp + rdi*8 + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_OpenTraceW]
nop dword [rax + rax]
mov rcx, qword [rsp + rdi*8 + 0x7e0]
mov qword [rsp + rdi*8 + 0x7e0], rax
cmp rcx, 0xffffffffffffffff
je 0x140005027
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
nop dword [rax + rax]
cmp qword [rsp + rdi*8 + 0x7e0], 0xffffffffffffffff
jne 0x140005056
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
mov edx, ebx
lea rcx, str.Error_Opening_Trace__d_with_status_d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rax, qword [rsp + rdi*8 + 0x2e0]
cmp qword [rax], rsi
je 0x14000508c
mov rdx, qword [rax]
lea rcx, str.Logfile__s:_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + rdi*8 + 0x2e0]
add rcx, 0x78
xor edx, edx
call fcn.1400025c4
add ebx, r14d
mov dword [rsp + 0xec], ebx
mov eax, dword [rsp + 0xb0]
jmp 0x140004fe7
cmp byte [rsp + 0xb7], sil
je 0x1400050ed
mov ecx, r14d
call fcn.140024330
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0xd8]
call fcn.1400014bc
mov ecx, r14d
call fcn.140024330
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x360]
call fcn.1400195d4
jmp 0x1400051ff
movzx ebx, byte [rsp + 0xb4]
mov ecx, ebx
sub ecx, 1
lea rdi, [0x140028328]
je 0x140005116
cmp ecx, 1
je 0x14000510d
mov rdx, rdi
jmp 0x14000511d
lea rdx, str.wt_ccsUTF_16LE
jmp 0x14000511d
lea rdx, str.wt_ccsUTF_8
mov r8d, r13d
lea rcx, [rsp + 0x1860]
call qword [sym.imp.msvcrt.dll__wfsopen]
nop dword [rax + rax]
test rax, rax
jne 0x140005168
call qword [sym.imp.msvcrt.dll__errno]
nop dword [rax + rax]
lea rdx, [rsp + 0x1860]
lea rcx, str.Format_File___s__Could_not_be_opened_for_writing__errno___u__n
mov r8d, dword [rax]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400054dc
mov r9b, byte [rsp + 0xb4]
mov r8b, r14b
mov rdx, rax
lea rcx, [rsp + 0x360]
call fcn.1400195d4
cmp dword [0x1400d5f64], esi
jne 0x1400051ff
sub ebx, 1
je 0x14000519e
cmp ebx, 1
jne 0x1400051a5
lea rdi, str.wt_ccsUTF_16LE
jmp 0x1400051a5
lea rdi, str.wt_ccsUTF_8
mov r8d, r13d
mov rdx, rdi
lea rcx, [rsp + 0x1060]
call qword [sym.imp.msvcrt.dll__wfsopen]
nop dword [rax + rax]
test rax, rax
jne 0x1400051e4
call qword [sym.imp.msvcrt.dll__errno]
nop dword [rax + rax]
lea rdx, [rsp + 0x1060]
lea rcx, str.Summary_File___s__could_not_be_opened_for_writing__errno___u__n
jmp 0x140005154
mov r9b, byte [rsp + 0xb4]
mov r8b, r14b
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1400014bc
mov r8, r15
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.140009234
xor r9d, r9d
xor r8d, r8d
mov edi, dword [rsp + 0xb0]
mov edx, edi
lea rcx, [rsp + 0x7e0]
call qword [sym.imp.ADVAPI32.dll_ProcessTrace]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140005259
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
mov edx, ebx
lea rcx, str.Error_processing_trace_entry_with_status0x_x__GetLastError0x_x__n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x1d8], eax
lea ecx, [rax + 0xc]
mov dword [rsp + 0x1d0], ecx
mov rax, qword [0x1400d5f88]
test rax, rax
je 0x1400052a6
lea edx, [rcx - 2]
lea rcx, str.GetParameter__d_n
cmp dword [0x1400d5f84], esi
jne 0x14000529a
call qword [0x140027658]
jmp 0x14000529f
call fcn.14000ea20
mov ecx, dword [rsp + 0x1d0]
mov eax, dword [0x1400d3f40]
cmp ecx, eax
cmovbe eax, ecx
mov r8d, eax
lea rdx, [0x1400d3f40]
lea rcx, [rsp + 0x1d0]
call sub.msvcrt.dll_memcpy
mov edx, dword [rsp + 0x594]
add edx, dword [rsp + 0x590]
add edx, dword [rsp + 0x58c]
add edx, dword [rsp + 0x588]
add edx, dword [rsp + 0x364]
add dword [rsp + 0x1d4], edx
mov eax, dword [rsp + 0x360]
add dword [rsp + 0x1d8], eax
cmp dword [0x1400d5f64], esi
jne 0x14000543b
lea rax, str.Files_Processed:_n
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x11
movaps xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xd8]
call fcn.140001568
mov ebx, esi
mov dword [rsp + 0xec], ebx
cmp ebx, edi
jae 0x140005380
mov eax, ebx
mov r8, qword [rsp + rax*8 + 0x2e0]
mov r8, qword [r8]
lea rdx, str._t_s_n
lea rcx, [rsp + 0xd8]
call fcn.140001518
add ebx, r14d
jmp 0x14000534f
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x560]
shr rdx, 0x17
mov qword [rsp + 0x38], rdx
mov eax, dword [rsp + 0x1d8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1d4]
mov dword [rsp + 0x28], eax
mov eax, dword [0x1400cbb38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x57c]
mov r8d, dword [0x1400d5f68]
lea rdx, str.Total_Buffers_Processed__u_nTotal_Events__Processed__u_nTotal_Events__Lost_______u_nTotal_Format__Errors_____u_nTotal_Formats_Unknown____u_nElapsed_Time_____________I64u_sec_n
lea rcx, [rsp + 0xd8]
call fcn.140001518
lea rax, [0x14002ca18]
mov qword [rsp + 0x28], rax
lea rax, str.EventType
mov qword [rsp + 0x20], rax
lea r9, str.EventName
lea r8, str.EventCount
lea rdx, str.____________________________________________________________________________________n_10s______20s___10s____36s_r_n____________________________________________________________________________________n
lea rcx, [rsp + 0xd8]
call fcn.140001518
mov r8, r15
call fcn.140008c1c
lea r8, [0x1400cbb40]
lea rdx, str._s____________________________________________________________________________________n
lea rcx, [rsp + 0xd8]
call fcn.140001518
cmp dword [0x1400cbb3c], esi
je 0x140005456
lea rcx, [0x1400288d8]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rsp + 0x1d8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x1d4]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x1400cbb38]
mov r8d, dword [rsp + 0x57c]
mov edx, dword [0x1400d5f68]
lea rcx, str._nProcessing_completed___Buffers:__d__Events:__d__EventsLost:__d_::_Format_Errors:__d__Unknowns:__d__n_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp byte [rsp + 0xb7], sil
jne 0x1400054dc
lea rdx, [rsp + 0x1860]
lea rcx, str.Event_traces_dumped_to__s_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [0x1400d5f64], esi
jne 0x1400054dc
lea rdx, [rsp + 0x1060]
lea rcx, str.Event_Summary_dumped_to__s_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rax, [0x140005b00]
lea rbx, [0x1400056e0]
lea rdi, [0x1400058f0]
jmp 0x140005516
mov r9, rax
mov r8, r13
mov edx, 0x20
lea rcx, [rsp + 0x5e0]
call fcn.140023c80
nop
mov r9, rbx
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x2e0]
call fcn.140023c80
nop
lea rax, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
je 0x140005568
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rax, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x598]
cmp rcx, rax
je 0x14000558a
lea rdx, [0x1400278bf]
call fcn.1400246a0
nop
lea rcx, [rsp + 0x360]
call fcn.14001934c
nop
cmp byte [rsp + 0xe0], sil
je 0x1400055b7
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
nop
mov r9, rdi
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x7e0]
call fcn.140023c80
nop
lea rcx, [rsp + 0xf8]
call fcn.140005720
nop
lea rcx, [rsp + 0x118]
call fcn.140005720
nop
lea rcx, [rsp + 0x130]
call fcn.140005720
nop
xor r8d, r8d
mov dl, r14b
lea rcx, [rsp + 0x200]
call fcn.140005c84
nop
xor r8d, r8d
mov dl, r14b
lea rcx, [rsp + 0x220]
call fcn.140005c84
nop
xor r8d, r8d
mov dl, r14b
lea rcx, [rsp + 0x1e0]
call fcn.140005c84
nop
xor r8d, r8d
mov dl, r14b
lea rcx, [rsp + 0x240]
call fcn.140005c84
xor eax, eax
mov rcx, qword [rsp + 0x2860]
xor rcx, rsp
call fcn.140023980
lea r11, [rsp + 0x2870]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret