Function at 0x140012b80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfb80]
mov eax, 0xfc80
call fcn.1400406f0
sub rsp, rax
mov rax, qword [0x14005f180]
xor rax, rsp
mov qword [rbp + 0xfb70], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor ecx, ecx
mov r14d, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x44], ecx
mov word [rbp + 0x9370], cx
mov rsi, rdx
lea rcx, [rbp + 0x9372]
xor edx, edx
mov r8d, 0x67fe
call sub.MSVCR120.dll_memset
call sub.LIBNSR.DLL_get_nsr_t_varp
mov r13, rax
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140012c18
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140012c27
shr ecx, 4
and ecx, 1
je 0x140012c27
lea rcx, str.nt_lookupname__s__n
mov rdx, rdi
call sub.liblocal.dll_debugprintf
and dword [rsi + 8], 0xfffffffd
lea rcx, [rsp + 0x70]
mov r8d, 0x3000
mov rdx, rdi
call sub.liblocal.dll_lg_strlcpy
mov rcx, rsi
call fcn.140018dc0
mov rcx, rsi
mov ebx, eax
call fcn.140018d30
test eax, eax
jne 0x140012c5c
test ebx, ebx
je 0x140012cde
cmp dword [r13 + 0xd2c], r14d
jne 0x140012cde
lea rax, [rsp + 0x70]
or rcx, 0xffffffffffffffff
nop
cmp byte [rax + rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140012c70
lea rax, [rsp + 0x70]
cmp byte [rcx + rax - 1], 0x2f
je 0x140012c9e
lea rdx, [0x14004519c]
lea rcx, [rsp + 0x70]
mov r8d, 0x3000
call sub.liblocal.dll_lg_strlcat
test ebx, ebx
je 0x140012cde
lea rax, [rsp + 0x70]
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rax + rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140012cb0
lea rax, [rsp + 0x70]
cmp byte [rcx + rax - 2], 0x2f
je 0x140012cde
lea rdx, [0x14004519c]
lea rcx, [rsp + 0x70]
mov r8d, 0x3000
call sub.liblocal.dll_lg_strlcat
mov rax, qword [sym.imp.liblocal.dll_Debug]
lea r8, str.TRUE
cmp dword [rax], 5
jge 0x140012d06
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140012d27
shr ecx, 4
and ecx, 1
je 0x140012d27
mov rax, qword [sym.imp.liblocal.dll_Quit]
lea rdx, str.FALSE
lea rcx, str.___nt_lookupname___set_Quit_s_n
cmp dword [rax], r14d
cmovne rdx, r8
call sub.liblocal.dll_debugprintf
lea rdx, [rbp + 0x2f70]
lea rcx, [rsp + 0x70]
call qword [0x1400ad8f8]
mov r12, rax
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140012da8
mov r15, qword [rax + 0x38]
mov qword [rsp + 0x48], r15
test r15, r15
je 0x140012da8
cmp dword [0x140070184], r14d
jne 0x140012da8
cmp dword [0x140066430], r14d
je 0x140012d9f
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 1
jge 0x140012d83
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140012d8f
and ecx, 1
je 0x140012d8f
lea rcx, str.Using_global_savetime_for_NMM_rollovers_n
call sub.liblocal.dll_debugprintf
mov r15, qword [0x1400b4388]
mov rdx, qword [0x140070188]
jmp 0x140012dbd
mov rdx, qword [0x140070188]
jmp 0x140012dc2
mov rdx, qword [0x140070188]
mov r15, qword [0x1400b4388]
test rdx, rdx
cmovg r15, rdx
mov qword [rsp + 0x48], r15
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140012de3
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140012e26
shr ecx, 4
and ecx, 1
je 0x140012e26
mov rcx, rdx
call sub.liblocal.dll_lg_int64str
mov rcx, qword [0x1400b4388]
mov rdi, rax
call sub.liblocal.dll_lg_int64str
mov rcx, r15
mov rbx, rax
call sub.liblocal.dll_lg_int64str
lea rdx, [rsp + 0x70]
lea rcx, str.Browsing__s_based_on_lookuptime__s_where_Savetime_PSS_master_ss_savetime_is__s__s__n
mov r9, rbx
mov r8, rax
mov qword [rsp + 0x20], rdi
call sub.liblocal.dll_debugprintf
mov rdi, qword [rsp + 0x60]
cmp dword [0x140066430], r14d
je 0x140012e5e
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140012e5e
cmp qword [rax + 0x38], r14
je 0x140012e5e
mov rcx, rsi
call fcn.140018ad0
mov rbx, qword [rsp + 0x48]
bt eax, 0xf
cmovb rbx, qword [0x1400b4388]
mov qword [rsp + 0x48], rbx
jmp 0x140012e63
mov rbx, qword [rsp + 0x48]
cmp dword [r13 + 0xe28], r14d
je 0x140012e96
mov rax, qword [r13 + 0xe30]
test rax, rax
je 0x140012e96
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov rcx, r12
or r8d, r9d
mov dword [rsp + 0x20], r14d
call sub.LIBNSR.DLL_getsrbynameforsavetimes
jmp 0x140012ead
or r9d, 0xffffffff
mov rdx, rbx
mov rcx, r12
or r8d, r9d
mov dword [rsp + 0x20], r14d
call sub.LIBNSR.DLL_getsrbyname
mov r15, rax
mov ebx, 1
test rax, rax
je 0x140012fcc
cmp dword [0x140070190], 7
je 0x140012f10
mov rax, qword [sym.imp.LIBNSR.DLL_ca_is_vssextattr_func]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140012eea
call sub.LIBNSR.DLL_ca_init
mov rax, qword [sym.imp.LIBNSR.DLL_ca_is_vssextattr_func]
mov rcx, qword [r15 + 8]
call qword [rax]
jmp 0x140012ef0
mov rcx, qword [r15 + 8]
call rdx
test eax, eax
je 0x140012f10
mov rax, qword [r15]
mov rcx, r15
mov rbx, qword [rax + 0x10]
dec rbx
mov qword [rsp + 0x48], rbx
call sub.LIBNSR.DLL_freesr
jmp 0x140012e63
movzx eax, byte [r12]
cmp al, byte [0x14004519c]
jne 0x140012faa
movzx eax, byte [r12 + 1]
cmp al, byte [0x14004519d]
jne 0x140012faa
mov rax, qword [sym.imp.LIBNSR.DLL_ca_is_vssextattr_func]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140012f52
call sub.LIBNSR.DLL_ca_init
mov rax, qword [sym.imp.LIBNSR.DLL_ca_is_vssextattr_func]
mov rcx, qword [r15 + 8]
call qword [rax]
jmp 0x140012f58
mov rcx, qword [r15 + 8]
call rdx
test eax, eax
je 0x140012faa
mov rcx, r15
call fcn.140012740
mov rdx, rax
mov rax, qword [r15]
cmp rdx, qword [rax + 0x10]
jle 0x140012faa
or r9d, 0xffffffff
mov rcx, r12
mov dword [rsp + 0x20], r14d
or r8d, r9d
call sub.LIBNSR.DLL_getsrbyname
mov rbx, rax
test rax, rax
je 0x140012fa5
mov rcx, r15
call sub.LIBNSR.DLL_freesr
mov rax, qword [rbx]
mov r15, rbx
mov rcx, qword [rax + 0x10]
mov qword [0x1400b4388], rcx
mov ebx, 1
lea rcx, [rsp + 0x70]
mov rdx, rsi
call fcn.1400089a0
test eax, eax
je 0x140012fcc
mov rcx, r15
mov dword [0x1400b1360], ebx
call sub.LIBNSR.DLL_freesr
xor r15d, r15d
mov rax, qword [sym.imp.liblocal.dll_Quit]
cmp dword [rax], r14d
je 0x140013021
call fcn.140016640
test rax, rax
jne 0x14001301b
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140013003
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013014
shr ecx, 4
and ecx, 1
je 0x140013014
lea rdx, [rsp + 0x70]
lea rcx, str.___exit_nt_lookupname__s_:_rebindnsr___returns_0_n
call sub.liblocal.dll_debugprintf
xor eax, eax
jmp 0x140013bfd
mov dword [0x1400b1360], ebx
movzx eax, byte [rdi]
cmp al, byte [0x14004519c]
jne 0x1400130ab
movzx eax, byte [rdi + 1]
cmp al, byte [0x14004519d]
jne 0x1400130ab
test r15, r15
je 0x140013049
mov rax, qword [r15]
cmp dword [rax + 0x40], 0x11168807
jae 0x14001309e
lea rdx, [rbp + 0x9370]
mov r8d, 0x3400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001309e
lea rdx, str.WinClient
lea rcx, [rbp + 0x9370]
call qword [sym.imp.MSVCR120.dll_wcsstr]
test rax, rax
jne 0x14001309e
mov rdx, rsi
mov rcx, rdi
call fcn.140012950
test eax, eax
je 0x14001309e
test r15, r15
je 0x140013014
mov rcx, r15
call sub.LIBNSR.DLL_freesr
xor eax, eax
jmp 0x140013bfd
mov edx, 0x10000000
mov rcx, rsi
call fcn.140018f50
movzx eax, byte [rdi]
cmp al, byte [0x14004519c]
jne 0x1400130cb
movzx eax, byte [rdi + 1]
cmp al, byte [0x14004519d]
jne 0x1400130cb
or dword [rsi + 8], 0x20000
jmp 0x1400130e0
mov rcx, rsi
call fcn.140018ad0
bt eax, 0x1c
jae 0x1400130e0
or dword [rsi + 8], 0x10000
test r15, r15
jne 0x140013341
cmp dword [0x1400b1360], r14d
je 0x14001312b
or dword [rsi + 8], 2
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x14001311f
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013bfa
shr ecx, 4
and ecx, 1
je 0x140013bfa
lea rcx, str.___exit_nt_lookupname__s_:_Stopexpand_on_n
jmp 0x140013bf0
mov rcx, qword [rsi]
movzx eax, byte [rcx]
cmp al, byte [0x14004519c]
jne 0x14001314f
movzx eax, byte [rcx + 1]
cmp al, byte [0x14004519d]
jne 0x14001314f
cmp qword [rsi + 0x58], r14
jne 0x140013bfa
mov rcx, rsi
call fcn.140018d30
test eax, eax
je 0x140013196
cmp qword [rsi + 0x38], r14
je 0x140013196
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x14001318a
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013bfa
shr ecx, 4
and ecx, 1
je 0x140013bfa
lea rcx, str.___exit_nt_lookupname__s_:_found_a_directory_n
jmp 0x140013bf0
cmp qword [rsi + 0x48], r14
je 0x14001327f
cmp qword [rsi + 0x58], r14
jne 0x14001327f
cmp dword [0x140070190], 7
jne 0x1400131e8
cmp dword [rsi + 8], 0x10000
jne 0x1400131e8
mov rdx, qword [rsi]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r14b
jne 0x1400131c3
cmp rax, 1
jne 0x1400131e8
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
call qword [sym.imp.MSVCR120.dll_strstr]
test rax, rax
jne 0x14001327f
mov r14, qword [rsi + 0x48]
mov rax, qword [r14 + 0x58]
add r14, 0x58
test rax, rax
je 0x14001327f
nop dword [rax]
cmp rax, rsi
je 0x140013214
lea r14, [rax + 0x50]
mov rax, qword [rax + 0x50]
test rax, rax
jne 0x140013200
jmp 0x14001327f
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14001327c
test byte [rbx + 8], 8
je 0x14001327c
mov rax, qword [rsi]
mov r8, qword [rbx]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140013243
inc rax
test ecx, ecx
jne 0x140013230
test edx, edx
jne 0x14001327c
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 2
jge 0x140013267
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013278
shr ecx, 1
and ecx, 1
je 0x140013278
lea rdx, [rsp + 0x70]
lea rcx, str._s:_mount_point_not_in_index_n
call sub.liblocal.dll_debugprintf
and dword [rbx + 8], 0xfffffff7
mov qword [r14], rbx
cmp dword [0x140070190], 7
jne 0x1400132be
mov rdx, qword [rsi]
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140013290
cmp rax, 1
jne 0x1400132be
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
call qword [sym.imp.MSVCR120.dll_strstr]
test rax, rax
je 0x1400132be
cmp dword [rsi + 8], 0x10000
je 0x140013341
cmp qword [rsi + 0x58], 0
jne 0x140013300
mov rcx, rsi
call fcn.14001b370
mov rax, qword [sym.imp.liblocal.dll_Vflag]
cmp dword [rax], 2
jl 0x140013300
mov edx, 2
lea r9, str._s:_not_in_index__deleted_n
mov ecx, 0x3f63
mov r8d, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
call sub.liblocal.dll_msg_print
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140013329
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013014
shr ecx, 4
and ecx, 1
je 0x140013014
lea rdx, [rsp + 0x70]
lea rcx, str.___exit_nt_lookupname__s_:_no_valid_entry._n
call sub.liblocal.dll_debugprintf
xor eax, eax
jmp 0x140013bfd
mov rdx, qword [rsi + 0x50]
test rdx, rdx
je 0x1400133a0
cmp qword [rsi + 0x38], 0
jne 0x1400133a0
mov rdx, qword [rdx]
mov rcx, qword [rsi]
call qword [sym.imp.MSVCR120.dll__stricmp]
test eax, eax
jne 0x1400133a0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140013392
cmp qword [rax + 0x58], 0
je 0x140013392
lea r14, [rax + 0x58]
mov rax, qword [rax + 0x58]
cmp rax, rsi
je 0x140013392
nop
test rax, rax
je 0x140013392
lea r14, [rax + 0x50]
mov rax, qword [rax + 0x50]
cmp rax, rsi
jne 0x140013380
test r14, r14
je 0x1400133a3
mov rax, qword [rsi + 0x50]
mov qword [r14], rax
jmp 0x1400133a3
xor r14d, r14d
test r15, r15
je 0x140013406
test byte [rsi + 8], 1
je 0x1400133b5
cmp qword [rsi + 0x38], 0
jne 0x140013406
mov rcx, rsi
call fcn.140018b50
mov rcx, rsi
mov ebx, eax
call fcn.140018ad0
mov rdx, qword [r15 + 8]
mov rcx, qword [r15]
mov r8, rsi
mov edi, eax
call qword [0x1400ad8e8]
mov rcx, rsi
call fcn.140018b50
mov rcx, rsi
or eax, ebx
mov edx, eax
call fcn.140018ff0
mov rcx, rsi
call fcn.140018ad0
mov rcx, rsi
or eax, edi
mov edx, eax
call fcn.140018f50
mov rdi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400397c0
test eax, eax
je 0x140013419
or dword [rsi + 8], 0x80000
test r14, r14
je 0x1400134ad
mov rax, qword [r14]
test rax, rax
je 0x140013467
mov r9, qword [rsi + 0x38]
nop
cmp qword [rax + 0x38], r9
jle 0x140013467
mov rax, qword [rax]
mov r8, qword [rsi]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140013453
inc rax
test ecx, ecx
jne 0x140013440
test edx, edx
jne 0x140013467
mov r14, qword [r14]
mov rax, qword [r14 + 0x50]
add r14, 0x50
test rax, rax
jne 0x140013430
mov rbx, qword [r14]
test rbx, rbx
je 0x1400134a6
mov rax, qword [rsi + 0x38]
cmp qword [rbx + 0x38], rax
jne 0x1400134a6
mov rax, qword [rbx]
mov r8, qword [rsi]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140013495
inc rax
test ecx, ecx
jne 0x140013482
test edx, edx
jne 0x1400134a6
mov rcx, rsi
call fcn.14001b370
mov rsi, rbx
jmp 0x1400134ad
mov qword [rsi + 0x50], rbx
mov qword [r14], rsi
cmp qword [rsi + 0x48], 0
jne 0x14001356c
mov rcx, rsi
call fcn.140018ad0
bt eax, 0x1c
jb 0x14001356c
mov rdx, rsi
mov rcx, rdi
mov rbx, rsi
call fcn.14001b750
mov rsi, rax
test rax, rax
jne 0x14001356c
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [0x1400b1360]
cmp dword [rax], 0xc
mov eax, 1
cmove ecx, eax
mov dword [0x1400b1360], ecx
mov rdx, qword [rbx]
movzx eax, byte [rdx]
cmp al, byte [0x14004519c]
jne 0x14001351b
movzx eax, byte [rdx + 1]
cmp al, byte [0x14004519d]
je 0x140013523
mov rcx, rbx
call fcn.14001b370
mov rcx, r15
call sub.LIBNSR.DLL_freesr
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140013554
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013014
shr ecx, 4
and ecx, 1
je 0x140013014
lea rdx, [rsp + 0x70]
lea rcx, str.___exit_nt_lookupname__s_:_graft_ep_returns_NULL._n
call sub.liblocal.dll_debugprintf
xor eax, eax
jmp 0x140013bfd
cmp dword [0x140066430], 0
je 0x140013665
cmp qword [rsi + 0x48], 0
jne 0x140013665
mov rcx, rsi
call fcn.140018ad0
bt eax, 0x1c
jae 0x140013665
lea rdx, [rbp + 0x2f70]
lea rcx, [rsp + 0x70]
call qword [0x1400ad8f8]
or rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400135b0
cmp rdx, 3
jbe 0x140013665
mov rdx, rsi
mov rcx, rdi
mov rbx, rsi
call fcn.14001b750
mov rsi, rax
test rax, rax
jne 0x140013665
call qword [sym.imp.MSVCR120.dll__errno]
mov edx, dword [0x1400b1360]
cmp dword [rax], 0xc
mov eax, 1
cmove edx, eax
mov dword [0x1400b1360], edx
mov rdx, qword [rbx]
movzx eax, byte [rdx]
cmp al, byte [0x14004519c]
jne 0x140013614
movzx eax, byte [rdx + 1]
cmp al, byte [0x14004519d]
je 0x14001361c
mov rcx, rbx
call fcn.14001b370
mov rcx, r15
call sub.LIBNSR.DLL_freesr
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x14001364d
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013014
shr ecx, 4
and ecx, 1
je 0x140013014
lea rdx, [rsp + 0x70]
lea rcx, str.___exit_nt_lookupname__s_:_graft_ep_returns_NULL._n
call sub.liblocal.dll_debugprintf
xor eax, eax
jmp 0x140013bfd
mov rcx, rsi
call fcn.140018d30
test eax, eax
je 0x14001379e
test r15, r15
je 0x1400137a8
test dword [rsi + 8], 0x1000
je 0x1400136ff
call sub.LIBASM.DLL_get_client_namespace
cmp eax, 0xa
mov rax, qword [r15]
mov rcx, qword [rax + 8]
jne 0x1400136f4
cmp rcx, 0x2710
jbe 0x1400136ff
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 2
jge 0x1400136c1
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov edx, dword [rax]
test edx, edx
je 0x1400136e3
shr edx, 1
and edx, 1
je 0x1400136e3
call sub.liblocal.dll_lg_uint64str
mov rcx, rsi
mov rbx, rax
call fcn.14001c1c0
lea rcx, str.delay___s__size__s__n
mov rdx, rax
mov r8, rbx
call sub.liblocal.dll_debugprintf
or dword [rsi + 8], 2
mov rcx, r15
call sub.LIBNSR.DLL_freesr
jmp 0x140013bfa
mov eax, dword [0x14005f02c]
cmp rcx, rax
jmp 0x14001369f
test dword [rsi + 8], 0x800000
je 0x140013716
mov rcx, rsi
call fcn.140018ad0
bt eax, 0xf
jb 0x1400136e7
mov rcx, rsi
call fcn.140018bf0
mov rbx, rax
test rax, rax
je 0x140013763
mov rcx, qword [rax + 0x18]
call sub.liblocal.dll_lg_strlen
test rax, rax
je 0x140013763
cmp dword [rbx], 8
jne 0x140013763
mov rcx, qword [rbx + 0x18]
lea rdx, str.Microsoft_Hyper_V_VSS_Writer
call qword [sym.imp.MSVCR120.dll__stricmp]
test eax, eax
je 0x140013763
mov rcx, qword [rbx + 0x18]
lea rdx, str.Cluster_Shared_Volume_VSS_Writer
call qword [sym.imp.MSVCR120.dll__stricmp]
test eax, eax
jne 0x1400136e7
mov rax, qword [sym.imp.LIBNSR.DLL_ca_direntry_func]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14001378e
call sub.LIBNSR.DLL_ca_init
mov rax, qword [sym.imp.LIBNSR.DLL_ca_direntry_func]
mov rcx, qword [r15 + 8]
call qword [rax]
mov r14, rax
mov qword [rsp + 0x50], rax
jmp 0x1400137ad
mov rcx, qword [r15 + 8]
call rdx
mov r14, rax
mov qword [rsp + 0x50], rax
jmp 0x1400137ad
xor r14d, r14d
mov qword [rsp + 0x50], r14
jmp 0x1400137ad
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsi + 0x58]
xor r12d, r12d
test rdi, rdi
setne r12b
xor ebx, ebx
mov dword [rsp + 0x40], ebx
test r12d, r12d
je 0x1400138d0
test r14, r14
je 0x1400138d0
mov rax, rdi
test rdi, rdi
je 0x1400138d0
nop
mov rax, qword [rax + 0x50]
inc ebx
test rax, rax
jne 0x1400137e0
mov dword [rsp + 0x40], ebx
test ebx, ebx
je 0x1400138d0
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x140049668]
divsd xmm1, qword [0x140049670]
addsd xmm1, qword [0x1400466d0]
mulsd xmm1, qword [0x140049670]
cvttsd2si eax, xmm1
movsxd rcx, eax
mov dword [rsp + 0x44], eax
shl rcx, 3
call qword [sym.imp.MSVCR120.dll_malloc]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400138af
call qword [sym.imp.MSVCR120.dll__errno]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rbx]
mov rdi, rax
call sub.liblocal.dll_lg_strerror
mov edx, dword [rdi]
mov qword [rsp + 0x38], rax
mov rax, qword [rsi]
mov dword [rsp + 0x30], 0x18
mov qword [rsp + 0x28], rax
lea r9, str.Unable_to_allocate_directory_listing_while_expanding_entry__s:__s_n
add edx, 0x3a98
mov ecx, 0x150ba
mov r8d, 2
mov dword [rsp + 0x20], 0x17
call sub.liblocal.dll_msg_print
mov eax, 1
mov rcx, r15
mov dword [0x1400b1360], eax
call sub.LIBNSR.DLL_freesr
or dword [rsi + 8], 2
jmp 0x140013bfa
test rdi, rdi
je 0x1400138d0
nop dword [rax]
nop dword [rax + rax]
mov qword [rax], rdi
mov rdi, qword [rdi + 0x50]
add rax, 8
test rdi, rdi
jne 0x1400138c0
mov rdi, r14
test r14, r14
je 0x140013b6d
mov r13, qword [rsp + 0x48]
mov rbx, qword [rdi]
cmp byte [rbx], 0x2e
jne 0x140013903
movzx eax, byte [rbx + 1]
test al, al
je 0x140013b4c
cmp al, 0x2e
jne 0x140013903
cmp byte [rbx + 2], 0
je 0x140013b4c
xor r14d, r14d
call sub.LIBNSR.DLL_nsr_dirsep
movsx ecx, byte [rbx]
cmp ecx, eax
jne 0x140013921
movsx ecx, byte [rbx + 1]
cmp ecx, eax
mov eax, 1
cmovne r14d, eax
call sub.LIBASM.DLL_get_client_namespace
cmp eax, 0xa
jne 0x140013930
cmp byte [rbx], 0x5c
je 0x140013939
test r14d, r14d
je 0x140013ada
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x14001395a
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013984
shr ecx, 4
and ecx, 1
je 0x140013984
mov rax, qword [sym.imp.liblocal.dll_Quit]
lea rdx, str.FALSE
lea r14, str.TRUE
cmp dword [rax], 0
lea rcx, str.nt_lookupname_3___set_Quit_s_n
cmovne rdx, r14
call sub.liblocal.dll_debugprintf
jmp 0x14001398b
lea r14, str.TRUE
lea rdx, [rbp + 0x5f70]
lea rcx, [rsp + 0x70]
call qword [0x1400ad8f8]
mov rax, qword [sym.imp.LIBNSR.DLL_nde_dircont_func]
cmp qword [rax], 0
jne 0x1400139af
call sub.LIBNSR.DLL_nde_init
call sub.LIBNSR.DLL_nsr_dirsep
mov rcx, qword [rdi]
lea rdx, [rbp + 0x2f70]
mov ebx, eax
call qword [0x1400ad8f8]
lea rcx, [rbp + 0x5f70]
mov rdx, rax
mov rax, qword [sym.imp.LIBNSR.DLL_nde_dircont_func]
mov r9, r13
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [rax]
mov rdi, rax
mov rax, qword [sym.imp.liblocal.dll_Quit]
cmp dword [rax], 0
je 0x140013a7a
mov dword [rax], 0
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140013a1d
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013a3e
shr ecx, 4
and ecx, 1
je 0x140013a3e
mov rax, qword [sym.imp.liblocal.dll_Quit]
lea rdx, str.FALSE
lea rcx, str.nt_lookupname_4___set_Quit_s_n
cmp dword [rax], 0
cmovne rdx, r14
call sub.liblocal.dll_debugprintf
call fcn.140016640
test rax, rax
je 0x140013b5b
mov eax, 1
mov dword [0x1400b1360], eax
test rdi, rdi
je 0x140013a76
mov rcx, qword [sym.imp.LIBRPC.DLL___xdr]
mov rdx, rdi
call sub.LIBNSR.DLL_xdr_dosdirentry
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_free]
xor edi, edi
or dword [rsi + 8], 2
test rdi, rdi
je 0x140013b69
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140013aa5
mov rcx, qword [sym.imp.LIBRPC.DLL___xdr]
mov rdx, rbx
call sub.LIBNSR.DLL_xdr_dosdirentry
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
mov rax, qword [sym.imp.LIBNSR.DLL_ca_set_direntry_func]
mov qword [rsp + 0x50], rdi
mov r8, qword [rax]
test r8, r8
jne 0x140013ad0
call sub.LIBNSR.DLL_ca_init
mov rax, qword [sym.imp.LIBNSR.DLL_ca_set_direntry_func]
mov rcx, qword [r15 + 8]
mov rdx, rdi
call qword [rax]
jmp 0x140013ada
mov rcx, qword [r15 + 8]
mov rdx, rdi
call r8
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140013c30
mov rbx, rax
test rax, rax
je 0x140013b65
mov qword [rax + 0x48], rsi
test dword [rsi + 8], 0x800000
je 0x140013b16
or dword [rax + 8], 0x800000
test dword [rsi + 8], 0x800000
jne 0x140013b4c
mov rcx, rax
call fcn.140018ad0
bt eax, 0xf
jae 0x140013b4c
or dword [rbx + 8], 8
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140013c30
test rax, rax
je 0x140013b65
or dword [rax + 8], 0x20
mov qword [rax + 0x48], rsi
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x1400138e1
jmp 0x140013b69
or ecx, 0xffffffff
call qword [sym.imp.MSVCR120.dll_exit]
int3
or dword [rsi + 8], 2
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [0x1400b1360]
cmp dword [rax], 0xc
mov eax, 1
cmove ecx, eax
mov dword [0x1400b1360], ecx
mov rcx, r15
call sub.LIBNSR.DLL_freesr
mov rdi, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov r8, rdi
movsxd r9, ebx
mov rcx, rsi
call fcn.140011040
test ebx, ebx
je 0x140013bc8
mov r8d, r12d
mov edx, ebx
mov rcx, rdi
call fcn.14001a7b0
mov rcx, rdi
mov qword [rsi + 0x58], rax
call qword [sym.imp.MSVCR120.dll_free]
mov rax, qword [sym.imp.liblocal.dll_Debug]
cmp dword [rax], 5
jge 0x140013be9
mov rax, qword [sym.imp.liblocal.dll_LgTrace]
mov ecx, dword [rax]
test ecx, ecx
je 0x140013bfa
shr ecx, 4
and ecx, 1
je 0x140013bfa
lea rcx, str.___exit_nt_lookupname__s_._n
lea rdx, [rsp + 0x70]
call sub.liblocal.dll_debugprintf
mov rax, rsi
mov rcx, qword [rbp + 0xfb70]
xor rcx, rsp
call fcn.1400403f0
mov rbx, qword [rsp + 0xfcd0]
add rsp, 0xfc80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret