Function at 0x1400fef1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x170
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, r8
mov rbx, rcx
lea rax, [0x1401720a0]
mov rcx, qword [0x1401720a0]
cmp rcx, rax
je 0x1400fef86
test byte [rcx + 0x1c], 1
je 0x1400fef86
cmp byte [rcx + 0x19], 4
jb 0x1400fef86
mov edx, 0xa
lea r8, [0x140158cf8]
mov rcx, qword [rcx + 0x10]
call fcn.140004b74
xor eax, eax
mov esi, eax
mov qword [rbp - 0x80], rax
mov r15d, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x28], rax
mov r13d, eax
mov qword [rbp - 0x70], rax
mov r14d, eax
mov qword [rbp - 0x50], rax
mov r12d, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x60], rax
cmp qword [rbx], rax
je 0x1400fefd5
lea r8, str.m_wszSpecsXML__NULL
mov edx, 0xc1
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008410c
xor eax, eax
cmp qword [rbx + 8], rax
je 0x1400feff3
lea r8, str.m_spBackupItemsRoot__NULL
mov edx, 0xc2
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008410c
mov ecx, 0x38
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
jne 0x1400ff014
mov ebx, 0x8007000e
jmp 0x1400ff97f
xor edx, edx
lea r8d, [rdx + 0x38]
mov rcx, rax
call sub.msvcrt.dll_memset
mov r9d, 1
lea r8, str._BackupSpecs_Version__u__
lea edx, [r9 + 0x19]
mov rcx, rbx
call fcn.14000fee4
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x1400ff902
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x30]
xor ebx, ebx
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400ff051
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff075
mov ecx, eax
call fcn.140001b00
int3
mov r8d, 0xb
lea rdx, str._FileSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff097
mov ecx, eax
call fcn.140001b00
int3
mov eax, ebx
mov dword [rbp - 0x58], ebx
mov ecx, dword [rbp + 0x58]
test ecx, ecx
je 0x1400ff437
add rdi, 0x18
xor r14d, r14d
cmp byte [rdi + 0x3c], r14b
je 0x1400ff3a7
test rsi, rsi
je 0x1400ff0ca
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x80], r14
test r15, r15
je 0x1400ff0dd
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r15, r14
jmp 0x1400ff0e1
mov r15, qword [rbp - 0x78]
lea rcx, [rdi - 0x18]
xor r9d, r9d
lea r8, [rbp - 0x80]
mov edx, dword [rdi + 0x40]
call fcn.140087c2c
mov ebx, eax
test eax, eax
js 0x1400ff41f
mov rax, qword [rdi - 8]
or r8, 0xffffffffffffffff
test rax, rax
je 0x1400ff11a
mov rdx, r8
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x1400ff10e
jmp 0x1400ff11d
mov rdx, r14
mov rax, qword [rdi]
test rax, rax
je 0x1400ff134
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x1400ff128
jmp 0x1400ff137
mov rcx, r14
mov rax, r8
mov r14, qword [rbp - 0x80]
xor r8d, r8d
inc rax
cmp word [r14 + rax*2], r8w
jne 0x1400ff141
add eax, edx
add ecx, 0x63
add eax, ecx
mov esi, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1400ff407
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r15, rax
mov qword [rbp - 0x78], rax
xor eax, eax
test r15, r15
je 0x1400ff3f2
mov r8d, ebx
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
lea r8, [0x14014be58]
mov rcx, r8
xor edx, edx
cmp qword [rdi], rdx
cmovne rcx, qword [rdi]
mov rax, r8
cmp qword [rdi - 8], rdx
cmovne rax, qword [rdi - 8]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._Volume_Name__ws__AccessPath__ws__OriginalAccessPath__ws__Label__ws__OriginalLabel__ws___
mov edx, esi
mov rcx, r15
call fcn.14000fee4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x1400ff41f
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], si
jne 0x1400ff1e5
mov r8d, eax
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
js 0x1400ff3ea
test byte [rdi + 0x40], 1
jne 0x1400ff380
mov r15d, esi
cmp dword [rdi + 0x50], esi
jbe 0x1400ff37c
mov eax, r15d
lea rsi, [rax + rax*2]
mov r14, qword [rdi + 0x58]
xor ebx, ebx
test r13, r13
je 0x1400ff23c
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r13d, ebx
jmp 0x1400ff240
mov r13, qword [rbp - 0x70]
test r12, r12
je 0x1400ff252
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x48], rbx
lea rdx, [rbp - 0x48]
mov rcx, qword [r14 + rsi*8]
call fcn.140084cd4
mov ebx, eax
xor r8d, r8d
test eax, eax
js 0x1400ff3dc
or r9, 0xffffffffffffffff
mov rdx, r9
mov rax, qword [rbp - 0x48]
inc rdx
cmp word [rax + rdx*2], r8w
jne 0x1400ff277
mov rcx, qword [r14 + rsi*8 + 8]
mov rax, r9
inc rax
cmp word [rcx + rax*2], r8w
jne 0x1400ff289
add edx, eax
mov al, byte [r14 + rsi*8 + 0x10]
neg al
sbb ecx, ecx
add ecx, 5
add edx, ecx
mov al, byte [r14 + rsi*8 + 0x11]
neg al
sbb ecx, ecx
lea eax, [rcx + 0x56]
add eax, edx
mov r12d, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1400ff3d6
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r13, rax
mov qword [rbp - 0x70], rax
xor eax, eax
test r13, r13
je 0x1400ff3c1
mov r8d, ebx
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
lea rax, str.false
mov rcx, rax
xor edx, edx
cmp byte [r14 + rsi*8 + 0x11], dl
lea r8, str.true
cmovne rcx, r8
cmp byte [r14 + rsi*8 + 0x10], dl
cmovne rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + rsi*8 + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x48]
lea r8, str._FileSpec_FilePath__ws__FileName__ws__IsRecursive__ws__IsInclude__ws____
mov edx, r12d
mov rcx, r13
call fcn.14000fee4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x1400ff86a
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], si
jne 0x1400ff34d
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
js 0x1400ff3b9
inc r15d
cmp r15d, dword [rdi + 0x50]
mov r12, qword [rbp - 0x48]
jb 0x1400ff21c
mov r15, qword [rbp - 0x78]
mov r8d, 9
lea rdx, str.__Volume_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
js 0x1400ff3e2
mov rsi, qword [rbp - 0x80]
mov eax, dword [rbp - 0x58]
mov ecx, dword [rbp + 0x58]
xor r14d, r14d
inc eax
mov dword [rbp - 0x58], eax
sub rdi, 0xffffffffffffff80
cmp eax, ecx
jae 0x1400ff433
jmp 0x1400ff0ae
mov ecx, eax
call fcn.140001b00
int3
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r14, rax
jmp 0x1400ff908
mov r15, qword [rbp - 0x78]
jmp 0x1400ff40b
mov r15, qword [rbp - 0x78]
jmp 0x1400ff410
mov ecx, eax
call fcn.140001b00
int3
mov ecx, eax
call fcn.140001b00
int3
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r14, rax
mov r13, qword [rbp - 0x70]
jmp 0x1400ff908
mov r13, qword [rbp - 0x70]
mov ebx, 0x80070216
mov rsi, qword [rbp - 0x80]
mov r14, r8
mov r12, r8
jmp 0x1400ff90b
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x50]
mov r13, qword [rbp - 0x70]
mov r12, r14
jmp 0x1400ff90b
mov r14, qword [rbp - 0x50]
mov r8d, 0xc
lea rdx, str.__FileSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
xor r13d, r13d
test eax, eax
jns 0x1400ff45c
mov ecx, eax
call fcn.140001b00
int3
mov dil, byte [rbp + 0x78]
mov al, dil
neg al
sbb ecx, ecx
add ecx, 0x29
mov esi, ecx
lea rax, [rcx + rcx]
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x1400ff484
mov ebx, 0x80070216
jmp 0x1400ff55c
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r12, rax
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1400ff4b0
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
jmp 0x1400ff90b
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r15, str.false
mov r9, r15
test dil, dil
lea rax, str.true
cmovne r9, rax
lea r8, str._SystemState_IsPresent__ws____
mov rdx, rsi
mov rcx, r12
call fcn.14000fee4
mov ebx, eax
test eax, eax
js 0x1400ff49f
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r13w
jne 0x1400ff4f1
mov r8d, eax
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff516
mov ecx, eax
call fcn.140001b00
int3
mov dil, byte [rbp + 0x80]
mov al, dil
neg al
sbb ecx, ecx
add ecx, 0x29
mov esi, ecx
lea rax, [rcx + rcx]
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x1400ff541
mov ebx, 0x80070216
jmp 0x1400ff49f
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r12, rax
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x1400ff571
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
mov r12, qword [rbp - 0x68]
jmp 0x1400ff90b
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
test dil, dil
lea rax, str.true
cmovne r15, rax
mov r9, r15
lea r8, str._AllCritical_IsPresent__ws____
mov rdx, rsi
mov rcx, r12
call fcn.14000fee4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x1400ff55c
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r12 + rax*2], si
jne 0x1400ff5b0
mov r8d, eax
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff5d5
mov ecx, eax
call fcn.140001b00
int3
mov r8d, 0x10
lea rdx, str._ComponentSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff5f7
mov ecx, eax
call fcn.140001b00
int3
mov dword [rbp - 0x58], esi
cmp dword [rbp + 0x68], esi
jbe 0x1400ff872
mov r13, qword [rbp + 0x70]
add r13, 8
mov qword [rbp - 0x38], r13
test r14, r14
je 0x1400ff620
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r14, rsi
mov rcx, qword [r13]
test rcx, rcx
je 0x1400ff637
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x1400ff62c
jmp 0x1400ff63a
mov rax, rsi
lea ecx, [rax + 0x10f]
mov rdx, qword [r13 - 8]
test rdx, rdx
je 0x1400ff657
mov rax, rbx
inc rax
cmp word [rdx + rax*2], si
jne 0x1400ff64c
jmp 0x1400ff65a
mov rax, rsi
add ecx, eax
mov rdx, qword [r13 + 0x28]
test rdx, rdx
je 0x1400ff673
mov rax, rbx
inc rax
cmp word [rdx + rax*2], si
jne 0x1400ff668
jmp 0x1400ff676
mov rax, rsi
add eax, ecx
mov qword [rbp - 8], rax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1400ff47a
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400ff557
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rcx, [0x14014be58]
mov rax, rcx
cmp qword [r13 + 0x28], rsi
cmovne rax, qword [r13 + 0x28]
mov qword [rbp - 0x20], rax
mov rax, rcx
cmp qword [r13 - 8], rsi
cmovne rax, qword [r13 - 8]
mov qword [rbp - 0x18], rax
mov rax, rcx
cmp qword [r13], rsi
cmovne rax, qword [r13]
mov qword [rbp - 0x10], rax
movzx eax, byte [r13 + 0x27]
movzx ecx, byte [r13 + 0x26]
movzx edx, byte [r13 + 0x25]
movzx r8d, byte [r13 + 0x24]
movzx r9d, byte [r13 + 0x23]
movzx r10d, byte [r13 + 0x22]
movzx r11d, byte [r13 + 0x21]
movzx ebx, byte [r13 + 0x20]
movzx edi, word [r13 + 0x1e]
movzx esi, word [r13 + 0x1c]
movzx r14d, byte [r13 + 0x17]
mov dword [rbp - 0x40], r14d
movzx r15d, byte [r13 + 0x16]
movzx r12d, byte [r13 + 0x15]
movzx r13d, byte [r13 + 0x14]
mov r14, qword [rbp - 0x20]
mov qword [rsp + 0xd8], r14
mov r14, qword [rbp - 0x18]
mov qword [rsp + 0xd0], r14
mov r14, qword [rbp - 0x10]
mov qword [rsp + 0xc8], r14
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xb8], ecx
mov dword [rsp + 0xb0], edx
mov dword [rsp + 0xa8], r8d
mov dword [rsp + 0xa0], r9d
mov dword [rsp + 0x98], r10d
mov dword [rsp + 0x90], r11d
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x78], esi
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x70], eax
mov r14d, dword [rbp - 0x40]
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov r13, qword [rbp - 0x38]
movzx eax, byte [r13 + 0x13]
mov dword [rsp + 0x48], eax
movzx eax, byte [r13 + 0x12]
mov dword [rsp + 0x40], eax
movzx eax, byte [r13 + 0x11]
mov dword [rsp + 0x38], eax
movzx eax, byte [r13 + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, word [r13 + 0xe]
mov dword [rsp + 0x28], eax
movzx eax, word [r13 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r13 + 8]
lea r8, str._ComponentSpec_WriterId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__InstanceId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__ComponentName__ws__LogicalPath__ws__Caption__ws____
mov rdx, qword [rbp - 8]
mov r14, qword [rbp - 0x50]
mov rcx, r14
call fcn.14000fee4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x1400ff55c
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r14 + rax*2], si
jne 0x1400ff82b
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
js 0x1400ff862
mov ecx, dword [rbp - 0x58]
inc ecx
mov dword [rbp - 0x58], ecx
add r13, 0x48
mov qword [rbp - 0x38], r13
cmp ecx, dword [rbp + 0x68]
jae 0x1400ff872
jmp 0x1400ff60f
mov ecx, eax
call fcn.140001b00
int3
mov r14, rsi
jmp 0x1400ff55c
mov r8d, 0x11
lea rdx, str.__ComponentSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff894
mov ecx, eax
call fcn.140001b00
int3
mov r8d, 0xe
lea rdx, str.__BackupSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006b19c
test eax, eax
jns 0x1400ff8b6
mov ecx, eax
call fcn.140001b00
int3
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400ff8ee
test byte [rcx + 0x1c], 1
je 0x1400ff8ee
cmp byte [rcx + 0x19], 4
jb 0x1400ff8ee
mov edx, 0xb
mov r9, qword [rbp - 0x60]
lea r8, [0x140158cf8]
mov rcx, qword [rcx + 0x10]
call fcn.140005afc
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x50]
call fcn.1400ff9e4
mov ebx, eax
jmp 0x1400ff55c
mov r15, rax
mov r13, rax
mov r12, rax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x1400ff923
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x1400ff931
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x1400ff93f
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1400ff951
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x1400ff95f
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1400ff971
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
je 0x1400ff97f
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400ff9b4
test byte [rcx + 0x1c], 1
je 0x1400ff9b4
cmp byte [rcx + 0x19], 4
jb 0x1400ff9b4
mov edx, 0xc
lea r8, [0x140158cf8]
mov rcx, qword [rcx + 0x10]
call fcn.140004b74
nop
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret