Function at 0x140024f44
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov ebx, r9d
mov dword [rbp - 0x50], ebx
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x78], rdx
mov r15, rcx
mov qword [rbp + 0xa0], rcx
mov r14, qword [rbp + 0x188]
mov qword [rbp - 0x68], r14
mov r13, qword [rbp + 0x180]
mov qword [rbp - 0x30], r13
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x70], rax
xor ecx, ecx
mov dword [rbp - 0x20], ecx
mov dword [rbp - 0x5c], ecx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x40], rcx
mov r12d, ecx
mov qword [rbp - 0x38], rcx
mov esi, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x10], rcx
mov dword [rsp + 0x74], ecx
mov qword [rbp - 0x18], rcx
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x7e], cl
mov byte [rbp - 0x5f], cl
mov edi, ecx
mov byte [rbp - 0x53], cl
mov byte [rbp - 0x70], cl
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x18], rcx
lea rax, [0x14017a048]
mov rcx, qword [0x14017a048]
cmp rcx, rax
je 0x14002503e
test byte [rcx + 0x1c], 1
je 0x14002503e
cmp byte [rcx + 0x19], 4
jb 0x14002503e
mov edx, 0x1fc
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b70
cmp ebx, dword [r15 + 0x170]
je 0x14002505f
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov rax, qword [rbp + 0x28]
mov byte [rax], sil
mov rax, qword [rbp + 0x70]
and dword [rax], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe0]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe0]
mov dword [r14 + 0x10], eax
lea rcx, [rbp - 0x53]
call fcn.140091c48
mov ebx, eax
test eax, eax
jns 0x1400250f5
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140027446
test byte [rcx + 0x1c], 1
je 0x140027446
cmp byte [rcx + 0x19], 2
jb 0x140027446
mov edx, 0x1fd
mov r9d, ebx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
jmp 0x140027446
lea r8, [rbp + 8]
lea rdx, [0x140152808]
mov rcx, qword [r15 + 0x158]
call fcn.14008867c
mov ebx, eax
test eax, eax
js 0x140027446
mov esi, dword [rbp - 0x50]
shl rsi, 4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x14002513f
mov ebx, 0x8007000e
jmp 0x140027442
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x50]
shl eax, 4
mov esi, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140025135
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov esi, dword [r14 + 8]
mov r12d, dword [rbp - 0x50]
cmp esi, r12d
jae 0x140027320
xor eax, eax
mov byte [rsp + 0x70], al
mov byte [rbp - 0x7f], al
neg byte [rbp - 0x7e]
sbb r12d, r12d
and r12d, edi
mov dword [rbp - 0x58], r12d
mov byte [rbp - 0x7e], al
mov eax, esi
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x38]
mov r13, qword [rcx + rax*8]
mov qword [rsp + 0x78], r13
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov dword [r15 + 0x174], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
je 0x1400252ad
mov ecx, dword [r14 + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + rcx*8]
lea rdx, [rbp - 0x38]
call fcn.140088424
test eax, eax
mov edi, r12d
mov r13d, eax
js 0x140026f3e
test byte [rsi + 0x54], 0x40
je 0x1400253d1
mov rdx, rsi
mov rcx, r15
call fcn.1400238ec
mov ebx, eax
test eax, eax
js 0x140027422
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [r14 + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
mov ecx, dword [r14 + 8]
inc ecx
mov dword [r14 + 8], ecx
mov edi, r12d
xor eax, eax
jmp 0x1400272c4
xor edi, edi
mov rcx, qword [r15 + 0x1b0]
cmp dword [rcx + 0x50], edi
jbe 0x1400252f2
mov eax, edi
imul r14, rax, 0x38
add r14, qword [rcx + 0x58]
mov qword [rbp + 0x40], r14
mov rdx, r13
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400252ee
inc edi
mov rcx, qword [r15 + 0x1b0]
cmp edi, dword [rcx + 0x50]
jb 0x1400252bb
mov r14, qword [rbp - 0x68]
mov rax, qword [r15 + 0x1b0]
cmp edi, dword [rax + 0x50]
jne 0x140025359
mov r13d, dword [rsi + 0x20]
test r13d, r13d
js 0x140025346
mov r13d, 0x80780020
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14002534d
test byte [rcx + 0x1c], 1
je 0x14002534d
cmp byte [rcx + 0x19], 2
jb 0x14002534d
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
mov rcx, qword [0x14017a048]
mov byte [rbp - 0x7f], 1
mov edi, r12d
jmp 0x140026f45
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140025377
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140025217
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400253c6
test byte [rcx + 0x1c], 1
je 0x1400253c6
cmp byte [rcx + 0x19], 2
jb 0x1400253c6
mov edx, 0x1ff
mov r9, r13
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
mov rcx, qword [0x14017a048]
mov r13d, 0x80780020
jmp 0x14002534d
mov edi, 8
test byte [rsi + 0x54], dil
jne 0x14002547b
test byte [rsi + 0x54], 0x20
jne 0x1400253fe
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov rax, qword [0x14017a048]
lea rcx, [0x14017a048]
cmp rax, rcx
je 0x140025452
test byte [rax + 0x1c], 1
je 0x140025452
cmp byte [rax + 0x19], 4
jb 0x140025452
lea rdx, [rsi + 0x44]
lea rcx, [rbp + 0x80]
call fcn.14001012c
nop
or dword [rbp - 0x20], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x140155270]
mov rcx, qword [0x14017a048]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
nop
mov eax, dword [rbp - 0x20]
test al, 1
je 0x140025299
and eax, 0xfffffffe
mov dword [rbp - 0x20], eax
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
jmp 0x140025299
mov r8b, 1
mov edx, edi
mov rcx, r15
call fcn.14002d47c
mov dword [r14 + 0x2c], edi
mov eax, dword [r14 + 8]
mov rdi, qword [rbp - 0x30]
cmp eax, dword [rdi + 8]
jne 0x1400254ad
cmp qword [rdi + 0x30], 0
je 0x1400254ad
mov rbx, qword [rdi + 0x30]
mov qword [rbp - 0x48], rbx
jmp 0x140025a87
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1400254ca
cmp rax, qword [r14 + 0x30]
je 0x1400254ca
cmp rax, qword [rdi + 0x30]
je 0x1400254ca
mov rcx, rax
call fcn.1400c1188
xor edi, edi
mov eax, edi
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test byte [rsi + 0x54], 1
je 0x14002553a
mov rcx, r15
call fcn.14002e5ac
mov r13d, eax
test eax, eax
jns 0x14002553a
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025351
test byte [rcx + 0x1c], 1
je 0x140025351
cmp byte [rcx + 0x19], 2
jb 0x140025351
mov edx, 0x201
mov r9d, ebx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
mov rcx, qword [0x14017a048]
jmp 0x140025351
lea r14, [r15 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test byte [r15 + 0x154], 0x10
jne 0x1400255ac
cmp byte [r15 + 0x17c], dil
jne 0x140025594
cmp byte [r15 + 0x17d], dil
je 0x1400255ac
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400255f0
test byte [rcx + 0x1c], 1
je 0x1400255f0
mov rbx, qword [rbp - 0x38]
cmp byte [rcx + 0x19], 4
jb 0x1400255f4
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005d24
jmp 0x1400255f4
mov rbx, qword [rbp - 0x38]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x8c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [r15 + 0x154]
mov r8b, byte [r15 + 0x17d]
mov dl, byte [r15 + 0x17c]
test al, 2
je 0x140025852
shr eax, 4
and al, 1
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], r15
mov r9b, r8b
mov r8b, dl
mov dl, al
mov rcx, rbx
call fcn.1400b9214
mov esi, eax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x48], rax
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x14017a048]
lea rax, [0x14017a048]
cmp r10, rax
je 0x140025749
test byte [r10 + 0x1c], 1
je 0x140025749
cmp byte [r10 + 0x19], 4
jb 0x140025749
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0x50], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0x54], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0x48], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0x4c], eax
mov rcx, qword [rbp + 0x48]
sub rcx, qword [rbp + 0x50]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x140155270]
mov rcx, qword [r10 + 0x10]
call fcn.140010438
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 0x20], rax
mov rax, qword [rbp]
mov qword [r14 + 0x18], rax
mov ecx, esi
test esi, esi
je 0x140025a7b
sub ecx, 1
je 0x140025a5a
sub ecx, 3
je 0x1400259c8
sub ecx, 1
je 0x14002596a
sub ecx, 1
je 0x1400259c8
sub ecx, 1
je 0x14002596a
sub ecx, 0xf
je 0x1400259c8
cmp ecx, 9
je 0x1400259c8
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14002582d
test byte [rcx + 0x1c], 1
je 0x14002582d
cmp byte [rcx + 0x19], 2
jb 0x14002582d
mov edx, 0x208
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
mov ecx, esi
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x5c]
call fcn.14010086c
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x14017a048]
mov rsi, qword [rbp - 0x78]
jmp 0x140026f45
lea rax, [rsp + 0x74]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x28], r15
lea rax, [0x140020a20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, rbx
call fcn.1400b9430
mov esi, eax
test eax, eax
jne 0x140025688
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x48], rbx
test rbx, rbx
jne 0x1400258dc
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.1400876c8
cmp byte [rbx + 0xb8], dil
je 0x140025938
mov edx, 0x2000
mov rcx, qword [rbp - 0x78]
call fcn.140012c88
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025690
test byte [rcx + 0x1c], 1
je 0x140025690
cmp byte [rcx + 0x19], 4
jb 0x140025690
mov edx, 0x203
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b70
jmp 0x140025690
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025690
test byte [rcx + 0x1c], 1
je 0x140025690
cmp byte [rcx + 0x19], 4
jb 0x140025690
mov edx, 0x204
jmp 0x140025923
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400259af
test byte [rcx + 0x1c], 1
je 0x1400259af
cmp byte [rcx + 0x19], 2
jb 0x1400259af
mov edx, 0x207
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.14010086c
mov byte [rsp + 0x70], 1
jmp 0x14002583c
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025a0d
test byte [rcx + 0x1c], 1
je 0x140025a0d
cmp byte [rcx + 0x19], 2
jb 0x140025a0d
mov edx, 0x206
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.14010086c
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140025a47
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024cb4
test eax, eax
js 0x140025a47
cmp byte [rbp - 0x70], 0
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, r12d
mov rcx, qword [0x14017a048]
jmp 0x140026f45
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005b13.0]
test al, al
mov eax, 0x80780167
cmovne r13d, eax
jmp 0x14002583f
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x30]
mov qword [r14 + 0x30], rbx
mov ecx, dword [r14 + 8]
mov eax, ecx
cmp ecx, dword [rdi + 8]
jne 0x140025aab
cmp qword [rdi + 0x30], 0
jne 0x140025aab
test byte [rsi + 0x54], 1
jne 0x140025aab
mov qword [rdi + 0x30], rbx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025ac5
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140025ac5
mov qword [rbp - 0x10], rcx
mov edx, dword [rdi + 0x40]
jmp 0x140025b6d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140025ae6
cmp rcx, qword [r14 + 0x38]
je 0x140025ae6
cmp rcx, qword [rdi + 0x38]
je 0x140025ae6
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rbp - 0x10], rcx
xor edx, edx
mov dword [rbp - 0x28], edx
test byte [r15 + 0x154], 2
je 0x140025b6d
lea r9, [rsp + 0x74]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400bd404
mov ebx, eax
test eax, eax
je 0x140025b62
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025b5b
test byte [rcx + 0x1c], 1
je 0x140025b5b
cmp byte [rcx + 0x19], 2
jb 0x140025b5b
mov edx, 0x209
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
mov ecx, ebx
jmp 0x14002582f
mov rcx, qword [rbp - 0x10]
mov edx, dword [rbp - 0x28]
mov rbx, qword [rbp - 0x48]
mov qword [r14 + 0x38], rcx
mov dword [r14 + 0x40], edx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025b92
cmp qword [rdi + 0x38], 0
jne 0x140025b92
test byte [rsi + 0x54], 1
jne 0x140025b92
mov qword [rdi + 0x38], rcx
mov dword [rdi + 0x40], edx
mov r8b, 1
mov edi, 9
mov edx, edi
mov rcx, r15
call fcn.14002d47c
mov edx, edi
mov rcx, r14
call fcn.140014a38
test byte [r15 + 0x154], 2
je 0x140025c04
lea r9, [rsp + 0x74]
mov rdx, qword [rbp - 0x10]
mov rcx, rbx
call fcn.1400bd5dc
mov ebx, eax
test eax, eax
je 0x140025c04
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025b5b
test byte [rcx + 0x1c], 1
je 0x140025b5b
cmp byte [rcx + 0x19], 2
jb 0x140025b5b
mov edx, 0x20a
jmp 0x140025b3a
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140025c21
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
and qword [rbp - 0x18], 0
lea rdx, [rsi + 0x44]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rsi + 0x54]
mov rcx, qword [r15 + 0x1d8]
call fcn.1401120dc
mov r13d, eax
mov edi, r12d
test eax, eax
js 0x140025842
lea r14, [r15 + 0x28]
mov rcx, r14
call fcn.1400fdd24
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
mov rcx, r15
call fcn.140020df4
mov r13d, eax
test eax, eax
jns 0x140025cc6
mov byte [rsp + 0x70], 1
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025cbd
test byte [rcx + 0x1c], 1
je 0x140025cbd
cmp byte [rcx + 0x19], 2
jb 0x140025cbd
mov edx, 0x20b
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
mov rcx, qword [0x14017a048]
mov r14, qword [rbp - 0x68]
jmp 0x140025849
xor edx, edx
mov rcx, r14
call fcn.1400fdb78
mov ebx, eax
test eax, eax
js 0x140027419
xor ebx, ebx
xor edi, edi
lea r9, [rbp + 0xd0]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x98]
mov rsi, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025d17
mov rcx, rsi
call fcn.1401373d4
mov r13d, eax
jmp 0x140025d28
mov rbx, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x98]
xor r13d, r13d
and qword [rbp + 0x30], 0
xor sil, sil
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswbengine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025e4a
and dword [rbp - 0x28], eax
mov dword [rbp - 0x40], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140025dba
mov eax, dword [rbp - 0x28]
shl rax, 0x14
test rax, rax
je 0x140025df5
cmp rax, rdi
jae 0x140025df5
mov rdi, rax
mov sil, 1
jmp 0x140025df5
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025e38
test byte [rcx + 0x1c], 1
je 0x140025e03
cmp byte [rcx + 0x19], 5
jb 0x140025e03
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025e38
test byte [rcx + 0x1c], 1
je 0x140025e38
cmp byte [rcx + 0x19], 4
jb 0x140025e38
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.1400111c0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140025e85
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025e93
test byte [rcx + 0x1c], 1
je 0x140025e93
cmp byte [rcx + 0x19], 5
jb 0x140025e93
mov edx, 0x20e
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
lea rax, [0x14017a048]
mov rcx, qword [0x14017a048]
test r13d, r13d
jns 0x140025ea5
mov byte [rsp + 0x70], 1
mov edi, r12d
jmp 0x140025cbd
cmp rcx, rax
je 0x140025ed3
test byte [rcx + 0x1c], 1
je 0x140025ed3
cmp byte [rcx + 0x19], 4
jb 0x140025ed3
mov edx, 0x20f
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004d18
mov rcx, r14
call fcn.1400fdd24
test byte [r15 + 0x154], 2
je 0x140026097
mov r8, qword [rbp - 0x68]
mov eax, dword [r8 + 0xc]
mov r9, qword [rbp - 0x30]
cmp eax, dword [r9 + 0xc]
jne 0x140025f22
mov bl, 1
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140025f8d
test byte [rcx + 0x1c], bl
je 0x140025f8d
cmp byte [rcx + 0x19], 4
jb 0x140025f8d
mov edx, 0x210
jmp 0x140025f6e
ja 0x140025f44
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x30]
xor bl, bl
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025f94
test byte [rcx + 0x1c], 1
je 0x140025f94
cmp byte [rcx + 0x19], 4
jb 0x140025f94
mov edx, 0x211
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r9 + 0xc]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.1400101b0
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
mov edx, 0x1400000
cmp rdi, rdx
ja 0x140025ff4
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025e9d
test byte [rcx + 0x1c], 1
je 0x140025e9d
cmp byte [rcx + 0x19], 3
jb 0x140025e9d
mov edx, 0x212
mov r9, rdi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010438
mov rcx, qword [0x14017a048]
jmp 0x140025e9d
test sil, sil
jne 0x14002604f
mov r8d, 0x40000000
cmp rdi, r8
ja 0x14002604f
test bl, bl
je 0x14002604f
mov r13d, 0x80780080
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025e9d
test byte [rcx + 0x1c], 1
je 0x140025e9d
cmp byte [rcx + 0x19], 3
jb 0x140025e9d
mov edx, 0x213
mov qword [rsp + 0x20], r8
mov r9, rdi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004d18
jmp 0x140025fe8
sub rdi, rdx
cmp rdi, 0x1100000
ja 0x140026097
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x140025e9d
test byte [rcx + 0x1c], 1
je 0x140025e9d
cmp byte [rcx + 0x19], 3
jb 0x140025e9d
mov edx, 0x214
jmp 0x140025fd5
mov bl, 1
mov byte [rbp - 0x60], bl
test byte [r15 + 0x154], 4
je 0x1400260d2
mov r9d, dword [r15 + 0x174]
shl r9d, 4
add r9, qword [rbp + 0x10]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x78]
mov rcx, r15
call fcn.14001f4c4
mov ebx, eax
test eax, eax
js 0x140027419
mov bl, byte [rbp - 0x60]
mov byte [rbp - 0x80], bl
lea rsi, [r15 + 0x58]
mov qword [rbp - 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
and qword [rcx], 0
and qword [rcx + 8], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026189
test byte [rcx + 0x1c], 1
je 0x14002615e
cmp byte [rcx + 0x19], 4
jb 0x14002615e
mov edx, 0x215
mov r9, rdi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010438
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026189
test byte [rcx + 0x1c], 1
je 0x140026189
cmp byte [rcx + 0x19], 4
jb 0x140026189
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x9c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
test byte [r15 + 0x154], 2
je 0x14002625b
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x1400261d7
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
cmp dword [r15 + 0x150], 4
sete r8b
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r15
lea rax, [0x140020a20]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x48]
call fcn.1400ba22c
mov r12d, eax
jmp 0x140026746
and qword [rbp - 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
cmp byte [rbp - 0x80], 0
jne 0x140026315
xor edx, edx
mov rcx, r14
call fcn.1400fdb78
mov ebx, eax
test eax, eax
js 0x140027419
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call fcn.14008f188
mov bl, al
mov rcx, r14
call fcn.1400fdd24
test bl, bl
je 0x140026315
mov dword [rbp + 0xa8], 2
lea r8, [rbp + 0xa8]
mov rdx, rsi
mov rcx, r14
call fcn.1401224b4
test eax, eax
jns 0x140026315
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140025e9d
test byte [rcx + 0x1c], 1
je 0x140025e9d
cmp byte [rcx + 0x19], 2
jb 0x140025e9d
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
jmp 0x140025fe8
lea r9, [rbp - 0x40]
mov r8, qword [rbp + 0x58]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r15
call fcn.140022f00
test eax, eax
jns 0x140026346
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x14017a048]
mov r14, qword [rbp - 0x68]
jmp 0x140026f45
xor edx, edx
mov rcx, r14
call fcn.1400fdb78
mov ebx, eax
test eax, eax
js 0x140027419
lea rdx, [rbp + 0x18]
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call fcn.14011e548
mov ebx, eax
mov rcx, r14
call fcn.1400fdd24
test ebx, ebx
jns 0x1400263c5
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400263ba
test byte [rcx + 0x1c], 1
je 0x1400263ba
cmp byte [rcx + 0x19], 2
jb 0x1400263ba
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
mov rcx, qword [0x14017a048]
mov r13d, ebx
mov edi, r12d
jmp 0x14002633d
movups xmm0, xmmword [rbp + 0xb0]
movdqu xmmword [rbp + 0xe0], xmm0
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x58], rax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rdi, qword [rbp + 0x18]
mov qword [rsp + 0x38], rdi
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r15
lea rdx, [0x140020a20]
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call fcn.1400bbe78
mov r12d, eax
test eax, eax
jne 0x140026575
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
jne 0x1400264d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x1400264b8
test byte [rcx + 0x1c], 1
je 0x1400264b8
cmp byte [rcx + 0x19], 2
jb 0x1400264b8
mov edx, 0x219
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
mov rcx, qword [0x14017a048]
mov eax, dword [rsp + 0x74]
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x14002633d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
test eax, eax
je 0x140026517
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x1400264b8
test byte [rcx + 0x1c], 1
je 0x1400264b8
cmp byte [rcx + 0x19], 2
jb 0x1400264b8
mov edx, 0x21a
jmp 0x14002649e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002656f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x1400264b8
test byte [rcx + 0x1c], 1
je 0x1400264b8
cmp byte [rcx + 0x19], 2
jb 0x1400264b8
mov edx, 0x21b
jmp 0x14002649e
xor edi, edi
mov qword [rbp + 0x18], rdi
mov r15, qword [0x14017a048]
lea rdi, [0x14017a048]
cmp r15, rdi
je 0x140026649
test byte [r15 + 0x1c], 4
je 0x140026649
cmp byte [r15 + 0x19], 4
jb 0x140026649
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + 0x138]
lea r8, [0x140155270]
mov rcx, qword [r15 + 0x10]
call fcn.140010200
mov rbx, qword [rbp - 0x48]
lea rdi, [0x14017a048]
test rbx, rbx
jne 0x140026666
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.1400876c8
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r15, qword [0x14017a048]
cmp r15, rdi
je 0x140026734
test byte [r15 + 0x1c], 4
je 0x140026734
cmp byte [r15 + 0x19], 4
jb 0x140026734
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + 0x148]
lea r8, [0x140155270]
mov rcx, qword [r15 + 0x10]
call fcn.140010200
mov byte [rbp - 0x54], 1
mov bl, byte [rbp - 0x60]
mov rsi, qword [rbp - 0x28]
mov r15, qword [rbp + 0xa0]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x14017a048]
lea rax, [0x14017a048]
cmp r10, rax
je 0x1400267ff
test byte [r10 + 0x1c], 1
je 0x1400267ff
cmp byte [r10 + 0x19], 4
jb 0x1400267ff
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x68], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x6c], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x60], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x60]
sub rcx, qword [rbp + 0x68]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x140155270]
mov rcx, qword [r10 + 0x10]
call fcn.140010438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, qword [rbp - 0x78]
cmp byte [rbp - 0x5f], r14b
je 0x140026834
mov byte [rdi + 0x84], 1
cmp byte [rbp - 0x80], r14b
jne 0x140026834
lea edx, [r14 + 0x10]
mov rcx, rdi
call fcn.140012c88
test bl, bl
jne 0x140026884
cmp byte [rbp - 0x80], r14b
je 0x140026884
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026872
test byte [rcx + 0x1c], 1
je 0x140026872
cmp byte [rcx + 0x19], 4
jb 0x140026872
mov edx, 0x21f
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b70
mov rax, qword [r15 + 0x188]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r14d
mov byte [rbp - 0x5e], 1
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov rdi, qword [rbp - 0x68]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp]
mov qword [rdi + 0x18], rax
mov ecx, r12d
test r12d, r12d
je 0x140026d1e
sub ecx, 1
je 0x140026cf6
sub ecx, 3
je 0x140026c54
sub ecx, 1
je 0x140026bc1
sub ecx, 1
je 0x140026c54
sub ecx, 1
je 0x1400269ee
cmp ecx, 0xd
je 0x14002698c
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026971
test byte [rcx + 0x1c], 1
je 0x140026971
cmp byte [rcx + 0x19], 2
jb 0x140026971
mov edx, 0x227
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.14010086c
mov r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x140025cb6
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400269d5
test byte [rcx + 0x1c], 1
je 0x1400269d5
cmp byte [rcx + 0x19], 2
jb 0x1400269d5
mov edx, 0x222
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 0x14
call fcn.14010086c
mov byte [rsp + 0x70], 1
jmp 0x140026981
mov rcx, qword [0x14017a048]
lea rbx, [0x14017a048]
cmp rcx, rbx
je 0x140026a37
test byte [rcx + 0x1c], 1
je 0x140026a37
cmp byte [rcx + 0x19], 2
jb 0x140026a37
mov edx, 0x223
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 7
call fcn.14010086c
mov r13d, eax
mov byte [rbp - 0x5e], r14b
cmp eax, 0x8078002a
jne 0x140026ba0
cmp dword [rsp + 0x74], 0x70
jne 0x140026b9a
mov rcx, qword [0x14017a048]
cmp rcx, rbx
je 0x140026a9c
test byte [rcx + 0x1c], 1
je 0x140026a9c
mov r12, qword [rbp + 8]
cmp byte [rcx + 0x19], 4
jb 0x140026aa0
mov edx, 0x224
mov r9, r12
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
jmp 0x140026aa0
mov r12, qword [rbp + 8]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x40], r14d
mov r14d, dword [rbp - 0x58]
test r14d, r14d
je 0x140026ac9
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400b9ba0
test eax, eax
jne 0x140026bad
mov rbx, qword [rbp - 0x28]
mov rdx, rbx
cmp byte [r15 + 0x428], al
je 0x140026b00
mov rcx, qword [r15 + 0x158]
call fcn.140117688
jmp 0x140026b08
mov rcx, r15
call fcn.14001c538
test eax, eax
js 0x140026b69
xor r13d, r13d
mov byte [rbp - 0x7e], 1
lea edi, [r14 + 1]
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140025cbd
test byte [rcx + 0x1c], 1
je 0x140025cbd
cmp byte [rcx + 0x19], 4
jb 0x140025cbd
mov edx, 0x225
mov qword [rsp + 0x20], r12
mov rbx, qword [rsp + 0x78]
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005d24
jmp 0x140026c40
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140026bb4
test byte [rcx + 0x1c], 1
je 0x140026bb4
cmp byte [rcx + 0x19], 2
jb 0x140026bb4
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14001047c
jmp 0x140026ba4
mov r14d, dword [rbp - 0x58]
jmp 0x140026bad
mov r14d, dword [rbp - 0x58]
test r13d, r13d
jns 0x140026d22
mov rcx, qword [0x14017a048]
mov byte [rsp + 0x70], 1
mov edi, r14d
jmp 0x140025cbd
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026c0f
test byte [rcx + 0x1c], 1
je 0x140026c0f
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026c14
mov edx, 0x221
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 5
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
jmp 0x140026c14
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 5
call fcn.14010086c
mov r13d, eax
cmp dword [rbp - 0x5c], r14d
jne 0x140026c38
mov dword [rbp - 0x5c], eax
mov r13d, 0x80780166
mov byte [rsp + 0x70], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x14017a048]
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
jmp 0x140026f4a
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026c9f
test byte [rcx + 0x1c], 1
je 0x140026c9f
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026ca4
mov edx, 0x220
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140010964
jmp 0x140026ca4
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.14010086c
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140026cdf
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024cb4
test eax, eax
js 0x140026cdf
cmp byte [rbp - 0x70], r14b
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x14017a048]
mov r14, qword [rbp - 0x68]
jmp 0x140026f4a
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005b13.0]
test al, al
mov r13d, 0x80780167
jne 0x140026984
mov r13d, dword [r15 + 0x20]
jmp 0x140026984
mov r14d, dword [rbp - 0x58]
lea rbx, [r15 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r12, qword [rbp - 0x78]
inc dword [r12 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r12 + 0x10]
mov dword [rdi + 0x28], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [rdi + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r15 + 0x154], 2
jne 0x140026dcf
mov rcx, r12
call fcn.140014328
test eax, eax
jns 0x140026dcf
mov r8d, eax
mov edx, 0x80780151
mov rsi, r12
mov rcx, r12
call fcn.140012c18
mov edi, r14d
jmp 0x140026336
cmp byte [rbp - 0x54], 0
jne 0x140026e21
mov rax, qword [rbp - 0x10]
cmp qword [rdi + 0x38], rax
je 0x140026df7
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
and qword [rdi + 0x38], 0
and dword [rdi + 0x40], 0
mov r13d, 0x80780030
mov byte [rsp + 0x70], 1
mov edi, r14d
mov rcx, qword [0x14017a048]
mov r14, qword [rbp - 0x68]
mov rsi, r12
jmp 0x140026f45
and qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400c2348
test eax, eax
je 0x140026e4f
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140026e99
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140026e99
test byte [rcx + 0x1c], 1
je 0x140026e99
cmp byte [rcx + 0x19], 2
jb 0x140026e99
mov edx, 0x228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.1400111c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [r12 + 0x28], rbx
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test rbx, rbx
jle 0x140026ef2
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, r12
call fcn.140012c18
mov ebx, 0xe
mov edx, ebx
mov rcx, r12
call fcn.140012d78
mov edx, ebx
mov rcx, rdi
call fcn.140014a38
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov edi, r14d
mov rsi, r12
test byte [r15 + 0x154], 2
jne 0x140026336
mov rdx, r12
mov rcx, r15
call fcn.14002f0c8
jmp 0x140026336
mov rcx, qword [0x14017a048]
mov rbx, qword [rsp + 0x78]
mov r12, qword [rbp + 0x18]
test r12, r12
je 0x14002700a
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
test eax, eax
je 0x140026fa6
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140026fa6
test byte [rcx + 0x1c], 1
je 0x140026fa6
cmp byte [rcx + 0x19], 3
jb 0x140026fa6
mov edx, 0x229
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x140026ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140027003
test byte [rcx + 0x1c], 1
je 0x140027003
cmp byte [rcx + 0x19], 3
jb 0x140027003
mov edx, 0x22a
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
mov rcx, qword [0x14017a048]
xor r12d, r12d
mov qword [rbp + 0x18], r12
cmp r13d, 0x80780030
je 0x14002702b
cmp r13d, 0x8078002a
jne 0x1400270f6
cmp dword [rsp + 0x74], 0x70
jne 0x14002711a
test byte [r15 + 0x154], 2
jne 0x14002707a
mov rcx, rsi
call fcn.140014328
test eax, eax
jns 0x14002707a
mov rcx, qword [0x14017a048]
lea r12, [0x14017a048]
cmp rcx, r12
je 0x140027081
test byte [rcx + 0x1c], 1
je 0x140027081
cmp byte [rcx + 0x19], 3
jb 0x140027081
mov edx, 0x22b
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
jmp 0x140027081
lea r12, [0x14017a048]
lea rax, [0x1400df760]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x188]
mov edx, dword [r15 + 0x150]
mov rcx, qword [r15 + 0x158]
call fcn.14010f17c
test eax, eax
jns 0x1400270ef
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400270f6
test byte [rcx + 0x1c], 1
je 0x1400270f6
cmp byte [rcx + 0x19], 2
jb 0x1400270f6
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r15 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x158]
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005de0
mov rcx, qword [0x14017a048]
cmp r13d, 0x80780030
jne 0x14002711a
test byte [r15 + 0x154], 2
je 0x14002711a
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0xc]
cmp dword [r14 + 0xc], eax
ja 0x1400272d4
mov r12, qword [rsp + 0x78]
mov rbx, r12
cmp qword [rsi + 0x58], 0
cmovne rbx, qword [rsi + 0x58]
test r13d, r13d
jns 0x140027216
mov edx, 0xc
mov rcx, r14
call fcn.140014a38
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14002717e
test byte [rcx + 0x1c], 1
je 0x14002717e
cmp byte [rcx + 0x19], 2
jb 0x14002717e
mov edx, 0x22e
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call fcn.140035778
mov ebx, eax
test eax, eax
jns 0x1400271d3
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400271d1
test byte [rcx + 0x1c], 1
je 0x1400271d1
cmp byte [rcx + 0x19], 3
jb 0x1400271d1
mov edx, 0x22f
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
xor ebx, ebx
mov r8d, dword [rbp - 0x5c]
mov edx, r13d
mov rcx, rsi
call fcn.140012e74
xor eax, eax
cmp byte [rbp - 0x7f], al
je 0x1400271fb
cmp byte [rbp - 0x53], al
je 0x140027292
cmp byte [rsi + 0x68], al
je 0x140027292
mov al, byte [rsp + 0x70]
mov rcx, qword [rbp + 0x28]
mov byte [rcx], al
mov eax, dword [rbp - 0x5c]
mov rcx, qword [rbp + 0x70]
mov dword [rcx], eax
mov ebx, r13d
jmp 0x140027422
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x140027246
test byte [rcx + 0x1c], 1
je 0x140027246
cmp byte [rcx + 0x19], 4
jb 0x140027246
mov edx, 0x230
mov r9, r12
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r15
call fcn.140035778
mov ebx, eax
test eax, eax
jns 0x140027292
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x140027292
test byte [rcx + 0x1c], 1
je 0x140027292
cmp byte [rcx + 0x19], 3
jb 0x140027292
mov edx, 0x231
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005ca0
mov ecx, dword [r14 + 8]
cmp byte [rbp - 0x7e], 0
jne 0x1400272a2
inc ecx
mov dword [r14 + 8], ecx
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x28], eax
mov dword [r14 + 0x2c], 0xf
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rax
mov dword [r14 + 0x40], eax
mov esi, ecx
mov r12d, dword [rbp - 0x50]
cmp ecx, r12d
jae 0x14002731c
jmp 0x14002518b
mov edx, 4
mov rcx, r14
call fcn.140014a38
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140027318
test byte [rcx + 0x1c], 1
je 0x140027318
cmp byte [rcx + 0x19], 4
jb 0x140027318
mov edx, 0x22d
mov r9, rbx
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140005c30
mov r12d, dword [rbp - 0x50]
mov r13, qword [rbp - 0x30]
mov rdx, qword [rbp + 0x28]
mov rcx, r15
call fcn.1400214f8
mov ebx, eax
test eax, eax
js 0x140027422
lea rcx, [r15 + 0x28]
xor edx, edx
call fcn.1400fdb78
mov ebx, eax
test eax, eax
js 0x140027422
mov r14d, dword [r13 + 0xc]
xor edi, edi
test r12d, r12d
je 0x1400273f7
xor esi, esi
mov r13, qword [rbp + 0x20]
mov ecx, edi
mov edx, edi
shl rdx, 4
add rdx, r13
mov rax, qword [rdx]
cmp rax, qword [0x140159df8]
jne 0x140027384
mov rax, qword [rdx + 8]
cmp rax, qword [0x140159e00]
je 0x1400273e5
mov r11, qword [r15 + 0xd8]
imul r8, rcx, 0x170
lea r10, [r11 + 0x78]
add r10, r8
mov ecx, edi
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea r9, [r11 + 0x44]
add r9, r8
mov eax, dword [r11 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rcx
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [r11 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r15
call fcn.14001f894
mov ebx, eax
inc r14d
test eax, eax
js 0x140027419
inc edi
add rsi, 0x170
cmp edi, r12d
jb 0x140027360
mov rax, qword [rbp - 0x68]
cmp r14d, dword [rax + 0xc]
je 0x14002741f
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.1400876c8
mov r14, qword [rbp - 0x68]
jmp 0x140027422
mov r14, rax
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x14002743a
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov r13, qword [rbp - 0x30]
mov r12, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140027467
cmp rcx, qword [r14 + 0x38]
je 0x140027467
cmp rcx, qword [r13 + 0x38]
je 0x140027467
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140027480
cmp rsi, qword [r14 + 0x30]
je 0x140027480
cmp rsi, qword [r13 + 0x30]
je 0x140027480
mov rcx, rsi
call fcn.1400c1188
test r12, r12
je 0x140027494
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x1400274ac
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x1400274c4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
test rax, rax
je 0x1400274dc
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rdi, [r15 + 0x28]
mov rcx, rdi
call fcn.1400fdd24
test ebx, ebx
jns 0x1400275e2
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x140027540
test byte [rcx + 0x1c], 1
je 0x140027540
cmp byte [rcx + 0x19], 2
jb 0x140027540
lea r8, [0x140155238]
lea rax, [0x140154558]
mov rdx, qword [rbp + 0x28]
cmp byte [rdx], 0
cmovne rax, r8
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.14001063c
mov rcx, qword [0x14017a048]
cmp byte [rbp - 0x5e], 0
jne 0x1400275f0
test byte [r15 + 0x154], 4
je 0x1400275f0
xor edx, edx
mov rcx, rdi
call fcn.1400fdb78
test eax, eax
jns 0x14002759c
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x140027616
test byte [rcx + 0x1c], 1
je 0x1400275f0
cmp byte [rcx + 0x19], 2
jb 0x1400275f0
mov edx, 0x233
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
jmp 0x1400275e9
mov rcx, r15
call fcn.14001d40c
test eax, eax
jns 0x1400275d8
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x1400275d8
test byte [rcx + 0x1c], 1
je 0x1400275d8
cmp byte [rcx + 0x19], 2
jb 0x1400275d8
mov edx, 0x234
mov r9d, eax
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b9c
mov rcx, rdi
call fcn.1400fdd24
jmp 0x1400275e9
lea rsi, [0x14017a048]
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x140027616
test byte [rcx + 0x1c], 1
je 0x140027616
cmp byte [rcx + 0x19], 4
jb 0x140027616
mov edx, 0x235
lea r8, [0x140155270]
mov rcx, qword [rcx + 0x10]
call fcn.140004b70
mov eax, ebx
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14014b700
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret