Function at 0x140024174
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x108]
sub rsp, 0x208
mov qword [rbp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r12d, r9d
mov dword [rbp - 0x38], r12d
mov qword [rbp + 0x50], r8
mov qword [rbp + 0x70], rdx
mov r14, rcx
mov qword [rbp - 0x30], rcx
mov r15, qword [rbp + 0x178]
mov qword [rbp - 0x28], r15
mov rsi, qword [rbp + 0x170]
mov qword [rbp - 0x58], rsi
mov rbx, qword [rbp + 0x180]
mov qword [rbp + 0x48], rbx
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x68], rax
xor ecx, ecx
mov dword [rbp - 0x18], ecx
mov dword [rbp - 0x64], ecx
mov qword [rbp + 0x20], rcx
mov r13d, ecx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 8], rcx
mov dword [rsp + 0x74], ecx
mov qword [rbp - 0x40], rcx
mov byte [rbp - 0x66], cl
mov byte [rsp + 0x7a], cl
mov byte [rbp - 0x68], cl
mov edi, ecx
mov byte [rbp - 0x5f], cl
mov byte [rbp - 0x70], cl
mov qword [rbp + 0x60], rcx
mov qword [rbp - 0x10], rcx
lea rax, [0x140170048]
mov rcx, qword [0x140170048]
cmp rcx, rax
je 0x140024267
test byte [rcx + 0x1c], 1
je 0x140024267
cmp byte [rcx + 0x19], 4
jb 0x140024267
mov edx, 0x1fc
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c54
cmp r12d, dword [r14 + 0x170]
je 0x140024288
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov byte [rbx], dil
mov rax, qword [rbp + 0x68]
and dword [rax], edi
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe0]
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r14 + 0xe0]
mov dword [r15 + 0x10], eax
lea rcx, [rbp - 0x5f]
call fcn.14008d554
mov ebx, eax
test eax, eax
jns 0x1400242ff
mov rcx, qword [0x140170048]
lea r12, [0x140170048]
cmp rcx, r12
je 0x14002434c
test byte [rcx + 0x1c], 1
je 0x14002434c
cmp byte [rcx + 0x19], 2
jb 0x14002434c
mov edx, 0x1fd
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
jmp 0x14002434c
lea r8, [rbp + 0x20]
lea rdx, [0x1401487f8]
mov rcx, qword [r14 + 0x158]
call fcn.140084760
mov ebx, eax
test eax, eax
js 0x140024345
mov rsi, r12
shl rsi, 4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r13, rax
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x1400244a2
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x58]
lea r12, [0x140170048]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002435b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140024376
cmp rcx, qword [r15 + 0x38]
je 0x140024376
cmp rcx, qword [rsi + 0x38]
je 0x140024376
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140024390
cmp rcx, qword [r15 + 0x30]
je 0x140024390
cmp rcx, qword [rsi + 0x30]
je 0x140024390
call fcn.1400bb470
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14002439f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x1400243b1
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x1400243bf
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400243ce
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdi, [r14 + 0x28]
mov rcx, rdi
call fcn.1400f6448
test ebx, ebx
jns 0x140026587
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x140024437
test byte [rcx + 0x1c], 1
je 0x140024437
cmp byte [rcx + 0x19], 2
jb 0x140024437
lea r8, [0x14014b188]
lea rax, [0x14014a4b8]
mov rdx, qword [rbp + 0x48]
cmp byte [rdx], 0
cmovne rax, r8
mov edx, 0x232
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140010268
mov rcx, qword [0x140170048]
cmp byte [rbp - 0x66], 0
jne 0x14002658e
test byte [r14 + 0x154], 4
je 0x14002658e
xor edx, edx
mov rcx, rdi
call fcn.1400f62b4
test eax, eax
jns 0x140026543
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x1400265b4
test byte [rcx + 0x1c], 1
je 0x14002658e
cmp byte [rcx + 0x19], 2
jb 0x14002658e
mov edx, 0x233
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
jmp 0x140026587
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, r12d
shl eax, 4
mov esi, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14002433c
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov esi, dword [r15 + 8]
cmp esi, r12d
jae 0x140026254
xor eax, eax
mov byte [rsp + 0x70], al
mov byte [rsp + 0x79], al
neg byte [rsp + 0x7a]
sbb r13d, r13d
and r13d, edi
mov dword [rbp - 0x6c], r13d
mov byte [rsp + 0x7a], al
mov eax, esi
imul rcx, rax, 0x170
add rcx, qword [r14 + 0xd8]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x50]
mov r12, qword [rcx + rax*8]
mov qword [rbp - 0x80], r12
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r14 + 0x174], esi
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
je 0x1400245ee
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + rcx*8]
lea rdx, [rbp - 0x20]
call fcn.140084524
test eax, eax
mov edi, r13d
mov r12d, eax
js 0x140024d0f
test byte [rsi + 0x54], 0x40
je 0x140024710
mov rdx, rsi
mov rcx, r14
call fcn.140022bec
mov ebx, eax
test eax, eax
js 0x14002645e
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe4]
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r14 + 0xe4]
mov dword [r15 + 0xc], eax
mov eax, dword [r14 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xe0]
mov rcx, qword [rbp - 0x50]
movdqu xmmword [rcx + rax*8], xmm0
mov ecx, dword [r15 + 8]
inc ecx
mov dword [r15 + 8], ecx
mov edi, r13d
xor eax, eax
jmp 0x14002651e
xor edi, edi
mov rcx, qword [r14 + 0x1b0]
cmp dword [rcx + 0x50], edi
jbe 0x14002462d
mov eax, edi
imul r13, rax, 0x38
add r13, qword [rcx + 0x58]
mov qword [rbp + 0x58], r13
mov rdx, r12
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140024629
inc edi
mov rcx, qword [r14 + 0x1b0]
cmp edi, dword [rcx + 0x50]
jb 0x1400245fc
mov r13d, dword [rbp - 0x6c]
mov rax, qword [r14 + 0x1b0]
cmp edi, dword [rax + 0x50]
jne 0x140024697
mov r12d, dword [rsi + 0x20]
test r12d, r12d
js 0x140024680
mov r12d, 0x80780020
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x140024687
test byte [rcx + 0x1c], 1
je 0x140024687
cmp byte [rcx + 0x19], 2
jb 0x140024687
mov edx, 0x1fe
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov rcx, qword [0x140170048]
mov byte [rsp + 0x79], 1
mov edi, r13d
mov r13, rsi
jmp 0x140024d19
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400246ab
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp - 0x20], 0
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140024564
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400246fa
test byte [rcx + 0x1c], 1
je 0x1400246fa
cmp byte [rcx + 0x19], 2
jb 0x1400246fa
mov edx, 0x1ff
mov r9, r12
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov rcx, qword [0x140170048]
mov r12d, 0x80780020
mov byte [rsp + 0x79], 1
mov edi, r13d
mov r13, rsi
jmp 0x140024d20
mov edi, 8
test byte [rsi + 0x54], dil
jne 0x1400247ae
test byte [rsi + 0x54], 0x20
jne 0x14002473d
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov rax, qword [0x140170048]
lea rcx, [0x140170048]
cmp rax, rcx
je 0x14002478e
test byte [rax + 0x1c], 1
je 0x14002478e
cmp byte [rax + 0x19], 4
jb 0x14002478e
lea rdx, [rsi + 0x44]
lea rcx, [rbp + 0x78]
call fcn.14000fda0
nop
or dword [rbp - 0x18], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x14014b1c0]
mov rcx, qword [0x140170048]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
nop
mov eax, dword [rbp - 0x18]
test al, 1
je 0x1400245da
and eax, 0xfffffffe
mov dword [rbp - 0x18], eax
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400245da
mov r8b, 1
mov edx, edi
mov rcx, r14
call fcn.14002c254
mov dword [r15 + 0x2c], edi
mov eax, dword [r15 + 8]
mov rdi, qword [rbp - 0x58]
cmp eax, dword [rdi + 8]
jne 0x1400247de
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x1400247de
mov qword [rbp - 0x48], rax
jmp 0x140024ec3
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400247f8
cmp rcx, qword [r15 + 0x30]
je 0x1400247f8
cmp rcx, qword [rdi + 0x30]
je 0x1400247f8
call fcn.1400bb470
xor edi, edi
mov qword [rbp - 0x48], rdi
test byte [rsi + 0x54], 1
je 0x140024862
mov rcx, r14
call fcn.14002d2d8
mov r12d, eax
test eax, eax
jns 0x140024862
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024705
test byte [rcx + 0x1c], 1
je 0x140024705
cmp byte [rcx + 0x19], 2
jb 0x140024705
mov edx, 0x201
mov r9d, ebx
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, qword [0x140170048]
jmp 0x140024705
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14003a574
test byte [r14 + 0x154], 0x10
jne 0x1400248a3
cmp byte [r14 + 0x17c], dil
jne 0x14002488b
cmp byte [r14 + 0x17d], dil
je 0x1400248a3
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400248e4
test byte [rcx + 0x1c], 1
je 0x1400248e4
cmp byte [rcx + 0x19], 4
jb 0x1400248e4
mov edx, 0x202
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cc0
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
add rax, 0x8c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [r14 + 0x154]
mov rax, qword [r14 + 0x28]
test cl, 2
je 0x14002499c
cmp rax, 0xffffffffffffffff
jne 0x14002492f
or rax, rax
cmp qword [r14 + 0x30], 0xffffffffffffffff
cmovne rax, qword [r14 + 0x30]
shr ecx, 4
and cl, 1
lea rdx, [rsp + 0x74]
mov qword [rsp + 0x58], rdx
lea rdx, [rbp + 8]
mov qword [rsp + 0x50], rdx
lea rdx, [rbp]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x80]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [0x14001ff60]
mov qword [rsp + 0x20], rax
mov r9b, byte [r14 + 0x17d]
mov r8b, byte [r14 + 0x17c]
mov dl, cl
mov rcx, qword [rbp - 0x20]
call fcn.1400b3a9c
mov edi, eax
jmp 0x140024ab9
cmp rax, 0xffffffffffffffff
jne 0x1400249af
or rax, rax
cmp qword [r14 + 0x30], 0xffffffffffffffff
cmovne rax, qword [r14 + 0x30]
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x68], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x60], rcx
lea rcx, [rbp + 8]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [0x14001ff60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, byte [r14 + 0x17d]
mov dl, byte [r14 + 0x17c]
mov rcx, qword [rbp - 0x20]
call fcn.1400b3c78
mov edi, eax
test eax, eax
jne 0x140024ab9
mov rbx, qword [rbp - 0x48]
test rbx, rbx
jne 0x140024a49
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008388c
cmp byte [rbx + 0xb8], 0
je 0x140024a85
mov edx, 0x2000
mov rcx, rsi
call fcn.140012760
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x140024ab9
test byte [rcx + 0x1c], 1
je 0x140024ab9
cmp byte [rcx + 0x19], 4
jb 0x140024ab9
mov edx, 0x203
jmp 0x140024aa9
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x140024ab9
test byte [rcx + 0x1c], 1
je 0x140024ab9
cmp byte [rcx + 0x19], 4
jb 0x140024ab9
mov edx, 0x204
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c54
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [0x140170048]
lea rcx, [0x140170048]
cmp rax, rcx
je 0x140024b48
test byte [rax + 0x1c], 1
je 0x140024b48
cmp byte [rax + 0x19], 4
jb 0x140024b48
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
lea rdx, [rax + 0x94]
add rdx, rcx
add rax, 0x8c
add rcx, rax
call fcn.14008d514
mov r9, rax
mov edx, 0x205
lea r8, [0x14014b1c0]
mov rcx, qword [0x140170048]
mov rcx, qword [rcx + 0x10]
call fcn.140010084
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
mov rcx, r14
call fcn.14003a574
mov rax, qword [rbp]
mov qword [r15 + 0x20], rax
mov rax, qword [rbp + 8]
mov qword [r15 + 0x18], rax
mov ecx, edi
test edi, edi
je 0x140024ebb
sub ecx, 1
je 0x140024cf0
sub ecx, 3
je 0x140024c6c
sub ecx, 1
je 0x140024c12
sub ecx, 1
je 0x140024c6c
sub ecx, 1
je 0x140024c12
sub ecx, 0xf
je 0x140024c6c
cmp ecx, 9
je 0x140024c6c
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024bf1
test byte [rcx + 0x1c], 1
je 0x140024bf1
cmp byte [rcx + 0x19], 2
jb 0x140024bf1
mov edx, 0x208
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
mov ecx, edi
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x64]
call fcn.1400f8d68
mov r12d, eax
mov edi, r13d
mov rcx, qword [0x140170048]
jmp 0x140024708
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024c56
test byte [rcx + 0x1c], 1
je 0x140024c56
cmp byte [rcx + 0x19], 2
jb 0x140024c56
mov edx, 0x207
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, edi
call fcn.1400f8d68
mov byte [rsp + 0x70], 1
jmp 0x140024c00
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024cb0
test byte [rcx + 0x1c], 1
je 0x140024cb0
cmp byte [rcx + 0x19], 2
jb 0x140024cb0
mov edx, 0x206
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, edi
call fcn.1400f8d68
mov r12d, eax
test byte [rsi + 0x54], 1
jne 0x140024ce6
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x20]
call fcn.140023f0c
test eax, eax
js 0x140024ce6
cmp byte [rbp - 0x70], 0
mov eax, 0x80780169
cmove r12d, eax
mov byte [rsp + 0x79], 1
jmp 0x140024c03
lea rcx, [r14 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005adb.0]
test al, al
mov eax, 0x80780167
cmovne r12d, eax
mov edi, r13d
mov r13, rsi
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
mov rsi, qword [rbp - 0x80]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140024dc3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
test eax, eax
je 0x140024d73
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x140024d73
test byte [rcx + 0x1c], 1
je 0x140024d73
cmp byte [rcx + 0x19], 3
jb 0x140024d73
mov edx, 0x229
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140024db7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x140024dbe
test byte [rcx + 0x1c], 1
je 0x140024dbe
cmp byte [rcx + 0x19], 3
jb 0x140024dbe
mov edx, 0x22a
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, qword [0x140170048]
and qword [rbp - 0x10], 0
cmp r12d, 0x80780030
je 0x140024de4
cmp r12d, 0x8078002a
jne 0x1400261d4
cmp dword [rsp + 0x74], 0x70
jne 0x140026362
mov r14, qword [rbp - 0x30]
test byte [r14 + 0x154], 2
jne 0x140024e2e
mov rcx, r13
call fcn.140013dd0
test eax, eax
jns 0x140024e2e
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x140024e2e
test byte [rcx + 0x1c], 1
je 0x140024e2e
cmp byte [rcx + 0x19], 3
jb 0x140024e2e
mov edx, 0x22b
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
lea rax, [0x1400d85e0]
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + 0x188]
mov r8, qword [r14 + 0x160]
mov edx, dword [r14 + 0x150]
mov rcx, qword [r14 + 0x158]
call fcn.140106fc4
test eax, eax
jns 0x140024eaf
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400261d8
test byte [rcx + 0x1c], 1
je 0x1400261d8
cmp byte [rcx + 0x19], 2
jb 0x1400261d8
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r14 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + 0x158]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005d78
mov rcx, qword [0x140170048]
jmp 0x1400261d8
mov rax, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x58]
mov qword [r15 + 0x30], rax
mov edx, dword [r15 + 8]
mov ecx, edx
cmp edx, dword [rdi + 8]
jne 0x140024ee7
cmp qword [rdi + 0x30], 0
jne 0x140024ee7
test byte [rsi + 0x54], 1
jne 0x140024ee7
mov qword [rdi + 0x30], rax
mov ecx, dword [r15 + 8]
cmp ecx, dword [rdi + 8]
jne 0x140024f04
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140024f04
mov qword [rbp - 8], rcx
mov edx, dword [rdi + 0x40]
mov dword [rbp - 0x14], edx
jmp 0x140024fa5
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140024f23
cmp rcx, qword [r15 + 0x38]
je 0x140024f23
cmp rcx, qword [rdi + 0x38]
je 0x140024f23
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x48]
xor ecx, ecx
mov qword [rbp - 8], rcx
xor edx, edx
mov dword [rbp - 0x14], edx
test byte [r14 + 0x154], 2
je 0x140024fa5
lea r9, [rsp + 0x74]
lea r8, [rbp - 0x14]
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.1400b79a0
mov ebx, eax
test eax, eax
je 0x140024f9e
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024f97
test byte [rcx + 0x1c], 1
je 0x140024f97
cmp byte [rcx + 0x19], 2
jb 0x140024f97
mov edx, 0x209
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
mov ecx, ebx
jmp 0x140024bf3
mov rcx, qword [rbp - 8]
mov edx, dword [rbp - 0x14]
mov qword [r15 + 0x38], rcx
mov dword [r15 + 0x40], edx
mov eax, dword [r15 + 8]
cmp eax, dword [rdi + 8]
jne 0x140024fca
cmp qword [rdi + 0x38], 0
jne 0x140024fca
test byte [rsi + 0x54], 1
jne 0x140024fca
mov qword [rdi + 0x38], rcx
mov dword [rdi + 0x40], edx
mov r8b, 1
mov ebx, 9
mov edx, ebx
mov rcx, r14
call fcn.14002c254
mov edx, ebx
mov rcx, r15
call fcn.1400144b8
test byte [r14 + 0x154], 2
je 0x140025041
lea r9, [rsp + 0x74]
mov r8d, dword [rbp - 0x14]
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x48]
call fcn.1400b7b5c
mov ebx, eax
test eax, eax
je 0x140025041
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024f97
test byte [rcx + 0x1c], 1
je 0x140024f97
cmp byte [rcx + 0x19], 2
jb 0x140024f97
mov edx, 0x20a
jmp 0x140024f77
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140025055
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp - 0x40], 0
lea rdx, [rsi + 0x44]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rsi + 0x54]
mov rcx, qword [r14 + 0x1d8]
call fcn.140109d94
mov r12d, eax
mov edi, r13d
test eax, eax
js 0x140024d0f
lea r15, [r14 + 0x28]
mov rcx, r15
call fcn.1400f6448
mov rdx, qword [rbp - 0x40]
mov rcx, r14
call fcn.140020260
mov r12d, eax
test eax, eax
jns 0x1400250f8
mov byte [rsp + 0x70], 1
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140024708
test byte [rcx + 0x1c], 1
je 0x140024708
cmp byte [rcx + 0x19], 2
jb 0x140024708
mov edx, 0x20b
mov dword [rsp + 0x20], eax
mov r9, qword [rbp - 0x40]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
jmp 0x140024c06
xor edx, edx
mov rcx, r15
call fcn.1400f62b4
mov ebx, eax
test eax, eax
js 0x14002653a
mov rbx, qword [rbp + 0x20]
xor edi, edi
xor esi, esi
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x140025143
mov rcx, rbx
call fcn.14012db10
mov r12d, eax
jmp 0x140025154
mov rdi, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x90]
xor r12d, r12d
and qword [rbp + 0x40], 0
xor r14b, r14b
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rbx, str.SYSTEMCurrentControlSetServiceswbengine
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140025267
and dword [rbp + 0x10], eax
mov dword [rbp + 0x28], 4
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400251e4
mov eax, dword [rbp + 0x10]
shl rax, 0x14
test rax, rax
je 0x1400251db
cmp rax, rsi
jae 0x1400251db
mov rsi, rax
mov r14b, 1
lea rbx, [0x140170048]
jmp 0x14002521f
mov rcx, qword [0x140170048]
lea rbx, [0x140170048]
cmp rcx, rbx
je 0x14002525b
test byte [rcx + 0x1c], 1
je 0x140025226
cmp byte [rcx + 0x19], 5
jb 0x140025226
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov rcx, qword [0x140170048]
cmp rcx, rbx
je 0x14002525b
test byte [rcx + 0x1c], 1
je 0x14002525b
cmp byte [rcx + 0x19], 4
jb 0x14002525b
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140010d74
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002529e
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400252ac
test byte [rcx + 0x1c], 1
je 0x1400252ac
cmp byte [rcx + 0x19], 5
jb 0x1400252ac
mov edx, 0x20e
mov r9, rbx
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
lea rax, [0x140170048]
mov rcx, qword [0x140170048]
test r12d, r12d
jns 0x1400252c2
mov edi, r13d
mov byte [rsp + 0x70], 1
mov r13, qword [rbp - 0x78]
jmp 0x140024d19
cmp rcx, rax
je 0x1400252f0
test byte [rcx + 0x1c], 1
je 0x1400252f0
cmp byte [rcx + 0x19], 4
jb 0x1400252f0
mov edx, 0x20f
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004ddc
mov rcx, r15
call fcn.1400f6448
mov r13, qword [rbp - 0x30]
test byte [r13 + 0x154], 2
je 0x1400254ae
mov rdi, qword [rbp - 0x28]
mov eax, dword [rdi + 0xc]
mov r8, qword [rbp - 0x58]
cmp eax, dword [r8 + 0xc]
jne 0x140025342
mov bl, 1
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400253a8
test byte [rcx + 0x1c], bl
je 0x1400253a8
cmp byte [rcx + 0x19], 4
jb 0x1400253a8
mov edx, 0x210
jmp 0x140025389
ja 0x140025360
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov r8, qword [rbp - 0x58]
xor bl, bl
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400253a8
test byte [rcx + 0x1c], 1
je 0x1400253a8
cmp byte [rcx + 0x19], 4
jb 0x1400253a8
mov edx, 0x211
mov eax, dword [rdi + 0xc]
mov r9d, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14000fe18
mov rcx, qword [0x140170048]
mov edx, 0x1400000
cmp rsi, rdx
ja 0x14002540a
neg bl
sbb r12d, r12d
and r12d, 0x44
add r12d, 0x80780030
mov byte [rsp + 0x70], 1
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400253fe
test byte [rcx + 0x1c], 1
je 0x1400253fe
cmp byte [rcx + 0x19], 3
jb 0x1400253fe
mov edx, 0x212
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140010084
mov rcx, qword [0x140170048]
mov edi, dword [rbp - 0x6c]
mov r13, qword [rbp - 0x78]
jmp 0x140024d20
test r14b, r14b
jne 0x14002545f
mov eax, 0x40000000
cmp rsi, rax
ja 0x14002545f
test bl, bl
je 0x14002545f
mov r12d, 0x80780080
mov byte [rsp + 0x70], 1
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400253fe
test byte [rcx + 0x1c], 1
je 0x1400253fe
cmp byte [rcx + 0x19], 3
jb 0x1400253fe
mov edx, 0x213
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004ddc
jmp 0x1400253f7
sub rsi, rdx
cmp rsi, 0x1100000
ja 0x1400254ae
neg bl
sbb r12d, r12d
and r12d, 0x44
add r12d, 0x80780030
mov byte [rsp + 0x70], 1
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400253fe
test byte [rcx + 0x1c], 1
je 0x1400253fe
cmp byte [rcx + 0x19], 3
jb 0x1400253fe
mov edx, 0x214
jmp 0x1400253e4
mov al, 1
mov byte [rbp - 0x67], al
mov r14, r13
mov rdi, qword [rbp + 0x18]
test byte [r13 + 0x154], 4
je 0x1400254ef
mov r9d, dword [r13 + 0x174]
shl r9d, 4
add r9, rdi
lea r8, [rbp - 0x67]
mov rdx, qword [rbp + 0x70]
mov rcx, r13
call fcn.14001ea14
mov ebx, eax
test eax, eax
js 0x14002653a
mov al, byte [rbp - 0x67]
mov byte [rsp + 0x78], al
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14003a574
mov rcx, qword [0x140170048]
lea rbx, [0x140170048]
cmp rcx, rbx
je 0x140025568
test byte [rcx + 0x1c], 1
je 0x14002553e
cmp byte [rcx + 0x19], 4
jb 0x14002553e
mov edx, 0x215
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140010084
mov rcx, qword [0x140170048]
cmp rcx, rbx
je 0x140025568
test byte [rcx + 0x1c], 1
je 0x140025568
cmp byte [rcx + 0x19], 4
jb 0x140025568
mov edx, 0x216
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
add rax, 0x9c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r13d, 2
test byte [r14 + 0x154], r13b
je 0x14002562b
mov ebx, dword [r14 + 0x174]
shl ebx, 4
add rbx, rdi
mov rcx, r15
call fcn.14003a618
cmp dword [r14 + 0x150], 4
sete r8b
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x60], rcx
lea rcx, [rbp + 8]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [0x14001ff60]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400b49c4
mov r13d, eax
jmp 0x140025adb
and qword [rbp + 0x28], 0
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0xc0]
call sub.msvcrt.dll_memset
cmp byte [rsp + 0x78], 0
jne 0x1400256e3
xor edx, edx
mov rcx, r15
call fcn.1400f62b4
mov ebx, eax
test eax, eax
js 0x14002653a
mov rcx, qword [rbp - 0x40]
call fcn.14008ad14
mov bl, al
mov rcx, r15
call fcn.1400f6448
test bl, bl
je 0x1400256e3
mov dword [rbp + 0xc0], r13d
lea r8, [rbp + 0xc0]
mov rdx, qword [rbp - 0x40]
mov rcx, r15
call fcn.14011994c
test eax, eax
jns 0x1400256e3
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400253fe
test byte [rcx + 0x1c], 1
je 0x1400253fe
cmp byte [rcx + 0x19], r13b
jb 0x1400253fe
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, qword [rbp - 0x40]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
jmp 0x1400253f7
lea r9, [rbp + 0x28]
mov r8, qword [rbp + 0x60]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r14
call fcn.140022230
test eax, eax
jns 0x140025709
mov r12d, eax
mov edi, dword [rbp - 0x6c]
jmp 0x140024d0f
xor edx, edx
mov rcx, r15
call fcn.1400f62b4
mov ebx, eax
test eax, eax
js 0x14002653a
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x40]
call fcn.140115adc
mov ebx, eax
mov rcx, r15
call fcn.1400f6448
test ebx, ebx
jns 0x140025786
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x14002577b
test byte [rcx + 0x1c], 1
je 0x14002577b
cmp byte [rcx + 0x19], r13b
jb 0x14002577b
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, qword [rbp - 0x40]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
mov rcx, qword [0x140170048]
mov r12d, ebx
mov edi, dword [rbp - 0x6c]
jmp 0x140024708
movups xmm0, xmmword [rbp + 0xc8]
movdqu xmmword [rbp + 0xb0], xmm0
mov ecx, dword [r14 + 0x174]
shl ecx, 4
add rcx, rdi
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r14
lea rdx, [0x14001ff60]
mov rcx, qword [rbp - 0x48]
call fcn.1400b649c
mov r13d, eax
test eax, eax
jne 0x140025914
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140025885
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x14002586b
test byte [rcx + 0x1c], 1
je 0x14002586b
cmp byte [rcx + 0x19], 2
jb 0x14002586b
mov edx, 0x219
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, qword [0x140170048]
mov eax, dword [rsp + 0x74]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
jmp 0x14002577e
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov dword [rsp + 0x74], eax
test eax, eax
je 0x1400258c2
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x14002586b
test byte [rcx + 0x1c], 1
je 0x14002586b
cmp byte [rcx + 0x19], 2
jb 0x14002586b
mov edx, 0x21a
jmp 0x140025851
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002590f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x14002586b
test byte [rcx + 0x1c], 1
je 0x14002586b
cmp byte [rcx + 0x19], 2
jb 0x14002586b
mov edx, 0x21b
jmp 0x140025851
and qword [rbp - 0x10], 0
mov r15, qword [0x140170048]
lea rdi, [0x140170048]
cmp r15, rdi
je 0x1400259e4
test byte [r15 + 0x1c], 4
je 0x1400259e4
cmp byte [r15 + 0x19], 4
jb 0x1400259e4
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + 0x138]
lea r8, [0x14014b1c0]
mov rcx, qword [r15 + 0x10]
call fcn.14000fe60
lea rdi, [0x140170048]
mov rbx, qword [rbp - 0x48]
test rbx, rbx
jne 0x140025a05
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008388c
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r15, qword [0x140170048]
cmp r15, rdi
je 0x140025ad3
test byte [r15 + 0x1c], 4
je 0x140025ad3
cmp byte [r15 + 0x19], 4
jb 0x140025ad3
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + 0x148]
lea r8, [0x14014b1c0]
mov rcx, qword [r15 + 0x10]
call fcn.14000fe60
mov byte [rbp - 0x60], 1
mov r14, qword [rbp - 0x30]
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [0x140170048]
lea r15, [0x140170048]
cmp rax, r15
je 0x140025b6a
test byte [rax + 0x1c], 1
je 0x140025b6a
cmp byte [rax + 0x19], 4
jb 0x140025b6a
mov eax, dword [r14 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r14 + 0xd8]
lea rdx, [rax + 0xa4]
add rdx, rcx
add rax, 0x9c
add rcx, rax
call fcn.14008d514
mov r9, rax
mov edx, 0x21e
lea r8, [0x14014b1c0]
mov rcx, qword [0x140170048]
mov rcx, qword [rcx + 0x10]
call fcn.140010084
lea rbx, [r14 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
mov rdi, qword [rbp - 0x78]
cmp byte [rbp - 0x68], sil
je 0x140025b9c
mov byte [rdi + 0x84], 1
cmp byte [rsp + 0x78], sil
jne 0x140025b9c
lea edx, [rsi + 0x10]
mov rcx, rdi
call fcn.140012760
cmp byte [rbp - 0x67], sil
jne 0x140025be7
cmp byte [rsp + 0x78], sil
je 0x140025be7
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x140025bd6
test byte [rcx + 0x1c], 1
je 0x140025bd6
cmp byte [rcx + 0x19], 4
jb 0x140025bd6
mov edx, 0x21f
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c54
mov rax, qword [r14 + 0x188]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], esi
mov byte [rbp - 0x66], 1
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
mov rcx, r14
call fcn.14003a574
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbp]
mov r15, qword [rbp - 0x28]
mov qword [r15 + 0x20], rax
mov rax, qword [rbp + 8]
mov qword [r15 + 0x18], rax
mov ecx, r13d
xor edi, edi
test r13d, r13d
je 0x14002601f
sub ecx, 1
je 0x140025ff4
sub ecx, 3
je 0x140025f5f
sub ecx, 1
je 0x140025eeb
sub ecx, 1
je 0x140025f5f
sub ecx, 1
je 0x140025d1c
cmp ecx, 0xd
je 0x140025cb5
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140025c9d
test byte [rcx + 0x1c], 1
je 0x140025c9d
cmp byte [rcx + 0x19], 2
jb 0x140025c9d
mov edx, 0x227
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, r13d
call fcn.1400f8d68
mov r12d, eax
jmp 0x1400253f7
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140025cfd
test byte [rcx + 0x1c], 1
je 0x140025cfd
cmp byte [rcx + 0x19], 2
jb 0x140025cfd
mov edx, 0x222
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x14
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, 0x14
call fcn.1400f8d68
mov r12d, eax
mov byte [rsp + 0x70], 1
jmp 0x1400253f7
mov rcx, qword [0x140170048]
lea r13, [0x140170048]
cmp rcx, r13
je 0x140025d64
test byte [rcx + 0x1c], 1
je 0x140025d64
cmp byte [rcx + 0x19], 2
jb 0x140025d64
mov edx, 0x223
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 7
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, 7
call fcn.1400f8d68
mov r12d, eax
mov byte [rbp - 0x66], dil
cmp eax, 0x8078002a
jne 0x140025ed1
cmp dword [rsp + 0x74], 0x70
jne 0x140025ecc
mov rcx, qword [0x140170048]
cmp rcx, r13
je 0x140025dc4
test byte [rcx + 0x1c], 1
je 0x140025dc4
cmp byte [rcx + 0x19], 4
jb 0x140025dc4
mov edx, 0x224
mov r9, qword [rbp + 0x20]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], edi
mov esi, dword [rbp - 0x6c]
test esi, esi
je 0x140025dea
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 0x48]
call fcn.1400b436c
test eax, eax
jne 0x140025edd
mov rdx, qword [rbp + 0x30]
cmp byte [r14 + 0x428], dil
je 0x140025e1e
mov rcx, qword [r14 + 0x158]
call fcn.14010efbc
jmp 0x140025e26
mov rcx, r14
call fcn.14001bc80
test eax, eax
js 0x140025e95
mov r12d, edi
mov byte [rsp + 0x7a], 1
lea edi, [rsi + 1]
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140025401
test byte [rcx + 0x1c], 1
je 0x140025401
cmp byte [rcx + 0x19], 4
jb 0x140025401
mov edx, 0x225
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, qword [rbp - 0x80]
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005cc0
mov rcx, qword [0x140170048]
mov r13, qword [rbp - 0x78]
jmp 0x140024d24
mov rcx, qword [0x140170048]
cmp rcx, r13
je 0x140025ee4
test byte [rcx + 0x1c], 1
je 0x140025ee4
cmp byte [rcx + 0x19], 2
jb 0x140025ee4
mov edx, 0x226
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x30]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400100c0
jmp 0x140025ed4
mov esi, dword [rbp - 0x6c]
jmp 0x140025edd
mov esi, dword [rbp - 0x6c]
test r12d, r12d
jns 0x140026022
mov rcx, qword [0x140170048]
mov edi, esi
jmp 0x1400252b4
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140025f33
test byte [rcx + 0x1c], 1
je 0x140025f33
cmp byte [rcx + 0x19], 2
jb 0x140025f33
mov edx, 0x221
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 5
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, 5
call fcn.1400f8d68
mov r12d, eax
cmp dword [rbp - 0x64], edi
jne 0x140025d12
mov dword [rbp - 0x64], eax
mov r12d, 0x80780166
jmp 0x140025d12
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x140025fa4
test byte [rcx + 0x1c], 1
je 0x140025fa4
cmp byte [rcx + 0x19], 2
jb 0x140025fa4
mov edx, 0x220
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
mov r9, qword [rbp - 0x80]
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.14001056c
lea r8, [rbp - 0x64]
mov edx, dword [rsp + 0x74]
mov ecx, r13d
call fcn.1400f8d68
mov r12d, eax
mov r13, qword [rbp - 0x78]
test byte [r13 + 0x54], 1
jne 0x140025fe0
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x20]
call fcn.140023f0c
test eax, eax
js 0x140025fe0
cmp byte [rbp - 0x70], dil
mov eax, 0x80780169
cmove r12d, eax
mov byte [rsp + 0x79], 1
mov edi, dword [rbp - 0x6c]
mov rcx, qword [0x140170048]
jmp 0x140024d20
lea rcx, [r14 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005adb.0]
test al, al
mov r12d, 0x80780167
jne 0x140026013
mov r12d, dword [r14 + 0x20]
mov edi, dword [rbp - 0x6c]
mov r13, qword [rbp - 0x78]
jmp 0x140024d12
mov esi, dword [rbp - 0x6c]
lea rdi, [r14 + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13, qword [rbp - 0x78]
inc dword [r13 + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0x10]
mov dword [r15 + 0x28], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r14 + 0xe4]
mov dword [r15 + 0xc], eax
mov eax, dword [r14 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xe0]
mov rcx, qword [rbp - 0x50]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r14 + 0x154], 2
jne 0x1400260b5
mov rcx, r13
call fcn.140013dd0
xor edi, edi
test eax, eax
jns 0x1400260b7
mov r8d, eax
mov edx, 0x80780151
mov rcx, r13
call fcn.1400126f8
mov edi, esi
jmp 0x140024d12
xor edi, edi
cmp byte [rbp - 0x60], dil
jne 0x1400260f4
mov rax, qword [rbp - 8]
cmp qword [r15 + 0x38], rax
je 0x1400260df
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov qword [r15 + 0x38], rdi
mov dword [r15 + 0x40], edi
mov r12d, 0x80780030
mov byte [rsp + 0x70], 1
jmp 0x1400260ae
mov qword [rbp - 0x78], rdi
lea rdx, [rbp - 0x78]
mov rcx, qword [rbp - 0x48]
call fcn.1400bc480
test eax, eax
je 0x140026121
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov r9, qword [rbp - 0x78]
test r9, r9
je 0x140026167
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x140026167
test byte [rcx + 0x1c], 1
je 0x140026167
cmp byte [rcx + 0x19], 2
jb 0x140026167
mov edx, 0x228
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140010d74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rbp - 0x78]
mov rcx, r13
call fcn.140012838
cmp qword [rbp - 0x78], rdi
jle 0x140026192
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, r13
call fcn.1400126f8
mov edi, 0xe
mov edx, edi
mov rcx, r13
call fcn.140012880
mov edx, edi
mov rcx, r15
call fcn.1400144b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
test byte [r14 + 0x154], 2
jne 0x140024d12
mov rdx, r13
mov rcx, r14
call fcn.14002dda4
jmp 0x140024d12
mov r14, qword [rbp - 0x30]
cmp r12d, 0x80780030
jne 0x140026362
mov r15, qword [rbp - 0x28]
test byte [r14 + 0x154], 2
je 0x140026366
mov rax, qword [rbp - 0x58]
mov eax, dword [rax + 0xc]
cmp dword [r15 + 0xc], eax
jbe 0x140026366
mov edx, 4
mov rcx, r15
call fcn.1400144b8
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x14002624c
test byte [rcx + 0x1c], 1
je 0x14002624c
cmp byte [rcx + 0x19], 4
jb 0x14002624c
mov edx, 0x22d
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
mov r12d, dword [rbp - 0x38]
mov r13, qword [rbp - 0x50]
mov rdx, qword [rbp + 0x48]
mov rcx, r14
call fcn.140020928
mov ebx, eax
test eax, eax
js 0x140024341
lea rcx, [r14 + 0x28]
xor edx, edx
call fcn.1400f62b4
mov ebx, eax
mov rsi, qword [rbp - 0x58]
test eax, eax
js 0x140024345
mov r14d, dword [rsi + 0xc]
xor edi, edi
test r12d, r12d
je 0x14002633b
xor esi, esi
mov r13, qword [rbp - 0x30]
mov ecx, edi
mov eax, edi
shl rax, 4
mov rdx, qword [rbp - 0x50]
add rdx, rax
mov rax, qword [rdx]
cmp rax, qword [0x14014fd28]
jne 0x1400262c0
mov rax, qword [rdx + 8]
cmp rax, qword [0x14014fd30]
je 0x140026325
mov r11, qword [r13 + 0xd8]
imul r8, rcx, 0x170
lea r10, [r11 + 0x78]
add r10, r8
mov ecx, edi
shl ecx, 4
add rcx, qword [rbp + 0x18]
lea r9, [r11 + 0x44]
add r9, r8
mov eax, dword [r11 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rcx
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov eax, dword [r11 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r13
call fcn.14001edc4
mov ebx, eax
inc r14d
test eax, eax
js 0x140026532
inc edi
add rsi, 0x170
cmp edi, r12d
jb 0x140026298
mov rsi, qword [rbp - 0x58]
cmp r14d, dword [r15 + 0xc]
je 0x140026359
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008388c
mov r14, qword [rbp - 0x30]
jmp 0x140026462
mov r15, qword [rbp - 0x28]
mov rbx, rsi
cmp qword [r13 + 0x58], 0
cmovne rbx, qword [r13 + 0x58]
test r12d, r12d
jns 0x14002646b
mov edx, 0xc
mov rcx, r15
call fcn.1400144b8
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400263c5
test byte [rcx + 0x1c], 1
je 0x1400263c5
cmp byte [rcx + 0x19], 2
jb 0x1400263c5
mov edx, 0x22e
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov r14, qword [rbp - 0x30]
mov rcx, r14
call fcn.14003424c
mov ebx, eax
test eax, eax
jns 0x14002641e
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x14002641c
test byte [rcx + 0x1c], 1
je 0x14002641c
cmp byte [rcx + 0x19], 3
jb 0x14002641c
mov edx, 0x22f
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
xor ebx, ebx
mov r8d, dword [rbp - 0x64]
mov edx, r12d
mov rcx, r13
call fcn.140012970
xor eax, eax
cmp byte [rsp + 0x79], al
je 0x140026448
cmp byte [rbp - 0x5f], al
je 0x1400264eb
cmp byte [r13 + 0x68], al
je 0x1400264eb
mov al, byte [rsp + 0x70]
mov rcx, qword [rbp + 0x48]
mov byte [rcx], al
mov eax, dword [rbp - 0x64]
mov rcx, qword [rbp + 0x68]
mov dword [rcx], eax
mov ebx, r12d
mov rsi, qword [rbp - 0x58]
mov r13, qword [rbp - 0x50]
jmp 0x140024345
lea r13, [0x140170048]
cmp rcx, r13
je 0x14002649b
test byte [rcx + 0x1c], 1
je 0x14002649b
cmp byte [rcx + 0x19], 4
jb 0x14002649b
mov edx, 0x230
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005bdc
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov r14, qword [rbp - 0x30]
mov rcx, r14
call fcn.14003424c
mov ebx, eax
test eax, eax
jns 0x1400264eb
mov rcx, qword [0x140170048]
cmp rcx, r13
je 0x1400264eb
test byte [rcx + 0x1c], 1
je 0x1400264eb
cmp byte [rcx + 0x19], 3
jb 0x1400264eb
mov edx, 0x231
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c44
mov ecx, dword [r15 + 8]
cmp byte [rsp + 0x7a], 0
jne 0x1400264fc
inc ecx
mov dword [r15 + 8], ecx
xor eax, eax
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], rax
mov dword [r15 + 0x28], eax
mov dword [r15 + 0x2c], 0xf
mov qword [r15 + 0x30], rax
mov qword [r15 + 0x38], rax
mov dword [r15 + 0x40], eax
mov esi, ecx
mov r12d, dword [rbp - 0x38]
cmp ecx, r12d
jae 0x140026250
jmp 0x1400244e8
mov r14, r13
jmp 0x14002645e
mov r15, qword [rbp - 0x28]
jmp 0x14002645e
mov rcx, r14
call fcn.14001cab0
test eax, eax
jns 0x14002657f
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x14002657f
test byte [rcx + 0x1c], 1
je 0x14002657f
cmp byte [rcx + 0x19], 2
jb 0x14002657f
mov edx, 0x234
mov r9d, eax
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, rdi
call fcn.1400f6448
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x1400265b4
test byte [rcx + 0x1c], 1
je 0x1400265b4
cmp byte [rcx + 0x19], 4
jb 0x1400265b4
mov edx, 0x235
lea r8, [0x14014b1c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004c54
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140141340
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret