Function at 0x140025264
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rax, qword [0x140183808]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov ebx, r9d
mov dword [rbp - 0x50], ebx
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x78], rdx
mov r15, rcx
mov qword [rbp + 0xa0], rcx
mov r14, qword [rbp + 0x188]
mov qword [rbp - 0x68], r14
mov r13, qword [rbp + 0x180]
mov qword [rbp - 0x30], r13
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x70], rax
xor ecx, ecx
mov dword [rbp - 0x20], ecx
mov dword [rbp - 0x5c], ecx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x40], rcx
mov r12d, ecx
mov qword [rbp - 0x38], rcx
mov esi, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x10], rcx
mov dword [rsp + 0x74], ecx
mov qword [rbp - 0x18], rcx
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x7e], cl
mov byte [rbp - 0x5f], cl
mov edi, ecx
mov byte [rbp - 0x53], cl
mov byte [rbp - 0x70], cl
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x18], rcx
lea rax, [0x140183048]
mov rcx, qword [0x140183048]
cmp rcx, rax
je 0x14002535e
test byte [rcx + 0x1c], 1
je 0x14002535e
cmp byte [rcx + 0x19], 4
jb 0x14002535e
mov edx, 0x1fc
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e50
cmp ebx, dword [r15 + 0x170]
je 0x14002537f
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov rax, qword [rbp + 0x28]
mov byte [rax], sil
mov rax, qword [rbp + 0x70]
and dword [rax], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe0]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe0]
mov dword [r14 + 0x10], eax
lea rcx, [rbp - 0x53]
call fcn.140099a48
mov ebx, eax
test eax, eax
jns 0x140025415
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140027766
test byte [rcx + 0x1c], 1
je 0x140027766
cmp byte [rcx + 0x19], 2
jb 0x140027766
mov edx, 0x1fd
mov r9d, ebx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
jmp 0x140027766
lea r8, [rbp + 8]
lea rdx, [0x14015ab98]
mov rcx, qword [r15 + 0x158]
call fcn.14009047c
mov ebx, eax
test eax, eax
js 0x140027766
mov esi, dword [rbp - 0x50]
shl rsi, 4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x14002545f
mov ebx, 0x8007000e
jmp 0x140027762
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x50]
shl eax, 4
mov esi, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140025455
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov esi, dword [r14 + 8]
mov r12d, dword [rbp - 0x50]
cmp esi, r12d
jae 0x140027640
xor eax, eax
mov byte [rsp + 0x70], al
mov byte [rbp - 0x7f], al
neg byte [rbp - 0x7e]
sbb r12d, r12d
and r12d, edi
mov dword [rbp - 0x58], r12d
mov byte [rbp - 0x7e], al
mov eax, esi
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x38]
mov r13, qword [rcx + rax*8]
mov qword [rsp + 0x78], r13
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov dword [r15 + 0x174], esi
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
je 0x1400255cd
mov ecx, dword [r14 + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + rcx*8]
lea rdx, [rbp - 0x38]
call fcn.140090224
test eax, eax
mov edi, r12d
mov r13d, eax
js 0x14002725e
test byte [rsi + 0x54], 0x40
je 0x1400256f1
mov rdx, rsi
mov rcx, r15
call fcn.140023c0c
mov ebx, eax
test eax, eax
js 0x140027742
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [r14 + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
mov ecx, dword [r14 + 8]
inc ecx
mov dword [r14 + 8], ecx
mov edi, r12d
xor eax, eax
jmp 0x1400275e4
xor edi, edi
mov rcx, qword [r15 + 0x1b0]
cmp dword [rcx + 0x50], edi
jbe 0x140025612
mov eax, edi
imul r14, rax, 0x38
add r14, qword [rcx + 0x58]
mov qword [rbp + 0x40], r14
mov rdx, r13
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14002560e
inc edi
mov rcx, qword [r15 + 0x1b0]
cmp edi, dword [rcx + 0x50]
jb 0x1400255db
mov r14, qword [rbp - 0x68]
mov rax, qword [r15 + 0x1b0]
cmp edi, dword [rax + 0x50]
jne 0x140025679
mov r13d, dword [rsi + 0x20]
test r13d, r13d
js 0x140025666
mov r13d, 0x80780020
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x14002566d
test byte [rcx + 0x1c], 1
je 0x14002566d
cmp byte [rcx + 0x19], 2
jb 0x14002566d
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
mov rcx, qword [0x140183048]
mov byte [rbp - 0x7f], 1
mov edi, r12d
jmp 0x140027265
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140025697
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140025537
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400256e6
test byte [rcx + 0x1c], 1
je 0x1400256e6
cmp byte [rcx + 0x19], 2
jb 0x1400256e6
mov edx, 0x1ff
mov r9, r13
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
mov rcx, qword [0x140183048]
mov r13d, 0x80780020
jmp 0x14002566d
mov edi, 8
test byte [rsi + 0x54], dil
jne 0x14002579b
test byte [rsi + 0x54], 0x20
jne 0x14002571e
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov rax, qword [0x140183048]
lea rcx, [0x140183048]
cmp rax, rcx
je 0x140025772
test byte [rax + 0x1c], 1
je 0x140025772
cmp byte [rax + 0x19], 4
jb 0x140025772
lea rdx, [rsi + 0x44]
lea rcx, [rbp + 0x80]
call fcn.14001044c
nop
or dword [rbp - 0x20], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x14015d600]
mov rcx, qword [0x140183048]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
nop
mov eax, dword [rbp - 0x20]
test al, 1
je 0x1400255b9
and eax, 0xfffffffe
mov dword [rbp - 0x20], eax
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
jmp 0x1400255b9
mov r8b, 1
mov edx, edi
mov rcx, r15
call fcn.14002d79c
mov dword [r14 + 0x2c], edi
mov eax, dword [r14 + 8]
mov rdi, qword [rbp - 0x30]
cmp eax, dword [rdi + 8]
jne 0x1400257cd
cmp qword [rdi + 0x30], 0
je 0x1400257cd
mov rbx, qword [rdi + 0x30]
mov qword [rbp - 0x48], rbx
jmp 0x140025da7
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1400257ea
cmp rax, qword [r14 + 0x30]
je 0x1400257ea
cmp rax, qword [rdi + 0x30]
je 0x1400257ea
mov rcx, rax
call fcn.1400c8f88
xor edi, edi
mov eax, edi
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test byte [rsi + 0x54], 1
je 0x14002585a
mov rcx, r15
call fcn.14002e8cc
mov r13d, eax
test eax, eax
jns 0x14002585a
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025671
test byte [rcx + 0x1c], 1
je 0x140025671
cmp byte [rcx + 0x19], 2
jb 0x140025671
mov edx, 0x201
mov r9d, ebx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
mov rcx, qword [0x140183048]
jmp 0x140025671
lea r14, [r15 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test byte [r15 + 0x154], 0x10
jne 0x1400258cc
cmp byte [r15 + 0x17c], dil
jne 0x1400258b4
cmp byte [r15 + 0x17d], dil
je 0x1400258cc
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025910
test byte [rcx + 0x1c], 1
je 0x140025910
mov rbx, qword [rbp - 0x38]
cmp byte [rcx + 0x19], 4
jb 0x140025914
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140006004
jmp 0x140025914
mov rbx, qword [rbp - 0x38]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x8c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [r15 + 0x154]
mov r8b, byte [r15 + 0x17d]
mov dl, byte [r15 + 0x17c]
test al, 2
je 0x140025b72
shr eax, 4
and al, 1
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], r15
mov r9b, r8b
mov r8b, dl
mov dl, al
mov rcx, rbx
call fcn.1400c1014
mov esi, eax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x48], rax
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x140183048]
lea rax, [0x140183048]
cmp r10, rax
je 0x140025a69
test byte [r10 + 0x1c], 1
je 0x140025a69
cmp byte [r10 + 0x19], 4
jb 0x140025a69
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0x50], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0x54], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0x48], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0x4c], eax
mov rcx, qword [rbp + 0x48]
sub rcx, qword [rbp + 0x50]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x14015d600]
mov rcx, qword [r10 + 0x10]
call fcn.140010758
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 0x20], rax
mov rax, qword [rbp]
mov qword [r14 + 0x18], rax
mov ecx, esi
test esi, esi
je 0x140025d9b
sub ecx, 1
je 0x140025d7a
sub ecx, 3
je 0x140025ce8
sub ecx, 1
je 0x140025c8a
sub ecx, 1
je 0x140025ce8
sub ecx, 1
je 0x140025c8a
sub ecx, 0xf
je 0x140025ce8
cmp ecx, 9
je 0x140025ce8
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025b4d
test byte [rcx + 0x1c], 1
je 0x140025b4d
cmp byte [rcx + 0x19], 2
jb 0x140025b4d
mov edx, 0x208
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
mov ecx, esi
mov edx, dword [rsp + 0x74]
lea r8, [rbp - 0x5c]
call fcn.14010866c
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x140183048]
mov rsi, qword [rbp - 0x78]
jmp 0x140027265
lea rax, [rsp + 0x74]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], dil
mov qword [rsp + 0x28], r15
lea rax, [0x140020d40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, rbx
call fcn.1400c1230
mov esi, eax
test eax, eax
jne 0x1400259a8
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x48], rbx
test rbx, rbx
jne 0x140025bfc
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008f4c8
cmp byte [rbx + 0xb8], dil
je 0x140025c58
mov edx, 0x2000
mov rcx, qword [rbp - 0x78]
call fcn.140012fa8
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400259b0
test byte [rcx + 0x1c], 1
je 0x1400259b0
cmp byte [rcx + 0x19], 4
jb 0x1400259b0
mov edx, 0x203
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e50
jmp 0x1400259b0
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400259b0
test byte [rcx + 0x1c], 1
je 0x1400259b0
cmp byte [rcx + 0x19], 4
jb 0x1400259b0
mov edx, 0x204
jmp 0x140025c43
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025ccf
test byte [rcx + 0x1c], 1
je 0x140025ccf
cmp byte [rcx + 0x19], 2
jb 0x140025ccf
mov edx, 0x207
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.14010866c
mov byte [rsp + 0x70], 1
jmp 0x140025b5c
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025d2d
test byte [rcx + 0x1c], 1
je 0x140025d2d
cmp byte [rcx + 0x19], 2
jb 0x140025d2d
mov edx, 0x206
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, esi
call fcn.14010866c
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140025d67
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024fd4
test eax, eax
js 0x140025d67
cmp byte [rbp - 0x70], 0
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, r12d
mov rcx, qword [0x140183048]
jmp 0x140027265
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005df3.0]
test al, al
mov eax, 0x80780167
cmovne r13d, eax
jmp 0x140025b5f
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x30]
mov qword [r14 + 0x30], rbx
mov ecx, dword [r14 + 8]
mov eax, ecx
cmp ecx, dword [rdi + 8]
jne 0x140025dcb
cmp qword [rdi + 0x30], 0
jne 0x140025dcb
test byte [rsi + 0x54], 1
jne 0x140025dcb
mov qword [rdi + 0x30], rbx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025de5
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140025de5
mov qword [rbp - 0x10], rcx
mov edx, dword [rdi + 0x40]
jmp 0x140025e8d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140025e06
cmp rcx, qword [r14 + 0x38]
je 0x140025e06
cmp rcx, qword [rdi + 0x38]
je 0x140025e06
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rbp - 0x10], rcx
xor edx, edx
mov dword [rbp - 0x28], edx
test byte [r15 + 0x154], 2
je 0x140025e8d
lea r9, [rsp + 0x74]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400c5204
mov ebx, eax
test eax, eax
je 0x140025e82
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025e7b
test byte [rcx + 0x1c], 1
je 0x140025e7b
cmp byte [rcx + 0x19], 2
jb 0x140025e7b
mov edx, 0x209
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
mov ecx, ebx
jmp 0x140025b4f
mov rcx, qword [rbp - 0x10]
mov edx, dword [rbp - 0x28]
mov rbx, qword [rbp - 0x48]
mov qword [r14 + 0x38], rcx
mov dword [r14 + 0x40], edx
mov eax, dword [r14 + 8]
cmp eax, dword [rdi + 8]
jne 0x140025eb2
cmp qword [rdi + 0x38], 0
jne 0x140025eb2
test byte [rsi + 0x54], 1
jne 0x140025eb2
mov qword [rdi + 0x38], rcx
mov dword [rdi + 0x40], edx
mov r8b, 1
mov edi, 9
mov edx, edi
mov rcx, r15
call fcn.14002d79c
mov edx, edi
mov rcx, r14
call fcn.140014d58
test byte [r15 + 0x154], 2
je 0x140025f24
lea r9, [rsp + 0x74]
mov rdx, qword [rbp - 0x10]
mov rcx, rbx
call fcn.1400c53dc
mov ebx, eax
test eax, eax
je 0x140025f24
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025e7b
test byte [rcx + 0x1c], 1
je 0x140025e7b
cmp byte [rcx + 0x19], 2
jb 0x140025e7b
mov edx, 0x20a
jmp 0x140025e5a
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140025f41
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
and qword [rbp - 0x18], 0
lea rdx, [rsi + 0x44]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rsi + 0x54]
mov rcx, qword [r15 + 0x1d8]
call fcn.140119edc
mov r13d, eax
mov edi, r12d
test eax, eax
js 0x140025b62
lea r14, [r15 + 0x28]
mov rcx, r14
call fcn.140105b24
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
mov rcx, r15
call fcn.140021114
mov r13d, eax
test eax, eax
jns 0x140025fe6
mov byte [rsp + 0x70], 1
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025fdd
test byte [rcx + 0x1c], 1
je 0x140025fdd
cmp byte [rcx + 0x19], 2
jb 0x140025fdd
mov edx, 0x20b
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
mov rcx, qword [0x140183048]
mov r14, qword [rbp - 0x68]
jmp 0x140025b69
xor edx, edx
mov rcx, r14
call fcn.140105978
mov ebx, eax
test eax, eax
js 0x140027739
xor ebx, ebx
xor edi, edi
lea r9, [rbp + 0xd0]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x98]
mov rsi, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
jne 0x140026037
mov rcx, rsi
call fcn.14013f1f4
mov r13d, eax
jmp 0x140026048
mov rbx, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x98]
xor r13d, r13d
and qword [rbp + 0x30], 0
xor sil, sil
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswbengine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002616a
and dword [rbp - 0x28], eax
mov dword [rbp - 0x40], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400260da
mov eax, dword [rbp - 0x28]
shl rax, 0x14
test rax, rax
je 0x140026115
cmp rax, rdi
jae 0x140026115
mov rdi, rax
mov sil, 1
jmp 0x140026115
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026158
test byte [rcx + 0x1c], 1
je 0x140026123
cmp byte [rcx + 0x19], 5
jb 0x140026123
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026158
test byte [rcx + 0x1c], 1
je 0x140026158
cmp byte [rcx + 0x19], 4
jb 0x140026158
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.1400114e0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400261a5
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400261b3
test byte [rcx + 0x1c], 1
je 0x1400261b3
cmp byte [rcx + 0x19], 5
jb 0x1400261b3
mov edx, 0x20e
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
lea rax, [0x140183048]
mov rcx, qword [0x140183048]
test r13d, r13d
jns 0x1400261c5
mov byte [rsp + 0x70], 1
mov edi, r12d
jmp 0x140025fdd
cmp rcx, rax
je 0x1400261f3
test byte [rcx + 0x1c], 1
je 0x1400261f3
cmp byte [rcx + 0x19], 4
jb 0x1400261f3
mov edx, 0x20f
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004ff8
mov rcx, r14
call fcn.140105b24
test byte [r15 + 0x154], 2
je 0x1400263b7
mov r8, qword [rbp - 0x68]
mov eax, dword [r8 + 0xc]
mov r9, qword [rbp - 0x30]
cmp eax, dword [r9 + 0xc]
jne 0x140026242
mov bl, 1
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400262ad
test byte [rcx + 0x1c], bl
je 0x1400262ad
cmp byte [rcx + 0x19], 4
jb 0x1400262ad
mov edx, 0x210
jmp 0x14002628e
ja 0x140026264
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x30]
xor bl, bl
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400262b4
test byte [rcx + 0x1c], 1
je 0x1400262b4
cmp byte [rcx + 0x19], 4
jb 0x1400262b4
mov edx, 0x211
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r9 + 0xc]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.1400104d0
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
mov edx, 0x1400000
cmp rdi, rdx
ja 0x140026314
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x1400261bd
test byte [rcx + 0x1c], 1
je 0x1400261bd
cmp byte [rcx + 0x19], 3
jb 0x1400261bd
mov edx, 0x212
mov r9, rdi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010758
mov rcx, qword [0x140183048]
jmp 0x1400261bd
test sil, sil
jne 0x14002636f
mov r8d, 0x40000000
cmp rdi, r8
ja 0x14002636f
test bl, bl
je 0x14002636f
mov r13d, 0x80780080
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x1400261bd
test byte [rcx + 0x1c], 1
je 0x1400261bd
cmp byte [rcx + 0x19], 3
jb 0x1400261bd
mov edx, 0x213
mov qword [rsp + 0x20], r8
mov r9, rdi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004ff8
jmp 0x140026308
sub rdi, rdx
cmp rdi, 0x1100000
ja 0x1400263b7
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x70], 1
cmp rcx, rax
je 0x1400261bd
test byte [rcx + 0x1c], 1
je 0x1400261bd
cmp byte [rcx + 0x19], 3
jb 0x1400261bd
mov edx, 0x214
jmp 0x1400262f5
mov bl, 1
mov byte [rbp - 0x60], bl
test byte [r15 + 0x154], 4
je 0x1400263f2
mov r9d, dword [r15 + 0x174]
shl r9d, 4
add r9, qword [rbp + 0x10]
lea r8, [rbp - 0x60]
mov rdx, qword [rbp + 0x78]
mov rcx, r15
call fcn.14001f7e4
mov ebx, eax
test eax, eax
js 0x140027739
mov bl, byte [rbp - 0x60]
mov byte [rbp - 0x80], bl
lea rsi, [r15 + 0x58]
mov qword [rbp - 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
and qword [rcx], 0
and qword [rcx + 8], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400264a9
test byte [rcx + 0x1c], 1
je 0x14002647e
cmp byte [rcx + 0x19], 4
jb 0x14002647e
mov edx, 0x215
mov r9, rdi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010758
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400264a9
test byte [rcx + 0x1c], 1
je 0x1400264a9
cmp byte [rcx + 0x19], 4
jb 0x1400264a9
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0x9c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
test byte [r15 + 0x154], 2
je 0x14002657b
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x1400264f7
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
cmp dword [r15 + 0x150], 4
sete r8b
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r15
lea rax, [0x140020d40]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x48]
call fcn.1400c202c
mov r12d, eax
jmp 0x140026a66
and qword [rbp - 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
cmp byte [rbp - 0x80], 0
jne 0x140026635
xor edx, edx
mov rcx, r14
call fcn.140105978
mov ebx, eax
test eax, eax
js 0x140027739
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call fcn.140096f88
mov bl, al
mov rcx, r14
call fcn.140105b24
test bl, bl
je 0x140026635
mov dword [rbp + 0xa8], 2
lea r8, [rbp + 0xa8]
mov rdx, rsi
mov rcx, r14
call fcn.14012a2b4
test eax, eax
jns 0x140026635
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400261bd
test byte [rcx + 0x1c], 1
je 0x1400261bd
cmp byte [rcx + 0x19], 2
jb 0x1400261bd
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
jmp 0x140026308
lea r9, [rbp - 0x40]
mov r8, qword [rbp + 0x58]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r15
call fcn.140023220
test eax, eax
jns 0x140026666
mov r13d, eax
mov edi, r12d
mov rcx, qword [0x140183048]
mov r14, qword [rbp - 0x68]
jmp 0x140027265
xor edx, edx
mov rcx, r14
call fcn.140105978
mov ebx, eax
test eax, eax
js 0x140027739
lea rdx, [rbp + 0x18]
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call fcn.140126348
mov ebx, eax
mov rcx, r14
call fcn.140105b24
test ebx, ebx
jns 0x1400266e5
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400266da
test byte [rcx + 0x1c], 1
je 0x1400266da
cmp byte [rcx + 0x19], 2
jb 0x1400266da
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
mov rcx, qword [0x140183048]
mov r13d, ebx
mov edi, r12d
jmp 0x14002665d
movups xmm0, xmmword [rbp + 0xb0]
movdqu xmmword [rbp + 0xe0], xmm0
mov ecx, dword [r15 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x58], rax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rdi, qword [rbp + 0x18]
mov qword [rsp + 0x38], rdi
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r15
lea rdx, [0x140020d40]
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call fcn.1400c3c78
mov r12d, eax
test eax, eax
jne 0x140026895
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
jne 0x1400267f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400267d8
test byte [rcx + 0x1c], 1
je 0x1400267d8
cmp byte [rcx + 0x19], 2
jb 0x1400267d8
mov edx, 0x219
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
mov rcx, qword [0x140183048]
mov eax, dword [rsp + 0x74]
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x14002665d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
test eax, eax
je 0x140026837
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400267d8
test byte [rcx + 0x1c], 1
je 0x1400267d8
cmp byte [rcx + 0x19], 2
jb 0x1400267d8
mov edx, 0x21a
jmp 0x1400267be
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002688f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x74], eax
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400267d8
test byte [rcx + 0x1c], 1
je 0x1400267d8
cmp byte [rcx + 0x19], 2
jb 0x1400267d8
mov edx, 0x21b
jmp 0x1400267be
xor edi, edi
mov qword [rbp + 0x18], rdi
mov r15, qword [0x140183048]
lea rdi, [0x140183048]
cmp r15, rdi
je 0x140026969
test byte [r15 + 0x1c], 4
je 0x140026969
cmp byte [r15 + 0x19], 4
jb 0x140026969
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + 0x138]
lea r8, [0x14015d600]
mov rcx, qword [r15 + 0x10]
call fcn.140010520
mov rbx, qword [rbp - 0x48]
lea rdi, [0x140183048]
test rbx, rbx
jne 0x140026986
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008f4c8
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r15, qword [0x140183048]
cmp r15, rdi
je 0x140026a54
test byte [r15 + 0x1c], 4
je 0x140026a54
cmp byte [r15 + 0x19], 4
jb 0x140026a54
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + 0x148]
lea r8, [0x14015d600]
mov rcx, qword [r15 + 0x10]
call fcn.140010520
mov byte [rbp - 0x54], 1
mov bl, byte [rbp - 0x60]
mov rsi, qword [rbp - 0x28]
mov r15, qword [rbp + 0xa0]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r15 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov r10, qword [0x140183048]
lea rax, [0x140183048]
cmp r10, rax
je 0x140026b1f
test byte [r10 + 0x1c], 1
je 0x140026b1f
cmp byte [r10 + 0x19], 4
jb 0x140026b1f
mov eax, dword [r15 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r15 + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x68], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x6c], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x60], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x60]
sub rcx, qword [rbp + 0x68]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x14015d600]
mov rcx, qword [r10 + 0x10]
call fcn.140010758
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, qword [rbp - 0x78]
cmp byte [rbp - 0x5f], r14b
je 0x140026b54
mov byte [rdi + 0x84], 1
cmp byte [rbp - 0x80], r14b
jne 0x140026b54
lea edx, [r14 + 0x10]
mov rcx, rdi
call fcn.140012fa8
test bl, bl
jne 0x140026ba4
cmp byte [rbp - 0x80], r14b
je 0x140026ba4
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026b92
test byte [rcx + 0x1c], 1
je 0x140026b92
cmp byte [rcx + 0x19], 4
jb 0x140026b92
mov edx, 0x21f
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e50
mov rax, qword [r15 + 0x188]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r14d
mov byte [rbp - 0x5e], 1
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r15 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbp - 8]
mov rdi, qword [rbp - 0x68]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp]
mov qword [rdi + 0x18], rax
mov ecx, r12d
test r12d, r12d
je 0x14002703e
sub ecx, 1
je 0x140027016
sub ecx, 3
je 0x140026f74
sub ecx, 1
je 0x140026ee1
sub ecx, 1
je 0x140026f74
sub ecx, 1
je 0x140026d0e
cmp ecx, 0xd
je 0x140026cac
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026c91
test byte [rcx + 0x1c], 1
je 0x140026c91
cmp byte [rcx + 0x19], 2
jb 0x140026c91
mov edx, 0x227
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.14010866c
mov r13d, eax
mov edi, dword [rbp - 0x58]
jmp 0x140025fd6
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026cf5
test byte [rcx + 0x1c], 1
je 0x140026cf5
cmp byte [rcx + 0x19], 2
jb 0x140026cf5
mov edx, 0x222
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 0x14
call fcn.14010866c
mov byte [rsp + 0x70], 1
jmp 0x140026ca1
mov rcx, qword [0x140183048]
lea rbx, [0x140183048]
cmp rcx, rbx
je 0x140026d57
test byte [rcx + 0x1c], 1
je 0x140026d57
cmp byte [rcx + 0x19], 2
jb 0x140026d57
mov edx, 0x223
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 7
call fcn.14010866c
mov r13d, eax
mov byte [rbp - 0x5e], r14b
cmp eax, 0x8078002a
jne 0x140026ec0
cmp dword [rsp + 0x74], 0x70
jne 0x140026eba
mov rcx, qword [0x140183048]
cmp rcx, rbx
je 0x140026dbc
test byte [rcx + 0x1c], 1
je 0x140026dbc
mov r12, qword [rbp + 8]
cmp byte [rcx + 0x19], 4
jb 0x140026dc0
mov edx, 0x224
mov r9, r12
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
jmp 0x140026dc0
mov r12, qword [rbp + 8]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x40], r14d
mov r14d, dword [rbp - 0x58]
test r14d, r14d
je 0x140026de9
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400c19a0
test eax, eax
jne 0x140026ecd
mov rbx, qword [rbp - 0x28]
mov rdx, rbx
cmp byte [r15 + 0x428], al
je 0x140026e20
mov rcx, qword [r15 + 0x158]
call fcn.14011f488
jmp 0x140026e28
mov rcx, r15
call fcn.14001c858
test eax, eax
js 0x140026e89
xor r13d, r13d
mov byte [rbp - 0x7e], 1
lea edi, [r14 + 1]
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140025fdd
test byte [rcx + 0x1c], 1
je 0x140025fdd
cmp byte [rcx + 0x19], 4
jb 0x140025fdd
mov edx, 0x225
mov qword [rsp + 0x20], r12
mov rbx, qword [rsp + 0x78]
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140006004
jmp 0x140026f60
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x140026ed4
test byte [rcx + 0x1c], 1
je 0x140026ed4
cmp byte [rcx + 0x19], 2
jb 0x140026ed4
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14001079c
jmp 0x140026ec4
mov r14d, dword [rbp - 0x58]
jmp 0x140026ecd
mov r14d, dword [rbp - 0x58]
test r13d, r13d
jns 0x140027042
mov rcx, qword [0x140183048]
mov byte [rsp + 0x70], 1
mov edi, r14d
jmp 0x140025fdd
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026f2f
test byte [rcx + 0x1c], 1
je 0x140026f2f
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026f34
mov edx, 0x221
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 5
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
jmp 0x140026f34
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, 5
call fcn.14010866c
mov r13d, eax
cmp dword [rbp - 0x5c], r14d
jne 0x140026f58
mov dword [rbp - 0x5c], eax
mov r13d, 0x80780166
mov byte [rsp + 0x70], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x140183048]
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
jmp 0x14002726a
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140026fbf
test byte [rcx + 0x1c], 1
je 0x140026fbf
mov rbx, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026fc4
mov edx, 0x220
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140010c84
jmp 0x140026fc4
mov rbx, qword [rsp + 0x78]
lea r8, [rbp - 0x5c]
mov edx, dword [rsp + 0x74]
mov ecx, r12d
call fcn.14010866c
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x140026fff
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140024fd4
test eax, eax
js 0x140026fff
cmp byte [rbp - 0x70], r14b
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x7f], 1
mov edi, dword [rbp - 0x58]
mov rcx, qword [0x140183048]
mov r14, qword [rbp - 0x68]
jmp 0x14002726a
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005df3.0]
test al, al
mov r13d, 0x80780167
jne 0x140026ca4
mov r13d, dword [r15 + 0x20]
jmp 0x140026ca4
mov r14d, dword [rbp - 0x58]
lea rbx, [r15 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov r12, qword [rbp - 0x78]
inc dword [r12 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r12 + 0x10]
mov dword [rdi + 0x28], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
inc dword [r15 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [r15 + 0xe4]
mov dword [rdi + 0xc], eax
mov eax, dword [r15 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0xf0]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r15 + 0x154], 2
jne 0x1400270ef
mov rcx, r12
call fcn.140014648
test eax, eax
jns 0x1400270ef
mov r8d, eax
mov edx, 0x80780151
mov rsi, r12
mov rcx, r12
call fcn.140012f38
mov edi, r14d
jmp 0x140026656
cmp byte [rbp - 0x54], 0
jne 0x140027141
mov rax, qword [rbp - 0x10]
cmp qword [rdi + 0x38], rax
je 0x140027117
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
and qword [rdi + 0x38], 0
and dword [rdi + 0x40], 0
mov r13d, 0x80780030
mov byte [rsp + 0x70], 1
mov edi, r14d
mov rcx, qword [0x140183048]
mov r14, qword [rbp - 0x68]
mov rsi, r12
jmp 0x140027265
and qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
call fcn.1400ca148
test eax, eax
je 0x14002716f
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x1400271b9
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400271b9
test byte [rcx + 0x1c], 1
je 0x1400271b9
cmp byte [rcx + 0x19], 2
jb 0x1400271b9
mov edx, 0x228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.1400114e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [r12 + 0x28], rbx
mov rcx, qword [r12 + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test rbx, rbx
jle 0x140027212
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, r12
call fcn.140012f38
mov ebx, 0xe
mov edx, ebx
mov rcx, r12
call fcn.140013098
mov edx, ebx
mov rcx, rdi
call fcn.140014d58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov edi, r14d
mov rsi, r12
test byte [r15 + 0x154], 2
jne 0x140026656
mov rdx, r12
mov rcx, r15
call fcn.14002f3e8
jmp 0x140026656
mov rcx, qword [0x140183048]
mov rbx, qword [rsp + 0x78]
mov r12, qword [rbp + 0x18]
test r12, r12
je 0x14002732a
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
nop dword [rax + rax]
test eax, eax
je 0x1400272c6
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x1400272c6
test byte [rcx + 0x1c], 1
je 0x1400272c6
cmp byte [rcx + 0x19], 3
jb 0x1400272c6
mov edx, 0x229
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14002731c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x140027323
test byte [rcx + 0x1c], 1
je 0x140027323
cmp byte [rcx + 0x19], 3
jb 0x140027323
mov edx, 0x22a
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
mov rcx, qword [0x140183048]
xor r12d, r12d
mov qword [rbp + 0x18], r12
cmp r13d, 0x80780030
je 0x14002734b
cmp r13d, 0x8078002a
jne 0x140027416
cmp dword [rsp + 0x74], 0x70
jne 0x14002743a
test byte [r15 + 0x154], 2
jne 0x14002739a
mov rcx, rsi
call fcn.140014648
test eax, eax
jns 0x14002739a
mov rcx, qword [0x140183048]
lea r12, [0x140183048]
cmp rcx, r12
je 0x1400273a1
test byte [rcx + 0x1c], 1
je 0x1400273a1
cmp byte [rcx + 0x19], 3
jb 0x1400273a1
mov edx, 0x22b
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
jmp 0x1400273a1
lea r12, [0x140183048]
lea rax, [0x1400e7560]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x188]
mov edx, dword [r15 + 0x150]
mov rcx, qword [r15 + 0x158]
call fcn.140116f7c
test eax, eax
jns 0x14002740f
mov rcx, qword [0x140183048]
cmp rcx, r12
je 0x140027416
test byte [rcx + 0x1c], 1
je 0x140027416
cmp byte [rcx + 0x19], 2
jb 0x140027416
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r15 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r15 + 0x158]
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.1400060c0
mov rcx, qword [0x140183048]
cmp r13d, 0x80780030
jne 0x14002743a
test byte [r15 + 0x154], 2
je 0x14002743a
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0xc]
cmp dword [r14 + 0xc], eax
ja 0x1400275f4
mov r12, qword [rsp + 0x78]
mov rbx, r12
cmp qword [rsi + 0x58], 0
cmovne rbx, qword [rsi + 0x58]
test r13d, r13d
jns 0x140027536
mov edx, 0xc
mov rcx, r14
call fcn.140014d58
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x14002749e
test byte [rcx + 0x1c], 1
je 0x14002749e
cmp byte [rcx + 0x19], 2
jb 0x14002749e
mov edx, 0x22e
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call fcn.140035a98
mov ebx, eax
test eax, eax
jns 0x1400274f3
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400274f1
test byte [rcx + 0x1c], 1
je 0x1400274f1
cmp byte [rcx + 0x19], 3
jb 0x1400274f1
mov edx, 0x22f
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
xor ebx, ebx
mov r8d, dword [rbp - 0x5c]
mov edx, r13d
mov rcx, rsi
call fcn.140013194
xor eax, eax
cmp byte [rbp - 0x7f], al
je 0x14002751b
cmp byte [rbp - 0x53], al
je 0x1400275b2
cmp byte [rsi + 0x68], al
je 0x1400275b2
mov al, byte [rsp + 0x70]
mov rcx, qword [rbp + 0x28]
mov byte [rcx], al
mov eax, dword [rbp - 0x5c]
mov rcx, qword [rbp + 0x70]
mov dword [rcx], eax
mov ebx, r13d
jmp 0x140027742
lea rsi, [0x140183048]
cmp rcx, rsi
je 0x140027566
test byte [rcx + 0x1c], 1
je 0x140027566
cmp byte [rcx + 0x19], 4
jb 0x140027566
mov edx, 0x230
mov r9, r12
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r15
call fcn.140035a98
mov ebx, eax
test eax, eax
jns 0x1400275b2
mov rcx, qword [0x140183048]
cmp rcx, rsi
je 0x1400275b2
test byte [rcx + 0x1c], 1
je 0x1400275b2
cmp byte [rcx + 0x19], 3
jb 0x1400275b2
mov edx, 0x231
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f80
mov ecx, dword [r14 + 8]
cmp byte [rbp - 0x7e], 0
jne 0x1400275c2
inc ecx
mov dword [r14 + 8], ecx
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x28], eax
mov dword [r14 + 0x2c], 0xf
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rax
mov dword [r14 + 0x40], eax
mov esi, ecx
mov r12d, dword [rbp - 0x50]
cmp ecx, r12d
jae 0x14002763c
jmp 0x1400254ab
mov edx, 4
mov rcx, r14
call fcn.140014d58
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140027638
test byte [rcx + 0x1c], 1
je 0x140027638
cmp byte [rcx + 0x19], 4
jb 0x140027638
mov edx, 0x22d
mov r9, rbx
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140005f10
mov r12d, dword [rbp - 0x50]
mov r13, qword [rbp - 0x30]
mov rdx, qword [rbp + 0x28]
mov rcx, r15
call fcn.140021818
mov ebx, eax
test eax, eax
js 0x140027742
lea rcx, [r15 + 0x28]
xor edx, edx
call fcn.140105978
mov ebx, eax
test eax, eax
js 0x140027742
mov r14d, dword [r13 + 0xc]
xor edi, edi
test r12d, r12d
je 0x140027717
xor esi, esi
mov r13, qword [rbp + 0x20]
mov ecx, edi
mov edx, edi
shl rdx, 4
add rdx, r13
mov rax, qword [rdx]
cmp rax, qword [0x140162618]
jne 0x1400276a4
mov rax, qword [rdx + 8]
cmp rax, qword [0x140162620]
je 0x140027705
mov r11, qword [r15 + 0xd8]
imul r8, rcx, 0x170
lea r10, [r11 + 0x78]
add r10, r8
mov ecx, edi
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea r9, [r11 + 0x44]
add r9, r8
mov eax, dword [r11 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rcx
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x28], rax
mov eax, dword [r11 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r15
call fcn.14001fbb4
mov ebx, eax
inc r14d
test eax, eax
js 0x140027739
inc edi
add rsi, 0x170
cmp edi, r12d
jb 0x140027680
mov rax, qword [rbp - 0x68]
cmp r14d, dword [rax + 0xc]
je 0x14002773f
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008f4c8
mov r14, qword [rbp - 0x68]
jmp 0x140027742
mov r14, rax
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x14002775a
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov r13, qword [rbp - 0x30]
mov r12, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140027787
cmp rcx, qword [r14 + 0x38]
je 0x140027787
cmp rcx, qword [r13 + 0x38]
je 0x140027787
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x1400277a0
cmp rsi, qword [r14 + 0x30]
je 0x1400277a0
cmp rsi, qword [r13 + 0x30]
je 0x1400277a0
mov rcx, rsi
call fcn.1400c8f88
test r12, r12
je 0x1400277b4
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x1400277cc
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x1400277e4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
test rax, rax
je 0x1400277fc
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rdi, [r15 + 0x28]
mov rcx, rdi
call fcn.140105b24
test ebx, ebx
jns 0x140027902
mov rcx, qword [0x140183048]
lea rsi, [0x140183048]
cmp rcx, rsi
je 0x140027860
test byte [rcx + 0x1c], 1
je 0x140027860
cmp byte [rcx + 0x19], 2
jb 0x140027860
lea r8, [0x14015d5c8]
lea rax, [0x14015c8e8]
mov rdx, qword [rbp + 0x28]
cmp byte [rdx], 0
cmovne rax, r8
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.14001095c
mov rcx, qword [0x140183048]
cmp byte [rbp - 0x5e], 0
jne 0x140027910
test byte [r15 + 0x154], 4
je 0x140027910
xor edx, edx
mov rcx, rdi
call fcn.140105978
test eax, eax
jns 0x1400278bc
mov rcx, qword [0x140183048]
cmp rcx, rsi
je 0x140027936
test byte [rcx + 0x1c], 1
je 0x140027910
cmp byte [rcx + 0x19], 2
jb 0x140027910
mov edx, 0x233
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
jmp 0x140027909
mov rcx, r15
call fcn.14001d72c
test eax, eax
jns 0x1400278f8
mov rcx, qword [0x140183048]
cmp rcx, rsi
je 0x1400278f8
test byte [rcx + 0x1c], 1
je 0x1400278f8
cmp byte [rcx + 0x19], 2
jb 0x1400278f8
mov edx, 0x234
mov r9d, eax
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e7c
mov rcx, rdi
call fcn.140105b24
jmp 0x140027909
lea rsi, [0x140183048]
mov rcx, qword [0x140183048]
cmp rcx, rsi
je 0x140027936
test byte [rcx + 0x1c], 1
je 0x140027936
cmp byte [rcx + 0x19], 4
jb 0x140027936
mov edx, 0x235
lea r8, [0x14015d600]
mov rcx, qword [rcx + 0x10]
call fcn.140004e50
mov eax, ebx
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1401534b0
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret