Function at 0x1400235b8
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov edi, r9d
mov dword [rbp - 0x28], r9d
mov qword [rbp + 0xd8], r8
mov qword [rbp + 0x118], rdx
mov r13, rcx
mov qword [rbp - 0x20], rcx
mov r15, qword [rbp + 0x200]
mov qword [rbp - 0x30], r15
mov r12, qword [rbp + 0x208]
mov qword [rbp - 0x60], r12
mov rax, qword [rbp + 0x210]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x110], rax
xor ecx, ecx
mov dword [rbp - 0x18], ecx
mov dword [rbp - 0x68], ecx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0xe0], rcx
mov r14d, ecx
mov qword [rbp - 0x38], rcx
mov ebx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 8], rcx
mov dword [rsp + 0x70], ecx
mov qword [rbp - 0x10], rcx
mov byte [rbp - 0x6c], cl
mov byte [rbp - 0x7f], cl
mov byte [rbp - 0x6d], cl
mov esi, ecx
mov byte [rbp - 0x57], cl
mov byte [rbp - 0x70], cl
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x38], rcx
lea rax, [0x14016d090]
mov rcx, qword [0x14016d090]
cmp rcx, rax
je 0x1400236bf
test byte [rcx + 0x1c], 1
je 0x1400236bf
cmp byte [rcx + 0x19], 4
jb 0x1400236bf
mov edx, 0x1fc
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
cmp edi, dword [r13 + 0x170]
je 0x1400236e0
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov rax, qword [rbp - 0x50]
mov byte [rax], bl
mov rax, qword [rbp + 0x110]
and dword [rax], ebx
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe0]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe0]
mov dword [r12 + 0x10], eax
lea rcx, [rbp - 0x57]
call fcn.14008b860
mov edi, eax
test eax, eax
jns 0x14002376d
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025b58
test byte [rcx + 0x1c], 1
je 0x140025b58
cmp byte [rcx + 0x19], 2
jb 0x140025b58
mov edx, 0x1fd
mov r9d, edi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
jmp 0x140025b58
lea r8, [rbp + 8]
lea rdx, [0x1401447d4]
mov rcx, qword [r13 + 0x158]
call fcn.1400829d8
mov edi, eax
test eax, eax
js 0x140025b58
mov ebx, dword [rbp - 0x28]
shl rbx, 4
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x1400237b5
mov edi, 0x8007000e
mov rbx, qword [rbp - 0x48]
jmp 0x140025b58
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x28]
shl eax, 4
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400237a7
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x28]
cmp dword [r12 + 8], eax
jae 0x140025a33
mov byte [rsp + 0x74], 0
mov byte [rbp - 0x80], 0
neg byte [rbp - 0x7f]
sbb eax, eax
and eax, esi
mov esi, eax
mov dword [rbp + 0x84], eax
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x7c], eax
mov dword [rbp + 0xc8], eax
mov dword [rbp + 0x18], eax
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0xc4], eax
mov dword [rbp + 4], eax
mov dword [rbp + 0x70], eax
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x20], eax
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xbc], eax
mov dword [rbp + 0xb8], eax
mov dword [rbp + 0xb4], eax
mov dword [rbp + 0x74], eax
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0x50], eax
mov dword [rbp + 0xac], eax
mov dword [rbp + 0xa8], eax
mov dword [rbp + 0xa4], eax
mov dword [rbp + 0x9c], eax
mov dword [rbp + 0x94], eax
mov dword [rbp + 0x78], eax
mov dword [rbp + 0x80], eax
mov dword [rbp + 0x8c], eax
mov dword [rbp + 0x90], eax
mov r13d, eax
mov r12d, eax
mov r14d, eax
mov byte [rbp - 0x7f], 0
mov rax, qword [rbp - 0x60]
mov ebx, dword [rax + 8]
imul rax, rbx, 0x170
mov r15, qword [rbp - 0x20]
add rax, qword [r15 + 0xd8]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0xd8]
mov rax, qword [rax + rbx*8]
mov qword [rsp + 0x78], rax
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r15 + 0x174], ebx
lea rcx, [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0x170]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov rdx, qword [rbp - 0x78]
test byte [rdx + 0x54], 1
je 0x140023926
mov rbx, qword [rbp - 0x60]
mov ecx, dword [rbx + 8]
lea rdx, [rbp - 0x38]
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rax + rcx*8]
call fcn.1400827b0
mov r15d, eax
test eax, eax
js 0x140025641
jmp 0x140023a67
xor ebx, ebx
mov rcx, qword [r15 + 0x1b0]
cmp dword [rcx + 0x50], ebx
jbe 0x140023970
mov r13, qword [rsp + 0x78]
mov eax, ebx
imul r12, rax, 0x38
add r12, qword [rcx + 0x58]
mov qword [rbp + 0xe0], r12
mov rdx, r13
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002396a
inc ebx
mov rcx, qword [r15 + 0x1b0]
cmp ebx, dword [rcx + 0x50]
jb 0x140023939
mov r12d, esi
mov r13d, esi
mov rax, qword [r15 + 0x1b0]
cmp ebx, dword [rax + 0x50]
jne 0x1400239d8
mov rdi, qword [rbp - 0x78]
mov r15d, dword [rdi + 0x20]
test r15d, r15d
js 0x1400239c8
mov r15d, 0x80780020
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400239cf
test byte [rcx + 0x1c], 1
je 0x1400239cf
cmp byte [rcx + 0x19], 2
jb 0x1400239cf
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
mov rcx, qword [0x14016d090]
mov byte [rbp - 0x80], 1
jmp 0x14002564c
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x1400239f0
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140023a4f
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023a40
test byte [rcx + 0x1c], 1
je 0x140023a40
cmp byte [rcx + 0x19], 2
jb 0x140023a40
mov edx, 0x1ff
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
mov rcx, qword [0x14016d090]
mov r15d, 0x80780020
mov byte [rbp - 0x80], 1
jmp 0x140025648
lea rdx, [rbp - 0x38]
call fcn.1400827b0
mov r15d, eax
test eax, eax
js 0x140025641
mov rbx, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 0x40
je 0x140023adc
mov rdx, rsi
mov r13, qword [rbp - 0x20]
mov rcx, r13
call fcn.140022078
mov edi, eax
test eax, eax
js 0x140025b30
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe4]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe4]
mov r12, qword [rbp - 0x60]
mov dword [r12 + 0xc], eax
mov eax, dword [r13 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0x170]
mov rcx, qword [rbp + 0x40]
movdqu xmmword [rcx + rax*8], xmm0
inc dword [r12 + 8]
mov esi, r14d
jmp 0x1400259bc
mov r14d, 8
test byte [rsi + 0x54], r14b
jne 0x140023b8b
test byte [rsi + 0x54], 0x20
jne 0x140023b0a
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov rax, qword [0x14016d090]
lea rcx, [0x14016d090]
cmp rax, rcx
je 0x140023b5e
test byte [rax + 0x1c], 1
je 0x140023b5e
cmp byte [rax + 0x19], 4
jb 0x140023b5e
lea rdx, [rsi + 0x44]
lea rcx, [rbp + 0x120]
call fcn.14000f5e4
nop
or dword [rbp - 0x18], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x140147170]
mov rcx, qword [0x14016d090]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
nop
mov eax, dword [rbp - 0x18]
test al, 1
je 0x140023b78
and eax, 0xfffffffe
mov dword [rbp - 0x18], eax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [rbx + 8]
mov esi, r12d
mov r13, qword [rbp - 0x20]
mov r12, qword [rbp - 0x60]
jmp 0x1400259bc
mov r8b, 1
mov edx, r14d
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.14002b90c
mov r12, qword [rbp - 0x60]
mov dword [r12 + 0x2c], r14d
mov r14, qword [rbp - 0x30]
mov eax, dword [r14 + 8]
cmp dword [r12 + 8], eax
jne 0x140023bcd
cmp qword [r14 + 0x30], 0
je 0x140023bcd
mov rbx, qword [r14 + 0x30]
mov qword [rbp - 0x48], rbx
mov r13, qword [rbp - 0x20]
jmp 0x140024182
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140023beb
cmp rax, qword [r12 + 0x30]
je 0x140023beb
cmp rax, qword [r14 + 0x30]
je 0x140023beb
mov rcx, rax
call fcn.1400b9088
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x60], rax
test byte [rsi + 0x54], 1
je 0x140023c57
mov rcx, rbx
call fcn.14002c94c
mov r15d, eax
test eax, eax
jns 0x140023c57
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023c48
test byte [rcx + 0x1c], 1
je 0x140023c48
cmp byte [rcx + 0x19], 2
jb 0x140023c48
mov edx, 0x201
mov r9d, edi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, qword [0x14016d090]
mov esi, r13d
mov r13, rbx
mov rdi, qword [rbp - 0x78]
jmp 0x140025654
mov r13, rbx
lea r14, [rbx + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x174]
imul rcx, rax, 0x170
add rcx, qword [rbx + 0xd8]
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [rbx + 0x154], 0x10
jne 0x140023cc0
cmp byte [rbx + 0x17c], dil
jne 0x140023ca8
cmp byte [rbx + 0x17d], dil
je 0x140023cc0
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023d04
test byte [rcx + 0x1c], 1
je 0x140023d04
mov rbx, qword [rbp - 0x38]
cmp byte [rcx + 0x19], 4
jb 0x140023d08
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000593c
jmp 0x140023d08
mov rbx, qword [rbp - 0x38]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r13 + 0xd8]
add rax, 0x8c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [r13 + 0x154]
test al, 2
je 0x140023d8c
shr eax, 4
and al, 1
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x128]
mov qword [rsp + 0x38], rcx
mov r9b, byte [r13 + 0x17d]
mov r8b, byte [r13 + 0x17c]
mov dl, al
mov rcx, rbx
call fcn.1400b1628
mov esi, eax
jmp 0x140023e89
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], dil
xor r9d, r9d
mov r8b, byte [r13 + 0x17d]
mov dl, byte [r13 + 0x17c]
mov rcx, rbx
call fcn.1400b1800
mov esi, eax
test eax, eax
jne 0x140023e89
mov rbx, qword [rbp + 0x60]
mov qword [rbp - 0x48], rbx
test rbx, rbx
jne 0x140023e16
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.140081b60
cmp byte [rbx + 0xb8], dil
je 0x140023e63
mov edx, 0x2000
mov rcx, qword [rbp - 0x78]
call fcn.140011e94
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023e91
test byte [rcx + 0x1c], 1
je 0x140023e91
cmp byte [rcx + 0x19], 4
jb 0x140023e91
mov edx, 0x203
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
jmp 0x140023e91
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140023e91
test byte [rcx + 0x1c], 1
je 0x140023e91
cmp byte [rcx + 0x19], 4
jb 0x140023e91
mov edx, 0x204
jmp 0x140023e51
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x48], rax
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r13 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x14016d090]
lea rax, [0x14016d090]
cmp r10, rax
je 0x140023f62
test byte [r10 + 0x1c], 1
je 0x140023f62
cmp byte [r10 + 0x19], 4
jb 0x140023f62
mov eax, dword [r13 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r13 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0xf0], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0xf4], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0xe8], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0xec], eax
mov rcx, qword [rbp + 0xe8]
sub rcx, qword [rbp + 0xf0]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x140147170]
mov rcx, qword [r10 + 0x10]
call fcn.14000f8a4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
mov rdi, qword [rbp + 0x28]
mov qword [rcx], rdi
mov rbx, qword [rbp + 0x30]
mov qword [rcx + 8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [r12 + 0x20], rbx
mov qword [r12 + 0x18], rdi
mov ecx, esi
test esi, esi
je 0x140024176
sub ecx, 1
je 0x14002414f
sub ecx, 3
je 0x1400240b6
sub ecx, 1
je 0x140024051
sub ecx, 1
je 0x1400240b6
sub ecx, 1
je 0x140024051
sub ecx, 0xf
je 0x1400240b6
cmp ecx, 9
je 0x1400240b6
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x14002402e
test byte [rcx + 0x1c], 1
je 0x14002402e
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140024032
mov edx, 0x208
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x140024032
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, esi
call fcn.1400f6d50
mov esi, dword [rbp + 0x78]
mov r15d, eax
mov rcx, qword [0x14016d090]
jmp 0x140023c4e
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024098
test byte [rcx + 0x1c], 1
je 0x140024098
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14002409c
mov edx, 0x207
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x14002409c
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, esi
call fcn.1400f6d50
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 0x80]
jmp 0x140024042
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400240fd
test byte [rcx + 0x1c], 1
je 0x1400240fd
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140024101
mov edx, 0x206
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x140024101
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, esi
call fcn.1400f6d50
mov r15d, eax
mov rdi, qword [rbp - 0x78]
test byte [rdi + 0x54], 1
jne 0x140024139
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140023358
test eax, eax
js 0x140024139
cmp byte [rbp - 0x70], 0
mov eax, 0x80780169
cmove r15d, eax
mov byte [rbp - 0x80], 1
mov esi, dword [rbp + 0x8c]
mov rcx, qword [0x14016d090]
jmp 0x140025654
lea rcx, [r13 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005783.0]
test al, al
mov eax, 0x80780167
cmovne r15d, eax
mov esi, dword [rbp + 0x90]
jmp 0x140024045
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x48]
mov r14, qword [rbp - 0x30]
mov qword [r12 + 0x30], rbx
mov eax, dword [r14 + 8]
cmp dword [r12 + 8], eax
jne 0x1400241c0
cmp qword [r14 + 0x30], 0
jne 0x1400241a3
test byte [rsi + 0x54], 1
jne 0x1400241a3
mov qword [r14 + 0x30], rbx
cmp dword [r12 + 8], eax
jne 0x1400241c0
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400241c0
mov qword [rbp - 8], rcx
mov edx, dword [r14 + 0x40]
jmp 0x14002427e
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400241dc
cmp rcx, qword [r12 + 0x38]
je 0x1400241dc
cmp rcx, qword [r14 + 0x38]
je 0x1400241dc
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
mov qword [rbp - 8], rcx
xor edx, edx
mov dword [rbp - 0x40], edx
test byte [r13 + 0x154], 2
je 0x14002427e
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.1400b55b8
mov ebx, eax
test eax, eax
je 0x140024273
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024257
test byte [rcx + 0x1c], 1
je 0x140024257
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14002425b
mov edx, 0x209
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x14002425b
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, ebx
call fcn.1400f6d50
mov esi, dword [rbp + 0x94]
jmp 0x140024042
mov rcx, qword [rbp - 8]
mov edx, dword [rbp - 0x40]
mov rbx, qword [rbp - 0x48]
mov qword [r12 + 0x38], rcx
mov dword [r12 + 0x40], edx
mov eax, dword [r14 + 8]
mov rdi, qword [rbp - 0x78]
cmp dword [r12 + 8], eax
jne 0x1400242ac
cmp qword [r14 + 0x38], 0
jne 0x1400242ac
test byte [rdi + 0x54], 1
jne 0x1400242ac
mov qword [r14 + 0x38], rcx
mov dword [r14 + 0x40], edx
mov r8b, 1
mov esi, 9
mov edx, esi
mov rcx, r13
call fcn.14002b90c
mov edx, esi
mov rcx, r12
call fcn.140013ab4
test byte [r13 + 0x154], 2
je 0x14002434c
lea r9, [rsp + 0x70]
mov rdx, qword [rbp - 8]
mov rcx, rbx
call fcn.1400b5770
mov ebx, eax
test eax, eax
je 0x14002434c
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024330
test byte [rcx + 0x1c], 1
je 0x140024330
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140024334
mov edx, 0x20a
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x140024334
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, ebx
call fcn.1400f6d50
mov esi, dword [rbp + 0x9c]
jmp 0x140024042
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140024363
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp - 0x10], 0
lea rdx, [rdi + 0x44]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rdi + 0x54]
mov rcx, qword [r13 + 0x1d8]
call fcn.140107594
mov r15d, eax
mov esi, dword [rbp + 0xa0]
test eax, eax
js 0x140024143
lea r14, [r13 + 0x28]
mov rcx, r14
call fcn.1400f44d0
mov rbx, qword [rbp - 0x10]
mov rdx, rbx
mov rcx, r13
call fcn.14001f724
mov r15d, eax
test eax, eax
jns 0x140024413
mov byte [rsp + 0x74], 1
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025654
test byte [rcx + 0x1c], 1
je 0x140025654
cmp byte [rcx + 0x19], 2
jb 0x140025654
mov edx, 0x20b
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
mov rcx, qword [0x14016d090]
jmp 0x140025654
xor edx, edx
mov rcx, r14
call fcn.1400f4344
mov edi, eax
test eax, eax
js 0x140025b30
xor ebx, ebx
xor esi, esi
lea r9, [rbp + 0x148]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x138]
mov rdi, qword [rbp + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x14002445e
mov rcx, rdi
call fcn.14012a050
mov r15d, eax
jmp 0x14002446f
mov rbx, qword [rbp + 0x130]
mov rsi, qword [rbp + 0x138]
xor r15d, r15d
and qword [rbp + 0xd0], 0
xor dil, dil
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswbengine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024584
and dword [rbp - 0x40], eax
mov dword [rbp], 4
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400244fe
mov eax, dword [rbp - 0x40]
shl rax, 0x14
test rax, rax
je 0x140024539
cmp rax, rsi
jae 0x140024539
mov rsi, rax
mov dil, 1
jmp 0x140024539
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024575
test byte [rcx + 0x1c], 1
je 0x140024547
cmp byte [rcx + 0x19], 5
jb 0x140024547
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024575
test byte [rcx + 0x1c], 1
je 0x140024575
cmp byte [rcx + 0x19], 4
jb 0x140024575
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rcx, qword [rcx + 0x10]
call fcn.14001051c
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400245bf
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400245cd
test byte [rcx + 0x1c], 1
je 0x1400245cd
cmp byte [rcx + 0x19], 5
jb 0x1400245cd
mov edx, 0x20e
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
lea rax, [0x14016d090]
mov rcx, qword [0x14016d090]
test r15d, r15d
jns 0x1400245e2
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 0xa4]
jmp 0x140023c4e
cmp rcx, rax
je 0x140024610
test byte [rcx + 0x1c], 1
je 0x140024610
cmp byte [rcx + 0x19], 4
jb 0x140024610
mov edx, 0x20f
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004ad4
mov rcx, r14
call fcn.1400f44d0
test byte [r13 + 0x154], 2
je 0x1400247dd
mov eax, dword [r12 + 0xc]
mov r8, qword [rbp - 0x30]
cmp eax, dword [r8 + 0xc]
jne 0x14002465c
mov bl, 1
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x1400246c4
test byte [rcx + 0x1c], bl
je 0x1400246c4
cmp byte [rcx + 0x19], 4
jb 0x1400246c4
mov edx, 0x210
jmp 0x1400246a5
ja 0x14002467a
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov r8, qword [rbp - 0x30]
xor bl, bl
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400246cb
test byte [rcx + 0x1c], 1
je 0x1400246cb
cmp byte [rcx + 0x19], 4
jb 0x1400246cb
mov edx, 0x211
mov eax, dword [r12 + 0xc]
mov r9d, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000f654
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
mov edx, 0x1400000
cmp rsi, rdx
ja 0x140024725
neg bl
sbb r15d, r15d
and r15d, 0x44
add r15d, 0x80780030
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x14002471a
test byte [rcx + 0x1c], 1
je 0x14002471a
cmp byte [rcx + 0x19], 3
jb 0x14002471a
mov edx, 0x212
mov r9, rsi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000f8a4
mov rcx, qword [0x14016d090]
mov esi, dword [rbp + 0xa8]
jmp 0x140023c4e
test dil, dil
jne 0x140024784
mov r8d, 0x40000000
cmp rsi, r8
ja 0x140024784
test bl, bl
je 0x140024784
mov r15d, 0x80780080
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x140024779
test byte [rcx + 0x1c], 1
je 0x140024779
cmp byte [rcx + 0x19], 3
jb 0x140024779
mov edx, 0x213
mov qword [rsp + 0x20], r8
mov r9, rsi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004ad4
mov rcx, qword [0x14016d090]
mov esi, dword [rbp + 0xac]
jmp 0x140023c4e
sub rsi, rdx
cmp rsi, 0x1100000
ja 0x1400247dd
neg bl
sbb r15d, r15d
and r15d, 0x44
add r15d, 0x80780030
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x1400247d5
test byte [rcx + 0x1c], 1
je 0x1400247d5
cmp byte [rcx + 0x19], 3
jb 0x1400247d5
mov edx, 0x214
mov r9, rsi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000f8a4
mov rcx, qword [0x14016d090]
mov esi, dword [rbp + 0x50]
jmp 0x140023c4e
mov dil, 1
mov byte [rbp - 0x6f], dil
test byte [r13 + 0x154], 4
je 0x14002481e
mov r9d, dword [r13 + 0x174]
shl r9d, 4
add r9, qword [rbp + 0x10]
lea r8, [rbp - 0x6f]
mov rdx, qword [rbp + 0x118]
mov rcx, r13
call fcn.14001dee4
mov edi, eax
test eax, eax
js 0x140025b30
mov dil, byte [rbp - 0x6f]
mov byte [rbp - 0x6e], dil
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
and qword [rcx], 0
and qword [rcx + 8], 0
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x14016d090]
lea rbx, [0x14016d090]
cmp rcx, rbx
je 0x1400248bd
test byte [rcx + 0x1c], 1
je 0x140024892
cmp byte [rcx + 0x19], 4
jb 0x140024892
mov edx, 0x215
mov r9, rsi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000f8a4
mov rcx, qword [0x14016d090]
cmp rcx, rbx
je 0x1400248bd
test byte [rcx + 0x1c], 1
je 0x1400248bd
cmp byte [rcx + 0x19], 4
jb 0x1400248bd
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r13 + 0xd8]
add rax, 0x9c
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
test byte [r13 + 0x154], 2
je 0x140024984
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x140024905
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r13 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
cmp dword [r13 + 0x150], 4
sete r8b
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x6e]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r13
mov r9, rsi
mov rdx, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call fcn.1400b24fc
mov r12d, eax
mov sil, byte [rbp - 0x58]
jmp 0x140024e84
and qword [rbp + 0x50], 0
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x150]
call sub.msvcrt.dll_memset
test dil, dil
jne 0x140024a3f
xor edx, edx
mov rcx, r14
call fcn.1400f4344
mov edi, eax
test eax, eax
js 0x140025b30
mov rdi, qword [rbp - 0x10]
mov rcx, rdi
call fcn.140088e08
mov bl, al
mov rcx, r14
call fcn.1400f44d0
test bl, bl
je 0x140024a3f
mov dword [rbp + 0x150], 2
lea r8, [rbp + 0x150]
mov rdx, rdi
mov rcx, r14
call fcn.1401161ec
test eax, eax
jns 0x140024a3f
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x140024a34
test byte [rcx + 0x1c], 1
je 0x140024a34
cmp byte [rcx + 0x19], 2
jb 0x140024a34
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
mov rcx, qword [0x14016d090]
mov esi, dword [rbp + 0xb0]
jmp 0x140023c4e
lea r9, [rbp + 0x50]
mov r8, qword [rbp + 0xf8]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r13
call fcn.1400216c8
test eax, eax
jns 0x140024a65
mov esi, dword [rbp + 0x74]
jmp 0x140024042
xor edx, edx
mov rcx, r14
call fcn.1400f4344
mov edi, eax
test eax, eax
js 0x140025b30
lea rdx, [rbp + 0x38]
mov rdi, qword [rbp - 0x10]
mov rcx, rdi
call fcn.1401127e4
mov ebx, eax
mov rcx, r14
call fcn.1400f44d0
test ebx, ebx
jns 0x140024ae7
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024ad9
test byte [rcx + 0x1c], 1
je 0x140024ad9
cmp byte [rcx + 0x19], 2
jb 0x140024ad9
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
mov rcx, qword [0x14016d090]
mov r15d, ebx
mov esi, dword [rbp + 0xb4]
jmp 0x140023c4e
movups xmm0, xmmword [rbp + 0x158]
movdqu xmmword [rbp + 0x60], xmm0
mov ecx, dword [r13 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x38], rdi
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x6e]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r13
lea rdx, [0x14001f490]
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call fcn.1400b4054
mov r12d, eax
test eax, eax
jne 0x140024cb6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140024bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x140024bcc
test byte [rcx + 0x1c], 1
je 0x140024bcc
cmp byte [rcx + 0x19], 2
jb 0x140024bcc
mov edx, 0x219
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, qword [0x14016d090]
mov eax, dword [rsp + 0x70]
mov esi, dword [rbp + 0xb8]
movzx r15d, ax
or r15d, 0x80070000
test eax, eax
cmovle r15d, eax
mov rdi, qword [rbp - 0x78]
jmp 0x140025650
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x140024c4c
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x140024c44
test byte [rcx + 0x1c], 1
je 0x140024c44
cmp byte [rcx + 0x19], 2
jb 0x140024c44
mov edx, 0x21a
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, qword [0x14016d090]
mov eax, dword [rsp + 0x70]
mov esi, dword [rbp + 0xbc]
jmp 0x140024bd2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140024cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x140024ca5
test byte [rcx + 0x1c], 1
je 0x140024ca5
cmp byte [rcx + 0x19], 2
jb 0x140024ca5
mov edx, 0x21b
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, qword [0x14016d090]
mov eax, dword [rsp + 0x70]
mov esi, dword [rbp + 0xc0]
jmp 0x140024bd2
xor edi, edi
mov qword [rbp + 0x38], rdi
mov r13, qword [0x14016d090]
lea rdi, [0x14016d090]
cmp r13, rdi
je 0x140024d8a
test byte [r13 + 0x1c], 4
je 0x140024d8a
cmp byte [r13 + 0x19], 4
jb 0x140024d8a
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + 0x138]
lea r8, [0x140147170]
mov rcx, qword [r13 + 0x10]
call fcn.14000f698
mov rbx, qword [rbp - 0x48]
lea rdi, [0x14016d090]
test rbx, rbx
jne 0x140024da7
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.140081b60
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r13, qword [0x14016d090]
cmp r13, rdi
je 0x140024e75
test byte [r13 + 0x1c], 4
je 0x140024e75
cmp byte [r13 + 0x19], 4
jb 0x140024e75
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + 0x148]
lea r8, [0x140147170]
mov rcx, qword [r13 + 0x10]
call fcn.14000f698
mov sil, 1
mov byte [rbp - 0x58], sil
mov dil, byte [rbp - 0x6f]
mov r13, qword [rbp - 0x20]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r13 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x14016d090]
lea rax, [0x14016d090]
cmp r10, rax
je 0x140024f55
test byte [r10 + 0x1c], 1
je 0x140024f55
cmp byte [r10 + 0x19], 4
jb 0x140024f55
mov eax, dword [r13 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r13 + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x108], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x10c], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x100], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x104], eax
mov rcx, qword [rbp + 0x100]
sub rcx, qword [rbp + 0x108]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x140147170]
mov rcx, qword [r10 + 0x10]
call fcn.14000f8a4
lea r14, [r13 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [rbp - 0x6e]
cmp byte [rbp - 0x6d], 0
je 0x140024f87
mov rax, qword [rbp - 0x78]
mov byte [rax + 0x84], 1
test bl, bl
jne 0x140024f87
mov edx, 0x10
mov rcx, rax
call fcn.140011e94
test dil, dil
jne 0x140024fda
test bl, bl
je 0x140024fda
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024fc4
test byte [rcx + 0x1c], 1
je 0x140024fc4
cmp byte [rcx + 0x19], 4
jb 0x140024fc4
mov edx, 0x21f
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
mov rax, qword [r13 + 0x188]
mov rcx, qword [rbp - 0x78]
mov qword [rcx + 0x78], rax
and dword [rcx + 0x80], 0
mov byte [rbp - 0x6c], 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
mov rdi, qword [rbp + 0x28]
mov qword [rcx], rdi
mov rbx, qword [rbp + 0x30]
mov qword [rcx + 8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbp - 0x60]
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], rdi
mov ecx, r12d
xor ebx, ebx
test r12d, r12d
je 0x140025469
sub ecx, 1
je 0x140025442
sub ecx, 3
je 0x14002539c
sub ecx, 1
je 0x140025308
sub ecx, 1
je 0x14002539c
sub ecx, 1
je 0x140025141
cmp ecx, 0xd
je 0x1400250d8
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400250b1
test byte [rcx + 0x1c], 1
je 0x1400250b1
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x1400250b5
mov edx, 0x227
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x1400250b5
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, r12d
call fcn.1400f6d50
mov esi, dword [rbp + 0xc4]
mov r15d, eax
mov rcx, qword [0x14016d090]
jmp 0x140024be3
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025123
test byte [rcx + 0x1c], 1
je 0x140025123
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140025127
mov edx, 0x222
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x140025127
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, 0x14
call fcn.1400f6d50
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 4]
jmp 0x1400250c9
mov rcx, qword [0x14016d090]
lea r12, [0x14016d090]
cmp rcx, r12
je 0x14002518c
test byte [rcx + 0x1c], 1
je 0x14002518c
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140025190
mov edx, 0x223
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x140025190
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, 7
call fcn.1400f6d50
mov r15d, eax
mov byte [rbp - 0x6c], bl
cmp eax, 0x8078002a
jne 0x1400252e8
cmp edi, 0x70
jne 0x1400252f1
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400251f0
test byte [rcx + 0x1c], 1
je 0x1400251f0
mov r12, qword [rbp + 8]
cmp byte [rcx + 0x19], 4
jb 0x1400251f4
mov edx, 0x224
mov r9, r12
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
jmp 0x1400251f4
mov r12, qword [rbp + 8]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 4], ebx
mov edi, dword [rbp + 0x18]
test edi, edi
je 0x14002521a
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
lea r8, [rbp + 0x20]
lea rdx, [rbp + 4]
mov rcx, qword [rbp - 0x48]
call fcn.1400b1ee8
test eax, eax
jne 0x1400252f1
cmp byte [r13 + 0x428], bl
mov rbx, qword [rbp + 0x20]
mov rdx, rbx
je 0x140025251
mov rcx, qword [r13 + 0x158]
call fcn.14010c610
jmp 0x140025259
mov rcx, r13
call fcn.14001b180
test eax, eax
js 0x1400252b9
xor r15d, r15d
mov byte [rbp - 0x7f], 1
lea esi, [rdi + 1]
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140024be3
test byte [rcx + 0x1c], 1
je 0x140024be3
cmp byte [rcx + 0x19], 4
jb 0x140024be3
mov edx, 0x225
mov qword [rsp + 0x20], r12
mov r14, qword [rsp + 0x78]
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000593c
jmp 0x140025388
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x1400252f8
test byte [rcx + 0x1c], 1
je 0x1400252f8
cmp byte [rcx + 0x19], 2
jb 0x1400252f8
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14000f8d8
test r15d, r15d
jns 0x140025469
mov rcx, qword [0x14016d090]
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 0xc8]
jmp 0x140024be3
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025356
test byte [rcx + 0x1c], 1
je 0x140025356
mov edi, dword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x14002535f
mov edx, 0x221
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 5
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x14002535f
mov r14, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, 5
call fcn.1400f6d50
mov r15d, eax
cmp dword [rbp - 0x68], ebx
jne 0x140025380
mov dword [rbp - 0x68], eax
mov r15d, 0x80780166
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 0x70]
mov rcx, qword [0x14016d090]
mov r12, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x78]
jmp 0x140025659
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400253e7
test byte [rcx + 0x1c], 1
je 0x1400253e7
mov edi, dword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x1400253f0
mov edx, 0x220
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd50
jmp 0x1400253f0
mov r14, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x68]
mov edx, edi
mov ecx, r12d
call fcn.1400f6d50
mov r15d, eax
mov rdi, qword [rbp - 0x78]
test byte [rdi + 0x54], 1
jne 0x140025428
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x38]
call fcn.140023358
test eax, eax
js 0x140025428
cmp byte [rbp - 0x70], bl
mov eax, 0x80780169
cmove r15d, eax
mov byte [rbp - 0x80], 1
mov esi, dword [rbp + 0x98]
mov rcx, qword [0x14016d090]
mov r12, qword [rbp - 0x60]
jmp 0x140025659
lea rcx, [r13 + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140005783.0]
test al, al
mov r15d, 0x80780167
jne 0x140025461
mov r15d, dword [r13 + 0x20]
mov esi, dword [rbp + 0x20]
jmp 0x1400250cc
lea rbx, [r13 + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rbp - 0x78]
inc dword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rdi + 0x10]
mov r12, qword [rbp - 0x60]
mov dword [r12 + 0x28], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe4]
mov dword [r12 + 0xc], eax
mov eax, dword [r13 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0x170]
mov rcx, qword [rbp + 0x40]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r13 + 0x154], 2
jne 0x1400254ff
mov rcx, rdi
call fcn.140013464
test eax, eax
jns 0x1400254ff
mov r8d, eax
mov edx, 0x80780151
mov rcx, rdi
call fcn.140011e34
mov esi, dword [rbp + 0x7c]
jmp 0x140024143
test sil, sil
jne 0x140025546
mov rax, qword [rbp - 8]
cmp qword [r12 + 0x38], rax
je 0x140025527
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
and qword [r12 + 0x38], 0
and dword [r12 + 0x40], 0
mov r15d, 0x80780030
mov byte [rsp + 0x74], 1
mov esi, dword [rbp + 0x48]
jmp 0x140024143
and qword [rbp + 0x48], 0
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp - 0x48]
call fcn.1400ba064
test eax, eax
je 0x140025574
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov rbx, qword [rbp + 0x48]
test rbx, rbx
je 0x1400255b7
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400255b7
test byte [rcx + 0x1c], 1
je 0x1400255b7
cmp byte [rcx + 0x19], 2
jb 0x1400255b7
mov edx, 0x228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.14001051c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
jle 0x1400255fb
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, rdi
call fcn.140011e34
mov ebx, 0xe
mov edx, ebx
mov rcx, rdi
call fcn.140011f54
mov edx, ebx
mov rcx, r12
call fcn.140013ab4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [rbp + 0x84]
test byte [r13 + 0x154], 2
jne 0x140024143
mov rdx, rdi
mov rcx, r13
call fcn.14002d334
jmp 0x140024143
mov rcx, qword [0x14016d090]
mov rdi, qword [rbp - 0x78]
mov r13, qword [rbp - 0x20]
mov r12, qword [rbp - 0x60]
mov r14, qword [rsp + 0x78]
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x140025706
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
test eax, eax
je 0x1400256af
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x1400256af
test byte [rcx + 0x1c], 1
je 0x1400256af
cmp byte [rcx + 0x19], 3
jb 0x1400256af
mov edx, 0x229
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400256f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14016d090]
lea rdx, [0x14016d090]
cmp rcx, rdx
je 0x140025700
test byte [rcx + 0x1c], 1
je 0x140025700
cmp byte [rcx + 0x19], 3
jb 0x140025700
mov edx, 0x22a
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, qword [0x14016d090]
xor ebx, ebx
mov qword [rbp + 0x38], rbx
cmp r15d, 0x80780030
je 0x140025727
cmp r15d, 0x8078002a
jne 0x1400257f2
cmp dword [rsp + 0x70], 0x70
jne 0x140025817
test byte [r13 + 0x154], 2
jne 0x140025776
mov rcx, rdi
call fcn.140013464
test eax, eax
jns 0x140025776
mov rcx, qword [0x14016d090]
lea rbx, [0x14016d090]
cmp rcx, rbx
je 0x14002577d
test byte [rcx + 0x1c], 1
je 0x14002577d
cmp byte [rcx + 0x19], 3
jb 0x14002577d
mov edx, 0x22b
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
jmp 0x14002577d
lea rbx, [0x14016d090]
lea rax, [0x1400d6620]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 0x188]
mov edx, dword [r13 + 0x150]
mov rcx, qword [r13 + 0x158]
call fcn.14010488c
test eax, eax
jns 0x1400257eb
mov rcx, qword [0x14016d090]
cmp rcx, rbx
je 0x1400257f2
test byte [rcx + 0x1c], 1
je 0x1400257f2
cmp byte [rcx + 0x19], 2
jb 0x1400257f2
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r13 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 0x158]
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400059f4
mov rcx, qword [0x14016d090]
cmp r15d, 0x80780030
jne 0x140025817
test byte [r13 + 0x154], 2
je 0x140025817
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0xc]
cmp dword [r12 + 0xc], eax
ja 0x1400259cb
mov rbx, r14
cmp qword [rdi + 0x58], 0
cmovne rbx, qword [rdi + 0x58]
test r15d, r15d
jns 0x140025900
mov edx, 0xc
mov rcx, r12
call fcn.140013ab4
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025876
test byte [rcx + 0x1c], 1
je 0x140025876
cmp byte [rcx + 0x19], 2
jb 0x140025876
mov edx, 0x22e
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
mov r9d, r15d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call fcn.1400336f0
mov edi, eax
test eax, eax
jns 0x1400258cb
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x1400258c9
test byte [rcx + 0x1c], 1
je 0x1400258c9
cmp byte [rcx + 0x19], 3
jb 0x1400258c9
mov edx, 0x22f
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
xor edi, edi
mov r8d, dword [rbp - 0x68]
mov edx, r15d
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call fcn.14001203c
xor eax, eax
cmp byte [rbp - 0x80], al
je 0x140025a11
cmp byte [rbp - 0x57], al
je 0x140025983
cmp byte [rbx + 0x68], al
jne 0x140025a11
jmp 0x140025983
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025930
test byte [rcx + 0x1c], 1
je 0x140025930
cmp byte [rcx + 0x19], 4
jb 0x140025930
mov edx, 0x230
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r13
call fcn.1400336f0
mov edi, eax
test eax, eax
jns 0x140025983
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025983
test byte [rcx + 0x1c], 1
je 0x140025983
cmp byte [rcx + 0x19], 3
jb 0x140025983
mov edx, 0x231
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.1400058c8
mov al, byte [rbp - 0x7f]
test al, al
jne 0x14002598f
inc dword [r12 + 8]
and qword [r12 + 0x18], 0
and qword [r12 + 0x20], 0
and dword [r12 + 0x28], 0
mov dword [r12 + 0x2c], 0xf
and qword [r12 + 0x30], 0
and qword [r12 + 0x38], 0
and dword [r12 + 0x40], 0
mov eax, dword [rbp - 0x28]
cmp dword [r12 + 8], eax
jae 0x140025a2f
jmp 0x1400237f6
mov edx, 4
mov rcx, r12
call fcn.140013ab4
mov rcx, qword [0x14016d090]
lea rax, [0x14016d090]
cmp rcx, rax
je 0x140025a2f
test byte [rcx + 0x1c], 1
je 0x140025a2f
cmp byte [rcx + 0x19], 4
jb 0x140025a2f
mov edx, 0x22d
mov r9, r14
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140005868
jmp 0x140025a2f
mov al, byte [rsp + 0x74]
mov rsi, qword [rbp - 0x50]
mov byte [rsi], al
mov eax, dword [rbp - 0x68]
mov rcx, qword [rbp + 0x110]
mov dword [rcx], eax
mov edi, r15d
jmp 0x140025b34
mov r15, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x50]
mov rcx, r13
call fcn.14001fdd0
mov edi, eax
test eax, eax
js 0x140025b30
lea rcx, [r13 + 0x28]
xor edx, edx
call fcn.1400f4344
mov edi, eax
test eax, eax
js 0x140025b30
mov r14d, dword [r15 + 0xc]
xor ebx, ebx
mov r15d, dword [rbp - 0x28]
test r15d, r15d
je 0x140025b11
xor esi, esi
mov ecx, ebx
mov eax, ebx
shl rax, 4
mov rdx, qword [rbp + 0x40]
add rdx, rax
mov rax, qword [rdx]
cmp rax, qword [0x140156cf8]
jne 0x140025a9b
mov rax, qword [rdx + 8]
cmp rax, qword [0x140156d00]
je 0x140025aff
mov r11, qword [r13 + 0xd8]
imul r8, rcx, 0x170
lea r10, [r11 + 0x78]
add r10, r8
mov ecx, ebx
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea r9, [r11 + 0x44]
add r9, r8
mov eax, dword [r11 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rcx
mov rax, qword [rbp + 0x118]
mov qword [rsp + 0x28], rax
mov eax, dword [r11 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r13
call fcn.14001e28c
mov edi, eax
inc r14d
test eax, eax
js 0x140025b30
inc ebx
add rsi, 0x170
cmp ebx, r15d
jb 0x140025a73
cmp r14d, dword [r12 + 0xc]
je 0x140025b30
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.140081b60
mov rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140025b46
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r12, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x48]
mov r14, qword [rbp - 0x38]
mov r15, qword [rbp - 0x30]
jmp 0x140025b5c
mov rsi, qword [rbp - 0x50]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140025b78
cmp rcx, qword [r12 + 0x38]
je 0x140025b78
cmp rcx, qword [r15 + 0x38]
je 0x140025b78
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x140025b92
cmp rbx, qword [r12 + 0x30]
je 0x140025b92
cmp rbx, qword [r15 + 0x30]
je 0x140025b92
mov rcx, rbx
call fcn.1400b9088
test r14, r14
je 0x140025ba0
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x140025bb2
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x140025bc4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 8]
test rax, rax
je 0x140025bd6
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rbx, [r13 + 0x28]
mov rcx, rbx
call fcn.1400f44d0
test edi, edi
jns 0x140025cd8
mov rcx, qword [0x14016d090]
lea r14, [0x14016d090]
cmp rcx, r14
je 0x140025c36
test byte [rcx + 0x1c], 1
je 0x140025c36
cmp byte [rcx + 0x19], 2
jb 0x140025c36
lea rdx, [0x140147138]
lea rax, [0x140146468]
cmp byte [rsi], 0
cmovne rax, rdx
mov qword [rsp + 0x20], rax
mov r9d, edi
mov rcx, qword [rcx + 0x10]
call fcn.14000fa68
mov rcx, qword [0x14016d090]
cmp byte [rbp - 0x6c], 0
jne 0x140025ce6
test byte [r13 + 0x154], 4
je 0x140025ce6
xor edx, edx
mov rcx, rbx
call fcn.1400f4344
test eax, eax
jns 0x140025c92
mov rcx, qword [0x14016d090]
cmp rcx, r14
je 0x140025d0c
test byte [rcx + 0x1c], 1
je 0x140025ce6
cmp byte [rcx + 0x19], 2
jb 0x140025ce6
mov edx, 0x233
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
jmp 0x140025cdf
mov rcx, r13
call fcn.14001bf94
test eax, eax
jns 0x140025cce
mov rcx, qword [0x14016d090]
cmp rcx, r14
je 0x140025cce
test byte [rcx + 0x1c], 1
je 0x140025cce
cmp byte [rcx + 0x19], 2
jb 0x140025cce
mov edx, 0x234
mov r9d, eax
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004988
mov rcx, rbx
call fcn.1400f44d0
jmp 0x140025cdf
lea r14, [0x14016d090]
mov rcx, qword [0x14016d090]
cmp rcx, r14
je 0x140025d0c
test byte [rcx + 0x1c], 1
je 0x140025d0c
cmp byte [rcx + 0x19], 4
jb 0x140025d0c
mov edx, 0x235
lea r8, [0x140147170]
mov rcx, qword [rcx + 0x10]
call fcn.140004968
mov eax, edi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14013cc00
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret