Function at 0x140016c34
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400471f8]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword gs:[0x58]
mov rsi, rcx
mov r13, rdx
mov qword [rsp + 0x48], r9
mov edx, 8
mov ebx, r8d
xor r14d, r14d
mov dword [rsp + 0x40], ebx
mov rcx, qword [rax]
mov edi, r14d
lea rax, str.CTieredVolume::InitializeJetInstance
mov qword [rdx + rcx], rax
lea rcx, [rsp + 0x50]
call fcn.140008524
mov rcx, qword [rsi + 0x258]
mov byte [rsp + 0x30], r14b
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x3c], r14d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
lea rcx, [0x14003ea30]
mov r15d, 0xb7
mov qword [rsp + 0x68], rcx
cmp eax, 0xffffffff
jne 0x140016e76
lea r12, [rsi + 0x2b8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlCreateSystemVolumeInformationFolder]
xor r9d, r9d
mov ebx, eax
test eax, eax
jns 0x140016d53
bts ebx, 0x1c
lea r14d, [r9 + 1]
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140047138]
lea r15, [0x140047138]
cmp rcx, r15
je 0x140016f25
test byte [rcx + 0x1c], r14b
je 0x14001742b
cmp byte [rcx + 0x19], 2
jb 0x14001742b
mov rcx, qword [rcx + 0x10]
lea edx, [r9 + 0x25]
mov r9, r12
mov dword [rsp + 0x20], ebx
lea r8, [0x14003f758]
call fcn.140008a18
mov r12d, r14d
mov r8d, edi
mov rcx, qword [0x140047138]
xor r9d, r9d
jmp 0x140018112
mov rcx, qword [rsi + 0x270]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016dfa
mov rcx, qword [rsi + 0x270]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x140016dfa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, r15d
je 0x140016dfa
mov r12d, 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140047138]
lea r15, [0x140047138]
cmp rcx, r15
je 0x140016f1d
lea r14d, [r12 - 1]
test byte [rcx + 0x1c], r14b
je 0x14001810a
cmp byte [rcx + 0x19], r12b
jb 0x14001810a
lea r9, [rsi + 0x268]
lea edx, [r12 + 0x24]
mov rcx, qword [rcx + 0x10]
lea rax, [rsi + 0x2a0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.140015820
jmp 0x140016d41
mov rcx, qword [rsi + 0x258]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x140016e72
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, r15d
je 0x140016e72
mov r12d, 3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140047138]
lea r15, [0x140047138]
cmp rcx, r15
je 0x140016f1d
lea r14d, [r12 - 2]
test byte [rcx + 0x1c], r14b
je 0x14001810a
cmp byte [rcx + 0x19], 2
jb 0x14001810a
lea r9, [rsi + 0x250]
lea edx, [r12 + 0x24]
jmp 0x140016ddc
mov ebx, dword [rsp + 0x40]
mov rcx, qword [rsi + 0x288]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016f2d
mov rcx, qword [rsi + 0x288]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x140016f2d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, r15d
je 0x140016f2d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140047138]
lea r15, [0x140047138]
cmp rcx, r15
je 0x140016f1a
mov r14d, 1
test byte [rcx + 0x1c], r14b
je 0x140017423
cmp byte [rcx + 0x19], 2
jb 0x140017423
mov rcx, qword [rcx + 0x10]
lea rax, [rsi + 0x2a0]
lea r9, [rsi + 0x280]
mov dword [rsp + 0x28], ebx
lea edx, [r14 + 0x27]
mov qword [rsp + 0x20], rax
call fcn.140015820
mov r12d, edi
jmp 0x140016d41
mov r12d, edi
xor r9d, r9d
jmp 0x14001814b
mov r12d, r14d
jmp 0x14001814b
mov dword [rsp + 0x34], r14d
mov r14d, 1
lea r15, [0x140047138]
test ebx, ebx
je 0x1400175bf
lea r12d, [r14 + 6]
jmp 0x140016f51
mov ebx, dword [rsp + 0x40]
xor eax, eax
cmp byte [rsi + 0xa5], al
jne 0x140017538
cmp byte [rsi + 0xa6], al
jne 0x140017538
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017538
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017538
mov r9, qword [rsp + 0x48]
mov r8d, ebx
mov rdx, r13
mov rcx, rsi
call fcn.14001590c
xor r9d, r9d
mov edi, eax
test eax, eax
jne 0x140017497
xor r8d, r8d
mov byte [rsp + 0x30], r14b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor edx, edx
mov ebx, eax
test eax, eax
je 0x14001712d
cmp eax, 0xfffffbc6
je 0x14001712d
cmp eax, 0xfffffbfa
je 0x14001712d
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017027
test byte [rcx + 0x1c], r14b
je 0x140017027
cmp byte [rcx + 0x19], 2
jb 0x140017027
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x2b]
mov r9, r13
mov dword [rsp + 0x20], eax
lea r8, [0x14003f758]
call fcn.140003cf4
xor edx, edx
cmp dword [section..data], 5
jbe 0x14001712d
movabs r8, 0x400000000000
test qword [0x140047010], r8
je 0x14001705d
mov rax, qword [0x140047018]
and rax, r8
cmp rax, qword [0x140047018]
mov al, r14b
je 0x14001705f
mov al, dl
test al, al
je 0x14001712d
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003ea30]
mov rax, qword [rsi + 0x2c0]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2b8]
mov dword [rbp - 0x58], eax
mov rax, rdx
mov dword [rbp - 0x54], edx
test r13, r13
je 0x1400170b0
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], dx
jne 0x1400170a5
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea r8, str.InitializeJetInstance
lea rax, [rsp + 0x3c]
mov dword [rbp - 0x44], edx
mov qword [rbp - 0x40], rax
or rax, 0xffffffffffffffff
mov dword [rsp + 0x3c], ebx
mov qword [rbp - 0x38], 4
inc rax
cmp byte [r8 + rax], dl
jne 0x1400170e1
inc eax
mov qword [rbp - 0x30], r8
mov dword [rbp - 0x28], eax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], edx
mov dword [rsp + 0x38], 6
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x140041035]
mov dword [rsp + 0x20], 8
call fcn.140001078
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ESENT.dll_JetInit3W]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor r9d, r9d
test edi, edi
je 0x140017484
cmp edi, 0xfffffbfa
je 0x140017433
cmp edi, 0xfffffdef
je 0x1400173ce
cmp edi, 0xfffffbbc
je 0x1400173ce
cmp edi, 0xfffff8f0
je 0x1400173ce
cmp edi, 0xfffffc0d
jne 0x140017196
mov ebx, 0x8007000e
jmp 0x1400171b2
mov eax, edi
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r9d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x1400171ea
test byte [rcx + 0x1c], r14b
je 0x1400171ea
cmp byte [rcx + 0x19], 2
jb 0x1400171ea
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x2e
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.140003cf4
mov rax, qword [rsp + 0x48]
mov r8d, 8
mov rcx, rsi
mov rdx, qword [rax]
call fcn.140016950
xor r9d, r9d
mov byte [rsp + 0x30], r9b
cmp byte [rsi + 0xa5], r9b
jne 0x140017389
cmp byte [rsi + 0xa6], r9b
jne 0x140017389
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017386
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017386
cmp dword [section..data], 5
jbe 0x14001735f
movabs rdx, 0x400000000000
test qword [0x140047010], rdx
je 0x140017290
mov rax, qword [0x140047018]
and rax, rdx
cmp rax, qword [0x140047018]
jne 0x140017290
mov al, r14b
xor edx, edx
jmp 0x140017294
xor edx, edx
mov al, dl
test al, al
je 0x14001735f
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003ea30]
mov rax, qword [rsi + 0x2c0]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2b8]
mov dword [rbp - 0x58], eax
mov rax, rdx
mov dword [rbp - 0x54], edx
test r13, r13
je 0x1400172e5
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], dx
jne 0x1400172da
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea r8, str.InitializeJetInstance
lea rax, [rsp + 0x3c]
mov dword [rbp - 0x44], edx
mov qword [rbp - 0x40], rax
or rax, 0xffffffffffffffff
mov dword [rsp + 0x3c], edi
mov qword [rbp - 0x38], 4
inc rax
cmp byte [r8 + rax], dl
jne 0x140017316
inc eax
mov qword [rbp - 0x30], r8
mov dword [rbp - 0x28], eax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], edx
mov dword [rsp + 0x38], r12d
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x140041035]
mov dword [rsp + 0x20], 8
call fcn.140001078
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov r8d, dword [rsp + 0x34]
add r8d, r14d
mov dword [rsp + 0x34], r8d
cmp r8d, 5
jb 0x140016f4d
jmp 0x140016d44
xor r9d, r9d
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x14001810d
test byte [rcx + 0x1c], r14b
je 0x14001810d
cmp byte [rcx + 0x19], 5
jb 0x14001810d
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
jmp 0x140018103
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140018147
test byte [rcx + 0x1c], r14b
je 0x14001810d
cmp byte [rcx + 0x19], 2
jb 0x14001810d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x2d
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.140003cf4
jmp 0x140018103
mov r12d, edi
jmp 0x14001810a
mov r12d, r14d
jmp 0x14001810d
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017475
test byte [rcx + 0x1c], r14b
je 0x140017475
cmp byte [rcx + 0x19], 2
jb 0x140017475
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x2c
mov dword [rsp + 0x20], 0xfffffbfa
mov r9, r13
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov ebx, r9d
mov edi, r9d
mov dword [rsp + 0x58], ebx
jmp 0x14001810d
mov rcx, qword [0x140047138]
mov ebx, r9d
mov dword [rsp + 0x58], ebx
jmp 0x14001810d
mov r12d, 5
cmp edi, 0xfffffdef
je 0x1400174e0
cmp edi, 0xfffffbbc
je 0x1400174e0
cmp edi, 0xfffff8f0
je 0x1400174e0
cmp edi, 0xfffffc0d
jne 0x1400174c4
mov ebx, 0x8007000e
jmp 0x1400174ec
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r9d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x1400174ec
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x14001752e
test byte [rcx + 0x1c], r14b
je 0x14001752e
cmp byte [rcx + 0x19], 2
jb 0x14001752e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x2a
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov byte [rsp + 0x30], r9b
jmp 0x14001810d
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017573
test byte [rcx + 0x1c], r14b
je 0x140017573
cmp byte [rcx + 0x19], 5
jb 0x140017573
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
mov rcx, qword [0x140047138]
mov eax, 0x80830002
mov r12d, 4
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x14001752b
test byte [rcx + 0x1c], r14b
je 0x14001752b
cmp byte [rcx + 0x19], 2
jb 0x14001752b
mov r9d, dword [rsi + 0x80]
lea edx, [r12 + 0x25]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov dword [rsp + 0x20], eax
call fcn.140001638
jmp 0x140017524
mov rcx, qword [0x140047138]
xor eax, eax
mov r12d, 0x102
cmp byte [rsi + 0xa5], al
jne 0x140018052
cmp byte [rsi + 0xa6], al
jne 0x140018052
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x14001804b
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x14001804b
mov r9, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, r13
mov rcx, rsi
call fcn.14001590c
xor r9d, r9d
mov edi, eax
test eax, eax
jne 0x140017faa
xor r8d, r8d
mov byte [rsp + 0x30], r14b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor edi, edi
mov ebx, eax
test eax, eax
je 0x1400177aa
cmp eax, 0xfffffbc6
je 0x1400177aa
cmp eax, 0xfffffbfa
je 0x1400177aa
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x1400176a3
test byte [rcx + 0x1c], r14b
je 0x1400176a3
cmp byte [rcx + 0x19], 2
jb 0x1400176a3
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x31]
mov r9, r13
mov dword [rsp + 0x20], eax
lea r8, [0x14003f758]
call fcn.140003cf4
mov rcx, qword [0x140047138]
cmp dword [section..data], 5
jbe 0x1400177b1
movabs r8, 0x400000000000
test qword [0x140047010], r8
je 0x1400176d9
mov rax, qword [0x140047018]
and rax, r8
cmp rax, qword [0x140047018]
mov al, r14b
je 0x1400176dc
mov al, dil
test al, al
je 0x1400177b1
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003ea30]
mov rax, qword [rsi + 0x2c0]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2b8]
mov dword [rbp - 0x58], eax
mov rax, rdi
mov dword [rbp - 0x54], edi
test r13, r13
je 0x14001772d
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], di
jne 0x140017722
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rdx, str.InitializeJetInstance
lea rax, [rsp + 0x40]
mov dword [rbp - 0x44], edi
mov qword [rbp - 0x40], rax
or rax, 0xffffffffffffffff
mov dword [rsp + 0x40], ebx
mov qword [rbp - 0x38], 4
inc rax
cmp byte [rdx + rax], dil
jne 0x14001775e
inc eax
mov qword [rbp - 0x30], rdx
mov dword [rbp - 0x28], eax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], edi
mov dword [rsp + 0x38], 0xa
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x140041035]
mov dword [rsp + 0x20], 8
call fcn.140001078
mov rcx, qword [0x140047138]
cmp byte [rsi + 0xa5], dil
jne 0x140017f1e
cmp byte [rsi + 0xa6], dil
jne 0x140017f1e
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x140017f17
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x140017f17
mov r12d, dword [rsp + 0x3c]
xor edx, edx
mov rcx, qword [rsp + 0x48]
mov r8d, r12d
call qword [sym.imp.ESENT.dll_JetInit3W]
xor ecx, ecx
mov edi, eax
mov ebx, ecx
test eax, eax
je 0x140017864
cmp eax, 0xfffffdef
je 0x140017858
cmp eax, 0xfffffbbc
je 0x140017858
cmp eax, 0xfffff8f0
je 0x140017858
cmp eax, 0xfffffc0d
jne 0x14001783d
mov ebx, 0x8007000e
jmp 0x140017864
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, ecx
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x140017864
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
xor r8d, r8d
mov dword [rsp + 0x58], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ESENT.dll_JetEnableMultiInstanceW]
xor r9d, r9d
mov dword [rsp + 0x38], 0xc
test edi, edi
je 0x140017f07
cmp edi, 0xfffffbfa
je 0x140017eb9
cmp edi, 0xfffffdef
je 0x140017e7a
cmp edi, 0xfffffbbc
je 0x140017e7a
cmp edi, 0xfffff8f0
je 0x140017e7a
lea eax, [rdi + 0x21f]
cmp eax, 0x2a
ja 0x140017a0a
movabs rcx, 0x40000000011
bt rcx, rax
jae 0x140017a0a
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x14001790e
test byte [rcx + 0x1c], r14b
je 0x14001790e
cmp byte [rcx + 0x19], 2
jb 0x14001790e
mov rcx, qword [rcx + 0x10]
lea edx, [r9 + 0x35]
mov r9, r13
mov dword [rsp + 0x20], edi
lea r8, [0x14003f758]
call fcn.140003cf4
mov rax, qword [rsp + 0x48]
mov r12d, 0xd
mov rcx, rsi
mov dword [rsp + 0x38], r12d
mov rdx, qword [rax]
lea r8d, [r12 - 5]
call fcn.140016950
xor r9d, r9d
mov byte [rsp + 0x30], r9b
cmp byte [rsi + 0xa5], r9b
jne 0x140017cc4
cmp byte [rsi + 0xa6], r9b
jne 0x140017cc4
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017cc1
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017cc1
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea r9, str.edb.log
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14003391c
lea r9, str.edbtmp.log
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14003391c
lea r9, str.edb.chk
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14003391c
lea rax, str..log
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
call fcn.140033f00
lea rax, str..jrs
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
call fcn.140033f00
jmp 0x140017b83
cmp edi, 0xfffffb40
jne 0x140017ab7
mov rax, qword [rsp + 0x48]
mov r8d, 8
mov rcx, rsi
mov rdx, qword [rax]
call fcn.140016950
xor r9d, r9d
mov byte [rsp + 0x30], r9b
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017a75
test byte [rcx + 0x1c], r14b
je 0x140017a75
cmp byte [rcx + 0x19], 2
jb 0x140017a75
mov rcx, qword [rcx + 0x10]
lea edx, [r9 + 0x36]
mov r9, r13
mov dword [rsp + 0x20], 0xfffffb40
lea r8, [0x14003f758]
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor r9d, r9d
test r12d, r12d
jne 0x140017a92
mov r12d, 0xe
mov dword [rsp + 0x3c], 0x80
mov dword [rsp + 0x38], r12d
jmp 0x140017b8d
cmp r12d, 0x80
jne 0x140017d64
mov r12d, 0xf
mov dword [rsp + 0x3c], 0x84
mov dword [rsp + 0x38], r12d
jmp 0x140017b8d
cmp edi, 0xfffffddf
je 0x140017acb
cmp edi, 0xfffffbc3
jne 0x140017dba
mov rax, qword [rsp + 0x48]
mov r12d, 0x11
mov rcx, rsi
mov dword [rsp + 0x38], r12d
mov rdx, qword [rax]
lea r8d, [r12 - 9]
call fcn.140016950
xor eax, eax
mov byte [rsp + 0x30], al
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017b2c
test byte [rcx + 0x1c], r14b
je 0x140017b2c
cmp byte [rcx + 0x19], 2
jb 0x140017b2c
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x38]
mov r9, r13
mov dword [rsp + 0x20], edi
lea r8, [0x14003f758]
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor eax, eax
cmp byte [rsi + 0xa5], al
jne 0x140017df8
cmp byte [rsi + 0xa6], al
jne 0x140017df8
mov rcx, qword [rsi + 0x300]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017df1
mov rcx, qword [rsi + 0x2f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017df1
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rcx, qword [0x140047138]
xor r9d, r9d
cmp dword [section..data], 5
jbe 0x140017c9b
movabs r8, 0x400000000000
test qword [0x140047010], r8
je 0x140017bc3
mov rax, qword [0x140047018]
and rax, r8
cmp rax, qword [0x140047018]
mov al, r14b
je 0x140017bc6
mov al, r9b
test al, al
je 0x140017c9b
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rcx, [0x14003ea30]
mov rax, qword [rsi + 0x2c0]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2b8]
mov dword [rbp - 0x58], eax
mov rax, r9
mov dword [rbp - 0x54], r9d
test r13, r13
je 0x140017c18
mov rcx, r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], r9w
jne 0x140017c0d
lea eax, [rax*2 + 2]
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rdx, str.InitializeJetInstance
lea rax, [rsp + 0x40]
mov dword [rbp - 0x44], r9d
mov qword [rbp - 0x40], rax
or rax, 0xffffffffffffffff
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x38], 4
inc rax
cmp byte [rdx + rax], r9b
jne 0x140017c4a
inc eax
mov qword [rbp - 0x30], rdx
mov dword [rbp - 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], r9d
mov dword [rsp + 0x60], r12d
mov qword [rbp - 0x18], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x140041035]
mov dword [rsp + 0x20], 8
call fcn.140001078
mov rcx, qword [0x140047138]
mov r8d, dword [rsp + 0x34]
add r8d, r14d
mov dword [rsp + 0x34], r8d
cmp r8d, 5
jb 0x1400175c6
mov r12d, dword [rsp + 0x38]
xor r9d, r9d
mov byte [rsp + 0x30], r9b
jmp 0x140017d13
xor r9d, r9d
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017eaf
test byte [rcx + 0x1c], r14b
je 0x140017eaf
cmp byte [rcx + 0x19], 5
jb 0x140017eaf
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov r8d, dword [rsp + 0x34]
cmp dword [rsp + 0x3c], 0x84
jne 0x140018112
test ebx, ebx
jne 0x140018112
test byte [0x140047c80], 2
je 0x1400180d2
movzx r8d, word [rsi + 0x2b8]
lea rdx, [0x14003e9a0]
mov r9, qword [rsi + 0x2c0]
shr r8w, 1
call fcn.140009708
mov rcx, qword [0x140047138]
xor r9d, r9d
jmp 0x1400180d5
mov dword [rsp + 0x38], 0x10
cmp rcx, r15
je 0x140017eaf
test byte [rcx + 0x1c], r14b
je 0x140017eaf
cmp byte [rcx + 0x19], 2
jb 0x140017eaf
mov edx, 0x37
mov dword [rsp + 0x20], 0xfffffb40
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov r9, r13
call fcn.140003cf4
mov rcx, qword [0x140047138]
mov r12d, dword [rsp + 0x38]
jmp 0x140017d0b
mov dword [rsp + 0x38], 0x13
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017eaf
test byte [rcx + 0x1c], r14b
je 0x140017eaf
cmp byte [rcx + 0x19], 2
jb 0x140017eaf
mov edx, 0x3a
mov dword [rsp + 0x20], edi
jmp 0x140017d96
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017e2c
test byte [rcx + 0x1c], r14b
je 0x140017e2c
cmp byte [rcx + 0x19], 5
jb 0x140017e2c
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
mov rcx, qword [0x140047138]
mov eax, 0x80830002
mov dword [rsp + 0x38], 0x12
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x140017eac
test byte [rcx + 0x1c], r14b
je 0x140017eac
cmp byte [rcx + 0x19], 2
jb 0x140017eac
mov r9d, dword [rsi + 0x80]
lea r8, [0x14003f758]
mov rcx, qword [rcx + 0x10]
mov edx, 0x39
mov dword [rsp + 0x20], eax
call fcn.140001638
jmp 0x140017da9
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], eax
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017eaf
test byte [rcx + 0x1c], r14b
je 0x140017eaf
cmp byte [rcx + 0x19], 2
jb 0x140017eaf
mov edx, 0x34
jmp 0x140017deb
xor r9d, r9d
mov r12d, dword [rsp + 0x38]
jmp 0x140017d0e
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017efb
test byte [rcx + 0x1c], r14b
je 0x140017efb
cmp byte [rcx + 0x19], 2
jb 0x140017efb
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x33
mov dword [rsp + 0x20], 0xfffffbfa
mov r9, r13
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov ebx, r9d
mov edi, r9d
mov dword [rsp + 0x58], ebx
jmp 0x140017eaf
mov rcx, qword [0x140047138]
mov ebx, r9d
mov dword [rsp + 0x58], ebx
jmp 0x140017eaf
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140017f52
test byte [rcx + 0x1c], r14b
je 0x140017f52
cmp byte [rcx + 0x19], 5
jb 0x140017f52
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
mov rcx, qword [0x140047138]
mov eax, 0x80830002
mov edi, 0xfffffc18
mov ebx, eax
mov dword [rsp + 0x58], eax
mov r12d, 0xb
cmp rcx, r15
je 0x140017d0b
test byte [rcx + 0x1c], r14b
je 0x140017d0b
cmp byte [rcx + 0x19], 2
jb 0x140017d0b
mov r9d, dword [rsi + 0x80]
lea edx, [r12 + 0x27]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov dword [rsp + 0x20], eax
call fcn.140001638
jmp 0x140017d04
mov r12d, 9
cmp edi, 0xfffffdef
je 0x140017ff3
cmp edi, 0xfffffbbc
je 0x140017ff3
cmp edi, 0xfffff8f0
je 0x140017ff3
cmp edi, 0xfffffc0d
jne 0x140017fd7
mov ebx, 0x8007000e
jmp 0x140017fff
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
test edi, edi
mov eax, r9d
sets al
shl eax, 0x1f
or eax, 0xe5e0000
or ebx, eax
jmp 0x140017fff
mov ecx, 0x70
call fcn.140003930
mov ebx, eax
mov dword [rsp + 0x58], ebx
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140018041
test byte [rcx + 0x1c], r14b
je 0x140018041
cmp byte [rcx + 0x19], 2
jb 0x140018041
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x30
mov dword [rsp + 0x20], edi
mov r9, r13
call fcn.140003cf4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov byte [rsp + 0x30], r9b
jmp 0x140017d0e
mov rcx, qword [0x140047138]
cmp rcx, r15
je 0x140018086
test byte [rcx + 0x1c], r14b
je 0x140018086
cmp byte [rcx + 0x19], 5
jb 0x140018086
mov rcx, qword [rcx + 0x10]
lea r9, [rsi + 0x2a0]
mov edx, 0xfc
lea r8, [0x14003f470]
call fcn.140009ea4
mov rcx, qword [0x140047138]
mov eax, 0x80830002
mov r12d, 8
mov ebx, eax
mov dword [rsp + 0x58], eax
mov edi, 0xfffffc18
cmp rcx, r15
je 0x14001803e
test byte [rcx + 0x1c], r14b
je 0x14001803e
cmp byte [rcx + 0x19], 2
jb 0x14001803e
mov r9d, dword [rsi + 0x80]
lea edx, [r12 + 0x27]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov dword [rsp + 0x20], eax
call fcn.140001638
jmp 0x140018037
mov eax, r9d
cmp rcx, r15
je 0x140018147
test byte [rcx + 0x1c], r14b
je 0x14001810d
cmp byte [rcx + 0x19], 4
jb 0x14001810d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f758]
mov edx, 0x3b
mov qword [rsp + 0x20], r13
mov r9d, eax
call fcn.1400039f4
mov rcx, qword [0x140047138]
xor r9d, r9d
mov r8d, dword [rsp + 0x34]
cmp rcx, r15
je 0x140018147
test byte [rcx + 0x1c], r14b
je 0x140018147
cmp byte [rcx + 0x19], 2
jb 0x140018147
mov rcx, qword [rcx + 0x10]
mov r9d, r8d
lea r8, [0x14003f758]
mov dword [rsp + 0x28], ebx
mov edx, 0x3c
mov qword [rsp + 0x20], r13
call fcn.1400156cc
xor r9d, r9d
test edi, edi
jne 0x140018153
test ebx, ebx
je 0x14001827f
cmp dword [section..data], 5
jbe 0x14001825e
movabs rcx, 0x400000000000
test qword [0x140047010], rcx
je 0x14001825e
mov rax, qword [0x140047018]
and rax, rcx
cmp rax, qword [0x140047018]
jne 0x14001825e
mov qword [rbp - 0x68], 2
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
mov rax, qword [rsi + 0x2c0]
mov qword [rbp - 0x60], rax
movzx eax, word [rsi + 0x2b8]
mov dword [rbp - 0x58], eax
mov rax, r9
mov dword [rbp - 0x54], r9d
test r13, r13
je 0x1400181d3
mov qword [rsp + 0x68], r13
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], r9w
jne 0x1400181c8
mov rcx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x40], rax
lea rax, str.InitializeJetInstance
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
lea rax, [rsp + 0x3c]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x44], r9d
mov dword [rsp + 0x60], edi
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x28], 0x16
mov dword [rsp + 0x40], r12d
mov qword [rbp - 0x18], 4
mov dword [rsp + 0x3c], ebx
mov qword [rbp - 8], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x140040fc3]
mov dword [rsp + 0x20], 9
call fcn.140001078
xor r9d, r9d
test edi, edi
je 0x14001827f
cmp byte [rsp + 0x30], r9b
je 0x14001827f
mov rax, qword [rsp + 0x48]
mov r8d, 8
mov rcx, rsi
mov rdx, qword [rax]
call fcn.140016950
lea rcx, [rsp + 0x50]
call fcn.140008380
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14003b910
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret