Function at 0x14022de70
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x320
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, r8
mov qword [rbp + 0x50], r8
mov r12, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov r8, rdx
lea rdx, [rcx + 8]
lea rcx, [rsp + 0x60]
call fcn.1401b5524
nop
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov rcx, qword [r14 + 0x30]
sub rcx, qword [r14 + 0x28]
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x14022dfec
mov dword [rsp + 0x30], 0x64a
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x14022dfe0
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.DataCollection_adapter_failed_due_to_empty_list_of_collection_command
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x8c
cmp qword [r12 + 0x18], 8
jb 0x14022df4e
mov r12, qword [r12]
lea rbx, [0x1402cb810]
mov rdx, rbx
mov rax, r15
or rcx, 0xffffffffffffffff
test r12, r12
je 0x14022df74
mov rdx, r12
mov rax, rcx
inc rax
cmp word [r12 + rax*2], r15w
jne 0x14022df6a
mov qword [rbp], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], r15d
cmp qword [rsi + 0x18], 8
jb 0x14022df90
mov rsi, qword [rsi]
mov rax, r15
test rsi, rsi
je 0x14022dfa8
mov rbx, rsi
mov rax, rcx
inc rax
cmp word [rsi + rax*2], r15w
jne 0x14022df9e
mov qword [rbp + 0x10], rbx
lea eax, [rax*2 + 2]
mov dword [rbp + 0x18], eax
mov dword [rbp + 0x1c], r15d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351e0b]
mov rcx, r10
call fcn.140001078
lea rdx, [0x140407968]
jmp 0x14022eed0
cmp qword [0x140407b58], r15
je 0x14022ee2a
cmp qword [0x140407b78], r15
je 0x14022ee2a
call fcn.140048a14
mov r10, qword [rax + 8]
lea rcx, [0x1402cb810]
or rdi, 0xffffffffffffffff
lea r13d, [rdi + 5]
cmp dword [r10], r13d
jbe 0x14022e0d3
lea rax, str.DataCollection_adapter_started
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x3e
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14022e049
mov rdx, qword [r12]
mov r8, rcx
mov rax, r15
test rdx, rdx
je 0x14022e064
mov r8, rdx
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x14022e05a
mov qword [rbp - 0x10], r8
lea eax, [rax*2 + 2]
mov dword [rbp - 8], eax
mov dword [rbp - 4], r15d
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14022e083
mov rdx, qword [rsi]
mov rax, r15
test rdx, rdx
je 0x14022e09b
mov rcx, rdx
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x14022e091
mov qword [rbp], rcx
lea eax, [rax*2 + 2]
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], r15d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14035212a]
mov rcx, r10
call fcn.140001078
mov word [rsp + 0x40], r15w
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x130], r15w
lea r9, [rbp + 0x130]
lea r8, [rsp + 0x40]
mov rdx, rsi
call fcn.14022f020
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14022e14d
mov rbx, qword [rsp + 0x60]
mov dword [rbx + 0x80], eax
lea rcx, [rbx + 0x60]
lea rdx, [0x1404079a8]
call fcn.14005b588
mov byte [rbx + 0x58], 0xfc
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
mov r15d, dword [rsp + 0x30]
jmp 0x14022ee19
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x58], 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
mov r8, r12
lea rdx, [r14 + 8]
lea rcx, [rsp + 0x50]
call fcn.1401b5524
nop
lea rcx, [rbp + 0xb0]
call fcn.1401d8e64
nop
mov r8d, SafeArrayGetLBound
lea rdx, str.CollectedData_
mov rcx, rax
call fcn.140054efc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp + 0xb0]
call fcn.1400492c0
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r15w
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x110]
call fcn.14022fd10
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14022e24f
mov rbx, qword [rsp + 0x50]
mov dword [rbx + 0x80], eax
lea rcx, [rbx + 0x60]
lea rdx, [0x140407a08]
call fcn.14005b588
mov byte [rbx + 0x58], 0xfe
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
mov r15d, dword [rsp + 0x30]
jmp 0x14022edf4
mov rcx, r14
call fcn.140230134
mov r9, qword [rsp + 0x50]
mov byte [r9 + 0x58], 3
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0x38], r15d
mov rcx, qword [r14 + 0x30]
sub rcx, qword [r14 + 0x28]
movabs r10, 0xe38e38e38e38e39
mov rax, r10
imul rcx
mov r8, rdx
sar r8, 3
mov rax, r8
shr rax, 0x3f
add r8, rax
add r9, 0xd8
mov qword [rsp + 0x40], r9
mov rcx, qword [r9 + 0x10]
sub rcx, qword [r9]
mov rax, r10
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r8, rdx
jbe 0x14022e2e0
movabs rax, 0x1c71c71c71c71c7
cmp r8, rax
jbe 0x14022e2d5
call fcn.14004d010
int3
mov rdx, r8
mov rcx, r9
call fcn.14023307c
lea rcx, [rbp + 0x170]
call fcn.140230984
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x170]
call fcn.140230bc0
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r15w
lea rdx, [rbp + 0xd0]
call fcn.140232210
mov rbx, qword [r14 + 0x28]
mov r14, qword [r14 + 0x30]
cmp rbx, r14
je 0x14022e64e
lea r13, [rbx + 0x20]
mov r12, qword [rsp + 0x70]
lea rdx, [r13 + 0x20]
lea r9, [0x140407b48]
lea r8, [0x14040e130]
lea rcx, [rbp + 0xb0]
call fcn.14026fdb4
nop
lea rcx, [rbp + 0xb0]
call fcn.14023c65c
mov edi, eax
lea rcx, [rbp + 0xb0]
call fcn.1400492c0
test edi, edi
jns 0x14022e449
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14007951c
nop
mov rdx, r13
lea rcx, [rbp - 0x20]
call fcn.14007951c
nop
mov byte [rbp], 0xfa
lea rdx, [0x140407a88]
lea rcx, [rbp + 8]
call fcn.14005517c
mov dword [rbp + 0x28], 0x8007000d
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
inc dword [rsp + 0x38]
inc dword [rsp + 0x34]
lea r8, [rbp - 0x40]
mov rdx, qword [rsp + 0x40]
call fcn.14022ef74
mov qword [rsp + 0x20], r13
mov r9, rbx
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xd0]
call fcn.140231ee8
nop
lea rcx, [rbp + 0x30]
call fcn.1400492c0
lea rcx, [rbp + 8]
call fcn.1400492c0
lea rcx, [rbp - 0x20]
call fcn.14004c91c
lea rcx, [rbp - 0x40]
call fcn.14004c91c
jmp 0x14022e627
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r15
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, r12
call fcn.140231040
mov rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x70]
cmp byte [r13 + 0x68], 1
jne 0x14022e53f
mov rax, rsi
sub rax, rdi
cmp rax, 0x40
jae 0x14022e53f
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14007951c
nop
mov rdx, r13
lea rcx, [rbp - 0x20]
call fcn.14007951c
nop
mov byte [rbp], 0xfe
lea rdx, [0x1404079e8]
lea rcx, [rbp + 8]
call fcn.14005517c
mov dword [rbp + 0x28], 0x8007000d
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
lea r8, [rbp - 0x40]
mov rdx, qword [rsp + 0x40]
call fcn.14022ef74
inc dword [rsp + 0x38]
inc dword [rsp + 0x34]
mov qword [rsp + 0x20], r13
mov r9, rbx
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xd0]
call fcn.140231ee8
nop
lea rcx, [rbp + 0x30]
call fcn.1400492c0
lea rcx, [rbp + 8]
call fcn.1400492c0
lea rcx, [rbp - 0x20]
call fcn.14004c91c
lea rcx, [rbp - 0x40]
call fcn.14004c91c
jmp 0x14022e61e
cmp rdi, rsi
je 0x14022e61e
mov r12, qword [rsp + 0x40]
mov qword [rbp - 0x30], r15
mov eax, SafeArrayGetLBound
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x40], r15b
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rax
mov byte [rbp - 0x20], r15b
mov byte [rbp], 0xff
mov qword [rbp + 0x18], r15
mov eax, 7
mov qword [rbp + 0x20], rax
mov word [rbp + 8], r15w
mov dword [rbp + 0x28], r15d
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rax
mov word [rbp + 0x30], r15w
lea r9, [rdi + 0x20]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
call fcn.140231288
inc dword [rsp + 0x38]
cmp byte [rbp], 3
je 0x14022e5cf
inc dword [rsp + 0x34]
lea r8, [rbp - 0x40]
mov rdx, r12
call fcn.14022ef74
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xd0]
call fcn.140231ee8
nop
lea rcx, [rbp + 0x30]
call fcn.1400492c0
lea rcx, [rbp + 8]
call fcn.1400492c0
lea rcx, [rbp - 0x20]
call fcn.14004c91c
lea rcx, [rbp - 0x40]
call fcn.14004c91c
add rdi, 0x40
cmp rdi, rsi
jne 0x14022e54d
mov r12, qword [rsp + 0x70]
lea rcx, [rbp + 0x70]
call fcn.14005380c
mov ecx, 0x90
add rbx, rcx
add r13, rcx
cmp rbx, r14
jne 0x14022e36a
mov r12, qword [rsp + 0x78]
mov r13d, 4
or rdi, 0xffffffffffffffff
mov rsi, qword [rbp + 0x50]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14022e792
cmp eax, dword [rsp + 0x38]
jne 0x14022e723
mov eax, 0x80004005
mov dword [rsp + 0x30], eax
mov rbx, qword [rsp + 0x50]
mov dword [rbx + 0x80], eax
lea rcx, [rbx + 0x60]
lea rdx, [0x1404079e8]
call fcn.14005b588
mov byte [rbx + 0x58], 0xfe
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x14022e719
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.all_commands_failed_____return
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], reloc.Cabinet.dll_SetCompressorInformation
lea rax, [rsp + 0x34]
mov qword [rbp], rax
mov qword [rbp + 8], 4
lea rax, [rsp + 0x38]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351f21]
call fcn.140001078
mov r15d, dword [rsp + 0x30]
jmp 0x14022edae
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x14022e789
lea rax, str.part_of_commands_failed_____continue
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x25
lea rax, [rsp + 0x34]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 4
lea rax, [rsp + 0x38]
mov qword [rbp], rax
mov qword [rbp + 8], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351ec5]
call fcn.140001078
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x58], r13b
lea r8, [0x1402cc570]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.1400547b0
nop
lea r14, [0x140407948]
mov rdx, r14
cmp qword [0x140407960], 8
cmovae rdx, qword [0x140407948]
mov r8, qword [0x140407958]
mov rcx, rax
call fcn.140054efc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp + 0x70]
call fcn.1400492c0
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.14023d2c0
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x14022e993
lea rdx, [0x1402f5138]
lea rcx, [rbp + 0x50]
call fcn.14005d3d4
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x40]
call fcn.14007951c
nop
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r8, qword [rbp + 0x50]
mov r9, qword [rbp + 0x60]
mov rcx, rax
call fcn.140086930
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayLock
mov byte [rax], r15b
lea rcx, [rbp - 0x40]
call fcn.14004c91c
mov dword [rsp + 0x40], r15d
mov rbx, qword [rbp + 0x80]
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdx, qword [rbp + 0x70]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x14022e8e7
cmp dword [rsp + 0x40], ebx
je 0x14022e972
call fcn.140048a14
mov r10, qword [rax + 8]
lea rbx, [0x1402cb810]
cmp dword [r10], 3
jbe 0x14022e979
lea rax, str.Failed_to_write_content_to_file
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], Compress
cmp qword [0x140407960], 8
cmovae r14, qword [0x140407948]
mov rcx, rbx
mov rax, r15
test r14, r14
je 0x14022e93b
mov rcx, r14
mov rax, rdi
inc rax
cmp word [r14 + rax*2], r15w
jne 0x14022e931
mov qword [rbp - 0x10], rcx
lea eax, [rax*2 + 2]
mov dword [rbp - 8], eax
mov dword [rbp - 4], r15d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351e7e]
mov rcx, r10
call fcn.140001078
jmp 0x14022e979
lea rbx, [0x1402cb810]
lea rcx, [rbp + 0x70]
call fcn.14004c91c
nop
lea rcx, [rbp + 0x50]
call fcn.14004c91c
mov rcx, qword [rsp + 0x48]
jmp 0x14022e99a
lea rbx, [0x1402cb810]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14022e9ab
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rcx, [rbp + 0xb0]
call fcn.1400492c0
lea rcx, [rbp - 0x40]
call fcn.1401d8e64
nop
lea r8, str.CompressedCollectedData_
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140070370
nop
lea rcx, [rbp - 0x40]
call fcn.1400492c0
mov dl, 1
lea rcx, [rbp + 0x150]
call fcn.14023c970
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14022ea1c
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9b, 0xfe
lea r8, [0x140407aa8]
mov edx, eax
call fcn.14022d9c0
mov r15d, dword [rsp + 0x30]
jmp 0x14022eda1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x100], xmm0
mov word [rbp + 0xf0], r15w
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140048130
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x90]
call fcn.140231934
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14022eaff
lea rcx, [rbp + 0xf0]
call fcn.1401cce40
test eax, eax
je 0x14022eadf
call fcn.140048a14
mov rbx, qword [rax + 8]
cmp dword [rbx], 2
jbe 0x14022eadf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.Failed_to_delete_data_collection_zip_after_AdjustPackageSize_has_failed
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x90
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14035185d]
mov rcx, rbx
call fcn.140001078
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
mov r15d, dword [rsp + 0x30]
jmp 0x14022ed94
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.1401cced8
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14022ebba
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x14022ebba
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.Failed_to_delete_data_collection_base_folder_after_the_data_was_compressed
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x96
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rcx, qword [rbp + 0x90]
mov rdx, rbx
mov rax, r15
test rcx, rcx
je 0x14022eb82
mov rdx, rcx
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14022eb78
mov qword [rbp], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], r15d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351890]
mov rcx, r10
call fcn.140001078
mov edx, 0x927c0
lea rcx, [rbp + 0x1d0]
call fcn.140214070
nop
lea rcx, [rbp - 0x40]
call fcn.14026fe70
nop
mov r9, rax
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x1d0]
call fcn.140213e88
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x40]
call fcn.1400492c0
mov edx, dword [rsp + 0x30]
test edx, edx
jns 0x14022ec2b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9b, 0xfe
lea r8, [0x140407ac8]
call fcn.14022d9c0
mov r15d, dword [rsp + 0x30]
jmp 0x14022ed87
lea rcx, [rbp + 0xf0]
call fcn.1401cce40
test eax, eax
je 0x14022ec9b
call fcn.140048a14
mov r14, qword [rax + 8]
cmp dword [r14], 2
jbe 0x14022ec9b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.Failed_to_delete_data_collection_zip_after_successful_uploading
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x80
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14035185d]
mov rcx, r14
call fcn.140001078
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], r13d
jbe 0x14022ed87
lea rax, str.DataCollection_adapter_finished
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
cmp qword [r12 + 0x18], 8
jb 0x14022ece2
mov r12, qword [r12]
mov rcx, rbx
mov rax, r15
test r12, r12
je 0x14022ecfd
mov rcx, r12
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r15w
jne 0x14022ecf3
mov qword [rbp - 0x10], rcx
lea eax, [rax*2 + 2]
mov dword [rbp - 8], eax
mov dword [rbp - 4], r15d
cmp qword [rsi + 0x18], 8
jb 0x14022ed19
mov rsi, qword [rsi]
mov rax, r15
test rsi, rsi
je 0x14022ed31
mov rbx, rsi
mov rax, rdi
inc rax
cmp word [rsi + rax*2], r15w
jne 0x14022ed27
mov qword [rbp], rbx
lea eax, [rax*2 + 2]
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], r15d
mov rax, qword [rsp + 0x50]
mov al, byte [rax + 0x58]
mov byte [rsp + 0x40], al
lea rax, [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351979]
mov rcx, r10
call fcn.140001078
nop
lea rcx, [rbp + 0x1d0]
call fcn.14021417c
nop
lea rcx, [rbp + 0xf0]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x150]
call fcn.1400492c0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400492c0
nop
lea rcx, [rbp - 0x80]
call fcn.140051660
nop
lea rcx, [rbp - 0x68]
call fcn.140051660
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400492c0
lea rcx, [rbp + 0x190]
call fcn.1400492c0
lea rcx, [rbp + 0x170]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x90]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x110]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400480e0
nop
lea rcx, [rbp + 0x130]
call fcn.1400492c0
jmp 0x14022ef08
mov dword [rsp + 0x30], 0x80070490
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x14022eec9
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 4
lea rax, str.DataCollection_adapter_failed_due_to_emptiness_of_windows_or_and_profiles_folder_values
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0xb0
cmp qword [r12 + 0x18], 8
jb 0x14022ee74
mov r12, qword [r12]
lea rbx, [0x1402cb810]
mov rax, r15
test r12, r12
je 0x14022ee94
mov rbx, r12
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r15w
jne 0x14022ee8a
mov qword [rbp], rbx
lea eax, [rax*2 + 2]
mov dword [rbp + 8], eax
mov dword [rbp + 0xc], r15d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140351dd6]
call fcn.140001078
lea rdx, [0x140407988]
mov rbx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x80], eax
lea rcx, [rbx + 0x60]
call fcn.14005b588
mov byte [rbx + 0x58], 0xfe
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140048130
mov rdx, rax
call fcn.14022f62c
mov r15d, dword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400480e0
mov eax, r15d
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0x378]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret