Function at 0x140103334
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x170
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, r8
mov rbx, rcx
lea rax, [0x1401782b0]
mov rcx, qword [0x1401782b0]
cmp rcx, rax
je 0x14010339e
test byte [rcx + 0x1c], 1
je 0x14010339e
cmp byte [rcx + 0x19], 4
jb 0x14010339e
mov edx, 0xa
lea r8, [0x14015eea8]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
xor eax, eax
mov esi, eax
mov qword [rbp - 0x80], rax
mov r15d, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x28], rax
mov r13d, eax
mov qword [rbp - 0x70], rax
mov r14d, eax
mov qword [rbp - 0x58], rax
mov r12d, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x60], rax
cmp qword [rbx], rax
je 0x1401033ed
lea r8, str.m_wszSpecsXML__NULL
mov edx, 0xc1
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008624c
xor eax, eax
cmp qword [rbx + 8], rax
je 0x14010340b
lea r8, str.m_spBackupItemsRoot__NULL
mov edx, 0xc2
lea rcx, str.base_stor_blbengine_blbengutils_blbbackupitemsutils.cpp
call fcn.14008624c
mov ecx, 0x38
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
jne 0x14010342c
mov ebx, 0x8007000e
jmp 0x140103d99
xor edx, edx
lea r8d, [rdx + 0x38]
mov rcx, rax
call sub.msvcrt.dll_memset
mov r9d, 1
lea r8, str._BackupSpecs_Version__u__
lea edx, [r9 + 0x19]
mov rcx, rbx
call fcn.1400102c4
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x140103d1c
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x30]
xor ebx, ebx
inc rax
cmp word [rcx + rax*2], bx
jne 0x140103469
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x14010348d
mov ecx, eax
call fcn.140001b20
int3
mov r8d, 0xb
lea rdx, str._FileSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x1401034af
mov ecx, eax
call fcn.140001b20
int3
mov eax, ebx
mov dword [rbp - 0x50], ebx
mov ecx, dword [rbp + 0x58]
test ecx, ecx
je 0x14010384f
add rdi, 0x18
xor r14d, r14d
cmp byte [rdi + 0x3c], r14b
je 0x1401037bf
test rsi, rsi
je 0x1401034e2
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x80], r14
test r15, r15
je 0x1401034f5
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r15, r14
jmp 0x1401034f9
mov r15, qword [rbp - 0x78]
lea rcx, [rdi - 0x18]
xor r9d, r9d
lea r8, [rbp - 0x80]
mov edx, dword [rdi + 0x40]
call fcn.140089d9c
mov ebx, eax
test eax, eax
js 0x140103837
mov rax, qword [rdi - 8]
or r8, 0xffffffffffffffff
test rax, rax
je 0x140103532
mov rdx, r8
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140103526
jmp 0x140103535
mov rdx, r14
mov rax, qword [rdi]
test rax, rax
je 0x14010354c
mov rcx, r8
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140103540
jmp 0x14010354f
mov rcx, r14
mov rax, r8
mov r14, qword [rbp - 0x80]
xor r8d, r8d
inc rax
cmp word [r14 + rax*2], r8w
jne 0x140103559
add eax, edx
add ecx, 0x63
add eax, ecx
mov esi, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14010381f
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r15, rax
mov qword [rbp - 0x78], rax
xor eax, eax
test r15, r15
je 0x14010380a
mov r8d, ebx
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
lea r8, [0x140151a68]
mov rcx, r8
xor edx, edx
cmp qword [rdi], rdx
cmovne rcx, qword [rdi]
mov rax, r8
cmp qword [rdi - 8], rdx
cmovne rax, qword [rdi - 8]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._Volume_Name__ws__AccessPath__ws__OriginalAccessPath__ws__Label__ws__OriginalLabel__ws___
mov edx, esi
mov rcx, r15
call fcn.1400102c4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x140103837
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], si
jne 0x1401035fd
mov r8d, eax
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
js 0x140103802
test byte [rdi + 0x40], 1
jne 0x140103798
mov r15d, esi
cmp dword [rdi + 0x50], esi
jbe 0x140103794
mov eax, r15d
lea rsi, [rax + rax*2]
mov r14, qword [rdi + 0x58]
xor ebx, ebx
test r13, r13
je 0x140103654
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r13d, ebx
jmp 0x140103658
mov r13, qword [rbp - 0x70]
test r12, r12
je 0x14010366a
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp - 0x48], rbx
lea rdx, [rbp - 0x48]
mov rcx, qword [r14 + rsi*8]
call fcn.140086e28
mov ebx, eax
xor r8d, r8d
test eax, eax
js 0x1401037f4
or r9, 0xffffffffffffffff
mov rdx, r9
mov rax, qword [rbp - 0x48]
inc rdx
cmp word [rax + rdx*2], r8w
jne 0x14010368f
mov rcx, qword [r14 + rsi*8 + 8]
mov rax, r9
inc rax
cmp word [rcx + rax*2], r8w
jne 0x1401036a1
add edx, eax
mov al, byte [r14 + rsi*8 + 0x10]
neg al
sbb ecx, ecx
add ecx, 5
add edx, ecx
mov al, byte [r14 + rsi*8 + 0x11]
neg al
sbb ecx, ecx
lea eax, [rcx + 0x56]
add eax, edx
mov r12d, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1401037ee
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r13, rax
mov qword [rbp - 0x70], rax
xor eax, eax
test r13, r13
je 0x1401037d9
mov r8d, ebx
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
lea rax, str.false
mov rcx, rax
xor edx, edx
cmp byte [r14 + rsi*8 + 0x11], dl
lea r8, str.true
cmovne rcx, r8
cmp byte [r14 + rsi*8 + 0x10], dl
cmovne rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + rsi*8 + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x48]
lea r8, str._FileSpec_FilePath__ws__FileName__ws__IsRecursive__ws__IsInclude__ws____
mov edx, r12d
mov rcx, r13
call fcn.1400102c4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x140103c84
or rax, 0xffffffffffffffff
inc rax
cmp word [r13 + rax*2], si
jne 0x140103765
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
js 0x1401037d1
inc r15d
cmp r15d, dword [rdi + 0x50]
mov r12, qword [rbp - 0x48]
jb 0x140103634
mov r15, qword [rbp - 0x78]
mov r8d, 9
lea rdx, str.__Volume_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
js 0x1401037fa
mov rsi, qword [rbp - 0x80]
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp + 0x58]
xor r14d, r14d
inc eax
mov dword [rbp - 0x50], eax
sub rdi, 0xffffffffffffff80
cmp eax, ecx
jae 0x14010384b
jmp 0x1401034c6
mov ecx, eax
call fcn.140001b20
int3
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r14, rax
jmp 0x140103d22
mov r15, qword [rbp - 0x78]
jmp 0x140103823
mov r15, qword [rbp - 0x78]
jmp 0x140103828
mov ecx, eax
call fcn.140001b20
int3
mov ecx, eax
call fcn.140001b20
int3
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r14, rax
mov r13, qword [rbp - 0x70]
jmp 0x140103d22
mov r13, qword [rbp - 0x70]
mov ebx, 0x80070216
mov rsi, qword [rbp - 0x80]
mov r14, r8
mov r12, r8
jmp 0x140103d25
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x58]
mov r13, qword [rbp - 0x70]
mov r12, r14
jmp 0x140103d25
mov r14, qword [rbp - 0x58]
mov r8d, 0xc
lea rdx, str.__FileSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
xor r13d, r13d
test eax, eax
jns 0x140103874
mov ecx, eax
call fcn.140001b20
int3
mov dil, byte [rbp + 0x78]
mov al, dil
neg al
sbb rcx, rcx
lea rax, [rcx + 0x29]
mov esi, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x14010389d
mov ebx, 0x80070216
jmp 0x140103976
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r12, rax
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1401038c9
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
jmp 0x140103d25
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r15, str.false
mov r9, r15
test dil, dil
lea rax, str.true
cmovne r9, rax
lea r8, str._SystemState_IsPresent__ws____
mov rdx, rsi
mov rcx, r12
call fcn.1400102c4
mov ebx, eax
test eax, eax
js 0x1401038b8
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r13w
jne 0x14010390a
mov r8d, eax
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x14010392f
mov ecx, eax
call fcn.140001b20
int3
mov dil, byte [rbp + 0x80]
mov al, dil
neg al
sbb rcx, rcx
lea rax, [rcx + 0x29]
mov esi, eax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x14010395b
mov ebx, 0x80070216
jmp 0x1401038b8
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r12, rax
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x14010398b
mov ebx, 0x8007000e
mov rsi, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
mov r12, qword [rbp - 0x68]
jmp 0x140103d25
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
test dil, dil
lea rax, str.true
cmovne r15, rax
mov r9, r15
lea r8, str._AllCritical_IsPresent__ws____
mov rdx, rsi
mov rcx, r12
call fcn.1400102c4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x140103976
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r12 + rax*2], si
jne 0x1401039ca
mov r8d, eax
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x1401039ef
mov ecx, eax
call fcn.140001b20
int3
mov r8d, 0x10
lea rdx, str._ComponentSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x140103a11
mov ecx, eax
call fcn.140001b20
int3
mov dword [rbp - 0x50], esi
cmp dword [rbp + 0x68], esi
jbe 0x140103c8c
mov r13, qword [rbp + 0x70]
add r13, 8
mov qword [rbp - 0x38], r13
test r14, r14
je 0x140103a3a
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r14, rsi
mov rcx, qword [r13]
test rcx, rcx
je 0x140103a51
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x140103a46
jmp 0x140103a54
mov rax, rsi
lea ecx, [rax + 0x10f]
mov rdx, qword [r13 - 8]
test rdx, rdx
je 0x140103a71
mov rax, rbx
inc rax
cmp word [rdx + rax*2], si
jne 0x140103a66
jmp 0x140103a74
mov rax, rsi
add ecx, eax
mov rdx, qword [r13 + 0x28]
test rdx, rdx
je 0x140103a8d
mov rax, rbx
inc rax
cmp word [rdx + rax*2], si
jne 0x140103a82
jmp 0x140103a90
mov rax, rsi
add eax, ecx
mov qword [rbp - 0x10], rax
add rax, rax
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140103893
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140103971
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rcx, [0x140151a68]
mov rax, rcx
cmp qword [r13 + 0x28], rsi
cmovne rax, qword [r13 + 0x28]
mov qword [rbp - 8], rax
mov rax, rcx
cmp qword [r13 - 8], rsi
cmovne rax, qword [r13 - 8]
mov qword [rbp - 0x20], rax
mov rax, rcx
cmp qword [r13], rsi
cmovne rax, qword [r13]
mov qword [rbp - 0x18], rax
movzx eax, byte [r13 + 0x27]
movzx ecx, byte [r13 + 0x26]
movzx edx, byte [r13 + 0x25]
movzx r8d, byte [r13 + 0x24]
movzx r9d, byte [r13 + 0x23]
movzx r10d, byte [r13 + 0x22]
movzx r11d, byte [r13 + 0x21]
movzx ebx, byte [r13 + 0x20]
movzx edi, word [r13 + 0x1e]
movzx esi, word [r13 + 0x1c]
movzx r14d, byte [r13 + 0x17]
mov dword [rbp - 0x3c], r14d
movzx r15d, byte [r13 + 0x16]
movzx r12d, byte [r13 + 0x15]
movzx r13d, byte [r13 + 0x14]
mov r14, qword [rbp - 8]
mov qword [rsp + 0xd8], r14
mov r14, qword [rbp - 0x20]
mov qword [rsp + 0xd0], r14
mov r14, qword [rbp - 0x18]
mov qword [rsp + 0xc8], r14
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xb8], ecx
mov dword [rsp + 0xb0], edx
mov dword [rsp + 0xa8], r8d
mov dword [rsp + 0xa0], r9d
mov dword [rsp + 0x98], r10d
mov dword [rsp + 0x90], r11d
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x78], esi
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x70], eax
mov r14d, dword [rbp - 0x3c]
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov r13, qword [rbp - 0x38]
movzx eax, byte [r13 + 0x13]
mov dword [rsp + 0x48], eax
movzx eax, byte [r13 + 0x12]
mov dword [rsp + 0x40], eax
movzx eax, byte [r13 + 0x11]
mov dword [rsp + 0x38], eax
movzx eax, byte [r13 + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, word [r13 + 0xe]
mov dword [rsp + 0x28], eax
movzx eax, word [r13 + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [r13 + 8]
lea r8, str._ComponentSpec_WriterId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__InstanceId__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x__ComponentName__ws__LogicalPath__ws__Caption__ws____
mov rdx, qword [rbp - 0x10]
mov r14, qword [rbp - 0x58]
mov rcx, r14
call fcn.1400102c4
mov ebx, eax
xor esi, esi
test eax, eax
js 0x140103976
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r14 + rax*2], si
jne 0x140103c45
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
js 0x140103c7c
mov ecx, dword [rbp - 0x50]
inc ecx
mov dword [rbp - 0x50], ecx
add r13, 0x48
mov qword [rbp - 0x38], r13
cmp ecx, dword [rbp + 0x68]
jae 0x140103c8c
jmp 0x140103a29
mov ecx, eax
call fcn.140001b20
int3
mov r14, rsi
jmp 0x140103976
mov r8d, 0x11
lea rdx, str.__ComponentSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x140103cae
mov ecx, eax
call fcn.140001b20
int3
mov r8d, 0xe
lea rdx, str.__BackupSpecs_
lea rcx, [rbp - 0x60]
call fcn.14006cccc
test eax, eax
jns 0x140103cd0
mov ecx, eax
call fcn.140001b20
int3
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140103d08
test byte [rcx + 0x1c], 1
je 0x140103d08
cmp byte [rcx + 0x19], 4
jb 0x140103d08
mov edx, 0xb
mov r9, qword [rbp - 0x60]
lea r8, [0x14015eea8]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x50]
call fcn.140103dfc
mov ebx, eax
jmp 0x140103976
mov r15, rax
mov r13, rax
mov r12, rax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15, r15
je 0x140103d3d
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x140103d4b
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r14, r14
je 0x140103d59
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140103d6b
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12, r12
je 0x140103d79
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x140103d8b
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
je 0x140103d99
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140103dce
test byte [rcx + 0x1c], 1
je 0x140103dce
cmp byte [rcx + 0x19], 4
jb 0x140103dce
mov edx, 0xc
lea r8, [0x14015eea8]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
nop
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret