Function at 0x140024cd0
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x128]
sub rsp, 0x228
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov ebx, r9d
mov dword [rbp - 0x44], ebx
mov qword [rbp + 0x58], r8
mov qword [rbp + 0x88], rdx
mov r13, rcx
mov qword [rbp - 0x40], rcx
mov r12, qword [rbp + 0x190]
mov qword [rbp - 0x38], r12
mov r15, qword [rbp + 0x198]
mov qword [rbp - 0x50], r15
mov rsi, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rsi
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x78], rax
xor ecx, ecx
mov dword [rbp - 0x10], ecx
mov dword [rbp - 0x58], ecx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x70], rcx
mov edi, ecx
mov qword [rbp - 0x28], rcx
mov r14d, ecx
mov qword [rbp - 0x78], rcx
mov qword [rbp], rcx
mov dword [rsp + 0x70], ecx
mov qword [rbp - 8], rcx
mov byte [rbp - 0x5f], cl
mov byte [rbp - 0x5d], cl
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x48], cl
mov byte [rbp - 0x60], cl
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x18], rcx
lea rax, [0x1401782b0]
mov rcx, qword [0x1401782b0]
cmp rcx, rax
je 0x140024dc8
test byte [rcx + 0x1c], 1
je 0x140024dc8
cmp byte [rcx + 0x19], 4
jb 0x140024dc8
mov edx, 0x1fc
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
cmp ebx, dword [r13 + 0x170]
je 0x140024de9
lea r8, str.cVolumeName__m_cVolume
mov edx, 0x2f13
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
mov byte [rsi], dil
mov rax, qword [rbp + 0x78]
and dword [rax], edi
lea rax, [r13 + 0x18]
mov qword [rbp + 0xb0], rax
lea rbx, [rax + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe0]
mov dword [r15 + 0x10], eax
lea rcx, [rbp - 0x48]
call fcn.140090220
mov esi, eax
test eax, eax
jns 0x140024e7c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14002709e
test byte [rcx + 0x1c], 1
je 0x14002709e
cmp byte [rcx + 0x19], 2
jb 0x14002709e
mov edx, 0x1fd
mov r9d, esi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
jmp 0x14002709e
lea r8, [rbp + 8]
lea rdx, [0x14014d7b8]
mov rcx, qword [r13 + 0x158]
call fcn.140087120
mov esi, eax
test eax, eax
js 0x14002709e
mov ebx, dword [rbp - 0x44]
shl rbx, 4
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x140024ec0
mov esi, 0x8007000e
jmp 0x14002709e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x44]
shl eax, 4
mov ebx, eax
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140024eb6
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov edi, dword [rbp - 0x44]
cmp dword [r15 + 8], edi
jae 0x140026f79
mov al, r14b
mov byte [rsp + 0x74], 0
mov byte [rbp - 0x70], 0
neg al
sbb eax, eax
and dword [rbp - 0x20], eax
xor al, al
mov byte [rbp - 0x80], al
mov edi, dword [r15 + 8]
imul rax, rdi, 0x170
add rax, qword [r13 + 0xd8]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x58]
mov r12, qword [rax + rdi*8]
mov qword [rsp + 0x78], r12
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r13 + 0x174], edi
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0x100]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov rdi, qword [rbp - 0x68]
test byte [rdi + 0x54], 1
je 0x140024f7e
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax + rcx*8]
jmp 0x14002508c
xor ebx, ebx
mov rcx, qword [r13 + 0x1b0]
cmp dword [rcx + 0x50], ebx
jbe 0x140024fbd
mov eax, ebx
imul r14, rax, 0x38
add r14, qword [rcx + 0x58]
mov qword [rbp + 0x70], r14
mov rdx, r12
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140024fb9
inc ebx
mov rcx, qword [r13 + 0x1b0]
cmp ebx, dword [rcx + 0x50]
jb 0x140024f8c
mov r14, qword [rbp - 0x78]
mov rax, qword [r13 + 0x1b0]
cmp ebx, dword [rax + 0x50]
jne 0x140025021
mov r12d, dword [rdi + 0x20]
test r12d, r12d
js 0x140025011
mov r12d, 0x80780020
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025018
test byte [rcx + 0x1c], 1
je 0x140025018
cmp byte [rcx + 0x19], 2
jb 0x140025018
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
mov byte [rbp - 0x70], 1
jmp 0x140026bad
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x140025039
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14002508c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025084
test byte [rcx + 0x1c], 1
je 0x140025084
cmp byte [rcx + 0x19], 2
jb 0x140025084
mov edx, 0x1ff
mov r9, r12
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
mov r12d, 0x80780020
jmp 0x140025018
lea rdx, [rbp - 0x28]
call fcn.140086ee4
test eax, eax
mov r12d, eax
js 0x14002525b
test byte [rdi + 0x54], 0x40
je 0x140025108
mov rdx, rdi
mov rcx, r13
call fcn.140023764
mov esi, eax
test eax, eax
js 0x140027080
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe4]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe4]
mov dword [r15 + 0xc], eax
mov eax, dword [r13 + 0x174]
shl rax, 4
movups xmm0, xmmword [rbp + 0x100]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rax + rcx], xmm0
inc dword [r15 + 8]
mov al, byte [rbp - 0x80]
jmp 0x140026f03
mov ebx, 8
test byte [rdi + 0x54], bl
jne 0x1400251ab
test byte [rdi + 0x54], 0x20
jne 0x140025134
lea r8, str.VOLUME_HAS_SYSTEMSTATE_pVolCtxt__m_dwVolumeFlags_
mov edx, 0x2faf
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
mov rax, qword [0x1401782b0]
lea rcx, [0x1401782b0]
cmp rax, rcx
je 0x140025188
test byte [rax + 0x1c], 1
je 0x140025188
cmp byte [rax + 0x19], 4
jb 0x140025188
lea rdx, [rdi + 0x44]
lea rcx, [rbp + 0x90]
call fcn.140010344
nop
or dword [rbp - 0x10], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x140151a70]
mov rcx, qword [0x1401782b0]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
nop
mov eax, dword [rbp - 0x10]
test al, 1
je 0x1400250fc
and eax, 0xfffffffe
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400250fc
mov r8b, 1
mov edx, ebx
mov rcx, r13
call fcn.14002d014
mov dword [r15 + 0x2c], ebx
mov rbx, qword [rbp - 0x38]
mov eax, dword [rbx + 8]
cmp dword [r15 + 8], eax
jne 0x1400251dd
cmp qword [rbx + 0x30], 0
je 0x1400251dd
mov r14, qword [rbx + 0x30]
mov qword [rbp - 0x78], r14
jmp 0x14002577e
test r14, r14
je 0x1400251f6
cmp r14, qword [r15 + 0x30]
je 0x1400251f6
cmp r14, qword [rbx + 0x30]
je 0x1400251f6
mov rcx, r14
call fcn.1400beb88
xor ebx, ebx
mov r14d, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x30], rbx
test byte [rdi + 0x54], 1
je 0x140025267
mov rcx, r13
call fcn.14002e0e8
mov r12d, eax
test eax, eax
jns 0x140025267
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026bad
test byte [rcx + 0x1c], 1
je 0x140026bad
cmp byte [rcx + 0x19], 2
jb 0x140026bad
mov edx, 0x201
mov r9d, esi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
mov rcx, qword [0x1401782b0]
jmp 0x140026bad
lea r14, [r13 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [r13 + 0x154], 0x10
jne 0x1400252cd
cmp byte [r13 + 0x17c], bl
jne 0x1400252b5
cmp byte [r13 + 0x17d], bl
je 0x1400252cd
lea r8, str.COMPACT_m_ulFeatures____m_rules.m_bExcludeAudio___m_rules.m_bExcludeVideo
mov edx, 0x2fe9
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025311
test byte [rcx + 0x1c], 1
je 0x140025311
mov rbx, qword [rbp - 0x28]
cmp byte [rcx + 0x19], 4
jb 0x140025315
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005d7c
jmp 0x140025315
mov rbx, qword [rbp - 0x28]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, 0x8c
add rcx, qword [r13 + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [r13 + 0x154]
test al, 2
je 0x140025397
shr eax, 4
and al, 1
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x38], rcx
mov r9b, byte [r13 + 0x17d]
mov r8b, byte [r13 + 0x17c]
mov dl, al
mov rcx, rbx
call fcn.1400b6fe4
mov esi, eax
jmp 0x140025490
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x38], 0
xor r9d, r9d
mov r8b, byte [r13 + 0x17d]
mov dl, byte [r13 + 0x17c]
mov rcx, rbx
call fcn.1400b71c0
mov esi, eax
test eax, eax
jne 0x140025490
mov rbx, qword [rbp - 0x30]
mov qword [rbp - 0x78], rbx
test rbx, rbx
jne 0x14002541e
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fb9
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008624c
cmp byte [rbx + 0xb8], 0
je 0x14002546a
mov edx, 0x2000
mov rcx, rdi
call fcn.1400130cc
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025498
test byte [rcx + 0x1c], 1
je 0x140025498
cmp byte [rcx + 0x19], 4
jb 0x140025498
mov edx, 0x203
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
jmp 0x140025498
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025498
test byte [rcx + 0x1c], 1
je 0x140025498
cmp byte [rcx + 0x19], 4
jb 0x140025498
mov edx, 0x204
jmp 0x140025458
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x78], rax
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
mov rax, qword [r13 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp r10, rax
je 0x140025558
test byte [r10 + 0x1c], 1
je 0x140025558
cmp byte [r10 + 0x19], 4
jb 0x140025558
mov eax, dword [r13 + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [r13 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0x80], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0x84], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0x60], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x60]
sub rcx, qword [rbp + 0x80]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x140151a70]
mov rcx, qword [r10 + 0x10]
call fcn.140010678
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
mov rdi, qword [rbp + 0x30]
mov qword [rcx], rdi
mov rbx, qword [rbp + 0x28]
mov qword [rcx + 8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [r15 + 0x20], rbx
mov qword [r15 + 0x18], rdi
mov ecx, esi
test esi, esi
je 0x140025772
sub ecx, 1
je 0x140025734
sub ecx, 3
je 0x1400256a1
sub ecx, 1
je 0x140025642
sub ecx, 1
je 0x1400256a1
sub ecx, 1
je 0x140025642
sub ecx, 0xf
je 0x1400256a1
cmp ecx, 9
je 0x1400256a1
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025622
test byte [rcx + 0x1c], 1
je 0x140025622
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140025626
mov edx, 0x208
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x140025626
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, esi
call fcn.1400ff178
mov r12d, eax
mov rcx, qword [0x1401782b0]
jmp 0x140026ba5
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025689
test byte [rcx + 0x1c], 1
je 0x140025689
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14002568d
mov edx, 0x207
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x14002568d
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, esi
call fcn.1400ff178
mov byte [rsp + 0x74], 1
jmp 0x140025633
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x1400256e8
test byte [rcx + 0x1c], 1
je 0x1400256e8
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x1400256ec
mov edx, 0x206
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x1400256ec
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, esi
call fcn.1400ff178
mov r12d, eax
mov rdi, qword [rbp - 0x68]
test byte [rdi + 0x54], 1
jne 0x140025724
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x28]
call fcn.140024a68
test eax, eax
js 0x140025724
cmp byte [rbp - 0x60], 0
mov eax, 0x80780169
cmove r12d, eax
mov byte [rbp - 0x70], 1
mov rcx, qword [0x1401782b0]
jmp 0x140026ba9
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14014cce0]
lea rcx, [r13 + 0x18]
call rbx
mov rcx, qword [0x1401782b0]
mov rdi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
test al, al
je 0x140026bb2
mov r12d, 0x80780167
jmp 0x140026bb2
mov rdi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x38]
mov qword [r15 + 0x30], r14
mov eax, dword [rbx + 8]
cmp dword [r15 + 8], eax
jne 0x1400257b7
cmp qword [rbx + 0x30], 0
jne 0x14002579c
test byte [rdi + 0x54], 1
jne 0x14002579c
mov qword [rbx + 0x30], r14
cmp dword [r15 + 8], eax
jne 0x1400257b7
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400257b7
mov qword [rbp], rcx
mov edx, dword [rbx + 0x40]
jmp 0x14002587c
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400257d2
cmp rcx, qword [r15 + 0x38]
je 0x1400257d2
cmp rcx, qword [rbx + 0x38]
je 0x1400257d2
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
mov qword [rbp], rcx
xor edx, edx
mov dword [rbp - 0x18], edx
test byte [r13 + 0x154], 2
je 0x14002587c
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x18]
lea rdx, [rbp]
mov rcx, r14
call fcn.1400bb020
mov ebx, eax
test eax, eax
je 0x140025871
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14002584d
test byte [rcx + 0x1c], 1
je 0x14002584d
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140025851
mov edx, 0x209
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x140025851
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, ebx
call fcn.1400ff178
mov r12d, eax
mov rcx, qword [0x1401782b0]
mov rdi, qword [rbp - 0x68]
jmp 0x140026bad
mov rcx, qword [rbp]
mov edx, dword [rbp - 0x18]
mov rbx, qword [rbp - 0x38]
mov qword [r15 + 0x38], rcx
mov dword [r15 + 0x40], edx
mov eax, dword [rbx + 8]
cmp dword [r15 + 8], eax
jne 0x1400258a1
cmp qword [rbx + 0x38], 0
jne 0x1400258a1
test byte [rdi + 0x54], 1
jne 0x1400258a1
mov qword [rbx + 0x38], rcx
mov dword [rbx + 0x40], edx
mov r8b, 1
mov ebx, 9
mov edx, ebx
mov rcx, r13
call fcn.14002d014
mov edx, ebx
mov rcx, r15
call fcn.140014d58
test byte [r13 + 0x154], 2
je 0x140025917
lea r9, [rsp + 0x70]
mov rdx, qword [rbp]
mov rcx, r14
call fcn.1400bb1dc
mov ebx, eax
test eax, eax
je 0x140025917
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14002584d
test byte [rcx + 0x1c], 1
je 0x14002584d
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x140025851
mov edx, 0x20a
jmp 0x14002582e
mov rax, qword [rbp - 8]
test rax, rax
je 0x14002592e
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp - 8], 0
lea rdx, [rdi + 0x44]
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9, str..vhdx
mov r8d, dword [rdi + 0x54]
mov rcx, qword [r13 + 0x1d8]
call fcn.14011057c
mov r12d, eax
test eax, eax
js 0x14002525b
lea r14, [r13 + 0x28]
mov rcx, r14
call fcn.1400fc870
mov rbx, qword [rbp - 8]
mov rdx, rbx
mov rcx, r13
call fcn.140020d70
mov r12d, eax
test eax, eax
jns 0x1400259d1
mov byte [rsp + 0x74], 1
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026ba9
test byte [rcx + 0x1c], 1
je 0x140026ba9
cmp byte [rcx + 0x19], 2
jb 0x140026ba9
mov edx, 0x20b
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
jmp 0x140025728
xor edx, edx
mov rcx, r14
call fcn.1400fc6dc
mov esi, eax
test eax, eax
js 0x140027080
xor ebx, ebx
xor edi, edi
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0xa0]
mov rsi, qword [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x140025a1c
mov rcx, rsi
call fcn.140133a1c
mov r12d, eax
jmp 0x140025a2d
mov rbx, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
xor r12d, r12d
and qword [rbp + 0x38], 0
xor sil, sil
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswbengine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140025b36
and dword [rbp - 0x18], eax
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FreeSpace
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140025ab3
mov eax, dword [rbp - 0x18]
shl rax, 0x14
test rax, rax
je 0x140025aee
cmp rax, rdi
jae 0x140025aee
mov rdi, rax
mov sil, 1
jmp 0x140025aee
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025b2a
test byte [rcx + 0x1c], 1
je 0x140025afc
cmp byte [rcx + 0x19], 5
jb 0x140025afc
mov edx, 0x20c
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025b2a
test byte [rcx + 0x1c], 1
je 0x140025b2a
cmp byte [rcx + 0x19], 4
jb 0x140025b2a
mov edx, 0x20d
lea rax, str.SYSTEMCurrentControlSetServiceswbengine
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140011594
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140025b71
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025b7f
test byte [rcx + 0x1c], 1
je 0x140025b7f
cmp byte [rcx + 0x19], 5
jb 0x140025b7f
mov edx, 0x20e
lea r9, str.SYSTEMCurrentControlSetServiceswbengine
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
lea rax, [0x1401782b0]
mov rcx, qword [0x1401782b0]
test r12d, r12d
jns 0x140025b8e
mov byte [rsp + 0x74], 1
jmp 0x140026ba5
cmp rcx, rax
je 0x140025bbc
test byte [rcx + 0x1c], 1
je 0x140025bbc
cmp byte [rcx + 0x19], 4
jb 0x140025bbc
mov edx, 0x20f
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004df4
mov rcx, r14
call fcn.1400fc870
test byte [r13 + 0x154], 2
je 0x140025d74
mov eax, dword [r15 + 0xc]
mov r8, qword [rbp - 0x38]
cmp eax, dword [r8 + 0xc]
jne 0x140025c07
mov bl, 1
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140025c6e
test byte [rcx + 0x1c], bl
je 0x140025c6e
cmp byte [rcx + 0x19], 4
jb 0x140025c6e
mov edx, 0x210
jmp 0x140025c4f
ja 0x140025c25
lea r8, str.pMediaCtxt__m_ulBagCount___pInitialMediaCtxt__m_ulBagCount
mov edx, 0x3112
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
mov r8, qword [rbp - 0x38]
xor bl, bl
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025c75
test byte [rcx + 0x1c], 1
je 0x140025c75
cmp byte [rcx + 0x19], 4
jb 0x140025c75
mov edx, 0x211
mov eax, dword [r15 + 0xc]
mov r9d, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.1400103bc
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
mov edx, 0x1400000
cmp rdi, rdx
ja 0x140025cce
neg bl
sbb r12d, r12d
and r12d, 0x44
add r12d, 0x80780030
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x140026ba5
test byte [rcx + 0x1c], 1
je 0x140026ba5
cmp byte [rcx + 0x19], 3
jb 0x140026ba5
mov edx, 0x212
mov r9, rdi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010678
jmp 0x140025636
test sil, sil
jne 0x140025d2c
mov r8d, 0x40000000
cmp rdi, r8
ja 0x140025d2c
test bl, bl
je 0x140025d2c
mov r12d, 0x80780080
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x140026ba5
test byte [rcx + 0x1c], 1
je 0x140026ba5
cmp byte [rcx + 0x19], 3
jb 0x140026ba5
mov edx, 0x213
mov qword [rsp + 0x20], r8
mov r9, rdi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004df4
jmp 0x140025636
sub rdi, rdx
cmp rdi, 0x1100000
ja 0x140025d74
neg bl
sbb r12d, r12d
and r12d, 0x44
add r12d, 0x80780030
mov byte [rsp + 0x74], 1
cmp rcx, rax
je 0x140026ba5
test byte [rcx + 0x1c], 1
je 0x140026ba5
cmp byte [rcx + 0x19], 3
jb 0x140026ba5
mov edx, 0x214
jmp 0x140025cb6
mov sil, 1
mov byte [rbp - 0x5c], sil
mov rbx, qword [rbp + 0x10]
test byte [r13 + 0x154], 4
je 0x140025db8
mov r9d, dword [r13 + 0x174]
shl r9d, 4
add r9, rbx
lea r8, [rbp - 0x5c]
mov rdx, qword [rbp + 0x88]
mov rcx, r13
call fcn.14001f3e0
mov esi, eax
test eax, eax
js 0x140027080
mov sil, byte [rbp - 0x5c]
mov byte [rbp - 0x5e], sil
lea r15, [r13 + 0x58]
mov qword [rbp - 0x18], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, qword [r13 + 0xd8]
and qword [rcx], 0
and qword [rcx + 8], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025e64
test byte [rcx + 0x1c], 1
je 0x140025e39
cmp byte [rcx + 0x19], 4
jb 0x140025e39
mov edx, 0x215
mov r9, rdi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010678
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140025e64
test byte [rcx + 0x1c], 1
je 0x140025e64
cmp byte [rcx + 0x19], 4
jb 0x140025e64
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
mov eax, dword [r13 + 0x174]
imul rcx, rax, 0x170
add rcx, 0x9c
add rcx, qword [r13 + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
test byte [r13 + 0x154], 2
je 0x140025f25
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x140025eaa
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r13 + 0x174]
shl ecx, 4
add rcx, rbx
cmp dword [r13 + 0x150], 4
sete r8b
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x47]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x5e]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r13
mov r9, rdi
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x78]
call fcn.1400b7edc
mov r13d, eax
mov r14b, byte [rbp - 0x47]
jmp 0x1400263ec
and qword [rbp - 0x30], 0
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0xc8]
call sub.msvcrt.dll_memset
test sil, sil
jne 0x140025fde
xor edx, edx
mov rcx, r14
call fcn.1400fc6dc
mov esi, eax
test eax, eax
js 0x14002707c
mov r15, qword [rbp - 8]
mov rcx, r15
call fcn.14008d724
mov bl, al
mov rcx, r14
call fcn.1400fc870
test bl, bl
je 0x140025fe2
mov dword [rbp + 0xc8], 2
lea r8, [rbp + 0xc8]
mov rdx, r15
mov rcx, r14
call fcn.14011f69c
test eax, eax
jns 0x140025fe2
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140025fd5
test byte [rcx + 0x1c], 1
je 0x140025fd5
cmp byte [rcx + 0x19], 2
jb 0x140025fd5
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, r15
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
mov rcx, qword [0x1401782b0]
mov r15, qword [rbp - 0x50]
jmp 0x140026ba5
mov r15, qword [rbp - 8]
lea r9, [rbp - 0x30]
mov r8, qword [rbp + 0x50]
mov rdi, qword [rbp - 0x68]
mov rdx, rdi
mov rcx, r13
call fcn.140022d8c
test eax, eax
jns 0x140026010
mov r12d, eax
mov rcx, qword [0x1401782b0]
mov r15, qword [rbp - 0x50]
jmp 0x140026ba9
xor edx, edx
mov rcx, r14
call fcn.1400fc6dc
mov esi, eax
test eax, eax
js 0x14002707c
lea rdx, [rbp + 0x18]
mov rcx, r15
call fcn.14011bb58
mov ebx, eax
mov rcx, r14
call fcn.1400fc870
test ebx, ebx
jns 0x140026085
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026080
test byte [rcx + 0x1c], 1
je 0x140026080
cmp byte [rcx + 0x19], 2
jb 0x140026080
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, r15
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
mov rcx, qword [0x1401782b0]
mov r12d, ebx
jmp 0x140026007
movups xmm0, xmmword [rbp + 0xd0]
movdqu xmmword [rbp + 0xf0], xmm0
mov ecx, dword [r13 + 0x174]
shl ecx, 4
add rcx, qword [rbp + 0x10]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov rsi, qword [rbp + 0x18]
mov qword [rsp + 0x38], rsi
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5e]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r13
lea rdx, [0x140020ac0]
mov r14, qword [rbp - 0x78]
mov rcx, r14
call fcn.1400b9a6c
mov r13d, eax
test eax, eax
jne 0x14002621c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14002618e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140026170
test byte [rcx + 0x1c], 1
je 0x140026170
cmp byte [rcx + 0x19], 2
jb 0x140026170
mov edx, 0x219
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
mov rcx, qword [0x1401782b0]
mov eax, dword [rsp + 0x70]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov r13, qword [rbp - 0x40]
mov r15, qword [rbp - 0x50]
jmp 0x140026bad
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x1400261ca
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140026170
test byte [rcx + 0x1c], 1
je 0x140026170
cmp byte [rcx + 0x19], 2
jb 0x140026170
mov edx, 0x21a
jmp 0x140026152
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140026216
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140026170
test byte [rcx + 0x1c], 1
je 0x140026170
cmp byte [rcx + 0x19], 2
jb 0x140026170
mov edx, 0x21b
jmp 0x140026152
xor esi, esi
mov qword [rbp + 0x18], rsi
mov r15, qword [0x1401782b0]
lea rbx, [0x1401782b0]
cmp r15, rbx
je 0x1400262f1
test byte [r15 + 0x1c], 4
je 0x1400262f1
cmp byte [r15 + 0x19], 4
jb 0x1400262f1
movzx eax, byte [rdi + 0x147]
movzx ecx, byte [rdi + 0x146]
movzx r8d, byte [rdi + 0x145]
movzx r9d, byte [rdi + 0x144]
movzx r10d, byte [rdi + 0x143]
movzx r11d, byte [rdi + 0x142]
movzx ebx, byte [rdi + 0x141]
movzx edi, byte [rdi + 0x140]
mov r14, qword [rbp - 0x68]
movzx esi, word [r14 + 0x13e]
movzx r14d, word [r14 + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rdi, qword [rbp - 0x68]
mov r9d, dword [rdi + 0x138]
lea r8, [0x140151a70]
mov rcx, qword [r15 + 0x10]
call fcn.140010404
mov r14, qword [rbp - 0x78]
lea rbx, [0x1401782b0]
test r14, r14
jne 0x14002630e
lea r8, str.ReplicationContext___NULL
mov edx, 0x1fae
lea rcx, str.base_stor_blb_blbimg_blbimg.cxx
call fcn.14008624c
movups xmm0, xmmword [r14 + 0x30]
movdqu xmmword [rdi + 0x148], xmm0
mov r15, qword [0x1401782b0]
cmp r15, rbx
je 0x1400263dd
test byte [r15 + 0x1c], 4
je 0x1400263dd
cmp byte [r15 + 0x19], 4
jb 0x1400263dd
movzx eax, byte [rdi + 0x157]
movzx ecx, byte [rdi + 0x156]
movzx r8d, byte [rdi + 0x155]
movzx r9d, byte [rdi + 0x154]
movzx r10d, byte [rdi + 0x153]
movzx r11d, byte [rdi + 0x152]
movzx ebx, byte [rdi + 0x151]
movzx edi, byte [rdi + 0x150]
mov rdx, qword [rbp - 0x68]
movzx esi, word [rdx + 0x14e]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov r14, qword [rbp - 0x68]
mov r9d, dword [r14 + 0x148]
lea r8, [0x140151a70]
mov rcx, qword [r15 + 0x10]
call fcn.140010404
mov r14b, 1
mov byte [rbp - 0x47], r14b
mov sil, byte [rbp - 0x5c]
mov r15, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x40]
mov eax, dword [rdi + 0x174]
imul rcx, rax, 0x170
mov rax, qword [rdi + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp r10, rax
je 0x1400264a1
test byte [r10 + 0x1c], 1
je 0x1400264a1
cmp byte [r10 + 0x19], 4
jb 0x1400264a1
mov eax, dword [rdi + 0x174]
imul rdx, rax, 0x170
mov rcx, qword [rdi + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x68], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x6c], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x48], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x4c], eax
mov rcx, qword [rbp + 0x48]
sub rcx, qword [rbp + 0x68]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x140151a70]
mov rcx, qword [r10 + 0x10]
call fcn.140010678
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [rbp - 0x5e]
cmp byte [rbp - 0x5d], 0
je 0x1400264cf
mov rax, qword [rbp - 0x68]
mov byte [rax + 0x84], 1
test bl, bl
jne 0x1400264cf
mov edx, 0x10
mov rcx, rax
call fcn.1400130cc
test sil, sil
jne 0x140026522
test bl, bl
je 0x140026522
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14002650c
test byte [rcx + 0x1c], 1
je 0x14002650c
cmp byte [rcx + 0x19], 4
jb 0x14002650c
mov edx, 0x21f
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
mov rax, qword [rdi + 0x188]
mov rcx, qword [rbp - 0x68]
mov qword [rcx + 0x78], rax
and dword [rcx + 0x80], 0
mov byte [rbp - 0x5f], 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rdi + 0x174]
imul rcx, rax, 0x170
add rcx, qword [rdi + 0xd8]
mov rdi, qword [rbp + 0x30]
mov qword [rcx], rdi
mov rbx, qword [rbp + 0x28]
mov qword [rcx + 8], rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rbp - 0x50]
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x18], rdi
mov ecx, r13d
xor ebx, ebx
test r13d, r13d
je 0x1400269cd
sub ecx, 1
je 0x140026985
sub ecx, 3
je 0x1400268dd
sub ecx, 1
je 0x140026857
sub ecx, 1
je 0x1400268dd
sub ecx, 1
je 0x140026686
cmp ecx, 0xd
je 0x140026620
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x1400265f8
test byte [rcx + 0x1c], 1
je 0x1400265f8
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x1400265fc
mov edx, 0x227
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r13d
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x1400265fc
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, r13d
call fcn.1400ff178
mov r12d, eax
mov rcx, qword [0x1401782b0]
mov r13, qword [rbp - 0x40]
mov r15, rsi
jmp 0x140026ba5
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14002666b
test byte [rcx + 0x1c], 1
je 0x14002666b
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14002666f
mov edx, 0x222
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x14002666f
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, 0x14
call fcn.1400ff178
mov byte [rsp + 0x74], 1
jmp 0x14002660a
mov rcx, qword [0x1401782b0]
lea r13, [0x1401782b0]
cmp rcx, r13
je 0x1400266d1
test byte [rcx + 0x1c], 1
je 0x1400266d1
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x1400266d5
mov edx, 0x223
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x1400266d5
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, 7
call fcn.1400ff178
mov r12d, eax
mov byte [rbp - 0x5f], bl
cmp eax, 0x8078002a
jne 0x140026835
cmp edi, 0x70
jne 0x140026842
mov rcx, qword [0x1401782b0]
cmp rcx, r13
je 0x140026735
test byte [rcx + 0x1c], 1
je 0x140026735
mov rdi, qword [rbp + 8]
cmp byte [rcx + 0x19], 4
jb 0x140026739
mov edx, 0x224
mov r9, rdi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
jmp 0x140026739
mov rdi, qword [rbp + 8]
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x30], ebx
cmp dword [rbp - 0x20], ebx
je 0x14002675d
lea r8, str.iNumVolumeRepeats__0
mov edx, 0x324e
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 0x78]
call fcn.1400b78b4
test eax, eax
jne 0x140026842
mov r13, qword [rbp - 0x40]
cmp byte [r13 + 0x428], bl
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
je 0x140026798
mov rcx, qword [r13 + 0x158]
call fcn.1401157b8
jmp 0x1400267a0
mov rcx, r13
call fcn.14001c60c
test eax, eax
js 0x140026804
xor r12d, r12d
mov byte [rbp - 0x80], 1
inc dword [rbp - 0x20]
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026618
test byte [rcx + 0x1c], 1
je 0x140026618
cmp byte [rcx + 0x19], 4
jb 0x140026618
mov edx, 0x225
mov qword [rsp + 0x20], rdi
mov rsi, qword [rsp + 0x78]
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005d7c
mov rdi, qword [rbp - 0x68]
jmp 0x140026971
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x14002684d
test byte [rcx + 0x1c], 1
je 0x14002684d
cmp byte [rcx + 0x19], 2
jb 0x14002684d
mov dword [rsp + 0x20], eax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400106b4
jmp 0x140026839
mov r13, qword [rbp - 0x40]
test r12d, r12d
jns 0x1400269d1
mov rcx, qword [0x1401782b0]
mov r13, qword [rbp - 0x40]
mov byte [rsp + 0x74], 1
jmp 0x140026618
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x1400268a5
test byte [rcx + 0x1c], 1
je 0x1400268a5
mov edi, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x1400268ae
mov edx, 0x221
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 5
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x1400268ae
mov rsi, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, 5
call fcn.1400ff178
mov r12d, eax
cmp dword [rbp - 0x58], ebx
jne 0x1400268cf
mov dword [rbp - 0x58], eax
mov r12d, 0x80780166
mov byte [rsp + 0x74], 1
mov rdi, qword [rbp - 0x68]
jmp 0x14002696d
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026928
test byte [rcx + 0x1c], 1
je 0x140026928
mov edi, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x140026931
mov edx, 0x220
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140010c10
jmp 0x140026931
mov rsi, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x58]
mov edx, edi
mov ecx, r13d
call fcn.1400ff178
mov r12d, eax
mov rdi, qword [rbp - 0x68]
test byte [rdi + 0x54], 1
jne 0x140026969
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x28]
call fcn.140024a68
test eax, eax
js 0x140026969
cmp byte [rbp - 0x60], bl
mov eax, 0x80780169
cmove r12d, eax
mov byte [rbp - 0x70], 1
mov r13, qword [rbp - 0x40]
mov rcx, qword [0x1401782b0]
mov r15, qword [rbp - 0x50]
mov r14, qword [rbp - 0x78]
jmp 0x140026bb2
mov rdi, qword [rbp + 0xb0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14014cce0]
mov rcx, rdi
call rbx
mov rcx, qword [0x1401782b0]
mov r13, qword [rbp - 0x40]
mov r15, rsi
mov rdi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
test al, al
jne 0x140025767
mov r12d, dword [r13 + 0x20]
jmp 0x140026bb2
mov r13, qword [rbp - 0x40]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rbp - 0x68]
inc dword [rdi + 0x10]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r13 + 0xe4]
lea rcx, [r13 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [r13 + 0xe4]
mov dword [rsi + 0xc], eax
mov eax, dword [r13 + 0x174]
add rax, rax
movups xmm0, xmmword [rbp + 0x100]
mov rcx, qword [rbp + 0x20]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r13 + 0x154], 2
jne 0x140026a66
mov rcx, rdi
call fcn.1400146f8
test eax, eax
jns 0x140026a66
mov r8d, eax
mov edx, 0x80780151
mov rcx, rdi
call fcn.140013064
mov rcx, qword [0x1401782b0]
mov r15, rsi
jmp 0x140026ba9
test r14b, r14b
jne 0x140026aaa
mov rax, qword [rbp]
mov r15, rsi
cmp qword [rsi + 0x38], rax
je 0x140026a90
lea r8, str.pMediaCtxt__m_pBackupPtr__pBackupPtr
mov edx, 0x32a3
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
and qword [r15 + 0x38], 0
and dword [r15 + 0x40], 0
mov r12d, 0x80780030
mov byte [rsp + 0x74], 1
jmp 0x140025728
and qword [rbp - 0x68], 0
lea rdx, [rbp - 0x68]
mov r14, qword [rbp - 0x78]
mov rcx, r14
call fcn.1400bfb98
test eax, eax
je 0x140026adb
lea r8, str.r1__BlbimgSuccess
mov edx, 0x32b1
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140026b1e
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026b1e
test byte [rcx + 0x1c], 1
je 0x140026b1e
cmp byte [rcx + 0x19], 2
jb 0x140026b1e
mov edx, 0x228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140011594
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
jle 0x140026b62
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, rdi
call fcn.140013064
mov ebx, 0xe
mov edx, ebx
mov rcx, rdi
call fcn.1400131a4
mov edx, ebx
mov rcx, rsi
call fcn.140014d58
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [r13 + 0x154], 2
jne 0x140026b99
mov rdx, rdi
mov rcx, r13
call fcn.14002eaf4
mov rcx, qword [0x1401782b0]
mov r15, rsi
jmp 0x140026bad
mov rdi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x140026c5f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
test eax, eax
je 0x140026c08
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140026c08
test byte [rcx + 0x1c], 1
je 0x140026c08
cmp byte [rcx + 0x19], 3
jb 0x140026c08
mov edx, 0x229
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140026c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1401782b0]
lea rdx, [0x1401782b0]
cmp rcx, rdx
je 0x140026c59
test byte [rcx + 0x1c], 1
je 0x140026c59
cmp byte [rcx + 0x19], 3
jb 0x140026c59
mov edx, 0x22a
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
mov rcx, qword [0x1401782b0]
xor ebx, ebx
mov qword [rbp + 0x18], rbx
cmp r12d, 0x80780030
je 0x140026c80
cmp r12d, 0x8078002a
jne 0x140026d4b
cmp dword [rsp + 0x70], 0x70
jne 0x140026d6f
test byte [r13 + 0x154], 2
jne 0x140026ccf
mov rcx, rdi
call fcn.1400146f8
test eax, eax
jns 0x140026ccf
mov rcx, qword [0x1401782b0]
lea rbx, [0x1401782b0]
cmp rcx, rbx
je 0x140026cd6
test byte [rcx + 0x1c], 1
je 0x140026cd6
cmp byte [rcx + 0x19], 3
jb 0x140026cd6
mov edx, 0x22b
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
jmp 0x140026cd6
lea rbx, [0x1401782b0]
lea rax, [0x1400dc7b0]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 0x188]
mov edx, dword [r13 + 0x150]
mov rcx, qword [r13 + 0x158]
call fcn.14010d760
test eax, eax
jns 0x140026d44
mov rcx, qword [0x1401782b0]
cmp rcx, rbx
je 0x140026d4b
test byte [rcx + 0x1c], 1
je 0x140026d4b
cmp byte [rcx + 0x19], 2
jb 0x140026d4b
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r13 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r13 + 0x158]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005e64
mov rcx, qword [0x1401782b0]
cmp r12d, 0x80780030
jne 0x140026d6f
test byte [r13 + 0x154], 2
je 0x140026d6f
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0xc]
cmp dword [r15 + 0xc], eax
ja 0x140026f11
mov rbx, rsi
cmp qword [rdi + 0x58], 0
cmovne rbx, qword [rdi + 0x58]
test r12d, r12d
jns 0x140026e54
mov edx, 0xc
mov rcx, r15
call fcn.140014d58
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026dce
test byte [rcx + 0x1c], 1
je 0x140026dce
cmp byte [rcx + 0x19], 2
jb 0x140026dce
mov edx, 0x22e
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call fcn.140035044
mov esi, eax
test eax, eax
jns 0x140026e25
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026e23
test byte [rcx + 0x1c], 1
je 0x140026e23
cmp byte [rcx + 0x19], 3
jb 0x140026e23
mov edx, 0x22f
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
xor esi, esi
mov r8d, dword [rbp - 0x58]
mov edx, r12d
mov rcx, rdi
call fcn.140013294
cmp byte [rbp - 0x70], 0
je 0x140026f57
cmp byte [rbp - 0x48], 0
je 0x140026ed2
cmp byte [rdi + 0x68], 0
jne 0x140026f57
jmp 0x140026ed2
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x140026e84
test byte [rcx + 0x1c], 1
je 0x140026e84
cmp byte [rcx + 0x19], 4
jb 0x140026e84
mov edx, 0x230
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r13
call fcn.140035044
mov esi, eax
test eax, eax
jns 0x140026ed2
mov rcx, qword [0x1401782b0]
cmp rcx, rdi
je 0x140026ed2
test byte [rcx + 0x1c], 1
je 0x140026ed2
cmp byte [rcx + 0x19], 3
jb 0x140026ed2
mov edx, 0x231
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005ce8
mov al, byte [rbp - 0x80]
test al, al
jne 0x140026edd
inc dword [r15 + 8]
and qword [r15 + 0x18], 0
and qword [r15 + 0x20], 0
and dword [r15 + 0x28], 0
mov dword [r15 + 0x2c], 0xf
and qword [r15 + 0x30], 0
and qword [r15 + 0x38], 0
and dword [r15 + 0x40], 0
mov edi, dword [rbp - 0x44]
cmp dword [r15 + 8], edi
jae 0x140026f75
jmp 0x140024f03
mov edx, 4
mov rcx, r15
call fcn.140014d58
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x140026f72
test byte [rcx + 0x1c], 1
je 0x140026f72
cmp byte [rcx + 0x19], 4
jb 0x140026f72
mov edx, 0x22d
mov r9, rsi
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140005c6c
jmp 0x140026f72
mov al, byte [rsp + 0x74]
mov rcx, qword [rbp + 0x40]
mov byte [rcx], al
mov eax, dword [rbp - 0x58]
mov rcx, qword [rbp + 0x78]
mov dword [rcx], eax
mov esi, r12d
jmp 0x140027080
mov edi, dword [rbp - 0x44]
mov r12, qword [rbp - 0x38]
mov rdx, qword [rbp + 0x40]
mov rcx, r13
call fcn.140021434
mov esi, eax
test eax, eax
js 0x140027080
lea rcx, [r13 + 0x28]
xor edx, edx
call fcn.1400fc6dc
mov esi, eax
test eax, eax
js 0x140027080
mov r14d, dword [r12 + 0xc]
xor ebx, ebx
test edi, edi
je 0x14002705c
xor edi, edi
xor r15d, r15d
mov r12, qword [rbp + 0x20]
mov ecx, ebx
mov edx, ebx
shl rdx, 4
add rdx, r12
mov rax, qword [rdx]
cmp rax, qword [0x140161c08]
jne 0x140026fe0
mov rax, qword [rdx + 8]
cmp rax, qword [0x140161c10]
je 0x140027042
mov r10, qword [r13 + 0xd8]
imul rax, rcx, 0x170
lea rcx, [r10 + 0x78]
add rcx, rax
mov r8d, r15d
add r8, qword [rbp + 0x10]
lea r9, [r10 + 0x44]
add r9, rax
mov eax, dword [rdi + r10 + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + r10 + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rcx, r13
call fcn.14001f79c
mov esi, eax
inc r14d
test eax, eax
js 0x14002707c
inc ebx
add r15d, 0x10
add rdi, 0x170
cmp ebx, dword [rbp - 0x44]
jb 0x140026fbc
mov r15, qword [rbp - 0x50]
cmp r14d, dword [r15 + 0xc]
je 0x140027080
lea r8, str.j__pMediaCtxt__m_ulBagCount
mov edx, 0x3382
lea rcx, str.base_stor_blbengine_service_backup.cpp
call fcn.14008624c
jmp 0x140027080
mov r15, qword [rbp - 0x50]
mov rax, qword [rbp - 8]
test rax, rax
je 0x140027092
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r12, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x78]
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400270ba
cmp rcx, qword [r15 + 0x38]
je 0x1400270ba
cmp rcx, qword [r12 + 0x38]
je 0x1400270ba
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1400270d4
cmp r14, qword [r15 + 0x30]
je 0x1400270d4
cmp r14, qword [r12 + 0x30]
je 0x1400270d4
mov rcx, r14
call fcn.1400beb88
test rdi, rdi
je 0x1400270e2
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x1400270f4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x140027106
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 8]
test rax, rax
je 0x140027118
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rbx, [r13 + 0x28]
mov rcx, rbx
call fcn.1400fc870
test esi, esi
jns 0x14002721e
mov rcx, qword [0x1401782b0]
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x14002717c
test byte [rcx + 0x1c], 1
je 0x14002717c
cmp byte [rcx + 0x19], 2
jb 0x14002717c
lea r8, [0x140151a38]
lea rax, [0x140150d68]
mov rdx, qword [rbp + 0x40]
cmp byte [rdx], 0
cmovne rax, r8
mov qword [rsp + 0x20], rax
mov r9d, esi
mov rcx, qword [rcx + 0x10]
call fcn.140010890
mov rcx, qword [0x1401782b0]
cmp byte [rbp - 0x5f], 0
jne 0x14002722c
test byte [r13 + 0x154], 4
je 0x14002722c
xor edx, edx
mov rcx, rbx
call fcn.1400fc6dc
test eax, eax
jns 0x1400271d8
mov rcx, qword [0x1401782b0]
cmp rcx, rdi
je 0x140027252
test byte [rcx + 0x1c], 1
je 0x14002722c
cmp byte [rcx + 0x19], 2
jb 0x14002722c
mov edx, 0x233
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
jmp 0x140027225
mov rcx, r13
call fcn.14001d438
test eax, eax
jns 0x140027214
mov rcx, qword [0x1401782b0]
cmp rcx, rdi
je 0x140027214
test byte [rcx + 0x1c], 1
je 0x140027214
cmp byte [rcx + 0x19], 2
jb 0x140027214
mov edx, 0x234
mov r9d, eax
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c90
mov rcx, rbx
call fcn.1400fc870
jmp 0x140027225
lea rdi, [0x1401782b0]
mov rcx, qword [0x1401782b0]
cmp rcx, rdi
je 0x140027252
test byte [rcx + 0x1c], 1
je 0x140027252
cmp byte [rcx + 0x19], 4
jb 0x140027252
mov edx, 0x235
lea r8, [0x140151a70]
mov rcx, qword [rcx + 0x10]
call fcn.140004c6c
mov eax, esi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401474d0
add rsp, 0x228
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret