Function at 0x140002fac
Capabilities:
Access pe header
Check if file exists
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
xor eax, eax
mov edi, edx
mov qword [rbp - 0x51], rax
mov rsi, rcx
mov qword [rbp - 0x41], rax
mov r12d, eax
mov qword [rbp - 1], rax
mov r14d, eax
mov qword [rbp - 0x79], rax
mov r13d, eax
mov qword [rbp - 0x59], rax
mov r15d, eax
mov qword [rbp - 9], rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x19], rax
mov qword [rbp + 7], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
test dl, 0x10
je 0x140003022
mov eax, edx
and al, 0x40
neg al
sbb ecx, ecx
not ecx
and ecx, 3
call fcn.14000b0c0
mov r8d, edi
mov eax, edi
and eax, 0x200
and r8d, 1
neg eax
mov dword [rbp + 0x77], r8d
mov eax, edi
sbb ebx, ebx
and eax, 0x100
and ebx, 0xb
add ebx, 0x6e
neg eax
mov dword [rsp + 0x40], ebx
mov eax, edi
sbb r11d, r11d
and al, 0x80
and r11d, 0xb
add r11d, 0x6e
neg al
mov dword [rsp + 0x38], r11d
mov eax, edi
sbb r10d, r10d
and al, 0x20
and r10d, 0xb
add r10d, 0x6e
neg al
mov dword [rsp + 0x30], r10d
mov eax, edi
sbb edx, edx
and al, 8
and edx, 0xb
add edx, 0x6e
neg al
mov dword [rsp + 0x28], edx
mov eax, edi
lea rdx, str.ServiceBootFiles_MuiOnly:_c_Res:_c_Fonts:_c_BootMgrOvw:_c_BootStatOvw:_c_DbgTrn:_c_SuspendBDE:_c
sbb ecx, ecx
and al, 4
and ecx, 0xb
add ecx, 0x6e
neg al
mov dword [rsp + 0x20], ecx
mov eax, r8d
mov ecx, 2
sbb r9d, r9d
and r9d, 0xb
add r9d, 0x6e
neg eax
sbb r8d, r8d
and r8d, 0xb
add r8d, 0x6e
call fcn.14000b134
mov eax, edi
lea rdx, [rbp - 0x69]
and eax, 0xfffffef3
xor ebx, ebx
cmp dword [rbp + 0x77], ebx
mov rcx, rsi
cmove eax, edi
mov dword [rbp + 0x6f], eax
call fcn.1400048b8
test eax, eax
jne 0x1400030f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003de3
mov edi, 1
lea r9, [rbp - 0x11]
mov r8d, edi
lea rcx, section..data
lea edx, [rdi + 3]
call fcn.14000b46c
test eax, eax
jne 0x140003122
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003dda
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x19]
call fcn.14000b2a0
test eax, eax
je 0x140003115
lea rdx, str.ISPCAT
lea rcx, [rbp - 0x69]
call fcn.14000bfac
test rax, rax
lea rdx, str.ACLS
mov ecx, ebx
cmovne ecx, edi
mov dword [rbp + 0x7f], ecx
lea rcx, [rbp - 0x69]
call fcn.14000bfac
test rax, rax
lea rdx, str.SOURCEFWTYPEBOOTMGR
lea rcx, [rbp - 0x69]
cmovne r14d, edi
mov dword [rbp - 0x49], r14d
call fcn.14000bd98
mov qword [rbp - 0x71], rax
mov r12, rax
test rax, rax
jne 0x140003195
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14, r13
jmp 0x140003dda
lea rdx, str.SYSPARTDESTBOOTMGR
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 0x41], rax
test rax, rax
je 0x140003185
lea rdx, str.SOURCERESOURCESBOOTRES.DLL
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov rdi, rax
test rax, rax
je 0x140003202
xor edx, edx
mov rcx, rax
call fcn.14000c000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x140003202
mov r8, rbx
lea rdx, str.Using_source_OS_version__I64x
mov ecx, 2
call fcn.14000b134
jmp 0x140003213
lea rdx, str.Failed_to_determine_source_OS_version.
mov ecx, 3
call fcn.14000b134
mov edi, dword [rbp + 0x6f]
mov qword [0x1400367f8], rbx
bt edi, 9
jae 0x1400032ea
mov rcx, rsi
call fcn.140002c20
mov qword [rbp + 7], rax
mov rbx, rax
test rax, rax
jne 0x14000325f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, str.Failed_to_get_VolumeName_for__ws__x
mov ebx, eax
mov r9d, eax
mov ecx, 4
call fcn.14000b134
jmp 0x14000318d
mov r8, rbx
lea rdx, str.Source_VolumeName__ws
mov ecx, 2
call fcn.14000b134
lea r9, [rbp - 0x31]
mov rcx, rbx
lea r8, [rbp - 0x45]
call fcn.14000c7f4
xor esi, esi
mov ebx, eax
test eax, eax
je 0x1400032b9
mov ecx, eax
lea rdx, str.BfspSuspendBitLocker_FAILED_Error_code___x
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
lea ecx, [rsi + 4]
cmove ebx, eax
mov r8d, ebx
call fcn.14000b134
mov r14d, esi
jmp 0x140003dda
mov eax, dword [rbp - 0x31]
lea rdx, str.BfspSuspendBitLocker_SUCCEEDED__Enabled:_c_Suspended:_c_
neg eax
mov ecx, 2
mov eax, dword [rbp - 0x45]
sbb r9d, r9d
and r9d, 0xb
add r9d, 0x6e
neg eax
sbb r8d, r8d
and r8d, 0xb
add r8d, 0x6e
call fcn.14000b134
test dil, 0x20
je 0x14000330f
mov r12d, 1
lea rdx, str.Boot_manager_to_be_overwritten_by_user_policy.
lea ecx, [r12 + 2]
call fcn.14000b134
mov ebx, dword [rbp + 0x7f]
jmp 0x1400033ba
mov ebx, dword [rbp + 0x7f]
mov rcx, r12
test ebx, ebx
je 0x140003386
mov edx, 1
call fcn.14000c4f4
test eax, eax
jne 0x14000333f
mov r9d, 0xc1
lea rdx, str.Failed_to_validate_boot_manager_checksum___s___Error_code___x
mov ebx, r9d
mov r8, r12
jmp 0x140003250
lea rdx, str.SYSPARTBOOTMGR
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r13, rax
test rax, rax
jne 0x140003367
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14, r15
jmp 0x140003dda
mov r15d, 1
mov rcx, r13
mov edx, r15d
call fcn.14000c4f4
test eax, eax
jne 0x140003381
mov r12d, r15d
jmp 0x1400033ba
mov rdx, r13
jmp 0x1400033ac
xor edx, edx
call fcn.14000c4f4
test eax, eax
je 0x140003327
mov rsi, qword [rbp - 0x41]
xor edx, edx
mov rcx, rsi
call fcn.14000c4f4
test eax, eax
jne 0x1400033a9
lea r12d, [rax + 1]
jmp 0x1400033ba
mov rdx, rsi
xor r8d, r8d
mov rcx, r12
call fcn.1400047b4
mov r12d, eax
lea rdx, str.SOURCEFWTYPE
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r15, rax
test rax, rax
jne 0x1400033df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003dd2
lea rdx, str.SYSPARTDEST
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 0x51], rax
test rax, rax
je 0x1400033d2
lea rcx, [0x1400253c8]
mov qword [rsp + 0x20], rax
test r12d, r12d
lea r8, [0x1400253d0]
mov r9, r15
lea rdx, str.Copying_boot_files_CopyBootManager__s___s_____s
cmovne r8, rcx
mov ecx, 2
call fcn.14000b134
mov esi, dword [rbp + 0x77]
mov eax, 1
mov rdx, qword [rbp - 0x51]
mov r9d, r12d
mov dword [rsp + 0x40], eax
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov rcx, r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call fcn.140003fec
test eax, eax
jne 0x14000347f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp - 0x51]
lea rdx, str.Error_copying_boot_files_from__s_to__s__Last_Error___x
mov r8, r15
mov ecx, 4
mov dword [rsp + 0x20], eax
mov ebx, eax
call fcn.14000b134
jmp 0x140003dd2
test ebx, ebx
jne 0x1400036c0
lea rdx, str.SYSPARTEFIDEFAULT
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r14, rax
call fcn.140004c9c
xor esi, esi
cmp eax, 2
jne 0x14000352c
mov rcx, qword [rbp - 0x71]
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x45]
mov ebx, esi
call fcn.140001fb0
test rax, rax
je 0x1400034dd
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400034d4
movzx ebx, word [rax + 4]
lea rcx, [rbp + 0xf]
call fcn.1400025d8
sub ebx, 0x14c
je 0x140003515
sub ebx, 0x76
je 0x14000350c
sub ebx, 0x84a2
je 0x140003503
cmp ebx, 0x2400
jne 0x14000352c
lea r8, str.bootaa64.efi
jmp 0x14000351c
lea r8, str.bootx64.efi
jmp 0x14000351c
lea r8, str.bootarm.efi
jmp 0x14000351c
lea r8, str.bootia32.efi
lea rdx, str.DEFAULTAPP
lea rcx, [rbp - 0x69]
call fcn.14000bbbc
lea rdx, str.SYSPARTEFIDEFAULTDEFAULTAPP
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov rbx, rax
test r14, r14
je 0x1400035f2
test rax, rax
je 0x1400035f2
mov rcx, rax
mov edi, esi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000356b
test al, 0x50
mov eax, 1
cmove edi, eax
mov r8d, 2
lea rdx, str.bootmgr.exe
mov rcx, rbx
call fcn.14000c264
mov rcx, qword [rbp - 0x71]
mov r8d, 1
mov rdx, rbx
mov esi, eax
call fcn.1400047b4
test edi, edi
je 0x1400035a9
mov ecx, 1
cmp esi, ecx
jne 0x140003605
xor esi, esi
test eax, eax
je 0x140003607
jmp 0x1400035ab
xor esi, esi
mov rcx, r14
call fcn.14000df28
test eax, eax
jne 0x1400035d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_path_for_default_EFI_application._Last_error___x
mov r8d, eax
mov ecx, 3
call fcn.14000b134
jmp 0x140003607
mov rcx, qword [rbp - 0x71]
mov rdx, rbx
call fcn.1400044c0
test eax, eax
jne 0x140003607
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_copy_Boot_Manager_to_default_EFI_application._Last_error___x
jmp 0x1400035c4
lea rdx, str.Failed_to_expand_default_EFI_application_location.
mov ecx, 3
call fcn.14000b134
jmp 0x14000360a
xor esi, esi
mov edi, dword [rbp + 0x6f]
test r14, r14
je 0x140003623
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14000363c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.Creating_Recovery_directory.
mov ecx, 2
call fcn.14000b134
lea rdx, str.SYSPARTEFIMicrosoftRecovery
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov rbx, rax
test rax, rax
je 0x14000368d
mov rcx, rax
call fcn.14000df28
test eax, eax
jne 0x14000369e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_Recovery_directory._Last_error___x
mov ecx, 3
mov r8d, eax
call fcn.14000b134
jmp 0x14000369e
lea rdx, str.Failed_to_expand_Recovery_directory_path
mov ecx, 3
call fcn.14000b134
test rbx, rbx
je 0x1400036b7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14d, dword [rbp - 0x49]
jmp 0x140003815
test esi, esi
jne 0x140003813
xor esi, esi
lea rbx, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
test r14d, r14d
je 0x14000371f
test r13, r13
jne 0x140003703
lea rdx, str.SYSPARTBOOTMGR
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r13, rax
test rax, rax
jne 0x140003703
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14, rsi
jmp 0x140003dd6
mov r8, rbx
xor edx, edx
mov rcx, r13
call fcn.14000b588
test eax, eax
jne 0x14000371f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400036f3
test r12d, r12d
je 0x140003734
mov rcx, qword [rbp - 0x71]
mov rdx, r13
call fcn.1400044c0
test eax, eax
je 0x1400036f3
mov rcx, r13
call fcn.14000dbc4
test eax, eax
jne 0x14000377a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x140003759
add eax, 0xffffffe0
mov ecx, 1
cmp eax, ecx
ja 0x140003761
mov rcx, r13
call fcn.140002260
mov r9d, ebx
lea rdx, str.Error_uncompressing_boor_manager___s___Last_Error___x
mov r8, r13
mov ecx, 4
call fcn.14000b134
jmp 0x1400036fb
mov edx, 7
mov rcx, r13
call fcn.140004d00
test eax, eax
je 0x1400036f3
test r14d, r14d
je 0x1400037c6
mov r8, rbx
mov edx, 1
mov rcx, r13
call fcn.14000b588
test eax, eax
je 0x1400036f3
mov rsi, qword [rbp - 0x41]
mov r8, rbx
mov rcx, rsi
xor edx, edx
call fcn.14000b588
test eax, eax
jne 0x1400037ca
jmp 0x1400033d2
mov rsi, qword [rbp - 0x41]
mov rcx, rsi
call fcn.14000d694
test eax, eax
jne 0x140003813
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x1400037ef
add eax, 0xffffffe0
mov ecx, 1
cmp eax, ecx
ja 0x1400037f7
mov rcx, rsi
call fcn.140002260
mov r9d, ebx
lea rdx, str.Error_deleting_boot_manager__s___Last_Error___x
mov r8, rsi
mov ecx, 4
call fcn.14000b134
jmp 0x140003dd2
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
lea rdx, str.SYSPARTDESTBOOTSTAT.DAT
lea rcx, [rbp - 0x69]
cmovne r15, rsi
call fcn.14000bd98
mov rsi, rax
mov qword [rbp - 0x79], rax
mov ebx, edi
and ebx, 0x80
mov ecx, ebx
neg ecx
mov rcx, rsi
sbb edx, edx
xor eax, eax
neg edx
mov qword [rsp + 0x30], rax
inc edx
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov edx, 0xc0000000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400038b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400038a7
test ebx, ebx
jne 0x1400038a7
mov edx, dword [rbp + 0x6f]
mov rcx, rsi
call fcn.140002d74
jmp 0x1400039b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_creating_boot_status_data_log__s___Last_Error___x
jmp 0x1400039a1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400038f2
mov r8, rsi
lea rdx, str.Error_creating_boot_status_data_log__s___Unable_to_allocate_memory
lea ecx, [rax + 3]
call fcn.14000b134
jmp 0x14000397f
xor edx, edx
mov r8d, 0x10000
mov rcx, rbx
call sub.msvcrt.dll_memset
xor eax, eax
lea r9, [rbp - 0x2d]
mov r8d, 0x10000
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140003942
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, str.Error_creating_boot_status_data_log__s___Last_Error___x
mov r9d, eax
mov ecx, 3
call fcn.14000b134
jmp 0x14000396b
mov r9d, dword [rbp - 0x2d]
cmp r9d, 0x10000
je 0x14000396b
mov r8, rsi
mov dword [rsp + 0x20], 0x10000
lea rdx, str.Error_creating_boot_status_data_log__s___Bytes_written___x__desired___x
mov ecx, 3
call fcn.14000b134
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rsi
call fcn.14000dbc4
test eax, eax
jne 0x1400039b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_uncompressing_boot_status_data_log__s___Last_Error___x
mov r9d, eax
mov r8, rsi
mov ecx, 3
call fcn.14000b134
mov ebx, dword [rbp + 0x7f]
mov edi, dword [rbp + 0x77]
test ebx, ebx
je 0x140003a6e
test edi, edi
jne 0x140003a4f
lea rdx, str.SYSPARTDESTBCD
lea rcx, [rbp - 0x69]
call fcn.14000bd98
lea rdx, str.SYSPARTDESTBCD.LOG
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov rcx, qword [rbp - 0x29]
lea edx, [rdi + 6]
mov qword [rbp - 0x21], rax
call fcn.140004d00
test eax, eax
jne 0x140003a0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400036f3
mov rcx, qword [rbp - 0x21]
mov edx, 6
call fcn.140004d00
test eax, eax
jne 0x140003a2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400036f3
mov edx, 6
mov rcx, rsi
call fcn.140004d00
test eax, eax
jne 0x140003a4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400033d2
test r14d, r14d
je 0x140003a6e
mov rcx, qword [rbp - 0x51]
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
xor edx, edx
call fcn.14000b588
test eax, eax
je 0x1400033d2
mov esi, dword [rbp + 0x6f]
test sil, 8
je 0x140003b0e
lea rdx, str.SOURCEFONTS
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r15, rax
test rax, rax
je 0x1400033d2
lea rdx, str.SYSPARTDESTFONTS
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 0x59], rax
test rax, rax
je 0x1400033d2
mov r9, rax
lea rdx, str.Copying_font_files_from__s_to__s...
mov r8, r15
mov ecx, 2
call fcn.14000b134
mov rdx, qword [rbp - 0x59]
mov eax, 1
mov dword [rsp + 0x40], eax
mov r9d, r12d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov rcx, r15
mov dword [rsp + 0x20], r14d
call fcn.140003fec
test eax, eax
jne 0x140003b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp - 0x59]
lea rdx, str.Error_copying_font_files_from__s_to__s.Last_Error___x
jmp 0x140003467
test sil, 4
je 0x140003baf
lea rdx, str.SOURCERESOURCES
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov r15, rax
test rax, rax
je 0x1400033d2
lea rdx, str.SYSPARTDESTRESOURCES
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 0x59], rax
test rax, rax
je 0x1400033d2
mov r9, rax
lea rdx, str.Copying_resource_files_from__s_to__s...
mov r8, r15
mov ecx, 2
call fcn.14000b134
mov rdx, qword [rbp - 0x59]
mov eax, 1
mov dword [rsp + 0x40], eax
mov r9d, r12d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov rcx, r15
mov dword [rsp + 0x20], r14d
call fcn.140003fec
test eax, eax
jne 0x140003baf
mov r8, r15
lea rdx, str.Resource_files_missing_from__s._These_files_are_required_for_some_editions_of_Windows._If_you_are_servicing_older_versions_of_Windows__you_can_ignore_this_message.
lea ecx, [rax + 3]
call fcn.14000b134
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x140003d7c
mov rdi, qword [rbp - 0x51]
mov edx, 6
mov rcx, rdi
call fcn.140004d00
test eax, eax
je 0x1400033d2
test r14d, r14d
je 0x140003bf1
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
mov edx, 1
mov rcx, rdi
call fcn.14000b588
test eax, eax
je 0x1400033d2
lea rdx, str.SYSPARTDESTBOOTNXT
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 1], rax
mov r12, rax
test rax, rax
jne 0x140003c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.SYSPARTDESTBOOTNXT
mov ebx, eax
lea rdx, str.Error_expanding_string__s._Last_Error___x
mov r9d, eax
jmp 0x140003804
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003d7c
test al, 0x50
jne 0x140003d7c
lea rdx, str.SYSPARTBOOTNXT
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 9], rax
mov rdi, rax
test rax, rax
jne 0x140003c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.SYSPARTBOOTNXT
jmp 0x140003c1a
lea rdx, str.SYSPARTBOOTTGT
lea rcx, [rbp - 0x69]
call fcn.14000bd98
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x140003c98
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.SYSPARTBOOTTGT
jmp 0x140003c1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003cd2
test al, 0x50
jne 0x140003cd2
mov rcx, qword [rbp - 0x39]
call fcn.14000d694
test eax, eax
jne 0x140003cd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbp - 0x39]
lea rdx, str.Error_deleting_boottgt__s___Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x140003804
mov rdx, rdi
mov rcx, r12
call fcn.1400044c0
test eax, eax
jne 0x140003cf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rdi
lea rdx, str.Error_copying__s_to__s._Last_Error___x
mov r8, r12
jmp 0x14000346a
mov rcx, r12
call fcn.14000d694
test eax, eax
jne 0x140003d1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, r12
lea rdx, str.Error_deleting_bootnxt_from_the_BOOT_folder___s___Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x140003804
mov edx, 6
mov rcx, rdi
call fcn.140004d00
test eax, eax
jne 0x140003d4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rdx, str.Error_setting_attributes_on__s._Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x140003804
test r14d, r14d
je 0x140003d7c
lea rdx, str.O:SYG:SYD:P_A_ID_FA___SY__A_ID_FA___BA__A_ID_0x1200a9___BU_
mov rcx, rdi
call fcn.14000b874
test eax, eax
jne 0x140003d7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rdx, str.Error_setting_security_attributes_on__s._Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x140003804
bt esi, 8
jae 0x140003d9c
mov r8d, ebx
lea rcx, [rbp - 0x69]
mov edx, r14d
call fcn.140004e10
xor esi, esi
test eax, eax
jne 0x140003d9e
jmp 0x1400033d2
xor esi, esi
mov edx, ebx
lea rcx, [rbp - 0x69]
call fcn.14000510c
test eax, eax
je 0x1400033d2
call fcn.140001dbc
mov ebx, eax
test eax, eax
je 0x140003dd2
mov r8d, eax
lea rdx, str.Failed_to_flush_system_volume._Error___x
mov ecx, 3
call fcn.14000b134
mov ebx, esi
mov r14, qword [rbp - 0x79]
mov r12, qword [rbp - 0x71]
lea rcx, [rbp - 0x69]
call fcn.14000bd38
test ebx, ebx
je 0x140003dfb
mov r8d, ebx
lea rdx, str.ServicingBootFiles_failed._Error___x
mov ecx, 4
call fcn.14000b134
call fcn.14000b068
mov rdi, qword [rbp - 0x19]
test rdi, rdi
je 0x140003e13
xor edx, edx
mov rcx, rdi
call fcn.14000b2a0
test r15, r15
je 0x140003e2c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x59]
test rdi, rdi
je 0x140003e49
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x51]
test rdi, rdi
je 0x140003e66
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x140003e7f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x41]
test rdi, rdi
je 0x140003e9c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140003eb5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 9]
test rdi, rdi
je 0x140003ed2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x39]
test rdi, rdi
je 0x140003eef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 1]
test rdi, rdi
je 0x140003f0c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x29]
test rdi, rdi
je 0x140003f29
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x21]
test rdi, rdi
je 0x140003f46
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x140003f5f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x19]
test rdi, rdi
je 0x140003f7c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp - 0x11]
test rdi, rdi
je 0x140003f99
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp + 7]
test rdi, rdi
je 0x140003fb6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x140003fc6
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140003fcb
mov eax, 1
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret