Function at 0x1800cd0a0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc08
mov qword [rsp + 0x920], 0xfffffffffffffffe
mov dword [rsp + 0x70], 0
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x48]
call fcn.1800016a9
nop
lea rcx, [rsp + 0x28]
call fcn.1800016a9
nop
mov rax, qword [rsp + 0xc10]
mov rax, qword [rax]
add rax, 0x38
mov qword [rsp + 0x68], rax
lea rdx, str.WindowsBootDVD
lea rcx, [rsp + 0xd8]
call fcn.1800334a0
nop
lea r8, [rsp + 0xd8]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.180033cc0
nop
lea rcx, [rsp + 0xd8]
call fcn.18000165e
lea rdx, str.WindowsBootDVDPCATen_US
lea rcx, [rsp + 0xf8]
call fcn.1800334a0
nop
lea r8, [rsp + 0xf8]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x98]
call fcn.180033cc0
nop
lea rcx, [rsp + 0xf8]
call fcn.18000165e
lea rdx, str.WindowsBootDVDEFIen_US
lea rcx, [rsp + 0x118]
call fcn.1800334a0
nop
lea r8, [rsp + 0x118]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xb8]
call fcn.180033cc0
nop
lea rcx, [rsp + 0x118]
call fcn.18000165e
lea rcx, [rsp + 0x78]
call fcn.18000122b
mov rcx, rax
call fcn.18003af40
test eax, eax
je 0x1800cd1d2
lea rcx, [rsp + 0x98]
call fcn.18000122b
mov rcx, rax
call fcn.18003af40
test eax, eax
jne 0x1800cd21a
mov rcx, qword [rsp + 0xc10]
call fcn.1800cbb10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800cd215
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
jmp 0x1800cd3b8
lea rdx, str.WindowsBootDVDPCAT
lea rcx, [rsp + 0x138]
call fcn.1800334a0
nop
lea r8, [rsp + 0x138]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x158]
call fcn.180033cc0
mov qword [rsp + 0x928], rax
mov rax, qword [rsp + 0x928]
mov qword [rsp + 0x930], rax
mov rdx, qword [rsp + 0x930]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x158]
call fcn.18000165e
nop
lea rcx, [rsp + 0x138]
call fcn.18000165e
lea rdx, [0x180229b00]
lea rcx, [rsp + 0x178]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x198]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0x938], rax
mov rax, qword [rsp + 0x938]
mov qword [rsp + 0x940], rax
lea r8, [rsp + 0x178]
mov rdx, qword [rsp + 0x940]
lea rcx, [rsp + 0x1b8]
call fcn.180033cc0
mov qword [rsp + 0x948], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x950], rax
mov rdx, qword [rsp + 0x950]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x1b8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x198]
call fcn.18000165e
nop
lea rcx, [rsp + 0x178]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0x958], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0x958]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cd3b8
mov rcx, qword [rsp + 0xc10]
call fcn.1800cbb10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800cd3b8
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.WindowsBootPCAT
lea rcx, [rsp + 0x1d8]
call fcn.1800334a0
nop
lea r8, [rsp + 0x1d8]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x1f8]
call fcn.180033cc0
mov qword [rsp + 0x960], rax
mov rax, qword [rsp + 0x960]
mov qword [rsp + 0x968], rax
mov rdx, qword [rsp + 0x968]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x1f8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000165e
lea rdx, str.Boot
lea rcx, [rsp + 0x218]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x238]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0x970], rax
mov rax, qword [rsp + 0x970]
mov qword [rsp + 0x978], rax
lea r8, [rsp + 0x218]
mov rdx, qword [rsp + 0x978]
lea rcx, [rsp + 0x258]
call fcn.180033cc0
mov qword [rsp + 0x980], rax
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x988], rax
mov rdx, qword [rsp + 0x988]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x258]
call fcn.18000165e
nop
lea rcx, [rsp + 0x238]
call fcn.18000165e
nop
lea rcx, [rsp + 0x218]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0x990], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0x990]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cd546
mov dword [rsp + 0x70], 0xffffeefc
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, [0x180229b50]
lea rcx, [rsp + 0x278]
call fcn.1800334a0
nop
lea r8, [rsp + 0x278]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x298]
call fcn.180033cc0
mov qword [rsp + 0x998], rax
mov rax, qword [rsp + 0x998]
mov qword [rsp + 0x9a0], rax
mov rdx, qword [rsp + 0x9a0]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x298]
call fcn.18000165e
nop
lea rcx, [rsp + 0x278]
call fcn.18000165e
lea rdx, str.BootFonts
lea rcx, [rsp + 0x2b8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x2d8]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0x9a8], rax
mov rax, qword [rsp + 0x9a8]
mov qword [rsp + 0x9b0], rax
lea r8, [rsp + 0x2b8]
mov rdx, qword [rsp + 0x9b0]
lea rcx, [rsp + 0x2f8]
call fcn.180033cc0
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x9c0], rax
mov rdx, qword [rsp + 0x9c0]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x2f8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x2d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x2b8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0x9c8], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0x9c8]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cd6d4
mov dword [rsp + 0x70], 0xffffeefc
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
mov rax, qword [rsp + 0xc10]
mov rcx, qword [rax]
call fcn.1800d0f40
movzx eax, al
test eax, eax
je 0x1800cdd8b
lea rcx, [rsp + 0x78]
call fcn.18000122b
mov rcx, rax
call fcn.18003af40
test eax, eax
je 0x1800cd71e
lea rcx, [rsp + 0x98]
call fcn.18000122b
mov rcx, rax
call fcn.18003af40
test eax, eax
jne 0x1800cd766
mov rcx, qword [rsp + 0xc10]
call fcn.1800cc3c0
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800cd761
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
jmp 0x1800cd904
lea rdx, str.WindowsBootDVDEFI
lea rcx, [rsp + 0x318]
call fcn.1800334a0
nop
lea r8, [rsp + 0x318]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x338]
call fcn.180033cc0
mov qword [rsp + 0x9d0], rax
mov rax, qword [rsp + 0x9d0]
mov qword [rsp + 0x9d8], rax
mov rdx, qword [rsp + 0x9d8]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x338]
call fcn.18000165e
nop
lea rcx, [rsp + 0x318]
call fcn.18000165e
lea rdx, [0x180229bc8]
lea rcx, [rsp + 0x358]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x378]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0x9e0], rax
mov rax, qword [rsp + 0x9e0]
mov qword [rsp + 0x9e8], rax
lea r8, [rsp + 0x358]
mov rdx, qword [rsp + 0x9e8]
lea rcx, [rsp + 0x398]
call fcn.180033cc0
mov qword [rsp + 0x9f0], rax
mov rax, qword [rsp + 0x9f0]
mov qword [rsp + 0x9f8], rax
mov rdx, qword [rsp + 0x9f8]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x398]
call fcn.18000165e
nop
lea rcx, [rsp + 0x378]
call fcn.18000165e
nop
lea rcx, [rsp + 0x358]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xa00], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xa00]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cd904
mov rcx, qword [rsp + 0xc10]
call fcn.1800cc3c0
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800cd904
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, [0x180229bf0]
lea rcx, [rsp + 0x3b8]
call fcn.1800334a0
nop
lea r8, [rsp + 0x3b8]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x3d8]
call fcn.180033cc0
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x3d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x3b8]
call fcn.18000165e
lea rdx, str.EFIMicrosoftBoot
lea rcx, [rsp + 0x3f8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x418]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xa18], rax
mov rax, qword [rsp + 0xa18]
mov qword [rsp + 0xa20], rax
lea r8, [rsp + 0x3f8]
mov rdx, qword [rsp + 0xa20]
lea rcx, [rsp + 0x438]
call fcn.180033cc0
mov qword [rsp + 0xa28], rax
mov rax, qword [rsp + 0xa28]
mov qword [rsp + 0xa30], rax
mov rdx, qword [rsp + 0xa30]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x438]
call fcn.18000165e
nop
lea rcx, [rsp + 0x418]
call fcn.18000165e
nop
lea rcx, [rsp + 0x3f8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xa38], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xa38]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cda92
mov dword [rsp + 0x70], 0xffffeefc
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.WindowsBootEFI
lea rcx, [rsp + 0x458]
call fcn.1800334a0
nop
lea r8, [rsp + 0x458]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x478]
call fcn.180033cc0
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
mov rdx, qword [rsp + 0xa48]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x478]
call fcn.18000165e
nop
lea rcx, [rsp + 0x458]
call fcn.18000165e
lea rdx, [rsp + 0x498]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xa50], rax
mov rax, qword [rsp + 0xa50]
mov qword [rsp + 0xa58], rax
mov rdx, qword [rsp + 0xa58]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x498]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xa60], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xa60]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cdbba
mov dword [rsp + 0x70], 0xffffeefc
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.WindowsBootFonts
lea rcx, [rsp + 0x4b8]
call fcn.1800334a0
nop
lea r8, [rsp + 0x4b8]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x4d8]
call fcn.180033cc0
mov qword [rsp + 0xa68], rax
mov rax, qword [rsp + 0xa68]
mov qword [rsp + 0xa70], rax
mov rdx, qword [rsp + 0xa70]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x4d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x4b8]
call fcn.18000165e
lea rdx, str.EFIMicrosoftBootFonts
lea rcx, [rsp + 0x4f8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x518]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xa78], rax
mov rax, qword [rsp + 0xa78]
mov qword [rsp + 0xa80], rax
lea r8, [rsp + 0x4f8]
mov rdx, qword [rsp + 0xa80]
lea rcx, [rsp + 0x538]
call fcn.180033cc0
mov qword [rsp + 0xa88], rax
mov rax, qword [rsp + 0xa88]
mov qword [rsp + 0xa90], rax
mov rdx, qword [rsp + 0xa90]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x538]
call fcn.18000165e
nop
lea rcx, [rsp + 0x518]
call fcn.18000165e
nop
lea rcx, [rsp + 0x4f8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xa98], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xa98]
mov rdx, rcx
mov rcx, rax
call fcn.18003b1a0
test eax, eax
jne 0x1800cdd48
mov dword [rsp + 0x70], 0xffffeefc
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
mov rcx, qword [rsp + 0xc10]
call fcn.1800cbf50
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800cdd8b
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.Boot_bootmgr
lea rcx, [rsp + 0x558]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x578]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xaa0], rax
mov rax, qword [rsp + 0xaa0]
mov qword [rsp + 0xaa8], rax
lea r8, [rsp + 0x558]
mov rdx, qword [rsp + 0xaa8]
lea rcx, [rsp + 0x598]
call fcn.180033cc0
mov qword [rsp + 0xab0], rax
mov rax, qword [rsp + 0xab0]
mov qword [rsp + 0xab8], rax
mov rdx, qword [rsp + 0xab8]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x598]
call fcn.18000165e
nop
lea rcx, [rsp + 0x578]
call fcn.18000165e
nop
lea rcx, [rsp + 0x558]
call fcn.18000165e
lea rdx, [0x180229cf0]
lea rcx, [rsp + 0x5b8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x5d8]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xac0], rax
mov rax, qword [rsp + 0xac0]
mov qword [rsp + 0xac8], rax
lea r8, [rsp + 0x5b8]
mov rdx, qword [rsp + 0xac8]
lea rcx, [rsp + 0x5f8]
call fcn.180033cc0
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xad0]
mov qword [rsp + 0xad8], rax
mov rdx, qword [rsp + 0xad8]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x5f8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x5d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x5b8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xae0], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xae0]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1800cdf6b
mov dword [rsp + 0x70], 0xffffefdb
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.Booten_US_bootfix.bin
lea rcx, [rsp + 0x618]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x638]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xae8], rax
mov rax, qword [rsp + 0xae8]
mov qword [rsp + 0xaf0], rax
lea r8, [rsp + 0x618]
mov rdx, qword [rsp + 0xaf0]
lea rcx, [rsp + 0x658]
call fcn.180033cc0
mov qword [rsp + 0xaf8], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0xb00], rax
mov rdx, qword [rsp + 0xb00]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x658]
call fcn.18000165e
nop
lea rcx, [rsp + 0x638]
call fcn.18000165e
nop
lea rcx, [rsp + 0x618]
call fcn.18000165e
lea rdx, str.Boot_bootfix.bin
lea rcx, [rsp + 0x678]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x698]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xb08], rax
mov rax, qword [rsp + 0xb08]
mov qword [rsp + 0xb10], rax
lea r8, [rsp + 0x678]
mov rdx, qword [rsp + 0xb10]
lea rcx, [rsp + 0x6b8]
call fcn.180033cc0
mov qword [rsp + 0xb18], rax
mov rax, qword [rsp + 0xb18]
mov qword [rsp + 0xb20], rax
mov rdx, qword [rsp + 0xb20]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x6b8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x698]
call fcn.18000165e
nop
lea rcx, [rsp + 0x678]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xb28], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xb28]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1800ce14b
mov dword [rsp + 0x70], 0xffffefdb
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
mov rax, qword [rsp + 0xc10]
mov rcx, qword [rax]
call fcn.1800d0f40
movzx eax, al
test eax, eax
je 0x1800ce346
lea rdx, str.EFImicrosoft_booten_USefisys.bin
lea rcx, [rsp + 0x6d8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x6f8]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xb30], rax
mov rax, qword [rsp + 0xb30]
mov qword [rsp + 0xb38], rax
lea r8, [rsp + 0x6d8]
mov rdx, qword [rsp + 0xb38]
lea rcx, [rsp + 0x718]
call fcn.180033cc0
mov qword [rsp + 0xb40], rax
mov rax, qword [rsp + 0xb40]
mov qword [rsp + 0xb48], rax
mov rdx, qword [rsp + 0xb48]
lea rcx, [rsp + 0x48]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x718]
call fcn.18000165e
nop
lea rcx, [rsp + 0x6f8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x6d8]
call fcn.18000165e
lea rdx, [0x180229db0]
lea rcx, [rsp + 0x738]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x758]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xb50], rax
mov rax, qword [rsp + 0xb50]
mov qword [rsp + 0xb58], rax
lea r8, [rsp + 0x738]
mov rdx, qword [rsp + 0xb58]
lea rcx, [rsp + 0x778]
call fcn.180033cc0
mov qword [rsp + 0xb60], rax
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0xb68], rax
mov rdx, qword [rsp + 0xb68]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x778]
call fcn.18000165e
nop
lea rcx, [rsp + 0x758]
call fcn.18000165e
nop
lea rcx, [rsp + 0x738]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov qword [rsp + 0xb70], rax
lea rcx, [rsp + 0x48]
call fcn.18000122b
mov rcx, qword [rsp + 0xb70]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1800ce346
mov dword [rsp + 0x70], 0xffffefdb
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
jmp 0x1800ce68f
lea rdx, str.EFImicrosoft_boot_boot.sdi
lea rcx, [rsp + 0x798]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x7b8]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xb78], rax
mov rax, qword [rsp + 0xb78]
mov qword [rsp + 0xb80], rax
lea r8, [rsp + 0x798]
mov rdx, qword [rsp + 0xb80]
lea rcx, [rsp + 0x7d8]
call fcn.180033cc0
mov qword [rsp + 0xb88], rax
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0xb90], rax
mov rdx, qword [rsp + 0xb90]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x7d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x7b8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x798]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.EFImicrosoft_boot_bootmgfw.efi
lea rcx, [rsp + 0x7f8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x818]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xb98], rax
mov rax, qword [rsp + 0xb98]
mov qword [rsp + 0xba0], rax
lea r8, [rsp + 0x7f8]
mov rdx, qword [rsp + 0xba0]
lea rcx, [rsp + 0x838]
call fcn.180033cc0
mov qword [rsp + 0xba8], rax
mov rax, qword [rsp + 0xba8]
mov qword [rsp + 0xbb0], rax
mov rdx, qword [rsp + 0xbb0]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x838]
call fcn.18000165e
nop
lea rcx, [rsp + 0x818]
call fcn.18000165e
nop
lea rcx, [rsp + 0x7f8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str._bootmgfw.efi
lea rcx, [rsp + 0x858]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x878]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xbb8], rax
mov rax, qword [rsp + 0xbb8]
mov qword [rsp + 0xbc0], rax
lea r8, [rsp + 0x858]
mov rdx, qword [rsp + 0xbc0]
lea rcx, [rsp + 0x898]
call fcn.180033cc0
mov qword [rsp + 0xbc8], rax
mov rax, qword [rsp + 0xbc8]
mov qword [rsp + 0xbd0], rax
mov rdx, qword [rsp + 0xbd0]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x898]
call fcn.18000165e
nop
lea rcx, [rsp + 0x878]
call fcn.18000165e
nop
lea rcx, [rsp + 0x858]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.memtest.efi
lea rcx, [rsp + 0x8b8]
call fcn.1800334a0
nop
lea rdx, [rsp + 0x8d8]
mov rcx, qword [rsp + 0xc10]
call fcn.1800cb8a0
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
lea r8, [rsp + 0x8b8]
mov rdx, qword [rsp + 0xbe0]
lea rcx, [rsp + 0x8f8]
call fcn.180033cc0
mov qword [rsp + 0xbe8], rax
mov rax, qword [rsp + 0xbe8]
mov qword [rsp + 0xbf0], rax
mov rdx, qword [rsp + 0xbf0]
lea rcx, [rsp + 0x28]
call fcn.180001d6b
nop
lea rcx, [rsp + 0x8f8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x8d8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x8b8]
call fcn.18000165e
lea rcx, [rsp + 0x28]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0xb8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x98]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
xor eax, eax
test eax, eax
jne 0x1800cd0ef
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x918], eax
lea rcx, [rsp + 0x28]
call fcn.18000165e
nop
lea rcx, [rsp + 0x48]
call fcn.18000165e
mov eax, dword [rsp + 0x918]
add rsp, 0xc08
ret