Function at 0x1400c7970
Capabilities:
Manipulate boot configuration
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4d0
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_1216], rax
mov esi, edx
mov rbx, rcx
call fcn.140049400
lea rcx, [rsp + 0xc2]
xor edx, edx
mov r8d, 0xfe
mov rdi, rax
mov word [rsp + 0xc0], 0
call sub.ntdll.dll_memset
mov rax, qword [rdi]
lea rdx, [rsp + 0xc0]
mov r8d, 0x80
mov rcx, rdi
call qword [rax + 0x48]
mov rdx, qword [rbx + 0x58]
test rdx, rdx
mov edi, eax
je 0x1400c7a01
lea rax, [rsp + 0xc0]
sub rax, rdx
nop
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
mov word [rax + rdx - 2], cx
jne 0x1400c79f0
test edi, edi
jne 0x1400c7ae8
call fcn.140049470
lea rbx, [0x1404343d0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea edx, [rdi + 0x5c]
lea rcx, str..._boot.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400c7a47
xor ebx, ebx
jmp 0x1400c7ad0
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xb0]
mov r8d, reloc.MFC80U.DLL_Ordinal_576
mov byte [rsp + 0xb0], 0
mov qword [rsp + 0xb1], rax
mov word [rsp + 0xb9], ax
mov byte [rsp + 0xbb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400c7a90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xb0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400c7ac0
mov rax, qword [rsi]
lea rdx, str._s:_Failed_to_IVol.GetSystemVolumeDevice_in_SetFileAttributeForBootIni.
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
jmp 0x1400c7c73
lea rcx, [rsp + 0x1c2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x1c0], 0
call sub.ntdll.dll_memset
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0x1c0]
mov edx, 0x80
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
lea rcx, [rsp + 0x2c2]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0x2c0], 0
call sub.ntdll.dll_memset
lea r8, [rsp + 0x1c0]
lea rdx, [0x1402dfd70]
lea rcx, [rsp + 0x2c0]
call fcn.140002b60
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor ebx, ebx
lea rax, [rsp + 0x90]
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x100100
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
mov edi, eax
jne 0x1400c7c38
mov rcx, qword [rsp + 0x30]
xor eax, eax
lea r9d, [rbx + 0x28]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_ZwSetInformationFile]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ntdll.dll_ZwClose]
test edi, edi
jne 0x1400c7c38
lea eax, [rbx + 1]
jmp 0x1400c7c75
mov ecx, edi
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140049470
lea rcx, str..._boot.cpp
mov rbx, qword [rax]
mov edx, reloc.MFC80U.DLL_Ordinal_628
mov rdi, rax
call fcn.1400c6f30
lea rdx, str._s:_Failed_to_ZwSetInformationFile_in_SetFileAttributeForBootIni.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_1216]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret