Function at 0x140043058
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
and qword [rbp + 0x48], 0
xor ebx, ebx
mov rsi, qword [rdx]
xorps xmm0, xmm0
mov rax, qword [r9]
xorps xmm1, xmm1
mov qword [rbp - 0x38], rsi
mov r13, rcx
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
test rcx, rcx
je 0x1400430b4
cmp qword [rcx + 0x48], rbx
mov rax, rcx
cmovne rax, qword [rcx + 0x48]
mov ebx, dword [rax + 0x24]
mov r14, qword [rbp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1400430dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14000a9c4
bt ebx, 0x1c
jae 0x140043383
lea r9, [0x1400bacf4]
lea r8, [0x1400b8190]
lea rdx, [0x1400450b0]
lea rcx, [0x140044ff0]
call fcn.14005cfa0
mov ebx, eax
test eax, eax
jns 0x140043134
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmainmiscutil.c
mov r9d, eax
lea rcx, str.WimExchangeFiles
mov r8d, 0x420
call fcn.140046874
jmp 0x1400437dd
movabs r10, 0xb97587c052d4b170
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov rax, qword [0x1400bad10]
xor edx, edx
and dword [rsp + 0x20], 0
xor ecx, ecx
call qword [vtable._SH_n.0]
mov qword [rbp - 0x38], rax
lea r15, str.onecore_base_ntsetupopktoolsosimagelibmainmiscutil.c
lea rdi, str.WimExchangeFiles
mov ebx, 0x80070000
mov r14, rax
mov r12d, 0x80004005
cmp rax, 0xffffffffffffffff
jne 0x1400431c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, ebx
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140043288
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
js 0x14004328b
mov r8, qword [rbp + 0x50]
mov rcx, r14
mov rdx, qword [rbp + 0x60]
call fcn.14005b19c
mov esi, eax
test eax, eax
jns 0x1400431f7
mov r9d, eax
mov r8d, 0x433
and qword [rsp + 0x20], 0
mov rdx, r15
mov rcx, rdi
call fcn.140046874
mov ebx, esi
cmp r14, 0xffffffffffffffff
je 0x1400437b4
movabs r10, 0xb2e10636105e9a70
mov rax, qword [0x1400bacf8]
xor ecx, ecx
call qword [vtable._SH_n.0]
mov r14d, 1
test esi, esi
js 0x1400432ea
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbp - 0x38]
mov rax, qword [0x1400bad08]
call qword [vtable._SH_n.0]
test eax, eax
jne 0x14004336e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov esi, 0x80070000
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140043299
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1400432b6
jmp 0x14004329c
mov esi, r12d
mov r9d, esi
mov r8d, 0x42b
jmp 0x1400431e6
mov ebx, r12d
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0x4e7
mov rdx, r15
mov rcx, rdi
call fcn.140046874
mov rsi, qword [rbp + 0x48]
lea r9, str.failed_transaction_commit
mov dword [rsp + 0x30], 0x4e9
mov r8, rsi
mov qword [rsp + 0x28], rdi
mov rdx, r13
mov ecx, r14d
mov dword [rsp + 0x20], ebx
call fcn.14002aaa0
test ebx, ebx
jns 0x14004336e
jmp 0x1400432ee
mov rsi, qword [rbp + 0x48]
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rbp - 0x38]
mov rax, qword [0x1400bad00]
call qword [vtable._SH_n.0]
test eax, eax
jne 0x14004336e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r15d, 0x80070000
or ecx, r15d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140043347
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r12d, ax
or r12d, r15d
test eax, eax
cmovle r12d, eax
mov dword [rsp + 0x30], 0x4f2
lea r9, str.failed_transaction_rollback
mov qword [rsp + 0x28], rdi
mov r8, rsi
mov rdx, r13
mov dword [rsp + 0x20], r12d
mov ecx, r14d
call fcn.14002aaa0
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x1400437b4
mov r12d, 8
lea r8, [rbp + 0x48]
mov edx, r12d
mov rcx, rsi
call fcn.140042c2c
lea r15, str.onecore_base_ntsetupopktoolsosimagelibmainmiscutil.c
lea rdi, str.WimExchangeFiles
test eax, eax
jns 0x1400433f7
and qword [rsp + 0x20], 0
mov r9d, eax
mov r8d, 0x443
mov rdx, r15
mov rcx, rdi
call fcn.140046874
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, rsi
call fcn.140042c2c
mov ebx, eax
test eax, eax
jns 0x1400433f7
and qword [rsp + 0x20], 0
mov r9d, eax
mov r8d, 0x446
mov rdx, r15
mov rcx, rdi
call fcn.140046874
jmp 0x1400437b4
mov rsi, qword [rbp + 0x48]
lea rdx, [rbp - 0x28]
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x140043448
and qword [rsp + 0x20], 0
mov r14d, 0x80070003
mov r9d, r14d
mov r8d, 0x451
mov rdx, r15
mov rcx, rdi
mov ebx, r14d
call fcn.140046874
mov r8, rsi
mov dword [rsp + 0x30], 0x452
jmp 0x140043494
xor r9d, r9d
lea rdx, [rbp - 0x18]
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x1400434b7
and qword [rsp + 0x20], 0
mov r14d, 0x80070003
mov r9d, r14d
mov r8d, 0x45d
mov rdx, r15
mov rcx, rdi
mov ebx, r14d
call fcn.140046874
mov r8, qword [rbp + 0x68]
mov dword [rsp + 0x30], 0x45e
mov qword [rsp + 0x28], rdi
lea r9, str.Converting_to_NT_filename_failed
mov rdx, r13
mov dword [rsp + 0x20], r14d
mov ecx, 1
call fcn.14002aaa0
jmp 0x1400437b4
movzx ebx, word [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rbx + 0x18]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x50], rax
mov esi, 0x80070000
mov r12d, 0x80004005
mov rbx, rax
test rax, rax
je 0x140043520
movzx r8d, word [rbp - 0x18]
lea rcx, [rax + 0x14]
mov rdx, qword [rbp - 0x10]
call sub.msvcrt.dll_memmove
movzx ecx, word [rbp - 0x18]
mov r14d, 1
and qword [rbx + 8], 0
mov dword [rbx + 0x10], ecx
mov byte [rbx], r14b
jmp 0x1400435a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140043556
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140043573
jmp 0x140043559
mov ebx, r12d
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0x474
mov rdx, r15
mov rcx, rdi
call fcn.140046874
mov r8, r14
mov dword [rsp + 0x30], 0x475
mov r14d, 1
mov qword [rsp + 0x28], rdi
mov ecx, r14d
mov dword [rsp + 0x20], ebx
lea r9, str.MALLOC_failed
mov rdx, r13
call fcn.14002aaa0
test ebx, ebx
js 0x1400437b4
movzx ebx, word [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rbx + 0x18]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400435fd
movzx r8d, word [rbp - 0x28]
lea rcx, [rax + 0x14]
mov rdx, qword [rbp - 0x20]
call sub.msvcrt.dll_memmove
movzx ecx, word [rbp - 0x28]
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov byte [rsi], r14b
jmp 0x140043687
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14004363b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140043658
jmp 0x14004363e
mov ebx, r12d
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0x48b
mov rdx, r15
mov rcx, rdi
call fcn.140046874
mov r8, qword [rbp + 0x58]
lea r9, str.MALLOC_failed
mov dword [rsp + 0x30], 0x48c
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov ecx, r14d
mov dword [rsp + 0x20], ebx
call fcn.14002aaa0
test ebx, ebx
js 0x14004378b
movzx r9d, word [rbp - 0x18]
mov rcx, r13
mov r15, qword [rbp + 0x50]
add r9d, 0x18
mov r12, qword [rbp - 0x38]
mov r8, r15
mov rdx, r12
mov dword [rsp + 0x20], 0xa
call fcn.140044c98
mov ebx, eax
test eax, eax
js 0x14004373d
movzx r9d, word [rbp - 0x28]
mov r8, rsi
mov rdx, qword [rbp - 0x30]
add r9d, 0x18
mov rcx, r13
mov dword [rsp + 0x20], 0xa
call fcn.140044c98
mov ebx, eax
test eax, eax
jns 0x140043764
mov r8, qword [rbp + 0x58]
lea r9, str.moving_folder_failed
mov dword [rsp + 0x30], 0x4aa
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov ecx, r14d
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
movzx r9d, word [rbp - 0x28]
mov r8, rsi
add r9d, 0x18
mov dword [rsp + 0x20], 0xa
mov rdx, r12
mov rcx, r13
call fcn.140044c98
test eax, eax
jns 0x140043764
mov dword [rsp + 0x30], 0x4b9
lea r9, str.restoring_folder_failed
jmp 0x14004374c
mov dword [rsp + 0x30], 0x4c1
lea r9, str.moving_folder_failed
mov r8, qword [rbp + 0x48]
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov ecx, r14d
mov dword [rsp + 0x20], eax
call fcn.14002aaa0
test rsi, rsi
je 0x14004378f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14004378f
mov r15, qword [rbp + 0x50]
test r15, r15
je 0x1400437b4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r14, qword [rbp + 0x48]
test r14, r14
je 0x1400437dd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rbp - 0x20], 0
je 0x140043803
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x20]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rbp - 0x10], 0
je 0x140043829
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret