Function at 0x14001a69c
Capabilities:
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, r8
xor eax, eax
mov r14, rdx
mov qword [r11 - 0x28], rax
mov r15, rcx
mov qword [r11 - 0x20], rax
mov rcx, rbp
lea rdx, [r11 - 0x38]
xor r9d, r9d
xor r8d, r8d
xor ebx, ebx
xor esi, esi
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x14001a735
mov ebx, 0x80070003
lea rdi, str.WimMoveFile
mov r9d, ebx
mov rcx, rdi
mov r8d, 0x525
call fcn.14001b2f8
mov dword [rsp + 0x30], 0x526
lea r9, str.Converting_to_NT_filename_failed
mov qword [rsp + 0x28], rdi
lea ecx, [rsi + 1]
mov r8, rbp
mov dword [rsp + 0x20], ebx
mov rdx, r15
call fcn.14000f794
jmp 0x14001a915
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
mov edx, 0x1f0000
mov rcx, r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
mov r13d, 0x80070000
cmp rax, 0xffffffffffffffff
jne 0x14001a7cd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001a7aa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x14001a7af
mov ebx, 0x80004005
test ebx, ebx
jns 0x14001a7cd
mov r9d, ebx
lea rcx, str.WimMoveFile
mov r8d, 0x536
call fcn.14001b2f8
jmp 0x14001a915
movzx edi, word [rsp + 0x40]
add rdi, 0x18
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14001a8ac
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and qword [rsi + 8], 0
lea rcx, [rsi + 0x14]
mov byte [rsi], 1
movzx eax, word [rsp + 0x40]
mov dword [rsi + 0x10], eax
movzx r8d, word [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov r9d, edi
mov dword [rsp + 0x20], 0xa
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14001a900
mov ebx, eax
lea rdi, str.WimMoveFile
or ebx, 0x10000000
jge 0x14001a882
mov r9d, ebx
mov r8d, 0x551
mov rcx, rdi
call fcn.14001b2f8
mov dword [rsp + 0x30], 0x552
lea r9, str.Could_not_move_source_file
mov qword [rsp + 0x28], rdi
mov r8, r14
mov rdx, r15
mov dword [rsp + 0x20], ebx
mov ecx, 1
call fcn.14000f794
jmp 0x14001a900
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001a8e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x14001a8e7
mov ebx, 0x80004005
test ebx, ebx
jns 0x14001a900
mov r9d, ebx
lea rcx, str.WimMoveFile
mov r8d, 0x558
call fcn.14001b2f8
cmp rbp, 0xffffffffffffffff
je 0x14001a915
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
cmp qword [rsp + 0x48], 0
je 0x14001a93d
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test rsi, rsi
je 0x14001a962
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret