Function at 0x14000b0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x968]
sub rsp, 0xa40
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
movsxd r14, dword [0x1401e8680]
lea rax, [0x140157458]
mov qword [rbp - 0x78], rax
xor r13d, r13d
mov qword [rsp + 0x60], rcx
lea rax, [0x14015745c]
mov ecx, dword [0x1401e9090]
xorps xmm0, xmm0
mov esi, ecx
mov qword [rbp - 0x70], rax
shl ecx, 7
lea rax, [0x140157460]
mov qword [rbp - 0x68], rax
xor edx, edx
mov eax, dword [0x1401e908c]
mov ebx, r13d
mov dword [rsp + 0x58], r8d
mov edi, r13d
mov dword [rsp + 0x54], ecx
mov r8d, 0x930
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x5c], r9d
imul rsi, rax
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x68], 2
call fcn.140136540
mov rcx, qword [0x1401e87c8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e87c8]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x150
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp + r14*8 - 0x78]
mov r9d, 0xca6
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov edx, 1
mov r15, rax
mov ecx, edx
call fcn.140021510
test r15, r15
mov eax, 0x200
cmove r15, rax
cmp r14d, 2
je 0x14000c184
test byte [rbp + 0x990], 4
je 0x14000b2b3
mov rdi, qword [0x1401e87b8]
mov edx, 0x1f6
mov rcx, rdi
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
test rax, rax
jne 0x14000b23b
call fcn.14004fba0
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
jmp 0x14000b286
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000b26c
call fcn.14004fba0
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
jmp 0x14000b286
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
test r13, r13
mov r13d, 0
cmove ebx, r13d
test rbx, rbx
jne 0x14000b2ab
lea rcx, str.Could_not_access_embedded_uefi_ntfs.img
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov r14d, dword [rsp + 0x50]
mov edi, r13d
xorps xmm0, xmm0
lea rcx, [0x1401e90a8]
xor edx, edx
mov r8d, 0x580
movups xmmword [0x1401e9070], xmm0
call fcn.140136540
cmp r14d, 1
je 0x14000b303
mov rcx, qword [0x1401e89e8]
mov edx, 0x3fc
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x14000b303
lea rax, [rsi - 1]
add rax, r15
cqo
idiv r15
imul rax, r15
add rax, rax
jmp 0x14000b308
mov eax, 0x100000
cmp dword [0x1401e9098], 0xc
mov qword [0x1401e90f0], rax
je 0x14000b328
cmp dword [0x1401d050c], 0x3a98
jbe 0x14000b447
movzx r10d, byte [rbp + 0x990]
test r10b, 2
je 0x14000b44f
cmp r14d, 1
je 0x14000b360
mov r8d, 0x907
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fbe54
mov rax, qword [0x1401e90f0]
mov ecx, dword [0x1401e9090]
lea r10, [rax + 0x10400000]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r9d, word [0x140157528]
xor edx, edx
movups xmm3, xmmword [0x140157510]
lea r8, [rsi - 1]
mov dword [0x1401e9074], r13d
movsd xmm4, qword [0x140157520]
add r8, r10
mov rax, r8
movsd qword [0x1401e90c8], xmm4
div rsi
mov rax, r15
mov word [0x1401e90d0], r9w
sub r8, rdx
mov qword [0x1401e90f8], 0x10400000
cqo
mov qword [0x1401e9148], r8
idiv rcx
movups xmmword [0x1401e90a8], xmm2
movups xmmword [0x1401e90b8], xmm3
test rdx, rdx
jne 0x14000b3f1
mov rax, r8
div r15
sub r8, rdx
mov qword [0x1401e9148], r8
cmp r8, r10
jae 0x14000b42d
mov r8d, 0x910
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_pi__1_.Offset___SelectedDrive.Partition_pi_.Offset__SelectedDrive.Partition_pi_.Size
call fcn.1400fbe54
movzx r9d, word [0x140157528]
movsd xmm4, qword [0x140157520]
movups xmm3, xmmword [0x140157510]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x990]
mov edi, 1
and r10b, 0xfd
mov byte [rbp + 0x990], r10b
jmp 0x14000b46d
movzx r10d, byte [rbp + 0x990]
movzx r9d, word [0x140157528]
movsd xmm4, qword [0x140157520]
movups xmm3, xmmword [0x140157510]
movups xmm2, xmmword [str.EFI_System_Partition]
lea r8, [0x140000000]
test r10b, 1
je 0x14000b5d1
cmp r14d, 1
je 0x14000b4c2
mov r8d, 0x918
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fbe54
movzx r9d, word [0x140157528]
lea r8, [0x140000000]
movsd xmm4, qword [0x140157520]
movups xmm3, xmmword [0x140157510]
movups xmm2, xmmword [str.EFI_System_Partition]
movups xmm0, xmmword [str.Microsoft_Reserved_Partition]
mov eax, edi
xor edx, edx
movups xmm1, xmmword [0x140157620]
imul rcx, rax, 0x58
movzx eax, word [0x140157648]
mov r11, qword [rcx + r8 + 0x1e90f0]
movups xmmword [rcx + r8 + 0x1e90a8], xmm0
mov qword [rcx + r8 + 0x1e90f8], 0x8000000
add r11, 0x8000000
movups xmm0, xmmword [0x140157630]
inc edi
movups xmmword [rcx + r8 + 0x1e90b8], xmm1
movups xmmword [rcx + r8 + 0x1e90c8], xmm0
movsd xmm0, qword [0x140157640]
movsd qword [rcx + r8 + 0x1e90d8], xmm0
mov word [rcx + r8 + 0x1e90e0], ax
lea r8, [rsi - 1]
add r8, r11
mov eax, edi
imul r10, rax, 0x58
lea rax, [0x1401e90f0]
add r10, rax
mov rax, r8
div rsi
mov rax, r15
sub r8, rdx
cqo
mov qword [r10], r8
mov ecx, dword [0x1401e9090]
idiv rcx
test rdx, rdx
jne 0x14000b57b
mov rax, r8
div r15
sub r8, rdx
mov qword [r10], r8
cmp r8, r11
jae 0x14000b5b7
mov r8d, 0x91f
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_pi__1_.Offset___SelectedDrive.Partition_pi_.Offset__SelectedDrive.Partition_pi_.Size
call fcn.1400fbe54
movzx r9d, word [0x140157528]
movsd xmm4, qword [0x140157520]
movups xmm3, xmmword [0x140157510]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x990]
lea r8, [0x140000000]
and r10b, 0xfe
mov byte [rbp + 0x990], r10b
mov r11d, edi
lea rax, str.EFI_System_Partition
mov dword [0x1401e9070], edi
lea rcx, str.Main_Data_Partition
inc edi
mov dword [rsp + 0x48], r11d
cmp dword [0x14019f14c], 0
lea r13, [r8 + 0x1e90a8]
mov dword [rsp + 0x40], edi
cmovne rcx, rax
imul r12, r11, 0x58
add r13, r12
mov rdx, r13
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000b620
test r10b, r10b
je 0x14000b807
test r10b, 0x10
je 0x14000b708
mov rcx, qword [0x14019f118]
test rcx, rcx
jne 0x14000b69a
mov r8d, 0x92e
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.persistence_size___0
call fcn.1400fbe54
movzx r9d, word [0x140157528]
movsd xmm4, qword [0x140157520]
movups xmm3, xmmword [0x140157510]
mov rcx, qword [0x14019f118]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x990]
mov r11d, dword [rsp + 0x48]
movups xmm0, xmmword [str.Linux_Persistence]
mov eax, edi
lea rdx, [0x140000000]
movups xmm1, xmmword [0x1401576b8]
dec rcx
mov dword [0x1401e9078], edi
imul r8, rax, 0x58
mov eax, dword [0x1401576c8]
add rcx, rsi
movups xmmword [r8 + rdx + 0x1e90a8], xmm0
movups xmmword [r8 + rdx + 0x1e90b8], xmm1
mov dword [r8 + rdx + 0x1e90c8], eax
xor edx, edx
mov rax, rcx
div rsi
lea rax, [0x140000000]
sub rcx, rdx
inc edi
mov qword [r8 + rax + 0x1e90f8], rcx
mov dword [rsp + 0x40], edi
lea r8, [0x140000000]
test r10b, 2
je 0x14000b75c
mov eax, edi
imul rcx, rax, 0x58
lea rax, [rsi + 0x103fffff]
mov dword [0x1401e9074], edi
cqo
idiv rsi
movups xmmword [rcx + r8 + 0x1e90a8], xmm2
movups xmmword [rcx + r8 + 0x1e90b8], xmm3
imul rax, rsi
movsd qword [rcx + r8 + 0x1e90c8], xmm4
mov word [rcx + r8 + 0x1e90d0], r9w
mov qword [rcx + r8 + 0x1e90f8], rax
jmp 0x14000b801
test r10b, 4
je 0x14000b7af
movups xmm0, xmmword [0x1401570c0]
mov eax, edi
lea r9, [0x140000000]
imul r8, rax, 0x58
mov eax, dword [0x1401570d0]
lea rcx, [rsi - 1]
add rcx, rbx
mov dword [0x1401e907c], edi
xor edx, edx
movups xmmword [r8 + r9 + 0x1e90a8], xmm0
mov dword [r8 + r9 + 0x1e90b8], eax
mov rax, rcx
div rsi
sub rcx, rdx
mov qword [r8 + r9 + 0x1e90f8], rcx
jmp 0x14000b801
test r10b, 8
je 0x14000b807
movups xmm0, xmmword [str.BIOS_Compatibility]
mov eax, edi
movups xmm1, xmmword [0x1401576e0]
imul rcx, rax, 0x58
mov eax, dword [0x1401576f0]
movups xmmword [rcx + r8 + 0x1e90a8], xmm0
mov qword [rcx + r8 + 0x1e90f8], rsi
movups xmmword [rcx + r8 + 0x1e90b8], xmm1
mov dword [rcx + r8 + 0x1e90c8], eax
movzx eax, word [0x1401576f4]
mov word [rcx + r8 + 0x1e90cc], ax
inc edi
mov dword [rsp + 0x40], edi
cmp edi, 0x10
jbe 0x14000b82c
mov r8d, 0x940
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.pi___MAX_PARTITIONS
call fcn.1400fbe54
xor eax, eax
jmp 0x14000c189
mov rbx, qword [0x1401e9080]
cmp r14d, 1
jne 0x14000b846
mov eax, dword [0x1401e9090]
imul rcx, rax, 0x21
sub rbx, rcx
lea ecx, [rdi - 1]
cmp ecx, r11d
jbe 0x14000b8a2
mov eax, ecx
imul rdi, rax, 0x58
lea rax, [0x1401e90f8]
add rdi, rax
sub ecx, r11d
mov r14d, ecx
cmp qword [rdi], rbx
jb 0x14000b882
mov r8d, 0x949
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_i_.Size___last_offset
call fcn.1400fbe54
sub rbx, qword [rdi]
xor edx, edx
mov rax, rbx
div rsi
sub rbx, rdx
mov qword [rdi - 8], rbx
sub rdi, 0x58
sub r14, 1
jne 0x14000b864
mov edi, dword [rsp + 0x40]
lea r8, [0x140000000]
cmp rbx, qword [r12 + r8 + 0x1e90f0]
ja 0x14000b8d3
mov r8d, 0x94f
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.last_offset___SelectedDrive.Partition_mi_.Offset
call fcn.1400fbe54
lea r8, [0x140000000]
sub rbx, qword [r12 + r8 + 0x1e90f0]
xor edx, edx
mov rax, rbx
div rsi
mov rax, r15
sub rbx, rdx
cqo
mov qword [r12 + r8 + 0x1e90f8], rbx
mov ecx, dword [0x1401e9090]
idiv rcx
test rdx, rdx
jne 0x14000b912
mov rax, rbx
div r15
sub rbx, rdx
mov qword [r12 + r8 + 0x1e90f8], rbx
test rbx, rbx
jne 0x14000b92d
mov rdx, r13
lea rcx, str.Error:_Invalid__S_size
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
xor r15d, r15d
mov r14d, r15d
test edi, edi
je 0x14000be58
mov esi, dword [rsp + 0x54]
movsd xmm9, qword [0x140176fe0]
movsd xmm8, qword [0x140176f68]
movsd xmm10, qword [0x140176fc0]
movsd xmm11, qword [0x140176f90]
mov r13d, dword [rsp + 0x48]
mov qword [rbp - 0x80], rsi
mov r12d, r14d
lea r10, [0x1401e2e30]
imul r15, r12, 0x58
xorps xmm7, xmm7
lea rdi, [0x1401564ce]
mov rcx, qword [r15 + r8 + 0x1e90f8]
test rcx, rcx
js 0x14000b998
cvtsi2sd xmm7, rcx
jmp 0x14000b9ad
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm7, rax
addsd xmm7, xmm7
xor ebx, ebx
nop
comisd xmm9, xmm7
ja 0x14000b9c5
inc rbx
mulsd xmm7, xmm8
cmp rbx, 5
jl 0x14000b9b0
test rbx, rbx
jne 0x14000b9ef
mov rax, qword [0x140196210]
lea r9, str._s_d_s__s
cvttsd2si ecx, xmm7
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ecx
mov rcx, r10
jmp 0x14000ba45
movaps xmm6, xmm7
movaps xmm0, xmm7
mulsd xmm6, xmm10
call fcn.140135bc0
lea rax, str._s_0.0f_s__s
mulsd xmm0, xmm10
lea r9, str._s_0.1f_s__s
lea rcx, [0x1401e2e30]
subsd xmm6, xmm0
comisd xmm11, xmm6
cmova r9, rax
lea rax, [0x140000000]
mov rax, qword [rax + rbx*8 + 0x196210]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
movsd qword [rsp + 0x28], xmm7
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rdi
mov edx, 0x20
call fcn.140004fd0
lea rbx, [0x140000000]
mov byte [0x1401e2e4f], 0
lea rdi, [rbx + 0x1e90a8]
add rdi, r15
lea rdx, str.Partition
mov rcx, rdi
call fcn.1400b3fa8
mov r9, qword [r15 + rbx + 0x1e90f0]
lea r8, [0x1401564ce]
test rax, rax
lea rcx, str._Creating__S_s__offset:__lld__size:__s_
lea rax, str._Partition
mov rdx, rdi
cmove r8, rax
lea rax, [0x1401e2e30]
mov qword [rsp + 0x20], rax
call fcn.14004f2f0
mov rax, qword [r15 + rbx + 0x1e90f8]
mov edx, 1
mov ecx, dword [rsp + 0x54]
cmp rsi, rax
mov rbx, qword [r15 + rbx + 0x1e90f0]
cmovae ecx, eax
mov dword [rsp + 0x48], ecx
call fcn.1400c4f6c
mov rsi, rax
test rax, rax
je 0x14000bb32
mov rdx, rbx
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000bb0f
mov rcx, rsi
call fcn.1400e8c70
jmp 0x14000bb32
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov rcx, rbx
call fcn.140050980
mov rcx, rsi
mov ebx, eax
call fcn.1400e8c70
test ebx, ebx
jne 0x14000bb49
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_zero__S:__s
mov rdx, rdi
call fcn.14004f2f0
lea rbx, [r12 + r12*8]
mov r12d, dword [rsp + 0x50]
shl rbx, 4
lea r8, [0x140000000]
mov rax, qword [r15 + r8 + 0x1e90f0]
lea esi, [r14 + 1]
mov qword [rbp + rbx - 0x28], rax
mov rax, qword [r15 + r8 + 0x1e90f8]
mov qword [rbp + rbx - 0x20], rax
mov dword [rbp + rbx - 0x30], r12d
mov dword [rbp + rbx - 0x18], esi
mov byte [rbp + rbx - 0x14], 1
test r12d, r12d
jne 0x14000bcc3
cmp r14d, r13d
jne 0x14000bbda
cmp dword [0x1401e89e0], r12d
setne al
mov byte [rbp + rbx - 0xf], al
movsxd rax, dword [rsp + 0x58]
cmp eax, 8
ja case.default.0x14000bbbe
mov ecx, dword [r8 + rax*4 + 0xc1d8]
add rcx, r8
jmp rcx
mov byte [rbp + rbx - 0x10], 0xe
jmp 0x14000bbda
mov byte [rbp + rbx - 0x10], 7
jmp 0x14000bbda
mov byte [rbp + rbx - 0x10], 0x83
jmp 0x14000bbda
mov byte [rbp + rbx - 0x10], 0xc
mov rcx, 0xffffffffffffffff
lea r15, str.EFI_System_Partition
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x14000bc12
add rcx, 2
cmp rcx, 0x15
je 0x14000bc40
movzx eax, word [rdi + rcx*2]
cmp ax, word [r15 + rcx*2]
je 0x14000bbf0
xor ecx, ecx
lea rdx, [0x1401570c0]
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000bc4a
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000bc4a
add rcx, 2
cmp rcx, 0xa
jne 0x14000bc20
mov byte [rbp + rbx - 0x10], 0xef
jmp 0x14000bd67
xor ecx, ecx
lea r15, str.Linux_Persistence
movzx eax, word [rdi + rcx*2]
cmp ax, word [r15 + rcx*2]
jne 0x14000bc7f
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x14000bc7f
add rcx, 2
cmp rcx, 0x12
jne 0x14000bc53
mov byte [rbp + rbx - 0x10], 0x83
jmp 0x14000bd67
mov rcx, 0xffffffffffffffff
lea rdx, str.BIOS_Compatibility
nop dword [rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000bd67
add rcx, 2
cmp rcx, 0x13
je 0x14000bcb9
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000bc90
jmp 0x14000bd67
mov byte [rbp + rbx - 0x10], 0xea
jmp 0x14000bd67
cmp r12d, 1
je 0x14000bce2
mov r8d, 0x992
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fbe54
xor ecx, ecx
lea rdx, [0x1401570c0]
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000bd7f
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000bd7f
add rcx, 2
cmp rcx, 0xa
jne 0x14000bcf0
movabs rax, 0x9000000000000000
mov qword [rbp + rbx + 0x10], rax
movups xmm0, xmmword [0x140158030]
lea rcx, [rbp]
add rcx, rbx
movups xmmword [rbp + rbx - 0x10], xmm0
call qword [sym.imp.ole32.dll_CoCreateGuid]
lea rcx, [rbp + 0x18]
sub rbx, rdi
add rcx, rbx
nop word [rax + rax]
movzx eax, word [rdi]
mov word [rdi + rcx], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x14000bd50
lea r8, [0x140000000]
mov edi, dword [rsp + 0x40]
mov r14d, esi
cmp esi, edi
jae 0x14000be5f
mov rsi, qword [rbp - 0x80]
jmp 0x14000b96c
mov rcx, 0xffffffffffffffff
lea r15, str.EFI_System_Partition
nop dword [rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x14000bdb2
add rcx, 2
cmp rcx, 0x15
je 0x14000bdee
movzx eax, word [rdi + rcx*2]
cmp ax, word [r15 + rcx*2]
je 0x14000bd90
xor ecx, ecx
lea r15, str.Linux_Persistence
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [r15 + rcx*2]
jne 0x14000bdfa
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x14000bdfa
add rcx, 2
cmp rcx, 0x12
jne 0x14000bdc0
movups xmm0, xmmword [0x140157af0]
jmp 0x14000bd2a
movups xmm0, xmmword [0x140157a60]
jmp 0x14000bd2a
mov rcx, 0xffffffffffffffff
lea rdx, str.Microsoft_Reserved_Partition
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000bd23
add rcx, 2
cmp rcx, 0x1d
je 0x14000be39
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000be10
jmp 0x14000bd23
movups xmm0, xmmword [0x140158020]
jmp 0x14000bd2a
lea rcx, str.Unsupported_file_system
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov r12d, dword [rsp + 0x50]
jmp 0x14000be62
xor r15d, r15d
test byte [rbp + 0x990], 4
je 0x14000bfcd
movsxd rax, dword [0x1401e907c]
lea rcx, str.Writing_UEFI:NTFS_data...
imul rdx, rax, 0x58
lea rax, [0x1401e90a8]
add rdx, rax
call fcn.14004f2f0
movsxd rax, dword [0x1401e907c]
xor r9d, r9d
mov r14, qword [rsp + 0x60]
xor r8d, r8d
imul rdx, rax, 0x58
lea rax, [0x140000000]
mov rcx, r14
mov rdx, qword [rdx + rax + 0x1e90f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000bed5
lea rcx, str.__Could_not_set_position
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov rbx, qword [0x1401e87b8]
mov edx, 0x1f6
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14000bf26
call fcn.14004fba0
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f2f0
lea rcx, str.__Could_not_access_source_image
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14000bf68
call fcn.14004fba0
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f2f0
lea rcx, str.__Could_not_access_source_image
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x14000bf97
lea rcx, str.__Could_not_access_source_image
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call fcn.140050980
test eax, eax
jne 0x14000bfc7
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Write_error:__s
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov edi, dword [rsp + 0x40]
jmp 0x14000bfd2
mov r14, qword [rsp + 0x60]
test r12d, r12d
je 0x14000c02e
cmp r12d, 1
jne 0x14000c059
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x68], r12d
call qword [sym.imp.ole32.dll_CoCreateGuid]
imul ecx, dword [0x1401e9090], 0x22
mov rax, qword [0x1401e9080]
movups xmm0, xmmword [rsp + 0x6c]
mov dword [rsp + 0x7c], 0x10
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x48], rcx
imul ecx, dword [0x1401e9090], 0x43
mov dword [rbp - 0x5c], edi
mov dword [rbp - 0x38], 0x10
movups xmmword [rbp - 0x58], xmm0
sub rax, rcx
mov qword [rbp - 0x40], rax
jmp 0x14000c059
cmp dword [rsp + 0x5c], 0
mov dword [rsp + 0x68], r15d
je 0x14000c041
mov eax, 0x49464555
jmp 0x14000c047
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rsp + 0x6c], eax
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x5c], 4
mov dword [rbp - 0x58], eax
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r15
mov r9d, 0x18
mov dword [rsp + 0x28], r15d
mov edx, 0x7c058
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000c0a5
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_reset_disk:__s
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov edx, 0x70140
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000c0e5
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f2f0
cmp r12d, 1
jne 0x14000c0f6
lea eax, [rdi + rdi*8]
shl eax, 4
add eax, 0x30
jmp 0x14000c0fb
mov eax, 0x930
mov qword [rsp + 0x38], r15
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r15
mov r9d, eax
mov dword [rsp + 0x28], r15d
mov edx, 0x7c054
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000c140
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_set_drive_layout:__s
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov edx, 0x70140
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000c184
call fcn.14004fba0
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f2f0
xor eax, eax
jmp 0x14000c189
mov eax, 1
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0xa40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret