Function at 0x14004f084
Capabilities:
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xc8
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 1], rax
mov r15d, dword [rbp + 0x7f]
mov r13, rdx
mov qword [rbp - 0x59], r9
mov rdi, rcx
xor r9d, r9d
mov qword [rbp - 0x49], r8
bt r15d, 0x18
jb 0x14004f110
mov ecx, dword [rbp + 0x77]
mov r10d, 0x9000000
and ecx, 0x10000000
mov eax, ecx
or eax, r10d
or r15d, eax
test rdi, rdi
je 0x14004f110
mov rdx, qword [rdi + 0x48]
mov rax, rdi
test rdx, rdx
cmovne rax, rdx
or ecx, r10d
mov r8d, dword [rax + 0x24]
mov rax, rdi
or r8d, ecx
jmp 0x14004f107
mov rax, rdx
mov rdx, qword [rdx + 0x48]
test rdx, rdx
jne 0x14004f100
mov dword [rax + 0x24], r8d
test r15b, 8
je 0x14004f14c
mov r8d, 0xfffffff7
and r15d, r8d
test rdi, rdi
je 0x14004f14c
mov rcx, qword [rdi + 0x48]
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
mov edx, dword [rax + 0x24]
mov rax, rdi
and edx, r8d
jmp 0x14004f144
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
jne 0x14004f13d
mov dword [rax + 0x24], edx
mov rcx, rdi
call fcn.14002e5e4
mov qword [rbp - 0x51], rax
test rax, rax
jne 0x14004f186
mov qword [rsp + 0x20], r9
lea r8d, [rax + 0x4a]
mov ebx, 0x8007000d
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_sparserestore.c
mov r9d, ebx
lea rcx, str.WIMMountExtractDirToHandle
call fcn.140046874
jmp 0x14004f7ec
or qword [rbp - 0x61], 0xffffffffffffffff
mov qword [rbp - 0x71], r9
mov qword [rbp - 0x79], r9
mov qword [rbp - 0x69], r9
test rdi, rdi
je 0x14004f1b0
cmp qword [rdi + 0x48], r9
mov rax, rdi
cmovne rax, qword [rdi + 0x48]
mov rax, qword [rax + 0x28]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x71]
mov rdx, r13
call fcn.1400444a0
mov r12, qword [rbp - 0x71]
lea r14, str.onecore_base_ntsetupopktoolsosimagelibmain_sparserestore.c
xor ecx, ecx
lea rsi, str.WIMMountExtractDirToHandle
mov ebx, eax
test eax, eax
jns 0x14004f1e7
mov qword [rsp + 0x20], rcx
lea r8d, [rcx + 0x58]
mov r9d, eax
jmp 0x14004f699
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], cx
jne 0x14004f1eb
movsd xmm0, qword [str..TMP]
movzx ecx, word [0x1400a6890]
mov eax, eax
add rax, rax
movsd qword [rbp - 0x41], xmm0
mov word [rbp - 0x71], cx
mov qword [rbp - 0x31], rax
lea rbx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14004f271
mov rbx, qword [rbp - 0x31]
mov rdx, r12
mov r8, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x79]
movsd xmm0, qword [rbp - 0x41]
movzx ecx, word [rbp - 0x71]
movsd qword [rbx + rax], xmm0
mov word [rbx + rax + 8], cx
jmp 0x14004f2b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14004f685
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14004f68a
mov rdx, qword [r13 + 0x18]
xor r9d, r9d
mov r8, r12
mov rcx, rdi
call fcn.140016d20
mov ebx, eax
test eax, eax
jns 0x14004f315
and qword [rsp + 0x20], 0
mov r9d, eax
mov r8d, 0x73
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov dword [rsp + 0x30], 0x77
mov r8, qword [r13 + 0x28]
lea r9, str.Failed_to_create_temp_dir
mov qword [rsp + 0x28], rsi
mov rdx, rdi
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.14002aaa0
jmp 0x14004f6a4
mov rax, qword [rbp - 0x69]
mov rdx, r12
mov r9, qword [rbp - 0x49]
mov rcx, rdi
mov r8, qword [r13 + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x51]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.140016f80
mov ebx, eax
test eax, eax
js 0x14004f6a4
mov rax, qword [rbp - 0x69]
mov rdx, r12
mov r9, qword [rbp - 0x49]
mov rcx, rdi
mov r8, qword [r13 + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x51]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.1400180f8
mov ebx, eax
test eax, eax
js 0x14004f6a4
mov rdx, qword [r13 + 0x18]
lea r9, [rbp - 0x61]
mov r8, r12
mov rcx, rdi
call fcn.140016d20
mov ebx, eax
xor eax, eax
test ebx, ebx
jns 0x14004f3be
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, 0x9a
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov dword [rsp + 0x30], 0x9e
jmp 0x14004f2ef
mov r15, rax
mov dword [rbp - 0x71], 0x10000
test r15, r15
je 0x14004f3ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x71]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14004f4b1
lea rax, [rbp - 0x71]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, r15
mov rax, qword [rbp - 0x59]
mov edx, 0x1f
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtQuerySecurityObject]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14004f3c8
xor eax, eax
test ebx, ebx
jns 0x14004f466
or ebx, 0x10000000
jge 0x14004f466
mov r8d, 0xc4
jmp 0x14004f4be
mov rdx, qword [rbp - 0x61]
mov r9, r15
mov r8, r12
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.14004a22c
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x14004f4fc
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov rdx, r14
mov r8d, 0xd0
mov rcx, rsi
call fcn.140046874
lea r9, str.Failed_to_set_SD
mov dword [rsp + 0x30], 0xd4
mov r8, r12
jmp 0x14004f4e4
mov ebx, 0x8007000e
mov r8d, 0xb7
xor eax, eax
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov r8, qword [r13 + 0x28]
lea r9, str.Failed_to_query_SD
mov dword [rsp + 0x30], 0xc9
mov qword [rsp + 0x28], rsi
mov rdx, rdi
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.14002aaa0
xor edx, edx
test r15, r15
je 0x14004f523
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor edx, edx
test ebx, ebx
js 0x14004f6a4
mov rcx, qword [r13 + 0x18]
xor r8d, r8d
mov r9, qword [r13 + 0x28]
mov dword [rsp + 0x30], edx
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x59]
mov rdx, qword [rax]
call fcn.140037764
mov r15, rax
test rax, rax
jne 0x14004f5f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14004f5a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004f5c3
jmp 0x14004f5a9
mov ebx, 0x80004005
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0xea
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov r8, qword [r13 + 0x28]
lea r9, str.Failed_to_query_metadata
mov dword [rsp + 0x30], 0xec
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.14002aaa0
test ebx, ebx
js 0x14004f6a4
lea r9, [rbp - 0x61]
mov dword [rsp + 0x20], 0xffffffdf
mov r8, r15
mov rdx, r12
mov rcx, rdi
call fcn.14004cedc
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x14004f62f
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov rdx, r14
mov r8d, 0xf3
mov rcx, rsi
call fcn.140046874
test r15, r15
je 0x14004f63c
mov rcx, r15
call fcn.140036ec0
test ebx, ebx
js 0x14004f6a4
mov r15, qword [rbp - 0x79]
lea r9, [rbp - 0x61]
mov rdx, qword [rbp - 0x59]
mov r8, r12
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140043058
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x14004f67f
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov rdx, r14
mov r8d, 0xfe
mov rcx, rsi
call fcn.140046874
jmp 0x14004f6a8
mov qword [r13 + 0x60], rdx
jmp 0x14004f6a8
mov ebx, 0x80004005
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8d, 0x6d
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov r15, qword [rbp - 0x79]
mov rcx, qword [rbp - 0x61]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004f6c2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r12, r12
je 0x14004f6e7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r15, r15
je 0x14004f70c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebx, ebx
js 0x14004f7ec
mov r12, qword [rbp - 0x59]
mov rcx, qword [r12]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004f7ec
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rbp - 9], rax
lea r8, [rbp - 0x29]
mov byte [rbp - 0x71], al
lea rdx, [rbp - 0x41]
mov dword [rbp - 9], 0x80
lea r9d, [rax + 0x28]
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 0x41], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
js 0x14004f7a1
mov rcx, qword [r12]
lea r8, [rbp - 0x71]
mov r9d, 1
mov byte [rbp - 0x71], 1
lea rdx, [rbp - 0x41]
mov dword [rsp + 0x20], FDICreate
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
jns 0x14004f7ec
and qword [rsp + 0x20], 0
mov ebx, r15d
bts ebx, 0x1c
mov r8d, 0x14b
mov r9d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.140046874
mov r8, qword [r13 + 0x28]
lea r9, str.WimExchangeFiles:_Delete_failed
mov dword [rsp + 0x30], 0x14c
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov ecx, 1
mov dword [rsp + 0x20], r15d
call fcn.14002aaa0
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140096bd0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret