Function at 0x14000a960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x978]
sub rsp, 0xa50
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x8e0], rax
movsxd r14, dword [0x1401e8700]
lea rax, [0x1401573d8]
mov qword [rbp - 0x70], rax
xor r13d, r13d
mov qword [rsp + 0x68], rcx
lea rax, [0x1401573dc]
mov ecx, dword [0x1401e9110]
xorps xmm0, xmm0
mov esi, ecx
mov qword [rbp - 0x68], rax
shl ecx, 7
lea rax, [0x1401573e0]
mov qword [rbp - 0x60], rax
xor edx, edx
mov eax, dword [0x1401e910c]
mov ebx, r13d
mov dword [rsp + 0x5c], r8d
mov edi, r13d
mov dword [rsp + 0x48], ecx
mov r8d, 0x930
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x60], r9d
imul rsi, rax
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x70], 2
call fcn.140136960
mov rcx, qword [0x1401e8848]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401e8848]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x150
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp + r14*8 - 0x70]
mov r9d, 0xca6
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov edx, 1
mov r15, rax
mov ecx, edx
call fcn.140020c90
test r15, r15
mov eax, 0x200
cmove r15, rax
cmp r14d, 2
je 0x14000b9fe
test byte [rbp + 0x9a0], 4
je 0x14000ab5f
mov rdi, qword [0x1401e8838]
lea edx, [rax - 0xa]
mov rcx, rdi
lea r8d, [r13 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
test rax, rax
jne 0x14000aae7
call fcn.140050120
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
jmp 0x14000ab32
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
test rax, rax
jne 0x14000ab18
call fcn.140050120
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
jmp 0x14000ab32
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
test r13, r13
mov r13d, 0
cmove ebx, r13d
test rbx, rbx
jne 0x14000ab57
lea rcx, str.Could_not_access_embedded_uefi_ntfs.img
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov r14d, dword [rsp + 0x44]
mov edi, r13d
xorps xmm0, xmm0
lea rcx, [0x1401e9128]
xor edx, edx
mov r8d, 0x580
movups xmmword [0x1401e90f0], xmm0
call fcn.140136960
cmp r14d, 1
je 0x14000abaf
mov rcx, qword [0x1401e8a68]
mov edx, 0x3fc
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x14000abaf
lea rax, [rsi - 1]
add rax, r15
cqo
idiv r15
imul rax, r15
add rax, rax
jmp 0x14000abb4
mov eax, 0x100000
cmp dword [0x1401e9118], 0xc
mov qword [0x1401e9170], rax
je 0x14000abd4
cmp dword [0x1401d048c], 0x3a98
jbe 0x14000acf3
movzx r10d, byte [rbp + 0x9a0]
test r10b, 2
je 0x14000acfb
cmp r14d, 1
je 0x14000ac0c
mov r8d, 0x907
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fc264
mov rax, qword [0x1401e9170]
mov ecx, dword [0x1401e9110]
lea r10, [rax + 0x10400000]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r9d, word [0x1401574a8]
xor edx, edx
movups xmm3, xmmword [0x140157490]
lea r8, [rsi - 1]
mov dword [0x1401e90f4], r13d
movsd xmm4, qword [0x1401574a0]
add r8, r10
mov rax, r8
movsd qword [0x1401e9148], xmm4
div rsi
mov rax, r15
mov word [0x1401e9150], r9w
sub r8, rdx
mov qword [0x1401e9178], 0x10400000
cqo
mov qword [0x1401e91c8], r8
idiv rcx
movups xmmword [0x1401e9128], xmm2
movups xmmword [0x1401e9138], xmm3
test rdx, rdx
jne 0x14000ac9d
mov rax, r8
div r15
sub r8, rdx
mov qword [0x1401e91c8], r8
cmp r8, r10
jae 0x14000acd9
mov r8d, 0x910
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_pi__1_.Offset___SelectedDrive.Partition_pi_.Offset__SelectedDrive.Partition_pi_.Size
call fcn.1400fc264
movzx r9d, word [0x1401574a8]
movsd xmm4, qword [0x1401574a0]
movups xmm3, xmmword [0x140157490]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x9a0]
mov edi, 1
and r10b, 0xfd
mov byte [rbp + 0x9a0], r10b
jmp 0x14000ad19
movzx r10d, byte [rbp + 0x9a0]
movzx r9d, word [0x1401574a8]
movsd xmm4, qword [0x1401574a0]
movups xmm3, xmmword [0x140157490]
movups xmm2, xmmword [str.EFI_System_Partition]
lea r8, [0x140000000]
test r10b, 1
je 0x14000ae7d
cmp r14d, 1
je 0x14000ad6e
mov r8d, 0x918
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fc264
movzx r9d, word [0x1401574a8]
lea r8, [0x140000000]
movsd xmm4, qword [0x1401574a0]
movups xmm3, xmmword [0x140157490]
movups xmm2, xmmword [str.EFI_System_Partition]
movups xmm0, xmmword [str.Microsoft_Reserved_Partition]
mov eax, edi
xor edx, edx
movups xmm1, xmmword [0x1401575a0]
imul rcx, rax, 0x58
movzx eax, word [0x1401575c8]
mov r11, qword [rcx + r8 + 0x1e9170]
movups xmmword [rcx + r8 + 0x1e9128], xmm0
mov qword [rcx + r8 + 0x1e9178], 0x8000000
add r11, 0x8000000
movups xmm0, xmmword [0x1401575b0]
inc edi
movups xmmword [rcx + r8 + 0x1e9138], xmm1
movups xmmword [rcx + r8 + 0x1e9148], xmm0
movsd xmm0, qword [0x1401575c0]
movsd qword [rcx + r8 + 0x1e9158], xmm0
mov word [rcx + r8 + 0x1e9160], ax
lea r8, [rsi - 1]
add r8, r11
mov eax, edi
imul r10, rax, 0x58
lea rax, [0x1401e9170]
add r10, rax
mov rax, r8
div rsi
mov rax, r15
sub r8, rdx
cqo
mov qword [r10], r8
mov ecx, dword [0x1401e9110]
idiv rcx
test rdx, rdx
jne 0x14000ae27
mov rax, r8
div r15
sub r8, rdx
mov qword [r10], r8
cmp r8, r11
jae 0x14000ae63
mov r8d, 0x91f
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_pi__1_.Offset___SelectedDrive.Partition_pi_.Offset__SelectedDrive.Partition_pi_.Size
call fcn.1400fc264
movzx r9d, word [0x1401574a8]
movsd xmm4, qword [0x1401574a0]
movups xmm3, xmmword [0x140157490]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x9a0]
lea r8, [0x140000000]
and r10b, 0xfe
mov byte [rbp + 0x9a0], r10b
mov r11d, edi
lea rax, str.EFI_System_Partition
mov dword [0x1401e90f0], edi
lea rcx, str.Main_Data_Partition
inc edi
mov dword [rsp + 0x58], r11d
cmp dword [0x14019f0cc], 0
lea r13, [r8 + 0x1e9128]
mov dword [rsp + 0x40], edi
cmovne rcx, rax
imul r12, r11, 0x58
add r13, r12
mov rdx, r13
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000aec0
test r10b, r10b
je 0x14000b0a7
test r10b, 0x10
je 0x14000afa8
mov rcx, qword [0x14019f098]
test rcx, rcx
jne 0x14000af3a
mov r8d, 0x92e
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.persistence_size___0
call fcn.1400fc264
movzx r9d, word [0x1401574a8]
movsd xmm4, qword [0x1401574a0]
movups xmm3, xmmword [0x140157490]
mov rcx, qword [0x14019f098]
movups xmm2, xmmword [str.EFI_System_Partition]
movzx r10d, byte [rbp + 0x9a0]
mov r11d, dword [rsp + 0x58]
movups xmm0, xmmword [str.Linux_Persistence]
mov eax, edi
lea rdx, [0x140000000]
movups xmm1, xmmword [0x140157638]
dec rcx
mov dword [0x1401e90f8], edi
imul r8, rax, 0x58
mov eax, dword [0x140157648]
add rcx, rsi
movups xmmword [r8 + rdx + 0x1e9128], xmm0
movups xmmword [r8 + rdx + 0x1e9138], xmm1
mov dword [r8 + rdx + 0x1e9148], eax
xor edx, edx
mov rax, rcx
div rsi
lea rax, [0x140000000]
sub rcx, rdx
inc edi
mov qword [r8 + rax + 0x1e9178], rcx
mov dword [rsp + 0x40], edi
lea r8, [0x140000000]
test r10b, 2
je 0x14000affc
mov eax, edi
imul rcx, rax, 0x58
lea rax, [rsi + 0x103fffff]
mov dword [0x1401e90f4], edi
cqo
idiv rsi
movups xmmword [rcx + r8 + 0x1e9128], xmm2
movups xmmword [rcx + r8 + 0x1e9138], xmm3
imul rax, rsi
movsd qword [rcx + r8 + 0x1e9148], xmm4
mov word [rcx + r8 + 0x1e9150], r9w
mov qword [rcx + r8 + 0x1e9178], rax
jmp 0x14000b0a1
test r10b, 4
je 0x14000b04f
movups xmm0, xmmword [0x140157040]
mov eax, edi
lea r9, [0x140000000]
imul r8, rax, 0x58
mov eax, dword [0x140157050]
lea rcx, [rsi - 1]
add rcx, rbx
mov dword [0x1401e90fc], edi
xor edx, edx
movups xmmword [r8 + r9 + 0x1e9128], xmm0
mov dword [r8 + r9 + 0x1e9138], eax
mov rax, rcx
div rsi
sub rcx, rdx
mov qword [r8 + r9 + 0x1e9178], rcx
jmp 0x14000b0a1
test r10b, 8
je 0x14000b0a7
movups xmm0, xmmword [str.BIOS_Compatibility]
mov eax, edi
movups xmm1, xmmword [0x140157660]
imul rcx, rax, 0x58
mov eax, dword [0x140157670]
movups xmmword [rcx + r8 + 0x1e9128], xmm0
mov qword [rcx + r8 + 0x1e9178], rsi
movups xmmword [rcx + r8 + 0x1e9138], xmm1
mov dword [rcx + r8 + 0x1e9148], eax
movzx eax, word [0x140157674]
mov word [rcx + r8 + 0x1e914c], ax
inc edi
mov dword [rsp + 0x40], edi
cmp edi, 0x10
jbe 0x14000b0cc
mov r8d, 0x940
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.pi___MAX_PARTITIONS
call fcn.1400fc264
xor eax, eax
jmp 0x14000ba03
mov rbx, qword [0x1401e9100]
cmp r14d, 1
jne 0x14000b0e6
mov eax, dword [0x1401e9110]
imul rcx, rax, 0x21
sub rbx, rcx
lea ecx, [rdi - 1]
lea rdx, [0x1401e9178]
cmp ecx, r11d
jbe 0x14000b142
mov eax, ecx
imul rdi, rax, 0x58
add rdi, rdx
sub ecx, r11d
mov r14d, ecx
cmp qword [rdi], rbx
jb 0x14000b122
mov r8d, 0x949
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.SelectedDrive.Partition_i_.Size___last_offset
call fcn.1400fc264
sub rbx, qword [rdi]
xor edx, edx
mov rax, rbx
div rsi
sub rbx, rdx
mov qword [rdi - 8], rbx
sub rdi, 0x58
sub r14, 1
jne 0x14000b104
mov edi, dword [rsp + 0x40]
lea r14, [0x140000000]
cmp rbx, qword [r12 + r14 + 0x1e9170]
ja 0x14000b16c
mov r8d, 0x94f
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.last_offset___SelectedDrive.Partition_mi_.Offset
call fcn.1400fc264
sub rbx, qword [r12 + r14 + 0x1e9170]
xor edx, edx
mov rax, rbx
div rsi
mov rax, r15
sub rbx, rdx
cqo
mov qword [r12 + r14 + 0x1e9178], rbx
mov ecx, dword [0x1401e9110]
idiv rcx
test rdx, rdx
jne 0x14000b1ab
mov rax, rbx
div r15
sub rbx, rdx
mov qword [r12 + r14 + 0x1e9178], rbx
test rbx, rbx
jne 0x14000b1c6
mov rdx, r13
lea rcx, str.Error:_Invalid__S_size
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
xor r15d, r15d
mov r14d, r15d
test edi, edi
je 0x14000b6de
mov esi, dword [rsp + 0x48]
lea r12, [rbp]
movsd xmm9, qword [0x140176f70]
lea r13, [0x1401e9178]
movsd xmm8, qword [0x140176ef8]
movsd xmm10, qword [0x140176f50]
movsd xmm11, qword [0x140176f20]
mov qword [rbp - 0x78], rsi
mov rcx, qword [r13]
lea r10, [0x1401e2e80]
lea rdi, [0x14015644e]
xorps xmm7, xmm7
test rcx, rcx
js 0x14000b22c
cvtsi2sd xmm7, rcx
jmp 0x14000b241
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm7, rax
addsd xmm7, xmm7
mov rbx, r15
comisd xmm9, xmm7
ja 0x14000b259
inc rbx
mulsd xmm7, xmm8
cmp rbx, 5
jl 0x14000b244
test rbx, rbx
jne 0x14000b29b
mov rax, qword [0x140196210]
lea r9, str._s_d_s__s
mov qword [rsp + 0x38], rax
lea edx, [rbx + 0x20]
cvttsd2si ecx, xmm7
mov qword [rsp + 0x30], rdi
lea r8, [rbx - 1]
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov qword [rsp + 0x20], rdi
call fcn.140004960
lea rbx, [0x1401e2e80]
jmp 0x14000b307
movaps xmm6, xmm7
movaps xmm0, xmm7
mulsd xmm6, xmm10
call fcn.140135fe0
mulsd xmm0, xmm10
lea rax, str._s_0.0f_s__s
mov edx, 0x20
lea r9, str._s_0.1f_s__s
subsd xmm6, xmm0
lea r8, [rdx - 0x21]
comisd xmm11, xmm6
cmova r9, rax
lea rax, [0x140000000]
mov rax, qword [rax + rbx*8 + 0x196210]
lea rbx, [0x1401e2e80]
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], rdi
movsd qword [rsp + 0x28], xmm7
mov qword [rsp + 0x20], rdi
call fcn.140004960
lea rcx, [0x140000000]
mov r15d, r14d
lea rdi, [rcx + 0x1e9128]
mov byte [0x1401e2e9f], 0
imul rax, r15, 0x58
lea rdx, str.Partition
add rdi, rax
mov rcx, rdi
call fcn.1400b33c8
mov r9, qword [r13 - 8]
lea r8, [0x14015644e]
test rax, rax
mov qword [rsp + 0x20], rbx
lea rax, str._Partition
mov rdx, rdi
cmove r8, rax
lea rcx, str._Creating__S_s__offset:__lld__size:__s_
call fcn.14004f910
mov rax, qword [r13]
mov edx, 1
mov ecx, dword [rsp + 0x48]
cmp rsi, rax
mov rbx, qword [r13 - 8]
cmovae ecx, eax
mov dword [rsp + 0x50], ecx
call fcn.1400c537c
mov rsi, rax
test rax, rax
je 0x14000b3d2
mov rdx, rbx
xor r9d, r9d
mov rbx, qword [rsp + 0x68]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000b3af
mov rcx, rsi
call fcn.1400e9080
jmp 0x14000b3d2
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
call fcn.140050f30
mov rcx, rsi
mov ebx, eax
call fcn.1400e9080
test ebx, ebx
jne 0x14000b3e9
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_zero__S:__s
mov rdx, rdi
call fcn.14004f910
mov rax, qword [r13 - 8]
lea esi, [r14 + 1]
mov ecx, dword [rsp + 0x44]
mov qword [r12 - 0x18], rax
mov rax, qword [r13]
mov qword [r12 - 0x10], rax
mov dword [r12 - 0x20], ecx
mov dword [r12 - 8], esi
mov byte [r12 - 4], 1
test ecx, ecx
jne 0x14000b553
cmp r14d, dword [rsp + 0x58]
jne 0x14000b46b
cmp dword [0x1401e8a60], ecx
setne al
mov byte [r12 + 1], al
movsxd rax, dword [rsp + 0x5c]
cmp eax, 8
ja case.default.0x14000b44f
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xba54]
add rcx, rdx
jmp rcx
mov byte [r12], 0xe
jmp 0x14000b46b
mov byte [r12], 7
jmp 0x14000b46b
mov byte [r12], 0x83
jmp 0x14000b46b
mov byte [r12], 0xc
mov rcx, 0xffffffffffffffff
lea rdx, str.EFI_System_Partition
nop dword [rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b4a0
add rcx, 2
cmp rcx, 0x15
je 0x14000b4d0
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000b480
xor ecx, ecx
lea rdx, [0x140157040]
nop dword [rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000b4da
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b4da
add rcx, 2
cmp rcx, 0xa
jne 0x14000b4b0
mov byte [r12], 0xef
jmp 0x14000b6a0
xor ecx, ecx
lea rdx, str.Linux_Persistence
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000b50d
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b50d
add rcx, 2
cmp rcx, 0x12
jne 0x14000b4e3
mov byte [r12], 0x83
jmp 0x14000b6a0
mov rcx, 0xffffffffffffffff
lea rdx, str.BIOS_Compatibility
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b6a0
add rcx, 2
cmp rcx, 0x13
je 0x14000b549
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000b520
jmp 0x14000b6a0
mov byte [r12], 0xea
jmp 0x14000b6a0
cmp ecx, 1
je 0x14000b571
mov r8d, 0x990
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
call fcn.1400fc264
xor ecx, ecx
lea rdx, [0x140157040]
nop word [rax + rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000b5bb
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b5bb
add rcx, 2
cmp rcx, 0xa
jne 0x14000b580
movups xmm0, xmmword [0x1401579e0]
movabs rax, 0x9000000000000000
mov qword [r12 + 0x20], rax
jmp 0x14000b667
mov rcx, 0xffffffffffffffff
lea rdx, str.EFI_System_Partition
nop dword [rax]
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b5f0
add rcx, 2
cmp rcx, 0x15
je 0x14000b629
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000b5d0
xor ecx, ecx
lea rdx, str.Linux_Persistence
nop dword [rax]
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x14000b632
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b632
add rcx, 2
cmp rcx, 0x12
jne 0x14000b600
movups xmm0, xmmword [0x140157a70]
jmp 0x14000b667
movups xmm0, xmmword [0x1401579e0]
jmp 0x14000b667
mov rcx, 0xffffffffffffffff
lea rdx, str.Microsoft_Reserved_Partition
movzx eax, word [rdi + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x14000b660
add rcx, 2
cmp rcx, 0x1d
je 0x14000b6c2
movzx eax, word [rdi + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x14000b640
movups xmm0, xmmword [0x140157fb0]
lea rbx, [r15 + r15*8]
shl rbx, 4
lea rcx, [rbp + 0x10]
add rcx, rbx
movups xmmword [r12], xmm0
call qword [sym.imp.ole32.dll_CoCreateGuid]
lea rcx, [rbp + 0x28]
sub rbx, rdi
add rcx, rbx
nop dword [rax + rax]
movzx eax, word [rdi]
mov word [rdi + rcx], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x14000b690
mov edi, dword [rsp + 0x40]
add r13, 0x58
add r12, 0x90
xor r15d, r15d
mov r14d, esi
cmp esi, edi
jae 0x14000b6de
mov rsi, qword [rbp - 0x78]
jmp 0x14000b20b
movups xmm0, xmmword [0x140157fa0]
jmp 0x14000b667
lea rcx, str.Unsupported_file_system
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
test byte [rbp + 0x9a0], 4
je 0x14000b849
movsxd rax, dword [0x1401e90fc]
lea rcx, str.Writing_UEFI:NTFS_data...
imul rdx, rax, 0x58
lea rax, [0x1401e9128]
add rdx, rax
call fcn.14004f910
movsxd rax, dword [0x1401e90fc]
xor r9d, r9d
mov r14, qword [rsp + 0x68]
xor r8d, r8d
imul rdx, rax, 0x58
lea rax, [0x140000000]
mov rcx, r14
mov rdx, qword [rdx + rax + 0x1e9170]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000b751
lea rcx, str.__Could_not_set_position
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov rbx, qword [0x1401e8838]
mov edx, 0x1f6
mov rcx, rbx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14000b7a2
call fcn.140050120
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_locate_resource__s:__s
call fcn.14004f910
lea rcx, str.__Could_not_access_source_image
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x14000b7e4
call fcn.140050120
mov r8, rax
lea rdx, str.uefi_ntfs.img
lea rcx, str.Could_not_load_resource__s:__s
call fcn.14004f910
lea rcx, str.__Could_not_access_source_image
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x14000b813
lea rcx, str.__Could_not_access_source_image
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call fcn.140050f30
test eax, eax
jne 0x14000b843
call fcn.140050120
mov rdx, rax
lea rcx, str.__Write_error:__s
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov edi, dword [rsp + 0x40]
jmp 0x14000b84e
mov r14, qword [rsp + 0x68]
mov ebx, dword [rsp + 0x44]
test ebx, ebx
je 0x14000b8a9
cmp ebx, 1
jne 0x14000b8d4
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ole32.dll_CoCreateGuid]
imul ecx, dword [0x1401e9110], 0x22
mov rax, qword [0x1401e9100]
movups xmm0, xmmword [rsp + 0x74]
mov dword [rbp - 0x7c], 0x10
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x38], rcx
imul ecx, dword [0x1401e9110], 0x43
mov dword [rbp - 0x4c], edi
mov dword [rbp - 0x28], 0x10
movups xmmword [rbp - 0x48], xmm0
sub rax, rcx
mov qword [rbp - 0x30], rax
jmp 0x14000b8d4
cmp dword [rsp + 0x60], 0
mov dword [rsp + 0x70], r15d
je 0x14000b8bc
mov eax, 0x49464555
jmp 0x14000b8c2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rsp + 0x74], eax
mov dword [rbp - 0x50], r15d
mov dword [rbp - 0x4c], 4
mov dword [rbp - 0x48], eax
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, 0x18
mov dword [rsp + 0x28], r15d
mov edx, 0x7c058
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000b920
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_reset_disk:__s
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov edx, 0x70140
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000b960
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f910
cmp ebx, 1
jne 0x14000b970
lea eax, [rdi + rdi*8]
shl eax, 4
add eax, 0x30
jmp 0x14000b975
mov eax, 0x930
mov qword [rsp + 0x38], r15
lea r8, [rbp - 0x50]
mov qword [rsp + 0x30], r15
mov r9d, eax
mov dword [rsp + 0x28], r15d
mov edx, 0x7c054
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000b9ba
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_set_drive_layout:__s
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov edx, 0x70140
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000b9fe
call fcn.140050120
mov rdx, rax
lea rcx, str.Could_not_refresh_drive_layout:__s
call fcn.14004f910
xor eax, eax
jmp 0x14000ba03
mov eax, 1
mov rcx, qword [rbp + 0x8e0]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret