Function at 0x14001b174
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, r8
mov r14, rdx
mov r15, rcx
lea rdx, [rax - 0x38]
xorps xmm0, xmm0
mov rcx, rbp
xor r9d, r9d
xor r8d, r8d
xor ebx, ebx
xor esi, esi
movups xmmword [rax - 0x28], xmm0
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x14001b20a
mov ebx, 0x80070003
lea rdi, str.WimMoveFile
mov r9d, ebx
mov rcx, rdi
mov r8d, 0x525
call fcn.1400064e0
mov dword [rsp + 0x30], 0x526
lea r9, str.Converting_to_NT_filename_failed
mov qword [rsp + 0x28], rdi
lea ecx, [rsi + 1]
mov r8, rbp
mov dword [rsp + 0x20], ebx
mov rdx, r15
call fcn.14000b4d0
jmp 0x14001b3ea
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
mov edx, 0x1f0000
mov rcx, r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
mov r13d, 0x80070000
cmp rax, 0xffffffffffffffff
jne 0x14001b2a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001b27f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x14001b284
mov ebx, 0x80004005
test ebx, ebx
jns 0x14001b2a2
mov r9d, ebx
lea rcx, str.WimMoveFile
mov r8d, 0x536
call fcn.1400064e0
jmp 0x14001b3ea
movzx edi, word [rsp + 0x40]
add rdi, 0x18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14001b381
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
and qword [rsi + 8], 0
lea rcx, [rsi + 0x14]
mov byte [rsi], 1
movzx eax, word [rsp + 0x40]
mov dword [rsi + 0x10], eax
movzx r8d, word [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call sub.msvcrt.dll_memcpy
mov r9d, edi
mov dword [rsp + 0x20], 0xa
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14001b3d5
mov ebx, eax
lea rdi, str.WimMoveFile
or ebx, 0x10000000
jge 0x14001b357
mov r9d, ebx
mov r8d, 0x551
mov rcx, rdi
call fcn.1400064e0
mov dword [rsp + 0x30], 0x552
lea r9, str.Could_not_move_source_file
mov qword [rsp + 0x28], rdi
mov r8, r14
mov rdx, r15
mov dword [rsp + 0x20], ebx
mov ecx, 1
call fcn.14000b4d0
jmp 0x14001b3d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001b3b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x14001b3bc
mov ebx, 0x80004005
test ebx, ebx
jns 0x14001b3d5
mov r9d, ebx
lea rcx, str.WimMoveFile
mov r8d, 0x558
call fcn.1400064e0
cmp rbp, 0xffffffffffffffff
je 0x14001b3ea
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp qword [rsp + 0x48], 0
je 0x14001b412
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test rsi, rsi
je 0x14001b437
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret