Function at 0x14000c050
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
xor eax, eax
mov r14d, edx
mov qword [rbp - 0x39], rax
mov r12, rcx
mov qword [rbp + 0xf], rax
mov r13d, eax
mov qword [rbp - 0x59], rax
mov esi, eax
mov qword [rbp - 0x49], rax
lea r9d, [rax + 1]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x61], rax
mov qword [rbp + 7], rax
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x6f], eax
mov qword [rbp - 9], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 1], rax
mov qword [rbp - 0x69], rax
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov dword [rbp + 0x7f], eax
mov dword [rbp - 0x6d], eax
test dl, 0x10
je 0x14000c0e3
mov eax, edx
and al, 0x40
neg al
sbb ecx, ecx
not ecx
and ecx, 3
call fcn.14000f3b0
mov r15d, 0xb
mov r8d, r14d
and r8d, r9d
mov eax, r14d
and eax, 0x800
mov dword [rbp + 0x77], r8d
neg eax
lea r9d, [r15 + 0x63]
mov eax, r14d
sbb edi, edi
and eax, 0x200
and edi, r15d
add edi, r9d
neg eax
mov dword [rsp + 0x48], edi
mov eax, r14d
sbb ebx, ebx
and eax, 0x100
and ebx, r15d
add ebx, r9d
neg eax
mov dword [rsp + 0x40], ebx
mov eax, r14d
sbb r11d, r11d
and al, 0x80
and r11d, r15d
add r11d, r9d
neg al
mov dword [rsp + 0x38], r11d
mov eax, r14d
sbb r10d, r10d
and al, 0x20
and r10d, r15d
add r10d, r9d
neg al
mov dword [rsp + 0x30], r10d
mov eax, r14d
sbb edx, edx
and al, 8
and edx, r15d
add edx, r9d
neg al
mov dword [rsp + 0x28], edx
mov eax, r14d
lea rdx, str.ServiceBootFiles_MuiOnly:_c_Res:_c_Fonts:_c_BootMgrOvw:_c_BootStatOvw:_c_DbgTrn:_c_SuspendBDE:_c_Offline:_c
sbb ecx, ecx
and al, 4
and ecx, r15d
add ecx, r9d
neg al
mov dword [rsp + 0x20], ecx
mov eax, r8d
lea ecx, [r15 - 9]
sbb r9d, r9d
and r9d, r15d
add r9d, 0x6e
neg eax
sbb r8d, r8d
and r8d, r15d
add r8d, 0x6e
call fcn.14000f424
xor eax, eax
lea rdx, [rsp + 0x58]
mov r15d, r14d
mov rcx, r12
and r15d, 0xfffffef3
cmp dword [rbp + 0x77], eax
cmove r15d, r14d
call fcn.14000e100
xor r14d, r14d
test eax, eax
jne 0x14000c1e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r14, rsi
jmp 0x14000d1e6
mov edi, 1
lea r9, [rbp - 9]
mov r8d, edi
lea rcx, section..data
lea ebx, [rdi + 3]
mov edx, ebx
call fcn.14000f7e8
test eax, eax
jne 0x14000c21a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r14, rsi
jmp 0x14000d1dc
mov rcx, qword [rbp - 9]
lea rdx, [rbp - 0x11]
call fcn.14000f5ac
test eax, eax
je 0x14000c204
lea rdx, str.FWTYPE
lea rcx, [rsp + 0x58]
call fcn.1400109f4
mov rcx, rax
lea rdx, [0x14002ff18]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
nop dword [rax + rax]
mov ebx, edi
lea rdx, str.ACLS
test eax, eax
lea rcx, [rsp + 0x58]
cmovne ebx, r14d
mov dword [rbp - 0x71], ebx
call fcn.1400109f4
test rax, rax
lea rdx, str.SOURCEFWTYPEBOOTMGBIN
mov ecx, r14d
cmovne ecx, edi
mov dword [rbp - 0x51], ecx
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov r13, rax
test rax, rax
je 0x14000c204
lea rdx, str.SYSPARTDESTBOOTMGBIN
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x39], rax
mov rdi, rax
test rax, rax
je 0x14000c204
lea rcx, [0x14003ca00]
call fcn.14000c028
test eax, eax
je 0x14000c3a6
test ebx, ebx
je 0x14000c3a6
lea r9, [rbp - 0x6d]
mov rdx, rdi
lea r8, [rbp - 0x29]
mov ecx, r15d
call fcn.140010a50
test eax, eax
je 0x14000c304
mov r8d, eax
lea rdx, str.ShouldUseExFiles_check_failed:__x__defaulting_to_2011_binaries
mov ecx, 4
call fcn.14000f424
jmp 0x14000c308
mov r14d, dword [rbp - 0x6d]
mov dword [rbp + 0x7f], r14d
test r14d, r14d
je 0x14000c34e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
lea rdx, str.SOURCEFWTYPE_EXBOOTMGBINEX
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov r13, rax
test rax, rax
je 0x14000c204
mov rdi, qword [rbp - 0x29]
xor ecx, ecx
test rdi, rdi
je 0x14000c3ac
lea rdx, [rbp - 1]
mov rcx, r13
call fcn.140010ce0
mov ebx, eax
xor eax, eax
test ebx, ebx
jne 0x14000c39e
mov r8, qword [rbp - 1]
mov rax, rdi
sub r8, rdi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000c38b
add rax, 2
test ecx, ecx
jne 0x14000c377
xor ecx, ecx
mov eax, esi
test edx, edx
lea r8d, [rcx + 1]
cmovne eax, r8d
mov dword [rbp + 0x6f], eax
jmp 0x14000c3ac
mov r14, rax
jmp 0x14000d1dc
mov r14d, dword [rbp + 0x7f]
xor ecx, ecx
mov rbx, rcx
lea rdx, str.SOURCERESOURCESBOOTRES.DLL
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rdi, rax
test rax, rax
je 0x14000c410
xor edx, edx
mov rcx, rax
call fcn.1400111a8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x14000c410
mov r8, rbx
lea rdx, str.Using_source_OS_version__I64x
mov ecx, 2
call fcn.14000f424
jmp 0x14000c421
lea rdx, str.Failed_to_determine_source_OS_version.
mov ecx, 3
call fcn.14000f424
mov qword [0x14003f890], rbx
bt r15d, 9
jae 0x14000c4fe
mov rcx, r12
call fcn.140006140
mov qword [rbp + 0x17], rax
mov rbx, rax
test rax, rax
jne 0x14000c471
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, r12
lea rdx, str.Failed_to_get_VolumeName_for__ws__x
mov ebx, eax
mov r9d, eax
mov ecx, 4
call fcn.14000f424
jmp 0x14000c212
mov r8, rbx
lea rdx, str.Source_VolumeName__ws
mov ecx, 2
call fcn.14000f424
lea r9, [rbp - 0x6d]
mov rcx, rbx
lea r8, [rbp - 0x31]
call fcn.1400120f4
xor r12d, r12d
mov ebx, eax
test eax, eax
je 0x14000c4cb
mov ecx, eax
lea rdx, str.BfspSuspendBitLocker_FAILED_Error_code___x
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
lea ecx, [r12 + 4]
cmove ebx, eax
mov r8d, ebx
call fcn.14000f424
jmp 0x14000c212
mov eax, dword [rbp - 0x6d]
lea rdx, str.BfspSuspendBitLocker_SUCCEEDED__Enabled:_c_Suspended:_c_
neg eax
mov ecx, 2
mov eax, dword [rbp - 0x31]
sbb r9d, r9d
and r9d, 0xb
add r9d, 0x6e
neg eax
sbb r8d, r8d
and r8d, 0xb
add r8d, 0x6e
call fcn.14000f424
jmp 0x14000c501
xor r12d, r12d
test r15b, 0x20
je 0x14000c526
mov r12d, 1
lea rdx, str.Boot_manager_to_be_overwritten_by_user_policy.
lea ecx, [r12 + 2]
call fcn.14000f424
mov ebx, dword [rbp + 0x6f]
jmp 0x14000c5f2
mov rcx, r13
cmp dword [rbp - 0x71], r12d
jne 0x14000c5a6
mov ebx, 1
mov edx, ebx
call fcn.140011704
test eax, eax
jne 0x14000c557
mov r9d, 0xc1
lea rdx, str.Failed_to_validate_boot_manager_checksum___s___Error_code___x
mov ebx, r9d
mov r8, r13
jmp 0x14000c462
lea rdx, str.SYSPARTBOOTMGBIN
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x61], rax
mov rdi, rax
test rax, rax
je 0x14000c204
mov edx, ebx
mov rcx, rax
call fcn.140011704
test eax, eax
jne 0x14000c58b
mov r12d, ebx
jmp 0x14000c5a1
test r13, r13
je 0x14000c5a1
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.14000dffc
mov r12d, eax
mov ebx, dword [rbp + 0x6f]
jmp 0x14000c5f5
xor edx, edx
call fcn.140011704
test eax, eax
je 0x14000c53f
mov rdi, qword [rbp - 0x39]
xor edx, edx
mov rcx, rdi
call fcn.140011704
mov ebx, dword [rbp + 0x6f]
test eax, eax
jne 0x14000c5cc
lea r12d, [rax + 1]
jmp 0x14000c5f2
test ebx, ebx
je 0x14000c5dc
mov r12d, 1
or r15d, 8
jmp 0x14000c5f2
test r13, r13
je 0x14000c5f2
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.14000dffc
mov r12d, eax
mov rdi, rsi
lea rdx, str.SOURCEFWTYPE
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x14000c623
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14000d1d7
test r14d, r14d
je 0x14000c647
lea rdx, str.SOURCEFWTYPE_EX
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x69], rax
mov r14, rax
test rax, rax
jne 0x14000c64a
jmp 0x14000c610
mov r14, rax
lea rdx, str.SYSPARTDEST
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x49], rax
test rax, rax
je 0x14000c610
lea rcx, [0x140030380]
mov qword [rsp + 0x20], rax
test r12d, r12d
lea r8, [0x140030388]
mov r9, rsi
lea rdx, str.Copying_boot_files_CopyBootManager__s___s_____s
cmovne r8, rcx
mov ecx, 2
call fcn.14000f424
mov r8, qword [rbp - 0x49]
mov eax, 1
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov ebx, dword [rbp - 0x51]
mov rdx, r14
mov dword [rsp + 0x38], eax
mov rcx, rsi
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
call fcn.14000d528
test eax, eax
jne 0x14000c6f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, qword [rbp - 0x49]
lea rdx, str.Error_copying_boot_files_from__s_to__s__Last_Error___x
mov r8, rsi
mov ecx, 4
mov dword [rsp + 0x20], eax
mov ebx, eax
call fcn.14000f424
jmp 0x14000d1d7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
cmovne rsi, rcx
test r14, r14
je 0x14000c750
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
cmovne r14, rcx
mov qword [rbp - 0x69], r14
cmp dword [rbp - 0x71], ecx
je 0x14000c94c
lea rdx, str.SYSPARTEFIDEFAULTDIR
lea rcx, [rsp + 0x58]
call fcn.1400107a4
lea rdx, str.SYSPARTEFIDEFAULTDIRDEFAULTAPP
mov r14, rax
lea rcx, [rsp + 0x58]
call fcn.1400107a4
xor edi, edi
mov rbx, rax
test r14, r14
je 0x14000c85a
test rax, rax
je 0x14000c85a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000c7b1
test al, 0x50
lea eax, [rdi + 1]
cmove edi, eax
mov r8d, 2
lea rdx, str.bootmgr.exe
mov rcx, rbx
call fcn.14001141c
test edi, edi
je 0x14000c806
xor edi, edi
test eax, eax
jne 0x14000c7dc
lea rdx, str.Default_EFI_application_is_not_Windows_boot_manager__will_not_update.
jmp 0x14000c861
mov ecx, 1
cmp eax, ecx
jne 0x14000c86b
test r13, r13
je 0x14000c7fe
mov r8d, ecx
mov rdx, rbx
mov rcx, r13
call fcn.14000dffc
jmp 0x14000c800
mov eax, edi
test eax, eax
je 0x14000c86b
jmp 0x14000c808
xor edi, edi
mov rcx, r14
call fcn.140014790
test eax, eax
jne 0x14000c836
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, str.Failed_to_create_path_for_default_EFI_application._Last_error___x
mov r8d, eax
mov ecx, 3
call fcn.14000f424
jmp 0x14000c86b
mov rdx, rbx
mov rcx, r13
call fcn.14000dc98
test eax, eax
jne 0x14000c86b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, str.Failed_to_copy_Boot_Manager_to_default_EFI_application._Last_error___x
jmp 0x14000c827
lea rdx, str.Failed_to_expand_default_EFI_application_location.
mov ecx, 3
call fcn.14000f424
test r14, r14
je 0x14000c890
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x14000c8b5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
lea rdx, str.Creating_Recovery_directory.
mov ecx, 2
call fcn.14000f424
lea rdx, str.SYSPARTEFIMicrosoftRecovery
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rbx, rax
test rax, rax
je 0x14000c90d
mov rcx, rax
call fcn.140014790
test eax, eax
jne 0x14000c91e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, str.Failed_to_create_Recovery_directory._Last_error___x
mov ecx, 3
mov r8d, eax
call fcn.14000f424
jmp 0x14000c91e
lea rdx, str.Failed_to_expand_Recovery_directory_path
mov ecx, 3
call fcn.14000f424
test rbx, rbx
je 0x14000c943
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r14, qword [rbp - 0x69]
jmp 0x14000caac
cmp dword [rbp + 0x77], ecx
jne 0x14000caaa
test ebx, ebx
je 0x14000c9a9
test rdi, rdi
jne 0x14000c97f
lea rdx, str.SYSPARTBOOTMGBIN
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x61], rax
mov rdi, rax
test rax, rax
je 0x14000c610
lea r8, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
xor edx, edx
mov rcx, rdi
call fcn.14000f930
test eax, eax
jne 0x14000c9a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000c610
test r12d, r12d
je 0x14000c9c1
mov rdx, rdi
mov rcx, r13
call fcn.14000dc98
test eax, eax
je 0x14000c610
mov rcx, rdi
call fcn.1400143b0
test eax, eax
jne 0x14000ca12
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 5
je 0x14000c9ee
add eax, 0xffffffe0
mov r8d, 1
cmp eax, r8d
ja 0x14000c9f6
mov rcx, rdi
call fcn.140005634
lea rdx, str.Error_uncompressing_boor_manager___s___Last_Error___x
mov r8, rdi
mov r9d, ebx
mov ecx, 4
call fcn.14000f424
jmp 0x14000d1d7
mov edx, 7
mov rcx, rdi
call fcn.14000e660
test eax, eax
je 0x14000c610
test ebx, ebx
je 0x14000ca65
lea r8, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
mov edx, 1
mov rcx, rdi
call fcn.14000f930
test eax, eax
je 0x14000c610
mov rdi, qword [rbp - 0x39]
lea r8, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
mov rcx, rdi
xor edx, edx
call fcn.14000f930
test eax, eax
jne 0x14000ca69
jmp 0x14000c610
mov rdi, qword [rbp - 0x39]
mov rcx, rdi
call fcn.140013d5c
test eax, eax
jne 0x14000caaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 5
je 0x14000ca96
add eax, 0xffffffe0
mov r8d, 1
cmp eax, r8d
ja 0x14000ca9e
mov rcx, rdi
call fcn.140005634
lea rdx, str.Error_deleting_boot_manager__s___Last_Error___x
jmp 0x14000c9fd
xor edi, edi
lea rdx, str.SYSPARTDESTBOOTSTAT.DAT
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rsp + 0x30], rdi
mov ebx, r15d
and ebx, 0x80
mov dword [rsp + 0x28], 6
mov ecx, ebx
mov qword [rbp - 0x59], rax
neg ecx
mov rcx, rax
sbb edx, edx
xor r9d, r9d
neg edx
xor r8d, r8d
inc edx
mov dword [rsp + 0x20], edx
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cb4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x50
jne 0x14000cb31
test ebx, ebx
jne 0x14000cb31
mov rbx, qword [rbp - 0x59]
mov edx, r15d
mov rcx, rbx
call fcn.1400062e4
jmp 0x14000cc7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x59]
lea rdx, str.Error_creating_boot_status_data_log__s___Last_Error___x
jmp 0x14000cc6f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000cb96
mov rbx, qword [rbp - 0x59]
lea rdx, str.Error_creating_boot_status_data_log__s___Unable_to_allocate_memory
mov r8, rbx
lea ecx, [rax + 3]
call fcn.14000f424
jmp 0x14000cc41
xor edx, edx
mov r8d, 0x10000
mov rcx, rbx
call sub.msvcrt.dll_memset
xor eax, eax
lea r9, [rbp - 0x2d]
mov r8d, 0x10000
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000cbf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, qword [rbp - 0x59]
lea rdx, str.Error_creating_boot_status_data_log__s___Last_Error___x
mov r9d, eax
mov ecx, 3
call fcn.14000f424
jmp 0x14000cc1d
mov r9d, dword [rbp - 0x2d]
cmp r9d, 0x10000
je 0x14000cc1d
mov r8, qword [rbp - 0x59]
lea rdx, str.Error_creating_boot_status_data_log__s___Bytes_written___x__desired___x
mov ecx, 3
mov dword [rsp + 0x20], 0x10000
call fcn.14000f424
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x59]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400143b0
test eax, eax
jne 0x14000cc7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, str.Error_uncompressing_boot_status_data_log__s___Last_Error___x
mov r9d, eax
mov r8, rbx
mov ecx, 3
call fcn.14000f424
mov edi, dword [rbp - 0x51]
xor eax, eax
cmp dword [rbp - 0x71], eax
jne 0x14000cd54
test edi, edi
je 0x14000ccad
mov rcx, qword [rbp - 0x49]
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
xor edx, edx
call fcn.14000f930
test eax, eax
je 0x14000c610
xor eax, eax
cmp dword [rbp + 0x77], eax
jne 0x14000cd54
lea rdx, str.SYSPARTDESTBCD
lea rcx, [rsp + 0x58]
call fcn.1400107a4
lea rdx, str.SYSPARTDESTBCD.LOG
mov qword [rbp - 0x21], rax
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rcx, qword [rbp - 0x21]
mov edx, 6
mov qword [rbp - 0x19], rax
call fcn.14000e660
test eax, eax
jne 0x14000cd07
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000c610
mov rcx, qword [rbp - 0x19]
mov edx, 6
call fcn.14000e660
test eax, eax
jne 0x14000cd2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000c610
mov edx, 6
mov rcx, rbx
call fcn.14000e660
test eax, eax
jne 0x14000cd54
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000c610
test r15b, 8
je 0x14000ce84
lea rdx, str.SOURCEFONTS
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rsi, rax
test rax, rax
je 0x14000c610
cmp dword [rbp + 0x7f], 0
je 0x14000cda2
lea rdx, str.SOURCEFONTS_EX
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x69], rax
mov r14, rax
test rax, rax
je 0x14000c610
lea rdx, str.SYSPARTDESTFONTS
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14000c610
mov r9, rax
lea rdx, str.Copying_font_files_from__s_to__s...
mov r8, rsi
mov ecx, 2
call fcn.14000f424
mov eax, dword [rbp + 0x6f]
xor r9d, r9d
mov ebx, dword [rbp + 0x77]
mov rdx, r14
mov r8, qword [rbp - 0x41]
mov rcx, rsi
mov dword [rsp + 0x40], eax
mov eax, 1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
call fcn.14000d528
test eax, eax
jne 0x14000ce29
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, qword [rbp - 0x41]
lea rdx, str.Error_copying_font_files_from__s_to__s.Last_Error___x
jmp 0x14000c6df
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
cmovne rsi, rcx
test r14, r14
je 0x14000ce87
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
cmovne r14, rcx
mov qword [rbp - 0x69], r14
jmp 0x14000ce87
mov ebx, dword [rbp + 0x77]
test r15b, 4
je 0x14000cf61
lea rdx, str.SOURCERESOURCES
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov rsi, rax
test rax, rax
je 0x14000c610
lea rdx, str.SYSPARTDESTRESOURCES
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp - 0x41], rax
mov r14, rax
test rax, rax
je 0x14000c610
mov r9, rax
lea rdx, str.Copying_resource_files_from__s_to__s...
mov r8, rsi
mov ecx, 2
call fcn.14000f424
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x40], eax
mov r8, r14
mov eax, 1
xor edx, edx
mov dword [rsp + 0x38], eax
mov rcx, rsi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
call fcn.14000d528
xor r12d, r12d
test eax, eax
jne 0x14000cf39
mov r8, rsi
lea rdx, str.Resource_files_missing_from__s._These_files_are_required_for_some_editions_of_Windows._If_you_are_servicing_older_versions_of_Windows__you_can_ignore_this_message.
lea ecx, [rax + 3]
call fcn.14000f424
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
cmovne rsi, r12
jmp 0x14000cf64
xor r12d, r12d
cmp dword [rbp - 0x71], r12d
jne 0x14000d18a
mov rbx, qword [rbp - 0x49]
mov edx, 6
mov rcx, rbx
call fcn.14000e660
test eax, eax
je 0x14000c610
test edi, edi
je 0x14000cfa7
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
mov edx, 1
mov rcx, rbx
call fcn.14000f930
test eax, eax
je 0x14000c610
lea rdx, str.SYSPARTDESTBOOTNXT
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp + 0xf], rax
mov r12, rax
test rax, rax
jne 0x14000cfe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.SYSPARTDESTBOOTNXT
mov ebx, eax
lea rdx, str.Error_expanding_string__s._Last_Error___x
mov r9d, eax
jmp 0x14000ca03
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000d187
test al, 0x50
jne 0x14000d187
lea rdx, str.SYSPARTBOOTNXT
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rbp + 7], rax
mov r14, rax
test rax, rax
jne 0x14000d03a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.SYSPARTBOOTNXT
jmp 0x14000cfd7
lea rdx, str.SYSPARTBOOTTGT
lea rcx, [rsp + 0x58]
call fcn.1400107a4
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
jne 0x14000d070
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.SYSPARTBOOTTGT
jmp 0x14000cfd7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000d0c3
test al, 0x50
jne 0x14000d0c3
mov rcx, rbx
call fcn.140013d5c
test eax, eax
jne 0x14000d0c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r14, qword [rsp + 0x50]
lea rdx, str.Error_deleting_boottgt__s___Last_Error___x
mov r9d, eax
mov r8, r14
mov ecx, 4
mov ebx, eax
call fcn.14000f424
jmp 0x14000d1dc
mov rdx, r14
mov rcx, r12
call fcn.14000dc98
test eax, eax
jne 0x14000d0f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, r14
lea rdx, str.Error_copying__s_to__s._Last_Error___x
mov r8, r12
jmp 0x14000c6e2
mov rcx, r12
call fcn.140013d5c
test eax, eax
jne 0x14000d11c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, r12
lea rdx, str.Error_deleting_bootnxt_from_the_BOOT_folder___s___Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x14000ca03
mov edx, 6
mov rcx, r14
call fcn.14000e660
xor r12d, r12d
test eax, eax
jne 0x14000d150
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, r14
lea rdx, str.Error_setting_attributes_on__s._Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x14000ca03
test edi, edi
je 0x14000d18a
lea rdx, str.O:SYG:SYD:P_A_ID_FA___SY__A_ID_FA___BA__A_ID_0x1200a9___BU_
mov rcx, r14
call fcn.14000fcd0
test eax, eax
jne 0x14000d18a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8, r14
lea rdx, str.Error_setting_security_attributes_on__s._Last_Error___x
mov ebx, eax
mov r9d, eax
jmp 0x14000ca03
xor r12d, r12d
bt r15d, 8
jae 0x14000d1a3
lea rcx, [rsp + 0x58]
call fcn.14000e790
test eax, eax
je 0x14000c610
lea rcx, [rsp + 0x58]
call fcn.14000eb3c
test eax, eax
je 0x14000c610
call fcn.1400050a4
mov ebx, eax
test eax, eax
je 0x14000d1d7
mov r8d, eax
lea rdx, str.Failed_to_flush_system_volume._Error___x
mov ecx, 3
call fcn.14000f424
mov ebx, r12d
mov r14, qword [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140010738
test ebx, ebx
je 0x14000d1fe
mov r8d, ebx
lea rdx, str.ServicingBootFiles_failed._Error___x
mov ecx, 4
call fcn.14000f424
call fcn.14000f358
mov rdi, qword [rbp - 0x11]
test rdi, rdi
je 0x14000d216
xor edx, edx
mov rcx, rdi
call fcn.14000f5ac
test rsi, rsi
je 0x14000d23b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x69]
test rdi, rdi
je 0x14000d264
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x41]
test rdi, rdi
je 0x14000d28d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x14000d2b6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x29]
test rdi, rdi
je 0x14000d2df
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x39]
test rdi, rdi
je 0x14000d308
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r13, r13
je 0x14000d32d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x61]
test rdi, rdi
je 0x14000d356
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp + 7]
test rdi, rdi
je 0x14000d37f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x14000d3a4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp + 0xf]
test rdi, rdi
je 0x14000d3cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x21]
test rdi, rdi
je 0x14000d3f6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x19]
test rdi, rdi
je 0x14000d41f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x59]
test rdi, rdi
je 0x14000d448
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 0x11]
test rdi, rdi
je 0x14000d471
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 9]
test rdi, rdi
je 0x14000d49a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp - 1]
test rdi, rdi
je 0x14000d4c3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rdi, qword [rbp + 0x17]
test rdi, rdi
je 0x14000d4ec
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebx, ebx
je 0x14000d502
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000d507
mov eax, 1
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret