Function at 0x140016504
Capabilities:
Delete file

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov r14, rcx
xor ebx, ebx
xor ecx, ecx
mov qword [rbp - 0x39], rbx
xor edi, edi
mov dword [rbp + 0x7f], ecx
mov rsi, rdx
test r14, r14
je 0x140016559
cmp qword [r14 + 0x48], rcx
mov rax, r14
cmovne rax, qword [r14 + 0x48]
mov ecx, dword [rax + 0x24]
mov rax, r14
cmovne rax, qword [r14 + 0x48]
mov dword [rbp + 0x7f], ecx
mov r15, qword [rax + 0x28]
jmp 0x14001655c
xor r15d, r15d
mov rdx, qword [rdx + 0x18]
mov r8d, dword [rdx + 0x1c]
mov dword [rbp + 0x6f], r8d
bt r8d, 0xa
jae 0x14001657a
test r15, r15
je 0x14001658f
test byte [r15], 0x80
je 0x14001658f
bt r8d, 0xe
jae 0x140016596
test r15, r15
je 0x14001658f
test dword [r15], 0x20000
jne 0x140016596
xor eax, eax
jmp 0x140016d04
mov eax, 2
lea r12, str.RestoreFileData
test byte [rsi + 0x4c], al
jne 0x140016984
lea r13d, [rax - 1]
bt ecx, 0x18
jae 0x14001665c
bt r8d, 0xa
jb 0x14001665c
cmp qword [rsi + 0x20], 0xffffffffffffffff
je 0x1400165f6
mov rcx, r14
add rdx, 0x20
call fcn.14002e0d0
mov rcx, rax
xor r9d, r9d
mov r8d, r13d
call fcn.140038bd8
test rax, rax
je 0x1400165f6
movzx eax, byte [rax + 0xf]
shr eax, 5
and eax, r13d
jne 0x140016658
xor eax, eax
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov rdx, rsi
mov rcx, r14
call fcn.14004b578
mov edi, eax
test eax, eax
jns 0x14001662d
and qword [rsp + 0x20], rbx
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov r9d, eax
mov r8d, 0xb99
mov rcx, r12
call fcn.140046874
cmp edi, 0x80070020
je 0x140016641
cmp edi, 0x80070015
jne 0x140016c09
mov edx, 5
lea rcx, [rbp - 0x29]
call fcn.140030b90
test eax, eax
jne 0x1400165ff
jmp 0x140016c09
mov r8d, dword [rbp + 0x6f]
cmp qword [rsi + 0x20], 0xffffffffffffffff
je 0x1400169c4
mov rdx, qword [rsi + 0x18]
mov rcx, r14
and qword [rbp - 0x11], rbx
add rdx, 0x20
and qword [rbp - 0x19], rbx
and qword [rbp - 9], rbx
call fcn.14002e0d0
mov rcx, rax
lea r9, [rbp - 0x19]
mov r8d, r13d
call fcn.140038bd8
mov qword [rbp - 0x29], rax
mov r13d, 0x80070000
test rax, rax
jne 0x140016735
mov rdx, qword [rsi + 0x18]
mov rcx, r14
add rdx, 0x20
call fcn.14002e0d0
mov rcx, rax
lea r8, [rbp - 9]
call fcn.140033218
mov qword [rbp - 0x11], rax
mov rbx, rax
test rax, rax
jne 0x140016703
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140016709
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r13d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14001670e
mov rbx, qword [rbx + 8]
jmp 0x140016752
mov edi, 0x80004005
mov r9d, edi
lea rcx, str.RestoreFileData
mov r8d, 0xa9f
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
call fcn.140046874
jmp 0x140016d02
test byte [rax + 0xf], 0x10
je 0x14001674e
mov rbx, qword [rax + 8]
movabs rcx, 0xffffffffffffff
and rbx, rcx
jmp 0x140016752
mov rbx, qword [rax + 0x18]
test dword [rsi + 0x4c], 0x20000000
lea rcx, [rsi + 0x20]
je 0x140016777
lea rax, [0x140016390]
mov qword [rbp - 1], rsi
mov qword [rbp + 7], rax
lea rax, [0x140016480]
jmp 0x140016790
mov rax, qword [rcx]
mov qword [rbp - 1], rax
lea rax, [0x140031810]
mov qword [rbp + 7], rax
lea rax, [fcn.14004eea0]
mov qword [rbp + 0xf], rax
mov rax, qword [rsi + 0x18]
test dword [rax + 0x1c], 0x800
je 0x14001684e
test r15, r15
je 0x14001684e
test byte [r15], 0x10
je 0x14001684e
and qword [rsp + 0x38], 0
lea rax, [rbp - 0x31]
mov rcx, qword [rcx]
lea r8, [rbp + 0x67]
and dword [rbp - 0x31], 0
mov edx, 2
mov qword [rsp + 0x30], rax
mov r9d, edx
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov word [rbp + 0x67], dx
mov edx, 0x9c040
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x14001684e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x301
je 0x14001684c
cmp eax, 0x32
je 0x14001684c
movzx edi, ax
or edi, r13d
cmp eax, 1
jne 0x14001691b
mov r8, qword [rsi + 0x28]
lea r9, str.Could_not_set_compression._Invalid_cluster_size.
mov dword [rsp + 0x30], 0xada
lea ecx, [rax + 1]
mov qword [rsp + 0x28], r12
mov rdx, r14
mov dword [rsp + 0x20], edi
call fcn.14002aaa0
xor edi, edi
test dword [rbp + 0x7f], 0x2000
je 0x14001686f
mov r8, qword [rsi + 0x28]
mov rcx, r14
mov rdx, qword [rsi + 0x18]
call fcn.140049ed8
test eax, eax
jne 0x140016978
mov r8, qword [rbp - 0x29]
test r8, r8
je 0x140016883
test byte [r8 + 0xf], 0x20
jne 0x140016978
test r15, r15
je 0x1400168c1
test byte [r15], 0x40
je 0x1400168c1
mov rax, qword [rsi + 0x18]
mov ecx, dword [rax + 0x1c]
bt ecx, 9
jae 0x1400168c1
mov rax, qword [rax + 0x68]
test rax, rax
je 0x1400168c1
cmp qword [rax], 0
jne 0x1400168c1
cmp rbx, qword [rax + 8]
je 0x1400168b5
test rbx, rbx
jne 0x1400168c1
test ecx, 0x4400
je 0x140016978
mov rax, qword [rbp - 0x19]
test rax, rax
jne 0x1400168d2
mov rcx, r14
call fcn.14002e0d0
mov r9, qword [rbp - 9]
lea rcx, [rbp - 1]
mov dword [rsp + 0x38], 1
mov rdx, rax
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.140047284
mov edi, eax
test eax, eax
jns 0x140016978
mov r9d, eax
mov r8d, 0xb15
mov rcx, r12
jmp 0x14001671e
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x140016942
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov r9d, edi
mov r8d, 0xae4
mov rcx, r12
call fcn.140046874
mov r8, qword [rsi + 0x28]
lea r9, str.Error_setting_compression
mov dword [rsp + 0x30], 0xae5
mov rdx, r14
mov qword [rsp + 0x28], r12
mov ecx, 1
mov dword [rsp + 0x20], edi
call fcn.14002aaa0
test edi, edi
js 0x140016d02
jmp 0x14001684e
or dword [rsi + 0x4c], 2
mov rbx, qword [rbp - 0x39]
mov r8d, dword [rbp + 0x6f]
cmp dword [rbp + 0x77], 0
mov eax, edi
je 0x140016cce
bt r8d, 0xe
jae 0x140016c62
mov r9, qword [rsi + 0x18]
lea rdx, [rsi + 0x20]
mov r8, qword [rsi + 0x28]
mov rcx, r14
call fcn.14004ca28
mov edi, eax
test eax, eax
jns 0x140016c8f
mov r8d, 0xbad
jmp 0x140016cb6
mov r13d, 0x80070000
bt r8d, 0xa
jb 0x1400169d8
bt r8d, 0xe
jae 0x140016a47
mov rcx, r14
call fcn.140034134
mov qword [rbp - 0x39], rax
mov rbx, rax
test rax, rax
jne 0x140016a65
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140016a24
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r13d
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x140016a47
jmp 0x140016a29
mov edi, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov r9d, edi
mov r8d, 0xb3a
mov rcx, r12
call fcn.140046874
mov rax, qword [rsi + 0x18]
lea r15, [rsi + 0x20]
mov r9, qword [rax + 0x10]
test rbx, rbx
jne 0x140016be1
mov r8, qword [rsi + 0x28]
jmp 0x140016be4
mov rdx, qword [rsi + 0x18]
xor ebx, ebx
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, qword [0x1400bace0]
jne 0x140016a9c
mov rax, qword [rdx + 8]
cmp rax, qword [0x1400bace8]
jne 0x140016a9c
mov eax, dword [rdx + 0x10]
cmp eax, dword [0x1400bacf0]
jne 0x140016a9c
and qword [rbp + 0x67], rbx
jmp 0x140016b4c
mov rcx, r14
call fcn.14002e0d0
xor r9d, r9d
mov rcx, rax
lea r8d, [r9 + 1]
call fcn.140038bd8
mov rbx, rax
test rax, rax
jne 0x140016af1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140016b14
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r13d
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140016b19
and qword [rbp + 0x67], 0
test rbx, rbx
je 0x140016b4c
test byte [rbx + 0xf], 0x10
je 0x140016b44
mov rax, qword [rbx + 8]
movabs rcx, 0xffffffffffffff
and rax, rcx
jmp 0x140016b48
mov edi, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov r9d, edi
mov r8d, 0xb50
mov rcx, r12
call fcn.140046874
mov rbx, qword [rbp - 0x39]
lea r15, [rsi + 0x20]
jmp 0x140016bde
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0x67], rax
neg rbx
lea rcx, [rbp + 0x67]
mov rbx, qword [rbp - 0x39]
lea r15, [rsi + 0x20]
sbb rax, rax
mov qword [rsp + 0x30], r15
and rax, rcx
mov r9d, 0x48000100
mov rcx, r14
mov qword [rsp + 0x28], rax
mov r8, rbx
mov rdx, rbx
call fcn.140027e60
test eax, eax
jne 0x140016bde
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140016bbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r13d
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x140016bde
jmp 0x140016bc0
mov edi, 0x80004005
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov r9d, edi
mov r8d, 0xb6e
mov rcx, r12
call fcn.140046874
xor r9d, r9d
mov r8, rbx
mov rdx, qword [rsi + 0x18]
mov rcx, r14
add rdx, 0x20
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
call fcn.140046fd0
test eax, eax
je 0x140016c16
or dword [rsi + 0x4c], 3
test edi, edi
js 0x140016cce
jmp 0x140016980
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140016c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, r13d
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x140016980
jmp 0x140016c57
mov edi, 0x80004005
mov r9d, edi
mov r8d, 0xb89
jmp 0x140016cb9
bt r8d, 0xa
jae 0x140016c8b
mov r9, qword [rsi + 0x18]
lea rdx, [rsi + 0x20]
mov r8, qword [rsi + 0x28]
mov rcx, r14
call fcn.14004c178
mov edi, eax
test eax, eax
jns 0x140016c8f
mov r8d, 0xbb9
jmp 0x140016cb6
test eax, eax
js 0x140016cce
mov r8, qword [rsi + 0x18]
cmp qword [r8 + 0x60], 0
je 0x140016cce
mov rdx, qword [rsi + 0x28]
lea r9, [rsi + 0x20]
mov rcx, r14
call fcn.14004bcd4
mov edi, eax
test eax, eax
jns 0x140016cce
mov r8d, 0xbc7
mov r9d, eax
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restore.c
mov rcx, r12
call fcn.140046874
test rbx, rbx
je 0x140016d02
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret