Function at 0x14000ce40
Capabilities:
Manipulate boot configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1400ad388]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov r12, rcx
mov qword [rbp + 0x420], rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea r8d, [rdi + 4]
lea rdx, str..blf
lea rcx, [rsp + 0x20]
call fcn.1400064b0
nop
mov qword [rsp + 0x40], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea r8d, [rdi + 0xc]
lea rdx, str..regtrans_ms
lea rcx, [rsp + 0x40]
call fcn.1400064b0
nop
mov qword [rsp + 0x60], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
lea r8d, [rdi + 0xb]
lea rdx, str..library_ms
lea rcx, [rsp + 0x60]
call fcn.1400064b0
nop
mov qword [rbp - 0x80], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], di
lea r8d, [rdi + 4]
lea rdx, str..sys
lea rcx, [rbp - 0x80]
call fcn.1400064b0
nop
mov qword [rbp - 0x60], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], di
lea r8d, [rdi + 4]
lea rdx, str..SYS
lea rcx, [rbp - 0x60]
call fcn.1400064b0
nop
mov qword [rbp - 0x40], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
lea r8d, [rdi + 4]
lea rdx, [0x140096180]
lea rcx, [rbp - 0x40]
call fcn.1400064b0
nop
mov qword [rbp - 0x20], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], di
lea r8d, [rdi + 4]
lea rdx, str..log
lea rcx, [rbp - 0x20]
call fcn.1400064b0
nop
mov qword [rbp], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x10], xmm0
mov word [rbp], di
lea r8d, [rdi + 4]
lea rdx, str..LOG
lea rcx, [rbp]
call fcn.1400064b0
nop
mov qword [rbp + 0x20], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], di
lea r8d, [rdi + 8]
lea rdx, str..log.tmp
lea rcx, [rbp + 0x20]
call fcn.1400064b0
nop
mov qword [rbp + 0x40], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], di
lea r8d, [rdi + 4]
lea rdx, str..efi
lea rcx, [rbp + 0x40]
call fcn.1400064b0
nop
mov qword [rbp + 0x60], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], di
lea r8d, [rdi + 4]
lea rdx, [0x140094f30]
lea rcx, [rbp + 0x60]
call fcn.1400064b0
nop
mov qword [rbp + 0x80], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], di
lea r8d, [rdi + 4]
lea rdx, str..bat
lea rcx, [rbp + 0x80]
call fcn.1400064b0
nop
mov qword [rbp + 0xa0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], di
lea r8d, [rdi + 4]
lea rdx, str..dll
lea rcx, [rbp + 0xa0]
call fcn.1400064b0
nop
mov qword [rbp + 0xc0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], di
lea r8d, [rdi + 4]
lea rdx, str..EXE
lea rcx, [rbp + 0xc0]
call fcn.1400064b0
nop
mov qword [rbp + 0xe0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0xf0], xmm0
mov word [rbp + 0xe0], di
lea r8d, [rdi + 4]
lea rdx, str..BAT
lea rcx, [rbp + 0xe0]
call fcn.1400064b0
nop
mov qword [rbp + 0x100], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], di
lea r8d, [rdi + 4]
lea rdx, str..DLL
lea rcx, [rbp + 0x100]
call fcn.1400064b0
nop
mov qword [rbp + 0x120], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], di
lea r8d, [rdi + 7]
lea rdx, str..crYptA
lea rcx, [rbp + 0x120]
call fcn.1400064b0
nop
mov qword [rbp + 0x140], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x150], xmm0
mov word [rbp + 0x140], di
lea r8d, [rdi + 7]
lea rdx, str..crYptB
lea rcx, [rbp + 0x140]
call fcn.1400064b0
nop
mov qword [rbp + 0x160], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], di
lea r8d, [rdi + 7]
lea rdx, str..crYptC
lea rcx, [rbp + 0x160]
call fcn.1400064b0
nop
mov qword [rbp + 0x180], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], di
lea r8d, [rdi + 7]
lea rdx, str..crYptD
lea rcx, [rbp + 0x180]
call fcn.1400064b0
nop
mov qword [rbp + 0x1a0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], di
lea r8d, [rdi + 7]
lea rdx, str..crYptE
lea rcx, [rbp + 0x1a0]
call fcn.1400064b0
nop
mov qword [rbp + 0x1c0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x1d0], xmm0
mov word [rbp + 0x1c0], di
lea r8d, [rdi + 7]
lea rdx, str..crYptF
lea rcx, [rbp + 0x1c0]
call fcn.1400064b0
nop
mov qword [rbp + 0x1e0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x1f0], xmm0
mov word [rbp + 0x1e0], di
lea r8d, [rdi + 7]
lea rdx, str..dnt___
lea rcx, [rbp + 0x1e0]
call fcn.1400064b0
nop
mov qword [rbp + 0x200], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], di
lea r8d, [rdi + 8]
lea rdx, str..crYptA1
lea rcx, [rbp + 0x200]
call fcn.1400064b0
nop
mov qword [rbp + 0x220], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], di
lea r8d, [rdi + 8]
lea rdx, str..crYptA2
lea rcx, [rbp + 0x220]
call fcn.1400064b0
nop
mov qword [rbp + 0x240], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], di
lea r8d, [rdi + 8]
lea rdx, str..crYptB2
lea rcx, [rbp + 0x240]
call fcn.1400064b0
nop
mov qword [rbp + 0x260], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], di
lea r8d, [rdi + 8]
lea rdx, str..crYptC2
lea rcx, [rbp + 0x260]
call fcn.1400064b0
nop
mov qword [rbp + 0x280], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], di
lea r8d, [rdi + 8]
lea rdx, str..crYptA3
lea rcx, [rbp + 0x280]
call fcn.1400064b0
nop
mov qword [rbp + 0x2a0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], di
lea r8d, [rdi + 4]
lea rdx, str..dnt
lea rcx, [rbp + 0x2a0]
call fcn.1400064b0
nop
mov qword [rbp + 0x2c0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x2d0], xmm0
mov word [rbp + 0x2c0], di
lea r8d, [rdi + 6]
lea rdx, str..crYpt
lea rcx, [rbp + 0x2c0]
call fcn.1400064b0
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x438], rax
lea rdx, [rbp + 0x430]
mov rcx, r12
call fcn.140018090
nop
lea r9, [fcn.140002060]
lea edx, [rdi + 0x20]
lea r8d, [rdi + 0x1e]
lea rcx, [rsp + 0x20]
call fcn.14004cb24
mov qword [rbp + 0x2e0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x2f0], xmm0
mov word [rbp + 0x2e0], di
lea r8d, [rdi + 0x15]
lea rdx, [0x140096330]
lea rcx, [rbp + 0x2e0]
call fcn.1400064b0
nop
mov qword [rbp + 0x300], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], di
lea r8d, [rdi + 0xc]
lea rdx, str.bootfont.bin
lea rcx, [rbp + 0x300]
call fcn.1400064b0
nop
mov qword [rbp + 0x320], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x330], xmm0
mov word [rbp + 0x320], di
lea r8d, [rdi + 8]
lea rdx, str.boot.ini
lea rcx, [rbp + 0x320]
call fcn.1400064b0
nop
mov qword [rbp + 0x340], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x350], xmm0
mov word [rbp + 0x340], di
lea r8d, [rdi + 0xc]
lea rdx, str.bootsect.bak
lea rcx, [rbp + 0x340]
call fcn.1400064b0
nop
mov qword [rbp + 0x360], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], di
lea r8d, [rdi + 0xa]
lea rdx, str.ntuser.dat
lea rcx, [rbp + 0x360]
call fcn.1400064b0
nop
mov qword [rbp + 0x380], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], di
lea r8d, [rdi + 0xe]
lea rdx, str.ntuser.dat.log
lea rcx, [rbp + 0x380]
call fcn.1400064b0
nop
mov qword [rbp + 0x3a0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x3b0], xmm0
mov word [rbp + 0x3a0], di
lea r8d, [rdi + 0xa]
lea rdx, str.ntuser.ini
lea rcx, [rbp + 0x3a0]
call fcn.1400064b0
nop
mov qword [rbp + 0x3c0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x3d0], xmm0
mov word [rbp + 0x3c0], di
lea r8d, [rdi + 9]
lea rdx, str.thumbs.db
lea rcx, [rbp + 0x3c0]
call fcn.1400064b0
nop
mov qword [rbp + 0x3e0], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x3f0], xmm0
mov word [rbp + 0x3e0], di
lea r8d, [rdi + 0xc]
lea rdx, str.iconcache.db
lea rcx, [rbp + 0x3e0]
call fcn.1400064b0
nop
mov qword [rbp + 0x400], rdi
movdqa xmm0, xmmword [0x1400976c0]
movdqa xmmword [rbp + 0x410], xmm0
mov word [rbp + 0x400], di
lea r8d, [rdi + 5]
lea rdx, str.ntldr
lea rcx, [rbp + 0x400]
call fcn.1400064b0
nop
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x420]
mov qword [rbp + 0x438], rax
lea rdx, [rbp + 0x430]
lea rcx, [r12 + 0x18]
call fcn.140018090
nop
lea r9, [fcn.140002060]
lea edx, [rdi + 0x20]
lea r8d, [rdi + 0xa]
lea rcx, [rbp + 0x2e0]
call fcn.14004cb24
lea r15, [r12 + 0x30]
lea rax, str.All_Users
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 9
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x20]
call fcn.140008480
nop
lea rax, str.Boot
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 4
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x40]
call fcn.140008480
nop
lea rax, str.Windows
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 7
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x60]
call fcn.140008480
nop
lea rax, str.Microsoft
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 9
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x80]
call fcn.140008480
nop
lea rax, str.System_Volume_Information
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0x19
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x60]
call fcn.140008480
nop
lea rax, str.Local_Settings
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0xe
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x40]
call fcn.140008480
nop
lea rax, str._Recycle.Bin
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0xc
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x20]
call fcn.140008480
nop
lea rax, str.AppData
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 7
lea rdx, [rbp + 0x430]
lea rcx, [rbp]
call fcn.140008480
nop
lea rax, str.ProgramData
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0xb
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x20]
call fcn.140008480
nop
lea rax, str.Program_Files__x86_
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0x13
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x40]
call fcn.140008480
nop
lea rax, str.Program_Files
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], 0xd
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x60]
call fcn.140008480
nop
mov qword [r15], rdi
mov qword [r15 + 8], rdi
mov qword [rbp + 0x440], r15
mov qword [rbp + 0x448], rdi
mov qword [rbp + 0x430], r15
xor r15d, r15d
mov qword [rbp + 0x438], r15
lea ecx, [rdi + 0x30]
call fcn.14004c570
mov r13, rax
mov qword [rbp + 0x438], rax
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x20]
call fcn.140006100
mov qword [rbp + 0x458], r13
mov rsi, r13
mov qword [rbp + 0x450], r13
mov r14d, 1
mov qword [rbp + 0x448], r14
lea rbx, [rsp + 0x40]
nop word [rax + rax]
mov qword [rbp + 0x438], r15
mov ecx, 0x30
call fcn.14004c570
mov rdi, rax
mov qword [rbp + 0x438], rax
lea rcx, [rax + 0x10]
mov rdx, rbx
call fcn.140006100
mov qword [rsi], rdi
mov qword [rdi + 8], rsi
mov rsi, rdi
mov qword [rbp + 0x438], r15
mov qword [rbp + 0x450], rdi
inc r14
mov qword [rbp + 0x448], r14
add rbx, 0x20
lea rax, [rbp + 0x80]
cmp rbx, rax
jne 0x14000d950
lea r15, [r12 + 0x30]
mov qword [rbp + 0x430], r15
xor edi, edi
mov qword [rbp + 0x438], rdi
lea ecx, [rdi + 0x30]
call fcn.14004c570
test r14, r14
jne 0x14000d9d4
mov qword [rax], rax
mov qword [rax + 8], rax
jmp 0x14000d9e2
mov qword [rax], r13
mov qword [rax + 8], rsi
mov qword [r13 + 8], rax
mov qword [rsi], rax
mov qword [r15 + 8], r14
mov qword [r15], rax
lea r9, [fcn.140002060]
mov edx, 0x20
lea r8d, [rdx - 0x15]
lea rcx, [rsp + 0x20]
call fcn.14004cb24
nop
mov rax, r12
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14004c550
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret