Function at 0x14000dbf0
Capabilities:
Get file size
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15, qword [rsp + 0xd8]
xor ebp, ebp
mov r14d, dword [rsp + 0xd0]
mov r12, rcx
xor ecx, ecx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], rbp
mov ebx, ebp
mov edi, ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x44], ebp
mov esi, r9d
mov dword [rsp + 0x40], ebp
mov r13d, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test r15, r15
je 0x14000dc4f
mov dword [r15], ebp
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, r12
call fcn.14000becc
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14000dc85
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov eax, 0xe
test edi, edi
cmove edi, eax
jmp 0x14000e41c
bt esi, 0xc
jb 0x14000dca9
cmp word [rax], bp
je 0x14000dc9f
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14000dc9f
cmp word [rax], bp
jne 0x14000dca9
mov edi, 0x57
jmp 0x14000e441
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r15d, 0x258
mov edx, 8
mov rcx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000dce5
mov rbx, rbp
lea edi, [rax + 0xe]
jmp 0x14000e441
mov r8, r15
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov dword [rbx], 0xfeedf001
test r13d, r13d
jns 0x14000dd05
bts dword [rbx + 0x1ac], 0x1f
mov r15d, r13d
and r15d, 0x40000000
je 0x14000dd23
or dword [rbx + 0x1ac], 0xc0000000
mov dword [rsp + 0x44], 1
mov r8d, 0x20000000
test r8d, r13d
je 0x14000dd38
or dword [rbx + 0x1ac], r8d
or esi, 0x40
mov dword [rbx + 0x1b4], 3
test esi, 0xdfffcfbd
je 0x14000dd54
mov edi, 0x57
jmp 0x14000e420
test sil, 2
je 0x14000dd6c
mov rcx, rbx
call fcn.14000774c
or eax, 2
mov edx, eax
call fcn.140007788
test sil, 0x40
je 0x14000dd84
mov rcx, rbx
call fcn.14000774c
or eax, 0x40
mov edx, eax
call fcn.140007788
test r8d, esi
je 0x14000dd9b
mov rcx, rbx
call fcn.14000774c
or eax, r8d
mov edx, eax
call fcn.140007788
bt esi, 0xd
mov ebp, 4
mov eax, 5
cmovae ebp, r14d
cmp ebp, 3
jbe 0x14000dddc
cmp ebp, eax
jbe 0x14000ddc3
cmp ebp, 7
je 0x14000dddc
lea edi, [rax + 0x52]
jmp 0x14000e41a
mov rcx, rbx
call fcn.140007518
test rax, rax
je 0x14000ddef
mov dword [rax + 0x1bc], 7
jmp 0x14000ddef
mov rcx, rbx
call fcn.140007518
test rax, rax
je 0x14000ddef
mov dword [rax + 0x1bc], ebp
bt esi, 0xc
jae 0x14000ddff
mov rcx, r12
call fcn.140018d88
jmp 0x14000de0e
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call fcn.14000becc
mov rcx, rbx
mov rdx, rax
call fcn.140007518
test rax, rax
je 0x14000de25
mov qword [rax + 0x210], rdx
call fcn.140007600
test rax, rax
je 0x14000e40c
or rdx, 0xffffffffffffffff
call fcn.140007a40
mov rdx, qword [0x14007b998]
call fcn.14001fef4
test eax, eax
je 0x14000e40c
mov rcx, rbx
call fcn.140007a00
cmp rax, 0xffffffffffffffff
je 0x14000e40c
mov dword [rbx + 0x1b4], 3
mov dword [rsp + 0x48], 1
call fcn.14000fcf0
test eax, eax
je 0x14000e40c
call fcn.14001e64c
mov rcx, rbx
mov qword [rbx + 0x1d0], rax
call fcn.140007518
test rax, rax
je 0x14000dea8
mov rcx, qword [0x14007b998]
mov qword [rax + 0x230], rcx
and qword [rsp + 0x50], rdi
mov r14d, dword [rsp + 0x44]
test r14d, r14d
jne 0x14000dec3
lea edx, [r14 + 1]
mov rcx, rbx
call fcn.1400078cc
mov rcx, rbx
call fcn.140007a00
cmp dword [0x14007ba38], edi
lea rdx, [rsp + 0x50]
mov rcx, rax
je 0x14000dee2
call fcn.14000d9b8
jmp 0x14000deee
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14000df0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
mov eax, 0xd
cmove edi, eax
test r14d, r14d
je 0x14000df34
test edi, edi
jne 0x14000dfb7
mov rcx, rbx
call fcn.14000774c
test al, 0x40
je 0x14000df38
call fcn.140007a00
mov rcx, rax
call fcn.14001fdc4
mov dword [rsp + 0x40], eax
test edi, edi
jne 0x14000dfb7
mov edx, dword [rsp + 0x40]
mov rcx, rbx
call fcn.14001f818
test eax, eax
jne 0x14000df9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r9d, ax
mov rcx, rbx
or r9d, 0x80070000
mov edi, eax
test eax, eax
cmovle r9d, eax
call fcn.140007600
mov r8, rax
mov dword [rsp + 0x30], 0x1a5
xor edx, edx
lea rax, str.WIMCreateFile
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
lea r9, str.Fail_to_read_WIM_header
lea ecx, [rdx + 1]
call fcn.14000b4d0
jmp 0x14000dfb7
mov rcx, rbx
call 0x140008404
test byte [rax + 0x10], 8
je 0x14000dfb7
test r15d, r15d
mov eax, 5
cmovne edi, eax
test r14d, r14d
je 0x14000e043
test edi, edi
jne 0x14000e0af
mov rcx, rbx
call fcn.14000774c
test al, 0x40
je 0x14000e04f
call 0x140008404
test byte [rax + 0x10], 0x40
je 0x14000e04f
cmp dword [rsp + 0x40], edi
je 0x14000dff5
mov rcx, rbx
call fcn.140007a00
mov rcx, rax
call fcn.14001fea4
mov edx, 1
mov rcx, rbx
call fcn.1400078cc
mov rcx, rbx
call fcn.14000e4a8
mov rcx, r12
xor ebx, ebx
call fcn.14000fad8
mov edi, eax
test eax, eax
jne 0x14000e43f
mov rax, qword [rsp + 0x58]
lea r8d, [rbx + 3]
mov qword [rsp + 0x28], rax
mov r9d, esi
mov edx, r13d
mov dword [rsp + 0x20], ebp
mov rcx, r12
call fcn.14000dbf0
jmp 0x14000e486
xor ebp, ebp
test edi, edi
jne 0x14000e2e5
jmp 0x14000e051
xor ebp, ebp
mov rcx, rbx
call fcn.14002143c
test eax, eax
je 0x14000e096
mov rcx, rbx
call fcn.140021bbc
test eax, eax
je 0x14000e096
cmp dword [rbx + 0x1ac], ebp
jge 0x14000e082
mov rcx, rbx
call fcn.14002022c
test eax, eax
jne 0x14000e082
lea edi, [rax + 0xd]
jmp 0x14000e0b1
mov rcx, rbx
call fcn.14002059c
test eax, eax
mov eax, 0xd
cmove edi, eax
jmp 0x14000e0b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000e0b1
mov edi, 0x570
jmp 0x14000e0b1
xor ebp, ebp
test r14d, r14d
je 0x14000e151
test edi, edi
jne 0x14000e2e5
mov rcx, rbx
call fcn.14000774c
test al, 0x40
je 0x14000e159
call 0x140008404
mov rcx, rbx
mov edx, dword [rax + 0x10]
or edx, 0x40
call 0x140008404
mov rcx, rbx
mov dword [rax + 0x10], edx
mov edx, dword [rsp + 0x40]
call fcn.14001fcc4
test eax, eax
je 0x14000e120
mov rcx, rbx
call fcn.140007880
or eax, 8
cmp dword [rbx], 0xfeedf002
jne 0x14000e110
mov dword [rbx + 0x2c], eax
jmp 0x14000e138
cmp dword [rbx], 0xfeedf001
jne 0x14000e138
mov dword [rbx + 0x1a8], eax
jmp 0x14000e138
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov eax, 0xe
test edi, edi
cmove edi, eax
mov rcx, rbx
call 0x140008404
mov rcx, rbx
mov edx, dword [rax + 0x10]
and edx, 0xffffffbf
call 0x140008404
mov dword [rax + 0x10], edx
test edi, edi
jne 0x14000e2e5
mov rcx, rbx
call 0x140008404
mov rcx, rbx
mov rdx, qword [rax + 0x48]
call 0x140008404
mov rcx, rbx
add rdx, qword [rax + 0x40]
call 0x1400082e8
mov r8, qword [0x14007b998]
xor edx, edx
call 0x14000828c
mov rcx, rbx
mov rdx, rax
call 0x140008404
cmp qword [rax + 0x80], rdx
jl 0x14000e1d2
mov rcx, rbx
call 0x140008404
cmp qword [rax + 0x88], rbp
je 0x14000e1d2
mov rcx, rbx
call 0x140008404
mov rcx, rbx
mov rdx, qword [rax + 0x88]
call 0x140008404
mov rcx, rbx
add rdx, qword [rax + 0x80]
call 0x1400082e8
mov r8, qword [0x14007b998]
xor edx, edx
mov rcx, rbx
call 0x14000828c
mov rcx, rbx
mov rdx, rax
call 0x140008404
cmp qword [rax + 0x108], rdx
jl 0x14000e22e
mov rcx, rbx
call 0x140008404
cmp qword [rax + 0x110], rbp
je 0x14000e22e
mov rcx, rbx
call 0x140008404
mov rcx, rbx
mov rdx, qword [rax + 0x110]
call 0x140008404
mov rcx, rbx
add rdx, qword [rax + 0x108]
call 0x1400082e8
mov r8, qword [0x14007b998]
xor edx, edx
mov rcx, rbx
call 0x14000828c
mov rcx, rbx
mov rdx, rax
call fcn.140007518
test rax, rax
je 0x14000e256
mov qword [rax + 0x230], rdx
call fcn.140007880
bt eax, 8
jae 0x14000e275
mov rcx, rbx
call 0x140008404
mov rcx, rbx
mov rdx, qword [rax + 0x40]
call 0x1400082e8
test r14d, r14d
je 0x14000e2e5
mov rcx, rbx
mov r8, rbp
call fcn.140007518
test rax, rax
je 0x14000e291
mov r8, qword [rax + 0x230]
call fcn.140007a00
mov rcx, rax
mov rdx, r8
call fcn.14000da44
mov rcx, rbx
call fcn.140007a00
mov rcx, rax
call fcn.14000db70
mov r8, qword [0x14007b998]
xor edx, edx
mov rcx, rbx
call 0x14000828c
mov rcx, rbx
mov r8, rax
call fcn.140007a00
mov rcx, rax
mov rdx, r8
call fcn.14000da44
mov edx, FDICreate
mov rcx, rbx
call fcn.1400078cc
cmp dword [rsp + 0x40], ebp
je 0x14000e2fb
mov rcx, rbx
call fcn.140007a00
mov rcx, rax
call fcn.14001fea4
test edi, edi
jne 0x14000e420
mov rcx, rbx
call 0x140008404
mov rcx, rbx
test dword [rax + 0x10], 0x40000
je 0x14000e334
call fcn.140007518
test rax, rax
je 0x14000e3b9
mov dword [rax + 0x1bc], 2
jmp 0x14000e3b9
call 0x140008404
mov rcx, rbx
test dword [rax + 0x10], 0x20000
je 0x14000e35b
call fcn.140007518
test rax, rax
je 0x14000e3b9
mov dword [rax + 0x1bc], 1
jmp 0x14000e3b9
call 0x140008404
mov rcx, rbx
test dword [rax + 0x10], 0x200000
je 0x14000e382
call fcn.140007518
test rax, rax
je 0x14000e3b9
mov dword [rax + 0x1bc], 7
jmp 0x14000e3b9
call 0x140008404
mov rcx, rbx
test dword [rax + 0x10], 0x80000
je 0x14000e3a9
call fcn.140007518
test rax, rax
je 0x14000e3b9
mov dword [rax + 0x1bc], 3
jmp 0x14000e3b9
call fcn.140007518
test rax, rax
je 0x14000e3b9
mov dword [rax + 0x1bc], ebp
mov rcx, rbx
call 0x140008404
cmp dword [rbx], 0xfeedf001
movzx ecx, word [rax + 0x28]
jne 0x14000e3d4
mov word [rbx + 0x1c8], cx
mov rcx, rbx
call 0x140008404
cmp dword [rbx], 0xfeedf001
movzx ecx, word [rax + 0x2a]
jne 0x14000e3ef
mov word [rbx + 0x1ca], cx
mov rdx, rbx
mov rcx, rbx
call fcn.140008184
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14000e441
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
jmp 0x14000e441
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
xor ebp, ebp
test edi, edi
je 0x14000e3fa
test rbx, rbx
je 0x14000e441
mov edx, 1
mov rcx, rbx
call fcn.1400078cc
mov rcx, rbx
call fcn.14000e4a8
mov rbx, rbp
jmp 0x14000e441
xor ebp, ebp
mov rsi, qword [rsp + 0x60]
mov edx, edi
mov rcx, rsi
call fcn.14000b6e4
test rsi, rsi
je 0x14000e475
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rbx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret