Function at 0x14007e4ec
Capabilities:
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11b0
call fcn.1400959f0
sub rsp, rax
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x11a0], rax
mov r12, r8
mov r14d, edx
mov eax, edx
and eax, 0x10000000
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x6c], eax
mov r13d, edx
and r13d, 1
add r13d, r13d
mov ebx, edx
shr ebx, 0x14
and ebx, 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x220]
call sub.msvcrt.dll_memset
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x330]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x540]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x750]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0xd80]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x960]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0xb70]
call sub.msvcrt.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0xf90]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x98], rax
lea rdi, str.SetupLog
lea rsi, str.WdsSetupLogInit
mov ecx, ebx
call fcn.140082d34
test eax, eax
je 0x14007f1ad
call fcn.14007d980
test eax, eax
je 0x14007e621
lea rsi, str.GlobalWdsSetupLogInit
lea rdi, str.GlobalSetupLog
mov edx, 1
mov rcx, rsi
mov rax, qword [0x1400c9ab8]
call qword [str.PN_t_]
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14007e683
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
jne 0x14007e67a
lea rdi, str.SetupLog
lea edx, [rax - 4]
lea rcx, str.WdsSetupLogInit
mov rax, qword [0x1400c9ab8]
call qword [str.PN_t_]
mov r15, rax
mov qword [rsp + 0x70], rax
test r15, r15
je 0x14007f1ad
mov ebx, dword [rsp + 0x64]
xor ecx, ecx
test ebx, ebx
jne 0x14007e693
inc dword [0x1400c9a68]
mov eax, ecx
mov rsi, qword [0x1400c9a80]
test rsi, rsi
setne al
mov dword [rsp + 0x68], eax
test rsi, rsi
je 0x14007e6b4
mov qword [rsp + 0x78], rsi
xor edi, edi
jmp 0x14007e6e3
call fcn.140081bd4
xor ecx, ecx
call fcn.140082d34
test eax, eax
je 0x14007f183
mov rcx, rdi
call fcn.14008514c
mov rsi, rax
mov qword [rsp + 0x78], rax
xor edi, edi
test rax, rax
je 0x14007f183
mov ebx, edi
mov dword [rsp + 0x60], ebx
test r12, r12
je 0x14007e70e
mov r9, r12
lea r8, [0x1400a9d50]
mov edx, 0x104
lea rcx, [rsp + 0x220]
call fcn.14007d86c
test eax, eax
jns 0x14007e777
mov edx, 0xfa
lea rcx, [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x14007e777
mov edx, 0x104
lea rcx, [rsp + 0x220]
lea r8, [0x1400b3aa0]
lea rax, [rsp + 0x220]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14007e769
mov al, byte [rcx + r8]
test al, al
je 0x14007e769
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14007e74a
lea rax, [rcx - 1]
test rdx, rdx
cmovne rax, rcx
mov byte [rax], dil
lea rax, [rsp + 0x330]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], r13d
and qword [rsp + 0xdc], 0
lea rax, [rsp + 0x540]
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], r13d
and qword [rsp + 0x10c], 0
lea rax, [rsp + 0xd80]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x120], r13d
and qword [rsp + 0x124], 0
lea rax, [rsp + 0x750]
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0x1d0], r13d
and qword [rsp + 0x1d4], 0
lea rax, str.CONOUT_
mov qword [rsp + 0x130], rax
and qword [rsp + 0x138], 0
mov dword [rsp + 0x140], edi
lea rax, [rsp + 0x960]
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], r13d
and qword [rsp + 0x16c], 0
lea rax, [rsp + 0xb70]
mov qword [rsp + 0x178], rax
mov dword [rsp + 0x180], r13d
and qword [rsp + 0x184], 0
lea rax, [0x1400b3a90]
mov qword [rsp + 0xa0], rax
lea r8, [0x1400b3a58]
mov qword [rsp + 0xa8], r8
lea rcx, [0x1400b3a60]
mov qword [rsp + 0xb0], rcx
lea rdx, [0x1400b3a88]
mov qword [rsp + 0xb8], rdx
lea rax, [0x1400b3a98]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], edi
mov qword [rsp + 0x1e0], r8
mov qword [rsp + 0x1e8], rcx
lea rax, [0x1400b3a68]
mov qword [rsp + 0x1f0], rax
lea rax, [0x1400b3a70]
mov qword [rsp + 0x1f8], rax
lea rax, [0x1400b3a78]
mov qword [rsp + 0x200], rax
lea rax, [0x1400b3a80]
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x210], rdx
lea rax, str.SACSetupAct
mov qword [rsp + 0x1a8], rax
lea rax, str.Windows_Setup_activity_log
mov qword [rsp + 0x1b0], rax
lea rax, str.SACSetupErr
mov qword [rsp + 0x1b8], rax
lea rax, str.Windows_Setup_error_log
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0xe8], r8
mov ecx, 0x4000000
mov dword [rsp + 0xf0], ecx
mov eax, 1
mov qword [rsp + 0xf4], rax
mov qword [rsp + 0x80], r8
mov dword [rsp + 0x88], 0x2000000
mov qword [rsp + 0x8c], rax
mov qword [rsp + 0x190], r8
mov dword [rsp + 0x198], 0x3000000
mov dword [rsp + 0x19c], eax
mov dword [rsp + 0x1a0], eax
mov qword [rsp + 0x148], r8
mov qword [rsp + 0x150], rcx
mov dword [rsp + 0x158], edi
lea rax, str.setupact.log
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov r13d, 0x104
mov edx, r13d
lea rcx, [rsp + 0x330]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.setuperr.log
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0x540]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.setuplog.xml
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0x750]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.diagerr.xml
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0x960]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.diagwrn.xml
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0xb70]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.debug.log
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0xd80]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
lea rax, str.setuplog.cfg
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, str._S_s
mov edx, r13d
lea rcx, [rsp + 0xf90]
call fcn.14002ba4c
test eax, eax
js 0x14007f144
bt r14d, 0x19
jae 0x14007ebe9
mov dword [0x1400c9a58], 1
lea rbx, [0x1400c8f20]
test r12, r12
je 0x14007eb5b
mov r9, r12
lea r8, [0x1400b3c08]
mov edx, r13d
mov rcx, rbx
call fcn.14002ba4c
test eax, eax
jns 0x14007ebe9
mov r8d, r13d
mov rdx, rbx
lea rcx, str._WINDIR_Minidump
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x14007eba1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
test al, 0x10
je 0x14007eba1
lea r8, [0x14009ce88]
mov rdx, r13
mov rcx, rbx
call fcn.1400027e4
test eax, eax
jns 0x14007ebe9
mov rdx, rbx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x14007ebe9
mov r8d, r13d
mov rdx, rbx
xor ecx, ecx
mov rax, qword [0x1400c9ac8]
call qword [str.PN_t_]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x14007ebe9
mov word [rax + 2], di
mov ebx, 0x1000000
test ebx, r14d
je 0x14007ec1b
test dword [0x1400c9a7c], ebx
jne 0x14007ec1b
lea rcx, [0x14007e280]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
nop dword [rax + rax]
mov qword [0x1400c9a70], rax
or dword [0x1400c9a7c], ebx
call fcn.14007e488
test eax, eax
je 0x14007f140
mov r12d, 0x1000
mov eax, dword [0x1400c9a7c]
lea rbx, [0x1400b6128]
test r12d, r14d
je 0x14007eca5
test r12d, eax
jne 0x14007eca5
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
lea r8, [rsp + 0xe8]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
or eax, r12d
mov dword [0x1400c9a7c], eax
mov r12d, 0x2000
test r12d, r14d
je 0x14007ed15
test r12d, eax
jne 0x14007ed15
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
lea r8, [rsp + 0x80]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
or eax, r12d
mov dword [0x1400c9a7c], eax
mov r12d, 0x20000
test r12d, r14d
je 0x14007ed7b
test r12d, eax
jne 0x14007ed7b
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x118]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
or eax, r12d
mov dword [0x1400c9a7c], eax
mov ecx, r14d
and ecx, 0xc0000
or ecx, eax
mov dword [0x1400c9a7c], ecx
mov eax, ecx
mov r12d, 0x10000
test r12d, r14d
je 0x14007edfe
test r12d, ecx
jne 0x14007edfe
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
lea r8, [rsp + 0x148]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
or eax, r12d
mov dword [0x1400c9a7c], eax
mov ecx, eax
mov r12d, 0x8000
test r12d, r14d
je 0x14007ee6a
test r12d, eax
jne 0x14007ee6a
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b3e40]
lea r8, [rsp + 0x1e0]
lea rdx, [0x1400b3e60]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
or eax, r12d
mov dword [0x1400c9a7c], eax
mov ecx, eax
mov eax, ecx
test r14d, r14d
jns 0x14007ef2c
test ecx, ecx
js 0x14007ef2c
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x1a8]
mov qword [rsp + 0x30], rcx
lea r12, [0x1400b6138]
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1400b6108]
lea r8, [rsp + 0x80]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov eax, dword [0x1400c9a7c]
bts eax, 0x1f
mov dword [0x1400c9a7c], eax
mov r12d, 0x4000
test r12d, r14d
je 0x14007efdd
test r12d, eax
jne 0x14007efdd
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x1400b3e50]
lea r8, [rsp + 0x80]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, [0x1400b3e50]
lea r8, [rsp + 0x190]
lea rdx, [0x1400b3e70]
mov rcx, rsi
mov rax, qword [rax]
call qword [str.PN_t_]
test eax, eax
je 0x14007f140
or dword [0x1400c9a7c], r12d
mov edi, dword [rsp + 0x68]
test edi, edi
jne 0x14007f030
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov dword [0x1400c9a8c], eax
mov qword [0x1400c9a80], rsi
mov r8d, r13d
lea rdx, [0x1400c5b90]
xor ecx, ecx
mov rax, qword [0x1400c9ae8]
call qword [str.PN_t_]
mov r8d, r13d
lea rdx, str._unknown_
xor ecx, ecx
mov rax, qword [0x1400c9ac8]
call qword [str.PN_t_]
mov ebx, 1
mov dword [rsp + 0x60], ebx
test edi, edi
jne 0x14007f0d8
mov rax, qword [rsi]
xor r9d, r9d
lea r8, [rsp + 0x98]
lea rdx, [0x1400b6118]
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [str.PN_t_]
xor edi, edi
test eax, eax
jne 0x14007f0da
mov rdi, qword [rsp + 0x11d8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
lea rdx, str.Unable_to_load_global_log_filter.
mov ecx, 0x67000000
call fcn.140002df4
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str.WdsSetupLogInit
mov qword [rsp + 0x30], rax
lea rax, str.onecore_base_ntsetuppantherwdslog_setuplog.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x599
xor r9d, r9d
mov edx, 0x90000
call fcn.14007fc40
mov ebx, dword [rsp + 0x60]
xor edi, edi
mov r12d, 0x4000000
test r12d, r14d
je 0x14007f112
test dword [0x1400c9a7c], r12d
jne 0x14007f112
mov ecx, r14d
shr ecx, 0x1b
and ecx, 1
lea rdx, [0x14007e2e0]
mov rax, qword [0x1400c9ae0]
call qword [str.PN_t_]
or dword [0x1400c9a7c], r12d
mov eax, r14d
and eax, 2
test al, al
je 0x14007f12e
mov rax, qword [rsi]
mov rax, qword [rax + 0x30]
mov rcx, rsi
call qword [str.PN_t_]
jmp 0x14007f144
and r14d, 4
test r14b, r14b
je 0x14007f144
mov rax, qword [rsi]
mov rax, qword [rax + 0x38]
jmp 0x14007f123
mov ebx, dword [rsp + 0x60]
test ebx, ebx
jne 0x14007f15a
mov qword [0x1400c9a80], rsi
cmp dword [rsp + 0x64], edi
jne 0x14007f15a
call fcn.14007f518
mov rcx, r15
mov rax, qword [0x1400c9aa8]
call qword [str.PN_t_]
mov rcx, r15
mov rax, qword [0x1400c9ac0]
call qword [str.PN_t_]
mov rax, qword [0x1400c9a80]
jmp 0x14007f1af
test ebx, ebx
jne 0x14007f18d
dec dword [0x1400c9a68]
mov rcx, r15
mov rax, qword [0x1400c9aa8]
call qword [str.PN_t_]
mov rcx, r15
mov rax, qword [0x1400c9ac0]
call qword [str.PN_t_]
xor eax, eax
mov rcx, qword [rsp + 0x11a0]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x11b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret