Function at 0x14000d007
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, qword [0x1400b5f80]
movsxd rsi, edx
mov qword [rsp + 0xd0], rcx
test esi, esi
je 0x14000d036
mov rax, qword [rbp]
jmp 0x14000d044
mov rax, qword [0x1400b67d0]
mov rax, qword [rax + 0x530]
mov edx, dword [rbp + 0x10]
mov qword [rsp + 0x70], rax
cmp edx, 0x1ff
ja 0x14000d065
lea rcx, str.Unexpected_sector_size___d____Aborting
call fcn.140038472
jmp 0x14000db6c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
mov r13, qword [0x14011c720]
call r13
test eax, eax
jne 0x14000d08f
lea rcx, str.Warning:_Unable_to_rewind_image_position___wrong_data_might_be_copied_
call fcn.140038472
xor eax, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
or ecx, 0xffffffff
call fcn.140045210
test esi, esi
je 0x14000d457
mov r15, qword [0x1400b6540]
lea rcx, str.Zeroing_drive:
cmp dword [r15], 0
je 0x14000d0c8
lea rcx, str.Fast_zeroing_drive:
call fcn.140038472
mov ecx, dword [rbp + 0x10]
lea rax, [rcx + 0x1ffffff]
mov rbx, rcx
cqo
idiv rcx
mov rdx, rcx
imul ebx, eax
mov eax, ebx
mov ecx, ebx
mov qword [rsp + 0x48], rax
call fcn.14000cc4b
mov r12, rax
test rax, rax
jne 0x14000d11b
lea rcx, str.Could_not_allocate_disk_zeroing_buffer
xor r15d, r15d
xor esi, esi
mov dword [0x1400cfd94], 0xc0030008
call fcn.140038472
jmp 0x14000db05
mov ecx, dword [rbp + 0x10]
xor edx, edx
mov r8d, 0x49f
div rcx
mov r14, rdx
test rdx, rdx
jne 0x14000d801
mov eax, dword [r15]
test eax, eax
je 0x14000d141
mov eax, 0xff
mov rdi, r12
mov ecx, ebx
xor esi, esi
rep stosb byte [rdi], al
cmp dword [r15], 0
je 0x14000d1a1
mov edx, dword [rbp + 0x10]
mov ecx, ebx
call fcn.14000cc4b
mov rsi, rax
test rax, rax
jne 0x14000d17a
lea rcx, str.Could_not_allocate_disk_comparison_buffer
mov dword [0x1400cfd94], 0xc0030008
call fcn.140038472
jmp 0x14000d1d5
mov ecx, dword [rbp + 0x10]
xor edx, edx
div rcx
test rdx, rdx
je 0x14000d1a1
mov r8d, 0x4ab
lea rdx, str.format.c
lea rcx, str._uintptr_t_cmp_buffer___SelectedDrive.SectorSize__0
call qword [sym.imp.msvcrt.dll_memmove]
xor eax, eax
mov dword [rsp + 0x78], ebx
xor edi, edi
xor ebx, ebx
mov dword [rsp + 0x68], eax
jmp 0x14000d241
mov rax, qword [0x1400b6540]
mov edi, dword [rax]
test edi, edi
je 0x14000d346
mov eax, dword [0x1400cfd94]
test eax, eax
jns 0x14000d1dd
cmp ax, 0x4c7
jne 0x14000d1dd
xor r15d, r15d
jmp 0x14000db05
xor eax, eax
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x6c]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xd0]
call qword [0x14011c6d8]
test eax, eax
je 0x14000d2f2
mov edx, dword [rsp + 0x78]
cmp edx, dword [rsp + 0x6c]
jne 0x14000d2f2
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0xfffffffd
jbe 0x14000d318
mov r8d, edx
mov eax, 1
shr r8d, 2
cmp eax, r8d
jb 0x14000d30b
mov dword [rsp + 0x68], edx
xor edi, edi
add rbx, rdx
mov r9, qword [rsp + 0x70]
cmp rbx, r9
jae 0x14000d43f
mov rax, qword [0x1400b6540]
mov edx, 0xcd6
cmp dword [rax], 0
je 0x14000d265
mov edx, 0xcea
xor eax, eax
mov r8, rbx
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.140045210
imul rax, rbx, 0x50
xor edx, edx
div qword [rsp + 0x70]
cmp r14, rax
jae 0x14000d2a9
cmp r14, 0x4f
ja 0x14000d2a9
lea rcx, [0x14008c525]
mov qword [rsp + 0x48], rax
inc r14
call fcn.14003856b
mov rax, qword [rsp + 0x48]
jmp 0x14000d283
mov eax, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov r8, rax
add rax, rbx
cmp rdx, rax
jae 0x14000d2c8
mov r8d, edx
sub r8d, ebx
mov dword [rsp + 0x78], r8d
mov ecx, dword [rbp + 0x10]
mov eax, r8d
xor edx, edx
div ecx
test edx, edx
je 0x14000d2e6
lea eax, [r8 + rcx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [rsp + 0x78], eax
test edi, edi
je 0x14000d1b4
dec edi
jmp 0x14000d346
call fcn.14003893c
lea rcx, str._r_nRead_error:_Could_not_read_data_for_fast_zeroing_comparison____s
mov rdx, rax
call fcn.140038472
jmp 0x14000d1d5
inc rax
cmp ecx, dword [rsi + rax*4 - 4]
je 0x14000d22f
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xd0]
mov rdx, rbx
call r13
test eax, eax
jne 0x14000d341
call fcn.14003893c
lea rcx, str._r_nError:_Could_not_reset_position____s
mov rdx, rax
jmp 0x14000d301
mov edi, 0xf
mov r15d, 4
mov eax, dword [0x1400cfd94]
test eax, eax
jns 0x14000d360
cmp ax, 0x4c7
je 0x14000d1d5
xor eax, eax
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rdx, r12
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xd0]
call qword [0x14011c7d8]
test eax, eax
je 0x14000d3a6
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x68]
cmp r8d, edx
je 0x14000d23e
lea rcx, str._r_nWrite_error:_Wrote__d_bytes__expected__d_bytes
call fcn.140038472
jmp 0x14000d3c8
call fcn.14003893c
mov ecx, dword [rbp + 0x10]
xor edx, edx
mov r8, rax
mov rax, rbx
div rcx
lea rcx, str._r_nWrite_error_at_sector__lld:__s
mov rdx, rax
call fcn.140038472
dec r15d
je 0x14000d423
mov edx, 5
lea rcx, [0x14008c7e4]
call fcn.140038472
mov r10, qword [0x14011c770]
mov ecx, 0x1388
mov qword [rsp + 0x48], r10
call r10
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0xd0]
call r13
mov r10, qword [rsp + 0x48]
test eax, eax
jne 0x14000d432
call fcn.14003893c
lea rcx, [0x14008c7fe]
mov rdx, rax
jmp 0x14000d301
mov dword [0x1400cfd94], 0xc003001d
jmp 0x14000d1d5
mov ecx, 0xc8
call r10
jmp 0x14000d34c
lea rcx, [0x14008c829]
xor r15d, r15d
or rbx, 0xffffffffffffffff
call fcn.14003856b
jmp 0x14000daf1
mov r12, qword [0x1400b67d0]
mov rdi, qword [0x1400b67c0]
mov al, byte [r12 + 0x56c]
lea edx, [rax - 1]
cmp dl, 7
ja 0x14000d66a
lea rcx, str.Writing_compressed_image:
xor r13d, r13d
call fcn.140038472
mov rcx, qword [rdi]
call fcn.14000ccb2
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rsi, rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_DeviceIoControEnumUILanguagesWFindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov r13d, eax
test rsi, rsi
je 0x14000d4d8
mov rcx, rsi
call fcn.1400796c8
mov ecx, r13d
call qword [0x14011c730]
cmp rbx, 0xffffffffffffffff
jne 0x14000d50d
call fcn.14003893c
mov rdx, qword [rdi]
lea rcx, [0x14008c846]
mov r8, rax
call fcn.140038472
mov dword [0x1400cfd94], 0xc003006e
jmp 0x14000d65d
mov ecx, dword [rbp + 0x10]
mov rdx, rcx
call fcn.14000cc4b
mov qword [0x1400cfd68], rax
test rax, rax
jne 0x14000d53f
lea rcx, str.Could_not_allocate_disk_write_buffer
mov dword [0x1400cfd94], 0xc0030008
call fcn.140038472
jmp 0x14000d65d
mov ecx, dword [rbp + 0x10]
xor edx, edx
div rcx
test rdx, rdx
je 0x14000d565
mov r8d, 0x50d
lea rdx, str.format.c
lea rcx, str._uintptr_t_sec_buf___SelectedDrive.SectorSize__0
jmp 0x14000d19b
lea rax, [0x1400cfd94]
xor esi, esi
xor r11d, r11d
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [0x14000ca7f]
mov rdx, qword [fcn.140038472]
lea r9, [0x14000caf6]
mov qword [rsp + 0x28], rsi
mov ecx, 0x40000
mov qword [rsp + 0x20], rax
mov dword [0x1400cfdb0], r11d
call fcn.14004c407
mov rdx, qword [rsp + 0xd0]
mov rcx, rbx
movzx r8d, byte [r12 + 0x56c]
call fcn.14004bed9
mov rsi, rax
call fcn.14004c49e
lea rcx, [0x14008c829]
call fcn.14003856b
test rsi, rsi
js 0x14000d616
cmp dword [0x1400cfdb0], 0
je 0x14000d616
lea rcx, str.Notice:_Compressed_image_data_didnt_end_on_block_boundary.
call fcn.140038472
xor r10d, r10d
mov r8d, dword [rbp + 0x10]
mov rdx, qword [0x1400cfd68]
mov qword [rsp + 0x20], r10
mov rcx, qword [rsp + 0xd0]
lea r9, [rsp + 0x68]
call qword [0x14011c7d8]
mov rcx, qword [0x1400cfd68]
call fcn.14000cca3
xor r9d, r9d
mov qword [0x1400cfd68], r9
test rsi, rsi
jns 0x14000dae9
cmp word [0x1400cfd94], 0x4c7
je 0x14000dae9
mov rdx, rsi
lea rcx, str.Could_not_write_compressed_image:__lld
call fcn.140038472
mov dword [0x1400cfd94], 0xc003001d
xor r15d, r15d
xor esi, esi
xor r12d, r12d
jmp 0x14000db09
mov r8d, 0x523
lea rdx, str.format.c
lea rcx, str.img_report.compression_type___IMG_COMPRESSION_FFU
cmp al, 9
je 0x14000d19b
sub eax, 0xa
mov r13, qword [rdi]
xor r15d, r15d
cmp al, 1
ja 0x14000d6bb
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.140048664
mov r15, rax
test rax, rax
je 0x14000db00
cmp qword [rsp + 0x70], 0
je 0x14000db00
mov r13, rax
mov edx, 1
mov ecx, 0x38
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
jne 0x14000d6e2
mov ecx, 8
call qword [0x14011c730]
jmp 0x14000d7be
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov rcx, r13
mov qword [rbx + 0x28], rax
mov r12, rax
call fcn.14000ccb2
xor r8d, r8d
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov qword [rsp + 0x30], r8
mov r8d, 1
mov dword [rsp + 0x28], 0x48000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.DLL_DeviceIoControEnumUILanguagesWFindFirstVolumeA]
mov r13, rax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov rcx, qword [rsp + 0x48]
mov r14d, eax
test rcx, rcx
je 0x14000d753
call fcn.1400796c8
mov ecx, r14d
call qword [0x14011c730]
mov qword [rbx], r13
inc r13
jne 0x14000d777
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
mov rcx, rbx
call fcn.1400796c8
jmp 0x14000d7be
mov r8d, dword [rbp + 0x10]
lea rax, [r8 + 0x1ffffff]
mov r13, r8
cqo
idiv r8
mov rdx, r8
imul r13d, eax
lea ecx, [r13 + r13]
call fcn.14000cc4b
mov r12, rax
test rax, rax
jne 0x14000d7eb
lea rcx, str.Could_not_allocate_disk_write_buffer
mov dword [0x1400cfd94], 0xc0030008
call fcn.140038472
jmp 0x14000d9e2
call fcn.14003893c
mov rdx, qword [rdi]
xor esi, esi
xor r12d, r12d
mov r8, rax
lea rcx, [0x14008c846]
xor ebx, ebx
call fcn.140038472
mov dword [0x1400cfd94], 0xc003006e
jmp 0x14000db09
mov ecx, dword [rbp + 0x10]
xor edx, edx
div rcx
mov rbp, rdx
test rdx, rdx
je 0x14000d814
mov r8d, 0x53d
lea rdx, str.format.c
lea rcx, str._uintptr_t_buffer___SelectedDrive.SectorSize__0
jmp 0x14000d19b
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
xor edi, edi
call fcn.14000cf83
mov dword [rsp + 0x7c], 1
xor ecx, ecx
mov r9, qword [rsp + 0x70]
mov edx, 0xcbd
mov r8, rdi
mov dword [rsp + 0x20], ecx
mov ecx, 4
call fcn.140045210
imul rax, rdi, 0x50
xor edx, edx
div qword [rsp + 0x70]
cmp rbp, rax
jae 0x14000d87a
cmp rbp, 0x4f
ja 0x14000d87a
lea rcx, [0x14008c525]
mov qword [rsp + 0x48], rax
inc rbp
call fcn.14003856b
mov rax, qword [rsp + 0x48]
jmp 0x14000d854
cmp rdi, qword [rsp + 0x70]
jb 0x14000d894
lea rcx, [0x14008c829]
xor esi, esi
call fcn.14003856b
jmp 0x14000daf1
cmp dword [rbx + 8], 0
jle 0x14000d8ac
mov eax, dword [rbx + 8]
test eax, eax
jne 0x14000d8c1
xor edx, edx
mov dword [rsp + rsi*4 + 0x78], edx
jmp 0x14000d92d
mov rcx, qword [rbx + 0x28]
mov edx, 0x3a98
call qword [0x14011c7c8]
test eax, eax
je 0x14000d89a
jmp 0x14000d92d
cmp dword [rbx + 0x30], 0
je 0x14000d8d4
mov ecx, 0x103
call qword [0x14011c730]
jmp 0x14000d92d
shr eax, 0x1f
movsxd r14, esi
lea rdx, [rbx + 0x10]
mov r9d, 0x1388
mov dword [rsp + 0x20], eax
lea r8, [rsp + r14*4 + 0x78]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_SetThreadUILanguage]
test eax, eax
jne 0x14000d91b
mov rdx, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov qword [rsp + 0x48], rdx
call rdx
cmp eax, 0x26
je 0x14000d950
mov rdx, qword [rsp + 0x48]
call rdx
cmp eax, 0x1b
jne 0x14000d92d
jmp 0x14000d950
mov eax, dword [rsp + r14*4 + 0x78]
mov dword [rbx + 0x30], 1
add qword [rbx + 0x20], rax
jmp 0x14000d950
call fcn.14003893c
lea rcx, str._r_nRead_error:__s
mov rdx, rax
call fcn.140038472
mov dword [0x1400cfd94], 0xc003001e
jmp 0x14000d9e2
mov eax, dword [rsp + r14*4 + 0x78]
mov rdx, qword [rsp + 0x70]
mov r8, rax
add rax, rdi
cmp rdx, rax
jae 0x14000d970
mov r8d, edx
sub r8d, edi
mov dword [rsp + r14*4 + 0x78], r8d
mov rax, qword [0x1400b5f80]
xor edx, edx
mov ecx, dword [rax + 0x10]
mov eax, r8d
div ecx
test edx, edx
je 0x14000d996
lea eax, [r8 + rcx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [rsp + r14*4 + 0x78], eax
lea eax, [rsi + 1]
mov r8d, r13d
mov rcx, rbx
mov r14d, 4
and eax, 1
mov edx, eax
mov dword [rsp + 0x48], eax
imul edx, r13d
add rdx, r12
call fcn.14000cf83
mov eax, esi
imul eax, r13d
add rax, r12
mov qword [rsp + 0x50], rax
jmp 0x14000d9d2
mov ecx, 0xc8
call r10
mov eax, dword [0x1400cfd94]
test eax, eax
jns 0x14000d9e9
cmp ax, 0x4c7
jne 0x14000d9e9
xor esi, esi
jmp 0x14000db09
xor eax, eax
mov r8d, dword [rsp + rsi*4 + 0x78]
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xd0]
call qword [0x14011c7d8]
test eax, eax
je 0x14000da31
mov r8d, dword [rsp + rsi*4 + 0x78]
mov edx, dword [rsp + 0x68]
cmp r8d, edx
je 0x14000dad0
lea rcx, str._r_nWrite_error:_Wrote__d_bytes__expected__d_bytes
call fcn.140038472
jmp 0x14000da5a
call fcn.14003893c
xor edx, edx
mov r8, rax
mov rax, qword [0x1400b5f80]
mov ecx, dword [rax + 0x10]
mov rax, rdi
div rcx
lea rcx, str._r_nWrite_error_at_sector__lld:__s
mov rdx, rax
call fcn.140038472
dec r14d
je 0x14000dac1
mov edx, 5
lea rcx, [0x14008c7e4]
call fcn.140038472
mov r10, qword [0x14011c770]
mov ecx, 0x1388
mov qword [rsp + 0x58], r10
call r10
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0xd0]
call qword [0x14011c720]
mov r10, qword [rsp + 0x58]
test eax, eax
jne 0x14000d9ca
call fcn.14003893c
lea rcx, [0x14008c7fe]
mov rdx, rax
call fcn.140038472
jmp 0x14000d9e2
mov dword [0x1400cfd94], 0xc003001d
jmp 0x14000d9e2
mov eax, r8d
add rdi, rax
test r8d, r8d
je 0x14000d881
movsxd rsi, dword [rsp + 0x48]
jmp 0x14000d82c
xor r15d, r15d
xor esi, esi
xor r12d, r12d
mov rcx, qword [rsp + 0xd0]
call fcn.14000a3ff
jmp 0x14000db09
xor esi, esi
xor r12d, r12d
or rbx, 0xffffffffffffffff
mov rax, qword [0x1400b67d0]
lea rdx, [rbx - 1]
mov al, byte [rax + 0x56c]
dec eax
cmp al, 7
ja 0x14000db31
cmp rdx, 0xfffffffffffffffd
ja 0x14000db51
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x14000db51
cmp rdx, 0xfffffffffffffffd
ja 0x14000db51
mov rcx, qword [rbx]
mov rdi, qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
call rdi
mov rcx, qword [rbx + 0x28]
call rdi
mov rcx, rbx
call fcn.1400796c8
test r15, r15
je 0x14000db5b
call fcn.1400485c0
mov rcx, r12
call fcn.14000cca3
mov rcx, rsi
call fcn.14000cca3
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret