Function at 0x140069fc0
Capabilities:
Get common file path
Link many functions at runtime
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov qword [rsp + 0x68], rcx
mov rbx, r8
mov dword [rsp + 0x50], esi
mov r13d, edx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
mov r14d, esi
mov r15d, esi
mov r12, r9
call fcn.140136960
mov rcx, rbp
call fcn.140067e00
mov rcx, rbx
mov qword [rsp + 0x58], rax
call fcn.140067e00
mov rcx, r12
mov qword [rsp + 0x40], rax
call fcn.140067e00
cmp qword [0x1401e5bf8], rsi
mov qword [rsp + 0x48], rax
jne 0x14006a09d
lea rcx, str.Wimgapi
call fcn.140067bf0
mov rcx, rax
lea rdx, str.WIMCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5bf8], rax
test rax, rax
jne 0x14006a09d
call fcn.140050120
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMCreateFile
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a359
cmp qword [0x1401e5d00], rsi
jne 0x14006a0ff
lea rcx, str.Wimgapi
call fcn.140067bf0
mov rcx, rax
lea rdx, str.WIMSetTemporaryPath
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5d00], rax
test rax, rax
jne 0x14006a0ff
call fcn.140050120
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMSetTemporaryPath
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a359
cmp qword [0x1401e57a8], rsi
jne 0x14006a161
lea rcx, str.Wimgapi
call fcn.140067bf0
mov rcx, rax
lea rdx, str.WIMLoadImage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e57a8], rax
test rax, rax
jne 0x14006a161
call fcn.140050120
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMLoadImage
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a359
cmp qword [0x1401e59b8], rsi
jne 0x14006a1c3
lea rcx, str.Wimgapi
call fcn.140067bf0
mov rcx, rax
lea rdx, str.WIMExtractImagePath
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e59b8], rax
test rax, rax
jne 0x14006a1c3
call fcn.140050120
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMExtractImagePath
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a359
cmp qword [0x1401e5d10], rsi
jne 0x14006a225
lea rcx, str.Wimgapi
call fcn.140067bf0
mov rcx, rax
lea rdx, str.WIMCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5d10], rax
test rax, rax
jne 0x14006a225
call fcn.140050120
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMCloseHandle
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a359
mov qword [rsp + 0x298], rdi
mov edi, dword [rsp + 0x300]
test edi, edi
jne 0x14006a24a
mov r8d, r13d
lea rcx, str.Opening:__s:__d___API_
mov rdx, rbp
call fcn.14004f910
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14006a281
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_fetch_temp_path:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a351
cmp dword [0x1401e8fc8], 0xe0000
mov r9d, esi
mov rcx, qword [rsp + 0x58]
mov eax, 0x20000000
cmovae r9d, eax
mov qword [rsp + 0x28], rsi
mov edx, 0x80000000
mov dword [rsp + 0x20], esi
mov r8d, 3
call qword [0x1401e5bf8]
mov rbp, rax
test rax, rax
jne 0x14006a2de
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_access_image:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x14006a351
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [0x1401e5d00]
test eax, eax
jne 0x14006a398
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_set_temp_path:__s
call fcn.14004f910
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
test edi, edi
jne 0x14006a327
mov rdx, qword [rsp + 0x68]
lea rcx, str.Closing:__s
call fcn.14004f910
test r14, r14
je 0x14006a335
mov rcx, r14
call qword [0x1401e5d10]
mov rcx, rbp
call qword [0x1401e5d10]
lea rcx, [r15 - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14006a351
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x58]
call fcn.1400e9080
mov rcx, r12
call fcn.1400e9080
mov rcx, rbx
call fcn.1400e9080
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
test edi, edi
jne 0x14006a3ae
mov r8, rbx
lea rcx, str.Extracting:__s__From__s_
mov rdx, r12
call fcn.14004f910
test rbx, rbx
lea rax, str._NULL_
mov rcx, rsi
lea rdx, str._1_.xml
cmove rbx, rax
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14006a4a3
cmp rcx, 8
jne 0x14006a3d0
lea r8, [rsp + 0x50]
mov rcx, rbp
lea rdx, [rsp + 0x60]
call qword [0x1401e5ce0]
test eax, eax
je 0x14006a48f
cmp dword [rsp + 0x50], esi
je 0x14006a48f
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14006a469
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006a50c
test edi, edi
jne 0x14006a30d
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_extract_file:__s
call fcn.14004f910
mov r12, qword [rsp + 0x40]
jmp 0x14006a316
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_access_WIM_info:__s
jmp 0x14006a303
mov edx, r13d
mov rcx, rbp
call qword [0x1401e57a8]
mov r14, rax
test rax, rax
jne 0x14006a4cb
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_set_index:__s
jmp 0x14006a303
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
mov r12, qword [rsp + 0x40]
mov r8, rbx
mov rdx, r12
mov rcx, rax
call qword [0x1401e59b8]
test eax, eax
jne 0x14006a511
test edi, edi
jne 0x14006a327
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_extract_file:__s
call fcn.14004f910
jmp 0x14006a312
mov r12, qword [rsp + 0x40]
mov esi, 1
jmp 0x14006a312