Function at 0x140006488
Capabilities:
Access peb ldr_data
Check if file exists
Check mutex on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4098]
mov eax, 0x4170
call fcn.140040840
sub rsp, rax
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rbp + 0x4060], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
movzx edx, word [rcx + 0x118]
movzx eax, word [rcx + 0x11c]
shl edx, 0x10
or edx, eax
cmp edx, 0x60001
jb 0x140006b1c
cmp edx, 0x60002
je 0x140006b1c
call fcn.140006434
mov r14, rax
test rax, rax
jne 0x140006517
call fcn.14001b570
mov r15d, eax
jmp 0x140006b17
call fcn.140001b5c
test rax, rax
je 0x140006b51
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140001b5c
test rax, rax
je 0x140006b51
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x68], rax
call fcn.140004db4
or edi, 0xffffffff
mov r15d, eax
test eax, eax
jne 0x140006ac6
lea rcx, str.wimgapi.dll
call fcn.14001b83c
mov rbx, rax
test rax, rax
jne 0x140006595
call fcn.14001b570
mov r15d, eax
jmp 0x140006aae
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
and dword [rsp + 0x40], 0
call fcn.140005088
mov r15d, eax
test eax, eax
jne 0x140006aae
cmp dword [rsp + 0x40], eax
jne 0x140006aae
lea r8, str.GlobalwimMaker
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
test rax, rax
jne 0x1400065f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov r15d, 0x65b
cmovne r15d, eax
jmp 0x140006a96
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140006609
mov r15d, 0x8007008e
jmp 0x140006a96
lea rdx, str.WIMMountImage
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WIMUnmountImage
mov rcx, rbx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x140006a90
test rax, rax
je 0x140006a90
mov r8d, 0x3fb4
mov dword [rbp + 0xa0], 0x4643534d
lea rdx, [0x14005f660]
lea rcx, [rbp + 0xa4]
call sub.msvcrt.dll_memcpy
lea rax, [rbp + 0xa0]
mov dword [rbp - 0x70], 0x3fb8
xorps xmm0, xmm0
mov qword [rbp - 0x6c], rax
movdqu xmmword [rsp + 0x50], xmm0
call fcn.140011690
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
call fcn.14001e25c
lea r8, [rsp + 0x50]
mov rcx, qword [rax]
call fcn.14001e090
mov rdx, qword [rsp + 0x70]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1400066c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
and qword [rbp + 0x98], 0
lea rax, fcn.140012a30
mov qword [rbp - 0x60], rax
lea rdx, [rbp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x28], rax
call fcn.140012a30
mov rcx, qword [rbp - 0x28]
mov qword [rbp + 0x98], rax
test rcx, rcx
je 0x140006714
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
lea rdx, [0x14005b048]
lea rcx, [rsp + 0x60]
call fcn.1400018d0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.14001014c
mov rdx, qword [rsp + 0x60]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140006758
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x78]
cmp rdi, qword [rsp + 0x50]
jne 0x140006772
mov r15d, 0x80004001
or edi, 0xffffffff
jmp 0x140006a3b
call fcn.140001b5c
test rax, rax
je 0x140006b51
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rsp + 0x30]
lea rcx, str._SystemDrive_360SysRt360ldMount_
mov qword [rsp + 0x30], rax
call fcn.14001bdc4
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
jne 0x1400067b6
mov r15d, 0x80004005
jmp 0x1400067ea
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400067f2
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call r12
test eax, eax
jne 0x1400067f2
mov rcx, qword [rsp + 0x30]
call fcn.14001d8e4
mov r15d, eax
test eax, eax
je 0x1400067f2
or edi, 0xffffffff
jmp 0x140006a1c
call fcn.140001b5c
test rax, rax
je 0x140006b51
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.14001b988
mov r15d, eax
test eax, eax
jne 0x1400069fa
mov rcx, qword [rsp + 0x30]
call fcn.14001b414
mov r15d, eax
test eax, eax
jne 0x1400069fa
and qword [rbp + 0x58], 0
lea rax, fcn.140012a10
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x20]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
mov qword [rbp + 0x18], rax
call fcn.140012a10
mov rcx, qword [rbp + 0x18]
mov qword [rbp + 0x58], rax
test rcx, rcx
je 0x140006887
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r9, qword [rsp + 0x48]
mov r8d, 1
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call r13
test eax, eax
je 0x1400069c1
lea r8, str.WindowsSystem32NativeDism.exe
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.140010bd8
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rax]
mov r8d, dword [rdx]
mov rdx, qword [rdx + 4]
call fcn.14001bec4
mov rdx, qword [rbp - 0x80]
mov edi, eax
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x1400068f6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test edi, edi
jne 0x140006993
lea r8, str.WindowsSystem32configSYSTEM
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x78]
call fcn.140010bd8
mov r13, 0xffffffff80000003
lea rdx, str.WinRE_SYSTEM
mov rcx, r13
mov r8, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov rdx, qword [rbp - 0x78]
mov edi, eax
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14000694f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test edi, edi
jne 0x140006993
lea rax, str.NativeDism_NativeDism_
mov dword [rsp + 0x28], 0x32
lea r9d, [rdi + 7]
mov qword [rsp + 0x20], rax
lea r8, str.BootExecute
mov rcx, r13
lea rdx, str.WinRE_SYSTEMControlSet001ControlSession_Manager
call fcn.14001c514
lea rdx, str.WinRE_SYSTEM
mov rcx, r13
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
test edi, edi
mov r8d, 1
sete r9b
call r12
test eax, eax
je 0x1400069c1
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140005088
jmp 0x1400069c6
call fcn.14001b570
mov rcx, qword [rbp + 0x58]
mov r15d, eax
test rcx, rcx
je 0x140006b5c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400069fa
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
and qword [rbp + 0x58], 0
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140006a1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x30]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140006a3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140006b5c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140006a75
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
and qword [rbp + 0x98], 0
lea rcx, [rsp + 0x50]
call fcn.14001118c
mov rcx, qword [rsp + 0x50]
mov edx, 0x30
call fcn.14003b3dc
jmp 0x140006a96
mov r15d, 0x80004002
test rsi, rsi
je 0x140006aae
mov rcx, rsi
call qword [fcn.140037368]
test eax, eax
jne 0x140006aae
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x140006ac6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x140006ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x68]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140006ae5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x38]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140006b04
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r14
call qword [fcn.140037368]
test eax, eax
jne 0x140006b17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, r15d
jmp 0x140006b21
mov eax, 0x80004001
mov rcx, qword [rbp + 0x4060]
xor rcx, rsp
call fcn.1400408d0
lea r11, [rsp + 0x4170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002198
int3
call fcn.1400398f8
int3