Function at 0x14000f62c
Capabilities:
Inspect section memory permissions
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xa8
mov rax, qword [0x1400b8288]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x7f]
mov r12, rcx
mov r15d, dword [rbp + 0x77]
mov r14d, r9d
mov qword [rbp - 0x49], rcx
mov esi, edx
xor ecx, ecx
mov dword [rbp - 0x4d], r8d
mov dword [rbp - 0x41], edx
mov ebx, ecx
mov qword [rbp - 0x39], rax
mov edi, ecx
mov qword [rbp - 0x31], rcx
lea r13d, [rcx + 1]
mov dword [rbp - 0x51], ecx
mov dword [rbp - 0x55], ecx
mov dword [rbp - 0x59], ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [rbp - 0x39]
xor ecx, ecx
test rax, rax
je 0x14000f6a2
mov dword [rax], ecx
lea r8, [rbp - 0x31]
xor edx, edx
mov rcx, r12
call fcn.14002f2f8
xor r12d, r12d
mov qword [rbp - 0x29], rax
test rax, rax
jne 0x14000f6d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea eax, [r12 + 0xe]
test edi, edi
cmove edi, eax
jmp 0x14001021d
bt r14d, 0xc
jb 0x14000f6ff
cmp word [rax], r12w
je 0x14000f6f5
mov rax, qword [rbp - 0x31]
test rax, rax
je 0x14000f6f5
cmp word [rax], r12w
jne 0x14000f6ff
mov edi, 0x57
jmp 0x14001021d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov r8d, 0x258
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000f738
mov rbx, r12
lea edi, [rax + 0xe]
jmp 0x14001021d
lea rcx, [rax + 4]
xor edx, edx
mov r8d, 0x254
call sub.msvcrt.dll_memset
mov dword [rbx], 0xfeedf001
test esi, esi
jns 0x14000f75b
bts dword [rbx + 0x1ac], 0x1f
mov r12d, esi
mov ecx, r13d
and r12d, 0x40000000
je 0x14000f777
or dword [rbx + 0x1ac], 0xc0000000
mov dword [rbp - 0x55], ecx
mov r8d, 0x20000000
test r8d, esi
je 0x14000f78d
or dword [rbx + 0x1ac], r8d
or r14d, 0x40
mov eax, dword [rbp - 0x4d]
mov r9d, 4
sub eax, r13d
je 0x14000f803
sub eax, r13d
je 0x14000f7f7
sub eax, r13d
je 0x14000f7eb
cmp eax, r13d
je 0x14000f7e2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x140010261
mov dword [rbx + 0x1b4], r9d
jmp 0x14000f809
mov dword [rbx + 0x1b4], 3
jmp 0x14000f809
mov dword [rbx + 0x1b4], 2
jmp 0x14000f809
mov dword [rbx + 0x1b4], ecx
test r14d, 0xdfffcfbd
je 0x14000f81e
mov edi, 0x57
xor esi, esi
jmp 0x14001029a
test r14b, 2
je 0x14000f836
mov rcx, rbx
call fcn.14002e2b4
or eax, 2
mov edx, eax
call fcn.14002e2f0
test r14b, 0x40
je 0x14000f84e
mov rcx, rbx
call fcn.14002e2b4
or eax, 0x40
mov edx, eax
call fcn.14002e2f0
test r8d, r14d
je 0x14000f865
mov rcx, rbx
call fcn.14002e2b4
or eax, r8d
mov edx, eax
call fcn.14002e2f0
bt r14d, 0xd
mov esi, r9d
mov eax, 5
cmovae esi, r15d
cmp esi, 3
jbe 0x14000f884
cmp esi, eax
jbe 0x14000f8ac
cmp esi, 7
jne 0x14000f812
mov rcx, rbx
call fcn.14002e0d0
test rax, rax
je 0x14000f897
mov dword [rax + 0x1bc], esi
bt r14d, 0xc
jae 0x14000f8c5
mov r15, qword [rbp - 0x49]
mov rcx, r15
call fcn.140030840
jmp 0x14000f8d7
mov rcx, rbx
call fcn.14002e0d0
test rax, rax
je 0x14000f897
mov dword [rax + 0x1bc], 7
jmp 0x14000f897
mov rcx, qword [rbp - 0x29]
xor r8d, r8d
xor edx, edx
call fcn.14002f2f8
mov r15, qword [rbp - 0x49]
mov rcx, rbx
mov rdx, rax
call fcn.14002e0d0
test rax, rax
je 0x14000f8ee
mov qword [rax + 0x210], rdx
call fcn.14002e168
test rax, rax
je 0x140010282
or rdx, 0xffffffffffffffff
call fcn.14002e5a8
mov rdx, qword [0x1400bac90]
call fcn.140026d28
test eax, eax
je 0x140010282
mov rcx, rbx
call fcn.14002e568
cmp rax, 0xffffffffffffffff
je 0x140010282
mov eax, dword [rbp - 0x4d]
cmp eax, 3
jne 0x14000f93f
mov dword [rbx + 0x1b4], eax
mov dword [rbp - 0x51], r13d
jmp 0x14000f984
cmp eax, 4
jne 0x14000f975
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
jne 0x14000f975
xor ecx, ecx
mov dword [rbx + 0x1b4], 3
mov dword [rbp - 0x51], r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x14000f984
xor eax, eax
mov dword [rbx + 0x1b4], r13d
mov dword [rbp - 0x51], eax
mov r13d, eax
mov rcx, rbx
call fcn.14002b13c
test eax, eax
je 0x140010282
call fcn.14003101c
mov rcx, rbx
mov qword [rbx + 0x1d0], rax
call fcn.14002e0d0
xor edx, edx
test rax, rax
je 0x14000f9bd
mov rcx, qword [0x1400bac90]
mov qword [rax + 0x230], rcx
mov r8d, 0x200000
mov r9d, 0x20000
test r13d, r13d
je 0x14000fe7b
mov r13d, dword [rbp - 0x55]
mov qword [rbp - 0x49], rdx
test r13d, r13d
jne 0x14000f9eb
lea edx, [r13 + 1]
mov rcx, rbx
call fcn.14002e434
mov rcx, rbx
call fcn.14002e568
mov rcx, rax
lea rdx, [rbp - 0x49]
call fcn.140031b34
xor r8d, r8d
test eax, eax
jne 0x14000fa20
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
mov edi, eax
test eax, eax
lea eax, [r8 + 0xd]
cmove edi, eax
test r13d, r13d
je 0x14000fa4f
test edi, edi
jne 0x14000fc41
mov rcx, rbx
call fcn.14002e2b4
test al, 0x40
je 0x14000fabf
call fcn.14002e568
mov rcx, rax
call fcn.140026bf8
mov dword [rbp - 0x59], eax
jmp 0x14000fac2
mov eax, r8d
mov dword [rbp - 0x59], eax
test edi, edi
je 0x14000fac2
xor esi, esi
test edi, edi
je 0x14000fbcf
mov r12d, dword [rbp - 0x59]
test r12d, r12d
je 0x14000fa7c
mov rcx, rbx
call fcn.14002e568
mov rcx, rax
call fcn.140026cd8
mov r14d, 1
test edi, edi
jne 0x14001029a
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
test dword [rax + 0x10], 0x40000
je 0x14001014c
call fcn.14002e0d0
test rax, rax
je 0x1400101ce
mov dword [rax + 0x1bc], 2
jmp 0x1400101ce
mov eax, dword [rbp - 0x59]
mov edx, eax
mov rcx, rbx
call fcn.140026654
test eax, eax
jne 0x14000fb26
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r9d, ax
mov rcx, rbx
or r9d, 0x80070000
mov edi, eax
test eax, eax
cmovle r9d, eax
call fcn.14002e168
mov r8, rax
mov dword [rsp + 0x30], 0x1a3
xor edx, edx
lea rax, str.WIMCreateFile
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
lea r9, str.Fail_to_read_WIM_header
lea ecx, [rdx + 1]
call fcn.14002aaa0
jmp 0x14000fb3f
mov rcx, rbx
call fcn.14002f1cc
test byte [rax + 0x10], 8
je 0x14000fb3f
test r12d, r12d
mov eax, 5
cmovne edi, eax
test r13d, r13d
je 0x14000fa59
test edi, edi
jne 0x14000fc41
mov rcx, rbx
call fcn.14002e2b4
test al, 0x40
je 0x14000fbcd
call fcn.14002f1cc
test byte [rax + 0x10], 0x40
je 0x14000fbcd
cmp dword [rbp - 0x59], edi
je 0x14000fb7c
mov rcx, rbx
call fcn.14002e568
mov rcx, rax
call fcn.140026cd8
mov edx, 1
mov rcx, rbx
call fcn.14002e434
mov rcx, rbx
call fcn.1400102c0
xor r12d, r12d
mov rcx, r15
mov ebx, r12d
call fcn.140011f8c
mov edi, eax
test eax, eax
jne 0x14001021d
mov rax, qword [rbp - 0x39]
mov r9d, r14d
mov r8d, dword [rbp - 0x4d]
mov rcx, r15
mov edx, dword [rbp - 0x41]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call fcn.14000f62c
jmp 0x140010261
xor esi, esi
mov rcx, rbx
call fcn.140031d60
test eax, eax
je 0x14000fc14
mov rcx, rbx
call fcn.1400324c0
test eax, eax
je 0x14000fc14
cmp dword [rbx + 0x1ac], esi
jge 0x14000fc00
mov rcx, rbx
call fcn.14002706c
test eax, eax
jne 0x14000fc00
lea edi, [rax + 0xd]
jmp 0x14000fc2b
mov rcx, rbx
call fcn.1400273f0
test eax, eax
mov eax, 0xd
cmove edi, eax
jmp 0x14000fc2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14000fc2b
mov edi, 0x570
test r13d, r13d
jne 0x14000fc43
mov r12d, dword [rbp - 0x59]
test edi, edi
jne 0x14000fa67
jmp 0x14000fce6
xor esi, esi
test edi, edi
jne 0x14000fa63
mov rcx, rbx
call fcn.14002e2b4
test al, 0x40
je 0x14000fce2
call fcn.14002f1cc
mov rcx, rbx
mov edx, dword [rax + 0x10]
or edx, 0x40
call fcn.14002f1cc
mov r12d, dword [rbp - 0x59]
mov rcx, rbx
mov dword [rax + 0x10], edx
mov edx, r12d
call fcn.140026af8
test eax, eax
je 0x14000fcac
mov rcx, rbx
call fcn.14002e3e8
or eax, 8
cmp dword [rbx], 0xfeedf002
jne 0x14000fc9c
mov dword [rbx + 0x30], eax
jmp 0x14000fcc4
cmp dword [rbx], 0xfeedf001
jne 0x14000fcc4
mov dword [rbx + 0x1a8], eax
jmp 0x14000fcc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov eax, 0xe
test edi, edi
cmove edi, eax
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov edx, dword [rax + 0x10]
and edx, 0xffffffbf
call fcn.14002f1cc
mov dword [rax + 0x10], edx
jmp 0x14000fc34
mov r12d, dword [rbp - 0x59]
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov rdx, qword [rax + 0x48]
call fcn.14002f1cc
mov rcx, rbx
add rdx, qword [rax + 0x40]
call fcn.14002ef98
mov r8, qword [0x1400bac90]
xor edx, edx
call fcn.14002ef44
mov rcx, rbx
mov rdx, rax
call fcn.14002f1cc
cmp qword [rax + 0x80], rdx
jl 0x14000fd5f
mov rcx, rbx
call fcn.14002f1cc
cmp qword [rax + 0x88], rsi
je 0x14000fd5f
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov rdx, qword [rax + 0x88]
call fcn.14002f1cc
mov rcx, rbx
add rdx, qword [rax + 0x80]
call fcn.14002ef98
mov r8, qword [0x1400bac90]
xor edx, edx
mov rcx, rbx
call fcn.14002ef44
mov rcx, rbx
mov rdx, rax
call fcn.14002f1cc
cmp qword [rax + 0x108], rdx
jl 0x14000fdbb
mov rcx, rbx
call fcn.14002f1cc
cmp qword [rax + 0x110], rsi
je 0x14000fdbb
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov rdx, qword [rax + 0x110]
call fcn.14002f1cc
mov rcx, rbx
add rdx, qword [rax + 0x108]
call fcn.14002ef98
mov r8, qword [0x1400bac90]
xor edx, edx
mov rcx, rbx
call fcn.14002ef44
mov rcx, rbx
mov rdx, rax
call fcn.14002e0d0
test rax, rax
je 0x14000fde3
mov qword [rax + 0x230], rdx
call fcn.14002e3e8
bt eax, 8
jae 0x14000fe02
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov rdx, qword [rax + 0x40]
call fcn.14002ef98
test r13d, r13d
je 0x14000fa67
mov rcx, rbx
mov r8, rsi
call fcn.14002e0d0
test rax, rax
je 0x14000fe22
mov r8, qword [rax + 0x230]
call fcn.14002e568
mov rcx, rax
mov rdx, r8
call fcn.140031a84
mov rcx, rbx
call fcn.14002e568
mov rcx, rax
call fcn.140031bd4
mov r8, qword [0x1400bac90]
xor edx, edx
mov rcx, rbx
call fcn.14002ef44
mov rcx, rbx
mov r8, rax
call fcn.14002e568
mov rcx, rax
mov rdx, r8
call fcn.140031a84
mov edx, FDICreate
mov rcx, rbx
call fcn.14002e434
jmp 0x14000fa67
mov rcx, rbx
call fcn.14002f1cc
movabs rcx, 0x4d4957534d
mov qword [rax], rcx
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov dword [rax + 8], 0xd0
call fcn.14002e2b4
bt eax, 0x1d
jae 0x14000febb
call fcn.14002f1cc
mov dword [rax + 0xc], 0xe00
jmp 0x14000fec7
call fcn.14002f1cc
mov dword [rax + 0xc], 0x10d00
sub esi, 1
je 0x140010033
sub esi, 1
je 0x14000fff3
sub esi, 1
je 0x14000ffb6
sub esi, 1
je 0x14000ff74
sub esi, 1
je 0x14000ff32
cmp esi, 2
jne 0x140010066
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], esi
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], r8d
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x140010025
mov dword [rax + 0x1bc], 7
jmp 0x140010025
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], 2
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], r8d
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x14000ff63
mov dword [rax + 0x1bc], 7
call fcn.14002f1cc
mov dword [rax + 0x14], 0x2000
jmp 0x140010068
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], 2
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], r8d
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x14000ffa5
mov dword [rax + 0x1bc], 7
call fcn.14002f1cc
mov dword [rax + 0x14], 0x1000
jmp 0x140010068
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], 2
call fcn.14002f1cc
mov rcx, rbx
bts dword [rax + 0x10], 0x13
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x14000ffe8
mov dword [rax + 0x1bc], 3
call fcn.14002f1cc
mov dword [rax + 0x14], r9d
jmp 0x140010068
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], 2
call fcn.14002f1cc
mov rcx, rbx
bts dword [rax + 0x10], 0x12
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x140010025
mov dword [rax + 0x1bc], 2
call fcn.14002f1cc
mov dword [rax + 0x14], 0x8000
jmp 0x140010068
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], 2
call fcn.14002f1cc
mov rcx, rbx
or dword [rax + 0x10], r9d
call fcn.14002e0d0
xor esi, esi
test rax, rax
je 0x140010025
mov dword [rax + 0x1bc], 1
jmp 0x140010025
xor esi, esi
xorps xmm0, xmm0
lea rdx, [rbp - 0x21]
mov r8d, FDICreate
lea rcx, str.WIM_Chunk_Size
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rbp - 0x55], eax
dec eax
cmp eax, 0xf
ja 0x1400100c7
lea r8, [rbp - 0x55]
lea rdx, [0x14009e38c]
lea rcx, [rbp - 0x21]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
test eax, eax
jle 0x1400100c7
mov rcx, rbx
call fcn.14002f1cc
mov ecx, dword [rbp - 0x55]
mov dword [rax + 0x14], ecx
mov rcx, rbx
call fcn.14002f1cc
mov r14d, 1
mov rcx, rbx
mov word [rax + 0x2a], r14w
call fcn.14002f1cc
mov rcx, rbx
mov word [rax + 0x28], r14w
call fcn.14002f1cc
lea rcx, [rax + 0x18]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001012a
xor edx, edx
mov rcx, rbx
call fcn.140026af8
test eax, eax
jne 0x14001012a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea eax, [r14 + 0xd]
test edi, edi
cmove edi, eax
mov rcx, rbx
call fcn.14002f1cc
mov rcx, rbx
mov edx, dword [rax + 8]
call fcn.14002ef98
mov edx, FDICreate
call fcn.14002e434
jmp 0x14000fa82
call fcn.14002f1cc
mov rcx, rbx
test dword [rax + 0x10], 0x20000
je 0x140010170
call fcn.14002e0d0
test rax, rax
je 0x1400101ce
mov dword [rax + 0x1bc], r14d
jmp 0x1400101ce
call fcn.14002f1cc
mov rcx, rbx
test dword [rax + 0x10], 0x200000
je 0x140010197
call fcn.14002e0d0
test rax, rax
je 0x1400101ce
mov dword [rax + 0x1bc], 7
jmp 0x1400101ce
call fcn.14002f1cc
mov rcx, rbx
test dword [rax + 0x10], 0x80000
je 0x1400101be
call fcn.14002e0d0
test rax, rax
je 0x1400101ce
mov dword [rax + 0x1bc], 3
jmp 0x1400101ce
call fcn.14002e0d0
test rax, rax
je 0x1400101ce
mov dword [rax + 0x1bc], esi
mov rcx, rbx
call fcn.14002f1cc
cmp dword [rbx], 0xfeedf001
movzx ecx, word [rax + 0x28]
jne 0x1400101e9
mov word [rbx + 0x1c8], cx
mov rcx, rbx
call fcn.14002f1cc
cmp dword [rbx], 0xfeedf001
movzx ecx, word [rax + 0x2a]
jne 0x140010204
mov word [rbx + 0x1ca], cx
mov rdx, rbx
mov rcx, rbx
call fcn.14002ee3c
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x14001021d
mov ecx, dword [rbp - 0x51]
mov dword [rax], ecx
mov rsi, qword [rbp - 0x29]
mov edx, edi
mov rcx, rsi
call fcn.14002acb8
test rsi, rsi
je 0x140010250
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rbx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140096bd0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
xor esi, esi
test eax, eax
je 0x14001020f
mov edx, 1
mov rcx, rbx
call fcn.14002e434
mov rcx, rbx
call fcn.1400102c0
mov rbx, rsi
jmp 0x14001021d