Function at 0x1400696f0
Capabilities:
Get common file path
Link many functions at runtime
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov qword [rsp + 0x68], rcx
mov rbx, r8
mov dword [rsp + 0x50], esi
mov r13d, edx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
mov r14d, esi
mov r15d, esi
mov r12, r9
call fcn.140136540
mov rcx, rbp
call fcn.140067550
mov rcx, rbx
mov qword [rsp + 0x58], rax
call fcn.140067550
mov rcx, r12
mov qword [rsp + 0x40], rax
call fcn.140067550
cmp qword [0x1401e5b98], rsi
mov qword [rsp + 0x48], rax
jne 0x1400697c6
call fcn.140067350
mov rcx, rax
lea rdx, str.WIMCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5b98], rax
test rax, rax
jne 0x1400697c6
call fcn.14004fba0
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMCreateFile
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a66
cmp qword [0x1401e5c80], rsi
jne 0x140069821
call fcn.140067350
mov rcx, rax
lea rdx, str.WIMSetTemporaryPath
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5c80], rax
test rax, rax
jne 0x140069821
call fcn.14004fba0
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMSetTemporaryPath
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a66
cmp qword [0x1401e5750], rsi
jne 0x14006987c
call fcn.140067350
mov rcx, rax
lea rdx, str.WIMLoadImage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5750], rax
test rax, rax
jne 0x14006987c
call fcn.14004fba0
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMLoadImage
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a66
cmp qword [0x1401e5968], rsi
jne 0x1400698d7
call fcn.140067350
mov rcx, rax
lea rdx, str.WIMExtractImagePath
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5968], rax
test rax, rax
jne 0x1400698d7
call fcn.14004fba0
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMExtractImagePath
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a66
cmp qword [0x1401e5c90], rsi
jne 0x140069932
call fcn.140067350
mov rcx, rax
lea rdx, str.WIMCloseHandle
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e5c90], rax
test rax, rax
jne 0x140069932
call fcn.14004fba0
mov r9, rax
lea r8, str.Wimgapi
lea rdx, str.WIMCloseHandle
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a66
mov qword [rsp + 0x298], rdi
mov edi, dword [rsp + 0x300]
test edi, edi
jne 0x140069957
mov r8d, r13d
lea rcx, str.Opening:__s:__d___API_
mov rdx, rbp
call fcn.14004f2f0
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14006998e
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_fetch_temp_path:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a5e
cmp dword [0x1401e8f48], 0xe0000
mov r9d, esi
mov rcx, qword [rsp + 0x58]
mov eax, 0x20000000
cmovae r9d, eax
mov qword [rsp + 0x28], rsi
mov edx, 0x80000000
mov dword [rsp + 0x20], esi
mov r8d, 3
call qword [0x1401e5b98]
mov rbp, rax
test rax, rax
jne 0x1400699eb
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_access_image:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
jmp 0x140069a5e
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [0x1401e5c80]
test eax, eax
jne 0x140069aa5
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_set_temp_path:__s
call fcn.14004f2f0
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
test edi, edi
jne 0x140069a34
mov rdx, qword [rsp + 0x68]
lea rcx, str.Closing:__s
call fcn.14004f2f0
test r14, r14
je 0x140069a42
mov rcx, r14
call qword [0x1401e5c90]
mov rcx, rbp
call qword [0x1401e5c90]
lea rcx, [r15 - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140069a5e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x58]
call fcn.1400e8c70
mov rcx, r12
call fcn.1400e8c70
mov rcx, rbx
call fcn.1400e8c70
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
test edi, edi
jne 0x140069abb
mov r8, rbx
lea rcx, str.Extracting:__s__From__s_
mov rdx, r12
call fcn.14004f2f0
test rbx, rbx
lea rax, str._NULL_
mov rcx, rsi
lea rdx, str._1_.xml
cmove rbx, rax
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140069ba8
cmp rcx, 8
jne 0x140069ad3
lea r8, [rsp + 0x50]
mov rcx, rbp
lea rdx, [rsp + 0x60]
call qword [0x1401e5c60]
test eax, eax
je 0x140069b94
cmp dword [rsp + 0x50], esi
je 0x140069b94
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov r8d, 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140069b6e
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069c11
test edi, edi
jne 0x140069a1a
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_extract_file:__s
call fcn.14004f2f0
mov r12, qword [rsp + 0x40]
jmp 0x140069a23
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_access_WIM_info:__s
jmp 0x140069a10
mov edx, r13d
mov rcx, rbp
call qword [0x1401e5750]
mov r14, rax
test rax, rax
jne 0x140069bd0
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_set_index:__s
jmp 0x140069a10
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
mov r12, qword [rsp + 0x40]
mov r8, rbx
mov rdx, r12
mov rcx, rax
call qword [0x1401e5968]
test eax, eax
jne 0x140069c16
test edi, edi
jne 0x140069a34
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_extract_file:__s
call fcn.14004f2f0
jmp 0x140069a1f
mov r12, qword [rsp + 0x40]
mov esi, 1
jmp 0x140069a1f