Function at 0x14001f720
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x6c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rsi, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rdx
mov byte [0x140c45676], 0
test r8, r8
je 0x14001f833
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x14001f7a3
lea rcx, str.ProgressCallBack_is_bad_
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45678], r12
test rsi, rsi
je 0x14001f7ea
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x14001f7e3
lea rcx, str.StartApplyCallback_is_bad_
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45880], rsi
xor r8d, r8d
lea rdx, [0x140021510]
xor ecx, ecx
call sub.WIMGAPI.DLL_WIMRegisterMessageCallback
cmp eax, 0xffffffff
jne 0x14001f8bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RegisterMessageCallback_is_falid__ErrorCode:_d
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
test r9, r9
je 0x14001f8bc
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x14001f870
lea rcx, str.StartApplyCallback_is_bad_
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45880], rsi
xor r8d, r8d
lea rdx, [0x140021510]
xor ecx, ecx
call sub.WIMGAPI.DLL_WIMRegisterMessageCallback
cmp eax, 0xffffffff
jne 0x14001f8bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RegisterMessageCallback_is_falid__ErrorCode:_d
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [0x140c45888], rbp
cmp qword [rbx + 0x20], 8
jb 0x14001f8d6
mov rcx, qword [rbx + 8]
jmp 0x14001f8da
lea rcx, [rbx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov edx, 0x80000000
mov r9d, 2
lea r8d, [r9 + 1]
call sub.WIMGAPI.DLL_WIMCreateFile
mov rsi, rax
test rax, rax
jne 0x14001f933
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_is_falid__ErrorCode:_d
call fcn.140021570
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45888], rax
mov word [rsp + 0x80], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call sub.ntdll.dll_memset
xor r11d, r11d
mov qword [rsp + 0x288], r11
mov qword [rsp + 0x290], r11
mov qword [rsp + 0x298], r11
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_672], r11
mov qword [rsp + 0x2a8], r11
mov r8d, Ordinal_563
lea rdx, [rsp + 0x80]
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMGetAttributes
test eax, eax
jne 0x14001f9d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetAttributes_is_falid__ErrorCode:_d
call fcn.140021570
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
cmp dword [rsp + 0x298], ebp
ja 0x14001f9f6
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov word [rsp + 0x2b0], bp
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
lea rcx, [rsp + 0x2b2]
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov edx, 0x400
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x40]
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
cmp qword [rsp + 0x58], 0
jne 0x14001fa90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetSystemDirectory_falid__ErrorCode:_d
call fcn.140021570
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
lea rdx, str.Temp
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMSetTemporaryPath
test eax, eax
jne 0x14001fb1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetTemporaryPath_is_falid__ErrorCode:_d
call fcn.140021570
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45890], rbp
mov edx, dword [rsp + 0x710]
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMLoadImage
mov rbp, rax
test rax, rax
jne 0x14001fb7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LoadImage_is_falid__ErrorCode:_d
call fcn.140021570
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
mov qword [0x140c45890], rax
cmp qword [rdi + 0x20], 8
jb 0x14001fb90
mov rdx, qword [rdi + 8]
jmp 0x14001fb94
lea rdx, [rdi + 8]
xor r8d, r8d
mov rcx, rax
call sub.WIMGAPI.DLL_WIMApplyImage
test eax, eax
jne 0x14001fbeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ApplyImage_is_falid__ErrorCode:_d
call fcn.140021570
mov rcx, rbp
call sub.WIMGAPI.DLL_WIMCloseHandle
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x14001fc31
test r12, r12
je 0x14001fbff
lea rdx, [0x140021510]
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMUnregisterMessageCallback
mov rcx, rbp
call sub.WIMGAPI.DLL_WIMCloseHandle
mov rcx, rsi
call sub.WIMGAPI.DLL_WIMCloseHandle
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140161080
add rsp, 0x6c0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret