Function at 0x14001cbd8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x20], 0xfffffffffffffffe
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x14001cc26
test byte [rcx + 0x1c], 4
je 0x14001cc26
mov edx, 0xa
lea r8, [0x1400504a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012d0
and qword [rbp + 0x60], 0
and dword [rbp + 0x58], 0
and dword [rbp + 0x50], 0
and qword [rbp - 0x38], 0
and dword [rbp + 0x48], 0
lea rdx, str.dismapi.dll
lea rcx, [rbp + 0x60]
call fcn.14002da5c
mov edi, eax
mov rbx, qword [rbp + 0x60]
test eax, eax
js 0x14001ce23
lea rdx, str.DismInitialize
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x14001cc84
xor edx, edx
lea rcx, str.DismInitialize
call fcn.140030534
mov edi, eax
jmp 0x14001cc86
xor edi, edi
test edi, edi
js 0x14001ce23
lea rdx, str.DismShutdown
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x14001ccb9
xor edx, edx
lea rcx, str.DismShutdown
call fcn.140030534
mov edi, eax
jmp 0x14001ccbb
xor edi, edi
test edi, edi
js 0x14001ce23
lea rdx, str.DismOpenSession
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x14001cced
xor edx, edx
lea rcx, str.DismOpenSession
call fcn.140030534
mov edi, eax
jmp 0x14001ccef
xor edi, edi
test edi, edi
js 0x14001ce23
lea rdx, str.DismCloseSession
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
jne 0x14001cd21
xor edx, edx
lea rcx, str.DismCloseSession
call fcn.140030534
mov edi, eax
jmp 0x14001cd23
xor edi, edi
test edi, edi
js 0x14001ce23
lea rdx, str.DismGetFeatures
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14001cd55
xor edx, edx
lea rcx, str.DismGetFeatures
call fcn.140030534
mov edi, eax
jmp 0x14001cd57
xor edi, edi
test edi, edi
js 0x14001ce23
lea rdx, str.DismDelete
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x14001cd89
xor edx, edx
lea rcx, str.DismDelete
call fcn.140030534
mov edi, eax
jmp 0x14001cd8b
xor edi, edi
test edi, edi
js 0x14001ce23
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
mov rax, r15
call qword [0x14003b4b0]
mov edi, eax
test eax, eax
jns 0x14001ce44
mov rax, qword [0x140060048]
lea rcx, [0x140060048]
cmp rax, rcx
je 0x14001cded
test byte [rax + 0x1c], 1
je 0x14001cded
lfence
mov edx, 0xb
mov r9d, edi
lea r8, [0x1400504a8]
mov rcx, qword [0x140060048]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
mov rbx, qword [rbp + 0x60]
mov r15d, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14001ce03
mov rax, r12
call qword [0x14003b4b0]
mov ecx, dword [rbp + 0x58]
test ecx, ecx
je 0x14001ce13
mov rax, r13
call qword [0x14003b4b0]
test r15d, r15d
je 0x14001ce23
mov rax, qword [rbp - 0x28]
call qword [0x14003b4b0]
nop
test rbx, rbx
je 0x14001ce31
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r15d, 1
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, str.DISM_53BFAE52_B167_4E2F_A258_0A37B57FF845
mov rax, r14
call qword [0x14003b4b0]
mov edi, eax
test eax, eax
jns 0x14001ceb4
mov rax, qword [0x140060048]
lea rcx, [0x140060048]
cmp rax, rcx
je 0x14001cdf1
test byte [rax + 0x1c], r15b
je 0x14001cdf1
lea edx, [r15 + 0xb]
lfence
mov r9d, edi
lea r8, [0x1400504a8]
mov rcx, qword [0x140060048]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
mov rbx, qword [rbp + 0x60]
jmp 0x14001cdf1
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
mov ecx, dword [rbp + 0x58]
mov rax, rsi
call qword [0x14003b4b0]
mov edi, eax
test eax, eax
jns 0x14001cf00
mov rax, qword [0x140060048]
lea rcx, [0x140060048]
cmp rax, rcx
je 0x14001cdf1
test byte [rax + 0x1c], r15b
je 0x14001cdf1
mov edx, 0xd
jmp 0x14001ce8e
xor esi, esi
mov ecx, dword [rbp + 0x48]
test ecx, ecx
je 0x14001cf28
mov rdx, qword [rbp - 0x38]
add rdx, 8
mov r8d, ecx
lea eax, [rsi + 1]
cmp dword [rdx], 4
cmovne eax, esi
mov esi, eax
lea rdx, [rdx + 0xc]
sub r8, r15
jne 0x14001cf14
and qword [rbp - 0x30], 0
mov eax, esi
shl eax, 3
mov r14d, eax
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.14001cfbc
mov edi, eax
test eax, eax
jns 0x14001cf5d
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14001cdf1
call fcn.140034674
jmp 0x14001cdf1
mov r8, r14
xor edx, edx
mov rdi, qword [rbp - 0x30]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, esi
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdi
xor r9d, r9d
mov rdx, qword [rbp - 0x38]
xor r8d, r8d
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x14001cfa8
cmp dword [rdx + 8], 4
jne 0x14001cf9c
mov rax, qword [rdx]
mov qword [rdi + r9*8], rax
inc r9d
mov eax, dword [rbp + 0x48]
add rdx, 0xc
inc r8d
cmp r8d, eax
jb 0x14001cf89
lea rcx, [rbp - 0x18]
call fcn.140027048
mov edi, eax
mov rcx, qword [rbp - 0x10]
jmp 0x14001cf4a