Function at 0x41bab0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2a8
lea rdi, [rsp + 0x40]
mov r15, rdx
xor edx, edx
mov byte [rsp + 0x60], 0
lea rax, [rdi + 0x22]
mov r14, rcx
mov word [rsp + 0x62], dx
xor ecx, ecx
lea r13, [rsp + 0x170]
mov qword [rsp + 0x50], rax
mov rsi, r8
mov r12, r9
lea rax, [0x00840bc0]
mov qword [rsp + 0x48], 0
lea rdx, [r13 + 0x22]
mov qword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x178], 0
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x188], pe_nt_image_headers64
mov byte [rsp + 0x190], 0
mov qword [rsp + 0x170], rax
mov word [rsp + 0x192], cx
call fcn.0043e440
mov dword [rsi], 1
lea r8, [0x008b9100]
mov rcx, rdi
mov rbx, rax
mov dword [r12], 1
lea rdx, str._sinstall64.exe
call fcn.00403810
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x00826970]
call fcn.0043e750
test al, al
jne 0x41bc21
lea rcx, [0x008b9100]
call fcn.0043f300
mov rcx, qword [0x00826910]
lea r8, [0x008b9100]
lea rdx, str.Dir:___S__n
call fcn.0041e020
lea rdx, [0x007f8d96]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rbp, rax
mov r8, qword [rsp + 0x50]
je 0x41bdf0
mov rcx, qword [0x00826910]
lea rdx, str.Created__S_n
call fcn.0041e020
lea rdx, [rsp + 0x30]
mov ecx, 0xd1
lea r8, [rsp + 0x38]
call fcn.0043e680
mov r8, qword [rsp + 0x38]
mov r9, rbp
mov edx, 1
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_fwrite
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rcx, qword [0x00826910]
mov dword [0x008b90e4], 1
call fcn.0041d9f0
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
lea rdx, [0x0041b370]
call qword [rax + 0x10]
mov rbp, qword [0x00826960]
test byte [rbp + 0x1c000], 0x40
je 0x41bdb0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsi]
test eax, eax
je 0x41bddb
test byte [rbp + 0x1c000], 0x40
jne 0x41bca5
cmp eax, 0xe0000235
je 0x41bd14
mov rax, qword [0x00828c70]
mov rax, qword [rax]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov eax, dword [rax + 0x120]
test eax, eax
jne 0x41bd14
mov rax, qword [rbx]
mov rcx, rbx
mov dword [0x008b90e4], 0
call qword [rax + 0x18]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
cmp dword [rsi], 1
je 0x41be10
mov rcx, qword [rsp + 0x178]
lea rbx, [0x008407e0]
mov qword [rsp + 0x170], rbx
test rcx, rcx
je 0x41bceb
call fcn.007da030
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x41bd00
call fcn.007da030
nop
add rsp, 0x2a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9, r15
mov r8, r14
mov rcx, r13
lea rdx, str.__s____s_
call fcn.00403810
lea r8, [0x008b9100]
mov rcx, rdi
lea rdx, str._sinstall64.exe
call fcn.00403810
mov r9, qword [rsp + 0x180]
lea rdx, str._S__S_n
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x00826910]
call fcn.0041e020
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8, qword [rsp + 0x180]
mov rcx, qword [0x00826970]
call fcn.0043f4d0
mov edx, eax
mov dword [rsi], eax
and edx, 0x7fffffff
cmp edx, 1
jne 0x41bca5
shr eax, 0x1f
mov dword [r12], eax
and dword [rsi], 0x7fffffff
jmp 0x41bca5
mov rax, qword [0x00826920]
mov r9d, 1
mov r8, r15
mov rdx, r14
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0x20], r12
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesW
test eax, eax
mov dword [rsi], eax
jne 0x41bc73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x41bc73
mov rcx, qword [0x00826910]
lea rdx, str.Failed_to_create__S_n
call fcn.0041e020
jmp 0x41bc21
mov rcx, r14
call fcn.004022f0
jmp 0x41bcca