Function at 0x14004765e
Capabilities:
Get common file path
Link many functions at runtime
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
xor eax, eax
mov ebp, dword [rsp + 0x2f0]
mov rsi, rcx
lea rdi, [rsp + 0x78]
mov ecx, 0x82
mov rbx, r8
rep stosd dword [rdi], eax
mov r13, r9
mov rcx, rsi
xor r9d, r9d
mov dword [rsp + 0x6c], r9d
mov r12d, edx
lea rdi, [rsp + 0x78]
call fcn.140045e79
mov rcx, rbx
mov qword [rsp + 0x50], rax
call fcn.140045e79
mov rcx, r13
mov qword [rsp + 0x58], rax
call fcn.140045e79
cmp qword [0x1401181c8], 0
mov qword [rsp + 0x48], rax
jne 0x140047725
lea r15, str.Wimgapi
lea r14, str.WIMCreateFile
mov rcx, r15
call fcn.140045a56
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1401181c8], rax
test rax, rax
jne 0x140047725
call fcn.140038579
mov r8, r15
mov rdx, r14
lea rcx, [0x1400a5704]
mov r9, rax
call fcn.1400380b9
xor ebx, ebx
xor r12d, r12d
xor r14d, r14d
jmp 0x1400479ea
cmp qword [0x1401181c0], 0
jne 0x14004775d
lea r15, str.Wimgapi
lea r14, str.WIMSetTemporaryPath
mov rcx, r15
call fcn.140045a56
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1401181c0], rax
test rax, rax
je 0x1400476fe
cmp qword [0x1401181b8], 0
jne 0x140047799
lea r15, str.Wimgapi
lea r14, str.WIMLoadImage
mov rcx, r15
call fcn.140045a56
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1401181b8], rax
test rax, rax
je 0x1400476fe
cmp qword [0x140118198], 0
jne 0x1400477d5
lea r15, str.Wimgapi
lea r14, str.WIMExtractImagePath
mov rcx, r15
call fcn.140045a56
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140118198], rax
test rax, rax
je 0x1400476fe
cmp qword [0x140118188], 0
jne 0x140047811
lea r15, str.Wimgapi
lea r14, str.WIMCloseHandle
mov rcx, r15
call fcn.140045a56
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140118188], rax
test rax, rax
je 0x1400476fe
test ebp, ebp
jne 0x140047827
mov r8d, r12d
mov rdx, rsi
lea rcx, str.Opening:__s:__d___API_
call fcn.1400380b9
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x14004784a
call fcn.140038579
lea rcx, str.__Could_not_fetch_temp_path:__s
mov rdx, rax
jmp 0x1400478a2
mov rax, qword [0x1400b4c60]
xor r9d, r9d
mov edx, 0x80000000
cmp dword [rax + 0x550], 0xdffff
seta r9b
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x28], rcx
shl r9d, 0x1d
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], r8d
mov r8d, 3
call qword [0x1401181c8]
mov r14, rax
test rax, rax
jne 0x1400478ac
call fcn.140038579
lea rcx, str.__Could_not_access_image:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140047718
mov rdx, rdi
mov rcx, rax
call qword [0x1401181c0]
mov edi, eax
test eax, eax
jne 0x1400478cf
call fcn.140038579
lea rcx, str.__Could_not_set_temp_path:__s
mov rdx, rax
jmp 0x140047937
test ebp, ebp
jne 0x1400478e5
mov r8, rbx
mov rdx, r13
lea rcx, str.Extracting:__s__From__s_
call fcn.1400380b9
test rbx, rbx
je 0x1400479c0
lea rdx, [0x1400a5f46]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
mov edi, eax
test eax, eax
jne 0x1400479c0
lea r12, [rsp + 0x6c]
lea rdx, [rsp + 0x70]
mov rcx, r14
mov r8, r12
call qword [0x140118190]
test eax, eax
je 0x140047928
cmp dword [rsp + 0x6c], 0
jne 0x140047940
call fcn.140038579
lea rcx, str.__Could_not_access_WIM_info:__s
mov rdx, rax
call fcn.1400380b9
xor ebx, ebx
jmp 0x1400479bb
xor edx, edx
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], rdx
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140047995
test ebp, ebp
jne 0x1400479bb
call fcn.140038579
lea rcx, str.__Could_not_extract_file:__s
xor edi, edi
mov rdx, rax
call fcn.1400380b9
jmp 0x1400479bb
xor eax, eax
mov r9, r12
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rcx, rbx
xor r12d, r12d
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140047a26
jmp 0x140047979
xor r12d, r12d
jmp 0x140047a2b
mov edx, r12d
mov rcx, r14
call qword [0x1401181b8]
mov r12, rax
test rax, rax
jne 0x1400479ee
call fcn.140038579
lea rcx, str.__Could_not_set_index:__s
xor ebx, ebx
mov rdx, rax
call fcn.1400380b9
xor edi, edi
jmp 0x140047a2b
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
xor r9d, r9d
mov rcx, rax
call qword [0x140118198]
xor ebx, ebx
mov edi, eax
test eax, eax
jne 0x140047a26
test ebp, ebp
jne 0x140047a2b
call fcn.140038579
lea rcx, str.__Could_not_extract_file:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140047a2b
mov edi, 1
mov rax, r14
or rax, r12
je 0x140047a67
test ebp, ebp
jne 0x140047a46
mov rdx, rsi
lea rcx, str.Closing:__s
call fcn.1400380b9
mov rax, qword [0x140118188]
test r12, r12
jne 0x140047a5d
mov rcx, r14
call qword [0x140118188]
jmp 0x140047a67
mov rcx, r12
call rax
test r14, r14
jne 0x140047a52
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140047a7a
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret