Function at 0x140048163
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
xor r11d, r11d
mov r8, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
mov r13d, edx
rep stosd dword [rdi], eax
mov rcx, r8
mov dword [rsp + 0x6c], r11d
lea r14, [rsp + 0x7c]
call fcn.14004604d
cmp qword [0x1401195e8], 0
mov qword [rsp + 0x50], rax
jne 0x1400481dc
lea rbx, str.Wimgapi
lea rsi, str.WIMCreateFile
mov rcx, rbx
call fcn.140045e22
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x1401195e8], rax
test rax, rax
je 0x14004824c
cmp qword [0x1401195b0], 0
jne 0x140048214
lea rbx, str.Wimgapi
lea rsi, str.WIMGetImageInformation
mov rcx, rbx
call fcn.140045e22
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x1401195b0], rax
test rax, rax
je 0x14004824c
cmp qword [0x1401195a8], 0
jne 0x14004826d
lea rbx, str.Wimgapi
lea rsi, str.WIMCloseHandle
mov rcx, rbx
call fcn.140045e22
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x1401195a8], rax
test rax, rax
jne 0x14004826d
call fcn.14003893c
mov r8, rbx
mov rdx, rsi
lea rcx, [0x1400a7184]
mov r9, rax
call fcn.140038472
xor esi, esi
jmp 0x1400484e0
test r13d, r13d
je 0x140048266
mov rax, qword [0x1400b67d0]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
mov edx, 0x80000000
cmp dword [rax + 0x548], 0xdffff
seta r9b
xor r8d, r8d
xor r10d, r10d
mov qword [rsp + 0x28], r8
shl r9d, 0x1d
mov r8d, 3
mov dword [rsp + 0x20], r10d
call qword [0x1401195e8]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400482d4
call fcn.14003893c
lea rcx, str.__Could_not_access_image:__s
mov rdx, rax
call fcn.140038472
jmp 0x140048266
lea rax, [rsp + 0x6c]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov r8, rax
call qword [0x1401195b0]
test eax, eax
je 0x1400482fc
cmp dword [rsp + 0x6c], 0
jne 0x140048317
call fcn.14003893c
lea rcx, str.__Could_not_access_WIM_info:__s
xor ebx, ebx
mov rdx, rax
call fcn.140038472
jmp 0x140048495
mov rcx, qword [0x1400b6ac0]
call fcn.14004604d
lea rcx, [0x1400a7126]
mov rbp, rax
call fcn.14004604d
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_vfprintf
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov r15, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov ebx, eax
call r15
mov esi, eax
test ebx, ebx
je 0x1400483a3
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rcx
mov r8, rdi
mov qword [rsp + 0x30], rcx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
call qword [0x14011c7d0]
mov ebx, eax
test eax, eax
jne 0x1400483a3
call r15
mov esi, eax
test rdi, rdi
je 0x1400483b0
mov rcx, rdi
call fcn.1400796c8
test r12, r12
je 0x1400483bd
mov rcx, r12
call fcn.1400796c8
test rbp, rbp
je 0x1400483ca
mov rcx, rbp
call fcn.1400796c8
mov ecx, esi
mov rsi, qword [0x14011c730]
call rsi
test ebx, ebx
je 0x1400483e0
cmp byte [rsp + 0x7c], 0
jne 0x140048401
movabs rax, 0x6d58566675525c2e
mov qword [rsp + 0x7c], rax
movabs rax, 0x706d742e6c6d58
mov qword [rsp + 0x82], rax
mov rcx, r14
call fcn.140046f5b
mov rcx, r14
call fcn.14004604d
xor edx, edx
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], rdx
mov rcx, rax
mov rbp, rax
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_DeviceIoControEnumUILanguagesWFindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov edi, eax
test rbp, rbp
je 0x14004845a
mov rcx, rbp
call fcn.1400796c8
mov ecx, edi
call rsi
xor esi, esi
cmp rbx, 0xffffffffffffffff
je 0x1400484c2
xor eax, eax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x6c]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x70]
mov esi, 1
lea rdi, [0x1400a7ab4]
call qword [0x14011c7d8]
test eax, eax
jne 0x1400484a5
xor esi, esi
jmp 0x1400484c2
call sub.msvcrt.dll_tolower
cmp eax, r13d
je 0x1400484bd
inc esi
mov rcx, rdi
mov r8d, esi
mov rdx, r14
call fcn.140023801
mov rcx, rax
test rax, rax
jne 0x140048499
jmp 0x140048495
mov esi, 1
mov rcx, qword [rsp + 0x48]
call qword [0x1401195a8]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400484e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
cmp byte [rsp + 0x7c], 0
je 0x1400484ef
mov rcx, r14
call fcn.140046f5b
mov rcx, qword [rsp + 0x50]
call fcn.1400796c8
mov eax, esi
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret