Function at 0x140047e04
Capabilities:
Get common file path
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
xor r11d, r11d
mov r8, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
mov r13d, edx
rep stosd dword [rdi], eax
mov rcx, r8
mov dword [rsp + 0x6c], r11d
lea r14, [rsp + 0x7c]
call fcn.140045e79
cmp qword [0x1401181c8], 0
mov qword [rsp + 0x50], rax
jne 0x140047e7d
lea rbx, str.Wimgapi
lea rsi, str.WIMCreateFile
mov rcx, rbx
call fcn.140045a56
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1401181c8], rax
test rax, rax
je 0x140047eed
cmp qword [0x140118190], 0
jne 0x140047eb5
lea rbx, str.Wimgapi
lea rsi, str.WIMGetImageInformation
mov rcx, rbx
call fcn.140045a56
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140118190], rax
test rax, rax
je 0x140047eed
cmp qword [0x140118188], 0
jne 0x140047f0c
lea rbx, str.Wimgapi
lea rsi, str.WIMCloseHandle
mov rcx, rbx
call fcn.140045a56
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140118188], rax
test rax, rax
jne 0x140047f0c
call fcn.140038579
mov r8, rbx
mov rdx, rsi
lea rcx, [0x1400a5704]
mov r9, rax
call fcn.1400380b9
jmp 0x140048199
test r13d, r13d
je 0x140048199
mov rax, qword [0x1400b4c60]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
mov edx, 0x80000000
cmp dword [rax + 0x550], 0xdffff
seta r9b
xor r8d, r8d
xor r10d, r10d
mov qword [rsp + 0x28], r8
shl r9d, 0x1d
mov r8d, 3
mov dword [rsp + 0x20], r10d
call qword [0x1401181c8]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140047f7a
call fcn.140038579
lea rcx, str.__Could_not_access_image:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x140048199
lea rax, [rsp + 0x6c]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov r8, rax
call qword [0x140118190]
test eax, eax
je 0x140047fa2
cmp dword [rsp + 0x6c], 0
jne 0x140047fbd
call fcn.140038579
lea rcx, str.__Could_not_access_WIM_info:__s
xor ebx, ebx
mov rdx, rax
call fcn.1400380b9
jmp 0x140048195
mov rcx, qword [0x1400b4f20]
call fcn.140045e79
lea rcx, [0x1400a56a6]
mov rbp, rax
call fcn.140045e79
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_calloc
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov r15, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
call r15
mov esi, eax
test ebx, ebx
je 0x140048049
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rcx
mov r8, rdi
mov qword [rsp + 0x30], rcx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x140048049
call r15
mov esi, eax
test rdi, rdi
je 0x140048056
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x140048063
mov rcx, r12
call sub.msvcrt.dll_free
test rbp, rbp
je 0x140048070
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, esi
mov rsi, qword [sym.imp.KERNEL32.DLL_SetLastError]
call rsi
test ebx, ebx
je 0x140048086
cmp byte [rsp + 0x7c], 0
jne 0x1400480a7
movabs rax, 0x6d58566675525c2e
mov qword [rsp + 0x7c], rax
movabs rax, 0x706d742e6c6d58
mov qword [rsp + 0x82], rax
mov rcx, r14
call fcn.140046d9a
mov rcx, r14
call fcn.140045e79
xor edx, edx
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], rdx
mov rcx, rax
mov rbp, rax
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test rbp, rbp
je 0x140048100
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, edi
call rsi
cmp rbx, 0xffffffffffffffff
je 0x140048195
xor eax, eax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x6c]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x70]
mov esi, 1
lea rdi, [0x1400a6014]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x140048195
mov rcx, rdi
mov r8d, esi
mov rdx, r14
call fcn.1400231ca
mov rcx, rax
test rax, rax
je 0x140048195
call sub.msvcrt.dll_atoi
cmp eax, r13d
je 0x140048161
inc esi
jmp 0x14004813d
mov esi, 1
mov rcx, qword [rsp + 0x48]
call qword [0x140118188]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140048184
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [rsp + 0x7c], 0
je 0x14004819d
mov rcx, r14
call fcn.140046d9a
jmp 0x14004819d
xor esi, esi
jmp 0x140048166
xor esi, esi
jmp 0x140048184
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov eax, esi
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret