Function at 0x140048664
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x190
mov rax, qword [0x1400b5fb0]
xor r9d, r9d
movups xmm0, xmmword [rax]
xor eax, eax
mov rbx, rcx
lea rdi, [rsp + 0x70]
mov ecx, 8
mov rbp, rdx
rep stosd dword [rdi], eax
mov rcx, rbx
mov dword [rsp + 0x5c], 1
mov qword [rsp + 0x54], r9
mov dword [rsp + 0x50], pe_nt_image_headers64
movups xmmword [rsp + 0x60], xmm0
call fcn.14004604d
cmp qword [0x140119028], 0
mov rsi, rax
jne 0x1400486f3
lea rdi, str.VirtDisk
lea r12, str.OpenVirtualDisk
mov rcx, rdi
call fcn.140045e22
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x140119028], rax
test rax, rax
je 0x1400487a0
cmp qword [0x140119020], 0
jne 0x14004872b
lea rdi, str.VirtDisk
lea r12, str.AttachVirtualDisk
mov rcx, rdi
call fcn.140045e22
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x140119020], rax
test rax, rax
je 0x1400487a0
cmp qword [0x140119010], 0
jne 0x140048763
lea rdi, str.VirtDisk
lea r12, str.GetVirtualDiskPhysicalPath
mov rcx, rdi
call fcn.140045e22
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x140119010], rax
test rax, rax
je 0x1400487a0
test rbp, rbp
je 0x1400487c9
cmp qword [0x140119000], 0
jne 0x1400487c9
lea rdi, str.VirtDisk
lea r12, str.GetVirtualDiskInformation
mov rcx, rdi
call fcn.140045e22
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x140119000], rax
test rax, rax
jne 0x1400487c9
call fcn.14003893c
mov r8, rdi
mov rdx, r12
lea rcx, [0x1400a7184]
mov r9, rax
call fcn.140038472
call fcn.1400485c0
test rsi, rsi
je 0x1400487ce
jmp 0x1400489f6
test rsi, rsi
jne 0x1400487d5
xor ebx, ebx
jmp 0x140048a00
mov rax, qword [0x140084778]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400487ea
call fcn.1400485c0
xor edi, edi
lea rcx, str._NULL_
test rbx, rbx
je 0x140048824
mov rcx, rbx
call fcn.1400797e8
lea rcx, str._NULL_
cmp rax, 4
jbe 0x140048824
lea rcx, [rbx + rax - 1]
cmp byte [rcx], 0x2e
je 0x140048821
cmp rcx, rbx
je 0x140048821
dec rcx
jmp 0x140048812
mov rdi, rcx
mov r12, qword [sym.imp.msvcrt.dll_fread]
lea rdx, [0x1400a7b53]
call r12
test eax, eax
jne 0x140048843
mov dword [rsp + 0x5c], 3
jmp 0x140048868
test rdi, rdi
jne 0x14004884f
lea rdi, str._NULL_
lea rdx, [0x1400a7b59]
mov rcx, rdi
call r12
test eax, eax
jne 0x140048868
mov dword [rsp + 0x5c], 2
lea rax, [0x140084778]
xor r8d, r8d
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x5c]
mov r8d, 0xd0000
mov qword [rsp + 0x28], rax
call qword [0x140119028]
mov ecx, eax
test eax, eax
je 0x1400488b6
call qword [0x14011c730]
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_open_image__s:__s
mov r8, rax
jmp 0x1400489df
xor ecx, ecx
lea rax, [rsp + 0x54]
xor r9d, r9d
mov r8d, 3
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, qword [0x140084778]
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x20], rax
call qword [0x140119020]
mov ecx, eax
test eax, eax
je 0x14004890a
call qword [0x14011c730]
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_mount_image__s:__s
mov r8, rax
jmp 0x1400489df
lea r8, [rsp + 0x90]
lea rdi, [rsp + 0x50]
mov rcx, qword [0x140084778]
mov qword [rsp + 0x48], r8
mov rdx, rdi
call qword [0x140119010]
mov r8, qword [rsp + 0x48]
test eax, eax
mov ecx, eax
je 0x140048954
call qword [0x14011c730]
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_obtain_physical_path_for_mounted_image__s:__s
mov r8, rax
jmp 0x1400489df
xor edx, edx
lea rax, [0x140118f80]
or r9d, 0xffffffff
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x38], rdx
mov ecx, 0xfde9
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [0x14011c7d0]
test rbp, rbp
jne 0x140048993
lea rbx, [0x140118f80]
jmp 0x1400489f8
xor eax, eax
mov rcx, qword [0x140084778]
xor r9d, r9d
mov rdx, rdi
mov qword [rbp], rax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x50], 0x20
call qword [0x140119000]
mov ecx, eax
test eax, eax
je 0x1400489eb
call qword [0x14011c730]
call fcn.14003893c
mov rdx, rbx
lea rcx, str.Could_not_obtain_virtual_size_of_mounted_image__s:__s
mov r8, rax
call fcn.140038472
call fcn.1400485c0
jmp 0x1400489f6
mov rax, qword [rsp + 0x78]
mov qword [rbp], rax
jmp 0x14004898a
xor ebx, ebx
mov rcx, rsi
call fcn.1400796c8
mov rax, rbx
add rsp, 0x190
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret