Function at 0x140067f30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
mov r15d, ebp
mov byte [0x1401e8f6c], bl
test rcx, rcx
je 0x140067fa1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x140067f68
cmp rax, 4
jbe 0x140067fa1
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140067f80
lea rbx, [rcx - 1]
add rbx, rax
cmp byte [rbx], 0x2e
je 0x140067fa1
cmp rbx, rdi
je 0x140067fa1
dec rbx
cmp byte [rbx], 0x2e
jne 0x140067f94
test rbx, rbx
lea r12, str._NULL_
lea r13, str..zip
mov esi, ebp
cmove rbx, r12
mov r14, r13
nop dword [rax + rax]
mov rax, qword [r14]
mov rdx, r12
test rax, rax
mov rcx, rbx
cmovne rdx, rax
call fcn.140107d64
test eax, eax
je 0x140068006
inc esi
add r14, 0x10
cmp esi, 0xa
jb 0x140067fc0
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movsxd r14, esi
mov ecx, 0x200
add r14, r14
movzx eax, byte [r13 + r14*8 + 8]
mov byte [0x1401e8f6c], al
call fcn.1400e8c84
mov rbx, rax
test rax, rax
je 0x140067fe4
cmp byte [0x1401e8f6c], 9
mov esi, 1
mov dword [0x14019f120], ebp
jae 0x14006808c
lea rax, [0x14019f120]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, [fcn.14004f2f0]
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.140087d20
movzx r9d, byte [r13 + r14*8 + 8]
mov r8d, 0x200
mov rdx, rbx
mov rcx, rdi
call fcn.140088140
mov r15, rax
call fcn.140087cd0
jmp 0x1400681c7
jne 0x14006813d
cmp dword [0x14019f5b4], ebp
je 0x140068124
mov rcx, rdi
call fcn.140067810
mov r14, rax
test rax, rax
je 0x140068100
mov r9, rax
mov byte [0x1401e8f4e], sil
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.14010a6f0
mov rcx, r14
mov r15, rax
call fcn.1400e9320
lea rcx, [rbx + 4]
mov r8d, 0xc
lea rdx, str.SignedImage
call fcn.1400fe370
test eax, eax
jne 0x1400681c7
mov word [rbx + 0x1fe], 0xaa55
jmp 0x1400681c7
call fcn.14010c7e8
mov rdx, rdi
lea rcx, str.Could_not_open__s:__d
mov r8d, dword [rax]
call fcn.14004f2f0
mov rcx, rbx
call fcn.1400e8c70
jmp 0x140067fe4
lea rcx, str.__An_FFU_image_was_selected__but_this_system_does_not_have_FFU_support_
call fcn.14004f2f0
mov rcx, rbx
call fcn.1400e8c70
jmp 0x140067fe4
xor edx, edx
mov rcx, rdi
call fcn.14006ab70
test rax, rax
je 0x140068182
mov rcx, rax
mov byte [0x1401e8f4e], sil
call fcn.140067810
mov rdi, rax
test rax, rax
je 0x140068182
mov r9, rax
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.14010a6f0
mov rcx, rdi
mov r15, rax
call fcn.1400e9320
mov rcx, qword [0x14019cca0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400681c0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov rcx, qword [0x14019cca0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400681c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14019cca0], 0xffffffffffffffff
mov byte [0x1401e5bd0], bpl
cmp r15, 0x200
je 0x1400681dd
mov rcx, rbx
call fcn.1400e8c70
jmp 0x140067fe4
cmp byte [rbx + 0x1fe], 0x55
jne 0x1400681ef
cmp byte [rbx + 0x1ff], 0xaa
je 0x1400681ff
cmp dword [0x14019f630], ebp
mov eax, 2
cmovne ebp, eax
mov esi, ebp
mov rcx, rbx
call fcn.1400e8c70
movzx eax, sil
jmp 0x140067fe6