Function at 0x14000a035
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rax, [0x1400893d7]
lea rsi, [0x14007b880]
mov qword [rsp + 0x48], rax
lea rax, [0x1400893db]
mov r12, rdx
lea rdi, [rsp + 0x90]
mov qword [rsp + 0x50], rax
lea rax, [0x1400893e0]
mov edx, 1
mov qword [rsp + 0x150], rcx
mov ecx, 0xc
rep movsd dword [rdi], dword [rsi]
mov qword [rsp + 0x58], rax
lea rdi, [rsp + 0xc0]
lea rax, [0x1400893e5]
lea rsi, [0x14007b8c0]
mov ecx, 0x10
mov qword [rsp + 0x60], rax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x6c]
lea rsi, [0x14007b900]
mov ecx, 9
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x200
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
jne 0x14000a0e5
lea rdi, str._Unrecognized_
jmp 0x14000a3db
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov rdx, r12
mov rcx, qword [rsp + 0x150]
call rsi
test eax, eax
je 0x14000a0d9
xor r8d, r8d
lea rax, [rsp + 0x44]
mov rdx, rbx
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x20], r8
mov r14, qword [sym.imp.KERNEL32.DLL_ReadFile]
mov r9, rax
mov r8d, 0x200
mov qword [rsp + 0x30], rax
call r14
test eax, eax
je 0x14000a0d9
cmp dword [rsp + 0x44], 0x200
jne 0x14000a0d9
lea rax, [rbx + 1]
mov r8d, 5
lea rcx, [0x1400893ea]
mov rdx, rax
mov qword [rsp + 0x38], rax
lea rdi, str.ISO9660
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x14000a3db
lea rbp, [rsp + 0x98]
xor edi, edi
lea r13, [rbx + 3]
mov r8d, 8
mov rdx, rbp
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000a3cc
inc edi
add rbp, 0x10
cmp edi, 3
jne 0x14000a17c
lea r13, [rbx + 0x36]
lea rbp, [rbx + 0x6e]
lea r15, [rsp + 0xc8]
xor edi, edi
mov r8d, 8
mov rdx, r15
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000a1d4
inc edi
add r15, 0x10
cmp edi, 4
jne 0x14000a1b2
jmp 0x14000a1e5
shl rdi, 4
mov rdi, qword [rsp + rdi + 0xc0]
jmp 0x14000a3db
add r13, 0x1c
cmp r13, rbp
jne 0x14000a1a8
lea rdx, [rbx + 0x20]
mov r8d, 4
lea rcx, str.NXSB
call sub.msvcrt.dll_strncmp
lea rdi, str.APFS
test eax, eax
je 0x14000a3db
xor eax, eax
mov ecx, pe_nt_image_headers64
mov rdi, rbx
xor r9d, r9d
rep stosd dword [rdi], eax
lea rdi, [r12 + 0x400]
xor r8d, r8d
mov rcx, qword [rsp + 0x150]
mov rdx, rdi
call rsi
test eax, eax
je 0x14000a0d9
xor ecx, ecx
mov r9, qword [rsp + 0x30]
mov r8d, 0x200
mov rdx, rbx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x150]
call r14
test eax, eax
je 0x14000a0d9
cmp dword [rsp + 0x44], 0x200
jne 0x14000a0d9
cmp byte [rbx], 0x48
jne 0x14000a290
mov al, byte [rbx + 1]
cmp al, 0x58
je 0x14000a3c3
cmp al, 0x2b
je 0x14000a3c3
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x150]
mov rdx, rdi
call rsi
test eax, eax
je 0x14000a0d9
xor edx, edx
mov r9, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
mov r8d, 0x200
mov qword [rsp + 0x20], rdx
mov rdx, rbx
call r14
test eax, eax
je 0x14000a0d9
cmp dword [rsp + 0x44], 0x200
jne 0x14000a0d9
cmp byte [rbx + 0x38], 0x53
jne 0x14000a339
cmp byte [rbx + 0x39], 0xef
jne 0x14000a339
lea r8, [rsp + 0x6c]
xor ecx, ecx
xor eax, eax
mov esi, dword [rbx + rcx + 0x5c]
mov r9, r8
xor edx, edx
mov r10d, esi
and r10d, dword [r9]
setne r11b
cmp edx, eax
setae r10b
inc edx
test r11b, r10b
cmovne rax, rdx
add r9, 4
cmp edx, 3
jne 0x14000a2ff
add rcx, 4
add r8, 0xc
cmp rcx, 0xc
jne 0x14000a2f6
mov rdi, qword [rsp + rax*8 + 0x48]
jmp 0x14000a3db
xor eax, eax
mov ecx, pe_nt_image_headers64
mov rdi, rbx
xor r9d, r9d
rep stosd dword [rdi], eax
xor r8d, r8d
mov rcx, qword [rsp + 0x150]
lea rdx, [r12 + 0x8000]
call rsi
test eax, eax
je 0x14000a0d9
xor eax, eax
mov r9, qword [rsp + 0x30]
mov r8d, 0x200
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x150]
call r14
test eax, eax
je 0x14000a0d9
cmp dword [rsp + 0x44], 0x200
jne 0x14000a0d9
mov rdx, qword [rsp + 0x38]
mov r8d, 5
lea rcx, str.BEA01
lea rdi, [0x1400893bd]
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x14000a0d9
jmp 0x14000a3db
lea rdi, str.HFS_HFS
jmp 0x14000a3db
mov r9d, edi
shl r9, 4
mov rdi, qword [rsp + r9 + 0x90]
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, rdi
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret