Function at 0x14004e880
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xc0
mov eax, dword [rsp + 0xd8]
and eax, 0x1000
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xd8]
and eax, 0x2000
test eax, eax
je 0x14004e8be
mov dword [rsp + 0xb4], 1
jmp 0x14004e8c9
mov dword [rsp + 0xb4], 0
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x58], eax
cmp qword [rsp + 0xd0], 0
je 0x14004e8ee
mov rax, qword [rsp + 0xd0]
movsx eax, byte [rax]
test eax, eax
jne 0x14004e8f5
xor eax, eax
jmp 0x14004f125
mov edx, 0x48
mov ecx, 1
call fcn.1400280c0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14004e922
lea rcx, [0x1400a05c0]
call fcn.140027e08
call fcn.140027b90
mov rcx, qword [rsp + 0xd0]
call fcn.14004bd50
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], r11
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x40], 0
mov eax, dword [rsp + 0xd8]
and eax, 1
test eax, eax
je 0x14004e97a
mov dword [rsp + 0xb0], 0
jmp 0x14004e985
mov dword [rsp + 0xb0], 2
mov edx, dword [rsp + 0xb0]
or edx, 0x8000
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call fcn.140028d44
mov r11d, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], r11d
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
jge 0x14004ea76
call fcn.1400295e8
mov ecx, dword [rax]
call fcn.140028fa0
mov rbx, rax
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov r8, qword [r8]
lea rdx, str.openHive__s__failed:__s__trying_read_only_n
call fcn.140026714
mov dword [rsp + 0xb0], 0
mov eax, dword [rsp + 0xd8]
or eax, 1
mov dword [rsp + 0xd8], eax
mov edx, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call fcn.140028d44
mov r11d, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], r11d
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
jge 0x14004ea76
call fcn.1400295e8
mov ecx, dword [rax]
call fcn.140028fa0
mov rbx, rax
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov r8, qword [r8]
lea rdx, str.openHive__s__in_fallback_RO_mode_failed:__s_n
call fcn.140026714
mov rcx, qword [rsp + 0x50]
call fcn.14004acd0
xor eax, eax
jmp 0x14004f125
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 8]
call fcn.140028104
test eax, eax
je 0x14004ea9f
lea rcx, str.stat__
call fcn.140027e08
xor eax, eax
jmp 0x14004f125
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x74]
mov dword [rcx + 0x28], eax
mov ecx, dword [rsp + 0xd8]
or ecx, 2
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], ecx
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x28]
mov edx, 1
call fcn.1400280c0
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x40], r11
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
jne 0x14004eaf9
lea rcx, str.malloc_failure
call fcn.140027e08
call fcn.140027b90
mov dword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r8d, dword [rcx + 0x28]
sub r8d, eax
movsxd rdx, dword [rsp + 0x90]
mov rax, qword [rsp + 0x50]
add rdx, qword [rax + 0x40]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 8]
call fcn.140029fd0
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 0
jg 0x14004eb48
jmp 0x14004eb70
mov ecx, dword [rsp + 0xac]
mov eax, dword [rsp + 0x90]
add eax, ecx
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x28]
cmp dword [rsp + 0x90], eax
jl 0x14004eb04
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x28]
cmp dword [rsp + 0x90], eax
jge 0x14004ebbb
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov rax, qword [rsp + 0x50]
mov r9d, dword [rax + 0x28]
mov r8d, dword [rsp + 0xac]
lea rdx, str.Could_not_read_file__got__d_bytes_while_expecting__d_n
call fcn.140026714
mov rcx, qword [rsp + 0x50]
call fcn.14004acd0
xor eax, eax
jmp 0x14004f125
mov dword [rsp + 0xa8], 0x1000
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
cmp dword [rax], 0x66676572
je 0x14004ec0e
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov r8, qword [rsp + 0xd0]
lea rdx, str.openHive__s_:_File_does_not_seem_to_be_a_registry_hive__n
call fcn.140026714
xor eax, eax
jmp 0x14004f125
mov rcx, qword [rsp + 0x50]
call fcn.14004ac70
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x1fc]
cmp dword [rsp + 0x94], eax
je 0x14004ec70
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x1fc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x94]
mov r8, qword [rsp + 0xd0]
lea rdx, str.openHive__s_:_WARNING:_REGF_header_checksum_mismatch__calc:_0x_08x___file:_0x_08x_n
call fcn.140026714
mov rdx, qword [rsp + 0xd0]
lea rcx, str.Hive___s__name__from_header_:__
call fcn.1400264fc
mov rax, qword [rsp + 0x98]
add rax, 0x30
mov qword [rsp + 0xa0], rax
jmp 0x14004ecae
mov rax, qword [rsp + 0xa0]
add rax, 2
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movsx eax, byte [rax]
test eax, eax
je 0x14004ece5
mov rax, qword [rsp + 0x98]
add rax, 0x70
cmp qword [rsp + 0xa0], rax
jae 0x14004ece5
mov rax, qword [rsp + 0xa0]
movsx ecx, byte [rax]
call fcn.14002a5c4
jmp 0x14004ec9a
mov rax, qword [rsp + 0x98]
mov ecx, dword [rax + 0x24]
add ecx, 0x1000
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x2c], ecx
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x2c]
lea rcx, str.__nROOT_KEY_at_offset:_0x_06x_
call fcn.1400264fc
mov r11, qword [rsp + 0x50]
movsxd rcx, dword [r11 + 0x2c]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
lea rax, [rax + rcx + 4]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movsx eax, word [rax]
cmp eax, 0x6b6e
jne 0x14004ee31
mov rax, qword [rsp + 0x48]
movsxd rcx, dword [rax + 0x1c]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
lea rax, [rax + rcx + 0x1004]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rcx + 0x38], ax
mov rax, qword [rsp + 0x50]
movsx eax, word [rax + 0x38]
cmp eax, 0x6972
jne 0x14004edbd
lea rcx, str.openHive:_DEBUG:_BIG_ROOT__n
call fcn.1400264fc
mov r11, qword [rsp + 0x30]
movsxd rcx, dword [r11 + 4]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
lea rax, [rax + rcx + 0x1004]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rcx + 0x38], ax
mov rax, qword [rsp + 0x50]
movsx eax, word [rax + 0x38]
cmp eax, 0x666c
je 0x14004edfb
mov rax, qword [rsp + 0x50]
movsx eax, word [rax + 0x38]
cmp eax, 0x686c
je 0x14004edfb
mov rax, qword [rsp + 0x50]
movsx eax, word [rax + 0x38]
cmp eax, 0x696c
je 0x14004edfb
mov ecx, 0x666c
mov rax, qword [rsp + 0x50]
mov word [rax + 0x38], cx
mov rax, qword [rsp + 0x50]
movsx r9d, word [rax + 0x38]
sar r9d, 8
mov rax, qword [rsp + 0x50]
movsx r8d, word [rax + 0x38]
and r8d, 0xff
mov rax, qword [rsp + 0x50]
movsx edx, word [rax + 0x38]
lea rcx, str.Subkey_indexing_type_is:__04x___c_c__n
call fcn.1400264fc
jmp 0x14004ee49
call fcn.140029158
mov rcx, rax
add rcx, 0x60
lea rdx, str.openHive:_WARNING:_ROOT_key_does_not_seem_to_be_a_key___not_type__nk__n
call fcn.140026714
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x28]
add eax, 0x1000
cmp dword [rsp + 0xa8], eax
jae 0x14004ef87
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x6e696268
je 0x14004eea0
mov edx, dword [rsp + 0xa8]
lea rcx, str.Page_at_0x_x_is_not_hbin__assuming_file_contains_garbage_at_end_n
call fcn.1400264fc
jmp 0x14004ef87
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0x14]
add ecx, 1
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x14], ecx
cmp dword [rsp + 0x40], 0
je 0x14004eedf
mov rax, qword [rsp + 0x38]
mov r9d, dword [rax + 8]
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax + 4]
mov edx, dword [rsp + 0xa8]
lea rcx, str._Page_at_0x_0x_ofs_self_0x_0x__size__delta_ofs_next__0x_0x__n
call fcn.1400264fc
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 0
jne 0x14004ef14
call fcn.140029158
mov rcx, rax
add rcx, 0x60
mov r8d, dword [rsp + 0xa8]
lea rdx, str.openHive:_ERROR:_Page_at_0x_x_has_size_zero__File_may_be_corrupt__or_program_has_a_bug_n
call fcn.140026714
mov rax, qword [rsp + 0x50]
jmp 0x14004f125
mov eax, dword [rsp + 0xa8]
add eax, 0x20
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov rax, qword [rsp + 0x38]
cmp ecx, dword [rax + 8]
jae 0x14004ef6a
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x28]
cmp dword [rsp + 0x44], eax
jge 0x14004ef6a
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
call fcn.14004e5d0
mov r11d, eax
mov eax, dword [rsp + 0x44]
add eax, r11d
mov dword [rsp + 0x44], eax
jmp 0x14004ef22
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 8]
mov eax, dword [rsp + 0xa8]
add eax, ecx
mov dword [rsp + 0xa8], eax
jmp 0x14004ee49
mov rax, qword [rsp + 0x98]
mov ecx, dword [rax + 0x28]
add ecx, 0x1000
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x34], ecx
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov ecx, dword [rsp + 0xa8]
sub ecx, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x30], ecx
cmp dword [rsp + 0x40], 0
je 0x14004f001
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x30]
lea rcx, str.Last_HBIN_at_offset_______:_0x_x_n
call fcn.1400264fc
mov r11, qword [rsp + 0x50]
mov edx, dword [r11 + 0x34]
lea rcx, str.First_non_HBIN_page_offset:_0x_x_n
call fcn.1400264fc
mov r11, qword [rsp + 0x98]
mov edx, dword [r11 + 0x18]
lea rcx, str.hdr__unknown4__version____:_0x_x_n
call fcn.1400264fc
mov rax, qword [rsp + 0x50]
mov r9d, dword [rax + 0x14]
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x28]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x28]
lea rcx, str.File_size__d___x__bytes__containing__d_pages___1_headerpage__n
call fcn.1400264fc
mov r11, qword [rsp + 0x50]
mov eax, dword [r11 + 0x24]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov r9d, dword [rax + 0x1c]
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x18]
lea rcx, str.Used_for_data:__d__d_blocks_bytes__unused:__d__d_blocks_bytes._n_n
call fcn.1400264fc
mov r11, qword [rsp + 0x50]
mov dword [r11 + 0x10], 0
xor r9d, r9d
lea r8, str.SAM
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14004bf50
test eax, eax
je 0x14004f08f
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 1
jmp 0x14004f105
xor r9d, r9d
lea r8, str.ControlSet
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14004bf50
test eax, eax
je 0x14004f0b7
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 2
jmp 0x14004f105
xor r9d, r9d
lea r8, str.Policy
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14004bf50
test eax, eax
je 0x14004f0df
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 3
jmp 0x14004f105
xor r9d, r9d
lea r8, [0x1400a0a08]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14004bf50
test eax, eax
je 0x14004f105
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 4
cmp dword [rsp + 0x40], 0
je 0x14004f120
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x10]
lea rcx, str.Type_of_hive_guessed_to_be:__d_n
call fcn.1400264fc
mov rax, qword [rsp + 0x50]
add rsp, 0xc0
pop rbx
ret