Function at 0x140019f30
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov r8, rdx
mov r14, r9
mov rdx, rcx
xor ecx, ecx
mov ebx, ecx
mov edi, ecx
cmp r8, 0x40
jb 0x140019f7d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14001a506
movsxd rax, dword [rdx + 0x3c]
add rax, 0x108
cmp r8, rax
jae 0x140019f97
mov ecx, 0xd
call qword [0x14005cd68]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
movsxd r13, dword [rdx + 0x3c]
add r13, rdx
cmp dword [r13], 0x4550
jne 0x14001a506
mov eax, 0x8664
cmp word [r13 + 4], ax
jne 0x14001a506
mov edx, dword [r13 + 0x38]
test dl, 1
jne 0x14001a506
movzx eax, word [r13 + 0x14]
mov r9d, edx
movzx edx, word [r13 + 6]
add rax, 0x24
cmp cx, dx
jae 0x14001a00b
lea rcx, [rax + r13]
mov r8d, edx
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x140019ff5
lea rax, [r9 + rdx]
jmp 0x140019ff7
add eax, edx
cmp rax, rbx
cmovbe rax, rbx
add rcx, 0x28
mov rbx, rax
sub r8, 1
jne 0x140019fe6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
mov eax, dword [r13 + 0x50]
lea r15, [rdx - 1]
add r15, rax
lea rcx, [rdx - 1]
not rcx
lea rax, [rdx - 1]
add rax, rbx
and r15, rcx
and rax, rcx
cmp r15, rax
jne 0x14001a506
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov rbx, qword [rsp + 0xb0]
mov r8d, 0x3000
mov qword [rsp + 0xb8], rbp
mov rdx, r15
mov rbp, qword [rsp + 0xd8]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x60], r12
call rbx
mov r12, rax
test rax, rax
jne 0x14001a0a8
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rbp
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call rbx
mov r12, rax
test rax, rax
je 0x14001a185
movabs rdx, 0xffffffff00000000
lea rcx, [r12 + r15]
mov rax, r12
and rcx, rdx
and rax, rdx
cmp rax, rcx
jae 0x14001a121
mov ecx, 0x10
call fcn.140026448
mov rsi, rax
test rax, rax
je 0x14001a1d8
mov qword [rax], rdi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r12
mov rdx, r15
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov rdi, rax
call rbx
mov r12, rax
test rax, rax
je 0x14001a1b1
lea rcx, [rax + r15]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x14001a0c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14001a21a
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call r14
test rdi, rdi
je 0x14001a185
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140023748
mov rdi, rbx
test rbx, rbx
jne 0x14001a160
mov ecx, 0xe
call qword [0x14005cd68]
xor eax, eax
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
mov rcx, qword [rsi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rsi]
mov rcx, rsi
call fcn.140023748
mov rsi, rbx
test rbx, rbx
jne 0x14001a1b1
jmp 0x14001a185
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call r14
test rdi, rdi
je 0x14001a185
nop
mov rcx, qword [rdi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140023748
mov rdi, rbx
test rbx, rbx
jne 0x14001a1f0
jmp 0x14001a185
mov qword [rax + 8], r12
movzx eax, word [r13 + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rsi + 0x30], r14
mov r14, qword [rsp + 0xa8]
mov dword [rsi + 0x20], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsi + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsi + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x58], rbp
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x68], eax
mov qword [rsi + 0x70], rdi
mov eax, dword [r13 + 0x54]
cmp r14, rax
jae 0x14001a34e
mov ecx, 0xd
call qword [0x14005cd68]
cmp dword [rsi + 0x1c], 0
je 0x14001a2a3
mov rax, qword [rsi]
xor r8d, r8d
mov rcx, qword [rsi + 8]
xor edx, edx
mov r9d, dword [rax + 0x28]
add r9, rcx
call r9
mov rcx, qword [rsi + 0x50]
call fcn.140023748
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14001a2e7
cmp dword [rsi + 0x18], 0
jle 0x14001a2e2
xor edi, edi
mov ebx, edi
nop
mov rax, qword [rbx + rcx]
test rax, rax
je 0x14001a2d7
mov rdx, qword [rsi + 0x58]
mov rcx, rax
call qword [rsi + 0x48]
mov rcx, qword [rsi + 0x10]
inc edi
add rbx, 8
cmp edi, dword [rsi + 0x18]
jl 0x14001a2c0
call fcn.140023748
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001a2ff
mov r9, qword [rsi + 0x58]
xor edx, edx
mov r8d, 0x8000
call qword [rsi + 0x30]
mov rdi, qword [rsi + 0x70]
mov rbp, qword [rsi + 0x58]
mov r14, qword [rsi + 0x30]
test rdi, rdi
je 0x14001a335
mov rcx, qword [rdi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140023748
mov rdi, rbx
test rbx, rbx
jne 0x14001a310
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001a190
mov edx, dword [r13 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov qword [rsp + 0x20], rbp
mov rcx, r12
call rbx
mov rdi, qword [rsp + 0xa0]
mov rcx, rax
mov r8d, dword [r13 + 0x54]
mov rdx, rdi
mov rbx, rax
call fcn.14001eba0
movsxd rax, dword [rdi + 0x3c]
mov r9, rsi
add rax, rbx
mov r8, r13
mov qword [rsi], rax
mov rdx, r14
mov rcx, rdi
mov qword [rax + 0x30], r12
call fcn.140019a90
test eax, eax
je 0x14001a287
mov rax, qword [rsi]
mov rbx, qword [rax + 0x30]
sub rbx, qword [r13 + 0x30]
je 0x14001a449
cmp dword [rax + 0xb4], 0
jne 0x14001a3ca
xor eax, eax
jmp 0x14001a44e
mov r11d, dword [rax + 0xb0]
mov rdi, qword [rsi + 8]
add r11, rdi
mov eax, dword [r11]
test eax, eax
je 0x14001a449
nop
mov r9d, dword [r11 + 4]
lea rdx, [r11 + 8]
mov r10d, eax
xor r8d, r8d
add r10, rdi
lea rax, [r9 - 8]
test rax, 0xfffffffffffffffe
jbe 0x14001a43c
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14001a41e
cmp eax, 0xa
jne 0x14001a422
add qword [rcx + r10], rbx
jmp 0x14001a422
add dword [rcx + r10], ebx
mov r9d, dword [r11 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r9 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x14001a400
mov eax, r9d
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x14001a3e0
mov eax, 1
mov rcx, rsi
mov dword [rsi + 0x24], eax
call fcn.140019900
test eax, eax
je 0x14001a287
mov rcx, rsi
call fcn.140019bd0
test eax, eax
je 0x14001a287
mov rax, qword [rsi]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14001a4ad
mov rdi, qword [rsi + 8]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x14001a4ad
mov rax, qword [rbx]
test rax, rax
je 0x14001a4ad
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14001a494
mov rax, qword [rsi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x14001a4f6
cmp dword [rsi + 0x20], 0
lea rax, [r12 + rcx]
je 0x14001a4ea
xor r8d, r8d
mov rcx, r12
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x14001a4db
mov ecx, 0x45a
jmp 0x14001a281
mov dword [rsi + 0x1c], 1
mov rax, rsi
jmp 0x14001a192
mov qword [rsi + 0x60], rax
mov rax, rsi
jmp 0x14001a192
mov qword [rsi + 0x60], 0
mov rax, rsi
jmp 0x14001a192
mov ecx, 0xc1
call qword [0x14005cd68]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret