Function at 0x14000ebdc
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r13d, r13d
mov r12, rdx
mov rbp, rcx
mov edi, r13d
mov r15d, r13d
cmp rdx, 0x40
jb 0x14000ec2a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000ef88
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rdx, rax
jae 0x14000ec34
mov ecx, ntohs
jmp 0x14000ef8d
movsxd rsi, dword [rcx + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
jne 0x14000ef88
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x14000ef88
test byte [rsi + 0x38], 1
jne 0x14000ef88
movzx ecx, word [rsi + 0x14]
mov r9d, dword [rsi + 0x38]
add rcx, 0x24
cmp r13w, word [rsi + 6]
jae 0x14000eca0
movzx r8d, word [rsi + 6]
add rcx, rsi
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14000ec8a
lea rax, [r9 + rdx]
jmp 0x14000ec8c
add eax, edx
cmp rax, rdi
cmovbe rax, rdi
add rcx, 0x28
mov rdi, rax
sub r8, 1
jne 0x14000ec7b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x24]
mov eax, dword [rsi + 0x50]
lea rbx, [rdx - 1]
add rbx, rax
lea rcx, [rdx - 1]
not rcx
lea rax, [rdx - 1]
add rax, rdi
and rbx, rcx
and rax, rcx
cmp rbx, rax
jne 0x14000ef88
mov rcx, qword [rsi + 0x30]
mov edi, 0x3000
mov r8d, edi
mov r9d, 4
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
jne 0x14000ed17
lea r9d, [rax + 4]
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14000edc0
lea rcx, [r14 + rbx]
mov rax, r14
jmp 0x14000ed63
mov ecx, reloc.WS2_32.dll_recv
call fcn.14001a500
mov rdi, rax
test rax, rax
je 0x14000edca
mov qword [rax], r15
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r14
mov rdx, rbx
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14000edae
lea rcx, [rax + rbx]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x14000ed20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14000ee09
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r15
jmp 0x14000edb1
mov rcx, rdi
lea rdx, [sub.KERNEL32.dll_VirtualFree]
xor r8d, r8d
call fcn.14000e5a8
mov ecx, ntohs
jmp 0x14000ef8d
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15, r15
je 0x14000edc0
mov rcx, qword [r15 + 8]
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
mov rbx, qword [r15]
mov rcx, r15
call fcn.140018fc0
mov r15, rbx
test rbx, rbx
jne 0x14000ede0
jmp 0x14000edc0
mov qword [rax + 8], r14
movzx eax, word [rsi + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rdi + 0x58], r13
mov dword [rdi + 0x20], eax
lea rax, [0x14000ebb4]
mov qword [rdi + 0x28], rax
lea rax, [sub.KERNEL32.dll_VirtualFree]
mov qword [rdi + 0x30], rax
lea rax, [0x14000ebc4]
mov qword [rdi + 0x38], rax
lea rax, [0x14000ebcc]
mov qword [rdi + 0x40], rax
lea rax, [0x14000ebd4]
mov qword [rdi + 0x48], rax
mov eax, dword [rsp + 0x24]
mov dword [rdi + 0x68], eax
mov qword [rdi + 0x70], r15
mov eax, dword [rsi + 0x54]
cmp r12, rax
jae 0x14000ee80
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.14000f134
jmp 0x14000ef93
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.14027dfb0
movsxd rax, dword [rbp + 0x3c]
mov r9, rdi
add rax, rbx
mov r8, rsi
mov qword [rdi], rax
mov rdx, r12
mov rcx, rbp
mov qword [rax + 0x30], r14
call fcn.14000e604
test eax, eax
je 0x14000ee73
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rsi + 0x30]
je 0x14000eee4
mov rcx, rdi
call fcn.14000e97c
jmp 0x14000eee9
mov eax, 1
mov rcx, rdi
mov dword [rdi + 0x24], eax
call fcn.14000ea30
test eax, eax
je 0x14000ee73
mov rcx, rdi
call fcn.14000e7f0
test eax, eax
je 0x14000ee73
mov rax, qword [rdi]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14000ef41
mov rsi, qword [rdi + 8]
mov rbx, qword [rcx + rsi + 0x18]
test rbx, rbx
je 0x14000ef41
jmp 0x14000ef39
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x14000ef29
mov rax, qword [rdi]
cmp dword [rax + 0x28], r13d
je 0x14000ef7f
mov eax, dword [rax + 0x28]
add rax, r14
cmp dword [rdi + 0x20], r13d
je 0x14000ef79
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x14000ef70
mov ecx, 0x45a
jmp 0x14000ee6d
mov dword [rdi + 0x1c], 1
jmp 0x14000ef83
mov qword [rdi + 0x60], rax
jmp 0x14000ef83
mov qword [rdi + 0x60], r13
mov rax, rdi
jmp 0x14000ef95
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret