Function at 0x1400021ed
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, qword [rsp + 0xf8]
mov qword [rsp + 0xc8], rdx
mov r12, rcx
mov r13, r8
mov rsi, r9
cmp rdx, 0x3f
jbe 0x140002238
cmp word [rcx], 0x5a4d
jne 0x14000224b
movsxd rbp, dword [rcx + 0x3c]
lea rax, [rbp + 0x108]
cmp qword [rsp + 0xc8], rax
jae 0x14000223f
mov ecx, 0xd
jmp 0x140002250
add rbp, rcx
cmp dword [rbp], 0x4550
je 0x14000225e
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r14d, r14d
jmp 0x140002527
cmp word [rbp + 4], 0x8664
jne 0x14000224b
mov eax, dword [rbp + 0x38]
mov r8d, eax
and r8d, 1
jne 0x14000224b
movzx edx, word [rbp + 0x14]
movzx r11d, word [rbp + 6]
xor r15d, r15d
lea rdx, [rbp + rdx + 0x18]
cmp r8d, r11d
jae 0x1400022ac
mov r10d, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
lea r9d, [r10 + rcx]
test r10d, r10d
jne 0x14000229c
lea r9, [rcx + rax]
cmp r15, r9
cmovb r15, r9
inc r8d
add rdx, 0x28
jmp 0x140002283
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x44]
mov r14d, dword [rbp + 0x50]
lea rdx, [rax - 1]
neg rax
add r14, rdx
add r15, rdx
and r14, rax
and r15, rax
cmp r15, r14
jne 0x14000224b
mov rcx, qword [rbp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov r8d, 0x3000
call r13
mov rbx, rax
test rax, rax
jne 0x140002323
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rdx, r15
xor ecx, ecx
mov r8d, 0x3000
call r13
mov rbx, rax
test rax, rax
je 0x1400023cb
xor r15d, r15d
mov rdx, rbx
lea rax, [rbx + r14]
shr rdx, 0x20
shr rax, 0x20
cmp rdx, rax
jae 0x14000238b
mov ecx, 0x10
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400023ad
mov qword [rax + 8], rbx
xor ecx, ecx
mov r9d, 4
mov rdx, r14
mov qword [rax], r15
mov r8d, 0x3000
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdi
call r13
mov r10, qword [rsp + 0x38]
test rax, rax
mov rbx, rax
jne 0x140002386
mov r8, rdi
mov rdx, rsi
mov rcx, r10
jmp 0x1400023c6
mov r15, r10
jmp 0x140002326
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x78
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1400023d5
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
mov r9, rdi
call rsi
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.14000161c
mov ecx, 0xe
jmp 0x140002250
mov qword [rax + 8], rbx
mov ax, word [rbp + 0x16]
mov ecx, 0xd
mov qword [r14 + 0x28], r13
mov edx, dword [rbp + 0x54]
shr ax, 0xd
mov qword [r14 + 0x30], rsi
and eax, 1
mov qword [r14 + 0x58], rdi
mov dword [r14 + 0x20], eax
mov rax, qword [rsp + 0xe0]
mov qword [r14 + 0x70], r15
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0xe8]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0xf0]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x44]
mov dword [r14 + 0x68], eax
cmp qword [rsp + 0xc8], rdx
jb 0x1400024fa
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rcx, rbx
mov rsi, r12
mov r8d, 0x1000
call r13
mov ecx, dword [rbp + 0x54]
mov r9, r14
mov r8, rbp
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
movsxd rdx, dword [r12 + 0x3c]
add rax, rdx
mov rdx, qword [rsp + 0xc8]
mov qword [r14], rax
mov qword [rax + 0x30], rbx
call fcn.14000165c
test eax, eax
je 0x14000251a
mov rax, qword [r14]
mov rdx, qword [rax + 0x30]
mov eax, 1
sub rdx, qword [rbp + 0x30]
je 0x1400024a3
mov rcx, r14
call fcn.140001578
mov dword [r14 + 0x24], eax
mov rcx, r14
call fcn.14000176b
test eax, eax
je 0x14000251a
mov rcx, r14
call fcn.140001b10
test eax, eax
je 0x14000251a
mov rcx, r14
call fcn.140001530
test eax, eax
je 0x14000251a
mov rax, qword [r14]
mov eax, dword [rax + 0x28]
test eax, eax
je 0x140002512
add rax, rbx
cmp dword [r14 + 0x20], 0
je 0x14000250c
mov r8, qword [rsp + 0x100]
mov edx, 1
mov rcx, rbx
call rax
test eax, eax
jne 0x140002502
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000251a
mov dword [r14 + 0x1c], 1
jmp 0x140002527
mov qword [r14 + 0x60], rax
jmp 0x140002527
xor eax, eax
mov qword [r14 + 0x60], rax
jmp 0x140002527
mov rcx, r14
call fcn.140001db1
jmp 0x140002256
mov rax, r14
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret