Function at 0x140020f00
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r10d, r10d
mov r14, r9
mov r15, r8
mov r12, rcx
mov ebx, r10d
mov r13d, r10d
cmp rdx, 0x40
jb 0x140020f54
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400212b0
movsxd rcx, dword [rcx + 0x3c]
lea rax, [rcx + 0x108]
cmp rdx, rax
jae 0x140020f5e
mov ecx, 0xd
jmp 0x1400212b5
lea rbp, [rcx + r12]
cmp dword [rbp], 0x4550
jne 0x1400212b0
mov eax, 0x8664
cmp word [rbp + 4], ax
jne 0x1400212b0
test byte [rbp + 0x38], 1
jne 0x1400212b0
movzx ecx, word [rbp + 0x14]
mov r9d, dword [rbp + 0x38]
add rcx, 0x24
cmp r10w, word [rbp + 6]
jae 0x140020fc8
movzx r8d, word [rbp + 6]
add rcx, rbp
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x140020fb2
lea rax, [r9 + rdx]
jmp 0x140020fb4
add eax, edx
cmp rax, rbx
cmovbe rax, rbx
add rcx, 0x28
mov rbx, rax
sub r8, 1
jne 0x140020fa3
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
mov eax, dword [rbp + 0x50]
lea rdi, [rdx - 1]
add rdi, rax
lea rcx, [rdx - 1]
not rcx
lea rax, [rdx - 1]
add rax, rbx
and rdi, rcx
and rax, rcx
cmp rdi, rax
jne 0x1400212b0
mov rbx, qword [rsp + 0xd8]
mov r9d, 4
mov rcx, qword [rbp + 0x30]
mov r8d, 0x3000
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call r15
mov rsi, rax
test rax, rax
jne 0x140021052
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rbx
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call r15
mov rsi, rax
test rax, rax
jne 0x140021052
mov ecx, 0xe
jmp 0x1400212b5
movabs rdx, 0xffffffff00000000
lea rcx, [rsi + rdi]
mov rax, rsi
and rcx, rdx
and rax, rdx
cmp rax, rcx
jae 0x1400210d8
mov ecx, 0x10
call fcn.1401e3a94
mov r15, rax
test rax, rax
je 0x140021181
mov qword [rax], r13
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], rsi
mov rdx, rdi
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov r13, rax
call qword [rsp + 0xb0]
mov rsi, rax
test rax, rax
je 0x14002116e
lea rcx, [rax + rdi]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x14002106e
mov r15, qword [rsp + 0xb0]
call fcn.14000989c
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call fcn.140009bfc
mov rdi, rax
test rax, rax
je 0x140021181
mov qword [rax + 8], rsi
movzx eax, word [rbp + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rdi + 0x30], r14
mov r14, qword [rsp + 0xa8]
mov dword [rdi + 0x20], eax
mov rax, qword [rsp + 0xc0]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x58], rbx
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x68], eax
mov qword [rdi + 0x70], r13
mov edx, dword [rbp + 0x54]
cmp r14, rdx
jae 0x140021197
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.140020c78
jmp 0x1400212bb
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140020af8
jmp 0x140021048
mov r9, rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call r14
mov rcx, r13
jmp 0x140021171
mov r9d, 4
mov qword [rsp + 0x20], rbx
mov r8d, 0x1000
mov rcx, rsi
call r15
mov r8d, dword [rbp + 0x54]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.1401db130
movsxd rax, dword [r12 + 0x3c]
mov r9, rdi
add rax, rbx
mov r8, rbp
mov qword [rdi], rax
mov rdx, r14
mov rcx, r12
mov qword [rax + 0x30], rsi
call fcn.14002078c
xor r14d, r14d
test eax, eax
je 0x140021161
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rbp + 0x30]
je 0x140021202
mov rcx, rdi
call fcn.140020b54
jmp 0x140021207
mov eax, 1
mov rcx, rdi
mov dword [rdi + 0x24], eax
call fcn.140020614
test eax, eax
je 0x140021161
mov rcx, rdi
call fcn.140020974
test eax, eax
je 0x140021161
mov rcx, qword [rdi]
mov rax, rcx
mov edx, dword [rcx + 0xd0]
test edx, edx
je 0x14002126c
mov rbp, qword [rdi + 8]
mov rbx, qword [rdx + rbp + 0x18]
test rbx, rbx
je 0x14002126c
mov r9, qword [rbx]
test r9, r9
je 0x14002126c
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call r9
lea rbx, [rbx + 8]
mov r9, qword [rbx]
test r9, r9
jne 0x140021250
mov rax, qword [rdi]
cmp dword [rax + 0x28], r14d
je 0x1400212a7
mov eax, dword [rax + 0x28]
add rax, rsi
cmp dword [rdi + 0x20], r14d
je 0x1400212a1
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x140021298
mov ecx, 0x45a
jmp 0x14002115b
mov dword [rdi + 0x1c], 1
jmp 0x1400212ab
mov qword [rdi + 0x60], rax
jmp 0x1400212ab
mov qword [rdi + 0x60], r14
mov rax, rdi
jmp 0x1400212bd
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret