Function at 0x180001654
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov eax, 0x5a4d
xor edi, edi
xor r12d, r12d
cmp word [0x180018580], ax
je 0x18000168f
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000188e
movsxd rcx, dword [0x1800185bc]
lea rax, [rcx + 0x108]
cmp rax, 0x6ac00
jbe 0x1800016ac
mov ecx, 0xd
jmp 0x180001684
lea rax, [0x180018580]
lea rbp, [rcx + rax]
cmp dword [rbp], 0x4550
jne 0x18000167f
mov eax, 0x8664
cmp word [rbp + 4], ax
jne 0x18000167f
test byte [rbp + 0x38], 1
jne 0x18000167f
movzx eax, word [rbp + 6]
movzx ecx, word [rbp + 0x14]
mov r9d, dword [rbp + 0x38]
test eax, eax
je 0x18000170b
lea rdx, [rcx + rbp + 0x24]
mov r8d, eax
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x1800016f7
mov eax, dword [rdx]
add rax, r9
jmp 0x1800016fb
mov eax, dword [rdx]
add eax, ecx
cmp rax, rdi
cmova rdi, rax
add rdx, 0x28
dec r8
jne 0x1800016e9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r11d, dword [rsp + 0x24]
mov eax, dword [rbp + 0x50]
lea rbx, [rax + r11 - 1]
lea rax, [r11 - 1]
lea rcx, [r11 + rdi - 1]
not rax
and rbx, rax
lea rax, [r11 - 1]
not rax
and rcx, rax
cmp rbx, rcx
jne 0x18000167f
mov rcx, qword [rbp + 0x30]
mov r15d, 4
mov edi, 0x3000
mov r9d, r15d
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000178e
mov r9d, r15d
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000178e
mov ecx, 0xe
jmp 0x180001684
lea rcx, [rsi + rbx]
movabs r15, 0xffffffff00000000
mov rax, rsi
jmp 0x1800017e8
mov ecx, 0x10
call fcn.18000574c
mov rdi, rax
test rax, rax
je 0x1800018c1
mov qword [rax], r12
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
mov qword [rax + 8], rsi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1800018aa
lea rcx, [rax + rbx]
and rcx, r15
and rax, r15
cmp rax, rcx
jb 0x1800017a1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1800018c1
mov qword [rax + 8], rsi
movzx eax, word [rbp + 0x16]
and qword [rdi + 0x58], 0
shr eax, 0xd
and eax, 1
mov dword [rdi + 0x20], eax
lea rax, [0x18000162c]
mov qword [rdi + 0x28], rax
lea rax, [0x180001634]
mov qword [rdi + 0x30], rax
lea rax, [0x18000163c]
mov qword [rdi + 0x38], rax
lea rax, [0x180001644]
mov qword [rdi + 0x40], rax
lea rax, [0x18000164c]
mov qword [rdi + 0x48], rax
mov eax, dword [rsp + 0x24]
mov qword [rdi + 0x70], r12
mov dword [rdi + 0x68], eax
mov edx, dword [rbp + 0x54]
cmp rdx, 0x6ac00
jbe 0x1800018d7
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.180001b6c
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
mov rcx, rdi
lea rdx, [0x180001634]
xor r8d, r8d
call fcn.180001000
jmp 0x180001784
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r12
jmp 0x1800018ad
mov r9d, 4
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x54]
lea rdx, [0x180018580]
mov rcx, rax
mov rbx, rax
call fcn.180009040
movsxd rax, dword [0x1800185bc]
mov rdx, rdi
add rax, rbx
mov rcx, rbp
mov qword [rdi], rax
mov qword [rax + 0x30], rsi
call fcn.18000105c
test eax, eax
je 0x180001886
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rbp + 0x30]
je 0x180001940
mov rcx, rdi
call fcn.1800013e8
mov dword [rdi + 0x24], eax
jmp 0x180001947
mov dword [rdi + 0x24], 1
mov rcx, rdi
call fcn.1800014a8
test eax, eax
je 0x180001886
mov rcx, rdi
call fcn.180001254
test eax, eax
je 0x180001886
mov rax, qword [rdi]
mov rbp, qword [rdi + 8]
cmp dword [rax + 0xd0], 0
je 0x1800019a1
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + rbp + 0x18]
test rbx, rbx
je 0x1800019a1
jmp 0x180001999
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x180001989
mov rax, qword [rdi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x1800019de
cmp dword [rdi + 0x20], 0
lea rax, [rsi + rcx]
je 0x1800019d8
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x1800019cf
mov ecx, 0x45a
jmp 0x180001880
mov dword [rdi + 0x1c], 1
jmp 0x1800019e3
mov qword [rdi + 0x60], rax
jmp 0x1800019e3
and qword [rdi + 0x60], 0
mov rax, rdi
jmp 0x180001890