Function at 0x1400ec140
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rdx], 0
mov qword [r8], 0
mov qword [r9], 0
mov al, 1
cmp qword [rsp + 0xd0], 0
je 0x1400ec4e4
mov rdi, r9
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rbp, qword [0x140d81498]
test rbp, rbp
je 0x1400ec192
xor ecx, ecx
jmp 0x1400ec1ab
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x3c]
mov qword [0x140d81498], rbp
mov rcx, qword [rbx]
mov rax, qword [rsp + 0xd0]
cmp rbp, rax
cmovae rbp, rax
mov rdx, qword [r12]
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400ec305
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0xd8], 0
je 0x1400ec420
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r14, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
mov r13, rsi
call rsi
cmp rax, 0xffffffffffffffff
je 0x1400ec329
mov rsi, rax
cmp rax, 1
je 0x1400ec4f5
cmp rsi, 2
je 0x1400ec519
mov qword [rdi], 0
xor eax, eax
mov r15, qword [rsp + 0xd0]
nop word cs:[rax + rax]
nop
cmp rbp, rax
jbe 0x1400ec2c0
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ec34c
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x1400ec4d9
cmp rax, r15
jne 0x1400ec270
jmp 0x1400ec4d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov rcx, qword [rbx]
mov rdx, qword [r12]
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov r15, r14
mov rsi, r13
jne 0x1400ec1f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.ReadFileToBuffer
lea r8, str.allocate
mov rcx, rbp
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbx]
mov rdx, qword [r12]
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
xor eax, eax
jmp 0x1400ec4e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400ec3b9
mov rbx, qword [r12]
test rbx, rbx
je 0x1400ec3b9
lea rdx, [rsp + 0x38]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400ec53d
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400ec3b9
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400ec561
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400ec4e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov rcx, qword [rbx]
mov rdx, qword [r12]
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
test rax, rax
mov r15, r13
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x1400ec305
nop word cs:[rax + rax]
nop
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r13, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call rsi
cmp rax, 0xffffffffffffffff
je 0x1400ec339
mov rsi, rax
cmp rax, 1
je 0x1400ec4f5
cmp rsi, 2
je 0x1400ec519
mov qword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0xd0]
lea r15, [rsp + 0x38]
nop dword [rax]
cmp rbp, rax
jbe 0x1400ec3c9
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ec35c
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x1400ec4d9
cmp rax, r14
jne 0x1400ec490
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
mov edx, 0x2485
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
mov edx, 0x2486
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__VirtualQuery_addr__mbi__sizeof_mbi________0_
mov edx, 0x222c
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov rsi, qword [str.SanitizerTool]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rcx, str.ERROR:__s_failed_to_deallocate_0x_zx___zd__bytes_at_address__p__error_code:__d__n
mov rdx, rsi
mov r8, rbx
mov r9, rbx
call method.__sanitizer.Report_char_const__..._
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___unable_to_unmap___0______0_
mov edx, 0x2236
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3