Function at 0x180002bb0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x60
xor ebx, ebx
mov rbp, rdx
lea r8d, [rbx + 0x40]
call fcn.1800024d0
test eax, eax
je 0x180002be2
mov eax, 0x5a4d
cmp word [rbp], ax
je 0x180002bf2
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
movsxd r8, dword [rbp + 0x3c]
add r8, 0x108
call fcn.1800024d0
test eax, eax
je 0x180002be2
mov qword [rsp + 0x78], rdi
movsxd rdi, dword [rbp + 0x3c]
add rdi, rbp
cmp dword [rdi], 0x4550
jne 0x180002c2d
mov eax, 0x8664
cmp word [rdi + 4], ax
jne 0x180002c2d
mov ecx, dword [rdi + 0x38]
test cl, 1
je 0x180002c4d
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
movzx eax, word [rdi + 0x14]
lea rdx, [rdi + 0x24]
mov qword [rsp + 0x80], r14
add rdx, rax
movzx eax, word [rdi + 6]
mov r9, rcx
test eax, eax
je 0x180002c92
mov r8d, eax
nop
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x180002c7e
mov eax, dword [rdx]
add rax, r9
jmp 0x180002c82
mov eax, dword [rdx]
add eax, ecx
cmp rax, rbx
cmova rbx, rax
add rdx, 0x28
dec r8
jne 0x180002c70
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r8d, dword [rsp + 0x34]
lea edx, [r8 - 1]
lea r14d, [r8 - 1]
lea rcx, [r8 - 1]
add r14d, dword [rdi + 0x50]
not edx
add rcx, rbx
and r14, rdx
and rcx, rdx
cmp r14, rcx
je 0x180002cd4
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180002e8b
mov rcx, qword [rdi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r14
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180002d17
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x180002d48
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x180002d58
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, SafeArrayGetDim
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180002e84
mov qword [rax + 8], rsi
movzx eax, word [rdi + 0x16]
mov qword [rbx + 0x40], 0
shr eax, 0xd
and eax, 1
mov dword [rbx + 0x20], eax
lea rax, [0x180002b80]
mov qword [rbx + 0x28], rax
lea rax, [0x180002b90]
mov qword [rbx + 0x30], rax
lea rax, [0x180002ba0]
mov qword [rbx + 0x38], rax
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0x50], eax
mov r8d, dword [rdi + 0x54]
call fcn.1800024d0
test eax, eax
je 0x180002e7c
mov edx, dword [rdi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rdi + 0x54]
mov rdx, rbp
mov rcx, rax
mov r10, rax
call fcn.1800023e0
movsxd rax, dword [rbp + 0x3c]
mov r9, rdi
add rax, r10
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov qword [rbx], rax
mov qword [rax + 0x30], rsi
call fcn.180002500
test eax, eax
je 0x180002e7c
mov rax, qword [rbx]
mov r8, qword [rax + 0x30]
sub r8, qword [rdi + 0x30]
je 0x180002e14
mov rdx, rbx
call fcn.180002900
mov dword [rbx + 0x24], eax
jmp 0x180002e1b
mov dword [rbx + 0x24], 1
mov rdx, rbx
call fcn.1800029d0
test eax, eax
je 0x180002e7c
mov rdx, rbx
call fcn.180002710
test eax, eax
je 0x180002e7c
mov rdx, rbx
call fcn.1800028a0
test eax, eax
je 0x180002e7c
mov rax, qword [rbx]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x180002e6f
cmp dword [rbx + 0x20], 0
lea rax, [rsi + rcx]
je 0x180002e66
mov qword [0x18028cc70], rax
mov dword [rbx + 0x1c], 1
mov rax, rbx
jmp 0x180002e86
mov qword [rbx + 0x48], rax
mov rax, rbx
jmp 0x180002e86
mov qword [rbx + 0x48], 0
mov rax, rbx
jmp 0x180002e86
mov rdx, rbx
call fcn.180002ec0
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret