Function at 0x1800015c0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x70
xor r8d, r8d
mov r14, r9
mov ebx, r8d
mov edi, r8d
cmp rdx, 0x40
jb 0x18000160a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180001ae4
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp rdx, rax
jae 0x180001624
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
movsxd r15, dword [rcx + 0x3c]
add r15, rcx
cmp dword [r15], 0x4550
jne 0x180001ae4
mov eax, 0x8664
cmp word [r15 + 4], ax
jne 0x180001ae4
mov eax, dword [r15 + 0x38]
test al, 1
jne 0x180001ae4
movzx ecx, word [r15 + 0x14]
mov r9d, eax
movzx eax, word [r15 + 6]
add rcx, 0x24
cmp r8w, ax
jae 0x180001696
add rcx, r15
mov r8d, eax
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x180001680
lea rax, [r9 + rdx]
jmp 0x180001682
add eax, edx
cmp rax, rbx
cmovbe rax, rbx
add rcx, 0x28
mov rbx, rax
sub r8, 1
jne 0x180001671
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
mov eax, dword [r15 + 0x50]
lea r12, [rdx - 1]
add r12, rax
lea rcx, [rdx - 1]
not rcx
lea rax, [rdx - 1]
add rax, rbx
and r12, rcx
and rax, rcx
cmp r12, rax
jne 0x180001ae4
mov rcx, qword [r15 + 0x30]
mov r9d, 4
mov rbx, qword [rsp + 0xb0]
mov r8d, 0x3000
mov qword [rsp + 0xb8], rbp
mov rdx, r12
mov rbp, qword [rsp + 0xd8]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x68], rsi
call rbx
mov r13, rax
test rax, rax
jne 0x180001733
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rbp
mov r8d, 0x3000
mov rdx, r12
xor ecx, ecx
call rbx
mov r13, rax
test rax, rax
je 0x180001815
movabs rdx, 0xffffffff00000000
lea rcx, [r12 + r13]
mov rax, r13
and rcx, rdx
and rax, rdx
cmp rax, rcx
jae 0x1800017ad
nop
mov ecx, 0x10
call fcn.180006adc
mov rsi, rax
test rax, rax
je 0x180001868
mov qword [rax], rdi
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r13
mov rdx, r12
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov rdi, rax
call rbx
mov r13, rax
test rax, rax
je 0x180001841
lea rcx, [r12 + rax]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x180001750
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1800018aa
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call r14
test rdi, rdi
je 0x180001815
nop word [rax + rax]
mov rcx, qword [rdi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.1800069e0
mov rdi, rbx
test rbx, rbx
jne 0x1800017f0
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xb8]
mov r13, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rsi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rsi]
mov rcx, rsi
call fcn.1800069e0
mov rsi, rbx
test rbx, rbx
jne 0x180001841
jmp 0x180001815
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call r14
test rdi, rdi
je 0x180001815
nop
mov rcx, qword [rdi + 8]
mov r9, rbp
xor edx, edx
mov r8d, 0x8000
call r14
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.1800069e0
mov rdi, rbx
test rbx, rbx
jne 0x180001880
jmp 0x180001815
mov qword [rax + 8], r13
movzx eax, word [r15 + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rsi + 0x30], r14
mov r14, qword [rsp + 0xa8]
mov dword [rsi + 0x20], eax
lea rax, [0x180001590]
mov qword [rsi + 0x38], rax
lea rax, [0x1800015a0]
mov qword [rsi + 0x40], rax
lea rax, [0x1800015b0]
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x58], rbp
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0x68], eax
mov qword [rsi + 0x70], rdi
mov eax, dword [r15 + 0x54]
cmp r14, rax
jae 0x18000191d
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call fcn.180001b00
jmp 0x180001820
mov edx, dword [r15 + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov qword [rsp + 0x20], rbp
mov rcx, r13
call rbx
mov rdi, qword [rsp + 0xa0]
mov rcx, rax
mov r8d, dword [r15 + 0x54]
mov rdx, rdi
mov rbx, rax
call fcn.1800044e0
movsxd rax, dword [rdi + 0x3c]
mov r9, rsi
add rax, rbx
mov r8, r15
mov qword [rsi], rax
mov rdx, r14
mov rcx, rdi
mov qword [rax + 0x30], r13
call section..text
test eax, eax
je 0x180001910
mov rax, qword [rsi]
mov rbx, qword [rax + 0x30]
sub rbx, qword [r15 + 0x30]
je 0x180001a19
cmp dword [rax + 0xb4], 0
jne 0x180001995
xor eax, eax
jmp 0x180001a1e
mov r11d, dword [rax + 0xb0]
mov rdi, qword [rsi + 8]
add r11, rdi
mov eax, dword [r11]
test eax, eax
je 0x180001a19
nop word [rax + rax]
mov r9d, dword [r11 + 4]
lea rdx, [r11 + 8]
mov r10d, eax
xor r8d, r8d
add r10, rdi
lea rax, [r9 - 8]
test rax, 0xfffffffffffffffe
jbe 0x180001a0c
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x1800019ee
cmp eax, 0xa
jne 0x1800019f2
add qword [rcx + r10], rbx
jmp 0x1800019f2
add dword [rcx + r10], ebx
mov r9d, dword [r11 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r9 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x1800019d0
mov eax, r9d
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x1800019b0
mov eax, 1
mov rcx, rsi
mov dword [rsi + 0x24], eax
call fcn.1800013d0
test eax, eax
je 0x180001910
mov rcx, rsi
call fcn.180001140
test eax, eax
je 0x180001910
mov rax, qword [rsi]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x180001a7d
mov rdi, qword [rsi + 8]
mov rbx, qword [rcx + rdi + 0x18]
test rbx, rbx
je 0x180001a7d
mov rax, qword [rbx]
test rax, rax
je 0x180001a7d
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x180001a64
mov rax, qword [rsi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x180001ad4
cmp dword [rsi + 0x20], 0
lea rax, [rcx + r13]
je 0x180001ac8
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x180001ab9
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call fcn.180001b00
jmp 0x180001820
mov dword [rsi + 0x1c], 1
mov rax, rsi
jmp 0x180001822
mov qword [rsi + 0x60], rax
mov rax, rsi
jmp 0x180001822
mov qword [rsi + 0x60], 0
mov rax, rsi
jmp 0x180001822
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret