Function at 0x1400074ac
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
xor r15d, r15d
mov r12, r9
mov rsi, r8
mov r13, rdx
mov r14, rcx
cmp rdx, 0x40
jae 0x1400074f1
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140007714
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x140007502
mov ecx, 0xc1
jmp 0x1400074e6
movsxd rcx, dword [rcx + 0x3c]
lea rax, [rcx + 0x108]
cmp rdx, rax
jb 0x1400074e1
lea rbp, [rcx + r14]
cmp dword [rbp], 0x4550
jne 0x1400074fb
mov eax, 0x8664
cmp word [rbp + 4], ax
jne 0x1400074fb
test byte [rbp + 0x38], 1
jne 0x1400074fb
movzx eax, word [rbp + 6]
movzx ecx, word [rbp + 0x14]
mov r9d, dword [rbp + 0x38]
test eax, eax
je 0x14000756a
lea rdx, [rcx + rbp + 0x24]
mov r8d, eax
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x140007556
mov eax, dword [rdx]
add rax, r9
jmp 0x14000755a
mov eax, dword [rdx]
add eax, ecx
cmp rax, rbx
cmova rbx, rax
add rdx, 0x28
dec r8
jne 0x140007548
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r11d, dword [rsp + 0x34]
mov eax, dword [rbp + 0x50]
lea rdi, [rax + r11 - 1]
lea rax, [r11 - 1]
lea rcx, [r11 + rbx - 1]
not rax
and rdi, rax
lea rax, [r11 - 1]
not rax
and rcx, rax
cmp rdi, rcx
jne 0x1400074fb
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call rsi
mov rsi, rax
test rax, rax
jne 0x1400075fb
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [rsp + 0xb0]
mov rsi, rax
test rax, rax
jne 0x1400075fb
mov ecx, ntohs
jmp 0x1400074e6
movabs rdx, 0xffffffff00000000
lea rcx, [rsi + rdi]
mov rax, rsi
and rcx, rdx
and rax, rdx
cmp rax, rcx
jae 0x140007681
mov ecx, reloc.WS2_32.dll_recv
call fcn.140022c58
mov r13, rax
test rax, rax
je 0x140007741
mov qword [rax], r15
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
mov qword [rax + 8], rsi
mov r15, rax
mov qword [rsp + 0x20], rbx
call qword [rsp + 0xb0]
mov rsi, rax
test rax, rax
je 0x14000772e
lea rcx, [rax + rdi]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x140007617
mov r13, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140007741
mov r10, qword [rsp + 0xb0]
mov qword [rax + 8], rsi
movzx eax, word [rbp + 0x16]
shr eax, 0xd
mov qword [rdi + 0x28], r10
mov qword [rdi + 0x30], r12
and eax, 1
mov qword [rdi + 0x58], rbx
mov dword [rdi + 0x20], eax
mov rax, qword [rsp + 0xc0]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x48], rax
mov eax, dword [rsp + 0x34]
mov qword [rdi + 0x70], r15
mov dword [rdi + 0x68], eax
mov edx, dword [rbp + 0x54]
cmp r13, rdx
jae 0x140007757
mov ecx, ntohs
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.1400073e4
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r13
mov rdx, r12
mov r8, rbx
call fcn.140006c1c
jmp 0x1400075f1
mov r9, rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call r12
mov rcx, r15
jmp 0x140007731
mov r9d, 4
mov r8d, 0x1000
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call r10
mov r8d, dword [rbp + 0x54]
mov rcx, rax
mov rdx, r14
mov rbx, rax
call fcn.140020ac0
movsxd rax, dword [r14 + 0x3c]
mov r9, rdi
add rax, rbx
mov r8, rbp
mov rdx, r13
mov qword [rdi], rax
mov rcx, r14
mov qword [rax + 0x30], rsi
call fcn.140006c78
xor r12d, r12d
test eax, eax
je 0x14000770c
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rbp + 0x30]
je 0x1400077c4
mov rcx, rdi
call fcn.140006ff8
mov dword [rdi + 0x24], eax
jmp 0x1400077cb
mov dword [rdi + 0x24], 1
mov rcx, rdi
call fcn.1400070b8
test eax, eax
je 0x14000770c
mov rcx, rdi
call fcn.140006e64
test eax, eax
je 0x14000770c
mov rax, qword [rdi]
mov rbp, qword [rdi + 8]
cmp dword [rax + 0xd0], r12d
je 0x140007825
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + rbp + 0x18]
test rbx, rbx
je 0x140007825
jmp 0x14000781d
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x14000780d
mov rax, qword [rdi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x140007862
lea rax, [rsi + rcx]
cmp dword [rdi + 0x20], r12d
je 0x14000785c
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x140007853
mov ecx, 0x45a
jmp 0x140007706
mov dword [rdi + 0x1c], 1
jmp 0x140007866
mov qword [rdi + 0x60], rax
jmp 0x140007866
mov qword [rdi + 0x60], r12
mov rax, rdi
jmp 0x140007716