Function at 0x14001db20
Capabilities:
Get system information on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r12, r9
mov r13, r8
mov r14, rdx
mov r15, rcx
test rdx, rdx
je 0x14001db62
cmp rdx, 0x40
jae 0x14001db62
mov ecx, SafeArrayDestroy
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x14001db87
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
test r14, r14
je 0x14001db9b
movsxd rax, dword [rcx + 0x3c]
add rax, 0x108
cmp r14, rax
jb 0x14001db47
mov qword [rsp + 0x90], rsi
movsxd rsi, dword [rcx + 0x3c]
add rsi, r15
cmp dword [rsi], 0x4550
jne 0x14001dbc5
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x14001dbc5
mov ecx, dword [rsi + 0x38]
test cl, 1
je 0x14001dbd7
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14001dd49
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x24]
add rdx, rax
mov qword [rsp + 0x98], rdi
movzx eax, word [rsi + 6]
mov r9, rcx
test eax, eax
je 0x14001dc1b
mov r8d, eax
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x14001dc06
mov eax, dword [rdx]
add rax, r9
jmp 0x14001dc0a
mov eax, dword [rdx]
add eax, ecx
cmp rax, rbx
cmova rbx, rax
add rdx, 0x28
sub r8, 1
jne 0x14001dbf8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x24]
lea r8d, [rdx - 1]
lea edi, [rdx - 1]
not r8d
add edi, dword [rsi + 0x50]
lea rcx, [rdx - 1]
add rcx, rbx
and rdi, r8
and rcx, r8
cmp rdi, rcx
jae 0x14001dc5b
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14001dd41
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov qword [rsp + 0x80], rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x14001dca1
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14001dcd2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14001dcdf
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, SafeArrayGetUBound
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001dd37
mov qword [rax + 8], rbp
movzx eax, word [rsi + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rdi + 0x28], r13
mov dword [rdi + 0x20], eax
mov rax, qword [rsp + 0xa0]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x30], r12
mov eax, dword [rsp + 0x24]
mov dword [rdi + 0x50], eax
test r14, r14
je 0x14001dd5f
mov eax, dword [rsi + 0x54]
cmp r14, rax
jae 0x14001dd5f
mov ecx, SafeArrayDestroy
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.14001e080
xor eax, eax
mov rbp, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov edx, dword [rsi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, rax
mov rbx, rax
call fcn.1400c64d0
movsxd rax, dword [r15 + 0x3c]
mov r9, rdi
add rax, rbx
mov r8, rsi
mov qword [rdi], rax
mov rdx, r14
mov rcx, r15
mov qword [rax + 0x30], rbp
call fcn.14001d280
test eax, eax
je 0x14001dd2f
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rsi + 0x30]
je 0x14001ddc6
mov rcx, rdi
call fcn.14001d610
mov dword [rdi + 0x24], eax
jmp 0x14001ddcd
mov dword [rdi + 0x24], 1
mov rcx, rdi
call fcn.14001d6d0
test eax, eax
je 0x14001dd2f
mov rcx, rdi
call fcn.14001d3b0
test eax, eax
je 0x14001dd2f
mov eax, dword [0x1401344b8]
cmp qword [rsi + 0x30], rax
je 0x14001de39
mov rax, qword [rdi]
mov rsi, qword [rdi + 8]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14001de39
mov rbx, qword [rcx + rsi + 0x18]
test rbx, rbx
je 0x14001de39
mov rax, qword [rbx]
test rax, rax
je 0x14001de39
nop dword [rax]
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14001de20
mov rdx, qword [rdi]
mov eax, dword [rdx + 0x28]
test eax, eax
je 0x14001df42
cmp dword [rdi + 0x20], 0
je 0x14001df33
lea rsi, [rax + rbp]
mov rax, qword gs:[0x60]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x88], 0
mov qword [0x1401373d8], rcx
mov r14, qword [rax + 0x110]
mov eax, dword [rdx + 0x50]
add rax, rcx
cmp qword [0x14013a3e8], 0
mov qword [0x1401373d0], rax
jne 0x14001deb7
lea rcx, [0x14010d078]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlPcToFileHeader
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013a3e8], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x88]
call fcn.14001e9e0
mov r8, rdi
mov edx, 1
mov rcx, rbp
mov rbx, rax
call rsi
mov esi, eax
test rbx, rbx
je 0x14001df0d
mov rcx, rbx
call fcn.14001eba0
mov rcx, qword [rsp + 0x88]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x14001df24
mov ecx, 0x45a
jmp 0x14001dd29
mov dword [rdi + 0x1c], 1
mov rax, rdi
jmp 0x14001dd39
add rax, rbp
mov qword [rdi + 0x48], rax
mov rax, rdi
jmp 0x14001dd39
mov qword [rdi + 0x48], 0
mov rax, rdi
jmp 0x14001dd39