Function at 0x140047720
Capabilities:
Get system information on windows
Parse pe header
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12, r9
xor ebp, ebp
mov edi, ebp
mov qword [rax - 0x78], rbp
mov esi, ebp
mov qword [rax - 0x80], rbp
mov ebx, ebp
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x1400477a3
mov rdi, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x140047934
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
test rax, rax
je 0x140047934
mov rsi, rax
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r13d, dword [rsp + 0x64]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x140047934
mov rbx, rax
mov qword [rsp + 0x40], rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400478d3
mov ebp, dword [rbx + 0x3c]
add rbp, rbx
mov edx, 0x108
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400478a1
cmp dword [rbp], 0x4550
jne 0x1400478a1
mov r12d, dword [rbp + 0x54]
cmp r13d, r12d
jae 0x1400478da
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
cmp rbx, rax
je 0x140047897
cmp qword [sym.imp.KERNEL32.dll_UnmapViewOfFile], 0
je 0x14004788f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x40], 0
mov rbx, rbp
mov qword [rsp + 0x40], rbx
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x1400478ab
mov ebp, 0xc1
jmp 0x14004793c
mov eax, dword [rbx + 0x3c]
add eax, ebx
mov ebp, eax
mov edx, 0x108
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400478a1
cmp dword [rbp], 0x4550
je 0x1400478da
mov ebp, 0xc1
jmp 0x14004793c
mov rbp, qword [rsp + 0x50]
jmp 0x1400478e2
mov r12, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x1400478f9
mov qword [rax], rbx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x140047910
mov qword [rax], rdi
xor edi, edi
mov qword [rsp + 0x50], rdi
test r12, r12
je 0x140047920
mov qword [r12], r15
xor esi, esi
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x140047930
mov qword [rax], rbp
xor ebp, ebp
jmp 0x14004793c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test rbx, rbx
je 0x14004795d
cmp qword [sym.imp.KERNEL32.dll_UnmapViewOfFile], 0
je 0x14004795d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x40], 0
test rsi, rsi
je 0x14004797e
cmp qword [sym.imp.KERNEL32.dll_CloseHandle], 0
je 0x14004797e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
test rdi, rdi
je 0x14004799f
cmp qword [sym.imp.KERNEL32.dll_CloseHandle], 0
je 0x14004799f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], 0
mov eax, ebp
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret