Function at 0x515320
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rdx
mov byte [rbp + 0x140], r8b
mov rcx, qword [rbp + 0x138]
call fcn.00410210
nop
lea rcx, [rbp + 0xa0]
call fcn.00514f10
mov rcx, qword [rbp + 0x138]
call fcn.00411e10
mov rcx, rax
mov edx, 0x80000000
mov r8d, 3
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000080
mov qword [rsp + 0x30], 0
call qword [0x00b34d90]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0xffffffffffffffff
je 0x515568
nop
lea rcx, [rbp + 0x70]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rbp + 0x98]
add eax, eax
lea rax, [rax + rax*4]
mov dword [rbp + 0x6c], eax
mov rcx, qword [rbp + 0xf8]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x100], rax
cmp qword [rbp + 0x100], 0
je 0x51551f
nop
mov qword [rbp + 0x58], 0
mov rcx, qword [rbp + 0xf8]
lea rdx, [rbp + 0x64]
call qword [0x00b34e50]
mov dword [rbp + 0x60], eax
cmp dword [rbp + 0x60], 0xffffffff
jne 0x51546d
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x51546d
mov dword [rbp + 0x64], 0xffffffff
cmp byte [rbp + 0x140], 0
je 0x51546d
mov rdi, qword [rbp + 0x130]
lea rsi, [0x00b34d80]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov rcx, qword [rbp + 0x48]
lea rdx, [0x00515599]
call fcn.0040f2d0
jmp 0x515599
cmp qword [rbp + 0x60], 0
jle 0x515510
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x58]
neg rcx
lea rax, [rax + rcx]
mov ecx, dword [rbp + 0x6c]
cmp rax, rcx
jge 0x515498
mov eax, dword [rbp + 0x60]
sub eax, dword [rbp + 0x58]
mov dword [rbp + 0x6c], eax
mov rcx, qword [rbp + 0x100]
mov edx, 4
mov r8d, dword [rbp + 0x5c]
mov r9d, dword [rbp + 0x58]
mov eax, dword [rbp + 0x6c]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x5154f0
nop
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x108]
mov r8d, dword [rbp + 0x6c]
call fcn.00514f60
nop
mov rcx, qword [rbp + 0x108]
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [rbp + 0x6c]
add qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
cmp rax, qword [rbp + 0x60]
jge 0x51550f
cmp qword [rbp + 0x108], 0
jne 0x515478
nop
nop
mov rcx, qword [rbp + 0x100]
call sub.kernel32.dll_CloseHandle
jmp 0x515559
cmp byte [rbp + 0x140], 0
je 0x515559
call sub.kernel32.dll_GetLastError
cmp eax, 0x3ee
je 0x515559
mov rdi, qword [rbp + 0x130]
lea rsi, [0x00b34d80]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov rcx, qword [rbp + 0x48]
lea rdx, [0x00515599]
call fcn.0040f2d0
jmp 0x515599
nop
mov rcx, qword [rbp + 0xf8]
call sub.kernel32.dll_CloseHandle
jmp 0x515585
cmp byte [rbp + 0x140], 0
je 0x515585
mov rdi, qword [rbp + 0x130]
lea rsi, [0x00b34d80]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
jmp 0x515599
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x130]
call fcn.00515030
nop
lea rcx, [rbp + 0x138]
call fcn.00410080
mov rax, qword [rbp + 0x130]
lea rsp, [rbp + 0x110]
pop rsi
pop rdi
pop rbp
ret