Function at 0x1800053b4
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1802b99e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rbp, rdx
lea r8d, [rbx + 0x40]
call fcn.180004d50
test eax, eax
je 0x180005644
mov eax, 0x5a4d
cmp word [rbp], ax
je 0x180005406
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180005644
movsxd r8, dword [rbp + 0x3c]
add r8, 0x108
call fcn.180004d50
test eax, eax
je 0x180005644
movsxd rdi, dword [rbp + 0x3c]
add rdi, rbp
cmp dword [rdi], 0x4550
jne 0x1800053f6
mov eax, 0x8664
cmp word [rdi + 4], ax
jne 0x1800053f6
test byte [rdi + 0x38], 1
jne 0x1800053f6
movzx eax, word [rdi + 6]
movzx ecx, word [rdi + 0x14]
mov r9d, dword [rdi + 0x38]
test eax, eax
je 0x18000547a
lea rdx, [rdi + 0x24]
mov r8d, eax
add rdx, rcx
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x180005466
mov eax, dword [rdx]
add rax, r9
jmp 0x18000546a
mov eax, dword [rdx]
add eax, ecx
cmp rax, rbx
cmova rbx, rax
add rdx, 0x28
dec r8
jne 0x180005458
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r8d, dword [rsp + 0x34]
lea edx, [r8 - 1]
lea r14d, [r8 - 1]
lea rcx, [r8 - 1]
add r14d, dword [rdi + 0x50]
not edx
add rcx, rbx
and r14, rdx
and rcx, rdx
cmp r14, rcx
jne 0x1800053f6
mov rcx, qword [rdi + 0x30]
mov ebx, 0x3000
mov r9d, 4
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800054f5
lea r9d, [rax + 4]
mov r8d, ebx
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800054f5
mov ecx, SafeArrayGetDim
jmp 0x1800053fb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x180005528
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800054eb
mov qword [rax + 8], rsi
movzx eax, word [rdi + 0x16]
and qword [rbx + 0x40], 0
shr eax, 0xd
and eax, 1
mov dword [rbx + 0x20], eax
lea rax, [0x18000539c]
mov qword [rbx + 0x28], rax
lea rax, [0x1800053a4]
mov qword [rbx + 0x30], rax
lea rax, [0x1800053ac]
mov qword [rbx + 0x38], rax
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0x50], eax
mov r8d, dword [rdi + 0x54]
call fcn.180004d50
test eax, eax
je 0x18000563c
mov edx, dword [rdi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rdi + 0x54]
mov rdx, rbp
mov rcx, rax
mov r10, rax
call fcn.180004c90
movsxd rax, dword [rbp + 0x3c]
mov r9, rdi
add rax, r10
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov qword [rbx], rax
mov qword [rax + 0x30], rsi
call fcn.180004d78
test eax, eax
je 0x18000563c
mov rax, qword [rbx]
mov r8, qword [rax + 0x30]
sub r8, qword [rdi + 0x30]
je 0x1800055dd
mov rdx, rbx
call fcn.180005154
mov dword [rbx + 0x24], eax
jmp 0x1800055e4
mov dword [rbx + 0x24], 1
mov rdx, rbx
call fcn.180005214
test eax, eax
je 0x18000563c
mov rdx, rbx
call fcn.180004f94
test eax, eax
je 0x18000563c
mov rdx, rbx
call fcn.180005104
test eax, eax
je 0x18000563c
mov rax, qword [rbx]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x180005632
cmp dword [rbx + 0x20], 0
lea rax, [rsi + rcx]
je 0x18000562c
mov qword [0x1802cc5f0], rax
mov dword [rbx + 0x1c], 1
jmp 0x180005637
mov qword [rbx + 0x48], rax
jmp 0x180005637
and qword [rbx + 0x48], 0
mov rax, rbx
jmp 0x180005646
mov rdx, rbx
call fcn.180005678
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801bb450
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret