Function at 0x4ec160
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rdx], 0
mov qword [r8], 0
mov qword [r9], 0
mov al, 1
cmp qword [rsp + 0xd0], 0
je 0x4ec504
mov rdi, r9
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rbp, qword [0x01170498]
test rbp, rbp
je 0x4ec1b2
xor ecx, ecx
jmp 0x4ec1cb
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x3c]
mov qword [0x01170498], rbp
mov rcx, qword [rbx]
mov rax, qword [rsp + 0xd0]
cmp rbp, rax
cmovae rbp, rax
mov rdx, qword [r12]
call fcn.004ced60
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x4ec325
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0xd8], 0
je 0x4ec440
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r14, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
mov r13, rsi
call rsi
cmp rax, 0xffffffffffffffff
je 0x4ec349
mov rsi, rax
cmp rax, 1
je 0x4ec515
cmp rsi, 2
je 0x4ec539
mov qword [rdi], 0
xor eax, eax
mov r15, qword [rsp + 0xd0]
nop word cs:[rax + rax]
nop
cmp rbp, rax
jbe 0x4ec2e0
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ec36c
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x4ec4f9
cmp rax, r15
jne 0x4ec290
jmp 0x4ec4f9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.004ced60
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov r15, r14
mov rsi, r13
jne 0x4ec219
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.ReadFileToBuffer
lea r8, str.allocate
mov rcx, rbp
mov r9d, eax
call fcn.004e5be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.004ced60
xor eax, eax
jmp 0x4ec504
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rdi, qword [rbx]
test rdi, rdi
je 0x4ec3d9
mov rbx, qword [r12]
test rbx, rbx
je 0x4ec3d9
lea rdx, [rsp + 0x38]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4ec55d
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x4ec3d9
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x4ec581
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4ec504
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.004ced60
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
test rax, rax
mov r15, r13
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x4ec325
nop word cs:[rax + rax]
nop
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r13, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call rsi
cmp rax, 0xffffffffffffffff
je 0x4ec359
mov rsi, rax
cmp rax, 1
je 0x4ec515
cmp rsi, 2
je 0x4ec539
mov qword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0xd0]
lea r15, [rsp + 0x38]
nop dword [rax]
cmp rbp, rax
jbe 0x4ec3e9
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ec37c
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x4ec4f9
cmp rax, r14
jne 0x4ec4b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
mov edx, 0x2485
xor r9d, r9d
call fcn.004b9330
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
mov edx, 0x2486
xor r9d, r9d
call fcn.004b9330
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__VirtualQuery_addr__mbi__sizeof_mbi________0_
mov edx, 0x222c
xor r9d, r9d
call fcn.004b9330
mov rsi, qword [str.SanitizerTool]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rcx, str.ERROR:__s_failed_to_deallocate_0x_zx___zd__bytes_at_address__p__error_code:__d__n
mov rdx, rsi
mov r8, rbx
mov r9, rbx
call fcn.004e5610
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___unable_to_unmap___0______0_
mov edx, 0x2236
xor r9d, r9d
call fcn.004b9330
int3