Function at 0x1401015c0
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rdx], 0
mov qword [r8], 0
mov qword [r9], 0
mov al, 1
cmp qword [rsp + 0xd0], 0
je 0x140101964
mov rdi, r9
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rbp, qword [0x140e17de8]
test rbp, rbp
je 0x140101612
xor ecx, ecx
jmp 0x14010162b
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x3c]
mov qword [0x140e17de8], rbp
mov rcx, qword [rbx]
mov rax, qword [rsp + 0xd0]
cmp rbp, rax
cmovae rbp, rax
mov rdx, qword [r12]
call fcn.1400e37c0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140101785
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0xd8], 0
je 0x1401018a0
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r14, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
mov r13, rsi
call rsi
cmp rax, 0xffffffffffffffff
je 0x1401017a9
mov rsi, rax
cmp rax, 1
je 0x140101975
cmp rsi, 2
je 0x140101999
mov qword [rdi], 0
xor eax, eax
mov r15, qword [rsp + 0xd0]
nop word cs:[rax + rax]
nop
cmp rbp, rax
jbe 0x140101740
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401017cc
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x140101959
cmp rax, r15
jne 0x1401016f0
jmp 0x140101959
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400e37c0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov r15, r14
mov rsi, r13
jne 0x140101679
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.ReadFileToBuffer
lea r8, str.allocate
mov rcx, rbp
mov r9d, eax
call fcn.1400fa8c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400e37c0
xor eax, eax
jmp 0x140101964
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rdi, qword [rbx]
test rdi, rdi
je 0x140101839
mov rbx, qword [r12]
test rbx, rbx
je 0x140101839
lea rdx, [rsp + 0x38]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401019bd
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140101839
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1401019e1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140101964
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400e37c0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
test rax, rax
mov r15, r13
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x140101785
nop word cs:[rax + rax]
nop
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r13, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call rsi
cmp rax, 0xffffffffffffffff
je 0x1401017b9
mov rsi, rax
cmp rax, 1
je 0x140101975
cmp rsi, 2
je 0x140101999
mov qword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0xd0]
lea r15, [rsp + 0x38]
nop dword [rax]
cmp rbp, rax
jbe 0x140101849
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401017dc
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x140101959
cmp rax, r14
jne 0x140101910
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
mov edx, 0x24e8
xor r9d, r9d
call fcn.1400ca810
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
mov edx, 0x24e9
xor r9d, r9d
call fcn.1400ca810
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__VirtualQuery_addr__mbi__sizeof_mbi________0_
mov edx, 0x227f
xor r9d, r9d
call fcn.1400ca810
mov rsi, qword [str.SanitizerTool]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rcx, str.ERROR:__s_failed_to_deallocate_0x_zx___zd__bytes_at_address__p__error_code:__d__n
mov rdx, rsi
mov r8, rbx
mov r9, rbx
call fcn.1400fa2d0
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___unable_to_unmap___0______0_
mov edx, 0x2289
xor r9d, r9d
call fcn.1400ca810
int3