Function at 0x1401098e0
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rdx], 0
mov qword [r8], 0
mov qword [r9], 0
mov al, 1
cmp qword [rsp + 0xd0], 0
je 0x140109c84
mov rdi, r9
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rbp, qword [0x140db1fa8]
test rbp, rbp
je 0x140109932
xor ecx, ecx
jmp 0x14010994b
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x3c]
mov qword [0x140db1fa8], rbp
mov rcx, qword [rbx]
mov rax, qword [rsp + 0xd0]
cmp rbp, rax
cmovae rbp, rax
mov rdx, qword [r12]
call fcn.1400ebae0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140109aa5
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0xd8], 0
je 0x140109bc0
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r14, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
mov r13, rsi
call rsi
cmp rax, 0xffffffffffffffff
je 0x140109ac9
mov rsi, rax
cmp rax, 1
je 0x140109c95
cmp rsi, 2
je 0x140109cb9
mov qword [rdi], 0
xor eax, eax
mov r15, qword [rsp + 0xd0]
nop word cs:[rax + rax]
nop
cmp rbp, rax
jbe 0x140109a60
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140109aec
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x140109c79
cmp rax, r15
jne 0x140109a10
jmp 0x140109c79
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r15
cmovae rbp, r15
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400ebae0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov r15, r14
mov rsi, r13
jne 0x140109999
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.ReadFileToBuffer
lea r8, str.allocate
mov rcx, rbp
mov r9d, eax
call fcn.140102be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400ebae0
xor eax, eax
jmp 0x140109c84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xd8]
mov dword [rcx], eax
mov rdi, qword [rbx]
test rdi, rdi
je 0x140109b59
mov rbx, qword [r12]
test rbx, rbx
je 0x140109b59
lea rdx, [rsp + 0x38]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140109cdd
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140109b59
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140109d01
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140109c84
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov rcx, qword [rbx]
mov rdx, qword [r12]
call fcn.1400ebae0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
test rax, rax
mov r15, r13
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
je 0x140109aa5
nop word cs:[rax + rax]
nop
mov qword [rbx], rax
mov qword [r12], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r13, r15
mov rcx, r15
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call rsi
cmp rax, 0xffffffffffffffff
je 0x140109ad9
mov rsi, rax
cmp rax, 1
je 0x140109c95
cmp rsi, 2
je 0x140109cb9
mov qword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0xd0]
lea r15, [rsp + 0x38]
nop dword [rax]
cmp rbp, rax
jbe 0x140109b69
mov rdx, qword [rbx]
add rdx, rax
mov r8d, ebp
sub r8d, eax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140109afc
mov ecx, dword [rsp + 0x38]
mov rax, qword [rdi]
add rax, rcx
mov qword [rdi], rax
test rcx, rcx
je 0x140109c79
cmp rax, r14
jne 0x140109c30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
mov edx, 0x24e8
xor r9d, r9d
call fcn.1400d2b30
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
mov edx, 0x24e9
xor r9d, r9d
call fcn.1400d2b30
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__VirtualQuery_addr__mbi__sizeof_mbi________0_
mov edx, 0x227f
xor r9d, r9d
call fcn.1400d2b30
mov rsi, qword [str.SanitizerTool]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rcx, str.ERROR:__s_failed_to_deallocate_0x_zx___zd__bytes_at_address__p__error_code:__d__n
mov rdx, rsi
mov r8, rbx
mov r9, rbx
call fcn.1401025f0
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___unable_to_unmap___0______0_
mov edx, 0x2289
xor r9d, r9d
call fcn.1400d2b30
int3