Function at 0x1400e78a8
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r12, qword [rbp + 0x100]
lea rcx, [rbp - 0x70]
mov r14, r8
mov rsi, rdx
mov edi, 0xfc
xor edx, edx
mov r8d, edi
mov r15, r9
call sub.msvcrt.dll_memset
xor r13d, r13d
lea r9, [rsp + 0x34]
mov r8d, edi
mov qword [rsp + 0x38], r13
lea rdx, [rbp - 0x70]
mov dword [rsp + 0x30], r13d
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400e7954
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e793a
mov esi, 0x80004005
jmp 0x1400e7948
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
jmp 0x1400e7b33
cmp dword [rsp + 0x34], edi
je 0x1400e7963
mov ecx, 0x8007000d
mov esi, ecx
jmp 0x1400e794a
mov eax, dword [rbp + 0x88]
test eax, eax
je 0x1400e795a
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400e7990
mov rbx, r13
jmp 0x1400e7995
test rbx, rbx
jne 0x1400e799c
mov esi, 0x8007000e
jmp 0x1400e7948
mov r8d, dword [rbp + 0x88]
lea r9, [rsp + 0x34]
mov rdx, rbx
mov qword [rsp + 0x20], r13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e7929
mov eax, dword [rsp + 0x34]
cmp dword [rbp + 0x88], eax
jne 0x1400e795a
mov r8d, 0x3c
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14007a854
mov esi, eax
test eax, eax
jns 0x1400e79ee
mov ecx, eax
jmp 0x1400e794a
lea rdx, str.spp:migblob_aesencryptor_tokenact
lea rcx, [rbp - 0x70]
call sub.msvcrt.dll_wcscmp
xor r9d, r9d
test eax, eax
je 0x1400e7a25
lea ecx, [r9 + 1]
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 0xc00004a5
call fcn.14004eeb8
mov esi, 0x80049e59
jmp 0x1400e7948
lea rax, [0x14001a09c]
mov qword [rsp + 0x50], 3
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x70], 0x60
mov qword [rsp + 0x60], rax
mov r8d, 0x3c
lea rax, [rbp + 8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x74], rax
lea rax, [rsp + 0x30]
lea ecx, [r8 + 0x7d]
mov qword [rsp + 0x7c], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rsp + 0x44]
test esi, esi
js 0x1400e7948
mov rdx, qword [rsp + 0x38]
lea rax, [0x14002535c]
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x7c], rdx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov eax, dword [rbp + 0x88]
mov dword [rsp + 0x68], eax
lea r8d, [r9 + 0x3c]
mov eax, dword [rsp + 0x30]
lea ecx, [r8 + 0x7d]
mov dword [rsp + 0x78], eax
lea rax, [rbp + 0x68]
mov qword [rbp - 0x7c], rax
mov qword [rsp + 0x6c], rbx
mov qword [rsp + 0x50], 3
mov dword [rsp + 0x74], 0x20
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rsp + 0x48]
test esi, esi
js 0x1400e7948
mov edx, dword [rbp + 0x88]
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1400e881c
mov esi, eax
test eax, eax
js 0x1400e79e7
mov rax, qword [rsp + 0x38]
mov qword [r15], rax
mov eax, dword [rsp + 0x30]
mov dword [r14], eax
mov eax, dword [rsp + 0x40]
mov dword [r12], eax
mov qword [rsp + 0x38], r13
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400e7b45
mov ecx, dword [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
mov ecx, esi
call fcn.14007ace8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400e7b61
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x38], r13
test rbx, rbx
je 0x1400e7b7a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140388a50
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret