Function at 0x140001e5d
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, qword [rsp + 0xf8]
mov qword [rsp + 0xc8], rdx
mov r12, rcx
mov r13, r8
mov rsi, r9
cmp rdx, 0x3f
jbe 0x140001ea8
cmp word [rcx], 0x5a4d
jne 0x140001ebb
movsxd rbp, dword [rcx + 0x3c]
lea rax, [rbp + 0x108]
cmp qword [rsp + 0xc8], rax
jae 0x140001eaf
mov ecx, 0xd
jmp 0x140001ec0
add rbp, rcx
cmp dword [rbp], 0x4550
je 0x140001ece
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r14d, r14d
jmp 0x140002192
cmp word [rbp + 4], 0x8664
jne 0x140001ebb
mov eax, dword [rbp + 0x38]
mov r8d, eax
and r8d, 1
jne 0x140001ebb
movzx edx, word [rbp + 0x14]
movzx r11d, word [rbp + 6]
xor r15d, r15d
lea rdx, [rbp + rdx + 0x18]
cmp r8d, r11d
jae 0x140001f1c
mov r10d, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
lea r9d, [r10 + rcx]
test r10d, r10d
jne 0x140001f0c
lea r9, [rcx + rax]
cmp r15, r9
cmovb r15, r9
inc r8d
add rdx, 0x28
jmp 0x140001ef3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x44]
mov r14d, dword [rbp + 0x50]
lea rdx, [rax - 1]
neg rax
add r14, rdx
add r15, rdx
and r14, rax
and r15, rax
cmp r15, r14
jne 0x140001ebb
mov rcx, qword [rbp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov r8d, 0x3000
call r13
mov rbx, rax
test rax, rax
jne 0x140001f93
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rdx, r15
xor ecx, ecx
mov r8d, 0x3000
call r13
mov rbx, rax
test rax, rax
je 0x14000203b
xor r15d, r15d
mov rdx, rbx
lea rax, [rbx + r14]
shr rdx, 0x20
shr rax, 0x20
cmp rdx, rax
jae 0x140001ffb
mov ecx, 0x10
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14000201d
mov qword [rax + 8], rbx
xor ecx, ecx
mov r9d, 4
mov rdx, r14
mov qword [rax], r15
mov r8d, 0x3000
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdi
call r13
mov r10, qword [rsp + 0x38]
test rax, rax
mov rbx, rax
jne 0x140001ff6
mov r8, rdi
mov rdx, rsi
mov rcx, r10
jmp 0x140002036
mov r15, r10
jmp 0x140001f96
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x78
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x140002045
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
mov r9, rdi
call rsi
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.14000161c
mov ecx, 0xe
jmp 0x140001ec0
mov qword [rax + 8], rbx
mov ax, word [rbp + 0x16]
mov ecx, 0xd
mov qword [r14 + 0x28], r13
mov edx, dword [rbp + 0x54]
shr ax, 0xd
mov qword [r14 + 0x30], rsi
and eax, 1
mov qword [r14 + 0x58], rdi
mov dword [r14 + 0x20], eax
mov rax, qword [rsp + 0xe0]
mov qword [r14 + 0x70], r15
mov qword [r14 + 0x38], rax
mov rax, qword [rsp + 0xe8]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0xf0]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x44]
mov dword [r14 + 0x68], eax
cmp qword [rsp + 0xc8], rdx
jb 0x140002165
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rcx, rbx
mov rsi, r12
mov r8d, 0x1000
call r13
mov ecx, dword [rbp + 0x54]
mov r9, r14
mov r8, rbp
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
movsxd rdx, dword [r12 + 0x3c]
add rax, rdx
mov rdx, qword [rsp + 0xc8]
mov qword [r14], rax
mov qword [rax + 0x30], rbx
call fcn.14000165c
test eax, eax
je 0x140002185
mov rax, qword [r14]
mov rdx, qword [rax + 0x30]
mov eax, 1
sub rdx, qword [rbp + 0x30]
je 0x140002113
mov rcx, r14
call fcn.140001578
mov dword [r14 + 0x24], eax
mov rcx, r14
call fcn.14000176b
test eax, eax
je 0x140002185
mov rcx, r14
call fcn.140001b10
test eax, eax
je 0x140002185
mov rcx, r14
call fcn.140001530
test eax, eax
je 0x140002185
mov rax, qword [r14]
mov eax, dword [rax + 0x28]
test eax, eax
je 0x14000217d
add rax, rbx
cmp dword [r14 + 0x20], 0
je 0x140002177
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call rax
test eax, eax
jne 0x14000216d
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002185
mov dword [r14 + 0x1c], 1
jmp 0x140002192
mov qword [r14 + 0x60], rax
jmp 0x140002192
xor eax, eax
mov qword [r14 + 0x60], rax
jmp 0x140002192
mov rcx, r14
call fcn.140001db1
jmp 0x140001ec6
mov rax, r14
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret