Function at 0x1400057f0
Capabilities:
Enumerate processes
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1290]
mov eax, 0x1390
call fcn.140012020
sub rsp, rax
mov rax, qword [0x14004a100]
xor rax, rsp
mov qword [rbp + 0x1280], rax
mov r12, rcx
mov qword [rbp - 0x70], rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x14000588f
lea rdx, str.Chyba_p
lea rcx, [0x14004b8e0]
call fcn.14000bfb0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000be00
movzx edx, al
mov rcx, rbx
call fcn.14000db10
mov rcx, rbx
call fcn.14000d670
jmp 0x140005fac
mov dword [rbp + 0x20], 0x238
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005fa3
nop dword [rax + rax]
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x1400058bf
mov rdx, qword [r12]
lea rcx, [rbp + 0x4c]
call fcn.1400178cc
test eax, eax
jne 0x140005924
mov r8d, dword [rbp + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14000593e
lea rdx, str.Nepoda
lea rcx, [0x14004b8e0]
call fcn.14000bfb0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000be00
movzx edx, al
mov rcx, rbx
call fcn.14000db10
mov rcx, rbx
call fcn.14000d670
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400058b0
jmp 0x140005fa3
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 8]
mov qword [rsp + 0x38], r14
cmp r14, qword [rbp]
jae 0x140005f9a
movabs r15, 0x7fffffffffffffff
movabs r13, 0x8000000000000000
mov r12d, 0x16
nop word [rax + rax]
mov r9d, 0x30
lea r8, [rbp - 0x40]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140005f95
cmp dword [rbp - 0x20], 0x1000
jne 0x140005f82
test byte [rbp - 0x1c], 4
je 0x140005f82
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x1000
lea r8, [rbp + 0x280]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140005f82
lea rsi, [rbp + 0x280]
add rsi, qword [rbp - 0x48]
xorps xmm0, xmm0
movups xmmword [rbp + 0x260], xmm0
lea rax, [rbp + 0x280]
cmp rax, rsi
jne 0x140005a22
xor eax, eax
mov qword [rbp + 0x270], rax
mov r13d, 0xf
mov qword [rbp + 0x278], r13
mov byte [rbp + 0x260], al
jmp 0x140005b29
lea rax, [rbp + 0x280]
sub rsi, rax
mov qword [rbp + 0x270], 0
mov edi, 0xf
mov qword [rbp + 0x278], rdi
cmp rsi, r15
ja 0x140005fe2
cmp rsi, rdi
jbe 0x140005ae8
mov rdi, rsi
or rdi, 0xf
cmp rdi, r15
jbe 0x140005a6a
mov rdi, r15
lea rax, [r13 + 0x27]
jmp 0x140005aa3
cmp rdi, 0x16
cmovb rdi, r12
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140005a8d
xor eax, eax
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x278], rdi
jmp 0x140005aef
cmp rcx, 0x1000
jb 0x140005ad3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005fe8
mov rcx, rax
call fcn.140011928
mov rcx, rax
test rax, rax
je 0x140005fdc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x278], rdi
jmp 0x140005aef
call fcn.140011928
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x278], rdi
jmp 0x140005aef
mov rax, qword [rbp + 0x260]
lea rbx, [rbp + 0x260]
cmp rdi, 0xf
cmova rbx, rax
mov r8, rsi
lea rdx, [rbp + 0x280]
mov rcx, rbx
call fcn.1400340f0
mov qword [rbp + 0x270], rsi
mov byte [rbx + rsi], 0
mov rax, qword [rbp + 0x270]
mov r13, qword [rbp + 0x278]
mov rdi, qword [0x14004d448]
mov rsi, qword [rbp + 0x260]
mov qword [rsp + 0x30], rsi
cmp rdi, qword [0x14004d450]
je 0x140005f40
nop dword [rax]
mov r14, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140005b5d
mov r14, qword [rdi]
lea r15, [rbp + 0x260]
cmp r13, 0xf
cmova r15, rsi
mov rsi, qword [rdi + 0x10]
cmp rsi, rax
ja 0x140005bf9
test rsi, rsi
je 0x140005c1b
sub rax, rsi
lea r12, [rax + r15]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call fcn.140034b30
mov rbx, rax
test rax, rax
je 0x140005beb
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.140034bd0
test eax, eax
je 0x140005be2
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call fcn.140034b30
mov rbx, rax
test rax, rax
jne 0x140005bb0
jmp 0x140005beb
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x140005c14
mov rax, qword [rbp + 0x270]
mov r13, qword [rbp + 0x278]
add rdi, 0x20
mov rsi, qword [rsp + 0x30]
cmp rdi, qword [0x14004d450]
je 0x140005f2b
jmp 0x140005b50
mov r13, qword [rbp + 0x278]
cmp dword [0x14004d440], 1
jne 0x140005cf1
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140002e30
mov rbx, rax
lea rdx, str.Detekce:_Nalezen_podezrely_retezec_
lea rcx, [0x14004b630]
call fcn.14000bfb0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140005c59
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000e060
lea rdx, str._v_procesu
mov rcx, rax
call fcn.14000bfb0
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140005c81
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000e060
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000be00
movzx edx, al
mov rcx, rbx
call fcn.14000db10
mov rcx, rbx
call fcn.14000d670
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005cf1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005fee
call fcn.140011680
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor ebx, ebx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov r8d, 0xc
lea rdx, str.DetectString
lea rcx, [rbp - 0x68]
call fcn.14000cc50
nop
lea rcx, [rsp + 0x70]
call fcn.140002fe0
mov r12, rax
mov r15, qword [rdi + 0x10]
movabs rax, 0x7fffffffffffffff
mov rcx, rax
sub rcx, r15
cmp rcx, 0x17
jb 0x14000600c
cmp qword [rdi + 0x18], 0xf
jbe 0x140005d4e
mov rdi, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r14, [r15 + 0x17]
mov ebx, 0xf
lea rsi, [rsp + 0x40]
cmp r14, rbx
jbe 0x140005dee
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x140005d92
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140005dc2
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140005dac
xor esi, esi
jmp 0x140005de9
cmp rcx, 0x1000
jb 0x140005de1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005ff4
mov rcx, rax
call fcn.140011928
test rax, rax
je 0x140005ffa
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005de9
call fcn.140011928
mov rsi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [str.Detekce_cheat_stringu:]
movups xmmword [rsi], xmm0
mov ecx, dword [0x140042c88]
mov dword [rsi + 0x10], ecx
movzx eax, word [0x140042c8c]
mov word [rsi + 0x14], ax
movzx eax, byte [0x140042c8e]
mov byte [rsi + 0x16], al
lea rcx, [rsi + 0x17]
mov r8, r15
mov rdx, rdi
call fcn.1400340f0
mov byte [rsi + r14], 0
lea r8, [rbp - 0x68]
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.140003630
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140005e83
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ffa
call fcn.140011680
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140005ed6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ed1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006000
call fcn.140011680
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005f26
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006006
call fcn.140011680
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
movabs r15, 0x7fffffffffffffff
mov r12d, 0x16
cmp r13, 0xf
jbe 0x140005f73
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005f6b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005fdc
mov rcx, rsi
call fcn.140011680
movabs r13, 0x8000000000000000
mov rbx, qword [rsp + 0x60]
add r14, qword [rbp - 0x28]
mov qword [rsp + 0x38], r14
cmp r14, qword [rbp]
jb 0x140005980
mov rdi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1280]
xor rcx, rsp
call fcn.140011660
lea r11, [rsp + 0x1390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001ba50
int3
call fcn.1400018f0
int3
call fcn.140001850
nop
call fcn.14001ba50
nop
call fcn.140001850
int3
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.1400018f0
int3