Function at 0x1400015f0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0xa8], rax
mov rax, qword [0x1400067c8]
cmp rax, qword [0x1400067d0]
je 0x14000163b
mov qword [0x1400067d0], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
xor edi, edi
mov ebx, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x60], 0x130
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400018d0
nop
lea rdx, str.HD_Player.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400016b3
mov eax, dword [rsp + 0x7c]
cmp eax, ebx
jbe 0x1400016b3
mov ebx, eax
mov edi, dword [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001690
test edi, edi
je 0x1400018d0
mov dword [0x1400067b8], edi
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400067c0], rax
test rax, rax
je 0x1400018d0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
mov dword [rsp + 0x60], 0xffffffff
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], 0x3f3f3f3f
mov dword [rsp + 0x74], 0x3f3f3f3f
mov dword [rsp + 0x78], 0x3f3f3f3f
mov qword [rsp + 0x7c], 0x3f3f3f3f
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov dword [rbp - 0x6c], eax
mov qword [rbp - 0x68], 0x43a50000
mov qword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov dword [rbp - 0x48], 0x3f3f3f3f
mov dword [rbp - 0x44], 0x3f3f3f3f
mov dword [rbp - 0x40], 0x3f3f3f3f
mov dword [rbp - 0x3c], 0x3f3f3f3f
mov dword [rbp - 0x38], 0x3f3f3f3f
mov dword [rbp - 0x34], 0x3f3f3f3f
mov dword [rbp - 0x30], 0x3f3f3f3f
mov dword [rbp - 0x2c], 0x3f3f3f3f
mov dword [rbp - 0x28], 0x3f3f3f3f
mov dword [rbp - 0x24], 0x3f3f3f3f
mov dword [rbp - 0x20], 0x3f3f3f3f
mov dword [rbp - 0x1c], 0x3f3f3f3f
mov dword [rbp - 0x18], 0x3f3f3f3f
mov dword [rbp - 0x14], 0x3f3f3f3f
mov dword [rbp - 0x10], 0x3f3f3f3f
mov dword [rbp - 0xc], 0x3f3f3f3f
mov dword [rbp - 8], 0x3f3f3f3f
mov dword [rbp - 4], 0x3f3f3f3f
mov dword [rbp], 0x3f3f3f3f
mov dword [rbp + 4], 0x3f3f3f3f
mov dword [rbp + 8], 0x3f3f3f3f
mov dword [rbp + 0xc], 0x3f3f3f3f
mov dword [rbp + 0x10], 0x3f3f3f3f
mov dword [rbp + 0x14], 0x3f3f3f3f
mov dword [rbp + 0x18], 0x3f3f3f3f
mov qword [rbp + 0x1c], 0x3f3f3f3f
mov qword [rbp + 0x24], rax
mov qword [rbp + 0x2c], rax
mov qword [rbp + 0x34], rax
mov qword [rbp + 0x3c], rax
mov qword [rbp + 0x44], rax
mov qword [rbp + 0x4c], rax
mov dword [rbp + 0x54], 0x3f3f0000
mov qword [rbp + 0x58], 0x3f3f
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], 0xbf800000
mov ecx, 0x110
call fcn.140002478
mov rbx, rax
mov qword [rbp + 0x90], rax
lea rdi, [rax + 0x110]
mov qword [rbp + 0xa0], rdi
mov r8d, 0x110
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x98], rdi
mov r9, rbx
mov r8, r15
mov rdx, r14
call fcn.1400012c0
nop
test rbx, rbx
je 0x1400018d0
sub rdi, rbx
cmp rdi, 0x1000
jb 0x1400018c5
mov edi, 0x137
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400018fc
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.140002470
mov rcx, qword [rbp + 0xa8]
xor rcx, rsp
call fcn.140002450
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3