Function at 0x14004ecd0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov dword [rsp + 0x30], 0xffffffff
mov qword [rsp + 0x34], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0x3f3f3f3f
mov dword [rsp + 0x44], 0x3f3f3f3f
mov dword [rsp + 0x48], 0x3f3f3f3f
mov qword [rsp + 0x4c], 0x3f3f3f3f
mov qword [rsp + 0x54], 0
mov qword [rsp + 0x5c], 0
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0x43a50000
mov qword [rsp + 0x70], 0x3f3f3f3f
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x80], 0x3f3f3f3f
mov dword [rbp - 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x78], 0x3f3f3f3f
mov dword [rbp - 0x74], 0x3f3f3f3f
mov dword [rbp - 0x70], 0x3f3f3f3f
mov dword [rbp - 0x6c], 0x3f3f3f3f
mov dword [rbp - 0x68], 0x3f3f3f3f
mov dword [rbp - 0x64], 0x3f3f3f3f
mov dword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x5c], 0x3f3f3f3f
mov dword [rbp - 0x58], 0x3f3f3f3f
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov dword [rbp - 0x48], 0x3f3f3f3f
mov dword [rbp - 0x44], 0x3f3f3f3f
mov dword [rbp - 0x40], 0x3f3f3f3f
mov dword [rbp - 0x3c], 0x3f3f3f3f
mov dword [rbp - 0x38], 0x3f3f3f3f
mov dword [rbp - 0x34], 0x3f3f3f3f
mov dword [rbp - 0x30], 0x3f3f3f3f
mov dword [rbp - 0x2c], 0x3f3f3f3f
mov dword [rbp - 0x28], 0x3f3f3f3f
mov dword [rbp - 0x24], 0x3f3f3f3f
mov dword [rbp - 0x20], 0x3f3f3f3f
mov dword [rbp - 0x1c], 0x3f3f3f3f
mov dword [rbp - 0x18], 0x3f3f3f3f
mov qword [rbp - 0x14], 0x3f3f3f3f
mov qword [rbp - 0xc], 0
mov qword [rbp - 4], 0
mov qword [rbp + 4], 0
mov qword [rbp + 0xc], 0
mov qword [rbp + 0x14], 0
mov qword [rbp + 0x1c], 0
mov dword [rbp + 0x24], 0x3f3f0000
mov qword [rbp + 0x28], 0x3f3f
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x38], 0
mov dword [rbp + 0x3c], 0xbf800000
mov qword [rbp + 0x40], 0x3f3f3f3f
mov qword [rbp + 0x48], 0x3f3f0000
mov dword [rbp + 0x50], 0
mov dword [rbp + 0x54], 0x3f3f3f3f
mov dword [rbp + 0x58], 0x3f3f3f3f
mov dword [rbp + 0x5c], 0x3f3f3f3f
mov dword [rbp + 0x60], 0x3f3f3f3f
mov qword [rbp + 0x64], 0x3f3f3f3f
mov qword [rbp + 0x6c], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
xor esi, esi
mov qword [rbp + 0xb0], rsi
mov edx, 0x144
lea rcx, [rbp + 0xa0]
call fcn.140057ab0
mov r8d, 0x144
lea rdx, [rsp + 0x30]
mov r13, qword [rbp + 0xa0]
mov rcx, r13
call sub.VCRUNTIME140.dll_memmove
lea rax, [r13 + 0x144]
mov qword [rbp + 0xa8], rax
lea rbx, str.HD_Player.exe
mov rdx, rbx
call fcn.14004f280
test eax, eax
jne 0x14004ef7d
lea rbx, str.MEmuHeadless.exe
mov rdx, rbx
call fcn.14004f280
test eax, eax
jne 0x14004ef7d
lea rbx, str.LdVBoxHeadless.exe
mov rdx, rbx
call fcn.14004f280
test eax, eax
jne 0x14004ef7d
lea rbx, str.AndroidProcess.exe
mov rdx, rbx
call fcn.14004f280
test eax, eax
jne 0x14004ef7d
lea rbx, str.Nox.exe
mov rdx, rbx
call fcn.14004f280
test eax, eax
cmove rbx, qword [rbp + 0x140]
mov rdx, rbx
call fcn.14004f280
test eax, eax
je 0x14004efab
mov dword [0x140137770], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140137778], rax
test rax, rax
jne 0x14004efbe
lea rdx, str.An_unexpected_error_occurred
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140057000
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0xe0]
mov qword [rbp + 0x140], 0x64
mov rax, qword [0x1401377a8]
sub rax, qword [0x140137798]
sar rax, 3
lea r14, [0x140137798]
cmp rax, 0x64
jae 0x14004f012
lea rdx, [rbp + 0x140]
mov rcx, r14
call fcn.140057290
mov qword [rsp + 0x20], r14
mov r9, r13
mov r8, rdi
mov rdx, rbx
lea rcx, [0x140137770]
call fcn.14004f4b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rsi
mov rdx, qword [0x140137798]
mov rax, qword [0x1401377a0]
cmp rdx, rax
je 0x14004f1ff
mov r12d, esi
sub rax, rdx
sar rax, 3
test rax, rax
je 0x14004f1ff
mov r15, rsi
nop dword [rax + rax]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], rsi
mov rax, qword [r15 + rdx]
add rax, 0x5c
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x88]
call fcn.1400582d0
mov r14, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x88]
sub r14, rdi
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rdi
mov rbx, qword [rbp + 0x80]
mov rdx, rbx
mov rcx, qword [0x140137778]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140137788]
cmp rdx, qword [0x140137790]
je 0x14004f130
mov qword [rdx], rbx
lea rsi, [rdx + 8]
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
test r14, r14
je 0x14004f124
mov rdx, r14
mov rcx, rsi
call fcn.140057ab0
mov rbx, qword [rsi]
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rbx]
mov qword [rsi + 8], rax
add qword [0x140137788], 0x20
xor esi, esi
jmp 0x14004f14a
lea r8, [rbp + 0x80]
lea rcx, [0x140137780]
call fcn.140057f80
mov rdi, qword [rbp + 0x88]
mov rax, qword [0x140137798]
mov rcx, qword [r15 + rax]
lea rdx, [rcx + 0x60]
lea rbx, [rcx + 0x5c]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x148]
mov rcx, qword [0x140137778]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x148]
mov rdx, rbx
mov rcx, qword [0x140137778]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14004f1d7
mov rdx, qword [rbp + 0x98]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004f1cf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f247
mov rcx, rdi
call fcn.1400bbadc
inc r12d
add r15, 8
mov rcx, qword [0x1401377a0]
mov rdx, qword [0x140137798]
sub rcx, rdx
sar rcx, 3
movsxd rax, r12d
cmp rax, rcx
jb 0x14004f070
mov edx, 0x1c2
mov ecx, 0x352
call qword [sym.imp.KERNEL32.dll_Beep]
nop
test r13, r13
je 0x14004f256
mov rdx, qword [rbp + 0xb0]
sub rdx, r13
mov rax, r13
cmp rdx, 0x1000
jb 0x14004f24e
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f24e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r13
call fcn.1400bbadc
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret