Function at 0x18005e3a0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa8], xmm0
xor r13d, r13d
mov qword [rbp + 0xb8], r13
mov qword [rsp + 0x30], 0xffffffffffffffff
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], 0x3f3f3f3f
mov dword [rsp + 0x4c], 0x3f3f3f3f
mov dword [rsp + 0x50], 0x3f3f3f3f
mov qword [rsp + 0x54], 0x3f3f3f3f
mov qword [rsp + 0x5c], r13
mov qword [rsp + 0x64], r13
mov qword [rsp + 0x6c], r13
mov qword [rsp + 0x74], 0x43a50000
mov qword [rsp + 0x7c], r13
mov qword [rbp - 0x7c], r13
mov dword [rbp - 0x74], 0x3f3f3f3f
mov dword [rbp - 0x70], 0x3f3f3f3f
mov dword [rbp - 0x6c], 0x3f3f3f3f
mov dword [rbp - 0x68], 0x3f3f3f3f
mov dword [rbp - 0x64], 0x3f3f3f3f
mov dword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x5c], 0x3f3f3f3f
mov dword [rbp - 0x58], 0x3f3f3f3f
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov dword [rbp - 0x48], 0x3f3f3f3f
mov dword [rbp - 0x44], 0x3f3f3f3f
mov dword [rbp - 0x40], 0x3f3f3f3f
mov qword [rbp - 0x3c], 0x3f3f3f3f
mov dword [rbp - 0x34], 0x3f3f3f3f
mov dword [rbp - 0x30], 0x3f3f3f3f
mov dword [rbp - 0x2c], 0x3f3f3f3f
mov dword [rbp - 0x28], 0x3f3f3f3f
mov dword [rbp - 0x24], 0x3f3f3f3f
mov dword [rbp - 0x20], 0x3f3f3f3f
mov dword [rbp - 0x1c], 0x3f3f3f3f
mov dword [rbp - 0x18], 0x3f3f3f3f
mov qword [rbp - 0x14], 0x3f3f3f3f
mov qword [rbp - 0xc], 0x3f3f3f3f
mov dword [rbp - 4], 0x3f3f3f3f
mov qword [rbp], 0x3f3f3f3f
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov dword [rbp + 0x50], 0xbf800000
mov qword [rbp + 0x54], 0x3f3f3f3f
mov qword [rbp + 0x5c], 0x3f3f0000
mov dword [rbp + 0x64], r13d
mov dword [rbp + 0x68], 0x3f3f3f3f
mov dword [rbp + 0x6c], 0x3f3f3f3f
mov dword [rbp + 0x70], 0x3f3f3f3f
mov dword [rbp + 0x74], 0x3f3f3f3f
mov dword [rbp + 0x78], 0x3f3f3f3f
mov dword [rbp + 0x7c], 0x3f3f3f3f
mov word [rbp + 0x80], r13w
mov byte [rbp + 0x82], r13b
movdqu xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
mov edx, 0x153
lea rcx, [rbp + 0x90]
call fcn.180052c90
mov r8d, 0x153
lea rdx, [rsp + 0x30]
mov rsi, qword [rbp + 0x90]
mov rcx, rsi
call fcn.180157060
lea rax, [rsi + 0x153]
mov qword [rbp + 0x98], rax
call fcn.18005de20
mov rdx, rax
call fcn.18005e180
test eax, eax
je 0x18005e5ea
mov dword [0x1804f1c60], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1804f1c68], rax
test rax, rax
jne 0x18005e5fd
lea rdx, str.An_unexpected_error_occurred
lea rcx, [0x1804cee20]
call fcn.18007c830
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9, rsi
call fcn.18005fbc0
mov rdi, qword [rbp + 0xa8]
mov r12, qword [rbp + 0xb0]
cmp rdi, r12
jne 0x18005e640
mov edx, 0x3e8
mov ecx, 0x190
jmp 0x18005e6f5
sub r12, rdi
sar r12, 3
mov rdx, r12
lea rcx, [0x1804cee20]
call fcn.1800776d0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.18007acc0
movzx edx, al
mov rcx, rbx
call fcn.180080100
mov rcx, rbx
call fcn.18007be30
mov r15d, r13d
test r12, r12
je 0x18005e6eb
mov r14, rdi
nop dword [rax + rax]
mov rax, qword [r14]
lea rdx, [rax + 0x70]
lea rbx, [rax + 0x6c]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x120]
mov rcx, qword [0x1804f1c68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x120]
mov rdx, rbx
mov rcx, qword [0x1804f1c68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc r15d
lea r14, [r14 + 8]
movsxd rax, r15d
cmp rax, r12
jb 0x18005e690
mov edx, 0x1c2
mov ecx, 0x352
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, qword [0x1804f1c68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rsi, rsi
je 0x18005e742
mov rdx, qword [rbp + 0xa0]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x18005e739
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005e7a5
mov rcx, rsi
call fcn.1801170ac
nop
test rdi, rdi
je 0x18005e77e
mov rdx, qword [rbp + 0xb8]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x18005e776
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005e79f
mov rcx, rdi
call fcn.1801170ac
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180133c08
nop
call fcn.180133c08
nop
int3