Function at 0x1400012c0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
xorps xmm0, xmm0
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x34], 0x43a50000
mov qword [rsp + 0x3c], 0x3f3f3f3f
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0x3f3f3f3f
mov dword [rsp + 0x4c], 0x3f3f3f3f
mov dword [rsp + 0x50], 0x3f3f3f3f
mov dword [rsp + 0x54], 0x3f3f3f3f
mov dword [rsp + 0x58], 0x3f3f3f3f
mov dword [rsp + 0x5c], 0x3f3f3f3f
mov dword [rsp + 0x60], 0x3f3f3f3f
mov dword [rsp + 0x64], 0x3f3f3f3f
mov dword [rsp + 0x68], 0x3f3f3f3f
mov dword [rsp + 0x6c], 0x3f3f3f3f
mov dword [rsp + 0x70], 0x3f3f3f3f
mov dword [rsp + 0x74], 0x3f3f3f3f
mov dword [rsp + 0x78], 0x3f3f3f3f
mov dword [rsp + 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x80], 0x3f3f3f3f
mov dword [rbp - 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x78], 0x3f3f3f3f
mov dword [rbp - 0x74], 0x3f3f3f3f
mov dword [rbp - 0x70], 0x3f3f3f3f
mov dword [rbp - 0x6c], 0x3f3f3f3f
mov dword [rbp - 0x68], 0x3f3f3f3f
mov dword [rbp - 0x64], 0x3f3f3f3f
mov dword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x5c], 0x3f3f3f3f
mov dword [rbp - 0x58], 0x3f3f3f3f
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov qword [rbp - 0x48], 0x3f3f3f3f
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], 0x3f3f0000
mov qword [rbp - 0xc], 0x3f3f
mov qword [rbp - 4], rax
mov dword [rbp + 4], eax
mov dword [rbp + 8], 0xbf800000
mov qword [rbp + 0xc], 0x3f3f3f3f
mov qword [rbp + 0x14], 0x3f3f0000
mov dword [rbp + 0x1c], eax
mov dword [rbp + 0x20], 0x3f3f3f3f
mov dword [rbp + 0x24], 0x3f3f3f3f
mov dword [rbp + 0x28], 0x3f3f3f3f
mov dword [rbp + 0x2c], 0x3f3f3f3f
mov qword [rbp + 0x30], 0x3f3f3f3f
mov qword [rbp + 0x38], rax
lea rbx, [rsp + 0x30]
movdqu xmmword [rbp + 0x88], xmm0
xor r13d, r13d
mov ecx, 0x110
call fcn.1400022a8
mov r14, rax
mov qword [rbp + 0x88], rax
lea r12, [rax + 0x110]
mov qword [rbp + 0x98], r12
mov r8d, 0x110
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x90], r12
lea rdx, str.Attempting_to_attach_to_HD_Player.exe_process..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
lea rbx, str.HD_Player.exe
mov rdx, rbx
call fcn.1400011b0
test eax, eax
jne 0x140001557
lea rbx, str.LdVBoxHeadless.exe
mov rdx, rbx
call fcn.1400011b0
test eax, eax
jne 0x140001557
lea rdx, str.MEmuHeadless.exe
call fcn.1400011b0
test eax, eax
je 0x14000150f
lea rbx, str.MEmuHeadless.exe
jmp 0x140001557
mov rdx, rbx
call fcn.1400011b0
test eax, eax
jne 0x140001557
lea rbx, str.AndroidProcess.exe
mov rdx, rbx
call fcn.1400011b0
test eax, eax
jne 0x140001557
lea rbx, str.aow_exe.exe
mov rdx, rbx
call fcn.1400011b0
test eax, eax
jne 0x140001557
lea rbx, str.NoxVMHandle.exe
mov rdx, rbx
call fcn.1400011b0
test eax, eax
cmove rbx, qword [rbp + 0x50]
mov rdx, rbx
call fcn.1400011b0
test eax, eax
je 0x140001776
mov dword [0x140006750], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006758], rax
test rax, rax
je 0x140001776
lea rdx, str.Pattern:_Scanning__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
mov rax, qword [0x140006778]
cmp rax, qword [0x140006780]
je 0x1400015b7
mov qword [0x140006780], rax
lea rax, [0x140006778]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rsi
mov rdx, rdi
call fcn.140001800
test al, al
jne 0x1400015e1
lea rdx, str.Pattern_search_failed._n
jmp 0x14000177d
mov rax, qword [0x140006780]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp qword [0x140006778], rax
jne 0x140001604
lea rdx, str.No_scan_results_available._n
jmp 0x140001784
lea rdx, str.Pattern_found._Injecting_aimbot_drag..._n
call fcn.140001d50
mov rbx, qword [0x140006778]
mov r15, qword [0x140006780]
cmp rbx, r15
je 0x14000175f
nop word [rax + rax]
mov qword [rbp + 0x50], r13
mov ecx, 4
call fcn.140002524
mov rsi, rax
mov rdx, qword [rbx]
add rdx, 0x28
mov qword [rsp + 0x20], r13
mov r9d, 4
mov r8, rax
mov rcx, qword [0x140006758]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbx]
test eax, eax
je 0x140001724
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rsi
mov rdx, qword [0x140006798]
cmp rdx, qword [0x1400067a0]
je 0x140001697
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rdx], xmm0
add qword [0x140006798], 0x10
jmp 0x1400016a7
lea r8, [rbp + 0x40]
lea rcx, [0x140006790]
call fcn.140001f30
mov rdx, qword [rbx]
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, qword [0x140006758]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001752
mov rdx, qword [rbx]
add rdx, 0x28
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, qword [0x140006758]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001752
lea rdx, str.Failed_to_write_memory_at_address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
mov rcx, rax
mov rdx, qword [rbx]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000456c]
jmp 0x140001784
lea rdx, str.Failed_to_read_memory_at_address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000456c]
call fcn.140001d50
add rbx, 8
cmp rbx, r15
jne 0x140001630
lea rdx, str.Aimbot_Drag:_Injected__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
mov bl, 1
jmp 0x14000178b
lea rdx, str.Failed_to_attach_to_the_process._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d50
xor bl, bl
test r14, r14
je 0x1400017c6
sub r12, r14
mov rax, r14
cmp r12, 0x1000
jb 0x1400017bb
add r12, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r12
mov rcx, r14
call fcn.1400022a0
movzx eax, bl
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140002280
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret