Function at 0x14004efc0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov r14, rcx
mov dword [rsp + 0x30], 0xffffffff
mov qword [rsp + 0x34], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0x3f3f3f3f
mov dword [rsp + 0x44], 0x3f3f3f3f
mov dword [rsp + 0x48], 0x3f3f3f3f
mov qword [rsp + 0x4c], 0x3f3f3f3f
mov qword [rsp + 0x54], 0
mov qword [rsp + 0x5c], 0
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0x43a50000
mov qword [rsp + 0x70], 0x3f3f3f3f
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x80], 0x3f3f3f3f
mov dword [rbp - 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x78], 0x3f3f3f3f
mov dword [rbp - 0x74], 0x3f3f3f3f
mov dword [rbp - 0x70], 0x3f3f3f3f
mov dword [rbp - 0x6c], 0x3f3f3f3f
mov dword [rbp - 0x68], 0x3f3f3f3f
mov dword [rbp - 0x64], 0x3f3f3f3f
mov dword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x5c], 0x3f3f3f3f
mov dword [rbp - 0x58], 0x3f3f3f3f
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov dword [rbp - 0x48], 0x3f3f3f3f
mov dword [rbp - 0x44], 0x3f3f3f3f
mov dword [rbp - 0x40], 0x3f3f3f3f
mov dword [rbp - 0x3c], 0x3f3f3f3f
mov dword [rbp - 0x38], 0x3f3f3f3f
mov dword [rbp - 0x34], 0x3f3f3f3f
mov dword [rbp - 0x30], 0x3f3f3f3f
mov dword [rbp - 0x2c], 0x3f3f3f3f
mov dword [rbp - 0x28], 0x3f3f3f3f
mov dword [rbp - 0x24], 0x3f3f3f3f
mov dword [rbp - 0x20], 0x3f3f3f3f
mov dword [rbp - 0x1c], 0x3f3f3f3f
mov dword [rbp - 0x18], 0x3f3f3f3f
mov qword [rbp - 0x14], 0x3f3f3f3f
mov qword [rbp - 0xc], 0
mov qword [rbp - 4], 0
mov qword [rbp + 4], 0
mov qword [rbp + 0xc], 0
mov qword [rbp + 0x14], 0
mov qword [rbp + 0x1c], 0
mov dword [rbp + 0x24], 0x3f3f0000
mov qword [rbp + 0x28], 0x3f3f
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x38], 0
mov dword [rbp + 0x3c], 0xbf800000
mov qword [rbp + 0x40], 0x3f3f3f3f
mov qword [rbp + 0x48], 0x3f3f0000
mov dword [rbp + 0x50], 0
mov dword [rbp + 0x54], 0x3f3f3f3f
mov dword [rbp + 0x58], 0x3f3f3f3f
mov dword [rbp + 0x5c], 0x3f3f3f3f
mov dword [rbp + 0x60], 0x3f3f3f3f
mov qword [rbp + 0x64], 0x3f3f3f3f
mov qword [rbp + 0x6c], 0
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa8], xmm0
xor r13d, r13d
mov ecx, 0x144
call fcn.1400bb648
mov rsi, rax
mov qword [rbp + 0xa8], rax
lea r15, [rax + 0x144]
mov qword [rbp + 0xb8], r15
mov r8d, 0x144
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xb0], r15
lea rbx, str.HD_Player.exe
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
jne 0x14004f276
lea rbx, str.MEmuHeadless.exe
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
jne 0x14004f276
lea rbx, str.LdVBoxHeadless.exe
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
jne 0x14004f276
lea rbx, str.AndroidProcess.exe
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
jne 0x14004f276
lea rbx, str.Nox.exe
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
cmove rbx, qword [rbp + 0x160]
mov rdx, rbx
mov rcx, r14
call fcn.1400516c0
test eax, eax
je 0x14004f2a1
mov dword [r14], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14 + 8], rax
test rax, rax
jne 0x14004f2b4
lea rdx, str.An_unexpected_error_occurred
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ace0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
lea r12, [r14 + 0x28]
mov qword [rbp + 0x160], 0x64
mov rax, qword [r12 + 0x10]
sub rax, qword [r12]
sar rax, 3
cmp rax, 0x64
jae 0x14004f300
lea rdx, [rbp + 0x160]
mov rcx, r12
call fcn.14004b5d0
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140050da0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r13
mov rdx, qword [r12]
mov rax, qword [r12 + 8]
cmp rdx, rax
je 0x14004f54f
mov dword [rbp + 0x168], r13d
sub rax, rdx
sar rax, 3
test rax, rax
je 0x14004f54f
xor esi, esi
mov r13d, esi
nop word [rax + rax]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
mov rax, qword [rdx + r13]
add rax, 0x5c
mov qword [rbp + 0x88], rax
lea r8, [rbp + 0x160]
mov edx, 4
lea rcx, [rbp + 0x90]
call fcn.14004b640
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0x90]
sub rsi, rdi
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
mov rbx, qword [rbp + 0x88]
mov rdx, rbx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r15, qword [r14 + 0x18]
cmp r15, qword [r14 + 0x20]
je 0x14004f474
mov qword [r15], rbx
xor eax, eax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
test rsi, rsi
je 0x14004f46d
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14004f5b3
cmp rsi, 0x1000
jb 0x14004f43c
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14004f5b9
call fcn.1400bb648
mov rcx, rax
test rax, rax
je 0x14004f57f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004f444
mov rcx, rsi
call fcn.1400bb648
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
add rax, rsi
mov qword [r15 + 0x18], rax
mov rbx, qword [r15 + 8]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rsi]
mov qword [r15 + 0x10], rax
add qword [r14 + 0x18], 0x20
jmp 0x14004f48e
lea r8, [rbp + 0x88]
mov rdx, r15
lea rcx, [r14 + 0x10]
call fcn.14004b050
mov rdi, qword [rbp + 0x90]
mov rax, qword [r12]
mov rcx, qword [rax + r13]
lea rdx, [rcx + 0x60]
lea rbx, [rcx + 0x5c]
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x80]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x80]
mov rdx, rbx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14004f514
mov rdx, qword [rbp + 0xa0]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004f50c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f586
mov rcx, rdi
call fcn.1400bb684
mov eax, dword [rbp + 0x168]
inc eax
mov dword [rbp + 0x168], eax
add r13, 8
mov rdx, qword [r12]
mov rcx, qword [r12 + 8]
sub rcx, rdx
sar rcx, 3
cdqe
cmp rax, rcx
jb 0x14004f360
mov rsi, qword [rbp + 0xa8]
mov r15, qword [rbp + 0xb8]
test rsi, rsi
je 0x14004f598
sub r15, rsi
mov rax, rsi
cmp r15, 0x1000
jb 0x14004f58d
add r15, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f58d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r15
mov rcx, rsi
call fcn.1400bb684
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140054570
nop
call fcn.140020e90
int3