Function at 0x1401e01e0
Capabilities:
Check for debugger via api
Check if file exists
Enumerate processes
Get file version info
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x478]
sub rsp, 0x540
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x410], rax
movzx edi, r8b
mov byte [rsp + 0x40], r8b
mov rsi, rdx
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov r14, qword [rbp + 0x4a8]
mov qword [rsp + 0x70], r14
mov r15, qword [rbp + 0x4b0]
mov qword [rsp + 0x78], r15
mov r13, qword [rbp + 0x4b8]
lea r8, str.TestReadyDll
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
test rax, rax
je 0x1401e0274
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401e074e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r15d, ax
xor esi, esi
mov dword [rbp - 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
mov rbx, 0xffffffffffffffff
test rax, rax
je 0x1401e0518
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, rbx
je 0x1401e0516
mov dword [rbp - 0x40], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1401e050d
nop
cmp dword [rbp - 0x38], edi
je 0x1401e031b
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1401e0300
jmp 0x1401e050d
mov edi, dword [rbp - 0x20]
test edi, edi
je 0x1401e050d
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1401e050d
nop dword [rax + rax]
cmp dword [rbp - 0x38], edi
je 0x1401e035b
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1401e0340
jmp 0x1401e050d
mov edi, 1
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea r8, str.devenv.exe
mov edx, ebx
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x1401e050d
xor eax, eax
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x60]
mov r8, r14
mov rdx, r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1401e03c9
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp - 0x50], 0
je 0x1401e0433
mov ecx, r15d
cmp r15d, 0x412
ja 0x1401e0406
je case.0x1401e0404.1025
sub ecx, 0x401
cmp ecx, 0x10
ja case.0x1401e0404.1025
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1e0d68]
mov ecx, dword [rdx + rax*4 + 0x1e0d5c]
add rcx, rdx
jmp rcx
sub ecx, 0x419
je case.0x1401e0404.1025
sub ecx, 5
je case.0x1401e0404.1025
sub ecx, 0x3e6
jne case.0x1401e0404.1025
lea rdx, [0x140417348]
jmp 0x1401e04f6
lea rdx, str.The_program_cannot_run_in_debugger_
jmp 0x1401e04f6
mov r8d, 0x104
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea r8, str.explorer.exe
mov edx, ebx
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x1401e050d
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea r8, [rbp + 0x200]
mov edx, ebx
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x1401e050d
mov dword [rbp - 0x50], edi
mov ecx, r15d
cmp r15d, 0x412
ja 0x1401e04d1
je case.0x1401e04cf.1025
sub ecx, 0x401
cmp ecx, 0x10
ja case.0x1401e04cf.1025
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1e0d88]
mov ecx, dword [rdx + rax*4 + 0x1e0d7c]
add rcx, rdx
jmp rcx
sub ecx, 0x419
je case.0x1401e04cf.1025
sub ecx, 5
je case.0x1401e04cf.1025
sub ecx, 0x3e6
jne case.0x1401e04cf.1025
lea rdx, [0x1404173e8]
jmp 0x1401e04f6
lea rdx, str.Please_run_program_in_correct_way___Double_click_the_program_icon_
mov word [rsp + 0x20], r15w
mov r9d, reloc.SinoSPE.dll_Ordinal_16
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp dword [rbp - 0x50], 0
jne 0x1401e0c2d
mov r8d, 0x104
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401e0bba
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp + 0x200]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401e0565
mov r8, rbx
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x48]
call fcn.140006340
nop
lea rcx, [rsp + 0x48]
call fcn.1401dc2a0
mov edi, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1401e05d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e05d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401e05d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
test edi, edi
jle 0x1401e06cc
lea r8, str.TestReadyApp
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
test rax, rax
je 0x1401e0bba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
xor edx, edx
lea rcx, [rbp + 0x200]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x1401e0bba
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.1403ca480
mov r14, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, r14
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x200]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1401e06c2
xor esi, esi
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x58], rsi
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x58]
lea rdx, str.StringFileInfo080404b0ProductName
mov rcx, r14
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov r8, qword [rbp - 0x58]
test r8, r8
je 0x1401e06c2
lea r9, [0x14041de68]
mov ecx, esi
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r8 + rcx*2]
movzx eax, word [r9 + rcx*2]
sub edx, eax
jne 0x1401e06b8
movzx edx, word [r8 + rcx*2 + 2]
movzx eax, word [r9 + rcx*2 + 2]
sub edx, eax
jne 0x1401e06b8
add rcx, 2
cmp rcx, 0xa
jne 0x1401e0690
test edx, edx
mov eax, 1
cmove edi, eax
mov rcx, r14
call fcn.1403ca488
test edi, edi
je 0x1401e0bba
test edi, edi
jns 0x1401e073a
mov ecx, r15d
cmp r15d, 0x412
ja 0x1401e070d
je case.0x1401e070b.1025
sub ecx, 0x401
cmp ecx, 0x10
ja case.0x1401e070b.1025
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1e0da8]
mov ecx, dword [rdx + rax*4 + 0x1e0d9c]
add rcx, rdx
jmp rcx
sub ecx, 0x419
je case.0x1401e070b.1025
sub ecx, 5
je case.0x1401e070b.1025
sub ecx, 0x3e6
jne case.0x1401e070b.1025
lea rdx, [0x140417510]
jmp 0x1401e0c16
lea rdx, str.The_application_self_verification_failed._Maybe_virus_infection_or_illegal_modification._Please_re_install_application_
jmp 0x1401e0c16
movzx edi, byte [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 8
call fcn.1403ca490
lea rcx, vtable.ui::RenderFactory_GdiPlus.0
mov qword [rax], rcx
mov rcx, qword [0x1404c78b8]
mov qword [0x1404c78b8], rax
test rcx, rcx
je 0x1401e0785
mov edx, 8
call fcn.1403ca488
mov rcx, qword [r12 + 0x10]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rcx
cmp rax, 7
jb 0x1401e0cb1
mov r9, r12
cmp qword [r12 + 0x18], 7
jbe 0x1401e07b3
mov r9, qword [r12]
mov qword [rsp + 0x30], 7
lea rax, str.Themes_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x80]
call fcn.1400d1c70
nop
mov rdx, r13
cmp qword [r13 + 0x18], 7
jbe 0x1401e07e5
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rbp - 0x80]
call fcn.140003f40
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
lea rcx, [rsp + 0x48]
call fcn.1401e0eb0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1401e0865
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e085f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401e085f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1401e08a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e08a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401e08a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov rax, qword [r12 + 0x10]
sub rbx, rax
cmp rbx, 0xa
jb 0x1401e0cb7
cmp qword [r12 + 0x18], 7
jbe 0x1401e08c6
mov r12, qword [r12]
mov qword [rsp + 0x30], 0xa
lea rcx, str.Languages_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r12
lea rcx, [rbp - 0x80]
call fcn.1400d1c70
nop
lea rcx, [rbp - 0x80]
call fcn.1401e19d0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1401e093a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e0935
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401e0935
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov rdx, rsi
lea rcx, [0x1404c7810]
call fcn.140124200
test dil, dil
je 0x1401e0b82
mov dword [rbp - 0x58], 0x65c
mov dword [rbp - 0x54], 0x3a0
call fcn.14020ef40
mov rcx, qword [rbp - 0x58]
mov qword [rax + 0x14], rcx
call fcn.14020ef40
mov rbx, rax
mov r12d, 4
cmp byte [rax + 0x10], 0
jne 0x1401e09eb
xor edx, edx
call fcn.14016c860
test al, al
je 0x1401e09e7
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov eax, dword [r12 + rsi]
cmp dword [0x1404c7c28], eax
jg 0x1401e0cbd
mov rax, qword [0x1404c7c30]
test rax, rax
je 0x1401e09bf
mov ecx, 2
call rax
test eax, eax
je 0x1401e09e7
mov eax, dword [r12 + rsi]
cmp dword [0x1404c7c38], eax
jg 0x1401e0d0b
mov rax, qword [0x1404c7c40]
test rax, rax
je 0x1401e09e1
call rax
test eax, eax
jne 0x1401e09e7
mov byte [rbx + 0x10], 0
jmp 0x1401e09eb
mov byte [rbx + 0x10], 1
mov eax, 1
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x54], eax
mov edx, 2
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rdi, rax
mov ebx, 0x60
mov dword [rbp - 0x50], ebx
mov dword [rbp - 0x60], ebx
mov edx, 2
call fcn.14016c860
test al, al
je 0x1401e0a5e
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov ecx, dword [r12 + rdx]
cmp dword [0x1404c7c18], ecx
jg 0x1401e0c63
mov rax, qword [0x1404c7c20]
test rax, rax
je 0x1401e0a88
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x50]
xor edx, edx
mov rcx, rdi
call rax
test eax, eax
je 0x1401e0a88
jmp 0x1401e0a85
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov edx, 0x58
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rbp - 0x50], eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [rbp - 0x50]
call fcn.14020ef40
mov rdi, rax
cmp byte [rax + 0x10], 0
je 0x1401e0b82
mov ecx, ebx
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
movss xmm6, dword [0x140452f54]
mulss xmm1, xmm6
divss xmm1, dword [0x140452f50]
movss dword [rax + 4], xmm1
cmp dword [rax + 0x14], 0
jle 0x1401e0b64
cmp dword [rax + 0x18], 0
jle 0x1401e0b64
mov ecx, reloc.SinoSPE.dll_Ordinal_16
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm8, eax
cvtdq2ps xmm8, xmm8
mulss xmm8, xmm6
movd xmm0, dword [rdi + 0x14]
cvtdq2ps xmm0, xmm0
divss xmm8, xmm0
divss xmm8, dword [rdi + 4]
mov ecx, reloc.SinoSPE.dll_Ordinal_17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 4
call qword [sym.imp.USER32.dll_GetSystemMetrics]
add ebx, eax
movd xmm2, ebx
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm6
movss xmm1, dword [rdi + 4]
movd xmm0, dword [rdi + 0x18]
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
divss xmm2, xmm1
movss xmm0, dword [0x140452cd0]
comiss xmm0, xmm8
ja 0x1401e0b4a
comiss xmm0, xmm2
jbe 0x1401e0b64
movaps xmm1, xmm2
movaps xmm0, xmm8
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fminf]
movaps xmm1, xmm0
mulss xmm1, dword [rdi + 4]
movss dword [rdi + 4], xmm1
movss dword [rdi + 0xc], xmm1
movss dword [rdi + 8], xmm1
movss xmm0, dword [rdi]
mulss xmm0, xmm6
divss xmm0, dword [0x140452f50]
movss dword [rdi], xmm0
call fcn.1401e24f0
mov rdx, r15
mov rcx, r14
call fcn.1401e26a0
xor r8d, r8d
lea rdx, reloc.SinoSPE.dll_Ordinal_1
lea rcx, [0x1404c7a00]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov byte [0x1404b9e28], 1
mov al, 1
jmp 0x1401e0c2f
mov ecx, r15d
cmp r15d, 0x412
ja 0x1401e0bf1
je case.0x1401e0bef.1025
sub ecx, 0x401
cmp ecx, 0x10
ja case.0x1401e0bef.1025
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1e0dc8]
mov ecx, dword [rdx + rax*4 + 0x1e0dbc]
add rcx, rdx
jmp rcx
sub ecx, 0x419
je case.0x1401e0bef.1025
sub ecx, 5
je case.0x1401e0bef.1025
sub ecx, 0x3e6
jne case.0x1401e0bef.1025
lea rdx, [0x140417588]
jmp 0x1401e0c16
lea rdx, str.Illegal_application_
mov word [rsp + 0x20], r15w
mov r9d, reloc.SinoSPE.dll_Ordinal_16
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1404c7c18]
call fcn.1403caa80
cmp dword [0x1404c7c18], 0xffffffff
jne 0x1401e0a3d
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDpiForMonitorInternal
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c7c20], rax
lea rcx, [0x1404c7c18]
call fcn.1403caa14
jmp 0x1401e0a3d
call fcn.140006110
int3
call fcn.140006110
int3
lea rcx, [0x1404c7c28]
call fcn.1403caa80
cmp dword [0x1404c7c28], 0xffffffff
jne 0x1401e09a8
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwarenessInternal
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c7c30], rax
lea rcx, [0x1404c7c28]
call fcn.1403caa14
jmp 0x1401e09a8
lea rcx, [0x1404c7c38]
call fcn.1403caa80
cmp dword [0x1404c7c38], 0xffffffff
jne 0x1401e09cf
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetProcessDPIAware
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c7c40], rax
lea rcx, [0x1404c7c38]
call fcn.1403caa14
jmp 0x1401e09cf