Function at 0x438fa0
Capabilities:
Check for sandbox and av modules
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffe0
mov eax, 0x29b8
call fcn.0046dec0
push esi
push edi
push ecx
call fcn.004059a0
mov edi, eax
mov dword [esp + 0x58], edi
test edi, edi
jne 0x438fcd
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00446870
test eax, eax
jne 0x439f2c
push str.VBoxHook.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str..VBoxMiniRdrDN
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x439f2c
test esi, esi
jne 0x439f2c
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x439f2c
lea eax, [esp + 0x20]
mov dword [esp + 0x60], str.VMWARE
push eax
push 0x20019
push esi
push str.SYSTEMControlSet001ServicesDiskEnum
push 0x80000002
mov dword [esp + 0x78], str.VBOX
mov dword [esp + 0x7c], str.VIRTUAL
mov dword [esp + 0x70], 0x3f
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4390bc
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x84]
push eax
push esi
push esi
push 0x47d814
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4390b2
nop dword [eax]
push dword [esp + esi*4 + 0x60]
lea eax, [esp + 0x84]
push eax
call fcn.00449b10
add esp, 8
test eax, eax
jne 0x439218
inc esi
cmp esi, 3
jb 0x439090
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00446900
test al, al
jne 0x439f2c
lea eax, [esp + 0x13c]
push eax
push 0x2000
lea eax, [esp + 0x9c8]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x439825
mov ecx, dword [esp + 0x13c]
cmp ecx, 0x2000
jae 0x439825
shr ecx, 2
xor eax, eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x5c], eax
test ecx, ecx
je 0x439825
nop word [eax + eax]
push 0x800
lea ecx, [esp + 0x1c4]
push ecx
push dword [esp + eax*4 + 0x9c8]
call dword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x439808
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x1c0]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439164
sub ecx, edx
lea eax, [esp + 0x1c0]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.0043a330
cmp dword [esp + 0x44], 0xf
lea ecx, [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
cmova ecx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ecx
cmp eax, 0xe
jb 0x43925f
add eax, 0xfffffff3
add eax, ecx
mov dword [esp + 0x28], eax
sub eax, ecx
push eax
push 0x6b
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43925f
nop word [eax + eax]
mov ecx, edi
mov edx, str.kprocesshacker
mov esi, 0xa
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4391f1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4391e0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x43922a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x43922a
cmp esi, 0xfffffffe
je 0x439214
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x43922a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x43922a
xor eax, eax
jmp 0x43922f
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
sbb eax, eax
or eax, 1
test eax, eax
je 0x43924e
mov eax, dword [esp + 0x28]
inc edi
sub eax, edi
push eax
push 0x6b
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4391d0
jmp 0x43925b
sub edi, dword [esp + 0x24]
cmp edi, 0xffffffff
jne 0x439874
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x44], 0xf
lea ecx, [esp + 0x30]
cmova ecx, esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
cmp esi, 9
jb 0x439319
lea eax, [esi - 8]
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x48
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x439319
nop dword [eax]
mov ecx, edi
mov edx, str.HtFSWHbug
mov esi, 5
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4392c1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4392b0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4392e8
cmp esi, 0xfffffffd
je 0x4392e4
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4392e8
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4392e8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4392e8
xor eax, eax
jmp 0x4392ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x43930c
mov eax, dword [esp + 0x24]
inc edi
sub eax, edi
push eax
push 0x48
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4392a0
jmp 0x439319
sub edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x439882
cmp dword [esp + 0x44], 0xf
lea esi, [esp + 0x30]
mov ecx, dword [esp + 0x40]
cmova esi, dword [esp + 0x20]
cmp ecx, 3
jb 0x43939a
lea edi, [esi + ecx]
lea eax, [edi - 2]
sub eax, esi
push eax
push 0x6e
push esi
call fcn.0044a8d0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x43939a
nop word [eax + eax]
movzx ecx, byte [edx]
cmp cl, 0x6e
jne 0x43936c
movzx eax, byte [edx + 1]
cmp al, 0x70
jne 0x43936c
movzx eax, byte [edx + 2]
cmp al, 0x66
jne 0x43936c
xor eax, eax
jmp 0x439371
sbb eax, eax
or eax, 1
test eax, eax
je 0x43938f
inc edx
lea eax, [edi - 2]
sub eax, edx
push eax
push 0x6e
push edx
call fcn.0044a8d0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x439350
jmp 0x43939a
sub edx, esi
cmp edx, 0xffffffff
jne 0x439890
cmp dword [esp + 0x44], 0xf
lea ecx, [esp + 0x30]
mov eax, dword [esp + 0x40]
cmova ecx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
cmp eax, 9
jb 0x439459
add eax, 0xfffffff8
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x54
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x439459
nop word [eax + eax]
mov ecx, edi
mov edx, str.TitanHide
mov esi, 5
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x439401
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4393f0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x439428
cmp esi, 0xfffffffd
je 0x439424
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x439428
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x439428
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x439428
xor eax, eax
jmp 0x43942d
sbb eax, eax
or eax, 1
test eax, eax
je 0x43944c
mov eax, dword [esp + 0x24]
inc edi
sub eax, edi
push eax
push 0x54
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4393e0
jmp 0x439459
sub edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x43989e
cmp dword [esp + 0x44], 0xf
lea esi, [esp + 0x30]
mov ecx, dword [esp + 0x40]
cmova esi, dword [esp + 0x20]
cmp ecx, 3
jb 0x4394da
lea edi, [esi + ecx]
lea eax, [edi - 2]
sub eax, esi
push eax
push 0x76
push esi
call fcn.0044a8d0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x4394da
nop word [eax + eax]
movzx ecx, byte [edx]
cmp cl, 0x76
jne 0x4394ac
movzx eax, byte [edx + 1]
cmp al, 0x67
jne 0x4394ac
movzx eax, byte [edx + 2]
cmp al, 0x6b
jne 0x4394ac
xor eax, eax
jmp 0x4394b1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4394cf
inc edx
lea eax, [edi - 2]
sub eax, edx
push eax
push 0x76
push edx
call fcn.0044a8d0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x439490
jmp 0x4394da
sub edx, esi
cmp edx, 0xffffffff
jne 0x4398ac
cmp dword [esp + 0x44], 0xf
lea ecx, [esp + 0x30]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
cmova ecx, esi
mov dword [esp + 0x28], ecx
cmp eax, 8
jb 0x4395a0
add eax, 0xfffffff9
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x66
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43959c
nop dword [eax]
mov ecx, edi
mov edx, str.faceitac
mov esi, 4
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x439545
add ecx, 4
add edx, 4
sub esi, 4
jae 0x439530
xor eax, eax
jmp 0x43956c
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x439567
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x439567
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x439567
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x439567
xor eax, eax
jmp 0x43956c
sbb eax, eax
or eax, 1
test eax, eax
je 0x43958b
mov eax, dword [esp + 0x24]
inc edi
sub eax, edi
push eax
push 0x66
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x439520
jmp 0x439598
sub edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x4398ba
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x30]
cmp edi, 0xf
cmova ecx, esi
mov dword [esp + 0x28], ecx
cmp eax, 0xd
jb 0x439665
add eax, 0xfffffff4
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x45
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43965d
nop dword [eax]
mov ecx, edi
mov edx, str.EasyAntiCheat
mov esi, 9
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x439601
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4395f0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x439628
cmp esi, 0xfffffffd
je 0x439624
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x439628
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x439628
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x439628
xor eax, eax
jmp 0x43962d
sbb eax, eax
or eax, 1
test eax, eax
je 0x43964c
mov eax, dword [esp + 0x24]
inc edi
sub eax, edi
push eax
push 0x45
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4395e0
jmp 0x439659
sub edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x4398c8
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
cmp edi, 0xf
lea ecx, [esp + 0x30]
cmova ecx, esi
mov dword [esp + 0x28], ecx
cmp eax, 7
jb 0x43971f
mov eax, dword [esp + 0x40]
add eax, 0xfffffffa
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x42
push ecx
call fcn.0044a8d0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x439717
nop dword [eax]
mov ecx, esi
mov edx, str.BEDaisy
mov edi, 3
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4396bb
add ecx, 4
add edx, 4
or edi, 0xffffffff
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4396e2
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4396e2
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4396e2
cmp edi, 0xffffffff
je 0x4396de
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4396e2
xor eax, eax
jmp 0x4396e7
sbb eax, eax
or eax, 1
test eax, eax
je 0x439706
mov eax, dword [esp + 0x24]
inc esi
sub eax, esi
push eax
push 0x42
push esi
call fcn.0044a8d0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4396a0
jmp 0x439713
sub esi, dword [esp + 0x28]
cmp esi, 0xffffffff
jne 0x4398d6
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
cmp edi, 0xf
lea ecx, [esp + 0x30]
cmova ecx, esi
mov dword [esp + 0x28], ecx
cmp eax, 0xb
jb 0x4397cd
add eax, 0xfffffff6
add eax, ecx
mov dword [esp + 0x24], eax
sub eax, ecx
push eax
push 0x53
push ecx
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4397cd
mov ecx, edi
mov edx, str.SharpOD_Drv
mov esi, 7
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x439771
add ecx, 4
add edx, 4
sub esi, 4
jae 0x439760
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x439798
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x439798
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x439798
cmp esi, 0xffffffff
je 0x439794
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x439798
xor eax, eax
jmp 0x43979d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4397bc
mov eax, dword [esp + 0x24]
inc edi
sub eax, edi
push eax
push 0x53
push edi
call fcn.0044a8d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x439753
jmp 0x4397c9
sub edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x4398e4
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
cmp eax, 0xf
jbe 0x439808
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x4397fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
mov dword [esp + 0x20], edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a1d0
push ecx
push dword [esp + 0x24]
call fcn.00447c10
add esp, 8
mov eax, dword [esp + 0x5c]
inc eax
mov dword [esp + 0x5c], eax
cmp eax, dword [esp + 0x2c]
jl 0x439120
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [esp + 0x58]
cmp dword [0x6f797c], 0xf
mov eax, 0x6f7968
push dword [0x6f7978]
cmova eax, dword [0x6f7968]
mov ecx, 0x6f8e98
cmp dword [0x6f8eac], 0xf
mov edx, dword [0x6f8ea8]
cmova ecx, dword [0x6f8e98]
push eax
call fcn.0043a7c0
xor al, 1
add esp, 8
mov byte [0x6f8e65], al
cmp al, 1
je 0x439f34
jmp 0x439941
push 1
push str.Nemezida
push str.Delete_Process_Hacker__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Delete_HTTP_Debugger__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Delete_Wireshark__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Delete_TitanHide__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Disable_Vanguard_Anti_Cheat__before_launching_loader._And_restart_your_PC
jmp 0x4398f0
push 1
push str.Nemezida
push str.Disable_FaceIt_Anti_Cheat__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Disable_EAC_Anti_Cheat__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Disable_Battleye_Anti_Cheat__before_launching_loader._And_restart_your_PC.
jmp 0x4398f0
push 1
push str.Nemezida
push str.Remove_SharpOD__before_launching_loader._And_restart_your_PC
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call esi
mov eax, dword [esp + 0x44]
cmp eax, 0xf
jbe 0x439932
mov edx, dword [esp + 0x20]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x439928
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a1d0
push ecx
push edx
call fcn.00447c10
add esp, 8
push 0xb
call fcn.0045a4f0
add esp, 4
jmp 0x439821
mov ax, word [0x487cb8]
xorps xmm0, xmm0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0xf
movaps xmmword [esp + 0x140], xmm0
movq xmm0, qword [str.C:Nemezida]
mov word [esp + 0x148], ax
mov al, byte [0x487cba]
mov byte [esp + 0x14a], al
lea eax, [esp + 0x140]
push 0
mov byte [esp + 0x144], 0
push eax
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x158], 0xb
movq qword [esp + 0x148], xmm0
mov byte [esp + 0x153], 0
call esi
push 0x11
push str.C:Nemezida_fonts
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x118]
push dword [esp + 0x34]
xorps xmm0, xmm0
mov dword [esp + 0x12c], 0
movaps xmmword [esp + 0x11c], xmm0
push 0x11
mov dword [esp + 0x134], 0xf
mov byte [esp + 0x120], 0
call fcn.0043a570
cmp dword [esp + 0x124], 0xf
lea eax, [esp + 0x110]
push 0
cmova eax, dword [esp + 0x114]
push eax
call esi
push 0x12
push str.C:Nemezidaimages
mov byte [esp + 0x34], 0
lea ecx, [esp + 0xf8]
push dword [esp + 0x34]
xorps xmm0, xmm0
mov dword [esp + 0x10c], 0
movaps xmmword [esp + 0xfc], xmm0
push 0x12
mov dword [esp + 0x114], 0xf
mov byte [esp + 0x100], 0
call fcn.0043a570
cmp dword [esp + 0x104], 0xf
lea eax, [esp + 0xf0]
push 0
cmova eax, dword [esp + 0xf4]
push eax
call esi
push 0
push 0x100
mov ecx, 0x6f7980
call fcn.0043a1f0
push 0
push 0x100
mov ecx, 0x6f7998
call fcn.0043a1f0
push dword [0x6f7990]
cmp dword [0x6f7994], 0xf
mov eax, 0x6f7980
push 0
cmova eax, dword [0x6f7980]
push eax
call fcn.0044a130
add esp, 0xc
mov eax, 0x6f7998
cmp dword [0x6f79ac], 0xf
cmova eax, dword [0x6f7998]
push dword [0x6f79a8]
push 0
push eax
call fcn.0044a130
add esp, 0xc
call fcn.00446f30
push edi
call fcn.00405bd0
push ecx
xor edx, edx
call fcn.00404710
add esp, 4
test eax, eax
je 0x439ba6
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
js 0x439ba6
cmp dword [esp + 0x2c], 0
je 0x439ba6
push ecx
mov edx, 2
call fcn.00404710
add esp, 4
test eax, eax
jne 0x439b67
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.dwmapi.dll_DwmGetColorizationColor]
test eax, eax
js 0x439b49
cmp dword [esp + 0x24], 0
je 0x439b67
lea eax, [esp + 0x60]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x64], xmm0
push edi
mov dword [esp + 0x68], 1
call dword [sym.imp.dwmapi.dll_DwmEnableBlurBehindWindow]
jmp 0x439ba6
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, eax
mov dword [esp + 0x6c], 0
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 3
push eax
push edi
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], 1
call dword [sym.imp.dwmapi.dll_DwmEnableBlurBehindWindow]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x60]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x439c02
lea eax, [esp + 0x60]
push eax
call edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x64], 0x10
je 0x439cda
cmp byte [0x6f8ee8], 0
jne 0x439cda
push 1
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
call esi
test eax, eax
jne 0x439bc5
mov edi, dword [0x6f8e5c]
test edi, edi
je 0x439c15
mov edi, dword [edi + 0x74]
test edi, edi
jne 0x439c2e
jmp 0x439c17
xor edi, edi
push 0x252
push str.D:peniswedfghjklimgui_1.89.8_backendsimgui_impl_dx11.cpp
push str.bd___nullptr___Did_you_call_ImGui_ImplDX11_Init____
call fcn.0044dbe0
add esp, 0xc
cmp dword [edi + 0x24], 0
jne 0x439c39
call fcn.00402000
call fcn.00403250
call fcn.0040bd70
push dword [esp + 0x58]
call fcn.00441370
call fcn.0040e180
mov eax, dword [0x6f7a1c]
xorps xmm0, xmm0
push 0
push 0x6f7a14
movups xmmword [esp + 0x68], xmm0
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x84]
mov eax, dword [0x6f7a1c]
lea edx, [esp + 0x60]
push edx
push dword [0x6f7a14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc8]
mov edi, dword [0x6f8e5c]
cmp dword [edi + 0x47d0], 0
jg 0x439caf
push 0x731
push str.D:peniswedfghjklimgui_1.89.8examplesexample_win32_directx11_srcimguiimgui.h
push str.i___0__i___Size
call fcn.0044dbe0
add esp, 0xc
mov eax, dword [edi + 0x47d8]
xor ecx, ecx
mov eax, dword [eax]
add eax, 0x38
cmp byte [eax], cl
cmovne ecx, eax
call fcn.00401790
mov eax, dword [0x6f7a10]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
jmp 0x439bac
mov esi, dword [0x6f8e5c]
test esi, esi
je 0x439ced
mov edi, dword [esi + 0x74]
test edi, edi
jne 0x439d0c
jmp 0x439cef
xor edi, edi
push 0x242
push str.D:peniswedfghjklimgui_1.89.8_backendsimgui_impl_dx11.cpp
push str.bd___nullptr___No_renderer_backend_to_shutdown__or_already_shutdown__
call fcn.0044dbe0
mov esi, dword [0x6f8e5c]
add esp, 0xc
test esi, esi
jne 0x439d2d
push 0x108f
push str.D:peniswedfghjklimgui_1.89.8examplesexample_win32_directx11_srcimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.0044dbe0
mov esi, dword [0x6f8e5c]
add esp, 0xc
call fcn.004024e0
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x439d3f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x439d4b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x439d58
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi + 0xc], 0xfffffff7
mov eax, dword [0x6f8e5c]
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
test eax, eax
je 0x439d79
dec dword [eax + 0xac]
push edi
call fcn.00454982
mov eax, dword [0x6f8e5c]
add esp, 4
test eax, eax
je 0x439d94
mov esi, dword [eax + 0x70]
test esi, esi
jne 0x439db2
jmp 0x439d96
xor esi, esi
push 0xb8
push str.D:peniswedfghjklimgui_1.89.8_backendsimgui_impl_win32.cpp
push str.bd___nullptr___No_platform_backend_to_shutdown__or_already_shutdown__
call fcn.0044dbe0
mov eax, dword [0x6f8e5c]
add esp, 0xc
test eax, eax
jne 0x439dd2
push 0x108f
push str.D:peniswedfghjklimgui_1.89.8examplesexample_win32_directx11_srcimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.0044dbe0
mov eax, dword [0x6f8e5c]
add esp, 0xc
mov ecx, dword [esi + 0x28]
lea edi, [eax + 8]
test ecx, ecx
je 0x439de8
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x6f8e5c]
and dword [edi + 4], 0xfffffff8
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
test eax, eax
je 0x439e04
dec dword [eax + 0xac]
push esi
call fcn.00454982
mov esi, dword [esp + 0x5c]
add esp, 4
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00405f70
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x6f8f58]
push dword [0x6f8f6c]
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, dword [esp + 0x104]
cmp ecx, 0xf
jbe 0x439e76
mov edx, dword [esp + 0xf0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439e6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a1d0
push ecx
push edx
call fcn.00447c10
add esp, 8
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0xf
mov byte [esp + 0xf0], 0
cmp ecx, 0xf
jbe 0x439ed0
mov edx, dword [esp + 0x110]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439ec6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a1d0
push ecx
push edx
call fcn.00447c10
add esp, 8
mov ecx, dword [esp + 0x154]
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0xf
mov byte [esp + 0x110], 0
cmp ecx, 0xf
jbe 0x439f2a
mov edx, dword [esp + 0x140]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439f20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a1d0
push ecx
push edx
call fcn.00447c10
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 1
push str.Nemezida
push str.Download_New_Loader__nClick_Ok_To_Download_
push eax
call esi
cmp eax, 1
jne 0x43a1c9
lea eax, [esp + 0x2c]
push eax
call fcn.0043a1e0
mov dword [esp + 0x80], 0xc240b8c5
lea eax, [esp + 0x160]
mov dword [esp + 0x84], 0xe221e1ea
mov dword [esp + 0x88], 0xafb17208
mov dword [esp + 0x8c], 0x8c2fa371
movaps xmm0, xmmword [esp + 0x80]
movaps xmmword [esp + 0x160], xmm0
mov dword [esp + 0x90], 0x41f9c06a
mov dword [esp + 0x94], 0x3edcb5d3
mov dword [esp + 0x98], 0x5476a715
mov dword [esp + 0x9c], 0xea2a69a4
movaps xmm0, xmmword [esp + 0x90]
movaps xmmword [esp + 0x170], xmm0
mov dword [esp + 0xa0], 0xee15a94f
mov dword [esp + 0xa4], 0xb56aac02
mov dword [esp + 0xa8], 0xca064dd7
mov dword [esp + 0xac], 0xfb1c174f
movaps xmm0, xmmword [esp + 0xa0]
movaps xmmword [esp + 0x180], xmm0
mov dword [esp + 0xb0], 0xcfc454ae
mov dword [esp + 0xb4], 0x75483b0a
mov dword [esp + 0xb8], 0x126375ca
mov dword [esp + 0xbc], 0x91a6911f
movaps xmm0, xmmword [esp + 0xb0]
movaps xmmword [esp + 0x190], xmm0
push 5
push 0
mov dword [esp + 0x88], 0xb234ccad
mov dword [esp + 0x8c], 0xcd0edb99
mov dword [esp + 0x90], 0xdac31d6e
mov dword [esp + 0x94], 0xe9418d1c
mov dword [esp + 0x98], 0x2883a507
mov dword [esp + 0x9c], 0x58f2d4b7
mov dword [esp + 0xa0], 0x3d59c960
mov dword [esp + 0xa4], 0x924f0dca
vmovdqu ymm0, ymmword [esp + 0x88]
vpxor ymm0, ymm0, ymmword [esp + 0x168]
mov dword [esp + 0xc8], 0x18e4e8bb
mov dword [esp + 0xcc], 0x88d4d8b2
mov dword [esp + 0xd0], 0x5d9ad8e2
mov dword [esp + 0xd4], 0x6afa1614
vmovaps xmm1, xmmword [esp + 0xc8]
push 0
vmovdqa ymmword [esp + 0x16c], ymm0
vmovdqu ymm0, ymmword [esp + 0x18c]
vmovaps xmmword [esp + 0x1ac], xmm1
push eax
mov dword [esp + 0xb0], 0x9e7dd961
mov dword [esp + 0xb4], 0xc702d83d
mov dword [esp + 0xb8], 0xb9622cb2
mov dword [esp + 0xbc], 0x96797960
mov dword [esp + 0xc0], 0xabad2ecb
mov dword [esp + 0xc4], 0x2e166b
mov dword [esp + 0xc8], 0x7d0f58a4
mov dword [esp + 0xcc], 0xe3c3f57e
vpxor ymm0, ymm0, ymmword [esp + 0xb0]
mov dword [esp + 0xd0], 0x37d1da95
mov dword [esp + 0xd4], 0xfbbba891
mov dword [esp + 0xd8], 0x6aa8f596
mov dword [esp + 0xdc], 0x6afa1614
vxorps xmm1, xmm1, xmmword [esp + 0xd0]
push 0
vmovdqa ymmword [esp + 0x194], ymm0
vmovaps xmmword [esp + 0x1b4], xmm1
push 0
vzeroupper
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xffffffffffffffff
call fcn.00459b33
call fcn.0044dffe
int3