Function at 0x140044930
Capabilities:
Check if file exists
Query environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
movaps xmmword [rax - 0x38], xmm6
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp + 0x98], xmm0
movups xmm0, xmmword [str.C:WindowsCapcom.sys]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400d0f20]
mov dword [rax + 0x10], ecx
movzx ecx, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], sil
lea rcx, [rbp + 0x88]
call fcn.1400447c0
test al, al
je 0x1400449e1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Dumping_Driver_Detected___Please_uninstall_it_first_or_Contact_Smarty
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov rdx, rax
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [0x1400d1e40]
movdqu xmmword [rbp + 0x58], xmm0
movups xmm0, xmmword [str.C:WindowsKsDumperDriver.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400d0f88]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400d0f90]
mov dword [rax + 0x18], ecx
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
lea rcx, [rbp + 0x48]
call fcn.1400447c0
test al, al
je 0x140044a67
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Dumping_Driver_Detected___Please_uninstall_it_first_or_Contact_Smarty
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp + 0x38], xmm0
movups xmm0, xmmword [str.C:WindowsCapcom.sys]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400d0f20]
mov dword [rax + 0x10], ecx
movzx ecx, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea rcx, [rbp + 0x28]
call fcn.1400447c0
test al, al
je 0x140044ac8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov rdx, rax
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [0x1400d1e40]
movdqu xmmword [rbp + 0x18], xmm0
movups xmm0, xmmword [str.C:WindowsKsDumperDriver.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400d0f88]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400d0f90]
mov dword [rax + 0x18], ecx
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
lea rcx, [rbp + 8]
call fcn.1400447c0
test al, al
je 0x140044b39
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140044b64
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14003e9c0
nop
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14004cd50
nop
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.AppDataLocaldnSpy
mov rcx, rax
call fcn.14003ee00
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140044c0e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044c09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044c09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqa xmm6, xmmword [0x1400d1e10]
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140044c61
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044c5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044c5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rsp + 0x30], xmm6
mov byte [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x140044c80
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14003e9c0
nop
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x68]
call fcn.14004cd50
nop
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.AppDataRoamingdnSpy
mov rcx, rax
call fcn.14003ee00
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140044d2a
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044d25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044d25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp + 0x78], xmm6
mov byte [rbp + 0x68], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140044d73
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044d6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044d6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x140044d92
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14003e9c0
nop
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14004cd50
nop
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.AppDataLocalHex_Rays
mov rcx, rax
call fcn.14003ee00
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140044e3c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044e37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140044e87
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140044e82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rsp + 0x30], xmm6
mov byte [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov ecx, Ordinal_50
call fcn.1400b1430
mov qword [rbp + 0xd0], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_33]
movdqu xmmword [rbp + 0xe0], xmm0
movups xmm0, xmmword [str.C:Program_FilesCheat_Engine_7.5]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d1010]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x1400d1020]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov ecx, Ordinal_50
call fcn.1400b1430
mov r13, rax
mov qword [rbp + 0x120], rax
movdqa xmm0, xmmword [0x1400d1e80]
movdqu xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [str.C:Program_Files__x86_Cheat_Engine_7.5]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d1038]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400d1048]
mov dword [rax + 0x20], ecx
movzx eax, word [0x1400d104c]
mov word [r13 + 0x24], ax
movzx eax, byte [0x1400d104e]
mov byte [r13 + 0x26], al
mov byte [r13 + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov ecx, Ordinal_50
call fcn.1400b1430
mov qword [rbp + 0xf8], rax
movdqa xmm0, xmmword [0x1400d1e60]
movdqu xmmword [rbp + 0x108], xmm0
movups xmm0, xmmword [str.C:Program_FilesIDA_Freeware8.3]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d1060]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400d1070]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov rdx, rax
mov qword [rsp + 0x60], rax
movdqa xmm0, xmmword [0x1400d1e40]
movdqu xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [str.C:Program_FilesIDA_Pro8.3]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400d1088]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400d1090]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x1400d1094]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov ecx, Ordinal_50
call fcn.1400b1430
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_33]
movdqu xmmword [rbp + 0xb8], xmm0
movups xmm0, xmmword [str.C:Program_FilesCheat_Engine_7.4]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d10a8]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x1400d10b8]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov ecx, Ordinal_50
call fcn.1400b1430
mov r12, rax
mov qword [rbp + 0x140], rax
movdqa xmm0, xmmword [0x1400d1e80]
movdqu xmmword [rbp + 0x150], xmm0
movups xmm0, xmmword [str.C:Program_Files__x86_Cheat_Engine_7.4]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d10d0]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x1400d10e0]
mov dword [rax + 0x20], ecx
movzx eax, word [0x1400d10e4]
mov word [r12 + 0x24], ax
movzx eax, byte [0x1400d10e6]
mov byte [r12 + 0x26], al
mov byte [r12 + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b1430
mov rdx, rax
mov qword [rbp + 0x68], rax
movdqa xmm0, xmmword [0x1400d1e40]
movdqu xmmword [rbp + 0x78], xmm0
movups xmm0, xmmword [str.C:Program_FilesCheat_Engine]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400d10f8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400d1100]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x1400d1104]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov ecx, Ordinal_50
call fcn.1400b1430
mov rdx, rax
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_35]
movdqu xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.C:Program_Files__x86_Cheat_Engine]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400d1118]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400d1128]
mov word [rax + 0x20], cx
movzx eax, byte [0x1400d112a]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov ecx, 0x50
call fcn.1400b1430
mov rdi, rax
mov qword [rbp + 0x160], rax
movdqa xmm0, xmmword [0x1400d1ea0]
movdqu xmmword [rbp + 0x170], xmm0
movaps xmm0, xmmword [str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsCheat_Engine_7.5]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d1140]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d1150]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d1160]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400d1170]
mov dword [rdi + 0x40], eax
movzx eax, byte [0x1400d1174]
mov byte [rdi + 0x44], al
mov byte [rdi + 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov ecx, 0x50
call fcn.1400b1430
mov rsi, rax
mov qword [rbp + 0x180], rax
movdqa xmm0, xmmword [0x1400d1ea0]
movdqu xmmword [rbp + 0x190], xmm0
movaps xmm0, xmmword [str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsCheat_Engine_7.4]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d1190]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d11a0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d11b0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400d11c0]
mov dword [rsi + 0x40], eax
movzx eax, byte [0x1400d11c4]
mov byte [rsi + 0x44], al
mov byte [rsi + 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov ecx, 0x50
call fcn.1400b1430
mov r14, rax
mov qword [rbp + 0x1a0], rax
movdqa xmm0, xmmword [0x1400d1ea0]
movdqu xmmword [rbp + 0x1b0], xmm0
movaps xmm0, xmmword [str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsCheat_Engine_7.3]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d11e0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d11f0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d1200]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400d1210]
mov dword [r14 + 0x40], eax
movzx eax, byte [0x1400d1214]
mov byte [r14 + 0x44], al
mov byte [r14 + 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov ecx, 0x50
call fcn.1400b1430
mov r15, rax
mov qword [rbp + 0x1c0], rax
movdqa xmm0, xmmword [0x1400d1e90]
movdqu xmmword [rbp + 0x1d0], xmm0
movaps xmm0, xmmword [str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsCheat_Engine]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d1230]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d1240]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d1250]
movups xmmword [rax + 0x30], xmm1
movzx eax, byte [0x1400d1260]
mov byte [r15 + 0x40], al
mov byte [r15 + 0x41], 0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140045346
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Cracking_Programs_Detected___Please_uninstall_the_Cracking_programs_or_Contact_Smarty
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140045730
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x140045730
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
inc rbx
cmp byte [rax + rbx], 0
jne 0x140045391
mov qword [rsp + 0x28], rbx
call fcn.1400b0be8
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140043cf0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call fcn.1400b10a4
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14004574e
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14004542c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045426
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045426
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
nop
mov edx, 0x50
mov rcx, r15
call fcn.1400b177c
nop
mov edx, 0x50
mov rcx, r14
call fcn.1400b177c
nop
mov edx, 0x50
mov rcx, rsi
call fcn.1400b177c
nop
mov edx, 0x50
mov rcx, rdi
call fcn.1400b177c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400454a2
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004549d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004549d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp - 0x10], xmm6
mov byte [rbp - 0x20], 0
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, qword [rbp + 0x68]
call fcn.1400b177c
nop
mov edx, Ordinal_50
mov rcx, r12
call fcn.1400b177c
nop
mov edx, Ordinal_50
mov rcx, qword [rbp + 0xa8]
call fcn.1400b177c
nop
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, qword [rsp + 0x60]
call fcn.1400b177c
nop
mov edx, Ordinal_50
mov rcx, qword [rbp + 0xf8]
call fcn.1400b177c
nop
mov edx, Ordinal_50
mov rcx, r13
call fcn.1400b177c
nop
mov edx, Ordinal_50
mov rcx, qword [rbp + 0xd0]
call fcn.1400b177c
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14004555a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045555
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045555
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400455a1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004559c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004559c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp - 0x50], xmm6
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400455e8
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400455e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400455e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp - 0x30], xmm6
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x14004562f
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004562a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004562a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140045676
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045671
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045671
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp + 0x38], xmm6
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400456bd
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400456b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400456b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
movdqu xmmword [rbp + 0x58], xmm6
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14004570a
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045705
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b177c
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DnSpy_Detected___Please_uninstall_it_or_Contact_Smarty
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
shr rdx, 0x20
lea r8, [rsp + 0x40]
call fcn.1400446f0
int3