Function at 0x401d20
Capabilities:
Execute command
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
call sym.start_antidebug__
mov ecx, 0xc8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401d73
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
call sym.DisableQuickEditMode__
lea rcx, [0x00496003]
call sym.system
lea rcx, str.color_6
call sym.system
call sym.IsElevated__
test eax, eax
sete al
test al, al
je 0x401dca
mov r9d, 0x41010
lea r8, str.BYPASS..........
lea rdx, str.Run_the_Bypass_as_Administrator
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 1
call sym.exit
lea rcx, str.msedgewebview2.exe
call sym.TP_char_const_
call sym.kill_back_edge__
call sym.do_title__
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401e0f
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
lea rdx, str.Initializing_Bypass....._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea rdx, str.wait.........._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.start_P_kill__
call sym.do_brave__
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401e7c
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
call sym.dis_link__
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.a.txt
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
je 0x401f21
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401ee5
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
lea rcx, [0x00496003]
call sym.system
lea rdx, str.Vip_mode_detected................._n
mov rcx, qword [0x0049c9d0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ecx, 0x4b0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.start_key_system__
mov ebx, 0
jmp 0x401fde
lea rcx, [0x00496003]
call sym.system
call sym.check_dis__
test eax, eax
sete al
test al, al
je 0x401faa
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401f6a
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
call sym.check_ads_system__
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401f9e
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
lea rcx, [0x00496003]
call sym.system
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401fd9
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sym.exit
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x401ff1
jmp 0x40200f
nop
jmp 0x40200f
add rsp, 0x208
pop rbx
pop rbp
ret