Function at 0x1000c730
Capabilities:
Acquire debug privileges
Create thread
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
dec dword [ebp + 0xc]
push esi
push edi
jne 0x1000cd00
mov eax, dword [ebp + 8]
mov dword [0x1001f674], eax
call sym.Codex.dll___Dllmain2
cmp dword [0x1001f774], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1000c77c
push 0
push 0
push 0
push 0x10012b10
push 0
push 0
call edi
cmp dword [0x1001f778], 1
jne 0x1000c796
push 0
push 0
push 0
push 0x10007110
push 0
push 0
call edi
mov eax, dword [0x1001f730]
test eax, eax
jne 0x1000c7ac
cmp dword [0x1001f6dc], 1
jne 0x1000c891
push 0
push 0
push 0
push 0x10007110
push 0
push 0
call edi
push dword [0x1001f69c]
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x1000c835
cmp dword [0x1001f718], 1
mov eax, dword [0x1001f724]
jne 0x1000c807
cmp eax, 1
je 0x1000c7e7
cmp eax, 3
jne 0x1000c807
push 0x200030
push dword [0x1001f6a0]
push str.AntiKill_Scan_n_nLauncher_not_found_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c835
cmp dword [0x1001f718], 1
jne 0x1000c835
push 0x200030
push dword [0x1001f6a0]
push str.AntiKill_Scan_n_nO_Launcher_deve_permanecer_ativo_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1001f6dc], 1
jne 0x1000c860
push 0
push 0
push 0
push 0x10011030
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100113a0
push 0
push 0
call edi
mov eax, dword [0x1001f730]
cmp eax, 1
jne 0x1000c891
push 0
push 0
push 0
push 0x10006800
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100068c0
push 0
push 0
call edi
mov eax, dword [0x1001f730]
cmp dword [0x1001f6d0], 1
jne 0x1000c8bf
test eax, eax
jne 0x1000c8ae
cmp dword [0x1001f6dc], 1
je 0x1000c8ae
call fcn.10010070
jmp 0x1000c8bf
push 0
push 0
push 0
push fcn.10010070
push 0
push 0
call edi
cmp dword [0x1001f76c], 1
jne 0x1000c8e8
mov eax, 0x693ff1
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.Player]
mov dword [ecx], eax
mov ax, word [0x1001615c]
mov word [ecx + 4], ax
cmp dword [0x1001f734], 1
jne 0x1000c902
push 0
push 0
push 0
push 0x10005e90
push 0
push 0
call edi
cmp dword [0x1001f6d4], 1
jne 0x1000c91c
push 0
push 0
push 0
push 0x10011c80
push 0
push 0
call edi
cmp dword [0x1001f6d8], 1
jne 0x1000c936
push 0
push 0
push 0
push 0x10006dc0
push 0
push 0
call edi
cmp dword [0x1001f6e8], 1
jne 0x1000c984
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x10015bb0
call fcn.10002ae0
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
lea eax, [esp + 8]
push eax
push 4
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1000
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [0x1001f6e4], 1
jne 0x1000c99e
push 0
push 0
push 0
push 0x10003ef0
push 0
push 0
call edi
cmp dword [0x1001f768], 1
jne 0x1000c9dc
mov esi, dword [sym.imp.MSVCR120.dll_remove]
push 0x1001672c
call esi
add esp, 4
push 0x10016730
call esi
add esp, 4
push 0x100164f8
call esi
add esp, 4
push 0
push 0
push 0
push 0x1000a7f0
push 0
push 0
call edi
cmp dword [0x1001f6cc], 1
jne 0x1000c9f6
push 0
push 0
push 0
push 0x1000d6d0
push 0
push 0
call edi
cmp dword [0x1001f70c], 1
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jne 0x1000ca0d
push dword [0x1001f698]
call esi
cmp dword [0x1001f77c], 1
jne 0x1000ca27
push 0
push 0
push 0
push 0x10005060
push 0
push 0
call edi
cmp dword [0x1001f6ec], 1
jne 0x1000ca42
push 0
push 0
push 0x1000e600
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
cmp dword [0x1001f708], 1
jne 0x1000ca52
push str.Glow.dll
call esi
cmp dword [0x1001f758], 1
jne 0x1000ca6c
push 0
push 0
push 0
push 0x10004210
push 0
push 0
call edi
cmp dword [0x1001f750], 1
jne 0x1000ca86
push 0
push 0
push 0
push 0x1000ec10
push 0
push 0
call edi
cmp dword [0x1001f728], 1
jne 0x1000caa0
push 0
push 0
push 0
push 0x100090a0
push 0
push 0
call edi
cmp dword [0x1001f72c], 1
jne 0x1000caba
push 0
push 0
push 0
push 0x10010890
push 0
push 0
call edi
cmp dword [0x1001f740], 1
jne 0x1000cad4
push 0
push 0
push 0
push 0x100126c0
push 0
push 0
call edi
cmp dword [0x1001f710], 1
jne 0x1000caee
push 0
push 0
push 0
push 0x1000f040
push 0
push 0
call edi
cmp dword [0x1001f744], 1
jne 0x1000cb08
push 0
push 0
push 0
push 0x1000f8c0
push 0
push 0
call edi
cmp dword [0x1001f748], 1
jne 0x1000cb22
push 0
push 0
push 0
push 0x10008df0
push 0
push 0
call edi
cmp dword [0x1001f74c], 1
jne 0x1000cb3c
push 0
push 0
push 0
push 0x10003ea0
push 0
push 0
call edi
cmp dword [0x1001f754], 1
jne 0x1000cb56
push 0
push 0
push 0
push 0x10001690
push 0
push 0
call edi
cmp dword [0x1001f75c], 1
jne 0x1000cb70
push 0
push 0
push 0
push 0x1000c1f0
push 0
push 0
call edi
cmp dword [0x1001f718], 1
jne 0x1000cb8a
push 0
push 0
push 0
push 0x1000bec0
push 0
push 0
call edi
cmp dword [0x1001f704], 1
jne 0x1000cba4
push 0
push 0
push 0
push 0x100104b0
push 0
push 0
call edi
cmp dword [0x1001f760], 1
jne 0x1000cbc7
cmp dword [0x1001f6e0], 0
jne 0x1000cbc7
push 0
push 0
push 0
push 0x10007540
push 0
push 0
call edi
cmp dword [0x1001f6c4], 1
jne 0x1000cbd5
call fcn.1000faf0
cmp dword [0x1001f6c8], 1
jne 0x1000cbef
push 0
push 0
push 0
push 0x10012980
push 0
push 0
call edi
cmp dword [0x1001f764], 1
jne 0x1000cc09
push 0
push 0
push 0
push 0x10010d50
push 0
push 0
call edi
cmp dword [0x1001f6e0], 1
jne 0x1000cc34
push 0
push 0
push 0
push 0x100120d0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100121b0
push 0
push 0
call edi
cmp dword [0x1001f71c], 1
jne 0x1000cc78
push 0
push 0
push 0
push 0x10007830
push 0
push 0
call edi
cmp dword [0x1001f760], 1
je 0x1000cc60
cmp dword [0x1001f768], 1
jne 0x1000cc78
push 0x200030
push dword [0x1001f6a0]
push str.WARNING__Anti_Kill_by_thread_incompatibility_detected__n_n_nThis_detector_dont_work_for_MU_Online_or_any_Main_without_STATIC_thread_count__n_n_nThis_detector_dont_work_with:__Ban_server_or_Hardware_Ban__for_the_same_reason._n_nYou_can_disable_this_message_on_START.cpp_adding_lines_intersection:____on_both_lines.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x1001f714], 1
jne 0x1000cd00
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ccf6
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000ccf6
mov eax, dword [esp + 0xc]
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.10012bb9
mov esp, ebp
pop ebp
ret 0xc