Function at 0x415610
Capabilities:
Create process on windows
Schedule task via at
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af850
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4df040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x11c]
call fcn.004148a0
mov dword [ebp - 0x64], eax
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x8c]
call fcn.004148a0
mov eax, dword [ebp - 0x64]
push eax
push 0
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00431030
add esp, 0xc
push ecx
movss xmm0, dword [0x4b2964]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b296c]
movss dword [esp], xmm0
lea ecx, [ebp - 0x10c]
call fcn.004148a0
push 0
lea edx, [ebp - 0x10c]
push edx
call fcn.004310b0
add esp, 8
push 0x126
push 0x4df004
push str.BGMI_Ban_Tool___2_Months_
call fcn.0041b680
add esp, 0xc
push 0xff2af6f6
push 0
call fcn.0042d8a0
add esp, 8
push str.Secure_your_Account_from_Scammers_
call fcn.004153e0
add esp, 4
push 1
call fcn.0042d480
add esp, 4
call fcn.00456890
movzx eax, byte [0x5166b8]
test eax, eax
jne 0x4158a4
push str.Enter_Key_
call fcn.004153e0
add esp, 4
push 0x4b1fe4
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 4
movss xmm0, dword [0x4b2964]
movss dword [esp], xmm0
call fcn.0042d720
add esp, 4
push 0
push 0
push 0
push 0x50
push 0x5160c8
push str.key
call fcn.00452710
add esp, 0x18
call fcn.0042d440
push 0x4b1ff4
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2948]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0x114]
call fcn.004148a0
lea ecx, [ebp - 0x114]
push ecx
push str.Authenticate_Me
call fcn.00450e20
add esp, 8
movzx edx, al
test edx, edx
je 0x415815
mov dword [0x5166bc], 1
push 0x5160c8
push 0x460600
lea ecx, [ebp - 0x6c]
call fcn.00413860
lea ecx, [ebp - 0x6c]
call fcn.00416c40
lea ecx, [ebp - 0x6c]
call fcn.00413520
call fcn.00457fc0
push str.Status_:
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
cmp dword [0x5166bc], 0
jne 0x415858
push str.Connected_to_server...
call fcn.004155b0
add esp, 4
cmp dword [0x5166bc], 1
jne 0x41586e
push str.Please_wait...
call fcn.004155b0
add esp, 4
cmp dword [0x5166bc], 2
jne 0x415884
push str.Successfully_Logged_In
call fcn.004155b0
add esp, 4
cmp dword [0x5166bc], 3
jne 0x41589a
push str.Invalid_Key_
call fcn.004155e0
add esp, 4
call fcn.00457fc0
jmp 0x41641d
push 0
push str.tabbar
call fcn.00450680
add esp, 8
mov eax, 0x20
test eax, eax
je 0x41641d
push 0
push 0
push str.___Bypass_BGMI
call fcn.00450ac0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x415df1
call fcn.00456890
push 0x4b2098
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2958]
movss dword [esp], xmm0
lea ecx, [ebp - 0x94]
call fcn.004148a0
lea edx, [ebp - 0x94]
push edx
push str.Start_LD_Player
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x4159b2
movzx ecx, byte [0x4df012]
test ecx, ecx
je 0x41599e
call fcn.00460ac0
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x415992
mov dword [0x5166b0], 1
push 0x462df0
lea ecx, [ebp - 0x9c]
call fcn.00413880
mov ecx, eax
call fcn.00416c40
lea ecx, [ebp - 0x9c]
call fcn.00413520
jmp 0x41599c
mov dword [0x5166b0], 3
jmp 0x4159b2
push 0x10
push 0x4b20b0
push 0x4b20c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push 0x4b20e8
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2958]
movss dword [esp], xmm0
lea ecx, [ebp - 0xa4]
call fcn.004148a0
lea edx, [ebp - 0xa4]
push edx
push str.Start_BGMI
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x415aac
movzx ecx, byte [0x4df012]
test ecx, ecx
je 0x415a98
call fcn.00460ac0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x415a82
mov dword [0x5166b4], 1
push 0x462710
lea ecx, [ebp - 0xac]
call fcn.00413880
mov ecx, eax
call fcn.00416c40
lea ecx, [ebp - 0xac]
call fcn.00413520
jmp 0x415a96
push 0x10
push 0x4b20fc
push str.Run_LD_Player_First__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x415aac
push 0x10
push str.Already_running
push str.Wait_to_Completed_Previous_Process__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00456890
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2968]
movss dword [esp], xmm0
lea ecx, [ebp - 0xb4]
call fcn.004148a0
lea edx, [ebp - 0xb4]
push edx
push str.Safe_Exit
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x415b15
push 0x460c90
lea ecx, [ebp - 0xbc]
call fcn.00413880
mov ecx, eax
call fcn.00416c40
lea ecx, [ebp - 0xbc]
call fcn.00413520
call fcn.00456890
call fcn.00457fc0
push 0xff00ff00
push 0
call fcn.0042d8a0
add esp, 8
push str.Points_to_be_Noted_
call fcn.004153e0
add esp, 4
push 1
call fcn.0042d480
add esp, 4
push 0x4b1d8d
call fcn.0045b7a0
add esp, 4
push str.LD_Player_is_Installed_throught_our_Tool.
call fcn.00450b60
add esp, 4
push str.Root_and_Adb_debugging_is_Enabled.
call fcn.00450b60
add esp, 4
call fcn.00457fc0
push str.Download_LD_PLayer____Downloads
call fcn.00450b60
add esp, 4
push str.Root_and_Adb_debugging____LD_Player_Settings____Other_Settings
call fcn.00450b60
add esp, 4
push 0x4b2224
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.Root_Permission____Enable
call fcn.004153e0
add esp, 4
push 0x4b224c
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.ADB_Settings____Open_Connection
call fcn.004153e0
add esp, 4
call fcn.00457fc0
push str.Game_Status_::
call fcn.0045b7a0
add esp, 4
cmp dword [0x5166b0], 1
jne 0x415c46
mov dword [0x5166b4], 0
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.Starting_LD_Player
call fcn.004155b0
add esp, 4
cmp dword [0x5166b0], 2
jne 0x415c7b
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.LD_Player_Started_
call fcn.004155b0
add esp, 4
cmp dword [0x5166b0], 3
jne 0x415cb0
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.LD_Player_already_running
call fcn.004155b0
add esp, 4
cmp dword [0x5166b0], 4
jne 0x415ce5
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.LD_Player_is_Not_Installed
call fcn.004155b0
add esp, 4
cmp dword [0x5166b4], 1
jne 0x415d24
mov dword [0x5166b0], 0
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.Bypassing_BGMI
call fcn.004155b0
add esp, 4
cmp dword [0x5166b4], 2
jne 0x415d59
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.Waiting_Libraries_to_get_load..
call fcn.004155b0
add esp, 4
cmp dword [0x5166b4], 3
jne 0x415d8e
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push str.BGMI_Started__
call fcn.004155b0
add esp, 4
push str.License_Status_::
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x70], esp
push str.C:Windows_banpanji.lic
call fcn.004058b0
lea ecx, [ebp - 0x40]
push ecx
call fcn.004171f0
add esp, 0x1c
mov ecx, eax
call fcn.004056c0
push eax
call fcn.004155b0
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00405810
call fcn.00452260
push 0
push 0
push str.___Tools
call fcn.00450ac0
add esp, 0xc
movzx edx, al
test edx, edx
je 0x41625f
push str.All_Tools_are_Here_
call fcn.0045b7a0
add esp, 4
call fcn.00457fc0
call fcn.00456890
push 0x4b1d8e
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0xc4]
call fcn.004148a0
lea eax, [ebp - 0xc4]
push eax
push str.Account_Log_out
call fcn.00450e20
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x415ec5
call fcn.00461e60
mov dword [ebp - 0x4c], eax
push 0x40
push str.Game_Pid
mov edx, dword [ebp - 0x4c]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00401dd0
add esp, 8
mov ecx, eax
call fcn.004056c0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x28]
call fcn.00405810
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0xcc]
call fcn.004148a0
lea ecx, [ebp - 0xcc]
push ecx
push str.Clear_Temp
call fcn.00450e20
add esp, 8
movzx edx, al
test edx, edx
je 0x415f88
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
push str.del__s__q_C:WindowsTemp
call fcn.004058b0
call fcn.00462ab0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.del__s__q_C:WindowsPrefetch
call fcn.004058b0
call fcn.00462ab0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.del__s__q__f__temp_
call fcn.004058b0
call fcn.00462ab0
add esp, 0x18
push 0x40
push 0x4b23f0
push str.Temp_Cleared_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0xd4]
call fcn.004148a0
lea eax, [ebp - 0xd4]
push eax
push str.Reset_Login_Timer
call fcn.00450e20
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x416017
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.adb.exe__s_emulator_5554_shell_rm__rf__sdcard_Android_data_com.pubg.imobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_SaveGames_loginInfoFile.json
call fcn.004058b0
call fcn.00462ab0
add esp, 0x18
push 0x40
push str.Reset
push str.Timer_Reset_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00456890
push 0x4b24dc
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2958]
movss dword [esp], xmm0
lea ecx, [ebp - 0xdc]
call fcn.004148a0
lea edx, [ebp - 0xdc]
push edx
push str.Install_Twitter
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x4160a4
mov dword [ebp - 0x50], str.https:__drive.google.com_file_d_1_Gd2aDvExLqkXl7_Z_Tz_Ce4DGUqW6MO_view_uspsharing
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
push ecx
push 0x4b254c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push 0x4b2554
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b295c]
movss dword [esp], xmm0
lea ecx, [ebp - 0xe4]
call fcn.004148a0
lea edx, [ebp - 0xe4]
push edx
push str.Install_FX_File_Manager
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x41614b
mov dword [ebp - 0x54], str.https:__fx_file_explorer.en.uptodown.com_android
push 0
push 0
push 0
mov ecx, dword [ebp - 0x54]
push ecx
push 0x4b25a8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.00456890
push 0x4b25b0
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b2950]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2960]
movss dword [esp], xmm0
lea ecx, [ebp - 0xec]
call fcn.004148a0
lea edx, [ebp - 0xec]
push edx
push str.Disable_Windows_Defender
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x4161eb
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
push str.reg_add_HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftMicrosoft_Defender__v_DisableAntiSpyware__t_REG_DWORD__d_1__f
call fcn.004058b0
call fcn.00462ab0
add esp, 0x18
push 0x40
push str.Done
push str.Restart_your_PC
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00457fc0
push str.Tool_Status_::
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
cmp dword [0x5160c0], 1
jne 0x41622e
push str.Downloading_Twitter...
call fcn.004155b0
add esp, 4
cmp dword [0x5160c0], 2
jne 0x416244
push str.Installing_Twitter...
call fcn.004155b0
add esp, 4
cmp dword [0x5160c0], 3
jne 0x41625a
push str.Twitter_Installed__
call fcn.004155b0
add esp, 4
call fcn.00452260
push 0
push 0
push str.___Downloads
call fcn.00450ac0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x41641d
push str.All_Downloads_are_here_
call fcn.0045b7a0
add esp, 4
call fcn.00457fc0
call fcn.00456890
push 0x4b1d8f
call fcn.0045b7a0
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0xf4]
call fcn.004148a0
lea edx, [ebp - 0xf4]
push edx
push str.Download_BGMI
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x41631a
mov dword [ebp - 0x58], str.https:__drive.google.com_file_d_12Ut92glsoUdE67l7IrgCjnysbInXMj4B_view_google_abuseGOOGLE_ABUSE_EXEMPTION_3DID_3Da5ce5ca9903da6ce:TM_3D1707135486:C_3Dr:IP_3D27.57.97.53_:S_3Dcgcms9k35hmTf2JXBqD7tJA_3Bpath_3D__3Bdomain_3Dgoogle.com_3Bexpires_3DMon_05_Feb_202415:18:06GMT
push 0
push 0
push 0
mov ecx, dword [ebp - 0x58]
push ecx
push 0x4b2820
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0xfc]
call fcn.004148a0
lea edx, [ebp - 0xfc]
push edx
push str.Download_LD
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x416399
mov dword [ebp - 0x5c], str.https:__drive.google.com_file_d_1DPkAIrtma9T7BvgdNgoFfzbI6sFqHFOt_view
push 0
push 0
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x4b2880
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ecx
movss xmm0, dword [0x4b2970]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.004300a0
add esp, 8
push ecx
movss xmm0, dword [0x4b294c]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x4b2954]
movss dword [esp], xmm0
lea ecx, [ebp - 0x104]
call fcn.004148a0
lea edx, [ebp - 0x104]
push edx
push str.Telegram
call fcn.00450e20
add esp, 8
movzx eax, al
test eax, eax
je 0x416418
mov dword [ebp - 0x60], str.https:__t.me_Banwaala
push 0
push 0
push 0
mov ecx, dword [ebp - 0x60]
push ecx
push 0x4b28ac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.00452260
call fcn.00421800
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004acccf
mov esp, ebp
pop ebp
ret