Function at 0x10004a70
Capabilities:
Acquire debug privileges
Check for software breakpoints
Check for time delay via gettickcount
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x1001e018]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
call fcn.10006280
call fcn.1000cde0
mov edi, 0x1011e9e8
call fcn.1000bfe0
test al, al
jne 0x10004af3
push 0x100
push 0
push 0x10129548
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10004ac0
mov cl, byte [eax + 0x100178c0]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10129548], cl
inc eax
cmp eax, 0x100
jb 0x10004ac0
push 0x10129548
push 0
mov ecx, 0x1011e7a8
call fcn.100063a0
add esp, 8
call fcn.1000f690
cmp byte [0x4da3e0], 0x28
je 0x10004b18
push 0
push str._ElfCheat_
push str.BQT_khuyen_ban_khong_gian_lan_khi_choi_game__1
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x5de171], 0x89
jne 0x10005cb0
cmp byte [0x5de172], 0x8a
jne 0x10005cb0
cmp byte [0x5de173], 0xa0
jne 0x10005cb0
cmp byte [0x5de174], 0
jne 0x10005cb0
cmp byte [0x5de175], 0
jne 0x10005cb0
cmp byte [0x5de176], 0
jne 0x10005cb0
cmp byte [0x5b5fff], 0xf5
jne 0x10005cb0
cmp byte [0x5b6000], 0
jne 0x10005cb0
cmp byte [0x5b6001], 0
jne 0x10005cb0
cmp byte [0x5b6002], 0
jne 0x10005cb0
cmp byte [0x5a1797], 0x8d
jne 0x10005cb0
mov cl, 0xd4
cmp byte [0x5a1798], cl
jne 0x10005cb0
cmp byte [0x5a1799], 0xf7
jne 0x10005cb0
mov al, 0xff
cmp byte [0x5a179a], al
jne 0x10005cb0
cmp byte [0x5a179b], al
jne 0x10005cb0
cmp byte [0x5ad824], 0x8d
jne 0x10005cb0
cmp byte [0x5ad825], 0xac
jne 0x10005cb0
cmp byte [0x5ad826], 0xef
jne 0x10005cb0
cmp byte [0x5ad827], al
jne 0x10005cb0
cmp byte [0x5ad828], al
jne 0x10005cb0
cmp byte [0x5af96d], 0x8d
jne 0x10005cb0
cmp byte [0x5af96e], 0x1c
jne 0x10005cb0
cmp byte [0x5af96f], 0x8e
jne 0x10005cb0
cmp byte [0x5af970], al
jne 0x10005cb0
cmp byte [0x5af971], al
jne 0x10005cb0
cmp byte [0x59c79d], 0x8d
jne 0x10005cb0
cmp byte [0x59c79e], cl
jne 0x10005cb0
cmp byte [0x59c79f], 0xf7
jne 0x10005cb0
cmp byte [0x59c7a0], al
jne 0x10005cb0
cmp byte [0x59c7a1], al
jne 0x10005cb0
cmp byte [0x5afbf1], 0x8d
jne 0x10005cb0
mov cl, 4
cmp byte [0x5afbf2], cl
jne 0x10005cb0
cmp byte [0x5afbf3], 0x86
jne 0x10005cb0
cmp byte [0x5afbf4], al
jne 0x10005cb0
cmp byte [0x5afbf5], al
jne 0x10005cb0
cmp byte [0x59cedc], 0x8d
jne 0x10005cb0
cmp byte [0x59cedd], 0xe4
jne 0x10005cb0
cmp byte [0x59cede], 0xf7
jne 0x10005cb0
cmp byte [0x59cedf], al
jne 0x10005cb0
cmp byte [0x59cee0], al
jne 0x10005cb0
cmp byte [0x5b1ccb], 0x8d
jne 0x10005cb0
cmp byte [0x5b1ccc], cl
jne 0x10005cb0
cmp byte [0x5b1ccd], 0x97
jne 0x10005cb0
cmp byte [0x5b1cce], al
jne 0x10005cb0
cmp byte [0x5b1ccf], al
jne 0x10005cb0
cmp byte [0x5b170a], 0x8d
jne 0x10005cb0
cmp byte [0x5b170b], 0x34
jne 0x10005cb0
cmp byte [0x5b170c], 0xaf
jne 0x10005cb0
cmp byte [0x5b170d], al
jne 0x10005cb0
cmp byte [0x5b170e], al
jne 0x10005cb0
cmp byte [0x5b0c07], 0x8d
jne 0x10005cb0
cmp byte [0x5b0c08], 0x7c
jne 0x10005cb0
cmp byte [0x5b0c09], 0xcf
jne 0x10005cb0
cmp byte [0x5b0c0a], al
jne 0x10005cb0
cmp byte [0x5b0c0b], al
jne 0x10005cb0
cmp byte [0x5b187c], 0x8d
jne 0x10005cb0
mov dl, 0x24
cmp byte [0x5b187d], dl
jne 0x10005cb0
cmp byte [0x5b187e], 0xa7
jne 0x10005cb0
cmp byte [0x5b187f], al
jne 0x10005cb0
cmp byte [0x5b1880], al
jne 0x10005cb0
cmp byte [0x59d1e2], 0x8d
jne 0x10005cb0
mov cl, 0x90
cmp byte [0x59d1e3], cl
je 0x10005cb0
cmp byte [0x59d1e4], 0xe7
jne 0x10005cb0
cmp byte [0x59d1e5], al
jne 0x10005cb0
cmp byte [0x59d1e6], al
jne 0x10005cb0
cmp byte [0x5b1aa9], 0x8d
jne 0x10005cb0
cmp byte [0x5b1aaa], 0x14
jne 0x10005cb0
cmp byte [0x5b1aab], 0x9f
jne 0x10005cb0
cmp byte [0x5b1aac], al
jne 0x10005cb0
cmp byte [0x5b1aad], al
jne 0x10005cb0
cmp byte [0x5ac554], 0x8d
jne 0x10005cb0
mov bl, 0x74
cmp byte [0x5ac555], bl
jne 0x10005cb0
cmp byte [0x5ac556], 0xb6
jne 0x10005cb0
cmp byte [0x5ac557], al
jne 0x10005cb0
cmp byte [0x5ac558], al
jne 0x10005cb0
cmp byte [0x59d6ad], 0x8d
jne 0x10005cb0
cmp byte [0x59d6ae], 0xcc
jne 0x10005cb0
cmp byte [0x59d6af], 0xef
jne 0x10005cb0
cmp byte [0x59d6b0], al
jne 0x10005cb0
cmp byte [0x59d6b1], al
jne 0x10005cb0
cmp byte [0x5ac22c], 0x8d
jne 0x10005cb0
cmp byte [0x5ac22d], 0xfc
jne 0x10005cb0
cmp byte [0x5ac22e], 0xbe
jne 0x10005cb0
cmp byte [0x5ac22f], al
jne 0x10005cb0
cmp byte [0x5ac230], al
jne 0x10005cb0
cmp byte [0x534fd2], 0x8d
jne 0x10005cb0
cmp byte [0x534fd3], cl
je 0x10005cb0
cmp byte [0x534fd4], 0xf7
jne 0x10005cb0
cmp byte [0x534fd5], al
jne 0x10005cb0
cmp byte [0x534fd6], al
jne 0x10005cb0
cmp byte [0x59ded9], 0x8d
jne 0x10005cb0
cmp byte [0x59deda], cl
je 0x10005cb0
cmp byte [0x59dedb], 0xef
jne 0x10005cb0
cmp byte [0x59dedc], al
jne 0x10005cb0
cmp byte [0x59dedd], al
jne 0x10005cb0
cmp byte [0x59dc87], 0x8d
jne 0x10005cb0
cmp byte [0x59dc88], cl
je 0x10005cb0
cmp byte [0x59dc89], 0xf7
jne 0x10005cb0
cmp byte [0x59dc8a], al
jne 0x10005cb0
cmp byte [0x59dc8b], al
jne 0x10005cb0
cmp byte [0x5b2c98], 0x8d
jne 0x10005cb0
cmp byte [0x5b2c99], 0x6c
jne 0x10005cb0
cmp byte [0x5b2c9a], 0x6e
jne 0x10005cb0
cmp byte [0x5b2c9b], al
jne 0x10005cb0
cmp byte [0x5b2c9c], al
jne 0x10005cb0
cmp byte [0x59f471], 0x8d
jne 0x10005cb0
cmp byte [0x59f472], dl
jne 0x10005cb0
cmp byte [0x59f473], 0xbf
jne 0x10005cb0
cmp byte [0x59f474], al
jne 0x10005cb0
cmp byte [0x59f475], al
jne 0x10005cb0
cmp byte [0x59f211], 0x8d
jne 0x10005cb0
cmp byte [0x59f212], 0x44
jne 0x10005cb0
cmp byte [0x59f213], 0xc7
jne 0x10005cb0
cmp byte [0x59f214], al
jne 0x10005cb0
cmp byte [0x59f215], al
jne 0x10005cb0
cmp byte [0x50fb50], 0x8d
jne 0x10005cb0
cmp byte [0x50fb51], 0x5a
je 0x10005cb0
cmp byte [0x50fb52], 0xf7
jne 0x10005cb0
cmp byte [0x50fb53], al
jne 0x10005cb0
cmp byte [0x50fb54], al
jne 0x10005cb0
cmp byte [0x50f357], 0x8d
jne 0x10005cb0
cmp byte [0x50f358], 0xb4
jne 0x10005cb0
cmp byte [0x50f359], 0xef
jne 0x10005cb0
cmp byte [0x50f35a], al
jne 0x10005cb0
cmp byte [0x50f35b], al
jne 0x10005cb0
cmp byte [0x5ade26], 0x8d
jne 0x10005cb0
cmp byte [0x5ade27], bl
jne 0x10005cb0
push 0
push str._ElfCheat_
push str.BQT_khuyen_ban_khong_gian_lan_khi_choi_game__2
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]