Function at 0x140003510
Capabilities:
Create process on windows
Enumerate processes
Execute command
Get hostname
Get session user name
Get system information on windows
Manipulate console buffer
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f80]
mov eax, 0x2080
call fcn.1400098d0
sub rsp, rax
movaps xmmword [rsp + 0x2070], xmm6
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0x1f60], rax
xor r15d, r15d
mov eax, r15d
mov dword [rbp + 0x538], eax
mov dword [rbp + 0x1c0], eax
mov dword [rbp + 0x1c8], 0x12
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x1f48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, str.______._.__Xin_Chao__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [rbp + 0x1f48]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x14000ba04]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x1cc], 0x12
lea rdx, [rbp + 0x1cc]
lea rcx, [rbp + 0x1f30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.______._.__Nguoi_Su_Dung_Ban_Hack__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [rbp + 0x1f30]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x14000ba04]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x1f48]
lea rcx, [rbp + 0xa28]
call fcn.1400065a0
nop
lea rcx, [rbp + 0xa28]
call fcn.1400063b0
mov r14d, r15d
mov dword [rbp + 0x1c0], r15d
lea ebx, [rax - 1]
test ebx, ebx
js 0x1400036b3
movsxd rdi, ebx
mov esi, r15d
nop dword [rax]
mov edx, esi
mov ecx, 0xa
call fcn.140006c60
movaps xmm6, xmm0
mov rdx, rdi
lea rcx, [rbp + 0xa28]
call fcn.1400063c0
movsx ecx, byte [rax]
sub ecx, 0x30
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
movd xmm0, r14d
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cvttsd2si r14d, xmm1
inc esi
dec rdi
sub ebx, 1
jns 0x140003660
mov dword [rbp + 0x1c0], r14d
lea rdx, [rbp + 0x1f30]
lea rcx, [rbp + 0xa08]
call fcn.1400065a0
nop
lea rcx, [rbp + 0xa08]
call fcn.1400063b0
lea ebx, [rax - 1]
test ebx, ebx
js 0x140003705
movsxd rdi, ebx
mov esi, r15d
mov edx, esi
mov ecx, 0xa
call fcn.140006c60
mov rdx, rdi
lea rcx, [rbp + 0xa08]
call fcn.1400063c0
inc esi
dec rdi
sub ebx, 1
jns 0x1400036e0
lea rdx, str.getmac
lea rcx, [rbp + 0xa88]
call fcn.1400065a0
nop
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0xa68]
call fcn.1400065a0
nop
lea r8, [0x14000ba64]
lea rdx, [rbp + 0xa88]
lea rcx, [rsp + 0x60]
call fcn.140006c80
nop
lea r8, [rbp + 0xa68]
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.140006db0
mov rcx, rax
call fcn.140002d30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
lea rcx, [rsp + 0x60]
call fcn.1400028c0
mov edx, 0x110
lea rcx, [rbp + 0x200]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0x200]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x200]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x140003811
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_Lay_Key_Gui_Cho_Quyen_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, r15d
lea rcx, [rbp + 0x9e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x9c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x9a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x988]
call fcn.140002920
nop
lea rcx, [rbp + 0x968]
call fcn.140002920
nop
lea rcx, [rbp + 0x948]
call fcn.140002920
nop
lea rcx, [rbp + 0x928]
call fcn.140002920
nop
lea rcx, [rbp + 0x908]
call fcn.140002920
nop
lea rcx, [rbp + 0x8e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x8c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x8a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x888]
call fcn.140002920
nop
lea rcx, [rbp + 0xca8]
call fcn.140002920
nop
lea rcx, [rbp + 0xc88]
call fcn.140002920
nop
lea rcx, [rbp + 0xc68]
call fcn.140002920
nop
lea rcx, [rbp + 0xc48]
call fcn.140002920
nop
lea rcx, [rbp + 0xc28]
call fcn.140002920
nop
lea rcx, [rbp + 0xc08]
call fcn.140002920
nop
lea rcx, [rbp + 0xbe8]
call fcn.140002920
nop
lea rcx, [rbp + 0xbc8]
call fcn.140002920
nop
lea rcx, [rbp + 0x588]
call fcn.140002920
nop
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x210], 1
jne 0x140003a64
nop
lea rdx, [rbp + 0x541]
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x541]
lea rcx, [rbp + 0x588]
call fcn.1400063e0
inc ebx
cmp ebx, 0xaa
jne 0x14000397d
lea rcx, [rbp + 0x9e8]
jmp 0x140003a3f
cmp ebx, 0xa9
jne 0x140003991
lea rcx, [rbp + 0x9c8]
jmp 0x140003a3f
cmp ebx, 0xa7
jne 0x1400039a5
lea rcx, [rbp + 0x9a8]
jmp 0x140003a3f
cmp ebx, 0xa6
jne 0x1400039b9
lea rcx, [rbp + 0x988]
jmp 0x140003a3f
cmp ebx, 0xa4
jne 0x1400039ca
lea rcx, [rbp + 0x968]
jmp 0x140003a3f
cmp ebx, 0xa3
jne 0x1400039db
lea rcx, [rbp + 0x948]
jmp 0x140003a3f
cmp ebx, 0xa1
jne 0x1400039ec
lea rcx, [rbp + 0x928]
jmp 0x140003a3f
cmp ebx, 0xa0
jne 0x1400039fd
lea rcx, [rbp + 0x908]
jmp 0x140003a3f
cmp ebx, 0xad
jne 0x140003a0e
lea rcx, [rbp + 0x8e8]
jmp 0x140003a3f
cmp ebx, 0xac
jne 0x140003a1f
lea rcx, [rbp + 0x8c8]
jmp 0x140003a3f
cmp ebx, 0xb0
jne 0x140003a30
lea rcx, [rbp + 0x8a8]
jmp 0x140003a3f
cmp ebx, 0xaf
jne 0x140003a4b
lea rcx, [rbp + 0x888]
lea rdx, [rbp + 0x588]
call fcn.140006480
mov rax, qword [rbp + 0x200]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x210], 1
je 0x140003940
lea rcx, [rbp + 0x200]
call fcn.1400026b0
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r13d, dword [rbp + 0x1d0]
mov r12d, dword [rbp + 0x1f0]
mov r15d, dword [rbp + 0x1d4]
mov r14d, dword [rbp + 0x1f4]
mov esi, dword [rbp + 0x1d8]
mov edi, dword [rbp + 0x1e0]
mov ebx, dword [rbp + 0x1e8]
mov edx, 0x108
lea rcx, [rbp + 0xef0]
call fcn.140006190
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0xef0]
call fcn.1400062a0
nop
add edi, ebx
add edi, esi
add edi, r14d
add edi, r15d
add edi, r12d
add edi, r13d
add edi, dword [rbp + 0x1c0]
mov edx, dword [rbp + 0x1cc]
add edx, edi
add edx, dword [rbp + 0x1c8]
lea rcx, [rbp + 0xef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rbp + 0xef0]
call fcn.1400061a0
mov edx, 0x110
lea rcx, [rbp + 0x310]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0x310]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x310]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x310]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x140003bac
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_FB_QuyenGaBon_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0xa48]
call fcn.140002920
nop
lea rcx, [rbp + 0xba8]
call fcn.140002920
nop
lea rcx, [rbp + 0xb88]
call fcn.140002920
nop
lea rcx, [rbp + 0xb68]
call fcn.140002920
nop
lea rcx, [rbp + 0xb48]
call fcn.140002920
nop
lea rcx, [rbp + 0xb28]
call fcn.140002920
nop
lea rcx, [rbp + 0xb08]
call fcn.140002920
nop
lea rcx, [rbp + 0xae8]
call fcn.140002920
nop
lea rcx, [rbp + 0xac8]
call fcn.140002920
nop
lea rcx, [rbp + 0xaa8]
call fcn.140002920
nop
lea rcx, [rbp + 0x5a8]
call fcn.140002920
nop
mov rax, qword [rbp + 0x310]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x320], 1
jne 0x140003d38
nop word [rax + rax]
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x310]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x540]
lea rcx, [rbp + 0x5a8]
call fcn.1400063e0
inc ebx
cmp ebx, 1
jne 0x140003c97
lea rcx, [rbp + 0xa48]
jmp 0x140003d13
cmp ebx, 2
jne 0x140003ca5
lea rcx, [rbp + 0xba8]
jmp 0x140003d13
cmp ebx, 3
jne 0x140003cb3
lea rcx, [rbp + 0xb88]
jmp 0x140003d13
cmp ebx, 4
jne 0x140003cc1
lea rcx, [rbp + 0xb68]
jmp 0x140003d13
cmp ebx, 5
jne 0x140003ccf
lea rcx, [rbp + 0xb48]
jmp 0x140003d13
cmp ebx, 6
jne 0x140003cdd
lea rcx, [rbp + 0xb28]
jmp 0x140003d13
cmp ebx, 7
jne 0x140003ceb
lea rcx, [rbp + 0xb08]
jmp 0x140003d13
cmp ebx, 8
jne 0x140003cf9
lea rcx, [rbp + 0xae8]
jmp 0x140003d13
cmp ebx, 9
jne 0x140003d07
lea rcx, [rbp + 0xac8]
jmp 0x140003d13
cmp ebx, 0xa
jne 0x140003d1f
lea rcx, [rbp + 0xaa8]
lea rdx, [rbp + 0x5a8]
call fcn.140006480
mov rax, qword [rbp + 0x310]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x320], 1
je 0x140003c60
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________________________________________FaceBook:_QUYEN_GA_BON
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.______________________________________________________________ROS_HACK
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x108
lea rcx, [rbp + 0xde0]
call fcn.140006190
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.FB_QuyenGaBon.txt
lea rcx, [rbp + 0xde0]
call fcn.1400062a0
nop
lea rdx, str.https:__www.facebook.com_thuynguyet.phonghoa.9
lea rcx, [rbp + 0xde0]
call fcn.140006a50
lea rcx, [rbp + 0xde0]
call fcn.1400061a0
mov edx, 0x108
lea rcx, [rbp + 0xcd0]
call fcn.140006190
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0xcd0]
call fcn.1400062a0
nop
lea r8, [rbp + 0x9c8]
lea rdx, [rbp + 0x9e8]
lea rcx, [rbp - 0x60]
call fcn.140006e20
nop
lea r8, [rbp + 0x9a8]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140006db0
nop
lea r8, [rbp + 0x988]
mov rdx, rax
lea rcx, [rbp]
call fcn.140006db0
nop
lea r8, [rbp + 0x968]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140006db0
nop
lea r8, [rbp + 0x948]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140006db0
nop
lea r8, [rbp + 0x928]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140006db0
nop
lea r8, [rbp + 0x908]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140006db0
nop
lea r8, [rbp + 0x8e8]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006db0
nop
lea r8, [rbp + 0x8c8]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140006db0
nop
lea r8, [rbp + 0x8a8]
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.140006db0
nop
lea r8, [rbp + 0x888]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140006db0
mov rbx, rax
mov edx, dword [rbp + 0x1cc]
add edx, edi
add edx, dword [rbp + 0x1c8]
lea rcx, [rbp + 0xcd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
mov rdx, rbx
call fcn.140006f80
nop
lea rcx, [rsp + 0x60]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x20]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x20]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x80]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x60]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x40]
call fcn.1400028c0
nop
lea rcx, [rbp]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x40]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x60]
call fcn.1400028c0
lea rcx, [rbp + 0xcd0]
call fcn.1400061a0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x110
lea rcx, [rbp + 0x420]
call fcn.140001840
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rdx, str.GuiKeyChoQuyen.txt
lea rcx, [rbp + 0x420]
call fcn.1400027b0
nop
mov rax, qword [rbp + 0x420]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x420]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::fail_void_const___ptr64]
test al, al
je 0x14000409d
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Vui_Long_Mo_Lai_Hack
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rcx, rax
lea rdx, [0x140006c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, r15d
lea rcx, [rbp + 0x668]
call fcn.140002920
nop
lea rcx, [rbp + 0x7a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x7c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x7e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x808]
call fcn.140002920
nop
lea rcx, [rbp + 0x828]
call fcn.140002920
nop
lea rcx, [rbp + 0x848]
call fcn.140002920
nop
lea rcx, [rbp + 0x868]
call fcn.140002920
nop
lea rcx, [rbp + 0x5e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x608]
call fcn.140002920
nop
lea rcx, [rbp + 0x628]
call fcn.140002920
nop
lea rcx, [rbp + 0x648]
call fcn.140002920
nop
lea rcx, [rbp + 0x688]
call fcn.140002920
nop
lea rcx, [rbp + 0x6a8]
call fcn.140002920
nop
lea rcx, [rbp + 0x6c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x6e8]
call fcn.140002920
nop
lea rcx, [rbp + 0x708]
call fcn.140002920
nop
lea rcx, [rbp + 0x728]
call fcn.140002920
nop
lea rcx, [rbp + 0x748]
call fcn.140002920
nop
lea rcx, [rbp + 0x768]
call fcn.140002920
nop
lea rcx, [rbp + 0x788]
call fcn.140002920
nop
lea rcx, [rbp + 0x5c8]
call fcn.140002920
nop
lea rcx, [rbp + 0x548]
call fcn.140002920
nop
mov rax, qword [rbp + 0x420]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x430], 1
jne 0x140004394
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x420]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_char____ptr64____ptr64]
movzx edx, byte [rbp + 0x530]
lea rcx, [rbp + 0x548]
call fcn.1400063e0
inc ebx
cmp ebx, 1
jne 0x14000422a
lea rcx, [rbp + 0x668]
jmp 0x14000436f
cmp ebx, 2
jne 0x14000423b
lea rcx, [rbp + 0x7a8]
jmp 0x14000436f
cmp ebx, 3
jne 0x14000424c
lea rcx, [rbp + 0x7c8]
jmp 0x14000436f
cmp ebx, 4
jne 0x14000425d
lea rcx, [rbp + 0x7e8]
jmp 0x14000436f
cmp ebx, 5
jne 0x14000426e
lea rcx, [rbp + 0x808]
jmp 0x14000436f
cmp ebx, 6
jne 0x14000427f
lea rcx, [rbp + 0x828]
jmp 0x14000436f
cmp ebx, 7
jne 0x140004290
lea rcx, [rbp + 0x848]
jmp 0x14000436f
cmp ebx, 8
jne 0x1400042a1
lea rcx, [rbp + 0x868]
jmp 0x14000436f
cmp ebx, 9
jne 0x1400042b2
lea rcx, [rbp + 0x5e8]
jmp 0x14000436f
cmp ebx, 0xa
jne 0x1400042c3
lea rcx, [rbp + 0x608]
jmp 0x14000436f
cmp ebx, 0xb
jne 0x1400042d4
lea rcx, [rbp + 0x628]
jmp 0x14000436f
cmp ebx, 0xc
jne 0x1400042e5
lea rcx, [rbp + 0x648]
jmp 0x14000436f
cmp ebx, 0xd
jne 0x1400042f3
lea rcx, [rbp + 0x688]
jmp 0x14000436f
cmp ebx, 0xe
jne 0x140004301
lea rcx, [rbp + 0x6a8]
jmp 0x14000436f
cmp ebx, 0xf
jne 0x14000430f
lea rcx, [rbp + 0x6c8]
jmp 0x14000436f
cmp ebx, 0x10
jne 0x14000431d
lea rcx, [rbp + 0x6e8]
jmp 0x14000436f
cmp ebx, 0x11
jne 0x14000432b
lea rcx, [rbp + 0x708]
jmp 0x14000436f
cmp ebx, 0x12
jne 0x140004339
lea rcx, [rbp + 0x728]
jmp 0x14000436f
cmp ebx, 0x13
jne 0x140004347
lea rcx, [rbp + 0x748]
jmp 0x14000436f
cmp ebx, 0x14
jne 0x140004355
lea rcx, [rbp + 0x768]
jmp 0x14000436f
cmp ebx, 0x15
jne 0x140004363
lea rcx, [rbp + 0x788]
jmp 0x14000436f
cmp ebx, 0x16
jne 0x14000437b
lea rcx, [rbp + 0x5c8]
lea rdx, [rbp + 0x548]
call fcn.140006480
mov rax, qword [rbp + 0x420]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x430], 1
je 0x1400041f0
lea r13, [fcn.1400028c0]
mov qword [rsp + 0x20], r13
lea r9, [fcn.140002920]
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1b20]
call fcn.140008aa8
nop
mov qword [rsp + 0x20], r13
lea r9, [fcn.140002920]
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.140008aa8
nop
lea rdx, str.files2_a0b.php
lea rcx, [rbp + 0x1720]
call fcn.140006400
lea rdx, str.files2_a1b.php
lea rcx, [rbp + 0x1740]
call fcn.140006400
lea rdx, str.files2_a2b.php
lea rcx, [rbp + 0x1760]
call fcn.140006400
lea rdx, str.files2_a3b.php
lea rcx, [rbp + 0x1780]
call fcn.140006400
lea rdx, str.files2_a4b.php
lea rcx, [rbp + 0x17a0]
call fcn.140006400
lea rdx, str.files2_a5b.php
lea rcx, [rbp + 0x17c0]
call fcn.140006400
lea rdx, str.files2_a6b.php
lea rcx, [rbp + 0x17e0]
call fcn.140006400
lea rdx, str.files2_a7b.php
lea rcx, [rbp + 0x1800]
call fcn.140006400
lea rdx, str.files2_a8b.php
lea rcx, [rbp + 0x1820]
call fcn.140006400
lea rdx, str.files2_a9b.php
lea rcx, [rbp + 0x1840]
call fcn.140006400
lea rdx, str.files2_a10b.php
lea rcx, [rbp + 0x1860]
call fcn.140006400
lea rdx, str.files2_a11b.php
lea rcx, [rbp + 0x1880]
call fcn.140006400
lea rdx, str.files2_a12b.php
lea rcx, [rbp + 0x18a0]
call fcn.140006400
lea rdx, str.files2_a13b.php
lea rcx, [rbp + 0x18c0]
call fcn.140006400
lea rdx, str.files2_a14b.php
lea rcx, [rbp + 0x18e0]
call fcn.140006400
lea rdx, str.files2_a15b.php
lea rcx, [rbp + 0x1900]
call fcn.140006400
lea rdx, str.files2_a16b.php
lea rcx, [rbp + 0x1920]
call fcn.140006400
lea rdx, str.files2_a17b.php
lea rcx, [rbp + 0x1940]
call fcn.140006400
lea rdx, str.files2_a18b.php
lea rcx, [rbp + 0x1960]
call fcn.140006400
lea rdx, str.files2_a19b.php
lea rcx, [rbp + 0x1980]
call fcn.140006400
lea rdx, str.files2_a20b.php
lea rcx, [rbp + 0x19a0]
call fcn.140006400
lea rdx, str.files2_a21b.php
lea rcx, [rbp + 0x19c0]
call fcn.140006400
lea rdx, str.files2_a22b.php
lea rcx, [rbp + 0x19e0]
call fcn.140006400
lea rdx, str.files2_a23b.php
lea rcx, [rbp + 0x1a00]
call fcn.140006400
lea rdx, str.files2_a24b.php
lea rcx, [rbp + 0x1a20]
call fcn.140006400
lea rdx, str.files2_a25b.php
lea rcx, [rbp + 0x1a40]
call fcn.140006400
lea rdx, str.files2_a26b.php
lea rcx, [rbp + 0x1a60]
call fcn.140006400
lea rdx, str.files2_a27b.php
lea rcx, [rbp + 0x1a80]
call fcn.140006400
lea rdx, str.files2_a28b.php
lea rcx, [rbp + 0x1aa0]
call fcn.140006400
lea rdx, str.files2_a29b.php
lea rcx, [rbp + 0x1ac0]
call fcn.140006400
lea rdx, str.files2_a30b.php
lea rcx, [rbp + 0x1ae0]
call fcn.140006400
lea rdx, str.files2_a31b.php
lea rcx, [rbp + 0x1b00]
call fcn.140006400
mov r12d, r15d
lea rdx, str.Dang_Check_KEY______
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov r14d, r15d
movzx ebx, byte [rbp + 0x530]
nop dword [rax]
lea rax, [rbp - 0x60]
mov qword [rbp + 0x1c0], rax
lea rax, [rbp + 0x568]
mov qword [rsp + 0x38], rax
movsxd rsi, r14d
shl rsi, 5
lea rdx, [rbp + 0x1720]
add rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1400066c0
mov rdi, rax
movzx edx, bl
lea rcx, [rbp + 0x568]
call fcn.140002e50
nop
mov r8d, 0x20
lea rdx, str.quyengabonchea.000webhostapp.com
lea rcx, [rbp + 0x568]
call fcn.140007180
nop
mov r9, rdi
lea r8, [rbp + 0x568]
lea rdx, [rbp - 0x40]
mov rcx, qword [0x140010a10]
call fcn.1400077d0
lea rcx, [rbp + 0x1b20]
add rsi, rcx
mov rdx, rax
mov rcx, rsi
call fcn.140006510
lea rcx, [rbp - 0x40]
call fcn.1400028c0
lea r8, [rbp + 0x7a8]
lea rdx, [rbp + 0x668]
lea rcx, [rsp + 0x40]
call fcn.140006e20
nop
mov edi, dword [rbp + 0x538]
or edi, 1
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x7c8]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006db0
nop
or edi, 2
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x7e8]
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140006db0
nop
or edi, 4
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x808]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140006db0
nop
or edi, 8
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x828]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140006db0
nop
or edi, 0x10
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x848]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140006db0
nop
or edi, 0x20
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x868]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140006db0
nop
or edi, 0x40
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x5e8]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140006db0
nop
bts edi, 7
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x608]
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140006db0
nop
bts edi, 8
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140006db0
nop
bts edi, 9
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x648]
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.140006db0
nop
bts edi, 0xa
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x688]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140006db0
nop
bts edi, 0xb
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x6a8]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140006db0
nop
bts edi, 0xc
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x6c8]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006db0
nop
bts edi, 0xd
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x6e8]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140006db0
nop
bts edi, 0xe
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x708]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140006db0
nop
bts edi, 0xf
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x728]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140006db0
nop
bts edi, 0x10
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x748]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140006db0
nop
bts edi, 0x11
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x768]
mov rdx, rax
lea rcx, [rbp]
call fcn.140006db0
nop
bts edi, 0x12
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x788]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140006db0
nop
bts edi, 0x13
mov dword [rbp + 0x1c0], edi
lea r8, [rbp + 0x5c8]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006db0
bts edi, 0x14
mov dword [rbp + 0x538], edi
mov rdx, rax
mov rcx, rsi
call fcn.140007590
test al, al
jne 0x1400049b8
lea rdx, str.quyenga2
mov rcx, rsi
call fcn.140007550
test al, al
jne 0x1400049b8
xor sil, sil
jmp 0x1400049bb
mov sil, 1
bt edi, 0x14
jae 0x1400049d5
btr edi, 0x14
mov dword [rbp + 0x538], edi
lea rcx, [rbp - 0x60]
call fcn.1400028c0
nop
bt edi, 0x13
jae 0x1400049ef
btr edi, 0x13
mov dword [rbp + 0x538], edi
lea rcx, [rbp - 0x40]
call fcn.1400028c0
nop
bt edi, 0x12
jae 0x140004a09
btr edi, 0x12
mov dword [rbp + 0x538], edi
lea rcx, [rbp]
call fcn.1400028c0
nop
bt edi, 0x11
jae 0x140004a23
btr edi, 0x11
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x40]
call fcn.1400028c0
nop
bt edi, 0x10
jae 0x140004a3d
btr edi, 0x10
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x60]
call fcn.1400028c0
nop
bt edi, 0xf
jae 0x140004a5a
btr edi, 0xf
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x80]
call fcn.1400028c0
nop
bt edi, 0xe
jae 0x140004a77
btr edi, 0xe
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0xa0]
call fcn.1400028c0
nop
bt edi, 0xd
jae 0x140004a91
btr edi, 0xd
mov dword [rbp + 0x538], edi
lea rcx, [rbp - 0x20]
call fcn.1400028c0
nop
bt edi, 0xc
jae 0x140004aab
btr edi, 0xc
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x20]
call fcn.1400028c0
nop
bt edi, 0xb
jae 0x140004ac6
btr edi, 0xb
mov dword [rbp + 0x538], edi
lea rcx, [rsp + 0x60]
call fcn.1400028c0
nop
bt edi, 0xa
jae 0x140004ae3
btr edi, 0xa
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
bt edi, 9
jae 0x140004b00
btr edi, 9
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x1a0]
call fcn.1400028c0
nop
bt edi, 8
jae 0x140004b1d
btr edi, 8
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x180]
call fcn.1400028c0
nop
test dil, dil
jns 0x140004b39
btr edi, 7
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x160]
call fcn.1400028c0
nop
test dil, 0x40
je 0x140004b55
and edi, 0xffffffbf
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x140]
call fcn.1400028c0
nop
test dil, 0x20
je 0x140004b71
and edi, 0xffffffdf
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0xc0]
call fcn.1400028c0
nop
test dil, 0x10
je 0x140004b8d
and edi, 0xffffffef
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x120]
call fcn.1400028c0
nop
test dil, 8
je 0x140004ba9
and edi, 0xfffffff7
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0x100]
call fcn.1400028c0
nop
test dil, 4
je 0x140004bc5
and edi, 0xfffffffb
mov dword [rbp + 0x538], edi
lea rcx, [rbp + 0xe0]
call fcn.1400028c0
nop
test dil, 2
je 0x140004bde
and edi, 0xfffffffd
mov dword [rbp + 0x538], edi
lea rcx, [rbp - 0x80]
call fcn.1400028c0
nop
test dil, 1
je 0x140004bf7
and edi, 0xfffffffe
mov dword [rbp + 0x538], edi
lea rcx, [rsp + 0x40]
call fcn.1400028c0
test sil, sil
jne 0x140004c0b
inc r14d
cmp r14d, 0x1e
jle 0x140004660
jmp 0x140004c11
mov r12d, 1
lea r8, [rbp + 0x7a8]
lea rdx, [rbp + 0x668]
lea rcx, [rbp + 0x568]
call fcn.140006e20
nop
lea r8, [rbp + 0x7c8]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140006db0
nop
lea r8, [rbp + 0x7e8]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140006db0
nop
lea r8, [rbp + 0x808]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006db0
nop
lea r8, [rbp + 0x828]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140006db0
nop
lea r8, [rbp + 0x848]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140006db0
nop
lea r8, [rbp + 0x868]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140006db0
nop
lea r8, [rbp + 0x5e8]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140006db0
nop
lea r8, [rbp + 0x608]
mov rdx, rax
lea rcx, [rbp]
call fcn.140006db0
nop
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140006db0
nop
lea r8, [rbp + 0x648]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006db0
nop
lea r8, [rbp + 0x688]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140006db0
nop
lea r8, [rbp + 0x6a8]
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140006db0
nop
lea r8, [rbp + 0x6c8]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140006db0
nop
lea r8, [rbp + 0x6e8]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140006db0
nop
lea r8, [rbp + 0x708]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140006db0
nop
lea r8, [rbp + 0x728]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140006db0
nop
lea r8, [rbp + 0x748]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140006db0
nop
lea r8, [rbp + 0x768]
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140006db0
nop
lea r8, [rbp + 0x788]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006db0
nop
lea r8, [rbp + 0x5c8]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140006db0
mov rsi, rax
lea rdx, str.KEY_:_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006a50
mov rdi, rax
mov rbx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.140002d30
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400075e0
nop
lea rcx, [rsp + 0x40]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x80]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x100]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x120]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x140]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x160]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x180]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x60]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x40]
call fcn.1400028c0
nop
lea rcx, [rbp]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x40]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x60]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x80]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa0]
call fcn.1400028c0
nop
lea rcx, [rbp - 0x20]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x20]
call fcn.1400028c0
nop
lea rcx, [rsp + 0x60]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
test r12d, r12d
jne 0x14000536f
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.https:__discord.com_invite_jjQ2KApzp3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx edx, byte [rbp + 0x530]
lea rcx, [rbp + 0x568]
call fcn.140002e50
lea rcx, [rbp + 0x568]
call fcn.140002d10
nop
lea rdx, [rbp + 0x568]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140006fa0
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
mov edx, 0x20
mov r9, r13
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.1400089d8
nop
mov edx, 0x20
mov r8d, edx
mov r9, r13
lea rcx, [rbp + 0x1b20]
call fcn.1400089d8
nop
lea rcx, [rbp + 0x548]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x788]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x768]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x748]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x728]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x708]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x688]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x648]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x628]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x608]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x868]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x848]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x828]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x808]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x668]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x4d0]
call fcn.1400026f0
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xd78]
call fcn.1400061e0
lea rcx, [rbp + 0xd78]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe88]
call fcn.1400061e0
lea rcx, [rbp + 0xe88]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x5a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xaa8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xac8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xae8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xba8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x3c0]
call fcn.1400026f0
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xf98]
call fcn.1400061e0
lea rcx, [rbp + 0xf98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x588]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbc8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbe8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x888]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x908]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x928]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x948]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x968]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x988]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400026f0
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xa68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa28]
call fcn.1400028c0
xor eax, eax
mov rcx, qword [rbp + 0x1f60]
xor rcx, rsp
call fcn.140008940
lea r11, [rsp + 0x2080]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r12d, 1
jne 0x140004f6e
lea rcx, [0x14000be38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140006c20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx edx, byte [rbp + 0x530]
lea rcx, [rbp + 0x568]
call fcn.140002e50
nop
lea r8d, [r12 + 7]
lea rdx, str.hyxd.exe
lea rcx, [rbp + 0x568]
call fcn.140007180
nop
lea rdx, [rbp + 0x568]
lea rcx, [rsp + 0x40]
call fcn.1400066c0
mov rcx, rax
call fcn.140003260
mov dword [rbp + 0x1c0], eax
movsd xmm0, qword [str.hyxd.exe]
movsd qword [rbp + 0x1f20], xmm0
movzx eax, byte [0x14000be48]
mov byte [rbp + 0x1f28], al
lea rdx, str.VN_Rules_of_Survival
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x1c0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [rbp + 0x1c0]
lea rcx, [rbp + 0x1f20]
call fcn.140003450
mov rcx, qword [0x140010a10]
call fcn.140008580
mov rcx, qword [0x140010a10]
call fcn.140008640
lea rcx, [0x14000be38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x538], 1
lea rdx, [rbp + 0x538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov rcx, qword [0x140010a10]
call fcn.140008640
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r14d, [r12 + 1]
mov dword [rbp + 0x538], 0x20002
mov edx, dword [rbp + 0x538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rdx, [0x140002ff0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Dang_Tai_Hack_Amibot
call fcn.140006a50
mov r8d, r14d
mov edx, r14d
mov rcx, qword [0x140010a10]
call fcn.140008690
lea rdx, [0x140002ff0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_1:_May_Cau_Hinh_Manh__Ve_Xuong__Line
call fcn.140006a50
lea r8d, [r12 + 2]
mov edx, r14d
mov rcx, qword [0x140010a10]
call fcn.140008690
lea rdx, [0x140002ff0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_2:_May_Cau_Hinh_Yeu___Ve_Khung_2D
call fcn.140006a50
lea r8d, [r12 + 3]
mov edx, r14d
mov rcx, qword [0x140010a10]
call fcn.140008690
lea rdx, [0x140002ff0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Bam_So_3:_May_Cau_Hinh_Manh_Quyen_Ngao
call fcn.140006a50
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
sub eax, 0x31
je 0x140005d93
sub eax, r12d
je 0x1400055e4
cmp eax, r12d
je 0x140005c48
lea rcx, [rbp + 0x568]
call fcn.1400028c0
jmp 0x140004f6e
lea rcx, [0x14000be38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, str.c:__GoogleChrome3.dll
lea rcx, [rsp + 0x40]
call fcn.1400065a0
mov rbx, rax
lea rdx, str.https:__quyenga.000webhostapp.com_files_aGoogleChrome3.dll
lea rcx, [rbp - 0x80]
call fcn.1400065a0
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x140010a10]
call fcn.1400083f0
test al, al
je 0x140005d6e
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1004]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1000], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140005a20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateToolhelp32Snapshot_failed:_0x_X_n
mov edx, eax
call fcn.140001050
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x568]
call fcn.1400028c0
nop
mov r9, r13
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1720]
call fcn.1400089d8
nop
mov r9, r13
mov edx, 0x20
mov r8d, edx
lea rcx, [rbp + 0x1b20]
call fcn.1400089d8
nop
lea rcx, [rbp + 0x548]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x788]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x768]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x748]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x728]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x708]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x6a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x688]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x648]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x628]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x608]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x5e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x868]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x848]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x828]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x808]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x7a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x668]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x420]
call fcn.140001780
nop
lea rcx, [rbp + 0xcd0]
call fcn.1400060d0
nop
lea rcx, [rbp + 0xde0]
call fcn.1400060d0
nop
lea rcx, [rbp + 0x5a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xaa8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xac8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xae8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xb88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xba8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x310]
call fcn.140001780
nop
lea rcx, [rbp + 0xef0]
call fcn.1400060d0
nop
lea rcx, [rbp + 0x588]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbc8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xbe8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc28]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc48]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xc88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xca8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x888]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x8e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x908]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x928]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x948]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x968]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x988]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9a8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9c8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x9e8]
call fcn.1400028c0
nop
lea rcx, [rbp + 0x200]
call fcn.140001780
nop
lea rcx, [rbp + 0xa68]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa88]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa08]
call fcn.1400028c0
nop
lea rcx, [rbp + 0xa28]
call fcn.1400028c0
jmp 0x140005338
mov esi, r15d
lea rdx, [rbp + 0x1000]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005a83
lea rbx, [0x14000b968]
nop
mov rax, rbx
lea r8, [rbp + 0x102c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005a63
inc rax
test ecx, ecx
jne 0x140005a50
test edx, edx
je 0x140005a7d
lea rdx, [rbp + 0x1000]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005a40
jmp 0x140005a83
mov esi, dword [rbp + 0x1008]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140005ab6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenProcess_failed:_0x_X_n
jmp 0x14000567d
mov rcx, rbx
call fcn.1400031d0
test al, al
jne 0x140005adc
lea rcx, str.Invalid_target_process._n
call fcn.140001050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005684
lea rdx, str.GoogleChrome3.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
jne 0x140005b09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Something_went_wrong_FeelsBadMan_n
call fcn.140001050
jmp 0x140005684
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, str.c:__GoogleChrome2.dll
lea rcx, [rsp + 0x40]
call fcn.1400065a0
mov rbx, rax
lea rdx, str.https:__quyenga.000webhostapp.com_files_aGoogleChrome2.dll
lea rcx, [rbp - 0x80]
call fcn.1400065a0
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [0x140010a10]
call fcn.1400083f0
test al, al
je 0x140005c48
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1134]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1130], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
mov esi, r15d
lea rdx, [rbp + 0x1130]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005bf3
lea rbx, [0x14000b990]
nop dword [rax]
mov rax, rbx
lea r8, [rbp + 0x115c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005bd3
inc rax
test ecx, ecx
jne 0x140005bc0
test edx, edx
je 0x140005bed
lea rdx, [rbp + 0x1130]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005bb0
jmp 0x140005bf3
mov esi, dword [rbp + 0x1138]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005aa4
mov rcx, rax
call fcn.1400031d0
test al, al
je 0x140005ac2
lea rdx, str.GoogleChrome2.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000be38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1264]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1260], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
lea rdx, [rbp + 0x1260]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005cf4
lea rdi, str.SolarlandClient_Win64_Shipping.exe
nop word [rax + rax]
mov rax, rdi
lea r8, [rbp + 0x128c]
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005cd3
inc rax
test ecx, ecx
jne 0x140005cc0
test edx, edx
je 0x140005ced
lea rdx, [rbp + 0x1260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005cb0
jmp 0x140005cf4
mov r15d, dword [rbp + 0x1268]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005aa4
mov rcx, rax
call fcn.1400031d0
test al, al
je 0x140005ac2
lea rdx, str.GoogleChrome4.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, [0x14000b9c8]
lea rdx, str.hack_done___in_game
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
lea r8, str.discord
lea rdx, [0x14000bfa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14000be38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x1394]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1390], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
mov esi, r15d
lea rdx, [rbp + 0x1390]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005e43
lea rbx, [0x14000b968]
nop dword [rax]
nop dword [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x13bc]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005e23
inc rax
test ecx, ecx
jne 0x140005e10
test edx, edx
je 0x140005e3d
lea rdx, [rbp + 0x1390]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005e00
jmp 0x140005e43
mov esi, dword [rbp + 0x1398]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005aa4
mov rcx, rax
call fcn.1400031d0
test al, al
je 0x140005ac2
lea rdx, str.GoogleChrome1.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x14c4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x14c0], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
mov esi, r15d
lea rdx, [rbp + 0x14c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rbx, [0x14000b990]
test eax, eax
je 0x140005f43
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x14ec]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005f23
inc rax
test ecx, ecx
jne 0x140005f10
test edx, edx
je 0x140005f3d
lea rdx, [rbp + 0x14c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005f00
jmp 0x140005f43
mov esi, dword [rbp + 0x14c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140005aa4
mov rcx, rax
call fcn.1400031d0
test al, al
jne 0x140005f8e
lea rcx, str.Invalid_target_process._n
call fcn.140001050
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005684
lea rdx, str.GoogleChrome.dll
mov rcx, rdi
call fcn.140001330
mov rcx, rdi
test al, al
je 0x140005af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x15f4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x15f0], 0x130
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005670
lea rdx, [rbp + 0x15f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140006054
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
lea r8, [rbp + 0x161c]
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006033
inc rax
test ecx, ecx
jne 0x140006020
test edx, edx
je 0x14000604d
lea rdx, [rbp + 0x15f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140006010
jmp 0x140006054
mov r15d, dword [rbp + 0x15f8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005aa4
mov rcx, rax
call fcn.1400031d0
test al, al
je 0x140005ac2
lea rdx, str.GoogleChrome2.dll
mov rcx, rbx
call fcn.140001330
mov rcx, rbx
test al, al
je 0x140005af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, str.discord
lea rdx, [0x14000bfa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3