Function at 0x401d20
Capabilities:
Execute command
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
call fcn.0040831d
mov ecx, 0xc8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401d73
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.00406f36
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rcx, str.color_6
call sub.msvcrt.dll_system
call fcn.004028c5
test eax, eax
sete al
test al, al
je 0x401dca
mov r9d, 0x41010
lea r8, str.BYPASS..........
lea rdx, str.Run_the_Bypass_as_Administrator
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str.msedgewebview2.exe
call fcn.00406ba2
call fcn.00407bc8
call fcn.004039a1
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401e0f
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdx, str.Initializing_Bypass....._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.wait.........._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.00406db4
call fcn.00405735
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401e7c
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.00402ea5
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.a.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
je 0x401f21
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401ee5
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.Vip_mode_detected................._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x4b0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.00402c91
mov ebx, 0
jmp 0x401fde
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
call fcn.00402b22
test eax, eax
sete al
test al, al
je 0x401faa
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401f6a
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.00406e21
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401f9e
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
mov eax, dword [0x004bb030]
cmp eax, 5
je 0x401fd9
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x401ff1
jmp 0x40200f
nop
jmp 0x40200f
add rsp, 0x208
pop rbx
pop rbp
ret