Function at 0x14004fae0
Capabilities:
Create thread
Enumerate gui resources
Enumerate process modules
Get graphical window text
Set console window title

Disassembly:
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1400ab040]
xor rax, rsp
mov qword [rbp + 0x230], rax
lea rcx, str.quyengabon0676
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.14006654c
mov r9, rax
lea r8, [0x14009a080]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x50]
call fcn.140067764
xor ecx, ecx
call fcn.14006654c
mov r9, rax
lea r8, [0x14009a080]
lea rdx, str.CONIN_
lea rcx, [rsp + 0x50]
call fcn.140067764
xorps xmm0, xmm0
lea rdx, str.quyen.dll
xorps xmm1, xmm1
lea rcx, [rbp + 0x1a8]
mov r8d, 9
movups xmmword [rbp + 0x1a8], xmm0
movdqu xmmword [rbp + 0x1b8], xmm1
call fcn.14000e850
xorps xmm0, xmm0
lea rdx, [0x14009a0a8]
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, 0xe
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14000e850
lea rdx, [rbp + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14004f8b0
xorps xmm0, xmm0
lea rdx, str.quyen.dll
xorps xmm1, xmm1
lea rcx, [rbp + 0x1a8]
mov r8d, 9
movups xmmword [rbp + 0x1a8], xmm0
movdqu xmmword [rbp + 0x1b8], xmm1
call fcn.14000e850
xorps xmm0, xmm0
lea rdx, str.companyask.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, 0x10
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14000e850
lea rdx, [rbp + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14004f8b0
lea rcx, str.kdmapper.exe_quyengabon.sys
call fcn.140061ad4
lea rcx, str.color_E
call fcn.140061ad4
lea rcx, [0x14009a0f8]
mov dword [0x1400af714], 9
call fcn.140061ad4
lea rdx, [0x1400996a0]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fc90
mov edx, 2
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str._____Discord:_quyengabon0676
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fd1e
mov edx, 2
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str._n_____Processing
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140095534]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fdac
mov edx, 6
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str._n_____Open_Game_And_Wait_Game_Load
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rdx, [0x1400996a0]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fdf3
mov edx, 7
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str.using_private_bypass_will_be_safe_for_main_account
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fe27
mov edx, 6
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str.Then
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fe5b
mov edx, 1
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str.Open_Hack
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fe8f
mov edx, 6
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, [0x14009554c]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x14004fec3
mov edx, 1
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str.Run_Admin___n
lea rcx, [0x1400ad2f0]
call fcn.14000de50
lea rdx, [0x140099968]
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1400af714], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xor r14d, r14d
lea rax, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rbp + 0x1b8], r14
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1c0], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x14004ff40
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1a8]
call fcn.14000e850
mov qword [rsp + 0x30], r14
call fcn.140050550
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x38], eax
lea rcx, [0x14004f840]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14004ff93
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14004ff93
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x14004ff96
mov rax, r14
mov rdx, qword [rbp + 0x1c0]
mov qword [0x1400af5a0], rax
cmp rdx, 0xf
jbe 0x14004ffe0
mov rcx, qword [rbp + 0x1a8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ffdb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ffdb
call fcn.1400662bc
int3
call fcn.140053960
mov qword [rsp + 0x350], rbx
mov ecx, 0x3e8
mov qword [rsp + 0x358], rsi
mov qword [rsp + 0x360], rdi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400af5a0]
lea rdx, [rbp + 0x1f8]
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call fcn.14006654c
mov rcx, rax
call fcn.14005ecc0
mov edx, dword [0x1400af714]
lea rcx, [0x1400ad2f0]
call fcn.14000bd40
mov rcx, rax
call fcn.14000e100
call fcn.140050550
lea rdx, str.Process_ID:
mov ebx, eax
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov rcx, rax
mov edx, ebx
call fcn.14000bd40
mov rcx, rax
call fcn.14000e100
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140050550
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rdx, str.Process_Handle:
mov qword [0x1400af578], rax
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov rcx, rax
call fcn.140050350
mov rcx, rax
call fcn.14000e100
movzx eax, word [0x1400996c8]
movups xmm0, xmmword [str.SolarlandClient_Win64_Shipping.exe]
mov word [rbp + 0x228], ax
movups xmm1, xmmword [0x1400996b8]
movzx eax, byte [0x1400996ca]
mov byte [rbp + 0x22a], al
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm1
call fcn.140050550
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
call fcn.140050550
mov edx, eax
mov ecx, 8
mov rdi, r14
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
mov rbx, rax
call fcn.140084b40
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x14005017d
nop dword [rax]
lea rdx, [rbp + 0x208]
lea rcx, [rbp - 0x70]
call fcn.140066334
test eax, eax
je 0x140050178
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140050150
jmp 0x14005017d
mov rdi, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rdi + 0x6b1b99c]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, str.YOU_CAN_BUY_MY_BYPASS_IT_SAFE_FOR_MAIN_ACCOUNT
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov rcx, rax
call fcn.14000e100
lea rdx, str.YOU_CAN_BUY_VIP_MAGIC_IT_SAFE_FOR_MAIN_ACCOUNT
lea rcx, [0x1400ad2f0]
call fcn.14000de50
mov rcx, rax
call fcn.14000e100
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x1a0], 0x41200000
mov rdi, qword [rsp + 0x360]
mov rsi, qword [rsp + 0x358]
mov rbx, qword [rsp + 0x350]
jne 0x1400502af
mov qword [rsp + 0x28], r14
lea r8, [0x140013820]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x14000b390]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140013590]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x1400139d0]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400502f0
lea rcx, [0x1400ad2f0]
call fcn.14004f610
test al, al
je 0x1400502d0
mov edx, 2
lea rcx, [0x1400ad2f0]
call fcn.14004f700
lea rdx, str._____Discord:_quyengabon0676
lea rcx, [0x1400ad2f0]
call fcn.14000de50
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x1c8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005032b
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x1d0], 0x12
je 0x140050341
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400502f0
xor ecx, ecx
call fcn.14005aa18
int3