Function at 0x10033ce0
Capabilities:
Check for foreground window switch
Contain obfuscated stackstrings
Create thread
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091256
mov eax, dword fs:[0]
push eax
sub esp, 0x6ac
mov eax, dword [0x100ab3c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c4], edi
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10035051
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
cmp edi, eax
jne 0x10035051
push 0x100
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
call esi
xorps xmm0, xmm0
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x218], 0
movups xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x214], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10033d76
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.10032340
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
push 0x79
push str.https:__discord.com_api_webhooks_1220819227880194099_JITDHHZut7tilBEyjy_BLMf_nS73RN2aZ8UyRbsgFfx5_rBmg86z5ZXKmzLyHlwTgBC7
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call fcn.10032340
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x278]
push 0x2b
xorps xmm0, xmm0
mov dword [ebp - 0x268], 0
push str.https:__i.postimg.cc_SKf5JC6k_boxso_sec.gif
movups xmmword [ebp - 0x278], xmm0
mov dword [ebp - 0x264], 0
call fcn.10032340
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6b8]
xorps xmm0, xmm0
mov dword [ebp - 0x6a8], 0
push 5
push str.bossb
movlpd qword [ebp - 0x230], xmm0
movups xmmword [ebp - 0x6b8], xmm0
mov dword [ebp - 0x6a4], 0
call fcn.10032340
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6a0]
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0x690], 0
push str._Trying_to_open_Bossb_Engine_
movups xmmword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x68c], 0
call fcn.10032340
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x688]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x678], 0
push str.Crossfire
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x674], 0
call fcn.10032340
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x670]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x660], 0
push str._Trying_to_open_Crossfire_Engine_
movups xmmword [ebp - 0x670], xmm0
mov dword [ebp - 0x65c], 0
call fcn.10032340
mov byte [ebp - 4], 7
xorps xmm0, xmm0
push 6
movups xmmword [ebp - 0x658], xmm0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
push str.Memory
lea ecx, [ebp - 0x658]
call fcn.10032340
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x640]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x630], 0
push str._Trying_to_open_Memory_
movups xmmword [ebp - 0x640], xmm0
mov dword [ebp - 0x62c], 0
call fcn.10032340
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x628]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x618], 0
push 0x100a5b6c
movups xmmword [ebp - 0x628], xmm0
mov dword [ebp - 0x614], 0
call fcn.10032340
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x610]
push 0x23
xorps xmm0, xmm0
mov dword [ebp - 0x600], 0
push str._Trying_to_open_Google_Thai_Engine_
movups xmmword [ebp - 0x610], xmm0
mov dword [ebp - 0x5fc], 0
call fcn.10032340
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5f8]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x5e8], 0
push str.DBG_DBG_DBG_DBG_DBG
movups xmmword [ebp - 0x5f8], xmm0
mov dword [ebp - 0x5e4], 0
call fcn.10032340
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x5e0]
push 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x5d0], 0
push str._Trying_to_open_Debug_
movups xmmword [ebp - 0x5e0], xmm0
mov dword [ebp - 0x5cc], 0
call fcn.10032340
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5c8]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x5b8], 0
push str.following_opcodes
movups xmmword [ebp - 0x5c8], xmm0
mov dword [ebp - 0x5b4], 0
call fcn.10032340
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5b0]
push 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x5a0], 0
push str._Trying_to_open_Debug_
movups xmmword [ebp - 0x5b0], xmm0
mov dword [ebp - 0x59c], 0
call fcn.10032340
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x598]
xorps xmm0, xmm0
mov dword [ebp - 0x588], 0
push 7
movups xmmword [ebp - 0x598], xmm0
mov dword [ebp - 0x584], 0
push str.Process
call fcn.10032340
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x580]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x570], 0
push str._Trying_to_open_Process_
movups xmmword [ebp - 0x580], xmm0
mov dword [ebp - 0x56c], 0
call fcn.10032340
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x568]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x558], 0
push str.Cheat
movups xmmword [ebp - 0x568], xmm0
mov dword [ebp - 0x554], 0
call fcn.10032340
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x550]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x540], 0
push str._Trying_to_open_Setting_
movups xmmword [ebp - 0x550], xmm0
mov dword [ebp - 0x53c], 0
call fcn.10032340
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x538]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x528], 0
push str.rakol
movups xmmword [ebp - 0x538], xmm0
mov dword [ebp - 0x524], 0
call fcn.10032340
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x520]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x510], 0
push str._Trying_to_open_Dimirakol_Engine_
movups xmmword [ebp - 0x520], xmm0
mov dword [ebp - 0x50c], 0
call fcn.10032340
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x508]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x4f8], 0
push str.address
movups xmmword [ebp - 0x508], xmm0
mov dword [ebp - 0x4f4], 0
call fcn.10032340
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4f0]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x4e0], 0
push str._Trying_to_Add_Address_
movups xmmword [ebp - 0x4f0], xmm0
mov dword [ebp - 0x4dc], 0
call fcn.10032340
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x4d8]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x4c8], 0
push str.assemb
movups xmmword [ebp - 0x4d8], xmm0
mov dword [ebp - 0x4c4], 0
call fcn.10032340
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x4c0]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x4b0], 0
push str._Trying_To_Make_Script_
movups xmmword [ebp - 0x4c0], xmm0
mov dword [ebp - 0x4ac], 0
call fcn.10032340
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x4a8]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x498], 0
push str.Assembly
movups xmmword [ebp - 0x4a8], xmm0
mov dword [ebp - 0x494], 0
call fcn.10032340
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x490]
push 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x480], 0
push str._Trying_To_Find_Cheat_
movups xmmword [ebp - 0x490], xmm0
mov dword [ebp - 0x47c], 0
call fcn.10032340
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x478]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x468], 0
push str.Break_and_Trace
movups xmmword [ebp - 0x478], xmm0
mov dword [ebp - 0x464], 0
call fcn.10032340
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x460]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x450], 0
push str._Trying_To_Trace_Cheat_
movups xmmword [ebp - 0x460], xmm0
mov dword [ebp - 0x44c], 0
call fcn.10032340
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x448]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x438], 0
push str.Pointer_scan
movups xmmword [ebp - 0x448], xmm0
mov dword [ebp - 0x434], 0
call fcn.10032340
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x430]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x420], 0
push str._Trying_To_Open_Pointer_
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x41c], 0
call fcn.10032340
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x418]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x408], 0
push str.Code_inject
movups xmmword [ebp - 0x418], xmm0
mov dword [ebp - 0x404], 0
call fcn.10032340
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x400]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x3f0], 0
push str._Trying_To_Inject_Code_
movups xmmword [ebp - 0x400], xmm0
mov dword [ebp - 0x3ec], 0
call fcn.10032340
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x3e8]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x3d8], 0
push str.ENGINE
movups xmmword [ebp - 0x3e8], xmm0
mov dword [ebp - 0x3d4], 0
call fcn.10032340
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x3d0]
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0x3c0], 0
push str._Trying_To_open_CHEAT_engine_
movups xmmword [ebp - 0x3d0], xmm0
mov dword [ebp - 0x3bc], 0
call fcn.10032340
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x3b8]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x3a8], 0
push str.Change_Value
movups xmmword [ebp - 0x3b8], xmm0
mov dword [ebp - 0x3a4], 0
call fcn.10032340
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x3a0]
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x390], 0
push str._Trying_to_Click_Value_
movups xmmword [ebp - 0x3a0], xmm0
mov dword [ebp - 0x38c], 0
call fcn.10032340
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x388]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x378], 0
push str.Change_address
movups xmmword [ebp - 0x388], xmm0
mov dword [ebp - 0x374], 0
call fcn.10032340
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x370]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x360], 0
push str._Trying_to_Click_Address_
movups xmmword [ebp - 0x370], xmm0
mov dword [ebp - 0x35c], 0
call fcn.10032340
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x358]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x348], 0
push str.hotkey
movups xmmword [ebp - 0x358], xmm0
mov dword [ebp - 0x344], 0
call fcn.10032340
mov byte [ebp - 4], 0x28
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
push str._Trying_to_Make_Hotkey_
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x32c], 0
movups xmmword [ebp - 0x340], xmm0
call fcn.10032340
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x328]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x318], 0
push str.llocate
movups xmmword [ebp - 0x328], xmm0
mov dword [ebp - 0x314], 0
call fcn.10032340
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x310]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x300], 0
push str._Trying_to_Locate_Memory_
movups xmmword [ebp - 0x310], xmm0
mov dword [ebp - 0x2fc], 0
call fcn.10032340
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x2f8]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x2e8], 0
push str.ayabu
movups xmmword [ebp - 0x2f8], xmm0
mov dword [ebp - 0x2e4], 0
call fcn.10032340
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x2e0]
push 0x20
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
push str._Trying_to_Open_Hayabusa_Engine_
movups xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x2cc], 0
call fcn.10032340
mov byte [ebp - 4], 0x2d
lea esi, [ebp - 0x6b8]
push 0x40
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
call fcn.1008f655
mov edi, eax
add esp, 4
mov dword [edi], edi
mov dword [edi + 4], edi
mov dword [edi + 8], edi
mov word [edi + 0xc], 0x101
mov dword [ebp - 0x230], edi
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 0x2e
cmp esi, eax
je 0x1003471a
nop
push esi
push edi
lea ecx, [ebp - 0x230]
call fcn.10038fa0
add esi, 0x30
lea eax, [ebp - 0x2c8]
cmp esi, eax
jne 0x10034700
push fcn.100350b0
push 0x15
push 0x30
lea eax, [ebp - 0x6b8]
mov byte [ebp - 4], 0x30
push eax
call fcn.1008f6ad
mov eax, dword [ebp - 0x230]
mov eax, dword [eax]
mov dword [ebp - 0x2bc], eax
cmp byte [eax + 0xd], 0
jne 0x100347a0
mov edi, dword [ebp - 0x218]
nop dword [eax]
cmp dword [eax + 0x24], 0xf
lea esi, [eax + 0x10]
mov eax, esi
jbe 0x1003475d
mov eax, dword [esi]
push dword [esi + 0x10]
cmp dword [ebp - 0x214], 0xf
lea ecx, [ebp - 0x228]
push eax
cmova ecx, dword [ebp - 0x228]
mov edx, edi
push ecx
call fcn.10038bd0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1003484c
lea ecx, [ebp - 0x2bc]
call fcn.100387d0
mov eax, dword [ebp - 0x2bc]
cmp byte [eax + 0xd], 0
je 0x10034750
cmp dword [ebp - 0x214], 0xf
lea ecx, [ebp - 0x228]
mov esi, dword [ebp - 0x218]
mov edx, esi
cmova ecx, dword [ebp - 0x228]
push 5
push str.Error
push ecx
call fcn.10038bd0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10034ab4
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x228]
mov ecx, dword [ebp - 0x228]
cmp eax, 0xf
cmova edx, ecx
mov dword [ebp - 0x2c0], edx
cmp esi, 0xc
jb 0x1003495c
lea eax, [esi - 0xb]
add eax, edx
mov dword [ebp - 0x2bc], eax
sub eax, edx
push eax
push 0x54
push edx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10034950
nop
mov ecx, edi
mov edx, str.Task_Manager
mov esi, 8
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100348e9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10034830
xor eax, eax
jmp 0x10034910
add esi, 0x18
lea eax, [ebp - 0x260]
cmp eax, esi
je 0x100347a0
cmp dword [esi + 0x14], 0xf
mov eax, dword [esi + 0x10]
jbe 0x10034868
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x260]
call fcn.10038830
cmp dword [ebp - 0x250], 0
je 0x100347a0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x278]
push eax
lea edx, [ebp - 0x260]
lea ecx, [ebp - 0x248]
call fcn.10032e10
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
mov esi, 5
nop
push 0
push 0
push 0
push 0x10035070
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10035090
push 0
push 0
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x100348b0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1003490b
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1003490b
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1003490b
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x1003490b
xor eax, eax
jmp 0x10034910
sbb eax, eax
or eax, 1
test eax, eax
je 0x1003493b
mov eax, dword [ebp - 0x2bc]
inc edi
sub eax, edi
push eax
push 0x54
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10034820
mov esi, dword [ebp - 0x218]
jmp 0x10034950
sub edi, dword [ebp - 0x2c0]
mov esi, dword [ebp - 0x218]
cmp edi, 0xffffffff
jne 0x10034ab4
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x228]
cmp eax, 0xf
lea edx, [ebp - 0x228]
cmova edx, ecx
mov dword [ebp - 0x2bc], edx
cmp esi, 0xe
jb 0x10034a2f
lea eax, [edx - 0xd]
add eax, esi
mov dword [ebp - 0x2c0], eax
sub eax, edx
push eax
push 0x43
push edx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10034a29
nop word [eax + eax]
mov ecx, edi
mov edx, str.Command_Prompt
mov esi, 0xa
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100349c1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100349b0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100349e8
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100349e8
cmp esi, 0xfffffffe
je 0x100349e4
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100349e8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x100349e8
xor eax, eax
jmp 0x100349ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034a14
mov eax, dword [ebp - 0x2c0]
inc edi
sub eax, edi
push eax
push 0x43
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100349a0
mov esi, dword [ebp - 0x218]
jmp 0x10034a29
sub edi, dword [ebp - 0x2bc]
mov esi, dword [ebp - 0x218]
cmp edi, 0xffffffff
jne 0x10034ab4
mov eax, dword [ebp - 0x214]
cmp eax, 0xf
lea edi, [ebp - 0x228]
cmova edi, dword [ebp - 0x228]
cmp esi, 3
jb 0x10034da1
lea eax, [edi - 2]
add eax, esi
sub eax, edi
push eax
push 0x4e
push edi
call sub.VCRUNTIME140.dll_memchr
mov edx, eax
add esp, 0xc
test edx, edx
je 0x10034da1
movzx ecx, byte [edx]
cmp cl, 0x4e
jne 0x10034a81
movzx eax, byte [edx + 1]
cmp al, 0x3f
jne 0x10034a81
movzx eax, byte [edx + 2]
cmp al, 0x3f
jne 0x10034a81
xor eax, eax
jmp 0x10034a86
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034aa9
inc edx
lea eax, [edi - 2]
add eax, esi
sub eax, edx
push eax
push 0x4e
push edx
call sub.VCRUNTIME140.dll_memchr
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x10034a65
jmp 0x10034da1
sub edx, edi
cmp edx, 0xffffffff
je 0x10034da1
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x228]
mov edi, dword [ebp - 0x228]
cmp eax, 0xf
cmova ecx, edi
mov dword [ebp - 0x2bc], ecx
cmp esi, 5
jb 0x10034b7e
lea eax, [ecx - 4]
add eax, esi
mov dword [ebp - 0x2c0], eax
sub eax, ecx
push eax
push 0x45
push ecx
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10034b78
nop
mov edx, ecx
mov esi, str.Error
mov edi, 1
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10034b1d
add edx, 4
mov edi, 0xfffffffd
add esi, 4
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10034b44
cmp edi, 0xfffffffd
je 0x10034b40
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10034b44
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10034b44
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
jne 0x10034b44
xor eax, eax
jmp 0x10034b49
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034be5
mov eax, dword [ebp - 0x2c0]
inc ecx
sub eax, ecx
push eax
push 0x45
push ecx
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x10034b00
mov edi, dword [ebp - 0x228]
mov esi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
cmp eax, 0xf
lea ecx, [ebp - 0x228]
cmova ecx, edi
mov dword [ebp - 0x2bc], ecx
cmp esi, 0xc
jb 0x10034c5d
lea eax, [ecx - 0xb]
add eax, esi
mov dword [ebp - 0x2c0], eax
sub eax, ecx
push eax
push 0x54
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10034c57
nop dword [eax]
mov ecx, edi
mov edx, str.Task_Manager
mov esi, 8
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10034c03
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10034bd0
xor eax, eax
jmp 0x10034c2a
sub ecx, dword [ebp - 0x2bc]
cmp ecx, 0xffffffff
je 0x10034b6c
mov eax, str.Error__DETECTED__
mov ecx, 0x11
jmp 0x10034d39
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10034c25
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10034c25
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10034c25
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10034c25
xor eax, eax
jmp 0x10034c2a
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034ce8
mov eax, dword [ebp - 0x2c0]
inc edi
sub eax, edi
push eax
push 0x54
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10034bc0
mov esi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
cmp eax, 0xf
lea ecx, [ebp - 0x228]
cmova ecx, dword [ebp - 0x228]
mov dword [ebp - 0x2bc], ecx
cmp esi, 0xe
jb 0x10034d2f
lea eax, [ecx - 0xd]
add eax, esi
mov dword [ebp - 0x2c0], eax
sub eax, ecx
push eax
push 0x43
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10034d2f
nop
mov edx, edi
mov ecx, str.Command_Prompt
mov esi, 0xa
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10034cc1
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10034cb0
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10034d03
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10034d03
cmp esi, 0xfffffffe
je 0x10034ce4
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10034d03
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x10034d03
xor eax, eax
jmp 0x10034d08
sub edi, dword [ebp - 0x2bc]
cmp edi, 0xffffffff
je 0x10034c51
mov eax, str.Trying_to_open_Task_Manager__DETECTED__
mov ecx, 0x27
jmp 0x10034d39
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034eeb
mov eax, dword [ebp - 0x2c0]
inc edi
sub eax, edi
push eax
push 0x43
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10034ca0
mov eax, str._Trying_to_open_Nat_Engine_
mov ecx, 0x1b
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.10038830
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2c4]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x2bc]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10034da1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x278]
push eax
lea edx, [ebp - 0x260]
lea ecx, [ebp - 0x248]
call fcn.10032e10
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2c8]
test esi, esi
je 0x10034f45
push 0x100
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
mov dword [ebp - 0x290], 0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x28c], 0
movups xmmword [ebp - 0x2a0], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10034df0
sub ecx, edx
lea eax, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x2a0]
call fcn.10032340
mov byte [ebp - 4], 0x31
cmp dword [ebp - 0x290], 0
jne 0x10034f09
lea eax, [ebp - 0x288]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x280]
sub ecx, dword [ebp - 0x288]
cmp ecx, 0x23a
jl 0x10034f09
mov eax, dword [ebp - 0x27c]
sub eax, dword [ebp - 0x284]
cmp eax, 0xfa
jl 0x10034f09
cmp ecx, 0x5dc
jg 0x10034f09
cmp eax, 0x3e8
jg 0x10034f09
push str._Trying_to_open_Thai_Engine_
lea ecx, [ebp - 0x2b8]
call fcn.10032300
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 0x32
push eax
lea eax, [ebp - 0x278]
push eax
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x248]
call fcn.10032e10
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
mov esi, 5
push 0
push 0
push 0
push 0x10035070
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10035090
push 0
push 0
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x10034eb2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub edi, dword [ebp - 0x2bc]
cmp edi, 0xffffffff
je 0x10034d2f
mov eax, str.Trying_to_open_Command_Prompt__DETECTED__
mov ecx, 0x29
jmp 0x10034d39
mov ecx, dword [ebp - 0x28c]
cmp ecx, 0xf
jbe 0x10034f45
mov edx, dword [ebp - 0x2a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10034f3b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10034f3b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1008f24d
add esp, 8
lea ecx, [ebp - 0x230]
call fcn.10037de0
mov ecx, dword [ebp - 0x264]
cmp ecx, 0xf
jbe 0x10034f8a
mov edx, dword [ebp - 0x278]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10034f80
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035041
push ecx
push edx
call fcn.1008f24d
add esp, 8
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe 0x10034fc4
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10034fba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035041
push ecx
push edx
call fcn.1008f24d
add esp, 8
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
cmp ecx, 0xf
jbe 0x10035015
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003500b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035041
push ecx
push edx
call fcn.1008f24d
add esp, 8
mov ecx, dword [ebp - 0x214]
cmp ecx, 0xf
jbe 0x10035051
mov edx, dword [ebp - 0x228]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10035047
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10035047
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1008f24d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008f042
mov esp, ebp
pop ebp
ret