Function at 0x14004f210
Capabilities:
Create thread
Delete file
Encode data using xor
Enumerate processes
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x1400a8398]
xor rax, rsp
mov qword [rbp + 0x680], rax
xor r12d, r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], 9
mov qword [rbp + 0xd8], 0xf
movsd xmm0, qword [str.CloudyWin]
movsd qword [rbp + 0xc0], xmm0
movzx ecx, byte [0x140076cb8]
mov byte [rbp + 0xc8], cl
mov byte [rbp + 0xc9], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], 0xa
mov qword [rbp + 0x118], 0xf
movsd xmm0, qword [str.MQcwmSISNc]
movsd qword [rbp + 0x100], xmm0
movzx eax, word [0x140076cc8]
mov word [rbp + 0x108], ax
mov byte [rbp + 0x10a], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
lea edx, [r12 + 0x50]
lea rcx, [rbp + 0x120]
call fcn.14004b490
mov rsi, rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x130], 0x40
mov qword [rbp + 0x138], 0x4f
movaps xmm0, xmmword [str.ffed9cd8218d319b3e3464a2374c53f96d1a8d62f340a7c838687a08bb3bcb35]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140076ce0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140076cf0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140076d00]
movups xmmword [rax + 0x30], xmm1
mov byte [rax + 0x40], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], 3
mov qword [rbp + 0xf8], 0xf
mov eax, dword [0x140076d14]
mov word [rbp + 0xe0], ax
movzx eax, byte [0x140076d16]
mov byte [rbp + 0xe2], al
mov byte [rbp + 0xe3], r12b
movups xmmword [rbp + 0x140], xmm0
lea edx, [r12 + 0x20]
lea rcx, [rbp + 0x140]
call fcn.14004b490
mov r14, rax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x150], 0x1c
mov qword [rbp + 0x158], 0x1f
movups xmm0, xmmword [str.https:__keyauth.win_api_1.2_]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140076d28]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140076d30]
mov dword [r14 + 0x18], eax
mov byte [r14 + 0x1c], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
lea edx, [r12 + 0x20]
lea rcx, [rbp + 0x160]
call fcn.14004b490
mov r15, rax
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], 0x16
mov qword [rbp + 0x178], 0x1f
movups xmm0, xmmword [str.ssl_pin_key__optional_]
movups xmmword [rax], xmm0
mov eax, dword [0x140076d48]
mov dword [r15 + 0x10], eax
movzx eax, word [0x140076d4c]
mov word [r15 + 0x14], ax
mov byte [r15 + 0x16], r12b
lea rax, [rsp + 0x78]
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
lea edx, [r12 + 0x20]
lea rcx, [rsp + 0x78]
call fcn.14004b490
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], 0x16
mov qword [rbp - 0x70], 0x1f
movups xmm0, xmmword [r15]
movups xmmword [rax], xmm0
mov ecx, dword [r15 + 0x10]
mov dword [rax + 0x10], ecx
movzx ecx, word [r15 + 0x14]
mov word [rax + 0x14], cx
movzx ecx, byte [r15 + 0x16]
mov byte [rax + 0x16], cl
lea rax, [rbp - 0x68]
mov qword [rbp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
lea edx, [r12 + 0x20]
lea rcx, [rbp - 0x68]
call fcn.14004b490
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], 0x1c
mov qword [rbp - 0x50], 0x1f
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
movsd xmm1, qword [r14 + 0x10]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [r14 + 0x18]
mov dword [rax + 0x18], ecx
movzx ecx, byte [r14 + 0x1c]
mov byte [rax + 0x1c], cl
lea rax, [rbp - 0x48]
mov qword [rbp + 0x60], rax
mov qword [rbp - 0x38], 3
mov qword [rbp - 0x30], 0xf
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp - 0x48], xmm0
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
lea edx, [r12 + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.14004b490
mov rcx, rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], 0x40
mov qword [rbp + 0xb8], 0x4f
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rax + 0x30], xmm1
movzx eax, byte [rsi + 0x40]
mov byte [rcx + 0x40], al
lea rax, [rbp - 0x28]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x18], 0xa
mov qword [rbp - 0x10], 0xf
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp - 0x28], xmm0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x70]
call fcn.14003b320
nop
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xa0]
lea r8, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14003b9b0
nop
lea ecx, [r12 + 8]
call fcn.140050a6c
test rax, rax
je 0x14004f62f
lea rcx, [0x14004c510]
mov qword [rax], rcx
jmp 0x14004f632
mov rax, r12
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003ac40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140050120
cmp dword [rsp + 0x68], 0
je 0x140050115
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140050115
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rax + 8]
call fcn.140050a6c
test rax, rax
je 0x14004f6b8
lea rcx, [0x14004d120]
mov qword [rax], rcx
jmp 0x14004f6bb
mov rax, r12
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003ac40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14005018c
cmp dword [rsp + 0x68], 0
je 0x140050181
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140050181
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rax + 8]
call fcn.140050a6c
test rax, rax
je 0x14004f741
lea rcx, [0x14004b940]
mov qword [rax], rcx
jmp 0x14004f744
mov rax, r12
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003ac40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140050171
cmp dword [rsp + 0x68], 0
je 0x140050166
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140050166
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rax + 8]
call fcn.140050a6c
test rax, rax
je 0x14004f7ca
lea rcx, [0x14004bf80]
mov qword [rax], rcx
jmp 0x14004f7cd
mov rax, r12
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003ac40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140050156
cmp dword [rsp + 0x68], 0
je 0x14005014b
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14005014b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rax + 8]
call fcn.140050a6c
test rax, rax
je 0x14004f853
lea rcx, [0x14004c880]
mov qword [rax], rcx
jmp 0x14004f856
mov rax, r12
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003ac40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14005013b
cmp dword [rsp + 0x68], 0
je 0x140050130
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140050130
call sub.MSVCP140.dll__Xtime_get_ticks
call sub.MSVCP140.dll__Xtime_get_ticks
mov edx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x70], r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x140077490]
movdqu xmmword [rbp + 0x190], xmm1
mov byte [rbp + 0x180], 0
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Loader
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._n__1__Load_Drivers_n__2__Load_External_n_n_Choose_option___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
call fcn.14004bc90
call fcn.14004bc90
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rsp + 0x70]
sub ecx, 1
jne 0x14004fb45
lea rcx, [0x140076d9c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004bc90
call fcn.14004bc90
lea rdx, str._n_Loading_driver_please_wait...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov rdx, qword [str.C:WindowsSystem32dontleaksunny.sys]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14004f9d0
lea rcx, [rbp + 0xa0]
call fcn.14003a6d0
nop
mov r8d, 0x2200
lea rdx, [0x140081210]
lea rcx, [rbp + 0xa0]
call fcn.14003d1a0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14004fa42
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fa3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fb37
call fcn.1400503b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [str._i_a_]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14004fa73
lea rcx, [rbp + 0xa0]
call fcn.14003a6d0
nop
mov r8d, 0x23270
lea rdx, [0x140083410]
lea rcx, [rbp + 0xa0]
call fcn.14003d1a0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14004fae1
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fadc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fb3e
call fcn.1400503b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004bc90
call fcn.14004bc90
lea rcx, str.C:WindowsSystem32dontleaksunny.exe_C:WindowsSystem32dontleaksunny.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32dontleaksunny.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32dontleaksunny.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [0x140076d9c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14004f912
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 1
je 0x14004fbf8
lea rcx, [rbp + 0x3e0]
call fcn.14003c290
nop
mov edx, 0x20
mov rcx, r15
call fcn.1400503b0
nop
mov edx, 0x20
mov rcx, r14
call fcn.1400503b0
nop
mov edx, 0x50
mov rcx, rsi
call fcn.1400503b0
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14004fbc6
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fbc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140050102
call fcn.1400503b0
xor eax, eax
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.1400507c0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rcx, str.Browser.exe
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [0x140053b86]
call fcn.140001590
test eax, eax
je 0x140050087
lea rdx, [0x140076e28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
lea rdx, str.Open_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
cmp qword [0x1400a8cf8], 0
jne 0x14004fcf4
nop dword [rax]
movsd xmm0, qword [str.w_A___C_]
movsd qword [rbp + 0x90], xmm0
movzx ecx, word [0x140076ca8]
mov word [rbp + 0x98], cx
movzx eax, byte [0x140076caa]
mov byte [rbp + 0x90], 0x46
xor byte [rbp + 0x91], 0x32
xor byte [rbp + 0x92], 0x33
xor byte [rbp + 0x93], 0x34
xor byte [rbp + 0x94], 0x35
xor byte [rbp + 0x95], 0x36
xor byte [rbp + 0x96], 0x37
xor byte [rbp + 0x97], 0x38
xor cl, 0x39
mov byte [rbp + 0x98], cl
xor byte [rbp + 0x99], 0x3a
xor al, 0x3b
mov byte [rbp + 0x9a], al
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400a8cf8], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400a8cf8], 0
je 0x14004fc50
lea rcx, [0x140076d9c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140053d30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
lea rdx, str._Found_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.14004b7e0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004bc90
call fcn.14004bc90
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov ebx, r12d
cmp rax, 0xffffffffffffffff
je 0x14004fe1b
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x1a4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1a0], 0x238
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14004fe12
lea rdx, [rbp + 0x1cc]
lea rcx, [0x140076e50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14004fdcf
mov ebx, dword [rbp + 0x1a8]
jmp 0x14004fe12
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14004fe12
lea rdx, [rbp + 0x1cc]
lea rcx, [0x140076e50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
cmove ebx, dword [rbp + 0x1a8]
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14004fde2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400a8cdc], ebx
lea rdx, [0x140053d30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
lea rdx, str._Cheat_injected
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004b7e0
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov ecx, dword [0x1400a8cdc]
call fcn.1400014b0
mov qword [0x1400a8ce0], rax
lea rdx, [0x140053d30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
mov rdx, qword [0x1400a8ce0]
lea rcx, str.__BASE_ID__Fortnites_Base_ID_is:__p
call fcn.1400501a0
lea rdx, [0x140076e28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a170
lea rcx, str._____IF_THE_BASE_ID_IS_ALL_0s_THE_DRIVER_DID_NOT_LOAD_CORRECTLY_AND_CHEAT_FEATURES_WILL_NOT_WORK
call fcn.1400501a0
mov qword [rbp], 0x50
lea rax, [0x14004b070]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x20], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x28], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
lea rax, [0x140076ae0]
mov qword [rbp + 0x40], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x48], rax
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x14004ff31
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [0x1400a8ec8], rax
test rax, rax
je 0x140050109
mov dword [0x1400a8ea4], 0x76c
mov dword [0x1400a8ed0], 0x42e
mov ecx, dword [0x1400a8d08]
add ecx, 5
mov eax, dword [0x1400a8d04]
add eax, 0xa
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x42e
mov dword [rsp + 0x30], 0x76c
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9d, 0x90000000
lea r8, str.Medal
lea rdx, str.Medal
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400a9030], rax
lea rdx, [0x140076868]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80020
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, 5
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400a9030]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14004e6b0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14003cc90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14004ed30
call fcn.14004efc0
nop
lea rcx, [rbp + 0x3e0]
call fcn.14003c290
nop
mov edx, 0x20
mov rcx, r15
call fcn.1400503b0
nop
mov edx, 0x20
mov rcx, r14
call fcn.1400503b0
nop
mov edx, 0x50
mov rcx, rsi
call fcn.1400503b0
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14004fbc6
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004fbc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fbc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3