Function at 0x14004ee30
Capabilities:
Create thread
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1401dd340]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 2
mov r8b, 0xc8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rcx, str.C:dd32695.x64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rdx, str.DD_btn
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd6e0], rax
lea rdx, str.DD_key
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd6e8], rax
lea rdx, str.DD_mov
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd6f0], rax
lea rdx, str.DD_str
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd6f8], rax
lea rdx, str.DD_todc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd700], rax
lea rdx, str.DD_movR
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401dd708], rax
xor ecx, ecx
call qword [0x1401dd6e0]
mov rcx, qword [0x1401dd810]
call fcn.14005a1e0
mov edx, 1
mov rcx, qword [0x1401dd858]
call fcn.14004e160
test al, al
jne 0x14004ef83
lea rcx, str._n_Driver_____driver_not_found._n
call fcn.14001dfb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rcx, str._n_Driver_____driver_loaded._n
call fcn.14001dfb0
mov rbx, qword [0x1401dd858]
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, rbx
call fcn.14004d280
mov dword [rbx], eax
test eax, eax
je 0x14004efd5
lea rdx, str.Attatchment:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400498b0
mov dl, 1
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
mov rcx, rax
mov dl, 0xa
call fcn.140049670
jmp 0x14004efee
lea rcx, str._Process_____failed_to_attach_to_pid._n
call fcn.14001dfb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401dda04], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401dda08], eax
cmp qword [0x1401dd768], r15
jne 0x14004f0b1
nop word [rax + rax]
mov al, 0x67
mov cl, 0x4d
mov dl, 0x51
mov r8b, 0x50
mov r9b, 0x4b
mov r10b, 0x4f
mov r11b, 0x53
movzx ebx, cl
mov dil, 9
mov sil, 0xa
xor r14d, r14d
xor al, 0x21
mov byte [rsp + 0x30], al
xor cl, 0x22
mov byte [rsp + 0x31], cl
xor dl, 0x23
mov byte [rsp + 0x32], dl
xor r8b, 0x24
mov byte [rsp + 0x33], r8b
xor r9b, 0x25
mov byte [rsp + 0x34], r9b
xor r10b, 0x26
mov byte [rsp + 0x35], r10b
xor r11b, 0x27
mov byte [rsp + 0x36], r11b
xor bl, 0x28
mov byte [rsp + 0x37], bl
xor dil, 0x29
mov byte [rsp + 0x38], dil
xor sil, 0x2a
mov byte [rsp + 0x39], sil
mov byte [rsp + 0x3a], r14b
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401dd768], rax
test rax, rax
je 0x14004f020
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x1401dd858]
call fcn.14004d280
test eax, eax
jne 0x14004f0fb
lea rcx, str._n_Process_____Fortnite_process_not_found._n
call fcn.14001dfb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
jmp 0x14004f109
mov edx, eax
lea rcx, str._PID______i_n
call fcn.14001dfb0
mov rbx, qword [0x1401dd858]
mov eax, dword [rbx]
cmp dword [rbx + 0x20], r15d
je 0x14004f14a
mov qword [rbp + 0x1d0], r15
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov edx, 7
mov rcx, rbx
call fcn.14004ed60
mov rsi, qword [rbp + 0x1d0]
jmp 0x14004f1a5
mov qword [rbp + 0x1d8], r15
mov dword [rbp + 0x1d0], r15d
mov dword [rbp - 0x50], eax
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x1b8], rax
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x1c0], rax
lea r8, str.FortniteClient_Win64_Shipping.exe
mov edx, 0xff
lea rcx, [rbp - 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rbp - 0x50]
mov edx, 6
mov rcx, rbx
call fcn.14004ed60
mov rsi, qword [rbp + 0x1d8]
test rsi, rsi
jne 0x14004f1c3
lea rcx, str._Driver_____failed_to_get_base_address._n
call fcn.14001dfb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rdx, rsi
lea rcx, str._base_address_____0x_llX_n
call fcn.14001dfb0
mov qword [rsp + 0x30], r15
mov rcx, qword [0x1401dd858]
mov eax, dword [rcx]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
mov edx, 2
call fcn.14004ed60
mov ebx, r15d
movsxd rcx, ebx
add rcx, rsi
mov qword [0x1401dd7b8], rcx
add rcx, 0x12300e58
mov qword [rbp + 0x1d8], r15
mov r9, qword [0x1401dd858]
mov eax, dword [r9]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x60], rcx
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], 8
mov eax, dword [r9 + 0x20]
mov dword [rsp + 0x6c], eax
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, r9
call fcn.14004ed60
mov rdi, qword [rbp + 0x1d8]
mov qword [rbp + 0x1d0], r15
mov rcx, qword [0x1401dd858]
mov eax, dword [rcx]
mov dword [rsp + 0x70], eax
lea rax, [rdi + 0x30]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x78], 8
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x74], eax
lea r8, [rsp + 0x70]
mov edx, 1
call fcn.14004ed60
test rdi, rdi
je 0x14004f305
mov rdx, qword [rbp + 0x1d0]
test rdx, rdx
je 0x14004f305
mov qword [rbp + 0x1e0], r15
mov rcx, qword [0x1401dd858]
mov eax, dword [rcx]
mov dword [rbp - 0x70], eax
lea rax, [rdx + 0xc0]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x1e0]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x58], 8
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x54], eax
lea r8, [rbp - 0x70]
mov edx, 1
call fcn.14004ed60
cmp qword [rbp + 0x1e0], rdi
je 0x14004f317
add ebx, 0x1000
cmp ebx, 0x3e8000
jl 0x14004f200
mov rdx, qword [0x1401dd7b8]
test rdx, rdx
jne 0x14004f34f
lea rdx, str.Couldnt_got_the_Va_Text
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400498b0
mov rcx, rax
mov dl, 0xa
call fcn.140049670
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
jmp 0x14004f35b
lea rcx, str._Va_Text______0x_llX_n
call fcn.14001dfb0
test rsi, rsi
jne 0x14004f396
lea rdx, str.0x0_failure_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400498b0
lea rdx, [0x14004a600]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._________.sys_is_not_loaded_in_your_system_________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400498b0
mov ecx, 1
call fcn.14005cda0
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14004a3e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14004f43d
cmp dword [rbp + 0x1e8], 0
je 0x14004f432
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14004f432
mov rcx, qword [0x1401dd808]
call fcn.14004ea80
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14005c760
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3