Function at 0x1400328a0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400b3040]
xor rax, rsp
mov qword [rbp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
test rax, rax
jne 0x14003290b
lea rdx, str.Error:_Could_not_get_console_window_handle.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140032943
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
bts rax, 0x13
mov r8, rax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r9d, 2
mov r8b, 0xc8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rcx, str.Arial_Free_External
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xor r14d, r14d
mov qword [rbp], r14
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], r14b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enter_Key:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14003d220
lea rcx, [rbp - 0x10]
mov r15, qword [rbp - 0x10]
mov r13, qword [rbp + 8]
cmp r13, 0xf
cmova rcx, r15
mov r8, qword [rbp]
cmp r8, 0xa
jne 0x140033461
test r8, r8
je 0x140032a18
lea rdx, str.Arial_Free
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
je 0x140033461
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa77c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Welcome_in_Arial_Free_External
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, 0x20
call fcn.14003d8b8
mov rdx, rax
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [0x1400ab060]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [str.Welcome_in_Arial_Free_External]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400aa7b8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400aa7c0]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400aa7c4]
mov word [rdx + 0x1c], ax
mov byte [rdx + 0x1e], 0
lea rcx, [rbp - 0x30]
call fcn.140031340
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140032b3d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032b38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003d840
lea rcx, [0x1400aa7c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa77c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Open_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400ab050]
movdqu xmmword [rbp - 0x20], xmm1
movsd xmm0, qword [str.Open_Fortnite_]
movsd qword [rbp - 0x30], xmm0
mov eax, dword [0x1400aa7e8]
mov dword [rbp - 0x28], eax
movzx eax, word [0x1400aa7ec]
mov word [rbp - 0x24], ax
mov byte [rbp - 0x22], 0
lea rcx, [rbp - 0x30]
call fcn.140031340
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140032c4c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032c47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003d840
lea rcx, [0x1400aa7c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.____Press_Enter_to_load_cheat___IN_LOBBY______
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, 0x30
call fcn.14003d8b8
mov rcx, rax
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [0x1400ab080]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [str.____Press_Enter_to_load_cheat___IN_LOBBY______]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400aa800]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400aa810]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400aa818]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1400aa81c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0
lea rcx, [rbp - 0x30]
call fcn.140031340
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140032d2b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032d26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003d840
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.______________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov edx, 0x258
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x1400aa7c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..jeremyownsyou
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1400e5198], rax
cmp qword [0x1400e4b98], 0
jne 0x140032e84
nop dword [rax]
mov al, 0xa7
mov cl, 0x8d
mov dl, 0x91
mov r8b, 0x90
mov r9b, 0x8b
mov r10b, 0x8f
mov r11b, 0x93
movzx ebx, cl
mov dil, 0xc9
mov sil, 0xca
xor r12d, r12d
xor al, 0xe1
mov byte [rbp - 0x40], al
xor cl, 0xe2
mov byte [rbp - 0x3f], cl
xor dl, 0xe3
mov byte [rbp - 0x3e], dl
xor r8b, 0xe4
mov byte [rbp - 0x3d], r8b
xor r9b, 0xe5
mov byte [rbp - 0x3c], r9b
xor r10b, 0xe6
mov byte [rbp - 0x3b], r10b
xor r11b, 0xe7
mov byte [rbp - 0x3a], r11b
xor bl, 0xe8
mov byte [rbp - 0x39], bl
xor dil, 0xe9
mov byte [rbp - 0x38], dil
xor sil, 0xea
mov byte [rbp - 0x37], sil
mov byte [rbp - 0x36], r12b
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400e4b98], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400e4b98], r12
je 0x140032df0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140032eda
nop dword [rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003305b
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140032eb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400e5190]
mov byte [rsp + 0x60], 0
mov dword [rbp - 0x40], 0x7f1e8b
mov dword [rbp - 0x3c], eax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp - 0x40]
mov edx, 0x23de8c
mov rcx, qword [0x1400e5198]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa86c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.STARTING_CHEAT_NOW__HAVE_FUN_DESTROYING_KIDS.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, 0x30
call fcn.14003d8b8
mov rcx, rax
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [0x1400ab070]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [str.STARTING_CHEAT_NOW__HAVE_FUN_DESTROYING_KIDS.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400aa880]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400aa890]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400aa898]
mov dword [rcx + 0x28], eax
movzx eax, byte [0x1400aa89c]
mov byte [rcx + 0x2c], al
mov byte [rcx + 0x2d], 0
lea rcx, [rbp - 0x30]
call fcn.140031340
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140033074
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003306f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003306f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov dword [0x1400e5190], eax
jmp 0x140032ee9
call fcn.14003d840
mov edx, 0xc8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x30], 0x7f1e8b
mov eax, dword [0x1400e5190]
mov dword [rbp - 0x2c], eax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp - 0x30]
mov edx, 0x2360d4
mov rcx, qword [0x1400e5198]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x40]
mov qword [0x1400e51a0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movsd xmm0, qword [0x1400aad60]
movsd qword [rbp - 0x40], xmm0
mov edx, dword [0x1400aad68]
mov dword [rbp - 0x38], edx
movzx eax, word [0x1400aad6c]
mov word [rbp - 0x34], ax
cmp byte [0x1400aad6d], 0
je 0x1400332ad
mov ecx, r14d
cmp dword [0x1400b3090], 2
jl 0x140033278
movdqa xmm5, xmmword [0x1400ab480]
movdqa xmm2, xmmword [0x1400ab0d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab100]
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x1400ab110]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ab120]
movd xmm0, dword [0x1400aad60]
xorps xmm2, xmm0
movd dword [rbp - 0x40], xmm2
movdqa xmm2, xmmword [0x1400ab0e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab100]
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400ab120]
movd xmm0, dword [rbp - 0x3c]
xorps xmm2, xmm0
movd dword [rbp - 0x3c], xmm2
movdqa xmm3, xmmword [0x1400ab0f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400ab100]
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x1400ab120]
movd xmm0, edx
xorps xmm3, xmm0
movd dword [rbp - 0x38], xmm3
mov ecx, 0xc
mov eax, ecx
lea r8, [rbp - 0x40]
add r8, rax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
sub al, dl
add al, 0x39
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xe
jl 0x140033281
mov rdx, qword [0x1400e51a0]
lea rcx, [rbp - 0x40]
call fcn.140030470
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140033560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x70], 0x50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x48], r14
lea rbx, str.About_Windows
mov qword [rbp - 0x50], rbx
lea rax, [0x14003bcf0]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x1400e4b98]
test rcx, rcx
je 0x140033455
lea rdx, [0x1400e4ba0]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rbp - 0x40]
mov rcx, qword [0x1400e4b98]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x40]
mov dword [0x1400e4ba0], eax
mov eax, dword [rbp - 0x3c]
mov dword [0x1400e4ba4], eax
mov ecx, dword [0x1400e4ba8]
mov dword [0x1400e4b94], ecx
mov eax, dword [0x1400e4bac]
mov dword [0x1400e4b90], eax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x90000000
lea r8, str.Winver
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400e4c50], rax
lea rdx, [0x1400446a8]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, qword [0x1400e4c50]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, 5
mov rcx, qword [0x1400e4c50]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4c50]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140033660
call fcn.14003b950
mov rcx, qword [0x1400e4ae8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4ca0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4b80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400e4c50]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x1400334e8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1400aa77c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Invalid_Key._Exiting_Cheat.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003cc40
lea rdx, [0x14003ce20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14d, 1
cmp r13, 0xf
jbe 0x140033522
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14003351a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003351a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14003d840
mov eax, r14d
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14003d3f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret