Function at 0x140030a50
Capabilities:
Create thread
Delete file
Encode data using xor
Execute command
Link many functions at runtime
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x140089010]
xor rax, rsp
mov qword [rbp + 0x300], rax
call fcn.140004fd0
mov rbx, qword [0x14008a3a0]
lea rdx, [rbp + 0xc0]
xor edi, edi
mov dword [rbp - 0x58], 3
xorps xmm0, xmm0
mov qword [rbp - 0x70], rdi
xor eax, eax
mov dword [rbp - 0x68], edi
mov rcx, qword [rbx + 0xa0]
movups xmmword [rbp - 0x1c], xmm0
mov qword [rbp - 0x44], rax
movups xmmword [rbp - 0xc], xmm0
mov byte [rbp - 0x64], al
movups xmmword [rbp + 0x84], xmm0
mov byte [rbp - 0x50], al
movups xmmword [rbp + 0x94], xmm0
mov qword [rbp - 0x4c], rax
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp + 0xe0], xmm0
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x28], al
mov qword [rbp + 4], rax
mov qword [rbp + 0xa4], rax
lea rax, [0x14005ed30]
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x54], 1
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rbp - 0x38], rdi
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rbp + 0xf0], xmm1
mov dword [rbp - 0x2c], 0x7f7fffff
mov dword [rbp - 0x24], edi
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x100], xmm0
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x120], xmm0
mov dword [rbp - 0x20], 0x3f800000
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x110], xmm1
movups xmm1, xmmword [rbp]
mov qword [rbp + 0x10], rdi
movsd xmm0, qword [rbp + 0x10]
movsd qword [rbp + 0x140], xmm0
mov qword [rbx + 0x20], rdi
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], edi
mov byte [rbp + 0x3c], 1
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x54], rdi
mov qword [rbp + 0x5c], rdi
mov qword [rbp + 0x68], rdi
mov dword [rbp + 0x70], edi
mov dword [rbp + 0x74], 0x7f7fffff
mov dword [rbp + 0x7c], edi
mov dword [rbp + 0x80], 0x3f800000
mov qword [rbp + 0xb0], rdi
mov byte [rbp + 0x78], 1
mov byte [rbp + 0x50], 1
mov dword [rbp + 0x48], 2
mov dword [rbp + 0x4c], 2
movups xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 0x225bc
mov dword [rbp + 0xd4], 0x41a80000
call fcn.14001e5e0
movss xmm3, dword [0x1400820a8]
lea rax, [0x140081eb8]
mov rcx, qword [rbx + 0xa0]
lea rdx, [0x140040600]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001ed10
mov rcx, qword [rbx + 0xa0]
call fcn.14001e860
xor ecx, ecx
call fcn.14001aaa0
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Loading
call fcn.14002ce20
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Vortex.wtf__Free_Tester_Build
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str._n_n_n__1__Load_Cheat_n__2__Load_Driver__n_n_n__
call fcn.14002ce20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x64]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rsp + 0x64], 2
jne 0x140030d8c
nop dword [rax]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1151207422816424047_1151207448074522715_mapper.exe___output_C:WindowsSystem32Vanguardmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1151207422816424047_1151207447491526686_driver.sys___output_C:WindowsSystem32Windows10Help.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Vanguardmapper.exe_C:WindowsSystem32Windows10Help.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Vanguardmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Windows10Help.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Loading
call fcn.14002ce20
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Vortex.wtf__Free_Tester_Build
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str._n_n_n__1__Load_Cheat_n__2__Load_Driver__n_n_n__
call fcn.14002ce20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x64]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rsp + 0x64], 2
je 0x140030ca0
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140030dff
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140030dff
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140030ec4
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140030e6e
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140030e6e
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140081468]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x140030ec4
movups xmm0, xmmword [rbx]
movups xmmword [0x14008a860], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [0x14008a870], xmm1
mov eax, dword [rbx + 0x18]
mov dword [0x14008a878], eax
movzx eax, word [rbx + 0x1c]
mov word [0x14008a87c], ax
movups xmm0, xmmword [rcx]
movups xmmword [0x14008a880], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [0x14008a890], xmm1
mov eax, dword [rcx + 0x18]
mov dword [0x14008a898], eax
movzx eax, word [rcx + 0x1c]
mov word [0x14008a89c], ax
mov qword [rsp + 0x28], rdi
lea r8, [0x14002ea40]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x140081828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.___Starting_Injection..._n_n
call fcn.14002ce20
cmp byte [0x140081f6d], dil
movups xmm0, xmmword [0x140081f50]
mov eax, dword [0x140081f68]
mov dword [rbp + 0x2f8], eax
movzx eax, word [0x140081f6c]
movups xmmword [rbp + 0x2e0], xmm0
mov word [rbp + 0x2fc], ax
movsd xmm0, qword [0x140081f60]
movsd qword [rbp + 0x2f0], xmm0
je 0x140031111
cmp dword [0x140089018], 2
mov r8d, edi
jl 0x1400310ce
movdqa xmm0, xmmword [0x140082220]
lea rcx, [rbp + 0x2e4]
movdqa xmm5, xmmword [0x1400821e0]
mov eax, 4
movdqa xmm4, xmmword [0x140082320]
movaps xmmword [rsp + 0x430], xmm6
movaps xmmword [rsp + 0x420], xmm7
movdqa xmm7, xmmword [str.4444]
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [rsp + 0x410], xmm8
movdqa xmmword [rbp - 0x80], xmm0
mov edx, dword [rbp - 0x80]
movd xmm8, eax
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140082200]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140082200]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x140030fb0
movaps xmm8, xmmword [rsp + 0x410]
movaps xmm7, xmmword [rsp + 0x420]
movaps xmm6, xmmword [rsp + 0x430]
cmp r8d, 0x1e
jge 0x140031111
movsxd rax, r8d
lea r9, [rbp + 0x2e0]
add r9, rax
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x1e
jl 0x1400310e0
lea rcx, [rbp + 0x2e0]
call fcn.14002ce20
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x140081ad0]
mov qword [0x14008a478], rax
lea rcx, [rbp + 0x2e0]
call fcn.140038880
mov rcx, rax
call fcn.1400308a0
cmp byte [0x140081f79], dil
mov dword [0x14008a440], eax
movzx eax, word [0x140081f78]
mov word [rsp + 0x60], ax
je 0x140031173
xor byte [rsp + 0x61], 0x32
mov byte [rsp + 0x60], 0xa
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x60]
call fcn.140038ef0
cmp byte [0x140081ead], dil
movzx eax, word [0x140081eac]
mov word [rsp + 0x60], ax
je 0x1400311a3
xor byte [rsp + 0x61], 0x32
mov byte [rsp + 0x60], 0x20
lea rcx, [rsp + 0x60]
call fcn.14002ce20
mov rcx, qword [0x14008a478]
lea rdx, [0x14008a440]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002d630
test al, al
je 0x14003138f
mov rbx, qword [0x14008a758]
mov eax, dword [0x14008a440]
mov dword [rbx], eax
cmp dword [rbx + 0x20], edi
je 0x1400312a6
mov dword [rbp - 0x80], eax
lea rcx, [0x14008a760]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x78], rax
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14003121f
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x14008a7ac], 0x7fffffff
jne 0x140031241
mov ecx, 6
mov dword [0x14008a7ac], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rax, [rbx + 0x18]
mov dword [rbp + 0x2e8], 6
mov qword [rbp + 0x2e0], rax
lea rax, [rbp - 0x80]
movups xmm0, xmmword [rbp + 0x2e0]
mov qword [rbp + 0x2f0], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbx + 8]
movups xmm1, xmmword [rbp + 0x2f0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [0x14008a760]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rsp + 0x70]
jmp 0x140031388
mov dword [rbp + 0xc0], eax
lea r8, str.FortniteClient_Win64_Shipping.exe
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp + 0xc4]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], edi
mov edx, 0xff
mov qword [rbp + 0x2d0], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [0x14008a760]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140031303
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x14008a7ac], 0x7fffffff
jne 0x140031325
mov ecx, 6
mov dword [0x14008a7ac], 0x7ffffffe
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rax, [rbx + 0x18]
mov dword [rbp + 0x2e8], 5
mov qword [rbp + 0x2e0], rax
lea rax, [rbp + 0xc0]
movups xmm0, xmmword [rbp + 0x2e0]
mov qword [rbp + 0x2f0], rax
lea rax, [rbp + 0x24]
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbx + 8]
movups xmm1, xmmword [rbp + 0x2f0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [0x14008a760]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rsp + 0x68]
mov qword [0x14008a470], rax
cmp byte [0x140081ead], dil
movzx eax, word [0x140081eac]
mov word [rsp + 0x60], ax
mov qword [rsp + 0x450], rsi
je 0x1400313b6
xor byte [rsp + 0x61], 0x32
mov byte [rsp + 0x60], 0x20
lea rcx, [rsp + 0x60]
call fcn.14002ce20
lea rcx, str.___Injected_Sucessfully_n_n
call fcn.14002ce20
mov rdx, qword [0x14008a470]
lea rcx, str.___Fortnited_BaseID:__p_n_n
call fcn.14002ce20
mov edx, 0xc8
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Beep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400315a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [rbp - 0x6c], edi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x38], rdi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x40], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rsi, str.soarwazhere
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x70]
lea rax, [0x140037f20]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x70], 3
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14003147b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_____overlay_failed
call fcn.140038ef0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
lea r8, str.SoarCheats1337
mov qword [rsp + 0x50], rdi
mov r9d, 0x80000000
mov qword [rsp + 0x48], rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x14008a838], rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14008a838]
lea rdx, [0x1400405f0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14008a838]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14008a838]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.1400316a0
call fcn.140037be0
mov rcx, qword [0x14008a3c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14008a858]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14008a450]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14008a838]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rsi, qword [rsp + 0x450]
xor eax, eax
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140039600
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret