Function at 0x140012550
Capabilities:
Create thread
Delete file
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1400af010]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r12d, r12d
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rsp + 0x50]
call fcn.140004b90
mov dword [rsp + 0x70], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov r15, 0xffffffffffffffff
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
cmp rax, r15
je 0x140012723
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x250]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rbp - 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x50]
cmp r14, 8
cmovae rax, rbx
lea rdi, [rbp + 0x250]
sub rdi, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140012633
add rax, 2
test ecx, ecx
jne 0x140012620
test edx, edx
jne 0x140012664
mov r8d, dword [rsp + 0x78]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140012664
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14001271a
nop word [rax + rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x250]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rbp - 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x50]
cmp r14, 8
cmovae rax, rbx
lea rdi, [rbp + 0x250]
sub rdi, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400126d3
add rax, 2
test ecx, ecx
jne 0x1400126c0
test edx, edx
jne 0x140012704
mov r8d, dword [rsp + 0x78]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140012704
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140012680
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 8
jb 0x14001275e
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140012756
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400133c8
mov rcx, rbx
call fcn.140059c74
mov edx, 1
lea rcx, [0x140004f30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [0x1400a2ca0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], 0xf
mov byte [rbp + 0x118], r12b
movdqa xmm0, xmmword [0x1400a4b90]
movdqu xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [0x1400a4b60]
movdqu xmmword [rbp + 0xc0], xmm1
mov word [rbp + 0xd0], 0x100
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 1]
xor byte [rbp + rcx + 0xb0], al
inc rcx
cmp rcx, 0x20
jb 0x1400127e0
mov byte [rbp + 0xd1], 0
lea rdx, [rbp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015f00
lea rdx, [rbp + 0x118]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400160d0
lea rcx, [rbp + 0x118]
mov r15, qword [rbp + 0x118]
mov r13, qword [rbp + 0x130]
cmp r13, 0x10
cmovae rcx, r15
mov rdi, qword [rbp + 0x128]
cmp rdi, 1
jne 0x140012861
mov r8, rdi
lea rdx, [0x1400a2d00]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400128e1
lea rcx, [rbp + 0x118]
cmp r13, 0x10
cmovae rcx, r15
cmp rdi, 1
jne 0x140012889
mov r8, rdi
lea rdx, [0x14005caa8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400128e1
lea rcx, [rbp + 0x118]
cmp r13, 0x10
cmovae rcx, r15
cmp rdi, 3
jne 0x1400128b1
mov r8, rdi
lea rdx, [0x1400a2d04]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400128e1
lea rcx, [rbp + 0x118]
cmp r13, 0x10
cmovae rcx, r15
cmp rdi, 3
jne 0x140012efc
mov r8, rdi
lea rdx, [0x1400a2d08]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012efc
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r12
mov qword [rbp + 0x110], 0xf
mov ecx, 0x20
call fcn.1400599e8
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x108], 0x15
mov qword [rbp + 0x110], 0x1f
movups xmm0, xmmword [str.C:WindowsMapper.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400a2d20]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400a2d24]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], 0xf
mov ecx, 0x20
call fcn.1400599e8
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], 0x15
mov qword [rbp + 0xf0], 0x1f
movups xmm0, xmmword [str.C:Windowsdriver.sys]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400a2d38]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400a2d3c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x250]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0x250]
call fcn.140014ce0
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x250], rdi
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x24c], edx
cmp qword [rbp + 0x2d8], 0
je 0x140013006
lea rcx, [rbp + 0x258]
call fcn.140014c30
test rax, rax
jne 0x140012a53
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x250]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rdx, qword [rbp + 0xd8]
lea rcx, [rbp + 0x140]
call fcn.140014ce0
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x140], rdi
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
cmp qword [rbp + 0x1c8], 0
je 0x140012fb4
lea rcx, [rbp + 0x148]
call fcn.140014c30
test rax, rax
jne 0x140012af6
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x140]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rsi, qword [rbp + 0x108]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x14001340f
lea r12, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae r12, qword [rbp + 0xf8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [rsi + 1]
mov edi, 0xf
lea rbx, [rsp + 0x30]
cmp r14, rdi
jbe 0x140012bcf
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140012b63
mov rdi, rcx
jmp 0x140012b6f
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140012bb9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013409
mov rcx, rax
call fcn.1400599e8
test rax, rax
je 0x140012bb2
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140012bca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140012bc8
call fcn.1400599e8
mov rbx, rax
jmp 0x140012bca
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rdi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0x20
mov byte [rbx + r14], 0
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rdx, qword [rbp + 0xd8]
mov r8, qword [rbp + 0xe8]
lea rcx, [rsp + 0x30]
call fcn.140002a00
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140012c94
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012c8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012c8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059c74
movdqa xmm0, xmmword [0x1400a46c0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140012d02
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae rcx, qword [rbp + 0xf8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rcx, qword [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400a2d70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015f00
mov rcx, rax
lea rdx, [0x1400a2d6c]
call fcn.140015f00
mov rcx, rax
lea rdx, [0x1400a2854]
call fcn.140015f00
mov rcx, rax
lea rdx, str._Have_fun_cheating_with_Precise_Slotted.
call fcn.140015f00
lea rcx, [0x1400a2ca0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140012d9f
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012d9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059c74
movdqa xmm0, xmmword [0x1400a46c0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x140], rdi
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x148]
call fcn.140014050
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x250], rdi
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x24c], edx
lea rcx, [rbp + 0x258]
call fcn.140014050
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x140012ea2
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012e9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013090
call fcn.140059c74
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140012efc
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012ef7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400130f1
call fcn.140059c74
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc8], 0xf
mov ecx, 0x20
call fcn.1400599e8
mov rsi, rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], 0x18
mov qword [rbp + 0xc8], 0x1f
movups xmm0, xmmword [str._Please_Start_Fortnite._n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400a2d88]
movsd qword [rax + 0x10], xmm0
lea r14, [rax + 0x18]
mov byte [r14], 0
mov rdi, rax
cmp rax, r14
je 0x14001315e
movabs r13, 0x7fffffffffffffff
movabs r15, 0x7ffffffffd050f7f
nop word [rax + rax]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015d40
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140013102
imul rax, rax, 0x64
jmp 0x14001311d
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x140], rdi
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x148]
call fcn.140014050
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x250], rdi
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x24c], edx
lea rcx, [rbp + 0x258]
call fcn.140014050
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x14001309c
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013097
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059c74
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x14001339d
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400130f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400130f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059c74
jmp 0x14001339d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jge 0x140013131
add rax, 0x2faf080
mov qword [rbp + 0xa0], rax
jmp 0x140013138
mov qword [rbp + 0xa0], r13
lea rcx, [rbp + 0xa0]
call fcn.140016e70
inc rdi
cmp rdi, r14
jne 0x140012f80
mov r15, qword [rbp + 0x118]
mov r13, qword [rbp + 0x130]
mov edx, 0x20
mov rcx, rsi
call fcn.140059c74
cmp qword [0x1400ea070], 0
jne 0x1400131e5
mov dword [rbp + 0xa0], 0x70716d47
mov dword [rbp + 0xa4], 0x6d736f6b
mov dword [rbp + 0xa8], 0x1002a29
mov rax, r12
nop word [rax + rax]
lea ecx, [rax + 1]
xor byte [rbp + rax + 0xa0], cl
inc rax
cmp rax, 0xa
jb 0x1400131a0
mov byte [rbp + 0xab], 0
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400ea070], rax
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400ea070], 0
je 0x140013175
mov rdi, qword [0x1400ea218]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0xb0]
call fcn.140004b90
nop
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call fcn.140004880
movzx edi, al
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140013258
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013253
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400132f6
call fcn.140059c74
test dil, dil
jne 0x14001327d
lea rdx, str.__log_____failed_to_attach_to_pid._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015f00
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rdx, qword [0x1400ea218]
mov rdx, qword [rdx + 0x18]
lea rcx, str.____Hacked_Game_Adress:__p
call fcn.1400046e0
lea rdx, str.mspaint.exe
lea rcx, [rbp + 0xb0]
call fcn.140004b90
lea rdx, [rbp + 0xb0]
call fcn.140004750
test eax, eax
sete dil
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140013302
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400132fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400132fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059c74
test dil, dil
je 0x140013314
lea rcx, str.start_mspaint
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140007670]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [fcn.140006a80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000eb40
mov dword [rbp + 0xa0], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea r9, [rbp + 0xa0]
mov edx, 0x1000
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
cmp r13, 0x10
jb 0x1400133d7
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400133cf
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400133cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140059c74
xor eax, eax
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.140059730
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001320
nop
call fcn.1400013c0
int3