Function at 0x140050dd0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Create thread
Encode data using base64
Encode data using xor
Enumerate processes
Execute command
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1401c7c00]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov r8d, Ordinal_41
lea rdx, str.https:__discord.com_invite_56cjJM8yva
lea rcx, [rsp + 0x50]
call fcn.140049840
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x60]
sub rax, rcx
cmp rax, 6
jb 0x140051ad9
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.start
lea r8, [rsp + 0x50]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14004bd00
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x70]
call fcn.14004cbd0
nop
lea rcx, [rsp + 0x50]
call fcn.14004cbd0
call fcn.140057330
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 2
mov r8b, reloc.WLDAP32.dll_Ordinal_200
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x50], 0xd4
mov byte [rsp + 0x51], 0xea
mov byte [rsp + 0x52], 0xed
mov byte [rsp + 0x53], 0xf1
mov byte [rsp + 0x54], 0xa7
mov byte [rsp + 0x55], 0xe7
mov byte [rsp + 0x56], 0xe4
mov byte [rsp + 0x57], 0xff
mov byte [rsp + 0x58], 0xfb
mov byte [rsp + 0x59], 0xeb
mov byte [rsp + 0x5a], 0xbc
mov byte [rsp + 0x5b], 0xfc
mov byte [rsp + 0x5c], 0xf1
mov byte [rsp + 0x5d], 0xf0
mov byte [rsp + 0x5e], 0xff
mov byte [rsp + 0x5f], 0xbb
mov byte [rsp + 0x60], 0xf2
mov byte [rsp + 0x61], 0xeb
mov byte [rsp + 0x62], 0xb4
mov byte [rsp + 0x63], 0xe4
mov byte [rsp + 0x64], 0xfa
mov byte [rsp + 0x65], 0xf9
mov byte [rsp + 0x66], 0xf8
mov byte [rsp + 0x67], Ordinal_200
mov byte [rsp + 0x68], Ordinal_200
mov byte [rsp + 0x69], 0x81
mov byte [rsp + 0x6a], Ordinal_143
mov byte [rsp + 0x6b], 0xe5
mov byte [rsp + 0x6c], Ordinal_211
mov byte [rsp + 0x6d], 0x84
mov byte [rsp + 0x6e], Ordinal_200
mov byte [rsp + 0x6f], Ordinal_200
mov byte [rsp + 0x70], 0xd4
mov byte [rsp + 0x71], 0x82
mov byte [rsp + 0x72], 0xc0
mov byte [rsp + 0x73], 0xcd
mov byte [rsp + 0x74], Ordinal_211
mov byte [rsp + 0x75], 0xca
mov byte [rsp + 0x76], 0xc0
mov byte [rsp + 0x77], Ordinal_217
mov byte [rsp + 0x78], 0xdb
mov byte [rsp + 0x79], 0xdb
mov byte [rsp + 0x7a], 0x9c
mov byte [rsp + 0x7b], Ordinal_217
mov byte [rsp + 0x7c], 0xc2
mov byte [rsp + 0x7d], 0xdb
mov byte [rsp + 0x7e], Ordinal_217
mov byte [rsp + 0x7f], 0x9b
mov byte [rbp - 0x80], 0xdf
mov byte [rbp - 0x7f], Ordinal_200
mov byte [rbp - 0x7e], 0xdc
mov byte [rbp - 0x7d], Ordinal_217
mov byte [rbp - 0x7c], Ordinal_200
mov byte [rbp - 0x7b], __WSAFDIsSet
mov byte [rbp - 0x7a], 0xcc
mov byte [rbp - 0x79], 0xaf
mov byte [rbp - 0x78], 0xa5
mov byte [rbp - 0x77], 0xbf
mov byte [rbp - 0x76], 0xa0
mov byte [rbp - 0x75], 0xa4
mov byte [rbp - 0x74], 0xe1
mov byte [rbp - 0x73], 0xc4
movzx eax, byte [rsp + 0x50]
mov r9d, r15d
movabs rsi, 0x3d255fdba3aaef89
mov r10, rsi
lea rax, [rsp + 0x50]
sub r10, rax
mov ebx, reloc.WS2_32.dll_ntohs
nop dword [rax]
lea r8, [rsp + 0x50]
add r8, r9
mov rcx, r9
and ecx, ebx
cmp rcx, rbx
cmovae rcx, rbx
shl cl, 2
mov rdx, rsi
shr rdx, cl
and dl, bl
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x50], dl
inc r9
cmp r9, 0x3e
jb 0x140051050
lea rdx, [rsp + 0x50]
mov rcx, r11
call fcn.1400493c0
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x50], 4
mov byte [rsp + 0x51], Ordinal_50
mov byte [rsp + 0x52], 0x3f
mov byte [rsp + 0x53], Ordinal_41
mov byte [rsp + 0x54], Ordinal_46
mov byte [rsp + 0x55], 0x3f
mov byte [rsp + 0x56], Ordinal_50
mov byte [rsp + 0x57], 0x66
mov byte [rsp + 0x58], WSASetLastError
mov byte [rsp + 0x59], WSAStartup
mov byte [rsp + 0x5a], 0x64
mov byte [rsp + 0x5b], Ordinal_41
mov byte [rsp + 0x5c], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x5d], 0x3e
mov byte [rsp + 0x5e], Ordinal_41
mov byte [rsp + 0x5f], gethostname
mov byte [rsp + 0x60], Ordinal_35
mov byte [rsp + 0x61], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x62], WSAStartup
mov byte [rsp + 0x63], Ordinal_50
mov byte [rsp + 0x64], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x65], WSAStartup
mov byte [rsp + 0x66], WSASetLastError
mov byte [rsp + 0x67], 0x60
mov byte [rsp + 0x68], Ordinal_50
mov byte [rsp + 0x69], gethostname
mov byte [rsp + 0x6a], reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x6b], reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x6d], 0x24
mov byte [rsp + 0x6e], reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x6f], 6
mov byte [rsp + 0x70], 0x60
movzx eax, byte [rsp + 0x50]
mov r9, r15
movabs rdi, 0x793aff5aecb02f41
mov r10, rdi
lea rax, [rsp + 0x50]
sub r10, rax
nop
lea r8, [rsp + 0x50]
add r8, r9
mov rcx, r9
and ecx, ebx
cmp rcx, rbx
cmovae rcx, rbx
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, bl
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x50], dl
inc r9
cmp r9, 0x21
jb 0x140051160
lea rdx, [rsp + 0x50]
mov rcx, r11
call fcn.1400493c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x40], 0xc0
movzx eax, byte [rsp + 0x40]
movzx eax, byte [rsp + 0x40]
xor al, 0xc0
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x40]
call fcn.1400493c0
mov byte [rbp - 0x40], 0xfa
mov byte [rbp - 0x3f], 0xd5
mov byte [rbp - 0x3e], 0xa3
mov byte [rbp - 0x3d], 0xc9
mov byte [rbp - 0x3c], 0xa0
mov byte [rbp - 0x3b], 0xd4
mov byte [rbp - 0x3a], 0xb9
mov byte [rbp - 0x39], 0x62
mov byte [rbp - 0x38], WSASetLastError
mov byte [rbp - 0x37], 0x63
mov byte [rbp - 0x36], Ordinal_35
mov byte [rbp - 0x35], 0x45
mov byte [rbp - 0x34], 0x67
mov byte [rbp - 0x33], 0x67
mov byte [rbp - 0x32], 0x65
mov byte [rbp - 0x31], 0x78
mov byte [rbp - 0x30], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x2f], WSAStartup
mov byte [rbp - 0x2e], 0x61
mov byte [rbp - 0x2d], 0x7c
mov byte [rbp - 0x2c], 0x65
mov byte [rbp - 0x2b], 0x24
mov byte [rbp - 0x2a], 0x41
mov byte [rbp - 0x29], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x28], 0x75
mov byte [rbp - 0x27], 0x61
mov byte [rbp - 0x26], 0x77
mov byte [rbp - 0x25], 0x64
mov byte [rbp - 0x24], 0x3f
mov byte [rbp - 0x23], Ordinal_60
mov byte [rbp - 0x22], 0x7b
mov byte [rbp - 0x21], WSAStartup
mov byte [rbp - 0x20], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1f], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x1e], gethostname
mov byte [rbp - 0x1d], 0x79
mov byte [rbp - 0x1c], 0x7b
mov byte [rbp - 0x1b], 0x60
mov byte [rbp - 0x1a], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x19], 0x5f
mov byte [rbp - 0x18], ntohl
mov byte [rbp - 0x17], 0x55
mov byte [rbp - 0x16], 0x47
mov byte [rbp - 0x15], 0x44
mov byte [rbp - 0x14], 0x40
mov byte [rbp - 0x13], Ordinal_79
mov byte [rbp - 0x12], 0x50
mov byte [rbp - 0x11], ntohl
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 0xf], 0x46
mov byte [rbp - 0xe], 1
mov byte [rbp - 0xd], Ordinal_35
mov byte [rbp - 0xc], reloc.WS2_32.dll_listen
mov byte [rbp - 0xb], 0x7f
mov byte [rbp - 0xa], reloc.WS2_32.dll_socket
mov byte [rbp - 9], 0x60
mov byte [rbp - 8], Ordinal_30
mov byte [rbp - 7], 0x7b
mov byte [rbp - 6], 0x5d
mov byte [rbp - 5], 0x57
mov byte [rbp - 4], 0x5b
mov byte [rbp - 3], reloc.WS2_32.dll_select
mov byte [rbp - 2], 0x77
mov byte [rbp - 1], 0x54
mov byte [rbp], 0x55
mov byte [rbp + 1], 0x54
mov byte [rbp + 2], Ordinal_79
mov byte [rbp + 3], Ordinal_26
mov byte [rbp + 4], 0x4a
mov byte [rbp + 5], 0x5d
mov byte [rbp + 6], 0x41
mov byte [rbp + 7], 0x25
mov byte [rbp + 8], WSAGetLastError
mov byte [rbp + 9], 3
mov byte [rbp + 0xa], Ordinal_50
mov byte [rbp + 0xb], Ordinal_50
mov byte [rbp + 0xc], reloc.WS2_32.dll_gethostname
mov byte [rbp + 0xd], Ordinal_41
mov byte [rbp + 0xe], gethostname
mov byte [rbp + 0xf], WSAGetLastError
mov byte [rbp + 0x10], 0x68
mov byte [rbp + 0x11], Ordinal_45
mov byte [rbp + 0x12], Ordinal_41
mov byte [rbp + 0x13], Ordinal_46
mov byte [rbp + 0x14], Ordinal_41
mov byte [rbp + 0x15], 0x64
mov byte [rbp + 0x16], 0x24
mov byte [rbp + 0x17], Ordinal_60
mov byte [rbp + 0x18], Ordinal_41
mov byte [rbp + 0x19], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x1a], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp + 0x1b], 0x76
mov byte [rbp + 0x1c], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp + 0x1d], gethostname
mov byte [rbp + 0x1e], gethostname
mov byte [rbp + 0x1f], 0x33
mov byte [rbp + 0x20], 0x3f
mov byte [rbp + reloc.WLDAP32.dll_Ordinal_33], 0x21
mov byte [rbp + 0x22], 0x78
mov byte [rbp + 0x23], Ordinal_41
mov byte [rbp + 0x24], 0x3e
mov byte [rbp + 0x25], 0x7d
mov byte [rbp + 0x26], 0x75
mov byte [rbp + 0x27], Ordinal_60
mov byte [rbp + 0x28], 0x25
mov byte [rbp + reloc.WLDAP32.dll_Ordinal_41], 0x29
mov byte [rbp + 0x2a], Ordinal_41
mov byte [rbp + 0x2b], reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp + 0x2c], gethostname
mov byte [rbp + 0x2d], Ordinal_50
mov byte [rbp + 0x2e], 0x44
mov byte [rbp + 0x2f], 0x5d
mov byte [rbp + 0x30], 0x51
mov byte [rbp + 0x31], 0x44
mov byte [rbp + 0x32], 0x48
mov byte [rbp + 0x33], 0x62
mov byte [rbp + 0x34], Ordinal_79
mov byte [rbp + 0x35], 0x3f
mov byte [rbp + 0x36], 0x56
mov byte [rbp + 0x37], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp + 0x38], 0x5c
mov byte [rbp + 0x39], Ordinal_60
mov byte [rbp + 0x3a], Ordinal_30
mov byte [rbp + 0x3b], reloc.WS2_32.dll_socket
mov byte [rbp + 0x3c], reloc.WLDAP32.dll_Ordinal_27
mov byte [rbp + 0x3d], 0x52
mov byte [rbp + 0x3e], gethostname
mov byte [rbp + 0x3f], reloc.WS2_32.dll_sendto
mov byte [rbp + 0x40], reloc.WS2_32.dll_setsockopt
mov byte [rbp + 0x41], reloc.WS2_32.dll_sendto
mov byte [rbp + 0x42], ntohl
mov byte [rbp + 0x43], 0x58
mov byte [rbp + 0x44], 0xa
mov byte [rbp + 0x45], Ordinal_30
mov byte [rbp + 0x46], 1
mov byte [rbp + 0x47], 0xe5
mov byte [rbp + 0x48], 0xe3
mov byte [rbp + 0x49], 0xf2
mov byte [rbp + 0x4a], 0xf6
mov byte [rbp + 0x4b], 0xa6
mov byte [rbp + 0x4c], 0xcb
mov byte [rbp + 0x4d], 0xf0
mov byte [rbp + 0x4e], 0xed
mov byte [rbp + 0x4f], 0xfa
mov byte [rbp + 0x50], 0xe5
mov byte [rbp + 0x51], 0xf7
mov byte [rbp + 0x52], 0x82
mov byte [rbp + 0x53], 0xa8
mov byte [rbp + 0x54], 0xad
mov byte [rbp + 0x55], Ordinal_143
mov byte [rbp + 0x56], reloc.WLDAP32.dll_Ordinal_143
mov byte [rbp + 0x57], 0xbd
mov byte [rbp + 0x58], 0xa2
mov byte [rbp + 0x59], 0xb7
mov byte [rbp + 0x5a], 0x92
movzx eax, byte [rbp - 0x40]
mov r9, r15
movabs r11, 0x434a215ddaa043f9
mov r10, r11
lea rax, [rbp - 0x40]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rbp - 0x40]
add r8, r9
mov rcx, r9
and ecx, ebx
cmp rcx, rbx
cmovae rcx, rbx
shl cl, 2
mov rdx, r11
shr rdx, cl
and dl, bl
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x40], dl
inc r9
cmp r9, 0x9b
jb 0x140051460
lea rcx, [rbp - 0x40]
call fcn.14001f550
lea rdx, [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp - 0x50]
sub ecx, 1
je 0x1400514c9
cmp ecx, 1
jne 0x1400514ce
call fcn.14005af10
jmp 0x1400514ce
call fcn.140059fb0
lea rcx, [0x1400f3b70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14004e370
mov rcx, qword [0x1401c85f8]
call fcn.140059a60
lea rcx, [0x1401c8fd0]
call fcn.140002280
test al, al
je 0x140051a92
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x50], 0xd4
mov byte [rsp + 0x51], 0xea
mov byte [rsp + 0x52], 0xed
mov byte [rsp + 0x53], 0xf1
mov byte [rsp + 0x54], 0xa7
mov byte [rsp + 0x55], 0xe7
mov byte [rsp + 0x56], 0xe4
mov byte [rsp + 0x57], 0xff
mov byte [rsp + 0x58], 0xfb
mov byte [rsp + 0x59], 0xeb
mov byte [rsp + 0x5a], 0xbc
mov byte [rsp + 0x5b], 0xfc
mov byte [rsp + 0x5c], 0xf1
mov byte [rsp + 0x5d], 0xf0
mov byte [rsp + 0x5e], 0xff
mov byte [rsp + 0x5f], 0xbb
mov byte [rsp + 0x60], 0xf2
mov byte [rsp + 0x61], 0xeb
mov byte [rsp + 0x62], 0xb4
mov byte [rsp + 0x63], 0xe4
mov byte [rsp + 0x64], 0xfa
mov byte [rsp + 0x65], 0xf9
mov byte [rsp + 0x66], 0xf8
mov byte [rsp + 0x67], Ordinal_200
mov byte [rsp + 0x68], Ordinal_200
mov byte [rsp + 0x69], 0x81
mov byte [rsp + 0x6a], Ordinal_143
mov byte [rsp + 0x6b], 0xe5
mov byte [rsp + 0x6c], Ordinal_211
mov byte [rsp + 0x6d], 0x84
mov byte [rsp + 0x6e], Ordinal_200
mov byte [rsp + 0x6f], Ordinal_200
mov byte [rsp + 0x70], 0xd4
mov byte [rsp + 0x71], 0x82
mov byte [rsp + 0x72], 0xc0
mov byte [rsp + 0x73], 0xcd
mov byte [rsp + 0x74], Ordinal_211
mov byte [rsp + 0x75], 0xca
mov byte [rsp + 0x76], 0xc0
mov byte [rsp + 0x77], Ordinal_217
mov byte [rsp + 0x78], 0xdb
mov byte [rsp + 0x79], 0xdb
mov byte [rsp + 0x7a], 0x9c
mov byte [rsp + 0x7b], Ordinal_217
mov byte [rsp + 0x7c], 0xc2
mov byte [rsp + 0x7d], 0xdb
mov byte [rsp + 0x7e], Ordinal_217
mov byte [rsp + 0x7f], 0x9b
mov byte [rbp - 0x80], 0xdf
mov byte [rbp - 0x7f], Ordinal_200
mov byte [rbp - 0x7e], 0xdc
mov byte [rbp - 0x7d], Ordinal_217
mov byte [rbp - 0x7c], Ordinal_200
mov byte [rbp - 0x7b], __WSAFDIsSet
mov byte [rbp - 0x7a], 0xcc
mov byte [rbp - 0x79], 0xaf
mov byte [rbp - 0x78], 0xa5
mov byte [rbp - 0x77], 0xbf
mov byte [rbp - 0x76], 0xa0
mov byte [rbp - 0x75], 0xa4
mov byte [rbp - 0x74], 0xe1
mov byte [rbp - 0x73], 0xc4
movzx eax, byte [rsp + 0x50]
mov r9, r15
mov r10, rsi
lea rax, [rsp + 0x50]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x50]
add r8, r9
mov rcx, r9
and ecx, ebx
cmp rcx, rbx
cmovae rcx, rbx
shl cl, 2
mov rdx, rsi
shr rdx, cl
and dl, bl
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x50], dl
inc r9
cmp r9, 0x3e
jb 0x140051650
lea rdx, [rsp + 0x50]
mov rcx, r11
call fcn.1400493c0
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x50], 4
mov byte [rsp + 0x51], Ordinal_50
mov byte [rsp + 0x52], 0x3f
mov byte [rsp + 0x53], Ordinal_41
mov byte [rsp + 0x54], Ordinal_46
mov byte [rsp + 0x55], 0x3f
mov byte [rsp + 0x56], Ordinal_50
mov byte [rsp + 0x57], 0x66
mov byte [rsp + 0x58], WSASetLastError
mov byte [rsp + 0x59], WSAStartup
mov byte [rsp + 0x5a], 0x64
mov byte [rsp + 0x5b], Ordinal_41
mov byte [rsp + 0x5c], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x5d], 0x3e
mov byte [rsp + 0x5e], Ordinal_41
mov byte [rsp + 0x5f], gethostname
mov byte [rsp + 0x60], Ordinal_35
mov byte [rsp + 0x61], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x62], WSAStartup
mov byte [rsp + 0x63], Ordinal_50
mov byte [rsp + 0x64], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x65], WSAStartup
mov byte [rsp + 0x66], WSASetLastError
mov byte [rsp + 0x67], 0x60
mov byte [rsp + 0x68], Ordinal_50
mov byte [rsp + 0x69], gethostname
mov byte [rsp + 0x6a], reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x6b], reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x6d], 0x24
mov byte [rsp + 0x6e], reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x6f], 6
mov byte [rsp + 0x70], 0x60
movzx eax, byte [rsp + 0x50]
mov r9, r15
mov r10, rdi
lea rax, [rsp + 0x50]
sub r10, rax
nop word [rax + rax]
lea r8, [rsp + 0x50]
add r8, r9
mov rcx, r9
and ecx, ebx
cmp rcx, rbx
cmovae rcx, rbx
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, bl
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x50], dl
inc r9
cmp r9, 0x21
jb 0x140051760
lea rdx, [rsp + 0x50]
mov rcx, r11
call fcn.1400493c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x40], 0xc0
movzx eax, byte [rsp + 0x40]
movzx eax, byte [rsp + 0x40]
xor al, 0xc0
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x40]
call fcn.1400493c0
lea rcx, str._n_Driver_____driver_loaded._n
call fcn.14001f550
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401c9020], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401c9024], eax
cmp qword [0x1401c8488], 0
jne 0x140051890
nop word [rax + rax]
mov al, 0x7e
mov cl, 0x56
mov dl, 0x48
mov r8b, reloc.WLDAP32.dll_Ordinal_79
mov r9b, 0x52
mov r10b, 0x54
mov r11b, 0x4a
mov bl, 0x5a
mov dil, 0x60
mov sil, 0x61
xor r14d, r14d
xor al, 0x38
mov byte [rbp - 0x70], al
xor cl, 0x39
mov byte [rbp - 0x6f], cl
xor dl, 0x3a
mov byte [rbp - 0x6e], dl
xor r8b, 0x3b
mov byte [rbp - 0x6d], r8b
xor r9b, 0x3c
mov byte [rbp - 0x6c], r9b
xor r10b, 0x3d
mov byte [rbp - 0x6b], r10b
xor r11b, 0x3e
mov byte [rbp - 0x6a], r11b
xor bl, 0x3f
mov byte [rbp - 0x69], bl
xor dil, 0x40
mov byte [rbp - 0x68], dil
xor sil, 0x41
mov byte [rbp - 0x67], sil
mov byte [rbp - 0x66], r14b
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401c8488], rax
test rax, rax
je 0x140051810
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov ebx, r15d
cmp rax, 0xffffffffffffffff
je 0x140051930
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x40], 0x238
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140051927
lea rdx, [rbp - 0x14]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400518ee
mov ebx, dword [rbp - 0x38]
jmp 0x140051927
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140051927
nop
lea rdx, [rbp - 0x14]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
cmove ebx, dword [rbp - 0x38]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140051900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov qword [0x1401c8398], rax
mov edx, ebx
lea rcx, [0x1401c8fd0]
call fcn.140002050
test al, al
je 0x14005197d
xor edx, edx
lea rcx, [0x1401c8fd0]
call fcn.140001fa0
mov qword [0x1401c8fe0], rax
test rax, rax
je 0x140051a92
lea rcx, [0x1401c8fd0]
call fcn.1400021e0
test al, al
je 0x140051a92
mov rcx, qword [0x1401c8fe0]
mov qword [0x1401c8390], rcx
mov rbx, r15
mov edi, Ordinal_26
nop dword [rax]
nop word [rax + rax]
lea rdx, [rcx + 0x250]
add rdx, rbx
mov dword [rbp - 0x70], r15d
mov r9d, 4
lea r8, [rbp - 0x70]
lea rcx, [0x1401c8fd0]
call fcn.140002130
add rbx, 0x1000
mov rcx, qword [0x1401c8390]
cmp dword [rbp - 0x70], 0x6f41c00
jne 0x1400519ec
lea rax, [rcx + 0x11ecd148]
add rax, rbx
mov qword [0x1401c8430], rax
sub rdi, 1
jne 0x1400519a0
test rcx, rcx
jne 0x140051a2d
lea rdx, str.0x0_failure_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400493c0
lea rdx, [0x14004b580]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._________.sys_is_not_loaded_in_your_system_________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400493c0
mov ecx, 1
call fcn.1400c8004
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14004aa00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140051ac9
cmp dword [rsp + 0x58], 0
je 0x140051abe
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140051abe
mov rcx, qword [0x1401c85b0]
call fcn.1400507d0
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400c7a00
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x58], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140052ac0
int3