Function at 0x408ce0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434960
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x44c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d4], edx
mov eax, ecx
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp + 0xc]
push eax
push 0
push 0x1000
mov dword [ebp - 0x2d0], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2b8], esi
test esi, esi
je 0x4098b6
lea eax, [ebp - 0x280]
mov dword [ebp - 0x280], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4098af
cmp dword [0x44e234], 0
jne 0x408d78
cmp dword [ebp - 0x280], 0
je 0x4098af
push 0x206
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00419020
add esp, 0xc
mov dword [ebp - 0x280], 0x104
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov eax, dword [ebp - 0x280]
inc eax
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00420573
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00418c8e
mov edi, eax
add esp, 0x10
test edi, edi
je 0x409104
add edi, 2
lea edx, [ebp - 0x218]
mov ecx, edi
call fcn.004071f0
test eax, eax
jne 0x409104
mov ecx, edi
call fcn.00408190
test eax, eax
je 0x409104
mov ecx, 0x43dbf0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408e3b
test dx, dx
je 0x408e37
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408e3b
add eax, 4
add ecx, 4
test dx, dx
jne 0x408e15
xor esi, esi
jmp 0x408e40
sbb esi, esi
or esi, 1
push str.fortniteclient_win64_shipping
push edi
call fcn.00418a2e
add esp, 8
test eax, eax
setne cl
test esi, esi
sete al
or cl, al
mov eax, edi
mov byte [ebp - 0x2c1], cl
mov ecx, str.tl.exe
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408e95
test dx, dx
je 0x408e89
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408e95
add eax, 4
add ecx, 4
test dx, dx
jne 0x408e67
mov dword [ebp - 0x27c], 0
jmp 0x408ea0
sbb edx, edx
or edx, 1
mov dword [ebp - 0x27c], edx
mov ecx, str.aces.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408ed5
test dx, dx
je 0x408ec9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408ed5
add eax, 4
add ecx, 4
test dx, dx
jne 0x408ea7
mov dword [ebp - 0x2cc], 0
jmp 0x408ee0
sbb edx, edx
or edx, 1
mov dword [ebp - 0x2cc], edx
mov ecx, str.hunt.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f15
test dx, dx
je 0x408f09
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f15
add eax, 4
add ecx, 4
test dx, dx
jne 0x408ee7
mov dword [ebp - 0x2b4], 0
jmp 0x408f20
sbb edx, edx
or edx, 1
mov dword [ebp - 0x2b4], edx
mov ecx, str.r5apex.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f55
test dx, dx
je 0x408f49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f55
add eax, 4
add ecx, 4
test dx, dx
jne 0x408f27
mov dword [ebp - 0x2c0], 0
jmp 0x408f60
sbb edx, edx
or edx, 1
mov dword [ebp - 0x2c0], edx
mov ecx, str.eldenring.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f95
test dx, dx
je 0x408f89
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f95
add eax, 4
add ecx, 4
test dx, dx
jne 0x408f67
mov dword [ebp - 0x2bc], 0
jmp 0x408fa0
sbb edx, edx
or edx, 1
mov dword [ebp - 0x2bc], edx
mov ecx, str.deadbydaylight.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408fd5
test dx, dx
je 0x408fc9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408fd5
add eax, 4
add ecx, 4
test dx, dx
jne 0x408fa7
mov dword [ebp - 0x284], 0
jmp 0x408fe0
sbb edx, edx
or edx, 1
mov dword [ebp - 0x284], edx
mov ecx, str.discovery.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409015
test dx, dx
je 0x409009
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409015
add eax, 4
add ecx, 4
test dx, dx
jne 0x408fe7
mov dword [ebp - 0x2d8], 0
jmp 0x409020
sbb edx, edx
or edx, 1
mov dword [ebp - 0x2d8], edx
mov ecx, str.eldenring.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40904d
test dx, dx
je 0x409049
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40904d
add eax, 4
add ecx, 4
test dx, dx
jne 0x409027
xor esi, esi
jmp 0x409052
sbb esi, esi
or esi, 1
mov ecx, str.eldenring.exe
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409086
test dx, dx
je 0x409082
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409086
add eax, 4
add ecx, 4
test dx, dx
jne 0x409060
xor eax, eax
jmp 0x40908b
sbb eax, eax
or eax, 1
test eax, eax
mov edx, 1
sete cl
test esi, esi
sete al
or cl, al
cmp dword [ebp - 0x2d8], 0
movzx ecx, cl
cmove ecx, edx
cmp dword [ebp - 0x284], 0
sete al
or cl, al
cmp dword [ebp - 0x2bc], 0
movzx ecx, cl
cmove ecx, edx
cmp dword [ebp - 0x2c0], 0
sete al
or cl, al
cmp dword [ebp - 0x2b4], 0
movzx ecx, cl
cmove ecx, edx
cmp dword [ebp - 0x2cc], 0
sete al
or cl, al
cmp dword [ebp - 0x27c], 0
movzx eax, cl
cmove eax, edx
or byte [ebp - 0x2c1], al
mov eax, 0
cmovne edi, eax
jmp 0x409106
xor edi, edi
xor esi, esi
cmp dword [0x44e234], esi
jne 0x409178
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x27c], esi
push eax
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x409165
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.IsWow64Process_error
mov eax, dword [eax + 0x1c]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
push dword [ebp - 0x2b8]
jmp 0x4098b0
xor eax, eax
cmp dword [ebp - 0x27c], eax
sete al
mov dword [ebp - 0x27c], eax
mov esi, eax
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4098b6
mov ecx, str.forzahorizon4.exe
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4091b9
test dx, dx
je 0x4091b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4091b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x409193
xor eax, eax
jmp 0x4091be
sbb eax, eax
or eax, 1
test eax, eax
je 0x409209
mov ecx, str.forzahorizon5.exe
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4091f6
test dx, dx
je 0x4091f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4091f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4091d0
xor eax, eax
jmp 0x4091fb
sbb eax, eax
or eax, 1
mov dword [ebp - 0x2b4], 0
test eax, eax
jne 0x409213
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x27c], 0
mov ecx, str.applicationframehost.exe
mov dword [ebp - 0x2cc], 0
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409256
test dx, dx
je 0x409252
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409256
add eax, 4
add ecx, 4
test dx, dx
jne 0x409230
xor eax, eax
jmp 0x40925b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4092b6
mov eax, dword [0x44e4b8]
mov ecx, 0x44c958
mov esi, dword [ebp - 0x2c8]
push str.Set_App_frame_host_process_id_
mov dword [eax + 0x10], esi
mov eax, dword [vtable.CDebugPrint.0]
mov eax, dword [eax + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, eax
call fcn.00408c80
jmp 0x4098b6
push esi
mov esi, dword [ebp - 0x2c8]
lea eax, [ebp - 0x2cc]
push eax
lea edx, [ebp - 0x27c]
mov ecx, esi
call fcn.00408690
add esp, 8
test eax, eax
je 0x4093cd
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x27c]
test ecx, ecx
je 0x4092ee
mov dword [ecx], eax
cmp dword [ebp - 0x2cc], 0
je 0x4098b6
test eax, eax
jne 0x4098a8
cmp dword [ebp - 0x2b4], eax
jne 0x4093cd
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.Injection_attempt__
mov eax, dword [eax + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
mov ecx, eax
push 0x43de38
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
mov esi, dword [ebp - 0x2c8]
mov ecx, esi
call fcn.00407f70
test eax, eax
jne 0x409841
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.Injection_failed__
mov eax, dword [eax + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
mov ecx, eax
push 0x43de38
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
xor dl, dl
mov ecx, edi
call fcn.00407dc0
mov esi, dword [ebp - 0x2c8]
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.Hooking_attempt____
mov eax, dword [eax + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
mov ecx, eax
push 0x43de38
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
push 0x28
call fcn.004173ce
mov esi, dword [ebp - 0x2c8]
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], eax
movups xmmword [eax + 0x10], xmm0
lea ecx, [eax + 0x10]
xor edx, edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], dx
mov edx, dword [ebp - 0x2d4]
push edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
call fcn.00406090
push esi
push str.FPSMonitor_DLL_Attached__d
call fcn.00405320
add esp, 8
lea ecx, [ebp - 0x2b0]
push eax
call fcn.00404ac0
push 0x5c
lea eax, [ebp - 0x274]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00419020
add esp, 0xc
mov dword [ebp - 0x2b4], 0
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x288], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x288]
mov word [ebp - 0x284], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x2c0]
mov esi, dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
push eax
push str.S_1_15_2_1
call esi
lea eax, [ebp - 0x2bc]
push eax
push str.S_1_15_2_2
call esi
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x2b8]
push eax
push 0
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], 0xc0100000
push eax
push 3
mov dword [ebp - 0x274], 2
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 5
mov dword [ebp - 0x258], 0xc0100000
mov dword [ebp - 0x254], 2
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 5
mov dword [ebp - 0x238], 0xc0100000
mov dword [ebp - 0x234], 2
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 5
mov dword [ebp - 0x2b8], 0
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [ebp - 0x2b8]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x2b8]
test eax, eax
je 0x409627
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x29c], 7
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x28c], 0xc
cmova eax, dword [ebp - 0x2b0]
push eax
push 0
push 1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x288], esi
movq xmm0, qword [ebp - 0x28c]
push eax
movq qword [ebp - 0x298], xmm0
mov dword [ebp - 0x290], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [ebp - 0x2d0]
push 0x43db50
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 0x27c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2d0], eax
test esi, esi
jne 0x409713
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.DirectInjector:
mov dword [0x44cba0], 2
mov edx, dword [edx + 0x1c]
call edx
mov ecx, eax
push str._Failed
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push str.GetModuleHandle
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push 0x43ccbc
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
push dword [ebp - 0x2d0]
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x2d4]
test eax, eax
jne 0x409797
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.DirectInjector:
mov dword [0x44cba0], 2
mov edx, dword [edx + 0x1c]
call edx
mov ecx, eax
push str._Failed
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push str.thread_id
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push 0x43ccbc
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
mov eax, dword [ebp - 0x2d4]
push eax
push dword [ebp - 0x27c]
push dword [sym.imp.fps_mon32.dll_long_int___stdcall_procHookGetMessage_int__unsigned_int__long_int_]
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 0xc], 0
mov esi, eax
jne 0x40982f
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str.DirectInjector:
mov dword [0x44cba0], 2
mov edx, dword [edx + 0x1c]
call edx
mov ecx, eax
push str._Failed
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push str.SetWindowsHookEx
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push 0x43ccbc
mov edx, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
push esi
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
cmp dword [edi + 0xc], 0
je 0x409851
push edi
push 0
push 0x4098e0
call fcn.00420a42
add esp, 0xc
jmp 0x40986c
mov dl, 1
mov ecx, edi
call fcn.00407dc0
mov eax, 1
jmp 0x4098b8
mov eax, dword [edi]
test eax, eax
je 0x409864
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
mov ecx, edi
call fcn.004099c0
mov ecx, dword [ebp - 0x29c]
cmp ecx, 7
jbe 0x4098a8
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40989e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098d3
push ecx
push edx
call fcn.0041739d
add esp, 8
mov eax, 1
jmp 0x4098b8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041713e
mov esp, ebp
pop ebp
ret
call fcn.0041b1e4
int3