Function at 0x140002960
Capabilities:
Delete file
Encode data using xor
Enumerate gui resources
Enumerate processes
Execute command
Generate random numbers using a mersenne twister
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.1400696c0
sub rsp, rax
mov rax, qword [0x140087080]
xor rax, rsp
mov qword [rbp + 0x12e0], rax
lea rcx, [0x1400a06d0]
call fcn.14000e9b0
lea rcx, [0x1400a06d0]
call fcn.14000f780
lea rcx, [0x14007b428]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400a06d0]
call fcn.14000e9b0
lea rcx, [0x1400a06d0]
call fcn.14000f780
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x20]
call fcn.140069000
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], Ordinal_32
mov qword [rsp + 0x48], Ordinal_32
movups xmm0, xmmword [str.C:WindowsRzChromaSDK64.dll]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14007b418]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14007b420]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], r14b
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400040d0
nop
mov r8d, 0x18670
lea rdx, [0x140087100]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rsp + 0x58]
call fcn.1400048c0
test rax, rax
jne 0x140002ac6
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea edx, [r14 + 2]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.140002830
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002b11
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006927c
lea rcx, [0x14007b428]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.______________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._____________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b5c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b6e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._______________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b7a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b800]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b860]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b8c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.______________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.________________________________________________Start_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007b9e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.____________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.___________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.____________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007bbc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, [0x14007bc20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.__________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.___________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str._____________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140004d30
mov edi, 1
cmp qword [0x1400a06c8], 0
jne 0x140002fcf
nop dword [rax]
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140003249
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002f7c
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002f7c
nop dword [rax]
lea rdx, [0x14007be00]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14000322e
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002f50
mov ecx, r14d
mov eax, ecx
mov qword [0x1400a06c0], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], ecx
lea rdx, [rsp + 0x30]
lea rcx, [0x1400028f0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14000323d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14000323d
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14000323d
mov qword [0x1400a06c8], rax
lea rcx, [0x14007b428]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140001b80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n__X_
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140001b50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Loading
call fcn.140004d30
mov esi, r14d
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edi
mov dword [rsp + rdi*4 + 0x54], eax
inc rdi
cmp rdi, 0x270
jb 0x140003040
mov dword [rsp + 0x50], 0x270
lea rcx, [rsp + 0x50]
call fcn.140005670
mov ecx, eax
imul rbx, rcx, 0x1389
cmp ebx, 0xd92
ja 0x14000309d
lea rcx, [rsp + 0x50]
call fcn.140005670
mov ecx, eax
imul rbx, rcx, 0x1389
cmp ebx, 0xd93
jb 0x140003082
shr rbx, 0x20
add ebx, 0x7530
nop word [rax + rax]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140004f00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc esi
sub ebx, 0x7d0
cmp esi, 0xa
je 0x1400030ef
test ebx, ebx
jg 0x1400030b0
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov esi, r14d
test ebx, ebx
jg 0x1400030b0
lea rcx, [0x14007b428]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_SubZero_Private
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140001b80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14007be74]
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140001bb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.discord.gg_subz
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140001b80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14007be74]
call fcn.140004d30
mov rcx, rax
lea rdx, [0x140001b20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.t.me_subzerocheats
call fcn.140004d30
lea rdx, str._n_n_Successfully_Injected._Press_F5_after_you_close_game_to_fully_unload_cheat.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
mov ebx, 0x8001
nop word [rax + rax]
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1400031d0
lea rcx, [0x14007b428]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Cleaning_up...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d30
lea rcx, str.C:WindowsRzChromaSDK64.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x58]
jmp 0x140002f7f
mov qword [0x1400a06c8], r14
jmp 0x140002ef0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3