Function at 0x140033b00
Capabilities:
Create thread
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140043010]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140033b9d
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140033b9d
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140033c66
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140033c0c
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140033c0c
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x14003c5c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
je 0x140033c66
movups xmm0, xmmword [rbx]
movups xmmword [0x140044268], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [0x140044278], xmm1
mov eax, dword [rbx + 0x18]
mov dword [0x140044280], eax
movzx eax, word [rbx + 0x1c]
mov word [0x140044284], ax
movups xmm0, xmmword [r8]
movups xmmword [0x140044288], xmm0
movsd xmm1, qword [r8 + 0x10]
movsd qword [0x140044298], xmm1
mov eax, dword [r8 + 0x18]
mov dword [0x1400442a0], eax
movzx eax, word [r8 + 0x1c]
mov word [0x1400442a4], ax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140032630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [0x140044140], rdi
jne 0x140033ced
nop
mov dword [rbp + 0x17], 0x9f9886ae
mov dword [rbp + 0x1b], 0x8a9a8482
mov word [rbp + 0x1f], 0xd1d0
xor eax, eax
mov byte [rbp + 0x21], al
mov rdx, rdi
nop dword [rax]
lea ecx, [rax - 0x18]
xor byte [rbp + rdx + 0x17], cl
inc eax
movsxd rdx, eax
cmp rdx, 0xa
jb 0x140033cb0
mov byte [rbp + 0x21], dil
lea rdx, [rbp + 0x17]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140044140], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140044140], rdi
je 0x140033c90
mov qword [rbp + 0x2f], rdi
mov ecx, 0x30
call fcn.140036b0c
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], 0x21
mov qword [rbp + 0x3f], 0x2f
movups xmm0, xmmword [str.FortniteClient_Win64_Shipping.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14003c8b0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14003c8c0]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], dil
lea rcx, [rbp + 0x27]
call fcn.140033950
mov dword [0x140044110], eax
mov ecx, 0x10
call fcn.140036b0c
mov rbx, rax
mov qword [rbp + 0x17], rax
mov ecx, dword [0x140044110]
mov dword [rax + 8], ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..githubpastadriverbyzyko
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx], rax
mov qword [0x140044188], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x3f], 0xf
mov ecx, 0x30
call fcn.140036b0c
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], 0x21
mov qword [rbp + 0x3f], 0x2f
movups xmm0, xmmword [str.FortniteClient_Win64_Shipping.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14003c8b0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14003c8c0]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], dil
lea rdx, [rbp + 0x27]
call fcn.1400319d0
mov qword [0x140044138], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140033e31
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033e2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033e2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140036a94
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140033fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [rbp - 0x35], edi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 1], rdi
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbp - 9], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp - 0x11], rax
mov qword [rbp - 0x21], rdi
lea rax, [0x140035dd0]
mov qword [rbp - 0x31], rax
lea rsi, str.Zyko5528
mov qword [rbp + 7], rsi
mov dword [rbp - 0x39], 3
lea rcx, [rbp - 0x39]
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x140033eb6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140036300
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140044238], rax
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14003c438]
mov rcx, qword [0x140044238]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, qword [0x140044238]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140044238]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.1400340b0
call fcn.1400359f0
mov rcx, qword [0x140044090]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140044260]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140044120]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140044238]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140036670
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret