Function at 0x140011920
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1400e5080]
xor rax, rsp
mov qword [rbp + 0x40], rax
lea rdx, str._n_n_Connecting..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
lea rcx, [0x14019e310]
call fcn.140064830
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp byte [0x14019e520], 0
jne 0x1400119ad
lea rdx, str._n_Status:
call fcn.1400136d0
mov rcx, rax
lea rdx, [0x14019e528]
call fcn.140013e20
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str._n_n_Welcome_To_Cloud.Win_Products_:
call fcn.1400136d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d34b0]
movdqu xmmword [rbp + 0x20], xmm1
mov byte [rbp + 0x10], 0
lea rdx, str._n_Enter_license:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
lea rdx, [rbp + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140013e40
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140012d40
mov rdx, rax
lea rcx, [0x14019e310]
call fcn.140066110
cmp byte [0x14019e520], 0
jne 0x140011a50
lea rdx, str._n_Status:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov rcx, rax
lea rdx, [0x14019e528]
call fcn.140013e20
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140011a8b
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001227a
call fcn.1400ba040
lea rcx, str.cloudproject
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.color_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor ebx, ebx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], bl
lea rdx, str._n_Do_you_want_to_load_The_cheat_driver____y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
lea rdx, [rbp + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140013e40
lea rcx, [rbp + 0x10]
mov rsi, qword [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 0x10
cmovae rcx, rsi
mov rdi, qword [rbp + 0x20]
cmp rdi, 1
jne 0x140011b11
mov r8, rdi
lea rdx, [0x1400ce6a4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140011b88
lea rcx, [rbp + 0x10]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, 1
jne 0x140011b36
mov r8, rdi
lea rdx, [0x1400ce190]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140011b88
lea rcx, [rbp + 0x10]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, 3
jne 0x140011b5b
mov r8, rdi
lea rdx, [0x1400ce6a8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140011b88
lea rcx, [rbp + 0x10]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, 3
jne 0x140011e3e
mov r8, rdi
lea rdx, [0x1400ce6ac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011e3e
movdqa xmm0, xmmword [0x1400d3a60]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400d3a10]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400d3a20]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400d3b20]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400d3ac0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [str.a_ejjcmonjoXN]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400d3510]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400d3bc0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1400d3be0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400d3550]
movdqa xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 1
mov rcx, rbx
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x9f
jb 0x140011c14
mov byte [rbp - 0x10], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d3a60]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400d3a10]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400d3a20]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400d3b20]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400d3ac0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [str.dc_l_bikjgoXNe]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400d3570]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400d3bf0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1400d3bd0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400d3bb0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1400d3ba0]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0xd68996c6
mov dword [rbp + 4], 0x8e9bd6cc
mov dword [rbp + 8], 0x8e9883
mov byte [rbp + 0xc], 1
mov rcx, rbx
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xbb
jb 0x140011ce4
mov byte [rbp + 0xc], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d3ab0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x75726266
mov dword [rsp + 0x44], 0x47282a
mov byte [rsp + 0x48], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x17
jb 0x140011d30
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x20], 0x746a66
mov byte [rsp + 0x24], 1
mov rcx, rbx
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 3
jb 0x140011d60
mov byte [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d3b00]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400d3a30]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400d39c0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400d35c0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [str.7_1__]
movdqa xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x60], Ordinal_41
mov byte [rbp - 0x5e], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x51
jb 0x140011de0
mov byte [rbp - 0x5e], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x20], 0x746a66
mov byte [rsp + 0x24], 1
mov rcx, rbx
nop
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 3
jb 0x140011e10
mov byte [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
lea ecx, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str._n_n__Loading...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0x7d686a46
mov dword [rsp + 0x24], 0x63795a6d
mov dword [rsp + 0x28], 0x646c6b67
mov word [rsp + 0x2c], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xc
jb 0x140011e80
mov byte [rsp + 0x2d], 0
movdqa xmm0, xmmword [0x1400d3ad0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1007270
mov rcx, rbx
nop
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x140011eb0
mov byte [rsp + 0x43], 0
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Searching_for_Medal
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
movdqa xmm0, xmmword [0x1400d3a40]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x43
mov byte [rsp + 0x42], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x20]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x140011f30
mov byte [rsp + 0x42], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140012029
movdqa xmm0, xmmword [0x1400d3af0]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d3a00]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0x840484c
mov dword [rbp + 0x34], 0xc4e425d
mov dword [rbp + 0x38], 0x514a464e
mov word [rbp + 0x3c], 0x45
mov byte [rbp + 0x3e], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 5]
xor byte [rbp + rbx + 0x10], al
inc rbx
cmp rbx, 0x2d
jb 0x140011fa0
mov byte [rbp + 0x3e], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
cmp r14, 0x10
jb 0x140011ffe
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140011ff6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001227a
mov rcx, rsi
call fcn.1400ba040
xor eax, eax
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400ba020
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Medal_Found
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Waiting_for_Fortnite
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
lea rdx, [0x140014050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rsp + 0x20], 0x7c756943
mov dword [rsp + 0x24], 0x697f6367
mov dword [rsp + 0x28], 0x1002e2d
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x1400120b0
mov byte [rsp + 0x2b], 0
mov dword [rsp + 0x30], 0x6d756850
mov dword [rsp + 0x34], 0x655c6668
mov dword [rsp + 0x38], 0x67606a63
mov word [rsp + 0x3c], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x1400120f0
mov byte [rsp + 0x3d], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140012090
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Found_Fortnite_Loading
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Press_F8_to_Inject._Do_this_in_the_main_lobby.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140012174
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140011150
test al, al
jne 0x1400121dd
lea rcx, [0x1400ce3ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_n__Loading_error_1___contact_support
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400136d0
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140007510]
call fcn.140010ef0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14019dd8c], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov dword [0x14019dd74], eax
mov eax, dword [0x14019dd8c]
cdq
sub eax, edx
sar eax, 1
mov dword [0x14019dd3c], eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [0x14019dd20], eax
call fcn.140001550
call fcn.1400108d0
call fcn.1400103f0
call fcn.140001980
nop
cmp r14, 0x10
jb 0x140011ffe
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140011ff6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ff6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3