Function at 0x1400574b0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14006c010]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor r12d, r12d
mov byte [rsp + 0x40], r12b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003b80
cmp qword [rax + 0x18], 0x10
jb 0x14005750a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140057552
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005754d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005754d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400598a4
mov rax, qword [0x14006dcb8]
test rax, rax
jne 0x140057625
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r15, rbx
nop dword [rax]
mov r11, qword [rbx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140057609
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140057609
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0xf2e26a4b
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140057604
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x1400575d0
cmp r9d, 0x68d21cee
je 0x140057700
test r10d, r10d
jne 0x1400575b0
mov rbx, qword [rbx]
cmp rbx, r15
je 0x14005761b
cmp qword [rbx + 0x30], r12
jne 0x140057580
mov rax, r12
mov qword [0x14006dcb8], rax
mov ecx, 0x3e8
call rax
call fcn.140049b10
mov rax, qword [0x14006d758]
test rax, rax
jne 0x140057793
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x14006dce0]
test rax, rax
jne 0x14005773a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1400576f8
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1400576f8
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x8a05c0bf
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1400576f3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x1400576c0
cmp r10d, 0x5eb3cf02
je 0x14005771c
test r11d, r11d
jne 0x1400576a0
mov rax, qword [rax]
jmp 0x140057671
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, r11
jmp 0x14005761e
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x14006dce0], rax
mov ecx, 0x32
call rax
mov dword [rbp - 0x70], 0x8d8a98b0
mov dword [rbp - 0x6c], 0x98889294
mov dword [rbp - 0x68], 0x100dfde
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0xa]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xa
jb 0x140057760
mov byte [rbp - 0x65], r12b
mov rax, qword [0x14006d750]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call rax
mov qword [0x14006d758], rax
test rax, rax
je 0x140057650
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x58]
sub eax, dword [rbp - 0x60]
mov dword [0x14006d7d8], eax
mov eax, dword [rbp - 0x54]
sub eax, dword [rbp - 0x5c]
mov dword [0x14006d7dc], eax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [0x140062988]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14006d7c8], rax
test rax, rax
je 0x1400577f5
cmp rax, 0xffffffffffffffff
jne 0x140057813
lea rdx, str._nfailed_to_find_driver
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140058a60
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x58], r12
mov ecx, 0x30
call fcn.140059610
mov rsi, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x21
mov qword [rbp - 0x48], 0x2f
movups xmm0, xmmword [str.FortniteClient_Win64_Shipping.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140062cf0]
movups xmmword [rax + 0x10], xmm1
movzx eax, byte [0x140062d00]
mov byte [rsi + 0x20], al
mov byte [rsi + 0x21], r12b
mov dword [rbp - 0x40], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140057903
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rbp - 0x14]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140057892
jmp 0x1400578c9
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400578fa
lea rax, [rbp - 0x14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400578c0
mov r8d, 0x21
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp - 0x14]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14005789d
cmp rbx, 0x21
jne 0x14005789d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x38]
jmp 0x140057906
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r12d
mov edx, 0x30
mov rcx, rsi
call fcn.1400598a4
mov qword [rbp - 0x70], r12
mov dword [rsp + 0x70], 0xb62eac52
mov dword [rsp + 0x74], ebx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, [rsp + 0x70]
mov edx, 0x221ddc
mov rcx, qword [0x14006d7c8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x70]
mov qword [0x14006d738], rax
lea rdx, str._nbase_addr:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140058a60
mov rdx, qword [0x14006d738]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov r15, rdi
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x140057a39
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x140057a39
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x217f0f04
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140057a34
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140057a00
cmp r9d, 0xa66ba920
je 0x140057bc1
test r10d, r10d
jne 0x1400579e0
mov rdi, qword [rdi]
cmp rdi, r15
je 0x140057a4b
cmp qword [rdi + 0x30], r12
jne 0x1400579b0
mov r8, r12
mov edx, 0xc8
mov ecx, edx
call r8
call fcn.140055a50
test al, al
jne 0x140057bfb
mov r10, qword [0x14006dd80]
test r10, r10
jne 0x140057b35
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov r15, rdi
nop dword [rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x140057b19
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x140057b19
mov r14d, dword [rbx + 0x20]
nop word [rax + rax]
dec r10d
lea rax, [r14 + r10*4]
mov r8d, dword [rax + r11]
add r8, r11
mov r9d, 0x3dca5e43
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140057b14
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx edx, byte [r8]
lea r8, [r8 + 1]
test dl, dl
jne 0x140057ae0
cmp r9d, 0xc3ad9582
je 0x140057bde
test r10d, r10d
jne 0x140057ac0
mov rdi, qword [rdi]
cmp rdi, r15
je 0x140057b2b
cmp qword [rdi + 0x30], r12
jne 0x140057a90
mov r10, r12
mov qword [0x14006dd80], r10
mov dword [rsp + 0x44], 0x968a8593
mov word [rsp + 0x48], 0x88
mov byte [rsp + 0x4a], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0xa]
xor byte [rsp + rcx + 0x44], al
inc rcx
cmp rcx, 5
jb 0x140057b50
mov byte [rsp + 0x4a], r12b
movdqa xmm0, xmmword [0x140063500]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x67617026
mov dword [rbp - 0x7c], 0x237b646e
mov word [rbp - 0x78], pe_nt_image_headers64
nop word [rax + rax]
lea eax, [r12 - 0xa]
xor byte [rsp + r12 + 0x70], al
inc r12
cmp r12, 0x18
jb 0x140057b90
mov byte [rbp - 0x77], 0
mov r9d, 0x10
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call r10
jmp 0x140057d13
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rsi + 0x24]
add rax, r11
movzx eax, word [rax + r10*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
jmp 0x140057a4e
mov ecx, dword [rbx + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
jmp 0x140057b2e
mov rcx, qword [0x14006dc40]
sub rcx, qword [0x14006dc30]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x2000
jae 0x140057c32
call fcn.140058060
mov ecx, 8
call fcn.140059610
lea rcx, [0x140055d10]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400593f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140057d6e
cmp dword [rsp + 0x68], 0
je 0x140057d62
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140057d62
lea ecx, [rax + 8]
call fcn.140059610
lea rcx, [0x140056260]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400593f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140057d51
cmp dword [rsp + 0x58], 0
je 0x140057d45
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140057d45
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400594d0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x58], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3