Function at 0x14001f520
Capabilities:
Create thread
Encode data using xor
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140063040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x17], 0x85938681
mov dword [rbp + 0x1b], 0x9fd4cbcb
mov dword [rbp + 0x1f], 0x1009190
xor ecx, ecx
lea eax, [rcx - 0xc]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 0xa
jb 0x14001f560
mov byte [rbp + 0x22], 0
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
movdqa xmm0, xmmword [0x14005aeb0]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0x1007677
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0x12
jb 0x14001f5a0
mov byte [rbp - 0x66], 0
xor edx, edx
lea rcx, [rbp - 0x79]
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140004920
call sym.Cherche.exe_interception_create_context
mov qword [0x140118ca0], rax
mov r8d, 0x1000
lea rdx, [sym.Cherche.exe_interception_is_mouse]
mov rcx, rax
call sym.Cherche.exe_interception_set_filter
mov edx, 0xffffffff
mov rcx, qword [0x140118ca0]
call sym.Cherche.exe_interception_wait_with_timeout
mov dword [0x140118ca8], eax
mov edx, 0xffffffff
mov rcx, qword [0x140118ca0]
call sym.Cherche.exe_interception_wait_with_timeout
mov dword [0x140118ca8], eax
mov r9d, 1
lea r8, [0x140118cb0]
mov edx, eax
mov rcx, qword [0x140118ca0]
call sym.Cherche.exe_interception_receive
test eax, eax
jle 0x14001f698
nop
mov edx, dword [0x140118ca8]
lea eax, [rdx - 0xb]
mov rcx, qword [0x140118ca0]
cmp eax, 9
jbe 0x14001f686
mov edx, 0xffffffff
call sym.Cherche.exe_interception_wait_with_timeout
mov dword [0x140118ca8], eax
mov r9d, 1
lea r8, [0x140118cb0]
mov edx, eax
mov rcx, qword [0x140118ca0]
call sym.Cherche.exe_interception_receive
test eax, eax
jg 0x14001f640
jmp 0x14001f698
mov r9d, 1
lea r8, [0x140118cb0]
call sym.Cherche.exe_interception_send
mov ecx, 1
call fcn.140051cd0
mov qword [rbp + 0x17], rax
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400219a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14001fb3f
cmp dword [rbp - 0x71], 0
je 0x14001fb33
movaps xmm0, xmmword [rbp - 0x79]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001fb33
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x79], xmm0
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140113810], rax
test rax, rax
jne 0x14001f762
mov r9d, 0x20
lea r8, str.PRESS_OK_IN_LOBBY
lea rdx, str.Waiting_For_Fortnite...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140113810], rax
test rax, rax
je 0x14001f720
lea rdx, [0x140113790]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rcx, [0x14001e7a0]
call fcn.14001e4f0
mov ecx, 0x28
call fcn.140051cd0
mov r10, rax
mov qword [rbp + 0x17], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r10], xmm0
movups xmmword [r10 + 0x10], xmm0
mov qword [r10 + 0x20], rax
movups xmm0, xmmword [str.u_GBYQM_xPT_Q4l]
movups xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [0x1400560a0]
movups xmmword [rbp - 0x29], xmm1
movups xmm0, xmmword [str.srje______46T]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [0x1400560c0]
movups xmmword [rbp - 9], xmm1
mov eax, dword [0x1400560d0]
mov dword [rbp + 7], eax
xor r8d, r8d
cmp dword [0x140063090], 2
jl 0x14001f8ff
movdqa xmm5, xmmword [0x14005ac30]
movdqa xmm4, xmmword [0x14005acf0]
movdqa xmm6, xmmword [0x14005ac70]
movdqa xmm7, xmmword [str.33333333]
lea rcx, [rbp - 0x39]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x20
jl 0x14001f810
cmp r8d, 0x22
jge 0x14001f943
movsxd rax, r8d
lea r9, [rbp - 0x39]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x37
movzx eax, r8w
sub ax, cx
add ax, 0x33
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x22
jl 0x14001f910
lea r8, [rbp - 0x39]
mov edx, dword [0x140113790]
mov rcx, r10
call fcn.140050e90
nop
mov qword [0x140113580], rax
nop dword [rax]
mov rax, qword [rax + 0x18]
mov qword [0x140113808], rax
test rax, rax
jne 0x14001f9b6
movdqa xmm0, xmmword [0x14005aea0]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp - 0x49], 0x1006077
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax - 0xc]
xor byte [rbp + rax - 0x59], cl
inc rax
cmp rax, 0x12
jb 0x14001f990
mov byte [rbp - 0x46], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x59]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [0x1400048a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140113808]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x1400207d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x14011358d], 0
jne 0x14001fa0b
lea rcx, [0x140016040]
call fcn.14001e4f0
lea rcx, [0x140012490]
call fcn.14001e4f0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401137fc], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401137ec], eax
xor bl, bl
mov dword [rbp + 0x17], 0x93979ab8
mov dword [rbp + 0x1b], 0x1008b9d
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0xc]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 6
jb 0x14001fa40
mov byte [rbp + 0x1e], bl
mov dword [rbp - 0x79], 0x94988ca7
mov dword [rbp - 0x75], 0x9e8c96d8
mov dword [rbp - 0x71], 0x869f918e
mov dword [rbp - 0x6d], 0x1003e20
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0xe
jb 0x14001fa80
mov byte [rbp - 0x6a], bl
mov r9d, 4
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x79]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 6
jne 0x14001fab0
mov bl, 1
mov eax, dword [0x1401137fc]
cdq
sub eax, edx
sar eax, 1
mov dword [0x140113794], eax
mov eax, dword [0x1401137ec]
cdq
sub eax, edx
sar eax, 1
mov dword [0x140113568], eax
call fcn.140051530
movzx ecx, bl
call fcn.140003480
call fcn.14001dd00
call fcn.14001c750
call fcn.140003900
cmp byte [0x14011358d], 0
je 0x14001fb0a
mov byte [0x14011358c], 0
mov rax, qword [0x140113580]
jmp 0x14001f960
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140051cb0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x71], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3