Function at 0x140218ce0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x248]
sub rsp, 0x348
xor r15d, r15d
mov dword [rbp + 0x280], r15d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1404e387c], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1404e3884], eax
call fcn.140056a30
lea rcx, [0x14025b650]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401833dc
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], Ordinal_27
mov qword [rbp - 0x78], Ordinal_33
movups xmm0, xmmword [str.Waiting_for_fortnite.._n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14025bf20]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], r15b
lea rcx, [rsp + 0x70]
call fcn.14021b010
cmp qword [0x1404e2f08], r15
jne 0x140218e24
mov al, 0x4a
mov cl, 0x62
mov dl, 0x7c
mov r8b, 0x7b
mov r9b, 0x7e
mov r10b, 0x78
mov r11b, 0x66
mov bl, 0x76
mov dil, 0x34
mov sil, 0x35
xor r14d, r14d
xor al, 0xc
mov byte [rsp + 0x60], al
xor cl, 0xd
mov byte [rsp + 0x61], cl
xor dl, 0xe
mov byte [rsp + 0x62], dl
xor r8b, 0xf
mov byte [rsp + 0x63], r8b
xor r9b, 0x10
mov byte [rsp + 0x64], r9b
xor r10b, 0x11
mov byte [rsp + 0x65], r10b
xor r11b, 0x12
mov byte [rsp + 0x66], r11b
xor bl, 0x13
mov byte [rsp + 0x67], bl
xor dil, 0x14
mov byte [rsp + 0x68], dil
xor sil, 0x15
mov byte [rsp + 0x69], sil
mov byte [rsp + 0x6a], r14b
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1404e2f08], rax
test rax, rax
je 0x140218d94
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401833dc
mov rdx, rax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], reloc.WS2_32.dll_socket
mov qword [rbp - 0x78], Ordinal_33
movups xmm0, xmmword [str.Waiting_for_Drivers.._n]
movups xmmword [rax], xmm0
mov ecx, dword [0x14025bf40]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14025bf44]
mov word [rax + 0x14], cx
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rdx + 0x16], al
mov byte [rdx + 0x17], r15b
lea rcx, [rsp + 0x70]
call fcn.14021b010
lea rcx, [0x1404e38c8]
call fcn.1401da550
test al, al
je 0x140218f62
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov ebx, r15d
cmp rax, 0xffffffffffffffff
je 0x140218f42
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp], 0x238
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140218f39
lea rdx, [rbp + 0x2c]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140218f00
mov ebx, dword [rbp + 8]
jmp 0x140218f39
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140218f39
lea rdx, [rbp + 0x2c]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
cmove ebx, dword [rbp + 8]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140218f11
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1404e2f9c], ebx
lea rsi, [rbp + 0x278]
mov rdi, qword [rsi]
mov qword [rsi], r15
mov dword [0x1404e38d0], ebx
test ebx, ebx
jne 0x140218f74
mov qword [rsi], rdi
xor eax, eax
add rsp, 0x348
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401da2a0
mov qword [rsi], rdi
test rax, rax
je 0x140218f62
call fcn.1401da2a0
mov qword [0x1404e3390], rax
test rax, rax
jne 0x140218fbf
lea rdx, str._Demonware___Error_code_0x3424__n
lea rcx, [rsp + 0x40]
call fcn.1400499a0
mov rcx, rax
call fcn.14021b010
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdi, [rbp + 0x278]
mov rbx, qword [rdi]
mov qword [rdi], r15
mov qword [rbp + 0x288], r15
mov eax, dword [0x1404e38d0]
mov dword [rbp + 0x288], eax
mov r8d, 4
lea rdx, [rbp + 0x288]
call fcn.1401da380
movzx eax, byte [rbp + 0x28c]
mov qword [rdi], rbx
test al, al
jne 0x14021902c
lea rdx, str._Demonware___Error_code_0x2524__n
lea rcx, [rsp + 0x40]
call fcn.1400499a0
mov rcx, rax
call fcn.14021b010
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14025b650]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14025bfe4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140069920
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov r8d, ntohl
lea rdx, str._Product__
lea rcx, [rsp + 0x70]
call fcn.140049f40
lea rcx, [rsp + 0x70]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Fortnite_Public_n
lea rcx, [rsp + 0x70]
call fcn.14006a090
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov r8d, ntohl
lea rdx, str._Status___
lea rcx, [rsp + 0x70]
call fcn.140049f40
lea rcx, [rsp + 0x70]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rax, [rbp - 0x70]
mov qword [rbp + 0x288], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov r8d, 1
lea rdx, [0x140258fec]
lea rcx, [rbp - 0x70]
call fcn.140049f40
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, ntohl
lea rdx, str.Undetected_n
lea rcx, [rsp + 0x40]
call fcn.140049f40
nop
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.14006cdb0
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.14006c240
mov dword [rbp + 0x280], 1
lea r9, [fcn.140049860]
mov edx, Ordinal_41
mov r8d, 1
lea rcx, [rbp - 0x50]
call fcn.140183694
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
lea rdi, [0x140254278]
xorps xmm0, xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._Subscription___
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
cmp byte [0x1404e2e9b], 1
jne 0x140219293
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Lifetime_n
lea rcx, [rsp + 0x70]
call fcn.14006a090
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, ntohl
lea rdx, str._Expiry___
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Never_n
lea rcx, [rsp + 0x70]
call fcn.14006a190
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
jmp 0x140219437
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.customer_n
lea rcx, [rsp + 0x70]
call fcn.14006a090
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, ntohl
lea rdx, str._Expiry___
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov r8, qword [0x1404e2f80]
add r8, 0x20
mov rcx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 1
jb 0x140219710
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140219337
mov r9, qword [r8]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
movzx edx, byte [rbp + 0x280]
lea rcx, [rbp - 0x70]
call fcn.14004a2e0
mov dword [rbp + 0x280], 4
lea rax, [rbp - 0x70]
mov qword [rbp + 0x288], rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x290], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 2
lea rdx, [0x14025b6d4]
lea rcx, [rsp + 0x40]
call fcn.140049f40
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.140066ee0
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14006cdb0
nop
lea rax, [rbp - 0x28]
mov qword [rsp + 0x70], rax
lea rax, [rbp]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14006c240
mov dword [rbp + 0x280], ntohl
lea r9, [fcn.140049860]
mov edx, Ordinal_41
mov r8d, 1
lea rcx, [rbp - 0x28]
call fcn.140183694
nop
lea rcx, [rbp - 0x70]
call fcn.1400499e0
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140069d70
nop
lea rcx, [rsp + 0x60]
call fcn.140065500
mov rdx, rdi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140069920
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0xa
lea rdx, str._Info___
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.If_the_Aimbot_Not_Work_Restart_The_Cheat_n
lea rcx, [rsp + 0x70]
call fcn.14006a190
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0xa
lea rdx, str._Info___
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Dont_Forgot_to_Vouch_in_the_discord_Server_n
lea rcx, [rsp + 0x70]
call fcn.14006a190
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0xa
lea rdx, str._Info___
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Bug_Reports____Discord.gg_vec2_n
lea rcx, [rsp + 0x70]
call fcn.14006a190
nop
mov rdx, rax
mov rcx, rbx
call fcn.140069d70
nop
lea rcx, [rsp + 0x70]
call fcn.140065500
mov rsi, r15
mov rbx, r15
mov edi, Ordinal_27
mov rax, qword [0x1404e3390]
lea rdx, [rax + 0x250]
add rdx, rbx
mov dword [rbp + 0x280], r15d
mov r9d, 4
lea r8, [rbp + 0x280]
call fcn.1401da120
add rbx, 0x1000
mov rax, qword [0x1404e3390]
cmp dword [rbp + 0x280], 0x6f41c00
jne 0x1402195c4
lea rsi, [rbx + rax]
sub rdi, 1
jne 0x140219583
test rsi, rsi
je 0x1402195dd
lea rax, [rsi + 0x11ecd148]
mov qword [rbp + 0x288], rax
mov ecx, 8
call fcn.1401833dc
lea rcx, [rbp + 0x288]
mov qword [rax], rcx
mov qword [rbp + 0x280], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400747d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1402196ff
cmp dword [rsp + 0x68], 0
je 0x1402196f3
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1402196f3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rbx, qword [0x1404e2f48]
mov rcx, rbx
call fcn.14005eb80
test al, al
jne 0x1402196d4
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, ntohl
lea rdx, str.Overlay__
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b010
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0x49
lea rdx, str.Info_The_overlay_cannot_load_Dont_press_anything_if_you_loading_the_cheat
lea rcx, [rsp + 0x40]
call fcn.140049f40
lea rcx, [rsp + 0x40]
call fcn.14021b430
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.14005e570
mov rcx, rbx
call fcn.1400639a0
jmp 0x140218f62
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140049780
int3