Function at 0x140092460
Capabilities:
Log keystrokes via application hook
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
mov qword [rbp - 0x41], rcx
mov edx, 0x18
lea rcx, [rbp + 0x17]
call fcn.140095520
lea rdx, [rbp + 0x5f]
lea rcx, [rbp + 0x17]
call fcn.14008f8a0
nop
mov eax, 0x5a4d
cmp word [r15], ax
je 0x1400924cc
lea rdx, str.Failed_to_retrieve_DOS_Header
jmp 0x140092834
movsxd rdi, dword [r15 + 0x3c]
add rdi, r15
cmp dword [rdi], 0x4550
je 0x1400924e7
lea rdx, str.Failed_to_retrieve_NT_Headers
jmp 0x140092834
call fcn.1400921f0
mov rbx, rax
test rax, rax
jne 0x140092500
lea rdx, str.Failed_to_retrieve_ProcessPeb
jmp 0x140092834
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, rbx
call fcn.140091f10
mov r12, rax
test rax, rax
jne 0x140092523
lea rdx, str.Failed_to_retrieve_TargetBaseAddress
jmp 0x140092834
lea rdx, str.DiscordHook64.dll
mov rcx, rbx
call fcn.140091f10
test rax, rax
jne 0x140092543
lea rdx, str.Failed_to_find_DiscordHook64__please_enable_discord_overlay
jmp 0x140092834
mov rcx, r12
call fcn.140091e60
mov qword [0x1405d4ef8], rax
test rax, rax
jne 0x140092563
lea rdx, str.Failed_to_find_CR3
jmp 0x140092834
mov r13d, dword [rdi + 0x50]
mov edx, 0x3000
mov r8d, 4
lea rcx, [r13 + 0x8f]
call fcn.140091a30
mov r14, rax
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, r15
call fcn.140091b20
test al, al
jne 0x1400925a7
lea rdx, str.Failed_to_find_resolve_imports
jmp 0x140092834
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.140092a60
test al, al
jne 0x1400925c5
lea rdx, str.Failed_to_find_relocate_image
jmp 0x140092834
movzx eax, word [rdi + 0x14]
lea rbx, [rax + 0x20]
xor edx, edx
mov esi, edx
movzx ecx, word [rdi + 6]
cmp dx, cx
jae 0x140092618
add rbx, rdi
nop dword [rax]
mov r8d, dword [rbx + 8]
cmp r8d, dword [rbx]
cmovae r8d, dword [rbx]
test r8d, r8d
je 0x140092601
mov ecx, dword [rbx + 4]
add rcx, r14
mov edx, dword [rbx + 0xc]
add rdx, r15
call fcn.140092ec0
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x1400925e0
movzx ecx, ax
movzx eax, word [rdi + 0x14]
xor edx, edx
movzx ebx, ax
add rbx, 0x28
mov esi, edx
cmp dx, cx
jae 0x1400926b1
add rbx, rdi
mov r15d, 4
lea rax, [rbx - 0x10]
test rax, rax
je 0x14009269f
mov eax, dword [rbx + 0x14]
test eax, eax
je 0x14009269f
bt eax, 0x19
jae 0x140092661
mov ecx, dword [rbx]
test ecx, ecx
je 0x140092661
mov r8d, ecx
mov ecx, dword [rbx - 4]
add rcx, r14
xor edx, edx
call fcn.140092ec0
jmp 0x14009269f
mov ecx, eax
shr ecx, 0x1e
mov edx, eax
shr edx, 0x1f
shr eax, 0x1d
and al, 1
and cl, 1
je 0x140092681
test al, al
je 0x140092681
mov r8d, 0x20
jmp 0x140092691
mov r8d, 2
test cl, cl
je 0x140092691
test dl, dl
cmovne r8, r15
movsxd rdx, dword [rbx]
mov ecx, dword [rbx - 4]
add rcx, r14
call fcn.140092890
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x140092633
mov r15, qword [rbp - 0x41]
mov ebx, dword [rdi + 0x28]
mov esi, dword [rdi + 0x50]
add rsi, r14
mov edx, 0x3000
mov r8d, 0x40
lea rcx, [r13 + 0x8f]
call fcn.140091a30
mov rdi, rax
mov qword [0x14044a006], rax
xor r13d, r13d
mov qword [rbp - 0x11], r13
mov qword [rbp + 7], 1
add rbx, r14
mov qword [rbp - 9], rbx
mov qword [rbp - 1], r12
mov qword [rbp + 0xf], r12
lea r8d, [r13 + 0x67]
lea rdx, section..data
mov rcx, rsi
call fcn.140092ec0
lea r8d, [r13 + 0x28]
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.140092ec0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1000
lea r8d, [r13 + 0x20]
mov rcx, rsi
call fcn.140092890
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1401e7e70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov ecx, dword [0x1405d4eec]
call fcn.1400922a0
mov r9d, eax
mov r8, rbx
mov rdx, rsi
lea ecx, [r13 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rbx, rax
cmp dword [rbp - 0x11], 2
je 0x140092806
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rax
lea r8d, [rax + 0x28]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140092980
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp - 1], xmm1
movsd xmm0, qword [rbp - 0x19]
movsd qword [rbp + 0xf], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov r8d, 0x21
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x39]
call fcn.14008a8e0
lea rcx, [rbp - 0x39]
call fcn.140092070
test eax, eax
je 0x14009287f
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp - 0x11], 2
jne 0x140092780
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov edx, 0x8000
mov rcx, rsi
call fcn.140091d80
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [0x1405d4fe8]
lea rdx, str.Successfully_injected_
xor r9d, r9d
lea r8, str.MakFN
xor ecx, ecx
call qword [0x1405d4fc8]
nop
lea rcx, [rbp + 0x17]
call fcn.140090e50
mov al, 1
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401dd5d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.Game_crashed_on_DllMain._User_issue
jmp 0x140092834