Function at 0x140048ba0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400fa0c0]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
xor esi, esi
mov ecx, 8
call fcn.1400b6800
lea rcx, [0x140047520]
mov qword [rax], rcx
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14004ede0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x14004a2d7
call fcn.140047860
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r13, rax
mov r12d, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x258
mov edx, 0x64
mov r9d, 0x320
mov r8d, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
movups xmm0, xmmword [0x1400e7ab0]
movups xmmword [rbp + 0x50], xmm0
mov eax, dword [0x1400e7ac0]
mov dword [rbp + 0x60], eax
mov r8d, esi
movdqa xmm7, xmmword [0x1400e7d70]
mov edi, dword [reloc.WS2_32.dll_accept]
cmp edi, 2
jl 0x140048dc7
movdqa xmm5, xmmword [0x1400e7d50]
movdqa xmm4, xmmword [0x1400e83d0]
movdqa xmm6, xmmword [str.1111]
movdqa xmm0, xmmword [0x1400e7db0]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0x30]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140048ce0
cmp r8d, 0x14
jge 0x140048e10
movsxd rax, r8d
lea r9, [rbp + 0x50]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x14
jl 0x140048de0
lea rdx, [rbp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rdx, [0x14004d130]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movabs r14, 0x7fffffffc46535ff
movabs r15, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0xd0]
call fcn.140004e80
lea rcx, [rbp + 0xd0]
call fcn.140047430
movzx ebx, al
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140048ec5
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048ec0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a27d
call fcn.1400b6a84
test bl, bl
jne 0x140048f2d
lea rcx, [rbp + 0xc0]
call fcn.14003e900
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xc8], rax
cmp rax, r14
je 0x140048f15
mov ecx, r12d
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x140048f15
add rax, 0x3b9aca00
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xc8]
call fcn.14004e620
jmp 0x140048e44
mov qword [rbp + 0xc8], r15
lea rcx, [rbp + 0xc8]
call fcn.14004e620
jmp 0x140048e44
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._SUCCESS__Fortnite_Cleared_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov eax, dword [str.QMZQeN]
mov dword [rbp + 0xc0], eax
movzx ecx, word [0x1400e7af4]
mov word [rbp + 0xc4], cx
movzx eax, byte [0x1400e7af6]
mov byte [rbp + 0xc0], 0x66
xor byte [rbp + 0xc1], 0x38
xor byte [rbp + 0xc2], 0x39
xor byte [rbp + 0xc3], 0x3a
xor cl, 0x3b
mov byte [rbp + 0xc4], cl
xor byte [rbp + 0xc5], 0x3c
xor al, 0x3d
mov byte [rbp + 0xc6], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140048fd4
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1a0]
call fcn.140004e80
nop
movsd xmm0, qword [str.MW_Tu_vKvV]
movsd qword [rbp + 0x30], xmm0
movzx ecx, word [0x1400e7b00]
mov word [rbp + 0x38], cx
movzx eax, byte [0x1400e7b02]
mov byte [rbp + 0x30], 0x7a
xor byte [rbp + 0x31], 0x38
xor byte [rbp + 0x32], 0x39
xor byte [rbp + 0x33], 0x3a
xor byte [rbp + 0x34], 0x3b
xor byte [rbp + 0x35], 0x3c
xor byte [rbp + 0x36], 0x3d
xor byte [rbp + 0x37], 0x3e
xor cl, 0x3f
mov byte [rbp + 0x38], cl
xor byte [rbp + 0x39], 0x40
xor al, 0x41
mov byte [rbp + 0x3a], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], rsi
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140049063
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x180]
call fcn.140004e80
nop
movups xmm0, xmmword [str.R_f_v_tZ_v]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [0x1400e7a40]
movups xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [0x1400e7a50]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [str.__aY_b_fX_t_t]
movups xmmword [rbp + 0xa0], xmm1
movzx eax, byte [0x1400e7a70]
mov byte [rbp + 0xb0], al
mov r8d, esi
cmp edi, 2
jl 0x1400491e7
movdqa xmm5, xmmword [0x1400e7d50]
movdqa xmm4, xmmword [0x1400e83d0]
movdqa xmm6, xmmword [str.1111]
movdqa xmm0, xmmword [0x1400e7db0]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x70]
mov edx, dword [rbp + 0x30]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x40
jl 0x140049100
cmp r8d, 0x41
jge 0x140049230
movsxd rax, r8d
lea r9, [rbp + 0x70]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x41
jl 0x140049200
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], rsi
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140049253
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140004e80
nop
mov eax, dword [0x1400e7adc]
mov dword [rbp + 0xc0], eax
cmp edi, 2
jl 0x1400492f0
movdqa xmm3, xmmword [0x1400e7d50]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400e83d0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400e83d0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x1400e7db0]
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp + 0xc0], xmm3
jmp 0x140049330
lea r9, [rbp + 0xc0]
mov r8d, esi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140049300
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rsi
mov qword [rbp + 0x158], rsi
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140049356
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x140]
call fcn.140004e80
nop
movups xmm0, xmmword [str._LMJH]
movups xmmword [rbp + 0x50], xmm0
movsd xmm0, qword [0x1400e7a88]
movsd qword [rbp + 0x60], xmm0
mov eax, dword [0x1400e7a90]
mov dword [rbp + 0x68], eax
movzx eax, byte [0x1400e7a94]
mov byte [rbp + 0x6c], al
mov r8d, esi
cmp edi, 2
jl 0x1400494c7
movdqa xmm5, xmmword [0x1400e7d50]
movdqa xmm4, xmmword [0x1400e83d0]
movdqa xmm6, xmmword [str.1111]
movdqa xmm0, xmmword [0x1400e7db0]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0x30]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x1400493e0
cmp r8d, 0x1d
jge 0x140049510
movsxd rax, r8d
lea r9, [rbp + 0x50]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1d
jl 0x1400494e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], rsi
lea rax, [rbp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140049533
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x120]
call fcn.140004e80
nop
mov byte [rsp + 0x60], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], rsi
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049580
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x100]
call fcn.140004e80
nop
xor edx, edx
mov r8d, 0x298
lea rcx, [rbp + 0x300]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x70]
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x70]
call fcn.14004b9a0
mov r15, rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0xc0], rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x50]
call fcn.14004b9a0
mov r14, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.14004b9a0
mov rsi, rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x1c0], rax
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x10]
call fcn.14004b9a0
mov rdi, rax
lea rax, [rbp + 0x10]
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x10]
call fcn.14004b9a0
mov rbx, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x70]
call fcn.14004b9a0
nop
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.14003fbf0
nop
lea rcx, [rbp + 0x300]
call fcn.14005ef70
mov ecx, 0xfffffff5
cmp byte [rbp + 0x530], 0
jne 0x1400496c9
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Failed_to_connect_to_server_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004a0df
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xor esi, esi
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str._i__Connecting_to_server...
lea rcx, [rbp + 0xd0]
call fcn.140004e80
nop
mov edx, 0x1388
lea rcx, [rbp + 0xd0]
call fcn.140047120
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140049767
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049762
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049762
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str._SUCCESS__Connected_to_server_
lea rcx, [rbp + 0xd0]
call fcn.140004e80
nop
mov edx, 0x1388
lea rcx, [rbp + 0xd0]
call fcn.140047120
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140049808
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049803
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xd0], 0
lea rdx, str._i__Enter_License:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rdx, [rbp + 0xd0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14004d150
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x70]
call fcn.14004b9a0
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.140060dc0
mov ecx, 0xfffffff5
cmp byte [rbp + 0x530], 0
jne 0x1400498cf
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__Unvalidated_license_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004a09a
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._SUCCESS__License_validated_successfully_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str.._redshirtfanisbased
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401035d8], rax
test rax, rax
je 0x14004a04d
cmp rax, 0xffffffffffffffff
je 0x14004a04d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._SUCCESS__Resources_Loaded__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov r8d, Ordinal_35
lea rdx, str._i__Initializing_packet_loading...
lea rcx, [rbp + 0x30]
call fcn.140004e80
nop
mov edx, 0xbb8
lea rcx, [rbp + 0x30]
call fcn.140047120
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400499f4
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400499ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400499ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov r8d, Ordinal_26
lea rdx, str._i__Initializing_Modules
lea rcx, [rbp + 0x30]
call fcn.140004e80
nop
mov edx, 0x7d0
lea rcx, [rbp + 0x30]
call fcn.140047120
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140049a67
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049a62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._i__Closing_Command_Prompt
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rcx, [rbp + 0xc8]
call fcn.14003e900
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xc0], rax
movabs rbx, 0x7fffffffe2329aff
mov r14d, 0xff
cmp rax, rbx
je 0x140049b18
mov ecx, r12d
cmovl ecx, r14d
test cl, cl
jns 0x140049b18
add rax, 0x1dcd6500
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
movabs rdi, 0x7fffffffffffffff
jmp 0x140049b48
movabs rdi, 0x7fffffffffffffff
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rcx, [rbp + 0xc8]
call fcn.14003e900
mov rax, qword [rbp + 0xc8]
cmp rax, rbx
je 0x140049b7a
mov ecx, r12d
cmovl ecx, r14d
test cl, cl
jns 0x140049b7a
add rax, 0x1dcd6500
mov qword [rbp + 0xc0], rax
jmp 0x140049b81
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rcx, [rbp + 0xc8]
call fcn.14003e900
mov rax, qword [rbp + 0xc8]
cmp rax, rbx
je 0x140049bd2
mov ecx, r12d
cmovl ecx, r14d
test cl, cl
jns 0x140049bd2
add rax, 0x1dcd6500
mov qword [rbp + 0xc0], rax
jmp 0x140049bd9
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rcx, [rbp + 0xc8]
call fcn.14003e900
mov rax, qword [rbp + 0xc8]
cmp rax, rbx
je 0x140049c2a
mov ecx, r12d
cmovl ecx, r14d
test cl, cl
jns 0x140049c2a
add rax, 0x1dcd6500
mov qword [rbp + 0xc0], rax
jmp 0x140049c31
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x1400e5f14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rcx, [rbp + 0xc8]
call fcn.14003e900
mov rax, qword [rbp + 0xc8]
cmp rax, rbx
je 0x140049c82
mov ecx, r12d
cmovl ecx, r14d
test cl, cl
jns 0x140049c82
add rax, 0x1dcd6500
mov qword [rbp + 0xc0], rax
jmp 0x140049c89
mov qword [rbp + 0xc0], rdi
lea rcx, [rbp + 0xc0]
call fcn.14004e620
lea rdx, [0x14004d0f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x1d0], 0x130
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140049d12
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140049fea
lea rdx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140049ce2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [0x1401035e0], eax
mov qword [rbp + 0xc8], rsi
mov dword [rbp + 0x30], 0x9af2b37
mov dword [rbp + 0x34], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x30]
mov edx, 0x22d158
mov rcx, qword [0x1401035d8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rbp + 0xc8]
mov qword [rbp + 0xc0], rsi
mov dword [rbp + 0x54], esi
mov eax, dword [0x1401035e0]
mov dword [rbp + 0x50], eax
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x50]
mov edx, 0x2359e0
mov rcx, qword [0x1401035d8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rbx, 0x1000
mov edi, Ordinal_26
nop
lea rcx, [rbx - 0xdb0]
call fcn.14004c660
cmp eax, 0x260e020b
jne 0x140049dea
mov qword [0x1401035d0], rbx
add rbx, 0x1000
sub rdi, 1
jne 0x140049dd0
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp + 0x78], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rbx, str.Fortnite
mov qword [rbp + 0xb0], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov dword [rbp + 0x70], 0x50
mov dword [rbp + 0x74], 0x40
mov qword [rbp + 0x80], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x88], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x90], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x98], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0xb8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], rsi
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov eax, dword [rbp + 0x5c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.redshirtfanEdition
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140103638], rax
test rax, rax
jne 0x140049f34
lea rdx, str.medal_was_not_found_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
mov rax, qword [0x140103638]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongA]
movdqa xmm0, xmmword [0x1400e7cd0]
movdqu xmmword [rbp + 0x1c0], xmm0
lea rdx, [rbp + 0x1c0]
mov rcx, qword [0x140103638]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x140103638]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x140103638]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x140103638]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x140103638]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140041050
call fcn.1400468f0
cmp dword [rbp + 0xf8], 0
jne 0x140049ffb
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x1d8]
jmp 0x140049d1d
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp + 0xf8], eax
jne 0x14004a015
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x30], xmm0
xor edx, edx
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x14004a03d
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov r12d, esi
jmp 0x14004a09a
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._ERROR__ERROR_CODE:_3__Resources_Unloaded_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ccd0
lea rdx, [0x14004d0f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r12d, 3
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14004a0df
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a0d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a0d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
lea rcx, [rbp + 0x300]
call fcn.14004a2f0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14004a131
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a12b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a12b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14004a176
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a170
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14004a1bb
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a1b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a1b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14004a200
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a1fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a1fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14004a245
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a23f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a23f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14004a28a
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a284
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a284
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6a84
nop
cmp dword [rbp + 0xf8], 0
je 0x14004a29a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov eax, r12d
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.1400b66c0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp + 0xf8], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3