Function at 0x140045770
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x2a8]
sub rsp, 0x3a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1400f30c0]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor esi, esi
mov qword [0x14011e7c8], rsi
lea rax, [0x14011e7b8]
cmp qword [0x14011e7d0], 0xf
cmova rax, qword [0x14011e7b8]
mov byte [rax], sil
mov qword [0x14011e4e8], rsi
lea rax, [0x14011e4d8]
cmp qword [0x14011e4f0], 0xf
cmova rax, qword [0x14011e4d8]
mov byte [rax], sil
mov qword [0x14011e7e8], rsi
lea rax, [0x14011e7d8]
cmp qword [0x14011e7f0], 0xf
cmova rax, qword [0x14011e7d8]
mov byte [rax], sil
mov qword [0x14011e4c8], rsi
lea rax, [0x14011e4b8]
cmp qword [0x14011e4d0], 0xf
cmova rax, qword [0x14011e4b8]
mov byte [rax], sil
mov qword [0x14011e508], rsi
lea rax, [0x14011e4f8]
cmp qword [0x14011e510], 0xf
cmova rax, qword [0x14011e4f8]
mov byte [rax], sil
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp - 0x1a]
sub cx, word [rbp - 0x1e]
inc cx
mov word [rbp - 0x30], cx
movzx ecx, word [rbp - 0x18]
sub cx, word [rbp - 0x1c]
inc cx
mov word [rbp - 0x2e], cx
mov edx, dword [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str._nConnecting
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
lea rcx, [0x14011e520]
call fcn.14006cf80
mov ebx, 3
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x1400dcae4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
lea rdx, [0x140050590]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140045900
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x1400df120]
movdqu xmmword [rbp + 0x260], xmm1
mov byte [rbp + 0x250], sil
movups xmm3, xmmword [0x1400dede8]
movups xmmword [rbp + 0x230], xmm3
movzx eax, word [0x1400dedf8]
mov word [rbp + 0x240], ax
mov ebx, dword [reloc.WS2_32.dll_accept]
movdqa xmm7, xmmword [0x1400df290]
cmp byte [0x1400dedf9], 0
je 0x140045bc2
mov r8d, esi
cmp ebx, 2
jl 0x140045b78
movdqa xmm4, xmmword [0x1400df710]
movdqa xmm5, xmmword [str.2222]
movdqa xmm6, xmmword [str.2222222222222222]
movdqa xmm2, xmmword [0x1400df1d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd eax, xmm3
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp + 0x230], xmm2
movdqa xmm2, xmmword [0x1400df1e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rbp + 0x234]
xorps xmm2, xmm0
movd dword [rbp + 0x234], xmm2
movdqa xmm3, xmmword [0x1400df1f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rbp + 0x238]
xorps xmm3, xmm0
movd dword [rbp + 0x238], xmm3
movdqa xmm2, xmmword [0x1400df200]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rbp + 0x23c]
xorps xmm2, xmm0
movd dword [rbp + 0x23c], xmm2
mov r8d, reloc.WS2_32.dll_recv
mov eax, r8d
lea r9, [rbp + 0x230]
add r9, rax
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x32
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x12
jl 0x140045b90
lea rdx, [rbp + 0x230]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
lea rdx, [rbp + 0x250]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400505b0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x230]
call fcn.140048830
mov rdx, rax
lea rcx, [0x14011e520]
call fcn.14006eee0
cmp byte [0x14011e750], 0
je 0x140045c87
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x60]
call fcn.140046ab0
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x140045c59
xor byte [rax], 0x32
xor byte [rax + 1], 0x33
xor byte [rax + 2], 0x34
xor byte [rax + 3], 0x35
xor byte [rax + 4], 0x36
xor byte [rax + 5], 0x37
xor byte [rax + 6], 0x38
xor byte [rax + 7], 0x39
xor byte [rax + 8], 0x3a
xor byte [rax + 9], 0x3b
xor dl, 0x3c
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.14004def0
mov rcx, rax
lea rdx, [0x14011e758]
call fcn.14004ded0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400507c0
mov rcx, rax
call fcn.140050a30
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, [0x1400dc7f8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14011e3a8], rax
dec rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp rax, 0xfffffffffffffffd
ja 0x140045d47
lea rdx, str.driver_is_loaded
call fcn.14004def0
mov ecx, 0x578
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140045d70
lea rdx, str.ERROR:_Driver_not_found__loading_the_driver...
call fcn.14004def0
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400455e0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm6, xmmword [str.eR_A_Y_]
movups xmmword [rbp + 0x230], xmm6
movsd xmm0, qword [0x1400de410]
movsd qword [rbp + 0x240], xmm0
cmp byte [0x1400de417], 0
je 0x1400460a9
mov r8d, esi
cmp ebx, 2
jl 0x14004606c
movdqa xmm4, xmmword [0x1400df710]
movdqa xmm5, xmmword [str.2222]
movdqa xmm3, xmmword [0x1400df1d0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [str.2222222222222222]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm6
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp + 0x230], xmm3
movdqa xmm2, xmmword [0x1400df1e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x234]
xorps xmm2, xmm1
movd dword [rbp + 0x234], xmm2
movdqa xmm3, xmmword [0x1400df1f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp + 0x238]
xorps xmm3, xmm1
movd dword [rbp + 0x238], xmm3
movdqa xmm2, xmmword [0x1400df200]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x23c]
xorps xmm2, xmm1
movd dword [rbp + 0x23c], xmm2
movdqa xmm3, xmmword [0x1400df210]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp + 0x240]
xorps xmm3, xmm1
movd dword [rbp + 0x240], xmm3
movdqa xmm2, xmmword [0x1400df220]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x244]
xorps xmm2, xmm1
movd dword [rbp + 0x244], xmm2
jmp 0x1400460a9
lea r9, [rbp + 0x230]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x18
jl 0x140046080
lea rcx, [rbp + 0x230]
call fcn.14003b7b0
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm6, xmmword [str.bAQFE]
movups xmmword [rbp + 0x230], xmm6
movsd xmm0, qword [0x1400dee38]
movsd qword [rbp + 0x240], xmm0
movzx eax, word [0x1400dee40]
mov word [rbp + 0x248], ax
movzx eax, byte [0x1400dee42]
mov byte [rbp + 0x24a], al
mov r8d, esi
cmp ebx, 2
jl 0x140046398
movdqa xmm4, xmmword [0x1400df710]
movdqa xmm5, xmmword [str.2222]
movdqa xmm3, xmmword [0x1400df1d0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
mov ecx, dword [str.2222222222222222]
movd xmm0, ecx
paddb xmm3, xmm0
movd eax, xmm6
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp + 0x230], xmm3
movdqa xmm2, xmmword [0x1400df1e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x234]
xorps xmm2, xmm1
movd dword [rbp + 0x234], xmm2
movdqa xmm3, xmmword [0x1400df1f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp + 0x238]
xorps xmm3, xmm1
movd dword [rbp + 0x238], xmm3
movdqa xmm2, xmmword [0x1400df200]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x23c]
xorps xmm2, xmm1
movd dword [rbp + 0x23c], xmm2
movdqa xmm3, xmmword [0x1400df210]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, ecx
paddb xmm3, xmm0
movd xmm1, dword [rbp + 0x240]
xorps xmm3, xmm1
movd dword [rbp + 0x240], xmm3
movdqa xmm2, xmmword [0x1400df220]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, ecx
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x244]
xorps xmm2, xmm1
movd dword [rbp + 0x244], xmm2
mov r8d, Ordinal_26
mov eax, r8d
lea r9, [rbp + 0x230]
add r9, rax
nop word [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x32
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1b
jl 0x1400463b0
lea rcx, [rbp + 0x230]
call fcn.14003b7b0
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14004641b
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140046400
lea rdx, str.F8_was_pressed._Continuing_execution.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
lea rdx, [0x14004e0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, Ordinal_301
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x1400dcf1c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400464ad
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400469de
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140046483
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov dword [0x14011e3b0], ecx
movsxd rax, ecx
mov qword [0x14011e458], rax
mov qword [rbp - 0x30], rsi
mov dword [rsp + 0x70], 0x9af2b37
mov dword [rsp + 0x74], ecx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x70]
mov edx, 0x22d158
mov rcx, qword [0x14011e3a8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x30]
mov qword [0x14011e3b8], rax
mov qword [rsp + 0x60], rsi
mov dword [rbp + 0x234], esi
mov eax, dword [0x14011e3b0]
mov dword [rbp + 0x230], eax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x238], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x230]
mov edx, 0x2359e0
mov rcx, qword [0x14011e3a8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x60]
mov qword [0x14011e418], rax
mov rbx, rsi
mov edi, Ordinal_26
mov rcx, qword [0x14011e3b8]
nop dword [rax]
add rcx, 0x250
add rcx, rbx
call fcn.14004d920
mov rcx, qword [0x14011e3b8]
add rbx, 0x1000
cmp eax, 0x6f41c00
jne 0x1400465bf
lea rax, [rbx + rcx]
mov qword [0x14011e3a0], rax
sub rdi, 1
jne 0x140046590
lea rdx, str.Process_ID____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
mov rdx, qword [0x14011e458]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14004e0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Base_Address___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
mov rdx, qword [0x14011e3b8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14004e0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.cr3___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
mov rdx, qword [0x14011e418]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14004e0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.VAText___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004def0
mov rdx, qword [0x14011e3a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14004e0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 0x80], 0x50
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x60], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea rbx, str.Fortnite
mov qword [rbp - 0x40], rbx
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x38], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], rsi
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.Jedi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14011e408], rax
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movdqa xmm0, xmmword [0x1400df0f0]
movdqu xmmword [rbp + 0x230], xmm0
lea rdx, [rbp + 0x230]
mov rcx, qword [0x14011e408]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x14011e408]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov rdx, 0xffffffffffffffff
mov r9d, 1
mov r8d, r9d
mov rcx, qword [0x14011e408]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 2
mov r8b, 0xff
mov edx, 0x10101
mov rcx, qword [0x14011e408]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14011e408]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rdx, [0x14011e410]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
js 0x140046a31
mov qword [0x14011e46c], rsi
mov qword [0x14011e478], 1
mov qword [0x14011e494], rsi
mov dword [0x14011e488], 1
mov r9, qword [0x14011e408]
mov qword [0x14011e480], r9
mov dword [0x14011e474], esi
mov dword [0x14011e468], 0x15
mov eax, dword [0x14011e4b4]
mov dword [0x14011e460], eax
mov eax, dword [0x14011e4b0]
mov dword [0x14011e464], eax
mov dword [0x14011e48c], 1
mov dword [0x14011e490], 0x50
mov dword [0x14011e49c], esi
mov rcx, qword [0x14011e410]
mov rax, qword [rcx]
lea rdx, [0x14011e4a0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
lea rdx, [0x14011e460]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r8d, 1
call qword [rax + 0xa0]
test eax, eax
js 0x140046a24
call fcn.140005f10
mov rbx, qword [0x14011e408]
lea rcx, [0x14011e868]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400469ec
lea rcx, [0x14011e860]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400469ec
mov qword [0x14011e858], rbx
mov rax, qword [0x14011e390]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x108], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], Ordinal_41
mov dword [rax + 0x44], Ordinal_41
mov dword [rax + 0x48], Ordinal_41
mov dword [rax + 0x4c], Ordinal_46
mov dword [rax + 0x50], reloc.WLDAP32.dll_Ordinal_33
mov dword [rax + 0x54], Ordinal_35
mov dword [rax + 0x58], Ordinal_41
mov dword [rax + 0x5c], reloc.WLDAP32.dll_Ordinal_35
mov dword [rax + 0x60], reloc.WLDAP32.dll_Ordinal_45
mov dword [rax + 0x64], reloc.WLDAP32.dll_Ordinal_46
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov dword [rax + 0x70], reloc.WS2_32.dll_listen
mov dword [rax + 0x74], reloc.WLDAP32.dll_Ordinal_27
mov dword [rax + 0x78], 0x41
mov dword [rax + 0x7c], 0x43
mov dword [rax + 0x80], 0x56
mov dword [rax + 0x84], 0x58
mov dword [rax + 0x88], 0x59
mov dword [rax + 0x8c], 0x5a
jmp 0x1400469f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 8]
jmp 0x1400464b8
mov rax, qword [0x14011e390]
mov rcx, qword [0x14011e4a0]
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140046a0a
mov byte [reloc.WS2_32.dll_accept], 0
lea rdx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rdx
mov qword [0x14011e848], rcx
call fcn.14001cd50
mov rcx, qword [0x14011e410]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call fcn.140044ef0
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 0xf
jbe 0x140046a7b
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140046a76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046a76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c45e4
xor eax, eax
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400c41d0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret