Function at 0x1400076d0
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140129f70]
xor rax, rsp
mov qword [rbp + 0x10], rax
movdqa xmm0, xmmword [0x1400f1480]
xor eax, eax
xor esi, esi
mov word [rbp + 8], ax
mov ecx, esi
mov dword [rsp + 0x50], 0x7f786e6f
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x54], 0x4d535072
mov dword [rsp + 0x58], 0x1a424c
mov byte [rsp + 0x5c], 1
nop dword [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1b
jb 0x140007730
mov r9d, 4
mov byte [rsp + 0x5c], sil
lea r8, [rbp + 8]
xor ecx, ecx
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [0x14016f7e1], sil
mov rcx, rsi
cmp eax, 6
mov dword [rbp], 0x7e6068
mov byte [rbp + 4], 1
sete byte [0x14016f7e2]
nop dword [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 3
jb 0x140007780
lea rcx, [rbp]
mov byte [rbp + 4], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rsi
mov dword [rsp + 0x30], 0x7a7f634d
mov dword [rsp + 0x34], 0x77657961
mov dword [rsp + 0x38], 0x1003433
nop dword [rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x1400077c0
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x3b], sil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14016f7b0], rax
test rax, rax
jne 0x1400078c2
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140007b4a
movdqa xmm0, xmmword [0x1400f1530]
mov rcx, rsi
movdqa xmm1, xmmword [str.uui1]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x60], 0x100
movdqu xmmword [rsp + 0x50], xmm1
nop dword [rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x20
jb 0x140007830
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x61], sil
lea r8, str.F8_To_Exit_nigger
xor ecx, ecx
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
mov dword [rsp + 0x30], 0x7a7f634d
mov dword [rsp + 0x34], 0x77657961
mov dword [rsp + 0x38], 0x1003433
nop word [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x140007890
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x3b], sil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14016f7b0], rax
test rax, rax
je 0x1400077f2
mov qword [rsp + 0x1a0], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.Fortnite
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x140007918
nop word [rax + rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.Fortnite
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne 0x1400078f0
mov dword [rbp], 0x7e6068
mov rcx, rsi
mov byte [rbp + 4], 1
nop word [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 3
jb 0x140007930
lea rcx, [rbp]
mov byte [rbp + 4], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400f1490]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400f14c0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x60], Ordinal_79
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x62], 1
nop dword [rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x140007980
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x62], sil
call fcn.1400038e0
movdqa xmm0, xmmword [0x1400f1490]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400f14c0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x60], Ordinal_79
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x62], 1
nop word [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x1400079d0
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x62], sil
call fcn.1400038e0
movdqa xmm0, xmmword [str.H6___buaux6Qqu]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400f1510]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [0x1400f14a0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x1400f14f0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400f13d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x1400f1360]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov dword [0x14016fc20], eax
mov dword [rbp - 0x10], 0x41c1b
mov dword [rbp - 0xc], 0xa145e08
mov word [rbp - 8], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 6], 1
nop
lea eax, [rcx + 0xb]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x69
jb 0x140007a60
lea rcx, [rbp - 0x70]
mov byte [rbp - 6], sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14016f7b8], rax
test rax, rax
jne 0x140007aec
movdqa xmm0, xmmword [0x1400f1570]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400f14b0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x60], 5
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x62], 1
nop word [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x140007ac0
xor r9d, r9d
mov byte [rsp + 0x62], sil
lea r8, str.Loader
xor ecx, ecx
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140003050
cmp qword [0x14016f8c0], rsi
jne 0x140007b53
movdqa xmm0, xmmword [0x1400f13a0]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x263e3c25
mov word [rsp + 0x54], 0x100
call fcn.1400076a0
mov rdx, rax
lea r8, str.Loader
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x1a8], rdi
lea r8, [0x140004cc0]
movaps xmmword [rsp + 0x180], xmm6
xor r9d, r9d
movaps xmmword [rsp + 0x170], xmm7
xor edx, edx
movaps xmmword [rsp + 0x160], xmm8
xor ecx, ecx
movaps xmmword [rsp + 0x150], xmm9
movaps xmmword [rsp + 0x140], xmm10
movaps xmmword [rsp + 0x130], xmm11
mov qword [rsp + 0x28], rsi
movaps xmmword [rsp + 0x120], xmm12
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x140004cc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016f8c0]
call fcn.140066de0
test eax, eax
jne 0x140007ecb
movss xmm12, dword [0x1400f10e0]
xorps xmm11, xmm11
movsd xmm9, qword [0x1400f1168]
movsd xmm10, qword [0x1400f1170]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008098
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140007c88
cmp byte [0x14016f7cb], sil
sete cl
cmp dword [0x14016fce8], 1
mov byte [0x14016f7cb], cl
jbe 0x140007c3b
mov dword [0x14016fce8], 1
mov eax, dword [0x14016fca8]
dec eax
cmp eax, 0x22f
jbe 0x140007c50
mov dword [0x14016fca8], esi
test cl, cl
mov r8d, esi
mov rcx, qword [0x14016f8c0]
mov edx, 0x2000d
sete r8b
call fcn.140068160
cmp byte [0x14016f7cb], sil
je 0x140007c88
mov rcx, qword [0x14016f8c0]
call fcn.14006f660
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.140068980
cmp dword [0x14016fdc4], esi
jne 0x140007c9a
call fcn.140031d00
call fcn.140031060
call fcn.14000ee70
cmp byte [0x14016f7c5], sil
je 0x140007e47
mov rax, qword [0x14016f8d0]
lea rcx, str.radar
movss xmm8, dword [0x140129ffc]
xor edx, edx
movss xmm7, dword [0x140129ff4]
mov r8d, 0x209f
movss xmm6, dword [0x14012a168]
or dword [rax + 0x1cb0], 3
mov qword [rax + 0x1cc0], rsi
mov qword [rax + 0x1cc8], rsi
mov dword [rax + 0x1cb4], 2
movsd xmm0, qword [rax + 0x10]
movsd qword [rax + 0x1cd0], xmm0
mov dword [rax + 0x1cb8], 2
call fcn.140014630
mov rcx, qword [0x14016f8d0]
movaps xmm1, xmm6
addss xmm1, xmm8
movss dword [rsp + 0x70], xmm6
movss dword [rsp + 0x74], xmm7
mov dword [rsp + 0x78], 0x3edc28f6
mov rax, qword [rcx + 0x1c10]
mov dword [rsp + 0x7c], 0x3edc28f6
movss dword [rsp + 0x68], xmm1
mov dword [rbp - 0x80], 0x3edc28f6
mov byte [rax + 0x90], 1
movss xmm0, dword [rcx + 0x1560]
mov rax, qword [rcx + 0x1c10]
lea rcx, [rsp + 0x78]
movss dword [rbp - 0x7c], xmm0
movaps xmm0, xmm7
addss xmm0, xmm8
mov rbx, qword [rax + 0x2b0]
movss dword [rsp + 0x6c], xmm0
call fcn.14000b800
mov r9d, eax
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x70]
movss dword [rsp + 0x20], xmm11
lea r8, [rsp + 0x68]
mov rcx, rbx
call fcn.14002a2a0
mov rax, qword [0x14016f8d0]
lea rcx, [rsp + 0x40]
mulss xmm8, xmm12
mov qword [rsp + 0x40], 0x3f800000
mov dword [rsp + 0x48], esi
movss xmm0, dword [rax + 0x1560]
movss dword [rsp + 0x4c], xmm0
movaps xmm0, xmm8
addss xmm0, xmm6
addss xmm8, xmm7
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x34], xmm8
call fcn.14000b800
xorps xmm0, xmm0
mov edi, eax
ucomisd xmm0, xmm9
ja 0x140007e15
xorps xmm0, xmm0
sqrtsd xmm0, xmm9
jmp 0x140007e1e
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mulsd xmm0, xmm10
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x3e8
mov r9d, edi
xorps xmm2, xmm2
mov rcx, rbx
cvtsd2ss xmm2, xmm0
call fcn.14002aa50
call fcn.140016a00
call fcn.140005260
call fcn.140006310
call fcn.1400112c0
mov rcx, qword [0x14016f8c0]
lea r8, [rbp + 8]
lea rdx, [rbp]
call fcn.140067570
mov r9d, dword [rbp + 8]
xor edx, edx
mov r8d, dword [rbp]
xor ecx, ecx
call qword [sym.imp.OPENGL32.dll_glViewport]
mov ecx, 0x4000
call qword [sym.imp.OPENGL32.dll_glClear]
mov rax, qword [0x14016f8d0]
mov rcx, qword [rax + 0x1dc0]
mov rax, qword [rcx]
mov rcx, rsi
add rax, 0x40
cmp byte [rax], sil
cmovne rcx, rax
call fcn.1400315e0
mov rcx, qword [0x14016f8c0]
call fcn.1400636f0
mov rcx, qword [0x14016f8c0]
call fcn.140066de0
test eax, eax
je 0x140007bf5
cmp dword [0x14016fdb8], esi
je 0x140007eeb
lea rdx, [0x14016fdb8]
mov ecx, 1
call qword [0x14016be28]
mov dword [0x14016fdb8], esi
cmp dword [0x14016fdb0], esi
je 0x140007f0b
lea rdx, [0x14016fdb0]
mov ecx, 1
call qword [0x14016be28]
mov dword [0x14016fdb0], esi
mov ecx, dword [0x14016fdc4]
test ecx, ecx
je 0x140007f21
call qword [0x14016c048]
mov dword [0x14016fdc4], esi
cmp dword [0x14016fdb4], esi
je 0x140007f53
mov rbx, qword [0x14016f8d0]
lea rdx, [0x14016fdb4]
mov ecx, 1
call qword [sym.imp.OPENGL32.dll_glDeleteTextures]
mov rax, qword [rbx + 0xa8]
mov qword [rax + 8], rsi
mov dword [0x14016fdb4], esi
cmp byte [0x14016f948], sil
je 0x140007faf
mov rdx, qword [0x14016fd90]
mov rcx, qword [0x14016fda0]
call fcn.140070500
mov rdx, qword [0x14016fd30]
mov rcx, qword [0x14016fda0]
call fcn.1400706e0
mov rdx, qword [0x14016fd98]
mov rcx, qword [0x14016fda0]
call fcn.140070320
mov rdx, qword [0x14016fd28]
mov rcx, qword [0x14016fda0]
call fcn.1400703c0
mov byte [0x14016f948], sil
lea rbx, [0x14016fd40]
lea rdi, [0x14016fd88]
nop dword [rax]
mov rcx, qword [rbx]
call fcn.1400701b0
mov qword [rbx], rsi
add rbx, 8
cmp rbx, rdi
jl 0x140007fc0
mov rbx, qword [0x14016f8d0]
mov rcx, rbx
call fcn.140010420
cmp qword [0x14016f8d0], rbx
jne 0x140007ff3
mov qword [0x14016f8d0], rsi
test rbx, rbx
je 0x14000801b
mov rcx, rbx
call fcn.14001f4d0
mov rax, qword [0x14016f8d0]
test rax, rax
je 0x140008012
dec dword [rax + 0x3b4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14016f8c0]
call fcn.140066d10
call fcn.140068fc0
movaps xmm11, xmmword [rsp + 0x130]
xor eax, eax
movaps xmm10, xmmword [rsp + 0x140]
movaps xmm9, xmmword [rsp + 0x150]
movaps xmm8, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x170]
movaps xmm6, xmmword [rsp + 0x180]
mov rdi, qword [rsp + 0x1a8]
movaps xmm12, xmmword [rsp + 0x120]
mov rbx, qword [rsp + 0x1a0]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400bf8d0
mov rsi, qword [rsp + 0x1b0]
add rsp, 0x190
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3