Function at 0x69cd7097
Capabilities:
Allocate or change rwx memory
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Get file attributes
Get session user name
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x2f0
mov eax, dword [str.NyxLauncher.exe]
mov dword [ebp - 0x228], eax
mov eax, dword [0x69ce6634]
mov dword [ebp - 0x224], eax
mov eax, dword [0x69ce6638]
mov dword [ebp - 0x220], eax
mov eax, dword [0x69ce663c]
mov dword [ebp - 0x21c], eax
mov eax, dword [0x69ce6640]
mov dword [ebp - 0x218], eax
mov eax, dword [0x69ce6644]
mov dword [ebp - 0x214], eax
mov eax, dword [0x69ce6648]
mov dword [ebp - 0x210], eax
mov eax, dword [0x69ce664c]
mov dword [ebp - 0x20c], eax
lea edx, [ebp - 0x208]
mov eax, 0
mov ecx, 0x7a
mov edi, edx
rep stosd dword es:[edi], eax
mov word [ebp - 0x268], 9
mov word [ebp - 0x266], 0x45
mov word [ebp - 0x264], 0x52
mov word [ebp - 0x262], 0x52
mov word [ebp - 0x260], 0x4f
mov word [ebp - 0x25e], 0x52
mov word [ebp - 0x25c], 0x20
mov word [ebp - 0x25a], 0x4c
mov word [ebp - 0x258], 0x4f
mov word [ebp - 0x256], 0x43
mov word [ebp - 0x254], 0x41
mov word [ebp - 0x252], 0x4c
mov word [ebp - 0x250], 0x20
mov word [ebp - 0x24e], 0x40
mov word [ebp - 0x24c], 0x30
mov word [ebp - 0x24a], 0
mov word [ebp - 0x248], 0
mov word [ebp - 0x246], 0x45
mov word [ebp - 0x244], 0x52
mov word [ebp - 0x242], 0x52
mov word [ebp - 0x240], 0x4f
mov word [ebp - 0x23e], 0x52
mov word [ebp - 0x23c], 0
mov dword [esp + 8], str.FortniteClient_Win64_Shipping
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexW]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x69cd7215
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x69cd7233
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [0x69ce9028]
mov dword [esp + 8], 0x291c84
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x69cd726c
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0x291c84
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x2b0]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2b0], 0x44
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x5198], edx
cmp dword [ebp + 0x10], 0
je 0x69cd730b
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
cmp ax, 0x40
jne 0x69cd72fc
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa53c], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa540], 1
jmp 0x69cd7318
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa53c], 5
jmp 0x69cd7318
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa53c], 5
mov dword [esp], str.pu239.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x69cd733e
mov eax, dword [ebp - 0x20]
and eax, 0x10
test eax, eax
je 0x69cd7369
mov dword [esp + 0xc], 0x40010
mov dword [esp + 8], 0x69ce6530
mov dword [esp + 4], str.No_se_encontr
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
jmp 0x69cd733e
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x2800]
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0x104
mov dword [esp], str.pu239.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call eax
sub esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x69cd73cb
mov dword [esp + 0xc], 0x40010
mov dword [esp + 8], 0x69ce65e2
mov dword [esp + 4], str.No_se_encontr
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
jmp 0x69cd73a0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add edx, 0x1400
mov word [eax + edx*2], 0
mov eax, dword [ebp - 0x14]
add eax, 0x2a08
mov dword [esp + 4], str.ewcKRlMlI8ssJJZzOsQkw
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call eax
sub esp, 8
mov dword [esp], str.KERNEL32.DLL
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x69cd7461
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x35
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp + 4], str.LoadLibraryW
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2b0c], edx
mov dword [esp + 4], str.GetProcAddress
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2b10], edx
mov dword [esp + 4], str.GetModuleHandleW
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2b14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x2b0c]
test eax, eax
je 0x69cd74f1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x2b10]
test eax, eax
je 0x69cd74f1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x2b14]
test eax, eax
jne 0x69cd753e
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x36
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov edx, 0x69cc322e
mov eax, 0x69cc3154
sub edx, eax
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2800
jbe 0x69cd75a5
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x44
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x69cc3154
mov dword [esp], eax
call fcn.69cc1c61
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x69cd75e7
mov eax, dword [ebp - 0x20]
and eax, 0x10
test eax, eax
je 0x69cd7634
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x46
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c0]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x2b0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessW]
call eax
sub esp, 0x28
test eax, eax
sete al
test al, al
je 0x69cd76f0
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x37
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], 0x291c84
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
test eax, eax
jne 0x69cd779b
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x38
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [ebp - 0x26c], 0
mov edx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2c0]
lea ecx, [ebp - 0x26c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x291c84
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x69cd77ec
mov eax, dword [ebp - 0x26c]
cmp eax, 0x291c84
je 0x69cd77f3
mov eax, 1
jmp 0x69cd77f8
mov eax, 0
test al, al
je 0x69cd7864
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x39
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2c0]
lea ebx, [ebp - 0x2c0]
add ebx, 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call eax
sub esp, 0x1c
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
test eax, eax
jne 0x69cd7928
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x41
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x2bc]
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call eax
sub esp, 8
test eax, eax
je 0x69cd795e
mov eax, dword [ebp - 0x20]
cmp eax, 0x103
jne 0x69cd795e
mov eax, 1
jmp 0x69cd7963
mov eax, 0
test al, al
je 0x69cd797a
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x69cd792f
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x69cd798b
mov eax, dword [ebp - 0x20]
cmp eax, 0x103
jne 0x69cd79f3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x42
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c0]
lea ebx, [ebp - 0x2c0]
add ebx, 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call eax
sub esp, 0x1c
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
test eax, eax
jne 0x69cd7ab4
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
lea eax, [ebp - 0x268]
add eax, 0x1c
mov dword [eax], 0x43
mov dword [esp + 0xc], 0x40010
lea eax, [ebp - 0x268]
add eax, 0x22
mov dword [esp + 8], eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax