Function at 0x1400ddc60
Capabilities:
Enumerate processes
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x1402e09a0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e0998], rax
add rsp, 0x28
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea ecx, [rdi + 0x20]
call fcn.140176e5c
movups xmm0, xmmword [str.Loading_Depends..._n]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], reloc.WS2_32.dll_send
mov qword [rsp + 0x58], Ordinal_33
movups xmmword [rax], xmm0
movzx ecx, word [0x140198f50]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WS2_32.dll_ioctlsocket]
mov byte [rax + 0x12], cl
lea rcx, [rsp + 0x40]
mov byte [rax + 0x13], dil
call fcn.1400db6e0
mov eax, dword [0x140198ed8]
lea rcx, [rsp + 0x40]
movsd xmm0, qword [str.Loading_Cheat_n]
mov dword [rsp + 0x48], eax
movzx eax, word [0x140198edc]
mov word [rsp + 0x4c], ax
mov word [rsp + 0x4e], di
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohl
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
movsd qword [rsp + 0x40], xmm0
call fcn.1400db6e0
lea rcx, [0x140198cec]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], edi
lea rcx, str..6E9B49D7_B3D3_4B8B_A14B_0E6091018321
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea ecx, [rdi + 2]
mov qword [0x1402df840], rax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400dddad
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400ddee9
lea rdx, [rsp + 0x60]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400ddd83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [0x1402df840]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
mov r9d, reloc.WS2_32.dll_recv
mov dword [0x1402df848], eax
mov edx, 0x2323d8
mov dword [rsp + 0x44], eax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rdi
mov qword [rbp + 0x1b0], rdi
mov dword [rsp + 0x40], 0xc8f8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x1402dfb58]
mov rax, qword [rbp + 0x1b0]
mov qword [rcx], rax
cmp byte [rcx + 0x2c], dil
je 0x1400dded0
mov rax, qword [str.Pid__]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
movzx eax, word [0x140198f2c]
mov word [rsp + 0x44], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsp + 0x46], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x47], dil
call fcn.1400db6e0
mov edx, dword [0x1402df848]
lea rcx, [0x140198f30]
call fcn.14006ce30
xorps xmm0, xmm0
mov qword [rsp + 0x50], 8
movups xmmword [rsp + 0x40], xmm0
movabs rax, 0x207c3c2065736142
mov byte [rsp + 0x48], dil
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
call fcn.1400db6e0
mov rdx, qword [0x1402dfb58]
lea rcx, str._I64d_n
mov rdx, qword [rdx]
call fcn.14006ce30
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
jmp 0x140041ea0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
jmp 0x1400dddb8