Function at 0x14001ea00
Capabilities:
Acquire credentials from windows credential manager
Clear windows event logs

Disassembly:
jmp 0x14003f9e0
push rbp
push rdi
sub rsp, 0xae8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1ee
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140259fc0]
xor rax, rbp
mov qword [rbp + 0xaa8], rax
lea rcx, [0x14026510e]
call fcn.14001f5cc
nop
lea rdx, str.C:WindowsHelpHelp_
lea rcx, [rbp + 8]
call fcn.14001e9a6
nop
lea rdx, str.temp.sys
lea rcx, [rbp + 0x48]
call fcn.14001e9a6
nop
mov byte [rbp + 0x84], 0x4b
movzx r8d, byte [rbp + 0x84]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xa8]
call fcn.14001e519
nop
movzx r8d, byte [rbp + 0x84]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.14001e519
nop
lea r8, [rbp + 0x48]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x128]
call fcn.14001f1a3
nop
mov edx, 0x108
lea rcx, [rbp + 0x170]
call fcn.14001e866
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x170]
call fcn.14001f63f
nop
mov r8d, 0x4600
lea rdx, section..data
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rbp + 0x170]
call fcn.14001eb22
nop
lea rdx, str.C:WindowsHelpHelp_
lea rcx, [rbp + 0x298]
call fcn.14001e9a6
nop
lea rdx, str.mapper.exe
lea rcx, [rbp + 0x2d8]
call fcn.14001e9a6
nop
mov byte [rbp + 0x314], 0x4b
movzx r8d, byte [rbp + 0x314]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x338]
call fcn.14001e519
nop
movzx r8d, byte [rbp + 0x314]
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x378]
call fcn.14001e519
nop
lea r8, [rbp + 0x2d8]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x3b8]
call fcn.14001f1a3
nop
mov edx, 0x108
lea rcx, [rbp + 0x400]
call fcn.14001e866
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x400]
call fcn.14001f63f
nop
mov r8d, 0x85800
lea rdx, [0x140079600]
lea rcx, [rbp + 0x400]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rbp + 0x400]
call fcn.14001eb22
nop
lea rdx, str.C:WindowsHelpHelp_
lea rcx, [rbp + 0x528]
call fcn.14001e9a6
nop
lea rdx, str.cleaner.bat
lea rcx, [rbp + 0x568]
call fcn.14001e9a6
nop
mov byte [rbp + 0x5a4], 0x4b
movzx r8d, byte [rbp + 0x5a4]
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x5c8]
call fcn.14001e519
nop
movzx r8d, byte [rbp + 0x5a4]
lea rdx, [rbp + 0x568]
lea rcx, [rbp + 0x608]
call fcn.14001e519
nop
lea r8, [rbp + 0x568]
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x648]
call fcn.14001f1a3
nop
mov edx, 0x108
lea rcx, [rbp + 0x690]
call fcn.14001e866
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
lea rdx, [rbp + 0x648]
lea rcx, [rbp + 0x690]
call fcn.14001f63f
nop
mov r8d, 0x10a44a
lea rdx, str._del__f__a:h__a:a__s__q__C:Users_USERPROFILE_AppDataLocalFortniteGame.__gt_nul_2gt_1_r_n_del__f__a:h__a:a__s__q__C:Users_USERPROFILE_AppDataLocalFortniteGameSavedLMSManifest.sav.__gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64Shared_Files.__gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Program_FilesEpic_GamesFortniteFortniteGamePersistentDownloadDir._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalEpicGamesLauncherSavedLogs._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalEpicGamesLauncherSavedwebcacheGPUCache._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalEpicGamesLauncherSavedwebcacheService_WorkerCacheStorage._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_Username_AppDataLocalFortniteGame._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalFortniteGameSavedConfigWindowsClient._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalFortniteGameSavedLMS._gt_nul_2gt_1_r_n_del__f__s__q___systemdrive_Users_username_AppDataLocalUnrealEngine._gt_nul_2gt_1_r_n_del__f__s__q__C:Users_username_AppDataLocalEpicGamesLauncher.__gt_nul_2gt_1_r_n_del__f__s__q__C:Users_username_AppDataLocalFortniteGame.__gt_nul_2gt_1_r_n_del__f__s__q__C:Users_username_AppDataLocalFortniteGameSavedLMSManifest.sav.__gt_nul_2gt_1_r_n_del__s__f__a:h___a_:_a___q__systemdrive__Users__username__AppData_Local_Microsoft_Windows_WebCache_._r_n_del__s__f__a:h___a_:_a___q__systemdrive__Users__username__AppData_Local_Microsoft_XboxLive_._r_n_del__s__f__a:h___a_:_a___q__systemdrive__Users_username__AppData_Local_Packages_Microsoft.Windows.Cortana_cw5n1h2txyewy_._r_n_del__s__f__a:h___a_:_a___q__systemdrive_Users_username_AppDataLocalMicrosoftWindowsWebCache._r_n_del__s__f__a:h___a_:_a___q__systemdrive_Users_username_AppDataLocalMicrosoftXboxLive._r_n_del__s__f__a:h___a_:_a___q__systemdrive_Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy._r_n_del__s__f__a:h___a_:_a___q_C:_Users__username__AppData_Local_Microsoft_Windows_WebCache_._r_n_del__s__f__a:h___a_:_a___q_C:_Users_username__AppData_Local_Packages_Microsoft.Windows.Cortana_cw5n1h2txyewy_._r_n_del__s__f__a:h___a_:_a___q_C:Users_username_AppDataLocalMicrosoftWindowsWebCache._r_n_del__s__f__a:h___a_:_a___q_C:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy._r_n_del__s__f__a:h___a_:_a___q_D:_Users__username__AppData_Local_Microsoft_Windows_WebCache_._r_n_del__s__f__a:h___a_:_a___q_D:_Users_username__AppData_Local_Packages_Microsoft.Windows.Cortana_cw5n1h2txyewy_._r_n_del__s__f__a:h___a_:_a___q_D:Users_username_AppDataLocalMicrosoftWindowsWebCache._r_n_del__s__f__a:h___a_:_a___q_D:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy._r_n_del__s__f__a:h___a_:_a___q_E:_Users__username__AppData_Local_Microsoft_Windows_WebCache_._r_n_del__s__f__a:h___a_:_a___q_E:_Users_username__AppData_Local_Packages_Microsoft.Windows.Cortana_cw5n1h2txyewy_._r_n_del__s__f__a:h___a_:_a___q_E:Users_username_AppDataLocalMicrosoftWindowsWebCache._r_n_del__s__f__a:h___a_:_a___q_E:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_cw5n1h2txyewy._r_n_del__s__f__a:h___a_:_a___q_F:_Users__username__AppData_Local_Microsoft_Windows_WebCache_._r_n_del__s__f__a:h___a_:_a___q_F:_Users_username__AppData_Local_Packages_Microsoft.Windows.Cortana_cw5n1h2txyewy_._r_n_del__s__f__a:h___a_:_a___q_F:Users_username_AppDataLocalMicrosoftWindowsWebCache._r_n_del__s__f__a:h___a_:_a___q_F:Usersusername_AppDataLocalPackagesMicrosoft.Windows.Cortana_
lea rcx, [rbp + 0x690]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rbp + 0x690]
call fcn.14001eb22
nop
lea rcx, [rbp + 0x690]
call fcn.14001e532
nop
lea rcx, [rbp + 0x648]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x608]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x5c8]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x568]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x528]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x400]
call fcn.14001e532
nop
lea rcx, [rbp + 0x3b8]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x378]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x338]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x2d8]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x298]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x170]
call fcn.14001e532
nop
lea rcx, [rbp + 0x128]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0xe8]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0xa8]
call fcn.14001e3ca
nop
lea rcx, [rbp + 0x48]
call fcn.14001e3ca
nop
lea rcx, [rbp + 8]
call fcn.14001e3ca
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140063790]
call fcn.14001f202
mov rcx, qword [rbp + 0xaa8]
xor rcx, rbp
call fcn.14001ea5f
lea rsp, [rbp + 0xab8]
pop rdi
pop rbp
ret