Function at 0x14000e4d0
Capabilities:
Create thread
Enumerate processes
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1400803c0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor edi, edi
lea rcx, str.Fire.cc_Private
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140002af0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..NetBIOS
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140080710], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rsp + 0x70], 0x130
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000e596
nop word [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14000e5ca
lea rdx, [rsp + 0x70]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000e570
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140080718], edi
mov r9d, 0x10
lea r8, [0x140065d46]
lea rdx, str.Could_not_find_fortnite...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
mov dword [0x140080718], eax
test eax, eax
je 0x14000e5a5
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x40], 0x3e7a1c4
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov edx, 0x231990
mov rcx, qword [0x140080710]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x50]
mov qword [0x140080700], rax
mov ecx, 1
call fcn.140061e20
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400042a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000e9e8
cmp dword [rsp + 0x68], 0
je 0x14000ea11
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14000ea11
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, 1
call fcn.140061e20
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400042f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000ea02
cmp dword [rsp + 0x48], 0
je 0x14000e9f7
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14000e9f7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x1400807b0]
test rcx, rcx
jne 0x14000e74b
lea rcx, [0x14008071c]
call fcn.1400060d0
mov qword [0x1400807b0], rax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400807b0]
test rcx, rcx
je 0x14000e721
movdqa xmm0, xmmword [0x140066520]
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
xor edx, edx
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_SetMenu]
mov edx, 0xfffffff0
mov r8d, 0x10000000
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov edx, 5
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 0xffffffec
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80020
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x1400807b0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea rdx, [0x140080730]
mov ecx, 0x20
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
jns 0x14000e80f
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [0x14008074c], rdi
mov qword [0x140080758], 1
mov qword [0x140080774], rdi
mov dword [0x140080768], 1
mov r9, qword [0x1400807b0]
mov qword [0x140080760], r9
mov dword [0x140080754], edi
mov dword [0x140080748], 0x15
mov eax, dword [0x140080824]
mov dword [0x140080740], eax
mov eax, dword [0x140080828]
mov dword [0x140080744], eax
mov dword [0x14008076c], 1
mov dword [0x140080770], 0x50
mov eax, edi
cmp byte [0x14008081f], dil
setne al
mov dword [0x14008077c], eax
mov rcx, qword [0x140080730]
mov rax, qword [rcx]
lea rdx, [0x140080738]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
lea rdx, [0x140080740]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r8d, 1
call qword [rax + 0xa0]
test eax, eax
jns 0x14000e8e8
mov rcx, qword [0x140080730]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call fcn.140019850
mov rcx, qword [0x1400807b0]
call fcn.140046c70
mov rcx, qword [0x140080738]
call fcn.140045f40
call fcn.14001d7c0
mov rbx, rax
mov qword [rax + 0x18], rdi
lea rcx, [rsp + 0x70]
call fcn.140032a80
mov byte [rbp - 0x70], 0
mov byte [rsp + 0x7c], 0
mov dword [rbp - 0x78], 5
mov dword [rbp - 0x74], 5
mov dword [rbp - 0x40], 0x3f99999a
lea rdi, [0x140066350]
mov qword [rbp - 0x58], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
movss xmm2, dword [0x1400664b4]
lea rdx, str.C:WindowsFonts_tahoma.ttf
mov rcx, qword [rbx + 0x50]
call fcn.140033c00
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1400664b8]
mov r8d, 0x8d8
lea rdx, [0x14007f020]
mov rcx, qword [rbx + 0x50]
call fcn.1400342e0
xor ecx, ecx
call fcn.14003d580
call fcn.14001e220
mov rcx, qword [0x140080730]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.14000de30
nop
cmp dword [rsp + 0x68], 0
je 0x14000e9c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400621c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x68], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3