Function at 0x14000fc70
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rcx
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
inc rax
cmp rax, 2
jb 0x140010085
lea rbx, [rsp + 0x68]
mov r8d, 0x130
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x68], 0x130
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x140010085
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 4
mov qword [rsp + 0x38], 0
lea r15, [rsp + 0x94]
lea r14, [rsp + 0x68]
mov r12, qword [sym.imp.kernel32.dll_Process32Next]
lea r13, [0x14020db88]
movabs rsi, 0x8080808080808080
mov qword [rsp + 0x48], rdi
jmp 0x14000fd42
xor r9d, r9d
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], r9b
nop dword [rax]
mov rcx, qword [0x14021f8e0]
xor edx, edx
mov r8, rbp
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rdi
mov rdx, r14
call r12
test eax, eax
je 0x140010055
movzx eax, byte [0x14021f978]
mov edx, 0x104
xor ecx, ecx
call fcn.14009fb80
test rax, rax
je 0x1400100bb
mov rbp, rax
mov r8d, 0x104
mov rcx, rax
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov eax, 4
nop dword [rax + rax]
cmp byte [rbp + rax - 4], 0
je 0x14000fddc
cmp byte [rbp + rax - 3], 0
je 0x14000fde2
cmp byte [rbp + rax - 2], 0
je 0x14000fde8
cmp byte [rbp + rax - 1], 0
je 0x14000fdee
cmp byte [rbp + rax], 0
je 0x14000fe00
add rax, 5
cmp rax, 0x108
jne 0x14000fd90
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.14002a4b0
test byte [rsp + 0x50], 1
jmp 0x14000fd30
add rax, 0xfffffffffffffffc
jmp 0x14000fe00
add rax, 0xfffffffffffffffd
jmp 0x14000fe00
add rax, 0xfffffffffffffffe
jmp 0x14000fe00
dec rax
nop word cs:[rax + rax]
mov rcx, rax
sub rcx, 0xf
mov edx, 0
cmovae rdx, rcx
test rax, rax
je 0x14000fd30
lea r8, [rbp + 7]
and r8, 0xfffffffffffffff8
sub r8, rbp
xor ecx, ecx
jmp 0x14000fe59
cmp bl, 0xc0
jge 0x14000fd23
lea r10, [rcx + 2]
cmp r10, rax
jae 0x14000fd20
cmp byte [rbp + r10], 0xbf
jg 0x14000fd23
inc r10
mov rcx, r10
cmp rcx, rax
jae 0x14000ffe0
movzx r10d, byte [rbp + rcx]
test r10b, r10b
js 0x14000fec0
mov r9d, r8d
sub r9d, ecx
test r9b, 7
je 0x14000fe84
inc rcx
jmp 0x14000fe50
add rcx, 0x10
cmp rcx, rdx
jae 0x14000fe98
mov r9, qword [rbp + rcx + 8]
or r9, qword [rbp + rcx]
test r9, rsi
je 0x14000fe80
cmp rcx, rax
jae 0x14000fe50
nop dword [rax]
cmp byte [rbp + rcx], 0
js 0x14000fe50
inc rcx
cmp rax, rcx
jne 0x14000fea0
jmp 0x14000ffe0
movzx r11d, r10b
movzx ebx, byte [r11 + r13]
mov r9b, 1
cmp ebx, 4
je 0x14000ff20
cmp ebx, 3
je 0x14000fef1
cmp ebx, 2
jne 0x14000fd23
lea r10, [rcx + 1]
cmp r10, rax
jb 0x14000fe3e
jmp 0x14000fd20
lea rbx, [rcx + 1]
cmp rbx, rax
jae 0x14000fd20
movzx ebx, byte [rbp + rbx]
cmp r10b, 0xe0
je 0x14000ff4b
cmp r11d, 0xed
jne 0x14000ff69
cmp bl, 0x9f
jle 0x14000fe31
jmp 0x14000fd23
lea rbx, [rcx + 1]
cmp rbx, rax
jae 0x14000fd20
movzx ebx, byte [rbp + rbx]
cmp r10b, 0xf0
je 0x14000ff5c
cmp r11d, 0xf4
jne 0x14000ff8a
cmp bl, 0x8f
jle 0x14000ffa1
jmp 0x14000fd23
and bl, 0xe0
cmp bl, 0xa0
je 0x14000fe31
jmp 0x14000fd23
add bl, 0x70
cmp bl, 0x30
jb 0x14000ffa1
jmp 0x14000fd23
lea r11d, [r10 + 0x1f]
cmp r11b, 0xc
jb 0x14000fe28
and r10b, 0xfe
cmp r10b, 0xee
je 0x14000fe28
jmp 0x14000fd23
add r10b, 0xf
cmp r10b, 2
ja 0x14000fd23
cmp bl, 0xc0
jge 0x14000fd23
lea r10, [rcx + 2]
cmp r10, rax
jae 0x14000fd20
cmp byte [rbp + r10], 0xbf
jg 0x14000fd23
lea r10, [rcx + 3]
cmp r10, rax
jae 0x14000fd20
cmp byte [rbp + r10], 0xc0
jl 0x14000fe4a
jmp 0x14000fd23
cmp rax, 0x21
jne 0x14000fd30
mov r8d, 0x21
mov rcx, rbp
lea rdx, str.FortniteClient_Win64_Shipping.exesrc_main.rs
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000fd30
mov rdi, r13
mov r13, r14
mov r14, r12
mov r12, r15
mov r15d, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x38]
cmp rbx, qword [rsp + 0x28]
jne 0x14001002e
lea rcx, [rsp + 0x28]
call fcn.140008f60
mov rax, qword [rsp + 0x30]
mov dword [rax + rbx*4], r15d
inc rbx
mov qword [rsp + 0x38], rbx
mov r15, r12
mov r12, r14
mov r14, r13
mov r13, rdi
mov rdi, qword [rsp + 0x48]
jmp 0x14000fd30
call qword [sym.imp.kernel32.dll_GetLastError]
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
mov ecx, 0x535f4f4b
cmovne ecx, edx
call fcn.1400b10b0
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140010071
mov ecx, 1
mov edx, 0x104
call fcn.1400b1210
int3