Function at 0x14005bdac
Capabilities:
Create thread
Execute command
Log keystrokes via polling
Move file
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x1a8
mov rax, qword [0x140088080]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x38], rax
call fcn.14004b0bc
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14004becc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x1e
lea rcx, [rsp + 0x130]
call fcn.140052aa8
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.14004ea80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rsp + 0x130]
call fcn.140030554
mov edx, 0xf
lea rcx, [rsp + 0x170]
call fcn.140052aa8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14004ea80
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x150]
call fcn.14005285c
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14004ea80
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rcx, [rsp + 0x150]
call fcn.140030554
nop
lea rcx, [rsp + 0x170]
call fcn.140030554
mov dx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400454a0
mov rcx, rax
call fcn.140044df8
mov rcx, rax
call fcn.14004b2cc
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x78], rax
lea rdx, str._Loading_Conserve_V2..._n_n_n
lea rcx, [rsp + 0xe0]
call fcn.140044070
mov dword [rsp + 0x100], 0x8c
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x78]
call fcn.140044d20
nop
lea rcx, [rsp + 0xe0]
call fcn.140044c84
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x80], rax
lea rdx, str._Loaded_Conserve_V2_n_n_n
lea rcx, [rsp + 0x108]
call fcn.140044070
mov dword [rsp + 0x128], 0x2d
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x80]
call fcn.140044d20
nop
lea rcx, [rsp + 0x108]
call fcn.140044c84
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140052400]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x140067740]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._n__e_33m___e_0m
call fcn.1400198f0
mov dx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Welcome_to_Conserve_V2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
mov qword [rsp + 0x88], rax
lea rdx, [0x1400418cc]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
mov qword [rsp + 0x90], rax
lea rdx, [0x1400418cc]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Press_WindowZ_When_FortniteLauncher.exe_Open_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
mov qword [rsp + 0x98], rax
lea rdx, [0x1400418cc]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x1f4
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14005c09c
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x14005c0a9
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005c072
mov edx, 0x1f4
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x1400677d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [0x140088e88], 0
jne 0x14005c110
lea rdx, str.Fortnite
lea rcx, [rsp + 0xd0]
call fcn.140043d2c
lea rcx, [rsp + 0xd0]
call fcn.1400503a4
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140088e88], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005c0c6
lea rax, [0x140050ae4]
test rax, rax
jne 0x14005c13e
lea rcx, str._n_______The_libraries_arent_initiaized
call fcn.1400198f0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x14005c14a
lea rcx, str._n______The_libraries_initiaized
call fcn.1400198f0
lea rcx, [0x14006783c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140088ef8]
call fcn.140050a3c
movzx eax, al
test eax, eax
jne 0x14005c17f
lea rdx, str.Driver_is_not_loaded_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
jmp 0x14005c157
mov dx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [0x140088ef8]
call fcn.140050978
mov dword [0x140088ef8], eax
lea rcx, [0x140088ef8]
call fcn.14005092c
mov qword [0x140088f00], rax
mov rax, qword [0x140088f00]
mov qword [0x140088e78], rax
lea rdx, str.___base_address_____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
mov qword [rsp + 0xa8], rax
mov rax, qword [0x140088e78]
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rsp + 0xb0], rax
lea rdx, [0x1400418cc]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x140070110]
mov qword [0x140070110], rax
lea rdx, str.___Uworld_____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003f3a8
mov qword [rsp + 0xc0], rax
mov rax, qword [0x140070110]
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rsp + 0xc8], rax
lea rdx, [0x1400418cc]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14005a2d0
call fcn.14005a45c
call fcn.14005b784
call fcn.14005bb24
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14005c5f0
add rsp, 0x1a8
ret