Function at 0x14009cbf0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get file size
Log keystrokes via polling
Read file on windows
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rbp + 0x218], rax
xor r15d, r15d
lea edx, [r15 + 0x18]
lea rcx, [rbp + 0x200]
call fcn.140095520
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x200]
call fcn.14008f8a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
mov dword [rbp + 0x100], 8
mov dword [rbp + 0x104], 3
mov qword [rbp + 0x118], r15
movdqa xmmword [rbp + 0x120], xmm0
lea rdx, [0x1401e0910]
lea rcx, [rbp + 0x118]
call fcn.140093040
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
lea rdx, [0x1401e0910]
lea rcx, [rbp + 0x130]
call fcn.140093040
nop
mov qword [rbp + 0x148], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [0x1401e0910]
lea rcx, [rbp + 0x148]
call fcn.140093040
nop
lea rcx, [rbp + 0x100]
call fcn.14009a5b0
nop
lea rcx, [rbp + 0x100]
call fcn.140095820
mov rsi, qword [rbp + 0x150]
mov rcx, rsi
mov rbx, qword [rbp + 0x148]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14009ce4a
cmp rbx, rsi
je 0x14009ce4a
nop dword [rax + rax]
mov dword [rbp + 0xdc], r15d
mov edx, dword [rbx + 8]
lea r9, [rbp + 0xdc]
mov r8d, 0x40
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14009cf72
mov ecx, dword [rbx + 8]
call fcn.1400974f0
mov rdi, rax
test rax, rax
je 0x14009cda0
mov r8d, dword [rbx + 8]
mov rdx, rax
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, dword [rbx + 8]
lea r9, [rbp + 0xdc]
mov r8d, dword [rbp + 0xdc]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14009cf52
add rbx, 0x28
cmp rbx, rsi
jne 0x14009cd50
mov rsi, qword [rbp + 0x150]
mov rbx, qword [rbp + 0x148]
cmp rbx, rsi
je 0x14009ce4a
lea rcx, [rbp + 0x148]
call fcn.140094b10
mov rdi, qword [rbp + 0x150]
mov rax, qword [rbp + 0x148]
cmp rax, rdi
je 0x14009ce43
lea rbx, [rax + 0x10]
mov rcx, rbx
call fcn.140094b10
mov rdx, qword [rbx]
test rdx, rdx
je 0x14009ce2f
mov r8, qword [rbx + 0x10]
sub r8, rdx
sar r8, 4
mov rcx, rbx
call fcn.1400965c0
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
add rbx, 0x28
lea rax, [rbx - 0x10]
cmp rax, rdi
jne 0x14009ce01
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x100]
call fcn.14009c7b0
mov dl, 1
lea rcx, [rbp + 0x100]
call fcn.14009af50
lea rcx, [rbp + 0x100]
call fcn.14009b1f0
mov ecx, 0xfffffff6
call qword [0x1405d5010]
mov rbx, rax
lea rdx, [rbp + 0xe0]
mov rcx, rax
call qword [0x1405d4ff0]
mov edx, dword [rbp + 0xe0]
and edx, 0xffffffaf
or edx, 0x85
mov dword [rbp + 0xe0], edx
mov rcx, rbx
call qword [0x1405d4ff8]
call fcn.140092400
test al, al
jne 0x14009d743
call qword [0x1405d4f38]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1401e801c]
lea rdx, str.CONIN_
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1401e8028]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1401e8028]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov ecx, 8
call fcn.1401dd024
test rax, rax
je 0x14009cfa5
lea rcx, [0x140092bd0]
mov qword [rax], rcx
jmp 0x14009cfa8
lea rcx, [rbp + 0x160]
call fcn.14008fbb0
lea rdx, [0x1404444c0]
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0xe8]
call fcn.14008fd60
lea rdx, [0x140444528]
lea rcx, [rbp + 0xe8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rax, r15
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14008bef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14009d7fe
lea rcx, [rbp + 0xe8]
call fcn.140096800
lea rcx, str.___Mapping_driver_n
call fcn.14009d8f0
mov ecx, 0x1194
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea rcx, str.b29c1c89_16d5_4556_b58c_db6c132d5b65
call fcn.140098d10
mov r8, rax
lea rdx, str.b29c1c89_16d5_4556_b58c_db6c132d5b65
lea rcx, [rsp + 0x48]
call fcn.14008a770
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov edx, 0x18
lea rcx, [rbp + 0x160]
call fcn.140095520
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x160]
call fcn.14008f8a0
nop
mov edx, 0x48
lea rcx, [rbp + 0x180]
call fcn.140095520
lea rdx, [0x1405d4fd0]
lea rcx, [rsp + 0x78]
call fcn.14008f5c0
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.14009db50
nop
mov r8d, 0x68a8
lea rdx, [0x1401e0fa0]
lea rcx, [rbp + 0x1d0]
call fcn.140098d70
nop
lea rdx, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0xf
cmova rdx, qword [rbp + 0x1d0]
mov r8, qword [rbp + 0x1e0]
lea rcx, [0x1405d5108]
call fcn.140095ba0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..GIO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [0x1405d5128], rax
lea rcx, [rbp + 0x1d0]
call fcn.140090b30
test rbx, rbx
je 0x14009d653
lea rcx, [rbp + 0xd8]
call fcn.1400902a0
mov rcx, qword [0x1405d4fd0]
call fcn.140097d40
mov r8d, dword [rax + 4]
lea rdx, [0x1405d5108]
lea rcx, [rbp + 0xd8]
call fcn.140095dc0
test al, al
je 0x14009d653
mov qword [rbp - 0x38], r15
lea rdx, [rbp - 0x70]
mov ecx, 0x10
call fcn.14006fd60
lea rcx, [0x1401e81e0]
mov qword [rax], rcx
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x180]
call fcn.14009dc70
lea rcx, [rbp + 0x180]
call fcn.14009dde0
lea rcx, [rbp + 0x180]
call fcn.14009e060
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp + 0xd8]
call fcn.140095780
mov rdi, rax
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.14009dee0
lea rcx, [rbp + 0x180]
call fcn.14009e060
mov rbx, rax
lea rcx, [rbp + 0x180]
call fcn.14006fe30
mov r9, rbx
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xd8]
call fcn.14009c530
lea rcx, [rbp + 0x180]
call fcn.14009dc60
lea rbx, [rdi + rax]
lea rcx, [rsp + 0x48]
call fcn.14009b910
mov qword [0x1405d4ed8], rax
xor r8d, r8d
lea rdx, str.ExAllocatePool
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e30], rax
xor r8d, r8d
lea rdx, str.ExFreePoolWithTag
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4ec0], rax
xor r8d, r8d
lea rdx, str.IoAllocateMdl
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e68], rax
xor r8d, r8d
lea rdx, str.IoCreateDevice
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4df8], rax
xor r8d, r8d
lea rdx, str.IoCreateDriver
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4de0], rax
xor r8d, r8d
lea rdx, str.IoCreateSymbolicLink
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4df0], rax
xor r8d, r8d
lea rdx, str.IofCompleteRequest
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4de8], rax
xor r8d, r8d
lea rdx, str.IoFreeMdl
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e98], rax
xor r8d, r8d
lea rdx, str.IoGetCurrentProcess
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4ea0], rax
xor r8d, r8d
lea rdx, str.KeAttachProcess
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e58], rax
xor r8d, r8d
lea rdx, str.KeDetachProcess
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e60], rax
xor r8d, r8d
lea rdx, str.MmCopyMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4ea8], rax
xor r8d, r8d
lea rdx, str.MmCopyVirtualMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e40], rax
xor r8d, r8d
lea rdx, str.MmMapIoSpaceEx
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4eb0], rax
xor r8d, r8d
lea rdx, str.MmMapLockedPagesSpecifyCache
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e78], rax
xor r8d, r8d
lea rdx, str.MmProbeAndLockPages
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e70], rax
xor r8d, r8d
lea rdx, str.MmProtectMdlSystemAddress
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e80], rax
xor r8d, r8d
lea rdx, str.MmUnlockPages
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e90], rax
xor r8d, r8d
lea rdx, str.MmUnmapIoSpace
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4eb8], rax
xor r8d, r8d
lea rdx, str.MmUnmapLockedPages
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e88], rax
xor r8d, r8d
lea rdx, str.MmGetPhysicalMemoryRanges
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4ec8], rax
xor r8d, r8d
lea rdx, str.MmGetVirtualForPhysical
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4ed0], rax
xor r8d, r8d
lea rdx, str.ObfDereferenceObject
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e48], rax
xor r8d, r8d
lea rdx, str.PsGetProcessPeb
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e50], rax
xor r8d, r8d
lea rdx, str.PsLookupProcessByProcessId
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e38], rax
xor r8d, r8d
lea rdx, [0x1401e7bc0]
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e00], rax
xor r8d, r8d
lea rdx, str.ZwAllocateVirtualMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e20], rax
xor r8d, r8d
lea rdx, str.ZwFreeVirtualMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e10], rax
xor r8d, r8d
lea rdx, str.ZwProtectVirtualMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e18], rax
xor r8d, r8d
lea rdx, str.ZwQuerySystemInformation
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e08], rax
xor r8d, r8d
lea rdx, str.ZwQueryVirtualMemory
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov qword [0x1405d4e28], rax
lea rax, [rbp - 0x30]
lea rcx, [0x1405d4de0]
mov r8d, 2
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r8, 1
jne 0x14009d5b2
lea r8, [rbp - 0x30]
mov rdx, rbx
lea rcx, [rbp + 0xd8]
call fcn.14008e510
lea rcx, [rbp + 0x180]
call fcn.14009ddd0
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xd8]
call fcn.14009cb40
mov rcx, qword [0x1405d5128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14009d653
lea rcx, [0x1405d5108]
call fcn.14009c190
nop
lea rcx, [rbp + 0x180]
call fcn.140090eb0
nop
lea rcx, [rbp + 0x160]
call fcn.140090e50
nop
lea rcx, [rsp + 0x48]
call fcn.140090a30
mov rax, qword [0x1405d4fd8]
cmp qword [0x1405d4fd0], rax
je 0x14009d6a1
lea rcx, [0x1405d4fd0]
call fcn.140094b10
mov rax, qword [0x1405d4fd0]
mov qword [0x1405d4fd8], rax
lea rcx, str.____Initialzing.._n
call fcn.14009d8f0
call fcn.140092400
test al, al
jne 0x14009d6cd
lea rcx, str.___Failed_to_load_driver_n
call fcn.14009d8f0
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___Finished_driver__hiding._n
call fcn.14009d8f0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, r15d
xchg byte [0x14044a067], al
lea rcx, [rbp + 0xe8]
call fcn.1400910b0
xor r9d, r9d
lea r8, str.MakFN
lea rdx, str.Please_launch_fortnite
xor ecx, ecx
call qword [0x1405d4fc8]
nop dword [rax]
lea rdx, str.Fortnite
lea rcx, str.UnrealWindow
call qword [0x1405d4fc0]
test rax, rax
je 0x14009d760
xor r9d, r9d
lea r8, str.MakFN
lea rdx, str.Press_F12_in_lobby
xor ecx, ecx
call qword [0x1405d4fc8]
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14009d792
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov r8d, 0x21
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rsp + 0x48]
call fcn.14008a8e0
lea rcx, [rsp + 0x48]
call fcn.140092070
mov r14d, eax
xor r9d, r9d
lea r8, str.MakFN
xor ecx, ecx
test eax, eax
jne 0x14009d810
lea rdx, str.Failed_to_find_process
call qword [0x1405d4fc8]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rbp + 0xf0], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rdx, str.Injecting..
call qword [0x1405d4fc8]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, str.internal.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xdc]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
jne 0x14009d8cd
xor r9d, r9d
lea r8, str.MakFN
lea rdx, str.Failed_to_find_dll
xor ecx, ecx
call qword [0x1405d4fc8]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, r14d
call fcn.140092eb0
mov rcx, rsi
call fcn.140092460
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3