Function at 0x140020070
Capabilities:
Create thread
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140087400]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, str..4d36e97d_e325_11ce_bfc1_08002be10318
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140087cf0], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140020568
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140020127
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14002015b
lea rdx, [rsp + 0x60]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140020101
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140087cf8], edi
mov r9d, 0x10
lea r8, [0x140070fda]
lea rdx, str.Could_not_find_fortnite...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov dword [0x140087cf8], eax
test eax, eax
je 0x140020136
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov edx, 0x220528
mov rcx, qword [0x140087cf0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x50]
mov qword [0x140087ce0], rax
test rax, rax
jne 0x1400201ea
lea r9d, [rax + 0x10]
lea r8, [0x140070fda]
lea rdx, str.The_driver_could_not_get_the_base_address...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001c30
mov ecx, 1
call fcn.14006c464
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140004a60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002058d
lea rcx, [rsp + 0x40]
call fcn.140012560
nop
cmp dword [rsp + 0x48], 0
je 0x140020247
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 1
call fcn.14006c464
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140004ab0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002059c
lea rcx, [rsp + 0x40]
call fcn.140012560
nop
cmp dword [rsp + 0x48], 0
je 0x14002029f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rcx, qword [0x140087cd0]
test rcx, rcx
jne 0x1400202da
nop dword [rax + rax]
lea rcx, [0x140087c58]
call fcn.14000ed00
mov qword [0x140087cd0], rax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140087cd0]
test rcx, rcx
je 0x1400202b0
movdqa xmm0, xmmword [0x1400734e0]
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
xor edx, edx
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_SetMenu]
mov edx, 0xfffffff0
mov r8d, 0x10000000
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edx, 5
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 0xffffffec
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80020
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x140087cd0]
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [0x140087c48]
mov ecx, 0x20
call sub.d3d9.dll_Direct3DCreate9Ex
test eax, eax
jns 0x14002039e
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [0x140087c6c], rdi
mov qword [0x140087c78], 1
mov qword [0x140087c94], rdi
mov dword [0x140087c88], 1
mov r9, qword [0x140087cd0]
mov qword [0x140087c80], r9
mov dword [0x140087c74], edi
mov dword [0x140087c68], 0x15
mov eax, dword [0x1400880e8]
mov dword [0x140087c60], eax
mov eax, dword [0x1400880ec]
mov dword [0x140087c64], eax
mov dword [0x140087c8c], 1
mov dword [0x140087c90], 0x50
mov eax, edi
cmp byte [0x1400880e3], dil
setne al
mov dword [0x140087c9c], eax
mov rcx, qword [0x140087c48]
mov rax, qword [rcx]
lea rdx, [0x140087c50]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
lea rdx, [0x140087c60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + 0xa0]
test eax, eax
jns 0x140020475
mov rcx, qword [0x140087c48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call fcn.14002a150
mov rcx, qword [0x140087cd0]
call fcn.1400532a0
mov rcx, qword [0x140087c50]
call fcn.140052620
call fcn.14002d200
mov rbx, rax
mov qword [rax + 0x18], rdi
lea rcx, [rsp + 0x60]
call fcn.14003ffd0
mov byte [rbp - 0x80], 0
mov byte [rsp + 0x6c], 0
mov dword [rsp + 0x78], 5
mov dword [rsp + 0x7c], 5
mov dword [rbp - 0x50], 0x3f99999a
lea rdi, [0x140071c30]
mov qword [rbp - 0x68], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
movss xmm2, dword [0x14007347c]
lea rdx, str.C:WindowsFonts_tahoma.ttf
mov rcx, qword [rbx + 0x50]
call fcn.140040e60
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x140073480]
mov r8d, 0x8d8
lea rdx, section..data
mov rcx, qword [rbx + 0x50]
call fcn.140041430
xor ecx, ecx
call fcn.14004a030
call fcn.14002d9d0
mov rcx, qword [0x140087c48]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.14001bec0
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14006c800
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov r9d, 0x10
lea r8, [0x140070fda]
lea rdx, str.The_driver_could_not_be_found...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3