Function at 0x1400484cc
Capabilities:
Create thread
Delete file
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x410
mov rax, qword [0x1400d29e8]
xor rax, rsp
mov qword [rsp + 0x400], rax
lea rcx, [0x1400d32f0]
call fcn.1400538c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x118], rax
call fcn.1400410e8
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140041cf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x1400b4978]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140047aa0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x1400b4980]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movzx eax, byte [0x1400d3500]
test eax, eax
jne 0x1400485e0
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x30]
call fcn.1400394cc
mov rcx, rax
call fcn.140038f84
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.140033728
lea rdx, [0x1400d3508]
mov rcx, rax
call fcn.1400336e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x31]
call fcn.140039524
mov rcx, rax
call fcn.140038f24
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140033728
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x32]
call fcn.14003957c
mov rcx, rax
call fcn.140038f44
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.140033728
lea rcx, [rsp + 0x170]
call fcn.140037958
nop
lea rdx, [rsp + 0x3c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 1
je 0x1400486aa
jmp 0x140048758
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x33]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x33]
call fcn.1400395d4
mov rcx, rax
call fcn.140038f04
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.140033728
lea rdx, [rsp + 0x170]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400333c0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x90]
call fcn.140037870
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x1400d32f0]
call fcn.1400551a0
jmp 0x1400487c2
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x34]
call fcn.140039600
mov rcx, rax
call fcn.140038f64
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
call fcn.140033728
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movzx eax, byte [0x1400d3500]
test eax, eax
jne 0x140048846
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x35]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x35]
call fcn.14003962c
mov rcx, rax
call fcn.140038f84
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
call fcn.140033728
lea rdx, [0x1400d3508]
mov rcx, rax
call fcn.1400336e0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [0x1400b4990]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rsp + 0x36]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x36]
call fcn.140039658
mov rcx, rax
call fcn.140038e40
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x37]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x37]
call fcn.140039684
mov rcx, rax
call fcn.140038e60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x38]
call fcn.1400396b0
mov rcx, rax
call fcn.140038e20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x39]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x39]
call fcn.14003926c
mov rcx, rax
call fcn.140038e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x3a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x3a]
call fcn.140039298
mov rcx, rax
call fcn.140038e00
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x3b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3b]
call fcn.1400392c4
mov rcx, rax
call fcn.140038de0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.color_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140044d14]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._n_n_Press_F6_In_the_lobby
mov rcx, rax
call fcn.140033728
lea rdx, [0x140047aa0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
cmp eax, 1
je 0x140048a17
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140048a15
jmp 0x140048a17
jmp 0x1400489f1
lea rcx, [0x1400b49bc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
cmp qword [0x1400d3170], 0
jne 0x140048a7e
lea rdx, str.Fortnite
lea rcx, [rsp + 0x160]
call fcn.14003722c
lea rcx, [rsp + 0x160]
call fcn.140044eac
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400d3170], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140048a34
lea rax, [rsp + 0x140]
mov qword [rsp + 0xc0], rax
lea rdx, [0x1400b49d0]
mov rcx, qword [rsp + 0xc0]
call fcn.140037900
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140043018
mov dword [0x1400d3178], eax
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rsp + 0x190]
call fcn.140037900
nop
lea rcx, [rsp + 0x190]
call fcn.140046780
mov qword [rsp + 0xd0], rax
mov rax, qword [0x1400d2f60]
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
lea rcx, [rsp + 0x190]
call fcn.140038664
mov rcx, qword [0x1400d2f60]
call fcn.140001694
mov rcx, qword [0x1400d2f60]
call fcn.140001640
mov qword [0x1400d3168], rax
lea rdx, str._nProcess_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140033728
mov qword [rsp + 0xd8], rax
lea rdx, [0x1400458b4]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov qword [rsp + 0xe8], rax
mov rax, qword [0x1400d2f60]
mov rax, qword [rax]
mov qword [rsp + 0xe0], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rsp + 0xf0], rax
lea rdx, [0x140035f88]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._nBase_Address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140033728
mov qword [rsp + 0xf8], rax
lea rdx, [0x1400458b4]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov qword [rsp + 0x108], rax
mov rax, qword [0x1400d3168]
mov qword [rsp + 0x100], rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rsp + 0x110], rax
lea rdx, [0x140035f88]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140047c58
call fcn.140047de4
call fcn.140048058
call fcn.1400483f8
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x170]
call fcn.140038664
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1400a8e80
add rsp, 0x410
pop rdi
ret