Function at 0x140075330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140151080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
call fcn.14007b050
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x1400753af
mov byte [rsp + 0x41], 0
mov rcx, qword [rsp + 0x70]
call fcn.14007b270
movzx eax, byte [rsp + 0x41]
jmp 0x140075417
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x327f7d
lea rdx, str._echo_r_n::_BatchGotAdmin_r_n:______________________________________r_n_r_nREM_____Check_for_permissions_r_nIF___PROCESSOR_ARCHITECTURE___EQU__amd64____r_n_nul_2_1___SYSTEMROOT_SysWOW64cacls.exe____SYSTEMROOT_SysWOW64config_system__r_n__ELSE___r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n__r_n_r_ntitle_Vanity.XYZ_Deep_Cleaner___Made_By_NotDB_r_nREM_____If_error_flag_set__we_do_not_have_admin._r_nif__errorlevel__NEQ_0___r_necho_Requesting_Admin..._r_ngoto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_necho_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_nset_params___r_necho_UAC.ShellExecute__cmd.exe_____c____s0____params:____________runas___1______temp_getadmin.vbs__r_n_r_n__temp_getadmin.vbs__r_ndel___temp_getadmin.vbs__r_nexit__B_r_n_r_n:gotAdmin_r_npushd___CD___r_nCD__D___dp0__r_n_r_ntaskkill__f__im_epicgameslauncher.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_EAC.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_BE.exe___nul_r_ntaskkill__f__im_FortniteLauncher.exe___nul_r_ntaskkill__f__im_OneDrive.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping.exe___nul_r_ntaskkill__f__im_EpicGamesLauncher.exe___nul_r_ntaskkill__f__im_UnrealCEFSubProcess.exe___nul_r_ntaskkill__f__im_CEFProcess.exe___nul_r_ntaskkill__f__im_EasyAntiCheat.exe___nul_r_ntaskkill__f__im_BEService.exe___nul_r_ntaskkill__f__im_BEServices.exe___nul_r_ntaskkill__f__im_BattleEye.exe___nul_r_n_r_nSc_stop_EasyAntiCheat_r_nSc_stop_FortniteClient_Win64_Shipping_EAC_r_nSc_stop_BattleEye_r_nSc_stop_FortniteClient_Win64_Shipping_BE_r_n_r_n_echo_off_r_nsc_config_winmgmt_start_disabled_r_nnet_stop_winmgmt__y_r_n_systemdrive__r_ncd__windir__system32wbem_r_nfor__f___s_in__dir__b_.dll__do_regsvr32__s___s_r_nwmiprvse__regserver_r_nwinmgmt__regserver_r_nsc_config_winmgmt_start_auto_r_nnet_start_winmgmt_r_nfor__f___s_in__dir__s__b_.mof_.mfl__do_mofcomp___s_r_nreg_delete__HKEY_CURRENT_USERSoftwareMicrosoftDirect3D___v_WHQLClass__f_r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64FortniteClient_Win64_Shipping_EAC.exe:__B1_8A_B0_E9_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64EasyAntiCheatEasyAntiCheat_Setup.exe:__73_D5_4B_11_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64FortniteClient_Win64_Shipping.exe:__E7_CB_84_E9_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKU.Dreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_Engine___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpicGames___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpicGames___f_r_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatDescription:__Provides_integrated_security_and_services_for_online_multiplayer_games.____f_r_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatSecuritySecurity:__01_00_14_80_A0_00_00_00_AC_00_00_00_14_00_00_00_30_00_00_00_02_00_1C_00_01_00_00_00_02_80_14_00_FF_01_0F_00_01_01_00_00_00_00_00_01_00_00_00_00_02_00_70_00_05_00_00_00_00_00_14_00
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140075403
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x70]
call fcn.14007b270
movzx eax, byte [rsp + 0x42]
jmp 0x140075417
mov byte [rsp + 0x43], 1
mov rcx, qword [rsp + 0x70]
call fcn.14007b270
movzx eax, byte [rsp + 0x43]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6550
add rsp, 0x68
ret