Function at 0x1400a5020
Capabilities:
Execute command
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x3b8
mov rax, qword [0x140564840]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
lea rdx, [0x1400a4ea0]
lea rcx, [rsp + 0x370]
call fcn.140007850
nop
lea rcx, [rsp + 0x370]
call fcn.14009ef10
nop
call fcn.14009de40
movzx eax, al
test eax, eax
jne 0x1400a50e5
lea rax, [rsp + 0x200]
mov qword [rsp + 0x90], rax
lea rdx, [0x1401c8af8]
mov rcx, qword [rsp + 0x90]
call fcn.14008ebd0
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x140565234]
call fcn.14009f5e0
nop
mov r8d, 0x1f4
mov edx, 0x145
lea rcx, [0x140565234]
call fcn.14009e770
mov edx, 0x1388
lea rcx, [0x140565234]
call fcn.1400a5000
xor edx, edx
lea rcx, [0x140565234]
call fcn.14009f740
nop
lea rax, [rsp + 0x220]
mov qword [rsp + 0xa0], rax
lea rdx, str.Loading_Auth...
mov rcx, qword [rsp + 0xa0]
call fcn.14008ebd0
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
lea rcx, [rsp + 0x380]
call fcn.14008f270
nop
lea rcx, [0x140565440]
call fcn.14012eac0
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0xb0], rax
lea rdx, str.Please_Enter_Your_License_Key:
mov rcx, qword [rsp + 0xb0]
call fcn.14008ebd0
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x140565234]
call fcn.1400a13e0
nop
lea rdx, [rsp + 0x380]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140007fa0
nop
lea rax, [rsp + 0x260]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x380]
mov rcx, qword [rsp + 0xc0]
call fcn.14008eb30
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x140565440]
call fcn.140131510
nop
movzx eax, byte [0x140565650]
test eax, eax
jne 0x1400a5261
lea rax, [rsp + 0x280]
mov qword [rsp + 0xd0], rax
lea rdx, str.Invalid_License_Key_Or_HWID_Mismatched
mov rcx, qword [rsp + 0xd0]
call fcn.14008ebd0
mov qword [rsp + 0xd8], rax
mov rdx, qword [rsp + 0xd8]
lea rcx, [0x140565234]
call fcn.14009f5e0
nop
mov r8d, 0x1f4
mov edx, 0x145
lea rcx, [0x140565234]
call fcn.14009e770
mov edx, 0x8fc
lea rcx, [0x140565234]
call fcn.1400a5000
xor edx, edx
lea rcx, [0x140565234]
call fcn.14009f740
nop
jmp 0x1400a5b4e
mov edx, 0x8fc
lea rcx, [0x140565234]
call fcn.1400a5000
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0xe0], rax
lea rdx, str.Loading_Dashboard...
mov rcx, qword [rsp + 0xe0]
call fcn.14008ebd0
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
mov edx, 0x7d0
lea rcx, [0x140565234]
call fcn.1400a5000
nop
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0xf0], rax
lea rdx, str.YOU_MUST_LOAD_BYPASS_BEFORE_INJECTING.
mov rcx, qword [rsp + 0xf0]
call fcn.14008ebd0
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0xf8]
lea rcx, [0x140565234]
call fcn.14009f5e0
nop
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x100], rax
lea rdx, str._1__Inject
mov rcx, qword [rsp + 0x100]
call fcn.14008ebd0
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
lea rax, [rsp + 0x300]
mov qword [rsp + 0x110], rax
lea rdx, str._2__Load_Bypass
mov rcx, qword [rsp + 0x110]
call fcn.14008ebd0
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
lea rdx, [rsp + 0x368]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
nop
mov eax, dword [rsp + 0x368]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 1
je 0x1400a53c1
cmp dword [rsp + 0x48], 2
je 0x1400a5796
jmp 0x1400a5b4e
lea rax, [rsp + 0x320]
mov qword [rsp + 0x120], rax
lea rdx, str.Waiting_For_Fortnite.
mov rcx, qword [rsp + 0x120]
call fcn.14008ebd0
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x128]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
cmp qword [0x140565300], 0
jne 0x1400a5429
lea rdx, str.Fortnite
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140565300], rax
jmp 0x1400a5402
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.14009f970
mov dword [0x140565230], eax
call fcn.14009f8c0
mov qword [0x140565210], rax
movzx eax, byte [0x1405653d4]
test eax, eax
jne 0x1400a5484
xor r9d, r9d
lea r8, [0x1401c8c74]
lea rdx, str.failed_to_get_uengine__restart_loader_
mov rcx, qword [0x140565220]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14009f760
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140565408], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140565414], eax
mov dword [rsp + 0x44], 0
jmp 0x1400a54bc
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x7fffffff
jge 0x1400a563e
imul eax, dword [rsp + 0x44], 0x1000
cdqe
mov rcx, qword [0x140565210]
add rcx, rax
mov rax, rcx
mov qword [0x140565418], rax
mov rax, qword [0x140565418]
add rax, 0x122ceee8
mov rcx, rax
call fcn.14008dcb0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x30
mov rcx, rax
call fcn.14008dcb0
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x50], 0
je 0x1400a5639
cmp qword [rsp + 0x70], 0
je 0x1400a5639
mov rax, qword [rsp + 0x70]
add rax, 0xc0
mov rcx, rax
call fcn.14008dcb0
cmp rax, qword [rsp + 0x50]
jne 0x1400a5639
mov byte [reloc.WS2_32.dll_accept], 0
lea rcx, [0x1401c8cb0]
call fcn.1400a6cb0
nop
cmp qword [0x140565300], 0
jne 0x1400a557e
lea rcx, [0x1401c8cd8]
call fcn.1400a6cb0
call fcn.140094030
nop
mov rdx, qword [0x140565210]
lea rcx, [0x1401c8cf8]
call fcn.1400a6cb0
lea rcx, [0x1401c8d20]
call fcn.1400a6cb0
lea rdx, [rsp + 0x360]
mov rcx, qword [0x140565300]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
cmp dword [rsp + 0x360], 0
jne 0x1400a55cf
lea rcx, [0x1401c8d40]
call fcn.1400a6cb0
call fcn.140094030
nop
mov edx, dword [rsp + 0x360]
lea rcx, [0x1401c8d68]
call fcn.1400a6cb0
lea rcx, [0x1401c8d90]
call fcn.1400a6cb0
nop
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1400a560c
lea rcx, [0x1401c8db8]
call fcn.1400a6cb0
call fcn.140094030
nop
mov rdx, qword [0x140565210]
lea rcx, [0x1401c8df0]
call fcn.1400a6cb0
lea rcx, [0x1401c8e28]
call fcn.1400a6cb0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call fcn.1400a5b90
nop
jmp 0x1400a563e
jmp 0x1400a54b2
xor eax, eax
cmp eax, 1
je 0x1400a56af
mov dword [rsp + 0x40], 0
jmp 0x1400a5659
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x19
jge 0x1400a56ad
imul eax, dword [rsp + 0x40], 0x1000
cdqe
mov rcx, qword [0x140565210]
lea rax, [rcx + rax + 0x250]
mov rcx, rax
call fcn.14008dcb0
cmp rax, 0x70f8600
jne 0x1400a56ab
mov eax, dword [rsp + 0x40]
inc eax
imul eax, eax, 0x1000
cdqe
mov rcx, qword [0x140565210]
add rcx, rax
mov rax, rcx
mov qword [0x140565418], rax
jmp 0x1400a564f
jmp 0x1400a563e
lea rcx, str.____Searching_for_target_window..._n
call fcn.1400a6cb0
nop
cmp qword [0x140565300], 0
jne 0x1400a56d8
lea rcx, str.____Target_window_not_found_n
call fcn.1400a6cb0
call fcn.140094030
nop
mov rdx, qword [0x140565210]
lea rcx, str.___Target_window_found_with_HWND_0x_p_n
call fcn.1400a6cb0
lea rcx, str.____Resolving_process_ID..._n
call fcn.1400a6cb0
lea rdx, [rsp + 0x364]
mov rcx, qword [0x140565300]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
cmp dword [rsp + 0x364], 0
jne 0x1400a5729
lea rcx, str.____Failed_to_resolve_process_ID_n
call fcn.1400a6cb0
call fcn.140094030
nop
mov edx, dword [rsp + 0x364]
lea rcx, str.___Process_ID_resolved_to__u_n
call fcn.1400a6cb0
lea rcx, str.____Connecting_to_the_process..._n
call fcn.1400a6cb0
nop
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1400a5766
lea rcx, str.____Failed_to_connect_to_the_process_overlay_backend_n
call fcn.1400a6cb0
call fcn.140094030
nop
mov rdx, qword [0x140565210]
lea rcx, str.___Connected_to_the_process_with_mapped_address_0x_p_n
call fcn.1400a6cb0
lea rcx, str.____Drawing..._n
call fcn.1400a6cb0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call fcn.1400a5b90
nop
jmp 0x1400a5b4e
lea rcx, [0x1401c8fd0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x58], 5
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, [0x1401c8fe8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401c9010]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x5c], 5
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x138]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, [0x1401c9020]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401c9048]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x60], 5
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x140]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, [0x1401c9058]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401c9080]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x64], 5
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x148]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, [0x1401c9098]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401c90c0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x68], 5
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x150]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, [0x1401c90d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp qword [0x1405653a0], 0
jne 0x1400a590a
lea rdx, [0x1401c90f4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140008330
mov qword [rsp + 0x78], rax
lea rdx, [0x14008b820]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x1405653a0]
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, str.start_regedit
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [0x1403cc400]
lea rcx, [rsp + 0x160]
call fcn.14008ebd0
nop
mov r8d, 0x3c5
lea rdx, str._echo_off_r_ncolor_b_r_necho_checking_for_admin.._r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n_r_nif__errorlevel__NEQ_0___r_n____echo_no_admin__requesting_admin..._r_n____goto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_n____echo_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_n____echo_UAC.ShellExecute__cmd.exe_____c____s0__________runas___1______temp_getadmin.vbs__r_n______temp_getadmin.vbs__r_n____del___temp_getadmin.vbs__r_n____exit__B_r_n_r_n:gotAdmin_r_n____pushd___CD___r_n____cd__d___dp0__r_n_r_necho_we_are_admin._r_ncls_r_n_r_nset__currentDir_cd___r_nset__tempDir_TEMP___r_n_r_n::_Check_if_the_current_directory_is_inside_the_TEMP_folder_r_nif__i___currentDir____tempDir_____r_n____echo_Please_extract_the_zip__r_n____pause_nul_r_n____exit__b_r_n__r_n_r_nsc_stop_RTCore64__nul_2_1_r_necho_loading_aimbot__provider:_1__RTCore64__r_ncolor_b_r_n_r_nDrvLdr.exe__map__fortnitewin_inject.sys___prv_1_r_necho._r_ncolor_b_r_necho_done_loading._r_n
lea rcx, [rsp + 0x160]
call fcn.140093040
nop
lea rcx, [rsp + 0x160]
call fcn.140090ee0
nop
mov rdx, qword [str.C:Windowsdrv64.dll]
lea rcx, [rsp + 0x180]
call fcn.14008ebd0
nop
mov r8d, 0x138c00
lea rdx, [0x140237bd0]
lea rcx, [rsp + 0x180]
call fcn.140093040
nop
lea rcx, [rsp + 0x180]
call fcn.140090ee0
nop
mov rdx, qword [str.C:Windows_fortnitewin_inject.sys]
lea rcx, [rsp + 0x1a0]
call fcn.14008ebd0
nop
mov r8d, 0x2400
lea rdx, section..data
lea rcx, [rsp + 0x1a0]
call fcn.140093040
nop
lea rcx, [rsp + 0x1a0]
call fcn.140090ee0
nop
mov rdx, qword [str.C:WindowsTaigei64.dll]
lea rcx, [rsp + 0x1c0]
call fcn.14008ebd0
nop
mov r8d, 0x1b400
lea rdx, [0x14021c7d0]
lea rcx, [rsp + 0x1c0]
call fcn.140093040
nop
lea rcx, [rsp + 0x1c0]
call fcn.140090ee0
nop
mov rdx, qword [str.C:WindowsDrvLdr.exe]
lea rcx, [rsp + 0x1e0]
call fcn.14008ebd0
nop
mov r8d, 0x5bc00
lea rdx, [0x1403707d0]
lea rcx, [rsp + 0x1e0]
call fcn.140093040
nop
lea rcx, [rsp + 0x1e0]
call fcn.140090ee0
nop
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsStartup.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x4c], 0x7d0
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x158]
call fcn.140007b50
mov rcx, rax
call fcn.14008dfa0
nop
lea rcx, str.taskkill__IM_regedit.exe__F__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xfffffffffffffffe
mov rcx, qword [0x1405653a0]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
lea rax, [rsp + 0x340]
mov qword [rsp + 0x80], rax
lea rdx, str.Successfully_Loaded_Bypass.
mov rcx, qword [rsp + 0x80]
call fcn.14008ebd0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [0x140565234]
call fcn.1400a6520
nop
mov ecx, 0x518
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009e370
nop
lea rcx, [rsp + 0x380]
call fcn.140090ee0
nop
lea rcx, [rsp + 0x370]
call fcn.1400916d0
nop
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1401c08f0
add rsp, 0x3b8
ret