Function at 0x140004b70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14004f040]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor edi, edi
lea r9, [0x14004fee0]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [r9 + rbx], dil
jne 0x140004bc0
mov rax, qword [0x14004f0b8]
cmp rbx, rax
ja 0x140004c05
lea rdi, [0x14004f0a0]
cmp rax, 0xf
cmova rdi, qword [0x14004f0a0]
mov qword [0x14004f0b0], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
xor edi, edi
jmp 0x140004c14
mov rdx, rbx
lea rcx, [0x14004f0a0]
call fcn.140012020
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rdi
mov r8d, 0x18
lea rdx, str.3db3ba5dcbd2e16703f3978d
lea rcx, [rbp + 0x20]
call fcn.14000f580
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov r8d, 0x16f
lea rdx, str.eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhY2NvdW50X2lkIjoiYmU5ZGE1YzJmYmVhNDQwN2IyZjQwZWJhYWQ4NTlhZDQiLCJnZW5lcmF0ZWQiOjE2Mzg3MTcyNzgsImNhbGRlcmFHdWlkIjoiMzgxMGI4NjMtMmE2NS00NDU3LTliNTgtNGRhYjNiNDgyYTg2IiwiYWNQcm92aWRlciI6IkVhc3lBbnRpQ2hlYXQiLCJub3RlcyI6IiIsImZhbGxiYWNrIjpmYWxzZX0.VAWQB67RTxhiWOxx7DBjnzDnXyyEnX7OljJm_j2d88G_WgwQ9wrE6lwMEHZHjBd1ISJdUO1UVUqkfLdU5nofBQ
lea rcx, [rbp]
call fcn.14000f580
nop
lea rax, str.__epicappFortnite__epicenvProd__epiclocaleen_us__epicportal__nobe__fromfleac__fltoken__caldera__AUTH_LOGIN__AUTH_PASSWORD_carbon.dev__AUTH_TYPEepic
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0xa4
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rax, qword [rbp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x70], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x70], rax
lea rax, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rax, qword [rbp]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x60], xmm0
movabs rax, 0xc000000000000010
mov qword [rsp + 0x78], rax
lea rax, str.CarbonUser
mov qword [rbp - 0x50], rax
movabs rax, 0xb000000000000020
mov qword [rbp - 0x80], rax
lea rax, str.verycoolpasswordwithmabros
mov qword [rbp - 0x48], rax
movabs rax, 0xb000000000000028
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x50], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.140013d60
nop
lea rdx, [0x14004f0a0]
lea rcx, [rbp + 0x60]
call fcn.1400080e0
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp + 0x70]
sub rax, rsi
cmp rax, 0x21
jb 0x1400050bb
lea r12, [rbp + 0x60]
mov r15, qword [rbp + 0x78]
cmp r15, 0xf
seta r13b
mov r14, qword [rbp + 0x60]
cmova r12, r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
add rsi, 0x21
mov edi, 0xf
lea rbx, [rbp - 0x20]
cmp rsi, rdi
jbe 0x140004e28
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140004deb
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140021680
test rax, rax
je 0x140004f59
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140004e24
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140004e13
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400050c1
jmp 0x140004dcc
test rcx, rcx
je 0x140004e22
call fcn.140021680
mov rbx, rax
jmp 0x140004e24
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, qword [rbp + 0x70]
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.FortniteClient_Win64_Shipping.exe]
movups xmmword [rdi + rbx], xmm0
movups xmm1, xmmword [0x140041ce8]
movups xmmword [rdi + rbx + 0x10], xmm1
movzx eax, byte [0x140041cf8]
mov byte [rdi + rbx + 0x20], al
mov byte [rbx + rsi], 0
lea rsi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rsi, qword [rbp + 0x40]
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rbx, qword [rbp - 0x20]
mov ecx, 0x68
call fcn.140021680
mov r12, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [r12], 0x68
lea rdi, [rbp - 0x40]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004f01
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp - 0x40]
jmp 0x140004f20
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.__X__Failed_to_create_process._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ea70
mov rax, rdi
mov qword [0x14004f098], rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140004f65
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140021b80
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
test r13b, r13b
je 0x140004faf
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140004fa6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fa6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140021b80
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140004fed
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fe8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140021b80
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000503b
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005036
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005036
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140021b80
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140005089
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005084
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005084
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140021b80
mov al, 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140021660
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001390
nop
call fcn.140001250
int3