Function at 0x1400043f0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2e0
lea rcx, [0x14008a139]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400044a9
mov rsi, rax
mov dword [rsp + 0xa0], 0x238
lea rdx, [rsp + 0xa0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400044a0
lea r15, [rsp + 0x98]
lea r12, [rsp + 0x90]
lea rdi, [rsp + 0xcc]
lea rbx, [0x14008b2c4]
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
lea r14, [rsp + 0xa0]
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, rbx
call r13
test eax, eax
je 0x1400045f3
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140004480
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r15, [rsp + 0x78]
lea r12, [rsp + 0x70]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x20], 0x31363532
mov word [rsp + 0x24], 0x3231
lea rcx, [rsp + 0x20]
call fcn.1400041c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [0x140085096]
movaps xmmword [rsp + 0xc0], xmm0
movabs rax, 0x656e061a044e3830
mov qword [rsp + 0xcd], rax
movups xmm0, xmmword [0x140085076]
xorps xmm0, xmmword [str.123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcd]
movups xmm1, xmmword [0x140085086]
movaps xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmmword [0x1400852b0]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmm0, xmmword [rsp + 0xc0]
xorps xmm0, xmmword [0x1400852c0]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [0x1400852d0]
movss dword [rsp + 0xd0], xmm0
xor byte [rsp + 0xd4], 0x65
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0xa0]
call fcn.140003c20
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea rsi, [rsp + 0x60]
cmp qword [0x1400a8eb0], 0
jne 0x14000478e
movabs rbx, 0x6574696e74726f46
lea rdi, [rsp + 0xa0]
mov r14, qword [sym.imp.USER32.dll_FindWindowA]
nop
mov qword [rsp + 0xa0], rbx
mov word [rsp + 0xa8], 0x2020
mov byte [rsp + 0xaa], 0
xor ecx, ecx
mov rdx, rdi
call r14
mov qword [0x1400a8eb0], rax
test rax, rax
je 0x1400045c0
jmp 0x14000478e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x14008b2c4]
call fcn.140004b50
lea rdx, str._n___Found:_FortniteClient_Win64_Shipping.exe_n
mov rcx, rax
call fcn.140004800
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
lea rcx, str.taskkill__F__IM_FortniteClient_Win64_Shipping.exe__T
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x40], 0x31363532
mov word [rsp + 0x44], 0x3231
lea rcx, [rsp + 0x40]
call fcn.1400041c0
movups xmm0, xmmword [0x140085096]
movaps xmmword [rsp + 0xc0], xmm0
movabs rax, 0x656e061a044e3830
mov qword [rsp + 0xcd], rax
movups xmm0, xmmword [0x140085076]
xorps xmm0, xmmword [str.123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcd]
movups xmm1, xmmword [0x140085086]
movaps xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmmword [0x1400852b0]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmm0, xmmword [rsp + 0xc0]
xorps xmm0, xmmword [0x1400852c0]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rsp + 0xd0]
xorps xmm0, xmmword [0x1400852d0]
movss dword [rsp + 0xd0], xmm0
xor byte [rsp + 0xd4], 0x65
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0xa0]
call fcn.140003c20
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea rsi, [rsp + 0x80]
cmp qword [0x1400a8eb0], 0
jne 0x14000478e
movabs rbx, 0x6574696e74726f46
lea rdi, [rsp + 0xa0]
mov r14, qword [sym.imp.USER32.dll_FindWindowA]
nop
mov qword [rsp + 0xa0], rbx
mov word [rsp + 0xa8], 0x2020
mov byte [rsp + 0xaa], 0
xor ecx, ecx
mov rdx, rdi
call r14
mov qword [0x1400a8eb0], rax
test rax, rax
je 0x140004760
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x14008a139]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [r12], 6
mov qword [r15], reloc.WS2_32.dll_ntohs
mov word [rsi + 4], 0x3033
mov dword [rsi], 0x36363737
mov rcx, rsi
call fcn.1400041c0
nop
add rsp, 0x2e0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret