Function at 0x14004d9c0
Capabilities:
Create thread
Enumerate processes
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x140395680]
xor rax, rsp
mov qword [rbp + 0x230], rax
xor edi, edi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp - 0x6c], edi
lea rdx, [rbp - 0x6c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x6c]
or edx, 4
mov dword [rbp - 0x6c], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, str.Steam
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop word [rax + rax]
mov r9d, 0x40
lea r8, str.Information
lea rdx, str.In_the_lobby__press_OK_to_load_the_cheat_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0xc8
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
lea rcx, str..4D37E972_E525_11CE_BAC1_08002BB10318
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140395ad0], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14004dfb8
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x20], 0x238
lea rdx, [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14004dae7
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0xc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14004db1b
lea rdx, [rbp - 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14004dac2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140395ab8], edi
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Could_not_find_fortnite...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x18]
mov dword [0x140395abc], eax
mov dword [0x140395ab8], eax
test eax, eax
je 0x14004daf6
mov qword [rbp - 0x68], rdi
mov dword [rsp + 0x74], edi
mov dword [rsp + 0x70], eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x227794
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140395ad0]
call fcn.14004dfe0
mov rax, qword [rbp - 0x68]
mov qword [0x140395ac0], rax
test rax, rax
je 0x14004df93
mov byte [rbp - 0x70], 0
mov dword [rbp - 0x7c], edi
mov eax, dword [0x140395abc]
mov dword [rbp - 0x80], eax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x10
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x227784
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140395ad0]
call fcn.14004dfe0
cmp byte [rbp - 0x70], 0
je 0x14004df6e
call fcn.140047750
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov r8d, 0x11
lea rdx, str.Inject_Successful
lea rcx, [rbp - 0x60]
call fcn.140037590
nop
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003ec50
lea rdx, [0x14003f340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14004dca1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dc9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004df33
call fcn.14004e220
mov edx, 0x64
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 1
call fcn.14004e6fc
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003eea0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004df5f
cmp dword [rsp + 0x68], 0
je 0x14004df54
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14004df54
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, 1
call fcn.14004e6fc
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14003eef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14004df45
cmp dword [rsp + 0x58], 0
je 0x14004df3a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14004df3a
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140044ca0
call fcn.14004b4a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [0x140395c80]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 5
mov rcx, qword [0x140395c80]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140395c80]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004de06
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.14000b4c0
mov rbx, rax
mov dword [rax + 0x10], 0x3c888889
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rbp - 0x30]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdf4], xmm0
movd xmm0, dword [rbp - 0x2c]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdf8], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004de6b
mov byte [rbx + 0xdfc], 1
mov byte [rbx + 0x3730], 1
mov eax, dword [rbx + 0xdf8]
mov dword [rbx + 0x36e0], eax
jmp 0x14004de72
mov byte [rbx + 0xdfc], 0
mov rcx, qword [0x140395c70]
xor r8d, r8d
mov rax, qword [rcx]
cmp byte [0x1403954c0], r8b
je 0x14004de8f
mov edx, 1
jmp 0x14004de91
xor edx, edx
call qword [rax + 0x40]
call fcn.14002e780
call fcn.14002f700
call fcn.1400114e0
call fcn.140046700
call fcn.140048550
call fcn.1400130b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
mov rcx, qword [0x140395c68]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140395c78]
mov edx, 1
call qword [rax + 0x108]
mov rcx, qword [0x140395c68]
mov rax, qword [rcx]
lea r8, [rbp + 0x220]
mov rdx, qword [0x140395c78]
call qword [rax + 0x190]
call fcn.14000b130
mov rcx, rax
call fcn.14002e7c0
cmp dword [rbp - 0x58], 0x12
jne 0x14004ddb0
call fcn.14002f430
call fcn.14002fb20
xor ecx, ecx
call fcn.140009150
mov rcx, qword [0x140395c80]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14004da30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x58], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.The_driver_could_not_get_the_directory_base...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.The_driver_could_not_get_the_base_address...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.The_driver_could_not_be_found...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3