Function at 0x140002e20
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb90]
sub rsp, 0xc90
xor esi, esi
lea rcx, str.BananaCleaner__secwin.lol__made_by_dvl
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping_EAC.exe
call fcn.14000e640
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe
call fcn.14000e640
lea rcx, str.taskkill__f__im_FortniteLauncher.exe
call fcn.14000e640
lea rcx, str.taskkill__f__im_EpicGamesLauncher.exe
call fcn.14000e640
lea rdx, str.This_was_made_by_di_vi_el___.mmcopymemory_n
lea rcx, [0x140038550]
call fcn.140004a10
lea rdx, str.Reset_adapters_REQUIRES_DRIVER_REINSTALLATION__y_n____
lea rcx, [0x140038550]
call fcn.140004a10
call fcn.14000e3e0
lea ecx, [rax - 0x59]
mov r12d, 0xff
movabs r14, 0x7fffffffffffffff
test cl, 0xdf
je 0x140002fb3
cmp al, 0x6e
je 0x140002ecf
cmp al, 0x4e
jne 0x140002ea6
movabs rdi, 0x7ffffffed5fa0dff
movabs r15, 0x12a05f200
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rbx, rax
test rax, rax
je 0x140002f48
lea r8, str.https:__google.com
mov edx, 0x2712
mov rcx, rax
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov edx, 0x2c
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov edx, 0xd
mov r8d, 0xa
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_perform]
mov rcx, rbx
test eax, eax
je 0x140003180
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
lea rdx, str.Internet_not_back_yet..._retrying_after_5_seconds
lea rcx, [0x140038550]
call fcn.140004a10
mov rcx, rax
call fcn.140004cc0
lea rcx, [rbp + 0xbc8]
call fcn.140001230
mov rax, qword [rbp + 0xbc8]
mov qword [rbp + 0xbc0], rax
cmp rax, rdi
je 0x140003168
mov ecx, 1
cmovl ecx, r12d
test cl, cl
jns 0x140003168
lea rcx, [rax + r15]
mov qword [rbp + 0xbc0], rcx
lea rcx, [rbp + 0xbc0]
call fcn.140005880
jmp 0x140002ee3
call fcn.1400022f0
lea rcx, [rbp + 0xbc0]
call fcn.140001230
mov rax, qword [rbp + 0xbc0]
mov qword [rbp + 0xbc0], rax
movabs rdx, 0x7fffffff88ca6bff
cmp rax, rdx
je 0x140002ffd
mov ecx, 1
cmovl ecx, r12d
test cl, cl
jns 0x140002ffd
add rax, 0x77359400
mov qword [rbp + 0xbc0], rax
jmp 0x140003004
mov qword [rbp + 0xbc0], r14
lea rcx, [rbp + 0xbc0]
call fcn.140005880
mov r9d, 0xa
xor r8d, r8d
xor edx, edx
lea rcx, [0x140026520]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002ecf
mov dword [rsp + 0x50], 0x20
mov edi, esi
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140002ecf
nop word [rax + rax]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140003149
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0x790]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xbc0]
mov r8d, 0xe
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x140003149
mov qword [rsp + 0x20], rsi
mov r9d, 0x200
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
je 0x140003149
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003fd0
nop
lea rdx, [rsp + 0x70]
call fcn.1400020c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140003149
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003144
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033bc
call fcn.140008610
inc edi
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140003060
jmp 0x140002ecf
mov qword [rbp + 0xbc0], r14
lea rcx, [rbp + 0xbc0]
call fcn.140005880
jmp 0x140002ee3
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
lea rdx, str.__RegFile_Thread___Starting_FileTrace_cleaner...
lea rcx, [0x140038550]
call fcn.140004a10
mov rcx, rax
call fcn.140004cc0
mov ecx, 8
call fcn.140008618
lea rcx, [0x140002980]
mov qword [rax], rcx
mov qword [rbp + 0xbc0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140005d20]
xor edx, edx
xor ecx, ecx
call fcn.14000e190
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400033ad
cmp dword [rsp + 0x48], 0
je 0x1400033c2
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x48], eax
je 0x1400033cd
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140008040
test eax, eax
jne 0x1400033d8
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [0x140037cc0]
lea rdi, [0x140037d38]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.1400024f0
add rbx, 0x18
cmp rbx, rdi
jne 0x140003240
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_BIOS___v_BIOSVendor__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_BIOS___v_BIOSReleaseDate__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_BIOS___v_SystemManufacturer__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_BIOS___v_SystemProductName__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_BIOS___v_SystemManufacturer__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_Hardware_Description_System_CentralProcessor_0___v_ProcessorNameString__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINE_System_CurrentControlSet_Control___v_SystemStartOptions__f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.reg_delete__HKEY_CURRENT_USER_Software_Epic_Games___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.EG_ADD_HKLM_SYSTEM_CurrentControlSet_Control_ComputerName_ComputerName__v_ComputerName__t_REG_SZ__d_EPIC__random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SYSTEM_CurrentControlSet_Control_ComputerName_ActiveComputerName__v_ComputerName__t_REG_SZ__d_EPIC__random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SYSTEM_HardwareConfig__v_LastConfig__t_REG_SZ__d_be_random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD__HKLMSYSTEMCurrentControlSetControlIDConfigDBHardwareProfiles0001___v_HwProfileGuid__t_REG_SZ__d___random___random___random___random____f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SYSTEM_CurrentControlSet_Control_IDConfigDB_Hardware_Profiles_0001__v_GUID__t_REG_SZ__d_fefefe_random___random___random___random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Windows_NT_CurrentVersion__v_BuildGUID__t_REG_SZ__d_Norc_random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Windows_NT_CurrentVersion__v_RegisteredOwner__t_REG_SZ__d_Norc_random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Windows_NT_CurrentVersion__v_RegisteredOrganization__t_REG_SZ__d_Norc_random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Cryptography__v_GUID__t_REG_SZ__d_Norc_random___random___random___random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Cryptography__v_MachineGuid__t_REG_SZ__d_hello_random___random___random___random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Windows_NT_CurrentVersion__v_ProductId__t_REG_SZ__d__random___random___random___random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SOFTWARE_Microsoft_Windows_NT_CurrentVersion__v_InstallDate__t_REG_SZ__d__random___f__NUL_2_NUL
call fcn.14000e640
lea rcx, str.REG_ADD_HKLM_SYSTEM_CurrentControlSet_Control_SystemInformation__v_ComputerHardwareId__t_REG_SZ__d_randomd_random___random___random___random___f__NUL_2_NUL
call fcn.14000e640
call fcn.1400025c0
lea rdx, str.BananaCleaner_has_finished_
lea rcx, [0x140038550]
call fcn.140004a10
mov rcx, rax
call fcn.140004cc0
lea rcx, str.pause
call fcn.14000e640
nop
cmp dword [rsp + 0x48], 0
jne 0x1400033a7
xor eax, eax
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14000e788
nop
mov dword [rsp + 0x48], esi
mov ecx, 6
call fcn.1400061b8
nop
call fcn.14000ebd4
nop
mov ecx, 1
call fcn.1400061b8
int3
mov ecx, 5
call fcn.1400061b8
int3
mov ecx, 2
call fcn.1400061b8
int3