Function at 0x1400afdb0
Capabilities:
Execute command
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x398
mov rax, qword [0x1405786c0]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rdx, [0x1400afc10]
lea rcx, [rsp + 0x350]
call fcn.140007dd0
nop
lea rcx, [rsp + 0x350]
call fcn.1400a98e0
nop
call fcn.1400a87c0
movzx eax, al
test eax, eax
jne 0x1400afe75
lea rax, [rsp + 0x200]
mov qword [rsp + 0xa0], rax
lea rdx, str.admin_permission_not_found__run_EXE_as_admin_
mov rcx, qword [rsp + 0xa0]
call fcn.140097ca0
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
lea rcx, [0x140579098]
call fcn.1400aa2f0
nop
mov r8d, 0x1f4
mov edx, 0x145
lea rcx, [0x140579098]
call fcn.1400a9150
mov edx, 0x1388
lea rcx, [0x140579098]
call fcn.1400afd90
xor edx, edx
lea rcx, [0x140579098]
call fcn.1400aa450
nop
lea rax, [rsp + 0x220]
mov qword [rsp + 0xb0], rax
lea rdx, str.Loading_Auth...
mov rcx, qword [rsp + 0xb0]
call fcn.140097ca0
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x140579098]
call fcn.1400b1400
nop
lea rcx, [rsp + 0x360]
call fcn.140098340
nop
lea rcx, [0x1405792a0]
call fcn.140139930
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0xc0], rax
lea rdx, str.Please_Enter_Your_License_Key:
mov rcx, qword [rsp + 0xc0]
call fcn.140097ca0
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x140579098]
call fcn.1400ac120
nop
lea rdx, [rsp + 0x360]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400084e0
nop
lea rax, [rsp + 0x260]
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0xd0]
call fcn.140097c00
mov qword [rsp + 0xd8], rax
mov rdx, qword [rsp + 0xd8]
lea rcx, [0x1405792a0]
call fcn.14013c380
nop
movzx eax, byte [0x1405794b0]
test eax, eax
jne 0x1400afff1
lea rax, [rsp + 0x280]
mov qword [rsp + 0xe0], rax
lea rdx, str.Invalid_License_Key_Or_HWID_Mismatched
mov rcx, qword [rsp + 0xe0]
call fcn.140097ca0
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
lea rcx, [0x140579098]
call fcn.1400aa2f0
nop
mov r8d, 0x1f4
mov edx, 0x145
lea rcx, [0x140579098]
call fcn.1400a9150
mov edx, 0x8fc
lea rcx, [0x140579098]
call fcn.1400afd90
xor edx, edx
lea rcx, [0x140579098]
call fcn.1400aa450
nop
jmp 0x1400b0a36
mov edx, 0x8fc
lea rcx, [0x140579098]
call fcn.1400afd90
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0xf0], rax
lea rdx, str.Loading_Dashboard...
mov rcx, qword [rsp + 0xf0]
call fcn.140097ca0
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0xf8]
lea rcx, [0x140579098]
call fcn.1400b1400
nop
mov edx, 0x7d0
lea rcx, [0x140579098]
call fcn.1400afd90
nop
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x100], rax
lea rdx, str.YOU_MUST_LOAD_BYPASS_BEFORE_INJECTING.
mov rcx, qword [rsp + 0x100]
call fcn.140097ca0
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [0x140579098]
call fcn.1400aa2f0
nop
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x110], rax
lea rdx, str._1__Inject
mov rcx, qword [rsp + 0x110]
call fcn.140097ca0
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
lea rcx, [0x140579098]
call fcn.1400b1400
nop
lea rax, [rsp + 0x300]
mov qword [rsp + 0x120], rax
lea rdx, str._2__Load_Bypass
mov rcx, qword [rsp + 0x120]
call fcn.140097ca0
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x128]
lea rcx, [0x140579098]
call fcn.1400b1400
nop
lea rdx, [rsp + 0x348]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
nop
mov eax, dword [rsp + 0x348]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 1
je 0x1400b0151
cmp dword [rsp + 0x48], 2
je 0x1400b0678
jmp 0x1400b0a36
lea rcx, str.__n_____Waiting_For_Fortnite.
call fcn.1400b1b90
nop
cmp qword [0x140579160], 0
jne 0x1400b0185
lea rdx, str.Fortnite
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140579160], rax
jmp 0x1400b015e
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [0x140579568]
call fcn.1400aa610
mov dword [0x140579570], eax
lea rcx, [0x140579568]
call fcn.1400aa540
mov qword [0x140579580], rax
lea rcx, [0x140579568]
call fcn.14009c270
mov qword [0x140579578], rax
cmp qword [0x140579578], 0
jne 0x1400b01db
lea rcx, str.__n_____Failed_to_target_process_directory_table_base.
call fcn.1400b1b90
nop
mov rdx, qword [0x140579578]
lea rcx, str.__n_____Got_target_directory_table_base:_0x_llx
call fcn.1400b1b90
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140579268], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140579274], eax
mov dword [rsp + 0x44], 0
jmp 0x1400b0221
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x7fffffff
jge 0x1400b04ee
imul eax, dword [rsp + 0x44], 0x1000
cdqe
mov rcx, qword [0x140579580]
add rcx, rax
mov rax, rcx
mov qword [0x140579278], rax
mov rax, qword [0x140579278]
add rax, 0x122ceee8
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
add rax, 0x30
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x70], 0
je 0x1400b04e9
cmp qword [rsp + 0x78], 0
je 0x1400b04e9
mov rax, qword [rsp + 0x78]
add rax, 0xc0
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
cmp rax, qword [rsp + 0x70]
jne 0x1400b04e9
mov byte [reloc.WS2_32.dll_accept], 0
lea rcx, [0x1401d51c8]
call fcn.1400b1b90
nop
cmp qword [0x140579160], 0
jne 0x1400b02f8
lea rcx, [0x1401d51f8]
call fcn.1400b1b90
call fcn.14009d440
nop
mov rdx, qword [0x140579580]
lea rcx, [0x1401d5220]
call fcn.1400b1b90
lea rcx, [0x1401d5250]
call fcn.1400b1b90
lea rdx, [rsp + 0x340]
mov rcx, qword [0x140579160]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
cmp dword [rsp + 0x340], 0
jne 0x1400b0349
lea rcx, [0x1401d5270]
call fcn.1400b1b90
call fcn.14009d440
nop
mov edx, dword [rsp + 0x340]
lea rcx, [0x1401d52a0]
call fcn.1400b1b90
lea rcx, [0x1401d52c8]
call fcn.1400b1b90
nop
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1400b0386
lea rcx, [0x1401d52f0]
call fcn.1400b1b90
call fcn.14009d440
nop
mov rdx, qword [0x140579580]
lea rcx, [0x1401d5330]
call fcn.1400b1b90
lea rcx, [0x1401d5370]
call fcn.1400b1b90
nop
cmp qword [0x140579278], 0
jne 0x1400b03bd
lea rcx, [0x1401d5388]
call fcn.1400b1b90
nop
mov rax, qword [0x140579278]
add rax, 0x122ceee8
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400b03f3
lea rcx, str.__n_____failed_to_get_uworld.
call fcn.1400b1b90
nop
mov rax, qword [rsp + 0x50]
add rax, 0x1d8
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x1400b042d
lea rcx, str.__n_____failed_to_get_gameinstance.
call fcn.1400b1b90
nop
lea rcx, str.__n_____Testing_Game_Writing...
call fcn.1400b1b90
mov ecx, 0x743
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.__n_____Writing_Control_Good__Testing_Game_Reading...
call fcn.1400b1b90
mov ecx, 0x743
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.__n_____Reading_Control_Good.
call fcn.1400b1b90
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8, str.device.dll
lea rdx, str.Press_OK_In_Lobby
mov rcx, qword [0x140579188]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [0x140579278]
lea rcx, [0x1401d54a8]
call fcn.1400b1b90
mov rdx, qword [0x140579580]
lea rcx, str.__n_____Got_driverarray:_0x_llx
call fcn.1400b1b90
mov rdx, qword [rsp + 0x50]
lea rcx, str.__n_____Got_uworld:_0x_llx
call fcn.1400b1b90
mov rdx, qword [rsp + 0x80]
lea rcx, str.__n_____Got_gameinstance:_0x_llx
call fcn.1400b1b90
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call fcn.1400b0a70
nop
jmp 0x1400b04ee
jmp 0x1400b0217
xor eax, eax
cmp eax, 1
je 0x1400b0566
mov dword [rsp + 0x40], 0
jmp 0x1400b0509
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x19
jge 0x1400b0564
imul eax, dword [rsp + 0x40], 0x1000
cdqe
mov rcx, qword [0x140579580]
lea rax, [rcx + rax + 0x250]
mov rdx, rax
lea rcx, [0x140579568]
call fcn.140096c00
cmp rax, 0x70f8600
jne 0x1400b0562
mov eax, dword [rsp + 0x40]
inc eax
imul eax, eax, 0x1000
cdqe
mov rcx, qword [0x140579580]
add rcx, rax
mov rax, rcx
mov qword [0x140579278], rax
jmp 0x1400b04ff
jmp 0x1400b04ee
lea rcx, str.__n_____Searching_for_target_window...
call fcn.1400b1b90
nop
cmp qword [0x140579160], 0
jne 0x1400b058f
lea rcx, str.__n_________Target_window_not_found
call fcn.1400b1b90
call fcn.14009d440
nop
mov rdx, qword [0x140579580]
lea rcx, str.__n_____Target_window_found_with_HWND_0x_p
call fcn.1400b1b90
lea rcx, str.__n_____Resolving_process_ID...
call fcn.1400b1b90
lea rdx, [rsp + 0x344]
mov rcx, qword [0x140579160]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
cmp dword [rsp + 0x344], 0
jne 0x1400b05e0
lea rcx, str.__n_________Failed_to_resolve_process_ID
call fcn.1400b1b90
call fcn.14009d440
nop
mov edx, dword [rsp + 0x344]
lea rcx, str.__n_____Process_ID_resolved_to__u
call fcn.1400b1b90
lea rcx, str.__n_____Connecting_to_the_process...
call fcn.1400b1b90
nop
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1400b061d
lea rcx, str.__n_________Failed_to_connect_to_the_process_overlay_backend
call fcn.1400b1b90
call fcn.14009d440
nop
mov rdx, qword [0x140579580]
lea rcx, str.__n_____Connected_to_the_process_with_mapped_address_0x_p
call fcn.1400b1b90
lea rcx, str.__n_____Drawing...
call fcn.1400b1b90
nop
cmp qword [0x140579278], 0
jne 0x1400b0654
lea rcx, str.__n_____failed_to_connect_to_game.
call fcn.1400b1b90
nop
mov rdx, qword [0x140579278]
lea rcx, str.__n_____Got_va_text:_0x_llx
call fcn.1400b1b90
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call fcn.1400b0a70
nop
jmp 0x1400b0a36
lea rcx, [0x1401d5740]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x58], 5
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x130]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, [0x1401d5750]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401d5778]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x5c], 5
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x138]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, [0x1401d5790]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401d57b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x60], 5
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x140]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, [0x1401d57c8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401d57f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x64], 5
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x148]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, [0x1401d5800]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401d5828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x68], 5
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x150]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, [0x1401d5838]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp qword [0x140579200], 0
jne 0x1400b07f2
lea rdx, [0x1401d5864]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140008870
mov qword [rsp + 0x88], rax
lea rdx, [0x140094820]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x140579200]
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, str.start_regedit
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [str.C:WindowsStartup.bat]
lea rcx, [rsp + 0x160]
call fcn.140097ca0
nop
mov r8d, 0x3c5
lea rdx, str._echo_off_r_ncolor_b_r_necho_checking_for_admin.._r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n_r_nif__errorlevel__NEQ_0___r_n____echo_no_admin__requesting_admin..._r_n____goto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_n____echo_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_n____echo_UAC.ShellExecute__cmd.exe_____c____s0__________runas___1______temp_getadmin.vbs__r_n______temp_getadmin.vbs__r_n____del___temp_getadmin.vbs__r_n____exit__B_r_n_r_n:gotAdmin_r_n____pushd___CD___r_n____cd__d___dp0__r_n_r_necho_we_are_admin._r_ncls_r_n_r_nset__currentDir_cd___r_nset__tempDir_TEMP___r_n_r_n::_Check_if_the_current_directory_is_inside_the_TEMP_folder_r_nif__i___currentDir____tempDir_____r_n____echo_Please_extract_the_zip__r_n____pause_nul_r_n____exit__b_r_n__r_n_r_nsc_stop_RTCore64__nul_2_1_r_necho_loading_aimbot__provider:_1__RTCore64__r_ncolor_b_r_n_r_nDrvLdr.exe__map__fortnitewin_inject.sys___prv_1_r_necho._r_ncolor_b_r_necho_done_loading._r_n
lea rcx, [rsp + 0x160]
call fcn.14009c160
nop
lea rcx, [rsp + 0x160]
call fcn.140099fb0
nop
mov rdx, qword [str.C:Windowsdrv64.dll]
lea rcx, [rsp + 0x180]
call fcn.140097ca0
nop
mov r8d, 0x138c00
lea rdx, [0x1403d8a50]
lea rcx, [rsp + 0x180]
call fcn.14009c160
nop
lea rcx, [rsp + 0x180]
call fcn.140099fb0
nop
mov rdx, qword [str.C:Windows_fortnitewin_inject.sys]
lea rcx, [rsp + 0x1a0]
call fcn.140097ca0
nop
mov r8d, 0x2400
lea rdx, [0x1403bae80]
lea rcx, [rsp + 0x1a0]
call fcn.14009c160
nop
lea rcx, [rsp + 0x1a0]
call fcn.140099fb0
nop
mov rdx, qword [str.C:WindowsTaigei64.dll]
lea rcx, [rsp + 0x1c0]
call fcn.140097ca0
nop
mov r8d, 0x1b400
lea rdx, [0x1403bd650]
lea rcx, [rsp + 0x1c0]
call fcn.14009c160
nop
lea rcx, [rsp + 0x1c0]
call fcn.140099fb0
nop
mov rdx, qword [str.C:WindowsDrvLdr.exe]
lea rcx, [rsp + 0x1e0]
call fcn.140097ca0
nop
mov r8d, 0x5bc00
lea rdx, [0x140511650]
lea rcx, [rsp + 0x1e0]
call fcn.14009c160
nop
lea rcx, [rsp + 0x1e0]
call fcn.140099fb0
nop
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsStartup.bat__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov dword [rsp + 0x6c], 0x7d0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x158]
call fcn.1400080d0
mov rcx, rax
call fcn.140096f20
nop
lea rcx, str.taskkill__IM_regedit.exe__F__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xfffffffffffffffe
mov rcx, qword [0x140579200]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
lea rax, [rsp + 0x320]
mov qword [rsp + 0x90], rax
lea rdx, str.Successfully_Loaded_Bypass.
mov rcx, qword [rsp + 0x90]
call fcn.140097ca0
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x140579098]
call fcn.1400b1400
nop
mov ecx, 0x518
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400a8cf0
nop
lea rcx, [rsp + 0x360]
call fcn.140099fb0
nop
lea rcx, [rsp + 0x350]
call fcn.14009a780
nop
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401cb6f0
add rsp, 0x398
ret