Function at 0x140052220
Capabilities:
Enumerate gui resources
Enumerate processes
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1400e1080]
xor rax, rsp
mov qword [rsp + 0x290], rax
call fcn.140055608
call fcn.1400555b0
call fcn.14005561e
call fcn.1400555b0
call fcn.1400555dc
call fcn.1400555c6
call fcn.1400555dc
call fcn.1400555c6
call fcn.1400555f2
call fcn.140051890
lea rcx, [0x1400ced0c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Streamproof__YES_NO_____
call fcn.1400517f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], dil
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140053a90
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
cmp r8, 3
jne 0x1400522ed
lea rdx, [0x1400ced94]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400522ed
mov byte [0x14015c6af], 1
jmp 0x1400522f6
cmp byte [0x14015c6af], 1
jne 0x140052308
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, qword [0x14015bbf8]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
call fcn.14005561e
call fcn.1400555b0
call fcn.140055608
call fcn.1400555c6
call fcn.1400555dc
call fcn.1400555b0
call fcn.1400555f2
call fcn.1400555c6
call fcn.1400555dc
lea rcx, [0x1400c981e]
call fcn.1400517f0
lea rcx, str.Press_INSERT_in_game_lobby_n
call fcn.140046ce0
nop dword [rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140052350
cmp qword [0x14015bc00], 0
jne 0x14005246e
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x2a8]
call fcn.140055520
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400523f4
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400523e8
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400523be
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x58]
jmp 0x1400523ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov dword [0x14015c570], edx
lea rcx, str.processid__i
call fcn.140046ce0
mov qword [rsp + 0x20], rdi
mov eax, dword [0x14015c570]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x20]
lea rcx, [0x140050630]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14005244b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14005244b
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x14005244e
mov rax, rdi
mov qword [0x14015bc00], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14015bc00], 0
je 0x140052370
lea rcx, [0x1400ced0c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14005263f
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14005263f
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x14015bbe0], rax
test rax, rax
je 0x14005263f
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x14015bbe8], rax
test rax, rax
je 0x14005263f
lea rdx, str.NtUserSendInput
mov rcx, qword [0x14015bbe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140052545
lea rdx, str.NtUserSendInput
mov rcx, qword [0x14015bbe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140052545
lea rcx, [0x1400c981e]
call fcn.1400517f0
lea rcx, str.The_input_was_not_initialized_
call fcn.140046ce0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [r8]
movups xmmword [0x14015c5d8], xmm0
movsd xmm1, qword [r8 + 0x10]
movsd qword [0x14015c5e8], xmm1
mov eax, dword [r8 + 0x18]
mov dword [0x14015c5f0], eax
movzx eax, word [r8 + 0x1c]
mov word [0x14015c5f4], ax
mov rcx, qword [rsp + 0x2a8]
call fcn.140055520
lea rdx, str.NtUserRegisterErrorReportingDialog
mov rcx, qword [0x14015bbe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015c568], rax
test rax, rax
jne 0x1400525ed
lea rdx, str.NtUserRegisterErrorReportingDialog
mov rcx, qword [0x14015bbe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015c568], rax
test rax, rax
jne 0x1400525ed
lea rcx, [0x1400c981e]
call fcn.1400517f0
lea rcx, str.The_driver_was_not_initialized_
call fcn.140046ce0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400c981e]
call fcn.1400517f0
lea rcx, [0x14015c568]
call fcn.140046ba0
mov rdx, rax
lea rcx, str.Base:__p
call fcn.140046ce0
lea rcx, [0x14015c568]
call fcn.140046ba0
mov qword [0x14015c578], rax
call fcn.1400484e0
call fcn.140047fc0
call fcn.1400506a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400c981e]
call fcn.1400517f0
lea rcx, str.The_librarys_was_not_initialized_
call fcn.140046ce0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3