Function at 0x14004f2c0
Capabilities:
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0xb0
mov rax, qword [0x14016d600]
xor rax, rsp
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x28], rax
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
bts rax, 0x13
mov r8, rax
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, 0x14
mov ecx, 0x50
call fcn.140046c70
mov dword [rsp + 0x24], 0xb
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x21]
call fcn.140039080
call fcn.14003bc20
mov qword [rsp + 0x40], rax
lea rcx, [0x1400595c4]
call qword [rsp + 0x40]
cmp qword [0x14016dd00], 0
jne 0x14004f3b3
lea rdx, str.Fortnite
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14016dd00], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004f386
call fcn.14003bc20
mov qword [rsp + 0x48], rax
lea rcx, [0x1400595d4]
call qword [rsp + 0x48]
lea rcx, [0x1400595d8]
call fcn.14004abc0
mov dword [0x14016dcf0], eax
call fcn.140048b60
movzx eax, al
test eax, eax
jne 0x14004f408
lea rcx, str.____The_driver_was_not_initialized_
call fcn.14001aa50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x14004f41d
call fcn.14003bc20
mov qword [rsp + 0x50], rax
lea rcx, [0x140059624]
call qword [rsp + 0x50]
lea rax, [0x140048a40]
test rax, rax
jne 0x14004f437
lea rcx, str.____The_driver_was_not_attached_
call fcn.14001aa50
jmp 0x14004f44c
call fcn.14003bc20
mov qword [rsp + 0x58], rax
lea rcx, [0x14005964c]
call qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Press_Win__H_in_lobby
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14004f48b
mov ecx, 0x48
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x14004f498
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004f461
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x22]
call fcn.14003dcc0
mov rcx, rax
call fcn.14003d920
mov rcx, rax
call fcn.14001aa50
call fcn.14003bc20
mov qword [rsp + 0x60], rax
lea rcx, [0x140059668]
call qword [rsp + 0x60]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.14004af10
mov qword [rsp + 0x78], rax
call fcn.14004b7e0
call fcn.1400457b0
lea rcx, str.FortniteClient_Win64_Shipping_EAC.exe
call fcn.14004abc0
mov eax, eax
mov qword [0x14016dc08], rax
lea rcx, [0x1400596c0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.1400383e0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.14004a2d0
nop
lea rcx, [rsp + 0x80]
call fcn.14003d630
call fcn.14004eb60
call fcn.14004ec50
call fcn.14004ef00
xor eax, eax
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14004f9f0
add rsp, 0xb0
pop rdi
ret