Function at 0x140052640
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x1400a6040]
xor rax, rsp
mov qword [rbp + 0x230], rax
xor ecx, ecx
xor esi, esi
call fcn.140068f20
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140053000
mov rdi, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov rbx, qword [rbp - 0x30]
cmp rdi, 0xf
mov r9, qword [rbp - 0x20]
movabs r8, 0xcbf29ce484222325
cmova rdx, rbx
mov ecx, esi
test r9, r9
je 0x1400526d3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r8, rax
imul r8, r10
cmp rcx, r9
jb 0x1400526c0
lea rdx, str.._08X
lea rcx, [rbp - 0x10]
call fcn.140016f60
cmp rdi, 0xf
jbe 0x14005271a
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140052712
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052d30
mov rcx, rbx
call fcn.1400542b4
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x28], 0x40000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
mov ecx, 2
mov qword [0x1400aa8f0], rax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400527a9
nop dword [rax]
nop word [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp + 0x1c]
call fcn.140068d9c
mov rcx, rbx
test eax, eax
je 0x140052d1c
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140052780
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x1400aa8e8]
mov eax, ebx
mov dword [0x1400a8eb0], ebx
mov byte [rbp - 0x40], sil
call fcn.1400531f0
xor eax, 0x7f1e8b
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x60], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x68], rax
call fcn.1400531f0
mov rcx, qword [0x1400aa8f0]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rsi
or eax, 0x88000
shl eax, 2
mov r9d, 0x10
mov qword [rsp + 0x30], rsi
mov edx, eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp - 0x38], rsi
call fcn.1400531f0
xor eax, 0x7f1e8b
mov dword [rsp + 0x60], eax
mov eax, dword [0x1400aa8e8]
mov dword [rsp + 0x64], eax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x68], rax
call fcn.1400531f0
mov rcx, qword [0x1400aa8f0]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rsi
or eax, 0x88000
shl eax, 2
mov r9d, 0x10
mov qword [rsp + 0x30], rsi
mov edx, eax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [0x1400a6090], 2
mov ecx, esi
movups xmm3, xmmword [str.rPAVuQRE_JIe]
mov r10, qword [rbp - 0x38]
movzx eax, byte [0x140095d4c]
mov edx, dword [0x140095d48]
movups xmmword [rbp - 0x30], xmm3
mov qword [0x1400a8ea8], r10
mov dword [rbp - 0x20], edx
mov byte [rbp - 0x1c], al
jl 0x140052adc
movdqa xmm5, xmmword [0x140096490]
movdqa xmm2, xmmword [0x1400960c0]
movdqa xmm4, xmmword [0x140096120]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x1400960e0]
movaps xmmword [rsp + 0x350], xmm6
movdqa xmm6, xmmword [str.9999]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movaps xmmword [rsp + 0x340], xmm7
movdqa xmm7, xmmword [0x140096130]
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rbp - 0x30], xmm2
movdqa xmm2, xmmword [0x1400960d0]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
pmuldq xmm1, xmm5
movd xmm0, dword [rbp - 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rbp - 0x2c], xmm2
movdqa xmm2, xmmword [0x1400960f0]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rbp - 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
pmuldq xmm1, xmm5
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rbp - 0x28], xmm3
shufps xmm1, xmm0, 0xdd
movdqa xmm3, xmmword [0x140096100]
paddd xmm1, xmm2
psrad xmm1, 5
mov ecx, 0x14
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rbp - 0x24]
andps xmm2, xmm4
packuswb xmm2, xmm2
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rbp - 0x24], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x350]
psubd xmm3, xmm0
andps xmm3, xmm4
movd xmm0, edx
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movaps xmm7, xmmword [rsp + 0x340]
xorps xmm3, xmm0
movd dword [rbp - 0x20], xmm3
mov eax, ecx
lea r9, [rbp - 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul r8d, eax, 0x39
movzx eax, cl
inc ecx
sub al, r8b
add al, 0x30
xor byte [r9 - 1], al
cmp ecx, 0x15
jl 0x140052af0
mov rdx, r10
lea rcx, [rbp - 0x30]
call fcn.14003cdb0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400490b0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140052520]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0x50
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
mov edx, 0x7f00
movdqu xmmword [rbp - 0x60], xmm0
lea rax, str.XYZAB
xor ecx, ecx
mov qword [rbp - 0x50], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x48], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
cmp byte [0x1400956b5], sil
movzx eax, word [0x1400956b4]
mov word [rbp - 0x40], ax
je 0x140052c0e
xor byte [rbp - 0x3f], 0x31
mov byte [rbp - 0x40], 0x58
cmp byte [0x1400956b5], sil
movzx eax, word [0x1400956b4]
mov word [rbp - 0x38], ax
je 0x140052c2a
xor byte [rbp - 0x37], 0x31
mov byte [rbp - 0x38], 0x58
mov rax, qword [rbp - 0x78]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x58], rsi
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x50], rax
mov r9d, 0x80000000
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x1400a8e80], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1400a8e80]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140096030]
lea rdx, [rbp - 0x30]
mov rcx, qword [0x1400a8e80]
movdqu xmmword [rbp - 0x30], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1400a8e80]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400a8e80]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140048480
call fcn.1400521e0
xor eax, eax
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140053ea0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 8]
mov dword [0x1400aa8e8], ebx
jmp 0x1400527b8
call fcn.140069338
int3