Function at 0x14005a6e0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov byte [rsp + 0x40], 0x83
xor ebx, ebx
mov byte [rsp + 0x41], 0x86
movabs r14, 0x6822c898de07a7e3
mov byte [rsp + 0x42], 0x91
mov r10, r14
mov byte [rsp + 0x43], 0xec
mov r9d, ebx
movzx eax, byte [rsp + 0x40]
mov r15d, 0xf
lea rax, [rsp + 0x40]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea r8, [rsp + 0x40]
add r8, r9
and ecx, r15d
cmp rcx, r15
mov rdx, r14
cmovae rcx, r15
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, r15b
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x40], dl
inc r9
cmp r9, 4
jb 0x14005a750
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140060970]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov edi, ebx
cmp rax, 0xffffffffffffffff
je 0x14005a863
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005a85a
lea rdx, [rbp - 0x74]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14005a816
mov edi, dword [rsp + 0x68]
jmp 0x14005a85a
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14005a85a
nop dword [rax + rax]
lea rdx, [rbp - 0x74]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rdx, [rsp + 0x60]
mov rcx, rsi
test eax, eax
cmove edi, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14005a830
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140077178]
mov dword [rax + 8], edi
call fcn.14004b640
test al, al
je 0x14005a91b
mov rdi, qword [0x1400771b0]
mov rax, qword [0x140077178]
mov edx, dword [rax + 8]
mov dword [rdi], edx
cmp dword [rdi + 0x20], ebx
je 0x14005a8be
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x48]
mov edx, 6
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
mov rcx, rdi
call fcn.14004ba90
mov rcx, qword [rsp + 0x48]
jmp 0x14005a911
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], edx
mov qword [rbp + 0x168], rax
lea r8, str.FortniteClient_Win64_Shipping.exe
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rbx
mov edx, 0xff
mov qword [rbp + 0x170], rax
lea rcx, [rsp + 0x64]
mov dword [rsp + 0x40], ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x60]
mov edx, 5
mov rcx, rdi
call fcn.14004ba90
mov rcx, qword [rsp + 0x50]
mov rax, qword [0x140077178]
mov qword [rax], rcx
mov byte [rsp + 0x40], 0x83
mov byte [rsp + 0x41], 0x86
mov byte [rsp + 0x42], 0x91
mov byte [rsp + 0x43], 0xec
movzx eax, byte [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + rbx + 0x40]
mov rcx, rbx
and ecx, r15d
mov rdx, r14
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
shr rdx, cl
and dl, r15b
xor dl, al
lea eax, [rbx - 0x1d]
xor dl, al
mov byte [rsp + rbx + 0x40], dl
inc rbx
cmp rbx, 4
jb 0x14005a940
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140061c60
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret