Function at 0x180069210
Capabilities:
Encode data using xor
Enumerate processes
Link many functions at runtime
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x180111618]
xor rax, rsp
mov qword [rbp + 0xc0], rax
lea rcx, str.C:dd32695.x64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rdx, str.DD_btn
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b30], rax
lea rdx, str.DD_key
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b38], rax
lea rdx, str.DD_mov
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b40], rax
lea rdx, str.DD_str
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b48], rax
lea rdx, str.DD_todc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b50], rax
lea rdx, str.DD_movR
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180112b58], rax
xor ecx, ecx
call qword [0x180112b30]
mov rcx, qword [0x180112c28]
call fcn.180068c80
call fcn.180005bc0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180112e50], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180112e54], eax
xor edi, edi
cmp qword [0x180112ac8], rdi
jne 0x18006936f
nop dword [rax + rax]
mov dword [rsp + 0x40], 0xa0f133d
mov dword [rsp + 0x44], 0xe7f5e911
mov word [rsp + 0x48], 0xa4a3
xor eax, eax
mov byte [rsp + 0x4a], al
mov edx, edi
nop
movsxd rcx, edx
lea eax, [rdx + 0x7b]
xor byte [rsp + rcx + 0x40], al
inc edx
cmp edx, 0xa
jb 0x180069340
mov byte [rsp + 0x4a], dil
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180112ac8], rax
test rax, rax
je 0x180069320
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x80], 0x130
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1800693c7
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1800693b6
lea rdx, [rbp - 0x80]
call sub.KERNEL32.dll_Process32Next
jmp 0x18006938f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x78]
mov dword [0x180112d70], ecx
jmp 0x1800693d2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
movsxd rax, ecx
mov qword [0x180112c18], rax
call fcn.180005fe0
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.180005930
mov qword [0x180112d78], rax
mov rcx, rax
call fcn.1800059e0
mov ecx, 1
call fcn.18006e3a4
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x18004deb0]
xor edx, edx
xor ecx, ecx
call fcn.180086488
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x180069808
cmp dword [rbp + 0xb8], 0
je 0x180069819
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18006d8bc
test eax, eax
jne 0x180069824
lea ecx, [rax + 1]
call fcn.18006e3a4
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x18004df10]
xor edx, edx
xor ecx, ecx
call fcn.180086488
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x1800697f7
cmp dword [rbp + 0xb8], 0
je 0x18006982c
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18006d8bc
test eax, eax
jne 0x180069837
lea rdx, str.MedalOverlay
lea rcx, str.MedalOverlayClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180112ac0], rax
test rax, rax
jne 0x180069515
lea r9d, [rax + 2]
lea r8, str.Overlay
lea rdx, str.Medal_Not_Found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1800695fd
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 1]
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
je 0x1800695fd
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
test eax, eax
je 0x1800695fd
mov edx, 0xffffffec
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x20
mov r8d, eax
mov edx, 0xffffffec
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
test eax, eax
je 0x1800695fd
movdqa xmm0, xmmword [0x1800aba50]
movdqu xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
mov rcx, qword [0x180112ac0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
test eax, eax
js 0x1800695fd
mov edx, 5
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor edx, edx
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x180112c20]
call fcn.1800687d0
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rdi, qword [0x180112c20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
nop
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 5
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x180112ac0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x180069689
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.180010660
mov rbx, rax
mov rcx, qword [0x180112ac0]
mov qword [rax + 0xc8], rcx
mov dword [rax + 0x10], 0x3c888889
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe00], xmm0
movd xmm1, dword [rsp + 0x44]
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0xe04], xmm1
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800696ff
mov byte [rbx + 0xe08], 1
mov byte [rbx + 0x3740], 1
mov eax, dword [rbx + 0xe04]
mov dword [rbx + 0x36f0], eax
jmp 0x180069706
mov byte [rbx + 0xe08], 0
xor ecx, ecx
call fcn.18002bf40
call fcn.1800348f0
call fcn.1800357b0
call fcn.180017720
mov rcx, qword [0x180112c30]
call fcn.18005c9f0
mov rcx, qword [0x180112c58]
call fcn.180051b50
mov rcx, rdi
call fcn.180069840
call fcn.180019fe0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov rcx, qword [0x180112ad8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x180112ae8]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x180112ad8]
mov rax, qword [rcx]
lea r8, [rbp + 0xb0]
mov rdx, qword [0x180112ae8]
call qword [rax + 0x190]
call fcn.1800102e0
mov rcx, rax
call fcn.180034930
mov rcx, qword [0x180112ae0]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [rax + 0x40]
cmp dword [rsp + 0x58], 0x12
jne 0x180069630
call fcn.180035590
call fcn.180035ac0
xor ecx, ecx
call fcn.18000e0c0
mov rcx, qword [0x180112ac0]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.18006e500
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov dword [rbp + 0xb8], edi
mov ecx, 6
call fcn.18006da6c
nop
mov dword [rbp + 0xb8], edi
mov ecx, 6
call fcn.18006da6c
nop
mov ecx, 1
call fcn.18006da6c
int3
mov ecx, eax
call fcn.18006da30
nop
mov ecx, 1
call fcn.18006da6c
int3
mov ecx, eax
call fcn.18006da30
int3