Function at 0x140001490
Capabilities:
Acquire credentials from windows credential manager
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x390]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x390]
call fcn.1400060d0
nop
movdqa xmm0, xmmword [0x140009a50]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400098d0]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x9e95de96
mov word [rsp + 0x44], 0x9f
mov byte [rsp + 0x46], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x25
jb 0x140001510
mov byte [rsp + 0x46], bl
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x390]
call fcn.140005fc0
mov r8d, 0x296b0
lea rdx, [0x140029cf0]
lea rcx, [rbp + 0x390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x398]
call fcn.140006690
test rax, rax
jne 0x140001582
mov rax, qword [rbp + 0x390]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x390]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x280]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x280]
call fcn.1400060d0
nop
movdqa xmm0, xmmword [0x140009a50]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140009af0]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x82899c
mov byte [rsp + 0x44], 1
mov rcx, rbx
nop
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x23
jb 0x1400015d0
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x280]
call fcn.140005fc0
mov r8d, 0x8788
lea rdx, [0x1400b1a10]
lea rcx, [rbp + 0x280]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x288]
call fcn.140006690
test rax, rax
jne 0x140001643
mov rax, qword [rbp + 0x280]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x280]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x170]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x170]
call fcn.1400060d0
nop
movdqa xmm0, xmmword [0x140009a50]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400096d0]
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x40], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1f
jb 0x140001690
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call fcn.140005fc0
mov r8d, 0x5e670
lea rdx, [0x1400533a0]
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x178]
call fcn.140006690
test rax, rax
jne 0x140001703
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x170]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x60]
call fcn.1400060d0
nop
movdqa xmm0, xmmword [0x140009a80]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x10085a7
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x140001740
mov byte [rsp + 0x33], 0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140005fc0
mov r8d, 0xf6b3
lea rdx, [0x14000d050]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x68]
call fcn.140006690
test rax, rax
jne 0x1400017a4
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x50]
call fcn.1400060d0
nop
movdqa xmm0, xmmword [0x140009ac0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400098e0]
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x40], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx - 0x31]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x20
jb 0x1400017f0
mov byte [rsp + 0x41], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140005fc0
mov r8d, 0xd5d3
lea rdx, str._echo_off_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsVALORANT_Win64_Shipping.exe___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistFA99DFC7_6AC2_453A_A5E2_5E2AFF4507BDCount___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF2A1CB5A_E3CC_4A2E_AF9D_505A7009D442Count___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCAA59E3C_4792_41A5_9909_6A6A8D32490ECount___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistBCB48336_4DDD_48FF_BB0B_D3190DACB3E2Count___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistB267E3AD_A825_4A09_82B9_EEC22AA3B847Count___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistA3D53349_6E61_4557_8FC7_0028EDCEEBF6Count___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist9E04CAB2_CC14_11DF_BB8C_A2F1DED72085Count___f_r_nreg_delete__HKEY_CLASSES_ROOT_riotclient___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_USERSS_1_5_21_2097722829_2509645790_3642206209_1001SoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineIdentifiers___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineHardware_Survey___f_r_nreg_delete__HKEY_LOCAL_MACHINESYSTEMHardwareConfig___f_r_nreg_delete__HKEY_LOCAL_MACHINESystemCurrentControlSetControl___v_SystemStartOptions__f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineHardware_Survey___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineIdentifiers___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineHardware_Survey___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineIdentifiers___f_r_nreg_delete__HKEY_CLASSES_ROOTcom.epicgames.launcher___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpicGames___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpicGames___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREEpicGames___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassesInstallerDependencies___v_MSICache__f_r_nreg_delete__HKEY_CURRENT_USERSoftwareMicrosoftDirect3D___v_WHQLClass__f_r_nreg_delete__HKEY_CLASSES_ROOTcom.epicgames.launcher___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSOFTWAREEpicGames___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassesInstallerDependencies___v_MSICache__f_r_nreg_delete__HKEY_CURRENT_USERSoftwareClassescom.epicgames.launcher___f_r
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x58]
call fcn.140006690
test rax, rax
jne 0x14000185a
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400018c0
nop
lea rcx, [rbp + 0x60]
call fcn.1400018c0
nop
lea rcx, [rbp + 0x170]
call fcn.1400018c0
nop
lea rcx, [rbp + 0x280]
call fcn.1400018c0
nop
lea rcx, [rbp + 0x390]
call fcn.1400018c0
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140007400
mov rbx, qword [rsp + 0x5c0]
add rsp, 0x5b0
pop rbp
ret