Function at 0x14000f200
Capabilities:
Acquire credentials from windows credential manager
Execute command
Self delete

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0xfffffff5
mov edi, ntohl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n___
call fcn.1400183d0
mov ecx, 0xfffffff5
lea ebx, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140096bc8]
call fcn.1400183d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140096bcc]
call fcn.1400183d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.PRESS_THE_ENTER_KEY_TO_START_CLEAN_VALORANT
call fcn.1400183d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rcx, [0x140096bb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalVALORANT___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:ProgramDataRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstallRiot_Game_valorant.live___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINE_system_skCryptCurrentControlSetServices_vgkSecurity__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINE_system_skCryptCurrentControlSetServices_vgcSecurity__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallRiot_Vangard__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsVALORANT___Win64___Shipping.ex__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_CLASSES_ROOT_riotclient__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalVALORANT___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Riot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataApplication_DataRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Program_FilesRiot_Vangard___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Program_FilesRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Documents_and_SettingsAll_UsersRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_Local_SettingsRiot_Games___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__f__q_C:ProgramDataMicrosoftWindowsStart_MenuProgramsRiot_GamesVALORANT.lnk___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Riot_GamesVALORANTliveManifest_NonFSFiles_Win64.txt__f__q___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Riot_GamesVALORANTliveEngineBinariesThirdPartyCEF3Win64icdtl.dat__f__q___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Riot_GamesRiot_ClientX_natives_blob.bin__f__q___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Riot_GamesRiot_ClientXicdtl.dat__f__q___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del_C:Riot_GamesRiot_ClientXPlginsplgin___manifest.json__f__q___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Windows_vgkbootstats.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKEY_LOCAL_MACHINE_system_skCryptHardwareConfig__f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__system_skCryptdrive__Recycle.bin___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_D:_system_skCrypt_Volume_Information_tracking.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Windowswin.ini___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Windowsmemory.dmp___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsWindowsUpdate.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMIWifi.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMIRadioMgr.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMINtfsLog.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMINetCore.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMIMicrosoft___Windows___Rdp___Graphics___RdpIdd___Trace.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32LogFilesWMILwtNetLog.etl___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsUserviceProfilesNetworkServiceNTSER.DAT___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsUserviceProfilesLocalServiceAppDataLocalMicrosoftWindowsqwavecache.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsLogsDISMdism.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsDirectX.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:UsersPublicDesktopVALORANT.lnk___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username__ntser.dat.LOG2___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username__ntser.dat.LOG1___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalMicrosoftWindowsINetCacheIEcontainer.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_NTSER.DAT___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalUnrealEngine4.23SavedConfigWindowsClientManifest.ini___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalMicrosoftWindowsINetCacheIEcontainer.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalMicrosoftVaultUserProfileRoamingLatest.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalMicrosoftOneDrivelogsCommonDeviceHealthSummaryConfigration.ini___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalIconCache.db___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Users_username_AppDataLocalACINetCookiesESEcontainer.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:_system_skCrypt_Volume_Information_tracking.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:ProgramDataMicrosoftWindowsDeviceMetadataCachedmrc.idx___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:Config.Msi___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsTemporary_Internet_Files___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowslogsCBS___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsTemp___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32config_system_skCryptprofileAppDataLocalScreenTime___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32config_system_skCryptprofileAppDataLocalMicrosoftVaultUserProfileRoaming___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32config_system_skCryptprofileAppDataLocalD3DSCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32configTxR___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32WDILogFilesStartpInfo___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSystem32WDILogFiles___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsSoftwareDistribution___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsdeliveryOptimizationLogs___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsDeliveryOptimizationState___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataRoamingMicrosoftProtect___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalVirtalStore___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalUnrealEngine___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalTemp___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateDeviceSearchCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateConstraintIndex___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsWebCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsWER___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsINetCookies___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsINetCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsIEDownloadHistory___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsIECompataCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsIECompatCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftWindowsCaches___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftTerminal_Server_ClientCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalMicrosoftInternet_ExplorerCacheStorage___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalD3DSCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalCrashDmps___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Users_username_AppDataLocalConnectedDevicesPlatform___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataNVIDIA_CorporationNV_Cache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataNVIDIA_CorporationDrs_nvAppTimestamps___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataMicrosoftWindowsWER___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:PerfLogs___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:Documents_and_Settings_username_AppDataLocalApplication_DataMicrosoftWindowsCaches___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__localappdata_MicrosoftWindowsCaches___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsSystem32_restoreMachineGuid.txt___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:UsersPublicLibrariescollection.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:_system_skCrypt_Volume_InformationIndexerVolumeGuid___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:_system_skCrypt_Volume_InformationWPSettings.dat___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:_system_skCrypt_Volume_Information_tracking.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:ProgramDataMicrosoftWindowsWER___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:UsersPublicShared_Files___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsINF_setpapi.dev.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:WindowsINF_setpapi.setp.log___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:UsersPublicLibraries___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q_C:MSOCache___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:ProgramData_ntser.pol___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q_C:UsersDefaltNTSER.DAT___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._systemdrive_desktop.ini___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_vgk___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_vgk___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_vgkSecurity___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices_vgcSecurity___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallRiot_Vangard___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplicationsVALORANT_Win64_Shipping.exe___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistFA99DFC7_6AC2_453A_A5E2_5E2AFF4507BDCount___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistF2A1CB5A_E3CC_4A2E_AF9D_505A7009D442Count___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistCAA59E3C_4792_41A5_9909_6A6A8D32490ECount___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistBCB48336_4DDD_48FF_BB0B_D3190DACB3E2Count___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistB267E3AD_A825_4A09_82B9_EEC22AA3B847Count___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssistA3D53349_6E61_4557_8FC7_0028EDCEEBF6Count___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerUserAssist9E04CAB2_CC14_11DF_BB8C_A2F1DED72085Count___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKEY_CLASSES_ROOT_riotclient___f___NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalVALORANT____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Riot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataApplication_DataRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Program_FilesRiot_Vangard____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Program_FilesRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Documents_and_SettingsAll_UsersRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_Local_SettingsRiot_Games____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowslogsCBS____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsTemp____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalScreenTime____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalMicrosoftVaultUserProfileRoaming____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalD3DSCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32configTxR____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFilesStartpInfo____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFiles____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSoftwareDistribution____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsdeliveryOptimizationLogs____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsDeliveryOptimizationState____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsTemporary_Internet_Files____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowslogsCBS____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsTemp____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalScreenTime____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalMicrosoftVaultUserProfileRoaming____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32config_systemprofileAppDataLocalD3DSCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32configTxR____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFilesStartpInfo____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSystem32WDILogFiles____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsSoftwareDistribution____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:WindowsUserviceProfilesNetworkServiceAppDataLocalMicrosoftWindowsdeliveryOptimizationLogs____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataRoamingMicrosoftProtect____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalVirtalStore____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalUnrealEngine____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalTemp____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateDeviceSearchCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalPackagesMicrosoft.Windows.Search_cw5n1h2txyewyLocalStateConstraintIndex____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsWebCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsWER____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsINetCookies____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsINetCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIEDownloadHistory____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIECompataCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsIECompatCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftWindowsCaches____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftTerminal_Server_ClientCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalMicrosoftInternet_ExplorerCacheStorage____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalD3DSCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalCrashDmps____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Users_username_AppDataLocalConnectedDevicesPlatform____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataNVIDIA_CorporationNV_Cache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataNVIDIA_CorporationDrs_nvAppTimestamps____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:ProgramDataMicrosoftWindowsWER____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:PerfLogs____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q__C:Documents_and_Settings_username_AppDataLocalApplication_DataMicrosoftWindowsCaches____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___localappdata_MicrosoftWindowsCaches____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__C:WindowsSystem32_restoreMachineGuid.txt____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_UsersPublicLibrariescollection.dat____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_System_Volume_InformationIndexerVolumeGuid____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_System_Volume_InformationWPSettings.dat____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_System_Volume_Information_tracking.log____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_ProgramDataMicrosoftWindowsWER____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_UsersPublicShared_Files____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_WindowsINF_setpapi.dev.log____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_WindowsINF_setpapi.setp.log____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_UsersPublicLibraries____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RMDIR__S__Q___systemdrive_MSOCache____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_ProgramData_ntser.pol____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_UsersDefaltNTSER.DAT____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_Recovery_ntser.sys____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q___systemdrive_desktop.ini____NUL_2___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.Shadow
lea rdx, str.Clean_Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x140096bb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n___
call fcn.1400183d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140099bdc]
call fcn.1400183d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140096bcc]
call fcn.1400183d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.DONE__PRESS_ANY_KEY_TO_EXIT
call fcn.1400183d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]