Function at 0x140042a00
Capabilities:
Check for foreground window switch
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov dword [rsp + 0x40], 0xe6e4e6f0
mov ecx, edi
mov dword [rsp + 0x44], 0xf9e2eaf8
mov dword [rsp + 0x48], 0x1008f8e
nop word [rax + rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140042a30
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4b], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1402982e8], rax
call fcn.140042580
lea rdx, [0x1402982e0]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
js 0x140042c55
cvttss2si rax, dword [0x140298300]
mov rcx, qword [0x1402982e0]
lea rdx, [0x140298640]
mov r9, qword [0x140298638]
mov qword [rsp + 0x30], rdx
lea rdx, [0x140298270]
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [0x14029827c], rdi
mov qword [0x140298288], 1
mov qword [0x1402982a4], rdi
mov dword [0x1402982ac], edi
lea r8d, [rdx + 1]
mov dword [0x140298278], 0x15
mov dword [0x140298270], eax
cvttss2si rax, dword [0x140298264]
mov dword [0x140298284], edi
mov dword [0x1402982a0], 0x50
mov dword [0x14029829c], 1
mov qword [0x140298290], r9
mov dword [0x140298298], 1
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov dword [0x140298274], eax
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
call fcn.140005ba0
mov rbx, qword [0x140298638]
lea rcx, [0x140298620]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140042c25
lea rcx, [0x140298618]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140042c25
mov rcx, qword [0x1402981e0]
lea rax, str.imgui_impl_win32
mov qword [0x140298610], rbx
or dword [rcx + 0xc], 6
mov qword [rcx + 0xd8], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x3c], 9
mov dword [rcx + 0x40], Ordinal_41
mov dword [rcx + 0x44], Ordinal_45
mov dword [rcx + 0x48], Ordinal_41
mov dword [rcx + 0x4c], Ordinal_46
mov dword [rcx + 0x50], reloc.WLDAP32.dll_Ordinal_33
mov dword [rcx + 0x54], Ordinal_35
mov dword [rcx + 0x58], Ordinal_41
mov dword [rcx + 0x5c], reloc.WLDAP32.dll_Ordinal_35
mov dword [rcx + 0x60], reloc.WLDAP32.dll_Ordinal_45
mov dword [rcx + 0x64], reloc.WLDAP32.dll_Ordinal_46
mov dword [rcx + 0x68], 8
mov dword [rcx + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov dword [rcx + 0x70], reloc.WS2_32.dll_listen
mov dword [rcx + 0x74], reloc.WLDAP32.dll_Ordinal_27
mov dword [rcx + 0x78], 0x41
mov dword [rcx + 0x7c], 0x43
mov dword [rcx + 0x80], 0x56
mov dword [rcx + 0x84], 0x58
mov dword [rcx + 0x88], 0x59
mov dword [rcx + 0x8c], 0x5a
jmp 0x140042c2c
mov rcx, qword [0x1402981e0]
mov rax, qword [0x140298640]
lea rdx, str.imgui_impl_dx9
mov qword [rcx + 0xe0], rdx
mov rcx, qword [0x1402982e0]
mov qword [0x140298600], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x140042c9a
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne 0x140042c72
mov qword [rsp + 0x28], rdi
lea r8, [0x14003cbe0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
invalid
invalid
pop rcx
invalid
invalid