Function at 0x14004bef0
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xor edi, edi
mov dword [rbp - 9], 0xd9d9d5c5
mov ecx, edi
mov dword [rbp - 5], 0xced7d9c5
mov dword [rbp - 1], 0x100bcbb
nop dword [rax + rax]
lea eax, [rcx - 0x6d]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 0xa
jb 0x14004bf20
lea rdx, [rbp - 9]
mov byte [rbp + 2], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov qword [rbp + 7], 0x50
mov qword [0x140217ae8], rax
lea rcx, [rbp + 7]
mov rax, qword [0x140217b10]
xorps xmm1, xmm1
mov qword [rbp + 0x47], rax
lea rax, [0x1400483f0]
mov qword [rbp + 0xf], rax
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmmword [rbp + 0x37], xmm0
mov qword [rbp + 0x4f], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x140217ae8]
test rcx, rcx
je 0x14004c168
lea rdx, [0x140217ad8]
mov qword [rsp + 0xd8], rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x140217ae8]
lea rdx, [rbp + 0x67]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x67]
mov r9d, 0x90000000
movd xmm1, dword [0x140217ae4]
movd xmm2, dword [0x140217ae0]
mov rdx, qword [0x140217b10]
mov qword [rsp + 0x58], rdi
mov r8, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
cvtdq2ps xmm1, xmm1
mov dword [0x140217ad8], eax
mov eax, dword [rbp + 0x6b]
mov dword [0x140217adc], eax
cvtdq2ps xmm2, xmm2
movss dword [0x140217ab8], xmm1
subss xmm1, dword [0x140117968]
movss dword [0x1402179d8], xmm2
subss xmm2, dword [0x140117968]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x140217c30], rax
lea rdx, [0x140115650]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140217c30]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x140217c30]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140217c30]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140048050
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x14004c0ea
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne case.default.0x14004c161
mov qword [rsp + 0x28], rdi
lea r8, [0x140048570]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004bad0
mov rcx, qword [0x1402179b8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140217c38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140217a60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140217c30]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x140217b10]
xor edx, edx
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rbp
jmp qword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x18], rbx
mov rbx, rcx
lea r8, str.07:22:40
lea rcx, str._nNal_Windows_Driver_Loaded____Compiled__s__s_n
lea rdx, str.Nov_14_2013
mov qword [rax + 0x20], rdi
call 0x13fc00ab0
xor edi, edi
lea rax, [0x1401bea40]
mov dword [0x13fc05ca0], edi
mov edx, 0x100
mov byte [rax + 0x108], dil
mov qword [rax], rdi
add rax, 0x110
dec rdx
jne 0x1401d0bd0
lea rax, [0x13fbffc10]
lea rcx, [0x13ffd65d0]
mov edx, 0xc350
mov qword [rbx + 0x70], rax
lea rax, [0x13fbffc70]
mov qword [rbx + 0x80], rax
lea rax, [0x13fbffcd0]
mov qword [rbx + 0xe0], rax
lea rax, [0x13fbffb90]
mov qword [rbx + 0x68], rax
lea rax, [0x13fc05cc8]
nop
nop
mov dword [rax - 8], edi
mov qword [rax], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 8], rdi
mov dword [rax + 0x20], edi
mov dword [rax + 0x24], edi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], rdi
mov qword [rcx + 8], rdi
mov qword [rcx], rdi
mov qword [rcx - 0x10], rdi
mov qword [rcx - 8], rdi
mov qword [rcx + 0x10], rdi
add rax, 0x50
add rcx, 0x28
dec rdx
jne 0x1401d0c30
lea rcx, [0x13fc03460]
call 0x13fc00ab0
lea rdx, [0x13fc03440]
lea rcx, [rsp + 0x40]
call qword [0x13fc04c20]
lea r11, [rsp + 0x70]
pop rsp
and al, 0x70
lea r8, [rsp + 0x40]
and al, 0x40
mov qword [rsp + 0x30], r11
pop rsp
and al, 0x30
mov r9d, 0x8086
mov edx, 0x18
mov rcx, rbx
mov byte [rsp + 0x28], dil
mov dword [rsp + 0x20], edi
call qword [0x13fc04ba0]
fidivr word [rsi]
movabs dword [0x8824bc8b48ff], eax
invalid
test eax, eax
fidivr word [rsi]
movabs dword [0x8824bc8b48ff], eax
add byte [rbp + 0x481579c0], al
jns 0x1401d0ce3
lea rcx, [0x13fc03400]
jns 0x1401d0ce3
lea rcx, [0x13fc03400]
mov edx, eax
call 0x13fc00ab0
mov eax, 0xc0000001
jmp 0x1401d0d19
invalid
mov rax, qword ss:[rsp + 0x70]
mov rax, qword [rsp + 0x70]
lea rdx, [0x13fc033e0]
lea rcx, [rsp + 0x50]
and al, 0x50
mov qword [rbx + 8], rax
mov rbx, qword [rax + 0x40]
mov qword [rbx], rax
call qword [0x13fc04c20]
lea rdx, [rsp + 0x40]
push rsp
and al, 0x40
lea rcx, [rsp + 0x50]
call qword [0x13fc04b98]
test eax, eax
jns case.0x14004c161.18
lea rcx, [0x13fc033a0]
mov edx, eax
call 0x13fc00ab0
mov rcx, qword [rsp + 0x70]
call qword [0x13fc04cb8]
jmp 0x1401d0d52
mov rax, qword [rsp + 0x70]
or dword [rax + 0x30], 4
mov rax, qword [rsp + 0x70]
and dword [rax + 0x30], 0xffffff7f
mov rax, qword [rsp + 0x70]
and al, 0x70
mov qword [rbx + 8], rax
lea rcx, [0x13fc03370]
call 0x13fc00ab0
lea rcx, str.Nal_Windows_Driver_DriverEntry:_Completed_n
call 0x13fc00ab0
mov rbx, qword [rsp + 0x80]
add byte [rax], 0
add byte [rbx], dh
ror byte [rax - 0x7d], 0xc4
invalid
ret
add byte [rax], 0
add byte [rbx], dh
ror byte [rax - 0x7d], 0xc4
push 0xffffffffccccccc3
int3
mov rax, qword [0x13fc05c88]
movabs r9, 0x2b992ddfa232
add byte [rax - 0x7b], cl
invalid
je 0x1401d0d9b
add byte [rax - 0x7b], cl
sal byte [rbp + rax + 0x49], 0x3b
sal dword [rbp + 0x2f], 0x4c
lea eax, [0x13fc05c88]
invalid
invalid
cmp rax, r9
jne 0x1401d0dca
lea r8, [0x13fc05c88]
movabs dword [0x8000000320b848ff], eax
idiv edi
dec dword [rax - 0x75]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
add byte [rcx + 0x33], cl
ror byte [rcx - 0x48], 0xff
invalid
invalid
invalid
invalid
inc dword [rax]
add byte [rcx + 0x23], cl
ror byte [rcx + 0xf], 0x44
cmove eax, ecx
add byte [rcx + 0x33], cl
ror byte [rcx - 0x48], 0xff
cmove eax, ecx
mov qword [0x13fc05c88], rax
not rax
mov qword [0x13fc05c80], rax
invalid
invalid
jmp 0x1401d0b90
movabs dword [0xccccfffffdb7e9ff], eax
int3
outsb dx, byte [rsi]
outsd dx, dword fs:[rsi]
ja 0x1401d0e5e
and byte [rdx + rsi*2 + 0x69], al
jbe 0x1401d0e56
jb 0x1401d0e13
jb 0x1401d0e5f
jb 0x1401d0e5f
jbe 0x1401d0e5d
jb 0x1401d0e3f
outsb dx, byte [rsi]
je 0x1401d0e6f
jns 0x1401d0e39
and byte [rbx + 0x6f], al
insd dword [rdi], dx
jo 0x1401d0e71
insb byte [rdi], dx
insb byte [rdi], dx
je 0x1401d0e6d
or al, byte fs:[rax]
int3
and byte [rcx], dh
xor al, 0x20
xor dh, byte [rax]
xor byte [rcx], dh
xor eax, dword [rax]
int3
int3
xor byte [rcx], dh
xor eax, dword [rax]
int3
and byte [rdx + rsi*2 + 0x69], al
jbe 0x1401d0e97
jb 0x1401d0e54
outsd dx, dword [rsi]
invalid
and byte fs:[0x1af602e6d], ch
and byte [0x1af602e6d], ch
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x1401d0eac
insb byte [rdi], dx
and byte fs:[0x1b3422ebf], ah
or al, byte [rax]
int3
xor bh, byte [rdx]
xor al, 0x30
add ah, cl
int3
and ebx, dword [rbp]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
pop rdx
invalid
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdx + 0x27], bl
pop rbp
add byte [rax], bl
invalid
add byte [rax], bl
and ebx, dword [rbp]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
movabs al, byte [0x6000005d27]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x27], ch
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rdi + riz + 0x5d], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
movabs byte [0xba00000000005d24], al
and al, 0x5d
add byte [rax], al
add byte [rax], al
add ah, cl
and al, 0x5d
add byte [rax], al
add byte [rax], al
add dl, ah
and al, 0x5d
add byte [rax], al
add byte [rax], al
add dl, bh
and al, 0x5d
add byte [rax], al
add byte [rax], al
add byte [rsi], cl
and eax, 0x5d
add byte [rax], al
and eax, 0x5d
add byte [rax], al
xor ah, byte [0x1401d0f4b]
add byte [rax], al
cmp al, 0x25
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax + 0x25], cl
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rbp + riz + 0x5d], dl
add byte [rax], al
add byte [rax], al
add byte [rbp + riz + 0x5d], dh
add byte [rax], al
add byte [rax], al
add byte [rax + 0x5d25], dl
add byte [rax], al
add byte [rax + 0x5d25], ah
add byte [rax], al
add byte [rdx + 0x5d25], dh
add byte [rax], al
add al, cl
and eax, 0x5d
add byte [rax], al
out 0x25, al
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rdx + 0x5d24], cl
add byte [rax], al
add byte [rax], dl
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax], ch
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax + 0x26], al
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax + 0x26], dl
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rax + 0x26], dh
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rsi + riz + 0x5d], al
add byte [rax], al
mov fs, word [rsi]
pop rbp
add byte [rax], al
add byte [rax], al
add byte [rdx + 0x5d26], ah
add byte [rax], al
add byte [rsi + riz + 0x5d], ch
add byte [rax], al
int3