Function at 0x1800179e0
Capabilities:
Access peb ldr_data
Check for foreground window switch
Contain obfuscated stackstrings
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
xorps xmm0, xmm0
xor ebp, ebp
movups xmmword [0x180148b10], xmm0
movups xmmword [0x180148b20], xmm0
movups xmmword [0x180148b30], xmm0
nop word [rax + rax]
mov rdx, qword [0x180148cb8]
lea rcx, [0x180148b10]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x180017480
lea rcx, [0x180148b10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x180148b10]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [0x180148a78]
cmp rax, rcx
jne 0x1800174d8
mov edx, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, qword [0x180148cb8]
mov r9d, 2
mov dword [rsp + 0x30], 3
mov r8d, r9d
mov dword [rsp + 0x28], 0xfffffffd
mov rdx, rax
mov dword [rsp + 0x20], 0xfffffffd
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x180148a78]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbp
lea rdx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x180148a78]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov rsi, qword [0x180148c20]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x44], eax
mov rax, qword [0x180148a78]
mov qword [rsi + 0xd0], rax
mov dword [rsi + 0x18], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x78]
sub eax, dword [rsp + 0x70]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsi + 0xe08], xmm0
mov eax, dword [rsp + 0x7c]
sub eax, dword [rsp + 0x74]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsi + 0xe0c], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800175f7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800175f7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xbc628fd7
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800175f2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800175d0
cmp r8d, 0x437d0d27
je 0x1800175fc
test r9d, r9d
jne 0x1800175b0
mov rax, qword [rax]
jmp 0x180017580
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 1
add rax, r10
call rax
test ax, ax
je 0x18001763b
mov byte [rsi + 0xe10], 1
mov eax, dword [rsi + 0xe0c]
mov dword [rsi + 0x36f8], eax
mov byte [rsi + 0x3748], 1
jmp 0x180017642
mov byte [rsi + 0xe10], bpl
mov eax, dword [0x1801493d0]
mov ecx, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
cmp dword [rsp + 0x40], eax
jne 0x180017672
cmp edx, dword [0x1801493d8]
jne 0x180017672
mov eax, dword [0x1801493d4]
cmp dword [rsp + 0x44], eax
jne 0x180017672
cmp ecx, dword [0x1801493dc]
je 0x1800176cd
movups xmm0, xmmword [rsp + 0x40]
mov r9d, dword [rsp + 0x74]
lea eax, [rcx - 3]
mov r8d, dword [rsp + 0x70]
add r9d, 2
mov dword [0x180148c30], ecx
add r8d, 2
mov dword [0x180148aa4], ecx
lea ecx, [rdx - 3]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x180148cb8]
mov dword [0x180148c38], edx
mov dword [0x180148aa0], edx
xor edx, edx
movups xmmword [0x1801493d0], xmm0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x180148c20]
test rax, rax
je 0x1800176e2
mov rcx, qword [rax + 0xa0]
jmp 0x1800176e5
mov rcx, rbp
cmp qword [rcx + 0x48], rbp
jne 0x1800176f0
call fcn.1800432f0
call fcn.180043f40
call fcn.18001fab0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180017787
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180017787
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x70c00527
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180017782
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180017760
cmp r8d, 0xaab59bd7
je 0x18001778c
test r9d, r9d
jne 0x180017740
mov rax, qword [rax]
jmp 0x180017710
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x2d
add rax, r10
call rax
test al, 1
je 0x1800177bc
cmp byte [0x180117479], bpl
sete byte [0x180117479]
call fcn.180002420
call fcn.180014cf0
mov rcx, qword [0x180148a70]
lea r8, [0x180148be0]
xor r9d, r9d
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x180148a70]
lea r8, [0x180148bd0]
mov rdx, qword [0x180148be0]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.180021b70
mov rax, qword [0x180148c20]
mov rcx, qword [rax + 0x48d0]
mov rax, qword [rcx]
mov rcx, rbp
add rax, 0x48
cmp byte [rax], cl
cmovne rcx, rax
call fcn.1800428c0
mov rcx, qword [0x180148b00]
mov edx, ebp
cmp byte [0x180148b9e], dl
setne dl
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp dword [0x180148b18], 0x12
jne 0x180017440
mov rdi, qword [0x180148c20]
test rdi, rdi
je 0x180017868
mov rbx, qword [rdi + 0xa0]
jmp 0x18001786b
mov rbx, rbp
call fcn.1800437d0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18001787f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001788d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18001789c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x180148c20]
mov qword [rdi + 0x90], rbp
mov qword [rdi + 0xa0], rbp
test rax, rax
je 0x1800178bc
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x180148c20]
test rax, rax
je 0x1800178da
mov rbx, qword [rax + 0x98]
jmp 0x1800178dd
mov rbx, rbp
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x1800178f7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x180148c20]
mov qword [rdi + 0x80], rbp
mov qword [rdi + 0x90], rbp
test rax, rax
je 0x180017910
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x180148c20]
mov qword [0x180148c20], rbx
call fcn.18001da00
mov qword [0x180148c20], rbp
test rbx, rbx
je 0x18001795b
mov rcx, rbx
call fcn.180034060
mov rax, qword [0x180148c20]
test rax, rax
je 0x180017952
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x180148cb8]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.USER32.dll_DestroyWindow]
push rbx
sub rsp, 0x40
lea rdx, [rsp + 0x30]
mov word [rsp + 0x39], 0x20
xor ecx, ecx
mov dword [rsp + 0x30], 0x4f4c4156
mov dword [rsp + 0x34], 0x544e4152
mov byte [rsp + 0x38], 0x20
mov byte [rsp + 0x3b], 0
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180148a78], rax
call fcn.180013070
call fcn.180012950
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x180017a6a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne 0x180017a42
xor ebx, ebx
lea r8, [0x180017980]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x180013ec0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x40
pop rbx
jmp 0x180017410