Function at 0x14004dc90
Capabilities:
Check for foreground window switch
Create thread
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xor edi, edi
mov dword [rbp - 9], 0xc0c2ccda
mov ecx, edi
mov dword [rbp - 5], 0xc7dcd0c2
mov dword [rbp - 1], 0x100b5b4
nop dword [rax + rax]
lea eax, [rcx - 0x74]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 0xa
jb 0x14004dcc0
lea rdx, [rbp - 9]
mov byte [rbp + 2], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov qword [rbp + 7], 0x50
mov qword [0x14021f9a0], rax
lea rcx, [rbp + 7]
mov rax, qword [0x14021f9c8]
xorps xmm1, xmm1
mov qword [rbp + 0x47], rax
lea rax, [0x14004a380]
mov qword [rbp + 0xf], rax
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmmword [rbp + 0x37], xmm0
mov qword [rbp + 0x4f], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x14021f9a0]
test rcx, rcx
je 0x14004df08
lea rdx, [0x14021f990]
mov qword [rsp + 0xd8], rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x14021f9a0]
lea rdx, [rbp + 0x67]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x67]
mov r9d, 0x90000000
movd xmm1, dword [0x14021f99c]
movd xmm2, dword [0x14021f998]
mov rdx, qword [0x14021f9c8]
mov qword [rsp + 0x58], rdi
mov r8, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
cvtdq2ps xmm1, xmm1
mov dword [0x14021f990], eax
mov eax, dword [rbp + 0x6b]
mov dword [0x14021f994], eax
cvtdq2ps xmm2, xmm2
movss dword [0x14021f968], xmm1
subss xmm1, dword [0x140119a48]
movss dword [0x14021f888], xmm2
subss xmm2, dword [0x140119a48]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x14021fae8], rax
lea rdx, [0x140117650]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14021fae8]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x14021fae8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14021fae8]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140049fe0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
je 0x14004de8a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.VALORANT
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne case.default.0x14004df01
mov qword [rsp + 0x28], rdi
lea r8, [0x14004a500]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004d870
mov rcx, qword [0x14021f868]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x14021faf0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x14021f910]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x14021fae8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x14021f9c8]
xor edx, edx
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rbp
jmp qword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
and al, 0x58
add rsp, 0x38
ret
mov rcx, qword [rdi + 0x30]
call qword [0x1401d7a38]
mov rbx, qword [rdi + 0x248]
xor edx, edx
mov rcx, rdi
call qword [0x1401d79c8]
test rbx, rbx
fisttp dword [rax - 0x75]
sti
fisttp dword [rax - 0x75]
sti
jne 0x1401d51f0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
pop rsp
and al, 0x40
mov word [rbp], si
jne 0x1401d5222
jne 0x1401d5222
mov rsi, qword [rsp + 0x50]
je 0x1401d524a
push rax
mov rbp, qword [rsp + 0x48]
insb byte [rdi], dx
and al, 0x48
xor eax, eax
add rsp, 0x38
invalid
cmp bl, al
invalid
sub rsp, 0x58
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x50], rbp
insb byte [rdi], dx
and al, 0x50
mov qword [rsp + 0x48], rsi
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdi
jl 0x1401d5281
mov qword [rsp + 0x38], r12
and al, 0x38
and al, 0x38
mov r12d, r8d
mov r8d, 0x206b6444
mov edx, 0x100
xor ecx, ecx
leave
leave
mov ebx, 0xc86a8002
call qword [0x1401d79c0]
test rbp, rbp
mov rdi, rax
je 0x1401d52c5
test rax, rax
je 0x1401d52df
mov rcx, rsi
call 0x1401d4ed0
test rax, rax
test eax, eax
test eax, eax
je 0x1401d52c5
xor r9d, r9d
mov r8b, reloc.WS2_32.dll_ntohs
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x20], 0x40
and al, 0x20
add byte [rax], al
add al, ch
invalid
invalid
invalid
dec dword [rbp - 0x75]
invalid
mov rdx, rdi
shl r8, 2
shl eax, 2
shl eax, 2
mov rcx, rbp
call 0x1401d5c40
xor ebx, ebx
test rdi, rdi
je 0x1401d52df
lea rdx, str.c:userscloudbuild337244_sdk_nal_srcwinnt_wdmdriverwindriverpci_i.c
adc eax, 0x18df
mov r8d, 0xf3
mov rcx, rdi
call 0x1401d3750
mov r12, qword [rsp + 0x38]
and al, 0x38
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
je 0x1401d5311
invalid
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x58
ret