Function at 0x140001000
Capabilities:
Check if file exists
Execute command
Get file attributes
Log keystrokes via application hook
Set console window title

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001095
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._BEMZ__Error.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400012f0
mov rcx, rax
lea rdx, [0x1400014c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001580
add rsp, 0x30
pop rbx
ret
xor edx, edx
lea rcx, str.ValorantUnrealWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400010db
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._BEMZ__VALORANT_is_not_opened__please_open_it_and_try_again.
jmp 0x140001054
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test eax, eax
jne 0x140001115
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.__FAILED___Could_not_get_thread_ID_of_the_target_window.
jmp 0x14000129b
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14000115c
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._BEMZ__Error__2_.
jmp 0x14000129b
lea rdx, str.NextHook
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000118a
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.__FAILED___The_function_was_not_found.
jmp 0x14000129b
mov r9d, edi
mov r8, rbx
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
jne 0x1400011bf
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rdx, str.__FAILED___Couldnt_set_the_hook_with_SetWindowsHookEx.
jmp 0x14000129b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._BEMZ__All_Skins_Has_Been_Unlocked.
call fcn.1400012f0
mov rcx, rax
lea rdx, [0x1400014c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._BEMZ__Press_any_key_to_unload__Valorant_will_close_
call fcn.1400012f0
mov rcx, rax
lea rdx, [0x1400014c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
jne 0x1400012cb
lea rcx, [0x140003300]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._WARNING__If_you_see_this_message_and_your_valorant_is_opened__click_enter_then_please_restart_your_pc.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400012f0
mov rcx, rax
lea rdx, [0x1400014c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
jmp 0x1400012cd
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001580
add rsp, 0x30
pop rbx
ret