Function at 0x14004f3d0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
xor edi, edi
mov dword [rsp + 0x60], 0xdad8d2c4
mov ecx, edi
mov dword [rsp + 0x64], 0xcdd6d6c4
mov dword [rsp + 0x68], 0x100bbba
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x6e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xa
jb 0x14004f0d0
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x6b], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov qword [rsp + 0x70], 0x50
mov qword [0x1401ac9d0], rax
lea rcx, [rsp + 0x70]
mov rax, qword [0x1401ac9f0]
xorps xmm1, xmm1
mov qword [rbp - 0x50], rax
lea rax, [0x14004b7a0]
mov qword [rsp + 0x78], rax
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x48], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x1401ac9d0]
test rcx, rcx
je 0x14004f3b6
mov qword [rsp + 0x1b8], rbx
lea rdx, [0x1401ac9c0]
movaps xmmword [rsp + 0x190], xmm6
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401ac9d0]
lea rdx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0xb0]
mov r9d, 0x90000000
movd xmm1, dword [0x1401ac9cc]
movd xmm2, dword [0x1401ac9c8]
mov rdx, qword [0x1401ac9f0]
mov qword [rsp + 0x58], rdi
mov r8, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
cvtdq2ps xmm1, xmm1
mov dword [0x1401ac9c0], eax
mov eax, dword [rbp + 0xb4]
mov dword [0x1401ac9c4], eax
cvtdq2ps xmm2, xmm2
movss dword [0x1401ac988], xmm1
subss xmm1, dword [0x1400c311c]
movss dword [0x1401ac8a8], xmm2
subss xmm2, dword [0x1400c311c]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, 0xffffffec
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x1401acec0], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1401acec0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401acec0]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14004b400
mov rbx, qword [0x1401ac870]
lea rdx, [0x1400c2e48]
movss xmm2, dword [0x1400c31f4]
xorps xmm6, xmm6
xor eax, eax
movups xmmword [rbp - 0x80], xmm6
mov rcx, qword [rbx + 0x58]
movups xmmword [rbp - 0x40], xmm6
mov qword [rbp - 0x10], rax
mov eax, 0xffff
movups xmmword [rsp + 0x70], xmm6
mov word [rbp - 0x3c], ax
movups xmmword [rbp - 0x50], xmm6
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x78], 3
mov dword [rbp - 0x74], 1
mov dword [rbp - 0x4c], 0x7f7fffff
mov dword [rbp - 0x40], 0x3f800000
call fcn.14002a090
movaps xmm0, xmmword [rsp + 0x70]
lea rax, [0x1401543d0]
movaps xmm1, xmmword [rbp - 0x80]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [rbp - 0x10]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movsd qword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x70], xmm6
mov qword [rbp], rax
mov dword [rbp + 8], 0x704
mov rcx, qword [rbx + 0x58]
lea rax, [0x1400c2f48]
lea rdx, [rbp]
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x14], 0x41880000
call fcn.140029dd0
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x14004b900]
mov qword [0x1401ac990], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14004ec70
mov rcx, qword [0x1401ac898]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401acec8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401ac930]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401acec0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1401ac9f0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x190]
mov rbx, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rbp
jmp qword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
cmp qword [0x140176560], 0xf
lea rdi, [0x140176548]
mov r8, qword [0x140176558]
mov rcx, rdi
cmova rcx, qword [0x140176548]
test r8, r8
jne 0x14004f41e
lea rdx, [0x140056bf6]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004f56d
xor esi, esi
mov dword [rsp + 0x40], 0x2bd02ce
mov ecx, esi
mov dword [rsp + 0x44], 0x2d302c8
mov dword [rsp + 0x48], 0x2f902f9
mov edx, 0x292
mov dword [rsp + 0x4c], 0x2fa02ec
mov dword [rsp + 0x50], 0x2e802f2
mov dword [rsp + 0x54], 0x2d502ac
mov dword [rsp + 0x58], 0x2db
mov byte [rsp + 0x5c], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x40], ax
inc rcx
cmp rcx, 0xd
jb 0x14004f470
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x40]
mov edx, 0xc0000000
mov byte [rsp + 0x5c], sil
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401ac9b0], rax
lea rcx, [0x1400c2e8c]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14004f936
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004f527
nop word [rax + rax]
lea rdx, str.VALORANT_Win64_Shipping.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14004f576
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004f500
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1401ac9ac]
test eax, eax
je 0x14004f8a0
cmp qword [0x140176560], 0xf
mov r8, qword [0x140176558]
cmova rdi, qword [0x140176548]
test r8, r8
jne 0x14004f588
lea rdx, [0x140056bf6]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004f588
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov dword [0x1401ac9ac], eax
jmp 0x14004f536
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401acfd0], eax
jle 0x14004f5e9
lea rcx, [0x1401acfd0]
call fcn.140052ecc
cmp dword [0x1401acfd0], 0xffffffff
jne 0x14004f5e9
lea rcx, [0x140056b80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400c2ae0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1401acfd0]
mov qword [0x1401ad018], rax
call fcn.140052e60
mov dword [rbp + 0x1e0], esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, 0xff
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8d, 0x30
lea r9, [rbp + 0x1e0]
mov rdx, rax
mov rdi, rax
lea ecx, [r8 + 0x12]
call qword [0x1401ad018]
mov ebx, dword [rbp + 0x1e0]
add ebx, 0x1f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, ebx
mov r8, rdi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8d, dword [rbp + 0x1e0]
lea r9, [rbp + 0x1e0]
mov rdx, rax
mov ecx, 0x42
mov rbx, rax
call qword [0x1401ad018]
mov rcx, rsi
test rbx, rbx
je 0x14004f6d1
mov edx, dword [rbx]
test edx, edx
je 0x14004f6d1
lea rax, [rbx + 0x18]
mov r8d, edx
nop dword [rax]
mov rdx, qword [rax - 0x10]
test dl, 1
je 0x14004f6c7
cmp qword [rax - 8], 0x200000
jne 0x14004f6c7
test rcx, rcx
jne 0x14004f6c7
cmp dword [rax], 0x546e6f43
jne 0x14004f6c7
mov rcx, rdx
and rcx, 0xfffffffffffffffe
add rax, 0x18
sub r8, 1
jne 0x14004f6a0
mov eax, dword [0x1401ac9ac]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rsi
mov r9d, 0x10
mov dword [rsp + 0x40], eax
mov edx, 0x37acd4c
lea rax, [rbp + 0x1e8]
mov qword [0x1401ac8b8], rcx
mov qword [0x1401ac978], rcx
mov rcx, qword [0x1401ac9b0]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x1e8], rsi
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [0x1401acdb8]
lea rcx, [0x1400c2e8c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [0x1401acad8], 0xf
lea rdi, [0x1401acac0]
jbe 0x14004f755
mov rdi, qword [0x1401acac0]
mov rsi, qword [0x1401acad0]
mov rcx, rdi
add rsi, rcx
mov rdx, rdi
cmp rdx, rsi
je 0x14004f890
mov qword [rsp + 0x2f0], r12
movabs r12, 0x7fffffffffffffff
mov qword [rsp + 0x2b0], r13
movabs r13, 0x7ffffffffd050f7f
mov qword [rsp + 0x2a8], r14
movabs r14, 0x4e94914f0000
mov qword [rsp + 0x2a0], r15
movabs r15, 0x431bde82d7b634db
nop word [rax + rax]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400514f0
lea rcx, [rbp + 0x1e8]
call fcn.140044f80
mov rbx, qword [rbp + 0x1e8]
cmp rbx, r13
jge 0x14004f7f0
add rbx, 0x2faf080
jmp 0x14004f7f3
mov rbx, r12
lea rcx, [rbp + 0x1e0]
call fcn.140044f80
mov rax, qword [rbp + 0x1e0]
cmp rax, rbx
jge 0x14004f864
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x14004f822
mov ecx, 0x5265c00
jmp 0x14004f847
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14004f845
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x1e0]
call fcn.140044f80
mov rax, qword [rbp + 0x1e0]
cmp rax, rbx
jl 0x14004f810
inc rdi
cmp rdi, rsi
jne 0x14004f7c0
mov r15, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x2a8]
mov r13, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2f0]
add rsp, 0x2b8
pop rdi
pop rsi
pop rbx
pop rbp
jmp 0x14004f090
lea rcx, [0x1400c2e8c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401ace00]
call fcn.140050ac0
lea rcx, [0x1401ace00]
mov rdi, rax
call fcn.140050ae0
mov rbx, rax
cmp rax, rdi
je 0x14004f922
mov dword [rbp + 0x1e0], 0x32
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400514f0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1e8]
call fcn.140051da0
mov rcx, rax
call fcn.140051db0
inc rbx
cmp rbx, rdi
jne 0x14004f8f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401aca40]
call fcn.140050ac0
lea rcx, [0x1401aca40]
mov rdi, rax
call fcn.140050ae0
mov rbx, rax
cmp rax, rdi
je 0x14004f9b2
mov dword [rbp + 0x1e0], 0x32
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400514f0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1e8]
call fcn.140051da0
mov rcx, rax
call fcn.140051db0
inc rbx
cmp rbx, rdi
jne 0x14004f980
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3