Function at 0x140034150
Capabilities:
Encode data using xor
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12, rdx
mov ecx, 0x6e
xor edx, edx
call fcn.140001240
lea ecx, [rdx + 0x74]
mov word [rbp - 0x30], ax
lea edx, [rcx - 0x73]
call fcn.140001240
lea ecx, [rdx + 0x63]
mov word [rbp - 0x2e], ax
lea edx, [rcx - 0x62]
call fcn.140001240
lea ecx, [rdx + 0x6a]
mov word [rbp - 0x2c], ax
lea edx, [rcx - 0x69]
call fcn.140001240
lea edx, [rcx - 0x68]
mov word [rbp - 0x2a], ax
call fcn.140001240
lea ecx, [rdx + 0x2a]
mov word [rbp - 0x28], ax
lea edx, [rcx - 0x29]
call fcn.140001240
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x26], ax
lea edx, [rcx - 0x5e]
call fcn.140001240
lea ecx, [rdx + 0x66]
mov word [rbp - 0x24], ax
lea edx, [rcx - 0x65]
call fcn.140001240
lea edx, [rcx - 0x64]
mov word [rbp - 0x22], ax
call fcn.140001240
xor ecx, ecx
mov word [rbp - 0x20], ax
lea edx, [rcx + 9]
call fcn.140001240
lea edx, [rcx + 0xa]
mov word [rbp - 0x1e], ax
movzx ecx, word [0x140049c54]
call fcn.140001240
movzx ecx, word [0x140049c56]
mov edx, 0xb
mov word [rbp - 0x1c], ax
call fcn.140001240
movzx ecx, word [str.SquadHackInject]
mov edx, 0xc
mov word [rbp - 0x1a], ax
call fcn.140001240
movzx ecx, word [0x140049c5a]
mov edx, 0xd
mov word [rbp - 0x18], ax
call fcn.140001240
movzx ecx, word [0x140049c5c]
mov edx, 0xe
mov word [rbp - 0x16], ax
call fcn.140001240
movzx ecx, word [0x140049c5e]
mov edx, 0xf
mov word [rbp - 0x14], ax
call fcn.140001240
movzx ecx, word [0x140049c60]
mov edx, 0x10
mov word [rbp - 0x12], ax
call fcn.140001240
movzx ecx, word [0x140049c62]
mov edx, 0x11
mov word [rbp - 0x10], ax
call fcn.140001240
movzx ecx, word [0x140049c64]
mov edx, 0x12
mov word [rbp - 0xe], ax
call fcn.140001240
mov word [rbp - 0xc], ax
mov r8d, 0x133
xor eax, eax
mov word [rbp - 0xa], ax
xor ebx, ebx
nop
movsxd rcx, eax
lea rdx, [rbp - 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1400342d0
lea rcx, [rbp - 0x30]
mov word [rbp - 0xa], bx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword gs:[0x58]
mov rdi, rax
mov r14d, 4
add r14, qword [rcx]
mov ecx, dword [r14]
cmp dword [0x1401a90e8], ecx
jle 0x140034355
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140034355
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov edx, 0x1000
lea rcx, [0x1401a90f0]
call fcn.140001300
mov edx, 0x74
mov qword [rbp - 0x40], rax
xor ecx, ecx
mov r8d, 0x3000
mov r13, rax
lea r9d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400976d0]
lea r15, [r13 + 0x5c]
mov rsi, rax
mov qword [rbp + 0x48], rax
movups xmmword [rax], xmm0
lea rbx, [rax + 0x5c]
movaps xmm1, xmmword [0x1400976e0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400976f0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140097700]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140097710]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x140097720]
movsd qword [rax + 0x50], xmm1
mov ecx, dword [0x140097728]
mov dword [rax + 0x58], ecx
mov qword [rax + 6], r15
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x10], r12
mov eax, dword [rax + 0x28]
add rax, r12
mov qword [rbx + 8], rax
mov eax, dword [r14]
cmp dword [0x1401a90e8], eax
jle 0x140034440
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140034440
xor edx, edx
mov qword [0x1401a90f8], 0xffffffffffffffff
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], edx
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov r9d, 0x74
lea rcx, [0x1401a90f0]
mov r8, rsi
mov rdx, r13
call fcn.140001250
mov r9d, dword [rbp + 0x40]
mov r8, rdi
mov rdx, r13
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rbx], 2
mov rdi, 0xffffffffc00000c0
mov r12, rax
je 0x140034570
xor esi, esi
mov r13, 0xffffffffc0000001
nop dword [rax]
mov ecx, dword [r14]
cmp dword [0x1401a90e8], ecx
jle 0x1400344d9
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x1400344d9
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], esi
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
mov eax, dword [0x1401a90f0]
mov word [rbp - 0x13], si
mov byte [rbp - 0x11], sil
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], 0x18
mov byte [rbp - 0x14], sil
cmp rcx, 0xffffffffffffffff
jne 0x140034510
mov r8, rdi
jmp 0x140034541
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x20
mov dword [rsp + 0x28], esi
mov edx, 0x3009ce20
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov r8, rsi
cmove r8, r13
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx], 2
jne 0x140034490
mov rsi, qword [rbp + 0x48]
mov r13, qword [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [r14]
cmp dword [0x1401a90e8], eax
jle 0x1400345c4
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x1400345c4
xor eax, eax
mov qword [0x1401a90f8], 0xffffffffffffffff
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], eax
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
xor edx, edx
mov eax, dword [0x1401a90f0]
mov dword [rbp - 0x3c], edx
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], r13
cmp rcx, 0xffffffffffffffff
je 0x14003461a
mov qword [rsp + 0x38], rdx
lea r9d, [rdx + 0x10]
mov qword [rsp + 0x30], rdx
lea r8, [rbp - 0x40]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, 0x3009d4e0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
test eax, eax
mov edi, edx
mov rax, 0xffffffffc0000001
cmove rdi, rax
mov r8, rdi
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]