Function at 0x1400341f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rbp + 0x27], rax
cmp qword [0x140044228], 0
movaps xmmword [rsp + 0xd0], xmm7
jne 0x14003422c
call fcn.140023550
mov rcx, qword [0x140044248]
lea rdx, [rbp - 0x39]
mov rdi, qword [0x1400440f0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x31]
lea rcx, [rbp - 0x49]
sub eax, dword [rbp - 0x39]
movd xmm1, eax
mov eax, dword [rbp - 0x2d]
sub eax, dword [rbp - 0x35]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x49]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x140044250]
cvtsi2ss xmm0, qword [0x140044258]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x140044250], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x130], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x131], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x1400440f0]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x133], 0
mov byte [rdi + 0x132], al
cmp byte [rcx + 0x3af], 0
lea rbx, [rcx + 0x118]
je 0x140034333
cvttss2si eax, dword [rbx]
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], eax
cvttss2si eax, dword [rcx + 0x11c]
mov rcx, qword [0x140044248]
mov dword [rbp - 0x25], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x25]
mov ecx, dword [rbp - 0x29]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140044248]
jne 0x14003438b
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14003438b
mov rcx, qword [0x140044248]
lea rdx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14003438b
movd xmm0, dword [rbp - 0x21]
movd xmm1, dword [rbp - 0x1d]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xd0], 0
je 0x14003439b
mov eax, 0xffffffff
jmp 0x1400343a8
mov rax, qword [0x1400440f0]
mov eax, dword [rax + 0x1d70]
cmp dword [0x140043628], eax
je 0x1400343bb
mov dword [0x140043628], eax
call fcn.1400236a0
call fcn.140005ec0
movss xmm7, dword [0x14003cb14]
xor edi, edi
cmp byte [0x1400440e9], dil
je 0x140034bed
movdqa xmm0, xmmword [str._tjwUC]
lea rcx, [rbp + 7]
movss xmm5, dword [0x14003cbe8]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x40455476
movaps xmmword [rsp + 0xe0], xmm6
mov dword [rbp + 0x1b], 0x1070413
mov word [rbp + 0x1f], 0xc
call fcn.140035310
mov rcx, qword [0x1400440f0]
lea rdx, [0x1400440e9]
movss xmm4, dword [0x14003cbdc]
mov r8d, 0x22
unpcklps xmm4, xmm5
movsd qword [rcx + 0x1af4], xmm4
mov dword [rcx + 0x1acc], 4
mov dword [rcx + 0x1b28], 0x3f800000
mov dword [rcx + 0x1ae0], 1
mov rcx, rax
call fcn.140009730
mov rcx, qword [0x1400440f0]
lea rdx, [rbp - 0x29]
movss xmm6, dword [0x14003cbb8]
mov dword [rbp - 0x29], 0x430c0000
mov dword [rbp - 0x25], 0x41e00000
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
lea rcx, str.Aimbot
movss xmm0, dword [rax + 0x10]
subss xmm0, dword [rax + 0x58]
movss xmm2, dword [rax + 0x14]
subss xmm2, dword [rax + 0x5c]
addss xmm0, dword [0x14003cba8]
addss xmm2, xmm6
movss dword [rax + 0xc8], xmm0
movss dword [rax + 0xcc], xmm2
movss xmm1, dword [rax + 0xe0]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0xe4]
maxss xmm0, xmm2
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
call fcn.140024900
test al, al
je 0x1400344ff
mov dword [0x140044710], edi
mov rcx, qword [0x1400440f0]
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x430c0000
mov dword [rbp - 0x25], 0x41e00000
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
lea rcx, [0x14003c924]
movss xmm0, dword [rax + 0x10]
subss xmm0, dword [rax + 0x58]
movss xmm2, dword [rax + 0x14]
subss xmm2, dword [rax + 0x5c]
addss xmm0, dword [0x14003cbd0]
addss xmm2, xmm6
movss dword [rax + 0xc8], xmm0
movss dword [rax + 0xcc], xmm2
movss xmm1, dword [rax + 0xe0]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0xe4]
maxss xmm0, xmm2
movss dword [rax + 0xe0], xmm1
movss dword [rax + 0xe4], xmm0
call fcn.140024900
movdqa xmm6, xmmword [0x14003ccd0]
test al, al
je 0x1400345a9
mov dword [0x140044710], 1
jmp 0x140034897
mov eax, dword [0x140044710]
test eax, eax
jne 0x14003488e
movdqa xmm0, xmmword [0x14003d200]
xor eax, eax
movdqa xmm2, xmmword [0x14003ccc0]
mov edx, edi
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 1], 0x404c4045
movdqa xmm0, xmmword [0x14003ccf0]
movdqa xmmword [rbp - 0x49], xmm0
mov r8d, dword [rbp - 0x49]
mov word [rbp + 3], 0x44
mov dword [rbp - 0x39], 0x3f68725a
mov dword [rbp - 0x35], 0x40504e63
mov word [rbp - 0x31], 0x4048
mov byte [rbp - 0x2f], al
mov dword [rbp - 0x21], 0x7671704f
mov word [rbp - 0x1d], 0x4954
mov byte [rbp - 0x1b], al
mov dword [rbp - 0x29], 0x3f73745d
mov dword [rbp - 0x25], 0x544866
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 4]
movd xmm1, edx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movd xmm0, r8d
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0x11]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 0x11], xmm1
movd xmm1, eax
lea eax, [rdx + 8]
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0xd]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 0xd], xmm1
movd xmm1, eax
lea eax, [rdx + 0xc]
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 9]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 9], xmm1
movd xmm1, eax
lea eax, [rdx + 0x10]
pshufd xmm1, xmm1, 0
add edx, 0x14
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 5]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 5], xmm1
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 1]
xorps xmm1, xmm0
movd dword [rbp + rcx - 1], xmm1
cmp edx, 0x14
jb 0x140034630
cmp edx, 0x15
jae 0x140034751
movsxd rcx, edx
lea eax, [rdx + 0x1c]
inc edx
xor byte [rbp + rcx - 0x11], al
cmp edx, 0x15
jb 0x140034740
lea rdx, [0x1400430c2]
mov byte [rbp + 4], dil
lea rcx, [rbp - 0x11]
call fcn.1400258c0
xor byte [rbp - 0x39], 0x1c
lea rdx, [0x1400430c0]
xor byte [rbp - 0x38], 0x1d
lea rcx, [rbp - 0x39]
xor byte [rbp - 0x37], 0x1e
xor byte [rbp - 0x36], 0x1f
xor byte [rbp - 0x35], 0x20
xor byte [rbp - 0x34], 0x21
xor byte [rbp - 0x33], 0x22
xor byte [rbp - 0x32], 0x23
xor byte [rbp - 0x31], 0x24
xor byte [rbp - 0x30], 0x25
mov byte [rbp - 0x2f], dil
call fcn.1400258c0
xor byte [rbp - 0x29], 0x1c
lea rcx, [rbp - 0x29]
xor byte [rbp - 0x28], 0x1d
xor byte [rbp - 0x27], 0x1e
xor byte [rbp - 0x26], 0x1f
xor byte [rbp - 0x25], 0x20
xor byte [rbp - 0x24], 0x21
xor byte [rbp - 0x23], 0x22
mov byte [rbp - 0x22], dil
call fcn.140024280
movss dword [rsp + 0x30], xmm7
lea rax, [rbp - 0x59]
lea rbx, str._.3f
mov dword [rbp - 0x59], 0x42a00000
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x49]
lea r8, [0x1400430c8]
mov qword [rsp + 0x20], rax
mov edx, 4
mov dword [rbp - 0x49], 0x3f800000
lea rcx, str.thgdrhjt
call fcn.140026f00
xor byte [rbp - 0x21], 0x1c
lea rcx, [rbp - 0x21]
xor byte [rbp - 0x20], 0x1d
xor byte [rbp - 0x1f], 0x1e
xor byte [rbp - 0x1e], 0x1f
xor byte [rbp - 0x1d], 0x20
xor byte [rbp - 0x1c], 0x21
mov byte [rbp - 0x1b], dil
call fcn.140024280
movss dword [rsp + 0x30], xmm7
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x59]
lea r8, [0x1400430c4]
mov qword [rsp + 0x20], rax
mov edx, 4
mov dword [rbp - 0x49], 0x41200000
lea rcx, str.rgsehydt
mov dword [rbp - 0x59], 0x3f800000
call fcn.140026f00
lea rcx, str.Aim_Key
call fcn.140024280
call fcn.1400316e0
call fcn.1400267e0
mov eax, dword [0x140044710]
cmp eax, 1
jne 0x140034be0
movdqa xmm0, xmmword [0x14003d1f0]
xor ebx, ebx
mov cl, 0x59
mov dword [rbp - 0x39], 0x5c3e592e
xor cl, 0x1d
mov dword [rbp - 0x35], 0x464c534f
mov dl, 0x3e
mov byte [rbp - 0x28], cl
xor dl, 0x1e
mov dword [rbp - 0x31], 0x48640556
mov al, 0x2e
mov byte [rbp - 0x27], dl
mov r8b, 0x5d
mov word [rbp - 0x2d], 0x5141
mov r9b, 0x4f
mov byte [rbp - 0x2b], bl
mov r10b, 0x48
mov dword [rbp - 0x21], 0x6f7f734f
mov r11b, 0x5a
mov dword [rbp - 0x1d], 0x464c484c
xor al, 0x1c
mov word [rbp - 0x19], 0x57
xor r8b, 0x1f
mov dword [rbp - 1], 0x4a4d434d
xor r9b, 0x20
mov byte [rbp + 3], bl
xor r10b, 0x21
mov byte [rbp - 0x29], al
xor r11b, 0x22
mov byte [rbp - 0x26], r8b
lea rdx, [0x1400430c1]
mov byte [rbp - 0x25], r9b
lea rcx, [rbp - 0x29]
mov byte [rbp - 0x24], r10b
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x23], r11b
mov byte [rbp - 0x22], bl
call fcn.1400258c0
movdqa xmm0, xmmword [0x14003ccf0]
mov edx, edi
movdqa xmm2, xmmword [0x14003ccc0]
movdqa xmmword [rbp - 0x49], xmm0
mov r8d, dword [rbp - 0x49]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 4]
movd xmm1, edx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movd xmm0, r8d
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0x39]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 0x39], xmm1
movd xmm1, eax
lea eax, [rdx + 8]
pshufd xmm1, xmm1, 0
add edx, 0xc
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0x35]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rbp + rcx - 0x35], xmm1
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0x31]
xorps xmm1, xmm0
movd dword [rbp + rcx - 0x31], xmm1
cmp edx, 0xc
jb 0x140034960
cmp edx, 0xe
jae 0x140034a21
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x1c]
inc edx
xor byte [rbp + rcx - 0x39], al
cmp edx, 0xe
jb 0x140034a10
lea rdx, [0x1400440ea]
mov byte [rbp - 0x2b], bl
lea rcx, [rbp - 0x39]
call fcn.1400258c0
xor byte [rbp - 0x21], 0x1c
lea rdx, [0x1400430c3]
xor byte [rbp - 0x20], 0x1d
lea rcx, [rbp - 0x21]
xor byte [rbp - 0x1f], 0x1e
xor byte [rbp - 0x1e], 0x1f
xor byte [rbp - 0x1d], 0x20
xor byte [rbp - 0x1c], 0x21
xor byte [rbp - 0x1b], 0x22
xor byte [rbp - 0x1a], 0x23
xor byte [rbp - 0x19], 0x24
mov byte [rbp - 0x18], bl
call fcn.1400258c0
movdqa xmm0, xmmword [0x14003ccf0]
lea rcx, [rbp - 0xd]
movdqa xmm3, xmmword [0x14003ccc0]
mov edx, edi
movdqa xmmword [rbp - 0x49], xmm0
mov r8d, dword [rbp - 0x49]
nop word [rax + rax]
lea eax, [rdx + 4]
movd xmm1, edx
pshufd xmm1, xmm1, 0
lea rcx, [rcx + 0x14]
paddd xmm1, xmm3
movd xmm2, eax
andps xmm1, xmm6
pshufd xmm2, xmm2, 0
packuswb xmm1, xmm1
lea eax, [rdx + 8]
packuswb xmm1, xmm1
paddd xmm2, xmm3
andps xmm2, xmm6
movd xmm0, r8d
paddb xmm1, xmm0
packuswb xmm2, xmm2
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
packuswb xmm2, xmm2
movd dword [rcx - 0x18], xmm1
movd xmm1, eax
lea eax, [rdx + 0xc]
pshufd xmm1, xmm1, 0
paddd xmm1, xmm3
movd xmm0, r8d
andps xmm1, xmm6
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0x14]
packuswb xmm1, xmm1
xorps xmm2, xmm0
packuswb xmm1, xmm1
movd dword [rcx - 0x14], xmm2
movd xmm0, r8d
paddb xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rcx - 0x10], xmm1
movd xmm1, eax
lea eax, [rdx + 0x10]
pshufd xmm1, xmm1, 0
add edx, 0x14
paddd xmm1, xmm3
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd xmm0, r8d
movd dword [rcx - 0xc], xmm1
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm3
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm1, xmm0
movd dword [rcx - 8], xmm1
cmp edx, 0x14
jb 0x140034a90
lea rcx, [rbp - 0x11]
mov byte [rbp + 3], bl
call fcn.140024280
movss dword [rsp + 0x30], xmm7
lea rax, [0x14003884c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x59]
lea rax, [rbp - 0x49]
mov dword [rbp - 0x49], 0x10e
lea r8, [0x14004362c]
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp - 0x59], 0x32
lea rcx, [0x1400386f6]
call fcn.140026f00
call fcn.14000c6a0
movaps xmm6, xmmword [rsp + 0xe0]
call fcn.1400336a0
call fcn.140007080
mov rcx, qword [0x1400442c0]
xor r8d, r8d
mov edx, 7
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400442c0]
xor r8d, r8d
mov edx, 0x1b
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400442c0]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x1400442c0]
mov r9d, 1
mov dword [rsp + 0x30], edi
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], edi
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x1400442c0]
mov rax, qword [rcx]
call qword [rax + 0x148]
movaps xmm7, xmmword [rsp + 0xd0]
test eax, eax
js 0x140034cb3
call fcn.140007530
mov rcx, qword [0x1400440f0]
add rcx, 0x1c70
cmp byte [rcx], dil
cmove rcx, rdi
call fcn.140022c50
mov rcx, qword [0x1400442c0]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400442c0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140034d75
mov rcx, qword [0x1400442c0]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140034d75
cmp qword [0x140044238], rdi
je 0x140034d59
mov rcx, qword [0x140044240]
test rcx, rcx
je 0x140034d15
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140044240], rdi
mov rcx, qword [0x140044230]
test rcx, rcx
je 0x140034d2e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140044230], rdi
mov rcx, qword [0x140044228]
mov rbx, qword [0x1400440f0]
test rcx, rcx
je 0x140034d47
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140044228], rdi
mov rax, qword [rbx + 0xa0]
mov qword [rax + 8], rdi
mov rcx, qword [0x1400442c0]
lea rdx, [0x140044110]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.140023550
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140035ea0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret