Function at 0x140044bc0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140096010]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov ecx, 0xbd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140044bf8
cmp byte [0x140096061], 0
sete al
mov byte [0x140096061], al
jmp 0x140044bff
movzx eax, byte [0x140096061]
test al, al
je 0x14004511d
lea rcx, [0x1400972a0]
mov qword [rsp + 0x90], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [0x140096cf8]
lea rcx, str.Protiwi
xor edx, edx
mov dword [rax + 0x1af4], 0x44250000
lea r8d, [rdx + 0x2a]
mov dword [rax + 0x1af8], 0x43af0000
mov dword [rax + 0x1acc], 1
call fcn.140013640
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
mov rdx, qword [rax + 0x1d8]
test rdx, rdx
je 0x140044c89
cmp dword [rdx + 0x10], 2
jne 0x140044c84
cmp dword [rdx + 4], 1
je 0x140044c9b
call fcn.14001c440
mov r8d, 1
call fcn.14001be70
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov ecx, 1
mov rax, qword [rax + 0x1d8]
movss xmm0, dword [rax + 0x14]
movss xmm1, dword [rax + 0x18]
mov rax, qword [rax + 0x38]
subss xmm1, xmm0
mulss xmm1, dword [rax]
addss xmm1, xmm0
addss xmm1, dword [0x14008e760]
call fcn.14001bb90
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x43020000
lea rcx, [0x14008e46c]
mov dword [rbp - 0x2c], 0x425c0000
call fcn.140030920
xor edi, edi
test al, al
je 0x140044cff
mov dword [0x140097250], edi
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044d2e
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x43020000
lea rcx, [0x14008e470]
mov dword [rbp - 0x2c], 0x425c0000
call fcn.140030920
test al, al
je 0x140044d5a
mov dword [0x140097250], 1
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044d89
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x43020000
lea rcx, [0x14008e474]
mov dword [rbp - 0x2c], 0x425c0000
call fcn.140030920
test al, al
je 0x140044db5
mov dword [0x140097250], 2
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044de4
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x43020000
lea rcx, [0x14008e478]
mov dword [rbp - 0x2c], 0x425c0000
call fcn.140030920
test al, al
je 0x140044e10
mov dword [0x140097250], 3
mov qword [rsp + 0x80], rbx
call fcn.14001b980
mov eax, dword [0x140097250]
test eax, eax
jne 0x14004512f
mov rbx, qword [0x140096cf8]
lea rcx, str.AimbotLeft
mov qword [rsp + 0x88], rsi
xor edx, edx
movaps xmmword [rsp + 0x60], xmm6
mov dword [rbp - 0x30], 0x435c0000
mov rax, qword [rbx + 0x19f8]
mov dword [rbp - 0x2c], 0x438b8000
mov byte [rax + 0x7c], 1
mov rax, qword [rbx + 0x19f8]
movsxd r8, dword [rax + 0x1e0]
mov rax, qword [rax + 0x1e8]
mov r8d, dword [rax + r8*4 - 4]
call fcn.14000bfa0
cmp dword [rbx + 0x1a24], eax
jne 0x140044e8e
mov dword [rbx + 0x1a2c], eax
cmp dword [rbx + 0x1a28], eax
jne 0x140044e9d
mov byte [rbx + 0x1a37], 1
lea r8, [rbp - 0x30]
mov dword [rsp + 0x20], edi
mov edx, eax
lea rcx, str.AimbotLeft
call fcn.140011950
lea rcx, str.Aim:
call fcn.140030200
lea rdx, [0x140096580]
lea rcx, str.Aimbot
call fcn.140031780
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044f01
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
lea rcx, str.Aimkey:
call fcn.140030200
call fcn.140043660
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044f48
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044f77
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
mov rcx, qword [0x140096cf8]
mov rax, qword [rcx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rcx + 0x19f8]
cmp byte [rax + 0x7f], dil
jne 0x140044f9f
xorps xmm1, xmm1
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x30]
call fcn.14000e8a0
lea rcx, str.Smooth
call fcn.140030200
movss xmm6, dword [0x14008e660]
lea rax, [rbp - 0x28]
movss dword [rsp + 0x30], xmm6
lea rsi, str._.3f
mov qword [rsp + 0x28], rsi
lea r9, [rbp - 0x30]
lea r8, [0x140096048]
mov qword [rsp + 0x20], rax
mov edx, 4
mov dword [rbp - 0x28], 0x41a00000
mov dword [rbp - 0x30], 0x3f800000
call fcn.140033a00
call fcn.140011b90
movss xmm1, dword [0x14008e7b4]
xorps xmm0, xmm0
call fcn.140017220
mov rbx, qword [0x140096cf8]
lea rcx, str.AimbotRight
xor edx, edx
mov dword [rbp - 0x30], 0x435c0000
mov dword [rbp - 0x2c], 0x438b8000
mov rax, qword [rbx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rbx + 0x19f8]
movsxd r8, dword [rax + 0x1e0]
mov rax, qword [rax + 0x1e8]
mov r8d, dword [rax + r8*4 - 4]
call fcn.14000bfa0
cmp dword [rbx + 0x1a24], eax
jne 0x14004505c
mov dword [rbx + 0x1a2c], eax
cmp dword [rbx + 0x1a28], eax
jne 0x14004506b
mov byte [rbx + 0x1a37], 1
lea r8, [rbp - 0x30]
mov dword [rsp + 0x20], edi
mov edx, eax
lea rcx, str.AimbotRight
call fcn.140011950
lea rcx, str.AimBone:
call fcn.140030200
lea rdx, [0x140096e38]
lea rcx, str.Crosshair
call fcn.140031780
lea rdx, [0x140096dfc]
lea rcx, str.Fov_Circle
call fcn.140031780
lea rcx, str.Fov_Size
call fcn.140030200
movss dword [rsp + 0x30], xmm6
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rsi
lea r9, [rbp - 0x28]
lea r8, [0x140096044]
mov qword [rsp + 0x20], rax
mov edx, 4
mov dword [rbp - 0x30], 0x44480000
mov dword [rbp - 0x28], 0x42480000
call fcn.140033a00
call fcn.140011b90
movaps xmm6, xmmword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
call fcn.140016590
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140045dc0
add rsp, 0x70
pop rbp
ret
cmp eax, 1
jne 0x140045326
mov rbx, qword [0x140096cf8]
lea rcx, str.VisualsLeft
xor edx, edx
mov dword [rbp - 0x30], 0x435c0000
mov dword [rbp - 0x2c], 0x438b8000
mov rax, qword [rbx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rbx + 0x19f8]
movsxd r8, dword [rax + 0x1e0]
mov rax, qword [rax + 0x1e8]
mov r8d, dword [rax + r8*4 - 4]
call fcn.14000bfa0
cmp dword [rbx + 0x1a24], eax
jne 0x14004518e
mov dword [rbx + 0x1a2c], eax
cmp dword [rbx + 0x1a28], eax
jne 0x14004519d
mov byte [rbx + 0x1a37], 1
lea r8, [rbp - 0x30]
mov dword [rsp + 0x20], edi
mov edx, eax
lea rcx, str.VisualsLeft
call fcn.140011950
lea rcx, str.Normal:
call fcn.140030200
lea rdx, [0x140096050]
lea rcx, str.Draw_Box
call fcn.140031780
lea rcx, str.Esp_Distance:
call fcn.140030200
movss xmm0, dword [0x14008e660]
lea rax, [0x14008dd54]
movss dword [rsp + 0x30], xmm0
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [0x14009619c]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x30], 0x1f4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x28], 0x14
call fcn.140033a00
call fcn.140011b90
movss xmm1, dword [0x14008e7b4]
xorps xmm0, xmm0
call fcn.140017220
mov rbx, qword [0x140096cf8]
lea rcx, str.VisualsRight
xor edx, edx
mov dword [rbp - 0x30], 0x435c0000
mov dword [rbp - 0x2c], 0x438b8000
mov rax, qword [rbx + 0x19f8]
mov byte [rax + 0x7c], 1
mov rax, qword [rbx + 0x19f8]
movsxd r8, dword [rax + 0x1e0]
mov rax, qword [rax + 0x1e8]
mov r8d, dword [rax + r8*4 - 4]
call fcn.14000bfa0
cmp dword [rbx + 0x1a24], eax
jne 0x14004528c
mov dword [rbx + 0x1a2c], eax
cmp dword [rbx + 0x1a28], eax
jne 0x14004529b
mov byte [rbx + 0x1a37], 1
lea r8, [rbp - 0x30]
mov dword [rsp + 0x20], edi
mov edx, eax
lea rcx, str.VisualsRight
call fcn.140011950
lea rcx, str.Optional:
call fcn.140030200
lea rdx, [0x140096e08]
lea rcx, str.Visual_Check
call fcn.140031780
lea rdx, [0x140096e09]
lea rcx, str.Skeleton
call fcn.140031780
lea rdx, [0x140096e0c]
lea rcx, str.Head_Esp
call fcn.140031780
lea rdx, [0x140096e0b]
lea rcx, str.SnapLine
call fcn.140031780
lea rdx, [0x140096dfd]
lea rcx, str.Distance_Esp
call fcn.140031780
call fcn.140011b90
jmp 0x140045108
cmp eax, 2
jne 0x14004534c
xor r9d, r9d
lea rdx, [0x1400965f8]
mov r8d, 0x100002
lea rcx, str.Color_Picker
call fcn.14003b0c0
jmp 0x140045108
cmp eax, 3
jne 0x140045108
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x42820000
lea rcx, str.Unload
mov dword [rbp - 0x2c], 0x42340000
call fcn.140030920
test al, al
je 0x140045108
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3