Function at 0x14004aee0
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x100
mov rax, qword [0x140061020]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor esi, esi
mov dword [0x140087c0c], 2
cmp byte [0x1400885b2], sil
je 0x14004affa
mov rax, qword [0x1400885a8]
lea r8, str.Foreground
lea edx, [rsi + 1]
mov qword [r11 + 8], rdi
mov rcx, qword [rax + 0x48b0]
mov rcx, qword [rcx]
call fcn.1400071b0
movaps xmm0, xmmword [0x140058470]
lea rcx, [rbp + 0x3f]
movups xmmword [rbp + 0x3f], xmm0
mov rbx, rax
call fcn.140003470
mov rcx, qword [0x1400885a8]
mov edi, eax
movss xmm1, dword [0x140058134]
movss xmm0, dword [rcx + 0x10]
mulss xmm0, xmm1
movss dword [rbp + 0x1f], xmm0
movss xmm0, dword [rcx + 0x14]
mulss xmm0, xmm1
movss dword [rbp + 0x23], xmm0
test eax, 0xff000000
je 0x14004aff2
movss xmm2, dword [0x140061068]
comiss xmm1, xmm2
ja 0x14004aff2
movss xmm0, dword [0x140058230]
subss xmm2, xmm1
mov dword [rsp + 0x28], 0xc7
lea rdx, [rbp + 0x1f]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm0
mov rcx, rbx
call fcn.140026460
movss xmm0, dword [0x1400581d8]
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rcx, rbx
mov rdx, qword [rbx + 0x80]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
call fcn.1400249e0
mov dword [rbx + 0x78], esi
mov rdi, qword [rsp + 0x110]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14004b01b
cmp byte [0x140061074], sil
sete al
mov byte [0x140061074], al
jmp 0x14004b022
movzx eax, byte [0x140061074]
test al, al
je 0x14004b8fa
mov rax, qword [0x1400885a8]
lea rcx, str.SubZero_Free_External_Made_By_Deano_3.0
xor edx, edx
or dword [rax + 0x47b0], 2
lea r8d, [rdx + 0x22]
mov dword [rax + 0x47d0], 0x438e8000
mov dword [rax + 0x47d4], 0x446d8000
mov dword [rax + 0x47b8], 2
call fcn.14000d000
lea rcx, str.Aimbot
call fcn.140030620
mov rcx, rsi
mov dword [rbp + 0x3f], 0xafada58f
mov dword [rbp + 0x43], 0x90f0aaa2
mov dword [rbp + 0x47], 0xbab6bebb
mov word [rbp + 0x4b], 0xa2
mov byte [rbp + 0x4d], 1
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 0xd
jb 0x14004b0a0
lea rdx, [0x1400885b3]
mov byte [rbp + 0x4d], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xbaa3a399
mov dword [rbp + 0x43], 0xa7bf89ee
mov word [rbp + 0x47], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 8
jb 0x14004b0e0
lea rdx, [0x1400885b2]
mov byte [rbp + 0x48], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xedbfa29c
mov dword [rbp + 0x43], 0xb2b5a78d
mov word [rbp + 0x47], 0xb9
mov byte [rbp + 0x49], 1
nop
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 9
jb 0x14004b120
lea rdx, [0x1400885b1]
mov byte [rbp + 0x49], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xf7baa48c
mov dword [rbp + 0x43], 0xe0feeaee
mov word [rbp + 0x47], 0xb4
mov byte [rbp + 0x49], 1
nop
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 9
jb 0x14004b160
mov byte [rbp + 0x49], sil
mov rcx, rsi
mov dword [rbp + 0x1f], 0xa28ae8e9
mov word [rbp + 0x23], 0xb8
mov byte [rbp + 0x25], 1
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x1f], al
inc rcx
cmp rcx, 5
jb 0x14004b190
lea rax, [rbp + 0x3f]
mov byte [rbp + 0x25], sil
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x17]
lea rax, [rbp + 0x37]
mov dword [rbp + 0x37], 0x43960000
lea r8, [0x140061068]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1f]
mov dword [rbp + 0x17], 0x42480000
call fcn.140035380
mov rcx, rsi
mov dword [rbp + 0x3f], 0xa2a3a699
mov dword [rbp + 0x43], 0xf1eaa7ba
mov dword [rbp + 0x47], 0xb3e5fdf7
mov word [rbp + 0x4b], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 0xc
jb 0x14004b200
mov byte [rbp + 0x4c], sil
mov rcx, rsi
mov dword [rbp + 0x1f], 0xa09fe8e9
mov dword [rbp + 0x23], 0xb9a4a0a1
mov dword [rbp + 0x27], 0xa6a7b6bc
mov word [rbp + 0x2b], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x1f], al
inc rcx
cmp rcx, 0xc
jb 0x14004b240
lea rax, [rbp + 0x3f]
mov byte [rbp + 0x2c], sil
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
lea rax, [rbp + 0x17]
mov dword [rbp + 0x17], 0x41c80000
lea r8, [0x140061064]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1f]
mov dword [rbp + 0x37], 0x3f800000
call fcn.140035380
mov rcx, rsi
mov dword [rbp + 0x3f], 0xb9bfa28e
mov dword [rbp + 0x43], 0xb4b3a1af
mov dword [rbp + 0x47], 0xfbf1f3e8
mov dword [rbp + 0x4b], 0x100b1e7
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 0xe
jb 0x14004b2b0
movdqa xmm0, xmmword [0x140058560]
mov rcx, rsi
movdqu xmmword [rbp + 0x1f], xmm0
mov byte [rbp + 0x4e], sil
mov word [rbp + 0x2f], 0xbf
mov byte [rbp + 0x31], 1
nop
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x1f], al
inc rcx
cmp rcx, 0x11
jb 0x14004b2e0
lea rax, [rbp + 0x3f]
mov byte [rbp + 0x31], sil
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
lea rax, [rbp + 0x17]
mov dword [rbp + 0x17], 0x41c80000
lea r8, [0x140061060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1f]
mov dword [rbp + 0x37], 0x3f800000
call fcn.140035380
lea rcx, [0x14005183c]
call fcn.140030620
movss xmm1, dword [0x1400582cc]
xorps xmm0, xmm0
call fcn.140012ac0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xedb8a282
mov dword [rbp + 0x43], 0xeba8a08c
mov word [rbp + 0x47], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 8
jb 0x14004b360
lea rcx, [rbp + 0x3f]
mov byte [rbp + 0x48], sil
call fcn.140030620
lea rcx, [0x14005183c]
call fcn.140030620
movss xmm1, dword [0x1400582cc]
xorps xmm0, xmm0
call fcn.140012ac0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xa484e8e9
mov dword [rbp + 0x43], 0xbe92efba
mov word [rbp + 0x47], 0xaa
mov byte [rbp + 0x49], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 9
jb 0x14004b3c0
lea rcx, [rbp + 0x3f]
mov byte [rbp + 0x49], sil
call fcn.140034100
lea rcx, [0x140057c70]
call fcn.140030620
lea rdx, [0x1400885e5]
lea rcx, str.Enable_Visuals
call fcn.140031fc0
cmp byte [0x1400885e5], sil
lea rbx, str._.3f
je 0x14004b5cd
mov dword [rbp + 0x17], 0xb4a488
mov rcx, rsi
mov byte [rbp + 0x1b], 1
nop
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 3
jb 0x14004b420
lea rdx, [0x1400885e7]
mov byte [rbp + 0x1b], sil
lea rcx, [rbp + 0x17]
call fcn.140031fc0
cmp byte [0x1400885e7], sil
je 0x14004b45b
mov byte [0x1400885e7], 1
mov byte [0x1400885b7], sil
mov dword [rbp + 0x3f], 0xa1a0a28c
mov rcx, rsi
mov dword [rbp + 0x43], 0xa9bf8dee
mov word [rbp + 0x47], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 8
jb 0x14004b480
lea rdx, [0x1400885b7]
mov byte [rbp + 0x48], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
cmp byte [0x1400885b7], sil
je 0x14004b4bb
mov byte [0x1400885e7], sil
mov byte [0x1400885b7], 1
mov dword [rbp + 0x17], 0xa8a2a286
mov rcx, rsi
mov word [rbp + 0x1b], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 4
jb 0x14004b4d0
lea rdx, [0x1400885e4]
mov byte [rbp + 0x1c], sil
lea rcx, [rbp + 0x17]
call fcn.140031fc0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xb9bfa28e
mov dword [rbp + 0x43], 0xb4b3a1af
mov word [rbp + 0x47], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 8
jb 0x14004b510
lea rdx, [0x1400885b5]
mov byte [rbp + 0x48], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
mov rcx, rsi
mov dword [rbp + 0x3f], 0xa1a9a099
mov dword [rbp + 0x43], 0xbfbfbbab
mov word [rbp + 0x47], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x36]
xor byte [rbp + rcx + 0x3f], al
inc rcx
cmp rcx, 8
jb 0x14004b550
lea rdx, [0x1400885b6]
mov byte [rbp + 0x48], sil
lea rcx, [rbp + 0x3f]
call fcn.140031fc0
lea rdx, [0x1400885b4]
lea rcx, str.Platform
call fcn.140031fc0
lea rdx, [0x1400885e6]
lea rcx, str.NickName
call fcn.140031fc0
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rbx
lea r9, [rbp + 0x37]
mov qword [rsp + 0x20], rax
lea r8, [0x14006106c]
mov dword [rbp + 0x17], 0x451c4000
lea rcx, str.Distance
mov dword [rbp + 0x37], 0x42480000
call fcn.140035380
movss xmm0, dword [0x1400885d8]
lea rdx, [rbp + 0x3f]
movss xmm1, dword [0x1400885dc]
lea rcx, str.Visible_Color
xor r9d, r9d
movss dword [rbp + 0x3f], xmm0
movss xmm0, dword [0x1400885e0]
movss dword [rbp + 0x43], xmm1
movss dword [rbp + 0x47], xmm0
lea r8d, [r9 + 0x22]
mov dword [rbp + 0x4b], 0x3f800000
call fcn.14003cc30
test al, al
je 0x14004b63d
movss xmm0, dword [rbp + 0x3f]
movss xmm1, dword [rbp + 0x43]
movss dword [0x1400885d8], xmm0
movss xmm0, dword [rbp + 0x47]
movss dword [0x1400885e0], xmm0
movss dword [0x1400885dc], xmm1
movss xmm0, dword [0x140088640]
lea rdx, [rbp + 0x3f]
movss xmm1, dword [0x140088644]
lea rcx, str.Not_Visible_Color
xor r9d, r9d
movss dword [rbp + 0x3f], xmm0
movss xmm0, dword [0x140088648]
movss dword [rbp + 0x43], xmm1
movss dword [rbp + 0x47], xmm0
lea r8d, [r9 + 0x22]
mov dword [rbp + 0x4b], 0x3f800000
call fcn.14003cc30
test al, al
je 0x14004b6ad
movss xmm0, dword [rbp + 0x3f]
movss xmm1, dword [rbp + 0x43]
movss dword [0x140088640], xmm0
movss xmm0, dword [rbp + 0x47]
movss dword [0x140088648], xmm0
movss dword [0x140088644], xmm1
lea rcx, str.Misc
call fcn.140030620
lea rcx, [0x14005183c]
call fcn.140030620
lea rdx, [0x1400885ea]
lea rcx, str.BigPlayer
call fcn.140031fc0
lea rdx, [0x1400885e9]
lea rcx, str.SmallPlayer
call fcn.140031fc0
lea rdx, [0x1400885ec]
lea rcx, str.Infinite_Fuel
call fcn.140031fc0
lea rdx, [0x1400885eb]
lea rcx, str.No_Recoil
call fcn.140031fc0
lea rdx, [0x1400885e8]
lea rcx, str.CarFly
call fcn.140031fc0
lea rdx, [0x1400885ee]
lea rcx, str.Aim_While_Jumping
call fcn.140031fc0
lea rdx, [0x1400885ed]
lea rcx, str.Car_Speed
call fcn.140031fc0
lea rdx, [rbp + 0x1f]
mov qword [rbp + 0x1f], rsi
lea rcx, str.Vbucks_SubZero
call fcn.140031010
test al, al
je 0x14004b86f
cvttss2si eax, dword [0x140061070]
mov rcx, qword [0x140088718]
lea r8, [rbp - 0x69]
mov edx, 1
mov qword [rbp + 0x1f], rsi
mov dword [rbp - 0x51], 8
mov dword [rbp + 0x17], eax
mov eax, dword [rcx]
mov dword [rbp - 0x69], eax
mov rax, qword [0x1400885d0]
add rax, 0xea5f7e0
mov qword [rbp - 0x59], rax
lea rax, [rbp + 0x1f]
mov qword [rbp - 0x61], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x4d], eax
call fcn.140043510
mov rcx, qword [0x140088718]
lea r8, [rbp - 0x49]
mov edx, 1
mov qword [rbp + 0x37], rsi
mov dword [rbp - 0x31], 8
mov eax, dword [rcx]
mov dword [rbp - 0x49], eax
mov rax, qword [rbp + 0x1f]
add rax, 8
mov qword [rbp - 0x39], rax
lea rax, [rbp + 0x37]
mov qword [rbp - 0x41], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x2d], eax
call fcn.140043510
mov rcx, qword [0x140088718]
lea r8, [rbp - 0x29]
mov edx, 1
mov qword [rbp + 0x3f], rsi
mov dword [rbp - 0x11], 8
mov eax, dword [rcx]
mov dword [rbp - 0x29], eax
mov rax, qword [rbp + 0x37]
add rax, 0xb8
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x3f]
mov qword [rbp - 0x21], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0xd], eax
call fcn.140043510
mov rcx, qword [0x140088718]
lea r8, [rbp - 9]
xor edx, edx
mov dword [rbp + 0xf], 4
mov eax, dword [rcx]
mov dword [rbp - 9], eax
lea rax, [rbp + 0x17]
mov qword [rbp + 7], rax
mov rax, qword [rbp + 0x3f]
add rax, 0xbc
mov qword [rbp - 1], rax
mov eax, dword [rcx + 0x20]
mov dword [rbp + 0x13], eax
call fcn.140043510
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rbx
lea r9, [rbp + 0x37]
mov qword [rsp + 0x20], rax
lea r8, [0x140061070]
mov dword [rbp + 0x17], 0x49742400
lea rcx, str.SubZero
mov dword [rbp + 0x37], esi
call fcn.140035380
lea rcx, [0x14005183c]
call fcn.140030620
movss xmm1, dword [0x1400582cc]
xorps xmm0, xmm0
call fcn.140012ac0
lea rcx, str.EXIT
mov qword [rbp + 0x3f], rsi
lea rdx, [rbp + 0x3f]
call fcn.140031010
test al, al
je 0x14004b8f5
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_mspaint.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000f2b0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14004e9a0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret