Function at 0x1400945b0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov eax, 0x4138
call fcn.140267aa0
sub rsp, rax
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x4128], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009466d
movzx eax, byte [0x14039b1d5]
test eax, eax
jne 0x1400945fb
mov dword [rsp + 0x30], 1
jmp 0x140094603
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [0x14039b1d5], al
movzx eax, byte [0x14039b1d5]
test eax, eax
je 0x140094633
mov r8d, 0x80080
mov edx, 0xffffffec
mov rcx, qword [0x14039b328]
call qword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x14009466d
mov edx, 0xffffffec
mov rcx, qword [0x14039b328]
call qword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x20
mov dword [rsp + 0x3c], eax
mov rax, qword [0x14039b328]
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x3c]
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140094740
lea rcx, [0x1402d0378]
call fcn.1400da580
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rdx, [0x1402d0388]
lea rcx, [rsp + 0x58]
call fcn.140032590
mov rcx, rax
call fcn.1400325c0
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14000f350
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140032680
movzx eax, byte [0x14039b3fd]
cmp eax, 1
jne 0x1400946e0
call fcn.140130810
mov byte [0x14039b1d5], 0
mov byte [rsp + 0x40c0], 0x70
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsp + 0x40c0]
mov edx, 0xe0c01c8
mov rcx, qword [0x14039b390]
call fcn.140266c10
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x14039b42c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009477c
movzx eax, byte [0x14039b419]
test eax, eax
jne 0x140094769
mov dword [rsp + 0x34], 1
jmp 0x140094771
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [0x14039b419], al
mov ecx, dword [0x14039b504]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140094920
lea rdx, [0x1402c5407]
lea rcx, [rsp + 0x40c8]
call fcn.14000f350
nop
cmp dword [0x14039b3d0], 0
jne 0x1400947c6
lea rdx, str.__AimBot
lea rcx, [rsp + 0x40c8]
call fcn.14005d610
cmp dword [0x14039b3d0], 1
jne 0x1400947e3
lea rdx, str.__Magic_Bullet
lea rcx, [rsp + 0x40c8]
call fcn.14005d610
cmp dword [0x14039b3d0], 2
jne 0x140094800
lea rdx, str.__Smart_Magic
lea rcx, [rsp + 0x40c8]
call fcn.14005d610
cmp dword [0x14039b3d0], 3
jne 0x14009481d
lea rdx, str.__AimBotSmart_Magic
lea rcx, [rsp + 0x40c8]
call fcn.14005d610
movzx eax, byte [0x14039b3df]
test eax, eax
jne 0x140094832
mov dword [rsp + 0x38], 1
jmp 0x14009483a
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov byte [0x14039b3df], al
lea r8, str._:_Is_Activated__
lea rdx, [rsp + 0x40c8]
lea rcx, [rsp + 0x4108]
call fcn.1400118d0
nop
lea r8, str._:_Is_DEActivated__
lea rdx, [rsp + 0x40c8]
lea rcx, [rsp + 0x40e8]
call fcn.1400118d0
nop
movzx eax, byte [0x14039b3df]
test eax, eax
je 0x1400948c1
lea rcx, [rsp + 0x4108]
call fcn.14000f130
mov r9, rax
mov r8d, 0xbb8
mov edx, 1
lea rcx, [rsp + 0xa0]
call fcn.140094510
lea rcx, [rsp + 0xa0]
call fcn.140094590
jmp 0x1400948f7
lea rcx, [rsp + 0x40e8]
call fcn.14000f130
mov r9, rax
mov r8d, 0xbb8
mov edx, 2
lea rcx, [rsp + 0x20b0]
call fcn.140094510
lea rcx, [rsp + 0x20b0]
call fcn.140094590
nop
lea rcx, [rsp + 0x40e8]
call fcn.14000f240
nop
lea rcx, [rsp + 0x4108]
call fcn.14000f240
nop
lea rcx, [rsp + 0x40c8]
call fcn.14000f240
mov rcx, qword [rsp + 0x4128]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x4138
ret