Function at 0x140197928
Capabilities:
Get session user name
Log keystrokes via polling

Disassembly:
jmp 0x1403307d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x778
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x136
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x798]
mov rax, qword [0x1405d17d8]
xor rax, rbp
mov qword [rbp + 0x708], rax
lea rcx, [0x14060b200]
call fcn.14019a24f
call fcn.140196145
movzx eax, al
test eax, eax
jne 0x1403308a5
call fcn.140199f4d
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14033084b
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140330852
xor ecx, ecx
call fcn.140191a82
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1405c52f0]
mov rcx, qword [rbp + 8]
call fcn.140199e03
test rax, rax
jne 0x14033089c
mov rcx, qword [rbp + 8]
call fcn.1401997f0
mov rcx, qword [rbp + 8]
call fcn.1401997f0
mov dword [rbp + 0x154], 0x104
lea rdx, [rbp + 0x154]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x178]
call fcn.140195295
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x178]
call fcn.140191acd
lea rdx, str.AppDataLocalUbisoft_r6siege
lea rcx, [rbp + 0x178]
call fcn.140191acd
lea rcx, [rbp + 0x178]
call fcn.140199129
lea rdx, str.D:Users_
lea rcx, [rbp + 0x178]
call fcn.14019155f
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x178]
call fcn.140191acd
lea rdx, str.AppDataLocalUbisoft_r6siege
lea rcx, [rbp + 0x178]
call fcn.140191acd
lea rcx, [rbp + 0x178]
call fcn.140199129
xor r9d, r9d
lea r8, str.Dogo
lea rdx, str.start_your_game_now
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x1b4], 0
cmp dword [rbp + 0x1b4], 0
jne 0x1403309b1
lea rdx, [rbp + 0x5f8]
lea rcx, [rbp + 0x5d4]
call fcn.14032a470
mov rcx, rax
call fcn.140199656
mov qword [rbp + 0x1d8], rax
mov rcx, qword [rbp + 0x1d8]
call fcn.140191cbc
mov dword [rbp + 0x1b4], eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140330967
lea rdx, str.Rainbow_Six
lea rcx, str.R6Game
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1403309d7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1403309b1
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
call fcn.1401970a4
call fcn.14019a902
movzx eax, al
test eax, eax
jne 0x140330a0f
mov dword [rbp + 0x624], 0
lea rcx, [rbp + 0x178]
call fcn.140192aea
mov eax, dword [rbp + 0x624]
jmp 0x1403311de
lea rdx, [0x140198ff8]
lea rcx, [rbp + 0x1f8]
call fcn.140195196
mov dword [rbp + 0x230], 0x50
mov dword [rbp + 0x234], 3
lea rax, [0x14019627b]
mov qword [rbp + 0x238], rax
mov dword [rbp + 0x240], 0
mov dword [rbp + 0x244], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x248], rax
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x268], 0
lea rax, str.OverWolf
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 0
lea rcx, [rbp + 0x230]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov dword [rbp + 0x294], 0x1f4
mov dword [rbp + 0x2b4], 0x1f4
lea rdx, [rbp + 0x2b4]
lea rcx, [rbp + 0x294]
call fcn.1401978e2
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rbp + 0x2b4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x294]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
lea r8, str.OverWolf
mov rdx, qword [rbp + 0x270]
mov ecx, 0x80028
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rbp + 0x2d8], rax
mov rcx, qword [rbp + 0x2d8]
call fcn.14019abe1
mov byte [rbp + 0x2f4], 0
movzx eax, byte [rbp + 0x2f4]
test eax, eax
jne 0x14033116c
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x318]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140330bc0
lea rcx, [rbp + 0x318]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x318]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rbp + 0x320], 0x12
jne 0x140330bbe
mov byte [rbp + 0x2f4], 1
jmp 0x140330b73
movzx eax, byte [rbp + 0x2f4]
test eax, eax
je 0x140330bd0
jmp 0x14033116c
mov ecx, dword [0x1405dee98]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
cmp eax, 1
jne 0x140330c13
movzx eax, byte [0x1405ce2e9]
test eax, eax
jne 0x140330bfc
mov dword [rbp + 0x6f4], 1
jmp 0x140330c06
mov dword [rbp + 0x6f4], 0
movzx eax, byte [rbp + 0x6f4]
mov byte [0x1405ce2e9], al
call fcn.14019468d
call fcn.140196de3
call fcn.140197b26
movzx eax, byte [0x1405ce2e9]
test eax, eax
je 0x14033106d
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x644]
call fcn.140196bf9
mov qword [rbp + 0x6f8], rax
movss xmm2, dword [0x14050ce00]
movss xmm1, dword [0x14050ce00]
lea rcx, [rbp + 0x664]
call fcn.140196bf9
mov qword [rbp + 0x700], rax
mov r8, qword [rbp + 0x6f8]
mov edx, 4
mov rcx, qword [rbp + 0x700]
call fcn.1401973a1
movss xmm2, dword [0x1404f62fc]
movss xmm1, dword [0x1404f62fc]
lea rcx, [rbp + 0x684]
call fcn.140196bf9
mov edx, 4
mov rcx, rax
call fcn.140193283
xor r8d, r8d
lea rdx, [0x1405ce2e8]
lea rcx, str.Dogo_R6
call fcn.140197d9c
movzx eax, byte [0x1405ce2e8]
test eax, eax
jne 0x140330cdb
mov dword [rbp + 0x6f4], 1
jmp 0x140330ce5
mov dword [rbp + 0x6f4], 0
movzx eax, byte [rbp + 0x6f4]
mov byte [rbp + 0x2f4], al
xor edx, edx
lea rcx, str.Aimbot
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140330df7
lea rdx, [0x1405b3002]
lea rcx, str.AimAssist
call fcn.140194f39
call fcn.140197699
lea rdx, [0x1405b3004]
lea rcx, str.Aimbot_circle
call fcn.140194f39
call fcn.140197699
mov dword [rsp + 0x28], 0
lea rax, str._.3f
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14050cd94]
movss xmm2, dword [0x1404dadc4]
lea rdx, [0x1405b304c]
lea rcx, str.Aim_smoothing
call fcn.14019a9b6
call fcn.140197699
call fcn.140197699
mov dword [rsp + 0x28], 0
lea rax, str._.3f
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x1404f62fc]
movss xmm2, dword [0x1404dadc4]
lea rdx, [0x1405b3008]
lea rcx, str.Aim_FOV
call fcn.14019a9b6
movss xmm1, dword [0x1404dae58]
xorps xmm0, xmm0
call fcn.140196f05
call fcn.140197699
call fcn.140197699
mov r9d, 0xffffffff
lea r8, str.Head
lea rdx, [0x1405d46ec]
lea rcx, str.Hitbox
call fcn.140192937
call fcn.140197699
call fcn.140197699
xor edx, edx
lea rcx, str.Triggerbot
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140330e5b
lea rdx, [0x1405b302d]
lea rcx, str.TriggerAssist
call fcn.140194f39
call fcn.140197699
mov dword [rsp + 0x28], 0
lea rax, str._.3f
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14050cda8]
movss xmm2, dword [0x1404dadc4]
lea rdx, [0x1405b305c]
lea rcx, str.trigger_delay
call fcn.14019a9b6
xor edx, edx
lea rcx, str.Visual
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140330f10
lea rdx, [0x1405b300c]
lea rcx, str.Object
call fcn.140194f39
movzx eax, al
test eax, eax
je 0x140330e93
call fcn.140197487
movzx eax, byte [0x1405b300c]
test eax, eax
je 0x140330f10
lea rdx, [0x1405b3005]
lea rcx, str.Player_Tags
call fcn.140194f39
lea rdx, [0x1405b3007]
lea rcx, str.snaplines
call fcn.140194f39
lea rdx, [0x1405b3006]
lea rcx, str.head_circle
call fcn.140194f39
lea rdx, [0x1405d46f0]
lea rcx, str.corner_box
call fcn.140194f39
lea rdx, [0x1405b302e]
lea rcx, str.normal_box
call fcn.140194f39
lea rdx, [0x1405d46f1]
lea rcx, str.fill_box
call fcn.140194f39
xor edx, edx
lea rcx, str.Visual_Colors
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140330fad
xor r8d, r8d
lea rdx, [0x1405b3010]
lea rcx, str.Fov_Circle_Color
call fcn.140195c59
xor r8d, r8d
lea rdx, [0x1405b3020]
lea rcx, str.BoxColour
call fcn.140195c59
xor r8d, r8d
lea rdx, [0x1405b3030]
lea rcx, str.headcircle
call fcn.140195c59
xor r8d, r8d
lea rdx, [0x1405b3040]
lea rcx, str.NameTagColor
call fcn.140195c59
xor r8d, r8d
lea rdx, [0x1405b3050]
lea rcx, str.healthBarColor
call fcn.140195c59
xor r8d, r8d
lea rdx, [0x1405b3060]
lea rcx, str.line_color
call fcn.140195c59
xor edx, edx
lea rcx, str.exploits
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140331004
mov dword [rsp + 0x28], 0
lea rax, [0x1404f3114]
mov qword [rsp + 0x20], rax
mov r9d, 0x15e
xor r8d, r8d
lea rdx, [0x1405b303c]
lea rcx, str.Bullets_per_shot
call fcn.14019a5f1
movzx eax, al
test eax, eax
je 0x140331004
mov ecx, dword [0x1405b303c]
call fcn.140195506
xor edx, edx
lea rcx, str.misc
call fcn.1401990fc
movzx eax, al
test eax, eax
je 0x140331043
lea rcx, str.menu__Key
call fcn.1401962ee
call fcn.140197699
mov r8d, dword [0x1405deeb0]
lea rdx, [0x1401936e8]
mov ecx, dword [0x1405dee98]
call fcn.140199197
mov dword [rbp + 0x6c4], 0xa
lea rdx, [rbp + 0x6c4]
lea rcx, [rbp + 0x6a8]
call fcn.140197b58
mov rcx, rax
call fcn.140198792
call fcn.1401950c4
movzx eax, byte [0x1405b300c]
test eax, eax
je 0x14033107d
call fcn.1401975ea
call fcn.140199cf5
xorps xmm0, xmm0
movss dword [rbp + 0x368], xmm0
xorps xmm0, xmm0
movss dword [rbp + 0x36c], xmm0
xorps xmm0, xmm0
movss dword [rbp + 0x370], xmm0
xorps xmm0, xmm0
movss dword [rbp + 0x374], xmm0
mov rax, qword [0x1405dee80]
mov rax, qword [rax]
mov rax, qword [rax + 0x108]
mov qword [rbp + 0x6f8], rax
xor r9d, r9d
lea r8, [0x1405dee90]
mov edx, 1
mov rcx, qword [0x1405dee80]
call qword [rbp + 0x6f8]
mov rax, qword [0x1405dee80]
mov rax, qword [rax]
mov rax, qword [rax + 0x190]
mov qword [rbp + 0x6f8], rax
lea r8, [rbp + 0x368]
mov rdx, qword [0x1405dee90]
mov rcx, qword [0x1405dee80]
call qword [rbp + 0x6f8]
call fcn.140199430
mov rcx, rax
call fcn.140191505
call fcn.140197f1d
mov eax, dword [rax]
and eax, 0x400
test eax, eax
je 0x140331140
call fcn.1401916ef
xor edx, edx
xor ecx, ecx
call fcn.14019a380
mov rax, qword [0x1405dee88]
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rbp + 0x6f8], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1405dee88]
call qword [rbp + 0x6f8]
jmp 0x140330b64
call fcn.14019915b
call fcn.140192991
xor ecx, ecx
call fcn.140197045
call fcn.140199269
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x248]
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov byte [0x1405d4780], 1
lea rcx, [rbp + 0x1f8]
call fcn.140191069
mov dword [rbp + 0x6e4], 0
lea rcx, [rbp + 0x1f8]
call fcn.140195245
lea rcx, [rbp + 0x178]
call fcn.140192aea
mov eax, dword [rbp + 0x6e4]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14052dbc0]
call fcn.140198896
mov rax, rdi
mov rcx, qword [rbp + 0x708]
xor rcx, rbp
call fcn.14019569b
lea rsp, [rbp + 0x718]
pop rdi
pop rbp
ret