Function at 0x140033c40
Capabilities:
Encode data using xor
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r12, rdx
mov ecx, 0x6e
xor edx, edx
call fcn.140001240
lea ecx, [rdx + 0x74]
mov word [rbp - 0x30], ax
lea edx, [rcx - 0x73]
call fcn.140001240
lea ecx, [rdx + 0x63]
mov word [rbp - 0x2e], ax
lea edx, [rcx - 0x62]
call fcn.140001240
lea ecx, [rdx + 0x6a]
mov word [rbp - 0x2c], ax
lea edx, [rcx - 0x69]
call fcn.140001240
lea edx, [rcx - 0x68]
mov word [rbp - 0x2a], ax
call fcn.140001240
lea ecx, [rdx + 0x2a]
mov word [rbp - 0x28], ax
lea edx, [rcx - 0x29]
call fcn.140001240
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x26], ax
lea edx, [rcx - 0x5e]
call fcn.140001240
lea ecx, [rdx + 0x66]
mov word [rbp - 0x24], ax
lea edx, [rcx - 0x65]
call fcn.140001240
lea edx, [rcx - 0x64]
mov word [rbp - 0x22], ax
call fcn.140001240
xor ecx, ecx
mov word [rbp - 0x20], ax
lea edx, [rcx + 9]
call fcn.140001240
lea edx, [rcx + 0xa]
mov word [rbp - 0x1e], ax
movzx ecx, word [0x140049c54]
call fcn.140001240
movzx ecx, word [0x140049c56]
mov edx, 0xb
mov word [rbp - 0x1c], ax
call fcn.140001240
movzx ecx, word [str.SquadHackInject]
mov edx, 0xc
mov word [rbp - 0x1a], ax
call fcn.140001240
movzx ecx, word [0x140049c5a]
mov edx, 0xd
mov word [rbp - 0x18], ax
call fcn.140001240
movzx ecx, word [0x140049c5c]
mov edx, 0xe
mov word [rbp - 0x16], ax
call fcn.140001240
movzx ecx, word [0x140049c5e]
mov edx, 0xf
mov word [rbp - 0x14], ax
call fcn.140001240
movzx ecx, word [0x140049c60]
mov edx, 0x10
mov word [rbp - 0x12], ax
call fcn.140001240
movzx ecx, word [0x140049c62]
mov edx, 0x11
mov word [rbp - 0x10], ax
call fcn.140001240
movzx ecx, word [0x140049c64]
mov edx, 0x12
mov word [rbp - 0xe], ax
call fcn.140001240
mov word [rbp - 0xc], ax
mov r8d, 0x133
xor eax, eax
mov word [rbp - 0xa], ax
xor ebx, ebx
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x140033dc0
lea rcx, [rbp - 0x30]
mov word [rbp - 0xa], bx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword gs:[0x58]
mov rdi, rax
mov r14d, 4
add r14, qword [rcx]
mov ecx, dword [r14]
cmp dword [0x1401a90e8], ecx
jle 0x140033e45
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140033e45
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], ebx
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov edx, 0x1000
lea rcx, [0x1401a90f0]
call fcn.140001300
xor ecx, ecx
mov qword [rbp + 0x58], rax
mov edx, 0xc8
mov r8d, 0x3000
mov r13, rax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x140097670]
lea r15, [r13 + 0x60]
mov rsi, rax
mov qword [rbp + 0x50], rax
mov r8, r12
mov edx, 0x50
movups xmmword [rax], xmm0
lea rbx, [rax + 0x60]
movaps xmm1, xmmword [0x140097680]
lea rcx, [rbx + 0x18]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140097690]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400976a0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400976b0]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400976c0]
movups xmmword [rax + 0x50], xmm1
mov qword [rax + 6], r15
mov rax, qword [0x140040048]
mov qword [rbx + 8], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov eax, dword [r14]
cmp dword [0x1401a90e8], eax
jle 0x140033f30
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140033f30
xor edx, edx
mov qword [0x1401a90f8], 0xffffffffffffffff
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], edx
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov r9d, 0xc8
lea rcx, [0x1401a90f0]
mov r8, rsi
mov rdx, r13
call fcn.140001250
mov r9d, dword [rbp + 0x40]
mov r8, rdi
mov rdx, r13
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rbx], 2
mov rdi, 0xffffffffc00000c0
mov r12, rax
je 0x140034060
xor esi, esi
mov r13, 0xffffffffc0000001
nop dword [rax]
mov ecx, dword [r14]
cmp dword [0x1401a90e8], ecx
jle 0x140033fc9
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x140033fc9
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], esi
mov qword [0x1401a90f8], 0xffffffffffffffff
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
mov eax, dword [0x1401a90f0]
mov word [rbp - 0x13], si
mov byte [rbp - 0x11], sil
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], 0x68
mov byte [rbp - 0x14], sil
cmp rcx, 0xffffffffffffffff
jne 0x140034000
mov r8, rdi
jmp 0x140034031
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0x20
mov dword [rsp + 0x28], esi
mov edx, 0x3009ce20
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov r8, rsi
cmove r8, r13
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx], 2
jne 0x140033f80
mov rsi, qword [rbp + 0x50]
mov r13, qword [rbp + 0x58]
mov rbx, qword [rbx + 0x10]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [r14]
cmp dword [0x1401a90e8], eax
jle 0x1400340b8
lea rcx, [0x1401a90e8]
call fcn.14003d9dc
cmp dword [0x1401a90e8], 0xffffffff
jne 0x1400340b8
xor eax, eax
mov qword [0x1401a90f8], 0xffffffffffffffff
lea rcx, [0x14003f6d0]
mov dword [0x1401a90f0], eax
call fcn.14003dd24
lea rcx, [0x1401a90e8]
call fcn.14003d97c
mov rcx, qword [0x1401a90f8]
xor edx, edx
mov eax, dword [0x1401a90f0]
mov dword [rbp - 0x2c], edx
mov dword [rbp - 0x30], eax
mov qword [rbp - 0x28], r13
cmp rcx, 0xffffffffffffffff
je 0x14003410e
mov qword [rsp + 0x38], rdx
lea r9d, [rdx + 0x10]
mov qword [rsp + 0x30], rdx
lea r8, [rbp - 0x30]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, 0x3009d4e0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
test eax, eax
mov edi, edx
mov rax, 0xffffffffc0000001
cmove rdi, rax
mov r8, rdi
lea rdx, str.send_serivce
lea rcx, [0x14004929c]
call fcn.14002e490
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret