Function at 0x14004a930
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140060020]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [0x140086c0c], 2
cmp byte [0x1400875b2], bl
je 0x14004aa50
mov rax, qword [0x1400875a8]
lea r8, str.Foreground
mov qword [r11 + 8], rsi
lea edx, [rbx + 1]
mov qword [r11 + 0x10], rdi
mov rcx, qword [rax + 0x48b0]
mov rcx, qword [rcx]
call fcn.1400071b0
movaps xmm0, xmmword [0x1400573c0]
lea rcx, [rbp - 0x18]
movups xmmword [rbp - 0x18], xmm0
mov rdi, rax
call fcn.140003470
mov rcx, qword [0x1400875a8]
mov esi, eax
movss xmm1, dword [0x140057094]
movss xmm0, dword [rcx + 0x10]
mulss xmm0, xmm1
movss dword [rbp - 0x40], xmm0
movss xmm0, dword [rcx + 0x14]
mulss xmm0, xmm1
movss dword [rbp - 0x3c], xmm0
test eax, 0xff000000
je 0x14004aa40
movss xmm2, dword [0x140060068]
comiss xmm1, xmm2
ja 0x14004aa40
movss xmm0, dword [0x140057188]
subss xmm2, xmm1
mov dword [rsp + 0x28], 0xc7
lea rdx, [rbp - 0x40]
xorps xmm3, xmm3
movss dword [rsp + 0x20], xmm0
mov rcx, rdi
call fcn.140026460
movss xmm0, dword [0x140057130]
mov r9d, esi
mov r8d, dword [rdi + 0x78]
mov rcx, rdi
mov rdx, qword [rdi + 0x80]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
call fcn.1400249e0
mov dword [rdi + 0x78], ebx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14004aa70
cmp byte [0x140060070], bl
sete al
mov byte [0x140060070], al
jmp 0x14004aa77
movzx eax, byte [0x140060070]
test al, al
je 0x14004b16c
mov rax, qword [0x1400875a8]
lea rcx, str.SubZero_Free_External
xor edx, edx
or dword [rax + 0x47b0], 2
lea r8d, [rdx + 0x22]
mov dword [rax + 0x47d0], 0x438c0000
mov dword [rax + 0x47d4], 0x44480000
mov dword [rax + 0x47b8], 2
call fcn.14000d000
lea rcx, str.Aimbot
call fcn.140030620
mov rcx, rbx
mov dword [rbp - 0x18], 0xc2fef0d8
mov dword [rbp - 0x14], 0xe583c7cd
mov dword [rbp - 0x10], 0xc7c5cbcc
mov word [rbp - 0xc], 0xdd
mov byte [rbp - 0xa], 1
nop dword [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0xd
jb 0x14004aaf0
lea rdx, [0x1400875b3]
mov byte [rbp - 0xa], bl
lea rcx, [rbp - 0x18]
call fcn.140031fc0
mov rcx, rbx
mov dword [rbp - 0x40], 0xd7f0f6ce
mov dword [rbp - 0x3c], 0xd2cce481
mov word [rbp - 0x38], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 8
jb 0x14004ab30
lea rdx, [0x1400875b2]
mov byte [rbp - 0x37], bl
lea rcx, [rbp - 0x40]
call fcn.140031fc0
mov rcx, rbx
mov dword [rbp - 0x40], 0x80ecf7cb
mov dword [rbp - 0x3c], 0xc7c6cae2
mov word [rbp - 0x38], 0xce
mov byte [rbp - 0x36], 1
nop
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 9
jb 0x14004ab70
lea rdx, [0x1400875b1]
mov byte [rbp - 0x36], bl
lea rcx, [rbp - 0x40]
call fcn.140031fc0
mov rcx, rbx
mov dword [rbp - 0x18], 0x9ae9f1db
mov dword [rbp - 0x14], 0x958d8781
mov word [rbp - 0x10], 0xc3
mov byte [rbp - 0xe], 1
nop
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 9
jb 0x14004abb0
mov byte [rbp - 0xe], bl
mov rcx, rbx
mov dword [rbp - 0x40], 0xcfd9bdbe
mov word [rbp - 0x3c], 0xd7
mov byte [rbp - 0x3a], 1
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 5
jb 0x14004abe0
lea rax, [rbp - 0x18]
mov byte [rbp - 0x3a], bl
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
lea rax, [rbp - 0x20]
mov dword [rbp - 0x20], 0x43960000
lea r8, [0x140060068]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x28], 0x42480000
call fcn.140035380
mov rcx, rbx
mov dword [rbp - 0x18], 0xcff0f3ce
mov dword [rbp - 0x14], 0x8499cad5
mov dword [rbp - 0x10], 0xce968880
mov word [rbp - 0xc], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0xc
jb 0x14004ac50
mov byte [rbp - 0xb], bl
mov rcx, rbx
mov dword [rbp - 0x40], 0xcdccbdbe
mov dword [rbp - 0x3c], 0xccd7cdce
mov dword [rbp - 0x38], 0xdbd4c3cb
mov word [rbp - 0x34], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x14004ac90
lea rax, [rbp - 0x18]
mov byte [rbp - 0x33], bl
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp - 0x28]
mov dword [rbp - 0x28], 0x41c80000
lea r8, [0x140060064]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x20], 0x3f800000
call fcn.140035380
mov rcx, rbx
mov dword [rbp - 0x18], 0xd4ecf7d9
mov dword [rbp - 0x14], 0xc1c0ccc0
mov dword [rbp - 0x10], 0x8682869f
mov dword [rbp - 0xc], 0x100cc98
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0xe
jb 0x14004ad00
movdqa xmm0, xmmword [0x140057450]
mov rcx, rbx
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 9], bl
mov word [rbp - 0x30], 0xc8
mov byte [rbp - 0x2e], 1
nop dword [rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x14004ad30
lea rax, [rbp - 0x18]
mov byte [rbp - 0x2e], bl
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp - 0x28]
mov dword [rbp - 0x28], 0x41c80000
lea r8, [0x140060060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x20], 0x3f800000
call fcn.140035380
lea rcx, [0x14005083c]
call fcn.140030620
movss xmm1, dword [0x140057224]
xorps xmm0, xmm0
call fcn.140012ac0
mov rcx, rbx
mov dword [rbp - 0x40], 0x80ebf7d5
mov dword [rbp - 0x3c], 0x9edbcde3
mov word [rbp - 0x38], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 8
jb 0x14004adb0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x37], bl
call fcn.140030620
lea rcx, [0x14005083c]
call fcn.140030620
movss xmm1, dword [0x140057224]
xorps xmm0, xmm0
call fcn.140012ac0
mov rcx, rbx
mov dword [rbp - 0x18], 0xc9d7bdbe
mov dword [rbp - 0x14], 0xcbe182d5
mov word [rbp - 0x10], 0xdd
mov byte [rbp - 0xe], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 9
jb 0x14004ae10
lea rcx, [rbp - 0x18]
mov byte [rbp - 0xe], bl
call fcn.140034100
lea rcx, [0x140056c60]
call fcn.140030620
lea rdx, [0x1400875e5]
lea rcx, str.Enable_Visuals
call fcn.140031fc0
cmp byte [0x1400875e5], bl
je 0x14004b014
mov dword [rbp - 0x28], 0xe7f1df
mov rcx, rbx
mov byte [rbp - 0x24], 1
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 3
jb 0x14004ae70
lea rdx, [0x1400875e7]
mov byte [rbp - 0x24], bl
lea rcx, [rbp - 0x28]
call fcn.140031fc0
cmp byte [0x1400875e7], bl
je 0x14004aea8
mov byte [0x1400875e7], 1
mov byte [0x1400875b7], bl
mov dword [rbp - 0x40], 0xccf3f7db
mov rcx, rbx
mov dword [rbp - 0x3c], 0xdccce081
mov word [rbp - 0x38], 0x100
nop
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 8
jb 0x14004aec0
lea rdx, [0x1400875b7]
mov byte [rbp - 0x37], bl
lea rcx, [rbp - 0x40]
call fcn.140031fc0
cmp byte [0x1400875b7], bl
je 0x14004aef8
mov byte [0x1400875e7], bl
mov byte [0x1400875b7], 1
mov dword [rbp - 0x28], 0xc5f1f7d1
mov rcx, rbx
mov word [rbp - 0x24], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 4
jb 0x14004af10
lea rdx, [0x1400875e4]
mov byte [rbp - 0x23], bl
lea rcx, [rbp - 0x28]
call fcn.140031fc0
mov rcx, rbx
mov dword [rbp - 0x40], 0xd4ecf7d9
mov dword [rbp - 0x3c], 0xc1c0ccc0
mov word [rbp - 0x38], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 8
jb 0x14004af50
lea rdx, [0x1400875b5]
mov byte [rbp - 0x37], bl
lea rcx, [rbp - 0x40]
call fcn.140031fc0
mov dword [rbp - 0x40], 0xccfaf5ce
mov dword [rbp - 0x3c], 0xcaccd6c4
mov word [rbp - 0x38], 0x100
nop word [rax + rax]
lea eax, [rbx - 0x63]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 8
jb 0x14004af90
lea rdx, [0x1400875b6]
mov byte [rbp - 0x37], 0
lea rcx, [rbp - 0x40]
call fcn.140031fc0
lea rdx, [0x1400875b4]
lea rcx, str.Platform
call fcn.140031fc0
lea rdx, [0x1400875e6]
lea rcx, str.NickName
call fcn.140031fc0
lea rax, str._.3f
mov dword [rbp - 0x28], 0x451c4000
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp - 0x28]
mov dword [rbp - 0x20], 0x42480000
lea r8, [0x14006006c]
mov qword [rsp + 0x20], rax
lea rcx, str.Distance
call fcn.140035380
movss xmm0, dword [0x1400875d8]
lea rdx, [rbp - 0x18]
movss xmm1, dword [0x1400875dc]
lea rcx, str.Visible_Color
xor r9d, r9d
movss dword [rbp - 0x18], xmm0
movss xmm0, dword [0x1400875e0]
movss dword [rbp - 0x14], xmm1
movss dword [rbp - 0x10], xmm0
lea r8d, [r9 + 0x22]
mov dword [rbp - 0xc], 0x3f800000
call fcn.14003cc30
test al, al
je 0x14004b084
movss xmm0, dword [rbp - 0x18]
movss xmm1, dword [rbp - 0x14]
movss dword [0x1400875d8], xmm0
movss xmm0, dword [rbp - 0x10]
movss dword [0x1400875e0], xmm0
movss dword [0x1400875dc], xmm1
movss xmm0, dword [0x140087640]
lea rdx, [rbp - 0x18]
movss xmm1, dword [0x140087644]
lea rcx, str.Not_Visible_Color
xor r9d, r9d
movss dword [rbp - 0x18], xmm0
movss xmm0, dword [0x140087648]
movss dword [rbp - 0x14], xmm1
movss dword [rbp - 0x10], xmm0
lea r8d, [r9 + 0x22]
mov dword [rbp - 0xc], 0x3f800000
call fcn.14003cc30
test al, al
je 0x14004b0f4
movss xmm2, dword [rbp - 0x18]
movss xmm3, dword [rbp - 0x14]
movss dword [0x140087640], xmm2
movss xmm2, dword [rbp - 0x10]
movss dword [0x140087648], xmm2
movss dword [0x140087644], xmm3
lea rcx, str.Misc
call fcn.140030620
lea rcx, [0x14005083c]
call fcn.140030620
lea rcx, [0x14005083c]
call fcn.140030620
movss xmm1, dword [0x140057224]
xorps xmm0, xmm0
call fcn.140012ac0
lea rcx, str.EXIT
mov qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
call fcn.140031010
test al, al
je 0x14004b167
lea rcx, str.taskkill__F__IM_notepad.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__F__IM_mspaint.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000f2b0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004e190
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rbp
ret