Function at 0x140038a90
Capabilities:
Create process on windows
Execute command
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rsi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x14004a010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [r11 + 8], rbx
mov ecx, 0x22
mov qword [r11 + 0x10], rdi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140038ae2
call fcn.14003a3f0
cmp byte [rax + 0xd8], 0
sete bl
call fcn.14003a3f0
mov byte [rax + 0xd8], bl
cmp qword [0x14004a900], 0
jne 0x140038afb
cmp qword [0x14004a910], 0
je 0x140038afb
call fcn.14002b650
mov rcx, qword [0x14004a940]
lea rdx, [rbp - 1]
mov rdi, qword [0x14004a810]
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 7]
lea rcx, [rbp + 0xf]
sub eax, dword [rbp - 1]
xor esi, esi
mov qword [rbp + 0xf], rsi
movd xmm1, eax
mov eax, dword [rbp + 0xb]
sub eax, dword [rbp + 3]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0xf]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x14004a948]
cvtsi2ss xmm0, qword [0x14004a950]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x14004a948], rcx
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea ecx, [rsi + 0x10]
and al, 1
mov byte [rdi + 0xe24], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea ecx, [rsi + 0x12]
and al, 1
mov byte [rdi + 0xe25], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x14004a810]
shr eax, 0xf
and al, 1
mov byte [rdi + 0xe27], sil
mov byte [rdi + 0xe26], al
cmp byte [rbx + 0xdb], sil
je 0x140038c0b
cvttss2si eax, dword [rbx + 0xe08]
mov rcx, qword [0x14004a940]
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x17], eax
cvttss2si eax, dword [rbx + 0xe0c]
mov dword [rbp + 0x1b], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140038c0b
mov edx, dword [rbp + 0x1b]
mov ecx, dword [rbp + 0x17]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0xe08], 0xff7fffff
mov dword [rbx + 0xe0c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14004a940]
jne 0x140038c71
lea rcx, [rbp - 0x11]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140038c71
mov rcx, qword [0x14004a940]
lea rdx, [rbp - 0x11]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140038c71
movd xmm0, dword [rbp - 0x11]
movd xmm1, dword [rbp - 0xd]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0xe08], xmm0
movss dword [rbx + 0xe0c], xmm1
cmp byte [rdi + 0x78], sil
mov rdi, qword [rsp + 0xe8]
je 0x140038c86
mov eax, 0xffffffff
jmp 0x140038c93
mov rax, qword [0x14004a810]
mov eax, dword [rax + 0x4a50]
cmp dword [0x14004a11c], eax
je 0x140038ca6
mov dword [0x14004a11c], eax
call fcn.14002b8e0
call fcn.14002ba50
call fcn.140006de0
call fcn.14003a3f0
movzx ecx, byte [rax + 0xd8]
mov rax, qword [0x14004a810]
mov byte [rax + 0x78], cl
call fcn.14003a3f0
cmp byte [rax + 0xd8], sil
je 0x14003950b
mov rax, qword [0x14004a810]
mov ecx, 1
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
mov dword [rax + 0xe10], esi
mov byte [rax + 0xe14], sil
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x14004a810]
test ax, ax
je 0x140038d23
mov byte [rcx + 0xe10], 1
or dword [rcx + 0x47a8], 2
mov dword [rcx + 0x47c8], 0x43960000
mov dword [rcx + 0x47cc], 0x43960000
mov dword [rcx + 0x47b0], 2
mov rcx, qword [0x14004a880]
call fcn.14000ebe0
xor edx, edx
lea rcx, str.Valorant_06.08.00.872043____Nanami1578
mov r8d, 0x80e2
call fcn.14000c200
mov rcx, qword [0x14004a810]
lea r8, str.Background
xor edx, edx
mov rax, qword [rcx + 0x3ed0]
movss xmm6, dword [rax + 0x20]
movss xmm7, dword [rax + 0x24]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ed0]
mov rcx, qword [rcx + 0x48a8]
mov rbx, qword [rax + 0x298]
mov rcx, qword [rcx]
call fcn.140006420
mov rax, qword [0x14004a810]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax + 0x48a8]
mov rcx, qword [rcx]
call fcn.140006420
movaps xmm0, xmm6
lea rcx, [rbp - 1]
addss xmm6, dword [0x14004382c]
xorps xmm8, xmm8
addss xmm0, xmm8
movss dword [rbp + 0xf], xmm6
movss dword [rbp + 0x17], xmm0
movaps xmm0, xmm7
addss xmm7, dword [0x14004382c]
addss xmm0, xmm8
movss dword [rbp + 0x13], xmm7
movss dword [rbp + 0x1b], xmm0
movaps xmm0, xmmword [0x140043aa0]
movaps xmm1, xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp - 0x11], xmm0
movaps xmm0, xmmword [0x140043b30]
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm1
call fcn.140002cb0
lea rcx, [rbp - 0x11]
mov r11d, eax
call fcn.140002cb0
lea rcx, [rbp - 0x35]
mov r10d, eax
call fcn.140002cb0
lea rcx, [rbp - 0x25]
mov r8d, eax
call fcn.140002cb0
mov dword [rsp + 0x30], r11d
lea rdx, [rbp + 0x17]
mov dword [rsp + 0x28], r10d
mov r9d, eax
mov dword [rsp + 0x20], r8d
mov rcx, rbx
lea r8, [rbp + 0xf]
call fcn.140025860
mov rax, qword [0x14004a810]
movaps xmm7, xmmword [rsp + 0xb0]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x140038eaf
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
mov rax, qword [0x14004a810]
movss xmm1, dword [rax + 0xe0]
lea rcx, str.Ext__.3f_MS_FPS___.1f_FPS__Show_hide_PageDown
movss xmm0, dword [0x1400437e4]
divss xmm0, xmm1
cvtps2pd xmm2, xmm1
cvtps2pd xmm1, xmm0
movq r8, xmm2
movq rdx, xmm1
call fcn.14002dd40
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x140038f08
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14003a3f0
lea rdx, [rbp + 0xf]
mov dword [rbp + 0xf], 0x42a00000
lea rcx, [0x140043378]
mov dword [rbp + 0x13], 0x41c80000
mov rbx, rax
call fcn.14002eb20
test al, al
je 0x140038f3c
mov dword [rbx + 0x168], 2
movss xmm6, dword [0x140043848]
xorps xmm0, xmm0
movaps xmm1, xmm6
call fcn.140011b80
call fcn.14003a3f0
lea rdx, [rbp + 0xf]
mov dword [rbp + 0xf], 0x42a00000
lea rcx, [0x14004337c]
mov dword [rbp + 0x13], 0x41c80000
mov rbx, rax
call fcn.14002eb20
test al, al
je 0x140038f83
mov dword [rbx + 0x168], 3
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140011b80
call fcn.14003a3f0
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xc0]
cmp dword [rax + 0x168], 1
jne 0x140039068
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x140038fda
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xf]
mov qword [rsp + 0x30], rsi
lea r8, str.user
mov dword [rsp + 0x28], esi
lea rcx, str.username
mov r9d, 0xc
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp + 0xf], rsi
call fcn.1400342a0
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xf]
mov qword [rsp + 0x30], rsi
lea r8, str.license
mov dword [rsp + 0x28], 0x8000
lea rdx, str._license_
mov r9d, 0x19
mov qword [rsp + 0x20], rax
lea rcx, [0x1400433a0]
mov qword [rbp + 0xf], rsi
call fcn.1400342a0
lea rdx, [rbp + 0xf]
mov qword [rbp + 0xf], rsi
lea rcx, str.Login
call fcn.14002eb20
jmp 0x14003946f
call fcn.14003a3f0
cmp dword [rax + 0x168], 2
jne 0x1400391d3
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x1400390a3
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14000ed20
call fcn.14003a3f0
lea rcx, str.Aim_b0t
lea rdx, [rax + 0xe5]
call fcn.14002f9a0
call fcn.14003a3f0
cmp byte [rax + 0xe5], sil
je 0x14003914c
mov dword [rbp - 0x11], 0x5d
mov dword [rbp + 0x17], 0x32
call fcn.14003a3f0
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x17]
lea rcx, str.Accurancy
lea r8, [rax + 0x178]
call fcn.140031610
call fcn.14003a3f0
lea rcx, str.Recoil
lea rdx, [rax + 0xe7]
call fcn.14002f9a0
mov dword [rbp + 0x17], 0x5dc
mov dword [rbp - 0x11], 0x32
call fcn.14003a3f0
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x11]
lea rcx, [0x14004340c]
lea r8, [rax + 0x18c]
call fcn.140031610
lea rcx, str._3_Nanami_TM_on_YT__3
call fcn.14002df30
lea rcx, str...........................................................
call fcn.14002df30
mov rdx, qword [0x14004a810]
mov eax, dword [rdx + 0x4750]
movsxd rcx, dword [rdx + 0x4858]
dec word [rdx + 0x5b78]
shr eax, 2
test al, 1
lea eax, [rcx - 1]
mov dword [rdx + 0x4858], eax
mov rax, qword [rdx + 0x4860]
mov r8d, dword [rax + rcx*4 - 8]
mov dword [rdx + 0x4750], r8d
je 0x1400391b4
test r8b, 4
jne 0x1400391b4
mov eax, dword [rdx + 0x5b74]
mov dword [rdx + 0x37d0], eax
mov rax, qword [rdx + 0x3ed0]
cmp byte [rax + 0xbb], sil
jne 0x140039498
mov eax, dword [rax + 0x1b4]
jmp 0x14003948c
call fcn.14003a3f0
cmp dword [rax + 0x168], 0xd
jne 0x14003934f
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x14003920e
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14003a3f0
lea rcx, str.Drop
lea rdx, [rax + 0xf7]
call fcn.14002f9a0
call fcn.14003a3f0
lea rcx, str.20__Damage
lea rdx, [rax + 0xf8]
call fcn.14002f9a0
call fcn.14003a3f0
lea rcx, str.Drop_Dupe
lea rdx, [rax + 0xf7]
call fcn.14002f9a0
call fcn.14003a3f0
lea rcx, [0x14004348c]
lea rdx, [rax + 0xf6]
call fcn.14002f9a0
mov dword [rbp + 0x17], 0x5dc
mov dword [rbp - 0x11], 0x64
call fcn.14003a3f0
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x11]
lea rcx, str.Atk_Range
lea r8, [rax + 0x194]
call fcn.140031610
mov dword [rbp + 0x17], 0x3e8
mov dword [rbp - 0x11], 0x64
call fcn.14003a3f0
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x11]
lea rcx, str.Speedhack
lea r8, [rax + 0x188]
call fcn.140031610
lea rdx, [rbp + 0xf]
mov qword [rbp + 0xf], rsi
lea rcx, str.Check_Status_license
call fcn.14002eb20
test al, al
je 0x14003931a
mov r9d, 0x1000
lea r8, [0x1400434c8]
lea rdx, str.License_no_register__n_Contact_Nanami1578
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 1
lea rcx, str.ActivePanel.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14003a3f0
lea rcx, str.Close_game_Safe
lea rdx, [rax + 0x109]
call fcn.14002f9a0
lea rcx, str._3_Nanami_TM_on_YT__3
call fcn.14002df30
lea rcx, str...........................................................
call fcn.14002df30
jmp 0x14003946f
call fcn.14003a3f0
cmp dword [rax + 0x168], 0xe
jne 0x140039501
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x14003938a
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14003a3f0
lea rcx, str.Enabled_Visual
lea rdx, [rax + 0xd9]
call fcn.14002f9a0
call fcn.14003a3f0
cmp byte [rax + 0xd9], sil
je 0x14003946f
call fcn.14003a3f0
lea rcx, str.ESP_Box
lea rdx, [rax + 0xda]
call fcn.14002f9a0
call fcn.14003a3f0
cmp byte [rax + 0xda], sil
je 0x140039405
call fcn.14003a3f0
mov rbx, rax
call fcn.14003a3f0
mov r9, rbx
mov dword [rsp + 0x20], 2
lea rcx, str.ESP_Box_Type
lea rdx, [rax + 0x160]
call fcn.1400312b0
call fcn.14003a3f0
lea rcx, str.ESP_Skeleton
lea rdx, [rax + 0xdb]
call fcn.14002f9a0
call fcn.14003a3f0
lea rcx, str.Change_Skin
lea rdx, [rax + 0xdc]
call fcn.14002f9a0
call fcn.14003a3f0
cmp byte [rax + 0xdc], sil
je 0x14003946f
call fcn.14003a3f0
lea rbx, [rax + 0x10]
call fcn.14003a3f0
mov r9, rbx
mov dword [rsp + 0x20], 3
lea rcx, str.Select_Skin__only_visual_
lea rdx, [rax + 0x164]
call fcn.1400312b0
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x140039498
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14003a3f0
lea rcx, str.Close
lea rdx, [rax + 0x109]
call fcn.14002f9a0
call fcn.14003a3f0
cmp byte [rax + 0x109], sil
je 0x1400394d8
lea rcx, str.taskkill__IM_login.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__IM_4v6fg.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x3ed0]
cmp byte [rcx + 0xbb], sil
jne 0x140039501
mov eax, dword [rcx + 0x1b4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.1400301f0
call fcn.14000ec80
call fcn.14000e6d0
call fcn.140008af0
mov rcx, qword [0x14004a088]
mov edx, 7
mov rax, qword [rcx]
lea r8d, [rdx - 6]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004a088]
mov edx, 0x1b
mov rax, qword [rcx]
lea r8d, [rdx - 0x1a]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004a088]
mov edx, 0xae
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14004a088]
mov r9d, 1
movss xmm0, dword [0x140043798]
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [rax + 0x158]
mov rcx, qword [0x14004a088]
mov rax, qword [rcx]
call qword [rax + 0x148]
mov rbx, qword [rsp + 0xe0]
test eax, eax
js 0x1400395e0
call fcn.140008ee0
mov rax, qword [0x14004a810]
mov rcx, qword [rax + 0x48a8]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], sil
cmove rcx, rsi
call fcn.14002b080
mov rcx, qword [0x14004a088]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14004a088]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x1400396a8
mov rcx, qword [0x14004a088]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x1400396a8
cmp qword [0x14004a910], rsi
je 0x140039683
mov rcx, qword [0x14004a918]
test rcx, rcx
je 0x140039642
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004a918], rsi
mov rcx, qword [0x14004a908]
test rcx, rcx
je 0x14003965b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004a908], rsi
mov rcx, qword [0x14004a900]
test rcx, rcx
je 0x140039683
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x14004a810]
mov qword [0x14004a900], rsi
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], rsi
mov rcx, qword [0x14004a088]
lea rdx, [0x14004a090]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp qword [0x14004a910], rsi
je 0x1400396a8
call fcn.14002b650
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14003aa10
mov rsi, qword [rsp + 0xf0]
add rsp, 0xd0
pop rbp
ret