Function at 0x140002e80
Capabilities:
Enumerate process modules
Enumerate processes
Log keystrokes via polling
Set console window title

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x140016020]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
lea rcx, str.CS2_Glow_Made_by:_github_9xN
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x140002f75
xor edx, edx
lea rcx, [rbp + 0x394]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x390]
mov dword [rbp + 0x390], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002f6c
nop
lea rax, [rbp + 0x5d0]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.cs2.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x3bc]
lea r8, [rbp + 0x5d0]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002f54
add rax, 2
test ecx, ecx
jne 0x140002f40
mov rcx, rbx
test edx, edx
je 0x140002fa0
lea rdx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002f00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.e_0m
lea r8, str.cs2.exe
lea rdx, str.e_31m
lea rcx, str._s_s_not_found__s_n
call fcn.140001020
mov eax, 1
jmp 0x14000302c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp + 0x398]
test edi, edi
je 0x140002f75
mov qword [rsp + 0xb30], rsi
lea r12, str.e_0m
lea rsi, str.e_32m
mov qword [rsp + 0x28], r12
mov rdx, rsi
mov dword [rsp + 0x20], edi
lea r9, str.e_33m
lea r8, str.cs2.exe
lea rcx, str._s_s_has_pid:__s_lu_s_n
call fcn.140001020
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, str.cs2.exe
mov rbx, rax
test rax, rax
jne 0x14000304a
mov r9, r12
lea rdx, str.e_31m
lea rcx, str._sFailed_to_open__s_process__s_n
call fcn.140001020
lea eax, [rbx + 1]
mov rsi, qword [rsp + 0xb30]
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.14000e6e0
add rsp, 0xb00
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 0xb38], r13
lea r9, str.e_33m
mov qword [rsp + 0x28], r12
lea rcx, str._s_s_process_handle:__s0x_p_s_n
mov rdx, rsi
mov qword [rsp + 0xb40], r15
mov qword [rsp + 0x20], rbx
call fcn.140001020
xor r13d, r13d
lea r8, str.client.dll
mov dword [rsp + 0x28], r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r13
lea r9d, [r13 - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], eax
lea r9d, [r13 - 1]
lea rax, [rbp + 0x7e0]
xor edx, edx
lea r8, str.client.dll
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, edi
lea ecx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003153
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000314a
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x60]
lea r8, [rbp + 0x7e0]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003134
add rax, 2
test ecx, ecx
jne 0x140003120
mov rcx, rdi
test edx, edx
je 0x14000319c
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003110
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.cs2.exe
mov qword [rsp + 0x20], r12
lea r8, str.client.dll
lea rdx, str.e_31m
lea rcx, str._s_s_not_found_in__s__s_n
call fcn.140001020
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0xb40]
mov eax, 1
mov r13, qword [rsp + 0xb38]
jmp 0x140003024
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x140003153
mov qword [rsp + 0x28], r12
lea r9, str.e_33m
lea r8, str.client.dll
mov dword [rsp + 0x20], r15d
mov rdx, rsi
lea rcx, str._s_s_base_address:__s0x_lx_s_n
call fcn.140001020
mov r8, r12
lea rcx, str._sFetching_offsets..._s_n
mov rdx, rsi
call fcn.140001020
call fcn.1400026c0
mov r8, r12
lea rdx, str.e_34m
lea rcx, str._sCS2_Glow_Made_by:_github_9xN___Press_F1_to_enable_disable_s_n
call fcn.140001020
mov ecx, 0x70
lea rdi, str.true
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000326a
cmp byte [0x140016c48], r13b
lea rcx, [rbp + 0x378]
mov qword [rbp + 0x378], 0x96
sete byte [0x140016c48]
call fcn.140004720
movzx eax, byte [0x140016c48]
lea r8, str.false
test al, al
lea rdx, str.e_31m
mov r9, r12
lea rcx, str.status_enabled:__s_s_s_n
cmovne r8, rdi
cmovne rdx, rsi
call fcn.140001020
mov edi, 1
nop
mov rdx, qword [0x140016c28]
lea r8, [rbp + 0x380]
add rdx, r15
mov qword [rbp + 0x380], r13
mov r9d, 8
mov qword [rsp + 0x20], r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r14, qword [rbp + 0x380]
test r14, r14
je 0x14000341d
mov edx, edi
mov qword [rbp + 0x370], r13
and edx, 0x7fff
mov qword [rsp + 0x20], r13
shl edx, 3
lea r8, [rbp + 0x370]
sar edx, 9
mov r9d, 8
add rdx, 0x10
mov rcx, rbx
add rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x370]
test rcx, rcx
je 0x14000341d
mov eax, edi
mov qword [rbp + 0x378], r13
and eax, 0x1ff
mov qword [rsp + 0x20], r13
imul edx, eax, 0x78
lea r8, [rbp + 0x378]
mov r9d, 8
add rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x14000341d
mov rdx, qword [0x140016c30]
lea r8, [rbp + 0x370]
add rdx, rcx
mov dword [rbp + 0x370], r13d
mov rcx, rbx
mov qword [rsp + 0x20], r13
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [rbp + 0x370]
lea r8, [rbp + 0x378]
mov edx, esi
mov qword [rbp + 0x378], r13
shr edx, 9
mov r9d, 8
and edx, 0x3f
mov qword [rsp + 0x20], r13
shl edx, 3
mov rcx, rbx
add rdx, 0x10
add rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x378]
test rcx, rcx
je 0x14000341d
and esi, 0x1ff
mov qword [rbp + 0x380], r13
imul edx, esi, 0x78
lea r8, [rbp + 0x380]
mov r9d, 8
mov qword [rsp + 0x20], r13
add rdx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x380]
test rcx, rcx
je 0x14000341d
mov rdx, qword [0x140016c20]
lea r8, [rbp + 0x370]
add rdx, rcx
mov qword [rsp + 0x20], r13
cmp byte [0x140016c48], r13b
mov r9d, 4
mov rcx, rbx
mov dword [rbp + 0x370], r13d
je 0x140003417
mov dword [rbp + 0x370], 0x47c35000
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc edi
cmp edi, 0x40
jl 0x140003270
lea rcx, [rbp + 0x378]
mov qword [rbp + 0x378], 0x32
call fcn.140004720
lea rsi, str.e_32m
jmp 0x140003200