Function at 0x401240
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x208
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
push 0x124
lea eax, [esp + 0xe8]
mov dword [esp + 0xbc], 0
push 0
push eax
mov dword [esp + 0xc8], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xe0], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [esp + 0xe0]
mov dword [esp + 0xa8], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x40137e
lea esi, [esp + 0x104]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4012c8
sub ecx, edx
mov edi, 8
cmp ecx, edi
mov dword [esp + 0x1c], ecx
mov edx, str.csgo.exe
cmovb edi, ecx
sub edi, 4
jb 0x401301
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x401306
add edx, 4
add esi, 4
sub edi, 4
jae 0x4012f0
cmp edi, 0xfffffffc
je 0x40133a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x401333
cmp edi, 0xfffffffd
je 0x40133a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x401333
cmp edi, 0xfffffffe
je 0x40133a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x401333
cmp edi, 0xffffffff
je 0x40133a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x40133a
sbb eax, eax
or eax, 1
jmp 0x40133c
xor eax, eax
test eax, eax
jne 0x401347
cmp ecx, 8
ja 0x401347
jae 0x40135b
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0xac]
jmp 0x4012ae
mov eax, dword [esp + 0xe8]
push eax
push 0
push 0x1fffff
mov dword [esp + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x401390
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
lea ecx, [esp + 0xc0]
mov eax, esp
mov dword [eax], str.client.dll
mov dword [eax + 4], 0xa
call section..text
sub esp, 8
mov esi, eax
mov ecx, esp
mov dword [ecx], str.engine.dll
mov dword [ecx + 4], 0xa
lea ecx, [esp + 0xc0]
call section..text
add eax, 0x58cfc4
lea ecx, [esi + 0xdb25dc]
mov dword [esp + 0x78], eax
lea eax, [esi + 0x4dcde8c]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7c], eax
nop dword [eax + eax]
lea ecx, [esp + 0x38]
call fcn.00401140
mov edi, dword [esp + 0x38]
mov ecx, edi
mov esi, dword [esp + 0x3c]
mov eax, esi
cmp ecx, 0xfff0bdbf
jne 0x401414
cmp eax, 0x7fffffff
je 0x40143a
cmp eax, 0x7fffffff
jg 0x401429
jl 0x401425
cmp ecx, 0xfff0bdbf
jae 0x401429
or al, 0xff
jmp 0x40142b
mov al, 1
test al, al
jns 0x40143a
add edi, 0xf4240
adc esi, 0
jmp 0x401442
or edi, 0xffffffff
mov esi, 0x7fffffff
mov dword [esp + 0xa8], esi
mov dword [esp + 8], edi
nop dword [eax]
lea ecx, [esp + 0x90]
call fcn.00401140
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
cmp edi, edx
jne 0x401476
cmp esi, ecx
je 0x401551
cmp esi, ecx
jg 0x401484
jl 0x401480
cmp edi, edx
jae 0x401484
or al, 0xff
jmp 0x401486
mov al, 1
test al, al
jle 0x401551
sub edi, edx
sbb esi, ecx
cmp edi, 0x914f0000
jne 0x4014a6
cmp esi, 0x4e94
je 0x401537
cmp esi, 0x4e94
jg 0x4014bc
jl 0x4014b8
cmp edi, 0x914f0000
jae 0x4014bc
or al, 0xff
jmp 0x4014be
mov al, 1
test al, al
jns 0x401537
push 0
push 0xf4240
push esi
push edi
call fcn.004029c0
push 0
push 0xf4240
mov ecx, edx
mov dword [esp + 0x18], eax
push ecx
push eax
call fcn.00402b50
cmp eax, edi
jne 0x4014ec
cmp edx, esi
je 0x40151d
cmp edx, esi
jg 0x4014fa
jl 0x4014f6
cmp eax, edi
jae 0x4014fa
or al, 0xff
jmp 0x4014fc
mov al, 1
test al, al
jns 0x40151d
mov eax, dword [esp + 0x10]
add eax, 1
push eax
call sub.KERNEL32.dll_Sleep
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 8]
jmp 0x401450
mov eax, dword [esp + 0x10]
push eax
call sub.KERNEL32.dll_Sleep
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 8]
jmp 0x401450
push 0x5265c00
call sub.KERNEL32.dll_Sleep
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 8]
jmp 0x401450
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4013f0
mov esi, dword [esp + 0xbc]
lea eax, [esp + 0xa8]
push 0
push 4
push eax
push dword [esp + 0x80]
mov dword [esp + 0xb8], 0
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [esp + 0xa8]
lea eax, [esp + 0xd8]
push 0
push 4
push eax
lea eax, [edi + 0xf4]
mov dword [esp + 0xe4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0
push eax
lea eax, [edi + 0x138]
mov dword [esp + 0x5c], 0
push eax
push esi
mov dword [esp + 0x68], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
lea eax, [edi + 0x108]
mov dword [esp + 0x50], 0
push eax
push esi
mov dword [esp + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [esp + 0x40]
lea eax, [esp + 0xdc]
addss xmm0, dword [esp + 0x4c]
push 0
push 4
push eax
push dword [esp + 0x84]
movss dword [esp + 0x74], xmm0
movss xmm0, dword [esp + 0x54]
addss xmm0, dword [esp + 0x60]
push esi
mov dword [esp + 0xf0], 0
movss dword [esp + 0x84], xmm0
movss xmm0, dword [esp + 0x5c]
addss xmm0, dword [esp + 0x68]
movss dword [esp + 0x80], xmm0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [esp + 0xdc]
lea eax, [esp + 0xb0]
push 0
push 4
push eax
lea eax, [esi + 0x180]
mov dword [esp + 0xbc], 0
push eax
push dword [esp + 0xcc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esi + 0x4d90]
mov dword [esp + 0xd4], 0
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0xd4]
push ecx
push eax
push dword [esp + 0xcc]
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0x44], eax
call esi
push 0
push 0xc
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push eax
lea eax, [edi + 0x303c]
mov dword [esp + 0x68], 0
mov edi, dword [esp + 0xc8]
push eax
push edi
mov dword [esp + 0x74], 0
call esi
movss xmm1, dword [0x40315c]
mov eax, 1
movss xmm0, dword [esp + 0x58]
mov ecx, dword [esp + 0xb0]
mulss xmm0, xmm1
rol eax, cl
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x7c]
movss dword [esp + 0x68], xmm0
movss xmm0, dword [esp + 0x5c]
mulss xmm0, xmm1
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x20
movss dword [esp + 0x88], xmm0
movss xmm0, dword [esp + 0x60]
mulss xmm0, xmm1
movss dword [esp + 0x84], xmm0
movss xmm0, dword [0x403164]
movss dword [esp + 0x24], xmm0
xorps xmm0, xmm0
movss dword [esp + 0x10], xmm0
movss dword [esp + 8], xmm0
movss dword [esp + 0xc], xmm0
nop word [eax + eax]
push 0
push 4
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], 0
push ecx
push eax
push edi
call esi
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0xac]
push 0
push 4
mov dword [esp + 0xb0], eax
add eax, 0xf4
push ecx
push eax
push edi
mov dword [esp + 0xc0], 0
call esi
mov eax, dword [esp + 0xd8]
cmp dword [esp + 0xac], eax
je 0x401b25
push 0
push 1
lea eax, [esp + 0xbf]
mov byte [esp + 0xbf], 0
push eax
mov eax, dword [esp + 0xb4]
add eax, 0xed
push eax
push edi
call esi
cmp byte [esp + 0xb7], 0
jne 0x401b25
push 0
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 0
push eax
mov eax, dword [esp + 0xb4]
add eax, 0x25f
push eax
push edi
call esi
cmp dword [esp + 0xac], 0
jne 0x401b25
push 0
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 0
push eax
mov eax, dword [esp + 0xb4]
add eax, 0x980
push eax
push edi
call esi
mov eax, dword [esp + 0x80]
test dword [esp + 0xac], eax
je 0x401b25
push 0
push 4
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 0
push eax
mov eax, dword [esp + 0xb4]
add eax, 0x26a8
push eax
push edi
call esi
mov esi, dword [esp + 0xac]
lea eax, [esp + 0xb0]
push 0
push 4
push eax
lea eax, [esi + 0x18c]
mov dword [esp + 0xbc], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0xb0], 0
push eax
lea eax, [esi + 0x19c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0xc8]
mov dword [esp + 0xc8], 0
push eax
lea eax, [esi + 0x1ac]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
push edi
call esi
movss xmm0, dword [esp + 0xd4]
sub esp, 8
addss xmm0, dword [esp + 0x8c]
movss dword [esp + 0x94], xmm0
movss xmm0, dword [esp + 0xb8]
subss xmm0, dword [esp + 0x6c]
movss dword [esp + 0xb8], xmm0
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [esp + 0xb0]
subss xmm0, dword [esp + 0x78]
movss dword [esp + 0xb4], xmm0
fld dword [esp + 0xb4]
movss dword [esp + 0xb0], xmm0
movss xmm0, dword [esp + 0xc8]
subss xmm0, dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0xb8]
fstp dword [esp]
xorps xmm0, xmmword [0x403170]
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x20], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
fstp dword [esp + 0xc8]
movss xmm0, dword [esp + 0xc8]
add esp, 8
fld qword [esp + 0x18]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0xc0], xmm0
fld qword [esp + 0xc0]
call sub.api_ms_win_crt_math_l1_1_0.dll__CIatan2
movss xmm0, dword [esp + 0xcc]
addss xmm0, dword [esp + 0x68]
fstp qword [esp + 0x18]
movsd xmm1, qword [esp + 0x18]
cvtpd2ps xmm1, xmm1
mulss xmm1, dword [0x403168]
subss xmm1, xmm0
movss xmm0, dword [esp + 0xa8]
cvtps2pd xmm0, xmm0
movss dword [esp + 0xac], xmm1
movss dword [esp + 0xc0], xmm1
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [esp + 0x14]
fld qword [esp + 0x18]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll__CIatan2
movss xmm0, dword [esp + 0xd0]
sub esp, 8
addss xmm0, dword [esp + 0x90]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
cvtpd2ps xmm1, xmm1
mulss xmm1, dword [0x403168]
subss xmm1, xmm0
movss dword [esp + 0x1c], xmm1
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld dword [esp + 0xc8]
fstp dword [esp]
movss dword [esp + 0xb8], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
movss xmm1, dword [esp + 0x2c]
add esp, 8
fstp dword [esp + 0x14]
movss xmm0, dword [esp + 0x14]
xorps xmm3, xmm3
comiss xmm1, xmm0
jbe 0x401b28
movss xmm1, dword [esp + 0xac]
movss xmm2, dword [esp + 0xb0]
movss dword [esp + 0x24], xmm0
xorps xmm0, xmm0
subss xmm0, dword [esp + 0x8c]
movss dword [esp + 0x10], xmm1
movss dword [esp + 8], xmm2
movss dword [esp + 0xc], xmm0
jmp 0x401b3a
xorps xmm3, xmm3
movss xmm0, dword [esp + 0xc]
movss xmm1, dword [esp + 0x10]
movss xmm2, dword [esp + 8]
mov eax, dword [esp + 0x28]
add eax, 0x10
sub dword [esp + 0x2c], 1
mov dword [esp + 0x28], eax
jne 0x4017b0
ucomiss xmm1, xmm3
lahf
test ah, 0x44
jp 0x401b6f
ucomiss xmm2, xmm3
lahf
test ah, 0x44
jp 0x401b6f
ucomiss xmm0, xmm3
lahf
test ah, 0x44
jnp 0x4013f0
movss xmm3, dword [0x403160]
lea eax, [esp + 0x9c]
divss xmm1, xmm3
push 0
push 0xc
push eax
divss xmm2, xmm3
divss xmm0, xmm3
addss xmm1, dword [esp + 0xd8]
addss xmm2, dword [esp + 0xdc]
addss xmm0, dword [esp + 0xe0]
push dword [esp + 0x3c]
push edi
movss dword [esp + 0xb0], xmm1
movss dword [esp + 0xb4], xmm2
movss dword [esp + 0xb8], xmm0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4013f0