Function at 0x401140
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x404004]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x124
lea eax, [esp + 0xf0]
mov dword [esp + 0xa4], 0
push 0
push eax
mov dword [esp + 0xb0], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xe8], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [esp + 0xe8]
mov dword [esp + 0x80], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x40128d
nop dword [eax]
lea ecx, [esp + 0x10c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011d0
sub ecx, edx
lea esi, [esp + 0x10c]
mov edi, 8
mov edx, str.csgo.exe
cmp ecx, edi
cmovb edi, ecx
sub edi, 4
jb 0x401205
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x40120a
add edx, 4
add esi, 4
sub edi, 4
jae 0x4011f4
cmp edi, 0xfffffffc
je 0x40123e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x401237
cmp edi, 0xfffffffd
je 0x40123e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x401237
cmp edi, 0xfffffffe
je 0x40123e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x401237
cmp edi, 0xffffffff
je 0x40123e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x40123e
sbb eax, eax
or eax, 1
jmp 0x401240
xor eax, eax
test eax, eax
jne 0x40124b
cmp ecx, 8
ja 0x40124b
jae 0x40126a
lea eax, [esp + 0xe8]
push eax
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4011c0
jmp 0x40128d
mov eax, dword [esp + 0xf0]
push eax
push 0
push 0x1fffff
mov dword [esp + 0xac], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x80]
test eax, eax
je 0x40129f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 8
lea ecx, [esp + 0xa8]
mov eax, esp
mov dword [eax], str.client.dll
mov dword [eax + 4], 0xa
call section..text
sub esp, 8
mov dword [esp + 0x2c], eax
mov ecx, esp
mov dword [ecx], str.engine.dll
mov dword [ecx + 4], 0xa
lea ecx, [esp + 0xa8]
call section..text
mov dword [esp + 0x3c], eax
call dword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov edi, eax
mov esi, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCP140.dll__Query_perf_counter]
push ebx
push esi
push edi
push edx
push eax
call fcn.00402870
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov dword [esp + 0x20], eax
mov edi, edx
call fcn.00402950
push dword [esp + 0xc]
push dword [esp + 0x18]
push edx
push eax
call fcn.004027c0
mov dword [esp + 0x88], eax
mov esi, edx
mov ecx, 0x3b9aca00
mov eax, edi
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, dword [esp + 0x10]
mul edx
add ecx, edx
mov edx, dword [esp + 0x88]
add edx, eax
adc esi, ecx
cmp edx, 0xfff0bdbf
jne 0x401367
cmp esi, 0x7fffffff
je 0x401392
cmp esi, 0x7fffffff
jg 0x401392
jl 0x401379
cmp edx, 0xfff0bdbf
jae 0x401392
add edx, 0xf4240
mov dword [esp + 0x88], edx
adc esi, 0
mov dword [esp + 0x84], esi
jmp 0x4013a7
or eax, 0xffffffff
mov dword [esp + 0x84], 0x7fffffff
mov dword [esp + 0x88], eax
call dword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov edi, eax
mov esi, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCP140.dll__Query_perf_counter]
push ebx
push esi
push edi
push edx
push eax
call fcn.00402870
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov dword [esp + 0x20], eax
mov edi, edx
call fcn.00402950
push dword [esp + 0xc]
push dword [esp + 0x18]
push edx
push eax
call fcn.004027c0
mov esi, eax
mov dword [esp + 0x98], edx
mov ecx, 0x3b9aca00
mov eax, edi
mov edi, dword [esp + 0x88]
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, dword [esp + 0x10]
mul edx
add ecx, edx
add esi, eax
mov eax, dword [esp + 0x98]
adc eax, ecx
mov dword [esp + 0x94], esi
cmp edi, esi
mov dword [esp + 0x98], eax
mov esi, dword [esp + 0x84]
jne 0x401443
cmp esi, eax
je 0x401503
cmp esi, eax
jl 0x401503
jg 0x40145a
cmp edi, dword [esp + 0x94]
jb 0x401503
call dword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
push 0
push 0x64
push edx
push eax
call fcn.00402950
sub edi, dword [esp + 0x94]
mov dword [esp + 0x70], eax
mov ecx, edi
mov eax, esi
mov dword [esp + 0x80], edx
sbb eax, dword [esp + 0x98]
mov edx, eax
mov dword [esp + 0xc], eax
call fcn.00402990
comisd xmm0, xmmword [0x403168]
mov edx, dword [esp + 0x70]
jbe 0x4014b1
mov edi, 0xad160000
mov esi, edx
mov ecx, 0x311cd
add esi, edi
jmp 0x4014b9
mov ecx, dword [esp + 0xc]
mov esi, edi
add esi, edx
add edi, edx
push 0
adc ecx, dword [esp + 0x84]
push 0x3b9aca00
push ecx
push edi
call fcn.004027c0
mov dword [esp + 0xd8], eax
imul eax, eax, 0x3b9aca00
mov dword [esp + 0xdc], edx
sub esi, eax
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0xe4], esi
call dword [sym.imp.MSVCP140.dll__Thrd_sleep]
add esp, 4
jmp 0x4013a7
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4012e3
mov esi, dword [esp + 0xa4]
lea eax, [esp + 0x70]
push 0
push 4
push eax
mov eax, dword [esp + 0x30]
add eax, 0xdb65ec
mov dword [esp + 0x7c], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x94]
push 0
push 4
push eax
lea eax, [edi + 0xf4]
mov dword [esp + 0xa0], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0xc8]
mov dword [esp + 0xc8], 0
push eax
lea eax, [edi + 0x138]
mov dword [esp + 0xd0], 0
push eax
push esi
mov dword [esp + 0xdc], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 0
push eax
lea eax, [edi + 0x108]
mov dword [esp + 0xc4], 0
push eax
push esi
mov dword [esp + 0xd0], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [esp + 0xb4]
lea eax, [esp + 0x70]
addss xmm0, dword [esp + 0xc0]
push 0
push 4
push eax
mov eax, dword [esp + 0x48]
movss dword [esp + 0x4c], xmm0
add eax, 0x589fc4
movss xmm0, dword [esp + 0xc4]
addss xmm0, dword [esp + 0xd0]
push eax
push esi
mov dword [esp + 0x84], 0
movss dword [esp + 0x58], xmm0
movss xmm0, dword [esp + 0xd0]
addss xmm0, dword [esp + 0xdc]
movss dword [esp + 0x5c], xmm0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [esp + 0x70]
lea eax, [esp + 0x80]
push 0
push 4
push eax
lea eax, [esi + 0x180]
mov dword [esp + 0x8c], 0
push eax
push dword [esp + 0xb4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
lea eax, [esi + 0x4d90]
mov dword [esp + 0xac], 0
push 0xc
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0x30], eax
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
push dword [esp + 0xb4]
call esi
push 0
push 0xc
lea eax, [esp + 0xd4]
mov dword [esp + 0xd4], 0
push eax
lea eax, [edi + 0x303c]
mov dword [esp + 0xdc], 0
mov edi, dword [esp + 0xb0]
push eax
push edi
mov dword [esp + 0xe8], 0
call esi
movss xmm1, dword [0x40315c]
movss xmm0, dword [esp + 0xcc]
mov eax, dword [esp + 0x24]
mulss xmm0, xmm1
add eax, 0x4dd1e2c
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
movss dword [esp + 0x4c], xmm0
movss xmm0, dword [esp + 0xd0]
mulss xmm0, xmm1
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0x20
movss dword [esp + 0x50], xmm0
movss xmm0, dword [esp + 0xd4]
mulss xmm0, xmm1
movss dword [esp + 0x54], xmm0
movss xmm0, dword [0x403160]
movss dword [esp + 0x10], xmm0
nop dword [eax]
push 0
push 4
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], 0
push ecx
push eax
push edi
call esi
push 0
push 4
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
push eax
mov eax, dword [esp + 0x94]
add eax, 0xf4
push eax
push edi
call esi
mov eax, dword [esp + 0x94]
cmp dword [esp + 0x70], eax
je 0x401a99
push 0
push 1
lea eax, [esp + 0x87]
mov byte [esp + 0x87], 0
push eax
mov eax, dword [esp + 0x94]
add eax, 0xed
push eax
push edi
call esi
cmp byte [esp + 0x7f], 0
jne 0x401a99
push 0
push 4
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
push eax
mov eax, dword [esp + 0x94]
add eax, 0x100
push eax
push edi
call esi
cmp dword [esp + 0x70], 0
je 0x401a99
push 0
push 4
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
push eax
mov eax, dword [esp + 0x94]
add eax, 0x980
push eax
push edi
call esi
mov ecx, dword [esp + 0x80]
mov eax, 1
shl eax, cl
test dword [esp + 0x70], eax
je 0x401a99
push 0
push 4
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
push eax
mov eax, dword [esp + 0x94]
add eax, 0x26a8
push eax
push edi
call esi
mov esi, dword [esp + 0x70]
lea eax, [esp + 0x98]
push 0
push 4
push eax
lea eax, [esi + 0x18c]
mov dword [esp + 0xa4], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x8c]
mov dword [esp + 0x8c], 0
push eax
lea eax, [esi + 0x19c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0
push eax
lea eax, [esi + 0x1ac]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
push edi
call esi
movss xmm0, dword [esp + 0x98]
sub esp, 8
subss xmm0, dword [esp + 0x48]
movss dword [esp + 0xa0], xmm0
movss dword [esp + 0x20], xmm0
movss xmm0, dword [esp + 0x8c]
subss xmm0, dword [esp + 0x4c]
movss dword [esp + 0x78], xmm0
fld dword [esp + 0x78]
movss dword [esp + 0x8c], xmm0
movss xmm0, dword [esp + 0x90]
subss xmm0, dword [esp + 0x50]
fstp dword [esp + 4]
fld dword [esp + 0xa0]
fstp dword [esp]
xorps xmm0, xmmword [0x403170]
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x90], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
fstp dword [esp + 0x78]
movss xmm0, dword [esp + 0x78]
add esp, 8
fld qword [esp + 0x88]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x70], xmm0
fld qword [esp + 0x70]
call sub.api_ms_win_crt_math_l1_1_0.dll__CIatan2
movss xmm0, dword [esp + 0xa8]
addss xmm0, dword [esp + 0x4c]
fstp qword [esp + 0x70]
movsd xmm1, qword [esp + 0x70]
cvtpd2ps xmm1, xmm1
mulss xmm1, dword [0x403164]
subss xmm1, xmm0
movss xmm0, dword [esp + 0x84]
cvtps2pd xmm0, xmm0
movss dword [esp + 0x70], xmm1
movsd qword [esp + 0x98], xmm0
movss xmm0, dword [esp + 0x18]
fld qword [esp + 0x98]
movss dword [esp + 0x58], xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll__CIatan2
movss xmm0, dword [esp + 0xac]
sub esp, 8
addss xmm0, dword [esp + 0x58]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
cvtpd2ps xmm1, xmm1
mulss xmm1, dword [0x403164]
subss xmm1, xmm0
xorps xmm0, xmm0
movss dword [esp + 0x20], xmm1
fld dword [esp + 0x20]
movss dword [esp + 0x64], xmm1
movss xmm1, dword [esp + 0xb8]
addss xmm1, dword [esp + 0x5c]
fstp dword [esp + 4]
fld dword [esp + 0x78]
fstp dword [esp]
subss xmm0, xmm1
movss dword [esp + 0x68], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
movss xmm1, dword [esp + 0x18]
add esp, 8
fstp dword [esp + 0x18]
movss xmm0, dword [esp + 0x18]
comiss xmm1, xmm0
jbe 0x401a99
mov eax, dword [esp + 0x60]
movss dword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x58]
movq qword [esp + 0x30], xmm0
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x14]
add eax, 0x10
sub dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
jne 0x401780
movss xmm2, dword [esp + 0x30]
xorps xmm3, xmm3
movss xmm0, dword [esp + 0x38]
movss xmm1, dword [esp + 0x34]
ucomiss xmm2, xmm3
lahf
test ah, 0x44
jp 0x401ae3
ucomiss xmm1, xmm3
lahf
test ah, 0x44
jp 0x401ae3
ucomiss xmm0, xmm3
lahf
test ah, 0x44
jnp 0x4012e3
addss xmm2, dword [esp + 0xa8]
addss xmm1, dword [esp + 0xac]
addss xmm0, dword [esp + 0xb0]
push 0
push 0xc
lea eax, [esp + 0x6c]
movss dword [esp + 0x6c], xmm2
push eax
push dword [esp + 0x34]
movss dword [esp + 0x78], xmm1
push edi
movss dword [esp + 0x80], xmm0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4012e3