Function at 0x401170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4027fd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x398
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
xor esi, esi
push 0x124
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 0x28], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x150], 0x128
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x37c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x4012ad
lea esi, [ebp - 0x12c]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401212
sub ecx, edx
mov edi, 8
cmp ecx, edi
mov dword [ebp - 0x38c], ecx
mov edx, str.csgo.exe
cmovb edi, ecx
sub edi, 4
jb 0x401246
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x40124b
add edx, 4
add esi, 4
sub edi, 4
jae 0x401235
cmp edi, 0xfffffffc
je 0x40127f
mov al, byte [edx]
cmp al, byte [esi]
jne 0x401278
cmp edi, 0xfffffffd
je 0x40127f
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x401278
cmp edi, 0xfffffffe
je 0x40127f
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x401278
cmp edi, 0xffffffff
je 0x40127f
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x40127f
sbb eax, eax
or eax, 1
jmp 0x401281
xor eax, eax
test eax, eax
jne 0x401290
cmp ecx, 8
ja 0x401290
jae 0x4013aa
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401207
xor esi, esi
mov eax, dword [ebp - 0x37c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4012c0
push eax
call edi
mov dword [ebp - 4], 0
mov edx, str.csgo_found_
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401730
push 0x401950
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x220
lea eax, [ebp - 0x374]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x378], 0x224
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x37c], eax
push ecx
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x4013fd
lea esi, [ebp - 0x358]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401336
sub ecx, edx
mov edi, 0xa
cmp ecx, edi
mov dword [ebp - 0x38c], ecx
mov edx, str.client.dll
cmovb edi, ecx
sub edi, 4
jb 0x401371
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x401376
add edx, 4
add esi, 4
sub edi, 4
jae 0x401360
cmp edi, 0xfffffffc
je 0x4013c9
mov al, byte [edx]
cmp al, byte [esi]
jne 0x4013a3
cmp edi, 0xfffffffd
je 0x4013c9
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x4013a3
cmp edi, 0xfffffffe
je 0x4013c9
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x4013a3
cmp edi, 0xffffffff
je 0x4013c9
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x4013c9
sbb eax, eax
or eax, 1
jmp 0x4013cb
mov esi, dword [ebp - 0x148]
push esi
push 0
push 0x1fffff
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
jmp 0x4012ad
xor eax, eax
test eax, eax
jne 0x4013da
cmp ecx, 0xa
ja 0x4013da
jae 0x4014b4
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x37c]
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x40132b
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x40140a
push eax
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.client.dll___
call fcn.00401730
mov edx, 0x40318c
mov ecx, eax
call fcn.00401730
push 0x401150
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x401130
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x401950
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [esi + 0xdef97c]
mov dword [ebp - 0x394], eax
lea eax, [esi + 0x52c0f50]
mov dword [ebp - 0x384], eax
nop
lea ecx, [ebp - 0x3a8]
call fcn.00401010
mov edi, dword [ebp - 0x3a8]
mov esi, dword [ebp - 0x3a4]
cmp edi, 0xfff0bdbf
jne 0x401497
cmp esi, 0x7fffffff
je 0x4014bf
cmp esi, 0x7fffffff
jg 0x4014bf
jl 0x4014a9
cmp edi, 0xfff0bdbf
jae 0x4014bf
add edi, 0xf4240
adc esi, 0
jmp 0x4014c7
mov esi, dword [ebp - 0x364]
jmp 0x4013f7
or edi, 0xffffffff
mov esi, 0x7fffffff
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x37c], edi
lea ecx, [ebp - 0x390]
call fcn.00401010
mov ecx, dword [ebp - 0x390]
mov eax, dword [ebp - 0x38c]
cmp edi, ecx
jne 0x4014f6
cmp esi, eax
je 0x4015cd
cmp esi, eax
jl 0x4015cd
jg 0x401508
cmp edi, ecx
jb 0x4015cd
sub edi, ecx
sbb esi, eax
cmp edi, 0x914f0000
jne 0x401520
cmp esi, 0x4e94
je 0x4015b2
cmp esi, 0x4e94
jg 0x4015b2
jl 0x401536
cmp edi, 0x914f0000
jae 0x4015b2
push 0
push 0xf4240
push esi
push edi
call fcn.00402620
push 0
mov ecx, edx
mov dword [ebp - 0x18], eax
push 0xf4240
push ecx
push eax
mov dword [ebp - 0x1c], ecx
call fcn.004027b0
cmp eax, edi
jne 0x401562
cmp edx, esi
je 0x401592
cmp edx, esi
jg 0x401592
jl 0x40156c
cmp eax, edi
jae 0x401592
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, 1
push eax
adc ecx, 0
mov dword [ebp - 0x1c], ecx
call sub.KERNEL32.dll_Sleep
mov esi, dword [ebp - 0x380]
mov edi, dword [ebp - 0x37c]
jmp 0x4014d3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ecx
call sub.KERNEL32.dll_Sleep
mov esi, dword [ebp - 0x380]
mov edi, dword [ebp - 0x37c]
jmp 0x4014d3
push 0x5265c00
call sub.KERNEL32.dll_Sleep
mov esi, dword [ebp - 0x380]
mov edi, dword [ebp - 0x37c]
jmp 0x4014d3
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push eax
push dword [ebp - 0x394]
mov dword [ebp - 0x1c], 0
push edi
call esi
push 0
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0x104
push eax
push edi
call esi
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x401470
test byte [ebp - 0x18], 1
push 0
push 4
je 0x401647
lea eax, [ebp - 0x398]
mov dword [ebp - 0x398], 6
push eax
push dword [ebp - 0x384]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x401470
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x39c], 4
push eax
push dword [ebp - 0x384]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x401470