Function at 0x140057450
Capabilities:
Capture screenshot
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1402a8800]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15d, dword [reloc.WS2_32.dll_getpeername]
xor ecx, ecx
mov eax, r15d
cdq
sub eax, edx
sar eax, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov esi, eax
sub esi, edi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
mov ebx, eax
sub ebx, edi
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r15d
mov edx, r15d
mov rcx, r13
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r14
mov r12, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r15d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, r14
mov dword [rsp + 0x20], r15d
mov qword [rbp - 0x29], rax
call qword [sym.imp.GDI32.dll_BitBlt]
xor edi, edi
mov dword [rbp - 9], Ordinal_46
mov eax, r15d
mov qword [rbp + 0x1b], rdi
neg eax
mov dword [rbp - 5], r15d
mov dword [rbp - 1], eax
xorps xmm0, xmm0
mov eax, r15d
mov qword [rbp + 3], 0x200001
imul eax, r15d
movdqu xmmword [rbp + 0xb], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rdi
shl eax, 2
movsxd rsi, eax
mov eax, edi
mov qword [rbp - 0x21], rax
test rsi, rsi
je 0x1400575d6
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14005784f
cmp rsi, 0x1000
jb 0x1400575ad
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140057849
call fcn.1400800e0
mov rcx, rax
test rax, rax
je 0x14005780d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400575b5
mov rcx, rsi
call fcn.1400800e0
lea rbx, [rax + rsi]
mov qword [rbp - 0x21], rax
mov r8, rsi
mov qword [rbp - 0x11], rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x19], rbx
lea rcx, [rbp - 9]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rcx
mov r9d, r15d
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rdx, qword [rbp - 0x29]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r11, qword [rbp - 0x21]
mov r15, qword [rbp - 0x19]
sub r15, r11
je 0x1400577e0
mov r12d, dword [0x14018d094]
lea rdx, [r11 + 1]
mov eax, dword [reloc.WLDAP32.dll_Ordinal_50]
mov r14d, r12d
mov esi, dword [str.d2]
sub r14d, eax
mov ebx, dword [0x14018d09c]
nop dword [rax + rax]
movzx r8d, byte [rdx + 1]
movzx r9d, byte [rdx]
movzx r10d, byte [rdx - 1]
cmp r8d, r14d
jl 0x14005769e
lea ecx, [rax + r12]
cmp r8d, ecx
jg 0x14005769e
mov ecx, esi
sub ecx, eax
cmp r9d, ecx
jl 0x14005769e
lea ecx, [rsi + rax]
cmp r9d, ecx
jg 0x14005769e
mov ecx, ebx
sub ecx, eax
cmp r10d, ecx
jl 0x14005769e
lea ecx, [rbx + rax]
cmp r10d, ecx
jle 0x1400576b2
add edi, 4
add rdx, 4
movsxd rcx, edi
cmp rcx, r15
jb 0x140057660
jmp 0x1400577e0
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140057740
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 0x41
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea edi, [rbx + 1]
mov ecx, 0x53
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [rdi + 1]
mov ecx, 0x5a
test ax, ax
cmovns ebx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea edi, [rbx + 1]
mov ecx, 0x51
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [rdi + 1]
mov ecx, 0x44
test ax, ax
cmovns ebx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
lea ecx, [rbx + 1]
cmovns ecx, ebx
test ecx, 0xfffffffd
jne 0x1400577dc
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x140057761
mov r8d, eax
xor r9d, r9d
movzx edx, r8b
movzx ecx, r8b
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x1400577b4
cmp eax, 2
jne 0x140057787
mov r8d, 1
xor r9d, r9d
movzx edx, r8b
movzx ecx, r8b
call qword [sym.imp.USER32.dll_keybd_event]
mov qword [rbp - 0x29], 0x7d
jmp 0x1400577ab
cmp eax, 3
jne 0x1400577c8
mov r8d, 1
xor r9d, r9d
movzx edx, r8b
movzx ecx, r8b
call qword [sym.imp.USER32.dll_keybd_event]
mov qword [rbp - 0x29], 0xdc
lea rcx, [rbp - 0x29]
call fcn.140048e40
mov dl, 1
xor r9d, r9d
movzx ecx, dl
mov r8d, 3
call qword [sym.imp.USER32.dll_keybd_event]
movsxd rax, dword [0x14018d0a4]
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x29], rax
call fcn.140048e40
mov r11, qword [rbp - 0x21]
test r11, r11
je 0x14005781c
mov rdx, qword [rbp - 0x11]
mov rax, r11
sub rdx, r11
cmp rdx, 0x1000
jb 0x140057814
mov r11, qword [r11 - 8]
add rdx, 0x27
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057814
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.14008011c
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14007ffa0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001fd90
int3
call fcn.140058b60
int3