Function at 0x40c6ef
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [0x769e90]
xor eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
push ecx
push 0x7f00
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f8a
push ebx
mov dword [0x7903ec], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f03
push ebx
mov dword [0x7903d4], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f89
push ebx
mov dword [0x7903dc], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f8b
push ebx
mov dword [0x790430], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f01
push ebx
mov dword [0x7903c8], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f88
push ebx
mov dword [0x7903e0], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f86
push ebx
mov dword [0x7903e8], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f83
push ebx
mov dword [0x7903f0], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f85
push ebx
mov dword [0x7903d8], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f82
push ebx
mov dword [0x7903d0], eax
call esi
mov ecx, eax
call fcn.0040c0b5
mov dword [0x790434], eax
push 0x7f84
push ebx
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f04
push ebx
mov dword [0x7903cc], eax
call esi
mov ecx, eax
call fcn.0040c0b5
push 0x7f02
push ebx
mov dword [0x7903e4], eax
call esi
mov ecx, eax
call fcn.0040c0b5
mov dword [0x7903f4], eax
lea eax, [esp + 0x18]
pop ecx
push eax
mov dword [esp + 0x18], 0x14
call dword [sym.imp.USER32.dll_GetCursorInfo]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0040c0b5
pop ecx
mov ecx, eax
call fcn.0040bffd
push ebx
push ebx
push 0x179
push 0x6dfde8
push 1
push 0x15
mov dword [0x6dfebc], eax
call fcn.005f5ba0
add esp, 0x10
mov ecx, eax
push 5
pop edx
call fcn.00487604
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov esi, eax
pop ecx
pop ecx
push 0x58
call ebx
push 5
mov word [esi], ax
call ebx
mov cl, byte [0x6dfebc]
xor edi, edi
mov byte [esi + 4], cl
mov edx, esi
push edi
mov ecx, ebp
mov word [esi + 2], ax
call fcn.0048e18a
pop ecx
push edi
push edi
push 0x17f
push str...meshcoreKVMWindowsinput.c
push 1
push 0x15
call fcn.005f5ba0
add esp, 0x10
mov ecx, eax
push 5
pop edx
call fcn.00487604
pop ecx
pop ecx
push 0x12
mov edi, eax
call ebx
push 5
mov word [edi], ax
call ebx
mov word [edi + 2], ax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
mov bx, ax
and bl, 1
push 0x91
add bl, bl
call esi
and al, 1
or al, bl
add al, al
push 0x90
mov word [esp + 0x14], ax
call esi
and al, 1
xor ebx, ebx
or al, byte [esp + 0x10]
mov edx, edi
push ebx
mov ecx, ebp
mov byte [edi + 4], al
call fcn.0048e18a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
push ebx
push ebx
push 0x40c5c2
push ebx
push ebx
mov dword [0x769e78], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x769e88], eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret