Function at 0x1400b15c0
Capabilities:
Capture screenshot
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x230
mov rax, qword [0x14036f200]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor eax, eax
cmp eax, 1
je 0x1400b1e4f
movzx eax, byte [0x14037038c]
test eax, eax
je 0x1400b1dbb
mov eax, dword [0x14036e228]
mov dword [rsp + 0x5c], eax
mov eax, dword [0x14036e228]
mov dword [rsp + 0x58], eax
mov eax, dword [0x140370014]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0x5c]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [rsp + 0xa8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [0x140370018]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0x58]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [rsp + 0xac]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
movzx eax, byte [0x140372818]
cmp eax, 1
jne 0x1400b1677
mov dword [0x14036e2fc], 0x190
movzx eax, byte [0x140372818]
test eax, eax
jne 0x1400b168c
mov dword [0x14036e2fc], 0
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400b1dbb
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0xc8], rax
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0xe0], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0x40cc0020
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, qword [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
mov rcx, qword [rsp + 0xe0]
call fcn.1400bf350
mov qword [rsp + 0x114], rax
mov rax, qword [rsp + 0x240]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x114]
mov qword [rax], rcx
mov rax, qword [rsp + 0x240]
mov rax, qword [rax + 8]
cmp dword [rax], 0xffffffff
je 0x1400b1d9e
lea rcx, [rsp + 0x1a8]
call fcn.140099db0
lea r8, [0x140372820]
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.14005b270
mov qword [rsp + 0x120], rax
mov byte [rsp + 0x54], 1
mov byte [rsp + 0x55], 0
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
cqo
mov ecx, 0xf4240
idiv rcx
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x1d0]
call fcn.14005abb0
nop
lea rcx, [rsp + 0x1d0]
call fcn.14007d610
movsxd rcx, dword [0x14036e2fc]
cmp rax, rcx
jle 0x1400b1d9e
movsd xmm0, qword [0x140333798]
movsd qword [rsp + 0x1b8], xmm0
mov rax, qword [rsp + 0x240]
mov rax, qword [rax + 8]
mov eax, dword [rax]
add eax, dword [rsp + 0x60]
mov dword [rsp + 0xb0], eax
mov eax, dword [0x140370014]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [rsp + 0xb0]
sub ecx, eax
mov eax, ecx
cvtsi2sd xmm0, eax
movsd qword [rsp + 0x98], xmm0
mov rax, qword [rsp + 0x240]
mov rax, qword [rax + 8]
mov eax, dword [rax + 4]
add eax, dword [rsp + 0x64]
mov dword [rsp + 0xb4], eax
mov eax, dword [0x140370018]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [rsp + 0xb4]
sub ecx, eax
mov eax, ecx
cvtsi2sd xmm0, eax
movsd qword [rsp + 0xa0], xmm0
movsd xmm0, qword [rsp + 0x98]
mulsd xmm0, qword [rsp + 0x98]
movsd xmm1, qword [rsp + 0xa0]
mulsd xmm1, qword [rsp + 0xa0]
addsd xmm0, xmm1
call fcn.14016a0f2
movsd qword [rsp + 0x88], xmm0
movsd xmm0, qword [0x1403337a0]
movsd qword [rsp + 0x1c0], xmm0
mov dword [rsp + 0x68], 0xa
mov dword [rsp + 0x6c], 0xa
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x6c], eax
jge 0x1400b1928
lea rax, [rsp + 0x68]
mov qword [rsp + 0xf0], rax
jmp 0x1400b1935
lea rax, [rsp + 0x6c]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov eax, dword [rax]
mov dword [rsp + 0x110], eax
movzx eax, byte [0x140370380]
test eax, eax
je 0x1400b1c7b
movsd xmm0, qword [rsp + 0x88]
comisd xmm0, xmmword [0x1403337a0]
jbe 0x1400b1c7b
xorps xmm0, xmm0
movsd qword [rsp + 0x1e8], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x1f0], xmm0
movsd xmm0, qword [rsp + 0x98]
movsd qword [rsp + 0x1d8], xmm0
movsd xmm0, qword [rsp + 0xa0]
movsd qword [rsp + 0x1e0], xmm0
movsd xmm0, qword [rsp + 0x88]
divsd xmm0, qword [0x1401775c0]
cvttsd2si eax, xmm0
add eax, 2
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 3
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x74], eax
jge 0x1400b1a05
lea rax, [rsp + 0x70]
mov qword [rsp + 0xf8], rax
jmp 0x1400b1a12
lea rax, [rsp + 0x74]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov eax, dword [rax]
mov dword [rsp + 0xb8], eax
movsd xmm0, qword [rsp + 0x88]
mulsd xmm0, qword [str.333333]
cvtsi2sd xmm1, dword [0x14036e230]
mulsd xmm0, xmm1
movsd qword [rsp + 0x158], xmm0
lea rax, [rsp + 0x208]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
movsd xmm0, qword [rsp + 0x158]
movsd qword [rsp + 0x20], xmm0
mov r9d, dword [rsp + 0xb8]
lea r8, [rsp + 0x1d8]
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x208]
call fcn.1400bf690
nop
mov dword [rsp + 0x50], 1
jmp 0x1400b1ac6
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xa
jg 0x1400b1c68
cvtsi2sd xmm0, dword [rsp + 0x50]
divsd xmm0, qword [0x1401775b8]
movsd qword [rsp + 0x160], xmm0
movsd xmm2, qword [rsp + 0x160]
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x1f8]
call fcn.1400bef40
cvtss2sd xmm0, dword [0x14036e224]
movsd xmm1, qword [rsp + 0x1f8]
divsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0x80], xmm0
cvtss2sd xmm0, dword [0x14036e224]
movsd xmm1, qword [rsp + 0x200]
divsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0x78], xmm0
movsd xmm0, qword [rsp + 0x80]
mulsd xmm0, qword [rsp + 0x80]
movsd xmm1, qword [rsp + 0x78]
mulsd xmm1, qword [rsp + 0x78]
addsd xmm0, xmm1
call fcn.14016a0f2
movsd qword [rsp + 0x100], xmm0
movsd xmm0, qword [rsp + 0x100]
comisd xmm0, xmmword [0x140333798]
jbe 0x1400b1bd2
movsd xmm0, qword [0x140333798]
divsd xmm0, qword [rsp + 0x100]
movsd qword [rsp + 0x108], xmm0
movsd xmm0, qword [rsp + 0x80]
mulsd xmm0, qword [rsp + 0x108]
movsd qword [rsp + 0x80], xmm0
movsd xmm0, qword [rsp + 0x78]
mulsd xmm0, qword [rsp + 0x108]
movsd qword [rsp + 0x78], xmm0
movsd xmm0, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_round]
cvttsd2si eax, xmm0
cvtsi2sd xmm0, eax
movsd qword [rsp + 0x168], xmm0
movsd xmm0, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_round]
cvttsd2si eax, xmm0
cvtsi2sd xmm0, eax
movsd qword [rsp + 0x170], xmm0
movsd xmm1, qword [rsp + 0x168]
movsd xmm0, qword [rsp + 0x170]
call fcn.1400b8780
nop
mov dword [rsp + 0xbc], 4
movsxd rax, dword [rsp + 0xbc]
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov rcx, rax
call fcn.1400780b0
nop
jmp 0x1400b1abc
lea rcx, [rsp + 0x208]
call fcn.1400be810
nop
jmp 0x1400b1d87
cvtss2sd xmm0, dword [0x14036e224]
movsd xmm1, qword [rsp + 0x98]
divsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0xd8], xmm0
cvtss2sd xmm0, dword [0x14036e224]
movsd xmm1, qword [rsp + 0xa0]
divsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0xd0], xmm0
movsd xmm0, qword [rsp + 0x88]
comisd xmm0, xmmword [0x140333798]
jbe 0x1400b1d20
movsd xmm0, qword [0x140333798]
divsd xmm0, qword [rsp + 0x88]
movsd qword [rsp + 0xe8], xmm0
movsd xmm0, qword [rsp + 0xd8]
mulsd xmm0, qword [rsp + 0xe8]
movsd qword [rsp + 0xd8], xmm0
movsd xmm0, qword [rsp + 0xd0]
mulsd xmm0, qword [rsp + 0xe8]
movsd qword [rsp + 0xd0], xmm0
cvtsi2sd xmm0, dword [0x140370384]
movsd xmm1, qword [rsp + 0xd0]
addsd xmm1, xmm0
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_round]
cvttsd2si eax, xmm0
cvtsi2sd xmm0, eax
movsd qword [rsp + 0x188], xmm0
movsd xmm0, qword [rsp + 0xd8]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_round]
cvttsd2si eax, xmm0
cvtsi2sd xmm0, eax
movsd qword [rsp + 0x190], xmm0
movsd xmm1, qword [rsp + 0x188]
movsd xmm0, qword [rsp + 0x190]
call fcn.1400b8780
nop
lea rcx, [rsp + 0x1c8]
call fcn.140099db0
mov rax, qword [rax]
mov qword [0x140372820], rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x1400b1e0e
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400b1e0e
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400b1e0e
movzx eax, byte [0x140370060]
test eax, eax
je 0x1400b1e0e
call fcn.1400be970
movzx eax, al
test eax, eax
je 0x1400b1e0e
call fcn.1400b37c0
nop
mov dword [rsp + 0xc0], 1
movsxd rax, dword [rsp + 0xc0]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov rcx, rax
call fcn.1400780b0
nop
jmp 0x1400b15df
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1401686c0
add rsp, 0x230
pop rdi
ret