Function at 0x140056ff0
Capabilities:
Capture screenshot
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1402a8800]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r12d, dword [reloc.WS2_32.dll_getpeername]
xor ecx, ecx
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov esi, eax
sub esi, edi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
xor ecx, ecx
sub eax, edx
sar eax, 1
mov ebx, eax
sub ebx, edi
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, r12d
mov edx, r12d
mov rcx, r15
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, rbp
mov r14, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r12d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, rbp
mov dword [rsp + 0x20], r12d
mov r13, rax
call qword [sym.imp.GDI32.dll_BitBlt]
xor r8d, r8d
imul r12d, r12d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r8
shl r12d, 2
movsxd rdi, r12d
test r12d, r12d
je 0x14005714e
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140057444
cmp rdi, 0x1000
jb 0x140057121
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14005743e
call fcn.1400800e0
mov rcx, rax
test rax, rax
je 0x140057401
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140057129
mov rcx, rdi
call fcn.1400800e0
lea rbx, [rax + rdi]
mov qword [rsp + 0x58], rax
mov r8, rdi
mov qword [rsp + 0x68], rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov edx, r12d
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetBitmapBits]
mov rcx, r14
test eax, eax
jne 0x14005718c
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1400573ce
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r10, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
sub rsi, r10
je 0x1400573d3
movzx r15d, byte [0x14018d05c]
lea rax, [r10 + 1]
mov r8d, dword [reloc.WLDAP32.dll_Ordinal_50]
mov rdi, 0xffffffffffffffff
movzx r12d, byte [0x14018d05e]
sub rdi, r10
movzx r13d, byte [0x14018d05d]
movzx ebp, byte [0x14018d072]
movzx r14d, byte [0x14018d071]
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rax + 1]
movzx r11d, byte [rax]
mov edx, r9d
movzx ebx, byte [rax - 1]
sub edx, r15d
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, r8d
jg 0x140057252
mov edx, r11d
sub edx, r13d
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, r8d
jg 0x140057252
mov edx, ebx
sub edx, r12d
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, r8d
jle 0x1400572a2
movzx ecx, byte [0x14018d070]
sub r9d, ecx
mov ecx, r9d
neg ecx
cmovs ecx, r9d
cmp ecx, r8d
jg 0x14005728c
mov edx, r11d
sub edx, r14d
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, r8d
jg 0x14005728c
mov edx, ebx
sub edx, ebp
mov ecx, edx
neg ecx
cmovs ecx, edx
cmp ecx, r8d
jle 0x1400572a2
add rax, 4
lea rcx, [rdi + rax]
cmp rcx, rsi
jb 0x140057210
jmp 0x1400573d3
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140057330
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 0x41
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea edi, [rbx + 1]
mov ecx, 0x53
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [rdi + 1]
mov ecx, 0x5a
test ax, ax
cmovns ebx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea edi, [rbx + 1]
mov ecx, 0x51
test ax, ax
cmovns edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [rdi + 1]
mov ecx, 0x44
test ax, ax
cmovns ebx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
lea ecx, [rbx + 1]
cmovns ecx, ebx
test ecx, 0xfffffffd
jne 0x1400573ce
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x140057350
mov r8d, eax
xor r9d, r9d
movzx edx, r8b
movzx ecx, dl
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x1400573a4
cmp eax, 2
jne 0x140057376
mov r8d, 1
xor r9d, r9d
movzx edx, r8b
movzx ecx, dl
call qword [sym.imp.USER32.dll_keybd_event]
mov qword [rsp + 0x50], 0x7d
jmp 0x14005739a
cmp eax, 3
jne 0x1400573b8
mov r8d, 1
xor r9d, r9d
movzx edx, r8b
movzx ecx, dl
call qword [sym.imp.USER32.dll_keybd_event]
mov qword [rsp + 0x50], 0xdc
lea rcx, [rsp + 0x50]
call fcn.140048e40
mov dl, 1
xor r9d, r9d
movzx ecx, dl
mov r8d, 3
call qword [sym.imp.USER32.dll_keybd_event]
movsxd rax, dword [0x14018d0a4]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.140048e40
mov r10, qword [rsp + 0x58]
test r10, r10
je 0x140057410
mov rdx, qword [rsp + 0x68]
mov rax, r10
sub rdx, r10
cmp rdx, 0x1000
jb 0x140057408
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057408
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.14008011c
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007ffa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001fd90
int3
call fcn.140058b60
int3