Function at 0x18002a0f0
Capabilities:
Create http request
Download and write a file
Log keystrokes via polling
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x10f0
call fcn.18005aa10
sub rsp, rax
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + 0x1138], rbx
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x30], r8d
mov r14d, edx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x1150]
mov qword [rsp + 0x68], rcx
mov rbp, qword [rsp + 0x1160]
mov rax, qword [rsp + 0x1168]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x1170]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x70], rdi
xor ebx, ebx
mov r13d, ebx
lea edx, [rbx + 1]
test rax, rax
je 0x18002a18a
cmp rax, 0xffffffffffffffff
cmovne r13d, edx
test r8d, r8d
je 0x18002a1ef
test r13d, r13d
je 0x18002a1bf
test rcx, rcx
jne 0x18002a1ef
mov rdx, qword [rdi]
sub rdx, 0x18
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18002a1b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x18002a96a
test r9, r9
je 0x18002a1c9
test rcx, rcx
jne 0x18002a1ef
mov rdx, qword [rdi]
sub rdx, 0x18
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18002a1e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x18002a96a
mov esi, edx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
bt edx, 0xf
jae 0x18002a22e
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
bt edx, 0xf
jae 0x18002a22e
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
bt edx, 0xf
cmovb esi, ebx
mov r12d, ebx
mov r15d, dword [rsp + 0x1158]
test r15d, r15d
setle r12b
mov r10, qword [rdi]
cmp dword [r10 - 0x10], ebx
je 0x18002a2cf
or rbx, 0xffffffffffffffff
test rbp, rbp
je 0x18002a29d
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18002a29d
mov eax, 0x10000000
test r12d, r12d
mov ecx, 0
cmovne eax, ecx
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbp
lea edx, [rbx + 4]
mov rcx, r10
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
mov qword [rsp + 0x40], rax
jmp 0x18002a351
mov eax, 0x10000000
test r12d, r12d
mov ecx, 0
cmovne eax, ecx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r10
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
mov qword [rsp + 0x40], rax
jmp 0x18002a351
or rbx, 0xffffffffffffffff
test rbp, rbp
je 0x18002a320
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18002a320
mov eax, 0x10000000
test r12d, r12d
mov ecx, 0
cmovne eax, ecx
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbp
lea edx, [rbx + 4]
lea rcx, [0x18006d208]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
mov qword [rsp + 0x40], rax
jmp 0x18002a351
mov eax, 0x10000000
test r12d, r12d
mov ecx, 0
cmovne eax, ecx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [0x18006d208]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rdi, rdi
jne 0x18002a37d
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18002a376
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x18002a96a
mov ebp, 0x84083180
mov eax, 0x84283180
test r14d, r14d
cmovne ebp, eax
mov ecx, 0x20
call fcn.180034140
mov rsi, rax
test rax, rax
je 0x18002a93e
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], eax
mov dword [rsi + 0x1c], eax
test r12d, r12d
jne 0x18002a3d1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
xor eax, eax
mov r14, rax
test r12d, r12d
je 0x18002a3fe
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r14, rax
jmp 0x18002a4d5
lea rdx, [0x18002a080]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp rax, 0xffffffffffffffff
je 0x18002a4d5
mov dword [rsp + 0x70], 1
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 0x3d]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
cmp qword [rsi + 8], 0
je 0x18002a4d5
lea r8, [0x18006d220]
lea r9, [0x18006d250]
mov edx, dword [rsp + 0x1178]
test edx, edx
je 0x18002a46f
xor eax, eax
mov rcx, rbx
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x18002a480
xor eax, eax
mov rcx, rbx
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
test edx, edx
cmovne r8, r9
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9d, ecx
mov rdx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
test rax, rax
jne 0x18002a4cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18002a4d5
mov edx, r15d
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18002a4d5
mov r14, qword [rsi]
jmp 0x18002a4d5
cmp rax, 0xffffffffffffffff
cmovne r14, rax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18002a4e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
jne 0x18002a51a
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18002a513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x18002a96a
xor ebp, ebp
mov word [rsp + 0xb8], bp
xor eax, eax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov word [rsp + 0xca], ax
mov dword [rsp + 0x58], 0x14
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xb8]
lea edx, [rbp + 0x13]
mov rcx, r14
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x18002a91d
lea rcx, [rsp + 0xb8]
call fcn.180036d04
cmp eax, 0xc8
je 0x18002a5a4
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rsp + 0x38]
call fcn.180001c10
xor eax, eax
jmp 0x18002a96a
mov edi, 1
mov r15d, dword [rsp + 0x30]
test r15d, r15d
je 0x18002a8e5
mov ebx, ebp
mov rdi, rbp
mov byte [rsp + 0xd0], bl
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xd1]
call fcn.180035fe0
movsxd r13, r13d
test r12d, r12d
je 0x18002a6ea
mov dword [rsp + 0x30], ebp
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0xd0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18002a8ca
mov r12, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x30]
test r8d, r8d
jle 0x18002a893
test r13, r13
jne 0x18002a689
test rdi, rdi
jne 0x18002a648
mov ecx, 0x1001
call fcn.1800355d0
mov rdi, rax
xor edx, edx
mov r8d, 0x1001
mov rcx, rax
call fcn.180035fe0
jmp 0x18002a66f
lea eax, [rbx + 0x1001]
movsxd rdx, eax
mov rcx, rdi
call fcn.1800372fc
mov rdi, rax
movsxd rcx, ebx
add rcx, rax
xor edx, edx
mov r8d, 0x1001
call fcn.180035fe0
movsxd r8, dword [rsp + 0x30]
movsxd rcx, ebx
add rcx, rdi
lea rdx, [rsp + 0xd0]
call fcn.18003b330
jmp 0x18002a6a8
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1001
lea rcx, [rsp + 0xd0]
call fcn.180035fe0
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0xd0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18002a611
jmp 0x18002a893
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x18002a8ca
mov r12, qword [rsp + 0x50]
nop dword [rax]
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x78], 0x38
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], 0x1000
mov r9, rsi
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFileExW]
test eax, eax
jne 0x18002a7b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18002a880
mov edx, 0x3a98
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18002a879
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r8d, dword [rsp + 0xa0]
test r8d, r8d
jle 0x18002a885
test r13, r13
jne 0x18002a832
test rdi, rdi
jne 0x18002a7ee
mov ecx, 0x1001
call fcn.1800355d0
mov rdi, rax
xor edx, edx
mov r8d, 0x1001
mov rcx, rax
call fcn.180035fe0
jmp 0x18002a815
lea eax, [rbx + 0x1001]
movsxd rdx, eax
mov rcx, rdi
call fcn.1800372fc
mov rdi, rax
movsxd rcx, ebx
add rcx, rax
xor edx, edx
mov r8d, 0x1001
call fcn.180035fe0
mov r8d, dword [rsp + 0xa0]
movsxd rcx, ebx
add rcx, rdi
lea rdx, [rsp + 0xd0]
call fcn.18003b330
jmp 0x18002a853
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [rsp + 0xa0]
xor edx, edx
mov r8d, 0x1001
lea rcx, [rsp + 0xd0]
call fcn.180035fe0
cmp dword [rsi + 0x1c], ebp
jne 0x18002a885
jmp 0x18002a710
mov ebp, 1
jmp 0x18002a885
mov ebp, 1
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x18002a8b7
test ebx, ebx
jle 0x18002a8b7
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18002a8a4
mov qword [rax], rdi
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18002a8b0
mov dword [rax], ebx
mov edi, 1
jmp 0x18002a8e5
test rdi, rdi
je 0x18002a8c8
mov rcx, rdi
call fcn.180035540
xor ebp, ebp
jmp 0x18002a8ca
xor ebp, ebp
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18002a8d7
mov qword [rax], rbp
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18002a8e3
mov dword [rax], ebp
mov edi, ebp
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r15d, r15d
je 0x18002a90c
mov rcx, qword [rsp + 0x38]
call fcn.180001c10
mov eax, edi
jmp 0x18002a96a
mov rcx, qword [rsp + 0x38]
call fcn.180001c10
mov eax, 1
jmp 0x18002a96a
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rsp + 0x38]
call fcn.180001c10
xor eax, eax
jmp 0x18002a96a
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18002a968
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x1138]
add rsp, 0x10f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret