Function at 0x1400102b0
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x918]
sub rsp, 0x9d8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x14030ef00]
xor rax, rsp
mov qword [rbp + 0x8a8], rax
mov r14d, 4
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], r8
mov r12, r9
mov r15, r8
mov r13d, edx
mov rdi, rcx
cmp edx, r14d
jl 0x140010df9
mov rcx, qword [0x1403174d0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d_
mov dword [rsp + 0x20], edx
mov r8d, r14d
mov edx, 0x200
call fcn.1400acf60
mov r8, r12
mov rdx, r15
xor ecx, ecx
call fcn.140010014
movzx ecx, word [rdi]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rdi + 2]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [0x1403174d0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d__type___u__size___u_
movzx esi, ax
mov r8d, r14d
mov eax, esi
mov edx, 0x200
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x70], eax
call fcn.1400acf60
cmp esi, r13d
jg 0x140010df9
lea r13d, [r14 + 8]
cmp ebx, r13d
ja 0x14001085f
je 0x14001082d
sub ebx, 1
je 0x14001078a
sub ebx, 1
je 0x1400105e8
sub ebx, 3
je 0x140010516
sub ebx, 1
je 0x1400103da
sub ebx, 2
je 0x140010df3
cmp ebx, 3
jne 0x140010df3
mov rdx, r12
mov rcx, r15
call fcn.14000fdd8
jmp 0x140010df3
cmp si, r14w
jne 0x140010df3
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov ebx, 8
mov word [rbp + 0x8a0], ax
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1403174e4]
mov word [rbp + 0x8a2], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x140317530]
mov word [rbp + 0x8a4], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, r12
lea rcx, [rbp + 0x8a0]
mov edx, ebx
mov word [rbp + 0x8a6], ax
call r15
mov rdx, r12
mov rcx, r15
call fcn.14000fdd8
mov rcx, qword [0x140317500]
lea r12d, [rbx - 7]
xor r15d, r15d
test rcx, rcx
jne 0x1400104cc
movsxd rcx, dword [0x14031751c]
shl rcx, 3
call fcn.1401ed1fc
mov qword [0x140317500], rax
mov rcx, rax
test rax, rax
je 0x140010e2c
mov eax, dword [0x14031751c]
mov esi, r15d
test eax, eax
jle 0x140010df3
mov edi, r15d
movsxd rcx, dword [0x14031752c]
shl rcx, 3
call fcn.1401ed1fc
mov rcx, qword [0x140317500]
mov qword [rdi + rcx], rax
test rax, rax
je 0x140010e72
mov eax, dword [0x14031751c]
add esi, r12d
add rdi, rbx
cmp esi, eax
jl 0x140010496
jmp 0x1400104d2
mov eax, dword [0x14031751c]
test eax, eax
jle 0x140010df3
mov r9d, dword [0x14031752c]
mov r8d, eax
test r9d, r9d
jle 0x140010509
mov rdx, r15
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rax + rdx + 4], r15b
add rdx, rbx
sub r10, r12
jne 0x1400104ef
add rcx, rbx
sub r8, r12
jne 0x1400104e4
jmp 0x140010df3
cmp esi, 0xa
jb 0x14001053a
movzx ecx, word [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x14]
cmp eax, 0x1374
ja 0x140010544
mov dword [0x140317508], ecx
jmp 0x140010544
mov ebx, 8
cmp si, bx
jb 0x140010563
movzx ecx, word [rdi + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x40]
cmp eax, 0xfc0
ja 0x140010571
mov dword [0x14030fc08], ecx
jmp 0x140010571
mov ebx, 6
cmp si, bx
jb 0x140010df3
movsx edx, byte [rdi + 5]
mov r12d, 1
movsx ecx, byte [rdi + 4]
mov dword [0x14030fc14], edx
cmp edx, r12d
jae 0x140010593
mov dword [0x14030fc14], r12d
jmp 0x1400105a2
cmp dl, 0x5a
jbe 0x1400105a2
mov dword [0x14030fc14], 0x5a
xor r15d, r15d
cmp qword [0x140317548], r15
je 0x140010df3
sub ecx, r12d
je 0x1400105d7
sub ecx, r12d
je 0x1400105ce
cmp ecx, r12d
jne 0x140010df3
lea rcx, str.image_tiff
jmp 0x1400105de
lea rcx, str.image_png
jmp 0x1400105de
lea rcx, str.image_jpeg
call fcn.1400122d0
jmp 0x140010df3
xor r15d, r15d
lea eax, [rsi - 0xa]
mov ecx, 0xfffd
movzx ebx, r15w
test cx, ax
jne 0x140010df3
movzx ecx, word [rdi + 6]
lea r12d, [r15 + 1]
mov dword [0x14031748c], r12d
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rdi + 8]
xorps xmm7, xmm7
movzx eax, ax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x14030fc0c]
cvtsi2sd xmm7, eax
mulsd xmm7, qword [0x1402ed290]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x140317514]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x14030fc0c]
mov r8d, dword [0x1403174f0]
movzx eax, ax
xorps xmm1, xmm1
xorps xmm4, xmm4
cvtsi2sd xmm1, edx
cvtsi2sd xmm4, eax
mov eax, dword [0x140317510]
sub eax, dword [0x1403174c8]
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
mov eax, dword [0x1403174fc]
sub eax, dword [0x140317534]
mulsd xmm4, qword [0x1402ed290]
andps xmm6, xmmword [0x1402ed3d0]
addsd xmm6, xmm7
xorps xmm7, xmm7
cvtsi2sd xmm7, eax
divsd xmm4, xmm0
andps xmm7, xmmword [0x1402ed3d0]
xorps xmm0, xmm0
addsd xmm7, xmm4
cvtsi2sd xmm0, dword [0x1403174f8]
divsd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm6, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm0, dword [0x1403174e8]
mulsd xmm6, qword [0x1402ed2b0]
cvtsi2sd xmm1, r8d
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402ed2b0]
cmp si, r13w
jne 0x14001070f
movzx ecx, word [rdi + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x140317514]
movzx ebx, ax
mov r8d, dword [0x1403174f0]
movzx ecx, byte [rdi + 5]
cmp ecx, 0x88
je 0x140010df3
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mov dword [rsp + 0x48], r15d
divsd xmm6, xmm0
movd xmm0, r8d
cvtdq2pd xmm0, xmm0
cvttsd2si eax, xmm6
divsd xmm7, xmm0
mov dword [rsp + 0x50], eax
cvttsd2si eax, xmm7
mov dword [rsp + 0x54], eax
movsx eax, bx
mov dword [rsp + 0x58], eax
mov eax, ecx
or eax, 0xc001
mov dword [rsp + 0x5c], eax
test bx, bx
je 0x14001076e
or ecx, 0xc801
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x140317480], rax
jmp 0x140010814
mov ebx, 6
cmp si, bx
jne 0x140010df3
mov bl, byte [rdi + 4]
movzx edi, byte [rdi + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x140010df3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x50], di
mov dword [rsp + 0x48], r12d
cmp bl, r12b
jne 0x1400107d8
lea r13d, [r15 + 2]
mov dword [rsp + 0x54], r13d
jmp 0x1400107f5
cmp bl, 3
jne 0x1400107e7
mov dword [rsp + 0x54], 3
jmp 0x1400107f5
cmp bl, r14b
mov eax, r15d
cmove eax, r12d
mov dword [rsp + 0x54], eax
mov ecx, edi
mov dword [rsp + 0x58], r15d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x52], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x60], rax
mov r8d, 0x28
lea rdx, [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x140010df3
mov ebx, 6
cmp si, bx
jb 0x140010df3
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor r15d, r15d
cmp eax, 0xffff
cmove eax, r15d
mov dword [0x1403174cc], eax
jmp 0x140010df3
sub ebx, 0xd
je 0x140010dd5
sub ebx, 1
je 0x140010ceb
sub ebx, 1
je 0x140010993
sub ebx, 0x46
je 0x140010925
mov r13d, 2
cmp ebx, r13d
jne 0x140010df3
lea ebx, [r13 + 3]
cmp si, bx
jne 0x140010df3
movsx ecx, byte [rdi + 4]
xor r15d, r15d
test ecx, ecx
je 0x1400108d5
sub ecx, 1
je 0x1400108b9
cmp ecx, 1
je 0x1400108e4
jmp 0x140010df3
mov r12d, 1
mov ecx, r12d
mov byte [0x140317364], r12b
call qword [sym.imp.USER32.dll_BlockInput]
mov r12, qword [rbp - 0x80]
jmp 0x1400108e4
xor ecx, ecx
mov byte [0x140317364], r15b
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, ebx
mov word [rbp + 0x8a0], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x8a2], ax
mov r8, r12
mov al, byte [0x140317364]
lea rcx, [rbp + 0x8a0]
mov byte [rbp + 0x8a4], al
mov edx, ebx
call qword [rbp - 0x78]
jmp 0x140010df3
mov eax, 7
cmp si, ax
jne 0x140010df3
movzx esi, byte [rdi + 5]
mov eax, 0x100
mov r13b, byte [rdi + 4]
imul esi, eax
movzx eax, byte [rdi + 6]
add si, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x140010df3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x50], r15w
cmp r13b, r12b
mov dword [rsp + 0x48], r12d
lea ebx, [r15 + 6]
mov dword [rsp + 0x58], r15d
cmove r14d, ebx
mov word [rsp + 0x52], si
mov dword [rsp + 0x54], r14d
jmp 0x140010809
mov r12d, 1
cmp byte [rdi + 4], r12b
jne 0x140010b5c
mov ecx, dword [rdi + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rdi + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [0x14030fc0c]
xor edx, edx
movzx eax, ax
shl eax, 0xa
div ecx
movzx ecx, word [rdi + 0xc]
mov r15d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
shl ebx, 0xa
cmp dword [0x140317488], r12d
je 0x1400109ed
xor r15d, r15d
jmp 0x140010b4e
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x90
call fcn.140211420
mov eax, dword [0x140317510]
xor edx, edx
sub eax, dword [0x1403174c8]
mov r13d, 2
movd xmm1, dword [0x140317514]
cvtdq2pd xmm1, xmm1
mov dword [rbp - 0x60], r13d
movzx r13d, byte [rdi + 5]
mov dword [rbp - 0x5c], r13d
mov dword [rbp - 0x54], esi
mov dword [rbp + 0x28], 0x5a
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [rbp + 0x2c], 0x7d00
andps xmm0, xmmword [0x1402ed3d0]
cvttsd2si eax, xmm0
movd xmm0, dword [0x1403174f8]
add ax, r15w
xor r15d, r15d
movzx eax, ax
cvtdq2pd xmm0, xmm0
mov dword [rbp], r15d
movd xmm2, eax
mov eax, ebx
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
movd xmm1, dword [0x1403174f0]
cvtdq2pd xmm1, xmm1
mulsd xmm2, qword [0x1402ed2b0]
cvttsd2si ecx, xmm2
movzx edi, cx
mov ecx, dword [0x1403174fc]
sub ecx, dword [0x140317534]
mov dword [rbp - 0x40], edi
movd xmm0, ecx
movzx ecx, word [0x14030fc0c]
div ecx
cvtdq2pd xmm0, xmm0
lea rdx, [rbp - 0x60]
mov ecx, r12d
andps xmm0, xmmword [0x1402ed3d0]
cvttsd2si r8d, xmm0
movd xmm0, dword [0x1403174e8]
add r8w, ax
cvtdq2pd xmm0, xmm0
movzx eax, r8w
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402ed2b0]
cvttsd2si eax, xmm2
movzx ebx, ax
lea eax, [r15 + 7]
mov dword [rbp + 4], eax
mov dword [rbp - 0x3c], ebx
lea eax, [rbx - 2]
mov dword [rbp + 0xc], eax
lea eax, [rbx + 2]
mov dword [rbp + 0x14], eax
lea eax, [rdi - 2]
mov dword [rbp + 8], eax
lea eax, [rdi + 2]
mov dword [rbp + 0x10], eax
call qword [0x1403174b8]
test eax, eax
jne 0x140010b4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9d, edi
lea rcx, str.TOUCH1ERROR:_id_u__flags_u__x_u__y_u__err_ld_r_n
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov edx, r13d
call fcn.14000105c
mov r15d, r12d
cmp r15d, r12d
jne 0x140010df3
jmp 0x140010cbc
mov r13d, 2
cmp byte [rdi + 4], r13b
jne 0x140010df3
cmp dword [0x140317488], r12d
mov eax, dword [0x14030fc0c]
mov dword [rsp + 0x40], eax
jne 0x140010df3
mov eax, 0x38e38e39
lea ecx, [rsi - 5]
imul ecx
mov ebx, edx
sar ebx, 1
mov eax, ebx
shr eax, 0x1f
add ebx, eax
lea eax, [r13 + 0xe]
cmp ebx, eax
cmovg ebx, eax
xor r15d, r15d
movsxd rax, ebx
mov qword [rbp - 0x68], rax
mov dword [rbp + 0x8a0], ebx
test ebx, ebx
jle 0x140010c91
lea rbx, [rbp - 0x40]
lea rsi, [rdi + 0xa]
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x78], rsi
mov ecx, dword [rsi - 4]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rsi]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rsi + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov r8d, 0x90
shl eax, 0xa
lea rcx, [rbx - 0x20]
cdq
idiv dword [rsp + 0x40]
xor edx, edx
mov esi, eax
call fcn.140211420
mov rax, qword [rsp + 0x78]
shl edi, 0xa
mov dword [rbx - 0x20], r13d
mov rbx, qword [rbp - 0x70]
movzx ecx, byte [rax - 5]
mov eax, edi
cdq
idiv dword [rsp + 0x40]
mov dword [rbx - 0x1c], ecx
lea ecx, [rsi - 2]
mov dword [rbx + 0x4c], ecx
lea ecx, [rsi + 2]
mov dword [rbx + 4], esi
mov rsi, qword [rsp + 0x78]
mov dword [rbx + 0x54], ecx
add rsi, 9
lea ecx, [rax - 2]
mov dword [rbx], eax
add eax, r13d
mov dword [rbx - 0x14], r14d
mov dword [rbx + 0x50], eax
mov dword [rbx + 0x40], r15d
mov dword [rbx + 0x44], 7
mov dword [rbx + 0x68], 0x5a
mov dword [rbx + 0x6c], 0x7d00
mov dword [rbx + 0x48], ecx
add rbx, 0x90
sub qword [rbp - 0x68], r12
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x78], rsi
jne 0x140010bca
mov ebx, dword [rbp + 0x8a0]
mov r14d, 4
lea rdx, [rbp - 0x60]
mov ecx, ebx
call qword [0x1403174b8]
test eax, eax
jne 0x140010df3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebx
lea rcx, str.TOUCH2ERROR:_records_d__err_ld_r_n
mov r8d, eax
call fcn.14000105c
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r14d
mov word [rsp + 0x40], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x80]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x42], ax
mov edx, r14d
jmp 0x14001091d
mov r13d, dword [0x140317488]
test r13d, r13d
jg 0x140010d8e
xor edx, edx
lea rcx, str.User32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1403174a0], rax
test rax, rax
je 0x140010d81
lea rdx, str.InitializeTouchInjection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1403174a0]
lea rdx, str.InjectTouchInput
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403174b8], rax
test rbx, rbx
je 0x140010d74
test rax, rax
je 0x140010d74
mov r12d, 1
mov ecx, 0x100
mov edx, r12d
call rbx
test eax, eax
je 0x140010d74
mov dword [0x140317488], r12d
mov r13d, r12d
jmp 0x140010d8e
mov rcx, qword [0x1403174a0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13d, 2
mov dword [0x140317488], r13d
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htons]
mov ebx, 6
mov word [rbp + 0x8a0], ax
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, r13w
mov word [rbp + 0x8a2], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0x8a0]
mov word [rbp + 0x8a4], ax
jmp 0x14001091b
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [rdx - 0x14]
cmp ecx, 0x1374
ja 0x140010df3
mov dword [0x140317508], edx
mov eax, dword [rsp + 0x70]
jmp 0x140010dfb
xor eax, eax
mov rcx, qword [rbp + 0x8a8]
xor rcx, rsp
call fcn.1401dbdb0
lea r11, [rsp + 0x9d8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:Users_anfdhDownloads_bvavMeshAgent_mastermeshcoreKVMWindowskvm.c
mov edi, 0x21f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400aa2f8
mov r8d, edi
lea rdx, str.C:Users_anfdhDownloads_bvavMeshAgent_mastermeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.14000105c
mov ecx, ebx
call fcn.1401e2ef8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:Users_anfdhDownloads_bvavMeshAgent_mastermeshcoreKVMWindowskvm.c
mov edi, 0x220
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400aa2f8
mov r8d, edi
lea rdx, str.C:Users_anfdhDownloads_bvavMeshAgent_mastermeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.14000105c
mov ecx, ebx
call fcn.1401e2ef8
int3