Function at 0x1400102e0
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x918]
sub rsp, 0x9d8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x14030cf00]
xor rax, rsp
mov qword [rbp + 0x8a8], rax
mov r14d, 4
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], r8
mov r12, r9
mov r15, r8
mov r13d, edx
mov rdi, rcx
cmp edx, r14d
jl 0x140010e23
mov rcx, qword [0x1403154d0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d_
mov dword [rsp + 0x20], edx
mov r8d, r14d
mov edx, 0x200
call fcn.1400acec4
mov r8, r12
mov rdx, r15
xor ecx, ecx
call fcn.140010044
movzx ecx, word [rdi]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rdi + 2]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [0x1403154d0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d__type___u__size___u_
movzx esi, ax
mov r8d, r14d
mov eax, esi
mov edx, 0x200
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x70], eax
call fcn.1400acec4
cmp esi, r13d
jg 0x140010e23
lea r13d, [r14 + 8]
cmp ebx, r13d
ja 0x140010888
je 0x140010856
sub ebx, 1
je 0x1400107b3
sub ebx, 1
je 0x140010618
sub ebx, 3
je 0x140010546
sub ebx, 1
je 0x14001040a
sub ebx, 2
je 0x140010e1d
cmp ebx, 3
jne 0x140010e1d
mov rdx, r12
mov rcx, r15
call fcn.14000fe08
jmp 0x140010e1d
cmp si, r14w
jne 0x140010e1d
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov ebx, 8
mov word [rbp + 0x8a0], ax
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1403154e4]
mov word [rbp + 0x8a2], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x140315530]
mov word [rbp + 0x8a4], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, r12
lea rcx, [rbp + 0x8a0]
mov edx, ebx
mov word [rbp + 0x8a6], ax
call r15
mov rdx, r12
mov rcx, r15
call fcn.14000fe08
mov rcx, qword [0x140315500]
lea r12d, [rbx - 7]
xor r15d, r15d
test rcx, rcx
jne 0x1400104fc
movsxd rcx, dword [0x14031551c]
shl rcx, 3
call fcn.1401ea40c
mov qword [0x140315500], rax
mov rcx, rax
test rax, rax
je 0x140010e56
mov eax, dword [0x14031551c]
mov esi, r15d
test eax, eax
jle 0x140010e1d
mov edi, r15d
movsxd rcx, dword [0x14031552c]
shl rcx, 3
call fcn.1401ea40c
mov rcx, qword [0x140315500]
mov qword [rdi + rcx], rax
test rax, rax
je 0x140010e9c
mov eax, dword [0x14031551c]
add esi, r12d
add rdi, rbx
cmp esi, eax
jl 0x1400104c6
jmp 0x140010502
mov eax, dword [0x14031551c]
test eax, eax
jle 0x140010e1d
mov r9d, dword [0x14031552c]
mov r8d, eax
test r9d, r9d
jle 0x140010539
mov rdx, r15
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rax + rdx + 4], r15b
add rdx, rbx
sub r10, r12
jne 0x14001051f
add rcx, rbx
sub r8, r12
jne 0x140010514
jmp 0x140010e1d
cmp esi, 0xa
jb 0x14001056a
movzx ecx, word [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x14]
cmp eax, 0x1374
ja 0x140010574
mov dword [0x140315508], ecx
jmp 0x140010574
mov ebx, 8
cmp si, bx
jb 0x140010593
movzx ecx, word [rdi + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x40]
cmp eax, 0xfc0
ja 0x1400105a1
mov dword [0x14030dc18], ecx
jmp 0x1400105a1
mov ebx, 6
cmp si, bx
jb 0x140010e1d
movsx edx, byte [rdi + 5]
mov r12d, 1
movsx ecx, byte [rdi + 4]
mov dword [0x14030dc24], edx
cmp edx, r12d
jae 0x1400105c3
mov dword [0x14030dc24], r12d
jmp 0x1400105d2
cmp dl, 0x5a
jbe 0x1400105d2
mov dword [0x14030dc24], 0x5a
xor r15d, r15d
cmp qword [0x140315548], r15
je 0x140010e1d
sub ecx, r12d
je 0x140010607
sub ecx, r12d
je 0x1400105fe
cmp ecx, r12d
jne 0x140010e1d
lea rcx, str.image_tiff
jmp 0x14001060e
lea rcx, str.image_png
jmp 0x14001060e
lea rcx, str.image_jpeg
call fcn.1400122fc
jmp 0x140010e1d
xor r15d, r15d
lea eax, [rsi - 0xa]
mov ecx, 0xfffd
movzx ebx, r15w
test cx, ax
jne 0x140010e1d
movzx ecx, word [rdi + 6]
lea r12d, [r15 + 1]
mov dword [0x14031548c], r12d
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rdi + 8]
xorps xmm7, xmm7
movzx eax, ax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x14030dc1c]
cvtsi2sd xmm7, eax
mulsd xmm7, qword [0x1402eb6e8]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x140315514]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x14030dc1c]
movzx eax, ax
xorps xmm1, xmm1
xorps xmm4, xmm4
cvtsi2sd xmm4, eax
mov eax, dword [0x140315510]
sub eax, dword [0x1403154c8]
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
mov eax, dword [0x1403154fc]
sub eax, dword [0x140315534]
mulsd xmm4, qword [0x1402eb6e8]
andps xmm6, xmmword [0x1402eb820]
addsd xmm6, xmm7
xorps xmm7, xmm7
cvtsi2sd xmm1, ecx
divsd xmm4, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1403154f8]
cvtsi2sd xmm7, eax
mov eax, dword [0x1403154f0]
divsd xmm1, xmm0
andps xmm7, xmmword [0x1402eb820]
xorps xmm0, xmm0
mulsd xmm6, xmm1
xorps xmm1, xmm1
addsd xmm7, xmm4
cvtsi2sd xmm0, dword [0x1403154e8]
mulsd xmm6, qword [0x1402eb708]
cvtsi2sd xmm1, eax
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402eb708]
cmp si, r13w
jne 0x14001073c
movzx ecx, word [rdi + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x140315514]
movzx ebx, ax
mov eax, dword [0x1403154f0]
movzx edx, byte [rdi + 5]
cmp edx, 0x88
je 0x140010e1d
movd xmm0, ecx
or edx, 0xc001
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x5c], edx
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rsp + 0x50], ecx
cvttsd2si eax, xmm7
mov dword [rsp + 0x54], eax
movsx eax, bx
mov dword [rsp + 0x58], eax
test bx, bx
je 0x140010797
bts edx, 0xb
mov dword [rsp + 0x5c], edx
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x140315480], rax
jmp 0x14001083d
mov ebx, 6
cmp si, bx
jne 0x140010e1d
mov bl, byte [rdi + 4]
movzx edi, byte [rdi + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x140010e1d
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x50], di
mov dword [rsp + 0x48], r12d
cmp bl, r12b
jne 0x140010801
lea r13d, [r15 + 2]
mov dword [rsp + 0x54], r13d
jmp 0x14001081e
cmp bl, 3
jne 0x140010810
mov dword [rsp + 0x54], 3
jmp 0x14001081e
cmp bl, r14b
mov eax, r15d
cmove eax, r12d
mov dword [rsp + 0x54], eax
mov ecx, edi
mov dword [rsp + 0x58], r15d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x52], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x60], rax
mov r8d, 0x28
lea rdx, [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x140010e1d
mov ebx, 6
cmp si, bx
jb 0x140010e1d
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor r15d, r15d
cmp eax, 0xffff
cmove eax, r15d
mov dword [0x1403154cc], eax
jmp 0x140010e1d
sub ebx, 0xd
je 0x140010dff
sub ebx, 1
je 0x140010d15
sub ebx, 1
je 0x1400109bc
sub ebx, 0x46
je 0x14001094e
mov r13d, 2
cmp ebx, r13d
jne 0x140010e1d
lea ebx, [r13 + 3]
cmp si, bx
jne 0x140010e1d
movsx ecx, byte [rdi + 4]
xor r15d, r15d
test ecx, ecx
je 0x1400108fe
sub ecx, 1
je 0x1400108e2
cmp ecx, 1
je 0x14001090d
jmp 0x140010e1d
mov r12d, 1
mov ecx, r12d
mov byte [0x140315364], r12b
call qword [sym.imp.USER32.dll_BlockInput]
mov r12, qword [rbp - 0x80]
jmp 0x14001090d
xor ecx, ecx
mov byte [0x140315364], r15b
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, ebx
mov word [rbp + 0x8a0], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x8a2], ax
mov r8, r12
mov al, byte [0x140315364]
lea rcx, [rbp + 0x8a0]
mov byte [rbp + 0x8a4], al
mov edx, ebx
call qword [rbp - 0x78]
jmp 0x140010e1d
mov eax, 7
cmp si, ax
jne 0x140010e1d
movzx esi, byte [rdi + 5]
mov eax, 0x100
mov r13b, byte [rdi + 4]
imul esi, eax
movzx eax, byte [rdi + 6]
add si, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x140010e1d
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x50], r15w
cmp r13b, r12b
mov dword [rsp + 0x48], r12d
lea ebx, [r15 + 6]
mov dword [rsp + 0x58], r15d
cmove r14d, ebx
mov word [rsp + 0x52], si
mov dword [rsp + 0x54], r14d
jmp 0x140010832
mov r12d, 1
cmp byte [rdi + 4], r12b
jne 0x140010b79
mov ecx, dword [rdi + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rdi + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [0x14030dc1c]
xor edx, edx
movzx eax, ax
shl eax, 0xa
div ecx
movzx ecx, word [rdi + 0xc]
mov r15d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
shl ebx, 0xa
cmp dword [0x140315488], r12d
jne 0x140010b9c
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x90
call fcn.14020e630
mov eax, dword [0x140315510]
lea r13d, [r12 + 1]
sub eax, dword [0x1403154c8]
xor edx, edx
movd xmm1, dword [0x140315514]
cvtdq2pd xmm1, xmm1
mov dword [rbp - 0x60], r13d
movzx r13d, byte [rdi + 5]
mov dword [rbp - 0x5c], r13d
mov dword [rbp - 0x54], esi
mov dword [rbp + 0x28], 0x5a
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [rbp + 0x2c], 0x7d00
andps xmm0, xmmword [0x1402eb820]
cvttsd2si eax, xmm0
movd xmm0, dword [0x1403154f8]
add ax, r15w
xor r15d, r15d
movzx eax, ax
cvtdq2pd xmm0, xmm0
mov dword [rbp], r15d
movd xmm2, eax
mov eax, ebx
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
movd xmm1, dword [0x1403154f0]
cvtdq2pd xmm1, xmm1
mulsd xmm2, qword [0x1402eb708]
cvttsd2si ecx, xmm2
movzx edi, cx
mov ecx, dword [0x1403154fc]
sub ecx, dword [0x140315534]
mov dword [rbp - 0x40], edi
movd xmm0, ecx
movzx ecx, word [0x14030dc1c]
div ecx
cvtdq2pd xmm0, xmm0
lea rdx, [rbp - 0x60]
mov ecx, r12d
andps xmm0, xmmword [0x1402eb820]
cvttsd2si r8d, xmm0
movd xmm0, dword [0x1403154e8]
add r8w, ax
cvtdq2pd xmm0, xmm0
movzx eax, r8w
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402eb708]
cvttsd2si eax, xmm2
movzx ebx, ax
lea eax, [r12 + 6]
mov dword [rbp + 4], eax
mov dword [rbp - 0x3c], ebx
lea eax, [rbx - 2]
mov dword [rbp + 0xc], eax
lea eax, [rbx + 2]
mov dword [rbp + 0x14], eax
lea eax, [rdi - 2]
mov dword [rbp + 8], eax
lea eax, [rdi + 2]
mov dword [rbp + 0x10], eax
call qword [0x1403154b8]
test eax, eax
jne 0x140010cdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9d, edi
lea rcx, str.TOUCH1ERROR:_id_u__flags_u__x_u__y_u__err_ld_r_n
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov edx, r13d
call fcn.14000105c
jmp 0x140010cda
mov r13d, 2
cmp byte [rdi + 4], r13b
jne 0x140010e1d
cmp dword [0x140315488], r12d
mov eax, dword [0x14030dc1c]
mov dword [rsp + 0x40], eax
je 0x140010ba4
xor r15d, r15d
jmp 0x140010cdd
mov eax, 0x38e38e39
lea ecx, [rsi - 5]
imul ecx
mov ebx, edx
sar ebx, 1
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, reloc.WS2_32.dll_recv
cmp ebx, eax
cmovg ebx, eax
xor r15d, r15d
movsxd rax, ebx
mov qword [rbp - 0x68], rax
mov dword [rbp + 0x8a0], ebx
test ebx, ebx
jle 0x140010cb3
lea rbx, [rbp - 0x40]
lea rsi, [rdi + 0xa]
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x78], rsi
mov ecx, dword [rsi - 4]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rsi]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rsi + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov r8d, 0x90
shl eax, 0xa
lea rcx, [rbx - 0x20]
cdq
idiv dword [rsp + 0x40]
xor edx, edx
mov esi, eax
call fcn.14020e630
mov rax, qword [rsp + 0x78]
shl edi, 0xa
mov dword [rbx - 0x20], r13d
mov rbx, qword [rbp - 0x70]
movzx ecx, byte [rax - 5]
mov eax, edi
cdq
idiv dword [rsp + 0x40]
mov dword [rbx - 0x1c], ecx
lea ecx, [rsi - 2]
mov dword [rbx + 0x4c], ecx
lea ecx, [rsi + 2]
mov dword [rbx + 4], esi
mov rsi, qword [rsp + 0x78]
mov dword [rbx + 0x54], ecx
add rsi, 9
lea ecx, [rax - 2]
mov dword [rbx], eax
add eax, r13d
mov dword [rbx - 0x14], r14d
mov dword [rbx + 0x50], eax
mov dword [rbx + 0x40], r15d
mov dword [rbx + 0x44], 7
mov dword [rbx + 0x68], 0x5a
mov dword [rbx + 0x6c], 0x7d00
mov dword [rbx + 0x48], ecx
add rbx, 0x90
sub qword [rbp - 0x68], r12
mov qword [rbp - 0x70], rbx
mov qword [rsp + 0x78], rsi
jne 0x140010bec
mov ebx, dword [rbp + 0x8a0]
mov r14d, 4
lea rdx, [rbp - 0x60]
mov ecx, ebx
call qword [0x1403154b8]
test eax, eax
jne 0x140010cdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebx
lea rcx, str.TOUCH2ERROR:_records_d__err_ld_r_n
mov r8d, eax
call fcn.14000105c
mov r15d, r12d
cmp r15d, r12d
jne 0x140010e1d
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r14d
mov word [rsp + 0x40], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x80]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x42], ax
mov edx, r14d
jmp 0x140010946
mov r13d, dword [0x140315488]
test r13d, r13d
jg 0x140010db8
xor edx, edx
lea rcx, str.User32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1403154a0], rax
test rax, rax
je 0x140010dab
lea rdx, str.InitializeTouchInjection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1403154a0]
lea rdx, str.InjectTouchInput
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403154b8], rax
test rbx, rbx
je 0x140010d9e
test rax, rax
je 0x140010d9e
mov r12d, 1
mov ecx, 0x100
mov edx, r12d
call rbx
test eax, eax
je 0x140010d9e
mov dword [0x140315488], r12d
mov r13d, r12d
jmp 0x140010db8
mov rcx, qword [0x1403154a0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13d, 2
mov dword [0x140315488], r13d
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htons]
mov ebx, 6
mov word [rbp + 0x8a0], ax
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, r13w
mov word [rbp + 0x8a2], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0x8a0]
mov word [rbp + 0x8a4], ax
jmp 0x140010944
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [rdx - 0x14]
cmp ecx, 0x1374
ja 0x140010e1d
mov dword [0x140315508], edx
mov eax, dword [rsp + 0x70]
jmp 0x140010e25
xor eax, eax
mov rcx, qword [rbp + 0x8a8]
xor rcx, rsp
call fcn.1401d9e80
lea r11, [rsp + 0x9d8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:Users_anfdhDownloadsMeshAgent_masterMeshAgent_mastermeshcoreKVMWindowskvm.c
mov edi, 0x21f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400aa25c
mov r8d, edi
lea rdx, str.C:Users_anfdhDownloadsMeshAgent_masterMeshAgent_mastermeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.14000105c
mov ecx, ebx
call fcn.1401e0110
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:Users_anfdhDownloadsMeshAgent_masterMeshAgent_mastermeshcoreKVMWindowskvm.c
mov edi, 0x220
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400aa25c
mov r8d, edi
lea rdx, str.C:Users_anfdhDownloadsMeshAgent_masterMeshAgent_mastermeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.14000105c
mov ecx, ebx
call fcn.1401e0110
int3