Function at 0x14000d470
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8f8]
sub rsp, 0x9c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402bff08]
xor rax, rsp
mov qword [rbp + 0x898], rax
mov r14d, 4
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], r8
mov r12, r9
mov r15, r8
mov edi, edx
mov rbx, rcx
cmp edx, r14d
jl 0x14000debf
mov r8, r9
mov rdx, r15
xor ecx, ecx
call fcn.14000d1e0
movzx ecx, word [rbx]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx r13d, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx esi, ax
mov dword [rsp + 0x60], esi
mov r8d, esi
cmp esi, edi
jg 0x14000debf
mov edx, r13d
cmp r13d, 0xb
ja 0x14000d995
je 0x14000d985
sub edx, 1
je 0x14000d8e0
sub edx, 1
je 0x14000d73b
sub edx, 3
je 0x14000d66d
cmp edx, 1
jne 0x14000deb9
cmp si, r14w
jne 0x14000deb9
lea ecx, [rdx + 6]
call qword [sym.imp.WS2_32.dll_htons]
lea edi, [r14 + 4]
mov word [rbp + 0x890], ax
mov ecx, edi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402c3628]
mov word [rbp + 0x892], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402c3674]
mov word [rbp + 0x894], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, r12
lea rcx, [rbp + 0x890]
mov edx, edi
mov word [rbp + 0x896], ax
call r15
mov rdx, r12
mov rcx, r15
call fcn.14000d024
mov rcx, qword [0x1402c3648]
lea r12d, [r14 - 3]
xor r15d, r15d
test rcx, rcx
jne 0x14000d623
movsxd rcx, dword [0x1402c3668]
shl rcx, 3
call fcn.1401cd1cc
mov qword [0x1402c3648], rax
test rax, rax
je 0x14000def5
cmp dword [0x1402c3668], r15d
mov ebx, r15d
jle 0x14000deb9
mov esi, r15d
movsxd rcx, dword [0x1402c3670]
shl rcx, 3
call fcn.1401cd1cc
mov rcx, qword [0x1402c3648]
mov qword [rsi + rcx], rax
test rax, rax
je 0x14000df3b
mov eax, dword [0x1402c3668]
add ebx, r12d
add rsi, rdi
cmp ebx, eax
jl 0x14000d5ed
jmp 0x14000d629
mov eax, dword [0x1402c3668]
test eax, eax
jle 0x14000deb9
mov r9d, dword [0x1402c3670]
mov r8d, eax
test r9d, r9d
jle 0x14000d660
mov rdx, r15
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rdx + rax + 4], r15b
add rdx, rdi
sub r10, r12
jne 0x14000d646
add rcx, rdi
sub r8, r12
jne 0x14000d63b
jmp 0x14000deb9
cmp esi, 0xa
jb 0x14000d691
movzx ecx, word [rbx + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x14]
cmp eax, 0x1374
ja 0x14000d69b
mov dword [0x1402c3644], ecx
jmp 0x14000d69b
mov edi, 8
cmp si, di
jb 0x14000d6ba
movzx ecx, word [rbx + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x40]
cmp eax, 0xfc0
ja 0x14000d6c8
mov dword [0x1402c0c78], ecx
jmp 0x14000d6c8
mov edi, 6
cmp si, di
jb 0x14000deb9
movsx eax, byte [rbx + 5]
mov r12d, 1
movsx ecx, byte [rbx + 4]
cmp eax, r12d
jae 0x14000d6e4
mov dword [0x1402c0c84], r12d
jmp 0x14000d6f5
mov edx, 0x5a
cmp byte [rbx + 5], dl
cmova eax, edx
mov dword [0x1402c0c84], eax
xor r15d, r15d
cmp qword [0x1402c3688], r15
je 0x14000deb9
sub ecx, r12d
je 0x14000d72a
sub ecx, r12d
je 0x14000d721
cmp ecx, r12d
jne 0x14000deb9
lea rcx, str.image_tiff
jmp 0x14000d731
lea rcx, str.image_png
jmp 0x14000d731
lea rcx, str.image_jpeg
call fcn.14000f114
jmp 0x14000deb9
xor r15d, r15d
lea eax, [rsi - 0xa]
mov ecx, 0xfffd
movzx edi, r15w
test cx, ax
jne 0x14000deb9
movzx ecx, word [rbx + 6]
lea r12d, [r15 + 1]
mov dword [0x1402c3610], r12d
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 8]
xorps xmm7, xmm7
movzx eax, ax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1402c0c7c]
cvtsi2sd xmm7, eax
mulsd xmm7, qword [0x14029f678]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402c3658]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1402c0c7c]
mov r8d, dword [0x1402c3634]
movzx eax, ax
xorps xmm1, xmm1
xorps xmm4, xmm4
cvtsi2sd xmm1, ecx
cvtsi2sd xmm4, eax
mov eax, dword [0x1402c3654]
sub eax, dword [0x1402c3614]
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
mov eax, dword [0x1402c3640]
sub eax, dword [0x1402c3678]
mulsd xmm4, qword [0x14029f678]
andps xmm6, xmmword [0x14029f7b0]
addsd xmm6, xmm7
xorps xmm7, xmm7
cvtsi2sd xmm7, eax
lea eax, [r15 + 0xc]
divsd xmm4, xmm0
andps xmm7, xmmword [0x14029f7b0]
xorps xmm0, xmm0
addsd xmm7, xmm4
cvtsi2sd xmm0, dword [0x1402c363c]
divsd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm6, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm0, dword [0x1402c362c]
mulsd xmm6, qword [0x14029f698]
cvtsi2sd xmm1, r8d
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x14029f698]
cmp si, ax
jne 0x14000d865
movzx ecx, word [rbx + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402c3658]
movzx edi, ax
mov r8d, dword [0x1402c3634]
movzx edx, byte [rbx + 5]
cmp edx, 0x88
je 0x14000deb9
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov dword [rsp + 0x38], r15d
divsd xmm6, xmm0
movd xmm0, r8d
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rsp + 0x40], ecx
cvttsd2si eax, xmm7
mov dword [rsp + 0x44], eax
movsx eax, di
mov dword [rsp + 0x48], eax
mov eax, edx
or eax, 0xc001
mov dword [rsp + 0x4c], eax
test di, di
je 0x14000d8c4
or edx, 0xc801
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1402c35d0], rax
jmp 0x14000d96c
mov edi, 6
cmp si, di
jne 0x14000deb9
mov dil, byte [rbx + 4]
movzx ebx, byte [rbx + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x14000deb9
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x40], bx
mov dword [rsp + 0x38], r12d
cmp dil, r12b
jne 0x14000d92f
lea r13d, [r15 + 2]
mov dword [rsp + 0x44], r13d
jmp 0x14000d94d
cmp dil, 3
jne 0x14000d93f
mov dword [rsp + 0x44], 3
jmp 0x14000d94d
cmp dil, r14b
mov eax, r15d
cmove eax, r12d
mov dword [rsp + 0x44], eax
mov ecx, ebx
mov dword [rsp + 0x48], r15d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x42], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x50], rax
mov r8d, 0x28
lea rdx, [rsp + 0x38]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000deb9
mov rdx, r12
mov rcx, r15
call fcn.14000d024
jmp 0x14000deb9
sub edx, 0xc
je 0x14000de8f
sub edx, 1
je 0x14000de70
sub edx, 1
je 0x14000dd84
sub edx, 1
je 0x14000da2a
cmp edx, 0x46
jne 0x14000deb9
lea eax, [rdx - 0x3f]
cmp si, ax
jne 0x14000deb9
movzx esi, byte [rbx + 5]
mov eax, 0x100
mov r13b, byte [rbx + 4]
imul esi, eax
movzx eax, byte [rbx + 6]
add si, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x14000deb9
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x40], r15w
cmp r13b, r12b
mov dword [rsp + 0x38], r12d
lea edi, [r15 + 6]
mov dword [rsp + 0x48], r15d
cmove r14d, edi
mov word [rsp + 0x42], si
mov dword [rsp + 0x44], r14d
jmp 0x14000d961
mov r12d, 1
cmp byte [rbx + 4], r12b
jne 0x14000dbe7
mov ecx, dword [rbx + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rbx + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [0x1402c0c7c]
xor edx, edx
movzx eax, ax
shl eax, 0xa
div ecx
movzx ecx, word [rbx + 0xc]
mov r15d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
shl edi, 0xa
cmp dword [0x1402c35cc], r12d
jne 0x14000deb9
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x90
call fcn.1401c31c0
mov eax, dword [0x1402c3654]
lea r13d, [r12 + 1]
sub eax, dword [0x1402c3614]
xor edx, edx
movd xmm1, dword [0x1402c3658]
cvtdq2pd xmm1, xmm1
mov dword [rbp - 0x70], r13d
movzx r13d, byte [rbx + 5]
mov dword [rbp - 0x6c], r13d
mov dword [rbp - 0x64], esi
mov dword [rbp + 0x18], 0x5a
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [rbp + 0x1c], 0x7d00
andps xmm0, xmmword [0x14029f7b0]
cvttsd2si eax, xmm0
movd xmm0, dword [0x1402c363c]
add ax, r15w
xor r15d, r15d
movzx eax, ax
cvtdq2pd xmm0, xmm0
mov dword [rbp - 0x10], r15d
movd xmm2, eax
mov eax, edi
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
movd xmm1, dword [0x1402c3634]
cvtdq2pd xmm1, xmm1
mulsd xmm2, qword [0x14029f698]
cvttsd2si ecx, xmm2
movzx ebx, cx
mov ecx, dword [0x1402c3640]
sub ecx, dword [0x1402c3678]
mov dword [rbp - 0x50], ebx
movd xmm0, ecx
movzx ecx, word [0x1402c0c7c]
div ecx
cvtdq2pd xmm0, xmm0
lea rdx, [rbp - 0x70]
mov ecx, r12d
andps xmm0, xmmword [0x14029f7b0]
cvttsd2si r8d, xmm0
movd xmm0, dword [0x1402c362c]
add r8w, ax
cvtdq2pd xmm0, xmm0
movzx eax, r8w
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x14029f698]
cvttsd2si eax, xmm2
movzx edi, ax
lea eax, [r12 + 6]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x4c], edi
lea eax, [rdi - 2]
mov dword [rbp - 4], eax
lea eax, [rdi + 2]
mov dword [rbp + 4], eax
lea eax, [rbx - 2]
mov dword [rbp - 8], eax
lea eax, [rbx + 2]
mov dword [rbp], eax
call qword [0x1402c3600]
test eax, eax
jne 0x14000deb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9d, ebx
lea rcx, str.TOUCH1ERROR:_id_d__flags_d__x_d__y_d__err_ld_r_n
mov dword [rsp + 0x20], edi
mov r8d, esi
mov edx, r13d
call fcn.140001090
jmp 0x14000dd59
mov r13d, 2
cmp byte [rbx + 4], r13b
jne 0x14000deb9
cmp dword [0x1402c35cc], r12d
mov esi, dword [0x1402c0c7c]
mov dword [rsp + 0x30], esi
jne 0x14000deb9
mov eax, 0x38e38e39
lea ecx, [r8 - 5]
imul ecx
mov edi, edx
sar edi, 1
mov eax, edi
shr eax, 0x1f
add edi, eax
lea eax, [r13 + 0xe]
cmp edi, eax
cmovg edi, eax
xor r15d, r15d
movsxd rax, edi
mov qword [rsp + 0x78], rax
mov dword [rbp + 0x890], edi
test edi, edi
jle 0x14000dd2e
lea rax, [rbp - 0x50]
add rbx, 0xa
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov ecx, dword [rbx - 4]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rbx]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rbx, qword [rsp + 0x68]
mov r8d, 0x90
movzx eax, ax
shl eax, 0xa
cdq
idiv esi
xor edx, edx
lea rcx, [rbx - 0x20]
mov esi, eax
call fcn.1401c31c0
mov r8, qword [rsp + 0x68]
shl edi, 0xa
mov eax, edi
mov dword [rbx - 0x20], r13d
mov rbx, qword [rsp + 0x70]
cdq
idiv dword [rsp + 0x30]
movzx ecx, byte [rbx - 5]
add rbx, 9
mov dword [r8 - 0x1c], ecx
lea ecx, [rsi - 2]
mov dword [r8 + 0x4c], ecx
lea ecx, [rsi + 2]
mov dword [r8 + 0x54], ecx
lea ecx, [rax - 2]
mov dword [r8], eax
add eax, r13d
mov dword [r8 + 4], esi
mov esi, dword [rsp + 0x30]
mov dword [r8 + 0x50], eax
mov dword [r8 - 0x14], r14d
mov dword [r8 + 0x40], r15d
mov dword [r8 + 0x44], 7
mov dword [r8 + 0x68], 0x5a
mov dword [r8 + 0x6c], 0x7d00
mov dword [r8 + 0x48], ecx
add r8, 0x90
sub qword [rsp + 0x78], r12
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rbx
jne 0x14000dc58
mov edi, dword [rbp + 0x890]
mov r14d, 4
lea rdx, [rbp - 0x70]
mov ecx, edi
call qword [0x1402c3600]
test eax, eax
jne 0x14000deb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, edi
lea rcx, str.TOUCH2ERROR:_records_d__err_ld_r_n
mov r8d, eax
call fcn.140001090
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r14d
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
mov edx, r14d
lea rcx, [rsp + 0x30]
jmp 0x14000de67
mov r13d, dword [0x1402c35cc]
test r13d, r13d
jg 0x14000de27
xor edx, edx
lea rcx, str.User32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1402c35e8], rax
test rax, rax
je 0x14000de1a
lea rdx, str.InitializeTouchInjection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402c35e8]
lea rdx, str.InjectTouchInput
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c3600], rax
test rbx, rbx
je 0x14000de0d
test rax, rax
je 0x14000de0d
mov r12d, 1
mov ecx, 0x100
mov edx, r12d
call rbx
test eax, eax
je 0x14000de0d
mov dword [0x1402c35cc], r12d
mov r13d, r12d
jmp 0x14000de27
mov rcx, qword [0x1402c35e8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13d, 2
mov dword [0x1402c35cc], r13d
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htons]
mov edi, 6
mov word [rbp + 0x890], ax
mov ecx, edi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, r13w
mov word [rbp + 0x892], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x894], ax
mov edx, edi
lea rcx, [rbp + 0x890]
mov r8, qword [rbp - 0x80]
call qword [rbp - 0x78]
jmp 0x14000deb9
movzx ecx, word [rbx + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x14]
cmp eax, 0x1374
ja 0x14000deb9
mov dword [0x1402c3644], ecx
jmp 0x14000deb9
mov edi, 6
cmp si, di
jb 0x14000deb9
movzx ecx, word [rbx + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
xor r15d, r15d
cmp ecx, 0xffff
cmove ecx, r15d
mov dword [0x1402c3618], ecx
mov eax, dword [rsp + 0x60]
jmp 0x14000dec1
xor eax, eax
mov rcx, qword [rbp + 0x898]
xor rcx, rsp
call fcn.1401c0ed0
lea r11, [rsp + 0x9c0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.X:XYO_SecurityDevelopmentMeshAgent.CustommeshcoreKVMWindowskvm.c
mov edi, 0x1d4
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.14009718c
mov r8d, edi
lea rdx, str.X:XYO_SecurityDevelopmentMeshAgent.CustommeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, ebx
call fcn.1401c761c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.X:XYO_SecurityDevelopmentMeshAgent.CustommeshcoreKVMWindowskvm.c
mov edi, 0x1d5
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.14009718c
mov r8d, edi
lea rdx, str.X:XYO_SecurityDevelopmentMeshAgent.CustommeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, ebx
call fcn.1401c761c
int3