Function at 0x14000f418
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x140301ed0]
xor rax, rsp
mov qword [rbp - 0x19], rax
mov r12d, 4
mov qword [rbp - 0x29], r9
mov r14, r9
mov r13, r8
mov esi, edx
mov r15, rcx
cmp edx, r12d
jge 0x14000f469
xor eax, eax
jmp 0x14000fc94
mov rcx, qword [0x14030a2f0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d_
mov r8d, r12d
mov dword [rsp + 0x20], esi
mov edx, 0x200
call fcn.1400aba58
mov r8, r14
mov rdx, r13
xor ecx, ecx
call fcn.14000f17c
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 2]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [0x14030a2f0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d__type___u__size___u_
movzx edi, ax
mov r8d, r12d
mov eax, edi
mov edx, 0x200
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
mov dword [rbp - 0x59], eax
call fcn.1400aba58
cmp edi, esi
jg 0x14000f462
mov eax, ntohs
cmp ebx, eax
ja 0x14000f99a
je 0x14000f969
sub ebx, 1
je 0x14000f8cf
sub ebx, 1
je 0x14000f730
sub ebx, 3
je 0x14000f660
sub ebx, 1
je 0x14000f535
sub ebx, 2
je 0x14000fc91
cmp ebx, 3
jne 0x14000fc91
mov rdx, r14
mov rcx, r13
call fcn.14000ef38
jmp 0x14000fc91
cmp di, r12w
jne 0x14000fc91
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 8
mov word [rbp - 0x21], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x14030a300]
mov word [rbp - 0x1f], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x14030a34c]
mov word [rbp - 0x1d], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, r14
lea rcx, [rbp - 0x21]
mov edx, esi
mov word [rbp - 0x1b], ax
call r13
mov rdx, r14
mov rcx, r13
call fcn.14000ef38
mov rcx, qword [0x14030a320]
lea r14d, [rsi - 7]
xor ebx, ebx
test rcx, rcx
jne 0x14000f617
movsxd rcx, dword [0x14030a340]
shl rcx, 3
call fcn.1401e3670
mov qword [0x14030a320], rax
mov rcx, rax
test rax, rax
je 0x14000fcc2
mov eax, dword [0x14030a340]
mov r15d, ebx
test eax, eax
jle 0x14000fc91
mov edi, ebx
movsxd rcx, dword [0x14030a348]
shl rcx, 3
call fcn.1401e3670
mov rcx, qword [0x14030a320]
mov qword [rdi + rcx], rax
test rax, rax
je 0x14000fd08
mov eax, dword [0x14030a340]
add r15d, r14d
add rdi, rsi
cmp r15d, eax
jl 0x14000f5e0
jmp 0x14000f61d
mov eax, dword [0x14030a340]
test eax, eax
jle 0x14000fc91
mov r9d, dword [0x14030a348]
mov r8d, eax
test r9d, r9d
jle 0x14000f653
mov rdx, rbx
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rdx + rax + 4], bl
add rdx, rsi
sub r10, r14
jne 0x14000f63a
add rcx, rsi
sub r8, r14
jne 0x14000f62f
jmp 0x14000fc91
cmp di, 0xa
jb 0x14000f68b
movzx ecx, word [r15 + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x14030a31c]
movzx edx, ax
lea eax, [rdx - 0x14]
cmp eax, 0x1374
cmovbe ecx, edx
mov dword [0x14030a31c], ecx
mov esi, 8
cmp di, si
jb 0x14000f6ba
movzx ecx, word [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x140302a78]
movzx edx, ax
lea eax, [rdx - 0x40]
cmp eax, 0xfc0
cmovbe ecx, edx
mov dword [0x140302a78], ecx
mov esi, 6
cmp di, si
jb 0x14000fc91
movsx eax, byte [r15 + 5]
lea r14d, [rsi - 5]
movsx ecx, byte [r15 + 4]
lea edx, [rsi + 0x54]
cmp eax, r14d
cmovb eax, r14d
cmp eax, edx
cmova eax, edx
xor ebx, ebx
cmp qword [0x14030a360], rbx
mov dword [0x140302a84], eax
je 0x14000fc91
sub ecx, r14d
je 0x14000f71f
sub ecx, r14d
je 0x14000f716
cmp ecx, r14d
jne 0x14000fc91
lea rcx, str.image_tiff
jmp 0x14000f726
lea rcx, str.image_png
jmp 0x14000f726
lea rcx, str.image_jpeg
call fcn.1400112a0
jmp 0x14000fc91
xor ebx, ebx
lea eax, [rdi - 0xa]
mov ecx, 0xfffd
movzx esi, bx
test cx, ax
jne 0x14000fc91
movzx ecx, word [r15 + 6]
lea r14d, [rbx + 1]
mov dword [0x14030a2e0], r14d
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x140302a7c]
movzx ecx, word [r15 + 8]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, qword [0x1402e0ca0]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x140302a7c]
lea edx, [rbx + 0xc]
mov ecx, dword [0x14030a330]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm4, eax
mov eax, dword [0x14030a32c]
sub eax, dword [0x14030a2e4]
cvtdq2pd xmm4, xmm4
movd xmm6, eax
mulsd xmm4, qword [0x1402e0ca0]
mov eax, dword [0x14030a318]
sub eax, dword [0x14030a350]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
divsd xmm4, xmm0
movd xmm0, dword [0x14030a314]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm6, xmm6
divsd xmm1, xmm0
andps xmm6, xmmword [0x1402e0de0]
movd xmm0, dword [0x14030a304]
addsd xmm6, xmm7
movd xmm7, eax
mov eax, dword [0x14030a30c]
cvtdq2pd xmm7, xmm7
mulsd xmm6, xmm1
andps xmm7, xmmword [0x1402e0de0]
movd xmm1, eax
addsd xmm7, xmm4
cvtdq2pd xmm1, xmm1
mulsd xmm6, qword [0x1402e0cc0]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402e0cc0]
cmp di, dx
jne 0x14000f861
movzx ecx, word [r15 + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x14030a330]
movzx esi, ax
mov eax, dword [0x14030a30c]
movzx edx, byte [r15 + 5]
cmp edx, 0x88
je 0x14000fc91
movd xmm0, ecx
or edx, 0xc001
mov dword [rbp - 0x51], ebx
mov dword [rbp - 0x3d], edx
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rbp - 0x49], ecx
cvttsd2si eax, xmm7
mov dword [rbp - 0x45], eax
movsx eax, si
mov dword [rbp - 0x41], eax
test si, si
je 0x14000f8b6
bts edx, 0xb
mov dword [rbp - 0x3d], edx
mov dword [rbp - 0x39], ebx
mov qword [rbp - 0x31], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x14030a2a0], rax
jmp 0x14000f951
mov esi, 6
cmp di, si
jne 0x14000fc91
movsx edi, byte [r15 + 4]
mov sil, byte [r15 + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000fc91
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
movzx eax, sil
mov word [rbp - 0x49], ax
mov dword [rbp - 0x51], r14d
cmp edi, r14d
jne 0x14000f91e
mov dword [rbp - 0x45], 2
jmp 0x14000f934
cmp edi, 3
jne 0x14000f928
mov dword [rbp - 0x45], edi
jmp 0x14000f934
cmp edi, r12d
mov eax, ebx
cmove eax, r14d
mov dword [rbp - 0x45], eax
movzx ecx, sil
xor edx, edx
mov dword [rbp - 0x41], ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rbp - 0x47], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rbp - 0x39], rax
mov r8d, 0x28
lea rdx, [rbp - 0x51]
mov ecx, r14d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000fc91
mov esi, 6
cmp di, si
jb 0x14000fc91
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor ebx, ebx
cmp eax, 0xffff
cmove eax, ebx
mov dword [0x14030a2e8], eax
jmp 0x14000fc91
sub ebx, 0xd
je 0x14000fc68
sub ebx, 1
je 0x14000fc2b
sub ebx, 1
je 0x14000fab5
sub ebx, 0x46
je 0x14000fa4e
cmp ebx, 2
jne 0x14000fc91
lea esi, [rbx + 3]
cmp di, si
jne 0x14000fc91
movsx edx, byte [r15 + 4]
xor ebx, ebx
test edx, edx
je 0x14000fa0b
sub edx, 1
je 0x14000f9ef
cmp edx, 1
je 0x14000fa19
mov eax, esi
jmp 0x14000fc94
mov r14d, 1
mov ecx, r14d
mov byte [0x14030a29f], r14b
call qword [sym.imp.USER32.dll_BlockInput]
mov r14, qword [rbp - 0x29]
jmp 0x14000fa19
xor ecx, ecx
mov byte [0x14030a29f], bl
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, esi
mov word [rbp - 0x21], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x1f], ax
lea rcx, [rbp - 0x21]
mov al, byte [0x14030a29f]
mov byte [rbp - 0x1d], al
mov edx, esi
mov r8, r14
call r13
jmp 0x14000fc91
mov eax, 7
cmp di, ax
jne 0x14000fc91
movzx edi, byte [r15 + 5]
mov ecx, 0x100
movzx eax, byte [r15 + 6]
mov r13b, byte [r15 + 4]
imul edi, ecx
add di, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000fc91
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
mov word [rbp - 0x49], bx
cmp r13b, r14b
mov dword [rbp - 0x51], r14d
lea esi, [rbx + 6]
mov dword [rbp - 0x41], ebx
cmove r12d, esi
mov word [rbp - 0x47], di
mov dword [rbp - 0x45], r12d
jmp 0x14000f947
mov r14d, 1
cmp byte [r15 + 4], r14b
jne 0x14000fbd5
mov ecx, dword [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [r15 + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 0xc]
movzx ebx, word [0x140302a7c]
movzx edi, ax
shl edi, 0xa
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x14030a32c]
xor edx, edx
sub ecx, dword [0x14030a2e4]
movd xmm1, dword [0x14030a330]
movzx r10d, ax
mov eax, edi
div ebx
movd xmm0, ecx
xor edx, edx
cvtdq2pd xmm0, xmm0
shl r10d, 0xa
cvtdq2pd xmm1, xmm1
andps xmm0, xmmword [0x1402e0de0]
cvttsd2si rcx, xmm0
movd xmm0, dword [0x14030a314]
add cx, ax
cvtdq2pd xmm0, xmm0
movzx eax, cx
mov ecx, dword [0x14030a318]
sub ecx, dword [0x14030a350]
movd xmm2, eax
mov eax, r10d
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
movd xmm0, ecx
movzx ecx, word [0x140302a7c]
mulsd xmm2, xmm1
movd xmm1, dword [0x14030a30c]
div ecx
mov cl, byte [r15 + 5]
mov edx, esi
mulsd xmm2, qword [0x1402e0cc0]
cvtdq2pd xmm0, xmm0
cvttsd2si r8, xmm2
andps xmm0, xmmword [0x1402e0de0]
cvttsd2si r9, xmm0
movd xmm0, dword [0x14030a304]
cvtdq2pd xmm1, xmm1
add r9w, ax
movzx eax, r9w
cvtdq2pd xmm0, xmm0
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402e0cc0]
cvttsd2si r9, xmm2
call fcn.14000e86c
jmp 0x14000fbf6
cmp byte [r15 + 4], 2
jne 0x14000fc91
mov edx, dword [rbp - 0x59]
lea rcx, [r15 + 5]
mov r8d, dword [0x140302a7c]
add edx, 0xfffffffb
call fcn.14000e968
cmp eax, r14d
jne 0x14000fc91
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r12d
mov word [rbp - 0x21], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x29]
lea rcx, [rbp - 0x21]
mov word [rbp - 0x1f], ax
mov edx, r12d
jmp 0x14000fa46
call fcn.14000e7c0
mov ecx, reloc.WS2_32.dll_ntohl
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 6
mov word [rbp - 0x21], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, bx
mov word [rbp - 0x1f], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x1d], ax
lea rcx, [rbp - 0x21]
jmp 0x14000fa41
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x14030a31c]
movzx r8d, ax
lea ecx, [r8 - 0x14]
cmp ecx, 0x1374
cmovbe edx, r8d
mov dword [0x14030a31c], edx
mov eax, dword [rbp - 0x59]
mov rcx, qword [rbp - 0x19]
xor rcx, rsp
call fcn.1401d9840
lea r11, [rsp + 0xb8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x21f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a8e8c
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401dbf38
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x220
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a8e8c
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401dbf38
int3