Function at 0x14000e744
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402e0ed0]
xor rax, rsp
mov qword [rbp - 9], rax
mov r12d, 4
mov rbx, r9
mov qword [rbp - 0x19], rbx
mov r13, r8
mov esi, edx
mov r15, rcx
cmp edx, r12d
jge 0x14000e798
xor eax, eax
jmp 0x14000ef7f
mov r8, rbx
mov rdx, r13
xor ecx, ecx
call fcn.14000e4b4
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 2]
movzx r14d, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
mov dword [rbp - 0x49], edi
cmp edi, esi
jg 0x14000e791
movzx ecx, r14w
mov eax, recv
cmp ecx, eax
ja 0x14000ec86
je 0x14000ec55
sub ecx, 1
je 0x14000ebce
sub ecx, 1
je 0x14000ea1c
sub ecx, 3
je 0x14000e94c
sub ecx, 1
je 0x14000e821
sub ecx, 2
je 0x14000ef7a
cmp ecx, 3
jne 0x14000ef7a
mov rdx, rbx
mov rcx, r13
call fcn.14000e270
jmp 0x14000ef7a
cmp di, r12w
jne 0x14000ef7a
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 8
mov word [rbp - 0x11], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402e7f78]
mov word [rbp - 0xf], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402e7fc8]
mov word [rbp - 0xd], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, rbx
lea rcx, [rbp - 0x11]
mov edx, esi
mov word [rbp - 0xb], ax
call r13
mov rdx, rbx
mov rcx, r13
call fcn.14000e270
mov rcx, qword [0x1402e7f98]
lea r14d, [rsi - 7]
xor ebx, ebx
test rcx, rcx
jne 0x14000e903
movsxd rcx, dword [0x1402e7fb4]
shl rcx, 3
call fcn.1401d6c94
mov qword [0x1402e7f98], rax
mov rcx, rax
test rax, rax
je 0x14000efb0
mov eax, dword [0x1402e7fb4]
mov r15d, ebx
test eax, eax
jle 0x14000ef7a
mov edi, ebx
movsxd rcx, dword [0x1402e7fc4]
shl rcx, 3
call fcn.1401d6c94
mov rcx, qword [0x1402e7f98]
mov qword [rdi + rcx], rax
test rax, rax
je 0x14000eff6
mov eax, dword [0x1402e7fb4]
add r15d, r14d
add rdi, rsi
cmp r15d, eax
jl 0x14000e8cc
jmp 0x14000e909
mov eax, dword [0x1402e7fb4]
test eax, eax
jle 0x14000ef7a
mov r9d, dword [0x1402e7fc4]
mov r8d, eax
test r9d, r9d
jle 0x14000e93f
mov rdx, rbx
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rax + rdx + 4], bl
add rdx, rsi
sub r10, r14
jne 0x14000e926
add rcx, rsi
sub r8, r14
jne 0x14000e91b
jmp 0x14000ef7a
cmp di, 0xa
jb 0x14000e977
movzx ecx, word [r15 + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402e7fa0]
movzx edx, ax
lea eax, [rdx - 0x14]
cmp eax, 0x1374
cmovbe ecx, edx
mov dword [0x1402e7fa0], ecx
mov esi, 8
cmp di, si
jb 0x14000e9a6
movzx ecx, word [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402e1a78]
movzx edx, ax
lea eax, [rdx - 0x40]
cmp eax, 0xfc0
cmovbe ecx, edx
mov dword [0x1402e1a78], ecx
mov esi, 6
cmp di, si
jb 0x14000ef7a
movsx eax, byte [r15 + 5]
lea r14d, [rsi - 5]
movsx ecx, byte [r15 + 4]
lea edx, [rsi + 0x54]
cmp eax, r14d
cmovb eax, r14d
cmp eax, edx
cmova eax, edx
xor ebx, ebx
cmp qword [0x1402e7fe0], rbx
mov dword [0x1402e1a84], eax
je 0x14000ef7a
sub ecx, r14d
je 0x14000ea13
sub ecx, r14d
je 0x14000ea0a
cmp ecx, r14d
jne 0x14000ef7a
lea rcx, str.image_tiff
call fcn.14001024c
jmp 0x14000ef7a
lea rcx, str.image_png
jmp 0x14000ea00
lea rcx, str.image_jpeg
jmp 0x14000ea00
xor ebx, ebx
lea eax, [rdi - 0xa]
mov ecx, 0xfffd
movzx esi, bx
test cx, ax
jne 0x14000ef7a
movzx ecx, word [r15 + 6]
lea r14d, [rbx + 1]
mov dword [0x1402e7f60], r14d
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x1402e1a7c]
movzx ecx, word [r15 + 8]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, qword [0x1402c04b8]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x1402e1a7c]
lea edx, [rbx + 0xc]
mov ecx, dword [0x1402e7fac]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm4, eax
mov eax, dword [0x1402e7fa8]
sub eax, dword [0x1402e7f64]
cvtdq2pd xmm4, xmm4
movd xmm6, eax
mulsd xmm4, qword [0x1402c04b8]
mov eax, dword [0x1402e7f94]
sub eax, dword [0x1402e7fcc]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
divsd xmm4, xmm0
movd xmm0, dword [0x1402e7f90]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm6, xmm6
divsd xmm1, xmm0
andps xmm6, xmmword [0x1402c05f0]
movd xmm0, dword [0x1402e7f7c]
addsd xmm6, xmm7
movd xmm7, eax
mov eax, dword [0x1402e7f88]
cvtdq2pd xmm7, xmm7
mulsd xmm6, xmm1
andps xmm7, xmmword [0x1402c05f0]
movd xmm1, eax
addsd xmm7, xmm4
cvtdq2pd xmm1, xmm1
mulsd xmm6, qword [0x1402c04d8]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402c04d8]
cmp di, dx
jne 0x14000eb4d
movzx ecx, word [r15 + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402e7fac]
movzx esi, ax
mov eax, dword [0x1402e7f88]
movzx edx, byte [r15 + 5]
cmp edx, 0x88
je 0x14000ef7a
movd xmm0, ecx
or edx, 0xc001
mov dword [rbp - 0x41], ebx
mov dword [rbp - 0x2d], edx
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rbp - 0x39], ecx
cvttsd2si eax, xmm7
mov dword [rbp - 0x35], eax
movsx eax, si
mov dword [rbp - 0x31], eax
test si, si
je 0x14000eba2
bts edx, 0xb
mov dword [rbp - 0x2d], edx
mov dword [rbp - 0x29], ebx
mov qword [rbp - 0x21], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1402e7f20], rax
mov r8d, 0x28
lea rdx, [rbp - 0x41]
mov ecx, r14d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000ef7a
mov esi, 6
cmp di, si
jne 0x14000ef7a
movsx edi, byte [r15 + 4]
mov sil, byte [r15 + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000ef7a
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
movzx eax, sil
mov word [rbp - 0x39], ax
mov dword [rbp - 0x41], r14d
cmp edi, r14d
jne 0x14000ec1d
mov dword [rbp - 0x35], 2
jmp 0x14000ec33
cmp edi, 3
jne 0x14000ec27
mov dword [rbp - 0x35], edi
jmp 0x14000ec33
cmp edi, r12d
mov eax, ebx
cmove eax, r14d
mov dword [rbp - 0x35], eax
movzx ecx, sil
xor edx, edx
mov dword [rbp - 0x31], ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rbp - 0x37], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rbp - 0x29], rax
jmp 0x14000ebb6
mov esi, 6
cmp di, si
jb 0x14000ef7a
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor ebx, ebx
cmp eax, 0xffff
cmove eax, ebx
mov dword [0x1402e7f68], eax
jmp 0x14000ef7a
sub ecx, 0xd
je 0x14000ef51
sub ecx, 1
je 0x14000ef14
sub ecx, 1
je 0x14000ed98
sub ecx, 0x46
je 0x14000ed31
cmp ecx, 2
jne 0x14000ef7a
lea esi, [rcx + 3]
cmp di, si
jne 0x14000ef7a
movsx edx, byte [r15 + 4]
xor ebx, ebx
test edx, edx
je 0x14000eced
sub edx, 1
je 0x14000ecdb
cmp edx, 1
je 0x14000ecfb
mov eax, esi
jmp 0x14000ef7f
mov r14d, 1
mov byte [0x1402e7f84], r14b
mov ecx, r14d
jmp 0x14000ecf5
mov byte [0x1402e7f84], bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, esi
mov word [rbp - 0x11], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0xf], ax
lea rcx, [rbp - 0x11]
mov al, byte [0x1402e7f84]
mov byte [rbp - 0xd], al
mov r8, qword [rbp - 0x19]
mov edx, esi
call r13
jmp 0x14000ef7a
mov eax, 7
cmp di, ax
jne 0x14000ef7a
movzx edi, byte [r15 + 5]
mov ecx, 0x100
movzx eax, byte [r15 + 6]
mov r13b, byte [r15 + 4]
imul edi, ecx
add di, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000ef7a
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
mov word [rbp - 0x39], bx
cmp r13b, r14b
mov dword [rbp - 0x41], r14d
lea esi, [rbx + 6]
mov dword [rbp - 0x31], ebx
cmove r12d, esi
mov word [rbp - 0x37], di
mov dword [rbp - 0x35], r12d
jmp 0x14000ec46
mov r14d, 1
cmp byte [r15 + 4], r14b
jne 0x14000eebf
mov ecx, dword [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [r15 + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 0xc]
movzx ebx, word [0x1402e1a7c]
movzx edi, ax
shl edi, 0xa
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402e7fa8]
xor edx, edx
sub ecx, dword [0x1402e7f64]
movd xmm1, dword [0x1402e7fac]
movzx r10d, ax
mov eax, edi
div ebx
movd xmm0, ecx
xor edx, edx
cvtdq2pd xmm0, xmm0
shl r10d, 0xa
cvtdq2pd xmm1, xmm1
andps xmm0, xmmword [0x1402c05f0]
cvttsd2si rcx, xmm0
movd xmm0, dword [0x1402e7f90]
add cx, ax
cvtdq2pd xmm0, xmm0
movzx eax, cx
mov ecx, dword [0x1402e7f94]
sub ecx, dword [0x1402e7fcc]
movd xmm2, eax
mov eax, r10d
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
movd xmm0, ecx
movzx ecx, word [0x1402e1a7c]
mulsd xmm2, xmm1
movd xmm1, dword [0x1402e7f88]
div ecx
mov cl, byte [r15 + 5]
mov edx, esi
mulsd xmm2, qword [0x1402c04d8]
cvtdq2pd xmm0, xmm0
cvttsd2si r8, xmm2
andps xmm0, xmmword [0x1402c05f0]
cvttsd2si r9, xmm0
movd xmm0, dword [0x1402e7f7c]
cvtdq2pd xmm1, xmm1
add r9w, ax
movzx eax, r9w
cvtdq2pd xmm0, xmm0
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402c04d8]
cvttsd2si r9, xmm2
call fcn.14000dc0c
mov rbx, qword [rbp - 0x19]
mov edi, dword [rbp - 0x49]
jmp 0x14000eee0
cmp byte [r15 + 4], 2
mov edi, dword [rbp - 0x49]
jne 0x14000ef7d
mov r8d, dword [0x1402e1a7c]
lea edx, [rdi - 5]
lea rcx, [r15 + 5]
call fcn.14000dd08
cmp eax, r14d
jne 0x14000ef7d
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r12d
mov word [rbp - 0x49], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, rbx
lea rcx, [rbp - 0x49]
mov edx, r12d
mov word [rbp - 0x47], ax
call r13
jmp 0x14000ef7d
call fcn.14000db60
mov ecx, reloc.WS2_32.dll_ntohl
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 6
mov word [rbp - 0x11], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, bx
mov word [rbp - 0xf], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0xd], ax
lea rcx, [rbp - 0x11]
jmp 0x14000ed23
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x1402e7fa0]
movzx r8d, ax
lea ecx, [r8 - 0x14]
cmp ecx, 0x1374
cmovbe edx, r8d
mov dword [0x1402e7fa0], edx
mov edi, dword [rbp - 0x49]
mov eax, edi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1401cce50
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x21f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a3d30
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401cf548
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x220
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a3d30
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401cf548
int3