Function at 0x14000f238
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x1402feed0]
xor rax, rsp
mov qword [rbp - 0x19], rax
mov r12d, 4
mov qword [rbp - 0x29], r9
mov r14, r9
mov r13, r8
mov esi, edx
mov r15, rcx
cmp edx, r12d
jge 0x14000f289
xor eax, eax
jmp 0x14000fab4
mov rcx, qword [0x1403072f0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d_
mov r8d, r12d
mov dword [rsp + 0x20], esi
mov edx, 0x200
call fcn.1400ab710
mov r8, r14
mov rdx, r13
xor ecx, ecx
call fcn.14000ef9c
movzx ecx, word [r15]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 2]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [0x1403072f0]
lea r9, str.KVM__SLAVE_:_Handle_Input__Len___d__type___u__size___u_
movzx edi, ax
mov r8d, r12d
mov eax, edi
mov edx, 0x200
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
mov dword [rbp - 0x59], eax
call fcn.1400ab710
cmp edi, esi
jg 0x14000f282
mov eax, recv
cmp ebx, eax
ja 0x14000f7ba
je 0x14000f789
sub ebx, 1
je 0x14000f6ef
sub ebx, 1
je 0x14000f550
sub ebx, 3
je 0x14000f480
sub ebx, 1
je 0x14000f355
sub ebx, 2
je 0x14000fab1
cmp ebx, 3
jne 0x14000fab1
mov rdx, r14
mov rcx, r13
call fcn.14000ed58
jmp 0x14000fab1
cmp di, r12w
jne 0x14000fab1
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 8
mov word [rbp - 0x21], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x140307300]
mov word [rbp - 0x1f], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x14030734c]
mov word [rbp - 0x1d], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, r14
lea rcx, [rbp - 0x21]
mov edx, esi
mov word [rbp - 0x1b], ax
call r13
mov rdx, r14
mov rcx, r13
call fcn.14000ed58
mov rcx, qword [0x140307320]
lea r14d, [rsi - 7]
xor ebx, ebx
test rcx, rcx
jne 0x14000f437
movsxd rcx, dword [0x140307340]
shl rcx, 3
call fcn.1401e2d40
mov qword [0x140307320], rax
mov rcx, rax
test rax, rax
je 0x14000fae2
mov eax, dword [0x140307340]
mov r15d, ebx
test eax, eax
jle 0x14000fab1
mov edi, ebx
movsxd rcx, dword [0x140307348]
shl rcx, 3
call fcn.1401e2d40
mov rcx, qword [0x140307320]
mov qword [rdi + rcx], rax
test rax, rax
je 0x14000fb28
mov eax, dword [0x140307340]
add r15d, r14d
add rdi, rsi
cmp r15d, eax
jl 0x14000f400
jmp 0x14000f43d
mov eax, dword [0x140307340]
test eax, eax
jle 0x14000fab1
mov r9d, dword [0x140307348]
mov r8d, eax
test r9d, r9d
jle 0x14000f473
mov rdx, rbx
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rdx + rax + 4], bl
add rdx, rsi
sub r10, r14
jne 0x14000f45a
add rcx, rsi
sub r8, r14
jne 0x14000f44f
jmp 0x14000fab1
cmp di, 0xa
jb 0x14000f4ab
movzx ecx, word [r15 + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x14030731c]
movzx edx, ax
lea eax, [rdx - 0x14]
cmp eax, 0x1374
cmovbe ecx, edx
mov dword [0x14030731c], ecx
mov esi, 8
cmp di, si
jb 0x14000f4da
movzx ecx, word [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402ffa78]
movzx edx, ax
lea eax, [rdx - 0x40]
cmp eax, 0xfc0
cmovbe ecx, edx
mov dword [0x1402ffa78], ecx
mov esi, 6
cmp di, si
jb 0x14000fab1
movsx eax, byte [r15 + 5]
lea r14d, [rsi - 5]
movsx ecx, byte [r15 + 4]
lea edx, [rsi + 0x54]
cmp eax, r14d
cmovb eax, r14d
cmp eax, edx
cmova eax, edx
xor ebx, ebx
cmp qword [0x140307360], rbx
mov dword [0x1402ffa84], eax
je 0x14000fab1
sub ecx, r14d
je 0x14000f53f
sub ecx, r14d
je 0x14000f536
cmp ecx, r14d
jne 0x14000fab1
lea rcx, str.image_tiff
jmp 0x14000f546
lea rcx, str.image_png
jmp 0x14000f546
lea rcx, str.image_jpeg
call fcn.1400110c0
jmp 0x14000fab1
xor ebx, ebx
lea eax, [rdi - 0xa]
mov ecx, 0xfffd
movzx esi, bx
test cx, ax
jne 0x14000fab1
movzx ecx, word [r15 + 6]
lea r14d, [rbx + 1]
mov dword [0x1403072e0], r14d
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x1402ffa7c]
movzx ecx, word [r15 + 8]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, qword [0x1402de2f8]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
movd xmm0, dword [0x1402ffa7c]
lea edx, [rbx + 0xc]
mov ecx, dword [0x140307330]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm4, eax
mov eax, dword [0x14030732c]
sub eax, dword [0x1403072e4]
cvtdq2pd xmm4, xmm4
movd xmm6, eax
mulsd xmm4, qword [0x1402de2f8]
mov eax, dword [0x140307318]
sub eax, dword [0x140307350]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
divsd xmm4, xmm0
movd xmm0, dword [0x140307314]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm6, xmm6
divsd xmm1, xmm0
andps xmm6, xmmword [0x1402de430]
movd xmm0, dword [0x140307304]
addsd xmm6, xmm7
movd xmm7, eax
mov eax, dword [0x14030730c]
cvtdq2pd xmm7, xmm7
mulsd xmm6, xmm1
andps xmm7, xmmword [0x1402de430]
movd xmm1, eax
addsd xmm7, xmm4
cvtdq2pd xmm1, xmm1
mulsd xmm6, qword [0x1402de318]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402de318]
cmp di, dx
jne 0x14000f681
movzx ecx, word [r15 + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x140307330]
movzx esi, ax
mov eax, dword [0x14030730c]
movzx edx, byte [r15 + 5]
cmp edx, 0x88
je 0x14000fab1
movd xmm0, ecx
or edx, 0xc001
mov dword [rbp - 0x51], ebx
mov dword [rbp - 0x3d], edx
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rbp - 0x49], ecx
cvttsd2si eax, xmm7
mov dword [rbp - 0x45], eax
movsx eax, si
mov dword [rbp - 0x41], eax
test si, si
je 0x14000f6d6
bts edx, 0xb
mov dword [rbp - 0x3d], edx
mov dword [rbp - 0x39], ebx
mov qword [rbp - 0x31], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1403072a0], rax
jmp 0x14000f771
mov esi, 6
cmp di, si
jne 0x14000fab1
movsx edi, byte [r15 + 4]
mov sil, byte [r15 + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000fab1
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
movzx eax, sil
mov word [rbp - 0x49], ax
mov dword [rbp - 0x51], r14d
cmp edi, r14d
jne 0x14000f73e
mov dword [rbp - 0x45], 2
jmp 0x14000f754
cmp edi, 3
jne 0x14000f748
mov dword [rbp - 0x45], edi
jmp 0x14000f754
cmp edi, r12d
mov eax, ebx
cmove eax, r14d
mov dword [rbp - 0x45], eax
movzx ecx, sil
xor edx, edx
mov dword [rbp - 0x41], ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rbp - 0x47], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rbp - 0x39], rax
mov r8d, 0x28
lea rdx, [rbp - 0x51]
mov ecx, r14d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000fab1
mov esi, 6
cmp di, si
jb 0x14000fab1
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor ebx, ebx
cmp eax, 0xffff
cmove eax, ebx
mov dword [0x1403072e8], eax
jmp 0x14000fab1
sub ebx, 0xd
je 0x14000fa88
sub ebx, 1
je 0x14000fa4b
sub ebx, 1
je 0x14000f8d5
sub ebx, 0x46
je 0x14000f86e
cmp ebx, 2
jne 0x14000fab1
lea esi, [rbx + 3]
cmp di, si
jne 0x14000fab1
movsx edx, byte [r15 + 4]
xor ebx, ebx
test edx, edx
je 0x14000f82b
sub edx, 1
je 0x14000f80f
cmp edx, 1
je 0x14000f839
mov eax, esi
jmp 0x14000fab4
mov r14d, 1
mov ecx, r14d
mov byte [0x14030729f], r14b
call qword [sym.imp.USER32.dll_BlockInput]
mov r14, qword [rbp - 0x29]
jmp 0x14000f839
xor ecx, ecx
mov byte [0x14030729f], bl
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, esi
mov word [rbp - 0x21], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x1f], ax
lea rcx, [rbp - 0x21]
mov al, byte [0x14030729f]
mov byte [rbp - 0x1d], al
mov edx, esi
mov r8, r14
call r13
jmp 0x14000fab1
mov eax, 7
cmp di, ax
jne 0x14000fab1
movzx edi, byte [r15 + 5]
mov ecx, 0x100
movzx eax, byte [r15 + 6]
mov r13b, byte [r15 + 4]
imul edi, ecx
add di, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test rax, rax
je 0x14000fab1
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r14d, [rbx + 1]
mov word [rbp - 0x49], bx
cmp r13b, r14b
mov dword [rbp - 0x51], r14d
lea esi, [rbx + 6]
mov dword [rbp - 0x41], ebx
cmove r12d, esi
mov word [rbp - 0x47], di
mov dword [rbp - 0x45], r12d
jmp 0x14000f767
mov r14d, 1
cmp byte [r15 + 4], r14b
jne 0x14000f9f5
mov ecx, dword [r15 + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [r15 + 0xa]
mov esi, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r15 + 0xc]
movzx ebx, word [0x1402ffa7c]
movzx edi, ax
shl edi, 0xa
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x14030732c]
xor edx, edx
sub ecx, dword [0x1403072e4]
movd xmm1, dword [0x140307330]
movzx r10d, ax
mov eax, edi
div ebx
movd xmm0, ecx
xor edx, edx
cvtdq2pd xmm0, xmm0
shl r10d, 0xa
cvtdq2pd xmm1, xmm1
andps xmm0, xmmword [0x1402de430]
cvttsd2si rcx, xmm0
movd xmm0, dword [0x140307314]
add cx, ax
cvtdq2pd xmm0, xmm0
movzx eax, cx
mov ecx, dword [0x140307318]
sub ecx, dword [0x140307350]
movd xmm2, eax
mov eax, r10d
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
movd xmm0, ecx
movzx ecx, word [0x1402ffa7c]
mulsd xmm2, xmm1
movd xmm1, dword [0x14030730c]
div ecx
mov cl, byte [r15 + 5]
mov edx, esi
mulsd xmm2, qword [0x1402de318]
cvtdq2pd xmm0, xmm0
cvttsd2si r8, xmm2
andps xmm0, xmmword [0x1402de430]
cvttsd2si r9, xmm0
movd xmm0, dword [0x140307304]
cvtdq2pd xmm1, xmm1
add r9w, ax
movzx eax, r9w
cvtdq2pd xmm0, xmm0
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402de318]
cvttsd2si r9, xmm2
call fcn.14000e68c
jmp 0x14000fa16
cmp byte [r15 + 4], 2
jne 0x14000fab1
mov edx, dword [rbp - 0x59]
lea rcx, [r15 + 5]
mov r8d, dword [0x1402ffa7c]
add edx, 0xfffffffb
call fcn.14000e788
cmp eax, r14d
jne 0x14000fab1
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r12d
mov word [rbp - 0x21], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rbp - 0x29]
lea rcx, [rbp - 0x21]
mov word [rbp - 0x1f], ax
mov edx, r12d
jmp 0x14000f866
call fcn.14000e5e0
mov ecx, reloc.WS2_32.dll_ntohl
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 6
mov word [rbp - 0x21], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, bx
mov word [rbp - 0x1f], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x1d], ax
lea rcx, [rbp - 0x21]
jmp 0x14000f861
movzx ecx, word [r15 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x14030731c]
movzx r8d, ax
lea ecx, [r8 - 0x14]
cmp ecx, 0x1374
cmovbe edx, r8d
mov dword [0x14030731c], edx
mov eax, dword [rbp - 0x59]
mov rcx, qword [rbp - 0x19]
xor rcx, rsp
call fcn.1401d8f10
lea r11, [rsp + 0xb8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x21f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a8b44
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401db608
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str...meshcoreKVMWindowskvm.c
mov edi, 0x220
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a8b44
mov r8d, edi
lea rdx, str...meshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.1400010e4
mov ecx, ebx
call fcn.1401db608
int3