Function at 0x14000e3a0
Capabilities:
Encrypt data using rc4 ksa
Log keystrokes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8f8]
sub rsp, 0x9c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rbp + 0x898], rax
mov r14d, 4
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], r8
mov r15, r9
mov rsi, r8
mov r12d, edx
mov rbx, rcx
cmp edx, r14d
jl 0x14000eec2
mov r8, r9
mov rdx, rsi
xor ecx, ecx
call fcn.14000e110
movzx ecx, word [rbx]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx r13d, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
mov dword [rsp + 0x60], edi
cmp edi, r12d
jg 0x14000eec2
mov r8d, r13d
lea r13d, [r14 + 8]
cmp r8d, r13d
ja 0x14000e90f
je 0x14000e8dd
sub r8d, 1
je 0x14000e838
sub r8d, 1
je 0x14000e69a
sub r8d, 3
je 0x14000e5cc
sub r8d, 1
je 0x14000e490
sub r8d, 2
je 0x14000eebc
cmp r8d, 3
jne 0x14000eebc
mov rdx, r15
mov rcx, rsi
call fcn.14000decc
jmp 0x14000eebc
cmp di, r14w
jne 0x14000eebc
mov ecx, 7
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 8
mov word [rbp + 0x890], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402ec538]
mov word [rbp + 0x892], ax
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [0x1402ec588]
mov word [rbp + 0x894], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp + 0x890]
mov r8, r15
mov word [rbp + 0x896], ax
mov edx, esi
call rbx
mov rdx, r15
mov rcx, rbx
call fcn.14000decc
mov rcx, qword [0x1402ec558]
lea r12d, [rsi - 7]
xor r15d, r15d
test rcx, rcx
jne 0x14000e582
movsxd rcx, dword [0x1402ec574]
shl rcx, 3
call fcn.1401d7f54
mov qword [0x1402ec558], rax
test rax, rax
je 0x14000eef8
cmp dword [0x1402ec574], r15d
mov ebx, r15d
jle 0x14000eebc
mov edi, r15d
movsxd rcx, dword [0x1402ec584]
shl rcx, 3
call fcn.1401d7f54
mov rcx, qword [0x1402ec558]
mov qword [rdi + rcx], rax
test rax, rax
je 0x14000ef3e
mov eax, dword [0x1402ec574]
add ebx, r12d
add rdi, rsi
cmp ebx, eax
jl 0x14000e54c
jmp 0x14000e588
mov eax, dword [0x1402ec574]
test eax, eax
jle 0x14000eebc
mov r9d, dword [0x1402ec584]
mov r8d, eax
test r9d, r9d
jle 0x14000e5bf
mov rdx, r15
mov r10, r9
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
mov rax, qword [rcx]
mov byte [rdx + rax + 4], r15b
add rdx, rsi
sub r10, r12
jne 0x14000e5a5
add rcx, rsi
sub r8, r12
jne 0x14000e59a
jmp 0x14000eebc
cmp edi, 0xa
jb 0x14000e5f0
movzx ecx, word [rbx + 8]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x14]
cmp eax, 0x1374
ja 0x14000e5fa
mov dword [0x1402ec560], ecx
jmp 0x14000e5fa
mov esi, 8
cmp di, si
jb 0x14000e619
movzx ecx, word [rbx + 6]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
lea eax, [rcx - 0x40]
cmp eax, 0xfc0
ja 0x14000e627
mov dword [0x1402e9b98], ecx
jmp 0x14000e627
mov esi, 6
cmp di, si
jb 0x14000eebc
movsx eax, byte [rbx + 5]
mov r12d, 1
movsx ecx, byte [rbx + 4]
cmp eax, r12d
jae 0x14000e643
mov dword [0x1402e9ba4], r12d
jmp 0x14000e654
mov edx, 0x5a
cmp byte [rbx + 5], dl
cmova eax, edx
mov dword [0x1402e9ba4], eax
xor r15d, r15d
cmp qword [0x1402ec5a0], r15
je 0x14000eebc
sub ecx, r12d
je 0x14000e689
sub ecx, r12d
je 0x14000e680
cmp ecx, r12d
jne 0x14000eebc
lea rcx, str.image_tiff
jmp 0x14000e690
lea rcx, str.image_png
jmp 0x14000e690
lea rcx, str.image_jpeg
call fcn.140010114
jmp 0x14000eebc
xor r15d, r15d
lea eax, [rdi - 0xa]
mov ecx, 0xfffd
movzx esi, r15w
test cx, ax
jne 0x14000eebc
movzx ecx, word [rbx + 6]
lea r12d, [r15 + 1]
mov dword [0x1402ec520], r12d
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 8]
xorps xmm7, xmm7
movzx eax, ax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1402e9b9c]
cvtsi2sd xmm7, eax
mulsd xmm7, qword [0x1402c8080]
divsd xmm7, xmm0
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402ec56c]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1402e9b9c]
movzx eax, ax
xorps xmm1, xmm1
xorps xmm4, xmm4
cvtsi2sd xmm4, eax
mov eax, dword [0x1402ec568]
sub eax, dword [0x1402ec524]
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
mov eax, dword [0x1402ec554]
sub eax, dword [0x1402ec58c]
mulsd xmm4, qword [0x1402c8080]
andps xmm6, xmmword [0x1402c81c0]
addsd xmm6, xmm7
xorps xmm7, xmm7
cvtsi2sd xmm1, ecx
divsd xmm4, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [0x1402ec550]
cvtsi2sd xmm7, eax
mov eax, dword [0x1402ec548]
divsd xmm1, xmm0
andps xmm7, xmmword [0x1402c81c0]
xorps xmm0, xmm0
mulsd xmm6, xmm1
xorps xmm1, xmm1
addsd xmm7, xmm4
cvtsi2sd xmm0, dword [0x1402ec53c]
mulsd xmm6, qword [0x1402c80a0]
cvtsi2sd xmm1, eax
divsd xmm1, xmm0
mulsd xmm7, xmm1
mulsd xmm7, qword [0x1402c80a0]
cmp di, r13w
jne 0x14000e7be
movzx ecx, word [rbx + 0xa]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [0x1402ec56c]
movzx esi, ax
mov eax, dword [0x1402ec548]
movzx edx, byte [rbx + 5]
cmp edx, 0x88
je 0x14000eebc
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov dword [rsp + 0x38], r15d
divsd xmm6, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si ecx, xmm6
divsd xmm7, xmm0
mov dword [rsp + 0x40], ecx
cvttsd2si eax, xmm7
mov dword [rsp + 0x44], eax
movsx eax, si
mov dword [rsp + 0x48], eax
mov eax, edx
or eax, 0xc001
mov dword [rsp + 0x4c], eax
test si, si
je 0x14000e81c
or edx, 0xc801
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1402ec4e0], rax
jmp 0x14000e8c4
mov esi, 6
cmp di, si
jne 0x14000eebc
mov dil, byte [rbx + 4]
movzx ebx, byte [rbx + 5]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x14000eebc
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [rsi - 5]
mov word [rsp + 0x40], bx
mov dword [rsp + 0x38], r12d
cmp dil, r12b
jne 0x14000e887
lea r13d, [rsi - 4]
mov dword [rsp + 0x44], r13d
jmp 0x14000e8a5
cmp dil, 3
jne 0x14000e897
mov dword [rsp + 0x44], 3
jmp 0x14000e8a5
cmp dil, r14b
mov eax, r15d
cmove eax, r12d
mov dword [rsp + 0x44], eax
mov ecx, ebx
mov dword [rsp + 0x48], r15d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x42], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x50], rax
mov r8d, 0x28
lea rdx, [rsp + 0x38]
mov ecx, r12d
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x14000eebc
mov esi, 6
cmp di, si
jb 0x14000eebc
movzx ecx, word [rbx + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor r15d, r15d
cmp eax, 0xffff
cmove eax, r15d
mov dword [0x1402ec528], eax
jmp 0x14000eebc
sub r8d, 0xd
je 0x14000ee94
sub r8d, 1
je 0x14000eda3
sub r8d, 1
je 0x14000ea41
sub r8d, 0x46
je 0x14000e9d3
mov r13d, 2
cmp r8d, r13d
jne 0x14000eebc
lea r14d, [r13 + 3]
cmp di, r14w
jne 0x14000eebc
movsx ecx, byte [rbx + 4]
xor r15d, r15d
test ecx, ecx
je 0x14000e980
sub ecx, 1
je 0x14000e96e
cmp ecx, 1
je 0x14000e98f
jmp 0x14000eebc
mov r12d, 1
mov byte [0x1402ec544], r12b
mov ecx, r12d
jmp 0x14000e989
mov byte [0x1402ec544], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, 0x57
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r14d
mov word [rbp + 0x890], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x892], ax
lea rcx, [rbp + 0x890]
mov al, byte [0x1402ec544]
mov byte [rbp + 0x894], al
mov r8, qword [rsp + 0x70]
mov edx, r14d
call rsi
jmp 0x14000eebc
mov eax, 7
cmp di, ax
jne 0x14000eebc
movzx edi, byte [rbx + 5]
mov eax, 0x100
mov r13b, byte [rbx + 4]
imul edi, eax
movzx eax, byte [rbx + 6]
add di, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x14000eebc
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r12d, [r15 + 1]
mov word [rsp + 0x40], r15w
cmp r13b, r12b
mov dword [rsp + 0x38], r12d
lea esi, [r15 + 6]
mov dword [rsp + 0x48], r15d
cmove r14d, esi
mov word [rsp + 0x42], di
mov dword [rsp + 0x44], r14d
jmp 0x14000e8b9
mov r12d, 1
cmp byte [rbx + 4], r12b
jne 0x14000ec0c
mov ecx, dword [rbx + 6]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rbx + 0xa]
mov r15d, eax
mov dword [rbp + 0x890], eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [0x1402e9b9c]
xor edx, edx
movzx eax, ax
shl eax, 0xa
div ecx
movzx ecx, word [rbx + 0xc]
mov dword [rsp + 0x30], eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
shl edi, 0xa
cmp dword [0x1402ec4dc], r12d
jne 0x14000eebc
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x90
call fcn.1401cbcd0
mov eax, dword [0x1402ec568]
lea r13d, [r12 + 1]
sub eax, dword [0x1402ec524]
xor edx, edx
movd xmm1, dword [0x1402ec56c]
cvtdq2pd xmm1, xmm1
mov dword [rbp - 0x70], r13d
movzx r13d, byte [rbx + 5]
mov dword [rbp - 0x64], r15d
xor r15d, r15d
mov dword [rbp - 0x6c], r13d
mov dword [rbp - 0x10], r15d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [rbp + 0x18], 0x5a
mov dword [rbp + 0x1c], 0x7d00
andps xmm0, xmmword [0x1402c81c0]
cvttsd2si eax, xmm0
movd xmm0, dword [0x1402ec550]
add ax, word [rsp + 0x30]
movzx eax, ax
cvtdq2pd xmm0, xmm0
movd xmm2, eax
mov eax, edi
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
movd xmm1, dword [0x1402ec548]
cvtdq2pd xmm1, xmm1
mulsd xmm2, qword [0x1402c80a0]
cvttsd2si ecx, xmm2
movzx ebx, cx
mov ecx, dword [0x1402ec554]
sub ecx, dword [0x1402ec58c]
mov dword [rbp - 0x50], ebx
movd xmm0, ecx
movzx ecx, word [0x1402e9b9c]
div ecx
cvtdq2pd xmm0, xmm0
lea rdx, [rbp - 0x70]
mov ecx, r12d
andps xmm0, xmmword [0x1402c81c0]
cvttsd2si r8d, xmm0
movd xmm0, dword [0x1402ec53c]
add r8w, ax
cvtdq2pd xmm0, xmm0
movzx eax, r8w
movd xmm2, eax
divsd xmm1, xmm0
cvtdq2pd xmm2, xmm2
mulsd xmm2, xmm1
mulsd xmm2, qword [0x1402c80a0]
cvttsd2si eax, xmm2
movzx edi, ax
lea eax, [r12 + 6]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x4c], edi
lea eax, [rdi - 2]
mov dword [rbp - 4], eax
lea eax, [rdi + 2]
mov dword [rbp + 4], eax
lea eax, [rbx - 2]
mov dword [rbp - 8], eax
lea eax, [rbx + 2]
mov dword [rbp], eax
call qword [0x1402ec510]
test eax, eax
jne 0x14000eebc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rbp + 0x890]
lea rcx, str.TOUCH1ERROR:_id_d__flags_d__x_d__y_d__err_ld_r_n
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov edx, r13d
mov dword [rsp + 0x20], edi
call fcn.140001128
jmp 0x14000ed7b
mov r13d, 2
cmp byte [rbx + 4], r13b
jne 0x14000eebc
cmp dword [0x1402ec4dc], r12d
mov eax, dword [0x1402e9b9c]
mov dword [rsp + 0x30], eax
jne 0x14000eebc
lea ecx, [rdi - 5]
mov eax, 0x38e38e39
imul ecx
mov edi, edx
sar edi, 1
mov eax, edi
shr eax, 0x1f
add edi, eax
lea eax, [r13 + 0xe]
cmp edi, eax
cmovg edi, eax
xor r15d, r15d
movsxd rax, edi
mov qword [rbp - 0x78], rax
mov dword [rbp + 0x890], edi
test edi, edi
jle 0x14000ed50
lea rax, [rbp - 0x50]
add rbx, 0xa
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rbx
mov ecx, dword [rbx - 4]
call qword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, word [rbx]
mov r14d, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rbx, qword [rsp + 0x68]
mov r8d, 0x90
movzx eax, ax
shl eax, 0xa
cdq
idiv dword [rsp + 0x30]
xor edx, edx
lea rcx, [rbx - 0x20]
mov esi, eax
call fcn.1401cbcd0
mov r8, qword [rsp + 0x68]
shl edi, 0xa
mov eax, edi
mov dword [rbx - 0x20], r13d
mov rbx, qword [rbp - 0x80]
cdq
idiv dword [rsp + 0x30]
movzx ecx, byte [rbx - 5]
add rbx, 9
mov dword [r8 - 0x1c], ecx
lea ecx, [rsi - 2]
mov dword [r8 + 0x4c], ecx
lea ecx, [rsi + 2]
mov dword [r8 + 0x54], ecx
lea ecx, [rax - 2]
mov dword [r8], eax
add eax, r13d
mov dword [r8 + 4], esi
mov dword [r8 + 0x50], eax
mov dword [r8 - 0x14], r14d
mov dword [r8 + 0x40], r15d
mov dword [r8 + 0x44], 7
mov dword [r8 + 0x68], 0x5a
mov dword [r8 + 0x6c], 0x7d00
mov dword [r8 + 0x48], ecx
add r8, 0x90
sub qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x80], rbx
jne 0x14000ec7a
mov edi, dword [rbp + 0x890]
mov r14d, 4
mov rsi, qword [rsp + 0x78]
lea rdx, [rbp - 0x70]
mov ecx, edi
call qword [0x1402ec510]
test eax, eax
jne 0x14000eebc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, edi
lea rcx, str.TOUCH2ERROR:_records_d__err_ld_r_n
mov r8d, eax
call fcn.140001128
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, r14d
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
lea rcx, [rsp + 0x30]
jmp 0x14000e9c4
mov r13d, dword [0x1402ec4dc]
test r13d, r13d
jg 0x14000ee46
xor edx, edx
lea rcx, str.User32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1402ec4f8], rax
test rax, rax
je 0x14000ee39
lea rdx, str.InitializeTouchInjection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1402ec4f8]
lea rdx, str.InjectTouchInput
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402ec510], rax
test rbx, rbx
je 0x14000ee2c
test rax, rax
je 0x14000ee2c
mov r12d, 1
mov ecx, 0x100
mov edx, r12d
call rbx
test eax, eax
je 0x14000ee2c
mov dword [0x1402ec4dc], r12d
mov r13d, r12d
jmp 0x14000ee46
mov rcx, qword [0x1402ec4f8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13d, 2
mov dword [0x1402ec4dc], r13d
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htons]
mov esi, 6
mov word [rbp + 0x890], ax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, r13w
mov word [rbp + 0x892], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x890]
mov rbx, qword [rsp + 0x78]
mov edx, esi
mov word [rbp + 0x894], ax
call rbx
jmp 0x14000eebc
movzx ecx, word [rbx + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [0x1402ec560]
movzx r8d, ax
lea ecx, [r8 - 0x14]
cmp ecx, 0x1374
cmovbe edx, r8d
mov dword [0x1402ec560], edx
mov eax, dword [rsp + 0x60]
jmp 0x14000eec4
xor eax, eax
mov rcx, qword [rbp + 0x898]
xor rcx, rsp
call fcn.1401c9740
lea r11, [rsp + 0x9c0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcoreKVMWindowskvm.c
mov edi, 0x219
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcoreKVMWindowskvm.c
mov edi, 0x21a
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcoreKVMWindowskvm.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3