Function at 0x43cd0a
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Hash data using murmur3
Move file
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f53b4
mov eax, dword fs:[0]
push eax
sub esp, 0x9e0
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x94c], edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
cmp eax, vtable.vncClient.0
jne 0x43f535
movzx esi, word [ecx + 0x1b0]
mov edx, dword [eax + 0x44]
cmp eax, vtable.vncClient.0
jne 0x43f547
mov eax, dword [ecx + 0x274]
movsx ecx, si
push ecx
push eax
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_client_connected_:__s___hd__n
push 1
push 0x558c50
call fcn.0041c840
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edx, dword [edi + 0x274]
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x968], 0
mov ecx, dword [edx]
mov esi, dword [ecx + 0x44]
cmp ecx, vtable.vncClient.0
jne 0x43f54e
mov eax, dword [edx + 0x274]
mov ecx, dword [edi + 0x270]
push eax
mov eax, dword [ecx]
call dword [eax + 0x1ac]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x20]
call eax
test al, al
jne 0x43b83c
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
cmp eax, vtable.vncClient.0
jne 0x43f557
movzx edx, word [ecx + 0x1b0]
mov ecx, dword [edi + 0x270]
push edx
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp 0x43f518
mov ecx, dword [edi + 0x270]
push edx
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp 0x43f518
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x10]
call eax
test eax, eax
jne 0x43ba11
mov edx, dword [edi + 0x274]
mov esi, dword [edx + 0x27c]
test esi, esi
je 0x43b87f
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x950], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b868
sub ecx, dword [ebp - 0x950]
je 0x43b87f
push esi
push str.Could_not_connect_using__s_
jmp 0x43b898
mov eax, dword [edx]
cmp eax, vtable.vncClient.0
jne 0x43f564
mov eax, dword [edx + 0x274]
push eax
push str.Could_not_connect_to__s_
lea eax, [ebp - 0x114]
push 0xff
push eax
call fcn.004241d0
mov ecx, dword [edi + 0x274]
add esp, 0x10
mov byte [ebp - 0x15], 0
cmp byte [ecx + 0x68e], 0
je 0x43b8d2
xor edx, edx
lea ecx, [ebp - 0x114]
call fcn.00474ee0
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x196], 0
je 0x43b806
cmp byte [0x563186], 0
jne 0x43b806
mov ecx, dword [edi + 0x270]
xor esi, esi
mov eax, dword [ecx + 0x60]
lea eax, [eax + eax*4]
add eax, eax
test eax, eax
jle 0x43b925
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [edi + 0x60], 0
jne 0x43f518
mov ecx, dword [edi + 0x270]
inc esi
mov eax, dword [ecx + 0x60]
lea eax, [eax + eax*4]
add eax, eax
cmp esi, eax
jl 0x43b900
add dword [ecx + 0x60], 0xa
mov eax, dword [edi + 0x270]
cmp dword [eax + 0x60], 0x14
jle 0x43b93c
mov dword [eax + 0x60], 0x14
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_PostAddNewClient_I_n
push 0
push 0x558c50
call fcn.0041c840
mov ecx, dword [edi + 0x270]
add esp, 0xc
mov eax, dword [edi + 0x274]
mov edx, dword [ecx]
movzx eax, byte [eax + 0x196]
cmp edx, vtable.vncServer.0
jne 0x43f570
mov dword [ecx + 0x614], eax
mov ecx, dword [edi + 0x270]
mov eax, dword [edi + 0x64]
mov edx, dword [ecx]
cmp edx, vtable.vncServer.0
jne 0x43f57c
mov dword [ecx + 0x61c], eax
mov ecx, dword [edi + 0x270]
lea eax, [edi + 0x68]
push eax
mov edx, dword [ecx]
cmp edx, vtable.vncServer.0
jne 0x43f588
lea eax, [ecx + 0x620]
push 0xff
push eax
call fcn.004d0170
add esp, 0xc
mov ecx, dword [edi + 0x270]
lea eax, [edi + 0x167]
push eax
mov edx, dword [ecx]
cmp edx, vtable.vncServer.0
jne 0x43f593
lea eax, [ecx + 0x71f]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
mov edx, 0x457
mov ecx, edx
call fcn.00484a80
jmp 0x43b800
mov edx, 0x457
mov ecx, edx
call fcn.00484a80
jmp 0x43b800
mov eax, dword [edi + 0x270]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_negotiated_version_n
push 9
push 0x558c50
mov dword [eax + 0x60], 0
call fcn.0041c840
mov eax, dword [edi]
add esp, 0xc
mov ecx, edi
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [edi + 0x274]
test eax, eax
mov eax, dword [ecx]
jne 0x43ba7b
cmp eax, vtable.vncClient.0
jne 0x43f59e
movzx edx, word [ecx + 0x1b0]
mov ecx, dword [edi + 0x270]
push edx
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp 0x43f488
mov ecx, dword [edi + 0x270]
push edx
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp 0x43f488
mov edx, dword [eax + 0x44]
cmp eax, vtable.vncClient.0
jne 0x43f5ab
mov eax, dword [ecx + 0x274]
mov ecx, dword [edi + 0x270]
push eax
mov eax, dword [ecx]
call dword [eax + 0x1b0]
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1f8]
cmp eax, vtable.vncServer.0
jne 0x43f5b2
mov eax, dword [ecx + 0xd8]
mov ecx, dword [edi + 0x26c]
imul eax, eax, 0x3e8
push eax
call fcn.00485eb0
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_authenticated_connection_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi + 0x274]
mov ecx, dword [edx]
mov esi, dword [ecx + 0x80]
cmp ecx, vtable.vncClient.0
jne 0x43f5b9
mov dword [edx + 0x1b4], eax
mov eax, dword [edi + 0x270]
mov ecx, dword [edi + 0x274]
cmp dword [eax + 0x134], 1
ja 0x43bba3
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
cmp eax, vtable.vncClient.0
jne 0x43f5c3
mov eax, dword [ecx + 0x24c]
mov esi, dword [eax + 0x68]
add esi, 0xdc2c
push esi
mov dword [ebp - 0x958], esi
mov dword [ebp - 0x954], 0x54
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov edx, dword [eax + 0x21c]
cmp eax, vtable.vncServer.0
jne 0x43f5cc
mov eax, dword [ecx + 0x370]
mov ecx, dword [edi + 0x274]
push eax
mov ecx, dword [ecx + 0x24c]
call fcn.00432a40
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x43bc4d
mov eax, dword [eax + 0x80]
mov edx, dword [eax + 0xe260]
mov esi, dword [eax + 0x84]
mov eax, dword [eax + 0x80]
mov dword [ebp - 0x95c], eax
mov eax, dword [ecx]
cmp eax, vtable.vncClient.0
mov edi, dword [eax + 0x68]
mov eax, dword [ebp - 0x95c]
jne 0x43f5d3
mov dword [ecx + 0x170], eax
mov dword [ecx + 0x174], esi
mov dword [ecx + 0x178], edx
mov edi, dword [ebp - 0x94c]
mov eax, dword [edi + 0x270]
mov ecx, dword [edi + 0x274]
mov eax, dword [eax + 0x80]
mov edx, dword [eax + 0xe0e0]
mov esi, dword [eax + 0xe0dc]
mov eax, dword [ecx]
mov edi, dword [eax + 0x64]
mov dword [ebp - 0x950], edi
mov edi, dword [ebp - 0x94c]
cmp eax, vtable.vncClient.0
jne 0x43f5dd
mov dword [ecx + 0x168], esi
mov dword [ecx + 0x16c], edx
mov eax, dword [ecx + 0x1d8]
mov dword [ecx + 0x244], esi
mov dword [ecx + 0x248], edx
mov dword [eax + 0x4c], esi
mov dword [eax + 0x50], edx
mov ecx, dword [edi + 0x274]
lea eax, [ebp - 0x984]
push eax
mov ecx, dword [ecx + 0x24c]
call fcn.00432ac0
mov ecx, dword [edi + 0x274]
push 0x112
push 0
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x528], xmm0
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx + 0x24c]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0x538], eax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x99c], 0x110
call fcn.004cddb0
add esp, 0xc
lea eax, [ebp - 0x99c]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x43bd29
lea ecx, [ebp - 0x22c]
xor esi, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bcd0
sub ecx, edx
je 0x43bd0f
nop dword [eax + eax]
movsx eax, byte [ebp + esi - 0x22c]
push eax
call fcn.004da9df
lea ecx, [ebp - 0x22c]
mov byte [ebp + esi - 0x22c], al
add esp, 4
lea edx, [ecx + 1]
inc esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bd02
sub ecx, edx
cmp esi, ecx
jb 0x43bce0
lea eax, [ebp - 0x22c]
push 0x2e
push eax
call fcn.004db4b4
add esp, 8
test eax, eax
je 0x43bd42
jmp 0x43bdc3
push 0x542d04
lea eax, [ebp - 0x22c]
push 0x112
push eax
call fcn.004d0170
add esp, 0xc
mov edx, 0x100
lea ecx, [ebp - 0x114]
call fcn.0043b130
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bd60
sub ecx, edx
cmp ecx, 3
jbe 0x43bdc3
mov al, byte [ebp - 0x114]
cmp al, 0x49
je 0x43bdc3
cmp al, 0x48
je 0x43bdc3
push 0x542d0c
lea eax, [ebp - 0x22c]
push 0x112
push eax
call fcn.004d01ca
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x22c]
push 0x112
push eax
call fcn.004d01ca
push 0x542d10
lea eax, [ebp - 0x22c]
push 0x112
push eax
call fcn.004d01ca
add esp, 0x24
push 0x542d14
lea eax, [ebp - 0x22c]
push 0x112
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [ebp - 0x22c]
cmp dword [0x5674b8], 0
je 0x43bdf2
push str.service_mode
jmp 0x43bdf7
push str.application_mode
push 0x112
push eax
call fcn.004d01ca
mov esi, dword [edi + 0x274]
add esp, 0xc
mov eax, dword [esi + 0x24c]
movups xmm0, xmmword [eax + 0x2c]
movups xmmword [ebp - 0x8d0], xmm0
mov edx, dword [esi + 0x530]
mov eax, edx
mov ecx, dword [esi + 0x528]
sub eax, ecx
sar eax, 8
sub edx, ecx
movzx eax, al
shl edx, 8
or eax, edx
mov word [ebp - 0x8d4], ax
mov edx, dword [esi + 0x534]
mov eax, edx
mov ecx, dword [esi + 0x52c]
sub eax, ecx
rol word [ebp - 0x8ca], 8
lea esi, [ebp - 0x22c]
sar eax, 8
sub edx, ecx
movzx eax, al
lea ecx, [esi + 1]
shl edx, 8
or eax, edx
mov word [ebp - 0x8d2], ax
pextrw eax, xmm0, 2
rol ax, 8
rol word [ebp - 0x8c8], 8
mov word [ebp - 0x8cc], ax
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43be90
sub esi, ecx
mov ecx, dword [edi + 0x26c]
mov eax, esi
bswap eax
mov dword [ebp - 0x8c0], eax
lea eax, [ebp - 0x8d4]
push 0x18
push eax
call fcn.004862f0
test eax, eax
je 0x43b800
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.00486260
test eax, eax
je 0x43b800
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_sent_pixel_format_to_client_n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [edi + 0x274]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x50]
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
cmp eax, vtable.vncClient.0
jne 0x43f5ea
mov eax, dword [ecx + 0x24c]
mov esi, dword [eax + 0x68]
add esi, 0xdc2c
push esi
mov dword [ebp - 0x9a4], esi
mov dword [ebp - 0x9a0], 0x5b
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
mov ecx, dword [edi + 0x274]
add ecx, 0x528
push ecx
lea ecx, [ebp - 0x958]
call fcn.00428640
mov byte [ebp - 4], 2
lea edx, [ebp - 0x958]
mov ecx, dword [edi + 0x274]
add ecx, 0x2a8
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x958]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x954]
call fcn.004dab64
add esp, 4
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 2
mov ecx, edi
call fcn.004bb400
mov eax, dword [edi + 0x274]
mov byte [eax + 0xc], 1
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov edx, dword [eax + 0x13c]
cmp eax, vtable.vncServer.0
jne 0x43f5f3
cmp dword [ecx + 0xac], 0
setne al
mov ecx, dword [edi + 0x274]
movzx esi, al
mov al, 1
mov byte [ebp - 0x93c], al
xor al, al
mov dword [ebp - 0x95c], esi
mov byte [ebp - 0x932], al
mov byte [ebp - 0x937], al
mov byte [ebp - 0x933], al
mov byte [ebp - 0x974], 1
mov byte [ebp - 0x934], al
mov byte [ebp - 0x935], al
mov byte [ebp - 0x936], al
cmp byte [ecx + 0xc], al
je 0x43f26b
mov dword [ebp - 0x998], 0x20
nop word [eax + eax]
mov eax, dword [ecx]
mov edx, dword [eax + 0x94]
cmp eax, vtable.vncClient.0
jne 0x43f5fa
cmp byte [ecx + 0x51a], 0
jne 0x43c115
cmp byte [ecx + 0x501], 0
jne 0x43c115
cmp byte [ecx + 0x502], 0
jne 0x43c115
call fcn.00484730
test eax, eax
jne 0x43c115
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_vncClientThread__n
push eax
push 0x558c50
call fcn.0041c840
add esp, 0xc
cmp dword [0x5674b4], 2
jne 0x43c115
push str.d:_saasultravncwinvncwinvnc_vncservice.cpp_:_SelectDesktop__n
push 0
push 0x558c50
call fcn.0041c840
push str.d:_saasultravncwinvncwinvnc_vncservice.cpp_:_OpenInputdesktop2_NULL_n
push 0
push 0x558c50
call fcn.0041c840
add esp, 0x18
push 0x400001cf
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
test esi, esi
je 0x43f24b
push str.d:_saasultravncwinvncwinvnc_vncservice.cpp_:_OpenInputdesktop2_OK_n
push 0
push 0x558c50
call fcn.0041c840
add esp, 0xc
mov ecx, esi
call fcn.00484590
test eax, eax
je 0x43f229
mov eax, dword [ebp - 0x968]
test eax, eax
je 0x43c109
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov dword [ebp - 0x968], esi
mov esi, dword [ebp - 0x95c]
mov ecx, dword [edi + 0x274]
cmp dword [ecx + 0x1a0], 0
je 0x43c149
cmp byte [ebp - 0x93c], 0
je 0x43c149
mov cl, 0x14
call fcn.0043b0d0
mov cl, 0x91
call fcn.0043b0d0
mov ecx, dword [edi + 0x274]
xor al, al
mov byte [ebp - 0x93c], al
test esi, esi
je 0x43c16b
mov ecx, dword [ecx + 0x24c]
mov ecx, dword [ecx + 0x68]
call fcn.00449c60
mov ecx, dword [edi + 0x274]
mov dword [ebp - 0x95c], 0
mov ecx, dword [ecx + 0x24c]
push dword [ebp - 0x974]
mov ecx, dword [ecx + 0x68]
call fcn.0044a5e0
cmp byte [ebp - 0x932], 0
mov byte [ebp - 0x974], 0
je 0x43c1bd
mov eax, dword [edi + 0x270]
mov ecx, dword [edi + 0x274]
push dword [eax + 0x83c]
push 2
call fcn.00443f90
mov ecx, dword [edi + 0x274]
push 1
call fcn.004440b0
xor al, al
mov byte [ebp - 0x932], al
cmp byte [ebp - 0x937], 0
je 0x43c1db
mov ecx, dword [edi + 0x274]
push 1
call fcn.004440b0
xor al, al
mov byte [ebp - 0x937], al
cmp byte [ebp - 0x933], 0
je 0x43c204
mov eax, dword [edi + 0x270]
mov ecx, dword [edi + 0x274]
push dword [eax + 0x840]
push 3
call fcn.00443f90
mov byte [ebp - 0x933], 0
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x160], 0
je 0x43c23a
cmp byte [eax + 0x68a], 0
je 0x43c23a
mov byte [eax + 0x160], 0
mov ecx, dword [edi + 0x274]
push dword [ecx + 0x15c]
push dword [ecx + 0x158]
call fcn.00443f90
cmp byte [ebp - 0x934], 0
je 0x43c256
mov ecx, dword [edi + 0x274]
call fcn.00444190
xor al, al
mov byte [ebp - 0x934], al
cmp byte [ebp - 0x935], 0
je 0x43c272
mov ecx, dword [edi + 0x274]
call fcn.00444280
xor al, al
mov byte [ebp - 0x935], al
cmp byte [ebp - 0x936], 0
je 0x43c28d
mov ecx, dword [edi + 0x274]
call fcn.00444430
mov byte [ebp - 0x936], 0
mov ecx, dword [edi + 0x26c]
mov esi, 1
cmp byte [ecx + 0x19], 0
jne 0x43c2ea
cmp byte [ecx + 0x18], 0
je 0x43c2ea
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov edx, dword [eax + 0x278]
cmp eax, vtable.vncServer.0
jne 0x43f603
mov eax, dword [ecx + 0x40c]
mov al, byte [eax + 0x21]
test al, al
je 0x43c2ea
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x924]
push 1
push eax
call fcn.004863e0
test eax, eax
je 0x43f261
xor esi, esi
jmp 0x43c306
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x924]
push 1
push eax
call fcn.004863e0
test eax, eax
je 0x43f261
movzx eax, byte [ebp - 0x924]
cmp eax, 0x50
ja case.0x43c31d.1
movzx eax, byte [eax + 0x43f694]
jmp dword [eax*4 + 0x43f658]
mov byte [ebp - 0x937], 1
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 0x14
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
mov eax, dword [edi + 0x274]
je 0x43cd5b
rol word [ebp - 0x91c], 8
xor ecx, ecx
rol word [ebp - 0x91a], 8
rol word [ebp - 0x918], 8
cmp byte [ebp - 0x913], 1
mov eax, dword [eax + 0x24c]
sete cl
mov dword [eax + 0x70], ecx
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [edi + 0x274]
lea eax, [ebp - 0x920]
push eax
add ecx, 0x1b8
call fcn.00435890
test eax, eax
jne 0x43c3cb
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_remote_pixel_format_invalid_n
push eax
push 0x558c50
call fcn.0041c840
mov eax, dword [edi + 0x274]
add esp, 0xc
mov byte [eax + 0xc], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x2e0], 1
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
call dword [eax + 0x50]
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 4
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43c31d.1
mov ecx, dword [edi + 0x274]
push 0
mov dword [ecx + 0x240], 0
mov ecx, dword [ecx + 0x24c]
call fcn.004347d0
mov eax, dword [edi + 0x274]
push 0xffffffffffffffff
mov dword [eax + 0x22c], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x230], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x234], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x238], 0
mov ecx, dword [edi + 0x274]
add ecx, 0x1b8
call fcn.00435a70
mov eax, dword [edi + 0x274]
mov dword [eax + 0x214], 0xffffffff
mov eax, dword [eax + 0x1d8]
test eax, eax
je 0x43c4a0
mov dword [eax + 0x6c], 0xffffffff
mov eax, dword [edi + 0x274]
mov dword [eax + 0x20c], 6
mov eax, dword [eax + 0x1d8]
test eax, eax
je 0x43c4c1
mov dword [eax + 0x64], 6
mov eax, dword [edi + 0x274]
mov dword [eax + 0x21c], 0
mov eax, dword [eax + 0x1d8]
test eax, eax
je 0x43c4e2
mov dword [eax + 0x74], 0
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x1d8]
mov dword [eax + 0x220], 0
test ecx, ecx
je 0x43c503
mov dword [ecx + 0x78], 0
mov dword [eax + 0x228], 0
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x1d8]
mov dword [eax + 0x224], 0
test ecx, ecx
je 0x43c52e
mov dword [ecx + 0x7c], 0
mov dword [eax + 0x228], 0
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x43f60a
mov dword [ecx + 0x610], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x368], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x36c], 0
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [edi + 0x274]
rol word [ebp - 0x922], 8
add ecx, 0x2a8
push 0
mov dword [ebp - 0x92c], 0
mov eax, dword [ecx]
call dword [eax + 0x10]
xor eax, eax
mov dword [ebp - 0x928], 0
cmp ax, word [ebp - 0x922]
jae 0x43cc2c
nop
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x964]
push 4
push eax
call fcn.004863e0
test eax, eax
je 0x43cc15
mov esi, dword [ebp - 0x964]
mov eax, esi
and eax, 0xff0000
mov ecx, esi
shr ecx, 0x10
mov edx, esi
or eax, ecx
shl edx, 0x10
mov ecx, esi
shr eax, 8
and ecx, 0xff00
or edx, ecx
shl edx, 8
or eax, edx
cmp eax, 1
jne 0x43c624
mov ecx, dword [edi + 0x274]
add ecx, 0x2a8
push 1
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x43cbf7
cmp eax, 0xffffff21
jne 0x43c640
mov eax, dword [edi + 0x274]
mov dword [eax + 0x358], 1
jmp 0x43cbf7
cmp eax, 0xffff0001
jne 0x43c67d
mov ecx, dword [edi + 0x274]
push 1
mov dword [ecx + 0x240], 1
mov ecx, dword [ecx + 0x24c]
call fcn.004347d0
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Cache_protocol_extension_enabled_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff0006
jne 0x43c6ad
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_XOR_protocol_extension_enabled_n
push 9
push 0x558c50
mov dword [eax + 0x22c], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffffff00
jb 0x43c70a
cmp eax, 0xffffff09
ja 0x43c70a
lea edx, [eax + 0x100]
mov ecx, 6
mov eax, dword [edi + 0x274]
cmp edx, 9
cmovbe ecx, edx
mov esi, dword [eax + 0x1d8]
mov dword [eax + 0x20c], ecx
test esi, esi
je 0x43c6f0
cmp ecx, 9
mov eax, 6
cmovbe eax, ecx
mov dword [esi + 0x64], eax
push edx
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_compression_level_requested:__d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
jmp 0x43cbf7
cmp eax, 0xffffffe0
jb 0x43c743
cmp eax, 0xffffffe9
ja 0x43c743
mov ecx, dword [edi + 0x274]
lea esi, [eax + 0x20]
push esi
add ecx, 0x1b8
call fcn.00435a70
push esi
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_image_quality_level_requested:__d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
jmp 0x43cbf7
cmp eax, 0xfffffe00
jb 0x43c79c
cmp eax, 0xfffffe64
ja 0x43c79c
lea edx, [eax + 0x200]
or ecx, 0xffffffff
mov eax, dword [edi + 0x274]
cmp edx, 0x64
cmovbe ecx, edx
mov esi, dword [eax + 0x1d8]
mov dword [eax + 0x214], ecx
test esi, esi
je 0x43c782
or eax, 0xffffffff
cmp ecx, 0x64
cmovbe eax, ecx
mov dword [esi + 0x6c], eax
push edx
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_fine_grained_image_quality_level_requested:__d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
jmp 0x43cbf7
cmp eax, 0xfffffd00
jb 0x43c7e3
cmp eax, 0xfffffd05
ja 0x43c7e3
lea ecx, [eax + 0x300]
mov eax, dword [edi + 0x274]
mov dword [eax + 0x218], ecx
mov eax, dword [eax + 0x1d8]
test eax, eax
je 0x43c7c9
mov dword [eax + 0x70], ecx
push ecx
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_subsampling_requested:__d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
jmp 0x43cbf7
cmp eax, 0xffffff20
jne 0x43c824
mov eax, dword [edi + 0x274]
mov dword [eax + 0x21c], 1
mov eax, dword [eax + 0x1d8]
test eax, eax
je 0x43c80b
mov dword [eax + 0x74], 1
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_LastRect_protocol_extension_enabled_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffffff10
jne 0x43c88c
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x1d8]
mov dword [eax + 0x220], 1
test ecx, ecx
je 0x43c84c
mov dword [ecx + 0x78], 1
mov dword [eax + 0x228], 0
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x43f617
mov dword [ecx + 0x610], 1
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_X_style_cursor_shape_updates_enabled_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffffff11
jne 0x43c8f4
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x1d8]
mov dword [eax + 0x224], 1
test ecx, ecx
je 0x43c8b4
mov dword [ecx + 0x7c], 1
mov dword [eax + 0x228], 0
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x43f624
mov dword [ecx + 0x610], 1
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Full_color_cursor_shape_updates_enabled_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffffff18
jne 0x43c924
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_PointerPos_protocol_extension_enabled_n
push 9
push 0x558c50
mov dword [eax + 0x374], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff8000
jne 0x43c95e
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_ServerState_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [eax + 0x688], 1
mov eax, dword [edi + 0x270]
mov byte [eax + 0x834], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff8003
jne 0x43c98b
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_KeepAlive_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [eax + 0x68c], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff8001
jne 0x43c9cc
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_KeepAlive_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [eax + 0x68b], 1
mov eax, dword [edi + 0x270]
mov byte [ebp - 0x932], 1
mov byte [eax + 0x835], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff8004
jne 0x43c9f3
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_IdleTime_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [ebp - 0x933], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xffff8002
jne 0x43ca1a
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_FTProtocolVersion_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [ebp - 0x934], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xc0a1e5ce
jne 0x43ca4e
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Extended_clipboard_protocol_extension_enabled_n
push 9
push 0x558c50
mov byte [ebp - 0x935], 1
mov byte [eax + 0x2e8], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0xc0a1e5cf
jne 0x43ca75
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Streaming_DSM_support_enabled_n
push 9
push 0x558c50
mov byte [ebp - 0x936], 1
call fcn.0041c840
add esp, 0xc
jmp 0x43cbf7
cmp eax, 0x10
jne 0x43caa4
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_ZRLE_found__n
push 9
push 0x558c50
mov dword [eax + 0x230], 1
call fcn.0041c840
mov esi, dword [ebp - 0x964]
add esp, 0xc
mov edx, esi
mov eax, esi
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov ecx, esi
shl ecx, 0x10
mov eax, esi
and eax, 0xff00
shr edx, 8
or ecx, eax
shl ecx, 8
or edx, ecx
cmp edx, 0x12
jne 0x43caf8
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_XZ_found__n
push 9
push 0x558c50
mov dword [eax + 0x234], 1
call fcn.0041c840
mov esi, dword [ebp - 0x964]
add esp, 0xc
mov ecx, esi
mov eax, esi
shr eax, 0x10
and ecx, 0xff0000
or ecx, eax
mov eax, esi
shl eax, 0x10
and esi, 0xff00
or eax, esi
shr ecx, 8
shl eax, 8
or ecx, eax
cmp ecx, 7
jne 0x43cb45
mov eax, dword [edi + 0x274]
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Tight_found_n
push 9
push 0x558c50
mov dword [eax + 0x238], 1
call fcn.0041c840
add esp, 0xc
cmp dword [ebp - 0x92c], 0
jne 0x43cbf7
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
cmp eax, vtable.vncClient.0
jne 0x43f631
mov eax, dword [ecx + 0x24c]
mov esi, dword [eax + 0x68]
add esi, 0xdc2c
push esi
mov dword [ebp - 0x9ac], esi
mov dword [ebp - 0x9a8], 0x55
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x964]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
or eax, ecx
shr edx, 8
mov ecx, dword [edi + 0x274]
shl eax, 8
add ecx, 0x1b8
push 0
or edx, eax
push edx
call fcn.00434bf0
mov ecx, dword [ebp - 0x92c]
test eax, eax
mov eax, 1
mov dword [ebp - 4], 0xffffffff
cmovne ecx, eax
push esi
mov dword [ebp - 0x92c], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x928]
movzx eax, word [ebp - 0x922]
inc esi
mov dword [ebp - 0x928], esi
cmp esi, eax
jl 0x43c5c0
jmp 0x43cc1f
mov eax, dword [edi + 0x274]
mov byte [eax + 0xc], 0
cmp dword [ebp - 0x92c], 0
jne 0x43ccc7
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_defaulting_to_raw_encoder_n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [edi + 0x274]
add esp, 0xc
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
cmp eax, vtable.vncClient.0
jne 0x43f63a
mov eax, dword [ecx + 0x24c]
mov esi, dword [eax + 0x68]
add esi, 0xdc2c
push esi
mov dword [ebp - 0x9b4], esi
mov dword [ebp - 0x9b0], 0x56
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 4
mov ecx, dword [edi + 0x274]
push 0
push 0
add ecx, 0x1b8
call fcn.00434bf0
test eax, eax
jne 0x43ccb9
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_failed_to_select_raw_encoder__n
push eax
push 0x558c50
call fcn.0041c840
mov eax, dword [edi + 0x274]
add esp, 0xc
mov byte [eax + 0xc], 0
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
cmp eax, vtable.vncServer.0
jne 0x43f643
mov eax, dword [ecx + 0x134]
cmp eax, 1
jbe 0x43cced
mov eax, dword [ecx]
call dword [eax + 0x28c]
mov eax, dword [edi + 0x274]
mov dword [eax + 0x190], 1
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
call dword [eax + 0x50]
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 0xa
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43c31d.1
movq xmm0, qword [ebp - 0x924]
sub esp, 0xc
mov ax, word [ebp - 0x91c]
mov ecx, esp
movq qword [ecx], xmm0
mov word [ecx + 8], ax
mov ecx, dword [edi + 0x274]
call fcn.00440570
test al, al
jne 0x43cd5f
mov eax, dword [edi + 0x274]
mov byte [eax + 0xc], 0
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2e8]
call eax
test eax, eax
je 0x43cd7e
mov ecx, dword [edi + 0x274]
call fcn.00443ec0
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0xc], 0
je 0x43f26b
mov esi, dword [ebp - 0x95c]
jmp 0x43c030
mov ecx, dword [edi + 0x26c]
mov eax, 8
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je 0x43cf25
cmp byte [0x55b152], 0
je 0x43ceb2
mov ecx, dword [ebp - 0x920]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp byte [ebp - 0x923], 0
mov dword [ebp - 0x920], edx
je 0x43cf25
add edx, 0xffffff9f
cmp edx, 0x63
ja 0x43cf25
mov eax, dword [edi + 0x274]
imul ecx, edx, 0x64
push str.GlobalSessionEventUltraPreConnect
push 0
mov eax, dword [eax + 0x24c]
push 2
mov eax, dword [eax + 0x68]
mov eax, dword [eax + 0xdbe0]
mov eax, dword [ecx + eax]
mov dword [0x55ad4c], eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.GlobalSessionUltraPreConnect
push 0
push 6
mov dword [ebp - 0x944], eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
je 0x43ce86
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x43ce7f
mov ecx, dword [0x55ad4c]
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x944]
test esi, esi
je 0x43cf25
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi + 0x274]
call fcn.004428f0
jmp 0x43cd5f
mov edx, dword [edi + 0x274]
cmp dword [edx + 0x1a0], 0
je 0x43cf25
mov ecx, dword [ebp - 0x920]
mov esi, ecx
mov eax, ecx
and esi, 0xff0000
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
cmp byte [ebp - 0x923], 0
mov dword [ebp - 0x920], esi
mov ecx, esi
movzx eax, byte [edx + 0x1a9]
push eax
movzx eax, byte [edx + 0x1a8]
setne dl
push eax
call fcn.0046f8c0
add esp, 8
mov eax, dword [edi + 0x274]
mov dword [eax + 0x2e4], 1
mov ecx, dword [edi + 0x274]
call fcn.004428f0
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 6
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je 0x43cd5f
cmp byte [0x55b152], 0
jne 0x43cd5f
mov esi, dword [edi + 0x274]
cmp dword [esi + 0x1a4], 0
je 0x43cd5f
movzx eax, word [ebp - 0x922]
rol ax, 8
movzx ecx, ax
movzx eax, word [ebp - 0x920]
rol ax, 8
movzx edx, ax
mov word [ebp - 0x922], cx
mov word [ebp - 0x920], dx
movzx eax, word [esi + 0x538]
mov esi, ecx
imul esi, eax
mov eax, edx
mov edx, dword [edi + 0x274]
mov dword [ebp - 0x928], 0x8000
mov word [ebp - 0x922], si
movzx ecx, word [edx + 0x538]
imul ecx, eax
mov word [ebp - 0x920], cx
movzx eax, cx
cmp si, word [edx + 0x2a2]
jne 0x43cfee
cmp ax, word [edx + 0x2a4]
je 0x43cff8
mov dword [ebp - 0x928], 0x8001
mov al, byte [edx + 0x2a1]
mov dl, byte [ebp - 0x923]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor al, dl
test al, 1
je 0x43d050
push 0x17
call esi
mov dl, byte [ebp - 0x923]
test eax, eax
mov ecx, dword [ebp - 0x928]
mov al, dl
not al
je 0x43d03c
and eax, 1
lea eax, [eax*8 + 8]
or ecx, eax
mov dword [ebp - 0x928], ecx
jmp 0x43d056
and eax, 1
lea eax, [eax*2 + 2]
or ecx, eax
mov dword [ebp - 0x928], ecx
jmp 0x43d056
mov ecx, dword [ebp - 0x928]
mov eax, dword [edi + 0x274]
mov dh, dl
and dh, 2
mov al, byte [eax + 0x2a1]
mov byte [ebp - 0x931], al
and al, 2
cmp dh, al
je 0x43d089
test dh, dh
mov eax, 0x40
cmovne eax, dword [ebp - 0x998]
or ecx, eax
mov dword [ebp - 0x928], ecx
xor dl, byte [ebp - 0x931]
test dl, 4
je 0x43d0cb
push 0x17
call esi
test eax, eax
mov eax, 0
je 0x43d0b4
test byte [ebp - 0x923], 4
sete al
lea eax, [eax*2 + 2]
jmp 0x43d0c5
test byte [ebp - 0x923], 4
sete al
lea eax, [eax*8 + 8]
or dword [ebp - 0x928], eax
mov ecx, dword [edi + 0x274]
xor esi, esi
add ecx, 0x1b8
mov dword [ebp - 0x92c], esi
call fcn.00435ad0
mov cl, byte [ebp - 0x923]
test eax, eax
je 0x43d12d
mov eax, dword [edi + 0x274]
test cl, 8
je 0x43d113
test byte [eax + 0x2a1], 8
jne 0x43d113
or dword [ebp - 0x928], 0x800
mov esi, 0x78
jmp 0x43d17f
test cl, 0x10
je 0x43d185
test byte [eax + 0x2a1], 0x10
jne 0x43d185
or dword [ebp - 0x928], 0x800
jmp 0x43d17a
mov eax, dword [ebp - 0x928]
mov esi, 0x78
or eax, 0x800
mov dword [ebp - 0x944], 0
and cl, 8
cmove eax, dword [ebp - 0x928]
test cl, cl
mov dword [ebp - 0x928], eax
cmove esi, dword [ebp - 0x944]
test byte [ebp - 0x923], 0x10
mov dword [ebp - 0x92c], esi
je 0x43d185
or eax, 0x800
mov dword [ebp - 0x928], eax
mov esi, 0xffffff88
mov dword [ebp - 0x92c], esi
mov ecx, dword [edi + 0x270]
lea edx, [ebp - 0x9a0]
push edx
lea edx, [ebp - 0x990]
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x994]
push edx
call dword [eax + 0x194]
mov ecx, dword [edi + 0x274]
mov dword [ebp - 0x944], ecx
cmp dword [ecx + 0x178], 1
jne 0x43d245
mov ecx, dword [ecx + 0x168]
movzx eax, word [ebp - 0x922]
add ecx, eax
imul eax, ecx, 0xffff
mov ecx, dword [ebp - 0x994]
dec ecx
cdq
idiv ecx
mov edx, dword [ebp - 0x944]
movzx ecx, word [ebp - 0x920]
mov edi, eax
mov edx, dword [edx + 0x16c]
add edx, ecx
mov ecx, dword [ebp - 0x990]
imul eax, edx, 0xffff
dec ecx
cdq
idiv ecx
mov ecx, dword [ebp - 0x94c]
mov esi, eax
mov ecx, dword [ecx + 0x270]
call fcn.00481f00
neg eax
sbb eax, eax
and eax, 0x564e4300
push eax
mov eax, dword [ebp - 0x92c]
push eax
push esi
mov esi, dword [ebp - 0x928]
push edi
push esi
call dword [sym.imp.USER32.dll_mouse_event]
mov edi, dword [ebp - 0x94c]
jmp 0x43d498
add ecx, 0x668
call fcn.00429ed0
test al, al
je 0x43d396
mov esi, dword [edi + 0x274]
push 0x4c
mov dword [ebp - 0x8f0], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esi + 0x170]
add edx, dword [esi + 0x168]
movzx ecx, word [ebp - 0x922]
mov esi, dword [edi + 0x274]
add edx, ecx
sub edx, eax
push 0x4d
mov dword [ebp - 0x944], edx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esi + 0x174]
add edx, dword [esi + 0x16c]
movzx ecx, word [ebp - 0x920]
add edx, ecx
mov ecx, dword [edi + 0x270]
sub edx, eax
mov dword [ebp - 0x940], edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
test eax, eax
je 0x43d2f4
mov eax, dword [edi + 0x274]
movzx esi, word [ebp - 0x922]
movzx ecx, word [ebp - 0x920]
add esi, dword [eax + 0x168]
add ecx, dword [eax + 0x16c]
mov dword [ebp - 0x940], ecx
jmp 0x43d2fa
mov esi, dword [ebp - 0x944]
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
lea ecx, [eax - 1]
imul eax, esi, 0xffff
cdq
idiv ecx
mov dword [ebp - 0x8ec], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [eax - 1]
imul eax, dword [ebp - 0x940], 0xffff
cdq
idiv ecx
mov ecx, dword [edi + 0x270]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x928]
or eax, 0x4000
mov dword [ebp - 0x8e0], eax
call fcn.00481f00
mov ecx, dword [edi + 0x274]
neg eax
push 0x1c
sbb eax, eax
mov dword [ebp - 0x8dc], 0
and eax, 0x564e4300
add ecx, 0x668
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x8e4], eax
lea eax, [ebp - 0x8f0]
push eax
push 1
call fcn.00444ce0
call eax
jmp 0x43d498
lea eax, [ebp - 0x9bc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x98c], 0xa
test al, 1
je 0x43d42c
and eax, 0xffff7fff
push 0
mov dword [ebp - 0x928], eax
lea eax, [ebp - 0x868]
push eax
push 0
push 3
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x988]
push eax
push 0
push 0x70
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x98c]
mov dword [ebp - 0x85c], 0xa
push eax
push 0
push 0x71
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x854], 0
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x85c]
push eax
push 0
push 4
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [edi + 0x270]
call fcn.00481f00
neg eax
sbb eax, eax
and eax, 0x564e4300
push eax
movzx eax, word [ebp - 0x920]
sub eax, dword [ebp - 0x9b8]
push esi
mov esi, dword [ebp - 0x928]
push eax
movzx eax, word [ebp - 0x922]
sub eax, dword [ebp - 0x9bc]
push eax
push esi
call dword [sym.imp.USER32.dll_mouse_event]
test byte [ebp - 0x928], 1
je 0x43d498
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x868]
push 0
push eax
push 0
push 4
call esi
push 0
lea eax, [ebp - 0x988]
push eax
push 0
push 0x71
call esi
mov ecx, dword [edi + 0x274]
mov eax, dword [ebp - 0x924]
mov dword [ecx + 0x2a0], eax
mov ax, word [ebp - 0x920]
mov word [ecx + 0x2a4], ax
jmp 0x43cf15
mov ecx, dword [edi + 0x26c]
mov eax, 8
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je 0x43cd5f
mov ecx, dword [ebp - 0x920]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
cmp esi, 0x6400000
jg 0x43cd5f
test esi, esi
jns 0x43d690
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x2e8], 0
je 0x43cd5f
mov eax, esi
lea ecx, [ebp - 0x984]
cdq
mov esi, eax
xor esi, edx
sub esi, edx
call fcn.0041adc0
push 0
push esi
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], 5
call fcn.0041af40
push esi
lea ecx, [ebp - 0x984]
call fcn.0041aeb0
mov ecx, dword [edi + 0x26c]
push eax
call fcn.004863e0
lea ecx, [ebp - 0x984]
test eax, eax
jne 0x43d58e
mov dword [ebp - 4], 0xffffffff
call fcn.0041ae30
jmp 0x43cd5f
call fcn.0041afb0
and eax, 0xff000000
test eax, 0x1000000
jne 0x43d65f
cmp eax, 0x4000000
ja 0x43d626
je 0x43d5c6
cmp eax, 0x1000000
je 0x43d65f
cmp eax, 0x2000000
jne 0x43d679
lea ecx, [ebp - 0x8f8]
call fcn.0041b0e0
push 0
lea ecx, [ebp - 0x8f8]
mov byte [ebp - 4], 6
call fcn.0041b180
test al, al
je 0x43d604
lea ecx, [ebp - 0x984]
call fcn.0041afb0
mov ecx, dword [edi + 0x274]
push eax
lea eax, [ebp - 0x8f8]
push eax
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [ebp - 0x8f8]
call fcn.0041b130
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ae30
jmp 0x43cd5f
cmp eax, 0x10000000
jne 0x43d679
mov ecx, dword [edi + 0x270]
lea eax, [ebp - 0x984]
push dword [edi + 0x274]
push eax
mov eax, dword [ecx]
call dword [eax + 0x100]
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ae30
jmp 0x43cd5f
mov ecx, dword [edi + 0x274]
lea eax, [ebp - 0x984]
push 1
push eax
add ecx, 0x2e8
call fcn.0041afe0
lea ecx, [ebp - 0x984]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ae30
jmp 0x43cd5f
lea eax, [esi + 1]
push eax
call fcn.004cbf7b
add esp, 4
mov dword [ebp - 0x92c], eax
test eax, eax
je 0x43cd5f
push esi
mov byte [eax + esi], 0
mov ecx, dword [edi + 0x26c]
push eax
call fcn.004863e0
test eax, eax
jne 0x43d6d2
push dword [ebp - 0x92c]
call fcn.004cbf38
add esp, 4
jmp 0x43cd5f
mov esi, dword [ebp - 0x92c]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x43d6e0
sub esi, ecx
lea eax, [esi*2 + 1]
push eax
call fcn.004cbf7b
add esp, 4
mov dword [ebp - 0x940], eax
xor ecx, ecx
xor edx, edx
test esi, esi
jle 0x43d73a
mov edi, eax
nop dword [eax]
mov eax, dword [ebp - 0x92c]
mov al, byte [edx + eax]
cmp al, 0xa
jne 0x43d72b
mov eax, dword [ebp - 0x92c]
mov byte [ecx + edi], 0xd
inc ecx
mov al, byte [edx + eax]
mov byte [ecx + edi], al
inc edx
inc ecx
cmp edx, esi
jl 0x43d710
mov edi, dword [ebp - 0x94c]
mov esi, dword [ebp - 0x940]
push dword [ebp - 0x92c]
mov byte [ecx + esi], 0
call fcn.004cbf38
add esp, 4
test esi, esi
je 0x43cd5f
mov ecx, dword [edi + 0x274]
push esi
add ecx, 0x318
call fcn.0041be90
mov ecx, dword [edi + 0x270]
push esi
mov eax, dword [ecx]
call dword [eax + 0xfc]
push esi
call fcn.004cbf38
add esp, 4
jmp 0x43cd5f
mov ecx, dword [edi + 0x270]
call fcn.0047f990
test al, al
jne case.0x43c31d.8
mov eax, dword [edi + 0x274]
mov byte [eax + 0x541], 1
mov eax, dword [edi + 0x274]
mov ecx, dword [edi + 0x26c]
cmp byte [eax + 0x541], 0
mov eax, 4
je 0x43d7d9
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
jne 0x43d7f2
jmp case.0x43c31d.1
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43c31d.1
mov ecx, dword [edi + 0x270]
call fcn.0047f990
cmp al, 1
je 0x43cd5f
mov cl, byte [ebp - 0x923]
mov al, cl
dec al
cmp al, 8
ja 0x43cd5f
mov eax, dword [edi + 0x274]
movzx ecx, cl
mov dword [eax + 0x53c], ecx
mov eax, dword [edi + 0x274]
movzx ecx, byte [ebp - 0x923]
mov dword [eax + 0x538], ecx
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
push 0x57
push eax
lea ecx, [ebp - 0x9c4]
call fcn.0041e930
mov dword [ebp - 4], 7
mov ecx, dword [edi + 0x274]
movzx eax, byte [ebp - 0x923]
push eax
mov ecx, dword [ecx + 0x24c]
call fcn.00432a40
test eax, eax
mov eax, dword [edi + 0x274]
jne 0x43d899
lea ecx, [ebp - 0x9c4]
mov byte [eax + 0xc], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0041e950
jmp 0x43cd5f
mov byte [eax + 0x540], 1
mov eax, dword [edi + 0x274]
movzx ecx, byte [ebp - 0x923]
push 1
push 0
mov eax, dword [eax + 0x24c]
push 0
mov esi, dword [eax + 0x68]
mov eax, dword [esi + 0xdbd8]
cdq
idiv ecx
mov dword [esi + 0xdbd8], eax
mov eax, dword [edi + 0x274]
movzx ecx, byte [ebp - 0x923]
mov eax, dword [eax + 0x24c]
mov esi, dword [eax + 0x68]
mov eax, dword [esi + 0xdbdc]
cdq
idiv ecx
mov dword [esi + 0xdbdc], eax
mov eax, dword [edi + 0x274]
movzx ecx, byte [ebp - 0x923]
mov eax, dword [eax + 0x24c]
mov esi, dword [eax + 0x68]
mov eax, dword [esi + 0xdbd0]
cdq
idiv ecx
mov dword [esi + 0xdbd0], eax
mov eax, dword [edi + 0x274]
movzx ecx, byte [ebp - 0x923]
mov eax, dword [eax + 0x24c]
mov esi, dword [eax + 0x68]
mov eax, dword [esi + 0xdbd4]
cdq
idiv ecx
mov dword [esi + 0xdbd4], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [edi + 0x274]
call fcn.004408a0
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 4], 0xffffffff
call fcn.0041e950
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 4
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
mov eax, dword [edi + 0x274]
je 0x43cd5b
mov byte [eax + 0x68a], 1
mov eax, dword [edi + 0x274]
cmp dword [eax + 0x1a0], 0
je 0x43cd5f
cmp byte [ebp - 0x923], 1
mov ecx, str.enabled
mov eax, str.disabled
cmovne eax, ecx
push eax
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_rfbSetServerInput:_inputs__s_n
push 9
push 0x558c50
call fcn.0041c840
mov ecx, dword [edi + 0x270]
add esp, 0x10
mov eax, dword [ecx]
mov eax, dword [eax + 0x70]
call eax
mov ecx, eax
call fcn.00434a00
test al, al
jne 0x43da18
cmp byte [ebp - 0x923], 1
jne 0x43da18
mov eax, dword [edi + 0x274]
push 1
mov ecx, dword [eax + 0x24c]
mov ecx, dword [ecx + 0x68]
call fcn.0044a510
mov eax, dword [edi + 0x274]
mov byte [eax + 0x689], 1
jmp 0x43cd5f
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x70]
call eax
mov ecx, eax
call fcn.00434a00
test al, al
je 0x43da48
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x689], 0
je 0x43da48
cmp byte [ebp - 0x923], 0
je 0x43da82
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x70]
call eax
mov ecx, eax
call fcn.00434a00
test al, al
jne 0x43cd5f
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x689], al
jne 0x43cd5f
cmp byte [ebp - 0x923], al
jne 0x43cd5f
mov ecx, dword [ecx + 0x24c]
push 0
mov ecx, dword [ecx + 0x68]
call fcn.0044a510
mov eax, dword [edi + 0x274]
mov byte [eax + 0x689], 0
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 6
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43c31d.1
mov ax, word [ebp - 0x922]
mov cx, word [ebp - 0x920]
rol ax, 8
movzx eax, ax
mov dword [ebp - 0x944], eax
cmp eax, 5
jae 0x43db12
mov ax, cx
rol ax, 8
cmp ax, 5
jae 0x43db12
mov eax, dword [edi + 0x274]
push 1
push 1
mov ecx, dword [eax + 0x24c]
mov ecx, dword [ecx + 0x68]
call fcn.00449c80
jmp 0x43cd5f
mov esi, dword [edi + 0x274]
rol cx, 8
movzx eax, cx
add eax, dword [esi + 0x174]
add eax, dword [esi + 0x16c]
mov edx, dword [esi + 0x538]
mov ecx, dword [esi + 0x170]
add ecx, dword [esi + 0x168]
imul eax, edx
push eax
mov eax, dword [ebp - 0x944]
movzx eax, ax
add ecx, eax
imul ecx, edx
push ecx
mov ecx, dword [esi + 0x24c]
mov ecx, dword [ecx + 0x68]
call fcn.00449c80
jmp 0x43cd5f
mov ecx, dword [edi + 0x274]
push esi
mov ecx, dword [ecx + 0x554]
call fcn.0042cc90
jmp 0x43cd5f
mov ecx, dword [edi + 0x270]
mov byte [ebp - 0x93b], 1
mov eax, dword [ecx]
mov eax, dword [eax + 0x2e8]
call eax
test eax, eax
je 0x43dba6
mov ecx, dword [edi + 0x274]
call fcn.00443c40
mov byte [ebp - 0x93b], al
mov ecx, dword [edi + 0x274]
cmp dword [ecx + 0x1a0], 0
je 0x43dbbe
cmp dword [ecx + 0x1a4], 0
jne 0x43dbc5
mov byte [ebp - 0x93b], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
push 0x58
push eax
lea ecx, [ebp - 0x9dc]
call fcn.0041e930
mov dword [ebp - 4], 8
mov eax, dword [edi + 0x274]
mov dword [eax + 0x380], 1
mov eax, 0xc
mov ecx, dword [edi + 0x26c]
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je 0x43f144
movzx eax, byte [ebp - 0x923]
dec eax
cmp eax, 0xf
ja case.0x43dc26.2
jmp dword [eax*4 + 0x43f6e8]
mov eax, dword [edi + 0x274]
mov byte [eax + 0x502], 1
jmp case.0x43dc26.2
mov eax, dword [edi + 0x274]
mov byte [eax + 0x502], 0
jmp case.0x43dc26.2
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
push 0x59
push eax
lea ecx, [ebp - 0x958]
call fcn.0041e930
mov byte [ebp - 4], 9
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je 0x43e3e5
cmp byte [ebp - 0x93b], 0
je 0x43e3e5
mov ecx, dword [ebp - 0x91c]
mov esi, ecx
mov eax, ecx
and esi, 0xff0000
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
mov eax, dword [edi + 0x274]
push 0x144
add eax, 0x388
push 0
push eax
call fcn.004cddb0
add esp, 0xc
cmp esi, 0x138
jbe 0x43dcf2
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
mov eax, dword [edi + 0x274]
mov ecx, dword [edi + 0x26c]
add eax, 0x388
push esi
push eax
call fcn.004863e0
test eax, eax
jne 0x43dd1e
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x920]
mov edx, ecx
mov eax, ecx
mov dword [ebp - 0x970], 0
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
mov ecx, dword [edi + 0x26c]
shl eax, 8
or edx, eax
lea eax, [ebp - 0x970]
push 4
push eax
mov dword [ebp - 0x92c], edx
call fcn.004863e0
test eax, eax
jne 0x43dd80
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x970]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
or eax, ecx
shr edx, 8
mov ecx, dword [edi + 0x274]
shl eax, 8
add ecx, 0x388
or edx, eax
mov dword [ebp - 0x930], edx
mov edx, 0x2c
call fcn.004349f0
mov dword [ebp - 0x944], eax
test eax, eax
jne 0x43dddf
mov eax, dword [edi + 0x274]
mov byte [eax + 0x4cc], 0
jmp 0x43ddfc
mov ecx, dword [edi + 0x274]
lea edx, [eax + 1]
add ecx, 0x4cc
call fcn.00444e10
mov eax, dword [ebp - 0x944]
mov byte [eax], 0
mov edx, dword [edi + 0x274]
lea ecx, [ebp - 0x910]
add edx, 0x388
call fcn.004362d0
mov ecx, eax
call fcn.00425fa0
mov ecx, dword [edi + 0x274]
mov edx, eax
add ecx, 0x388
call fcn.00444e20
lea ecx, [ebp - 0x910]
call fcn.0041bea0
lea eax, [esi + 0x41]
mov dword [ebp - 0x928], 0
push eax
mov dword [ebp - 0x940], eax
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
jne 0x43de6a
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
push dword [ebp - 0x940]
push 0
push esi
call fcn.004cddb0
mov eax, dword [edi + 0x274]
add eax, 0x388
push eax
push dword [ebp - 0x940]
push esi
call fcn.004d0170
add esp, 0x18
mov edx, 0x5c
mov ecx, esi
call fcn.004349f0
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43deeb
lea ecx, [ebp - 0x9e4]
push ecx
lea ecx, [ebp - 0x9ec]
push ecx
lea ecx, [ebp - 0x9cc]
push ecx
push esi
call eax
mov ecx, dword [ebp - 0x928]
test eax, eax
mov eax, 0xffffffff
cmove ecx, eax
mov dword [ebp - 0x928], ecx
push esi
call fcn.004cbf38
add esp, 4
mov ecx, 0xa
mov eax, dword [ebp - 0x9cc]
mov edx, dword [ebp - 0x9c8]
shrd eax, edx, cl
sar edx, cl
xor ecx, ecx
mov dword [ebp - 0x944], edx
add ecx, dword [ebp - 0x92c]
mov esi, eax
mov edx, dword [ebp - 0x930]
push 0
push 0x3e8
adc edx, 0
push edx
push ecx
call fcn.004cc6d0
xor ecx, ecx
cmp ecx, edx
jg 0x43df47
jl 0x43df3d
cmp esi, eax
jae 0x43df47
mov dword [ebp - 0x928], 0xffffffff
push 0x2400
call fcn.004cbf7b
mov ecx, dword [edi + 0x274]
mov esi, 0xffffffff
push 0x2000
mov dword [ecx + 0x4e0], eax
mov eax, dword [edi + 0x274]
cmp dword [eax + 0x4e0], 0
mov eax, dword [ebp - 0x928]
cmove eax, esi
mov dword [ebp - 0x928], eax
call fcn.004cbf7b
mov ecx, dword [edi + 0x274]
add esp, 8
xorps xmm0, xmm0
mov dword [ecx + 0x4e4], eax
mov eax, dword [edi + 0x274]
mov ecx, dword [ebp - 0x928]
cmp dword [eax + 0x4e4], 0
movq qword [ebp - 0x880], xmm0
cmove ecx, esi
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x928], ecx
mov byte [ebp - 0x880], 7
cmp ecx, esi
je 0x43e1d1
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x43dfeb
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov eax, dword [edi + 0x274]
push 0
push 0x8000000
push 4
push 0
push 3
push 0xc0000000
add eax, 0x388
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [edi + 0x274]
mov dword [ecx + 0x4e8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi + 0x274]
cmp eax, 0xb7
sete al
xor ecx, ecx
mov esi, dword [edx + 0x4e8]
cmp esi, 0xffffffff
setne cl
dec ecx
mov dword [ebp - 0x930], ecx
mov dword [ebp - 0x928], ecx
test al, al
je 0x43e1cb
mov dword [ebp - 0x928], ecx
cmp esi, 0xffffffff
je 0x43e1d1
lea eax, [ebp - 0x9d4]
mov ecx, edx
push eax
lea eax, [edx + 0x388]
push eax
call fcn.00443ba0
mov esi, dword [ebp - 0x930]
mov ecx, esi
mov dword [ebp - 0x928], ecx
test al, al
je 0x43e1d1
mov ecx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x9d0]
shrd ecx, eax, 0xd
lea eax, [ecx*4 + 0x400]
push eax
mov dword [ebp - 0x940], eax
call fcn.004cbf7b
add esp, 4
mov dword [ebp - 0x92c], eax
mov ecx, esi
mov dword [ebp - 0x928], ecx
test eax, eax
je 0x43e1d1
mov ecx, dword [edi + 0x274]
push 0x2000
mov eax, dword [ecx + 0x4e8]
mov dword [ebp - 0x930], eax
call fcn.004cbf7b
add esp, 4
test eax, eax
jne 0x43e0f2
mov ecx, esi
mov dword [ebp - 0x928], ecx
jmp 0x43e1d1
mov ecx, dword [ebp - 0x930]
push eax
push dword [ebp - 0x92c]
call fcn.00442910
mov dword [ebp - 0x944], eax
mov ecx, esi
mov dword [ebp - 0x928], ecx
cmp eax, 0xffffffff
je 0x43e1d1
mov ecx, dword [ebp - 0x940]
mov edx, ecx
and ecx, 0xff00
shl edx, 0x10
or edx, ecx
mov byte [ebp - 0x87f], 0xc
mov ecx, dword [ebp - 0x940]
mov eax, ecx
sar eax, 8
and eax, 0xff00
shr ecx, 0x18
shl edx, 8
or edx, eax
or edx, ecx
mov dword [ebp - 0x87c], edx
mov edx, dword [ebp - 0x944]
mov ecx, edx
shl ecx, 0x10
mov eax, edx
and eax, 0xff00
or ecx, eax
mov eax, edx
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, edx
shr eax, 0x18
or ecx, eax
lea eax, [ebp - 0x880]
push 7
push 0xc
mov dword [ebp - 0x878], ecx
mov ecx, dword [edi + 0x26c]
push eax
call fcn.00486210
mov eax, dword [ebp - 0x944]
mov ecx, dword [edi + 0x26c]
push eax
push dword [ebp - 0x92c]
call fcn.004862f0
push dword [ebp - 0x92c]
call fcn.004cbf38
mov ecx, esi
add esp, 4
mov dword [ebp - 0x928], ecx
jmp 0x43e1d1
mov ecx, dword [ebp - 0x928]
mov esi, dword [edi + 0x274]
bswap ecx
add esi, 0x388
mov dword [ebp - 0x87c], ecx
mov ecx, esi
mov byte [ebp - 0x87f], 9
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e1f1
sub ecx, edx
mov edx, esi
mov dword [ebp - 0x944], ecx
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x43e205
sub edx, ecx
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x930], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e220
sub ecx, dword [ebp - 0x930]
lea eax, [esi + 1]
mov dword [ebp - 0x930], eax
mov al, byte [esi]
inc esi
test al, al
jne 0x43e236
sub esi, dword [ebp - 0x930]
and ecx, 0xff00
mov eax, dword [ebp - 0x944]
and edx, 0xff0000
shl esi, 0x10
shr eax, 0x10
or esi, ecx
mov ecx, dword [edi + 0x26c]
or edx, eax
push 7
shr edx, 8
lea eax, [ebp - 0x880]
shl esi, 8
push 0xc
or esi, edx
push eax
mov dword [ebp - 0x878], esi
call fcn.00486210
mov edx, dword [edi + 0x274]
add edx, 0x388
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e294
sub ecx, esi
push ecx
mov ecx, dword [edi + 0x26c]
push edx
call fcn.00486260
cmp dword [ebp - 0x928], 0xffffffff
jne 0x43e326
mov ecx, dword [edi + 0x274]
add ecx, 0x4e8
call fcn.004868a0
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x4e4]
test ecx, ecx
je 0x43e2f3
push ecx
call fcn.004cbf38
mov eax, dword [edi + 0x274]
add esp, 4
mov dword [eax + 0x4e4], 0
mov eax, dword [edi + 0x274]
mov eax, dword [eax + 0x4e0]
test eax, eax
je 0x43e316
push eax
call fcn.004cbf38
mov eax, dword [edi + 0x274]
add esp, 4
mov dword [eax + 0x4e0], 0
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x920]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov eax, dword [edi + 0x274]
mov dword [eax + 0x4ec], edx
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx + 0x4ec]
shr eax, 0xd
mov dword [ecx + 0x4f0], eax
mov eax, dword [edi + 0x274]
mov dword [eax + 0x4f4], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x4f8], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x4fc], 0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x503], 0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x500], 0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x501], 1
mov ecx, dword [edi + 0x270]
call fcn.004362c0
mov ecx, dword [edi + 0x26c]
imul eax, eax, 0x3e8
push eax
call fcn.00485f70
lea ecx, [ebp - 0x958]
call fcn.0041e950
jmp case.0x43dc26.2
push dword [ebp - 0x93b]
movups xmm0, xmmword [ebp - 0x924]
mov eax, dword [ebp - 0x914]
sub esp, 0x14
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
mov ecx, dword [edi + 0x274]
call fcn.00444580
jmp case.0x43dc26.2
mov ecx, dword [edi + 0x270]
call fcn.004362c0
mov ecx, dword [edi + 0x26c]
imul eax, eax, 0x3e8
push eax
call fcn.00485f10
mov ecx, dword [ebp - 0x91c]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov eax, dword [edi + 0x274]
jl 0x43e48a
push edx
mov ecx, eax
call fcn.004429b0
mov cl, al
mov eax, dword [edi + 0x274]
mov byte [eax + 0xc], cl
jmp case.0x43dc26.2
xor cl, cl
mov byte [eax + 0xc], cl
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x920]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 0xffffffff
jne 0x43e4d9
mov ecx, dword [edi + 0x274]
add ecx, 0x504
call fcn.004868a0
jmp case.0x43dc26.2
push 0x2000
call fcn.004cbf7b
mov ecx, dword [edi + 0x274]
add esp, 4
mov dword [ecx + 0x4e0], eax
mov ecx, dword [edi + 0x274]
cmp dword [ecx + 0x4e0], 0
jne 0x43e511
add ecx, 0x504
call fcn.004868a0
jmp case.0x43dc26.2
push 0x2400
call fcn.004cbf7b
mov ecx, dword [edi + 0x274]
add esp, 4
mov dword [ecx + 0x4e4], eax
mov eax, dword [edi + 0x274]
cmp dword [eax + 0x4e4], 0
jne 0x43e576
lea ecx, [eax + 0x504]
call fcn.004868a0
mov eax, dword [edi + 0x274]
mov eax, dword [eax + 0x4e0]
test eax, eax
je case.0x43dc26.2
push eax
call fcn.004cbf38
mov eax, dword [edi + 0x274]
add esp, 4
mov dword [eax + 0x4e0], 0
jmp case.0x43dc26.2
mov byte [eax + 0x508], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x50c], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x4fc], 0
mov eax, dword [edi + 0x274]
mov dword [eax + 0x514], 0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x519], 0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x51a], 1
mov eax, dword [edi + 0x274]
mov byte [eax + 0x503], 0
mov ecx, dword [edi + 0x274]
call fcn.00443050
mov ecx, dword [edi + 0x274]
mov byte [ecx + 0xc], al
jmp case.0x43dc26.2
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
mov ecx, dword [ebp - 0x920]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
mov ecx, dword [ebp - 0x91c]
shl eax, 8
or edx, eax
mov eax, ecx
push edx
mov edx, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
mov ecx, dword [edi + 0x274]
shl eax, 8
or edx, eax
push edx
call fcn.00442a20
mov ecx, dword [edi + 0x274]
push 0
mov byte [ecx + 0xc], al
mov ecx, dword [edi + 0x274]
call fcn.004440b0
jmp case.0x43dc26.2
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x501], 0
je case.0x43dc26.2
call fcn.00442b60
jmp case.0x43dc26.2
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x501], 0
je 0x43e703
mov byte [eax + 0x500], 1
mov eax, dword [edi + 0x274]
mov byte [eax + 0x503], 1
mov ecx, dword [edi + 0x274]
call fcn.00442b60
jmp case.0x43dc26.2
cmp byte [eax + 0x51a], 0
je 0x43e725
mov byte [eax + 0x519], 1
mov eax, dword [edi + 0x274]
mov byte [eax + 0x503], 1
jmp case.0x43dc26.2
mov byte [eax + 0x542], 1
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x542], 0
je case.0x43dc26.2
mov cx, word [ebp - 0x922]
mov eax, 0xe
test cx, cx
mov dword [ebp - 0x884], 0
xorps xmm0, xmm0
sete dl
movq qword [ebp - 0x88c], xmm0
test cx, cx
mov byte [ebp - 0x88c], 7
mov ecx, 7
cmove eax, ecx
mov byte [ebp - 0x88b], al
test dl, dl
jne 0x43e7c3
mov ecx, dword [edi + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je 0x43e7c3
mov eax, dword [edi + 0x274]
mov ecx, dword [eax + 0x270]
mov eax, dword [ecx]
mov eax, dword [eax + 0x134]
call eax
test eax, eax
je 0x43e7c3
cmp byte [ebp - 0x93b], 0
mov dword [ebp - 0x888], 0x1000000
jne 0x43e7cd
mov dword [ebp - 0x888], 0xffffffff
mov ecx, dword [edi + 0x274]
lea eax, [ebp - 0x88c]
push 7
push 0xc
push eax
mov ecx, dword [ecx + 0x198]
call fcn.004861c0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x542], 0
jmp case.0x43dc26.2
movzx eax, word [ebp - 0x922]
sub eax, 1
je 0x43e943
sub eax, 1
jne case.0x43dc26.2
lea eax, [ebp - 0x114]
xor esi, esi
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [edi + 0x270]
mov dword [ebp - 0x944], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x224]
call edx
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
mov eax, dword [ebp - 0x944]
add eax, 0xfffffffd
mov dword [ebp - 0x930], eax
je 0x43e8d1
mov edi, eax
nop word [eax + eax]
lea edx, [ebp + esi - 0x114]
lea ecx, [ebp - 0x96c]
call fcn.00444e30
lea eax, [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x43e897
jmp dword [eax*4 + 0x43f728]
mov byte [ebp + esi - 0x112], 0x6c
jmp case.default.0x43e897
mov byte [ebp + esi - 0x112], 0x66
jmp case.default.0x43e897
mov byte [ebp + esi - 0x112], 0x63
jmp case.default.0x43e897
mov byte [ebp + esi - 0x112], 0x6e
add esi, 4
cmp esi, edi
jb 0x43e870
mov edi, dword [ebp - 0x94c]
mov esi, dword [ebp - 0x944]
mov ecx, esi
shl ecx, 0x10
mov eax, esi
and eax, 0xff00
mov dword [ebp - 0x8a0], 0
or ecx, eax
mov dword [ebp - 0x8a4], 0x30207
mov eax, esi
shl ecx, 8
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, esi
shr eax, 0x18
or ecx, eax
lea eax, [ebp - 0x8a4]
push 7
push 0xc
mov dword [ebp - 0x89c], ecx
mov ecx, dword [edi + 0x26c]
push eax
call fcn.00486210
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00486260
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x91c]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
cmp esi, 0x105
ja case.0x43dc26.2
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x338]
push esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43dc26.2
cmp esi, 0x106
jae 0x43f653
mov ecx, dword [edi + 0x270]
mov byte [ebp + esi - 0x338], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
push 0xb
lea eax, [ebp - 0x338]
mov byte [ebp - 0x931], 0
push str.My_Documents
push eax
or esi, 0xffffffff
call fcn.004db56d
test eax, eax
mov eax, 5
push 7
cmove esi, eax
lea eax, [ebp - 0x338]
push str.Desktop
push eax
call fcn.004db56d
neg eax
push 0x11
sbb eax, eax
and eax, esi
mov dword [ebp - 0x930], eax
lea eax, [ebp - 0x338]
push str.Network_Favorites
push eax
call fcn.004db56d
add esp, 0x24
test eax, eax
jne 0x43ea34
mov eax, 0x13
jmp 0x43ea3f
mov eax, dword [ebp - 0x930]
cmp eax, 0xffffffff
je 0x43ea9d
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [edi + 0x274]
push eax
call fcn.00443740
test al, al
je 0x43ea96
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ea60
sub ecx, edx
cmp byte [ebp + ecx - 0x119], 0x5c
je 0x43ea83
mov edx, 0x53e1f8
lea ecx, [ebp - 0x118]
call fcn.00444e40
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x338]
call fcn.00444e50
jmp 0x43ea9d
mov byte [ebp - 0x931], 1
mov edx, 0x541a30
lea ecx, [ebp - 0x338]
call fcn.00444e40
push 1
mov dword [ebp - 0x874], 0x10207
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
mov dword [ebp - 0x92c], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x92c], 0xffffffff
je 0x43eccc
cmp byte [ebp - 0x931], 0
jne 0x43eccc
lea ecx, [ebp - 0x338]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43eb05
sub ecx, edx
push 7
push 0xc
lea eax, [ecx - 1]
mov ecx, dword [edi + 0x26c]
bswap eax
mov dword [ebp - 0x86c], eax
lea eax, [ebp - 0x874]
push eax
call fcn.00486210
lea ecx, [ebp - 0x338]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43eb38
sub ecx, edx
lea eax, [ecx - 1]
mov ecx, dword [edi + 0x26c]
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.004862f0
test byte [ebp - 0x57c], 0x10
je 0x43eb99
mov ecx, 0x5435a0
lea eax, [ebp - 0x550]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43eb90
test dl, dl
je 0x43eb8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43eb90
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eb70
xor eax, eax
jmp 0x43eb95
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ec01
mov ecx, 0x5435a4
lea eax, [ebp - 0x550]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ebc4
test dl, dl
je 0x43ebc0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ebc4
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eba4
xor eax, eax
jmp 0x43ebc9
sbb eax, eax
or eax, 1
test eax, eax
je 0x43ec01
mov ecx, 0x5435a0
lea eax, [ebp - 0x550]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43ebf8
test dl, dl
je 0x43ebf4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43ebf8
add eax, 2
add ecx, 2
test dl, dl
jne 0x43ebd8
xor eax, eax
jmp 0x43ebfd
sbb eax, eax
or eax, 1
test eax, eax
je 0x43ec7b
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 0x2e]
lea eax, [ebp - 0x57c]
push esi
push eax
lea eax, [ebp - 0x788]
push eax
call fcn.004cd830
mov eax, esi
mov ecx, esi
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
add esp, 0xc
mov eax, esi
shl ecx, 8
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, esi
shr eax, 0x18
push 7
or ecx, eax
lea eax, [ebp - 0x874]
push 0xc
mov dword [ebp - 0x86c], ecx
mov ecx, dword [edi + 0x26c]
push eax
call fcn.00486210
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x788]
push esi
push eax
call fcn.004862f0
lea eax, [ebp - 0x57c]
push eax
push dword [ebp - 0x92c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43eb57
push dword [ebp - 0x92c]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov word [ebp - 0x872], ax
mov dword [ebp - 0x86c], eax
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x874]
push 7
push 0xc
push eax
call fcn.004861c0
jmp case.0x43dc26.2
mov dword [ebp - 0x86c], 0
jmp 0x43ecb1
movzx eax, word [ebp - 0x922]
sub eax, 1
je 0x43f027
sub eax, 3
je 0x43ee7a
sub eax, 1
jne case.0x43dc26.2
mov ecx, dword [ebp - 0x91c]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
mov dword [ebp - 0x930], esi
cmp esi, 0x208
ja case.0x43dc26.2
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x850]
push esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43dc26.2
cmp esi, 0x209
jae 0x43f653
mov ecx, dword [edi + 0x270]
mov byte [ebp + esi - 0x850], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
mov edx, 0x2a
lea ecx, [ebp - 0x850]
call fcn.004349f0
mov esi, eax
test esi, esi
je case.0x43dc26.2
lea edx, [esi + 1]
lea ecx, [ebp - 0x644]
call fcn.00444e60
lea edx, [ebp - 0x850]
mov byte [esi], 0
lea ecx, [ebp - 0x438]
call fcn.00444e60
lea eax, [ebp - 0x644]
mov byte [esi], 0x2a
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
mov dword [ebp - 0x8b0], 0x80b07
mov eax, dword [ebp - 0x91c]
mov ecx, esi
neg ecx
mov dword [ebp - 0x8a8], eax
push 7
sbb ecx, ecx
lea eax, [ebp - 0x8b0]
neg ecx
dec ecx
push 0xc
mov dword [ebp - 0x8ac], ecx
mov ecx, dword [edi + 0x26c]
push eax
call fcn.00486210
push dword [ebp - 0x930]
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x850]
push eax
call fcn.00486260
test esi, esi
je case.0x43dc26.2
sub esp, 0x18
lea eax, [ebp - 0x644]
mov ecx, esp
mov dword [ebp - 0x930], esp
push eax
call fcn.00425fb0
sub esp, 0x18
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x438]
mov ecx, esp
push eax
call fcn.00425fb0
mov byte [ebp - 4], 8
mov ecx, dword [edi + 0x274]
call fcn.004366f0
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x91c]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
cmp esi, 0x104
ja case.0x43dc26.2
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x334]
push esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43dc26.2
cmp esi, 0x105
jae 0x43f653
mov ecx, dword [edi + 0x270]
mov byte [ebp + esi - 0x334], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
lea ecx, [ebp - 0x334]
call fcn.00436630
mov byte [ebp - 0x950], al
lea ecx, [ebp - 0x910]
lea eax, [ebp - 0x334]
push eax
call fcn.00425fb0
cmp byte [ebp - 0x950], 0
mov byte [ebp - 4], 0xa
je 0x43ef5c
lea edx, [ebp - 0x334]
lea ecx, [ebp - 0x8ec]
call fcn.00436550
push eax
lea ecx, [ebp - 0x910]
call fcn.00444d70
lea ecx, [ebp - 0x8ec]
call fcn.0041bea0
lea ecx, [ebp - 0x910]
call fcn.00444cf0
lea ecx, [ebp - 0x334]
lea esi, [eax + 1]
call fcn.004364a0
mov ecx, dword [ebp - 0x94c]
movzx edi, al
mov eax, edi
mov dword [ebp - 0x898], 0x70b07
neg eax
mov ecx, dword [ecx + 0x26c]
sbb eax, eax
neg eax
dec eax
mov dword [ebp - 0x894], eax
mov eax, esi
bswap eax
push 7
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x898]
push 0xc
push eax
call fcn.00486210
push esi
lea ecx, [ebp - 0x910]
call fcn.00425fa0
push eax
mov eax, dword [ebp - 0x94c]
mov ecx, dword [eax + 0x26c]
call fcn.00486260
test edi, edi
je 0x43f011
push dword [ebp - 0x950]
lea eax, [ebp - 0x334]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00425fb0
mov edi, dword [ebp - 0x94c]
mov ecx, dword [edi + 0x274]
call fcn.004366b0
lea ecx, [ebp - 0x910]
call fcn.0041bea0
jmp case.0x43dc26.2
mov edi, dword [ebp - 0x94c]
lea ecx, [ebp - 0x910]
call fcn.0041bea0
jmp case.0x43dc26.2
mov ecx, dword [ebp - 0x91c]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr esi, 8
shl eax, 8
or esi, eax
mov dword [ebp - 0x930], esi
cmp esi, 0x104
ja case.0x43dc26.2
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x334]
push esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43dc26.2
cmp esi, 0x105
jae 0x43f653
mov ecx, dword [edi + 0x270]
mov byte [ebp + esi - 0x334], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x224]
call eax
test eax, eax
je case.0x43dc26.2
cmp byte [ebp - 0x93b], 0
je case.0x43dc26.2
push 0
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov dword [ebp - 0x8bc], 0x40b07
mov eax, dword [ebp - 0x91c]
mov ecx, esi
neg ecx
mov dword [ebp - 0x8b4], eax
push 7
sbb ecx, ecx
lea eax, [ebp - 0x8bc]
neg ecx
dec ecx
push 0xc
mov dword [ebp - 0x8b8], ecx
mov ecx, dword [edi + 0x26c]
push eax
call fcn.00486210
push dword [ebp - 0x930]
mov ecx, dword [edi + 0x26c]
lea eax, [ebp - 0x334]
push eax
call fcn.00486260
test esi, esi
je case.0x43dc26.2
sub esp, 0x18
lea eax, [ebp - 0x334]
mov ecx, esp
push eax
call fcn.00425fb0
mov ecx, dword [edi + 0x274]
call fcn.00436670
jmp case.0x43dc26.2
mov eax, dword [edi + 0x274]
mov esi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp byte [eax + 0x501], 0
je 0x43f192
mov byte [eax + 0x500], 1
mov eax, dword [edi + 0x274]
push dword [eax + 0x4e8]
call esi
mov ecx, dword [edi + 0x274]
add ecx, 0x4e8
call fcn.004868a0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x501], 0
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x51a], 0
je case.0x43dc26.2
mov byte [eax + 0x519], 1
mov eax, dword [edi + 0x274]
push dword [eax + 0x504]
call esi
mov ecx, dword [edi + 0x274]
add ecx, 0x504
call fcn.004868a0
mov eax, dword [edi + 0x274]
mov byte [eax + 0x51a], 0
mov eax, dword [edi + 0x274]
lea ecx, [ebp - 0x9dc]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x380], 0
call fcn.0041e950
jmp 0x43cd5f
mov ecx, dword [edi + 0x26c]
mov eax, 4
sub eax, esi
push eax
lea eax, [ebp - 0x924]
add eax, esi
push eax
call fcn.004863e0
test eax, eax
je case.0x43c31d.1
mov ecx, dword [edi + 0x26c]
call fcn.004349e0
jmp 0x43cd5f
push esi
mov esi, dword [sym.imp.USER32.dll_CloseDesktop]
call esi
test eax, eax
jne 0x43f271
push str.d:_saasultravncwinvncwinvnc_vncservice.cpp_:_SelectDesktop_failed_to_close_desktop_n
push eax
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43f271
push str.d:_saasultravncwinvncwinvnc_vncservice.cpp_:_OpenInputdesktop2__n
push 0
push 0x558c50
call fcn.0041c840
add esp, 0xc
jmp 0x43f26b
mov eax, dword [edi + 0x274]
mov byte [eax + 0xc], 0
mov esi, dword [sym.imp.USER32.dll_CloseDesktop]
cmp byte [0x563186], 0
je 0x43f289
push 0xc8
mov byte [edi + 0x60], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x501], 0
je 0x43f2d5
mov byte [eax + 0x500], 1
mov eax, dword [edi + 0x274]
push dword [eax + 0x4e8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [edi + 0x274]
mov byte [eax + 0x501], 0
mov ecx, dword [edi + 0x274]
add ecx, 0x4e8
call fcn.004868a0
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x51a], 0
je 0x43f315
mov byte [eax + 0x519], 1
mov eax, dword [edi + 0x274]
push dword [eax + 0x504]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [edi + 0x274]
mov byte [eax + 0x51a], 0
mov ecx, dword [edi + 0x274]
add ecx, 0x504
call fcn.004868a0
mov ecx, dword [ebp - 0x960]
call fcn.00484590
mov ecx, dword [edi + 0x274]
cmp byte [ecx + 0x689], 0
je 0x43f34c
mov ecx, dword [ecx + 0x24c]
push 0
mov ecx, dword [ecx + 0x68]
call fcn.0044a510
mov eax, dword [edi + 0x274]
mov byte [eax + 0x689], 0
mov eax, dword [ebp - 0x968]
test eax, eax
je 0x43f370
push eax
call esi
test eax, eax
jne 0x43f370
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_failed_to_close_desktop_n
push eax
push 0x558c50
call fcn.0041c840
add esp, 0xc
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov eax, dword [eax + 0x48]
call eax
mov ecx, dword [edi + 0x274]
mov si, ax
mov edx, dword [ecx]
mov edx, dword [edx + 0x44]
call edx
movsx ecx, si
push ecx
push eax
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_client_disconnected_:__s___hd__n
push 1
push 0x558c50
call fcn.0041c840
add esp, 0x14
lea eax, [ebp - 0x334]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x43f401
mov edx, 0x5c
lea ecx, [ebp - 0x334]
call fcn.004349f0
lea ecx, [ebp - 0x334]
dec ecx
mov byte [eax], 0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x43f3d8
mov eax, dword [str.logging.dll]
mov dword [ecx], eax
mov eax, dword [0x54269c]
mov dword [ecx + 4], eax
mov eax, dword [0x5426a0]
mov dword [ecx + 8], eax
mov al, byte [0x5426a4]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x960], eax
test eax, eax
je 0x43f445
push str.LOGEXIT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 0x274]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x44]
call edx
push eax
call esi
add esp, 4
push dword [ebp - 0x960]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx + 0x2d4]
test eax, eax
je 0x43f475
mov ecx, eax
call fcn.004369f0
mov ecx, dword [edi + 0x274]
push 0
mov ecx, dword [ecx + 0x2d4]
call fcn.004bb340
mov ecx, dword [edi + 0x274]
mov eax, dword [ecx]
mov eax, dword [eax + 0x48]
call eax
mov ecx, dword [edi + 0x270]
push eax
mov edx, dword [ecx]
call dword [edx + 0x64]
cmp byte [0x563186], 0
jne 0x43f518
mov eax, dword [edi + 0x274]
cmp byte [eax + 0x196], 0
je 0x43f518
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_PostAddNewClient_II_n
push 0
push 0x558c50
call fcn.0041c840
mov ecx, dword [edi + 0x270]
add esp, 0xc
mov eax, dword [edi + 0x274]
mov edx, dword [ecx]
movzx eax, byte [eax + 0x196]
push eax
call dword [edx + 0x2a8]
mov ecx, dword [edi + 0x270]
push dword [edi + 0x64]
mov eax, dword [ecx]
call dword [eax + 0x2b8]
mov ecx, dword [edi + 0x270]
lea eax, [edi + 0x68]
push eax
mov edx, dword [ecx]
call dword [edx + 0x2c0]
mov ecx, dword [edi + 0x270]
lea eax, [edi + 0x167]
push eax
mov edx, dword [ecx]
call dword [edx + 0x2c8]
mov edx, 0x457
mov ecx, edx
call fcn.00484a80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 4
call edx
mov ecx, dword [edi + 0x274]
movzx esi, ax
mov eax, dword [ecx]
jmp 0x43b77d
call edx
jmp 0x43b791
mov ecx, edx
call esi
jmp 0x43b7e4
mov eax, dword [eax + 0x48]
call eax
movzx edx, ax
jmp 0x43b82b
mov eax, dword [eax + 0x44]
mov ecx, edx
call eax
jmp 0x43b892
push eax
call dword [edx + 0x2a8]
jmp 0x43b977
push eax
call dword [edx + 0x2b8]
jmp 0x43b994
call dword [edx + 0x2c0]
jmp 0x43b9c0
call dword [edx + 0x2c8]
jmp 0x43ba00
mov eax, dword [eax + 0x48]
call eax
movzx edx, ax
jmp 0x43ba6a
call edx
jmp 0x43ba8f
call edx
jmp 0x43babd
push eax
mov ecx, edx
call esi
jmp 0x43bb09
call edx
mov esi, eax
jmp 0x43bb41
call edx
jmp 0x43bb7e
push edx
push esi
push eax
call edi
jmp 0x43bbe9
push edx
push esi
call dword [ebp - 0x950]
jmp 0x43bc4d
call edx
mov esi, eax
jmp 0x43bf1e
call edx
jmp 0x43bfce
call edx
test al, al
jmp 0x43c064
call edx
jmp 0x43c2c3
push 0
call dword [eax + 0x284]
jmp 0x43c555
push 1
call dword [eax + 0x284]
jmp 0x43c873
push 1
call dword [eax + 0x284]
jmp 0x43c8db
call edx
mov esi, eax
jmp 0x43cb77
call edx
mov esi, eax
jmp 0x43cc65
mov eax, dword [eax + 0x20]
call eax
mov ecx, dword [edi + 0x270]
jmp 0x43cce0
call fcn.004cc362
xor bl, al
inc ebx
add bl, ch
ret