Function at 0x4139c0
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472e7a
mov eax, dword fs:[0]
push eax
sub esp, 0xa68
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0xa60], eax
push ebx
push esi
push edi
mov eax, dword [0x48a348]
xor eax, esp
push eax
lea eax, [esp + 0xa78]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x68]
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x40]
mov ecx, esi
mov dword [esp + 0x14], ebx
call eax
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [edx + 0x3c]
push ecx
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_connected_:__s___hd__n
mov ecx, 1
mov eax, 0x48c4e8
call fcn.00401000
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, dword [ebx + 0x60]
push 0x7530
mov dword [esp + 0x78], eax
call fcn.0044b290
test eax, eax
jne 0x413a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncclient.cpp_:_failed_to_set_socket_timeout__d__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 8
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
test eax, eax
je 0x416cf4
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
mov ecx, dword [ebx + 0x60]
mov dword [ecx + 8], eax
push str.._vncclient.cpp_:_DSMPlugin_Pointer_to_socket_OK_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov ecx, dword [ebx + 0x64]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
add esp, 4
add esi, 0x17c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
mov al, byte [eax + 0x21]
test al, al
je 0x413b3c
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jbe 0x413b03
push str.._vncclient.cpp_:_A_connection_using_DSM_already_exist___client_rejected_to_avoid_crash__n
mov ecx, 1
jmp 0x416cfe
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jne 0x413b26
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
mov eax, dword [eax + 0x2ec]
call eax
mov eax, dword [ebx + 0x60]
mov byte [eax + 0xc], 1
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x6c], 0
jmp 0x413b49
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x6c], 1
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
mov ecx, ebx
call eax
test eax, eax
jne 0x413bbc
mov ecx, dword [ebx + 0x64]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
mov ebx, dword [ebx + 0x64]
mov eax, dword [ebx]
mov edx, dword [eax + 0x230]
mov ecx, ebx
call edx
test eax, eax
je 0x416d0b
mov esi, dword [0x4a78c8]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x416ceb
push 0x457
push 0x457
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x416d0b
push str.._vncclient.cpp_:_negotiated_version_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
add esp, 4
mov ecx, ebx
call edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [ebx + 0x64]
mov esi, dword [eax]
jne 0x413c02
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
jmp 0x416d0b
mov eax, dword [edx + 0x3c]
add esi, 0x180
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b8]
call edx
imul eax, eax, 0x3e8
mov edi, dword [ebx + 0x60]
push eax
call fcn.0044b290
push str.._vncclient.cpp_:_authenticated_connection_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [ebx + 0x68]
mov esi, dword [eax]
add esp, 4
add esi, 0x68
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebx + 0x68]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x74], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa80], 0
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1cc]
call edx
mov ecx, dword [ebx + 0x68]
mov esi, dword [ecx + 0xc8]
call fcn.0040e3c0
push edi
mov dword [esp + 0xa84], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0xc8]
lea edi, [esp + 0x100]
call fcn.0040e490
mov edx, dword [eax]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x460], edx
mov edx, dword [eax + 4]
add ecx, 0x460
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov ecx, dword [ecx + 0x30]
push 0x110
lea edx, [esp + 0x330]
push 0
mov dword [eax + 0x470], ecx
push edx
mov dword [esp + 0x88], 0x110
call fcn.00463710
add esp, 0xc
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x413d9b
lea eax, [esp + 0x32c]
xor esi, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413d40
sub eax, edx
je 0x413d80
jmp 0x413d50
movsx edx, byte [esp + esi + 0x32c]
push edx
call fcn.0045f8b7
mov byte [esp + esi + 0x330], al
lea eax, [esp + 0x330]
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413d73
sub eax, edx
cmp esi, eax
jb 0x413d50
lea eax, [esp + 0x32c]
push 0x2e
push eax
call fcn.0045f78b
add esp, 8
test eax, eax
je 0x413dc3
jmp 0x413e6c
mov ecx, dword [0x47d010]
mov dx, word [0x47d014]
mov al, byte [0x47d016]
mov dword [esp + 0x32c], ecx
mov word [esp + 0x330], dx
mov byte [esp + 0x332], al
lea edi, [esp + 0x224]
call fcn.00413840
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413dd4
sub eax, edx
cmp eax, 3
jbe 0x413e6c
mov al, byte [esp + 0x224]
cmp al, 0x49
je 0x413e6c
cmp al, 0x48
je 0x413e6c
lea edi, [esp + 0x32c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x413e00
mov ecx, dword [0x47d018]
lea eax, [esp + 0x224]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413e20
lea edi, [esp + 0x32c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413e31
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x32c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413e51
mov dx, word [0x47d01c]
mov cl, byte [0x47d01e]
mov word [eax], dx
mov byte [eax + 2], cl
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x94], edx
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x98], edx
mov edx, dword [ecx + 0x14]
mov dword [esp + 0x9c], edx
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0xa0], ecx
movzx ecx, word [eax + 0x468]
sub cx, word [eax + 0x460]
mov edx, dword [eax + 0x468]
sub edx, dword [eax + 0x460]
mov esi, pe_nt_image_headers32
imul cx, si
sar edx, 8
and edx, 0xff
xor dx, cx
mov word [esp + 0x90], dx
movzx ecx, word [eax + 0x46c]
sub cx, word [eax + 0x464]
mov edx, dword [eax + 0x46c]
sub edx, dword [eax + 0x464]
mov eax, esi
imul cx, ax
mov ax, word [esp + 0x9c]
sar edx, 8
and edx, 0xff
xor dx, cx
movzx ecx, word [esp + 0x98]
mov word [esp + 0x92], dx
mov dx, word [esp + 0x9a]
rol cx, 8
rol dx, 8
rol ax, 8
mov word [esp + 0x9c], ax
lea eax, [esp + 0x32c]
mov word [esp + 0x9a], dx
mov word [esp + 0x98], cx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413f50
sub eax, edx
lea esi, [esp + 0x32c]
mov ecx, eax
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x413f65
lea eax, [esp + 0x32c]
sub esi, edx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413f78
sub eax, edi
mov edi, eax
lea eax, [esp + 0x32c]
lea edx, [eax + 1]
mov dword [esp + 0x44], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413f91
sub eax, dword [esp + 0x44]
shr ecx, 0x10
shl eax, 0x10
and edi, 0xff00
or eax, edi
mov edi, dword [ebx + 0x60]
and esi, 0xff0000
or esi, ecx
shl eax, 8
shr esi, 8
or eax, esi
mov dword [esp + 0xa4], eax
mov ecx, 0x18
lea eax, [esp + 0x90]
call fcn.0044b4f0
test eax, eax
jne 0x413fe8
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
jmp 0x413bea
lea eax, [esp + 0x32c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413ff2
mov edi, dword [ebx + 0x60]
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x32c]
call fcn.0044b4f0
test eax, eax
je 0x413fd9
push str.._vncclient.cpp_:_sent_pixel_format_to_client_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
add esp, 4
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa80], 1
mov esi, dword [ebx + 0x68]
add esi, 0x460
lea edi, [esp + 0x4c]
call fcn.00406950
mov byte [esp + 0xa80], 2
mov eax, dword [ebx + 0x68]
lea ecx, [eax + 0x118]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov edx, edi
push edx
call eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 8]
push ecx
mov esi, eax
call fcn.0045ecd6
add esp, 4
push esi
call fcn.0045ecd6
mov dword [esp + 0xa84], 0xffffffff
mov edx, dword [esp + 0x48]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 2
mov ecx, ebx
call fcn.0045d680
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x120]
mov dword [esp + 0x1c], 1
call edx
movzx eax, al
mov dword [esp + 0x8c], eax
mov byte [esp + 0x37], 1
mov byte [esp + 0x36], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
test al, al
jne 0x41410e
call fcn.00449500
test eax, eax
jne 0x41410e
cmp dword [0x4a2188], 2
jne 0x41410e
call fcn.00449440
test eax, eax
je 0x414ea6
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x34], 0
je 0x414135
cmp byte [esp + 0x37], 0
je 0x414135
mov bl, 0x14
call fcn.004137e0
mov bl, 0x91
call fcn.004137e0
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x37], 0
cmp dword [esp + 0x8c], 0
je 0x41416e
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x120]
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xc8]
mov bl, al
mov eax, dword [edx + 0x54]
call fcn.0041e3b0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x8c], 0
cmp byte [esp + 0x36], 0
je 0x414184
mov esi, dword [ebx + 0x68]
push 0
call fcn.00419fe0
mov byte [esp + 0x36], 0
mov eax, dword [ebx + 0x60]
cmp byte [eax + 0xc], 0
mov esi, 1
je 0x4141c1
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
cmp byte [eax + 0x21], 0
je 0x4141c1
mov edx, dword [ebx + 0x60]
lea ecx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
je 0x414ea6
xor esi, esi
jmp 0x4141d9
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
je 0x414ea6
movzx eax, byte [esp + 0x20]
cmp eax, 0xf
ja case.0x4141e7.1
jmp dword [eax*4 + 0x416d34]
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 0x14
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
mov cx, word [esp + 0x28]
mov dx, word [esp + 0x2a]
mov ax, word [esp + 0x2c]
rol cx, 8
mov word [esp + 0x28], cx
rol dx, 8
rol ax, 8
xor ecx, ecx
cmp byte [esp + 0x31], 1
mov word [esp + 0x2a], dx
mov edx, dword [ebx + 0x68]
sete cl
mov word [esp + 0x2c], ax
mov eax, dword [edx + 0xc8]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov eax, dword [ebx + 0x68]
add eax, 0x4c
lea edi, [esp + 0x24]
call fcn.00410c20
test eax, eax
jne 0x414284
push str.._vncclient.cpp_:_remote_pixel_format_invalid_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
mov dword [esp + 0x1c], 0
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x140], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 4
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
mov eax, dword [ebx + 0x68]
add eax, 0x4c
xor esi, esi
mov dword [eax + 0x70], esi
mov eax, dword [eax + 0x7c]
mov dword [eax + 0x20], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x60], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x68], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
or ecx, 0xffffffff
mov dword [eax + 0x4c], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x4142ff
mov dword [eax + 0x60], ecx
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov ecx, 6
mov dword [eax + 0x48], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x414317
mov dword [eax + 0x5c], ecx
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x50], esi
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x41432a
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], esi
cmp ecx, esi
je 0x41433d
mov dword [ecx + 0x68], esi
mov dword [eax + 0x5c], esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], esi
cmp ecx, esi
je 0x414353
mov dword [ecx + 0x6c], esi
mov dword [eax + 0x5c], esi
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push esi
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x15c], esi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x160], esi
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
call edx
mov ax, word [esp + 0x22]
mov ecx, dword [ebx + 0x68]
rol ax, 8
mov word [esp + 0x22], ax
mov edx, dword [ecx + 0x118]
mov eax, dword [edx + 0x10]
add ecx, 0x118
push esi
mov dword [esp + 0x1c], esi
call eax
xor ecx, ecx
mov dword [esp + 0x38], esi
lea edi, [ecx + 1]
cmp cx, word [esp + 0x22]
jae 0x4146ff
jmp 0x4143c0
mov eax, dword [ebx + 0x60]
lea edx, [esp + 0x78]
push edx
push eax
mov ecx, 4
call fcn.0044b5d0
test eax, eax
je 0x4146ec
mov ecx, dword [esp + 0x78]
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
mov esi, ecx
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, edi
jne 0x414422
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x118]
mov edx, dword [eax + 0x10]
add ecx, 0x118
push edi
call edx
jmp 0x4146d3
cmp eax, 0xffffff21
jne 0x414437
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x14c], edi
jmp 0x4146d3
cmp eax, 0xffff0001
jne 0x41446e
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x70], edi
mov eax, dword [eax + 0x7c]
mov dword [eax + 0x20], edi
call fcn.004102c0
push str.._vncclient.cpp_:_Cache_protocol_extension_enabled_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
jmp 0x4146d3
cmp eax, 0xffff0006
jne 0x414485
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x60], edi
push str.._vncclient.cpp_:_XOR_protocol_extension_enabled_n
jmp 0x414457
cmp eax, 0xffffff00
jb 0x4144c3
cmp eax, 0xffffff09
ja 0x4144c3
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 0x100]
add ecx, 0x4c
mov eax, esi
call fcn.00410d80
push esi
push str.._vncclient.cpp_:_compression_level_requested:__d_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 8
jmp 0x4146d3
cmp eax, 0xffffffe0
jb 0x4144e5
cmp eax, 0xffffffe9
ja 0x4144e5
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 0x20]
add ecx, 0x4c
mov eax, esi
call fcn.00410db0
push esi
push str.._vncclient.cpp_:_image_quality_level_requested:__d_n
jmp 0x4144ac
cmp eax, 0xffffff20
jne 0x414509
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x50], edi
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4144ff
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_LastRect_protocol_extension_enabled_n
jmp 0x414457
cmp eax, 0xffffff10
jne 0x414542
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], edi
test ecx, ecx
je 0x414523
mov dword [ecx + 0x68], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push edi
call eax
push str.._vncclient.cpp_:_X_style_cursor_shape_updates_enabled_n
jmp 0x414457
cmp eax, 0xffffff11
jne 0x41457b
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], edi
test ecx, ecx
je 0x41455c
mov dword [ecx + 0x6c], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push edi
call eax
push str.._vncclient.cpp_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x414457
cmp eax, 0xffffff18
jne 0x414595
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x168], edi
push str.._vncclient.cpp_:_PointerPos_protocol_extension_enabled_n
jmp 0x414457
cmp eax, 0xffff8000
jne 0x4145ba
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x4cc], 1
mov eax, dword [ebx + 0x64]
mov byte [eax + 0x570], 1
push str.._vncclient.cpp_:_ServerState_protocol_extension_enabled_n
jmp 0x414457
cmp eax, 0xffff8001
jne 0x4145e4
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x4ce], 1
mov eax, dword [ebx + 0x64]
mov byte [eax + 0x571], 1
mov byte [esp + 0x36], 1
push str.._vncclient.cpp_:_KeepAlive_protocol_extension_enabled_n
jmp 0x414457
cmp eax, 0x10
jne 0x41460d
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_ZRLE_found__n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov ecx, dword [esp + 0x7c]
add esp, 4
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 7
jne 0x414654
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x68], edi
push str.._vncclient.cpp_:_Tight_found_n
lea ecx, [edx + 2]
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
cmp dword [esp + 0x18], 0
jne 0x4146d3
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x100]
call fcn.00402470
mov dword [esp + 0xa80], 3
mov eax, dword [esp + 0x78]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
or ecx, edx
push 0
push ecx
mov ecx, dword [ebx + 0x68]
add ecx, 0x4c
call fcn.00410660
test eax, eax
je 0x4146ba
mov dword [esp + 0x18], edi
mov dword [esp + 0xa80], 0xffffffff
mov eax, dword [esp + 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x38]
movzx ecx, word [esp + 0x22]
add eax, edi
cmp eax, ecx
mov dword [esp + 0x38], eax
jl 0x4143c0
jmp 0x4146f4
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x18], 0
jne 0x414780
push str.._vncclient.cpp_:_defaulting_to_raw_encoder_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
add esp, 4
call eax
push eax
lea ecx, [esp + 0xf8]
call fcn.00402470
mov dword [esp + 0xa80], 4
mov ecx, dword [ebx + 0x68]
push 0
push 0
add ecx, 0x4c
call fcn.00410660
test eax, eax
jne 0x414767
push str.._vncclient.cpp_:_failed_to_select_raw_encoder__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0xa80], 0xffffffff
mov ecx, dword [esp + 0xf4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, edi
jbe 0x41479b
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x214]
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2c], edi
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
xor ecx, ecx
cmp byte [eax + 0xe200], cl
sete cl
mov eax, ecx
mov ecx, dword [ebx + 0x68]
call fcn.00419f50
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 0xa
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
movzx ecx, word [esp + 0x22]
mov esi, dword [ebx + 0x68]
mov edx, dword [esi + 0x470]
rol cx, 8
movzx eax, cx
add eax, dword [esi + 4]
movzx ecx, word [esp + 0x24]
imul eax, edx
rol cx, 8
movzx ecx, cx
add ecx, dword [esi + 8]
mov si, word [esp + 0x26]
imul ecx, edx
rol si, 8
movzx esi, si
imul esi, edx
add esi, eax
mov dword [esp + 0x14c], eax
mov ax, word [esp + 0x28]
rol ax, 8
movzx eax, ax
imul eax, edx
mov dword [esp + 0x154], esi
add eax, ecx
lea esi, [esp + 0x14c]
lea edi, [esp + 0x50]
mov dword [esp + 0x150], ecx
mov dword [esp + 0x158], eax
call fcn.00406950
mov dword [esp + 0xa80], 5
mov ecx, dword [esp + 0x50]
cmp dword [ecx + 4], 0
jne 0x4148b1
push str.._vncclient.cpp_:_FATAL__client_update_region_is_empty__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x50]
mov dword [esp + 0xa80], 0xffffffff
call fcn.004069a0
jmp case.0x4141e7.13
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0xf4]
call fcn.00402470
lea ecx, [esp + 0x50]
mov byte [esp + 0xa80], 6
mov eax, dword [ebx + 0x68]
push ecx
lea edx, [esp + 0x50]
push edx
add eax, 0x13c
push eax
call fcn.00406a80
mov byte [esp + 0xa80], 7
mov esi, dword [ebx + 0x68]
add esi, 0x13c
mov edx, eax
call fcn.004069c0
lea eax, [esp + 0x4c]
mov byte [esp + 0xa80], 6
call fcn.004069a0
cmp byte [esp + 0x21], 0
jne 0x41494a
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x118]
mov edx, dword [edx + 4]
lea ecx, [eax + 0x118]
lea eax, [esp + 0x50]
push eax
call edx
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ecx + 0x54]
push edx
lea eax, [esp + 0x150]
call fcn.0041bb40
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov esi, dword [ecx + 0x54]
call fcn.0041bb80
mov edi, dword [ebx + 0x68]
call fcn.00417460
mov edx, dword [esp + 0xf0]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414898
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x20]
push eax
mov ecx, 8
sub ecx, esi
push edx
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.13
mov edx, dword [ebx + 0x68]
cmp dword [edx + 0x34], 0
je case.0x4141e7.13
mov ecx, dword [esp + 0x24]
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and ecx, 0xff00
shl esi, 0x10
or esi, ecx
shr eax, 8
shl esi, 8
or eax, esi
cmp byte [esp + 0x21], 0
mov dword [esp + 0x24], eax
movzx ecx, byte [edx + 0x3c]
push ecx
setne dl
movzx ecx, dl
push ecx
push eax
call fcn.00435560
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x144], 1
jmp case.0x4141e7.13
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x20]
push eax
mov ecx, 6
sub ecx, esi
push edx
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.13
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x38], 0
je case.0x4141e7.13
mov ax, word [esp + 0x22]
mov dx, word [esp + 0x24]
rol ax, 8
add ax, word [ecx + 0xc]
mov dword [esp + 0x18], 0x8000
add ax, word [ecx + 4]
imul ax, word [ecx + 0x470]
rol dx, 8
mov word [esp + 0x22], ax
add dx, word [ecx + 0x10]
add dx, word [ecx + 8]
imul dx, word [ecx + 0x470]
mov word [esp + 0x24], dx
cmp ax, word [ecx + 0x112]
jne 0x414a74
cmp dx, word [ecx + 0x114]
je 0x414a7c
mov dword [esp + 0x18], 0x8001
mov cl, byte [ecx + 0x111]
mov al, byte [esp + 0x21]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor cl, al
test cl, 1
je 0x414ac8
push 0x17
call esi
test eax, eax
mov al, byte [esp + 0x21]
je 0x414ab6
test al, 1
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x18], edx
jmp 0x414ac8
test al, 1
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x18], ecx
mov edx, dword [ebx + 0x68]
mov dl, byte [edx + 0x111]
mov cl, al
mov byte [esp + 0x13], dl
and cl, 2
and dl, 2
cmp cl, dl
je 0x414af2
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x40
or dword [esp + 0x18], ecx
mov dl, al
xor dl, byte [esp + 0x13]
test dl, 4
je 0x414b32
push 0x17
call esi
test eax, eax
mov al, byte [esp + 0x21]
je 0x414b1d
test al, 4
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x18], ecx
jmp 0x414b32
test al, 4
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x18], edx
mov ecx, dword [ebx + 0x68]
xor edi, edi
cmp dword [ecx + 0xb4], edi
je 0x414b6a
cmp dword [ecx + 0xac], edi
jne 0x414b6a
test al, 8
je 0x414b5b
test byte [ecx + 0x111], 8
jne 0x414b5b
mov edi, 0x78
jmp 0x414b84
test al, 0x10
je 0x414b8c
test byte [ecx + 0x111], 0x10
jne 0x414b8c
jmp 0x414b7f
test al, 8
je 0x414b7b
or dword [esp + 0x18], 0x800
mov edi, 0x78
test al, 0x10
je 0x414b8c
mov edi, 0xffffff88
or dword [esp + 0x18], 0x800
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x164]
lea edx, [esp + 0x17c]
push edx
lea edx, [esp + 0xd8]
push edx
lea edx, [esp + 0xec]
push edx
call eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x14], 1
jne 0x414bfd
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0xd4]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [esp + 0xe4]
push 0
push edi
lea ecx, [edx - 1]
push eax
movzx eax, word [esp + 0x2e]
imul eax, eax, 0xffff
cdq
idiv ecx
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x414d78
cmp dword [eax + 0x4ac], 0
je 0x414ca2
push 0x4c
mov dword [esp + 0x20c], 0
call esi
sub word [esp + 0x22], ax
push 0x4d
call esi
sub word [esp + 0x24], ax
push 0x4e
call esi
mov ecx, eax
movzx eax, word [esp + 0x22]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
push 0x4f
mov dword [esp + 0x210], eax
call esi
mov ecx, eax
movzx eax, word [esp + 0x24]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [ebx + 0x68]
push 0x1c
mov dword [esp + 0x218], edi
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x1c]
or eax, 0x4000
mov dword [esp + 0x21c], eax
xor eax, eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x220], eax
mov ecx, dword [edx + 0x4ac]
lea eax, [esp + 0x20c]
push eax
push 1
call ecx
jmp 0x414d78
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
test byte [esp + 0x18], 1
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esp + 0xf8], 0xa
je 0x414d29
and dword [esp + 0x18], 0xffff7fff
push 0
lea eax, [esp + 0x18c]
push eax
push 0
push 3
call esi
push 0
lea ecx, [esp + 0xd4]
push ecx
push 0
push 0x70
call esi
xor eax, eax
push eax
lea edx, [esp + 0xfc]
push edx
push eax
push 0x71
mov dword [esp + 0x180], 0xa
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
call esi
push 0
lea eax, [esp + 0x174]
push eax
push 0
push 4
call esi
movzx ecx, word [esp + 0x24]
movzx edx, word [esp + 0x22]
sub ecx, dword [esp + 0x138]
sub edx, dword [esp + 0x134]
mov eax, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_mouse_event]
test byte [esp + 0x18], 1
je 0x414d78
push 0
lea ecx, [esp + 0x18c]
push ecx
push 0
push 4
call esi
push 0
lea edx, [esp + 0xd4]
push edx
push 0
push 0x71
call esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x110], ecx
mov dx, word [esp + 0x24]
add eax, 0x110
mov word [eax + 4], dx
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x144], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xc8]
mov esi, dword [edx + 0x54]
call fcn.0041bb80
jmp case.0x4141e7.13
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x20]
push eax
mov ecx, 8
sub ecx, esi
push edx
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.13
mov eax, dword [esp + 0x24]
mov esi, eax
mov ecx, eax
mov edx, eax
and esi, 0xff0000
shl edx, 0x10
and eax, 0xff00
shr ecx, 0x10
or esi, ecx
or edx, eax
shl edx, 8
shr esi, 8
or esi, edx
lea eax, [esi + 1]
push eax
call fcn.0045e0f8
mov edi, eax
add esp, 4
test edi, edi
je case.0x4141e7.13
mov byte [edi + esi], 0
mov ecx, dword [ebx + 0x60]
push edi
push ecx
mov ecx, esi
call fcn.0044b5d0
push edi
test eax, eax
jne 0x414e2b
call fcn.0045e501
add esp, 4
jmp case.0x4141e7.13
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0xec]
call eax
push edi
call fcn.0045e501
add esp, 4
jmp case.0x4141e7.13
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x475], 1
mov edx, dword [ebx + 0x68]
mov ecx, 4
lea eax, [esp + esi + 0x20]
sub ecx, esi
cmp byte [edx + 0x475], 0
mov edx, dword [ebx + 0x60]
push eax
push edx
je 0x414f7f
call fcn.0044b5d0
test eax, eax
jne 0x414f8c
mov dword [esp + 0x1c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x26c]
call eax
test eax, eax
je 0x414e9b
mov esi, dword [ebx + 0x68]
call fcn.00419ed0
cmp dword [esp + 0x1c], 0
jne 0x4140e1
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je 0x414ed3
mov byte [eax + 0x2f4], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0x2dc]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2f5], 0
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x452], 0
je 0x414f00
mov byte [eax + 0x451], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x452], 0
mov esi, dword [esp + 0x74]
call fcn.00449360
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x4cd], 0
je 0x416b95
mov ecx, dword [eax + 0xc8]
mov edi, dword [ecx + 0x54]
xor bl, bl
mov esi, edi
call fcn.0041e170
push str.enabled
push str.._vncdesktop.cpp_:_SetDisableInput:_inputs__s_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [0x48b140]
add esp, 8
cmp eax, 1
je 0x416b2c
cmp eax, 2
je 0x416b2c
mov ecx, dword [edi + 0xdbd0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x11c]
push 0
call eax
mov dword [edi + 0xe108], 1
jmp 0x416b71
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
mov al, byte [esp + 0x21]
mov cl, al
dec cl
cmp cl, 8
ja case.0x4141e7.13
movzx edx, al
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x470], edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x48]
call fcn.00402470
mov dword [esp + 0xa80], 8
mov ecx, dword [ebx + 0x68]
movzx eax, byte [esp + 0x21]
mov esi, dword [ecx + 0xc8]
call fcn.0040e3c0
test eax, eax
jne 0x414ffe
mov dword [esp + 0xa80], 0xffffffff
mov edx, dword [esp + 0x44]
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x68]
push 1
push 0
push 0
mov byte [eax + 0x474], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [ebx + 0x68]
call fcn.00417460
mov dword [esp + 0xa80], 0xffffffff
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 4
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x34], 0
je case.0x4141e7.13
cmp byte [esp + 0x21], 1
mov eax, str.disabled
je 0x415072
mov eax, str.enabled
push eax
push str.._vncclient.cpp_:_rfbSetServerInput:_inputs__s_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
add esp, 8
call eax
cmp byte [eax + 0xe200], 0
je 0x4150cc
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x4cd], 0
jne 0x4150cc
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
mov esi, dword [ebx + 0x64]
xor ecx, ecx
cmp byte [eax + 0xe200], cl
sete cl
push ecx
call fcn.00448890
jmp case.0x4141e7.13
mov edx, dword [ebx + 0x68]
cmp byte [esp + 0x21], 1
mov ecx, dword [edx + 0xc8]
mov ecx, dword [ecx + 0x54]
sete al
call fcn.0041ee70
cmp byte [esp + 0x21], 1
mov eax, dword [ebx + 0x68]
sete dl
mov byte [eax + 0x4cd], dl
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 6
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je case.0x4141e7.1
movzx ecx, word [esp + 0x22]
rol cx, 8
movzx esi, cx
mov cx, word [esp + 0x24]
cmp si, 5
jae 0x4151a9
mov dx, cx
rol dx, 8
cmp dx, 5
jae 0x4151a9
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov esi, dword [ecx + 0x54]
mov edi, 1
push edi
push edi
push str.._vncdesktop.cpp_:_SETW__i__i_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [esi + 0xe1fc]
add esp, 0xc
sub eax, edi
je 0x415199
sub eax, edi
je 0x415187
sub eax, edi
jne case.0x4141e7.13
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x64], eax
jmp case.0x4141e7.13
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x64], 0
jmp case.0x4141e7.13
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x64], eax
jmp case.0x4141e7.13
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x470]
mov ebx, dword [eax + 0xc]
add ebx, dword [eax + 4]
rol cx, 8
movzx ecx, cx
add ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
imul ecx, edx
push ecx
movzx ecx, si
add ebx, ecx
imul ebx, edx
mov edx, dword [eax + 0xc8]
mov eax, dword [edx + 0x54]
call fcn.0041e480
mov ebx, dword [esp + 0x14]
jmp case.0x4141e7.13
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0x49c]
mov eax, esi
call fcn.00409990
jmp case.0x4141e7.13
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x26c]
mov byte [esp + 0x13], 1
call eax
test eax, eax
je 0x41521f
mov edi, dword [ebx + 0x68]
call fcn.00419cd0
mov byte [esp + 0x13], al
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x74]
call fcn.00402470
mov dword [esp + 0xa80], 9
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x174], 1
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x20]
push edx
mov ecx, 0xc
sub ecx, esi
push eax
call fcn.0044b5d0
test eax, eax
je 0x416a8e
movzx eax, byte [esp + 0x21]
dec eax
cmp eax, 0xb
ja case.0x415277.2
jmp dword [eax*4 + 0x416d74]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x40]
call fcn.00402470
mov byte [esp + 0xa80], 0xa
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je 0x41549f
cmp byte [esp + 0x13], 0
je 0x41549f
mov eax, dword [esp + 0x28]
mov edx, eax
mov edi, eax
mov ecx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
and edi, 0xff0000
shr ecx, 0x10
or edi, ecx
push 0x144
add eax, 0x17c
shl edx, 8
push 0
shr edi, 8
push eax
or edi, edx
call fcn.00463710
add esp, 0xc
cmp edi, 0x144
jbe 0x415311
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov edx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
add edx, 0x17c
push edx
push eax
mov ecx, edi
call fcn.0044b5d0
test eax, eax
jne 0x41533a
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov eax, dword [esp + 0x24]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x60]
push eax
push ecx
mov ecx, 4
mov dword [esp + 0x68], 0
call fcn.0044b5d0
test eax, eax
jne 0x415394
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov eax, dword [esp + 0x60]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
shr ecx, 8
shl edx, 8
add eax, 0x17c
or ecx, edx
push 0x2c
push eax
mov dword [esp + 0x40], ecx
call fcn.0045f99f
add esp, 8
test eax, eax
jne 0x4153e2
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2c0], 0
jmp 0x4153fc
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 1]
add ecx, 0x2c0
mov edi, edi
mov dl, byte [esi]
mov byte [ecx], dl
inc esi
inc ecx
test dl, dl
jne 0x4153f0
mov byte [eax], dl
mov ecx, dword [ebx + 0x68]
add ecx, 0x17c
lea esi, [esp + 0x1b0]
call fcn.004111e0
cmp dword [eax + 0x18], 0x10
jb 0x41541c
mov edx, dword [eax + 4]
jmp 0x41541f
lea edx, [eax + 4]
mov ecx, dword [ebx + 0x68]
add ecx, 0x17c
mov al, byte [edx]
mov byte [ecx], al
inc edx
inc ecx
test al, al
jne 0x415428
lea ecx, [esp + 0x1b0]
call fcn.00404540
mov ecx, dword [ebx + 0x68]
push 0
push 0x8000000
push 4
push 0
push 3
push 0xc0000000
add ecx, 0x17c
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2dc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, dword [ebx + 0x68]
sete byte [esp + 0x13]
xor ecx, ecx
cmp dword [eax + 0x2dc], 0xffffffff
setne cl
add edi, 0x41
push edi
dec ecx
mov dword [esp + 0x1c], ecx
call fcn.0045e0f8
mov esi, eax
add esp, 4
test esi, esi
jne 0x4154af
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
push edi
push 0
push esi
call fcn.00463710
mov eax, dword [ebx + 0x68]
add esp, 0xc
add eax, 0x17c
mov edx, esi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4154c5
push 0x5c
push esi
call fcn.0045f99f
add esp, 8
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x415520
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x164]
push ecx
push esi
call eax
test eax, eax
jne 0x415520
or edi, 0xffffffff
mov dword [esp + 0x18], edi
jmp 0x415523
or edi, 0xffffffff
push esi
call fcn.0045e501
add esp, 4
mov ecx, 0xa
mov eax, dword [esp + 0x15c]
mov edx, dword [esp + 0x160]
shrd eax, edx, cl
sar edx, cl
push 1
push 0
mov dword [esp + 0x1d8], edx
mov edx, dword [esp + 0x40]
push 0
push edx
mov esi, eax
call fcn.0046aef0
xor ecx, ecx
add eax, dword [esp + 0x40]
push ecx
push 0x3e8
adc edx, ecx
push edx
push eax
call fcn.0046be10
xor ecx, ecx
cmp ecx, edx
jg 0x415582
jl 0x41557e
cmp esi, eax
jae 0x415582
mov dword [esp + 0x18], edi
push 0x2400
call fcn.0045e0f8
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2d4], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d4], 0
jne 0x4155a8
mov dword [esp + 0x18], edi
push 0x2000
call fcn.0045e0f8
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2d8], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d8], 0
jne 0x4155ce
mov dword [esp + 0x18], edi
cmp byte [esp + 0x13], 0
mov byte [esp + 0x80], 7
je 0x415707
cmp dword [esp + 0x18], 0xffffffff
je 0x415707
lea ecx, [eax + 0x17c]
lea esi, [esp + 0x144]
call fcn.00419c30
test al, al
je 0x415707
mov edx, dword [esp + 0x144]
mov eax, dword [esp + 0x148]
shrd edx, eax, 0xd
mov ecx, edx
shr eax, 0xd
lea eax, [ecx*4 + 0x400]
push eax
mov dword [esp + 0x44], eax
call fcn.0045e0f8
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
je 0x415707
mov edx, dword [ebx + 0x68]
mov edi, dword [edx + 0x2dc]
push 0x2000
call fcn.0045e0f8
add esp, 4
test eax, eax
je 0x415707
mov ecx, dword [esp + 0x38]
push ecx
mov esi, eax
mov ebx, edi
call fcn.00418f00
mov edi, eax
cmp edi, 0xffffffff
je 0x415703
mov eax, dword [esp + 0x40]
mov edx, eax
shl edx, 0x10
mov ecx, eax
and ecx, 0xff00
or edx, ecx
mov ecx, eax
shl edx, 8
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr eax, 0x18
or edx, eax
mov dword [esp + 0x84], edx
mov edx, edi
shl edx, 0x10
mov eax, edi
and eax, 0xff00
or edx, eax
mov ecx, edi
sar ecx, 8
shl edx, 8
and ecx, 0xff00
or edx, ecx
mov eax, edi
shr eax, 0x18
or edx, eax
mov dword [esp + 0x88], edx
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x80]
mov byte [esp + 0x81], 0xc
call fcn.0044b4b0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
mov ecx, edi
mov edi, dword [edx + 0x60]
call fcn.0044b4f0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx + 0x68]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
lea eax, [ebx + 0x17c]
mov dword [esp + 0x84], ecx
mov ecx, eax
mov byte [esp + 0x81], 9
lea esi, [ecx + 1]
jmp 0x415750
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415750
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415760
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov edi, edi
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x415770
sub esi, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x415780
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x88], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x80]
call fcn.0044b4b0
mov eax, dword [edi + 0x68]
add eax, 0x17c
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4157d5
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044b4f0
cmp dword [esp + 0x18], 0xffffffff
jne 0x41583d
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x68]
add esi, 0x2dc
call fcn.0044b8c0
mov eax, dword [edi + 0x68]
mov eax, dword [eax + 0x2d8]
test eax, eax
je 0x415815
push eax
call fcn.0045dc91
add esp, 4
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx + 0x2d4]
test eax, eax
je 0x41582b
push eax
call fcn.0045dc91
add esp, 4
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, edi
jmp case.0x415277.2
mov eax, dword [esp + 0x24]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
mov eax, dword [esp + 0x14]
shl edx, 8
shr ecx, 8
or ecx, edx
mov edx, dword [eax + 0x68]
mov dword [edx + 0x2e0], ecx
mov ecx, dword [eax + 0x68]
mov edx, dword [ecx + 0x2e0]
shr edx, 0xd
mov dword [ecx + 0x2e4], edx
mov edx, dword [eax + 0x68]
xor ecx, ecx
mov dword [edx + 0x2e8], ecx
mov edx, dword [eax + 0x68]
mov dword [edx + 0x2ec], ecx
mov edx, dword [eax + 0x68]
mov dword [edx + 0x2f0], ecx
mov edx, dword [eax + 0x68]
mov byte [edx + 0x2f6], cl
mov edx, dword [eax + 0x68]
mov byte [edx + 0x2f4], cl
mov ecx, dword [esp + 0x3c]
mov eax, dword [eax + 0x68]
push ecx
mov byte [eax + 0x2f5], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402470
mov byte [esp + 0xa80], 0xb
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je 0x415db3
cmp byte [esp + 0x13], 0
je 0x415db3
mov eax, dword [esp + 0x24]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 1
mov ecx, dword [ebx + 0x68]
sete al
mov byte [ecx + 0x450], al
mov eax, dword [esp + 0x28]
mov esi, eax
mov edx, eax
shr edx, 0x10
and esi, 0xff0000
or esi, edx
mov edx, dword [ebx + 0x68]
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
push 0x144
or ecx, eax
add edx, 0x2f7
shl ecx, 8
push 0
shr esi, 8
push edx
or esi, ecx
call fcn.00463710
add esp, 0xc
cmp esi, 0x144
jbe 0x41599a
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov ecx, dword [ebx + 0x68]
mov edx, dword [ebx + 0x60]
add ecx, 0x2f7
push ecx
push edx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
jne 0x4159c3
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov eax, dword [ebx + 0x68]
lea ecx, [eax + 0x2f7]
push ecx
push eax
call fcn.00419820
or edi, 0xffffffff
cmp eax, edi
jne 0x415adf
mov ebx, dword [ebx + 0x68]
lea eax, [ebx + 0x2f7]
mov ecx, eax
mov byte [esp + 0x110], 7
mov byte [esp + 0x111], 4
mov dword [esp + 0x114], edi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415a03
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415a13
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x415a21
sub esi, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x415a30
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x118], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x110]
call fcn.0044b4b0
mov eax, dword [edi + 0x68]
add eax, 0x2f7
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415a85
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044b4f0
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x60]
mov ecx, 4
lea eax, [esp + 0xec]
mov dword [esp + 0xec], 0xffffffff
call fcn.0044b4f0
mov edx, dword [esi + 0x68]
mov ecx, dword [esp + 0x48]
mov byte [edx + 0x451], 1
mov eax, dword [esi + 0x68]
push ecx
mov byte [eax + 0x452], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, esi
jmp case.0x415277.2
mov edx, dword [ebx + 0x68]
push 0
push 0x8000000
push 3
push 0
push 1
push accept
add edx, 0x2f7
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x43c], eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x43c], edi
jne 0x415b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], edi
jmp 0x415c2c
lea ecx, [eax + 0x2f7]
lea esi, [esp + 0x54]
call fcn.00419c30
test al, al
jne 0x415b58
mov esi, dword [ebx + 0x68]
add esi, 0x43c
call fcn.0044b8c0
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
jmp 0x415c28
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x43c]
lea edx, [esp + 0x180]
push edx
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x415c28
lea edx, [esp + 0x100]
push edx
lea eax, [esp + 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [esp + 0x10a]
movzx edx, word [esp + 0x108]
movzx eax, word [esp + 0x100]
push ecx
movzx ecx, word [esp + 0x10a]
push edx
movzx edx, word [esp + 0x10a]
push eax
push ecx
push edx
lea eax, [esp + 0x21c]
push str._2.2d__2.2d__4.4d__2.2d:_2.2d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebx + 0x68]
add eax, 0x2f7
add esp, 0x1c
add eax, edi
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x415be0
mov cx, word [0x47d408]
mov edi, eax
lea eax, [esp + 0x208]
mov word [edi], cx
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415c00
mov edi, dword [ebx + 0x68]
sub eax, esi
add edi, 0x2f6
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x415c12
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x54]
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x454]
xor edi, edi
cmp eax, edi
je 0x415c4d
push eax
call fcn.0045e501
mov eax, dword [ebx + 0x68]
add esp, 4
mov dword [eax + 0x454], edi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x458], edi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x45c], edi
mov ebx, dword [ebx + 0x68]
mov eax, esi
mov ecx, esi
mov edx, esi
and eax, 0xff0000
shr ecx, 0x10
shl edx, 0x10
and esi, 0xff00
or eax, ecx
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0x12c], eax
lea eax, [ebx + 0x2f7]
mov ecx, eax
mov byte [esp + 0x128], 7
mov byte [esp + 0x129], 4
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415ca7
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415cb7
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x415cc5
sub esi, ebx
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x415cd1
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x130], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x128]
call fcn.0044b4b0
mov eax, dword [edi + 0x68]
add eax, 0x2f7
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415d26
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044b4f0
mov esi, dword [esp + 0x58]
mov eax, esi
and eax, 0xff0000
mov ecx, esi
shr ecx, 0x10
or eax, ecx
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
mov edx, dword [esp + 0x14]
mov edi, dword [edx + 0x60]
mov dword [esp + 0xc0], eax
mov ecx, 4
lea eax, [esp + 0xc0]
call fcn.0044b4f0
cmp dword [esp + 0x54], 0xffffffff
jne 0x415d9f
cmp esi, 0xffffffff
jne 0x415d9f
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov edx, dword [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x415277.2
mov eax, dword [ebx + 0x64]
mov eax, dword [eax + 0x574]
mov edi, dword [ebx + 0x60]
push eax
call fcn.0044b290
mov eax, dword [esp + 0x28]
mov esi, dword [ebx + 0x68]
mov edi, eax
mov ecx, eax
mov edx, eax
and edi, 0xff0000
shl edx, 0x10
and eax, 0xff00
shr ecx, 0x10
or edi, ecx
or edx, eax
shl edx, 8
shr edi, 8
or edi, edx
lea eax, [edi + 1]
push eax
call fcn.0045e0f8
add esp, 4
mov dword [esi + 0x454], eax
test eax, eax
jne 0x415e23
xor al, al
movzx ecx, al
mov dword [esp + 0x1c], ecx
jmp case.0x415277.2
call fcn.00418f90
movzx ecx, al
mov dword [esp + 0x1c], ecx
jmp case.0x415277.2
mov eax, dword [esp + 0x24]
mov edx, eax
and edx, 0xff0000
mov ecx, eax
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
cmp edx, 0xffffffff
jne 0x415e73
mov esi, dword [ebx + 0x68]
add esi, 0x43c
call fcn.0044b8c0
jmp case.0x415277.2
push 0x2000
call fcn.0045e0f8
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2d4], eax
mov eax, dword [ebx + 0x68]
xor edi, edi
add esp, 4
cmp dword [eax + 0x2d4], edi
jne 0x415ea6
lea esi, [eax + 0x43c]
call fcn.0044b8c0
jmp case.0x415277.2
push 0x2400
call fcn.0045e0f8
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2d8], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d8], edi
jne 0x415ef1
lea esi, [eax + 0x43c]
call fcn.0044b8c0
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x2d4]
cmp eax, edi
je case.0x415277.2
push eax
call fcn.0045dc91
add esp, 4
jmp case.0x415277.2
mov byte [eax + 0x440], 0
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x444], edi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2f0], edi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x44c], edi
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x451], 0
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x452], 1
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2f6], 0
mov eax, dword [ebx + 0x68]
push eax
call fcn.00419350
movzx ecx, al
mov dword [esp + 0x1c], ecx
jmp case.0x415277.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x415277.2
cmp byte [esp + 0x13], 0
je case.0x415277.2
mov eax, dword [esp + 0x24]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
mov esi, dword [ebx + 0x68]
and eax, 0xff00
or edx, eax
shl edx, 8
shr ecx, 8
or ecx, edx
push ecx
mov ecx, dword [esp + 0x2c]
mov eax, ecx
mov edx, ecx
shr edx, 0x10
and eax, 0xff0000
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
call fcn.00418fd0
mov esi, dword [ebx + 0x68]
movzx eax, al
push 0
mov dword [esp + 0x20], eax
call fcn.00419fe0
jmp case.0x415277.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x415277.2
cmp byte [esp + 0x13], 0
je case.0x415277.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je case.0x415277.2
push eax
call fcn.00419110
jmp case.0x415277.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je 0x416039
mov byte [eax + 0x2f4], 1
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x2f6], 1
mov edx, dword [ebx + 0x68]
push edx
call fcn.00419110
jmp case.0x415277.2
cmp byte [eax + 0x452], 0
je 0x416058
mov byte [eax + 0x451], 1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2f6], 1
jmp case.0x415277.2
mov byte [eax + 0x476], 1
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x476], 0
je case.0x415277.2
cmp word [esp + 0x22], 0
mov byte [esp + 0xc4], 7
sete al
test al, al
je 0x41608e
mov byte [esp + 0xc5], 7
jmp 0x4160d0
mov ecx, dword [ebx + 0x64]
mov byte [esp + 0xc5], 0xe
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je 0x4160d0
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0xe8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x118]
call eax
test eax, eax
je 0x4160d0
cmp byte [esp + 0x13], 0
mov dword [esp + 0xc8], 0x1000000
jne 0x4160db
mov dword [esp + 0xc8], 0xffffffff
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0xec]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0xc4]
call fcn.0044b4b0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x68]
mov byte [ecx + 0x476], 0
mov ebx, eax
jmp case.0x415277.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x415277.2
cmp byte [esp + 0x13], 0
je case.0x415277.2
movzx eax, word [esp + 0x22]
sub eax, 1
je 0x41625e
sub eax, 1
jne case.0x415277.2
lea ecx, [esp + 0x224]
push ecx
push pe_nt_image_headers32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
lea eax, [ebx - 3]
mov dword [esp + 0x40], ebx
test eax, eax
jbe 0x4161e1
lea esi, [esp + 0xe8]
lea edx, [esp + 0x224]
sub esi, edx
jmp 0x416180
lea eax, [esp + edi + 0x224]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x416187
lea eax, [esp + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x4161a7
jmp dword [eax*4 + 0x416da4]
mov byte [esp + edi + 0x226], 0x6c
jmp case.default.0x4161a7
mov byte [esp + edi + 0x226], 0x66
jmp case.default.0x4161a7
mov byte [esp + edi + 0x226], 0x63
jmp case.default.0x4161a7
mov byte [esp + edi + 0x226], 0x6e
add edi, 4
lea eax, [ebx - 3]
sub esi, 4
cmp edi, eax
jb 0x416180
mov edi, dword [esp + 0x14]
mov edx, 3
mov word [esp + 0x11e], dx
mov eax, ebx
shl eax, 0x10
mov edx, ebx
and edx, 0xff00
or eax, edx
mov edx, ebx
shl eax, 8
sar edx, 8
and edx, 0xff00
or eax, edx
shr ebx, 0x18
or eax, ebx
mov cl, 7
mov dword [esp + 0x124], eax
mov eax, dword [edi + 0x60]
mov esi, 0xc
lea ebx, [esp + 0x11c]
mov byte [esp + 0x11c], cl
mov byte [esp + 0x11d], 2
call fcn.0044b4b0
mov ecx, dword [esp + 0x40]
mov edi, dword [edi + 0x60]
lea eax, [esp + 0x224]
call fcn.0044b4f0
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov eax, dword [esp + 0x28]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x415277.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x224]
push eax
push ecx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
je case.0x415277.2
push 0xb
lea edx, [esp + 0x228]
push str.My_Documents
mov byte [esp + esi + 0x22c], 0
push edx
or esi, 0xffffffff
xor bl, bl
call fcn.0045f407
add esp, 0xc
test eax, eax
jne 0x4162d7
lea esi, [eax + 5]
push 7
lea eax, [esp + 0x228]
push str.Desktop
push eax
call fcn.0045f407
add esp, 0xc
test eax, eax
jne 0x4162f4
xor esi, esi
push 0x11
lea ecx, [esp + 0x228]
push str.Network_Favorites
push ecx
call fcn.0045f407
add esp, 0xc
test eax, eax
jne 0x416314
lea esi, [eax + 0x13]
jmp 0x416319
cmp esi, 0xffffffff
je 0x416387
lea edx, [esp + 0x85c]
push edx
push esi
call fcn.004197b0
test al, al
je 0x416385
lea eax, [esp + 0x85c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416335
sub eax, edx
cmp byte [esp + eax + 0x85b], 0x5c
je 0x416361
lea edi, [esp + 0x85c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x416350
mov ax, word [0x47630c]
mov word [edi], ax
xor eax, eax
jmp 0x416370
mov cl, byte [esp + eax + 0x85c]
mov byte [esp + eax + 0x224], cl
inc eax
test cl, cl
jne 0x416370
jmp 0x416387
mov bl, 1
lea eax, [esp + 0x224]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x416390
mov cx, word [0x47c168]
mov edi, eax
mov edx, 1
mov word [edi], cx
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edx
mov byte [esp + 0x68], 7
mov byte [esp + 0x69], 2
mov word [esp + 0x6a], dx
call edi
lea eax, [esp + 0x43c]
push eax
lea ecx, [esp + 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push 0
mov dword [esp + 0x3c], esi
call edi
cmp esi, 0xffffffff
je 0x41668e
test bl, bl
jne 0x41668e
lea eax, [esp + 0x224]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416400
sub eax, edx
mov ebx, eax
lea eax, [esp + 0x224]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416415
sub eax, edx
mov edi, eax
lea eax, [esp + 0x224]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416430
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x224]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416445
sub eax, esi
dec eax
dec edi
shl eax, 0x10
dec ecx
dec ebx
and edi, 0xff0000
and ecx, 0xff00
or eax, ecx
shr ebx, 0x10
or edi, ebx
shl eax, 8
shr edi, 8
or eax, edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x6c], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x64]
call fcn.0044b4b0
lea eax, [esp + 0x224]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416495
mov edi, dword [edi + 0x60]
sub eax, ecx
lea ecx, [eax - 1]
lea eax, [esp + 0x224]
call fcn.0044b4f0
test byte [esp + 0x43c], 0x10
je 0x4164ef
mov ecx, 0x47d438
lea eax, [esp + 0x468]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4164e6
test dl, dl
je 0x4164e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4164e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4164c6
xor eax, eax
jmp 0x4164eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x416529
mov ecx, 0x47d43c
lea eax, [esp + 0x468]
jmp 0x416500
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x416520
test dl, dl
je 0x41651c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x416520
add eax, 2
add ecx, 2
test dl, dl
jne 0x416500
xor eax, eax
jmp 0x416525
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x416580
lea edx, [esp + 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea eax, [esp + 0x440]
push eax
lea ecx, [esp + 0x654]
push ecx
call fcn.00463790
mov edx, edi
shl edx, 0x10
mov eax, edi
and eax, 0xff00
or edx, eax
mov ecx, edi
sar ecx, 8
shl edx, 8
and ecx, 0xff00
mov eax, edi
or edx, ecx
shr eax, 0x18
or edx, eax
mov dword [esp + 0x78], edx
jmp 0x416610
mov ecx, 0x47d438
lea eax, [esp + 0x468]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4165b0
test dl, dl
je 0x4165ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4165b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x416590
xor eax, eax
jmp 0x4165b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41663f
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x654]
push edx
call fcn.00463790
mov eax, edi
shl eax, 0x10
mov ecx, edi
and ecx, 0xff00
or eax, ecx
mov edx, edi
sar edx, 8
shl eax, 8
and edx, 0xff00
mov ecx, edi
or eax, edx
shr ecx, 0x18
or eax, ecx
mov dword [esp + 0x78], eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x60]
add esp, 0xc
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x64]
call fcn.0044b4b0
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
lea eax, [esp + 0x64c]
call fcn.0044b4f0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x43c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4164b0
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x14]
xor eax, eax
mov word [esp + 0x66], ax
mov dword [esp + 0x6c], eax
lea esi, [eax + 0xc]
mov eax, dword [edx + 0x60]
mov cl, 7
lea ebx, [esp + 0x64]
call fcn.0044b4b0
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x64]
mov dword [esp + 0x6c], 0
call fcn.0044b4b0
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x415277.2
cmp byte [esp + 0x13], 0
je case.0x415277.2
movzx eax, word [esp + 0x22]
sub eax, 1
je 0x4169c0
sub eax, 3
je 0x416825
sub eax, 1
jne case.0x415277.2
mov eax, dword [esp + 0x28]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
mov dword [esp + 0x40], esi
cmp esi, 0x209
ja case.0x415277.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x64c]
push eax
push ecx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
je case.0x415277.2
lea edx, [esp + 0x64c]
push 0x2a
push edx
mov byte [esp + esi + 0x654], 0
call fcn.0045f99f
add esp, 8
test eax, eax
je case.0x415277.2
lea ecx, [eax + 1]
lea esi, [esp + 0x43c]
sub esi, ecx
mov dl, byte [ecx]
mov byte [ecx + esi], dl
inc ecx
test dl, dl
jne 0x416776
mov byte [eax], dl
xor ecx, ecx
jmp 0x416790
mov dl, byte [esp + ecx + 0x64c]
mov byte [esp + ecx + 0x85c], dl
inc ecx
test dl, dl
jne 0x416790
mov byte [eax], 0x2a
lea eax, [esp + 0x43c]
push eax
lea ecx, [esp + 0x860]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, dword [esp + 0x14]
neg eax
sbb eax, eax
neg eax
dec eax
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x28]
mov edx, 8
mov cl, 7
mov dword [esp + 0xb0], eax
mov eax, dword [edi + 0x60]
lea esi, [edx + 4]
lea ebx, [esp + 0xa8]
mov byte [esp + 0xa8], cl
mov byte [esp + 0xa9], 0xb
mov word [esp + 0xaa], dx
call fcn.0044b4b0
mov ecx, dword [esp + 0x40]
mov edi, dword [edi + 0x60]
lea eax, [esp + 0x64c]
call fcn.0044b4f0
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov eax, dword [esp + 0x28]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x415277.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x224]
push eax
push ecx
mov ecx, esi
call fcn.0044b5d0
test eax, eax
je case.0x415277.2
lea edx, [esp + 0x1d4]
push edx
lea eax, [esp + 0x228]
push eax
mov byte [esp + esi + 0x22c], 0
call fcn.0045fa90
mov bl, byte [esp + 0x1e2]
add esp, 8
lea ecx, [esp + 0x224]
push ecx
lea ecx, [esp + 0x20c]
and bl, 1
call fcn.00404500
mov byte [esp + 0xa80], 0xc
test bl, bl
je 0x4168f8
lea edi, [esp + 0x224]
lea esi, [esp + 0x194]
call fcn.00411450
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x214]
mov byte [esp + 0xa8c], 0xd
call fcn.00404590
mov ecx, esi
mov byte [esp + 0xa80], 0xc
call fcn.00404540
mov edi, dword [esp + 0x21c]
lea esi, [esp + 0x224]
inc edi
call fcn.004113b0
movzx eax, al
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, 7
mov dword [esp + 0xdc], eax
mov edx, ecx
mov word [esp + 0xda], dx
mov eax, edi
and eax, 0xff0000
mov edx, edi
shr edx, 0x10
or eax, edx
mov edx, edi
shl edx, 0x10
mov esi, edi
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x60]
lea esi, [ecx + 5]
lea ebx, [esp + 0xd8]
mov byte [esp + 0xd8], cl
mov byte [esp + 0xd9], 0xb
call fcn.0044b4b0
cmp dword [esp + 0x220], 0x10
mov eax, dword [esp + 0x20c]
jae 0x416995
lea eax, [esp + 0x20c]
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
call fcn.0044b4f0
lea ecx, [esp + 0x208]
mov byte [esp + 0xa80], 9
call fcn.00404540
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov eax, dword [esp + 0x28]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x415277.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x224]
push eax
push ecx
mov ecx, edi
call fcn.0044b5d0
test eax, eax
je case.0x415277.2
push 0
lea edx, [esp + 0x228]
push edx
mov byte [esp + edi + 0x22c], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
dec eax
mov edx, 4
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x28]
mov word [esp + 0xb6], dx
lea esi, [edx + 8]
mov edx, dword [esp + 0x14]
mov cl, 7
mov dword [esp + 0xbc], eax
mov eax, dword [edx + 0x60]
lea ebx, [esp + 0xb4]
mov byte [esp + 0xb4], cl
mov byte [esp + 0xb5], 0xb
call fcn.0044b4b0
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
lea eax, [esp + 0x224]
call fcn.0044b4f0
mov ebx, dword [esp + 0x14]
jmp case.0x415277.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je 0x416ac9
mov byte [eax + 0x2f4], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, dword [ebx + 0x68]
add esi, 0x2dc
call fcn.0044b8c0
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2f5], 0
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x452], 0
je case.0x415277.2
mov byte [eax + 0x451], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, dword [ebx + 0x68]
add esi, 0x43c
call fcn.0044b8c0
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x452], 0
mov eax, dword [ebx + 0x68]
mov dword [esp + 0xa80], 0xffffffff
mov ecx, dword [esp + 0x70]
push ecx
mov dword [eax + 0x174], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x4141e7.13
mov eax, dword [edi + 0xe13c]
test eax, eax
je 0x416b71
push 0
call eax
test eax, eax
jne 0x416b5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncdesktop.cpp_:_BlockInput_failed:__Last_error__08X_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [edi + 0xe13c]
push 0
call ecx
mov esi, dword [edi + 0xdbd0]
push 1
call fcn.00448890
mov edx, dword [esp + 0x14]
xor al, al
mov byte [edi + 0xe200], al
mov ecx, dword [edx + 0x68]
mov byte [ecx + 0x4cd], al
mov ebx, edx
mov edx, dword [ebx + 0x68]
mov esi, edx
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
mov ecx, esi
call edx
mov edx, dword [esi]
cwde
push eax
mov eax, dword [edx + 0x3c]
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_disconnected_:__s___hd__n
mov ecx, 1
mov eax, 0x48c4e8
call fcn.00401000
add esp, 0xc
push 0x104
lea ecx, [esp + 0x228]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x416c2b
lea edx, [esp + 0x224]
push 0x5c
push edx
call fcn.0045f99f
mov byte [eax], 0
lea eax, [esp + 0x22c]
add esp, 8
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x416c00
mov ecx, dword [str.logging.dll]
mov edx, dword [0x47cd3c]
mov dword [eax], ecx
mov ecx, dword [0x47cd40]
mov dword [eax + 4], edx
mov dl, byte [0x47cd44]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x416c64
push str.LOGEXIT
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x3c]
call eax
push eax
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [ebx + 0x68]
mov esi, dword [ecx + 0x138]
test esi, esi
je 0x416c90
call fcn.004116f0
mov edx, dword [ebx + 0x68]
mov ecx, dword [edx + 0x138]
push 0
call fcn.0045d5c0
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
mov ebx, dword [ebx + 0x64]
mov eax, dword [ebx]
mov edx, dword [eax + 0x230]
mov ecx, ebx
call edx
test eax, eax
je 0x416d0b
mov esi, dword [0x4a78c8]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x416ceb
push 0x457
push 0x457
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x416d0b
mov byte [0x4a77f2], 1
jmp 0x416d0b
push str.._vncclient.cpp_:_Invalid_DSMPlugin_Pointer_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
mov ecx, dword [esp + 0xa78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa60]
xor ecx, esp
call fcn.0045dc1f
mov esp, ebp
pop ebp
ret 4