Function at 0x140055660
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check os version
Create thread
Power down monitor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov rax, qword [0x14022a710]
mov ecx, dword [rax + 0xe60]
cmp ecx, 1
jne 0x140055789
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x1400556da
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x14005577f
test rax, rax
jne 0x14005570e
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
jmp 0x140055711
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x14005577f
test rcx, rcx
jne 0x140055740
mov ecx, gethostbyname
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
jmp 0x140055743
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x14005577f
test rcx, rcx
jne 0x14005576f
mov ecx, gethostbyname
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
mov rcx, rax
mov qword [0x140227bc8], rax
cmp byte [rcx + 8], 0
jne 0x14005577f
mov al, 1
mov byte [0x14021f0a0], al
jmp 0x140055793
xor al, al
mov byte [0x14021f0a0], al
jmp 0x140055793
cmp ecx, 2
sete byte [0x14021f0a0]
mov byte [rdi + 0x10b68], 1
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_1_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xeac0], rax
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_2_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov dword [rbp + 0x110], __WSAFDIsSet
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400558be
lea r8, str.vncDesktop::KillScreenSaver_:_KillScreenSaver..._n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov eax, dword [rbp + 0x120]
sub eax, 1
je 0x140055897
cmp eax, 1
jne 0x1400558be
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
lea rcx, str.Screen_saver
call qword [sym.imp.USER32.dll_OpenDesktopA]
mov rbx, rax
test rax, rax
je 0x1400558be
lea r8, str.vncDesktop::KillScreenSaver_:_Killing_ScreenSaver_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor r8d, r8d
lea rdx, [0x14004e430]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 - 1]
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x1400558be
xor edx, edx
lea rcx, str.WindowsScreenSaverClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400558be
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_recvfrom
call fcn.140030680
xor edx, edx
lea r8d, [rdx + 2]
mov cl, reloc.WS2_32.dll_recvfrom
call fcn.140030680
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x10a80]
call fcn.14004dc00
mov ebx, eax
test eax, eax
je 0x140055930
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xeac0]
call fcn.140021350
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xeab8]
test rcx, rcx
je 0x140055920
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x20]
jmp 0x140057bc9
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x20]
mov rax, qword [0x14022a710]
mov r8d, dword [rax + 0xe50]
mov edx, dword [rax + 0xe54]
mov rcx, qword [rdi + 0x10a80]
call fcn.140051000
mov byte [rdi + 0x10b69], 0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov qword [rbp - 0x60], r14
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp - 0x50], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x58], rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp - 0x40], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x48], rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp - 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x38], rax
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x20], r12b
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
lea r13, vtable.rfb::ClippedUpdateTracker.0
mov qword [rbp - 0x10], r13
lea rax, [rbp - 0x60]
mov qword [rbp - 8], rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp], rax
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov byte [rbp - 0x20], 1
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rsp + 0x40], rax
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rdi + 0x10a80]
mov r10, qword [rcx]
cmp dword [rax + 0xe478], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xe8]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbp + 0xc8]
mov qword [rdi + 0x10a8c], rax
mov rdx, qword [rdi + 0x10a80]
mov rax, qword [rdx + 0xe458]
test rax, rax
je 0x140055bce
cmp qword [rax + 0x20], r12
je 0x140055bba
cmp dword [rdx + 0x8d0], r12d
je 0x140055bce
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xe0]
mov rax, qword [rdi + 0x10a80]
mov qword [rax + 0x808], 4
jmp 0x140055bce
mov dword [rdx + 0xe9ec], 1
mov dword [rdx + 0xe9f0], 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f0], 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe978], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9ec], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f4], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f8], r12d
mov ebx, r12d
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
jne 0x140055c6b
nop
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jg 0x140055c6b
lea r8, str.vncDesktopThread::run_undetached_:_Wait_for_viewer_init__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
je 0x140055c30
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10af0], dl
test eax, eax
jne 0x140055cb1
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055cb1
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx edx, byte [rdi + 0x10af0]
test dl, dl
je 0x140055ce9
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055cd9
mov rax, qword [rcx]
call qword [rax + 0x20]
movzx edx, byte [rdi + 0x10af0]
test dl, dl
je 0x140055ce9
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10af8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10afc], eax
mov r15d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
mov byte [0x14021f658], r15b
mov byte [rdi + 0x10a88], 1
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
cmp byte [0x14021f65a], r12b
jne 0x140055f05
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055e81
cmp qword [rcx + 0x20], r15
je 0x140055e67
cmp dword [rax + 0x8d0], r12d
je 0x140055e81
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x140055e08
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x140055e88
test rax, rax
jne 0x140055e39
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
mov esi, 1
cmp byte [rcx + 8], 0
jne 0x140055e8d
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
mov r9d, esi
mov r8d, esi
lea rdx, [rsp + 0x40]
call fcn.140036b50
jmp 0x140055f0a
mov esi, 1
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x140227bc8]
jmp 0x140055e8d
mov rax, qword [0x140227bc8]
mov esi, 1
test rax, rax
jne 0x140055eaf
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x140055f0a
test rax, rax
jne 0x140055edc
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
jmp 0x140055edf
mov rax, rcx
cmp byte [rax + 8], 0
jne 0x140055f0a
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
mov r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140036b50
jmp 0x140055f0a
mov esi, 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe4cc], esi
mov qword [rbp + 0x28], r12
mov qword [rbp - 0x68], r12
mov rax, qword [0x14022a710]
cmp dword [rax + 0xa58], 0
mov ecx, 0x80000043
jne 0x140055f39
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x14005603e
cmp qword [rcx + 0x20], 0
je 0x140056032
cmp dword [rax + 0x8d0], 0
je 0x14005603e
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x140055f97
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x140056045
test rax, rax
jne 0x140055fcc
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rcx + 8], 0
jne 0x140056045
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140055570]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0xb4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400555f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
jmp 0x140056164
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x140227bc8]
mov rcx, qword [rdi + 0x10a80]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x1400562b0
cmp qword [rdx + 0x20], 0
je 0x1400562a4
cmp dword [rcx + 0x8d0], 0
je 0x1400562b0
test rax, rax
jne 0x140056096
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x1400560d0
test rax, rax
jne 0x1400560c3
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
jmp 0x1400560c6
mov rax, rcx
cmp byte [rax + 8], 0
je 0x1400562b0
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xe3e8], rax
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xe3f0], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
cmp byte [rdi + 0x10af0], 0
je 0x140056164
mov rax, qword [rdi + 0x10a80]
cmp qword [rax + 0xe458], 0
je 0x140056160
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400555f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, dword [rsp + 0x50]
cmp byte [rdi + 0x10a88], 0
je 0x140057989
mov r14d, 0x421
nop word [rax + rax]
cmp byte [0x14021fa63], 0
jne 0x14005797b
mov rdx, qword [rdi + 0x10a80]
add rdx, 0xe3b8
mov r9d, eax
xor r8d, r8d
lea ecx, [r8 + 8]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, qword [rdi + 0x10a80]
mov edx, 0x2710
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400561d4
mov byte [rdi + 0x10a88], 0
cmp ebx, 5
ja 0x140056398
je 0x140056378
test ebx, ebx
je 0x140056447
sub ebx, 1
je 0x140056300
sub ebx, 1
je 0x1400562e7
sub ebx, 1
je 0x1400563d7
cmp ebx, 1
jne 0x140057964
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], bl
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 0
jmp 0x140057964
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
lea rax, [rbp + 0xbc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400555f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x21
mov dword [rsp + 0x50], eax
jmp 0x140056164
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140057964
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 1
mov r8, qword [rdi + 0x10a80]
mov r9d, 2
mov r8, qword [r8 + 0xe418]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, qword [rdi + 0x10a80]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xe418]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 0
jmp 0x140057964
mov byte [rdi + 0x10a88], 0
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140057964
cmp ebx, 6
je 0x14005641b
cmp ebx, 7
je 0x1400563c3
cmp ebx, 0x102
je 0x140056447
cmp ebx, 0xffffffff
jne 0x140057964
mov byte [rdi + 0x10a88], 0
jmp 0x140057964
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10ae8]
test rax, rax
je 0x140056402
mov dword [rbp - 0x80], 0x18
lea rcx, [rbp - 0x80]
call rax
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rbp - 0x78]
mov qword [rcx + 0xe960], rax
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140057964
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r8, str.DDEngine
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x14021fa68]
call fcn.14015b9d4
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe48], 0x64
je 0x1400564db
cmp r15d, 0xa
ja 0x1400564e5
bt r14d, r15d
jae 0x1400564e5
lea rcx, [rdi + 0x10b08]
call fcn.140019560
mov word [rdi + 0x10b58], ax
mov r8d, dword [rdi + 0x10b5c]
movsx ecx, ax
mov rax, qword [0x14022a710]
cmp ecx, dword [rax + 0xe48]
lea eax, [r8 + 0xa]
jg 0x1400564ab
lea eax, [r8 - 0xa]
lea r8, [rdi + 0x10b5c]
mov ecx, eax
mov dword [r8], eax
mov ecx, dword [rdi + 0x10b64]
cmp eax, ecx
jae 0x1400564c9
mov dword [rdi + 0x10b5c], ecx
mov eax, ecx
mov ecx, dword [rdi + 0x10b60]
cmp eax, ecx
jbe 0x1400564e5
mov dword [rdi + 0x10b5c], ecx
jmp 0x1400564e5
mov dword [rdi + 0x10b5c], 0x19
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10af4], eax
mov ecx, dword [rdi + 0x10af8]
mov r8d, dword [rdi + 0x10b5c]
mov edx, eax
sub edx, ecx
cmp edx, r8d
jae 0x140056512
sub ecx, eax
add ecx, r8d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140056555
cmp qword [rcx + 0x20], 0
je 0x140056549
cmp dword [rax + 0x8d0], 0
je 0x140056555
mov rax, qword [rdi]
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x140056555
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [rdi + 0x10a80]
cmp dword [rax + 0xe9f0], 0
je 0x1400565cb
cmp dword [rax + 0xe9ec], 0
jne 0x1400565cb
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rdi + 0x10a80]
movsxd r8, dword [rcx + 0xe9e8]
xor r9d, r9d
mov edx, 0x8007
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [rdi + 0x10a80]
cmp dword [rax + 0xe9e8], 0
je 0x1400565c4
mov qword [rax + 0xe968], r12
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f0], r12d
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x250]
test al, al
jne 0x14005660d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400542a0
test al, al
jne 0x14005660d
mov byte [rdi + 0x10a88], al
jmp 0x140057964
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x238]
mov rcx, qword [rdi + 0x10a80]
mov byte [rcx + 0x8d4], al
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x240]
mov rcx, qword [rdi + 0x10a80]
mov byte [rcx + 0x8d5], al
mov rax, qword [rdi + 0x10a80]
add rax, 0xe4e8
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x113
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
jne 0x1400566a9
cmp byte [rdi + 0x10b69], al
jne 0x140057959
mov eax, dword [rdi + 0x10af4]
mov dword [rdi + 0x10af8], eax
xor r14b, r14b
mov byte [rsp + 0x30], r14b
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14005673c
mov rax, qword [rbp + 0x50]
cmp eax, dword [rdi + 0x10a8c]
jne 0x1400566e2
mov ecx, dword [rdi + 0x10a90]
cmp dword [rbp + 0x54], ecx
je 0x14005673c
mov r14b, 1
mov byte [rsp + 0x30], r14b
mov qword [rdi + 0x10a8c], rax
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rax, qword [rdi + 0x10ae8]
test rax, rax
je 0x14005673c
mov dword [rbp + 0xf8], 0x18
lea rcx, [rbp + 0xf8]
call rax
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rbp + 0x100]
mov qword [rcx + 0xe960], rax
xor r13b, r13b
mov r8, qword [rdi + 0x10a80]
cmp dword [r8 + 0x8d0], 0
jne 0x140056771
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.140050540
movzx r13d, al
mov r8, qword [rdi + 0x10a80]
cmp dword [r8 + 0x8d0], 0
je 0x1400567d7
cmp byte [r8 + 0xea78], 0
je 0x1400567d7
cmp dword [r8 + 0xea68], 0
jne 0x1400567d7
mov rax, qword [0x14022a710]
test r14b, r14b
je 0x1400567b0
mov ecx, r12d
cmp dword [rax + 0xe30], 0
setne cl
inc ecx
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140056809
mov ecx, 2
cmp dword [rax + 0xe30], 0
mov eax, 4
cmovne ecx, eax
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x14005692a
test r13b, r13b
jne 0x140056800
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140055170
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
test r14b, r14b
je 0x14005692a
mov rcx, qword [rdi + 0x10a80]
cmp dword [rcx + 0x8d0], 0
jne 0x14005692a
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x14005692a
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x14005692a
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140056888
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140056896
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x1400568ab
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x1400568bf
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x140056927
test edx, edx
jle 0x140056927
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.14014e740
movzx r14d, byte [rsp + 0x30]
mov esi, 1
xor r12d, r12d
mov rax, qword [rdi + 0x10a80]
add rax, 0xe4e8
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], 0x114
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x14022a710]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b58]
cmp ecx, eax
jge 0x140056994
mov rcx, qword [rdi + 0x10a80]
cmp dword [rcx + 0x8d0], 0
jne 0x140056994
test r13b, r13b
jne 0x140056994
lea rdx, [rbp - 0x10]
call fcn.140050540
movzx eax, byte [0x14021f65a]
test al, al
je 0x1400569e8
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x248]
test al, al
je 0x1400569dd
mov rcx, qword [rdi + 0x10a80]
mov r8d, dword [rcx + 0x838]
mov rdx, qword [rcx + 0x870]
mov rcx, qword [rcx + 0x878]
call fcn.14004f350
jmp 0x140056a43
movzx eax, byte [0x14021f65a]
test al, al
jne 0x140056a43
mov rcx, qword [rdi + 0x10a80]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140056a23
cmp qword [rdx + 0x20], 0
je 0x140056a10
cmp dword [rcx + 0x8d0], 0
je 0x140056a23
mov r8d, esi
jmp 0x140056a2a
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
mov rcx, qword [rdi + 0x10a80]
test al, al
jne 0x140056a43
xor r8d, r8d
movzx r9d, byte [rdi + 0x10b68]
lea rdx, [rsp + 0x40]
add rcx, 0x7e8
call fcn.140036b50
mov byte [rdi + 0x10b68], 1
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov ecx, r12d
cmp byte [rdi + 0x10af0], 0
sete cl
cmp ecx, eax
jne 0x140056ab6
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10af0], dl
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140056ab6
mov rax, qword [rcx]
test dl, dl
jne 0x140056ab3
call qword [rax + 0x18]
jmp 0x140056ab6
call qword [rax + 0x20]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov rcx, qword [rdi + 0x10a80]
test eax, eax
je 0x140056cc5
mov rax, qword [rcx + 0xe968]
cmp qword [rcx + 0xe960], rax
jne 0x140056b01
mov eax, dword [rcx + 0x880]
mov dword [rcx + 0x880], r12d
test eax, eax
je 0x140056e6a
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rcx + 0xe960]
mov qword [rcx + 0xe968], rax
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0x810], esi
mov rsi, qword [rdi + 0x10a80]
cmp dword [rsi + 0x8d0], 0
je 0x140056b3c
cmp byte [rsi + 0xea78], 0
jne 0x140056ba5
add rsi, 0x7e8
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x140056b5f
cmp qword [rsi + 0x88], rcx
jne 0x140056b68
cmp qword [rsi + 0x88], rcx
je 0x140056b74
mov rcx, rsi
call fcn.140035f80
test eax, eax
je 0x140056ba5
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004ff70
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.1400370e0
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a80]
mov r11d, dword [rcx + 0xe42c]
mov r8d, dword [rcx + 0xe434]
sub r8d, r11d
mov r15d, dword [rcx + 0xe430]
mov edx, dword [rcx + 0xe438]
sub edx, r15d
mov r10d, dword [rcx + 0xe514]
mov esi, dword [rcx + 0xe51c]
add esi, r10d
mov r9d, dword [rcx + 0xe510]
mov ebx, dword [rcx + 0xe518]
add ebx, r9d
cmp r11d, r9d
jge 0x140056c12
mov eax, r11d
sub eax, r9d
add r8d, eax
mov r12d, r9d
cmp r11d, r9d
cmovge r12d, r11d
cmp r15d, r10d
jge 0x140056c2a
sub r15d, r10d
add edx, r15d
mov r15d, r10d
lea ecx, [rbx + r9]
lea eax, [r8 + r12]
cmp eax, ecx
jle 0x140056c3f
mov r8d, ebx
sub r8d, r12d
add r8d, r9d
lea ecx, [rdx + r15]
lea eax, [r10 + rsi]
cmp ecx, eax
jle 0x140056c53
mov edx, r10d
sub edx, r15d
add edx, esi
test r8d, r8d
jle 0x140056cb0
test edx, edx
jle 0x140056cb0
lea esi, [r8 + r12]
lea ebx, [rdx + r15]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.14014e740
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
jmp 0x140056e6a
cmp dword [rcx + 0x8d0], 0
je 0x140056cdb
cmp byte [rcx + 0xea78], 0
jne 0x140056e6a
lea rsi, [rcx + 0x7e8]
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x140056cfe
cmp qword [rsi + 0x88], rcx
jne 0x140056d07
cmp qword [rsi + 0x88], rcx
je 0x140056d13
mov rcx, rsi
call fcn.140035f80
test eax, eax
je 0x140056d44
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004ff70
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.1400370e0
test r14b, r14b
je 0x140056e6a
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a80]
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x140056e6a
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x140056e6a
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140056dd6
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140056de4
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x140056df9
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x140056e0d
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x140056e6a
test edx, edx
jle 0x140056e6a
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.14014e740
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r15, rax
mov qword [rbp + 0xa0], rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 0x98], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r12, rax
mov qword [rbp + 0x90], rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 0x88], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r13, rax
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
xor r14d, r14d
cmp eax, 1
je 0x140056f98
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.1400272c0
mov rbx, qword [rbp + 0x128]
cmp rbx, qword [rbp + 0x130]
je 0x140056f8c
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
lea r8, [rbp + 0x140]
mov rdx, rbx
call fcn.140037990
add rbx, 0x10
cmp rbx, qword [rbp + 0x130]
jne 0x140056f62
lea rcx, [rbp + 0x110]
call fcn.1400474e0
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 4
mov r8, qword [rbp - 0x38]
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400573d5
mov rax, qword [0x14022a710]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b58]
cmp ecx, eax
jge 0x1400573d5
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.1400272c0
mov r13, qword [rbp + 0x128]
cmp r13, qword [rbp + 0x130]
je 0x1400573c0
add r13, 0xc
nop
mov r12d, dword [r13 - 4]
add r12d, 4
mov dword [rsp + 0x68], r12d
mov r8d, dword [r13]
add r8d, 4
mov dword [rsp + 0x6c], r8d
mov ecx, dword [r13 - 0xc]
add ecx, 0xfffffffc
mov dword [rsp + 0x60], ecx
mov r9d, dword [r13 - 8]
add r9d, 0xfffffffc
mov dword [rsp + 0x64], r9d
mov rdx, qword [rdi + 0x10a80]
cmp qword [rdx + 0xe458], 0
je 0x140057168
add rdx, 0x8d8
lea rax, [rsp + 0x60]
cmp ecx, dword [rdx]
cmovl rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x60], eax
lea rax, [rdx + 4]
lea rcx, [rsp + 0x64]
cmp r9d, dword [rax]
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x64], eax
lea rax, [rdx + 8]
lea rcx, [rsp + 0x68]
cmp dword [rax], r12d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x68], eax
lea rax, [rdx + 0xc]
lea rcx, [rsp + 0x6c]
cmp dword [rax], r8d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x6c], eax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r12d, dword [rsp + 0x68]
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r15, rax
mov r9d, dword [rsp + 0x6c]
mov r8d, r12d
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call fcn.14014e740
mov ecx, dword [rbp + 0x144]
neg ecx
mov eax, dword [rbp + 0x140]
neg eax
mov r10d, dword [rsp + 0x6c]
add r10d, ecx
lea r9d, [rax + r12]
mov dword [rbp + 0x20], r9d
mov dword [rbp + 0x24], r10d
mov edx, dword [rsp + 0x64]
add edx, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x14], edx
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x18], rax
mov r8, qword [rdi + 0x10a80]
add r8, 0x8d8
lea rax, [rbp + 0x10]
cmp ecx, dword [r8]
cmovl rax, r8
mov r15d, dword [rax]
mov dword [rbp + 0x70], r15d
lea rax, [r8 + 4]
lea rcx, [rbp + 0x14]
cmp edx, dword [rax]
cmovl rcx, rax
mov r14d, dword [rcx]
mov dword [rbp + 0x74], r14d
lea rax, [r8 + 8]
lea rcx, [rbp + 0x18]
cmp dword [rax], r9d
cmovl rcx, rax
mov esi, dword [rcx]
mov dword [rbp + 0x78], esi
lea rax, [r8 + 0xc]
lea r9, [rbp + 0x1c]
cmp dword [rax], r10d
cmovl r9, rax
mov ebx, dword [r9]
mov dword [rbp + 0x7c], ebx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r12, rax
mov r9d, ebx
mov r8d, esi
mov edx, r14d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call fcn.14014e740
add r13, 0x10
lea rax, [r13 - 0xc]
cmp rax, qword [rbp + 0x130]
jne 0x1400570c0
mov r15, qword [rbp + 0xa0]
mov r12, qword [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.1400474e0
mov r13, qword [rbp + 0x80]
jmp 0x140057405
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov rdx, qword [rbp - 0x38]
mov r8, rdx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400575f3
mov rbx, qword [rdi + 0x10a80]
mov rcx, qword [rbx + 0xe458]
test rcx, rcx
je 0x14005743e
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rdi + 0x10a80]
xor r14b, r14b
mov rsi, rbx
cmp byte [rbx + 0x8d5], r14b
je 0x1400574c8
inc dword [rdi + 0x98]
cmp dword [rdi + 0x98], 0xa
jle 0x1400574c8
mov dword [rdi + 0x98], 0
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rdx, r15
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov r14b, 1
mov rsi, qword [rdi + 0x10a80]
mov rax, qword [rsi + 0x878]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x1400574e4
cmp qword [rsi + 0x870], rcx
jne 0x1400574ed
cmp qword [rsi + 0x870], rcx
je 0x140057501
lea rcx, [rsi + 0x7e8]
call fcn.140035f80
test eax, eax
je 0x1400575da
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0
mov r9b, 1
movzx r8d, r9b
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.140025d10
mov rbx, qword [rbp - 0x80]
cmp rbx, qword [rbp - 0x78]
jne 0x140057570
test rbx, rbx
je 0x1400575da
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14005756b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057bfb
mov rcx, rbx
jmp 0x1400575d5
mov byte [rsp + 0x20], r14b
mov r9, rbx
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x7e8]
call fcn.140036340
add rbx, 0x10
cmp rbx, qword [rbp - 0x78]
jne 0x140057570
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400575da
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400575d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057bfb
call fcn.140147b54
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400575f3
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rsi, qword [rdi + 0x10a98]
mov rax, qword [rsi + 0x130]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14005763d
nop dword [rax]
mov rax, qword [rsi]
movzx edx, word [rbx + 0x10]
mov rcx, rsi
call qword [rax + 0x90]
mov byte [rax + 0x3ac], 1
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsi + 0x130]
jne 0x140057610
mov rsi, qword [rdi + 0x10a98]
cmp byte [rdi + 0x10b69], 0
jne 0x140057675
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
call qword [rax + 0xf0]
mov byte [rdi + 0x10b69], 1
mov rcx, qword [rdi + 0x10a80]
mov eax, Ordinal_102
cmp dword [rcx], eax
mov esi, 1
cmove eax, esi
mov dword [rcx], eax
jmp 0x14005767a
mov esi, 1
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 0x38], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x30], rax
mov r9d, 5
mov r8, r12
mov rdx, r12
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x30]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x38]
call fcn.14014e740
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov qword [rbp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x40], rax
mov r9d, 5
mov r8, r13
mov rdx, r13
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x48]
call fcn.14014e740
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rbx, rax
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140057795
mov r9, qword [rbx]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [r9 + 0x18]
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400577b8
mov rax, qword [rbx]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rbp + 0x200]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400577dc
mov rax, qword [rbx]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x88]
call fcn.14014e740
nop
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x98]
call fcn.14014e740
nop
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0xa8]
call fcn.14014e740
nop
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a80]
cmp byte [rax + 0xe9e0], r12b
je 0x14005794e
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x1400578b2
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rbp + 0xf0], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
cmp byte [rax + 0x15], 0
jne 0x1400578e3
movzx ecx, byte [rax + 0x10]
test cl, cl
je 0x14005790b
cmp byte [rax + 0xd], 0
jne 0x1400578e3
cmp byte [rax + 0xb], 0
jne 0x1400578d2
cmp byte [rax + 0xc], 0
je 0x1400578d8
cmp byte [rax + 0xf], 0
je 0x1400578e3
cmp cl, 1
jne 0x14005790b
cmp byte [rax + 0xf], 0
jne 0x14005790b
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x14005794e
cmp qword [rcx + 0x20], 0
jne 0x14005790b
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
jmp 0x14005794e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov edx, eax
sub edx, dword [rdi + 0x10b6c]
cmp edx, 0x1f4
jbe 0x14005794e
mov rcx, qword [rdi + 0x10a80]
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov dword [rdi + 0x10b6c], ebx
mov r15d, dword [rsp + 0x34]
mov r14d, 0x421
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
cmp byte [rdi + 0x10a88], 0
je 0x14005797b
mov eax, dword [rsp + 0x50]
jmp 0x140056180
lea r13, vtable.rfb::ClippedUpdateTracker.0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov byte [rdi + 0x10a88], 0
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov byte [0x14021f658], 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400579c9
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r12
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x1400579e9
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140057a09
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe4cc], r12d
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rbx, qword [rdi + 0x10a80]
mov rax, qword [0x14022a710]
cmp dword [rax + 0x798], 0
je 0x140057a6e
cmp dword [rax + 0x79c], 0
jne 0x140057a6e
movzx r9d, byte [rbx + 0xe9e1]
mov r8b, 1
xor edx, edx
call fcn.140023b10
mov byte [rbx + 0xe9e1], al
mov byte [rbx + 0xeab0], 0
mov byte [rbx + 0xeab3], 0
mov r8d, esi
mov rcx, qword [rbx + 0xe450]
call fcn.140088fa0
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:SetBlockInputState_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov cl, 0xa0
call fcn.140077530
mov cl, 0xa2
call fcn.140077530
mov cl, 0xa4
call fcn.140077530
mov cl, 0xa1
call fcn.140077530
mov cl, 0xa3
call fcn.140077530
mov cl, 0xa5
call fcn.140077530
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:ClearShiftKeys_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor edx, edx
lea rcx, str.blackscreen
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140057b10
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov byte [0x14021f65b], 0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:g_DesktopThread_runningfalse_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rdi + 0x10a80]
call fcn.14004e160
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:m_desktop__Shutdown_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x48]
call fcn.14014e740
nop
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 8]
call fcn.14014e740
lea rax, vtable.rfb::UpdateTracker.0
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x60], r14
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x30]
call fcn.14014e740
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x40]
call fcn.14014e740
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x50]
call fcn.14014e740
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14014e6c8
nop
int3