Function at 0x1400539d0
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check os version
Create thread
Power down monitor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov rax, qword [0x1401fef68]
mov ecx, dword [rax + 0xe60]
cmp ecx, 1
jne 0x140053af9
mov rax, qword [0x1401fc428]
test rax, rax
jne 0x140053a4a
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x140053aef
test rax, rax
jne 0x140053a7e
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
jmp 0x140053a81
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x140053aef
test rcx, rcx
jne 0x140053ab0
mov ecx, gethostbyname
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
jmp 0x140053ab3
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x140053aef
test rcx, rcx
jne 0x140053adf
mov ecx, gethostbyname
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
mov rcx, rax
mov qword [0x1401fc428], rax
cmp byte [rcx + 8], 0
jne 0x140053aef
mov al, 1
mov byte [0x1401f3900], al
jmp 0x140053b03
xor al, al
mov byte [0x1401f3900], al
jmp 0x140053b03
cmp ecx, 2
sete byte [0x1401f3900]
mov byte [rdi + 0x10b78], 1
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_1_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xeac8], rax
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_2_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov dword [rbp + 0x110], __WSAFDIsSet
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140053c2e
lea r8, str.vncDesktop::KillScreenSaver_:_KillScreenSaver..._n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov eax, dword [rbp + 0x120]
sub eax, 1
je 0x140053c07
cmp eax, 1
jne 0x140053c2e
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
lea rcx, str.Screen_saver
call qword [sym.imp.USER32.dll_OpenDesktopA]
mov rbx, rax
test rax, rax
je 0x140053c2e
lea r8, str.vncDesktop::KillScreenSaver_:_Killing_ScreenSaver_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor r8d, r8d
lea rdx, [0x14004c9f0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 - 1]
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x140053c2e
xor edx, edx
lea rcx, str.WindowsScreenSaverClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140053c2e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
xor r8d, r8d
xor edx, edx
mov cl, select
call fcn.14002f620
xor edx, edx
lea r8d, [rdx + 2]
mov cl, select
call fcn.14002f620
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x10a90]
call fcn.14004c1c0
mov ebx, eax
test eax, eax
je 0x140053ca0
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xeac8]
call fcn.140020b50
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xeac0]
test rcx, rcx
je 0x140053c90
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x20]
jmp 0x140055f39
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x20]
mov rax, qword [0x1401fef68]
mov r8d, dword [rax + 0xe50]
mov edx, dword [rax + 0xe54]
mov rcx, qword [rdi + 0x10a90]
call fcn.14004f3e0
mov byte [rdi + 0x10b79], 0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov qword [rbp - 0x60], r14
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp - 0x50], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x58], rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp - 0x40], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x48], rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp - 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x38], rax
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x20], r12b
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
lea r13, vtable.rfb::ClippedUpdateTracker.0
mov qword [rbp - 0x10], r13
lea rax, [rbp - 0x60]
mov qword [rbp - 8], rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp], rax
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov byte [rbp - 0x20], 1
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rsp + 0x40], rax
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rdi + 0x10a90]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xe8]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbp + 0xc8]
mov qword [rdi + 0x10a9c], rax
mov rdx, qword [rdi + 0x10a90]
mov rax, qword [rdx + 0xe458]
test rax, rax
je 0x140053f3e
cmp qword [rax + 0x20], r12
je 0x140053f2a
cmp dword [rdx + 0x8d0], r12d
je 0x140053f3e
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xe0]
mov rax, qword [rdi + 0x10a90]
mov qword [rax + 0x808], 4
jmp 0x140053f3e
mov dword [rdx + 0xe9ec], 1
mov dword [rdx + 0xe9f0], 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f0], 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe978], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9ec], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f4], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f8], r12d
mov ebx, r12d
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
jne 0x140053fdb
nop
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jg 0x140053fdb
lea r8, str.vncDesktopThread::run_undetached_:_Wait_for_viewer_init__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
je 0x140053fa0
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10b00], dl
test eax, eax
jne 0x140054021
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054021
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx edx, byte [rdi + 0x10b00]
test dl, dl
je 0x140054059
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054049
mov rax, qword [rcx]
call qword [rax + 0x20]
movzx edx, byte [rdi + 0x10b00]
test dl, dl
je 0x140054059
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b08], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b0c], eax
mov r15d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
mov byte [0x1401f3eb8], r15b
mov byte [rdi + 0x10a98], 1
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
cmp byte [0x1401f3eba], r12b
jne 0x140054275
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400541f1
cmp qword [rcx + 0x20], r15
je 0x1400541d7
cmp dword [rax + 0x8d0], r12d
je 0x1400541f1
mov rax, qword [0x1401fc428]
test rax, rax
jne 0x140054178
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x1400541f8
test rax, rax
jne 0x1400541a9
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
mov esi, 1
cmp byte [rcx + 8], 0
jne 0x1400541fd
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
mov r9d, esi
mov r8d, esi
lea rdx, [rsp + 0x40]
call fcn.140035900
jmp 0x14005427a
mov esi, 1
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fc428]
jmp 0x1400541fd
mov rax, qword [0x1401fc428]
mov esi, 1
test rax, rax
jne 0x14005421f
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x14005427a
test rax, rax
jne 0x14005424c
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
jmp 0x14005424f
mov rax, rcx
cmp byte [rax + 8], 0
jne 0x14005427a
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
mov r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140035900
jmp 0x14005427a
mov esi, 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe4cc], esi
mov qword [rbp + 0x28], r12
mov qword [rbp - 0x68], r12
mov rax, qword [0x1401fef68]
cmp dword [rax + 0xa58], 0
mov ecx, 0x80000043
jne 0x1400542a9
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400543ae
cmp qword [rcx + 0x20], 0
je 0x1400543a2
cmp dword [rax + 0x8d0], 0
je 0x1400543ae
mov rax, qword [0x1401fc428]
test rax, rax
jne 0x140054307
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x1400543b5
test rax, rax
jne 0x14005433c
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
cmp byte [rcx + 8], 0
jne 0x1400543b5
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400538e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0xb4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
jmp 0x1400544d4
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fc428]
mov rcx, qword [rdi + 0x10a90]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140054620
cmp qword [rdx + 0x20], 0
je 0x140054614
cmp dword [rcx + 0x8d0], 0
je 0x140054620
test rax, rax
jne 0x140054406
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x140054440
test rax, rax
jne 0x140054433
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
jmp 0x140054436
mov rax, rcx
cmp byte [rax + 8], 0
je 0x140054620
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xe3e8], rax
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xe3f0], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
cmp byte [rdi + 0x10b00], 0
je 0x1400544d4
mov rax, qword [rdi + 0x10a90]
cmp qword [rax + 0xe458], 0
je 0x1400544d0
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, dword [rsp + 0x50]
cmp byte [rdi + 0x10a98], 0
je 0x140055cf9
mov r14d, 0x421
nop word [rax + rax]
cmp byte [0x1401f42c3], 0
jne 0x140055ceb
mov rdx, qword [rdi + 0x10a90]
add rdx, 0xe3b8
mov r9d, eax
xor r8d, r8d
lea ecx, [r8 + 8]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, qword [rdi + 0x10a90]
mov edx, 0x2710
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140054544
mov byte [rdi + 0x10a98], 0
cmp ebx, 5
ja 0x140054708
je 0x1400546e8
test ebx, ebx
je 0x1400547b7
sub ebx, 1
je 0x140054670
sub ebx, 1
je 0x140054657
sub ebx, 1
je 0x140054747
cmp ebx, 1
jne 0x140055cd4
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], bl
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 0
jmp 0x140055cd4
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
lea rax, [rbp + 0xbc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x21
mov dword [rsp + 0x50], eax
jmp 0x1400544d4
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055cd4
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 1
mov r8, qword [rdi + 0x10a90]
mov r9d, 2
mov r8, qword [r8 + 0xe418]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, qword [rdi + 0x10a90]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xe418]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 0
jmp 0x140055cd4
mov byte [rdi + 0x10a98], 0
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055cd4
cmp ebx, 6
je 0x14005478b
cmp ebx, 7
je 0x140054733
cmp ebx, 0x102
je 0x1400547b7
cmp ebx, 0xffffffff
jne 0x140055cd4
mov byte [rdi + 0x10a98], 0
jmp 0x140055cd4
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10af8]
test rax, rax
je 0x140054772
mov dword [rbp - 0x80], 0x18
lea rcx, [rbp - 0x80]
call rax
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rbp - 0x78]
mov qword [rcx + 0xe960], rax
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055cd4
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r8, str.ddengine
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x1401f42c8]
call fcn.14014b110
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401fef68]
cmp dword [rax + 0xe48], 0x64
je 0x14005484b
cmp r15d, 0xa
ja 0x140054855
bt r14d, r15d
jae 0x140054855
lea rcx, [rdi + 0x10b18]
call fcn.140018220
mov word [rdi + 0x10b68], ax
mov r8d, dword [rdi + 0x10b6c]
movsx ecx, ax
mov rax, qword [0x1401fef68]
cmp ecx, dword [rax + 0xe48]
lea eax, [r8 + 0xa]
jg 0x14005481b
lea eax, [r8 - 0xa]
lea r8, [rdi + 0x10b6c]
mov ecx, eax
mov dword [r8], eax
mov ecx, dword [rdi + 0x10b74]
cmp eax, ecx
jae 0x140054839
mov dword [rdi + 0x10b6c], ecx
mov eax, ecx
mov ecx, dword [rdi + 0x10b70]
cmp eax, ecx
jbe 0x140054855
mov dword [rdi + 0x10b6c], ecx
jmp 0x140054855
mov dword [rdi + 0x10b6c], 0x19
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b04], eax
mov ecx, dword [rdi + 0x10b08]
mov r8d, dword [rdi + 0x10b6c]
mov edx, eax
sub edx, ecx
cmp edx, r8d
jae 0x140054882
sub ecx, eax
add ecx, r8d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400548c5
cmp qword [rcx + 0x20], 0
je 0x1400548b9
cmp dword [rax + 0x8d0], 0
je 0x1400548c5
mov rax, qword [rdi]
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x1400548c5
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [rdi + 0x10a90]
cmp dword [rax + 0xe9f0], 0
je 0x14005493b
cmp dword [rax + 0xe9ec], 0
jne 0x14005493b
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10a90]
movsxd r8, dword [rcx + 0xe9e8]
xor r9d, r9d
mov edx, 0x8007
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [rdi + 0x10a90]
cmp dword [rax + 0xe9e8], 0
je 0x140054934
mov qword [rax + 0xe968], r12
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f0], r12d
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x250]
test al, al
jne 0x14005497d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400526a0
test al, al
jne 0x14005497d
mov byte [rdi + 0x10a98], al
jmp 0x140055cd4
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x238]
mov rcx, qword [rdi + 0x10a90]
mov byte [rcx + 0x8d4], al
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x240]
mov rcx, qword [rdi + 0x10a90]
mov byte [rcx + 0x8d5], al
mov rax, qword [rdi + 0x10a90]
add rax, 0xe4e8
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x113
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
jne 0x140054a19
cmp byte [rdi + 0x10b79], al
jne 0x140055cc9
mov eax, dword [rdi + 0x10b04]
mov dword [rdi + 0x10b08], eax
xor r14b, r14b
mov byte [rsp + 0x30], r14b
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140054aac
mov rax, qword [rbp + 0x50]
cmp eax, dword [rdi + 0x10a9c]
jne 0x140054a52
mov ecx, dword [rdi + 0x10aa0]
cmp dword [rbp + 0x54], ecx
je 0x140054aac
mov r14b, 1
mov byte [rsp + 0x30], r14b
mov qword [rdi + 0x10a9c], rax
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rax, qword [rdi + 0x10af8]
test rax, rax
je 0x140054aac
mov dword [rbp + 0xf8], 0x18
lea rcx, [rbp + 0xf8]
call rax
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rbp + 0x100]
mov qword [rcx + 0xe960], rax
xor r13b, r13b
mov r8, qword [rdi + 0x10a90]
cmp dword [r8 + 0x8d0], 0
jne 0x140054ae1
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.14004e940
movzx r13d, al
mov r8, qword [rdi + 0x10a90]
cmp dword [r8 + 0x8d0], 0
je 0x140054b47
cmp byte [r8 + 0xea78], 0
je 0x140054b47
cmp dword [r8 + 0xea68], 0
jne 0x140054b47
mov rax, qword [0x1401fef68]
test r14b, r14b
je 0x140054b20
mov ecx, r12d
cmp dword [rax + 0xe30], 0
setne cl
inc ecx
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140054b79
mov ecx, 2
cmp dword [rax + 0xe30], 0
mov eax, 4
cmovne ecx, eax
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140054c9a
test r13b, r13b
jne 0x140054b70
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400534e0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
test r14b, r14b
je 0x140054c9a
mov rcx, qword [rdi + 0x10a90]
cmp dword [rcx + 0x8d0], 0
jne 0x140054c9a
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x140054c9a
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x140054c9a
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140054bf8
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140054c06
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x140054c1b
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x140054c2f
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x140054c97
test edx, edx
jle 0x140054c97
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140138b40
movzx r14d, byte [rsp + 0x30]
mov esi, 1
xor r12d, r12d
mov rax, qword [rdi + 0x10a90]
add rax, 0xe4e8
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], 0x114
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x1401fef68]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b68]
cmp ecx, eax
jge 0x140054d04
mov rcx, qword [rdi + 0x10a90]
cmp dword [rcx + 0x8d0], 0
jne 0x140054d04
test r13b, r13b
jne 0x140054d04
lea rdx, [rbp - 0x10]
call fcn.14004e940
movzx eax, byte [0x1401f3eba]
test al, al
je 0x140054d58
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x248]
test al, al
je 0x140054d4d
mov rcx, qword [rdi + 0x10a90]
mov r8d, dword [rcx + 0x838]
mov rdx, qword [rcx + 0x870]
mov rcx, qword [rcx + 0x878]
call fcn.14004d750
jmp 0x140054db3
movzx eax, byte [0x1401f3eba]
test al, al
jne 0x140054db3
mov rcx, qword [rdi + 0x10a90]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140054d93
cmp qword [rdx + 0x20], 0
je 0x140054d80
cmp dword [rcx + 0x8d0], 0
je 0x140054d93
mov r8d, esi
jmp 0x140054d9a
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
mov rcx, qword [rdi + 0x10a90]
test al, al
jne 0x140054db3
xor r8d, r8d
movzx r9d, byte [rdi + 0x10b78]
lea rdx, [rsp + 0x40]
add rcx, 0x7e8
call fcn.140035900
mov byte [rdi + 0x10b78], 1
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov ecx, r12d
cmp byte [rdi + 0x10b00], 0
sete cl
cmp ecx, eax
jne 0x140054e26
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10b00], dl
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054e26
mov rax, qword [rcx]
test dl, dl
jne 0x140054e23
call qword [rax + 0x18]
jmp 0x140054e26
call qword [rax + 0x20]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov rcx, qword [rdi + 0x10a90]
test eax, eax
je 0x140055035
mov rax, qword [rcx + 0xe968]
cmp qword [rcx + 0xe960], rax
jne 0x140054e71
mov eax, dword [rcx + 0x880]
mov dword [rcx + 0x880], r12d
test eax, eax
je 0x1400551da
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rcx + 0xe960]
mov qword [rcx + 0xe968], rax
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0x810], esi
mov rsi, qword [rdi + 0x10a90]
cmp dword [rsi + 0x8d0], 0
je 0x140054eac
cmp byte [rsi + 0xea78], 0
jne 0x140054f15
add rsi, 0x7e8
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x140054ecf
cmp qword [rsi + 0x88], rcx
jne 0x140054ed8
cmp qword [rsi + 0x88], rcx
je 0x140054ee4
mov rcx, rsi
call fcn.140034d30
test eax, eax
je 0x140054f15
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004e370
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140035e90
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a90]
mov r11d, dword [rcx + 0xe42c]
mov r8d, dword [rcx + 0xe434]
sub r8d, r11d
mov r15d, dword [rcx + 0xe430]
mov edx, dword [rcx + 0xe438]
sub edx, r15d
mov r10d, dword [rcx + 0xe514]
mov esi, dword [rcx + 0xe51c]
add esi, r10d
mov r9d, dword [rcx + 0xe510]
mov ebx, dword [rcx + 0xe518]
add ebx, r9d
cmp r11d, r9d
jge 0x140054f82
mov eax, r11d
sub eax, r9d
add r8d, eax
mov r12d, r9d
cmp r11d, r9d
cmovge r12d, r11d
cmp r15d, r10d
jge 0x140054f9a
sub r15d, r10d
add edx, r15d
mov r15d, r10d
lea ecx, [rbx + r9]
lea eax, [r8 + r12]
cmp eax, ecx
jle 0x140054faf
mov r8d, ebx
sub r8d, r12d
add r8d, r9d
lea ecx, [rdx + r15]
lea eax, [r10 + rsi]
cmp ecx, eax
jle 0x140054fc3
mov edx, r10d
sub edx, r15d
add edx, esi
test r8d, r8d
jle 0x140055020
test edx, edx
jle 0x140055020
lea esi, [r8 + r12]
lea ebx, [rdx + r15]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140138b40
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
jmp 0x1400551da
cmp dword [rcx + 0x8d0], 0
je 0x14005504b
cmp byte [rcx + 0xea78], 0
jne 0x1400551da
lea rsi, [rcx + 0x7e8]
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x14005506e
cmp qword [rsi + 0x88], rcx
jne 0x140055077
cmp qword [rsi + 0x88], rcx
je 0x140055083
mov rcx, rsi
call fcn.140034d30
test eax, eax
je 0x1400550b4
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004e370
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140035e90
test r14b, r14b
je 0x1400551da
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a90]
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x1400551da
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x1400551da
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140055146
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140055154
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x140055169
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x14005517d
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x1400551da
test edx, edx
jle 0x1400551da
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140138b40
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r15, rax
mov qword [rbp + 0xa0], rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 0x98], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r12, rax
mov qword [rbp + 0x90], rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 0x88], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r13, rax
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
xor r14d, r14d
cmp eax, 1
je 0x140055308
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140026b20
mov rbx, qword [rbp + 0x128]
cmp rbx, qword [rbp + 0x130]
je 0x1400552fc
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
lea r8, [rbp + 0x140]
mov rdx, rbx
call fcn.140036740
add rbx, 0x10
cmp rbx, qword [rbp + 0x130]
jne 0x1400552d2
lea rcx, [rbp + 0x110]
call fcn.140045d20
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 4
mov r8, qword [rbp - 0x38]
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055745
mov rax, qword [0x1401fef68]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b68]
cmp ecx, eax
jge 0x140055745
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140026b20
mov r13, qword [rbp + 0x128]
cmp r13, qword [rbp + 0x130]
je 0x140055730
add r13, 0xc
nop
mov r12d, dword [r13 - 4]
add r12d, 4
mov dword [rsp + 0x68], r12d
mov r8d, dword [r13]
add r8d, 4
mov dword [rsp + 0x6c], r8d
mov ecx, dword [r13 - 0xc]
add ecx, 0xfffffffc
mov dword [rsp + 0x60], ecx
mov r9d, dword [r13 - 8]
add r9d, 0xfffffffc
mov dword [rsp + 0x64], r9d
mov rdx, qword [rdi + 0x10a90]
cmp qword [rdx + 0xe458], 0
je 0x1400554d8
add rdx, 0x8d8
lea rax, [rsp + 0x60]
cmp ecx, dword [rdx]
cmovl rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x60], eax
lea rax, [rdx + 4]
lea rcx, [rsp + 0x64]
cmp r9d, dword [rax]
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x64], eax
lea rax, [rdx + 8]
lea rcx, [rsp + 0x68]
cmp dword [rax], r12d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x68], eax
lea rax, [rdx + 0xc]
lea rcx, [rsp + 0x6c]
cmp dword [rax], r8d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x6c], eax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r12d, dword [rsp + 0x68]
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov r15, rax
mov r9d, dword [rsp + 0x6c]
mov r8d, r12d
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call fcn.140138b40
mov ecx, dword [rbp + 0x144]
neg ecx
mov eax, dword [rbp + 0x140]
neg eax
mov r10d, dword [rsp + 0x6c]
add r10d, ecx
lea r9d, [rax + r12]
mov dword [rbp + 0x20], r9d
mov dword [rbp + 0x24], r10d
mov edx, dword [rsp + 0x64]
add edx, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x14], edx
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x18], rax
mov r8, qword [rdi + 0x10a90]
add r8, 0x8d8
lea rax, [rbp + 0x10]
cmp ecx, dword [r8]
cmovl rax, r8
mov r15d, dword [rax]
mov dword [rbp + 0x70], r15d
lea rax, [r8 + 4]
lea rcx, [rbp + 0x14]
cmp edx, dword [rax]
cmovl rcx, rax
mov r14d, dword [rcx]
mov dword [rbp + 0x74], r14d
lea rax, [r8 + 8]
lea rcx, [rbp + 0x18]
cmp dword [rax], r9d
cmovl rcx, rax
mov esi, dword [rcx]
mov dword [rbp + 0x78], esi
lea rax, [r8 + 0xc]
lea r9, [rbp + 0x1c]
cmp dword [rax], r10d
cmovl r9, rax
mov ebx, dword [r9]
mov dword [rbp + 0x7c], ebx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov r12, rax
mov r9d, ebx
mov r8d, esi
mov edx, r14d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call fcn.140138b40
add r13, 0x10
lea rax, [r13 - 0xc]
cmp rax, qword [rbp + 0x130]
jne 0x140055430
mov r15, qword [rbp + 0xa0]
mov r12, qword [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.140045d20
mov r13, qword [rbp + 0x80]
jmp 0x140055775
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov rdx, qword [rbp - 0x38]
mov r8, rdx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055963
mov rbx, qword [rdi + 0x10a90]
mov rcx, qword [rbx + 0xe458]
test rcx, rcx
je 0x1400557ae
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rdi + 0x10a90]
xor r14b, r14b
mov rsi, rbx
cmp byte [rbx + 0x8d5], r14b
je 0x140055838
inc dword [rdi + 0xa8]
cmp dword [rdi + 0xa8], 0xa
jle 0x140055838
mov dword [rdi + 0xa8], 0
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rdx, r15
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140138b40
mov r14b, 1
mov rsi, qword [rdi + 0x10a90]
mov rax, qword [rsi + 0x878]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x140055854
cmp qword [rsi + 0x870], rcx
jne 0x14005585d
cmp qword [rsi + 0x870], rcx
je 0x140055871
lea rcx, [rsi + 0x7e8]
call fcn.140034d30
test eax, eax
je 0x14005594a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0
mov r9b, 1
movzx r8d, r9b
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.140025570
mov rbx, qword [rbp - 0x80]
cmp rbx, qword [rbp - 0x78]
jne 0x1400558e0
test rbx, rbx
je 0x14005594a
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400558db
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055f6b
mov rcx, rbx
jmp 0x140055945
mov byte [rsp + 0x20], r14b
mov r9, rbx
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x7e8]
call fcn.1400350f0
add rbx, 0x10
cmp rbx, qword [rbp - 0x78]
jne 0x1400558e0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14005594a
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055f6b
call fcn.140131f54
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055963
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rsi, qword [rdi + 0x10aa8]
mov rax, qword [rsi + 0x130]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400559ad
nop dword [rax]
mov rax, qword [rsi]
movzx edx, word [rbx + 0x10]
mov rcx, rsi
call qword [rax + 0x90]
mov byte [rax + 0x3ac], 1
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsi + 0x130]
jne 0x140055980
mov rsi, qword [rdi + 0x10aa8]
cmp byte [rdi + 0x10b79], 0
jne 0x1400559e5
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
call qword [rax + 0xf0]
mov byte [rdi + 0x10b79], 1
mov rcx, qword [rdi + 0x10a90]
mov eax, Ordinal_102
cmp dword [rcx], eax
mov esi, 1
cmove eax, esi
mov dword [rcx], eax
jmp 0x1400559ea
mov esi, 1
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 0x38], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x30], rax
mov r9d, 5
mov r8, r12
mov rdx, r12
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x30]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x38]
call fcn.140138b40
lea rcx, [0x14019626c]
call fcn.14014a9a0
mov qword [rbp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x40], rax
mov r9d, 5
mov r8, r13
mov rdx, r13
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x48]
call fcn.140138b40
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rbx, rax
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055b05
mov r9, qword [rbx]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [r9 + 0x18]
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055b28
mov rax, qword [rbx]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rbp + 0x200]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055b4c
mov rax, qword [rbx]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x88]
call fcn.140138b40
nop
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x98]
call fcn.140138b40
nop
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0xa8]
call fcn.140138b40
nop
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a90]
cmp byte [rax + 0xe9e0], r12b
je 0x140055cbe
mov rax, qword [0x1401fc428]
test rax, rax
jne 0x140055c22
lea ecx, [rax + 0x30]
call fcn.140131f18
mov qword [rbp + 0xf0], rax
mov rcx, rax
call fcn.14007c180
nop
mov qword [0x1401fc428], rax
cmp byte [rax + 0x15], 0
jne 0x140055c53
movzx ecx, byte [rax + 0x10]
test cl, cl
je 0x140055c7b
cmp byte [rax + 0xd], 0
jne 0x140055c53
cmp byte [rax + 0xb], 0
jne 0x140055c42
cmp byte [rax + 0xc], 0
je 0x140055c48
cmp byte [rax + 0xf], 0
je 0x140055c53
cmp cl, 1
jne 0x140055c7b
cmp byte [rax + 0xf], 0
jne 0x140055c7b
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055cbe
cmp qword [rcx + 0x20], 0
jne 0x140055c7b
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
jmp 0x140055cbe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov edx, eax
sub edx, dword [rdi + 0x10b7c]
cmp edx, 0x1f4
jbe 0x140055cbe
mov rcx, qword [rdi + 0x10a90]
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov dword [rdi + 0x10b7c], ebx
mov r15d, dword [rsp + 0x34]
mov r14d, 0x421
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
cmp byte [rdi + 0x10a98], 0
je 0x140055ceb
mov eax, dword [rsp + 0x50]
jmp 0x1400544f0
lea r13, vtable.rfb::ClippedUpdateTracker.0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov byte [rdi + 0x10a98], 0
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov byte [0x1401f3eb8], 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140055d39
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r12
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140055d59
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140055d79
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe4cc], r12d
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rbx, qword [rdi + 0x10a90]
mov rax, qword [0x1401fef68]
cmp dword [rax + 0x798], 0
je 0x140055dde
cmp dword [rax + 0x79c], 0
jne 0x140055dde
movzx r9d, byte [rbx + 0xe9e1]
mov r8b, 1
xor edx, edx
call fcn.140023370
mov byte [rbx + 0xe9e1], al
mov byte [rbx + 0xeab0], 0
mov byte [rbx + 0xeaba], 0
mov r8d, esi
mov rcx, qword [rbx + 0xe450]
call fcn.140085d40
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:SetBlockInputState_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov cl, 0xa0
call fcn.1400758d0
mov cl, 0xa2
call fcn.1400758d0
mov cl, 0xa4
call fcn.1400758d0
mov cl, 0xa1
call fcn.1400758d0
mov cl, 0xa3
call fcn.1400758d0
mov cl, 0xa5
call fcn.1400758d0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:ClearShiftKeys_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor edx, edx
lea rcx, str.blackscreen
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e80
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov byte [0x1401f3ebb], 0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:g_DesktopThread_runningfalse_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10a90]
call fcn.14004c720
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:m_desktop__Shutdown_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x48]
call fcn.140138b40
nop
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 8]
call fcn.140138b40
lea rax, vtable.rfb::UpdateTracker.0
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x60], r14
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x30]
call fcn.140138b40
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x40]
call fcn.140138b40
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x50]
call fcn.140138b40
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140138ac8
nop
int3