Function at 0x4170e0
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49a7aa
mov eax, dword fs:[0]
push eax
sub esp, 0xa78
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0xa70], eax
push ebx
push esi
push edi
mov eax, dword [0x4ba700]
xor eax, esp
push eax
lea eax, [esp + 0xa88]
mov dword fs:[0], eax
mov ebx, ecx
push 0x8001
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebx + 0x6c]
mov edx, dword [esi]
mov eax, dword [edx + 0x40]
mov ecx, esi
call eax
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [edx + 0x3c]
push ecx
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_connected_:__s___hd__n
mov ecx, 1
mov eax, 0x4bc990
call fcn.00401110
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, dword [ebx + 0x64]
push 0x7530
mov dword [esp + 0x60], eax
mov dword [esp + 0x9c], 0
call fcn.004537b0
test eax, eax
jne 0x4171aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncclient.cpp_:_failed_to_set_socket_timeout__d__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x23c]
call eax
test eax, eax
je 0x41a8af
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x23c]
call eax
mov edi, dword [ebx + 0x64]
mov ecx, dword [edi + 0xc]
xor esi, esi
mov dword [edi + 8], eax
cmp ecx, esi
je 0x4171e6
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [edi + 0xc], esi
mov eax, dword [edi + 8]
cmp eax, esi
je 0x417208
cmp dword [eax + 0x2f0], esi
je 0x417208
mov eax, dword [eax + 0x2f0]
cmp eax, esi
je 0x417203
call eax
jmp 0x417205
xor eax, eax
mov dword [edi + 0xc], eax
push str.._vncclient.cpp_:_DSMPlugin_Pointer_to_socket_OK_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [ebx + 0x68]
mov edi, dword [ecx]
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
add esp, 4
add edi, 0x198
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [edi]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x23c]
call edx
cmp byte [eax + 0x21], 0
je 0x4172b6
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x23c]
call edx
cmp dword [eax + 0x2f0], esi
jne 0x417281
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
test eax, eax
jbe 0x417281
push str.._vncclient.cpp_:_A_connection_using_DSM_already_exist___client_rejected_to_avoid_crash__n
mov ecx, 1
jmp 0x41a8b9
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
test eax, eax
jne 0x4172a4
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x23c]
call edx
mov eax, dword [eax + 0x2ec]
call eax
mov eax, dword [ebx + 0x64]
mov byte [eax + 0x10], 1
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x6c], esi
jmp 0x4172c3
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x6c], 1
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
mov ecx, ebx
call eax
test eax, eax
jne 0x41740c
mov ecx, dword [ebx + 0x6c]
mov edi, dword [ecx + 0xf8]
cmp edi, esi
je 0x4172f9
mov eax, edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4172e6
sub eax, esi
je 0x4172f9
push edi
push str.Could_not_connect_using__s_
jmp 0x417306
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
call eax
push eax
push str.Could_not_connect_to__s_
lea ecx, [esp + 0x23c]
push 0xff
push ecx
call fcn.0047cd5d
add esp, 0x10
lea eax, [esp + 0x234]
mov byte [esp + 0x333], 0
call fcn.00440850
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
mov edi, dword [edx]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
add edi, 0x64
call edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [edi]
movzx eax, ax
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x264]
call edx
test eax, eax
je 0x41a8c6
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x28]
lea ecx, [eax + eax*4]
add ecx, ecx
xor edi, edi
test ecx, ecx
jle 0x417396
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
cmp byte [ebx + 0x60], 0
jne 0x41a8c6
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x28]
lea eax, [eax + eax*4]
inc edi
add eax, eax
cmp edi, eax
jl 0x417378
mov eax, dword [ebx + 0x68]
add dword [eax + 0x28], 0xa
mov ebx, dword [ebx + 0x68]
mov eax, 0x708
cmp dword [ebx + 0x28], eax
jle 0x4173ad
mov dword [ebx + 0x28], eax
push str.._vncclient.cpp_:_PostAddNewClient_I_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov edi, dword [0x4f3864]
add esp, 4
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4173ef
push 0x457
push 0x457
push edi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41a8c6
push str.._vncservice.cpp_:_PostAddNewClient_failed_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov byte [0x4f378c], 1
jmp 0x41a8c3
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x28], esi
push str.._vncclient.cpp_:_negotiated_version_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov edx, dword [ebx]
mov eax, dword [edx + 0x14]
add esp, 4
mov ecx, ebx
call eax
test eax, eax
jne 0x417458
mov ecx, dword [ebx + 0x68]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x64
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x68]
call edx
jmp 0x41a8c6
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
add esi, 0x19c
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
imul eax, eax, 0x3e8
mov edi, dword [ebx + 0x64]
push eax
call fcn.004537b0
push str.._vncclient.cpp_:_authenticated_connection_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [ebx + 0x6c]
mov esi, dword [eax]
add esp, 4
add esi, 0x70
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebx + 0x6c]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x84], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa90], 0
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1e8]
call edx
mov ecx, dword [ebx + 0x6c]
mov esi, dword [ecx + 0xc8]
call fcn.00411a30
push edi
mov dword [esp + 0xa94], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0xc8]
lea edi, [esp + 0x120]
call fcn.00411ab0
mov edx, dword [eax]
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x47c], edx
mov edx, dword [eax + 4]
add ecx, 0x47c
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov ecx, dword [ecx + 0x18]
push 0x110
lea edx, [esp + 0x340]
push 0
mov dword [eax + 0x48c], ecx
push edx
mov dword [esp + 0x88], 0x110
call fcn.004858b0
add esp, 0xc
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4175fb
lea eax, [esp + 0x33c]
xor esi, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4175a0
sub eax, edx
je 0x4175e0
jmp 0x4175b0
movsx edx, byte [esp + esi + 0x33c]
push edx
call fcn.0047e4d6
mov byte [esp + esi + 0x340], al
lea eax, [esp + 0x340]
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4175d3
sub eax, edx
cmp esi, eax
jb 0x4175b0
lea eax, [esp + 0x33c]
push 0x2e
push eax
call fcn.0047e3aa
add esp, 8
test eax, eax
je 0x417623
jmp 0x4176cc
mov ecx, dword [0x4ab7e8]
mov dx, word [0x4ab7ec]
mov al, byte [0x4ab7ee]
mov dword [esp + 0x33c], ecx
mov word [esp + 0x340], dx
mov byte [esp + 0x342], al
lea edi, [esp + 0x234]
call fcn.00416f60
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417634
sub eax, edx
cmp eax, 3
jbe 0x4176cc
mov al, byte [esp + 0x234]
cmp al, 0x49
je 0x4176cc
cmp al, 0x48
je 0x4176cc
lea edi, [esp + 0x33c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417660
mov ecx, dword [0x4ab7f0]
lea eax, [esp + 0x234]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417680
lea edi, [esp + 0x33c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x417691
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x33c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4176b1
mov dx, word [0x4ab7f4]
mov cl, byte [0x4ab7f6]
mov word [eax], dx
mov byte [eax + 2], cl
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ecx + 0x30]
mov dword [esp + 0xb4], edx
mov edx, dword [ecx + 0x34]
mov dword [esp + 0xb8], edx
mov edx, dword [ecx + 0x38]
mov dword [esp + 0xbc], edx
mov ecx, dword [ecx + 0x3c]
mov dword [esp + 0xc0], ecx
movzx ecx, word [eax + 0x484]
sub cx, word [eax + 0x47c]
mov edx, dword [eax + 0x484]
sub edx, dword [eax + 0x47c]
mov esi, 0x100
imul cx, si
sar edx, 8
and edx, 0xff
xor dx, cx
mov word [esp + 0xb0], dx
movzx ecx, word [eax + 0x488]
sub cx, word [eax + 0x480]
mov edx, dword [eax + 0x488]
sub edx, dword [eax + 0x480]
mov eax, esi
imul cx, ax
mov ax, word [esp + 0xbc]
sar edx, 8
and edx, 0xff
xor dx, cx
movzx ecx, word [esp + 0xb8]
mov word [esp + 0xb2], dx
mov dx, word [esp + 0xba]
rol cx, 8
rol dx, 8
rol ax, 8
mov word [esp + 0xbc], ax
lea eax, [esp + 0x33c]
mov word [esp + 0xba], dx
mov word [esp + 0xb8], cx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4177b0
sub eax, edx
lea esi, [esp + 0x33c]
mov ecx, eax
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4177c5
lea eax, [esp + 0x33c]
sub esi, edx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4177d8
sub eax, edi
mov edi, eax
lea eax, [esp + 0x33c]
lea edx, [eax + 1]
mov dword [esp + 0x50], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4177f1
sub eax, dword [esp + 0x50]
shr ecx, 0x10
shl eax, 0x10
and edi, 0xff00
or eax, edi
mov edi, dword [ebx + 0x64]
and esi, 0xff0000
or esi, ecx
shl eax, 8
shr esi, 8
or eax, esi
mov dword [esp + 0xc4], eax
mov ecx, 0x18
lea eax, [esp + 0xb0]
call fcn.00453a00
test eax, eax
jne 0x41785b
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x64
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x68]
call edx
jmp 0x41a8c6
lea eax, [esp + 0x33c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417865
mov edi, dword [ebx + 0x64]
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x33c]
call fcn.00453a00
test eax, eax
je 0x417839
push str.._vncclient.cpp_:_sent_pixel_format_to_client_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [ebx + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
add esp, 4
call edx
mov ecx, dword [ebx + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa90], 1
mov esi, dword [ebx + 0x6c]
add esi, 0x47c
lea edi, [esp + 0x54]
call fcn.00409590
mov byte [esp + 0xa90], 2
mov eax, dword [ebx + 0x6c]
lea ecx, [eax + 0x124]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov edx, edi
push edx
call eax
mov ecx, dword [esp + 0x54]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x58]
push edx
call fcn.0047d643
mov dword [esp + 0xa94], 0xffffffff
mov eax, dword [esp + 0x54]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 2
mov ecx, ebx
call fcn.0047be60
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x138]
mov dword [esp + 0x24], 1
call eax
movzx ecx, al
mov dword [esp + 0x9c], ecx
mov byte [esp + 0x47], 1
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3e], 0
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x80]
call eax
test al, al
jne 0x4179a3
call fcn.00451850
test eax, eax
jne 0x4179a3
push str.._vncclient.cpp_:_vncClientThread__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp dword [0x4ee094], 2
jne 0x4179a3
lea edi, [esp + 0x98]
xor eax, eax
call fcn.00451780
test eax, eax
je 0x418820
mov ecx, dword [ebx + 0x6c]
cmp dword [ecx + 0x34], 0
je 0x4179ca
cmp byte [esp + 0x47], 0
je 0x4179ca
mov bl, 0x14
call fcn.00416f00
mov bl, 0x91
call fcn.00416f00
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x47], 0
cmp dword [esp + 0x9c], 0
je 0x417a03
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x138]
call eax
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0xc8]
mov bl, al
mov eax, dword [edx + 0x54]
call fcn.00422310
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x9c], 0
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov eax, dword [ecx + 0x54]
mov cl, byte [eax + 0xe22c]
mov eax, dword [eax + 0xe160]
test eax, eax
je 0x417a25
movzx edx, cl
push edx
call eax
cmp byte [esp + 0x3f], 0
je 0x417a52
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x594]
mov edx, dword [ebx + 0x6c]
mov ecx, 2
call fcn.0041dd70
mov ecx, dword [ebx + 0x6c]
push 0
push ecx
call fcn.0041de30
mov byte [esp + 0x3f], 0
cmp byte [esp + 0x3e], 0
je 0x417a66
mov edx, dword [ebx + 0x6c]
call fcn.0041def0
mov byte [esp + 0x3e], 0
mov edx, dword [ebx + 0x64]
cmp byte [edx + 0x10], 0
mov esi, 1
je 0x417aa2
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x23c]
call edx
cmp byte [eax + 0x21], 0
je 0x417aa2
mov edx, dword [ebx + 0x64]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00453b00
test eax, eax
je 0x418820
xor esi, esi
jmp 0x417ab9
mov edx, dword [ebx + 0x64]
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.00453b00
test eax, eax
je 0x418820
movzx eax, byte [esp + 0x28]
cmp eax, 0xf
ja case.0x417ac7.1
jmp dword [eax*4 + 0x41a8ec]
lea edx, [esp + esi + 0x28]
mov ecx, 0x14
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
mov ax, word [esp + 0x30]
mov cx, word [esp + 0x32]
mov dx, word [esp + 0x34]
rol ax, 8
mov word [esp + 0x30], ax
rol cx, 8
rol dx, 8
xor eax, eax
cmp byte [esp + 0x39], 1
mov word [esp + 0x32], cx
mov ecx, dword [ebx + 0x6c]
sete al
mov word [esp + 0x34], dx
mov edx, dword [ecx + 0xc8]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebx + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
call edx
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
lea edi, [esp + 0x2c]
call fcn.00414040
test eax, eax
jne 0x417b63
push str.._vncclient.cpp_:_remote_pixel_format_invalid_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov dword [esp + 0x24], 0
mov eax, dword [ebx + 0x6c]
mov dword [eax + 0x15c], 1
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
jmp case.0x417ac7.13
lea edx, [esp + esi + 0x28]
mov ecx, 4
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
xor esi, esi
mov dword [eax + 0x70], esi
mov eax, dword [eax + 0x7c]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x60], esi
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x68], esi
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
or ecx, 0xffffffff
mov dword [eax + 0x4c], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x417bdd
mov dword [eax + 0x60], ecx
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov ecx, 6
mov dword [eax + 0x48], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x417bf5
mov dword [eax + 0x5c], ecx
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x50], esi
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x417c08
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], esi
cmp ecx, esi
je 0x417c1b
mov dword [ecx + 0x68], esi
mov dword [eax + 0x5c], esi
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], esi
cmp ecx, esi
je 0x417c31
mov dword [ecx + 0x6c], esi
mov dword [eax + 0x5c], esi
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x240]
push esi
call edx
mov eax, dword [ebx + 0x6c]
mov dword [eax + 0x178], esi
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x17c], esi
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov cx, word [esp + 0x2a]
mov eax, dword [ebx + 0x6c]
rol cx, 8
mov word [esp + 0x2a], cx
mov edx, dword [eax + 0x124]
lea ecx, [eax + 0x124]
mov eax, dword [edx + 0x10]
push esi
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [esp + 0x20], esi
lea edi, [ecx + 1]
cmp cx, word [esp + 0x2a]
jae 0x417ff0
lea esp, [esp]
lea edx, [esp + 0x78]
push edx
mov edx, dword [ebx + 0x64]
mov ecx, 4
call fcn.00453b00
test eax, eax
je 0x417fdd
mov ecx, dword [esp + 0x78]
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
mov esi, ecx
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, edi
jne 0x417cfd
mov eax, dword [ebx + 0x6c]
lea ecx, [eax + 0x124]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push edi
call edx
jmp 0x417fc4
cmp eax, 0xffffff21
jne 0x417d12
mov eax, dword [ebx + 0x6c]
mov dword [eax + 0x168], edi
jmp 0x417fc4
cmp eax, 0xffff0001
jne 0x417d49
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x70], edi
mov eax, dword [eax + 0x7c]
mov dword [eax + 8], edi
call fcn.00413760
push str.._vncclient.cpp_:_Cache_protocol_extension_enabled_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
jmp 0x417fc4
cmp eax, 0xffff0006
jne 0x417d60
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x60], edi
push str.._vncclient.cpp_:_XOR_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0xffffff00
jb 0x417d9e
cmp eax, 0xffffff09
ja 0x417d9e
mov ecx, dword [ebx + 0x6c]
lea esi, [eax + 0x100]
add ecx, 0x4c
mov eax, esi
call fcn.004141c0
push esi
push str.._vncclient.cpp_:_compression_level_requested:__d_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
jmp 0x417fc4
cmp eax, 0xffffffe0
jb 0x417dc0
cmp eax, 0xffffffe9
ja 0x417dc0
mov ecx, dword [ebx + 0x6c]
lea esi, [eax + 0x20]
add ecx, 0x4c
mov eax, esi
call fcn.004141f0
push esi
push str.._vncclient.cpp_:_image_quality_level_requested:__d_n
jmp 0x417d87
cmp eax, 0xffffff20
jne 0x417de4
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x50], edi
mov eax, dword [eax + 0x20]
test eax, eax
je 0x417dda
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_LastRect_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0xffffff10
jne 0x417e1d
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], edi
test ecx, ecx
je 0x417dfe
mov dword [ecx + 0x68], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x240]
push edi
call eax
push str.._vncclient.cpp_:_X_style_cursor_shape_updates_enabled_n
jmp 0x417d32
cmp eax, 0xffffff11
jne 0x417e56
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], edi
test ecx, ecx
je 0x417e37
mov dword [ecx + 0x6c], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x240]
push edi
call eax
push str.._vncclient.cpp_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x417d32
cmp eax, 0xffffff18
jne 0x417e70
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x184], edi
push str.._vncclient.cpp_:_PointerPos_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0xffff8000
jne 0x417e95
mov edx, dword [ebx + 0x6c]
mov byte [edx + 0x4d8], 1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x58c], 1
push str.._vncclient.cpp_:_ServerState_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0xffff8001
jne 0x417ebf
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x4da], 1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x58d], 1
mov byte [esp + 0x3f], 1
push str.._vncclient.cpp_:_KeepAlive_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0xffff8002
jne 0x417ed5
mov byte [esp + 0x3e], 1
push str.._vncclient.cpp_:_FTProtocolVersion_protocol_extension_enabled_n
jmp 0x417d32
cmp eax, 0x10
jne 0x417efe
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_ZRLE_found__n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [esp + 0x7c]
add esp, 4
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 7
jne 0x417f45
mov eax, dword [ebx + 0x6c]
add eax, 0x4c
mov dword [eax + 0x68], edi
push str.._vncclient.cpp_:_Tight_found_n
lea ecx, [edx + 2]
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp dword [esp + 0x1c], 0
jne 0x417fc4
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x10c]
call fcn.00402bc0
mov dword [esp + 0xa90], 3
mov eax, dword [esp + 0x78]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
or ecx, edx
push 0
push ecx
mov ecx, dword [ebx + 0x6c]
add ecx, 0x4c
call fcn.00413a60
test eax, eax
je 0x417fab
mov dword [esp + 0x1c], edi
mov dword [esp + 0xa90], 0xffffffff
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x20]
movzx ecx, word [esp + 0x2a]
add eax, edi
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x417ca0
jmp 0x417fe5
mov dword [esp + 0x24], 0
cmp dword [esp + 0x1c], 0
jne 0x418071
push str.._vncclient.cpp_:_defaulting_to_raw_encoder_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
add esp, 4
call eax
push eax
lea ecx, [esp + 0x110]
call fcn.00402bc0
mov dword [esp + 0xa90], 4
mov ecx, dword [ebx + 0x6c]
push 0
push 0
add ecx, 0x4c
call fcn.00413a60
test eax, eax
jne 0x418058
push str.._vncclient.cpp_:_failed_to_select_raw_encoder__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov dword [esp + 0x24], 0
mov dword [esp + 0xa90], 0xffffffff
mov ecx, dword [esp + 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
cmp eax, edi
jbe 0x41808c
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x248]
call eax
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x2c], edi
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x80]
call eax
mov edx, dword [ebx + 0x6c]
xor ecx, ecx
cmp byte [eax + 0xe22c], cl
sete cl
mov eax, ecx
mov ecx, edi
call fcn.0041dd70
jmp case.0x417ac7.13
lea edx, [esp + esi + 0x28]
mov ecx, 0xa
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
movzx eax, word [esp + 0x2a]
mov esi, dword [ebx + 0x6c]
mov edx, dword [esi + 0x48c]
mov cx, word [esp + 0x2c]
rol ax, 8
movzx eax, ax
add eax, dword [esi + 4]
lea edi, [esp + 0x90]
imul eax, edx
rol cx, 8
movzx ecx, cx
add ecx, dword [esi + 8]
mov si, word [esp + 0x2e]
imul ecx, edx
rol si, 8
movzx esi, si
imul esi, edx
add esi, eax
mov dword [esp + 0xa0], eax
movzx eax, word [esp + 0x30]
rol ax, 8
movzx eax, ax
imul eax, edx
mov dword [esp + 0xa8], esi
add eax, ecx
lea esi, [esp + 0xa0]
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xac], eax
call fcn.00409590
mov dword [esp + 0xa90], 5
cmp byte [esp + 0x29], 0
jne 0x418206
mov eax, dword [ebx + 0x6c]
mov esi, dword [eax + 0x47c]
mov edx, dword [eax + 4]
mov edi, dword [eax + 0x480]
mov ecx, dword [eax + 0x48c]
add edx, esi
mov esi, dword [eax + 8]
imul edx, ecx
add esi, edi
imul esi, ecx
mov dword [esp + 0xa4], esi
mov esi, dword [eax + 0x484]
sub esi, dword [eax + 0x47c]
mov dword [esp + 0xa0], edx
imul esi, ecx
add esi, edx
mov edx, dword [eax + 0x488]
sub edx, edi
imul edx, ecx
add edx, dword [esp + 0xa4]
mov dword [esp + 0xa8], esi
mov dword [esp + 0x20], edi
lea esi, [esp + 0xa0]
lea edi, [esp + 0x164]
mov dword [esp + 0xac], edx
call fcn.00409590
mov eax, edi
push eax
lea esi, [esp + 0x94]
call fcn.004095e0
mov esi, edi
call fcn.004095c0
lea ecx, [esp + 0x90]
call fcn.00409720
test al, al
je 0x41824e
push str.._vncclient.cpp_:_FATAL__client_update_region_is_empty__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov dword [esp + 0x24], 0
lea esi, [esp + 0x90]
mov dword [esp + 0xa90], 0xffffffff
call fcn.004095c0
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0xf8]
call fcn.00402bc0
mov byte [esp + 0xa90], 6
mov eax, dword [ebx + 0x6c]
mov ecx, dword [esp + 0x90]
push 2
add eax, 0x154
mov eax, dword [eax]
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
cmp byte [esp + 0x29], 0
jne 0x4182c5
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax + 0x124]
mov edx, dword [edx + 4]
lea ecx, [eax + 0x124]
lea eax, [esp + 0x90]
push eax
call edx
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov eax, dword [ecx + 0x54]
mov edx, dword [eax + 0xdb94]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov eax, dword [ecx + 0x54]
call fcn.0041fe10
mov edi, dword [ebx + 0x6c]
call fcn.0041b190
mov edx, dword [esp + 0xf4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x418232
mov edx, dword [ebx + 0x64]
lea eax, [esp + esi + 0x28]
mov ecx, 8
sub ecx, esi
push eax
call fcn.00453b00
test eax, eax
je 0x418361
mov edx, dword [ebx + 0x6c]
cmp dword [edx + 0x34], 0
je 0x418361
mov ecx, dword [esp + 0x2c]
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and ecx, 0xff00
shl esi, 0x10
or esi, ecx
shr eax, 8
shl esi, 8
or eax, esi
cmp byte [esp + 0x29], 0
mov dword [esp + 0x2c], eax
movzx ecx, byte [edx + 0x3c]
push ecx
setne dl
movzx ecx, dl
push ecx
push eax
call fcn.0043b010
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x160], 1
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov eax, dword [ecx + 0x54]
call fcn.0041fe10
jmp case.0x417ac7.13
lea edx, [esp + esi + 0x28]
mov ecx, 6
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.13
mov ecx, dword [ebx + 0x6c]
cmp dword [ecx + 0x38], 0
je case.0x417ac7.13
mov ax, word [esp + 0x2a]
mov dx, word [esp + 0x2c]
rol ax, 8
imul ax, word [ecx + 0x48c]
add ax, word [ecx + 0xc]
mov dword [esp + 0x1c], 0x8000
add ax, word [ecx + 4]
rol dx, 8
mov word [esp + 0x2a], ax
imul dx, word [ecx + 0x48c]
add dx, word [ecx + 0x10]
add dx, word [ecx + 8]
mov word [esp + 0x2c], dx
cmp ax, word [ecx + 0x11e]
jne 0x4183f6
cmp dx, word [ecx + 0x120]
je 0x4183fe
mov dword [esp + 0x1c], 0x8001
mov cl, byte [ecx + 0x11d]
mov al, byte [esp + 0x29]
xor cl, al
test cl, 1
je 0x418448
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov al, byte [esp + 0x29]
je 0x418436
test al, 1
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x1c], edx
jmp 0x418448
test al, 1
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x1c], ecx
mov edx, dword [ebx + 0x6c]
mov dl, byte [edx + 0x11d]
mov cl, al
mov byte [esp + 0x17], dl
and cl, 2
and dl, 2
cmp cl, dl
je 0x418472
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x40
or dword [esp + 0x1c], ecx
mov dl, al
xor dl, byte [esp + 0x17]
test dl, 4
je 0x4184b6
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov al, byte [esp + 0x29]
je 0x4184a1
test al, 4
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x1c], ecx
jmp 0x4184b6
test al, 4
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x1c], edx
mov ecx, dword [ebx + 0x6c]
xor esi, esi
xor edi, edi
cmp dword [ecx + 0xb4], esi
je 0x4184ee
cmp dword [ecx + 0xac], esi
jne 0x4184ee
test al, 8
je 0x4184df
test byte [ecx + 0x11d], 8
jne 0x4184df
lea edi, [esi + 0x78]
jmp 0x418508
test al, 0x10
je 0x418510
test byte [ecx + 0x11d], 0x10
jne 0x418510
jmp 0x418503
test al, 8
je 0x4184ff
or dword [esp + 0x1c], 0x800
mov edi, 0x78
test al, 0x10
je 0x418510
mov edi, 0xffffff88
or dword [esp + 0x1c], 0x800
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov eax, dword [eax + 0x180]
lea edx, [esp + 0x18c]
push edx
lea edx, [esp + 0x120]
push edx
lea edx, [esp + 0x10c]
push edx
call eax
mov eax, dword [ebx + 0x6c]
cmp dword [eax + 0x14], 1
jne 0x418580
movzx eax, word [esp + 0x2c]
mov ecx, dword [esp + 0x11c]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [esp + 0x104]
push esi
push edi
lea ecx, [edx - 1]
push eax
movzx eax, word [esp + 0x36]
imul eax, eax, 0xffff
cdq
idiv ecx
mov edx, dword [esp + 0x28]
push eax
push edx
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x41870b
cmp dword [eax + 0x4b4], esi
je 0x418622
mov dword [esp + 0x218], esi
call fcn.00401040
add word [esp + 0x2a], ax
call fcn.00401060
add word [esp + 0x2c], ax
call fcn.00401000
mov ecx, eax
movzx eax, word [esp + 0x2a]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov dword [esp + 0x21c], eax
call fcn.00401020
mov ecx, eax
movzx eax, word [esp + 0x2c]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [ebx + 0x6c]
push 0x1c
mov dword [esp + 0x234], esi
mov dword [esp + 0x228], edi
mov dword [esp + 0x230], esi
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x20]
or eax, 0x4000
mov dword [esp + 0x22c], eax
mov ecx, dword [edx + 0x4b4]
lea eax, [esp + 0x21c]
push eax
push 1
call ecx
jmp 0x41870b
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x54]
push eax
call fcn.00413840
mov ecx, dword [esp + 0x58]
push ecx
mov dword [esp + 0x58], eax
call fcn.00413860
test byte [esp + 0x1c], 1
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esp + 0x58], eax
mov dword [esp + 0x114], 0xa
je 0x4186c2
and dword [esp + 0x1c], 0xffff7fff
push 0
lea edx, [esp + 0x19c]
push edx
push 0
push 3
call esi
push 0
lea eax, [esp + 0x11c]
push eax
push 0
push 0x70
call esi
xor eax, eax
push eax
lea ecx, [esp + 0x118]
push ecx
push eax
push 0x71
mov dword [esp + 0x190], 0xa
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
call esi
push 0
lea edx, [esp + 0x184]
push edx
push 0
push 4
call esi
movzx eax, word [esp + 0x2c]
movzx ecx, word [esp + 0x2a]
sub eax, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x1c]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_mouse_event]
test byte [esp + 0x1c], 1
je 0x41870b
push 0
lea eax, [esp + 0x19c]
push eax
push 0
push 4
call esi
push 0
lea ecx, [esp + 0x11c]
push ecx
push 0
push 0x71
call esi
mov eax, dword [ebx + 0x6c]
mov edx, dword [esp + 0x28]
add eax, 0x11c
mov dword [eax], edx
mov cx, word [esp + 0x2c]
mov word [eax + 4], cx
jmp 0x418354
lea edx, [esp + esi + 0x28]
mov ecx, 8
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.13
mov eax, dword [esp + 0x2c]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x6400000
ja case.0x417ac7.13
lea eax, [esi + 1]
push eax
call fcn.0047cc97
mov edi, eax
add esp, 4
test edi, edi
je case.0x417ac7.13
mov byte [edi + esi], 0
mov edx, dword [ebx + 0x64]
push edi
mov ecx, esi
call fcn.00453b00
push edi
test eax, eax
jne 0x4187a6
call fcn.0047d0a1
add esp, 4
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0xfc]
call eax
push edi
call fcn.0047d0a1
add esp, 4
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x491], 1
mov edx, dword [ebx + 0x6c]
mov ecx, 4
sub ecx, esi
cmp byte [edx + 0x491], 0
je 0x418aa7
mov edx, dword [ebx + 0x64]
lea eax, [esp + esi + 0x28]
push eax
call fcn.00453b00
test eax, eax
jne 0x418abc
mov dword [esp + 0x24], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2a0]
call eax
test eax, eax
je 0x418815
mov esi, dword [ebx + 0x6c]
call fcn.0041dce0
cmp dword [esp + 0x24], 0
jne 0x417956
cmp byte [0x4f378d], 0
je 0x418838
push 0xc8
mov byte [ebx + 0x60], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x311], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x418888
mov byte [eax + 0x310], 1
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0x2f8]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x311], 0
mov esi, dword [ebx + 0x6c]
mov eax, dword [esi + 0x2f8]
add esi, 0x2f8
cmp eax, 0xffffffff
je 0x418888
push eax
call edi
mov dword [esi], 0xffffffff
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x46e], 0
je 0x4188d2
mov byte [eax + 0x46d], 1
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x46e], 0
mov esi, dword [ebx + 0x6c]
mov eax, dword [esi + 0x458]
add esi, 0x458
cmp eax, 0xffffffff
je 0x4188d2
push eax
call edi
mov dword [esi], 0xffffffff
mov esi, dword [esp + 0x5c]
call fcn.004516a0
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x4d9], 0
je 0x418901
mov ecx, dword [eax + 0xc8]
mov ecx, dword [ecx + 0x54]
xor al, al
call fcn.00422b60
mov edx, dword [ebx + 0x6c]
mov byte [edx + 0x4d9], 0
mov eax, dword [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
test eax, eax
jne 0x418927
push str.._vncclient.cpp_:_failed_to_close_desktop_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov ecx, dword [ebx + 0x6c]
mov esi, ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x40]
call eax
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [edx + 0x3c]
push ecx
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_disconnected_:__s___hd__n
mov ecx, 1
mov eax, 0x4bc990
call fcn.00401110
add esp, 0xc
push 0x104
lea ecx, [esp + 0x660]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4189bb
lea edx, [esp + 0x65c]
push 0x5c
push edx
call fcn.0047e5be
mov byte [eax], 0
lea eax, [esp + 0x664]
add esp, 8
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x418990
mov ecx, dword [str.logging.dll]
mov edx, dword [0x4ab480]
mov dword [eax], ecx
mov ecx, dword [0x4ab484]
mov dword [eax + 4], edx
mov dl, byte [0x4ab488]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4189f4
push str.LOGEXIT
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x3c]
call eax
push eax
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [ebx + 0x6c]
mov esi, dword [ecx + 0x150]
test esi, esi
je 0x418a20
call fcn.00414d10
mov edx, dword [ebx + 0x6c]
mov ecx, dword [edx + 0x150]
push 0
call fcn.0047bda0
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x64
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x68]
call edx
cmp byte [0x4f378d], 0
jne 0x41a8c6
mov ebx, dword [ebx + 0x68]
mov eax, dword [ebx]
mov edx, dword [eax + 0x264]
mov ecx, ebx
call edx
test eax, eax
je 0x41a8c6
push str.._vncclient.cpp_:_PostAddNewClient_II_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov esi, dword [0x4f3864]
add esp, 4
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4173ef
push 0x457
push 0x457
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41a8c6
lea edx, [esp + esi + 0x28]
push edx
mov edx, dword [ebx + 0x64]
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
mov al, byte [esp + 0x29]
mov cl, al
dec cl
cmp cl, 8
ja case.0x417ac7.13
movzx edx, al
mov eax, dword [ebx + 0x6c]
mov dword [eax + 0x48c], edx
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x54]
call fcn.00402bc0
mov dword [esp + 0xa90], 7
mov ecx, dword [ebx + 0x6c]
movzx eax, byte [esp + 0x29]
mov esi, dword [ecx + 0xc8]
call fcn.00411a30
test eax, eax
jne 0x418b2e
mov dword [esp + 0xa90], 0xffffffff
mov edx, dword [esp + 0x50]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x417ac7.13
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x490], 1
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0xc8]
mov ecx, dword [edx + 0x54]
mov eax, dword [ecx + 0xdbb8]
movzx esi, byte [esp + 0x29]
cdq
idiv esi
push 1
push 0
push 0
mov dword [ecx + 0xdbb8], eax
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov ecx, dword [ecx + 0x54]
mov eax, dword [ecx + 0xdbbc]
movzx esi, byte [esp + 0x35]
cdq
idiv esi
mov dword [ecx + 0xdbbc], eax
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0xc8]
mov ecx, dword [eax + 0x54]
mov eax, dword [ecx + 0xdbb0]
movzx esi, byte [esp + 0x35]
cdq
idiv esi
mov dword [ecx + 0xdbb0], eax
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0xc8]
mov ecx, dword [edx + 0x54]
mov eax, dword [ecx + 0xdbb4]
movzx esi, byte [esp + 0x35]
cdq
idiv esi
mov dword [ecx + 0xdbb4], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [ebx + 0x6c]
call fcn.0041b190
mov dword [esp + 0xa90], 0xffffffff
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x417ac7.13
lea edx, [esp + esi + 0x28]
mov ecx, 4
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
mov eax, dword [ebx + 0x6c]
cmp dword [eax + 0x34], 0
je case.0x417ac7.13
cmp byte [esp + 0x29], 1
mov eax, str.disabled
je 0x418c21
mov eax, str.enabled
push eax
push str.._vncclient.cpp_:_rfbSetServerInput:_inputs__s_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x80]
add esp, 8
call eax
cmp byte [eax + 0xe22c], 0
jne 0x418c89
mov ecx, dword [ebx + 0x6c]
cmp byte [ecx + 0x4d9], 0
jne 0x418c89
cmp byte [esp + 0x29], 1
jne 0x418c89
mov esi, dword [ebx + 0x68]
push 1
call fcn.00450910
mov edx, dword [ebx + 0x6c]
mov ecx, dword [edx + 0xc8]
mov ecx, dword [ecx + 0x54]
mov al, 1
call fcn.00422b60
mov edx, dword [ebx + 0x6c]
mov byte [edx + 0x4d9], 1
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x80]
call edx
cmp byte [eax + 0xe22c], 0
je case.0x417ac7.13
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x4d9], 0
je case.0x417ac7.13
cmp byte [esp + 0x29], 0
jne case.0x417ac7.13
mov esi, dword [ebx + 0x68]
push 0
call fcn.00450910
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx + 0xc8]
mov ecx, dword [edx + 0x54]
xor al, al
call fcn.00422b60
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x4d9], 0
jmp case.0x417ac7.13
lea edx, [esp + esi + 0x28]
mov ecx, 6
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je case.0x417ac7.1
mov ax, word [esp + 0x2a]
mov cx, word [esp + 0x2c]
rol ax, 8
movzx eax, ax
mov dword [esp + 0x20], eax
cmp ax, 5
jae 0x418d9b
mov dx, cx
rol dx, 8
cmp dx, 5
jae 0x418d9b
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0xc8]
mov esi, dword [ecx + 0x54]
mov edi, 1
push edi
push edi
push str.._vncdesktop.cpp_:_SETW__i__i_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [esi + 0xe228]
add esp, 0xc
sub eax, edi
je 0x418d8b
sub eax, edi
je 0x418d79
sub eax, edi
jne case.0x417ac7.13
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x64], eax
jmp case.0x417ac7.13
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x64], 0
jmp case.0x417ac7.13
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x64], eax
jmp case.0x417ac7.13
mov eax, dword [ebx + 0x6c]
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x48c]
add esi, dword [eax + 4]
rol cx, 8
movzx edi, cx
add edi, dword [eax + 0x10]
movzx ecx, word [esp + 0x20]
add edi, dword [eax + 8]
add esi, ecx
imul edi, edx
imul esi, edx
mov edx, dword [eax + 0xc8]
mov eax, dword [edx + 0x54]
push edi
mov dword [esp + 0x24], eax
push esi
push str.._vncdesktop.cpp_:_SETW__i__i_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 0xc
cmp esi, 5
jg case.0x417ac7.13
mov eax, dword [esp + 0x20]
push esi
mov ecx, edi
call fcn.004223c0
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x6c]
mov ecx, dword [ecx + 0x4a4]
mov eax, esi
call fcn.0040cf00
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2a0]
mov byte [esp + 0x17], 1
call eax
test eax, eax
je 0x418e38
mov edi, dword [ebx + 0x6c]
call fcn.0041dae0
mov byte [esp + 0x17], al
mov ecx, dword [ebx + 0x6c]
cmp dword [ecx + 0x34], 0
je 0x418e47
cmp dword [ecx + 0x38], 0
jne 0x418e4c
mov byte [esp + 0x17], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x84]
call fcn.00402bc0
mov dword [esp + 0xa90], 8
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x190], 1
lea edx, [esp + esi + 0x28]
mov ecx, 0xc
push edx
mov edx, dword [ebx + 0x64]
sub ecx, esi
call fcn.00453b00
test eax, eax
je 0x41a830
movzx eax, byte [esp + 0x29]
dec eax
cmp eax, 0xf
ja case.0x418ea3.2
jmp dword [eax*4 + 0x41a92c]
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x312], 1
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x312], 0
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x4c]
call fcn.00402bc0
mov byte [esp + 0xa90], 9
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je 0x418f43
cmp byte [esp + 0x17], 0
je 0x418f43
mov eax, dword [esp + 0x30]
mov edx, eax
mov edi, eax
mov ecx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x6c]
and edi, 0xff0000
shr ecx, 0x10
or edi, ecx
push 0x144
add eax, 0x198
shl edx, 8
push 0
shr edi, 8
push eax
or edi, edx
call fcn.004858b0
add esp, 0xc
cmp edi, 0x144
jbe 0x418f53
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
mov edx, dword [ebx + 0x6c]
add edx, 0x198
push edx
mov edx, dword [ebx + 0x64]
mov ecx, edi
call fcn.00453b00
test eax, eax
jne 0x418f7b
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
mov eax, dword [esp + 0x2c]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
mov edx, dword [ebx + 0x64]
lea eax, [esp + 0x60]
mov dword [esp + 0x40], ecx
push eax
mov ecx, 4
mov dword [esp + 0x64], 0
call fcn.00453b00
test eax, eax
jne 0x418fd4
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
mov eax, dword [esp + 0x60]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x6c]
shr ecx, 8
shl edx, 8
add eax, 0x198
or ecx, edx
push 0x2c
push eax
mov dword [esp + 0x28], ecx
call fcn.0047e5be
add esp, 8
test eax, eax
jne 0x419022
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x2dc], 0
jmp 0x41903c
mov ecx, dword [ebx + 0x6c]
lea esi, [eax + 1]
add ecx, 0x2dc
mov edi, edi
mov dl, byte [esi]
mov byte [ecx], dl
inc esi
inc ecx
test dl, dl
jne 0x419030
mov byte [eax], dl
mov ecx, dword [ebx + 0x6c]
add ecx, 0x198
lea esi, [esp + 0x1f0]
call fcn.00414700
cmp dword [eax + 0x18], 0x10
jb 0x41905c
mov edx, dword [eax + 4]
jmp 0x41905f
lea edx, [eax + 4]
mov ecx, dword [ebx + 0x6c]
add ecx, 0x198
mov al, byte [edx]
mov byte [ecx], al
inc edx
inc ecx
test al, al
jne 0x419068
lea ecx, [esp + 0x1f0]
call fcn.004070c0
add edi, 0x41
push edi
mov dword [esp + 0x20], 0
call fcn.0047cc97
mov esi, eax
add esp, 4
test esi, esi
jne 0x4190a8
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
push edi
push 0
push esi
call fcn.004858b0
mov eax, dword [ebx + 0x6c]
add esp, 0xc
add eax, 0x198
mov edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4190c0
push 0x5c
push esi
call fcn.0047e5be
add esp, 8
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41911b
lea edx, [esp + 0x15c]
push edx
lea ecx, [esp + 0x170]
push ecx
lea edx, [esp + 0x17c]
push edx
push esi
call eax
test eax, eax
jne 0x41911b
or edi, 0xffffffff
mov dword [esp + 0x1c], edi
jmp 0x41911e
or edi, 0xffffffff
push esi
call fcn.0047d0a1
add esp, 4
mov ecx, 0xa
mov eax, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
shrd eax, edx, cl
sar edx, cl
push 1
push 0
mov esi, eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x220], edx
call fcn.00485870
xor ecx, ecx
add eax, dword [esp + 0x40]
push ecx
push 0x3e8
adc edx, ecx
push edx
push eax
call fcn.00491cc0
xor ecx, ecx
cmp ecx, edx
jg 0x41917d
jl 0x419179
cmp esi, eax
jae 0x41917d
mov dword [esp + 0x1c], edi
push 0x2400
call fcn.0047cc97
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x2f0], eax
mov eax, dword [ebx + 0x6c]
add esp, 4
cmp dword [eax + 0x2f0], 0
jne 0x4191a3
mov dword [esp + 0x1c], edi
push 0x2000
call fcn.0047cc97
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x2f4], eax
mov eax, dword [ebx + 0x6c]
add esp, 4
cmp dword [eax + 0x2f4], 0
jne 0x4191c9
mov dword [esp + 0x1c], edi
mov byte [esp + 0x84], 7
cmp dword [esp + 0x1c], edi
je 0x41935b
push 0
push 0x8000000
push 4
push 0
push 3
push 0xc0000000
add eax, 0x198
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x2f8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, dword [ebx + 0x6c]
sete cl
xor edx, edx
cmp dword [eax + 0x2f8], 0xffffffff
setne dl
dec edx
mov dword [esp + 0x1c], edx
test cl, cl
je 0x41935b
cmp edx, 0xffffffff
je 0x41935b
lea ecx, [eax + 0x198]
lea esi, [esp + 0x154]
call fcn.0041da40
test al, al
je 0x41935b
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x158]
shrd eax, ecx, 0xd
lea eax, [eax*4 + 0x400]
push eax
shr ecx, 0xd
mov dword [esp + 0x44], eax
call fcn.0047cc97
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
je 0x41935b
mov edx, dword [ebx + 0x6c]
mov edi, dword [edx + 0x2f8]
push 0x2000
call fcn.0047cc97
add esp, 4
test eax, eax
je 0x41935b
mov ecx, dword [esp + 0x20]
push ecx
mov esi, eax
mov ebx, edi
call fcn.0041cce0
mov edi, eax
cmp edi, 0xffffffff
je 0x419357
mov eax, dword [esp + 0x40]
mov edx, eax
shl edx, 0x10
mov ecx, eax
and ecx, 0xff00
or edx, ecx
mov ecx, eax
shl edx, 8
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr eax, 0x18
or edx, eax
mov dword [esp + 0x88], edx
mov edx, edi
shl edx, 0x10
mov eax, edi
and eax, 0xff00
or edx, eax
mov ecx, edi
sar ecx, 8
shl edx, 8
and ecx, 0xff00
or edx, ecx
mov eax, edi
shr eax, 0x18
or edx, eax
mov dword [esp + 0x8c], edx
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x84]
mov byte [esp + 0x85], 0xc
call fcn.004539c0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, edi
mov edi, dword [edx + 0x64]
call fcn.00453a00
mov eax, dword [esp + 0x20]
push eax
call fcn.0047d0a1
add esp, 4
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [ebx + 0x6c]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
lea eax, [ebx + 0x198]
mov dword [esp + 0x88], ecx
mov ecx, eax
mov byte [esp + 0x85], 9
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4193a0
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4193b0
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov edi, edi
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x4193c0
sub esi, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4193d0
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x18]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x8c], eax
mov eax, dword [edi + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x84]
call fcn.004539c0
mov eax, dword [edi + 0x6c]
add eax, 0x198
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x419425
mov edi, dword [edi + 0x64]
sub ecx, esi
call fcn.00453a00
cmp dword [esp + 0x1c], 0xffffffff
jne 0x4194a1
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 0x6c]
add esi, 0x2f8
call fcn.00453e70
mov eax, dword [edi + 0x6c]
mov eax, dword [eax + 0x2f4]
xor esi, esi
cmp eax, esi
je 0x419470
push eax
call fcn.0047d0a1
mov ecx, dword [edi + 0x6c]
add esp, 4
mov dword [ecx + 0x2f4], esi
mov edx, dword [edi + 0x6c]
mov eax, dword [edx + 0x2f0]
cmp eax, esi
je 0x41948f
push eax
call fcn.0047d0a1
mov eax, dword [edi + 0x6c]
add esp, 4
mov dword [eax + 0x2f0], esi
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, edi
jmp case.0x418ea3.2
mov eax, dword [esp + 0x2c]
mov edx, eax
and edx, 0xff0000
mov ecx, eax
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
shr edx, 8
and eax, 0xff00
or ecx, eax
mov eax, dword [esp + 0x18]
shl ecx, 8
or edx, ecx
mov ecx, dword [eax + 0x6c]
mov dword [ecx + 0x2fc], edx
mov ecx, dword [eax + 0x6c]
mov edx, dword [ecx + 0x2fc]
shr edx, 0xd
mov dword [ecx + 0x300], edx
mov edx, dword [eax + 0x6c]
xor ecx, ecx
mov dword [edx + 0x304], ecx
mov edx, dword [eax + 0x6c]
mov dword [edx + 0x308], ecx
mov edx, dword [eax + 0x6c]
mov dword [edx + 0x30c], ecx
mov edx, dword [eax + 0x6c]
mov byte [edx + 0x313], cl
mov edx, dword [eax + 0x6c]
mov byte [edx + 0x310], cl
mov ecx, dword [eax + 0x6c]
mov byte [ecx + 0x311], 1
mov edx, dword [eax + 0x68]
mov ecx, dword [edx + 0x590]
mov eax, dword [eax + 0x64]
imul ecx, ecx, 0x3e8
push ecx
mov edi, eax
call fcn.004537b0
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x18]
mov edx, dword [ebx + 0x6c]
mov dword [esp + 0xa90], 0xffffffff
mov eax, dword [esp + 0x80]
push eax
mov dword [edx + 0x190], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x417ac7.13
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x50]
call fcn.00402bc0
mov byte [esp + 0xa90], 0xa
mov eax, dword [esp + 0x2c]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 1
mov ecx, dword [ebx + 0x6c]
sete al
mov byte [ecx + 0x46c], al
mov eax, dword [esp + 0x30]
mov esi, eax
mov edx, eax
shr edx, 0x10
and esi, 0xff0000
or esi, edx
mov edx, dword [ebx + 0x6c]
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
push 0x144
or ecx, eax
add edx, 0x314
shl ecx, 8
push 0
shr esi, 8
push edx
or esi, ecx
call fcn.004858b0
add esp, 0xc
cmp esi, 0x144
jbe 0x41961e
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x6c]
mov edx, dword [ebx + 0x64]
add ecx, 0x314
push ecx
mov ecx, esi
call fcn.00453b00
test eax, eax
jne 0x419646
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1f0]
call edx
test eax, eax
je 0x419636
cmp byte [esp + 0x17], 0
je 0x419636
mov eax, dword [ebx + 0x6c]
lea ecx, [eax + 0x314]
push ecx
push eax
call fcn.0041d650
or esi, 0xffffffff
cmp eax, esi
jne 0x41977f
mov ebx, dword [ebx + 0x6c]
lea eax, [ebx + 0x314]
mov ecx, eax
mov dword [esp + 0x134], esi
mov byte [esp + 0x130], 7
mov byte [esp + 0x131], 4
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4196a0
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4196b0
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov edi, edi
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x4196c0
sub esi, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4196d0
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x18]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x138], eax
mov eax, dword [edi + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x130]
call fcn.004539c0
mov eax, dword [edi + 0x6c]
add eax, 0x314
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x419725
mov edi, dword [edi + 0x64]
sub ecx, esi
call fcn.00453a00
mov esi, dword [esp + 0x18]
mov edi, dword [esi + 0x64]
mov ecx, 4
lea eax, [esp + 0xec]
mov dword [esp + 0xec], 0xffffffff
call fcn.00453a00
mov edx, dword [esi + 0x6c]
mov ecx, dword [esp + 0x4c]
mov byte [edx + 0x46d], 1
mov eax, dword [esi + 0x6c]
push ecx
mov byte [eax + 0x46e], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, esi
jmp case.0x418ea3.2
mov edx, dword [ebx + 0x6c]
push 0
push 0x8000000
push 3
push 0
push 1
push bind
add edx, 0x314
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x458], eax
mov eax, dword [ebx + 0x6c]
cmp dword [eax + 0x458], esi
jne 0x4197c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
jmp 0x4198cc
lea ecx, [eax + 0x314]
lea esi, [esp + 0x64]
call fcn.0041da40
test al, al
jne 0x4197f9
mov esi, dword [ebx + 0x6c]
add esi, 0x458
call fcn.00453e70
or eax, 0xffffffff
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
jmp 0x4198c8
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x458]
lea edx, [esp + 0x190]
push edx
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4198c8
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [esp + 0x12a]
movzx edx, word [esp + 0x128]
movzx eax, word [esp + 0x120]
push ecx
movzx ecx, word [esp + 0x12a]
push edx
movzx edx, word [esp + 0x12a]
push eax
push ecx
push edx
lea eax, [esp + 0x22c]
push str._2.2d__2.2d__4.4d__2.2d:_2.2d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [ebx + 0x6c]
add esp, 0x1c
add edi, 0x313
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x419880
mov cx, word [0x4abc48]
lea eax, [esp + 0x218]
mov word [edi], cx
mov esi, eax
jmp 0x4198a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4198a0
mov edi, dword [ebx + 0x6c]
sub eax, esi
add edi, 0x313
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4198b2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x64]
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0x470]
xor edi, edi
cmp eax, edi
je 0x4198ed
push eax
call fcn.0047d0a1
mov eax, dword [ebx + 0x6c]
add esp, 4
mov dword [eax + 0x470], edi
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x474], edi
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x478], edi
mov ebx, dword [ebx + 0x6c]
mov eax, esi
mov ecx, esi
mov edx, esi
and eax, 0xff0000
shr ecx, 0x10
shl edx, 0x10
and esi, 0xff00
or eax, ecx
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0x140], eax
lea eax, [ebx + 0x314]
mov ecx, eax
mov byte [esp + 0x13c], 7
mov byte [esp + 0x13d], 4
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x419947
mov edi, eax
sub ecx, esi
lea esi, [edi + 1]
mov dl, byte [edi]
inc edi
test dl, dl
jne 0x419955
sub edi, esi
mov esi, eax
lea ebx, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x419963
sub esi, ebx
lea edx, [eax + 1]
nop
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x419970
sub eax, edx
shl eax, 0x10
shr ecx, 0x10
and esi, 0xff00
or eax, esi
and edi, 0xff0000
or ecx, edi
mov edi, dword [esp + 0x18]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x144], eax
mov eax, dword [edi + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x13c]
call fcn.004539c0
mov eax, dword [edi + 0x6c]
add eax, 0x314
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4199c5
mov edi, dword [edi + 0x64]
sub ecx, esi
call fcn.00453a00
mov esi, dword [esp + 0x68]
mov eax, esi
and eax, 0xff0000
mov ecx, esi
shr ecx, 0x10
or eax, ecx
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
mov edx, dword [esp + 0x18]
mov edi, dword [edx + 0x64]
mov dword [esp + 0xf0], eax
mov ecx, 4
lea eax, [esp + 0xf0]
call fcn.00453a00
cmp dword [esp + 0x64], 0xffffffff
jne 0x419a33
cmp esi, 0xffffffff
jne 0x419a33
mov eax, dword [esp + 0x4c]
jmp 0x41953e
mov ecx, dword [esp + 0x4c]
push ecx
jmp 0x41953f
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x590]
mov edi, dword [ebx + 0x64]
imul eax, eax, 0x3e8
push eax
call fcn.004537b0
mov eax, dword [esp + 0x30]
mov esi, dword [ebx + 0x6c]
mov edi, eax
mov ecx, eax
mov edx, eax
and edi, 0xff0000
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
jl 0x419a92
call fcn.0041cd70
movzx eax, al
mov dword [esp + 0x24], eax
jmp case.0x418ea3.2
xor al, al
movzx eax, al
mov dword [esp + 0x24], eax
jmp case.0x418ea3.2
mov eax, dword [esp + 0x2c]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 0xffffffff
jne 0x419adf
mov esi, dword [ebx + 0x6c]
add esi, 0x458
call fcn.00453e70
jmp case.0x418ea3.2
push 0x2000
call fcn.0047cc97
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x2f0], eax
mov eax, dword [ebx + 0x6c]
xor esi, esi
add esp, 4
cmp dword [eax + 0x2f0], esi
jne 0x419b12
lea esi, [eax + 0x458]
call fcn.00453e70
jmp case.0x418ea3.2
push 0x2400
call fcn.0047cc97
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x2f4], eax
mov eax, dword [ebx + 0x6c]
add esp, 4
cmp dword [eax + 0x2f4], esi
jne 0x419b6a
lea esi, [eax + 0x458]
call fcn.00453e70
mov eax, dword [ebx + 0x6c]
mov eax, dword [eax + 0x2f0]
test eax, eax
je case.0x418ea3.2
push eax
call fcn.0047d0a1
mov ecx, dword [ebx + 0x6c]
add esp, 4
mov dword [ecx + 0x2f0], 0
jmp case.0x418ea3.2
mov byte [eax + 0x45c], 0
mov edx, dword [ebx + 0x6c]
mov dword [edx + 0x460], esi
mov eax, dword [ebx + 0x6c]
mov dword [eax + 0x30c], esi
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 0x468], esi
mov edx, dword [ebx + 0x6c]
mov byte [edx + 0x46d], 0
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x46e], 1
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x313], 0
mov edx, dword [ebx + 0x6c]
push edx
call fcn.0041d170
movzx eax, al
mov dword [esp + 0x24], eax
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
mov eax, dword [esp + 0x2c]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
mov esi, dword [ebx + 0x6c]
and eax, 0xff00
or edx, eax
shl edx, 8
shr ecx, 8
or ecx, edx
push ecx
mov ecx, dword [esp + 0x34]
mov eax, ecx
mov edx, ecx
shr edx, 0x10
and eax, 0xff0000
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
call fcn.0041cdd0
mov ecx, dword [ebx + 0x6c]
movzx eax, al
push 0
push ecx
mov dword [esp + 0x2c], eax
call fcn.0041de30
jmp case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x311], 0
je case.0x418ea3.2
push eax
call fcn.0041cf10
jmp case.0x418ea3.2
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x311], 0
je 0x419cb3
mov byte [eax + 0x310], 1
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x313], 1
mov edx, dword [ebx + 0x6c]
push edx
call fcn.0041cf10
jmp case.0x418ea3.2
cmp byte [eax + 0x46e], 0
je 0x419cd2
mov byte [eax + 0x46d], 1
mov eax, dword [ebx + 0x6c]
mov byte [eax + 0x313], 1
jmp case.0x418ea3.2
mov byte [eax + 0x492], 1
mov ecx, dword [ebx + 0x6c]
cmp byte [ecx + 0x492], 0
je case.0x418ea3.2
cmp word [esp + 0x2a], 0
mov byte [esp + 0xe0], 7
sete al
test al, al
je 0x419d08
mov byte [esp + 0xe1], 7
jmp 0x419d4a
mov ecx, dword [ebx + 0x68]
mov byte [esp + 0xe1], 0xe
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je 0x419d4a
mov ecx, dword [ebx + 0x6c]
mov ecx, dword [ecx + 0xe8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x130]
call eax
test eax, eax
je 0x419d4a
cmp byte [esp + 0x17], 0
mov dword [esp + 0xe4], 0x1000000
jne 0x419d55
mov dword [esp + 0xe4], 0xffffffff
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0xec]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0xe0]
call fcn.004539c0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x6c]
mov byte [ecx + 0x492], 0
mov ebx, eax
jmp case.0x418ea3.2
movzx eax, word [esp + 0x2a]
sub eax, 1
je 0x419ed7
sub eax, 1
jne case.0x418ea3.2
lea edx, [esp + 0x234]
push edx
push 0x100
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebx + 0x68]
mov edi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1f0]
mov dword [esp + 0x40], edi
call edx
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
lea eax, [edi - 3]
test eax, eax
jbe 0x419e5e
lea esi, [esp + 0x110]
lea eax, [esp + 0x234]
sub esi, eax
mov ebx, dword [esp + 0x20]
lea eax, [esp + ebx + 0x234]
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x419e00
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x419e20
jmp dword [eax*4 + 0x41a96c]
mov byte [esp + ebx + 0x236], 0x6c
jmp case.default.0x419e20
mov byte [esp + ebx + 0x236], 0x66
jmp case.default.0x419e20
mov byte [esp + ebx + 0x236], 0x63
jmp case.default.0x419e20
mov byte [esp + ebx + 0x236], 0x6e
add ebx, 4
lea eax, [edi - 3]
sub esi, 4
mov dword [esp + 0x20], ebx
cmp ebx, eax
jb 0x419df1
mov edx, 3
mov word [esp + 0x14a], dx
mov eax, edi
shl eax, 0x10
mov edx, edi
and edx, 0xff00
or eax, edx
mov edx, edi
shl eax, 8
sar edx, 8
and edx, 0xff00
or eax, edx
shr edi, 0x18
or eax, edi
mov edi, dword [esp + 0x18]
mov cl, 7
mov dword [esp + 0x150], eax
mov eax, dword [edi + 0x64]
mov esi, 0xc
lea ebx, [esp + 0x148]
mov byte [esp + 0x148], cl
mov byte [esp + 0x149], 2
call fcn.004539c0
mov ecx, dword [esp + 0x40]
mov edi, dword [edi + 0x64]
lea eax, [esp + 0x234]
call fcn.00453a00
jmp 0x419545
mov eax, dword [esp + 0x30]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x418ea3.2
mov edx, dword [ebx + 0x64]
lea eax, [esp + 0x234]
push eax
mov ecx, esi
call fcn.00453b00
test eax, eax
je case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov byte [esp + esi + 0x234], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
push 0xb
lea ecx, [esp + 0x238]
push str.My_Documents
push ecx
or esi, 0xffffffff
mov byte [esp + 0x23], 0
call fcn.0047e047
add esp, 0xc
test eax, eax
jne 0x419f72
lea esi, [eax + 5]
push 7
lea edx, [esp + 0x238]
push str.Desktop
push edx
call fcn.0047e047
add esp, 0xc
test eax, eax
jne 0x419f8f
xor esi, esi
push 0x11
lea eax, [esp + 0x238]
push str.Network_Favorites
push eax
call fcn.0047e047
add esp, 0xc
test eax, eax
jne 0x419faf
lea esi, [eax + 0x13]
jmp 0x419fb4
cmp esi, 0xffffffff
je 0x41a02a
lea ecx, [esp + 0x65c]
push ecx
push esi
call fcn.0041d5e0
test al, al
je 0x41a025
lea eax, [esp + 0x65c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x419fd0
sub eax, edx
cmp byte [esp + eax + 0x65b], 0x5c
je 0x41a002
lea edi, [esp + 0x65c]
dec edi
jmp 0x419ff0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x419ff0
mov dx, word [0x4a3f08]
mov word [edi], dx
xor eax, eax
jmp 0x41a010
mov cl, byte [esp + eax + 0x65c]
mov byte [esp + eax + 0x234], cl
inc eax
test cl, cl
jne 0x41a010
jmp 0x41a02a
mov byte [esp + 0x17], 1
lea edi, [esp + 0x234]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41a032
mov ax, word [0x4aa808]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
push ecx
mov word [edi], ax
mov byte [esp + 0x70], 7
mov byte [esp + 0x71], 2
mov word [esp + 0x72], cx
call ebx
lea edx, [esp + 0x44c]
mov esi, eax
push edx
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push esi
mov dword [esp + 0x24], edi
call ebx
cmp edi, 0xffffffff
je 0x41a333
cmp byte [esp + 0x17], 0
jne 0x41a333
lea eax, [esp + 0x234]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a0a0
sub eax, edx
mov ebx, eax
lea eax, [esp + 0x234]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a0b5
sub eax, edx
mov edi, eax
lea eax, [esp + 0x234]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a0d0
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x234]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41a0e5
sub eax, esi
dec eax
dec edi
shl eax, 0x10
dec ecx
dec ebx
and edi, 0xff0000
and ecx, 0xff00
or eax, ecx
shr ebx, 0x10
or edi, ebx
shl eax, 8
shr edi, 8
or eax, edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x74], eax
mov eax, dword [edi + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
call fcn.004539c0
lea eax, [esp + 0x234]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41a135
mov edi, dword [edi + 0x64]
sub eax, ecx
lea ecx, [eax - 1]
lea eax, [esp + 0x234]
call fcn.00453a00
test byte [esp + 0x44c], 0x10
je 0x41a18f
mov ecx, 0x4abc78
lea eax, [esp + 0x478]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a186
test dl, dl
je 0x41a182
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41a186
add eax, 2
add ecx, 2
test dl, dl
jne 0x41a166
xor eax, eax
jmp 0x41a18b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41a1c9
mov ecx, 0x4abc7c
lea eax, [esp + 0x478]
jmp 0x41a1a0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a1c0
test dl, dl
je 0x41a1bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41a1c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x41a1a0
xor eax, eax
jmp 0x41a1c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41a22a
lea ecx, [esp + 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea edx, [esp + 0x450]
push edx
lea eax, [esp + 0x874]
push eax
call fcn.00485490
mov ecx, edi
shl ecx, 0x10
mov edx, edi
and edx, 0xff00
or ecx, edx
mov eax, edi
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x64]
mov edx, edi
shr edx, 0x18
or ecx, edx
mov dword [esp + 0x80], ecx
jmp 0x41a2c0
mov ecx, 0x4abc78
lea eax, [esp + 0x478]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a256
test dl, dl
je 0x41a252
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41a256
add eax, 2
add ecx, 2
test dl, dl
jne 0x41a236
xor eax, eax
jmp 0x41a25b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a2e8
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea ecx, [esp + 0x450]
push ecx
lea edx, [esp + 0x874]
push edx
call fcn.00485490
mov eax, edi
shl eax, 0x10
mov ecx, edi
and ecx, 0xff00
or eax, ecx
mov edx, edi
sar edx, 8
shl eax, 8
and edx, 0xff00
or eax, edx
mov edx, dword [esp + 0x24]
mov ecx, edi
shr ecx, 0x18
or eax, ecx
mov dword [esp + 0x80], eax
mov eax, dword [edx + 0x64]
add esp, 0xc
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
call fcn.004539c0
mov edx, dword [esp + 0x18]
mov ecx, edi
mov edi, dword [edx + 0x64]
lea eax, [esp + 0x86c]
call fcn.00453a00
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x44c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a150
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x18]
xor eax, eax
mov word [esp + 0x6e], ax
mov dword [esp + 0x74], eax
lea esi, [eax + 0xc]
mov eax, dword [edx + 0x64]
mov cl, 7
lea ebx, [esp + 0x6c]
call fcn.004539c0
jmp 0x419545
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x64]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
mov dword [esp + 0x74], 0
call fcn.004539c0
jmp 0x419545
movzx eax, word [esp + 0x2a]
sub eax, 1
je 0x41a703
sub eax, 3
je 0x41a503
sub eax, 1
jne case.0x418ea3.2
mov eax, dword [esp + 0x30]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x209
ja case.0x418ea3.2
mov edx, dword [ebx + 0x64]
lea eax, [esp + 0x86c]
push eax
mov ecx, edi
call fcn.00453b00
test eax, eax
je case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov byte [esp + edi + 0x86c], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
lea ecx, [esp + 0x86c]
push 0x2a
push ecx
call fcn.0047e5be
add esp, 8
test eax, eax
je case.0x418ea3.2
lea ecx, [eax + 1]
lea esi, [esp + 0x44c]
sub esi, ecx
mov dl, byte [ecx]
mov byte [ecx + esi], dl
inc ecx
test dl, dl
jne 0x41a412
mov byte [eax], dl
xor ecx, ecx
mov dl, byte [esp + ecx + 0x86c]
mov byte [esp + ecx + 0x65c], dl
inc ecx
test dl, dl
jne 0x41a420
lea edx, [esp + 0x44c]
mov byte [eax], 0x2a
push edx
lea eax, [esp + 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0x40], eax
neg eax
sbb eax, eax
neg eax
dec eax
mov edx, 8
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x30]
mov word [esp + 0xca], dx
lea esi, [edx + 4]
mov edx, dword [esp + 0x18]
mov cl, 7
mov dword [esp + 0xd0], eax
mov eax, dword [edx + 0x64]
lea ebx, [esp + 0xc8]
mov byte [esp + 0xc8], cl
mov byte [esp + 0xc9], 0xb
call fcn.004539c0
mov edx, dword [esp + 0x18]
mov ecx, edi
mov edi, dword [edx + 0x64]
lea eax, [esp + 0x86c]
call fcn.00453a00
cmp dword [esp + 0x40], 0
je 0x419545
sub esp, 0x1c
lea eax, [esp + 0x468]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00407080
sub esp, 0x1c
lea edx, [esp + 0x694]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
mov byte [esp + 0xacc], 0xd
call fcn.00407080
mov byte [esp + 0xac8], 8
call fcn.00414a90
jmp 0x419545
mov eax, dword [esp + 0x30]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x418ea3.2
mov edx, dword [ebx + 0x64]
lea eax, [esp + 0x234]
push eax
mov ecx, esi
call fcn.00453b00
test eax, eax
je case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov byte [esp + esi + 0x234], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1f0]
call eax
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
lea ecx, [esp + 0x1a4]
push ecx
lea edx, [esp + 0x238]
push edx
call fcn.0047e6af
mov eax, dword [esp + 0x1b2]
add esp, 8
and eax, 0x4000
lea ecx, [esp + 0x234]
cmp eax, 0x4000
push ecx
lea ecx, [esp + 0x21c]
sete byte [esp + 0x1b]
call fcn.00407080
cmp byte [esp + 0x17], 0
mov bl, 0xb
mov byte [esp + 0xa90], bl
je 0x41a604
lea edi, [esp + 0x234]
lea esi, [esp + 0x1d4]
call fcn.004149f0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x224]
mov byte [esp + 0xa9c], 0xc
call fcn.00407110
mov ecx, esi
mov byte [esp + 0xa90], bl
call fcn.004070c0
mov edi, dword [esp + 0x22c]
lea esi, [esp + 0x234]
inc edi
call fcn.004148e0
movzx eax, al
mov dword [esp + 0x40], eax
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, 7
mov dword [esp + 0xfc], eax
mov edx, ecx
mov word [esp + 0xfa], dx
mov eax, edi
and eax, 0xff0000
mov edx, edi
shr edx, 0x10
or eax, edx
mov edx, edi
shl edx, 0x10
mov esi, edi
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x64]
mov byte [esp + 0xf9], bl
lea esi, [ecx + 5]
lea ebx, [esp + 0xf8]
mov byte [esp + 0xf8], cl
call fcn.004539c0
mov eax, dword [esp + 0x21c]
mov esi, 0x10
cmp dword [esp + 0x230], esi
jae 0x41a6a8
lea eax, [esp + 0x21c]
mov edx, dword [esp + 0x18]
mov ecx, edi
mov edi, dword [edx + 0x64]
call fcn.00453a00
cmp dword [esp + 0x40], 0
je 0x41a6ea
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x1a8]
call fcn.00407080
cmp dword [esp + 0x1bc], esi
jb 0x41a6ea
mov ecx, dword [esp + 0x1a8]
push ecx
call fcn.0047c43d
add esp, 4
lea ecx, [esp + 0x218]
mov byte [esp + 0xa90], 8
call fcn.004070c0
jmp 0x419545
mov eax, dword [esp + 0x30]
mov edi, eax
and edi, 0xff0000
mov edx, eax
mov ecx, eax
shl ecx, 0x10
shr edx, 0x10
and eax, 0xff00
or edi, edx
or ecx, eax
shr edi, 8
shl ecx, 8
or edi, ecx
cmp edi, 0x104
ja case.0x418ea3.2
lea edx, [esp + 0x234]
push edx
mov edx, dword [ebx + 0x64]
mov ecx, edi
call fcn.00453b00
test eax, eax
je case.0x418ea3.2
mov ecx, dword [ebx + 0x68]
mov byte [esp + edi + 0x234], 0
mov eax, dword [ecx]
mov edx, dword [eax + 0x1f0]
call edx
test eax, eax
je case.0x418ea3.2
cmp byte [esp + 0x17], 0
je case.0x418ea3.2
push 0
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0x40], eax
neg eax
sbb eax, eax
neg eax
dec eax
mov edx, 4
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x30]
mov word [esp + 0xd6], dx
lea esi, [edx + 8]
mov edx, dword [esp + 0x18]
mov cl, 7
mov dword [esp + 0xdc], eax
mov eax, dword [edx + 0x64]
lea ebx, [esp + 0xd4]
mov byte [esp + 0xd4], cl
mov byte [esp + 0xd5], 0xb
call fcn.004539c0
mov edx, dword [esp + 0x18]
mov ecx, edi
mov edi, dword [edx + 0x64]
lea eax, [esp + 0x234]
call fcn.00453a00
cmp dword [esp + 0x40], 0
je 0x419545
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x1a8]
call fcn.00407080
cmp dword [esp + 0x1bc], 0x10
jb 0x419545
mov ecx, dword [esp + 0x1a8]
push ecx
call fcn.0047c43d
add esp, 4
jmp 0x419545
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x311], 0
je 0x41a86b
mov byte [eax + 0x310], 1
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, dword [ebx + 0x6c]
add esi, 0x2f8
call fcn.00453e70
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x311], 0
mov eax, dword [ebx + 0x6c]
cmp byte [eax + 0x46e], 0
je case.0x418ea3.2
mov byte [eax + 0x46d], 1
mov edx, dword [ebx + 0x6c]
mov eax, dword [edx + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, dword [ebx + 0x6c]
add esi, 0x458
call fcn.00453e70
mov ecx, dword [ebx + 0x6c]
mov byte [ecx + 0x46e], 0
jmp case.0x418ea3.2
push str.._vncclient.cpp_:_Invalid_DSMPlugin_Pointer_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov ecx, dword [esp + 0xa88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret 4