Function at 0x1400896f0
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Delete registry value
Initialize winsock library
Resolve dns
Set registry value
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd80
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0xd70], rax
mov rdi, r8
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x140089750
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
cmp byte [rax + 0xd], 1
jne 0x140089779
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Warning
lea rdx, str.WIndows_XP_require_special_build
call fcn.140020f00
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x14008979b
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
cmp byte [rax + 0x11], 1
jne 0x140089801
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Unsupported_OS
lea rdx, str.Error_OS_not_supported
call fcn.140020f00
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x1400897ea
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x1400897f7
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
mov eax, 1
jmp 0x14008b94d
xor edx, edx
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rcx, str.SHCore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008984c
mov ecx, 2
call rax
jmp 0x140089863
lea rdx, str.SetProcessDPIAware
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140089863
call rax
test rsi, rsi
je 0x140089871
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14008987f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r13b, r13b
mov byte [rsp + 0x50], r13b
mov rax, qword [0x1401fdf80]
mov word [rax + 0xe2c], 0
mov ecx, 2
call fcn.140146238
mov rcx, rax
xor edx, edx
call fcn.14014cd68
xor r12d, r12d
mov qword [0x1401fb658], r12
mov r8d, 0x104
lea rdx, [rsp + 0x710]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400898e4
lea edx, [r12 + 0x5c]
lea rcx, [rsp + 0x710]
call fcn.140134588
mov byte [rax], r12b
lea r8, [rsp + 0x710]
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.14013b330
lea r8, [0x1401c3148]
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.14013b390
lea r8, str.vnclang_server.dll
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.14013b390
lea rcx, [rsp + 0x600]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
cmove rax, r15
mov qword [0x1401fb658], rax
call fcn.140088d80
mov r8d, 0x104
lea rdx, [rsp + 0x820]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400899c9
mov edx, 0x5c
lea rcx, [rsp + 0x820]
call fcn.140134588
test rax, rax
jne 0x1400899c6
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x1400899b2
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x1400899bf
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
xor eax, eax
jmp 0x14008b94d
mov byte [rax], r12b
mov r9d, 0x104
lea r8, [rsp + 0x820]
mov edx, r9d
lea rcx, [rsp + 0xa40]
call fcn.1401456fc
mov byte [rsp + 0xb43], r12b
call fcn.140076d80
mov qword [0x1401fb868], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 2
lea rdx, [rsp + 0x110]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140089a1d
mov eax, r12d
jmp 0x140089a31
movzx eax, word [rsp + 0x110]
mov word [0x14023e518], ax
mov eax, 0xffffffff
mov dword [rsp + 0x74], eax
test eax, eax
jne 0x140089a94
xor r9d, r9d
lea r8, [0x1401c9b4c]
lea rdx, [0x1401fc990]
call fcn.140020f00
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089a7f
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089a8d
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
xor eax, eax
jmp 0x14008b94d
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140089aa0
test rax, rax
je 0x140089ad9
mov rbx, rdi
movsx ecx, byte [rbx]
call fcn.1401454f4
mov byte [rbx], al
inc rbx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140089ac5
mov rax, rbx
sub rax, rdi
cmp rax, rcx
jb 0x140089ab1
mov dword [rsp + 0x70], r12d
mov rsi, r12
mov r14d, 1
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140089af0
cmp rsi, rax
jae 0x14008b84a
lea rbx, [rsi + rdi]
cmp byte [rbx], 0x20
jle 0x14008b27f
mov dword [rsp + 0x70], r14d
mov r8d, 8
lea rdx, str._inifile
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089c19
add rsi, 8
lea rcx, [rdi + 1]
add rcx, rsi
mov qword [rsp + 0x40], 0x104
lea rax, [rsp + 0x930]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rsp + 0xb50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rsp + 0xc60]
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
call fcn.14014d548
mov edx, 0x20
lea rcx, [rsp + 0x930]
call fcn.1401348b0
test rax, rax
je 0x140089ba6
mov byte [rax], 0
lea rax, [rsp + 0x930]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc60]
lea r8, [rsp + 0x4f0]
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.14014cd90
lea rcx, [rsp + 0x3e0]
call fcn.140145b50
mov qword [0x1401f29f8], rax
lea rcx, [rsp + 0x3e0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140089c05
add rsi, rax
inc rsi
jmp 0x140089ae1
mov r8d, recv
lea rdx, str._settingshelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089cae
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rdi + 0x10]
add r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.14013b330
lea rcx, [rsp + 0x2b0]
call fcn.14001ea30
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089c93
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089ca1
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._stopservicehelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089d22
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020af0
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089d07
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089d15
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, 5
lea rdx, str._kill
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089e08
lea r8, str.GlobalSessionEventUltra
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [0x1402595d0], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x1402595d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.WinVNC_Tray_Icon
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
jne 0x140089d93
mov rbx, qword [0x1401f2990]
test rbx, rbx
je 0x140089dbd
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9c42
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089ded
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089dfb
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._openhomepage
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089e8f
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.https:__www.uvnc.com
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089e74
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089e82
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, 0xa
lea rdx, str._openforum
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089f16
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.https:__forum.uvnc.com
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089efb
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089f09
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_send
lea rdx, str._startservicehelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089f8a
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020bc0
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089f6f
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089f7d
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, recv
lea rdx, str._installhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x140089ffe
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020c90
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x140089fe3
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x140089ff1
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._uninstallhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a072
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020d60
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a057
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a065
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._softwarecadhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a0e6
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018e00
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a0cb
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a0d9
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._delsoftwarecadhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a204
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x2b0], __WSAFDIsSet
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x2b4], 6
jb 0x14008a1b9
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x80], WSACleanup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
lea rax, str.runas
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x98], rax
lea rax, str._delsoftwarecad
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0xb8], r12
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a1e9
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a1f7
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._rebootsafemodehelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a278
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002aea0
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a25d
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a26b
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._rebootforcehelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a2ec
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002aa90
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a2d1
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a2df
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._securityeditorhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a360
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020e30
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a345
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a353
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, recv
lea rdx, str._securityeditor
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a45b
mov r8d, 0x104
lea rdx, [rsp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14008a3c5
mov edx, 0x5c
lea rcx, [rsp + 0x2b0]
call fcn.140134588
mov byte [rax], 0
lea r8, str._authSSP.dll
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.14013b390
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14008a410
lea rdx, str.vncEditSecurity
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rdx, qword [0x1401fb868]
xor ecx, ecx
call rdi
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a440
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a44e
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, 9
lea rdx, str._settings
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a4e5
lea r8, [rdi + 0xa]
add r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.14013b330
lea rcx, [rsp + 0x2b0]
call fcn.14001eb50
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a4ca
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a4d8
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._dsmpluginhelper
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a61e
lea r8, [rdi + 0x11]
add r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.14013b330
lea r8, str.__dsmplugininstance
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.14013b330
lea r8, [rsp + 0x2b0]
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.14013b390
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x80], WSACleanup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
lea rax, str.runas
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], r12d
mov qword [rsp + 0xb8], r12
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a603
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a611
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._dsmplugininstance
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a6a8
lea r8, [rdi + 0x13]
add r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.14013b330
lea rcx, [rsp + 0x2b0]
call fcn.140080360
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a68d
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a69b
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x1401971d8]
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a7ce
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14008a783
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.System
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008a775
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a7b3
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a7c1
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, recv
lea rdx, [0x140197170]
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a8d4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14008a889
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.System
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008a87b
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a8b9
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a8c7
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, recv
lea rdx, [0x1401970a0]
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008a93d
call fcn.14002ab30
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008a922
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008a930
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x140197220]
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008aa47
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14008a9fc
lea r8, [rsp + 0xf4]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [rsp + 0xf0], r14d
mov dword [rsp + 0xfc], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0xf0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14008a9fc
mov dword [rsp + 0x2b0], __WSAFDIsSet
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edx, edx
cmp dword [rsp + 0x2b4], 6
lea ecx, [rdx + 0x12]
jb 0x14008a9f6
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008aa2c
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008aa3a
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str._stopservice
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008aadb
lea r9, [0x1401efc50]
lea r8, str.net_stop___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021bf0
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008aac0
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008aace
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._startservice
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008ab6f
lea r9, [0x1401efc50]
lea r8, str.net_start___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021bf0
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008ab54
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008ab62
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, recv
lea rdx, str._installdriver
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008abda
mov cl, 1
call fcn.140033690
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008abbf
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008abcd
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, 8
lea rdx, str._install
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008aca8
movzx eax, byte [rbx]
test al, al
je 0x14008ac1a
nop
movzx ecx, al
call fcn.14014d120
test eax, eax
jne 0x14008ad9d
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008ac00
lea rdi, [0x1401efc50]
call fcn.14002a5c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, rdi
lea r8, str.net_start___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021bf0
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008ac8d
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008ac9b
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, 0xa
lea rdx, str._uninstall
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008ad6d
movzx eax, byte [rbx]
test al, al
je 0x14008acea
nop dword [rax]
movzx ecx, al
call fcn.14014d120
test eax, eax
jne 0x14008ae36
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008acd0
lea rdi, [0x1401efc50]
mov r9, rdi
lea r8, str.net_stop___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021bf0
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14002a8f0
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008ad52
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008ad60
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str._preconnect
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008aecf
add rsi, 0xb
mov byte [0x1401f2eda], 1
inc rsi
jmp 0x140089ae1
movzx eax, byte [rbx]
test al, al
je 0x14008ac1a
movzx ecx, al
call fcn.14014d120
test eax, eax
je 0x14008adc3
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008ada8
jmp 0x14008ac1a
movzx eax, byte [rbx]
test al, al
je 0x14008ac1a
cmp al, 0x22
jne 0x14008adde
inc rbx
cmp byte [rbx], 0
je 0x14008ac1a
mov edx, 0x22
mov rcx, rbx
call fcn.140134588
test rax, rax
je 0x14008adf3
mov byte [rax], 0
cmp byte [rbx], 0
je 0x14008ac1a
lea rdi, [0x1401efc50]
mov rdx, rdi
mov rcx, rbx
call fcn.140145828
test eax, eax
je 0x14008ac21
mov r9d, 0x100
mov r8, rbx
mov edx, r9d
mov rcx, rdi
call fcn.1401456fc
mov byte [0x1401efd4f], 0
jmp 0x14008ac21
movzx eax, byte [rbx]
test al, al
je 0x14008acea
movzx ecx, al
call fcn.14014d120
test eax, eax
je 0x14008ae5c
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008ae41
jmp 0x14008acea
movzx eax, byte [rbx]
test al, al
je 0x14008acea
cmp al, 0x22
jne 0x14008ae77
inc rbx
cmp byte [rbx], 0
je 0x14008acea
mov edx, 0x22
mov rcx, rbx
call fcn.140134588
test rax, rax
je 0x14008ae8c
mov byte [rax], 0
cmp byte [rbx], 0
je 0x14008acea
lea rdi, [0x1401efc50]
mov rdx, rdi
mov rcx, rbx
call fcn.140145828
test eax, eax
je 0x14008acf1
mov r9d, 0x100
mov r8, rbx
mov edx, r9d
mov rcx, rdi
call fcn.1401456fc
mov byte [0x1401efd4f], 0
jmp 0x14008acf1
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str._service_run
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008af38
mov rcx, r15
call fcn.140089380
test al, al
jne 0x14008af0b
xor ecx, ecx
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov rax, qword [0x1401fdf80]
mov dword [rax + 0xe20], r14d
call fcn.14008be40
test eax, eax
setne cl
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._service_rdp_run
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008afa8
mov rcx, r15
call fcn.140089380
test al, al
jne 0x14008af74
xor ecx, ecx
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov rax, qword [0x1401fdf80]
mov dword [rax + 0xe20], r14d
mov dword [rax + 0xe24], r14d
call fcn.14008be40
test eax, eax
setne cl
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov r8d, 8
lea rdx, str._service
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b028
mov r8, rdi
mov edx, 0x100
lea rcx, [0x1401f2b60]
call fcn.14013b330
lea rdi, [0x1401efc50]
mov qword [rsp + 0xf0], rdi
lea rax, [0x140029f20]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], r12
mov qword [rsp + 0x108], r12
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor ecx, ecx
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov r8d, 4
lea rdx, str._run
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b083
mov rcx, r15
call fcn.140089380
test al, al
jne 0x14008b064
xor ecx, ecx
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
call fcn.14008be40
test eax, eax
setne cl
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
mov r8d, 8
lea rdx, str._sc_exit
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b0b6
mov rax, qword [0x1401fdf80]
mov byte [rax + 0xe2c], 1
add rsi, 8
inc rsi
jmp 0x140089ae1
mov r8d, 0xa
lea rdx, str._sc_prompt
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b0e9
mov rax, qword [0x1401fdf80]
mov byte [rax + 0xe2d], 1
add rsi, 0xa
inc rsi
jmp 0x140089ae1
mov r8d, 6
lea rdx, str._multi
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b115
mov byte [0x1401f2922], 1
add rsi, 6
inc rsi
jmp 0x140089ae1
mov r8d, recv
lea rdx, str._stopreconnect
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b15a
add rsi, 0xe
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x1401fdf5c]
call fcn.1400214b0
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x1401fdf7c]
call fcn.1400214b0
inc rsi
jmp 0x140089ae1
mov r8d, recv
lea rdx, str._autoreconnect
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b28e
add rsi, 0xe
mov byte [rsp + 0x50], 1
mov r15, r12
mov rbx, rsi
movzx eax, byte [rsi + rdi]
cmp al, 0x20
jg 0x14008b19f
nop
test al, al
je 0x14008b19f
inc rbx
movzx eax, byte [rbx + rdi]
cmp al, 0x20
jle 0x14008b190
lea r13, [rbx + rdi]
mov r8d, 3
lea rdx, [0x140196e5c]
mov rcx, r13
call fcn.140144b40
test eax, eax
jne 0x14008b204
mov rsi, rbx
cmp byte [r13], 0x20
jle 0x14008b1cf
inc rsi
cmp byte [rsi + rdi], 0x20
jg 0x14008b1c6
mov r14, rsi
sub r14, rbx
je 0x14008b204
lea rcx, [r14 + 1]
call fcn.14013268c
mov rbx, rax
mov r9, r14
mov r8, r13
lea rdx, [r14 + 1]
mov rcx, rax
call fcn.1401456fc
mov byte [r14 + rbx], r15b
mov rcx, rbx
call fcn.14014606c
mov r15, rax
movzx eax, r12w
test r15, r15
je 0x14008b216
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx r8d, ax
xor edx, edx
mov ecx, dword [0x1401fdf64]
call fcn.1400214b0
test eax, eax
jne 0x14008b287
mov byte [0x1401fb441], 1
test r15, r15
jne 0x14008b258
mov byte [0x1401fb9dc], 1
mov byte [0x1401fb441], r15b
movzx r13d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
mov r8, r15
mov edx, setsockopt
lea rcx, [0x1401fb9c8]
call fcn.14013b330
mov rcx, r15
call fcn.140132640
movzx r13d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
test r15, r15
je 0x14008b274
jmp 0x14008b26c
mov r8d, 4
lea rdx, str._id:
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b382
inc rsi
mov r14, r12
mov rbx, rsi
lea r13, [rsi + rdi]
cmp byte [r13], 0x20
jle 0x14008b2c9
nop
inc rbx
cmp byte [rbx + rdi], 0x20
jg 0x14008b2c0
mov r15, rbx
sub r15, rsi
je 0x14008b2fe
lea rcx, [r15 + 1]
call fcn.14013268c
mov rsi, rax
mov r9, r15
mov r8, r13
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.1401456fc
mov byte [r15 + rsi], r14b
mov rcx, rsi
call fcn.14014606c
mov r14, rax
mov rsi, rbx
movzx eax, r12w
test r14, r14
je 0x14008b313
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx r8d, ax
xor edx, edx
mov ecx, dword [0x1401fdf70]
call fcn.1400214b0
test eax, eax
jne 0x14008b371
mov byte [0x1401fb9df], 1
test r14, r14
jne 0x14008b355
mov byte [0x1401fb9dd], 1
mov byte [0x1401fb9df], r14b
movzx r13d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
mov r8, r14
mov edx, setsockopt
lea rcx, [0x1401fb9c8]
call fcn.14013b330
mov rcx, r14
jmp 0x14008b26f
test r14, r14
je 0x14008b274
mov rcx, r14
jmp 0x14008b26f
mov r8d, 8
lea rdx, str._connect
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b6a7
test r13b, r13b
jne 0x14008b3b4
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x1401fdf5c]
call fcn.1400214b0
add rsi, 8
mov rbx, rsi
movzx eax, byte [rsi + rdi]
cmp al, 0x20
jg 0x14008b3d2
test al, al
je 0x14008b3d2
inc rbx
movzx eax, byte [rbx + rdi]
cmp al, 0x20
jle 0x14008b3c3
mov r15, rbx
lea rax, [rbx + rdi]
cmp byte [rax], 0x20
jle 0x14008b3ea
nop
inc r15
cmp byte [r15 + rdi], 0x20
jg 0x14008b3e0
mov r14, r15
sub r14, rbx
je 0x14008b643
lea r13, [r14 + 1]
mov rcx, r13
call fcn.14013268c
mov rsi, rax
mov rcx, r13
call fcn.14013268c
mov qword [rsp + 0xf0], rax
mov r9, r14
lea r8, [rbx + rdi]
mov rdx, r13
mov rcx, rsi
call fcn.1401456fc
mov rax, rsi
sub rax, rbx
mov byte [rax + r15], 0
mov r8, rsi
mov rdx, r13
mov rcx, qword [rsp + 0xf0]
call fcn.14013b330
mov edx, 0x5b
mov rcx, rsi
call fcn.1401348b0
mov r14, rax
mov edx, 0x5d
mov rcx, rsi
call fcn.1401348b0
mov rbx, rax
test r14, r14
je 0x14008b4a8
test rax, rax
je 0x14008b4a8
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x14008b476
lea r8, [rax + 1]
mov rdx, r13
mov rcx, qword [rsp + 0xf0]
call fcn.1401456fc
mov byte [rbx], 0
lea r8, [r14 + 1]
mov rdx, r13
mov rcx, rsi
call fcn.14013b330
jmp 0x14008b4bd
mov edx, 0x3a
mov rcx, rsi
call fcn.1401348b0
test rax, rax
je 0x14008b4bd
mov byte [rax], 0
mov edx, 0x3a
mov r14d, 0x157c
mov rbx, qword [rsp + 0xf0]
mov rcx, rbx
call fcn.1401348b0
test rax, rax
je 0x14008b4f6
mov byte [rax], 0
cmp byte [rax + 1], 0x3a
lea rcx, [rax + 2]
je 0x14008b4ee
lea rcx, [rax + 1]
call fcn.140144ee0
mov r14d, eax
mov rcx, rbx
call fcn.140132640
mov dword [rsp + 0x20], r14d
mov r9, rsi
lea r8, str.WinMain_:_test...__s__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r8, rsi
mov edx, 0xff
lea rcx, [0x1401fcbe0]
call fcn.14013b330
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
mov eax, 0xffffffff
cmp ebx, eax
jne 0x14008b567
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14008b604
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
test rcx, rcx
je 0x14008b604
mov ebx, dword [rcx]
mov rcx, rsi
call fcn.140132640
test ebx, ebx
je 0x14008b60c
lea r8, str.WinMain_:_PostAddNewClient_III__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
movzx esi, r14w
mov r8d, ebx
mov edx, esi
mov ecx, dword [0x1401fdf60]
call fcn.1400214b0
test eax, eax
jne 0x14008b5ee
lea r8, str.postHelper::PostAddNewClientInit_:_PostAddNewClient_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov edx, 0x457
cmp si, dx
jne 0x14008b5da
movzx eax, byte [0x1401f2921]
cmp ebx, edx
mov ecx, 1
cmove eax, ecx
mov byte [0x1401f2921], al
mov byte [0x1401fb442], 1
mov dword [0x1401fb444], r14d
mov dword [0x1401fb8fc], ebx
mov rsi, r15
movzx r13d, byte [rsp + 0x50]
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
mov rcx, rsi
call fcn.140132640
mov byte [0x1401fb442], 1
mov dword [0x1401fb444], r12d
mov dword [0x1401fb8fc], r12d
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1400896a0
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008b94d
lea r8, str.WinMain_:_PostAddNewClient_IIII_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x1401fdf6c]
call fcn.1400214b0
test eax, eax
jne 0x14008b27a
lea r8, str.postHelper::PostAddNewClient_:_PostAddNewClient_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov byte [0x1401fb442], 1
mov dword [0x1401fb444], r12d
mov dword [0x1401fb8fc], r12d
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
mov r8d, 9
lea rdx, str._repeater
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x14008b79e
add rsi, 9
mov rcx, rsi
movzx eax, byte [rsi + rdi]
cmp al, 0x20
jg 0x14008b6e2
test al, al
je 0x14008b6e2
inc rcx
movzx eax, byte [rcx + rdi]
cmp al, 0x20
jle 0x14008b6d3
mov rbx, rcx
lea r15, [rcx + rdi]
cmp byte [r15], 0x20
jle 0x14008b6f9
nop
inc rbx
cmp byte [rbx + rdi], 0x20
jg 0x14008b6f0
mov r14, rbx
sub r14, rcx
je 0x14008b27a
mov rcx, qword [0x1401fbb28]
test rcx, rcx
je 0x14008b71d
call fcn.140132640
mov qword [0x1401fbb28], r12
lea rcx, [r14 + 1]
call fcn.14013268c
mov qword [0x1401fbb28], rax
mov r9, r14
mov r8, r15
lea rdx, [r14 + 1]
mov rcx, rax
call fcn.1401456fc
mov rax, qword [0x1401fbb28]
mov byte [r14 + rax], 0
lea r8, str.WinMain_:_PostAddNewRepeaterClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov eax, 0xffffffff
mov r8d, eax
mov edx, eax
mov ecx, dword [0x1401fdf6c]
call fcn.1400214b0
test eax, eax
jne 0x14008b78e
mov byte [0x1401fb443], 1
mov dword [0x1401fb444], r12d
mov dword [0x1401fb8fc], r12d
mov rsi, rbx
mov r15, qword [rsp + 0x60]
inc rsi
jmp 0x140089ae1
mov rax, qword [0x1401fdf80]
cmp dword [rax + 0xe20], 0
je 0x14008b829
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14008b901
test rax, rax
je 0x14008b901
cmp rax, rbx
je 0x14008b901
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov r9d, 0x40
lea r8, [0x1401fc610]
lea rdx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008b901
mov r9d, 0x40
lea r8, [0x1401fc610]
lea rdx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14008b901
cmp dword [rsp + 0x70], 0
jne 0x14008b901
mov rcx, r15
call fcn.140089380
test al, al
jne 0x14008b8ac
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008b891
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008b89f
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008b94d
call fcn.14008be40
mov ebx, eax
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008b8e3
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008b8f0
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
test ebx, ebx
setne r12b
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, r12d
jmp 0x14008b94d
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rax, qword [0x1401f2b48]
test rax, rax
jne 0x14008b938
mov ecx, 0x1134
call fcn.140132648
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140027740
nop
mov qword [0x1401f2b48], rax
test rax, rax
je 0x14008b945
mov edx, 0x1134
mov rcx, rax
call fcn.140132684
xor eax, eax
jmp 0x14008b94d
mov rcx, qword [rsp + 0xd70]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0xd80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret