Function at 0x48fba0
Capabilities:
Check for foreground window switch
Check os version
Delete registry value
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559a52
mov eax, dword fs:[0]
push eax
sub esp, 0xe20
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
cmp byte [0x5c3db8], 0
mov dword [ebp - 0xdf0], eax
mov dword [ebp - 0xdc8], ecx
mov dword [0x5c3dbc], 2
mov byte [0x5c3db9], 0
jne 0x48fc09
call fcn.0047c430
mov byte [0x5c3dba], 0
mov dword [0x5c3dc0], 0xa
call fcn.0047bac0
mov eax, dword [0x5cf18c]
test eax, eax
jne 0x48fc4c
push 0x20
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00484690
mov byte [ebp - 4], 0
mov dword [0x5cf18c], eax
mov ecx, eax
cmp byte [ecx + 9], 1
jne 0x48fc6d
push 0x10
push str.Warning
mov edx, str.WIndows_XP_require_special_build
call fcn.00425f30
mov eax, dword [0x5cf18c]
add esp, 8
test eax, eax
jne 0x48fc95
push 0x20
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00484690
mov byte [ebp - 4], 0
mov dword [0x5cf18c], eax
cmp byte [eax + 0xd], 1
jne 0x48fcf7
push 0x10
push str.Unsupported_OS
mov edx, str.Error_OS_not_supported
call fcn.00425f30
mov eax, dword [0x5c66bc]
add esp, 8
test eax, eax
jne 0x48fcdf
push 0x1134
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0042b8e0
mov dword [0x5c66bc], eax
test eax, eax
je 0x48fced
push 0x1134
push eax
call fcn.005247a6
add esp, 8
mov eax, 1
jmp 0x492206
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call edi
push str.SHCore.dll
mov esi, eax
call edi
mov edi, eax
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48fd32
push 2
call eax
jmp 0x48fd44
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48fd44
call eax
test esi, esi
je 0x48fd4f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x48fd5a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x5d1914]
push 0
push 2
mov byte [ebp - 0xde5], 0
mov word [eax + 0xe2c], 0
call fcn.005359d0
add esp, 4
push eax
call fcn.0053c4fd
add esp, 8
mov dword [0x5d0700], 0
lea eax, [ebp - 0x548]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48fdba
lea eax, [ebp - 0x548]
push 0x5c
push eax
call fcn.00525fd0
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x340]
push 0x104
push eax
call fcn.0052c1a3
push 0x5a7330
lea eax, [ebp - 0x340]
push 0x104
push eax
call fcn.0052c1fd
push str.vnclang_server.dll
lea eax, [ebp - 0x340]
push 0x104
push eax
call fcn.0052c1fd
add esp, 0x24
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [ebp - 0xdf0]
mov dword [0x5d0700], eax
test eax, eax
jne 0x48fe23
mov dword [0x5d0700], esi
call fcn.0048f4a0
push 0x104
lea eax, [ebp - 0x64c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48fe58
lea eax, [ebp - 0x64c]
push 0x5c
push eax
call fcn.00525fd0
add esp, 8
test eax, eax
je 0x48feb7
mov byte [eax], 0
push 0x104
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x854]
push 0x104
push eax
call fcn.00534cfe
add esp, 0x10
mov byte [ebp - 0x751], 0
mov dword [0x5d07c8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0xde0]
call fcn.0048e3a0
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0xde0]
test esi, esi
jne 0x48fec6
push esi
push 0x5adfa8
mov edx, 0x5d04f0
call fcn.00425f30
add esp, 8
xor cl, cl
call fcn.0048fb20
movzx eax, al
jmp 0x492206
mov ecx, dword [ebp - 0xdc8]
xor edi, edi
mov edx, ecx
mov dword [ebp - 0xde4], ecx
mov dword [ebp - 0xdec], ecx
lea eax, [edx + 1]
mov dword [ebp - 0xddc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x48fee5
sub edx, dword [ebp - 0xddc]
je 0x48ff11
mov edx, ecx
inc edi
lea eax, [edx + 1]
mov dword [ebp - 0xddc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x48ff00
sub edx, dword [ebp - 0xddc]
cmp edi, edx
jb 0x48fef4
mov dword [ebp - 0xddc], 0
xor edi, edi
mov edx, ecx
mov dword [ebp - 0xdcc], edi
lea eax, [edx + 1]
mov dword [ebp - 0xdbc], eax
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x48ff30
sub edx, dword [ebp - 0xdbc]
cmp edi, edx
jae 0x492140
add edi, ecx
cmp byte [edi], 0x20
jle 0x492134
push 8
push str._inifile
push edi
mov dword [ebp - 0xddc], 1
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490037
mov edi, dword [ebp - 0xdcc]
lea eax, [ebp - 0x118]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0x958]
add edi, 8
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0xdc8]
inc eax
add eax, edi
push eax
call fcn.0053c961
lea eax, [ebp - 0x118]
push 0x20
push eax
call fcn.00526380
add esp, 0x2c
test eax, eax
je 0x48ffd2
mov byte [eax], 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x958]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x750]
push 0x104
push eax
call fcn.0053c72f
lea eax, [ebp - 0x750]
push eax
call fcn.00535058
lea ecx, [ebp - 0x750]
mov dword [0x5c6588], eax
add esp, 0x1c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x490020
sub ecx, edx
add edi, ecx
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
push 0xf
push str._settingshelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4900a3
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add eax, 0xf
inc ecx
add eax, ecx
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.004241d0
xor cl, cl
call fcn.0048fb20
movzx edi, al
test esi, esi
je 0x49009c
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
jmp 0x492206
push 0x12
push str._stopservicehelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4900c9
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425b70
jmp 0x490088
push 5
push str._kill
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490158
push str.GlobalSessionEventUltra
push eax
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x60d118], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x60d118]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xde4], eax
test eax, eax
jne 0x490130
mov eax, dword [0x5c6510]
mov dword [ebp - 0xde4], eax
test eax, eax
je 0x490088
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push eax
call edi
push 0
push 0
push 0x10
push dword [ebp - 0xde4]
call edi
jmp 0x490088
push 0xd
push str._openhomepage
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490186
push 1
push eax
push eax
push str.https:__www.uvnc.com
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x490088
push 0xa
push str._openforum
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4901b4
push 1
push eax
push eax
push str.https:__forum.uvnc.com
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x490088
push 0x13
push str._startservicehelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4901dd
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425c30
jmp 0x490088
push 0xe
push str._installhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490206
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425cf0
jmp 0x490088
push 0x10
push str._uninstallhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49022f
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425db0
jmp 0x490088
push 0x12
push str._softwarecadhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490258
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041de10
jmp 0x490088
push 0x15
push str._delsoftwarecadhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490323
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
jb 0x490088
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xe2c], 0x3c
mov dword [ebp - 0xe28], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xe24], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0xe1c], eax
mov dword [ebp - 0xe18], str._delsoftwarecad
mov dword [ebp - 0xe10], 1
lea eax, [ebp - 0xe2c]
mov dword [ebp - 0xe14], 0
push eax
mov dword [ebp - 0xe20], str.runas
mov dword [ebp - 0xe0c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x490088
push 0x15
push str._rebootsafemodehelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49034c
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00433cf0
jmp 0x490088
push 0x12
push str._rebootforcehelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490375
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00433c50
jmp 0x490088
push 0x15
push str._securityeditorhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49039e
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425e70
jmp 0x490088
push 0xf
push str._securityeditor
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49044c
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4903f8
lea eax, [ebp - 0x118]
push 0x5c
push eax
call fcn.00525fd0
push str._authSSP.dll
push 0x104
mov byte [eax], 0
lea eax, [ebp - 0x118]
push eax
call fcn.0052c1fd
add esp, 0x14
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x490088
push str.vncEditSecurity
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [ebp - 0xddc], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x5d07c8]
push 0
call dword [ebp - 0xddc]
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x490088
push 9
push str._settings
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490497
mov eax, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add eax, 9
inc ecx
add eax, ecx
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.004242e0
jmp 0x490088
push 0x10
push str._dsmpluginhelper
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49055f
mov eax, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add eax, 0x10
inc ecx
add eax, ecx
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0052c1a3
push str.__dsmplugininstance
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0052c1a3
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0052c1fd
add esp, 0x24
lea eax, [ebp - 0x444]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xe2c], 0x3c
mov dword [ebp - 0xe28], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xe24], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0xe1c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0xe18], eax
mov dword [ebp - 0xe10], 0
jmp 0x4902f3
push 0x12
push str._dsmplugininstance
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4905aa
mov eax, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add eax, 0x12
inc ecx
add eax, ecx
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.00487a70
jmp 0x490088
push 0xc
push 0x57b9b0
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49066c
lea eax, [ebp - 0xdc0]
push eax
lea eax, [ebp - 0xdc4]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x490088
lea eax, [ebp - 0xde4]
push eax
push 0x2001f
push 0
push str.System
push dword [ebp - 0xdc4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x490629
push dword [ebp - 0xdc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x490088
push 4
lea eax, [ebp - 0xddc]
mov dword [ebp - 0xddc], 1
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 0xde4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xde4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xdc4]
call edi
jmp 0x490088
push 0xf
push 0x57b94c
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4906fd
lea eax, [ebp - 0xdc0]
push eax
lea eax, [ebp - 0xdc4]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x490088
lea eax, [ebp - 0xde4]
push eax
push 0x2001f
push 0
push str.System
push dword [ebp - 0xdc4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4906e7
push dword [ebp - 0xdc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x490088
push str.SoftwareSASGeneration
push dword [ebp - 0xde4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x490651
push 0xf
push 0x57b8a0
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490813
push str.uvnc_service
push 0x5abd30
push str.SYSTEMCurrentControlSetControlSafeBoot_s_s
mov dword [ebp - 0xddc], eax
lea eax, [ebp - 0xd58]
push 0x400
push eax
call fcn.004359f0
add esp, 0x14
lea eax, [ebp - 0xddc]
push eax
lea eax, [ebp - 0xde4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0xd58]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x490088
push 8
push str.Service
push 1
push eax
push eax
push dword [ebp - 0xde4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xde4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004338c0
lea eax, [ebp - 0xddc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x490088
lea eax, [ebp - 0xd64]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0xd68]
mov dword [ebp - 0xd68], 1
push eax
push 0
push dword [ebp - 0xddc]
mov dword [ebp - 0xd5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x490088
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x490088
push 0xc
push 0x57b9e4
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4908d0
lea eax, [ebp - 0xddc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x490088
lea eax, [ebp - 0xd64]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0xd68]
mov dword [ebp - 0xd68], 1
push eax
push 0
push dword [ebp - 0xddc]
mov dword [ebp - 0xd5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x490088
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
push 0
jae 0x4908c3
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x490088
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x490088
push 0xc
push str._stopservice
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490916
push str.uvnc_service
push str.net_stop___s_
lea eax, [ebp - 0x23c]
push 0x124
push eax
call fcn.00426d30
add esp, 0x10
lea eax, [ebp - 0x23c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x490088
push 0xd
push str._startservice
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490936
push str.uvnc_service
push str.net_start___s_
jmp 0x4908ee
push 0xe
push str._installdriver
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490956
mov cl, 1
call fcn.0043b4b0
jmp 0x490088
push 8
push str._install
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490a54
mov al, byte [edi]
test al, al
je 0x490a12
nop dword [eax + eax]
movzx eax, al
push eax
call fcn.005353a0
add esp, 4
test eax, eax
jne 0x49099a
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x490980
jmp 0x490a12
mov al, byte [edi]
test al, al
je 0x490a12
movzx eax, al
push eax
call fcn.005353a0
add esp, 4
test eax, eax
je 0x4909ba
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4909a0
jmp 0x490a12
mov al, byte [edi]
test al, al
je 0x490a12
cmp al, 0x22
jne 0x4909ca
inc edi
cmp byte [edi], 0
je 0x490a12
push 0x22
push edi
call fcn.00525fd0
add esp, 8
test eax, eax
je 0x4909dc
mov byte [eax], 0
cmp byte [edi], 0
je 0x490a12
push str.uvnc_service
push edi
call fcn.00534d42
add esp, 8
test eax, eax
je 0x490a12
push 0x100
push edi
push 0x100
push str.uvnc_service
call fcn.00534cfe
add esp, 0x10
mov byte [0x5c3c07], 0
call fcn.00433440
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
lea eax, [ebp - 0xa7c]
push 0x124
push eax
call fcn.00426d30
add esp, 0x10
lea eax, [ebp - 0xa7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x490088
push 0xa
push str._uninstall
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490b3f
mov al, byte [edi]
test al, al
je 0x490b08
movzx eax, al
push eax
call fcn.005353a0
add esp, 4
test eax, eax
jne 0x490a90
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x490a76
jmp 0x490b08
mov al, byte [edi]
test al, al
je 0x490b08
movzx eax, al
push eax
call fcn.005353a0
add esp, 4
test eax, eax
je 0x490ab0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x490a96
jmp 0x490b08
mov al, byte [edi]
test al, al
je 0x490b08
cmp al, 0x22
jne 0x490ac0
inc edi
cmp byte [edi], 0
je 0x490b08
push 0x22
push edi
call fcn.00525fd0
add esp, 8
test eax, eax
je 0x490ad2
mov byte [eax], 0
cmp byte [edi], 0
je 0x490b08
push str.uvnc_service
push edi
call fcn.00534d42
add esp, 8
test eax, eax
je 0x490b08
push 0x100
push edi
push 0x100
push str.uvnc_service
call fcn.00534cfe
add esp, 0x10
mov byte [0x5c3c07], 0
push str.uvnc_service
push str.net_stop___s_
lea eax, [ebp - 0xa7c]
push 0x124
push eax
call fcn.00426d30
add esp, 0x10
lea eax, [ebp - 0xa7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.00433710
jmp 0x490088
push 0xb
push str._preconnect
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490b6f
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 0xb
mov byte [0x5c6497], 1
inc edi
jmp 0x48ff1d
push 0xc
push str._service_run
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490bb4
mov ecx, dword [ebp - 0xdf0]
call fcn.0048f820
test al, al
je 0x490088
mov eax, dword [0x5d1914]
mov dword [eax + 0xe20], 1
call fcn.00492690
test eax, eax
setne cl
jmp 0x49008a
push 0x10
push str._service_rdp_run
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490c03
mov ecx, dword [ebp - 0xdf0]
call fcn.0048f820
test al, al
je 0x490088
mov eax, dword [0x5d1914]
mov dword [eax + 0xe20], 1
mov dword [eax + 0xe24], 1
call fcn.00492690
test eax, eax
setne cl
jmp 0x49008a
push 8
push str._service
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490c27
mov ecx, dword [ebp - 0xdc8]
call fcn.004333f0
jmp 0x490088
push 4
push str._run
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490c53
mov ecx, dword [ebp - 0xdf0]
call fcn.0048f820
test al, al
jne 0x490ba5
jmp 0x490088
push 8
push str._sc_exit
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490c88
mov eax, dword [0x5d1914]
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 8
inc edi
mov byte [eax + 0xe2c], 1
jmp 0x48ff1d
push 0xa
push str._sc_prompt
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490cbd
mov eax, dword [0x5d1914]
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 0xa
inc edi
mov byte [eax + 0xe2d], 1
jmp 0x48ff1d
push 6
push str._multi
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490ced
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 6
mov byte [0x5c6482], 1
inc edi
jmp 0x48ff1d
push 0xe
push str._stopreconnect
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490d1b
mov edi, dword [ebp - 0xdcc]
add edi, 0xe
call fcn.004264a0
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
push 0xe
push str._autoreconnect
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490e88
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 0xe
mov dword [ebp - 0xdcc], eax
mov eax, edi
mov byte [ebp - 0xde5], 1
mov dword [ebp - 0xdd0], eax
mov dl, byte [edi + ecx]
cmp dl, 0x20
jg 0x490d74
nop
test dl, dl
je 0x490d74
mov dl, byte [eax + ecx + 1]
inc eax
mov dword [ebp - 0xdd0], eax
cmp dl, 0x20
jle 0x490d60
push 3
add eax, ecx
push 0x57b6d8
push eax
mov dword [ebp - 0xdc4], eax
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490e10
mov eax, dword [ebp - 0xdc4]
mov ecx, dword [ebp - 0xdd0]
mov edi, ecx
cmp byte [eax], 0x20
jle 0x490db7
mov eax, dword [ebp - 0xdec]
nop dword [eax]
inc edi
cmp byte [eax + edi], 0x20
jg 0x490db0
mov eax, edi
sub eax, ecx
mov dword [ebp - 0xdd0], eax
je 0x490e10
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov dword [ebp - 0xdd4], eax
push dword [ebp - 0xdd0]
push dword [ebp - 0xdc4]
push dword [ebp - 0xdbc]
push eax
call fcn.00534cfe
mov ecx, dword [ebp - 0xdd4]
mov eax, dword [ebp - 0xdd0]
push ecx
mov byte [ecx + eax], 0
call fcn.00535875
add esp, 0x14
mov dword [ebp - 0xdcc], eax
mov ecx, dword [ebp - 0xdcc]
call fcn.00426330
test eax, eax
mov eax, dword [ebp - 0xdcc]
jne 0x490e6f
mov byte [0x5c64ae], 1
test eax, eax
jne 0x490e48
mov ecx, dword [ebp - 0xdc8]
inc edi
mov byte [0x5c64bd], 1
mov byte [0x5c64ae], al
jmp 0x48ff1d
push eax
push 0x14
push 0x5cfca8
call fcn.0052c1a3
push dword [ebp - 0xdcc]
call fcn.00524771
add esp, 0x10
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
test eax, eax
je 0x490e63
push eax
call fcn.00524771
mov ecx, dword [ebp - 0xdc8]
add esp, 4
inc edi
jmp 0x48ff1d
push 4
push str._id:
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x490f93
mov eax, dword [ebp - 0xdcc]
xor edx, edx
mov ecx, dword [ebp - 0xdc8]
inc eax
add ecx, eax
mov dword [ebp - 0xdd4], edx
mov edi, eax
mov dword [ebp - 0xdbc], ecx
cmp byte [ecx], 0x20
jle 0x490ed7
mov ecx, dword [ebp - 0xdec]
nop word [eax + eax]
inc edi
cmp byte [ecx + edi], 0x20
jg 0x490ed0
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0xdd0], ecx
je 0x490f34
lea eax, [ecx + 1]
push eax
mov dword [ebp - 0xdc4], eax
call fcn.005247b4
add esp, 4
mov dword [ebp - 0xdd4], eax
push dword [ebp - 0xdd0]
push dword [ebp - 0xdbc]
push dword [ebp - 0xdc4]
push eax
call fcn.00534cfe
mov ecx, dword [ebp - 0xdd4]
mov eax, dword [ebp - 0xdd0]
push ecx
mov byte [ecx + eax], 0
call fcn.00535875
add esp, 0x14
mov dword [ebp - 0xdd4], eax
mov edx, eax
mov ecx, edx
call fcn.00426620
test eax, eax
mov eax, dword [ebp - 0xdd4]
jne 0x490e6f
mov byte [0x5c64d4], 1
test eax, eax
jne 0x490f6c
mov ecx, dword [ebp - 0xdc8]
inc edi
mov byte [0x5c64be], 1
mov byte [0x5c64d4], al
jmp 0x48ff1d
push eax
push 0x14
push 0x5cfca8
call fcn.0052c1a3
push dword [ebp - 0xdd4]
call fcn.00524771
mov ecx, dword [ebp - 0xdc8]
add esp, 0x10
inc edi
jmp 0x48ff1d
push 8
push str._connect
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4912a4
cmp byte [ebp - 0xde5], al
jne 0x490fb8
call fcn.00426440
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 8
mov edx, edi
mov dword [ebp - 0xdbc], edx
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x490fe9
test al, al
je 0x490fe9
mov al, byte [edx + ecx + 1]
inc edx
mov dword [ebp - 0xdbc], edx
cmp al, 0x20
jle 0x490fd6
cmp byte [edx + ecx], 0x20
lea eax, [edx + ecx]
mov dword [ebp - 0xdd0], edx
mov dword [ebp - 0xdc0], eax
jle 0x49101f
mov eax, dword [ebp - 0xdec]
mov ecx, edx
nop word [eax + eax]
inc ecx
mov dword [ebp - 0xdd0], ecx
cmp byte [eax + ecx], 0x20
jg 0x491010
jmp 0x491021
mov ecx, edx
mov eax, ecx
sub eax, edx
mov dword [ebp - 0xdd8], eax
je 0x491262
inc eax
push eax
mov dword [ebp - 0xdd4], eax
call fcn.005247b4
add esp, 4
mov edi, eax
mov dword [ebp - 0xdcc], edi
push dword [ebp - 0xdd4]
call fcn.005247b4
add esp, 4
mov dword [ebp - 0xdc4], eax
push dword [ebp - 0xdd8]
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd4]
push edi
call fcn.00534cfe
push dword [ebp - 0xdcc]
mov eax, edi
mov edi, dword [ebp - 0xdd0]
sub eax, dword [ebp - 0xdbc]
push dword [ebp - 0xdd4]
push dword [ebp - 0xdc4]
mov byte [eax + edi], 0
call fcn.0052c1a3
push 0x5b
push dword [ebp - 0xdcc]
call fcn.00526380
push 0x5d
push dword [ebp - 0xdcc]
mov dword [ebp - 0xdbc], eax
call fcn.00526380
add esp, 0x2c
mov edx, eax
cmp dword [ebp - 0xdbc], 0
mov dword [ebp - 0xdd8], edx
je 0x49112b
test edx, edx
je 0x49112b
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xdc0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4910e1
sub ecx, dword [ebp - 0xdc0]
lea eax, [edx + 1]
push ecx
push eax
push dword [ebp - 0xdd4]
push dword [ebp - 0xdc4]
call fcn.00534cfe
mov eax, dword [ebp - 0xdd8]
mov byte [eax], 0
mov eax, dword [ebp - 0xdbc]
inc eax
push eax
push dword [ebp - 0xdd4]
push dword [ebp - 0xdcc]
call fcn.0052c1a3
add esp, 0x1c
jmp 0x491142
push 0x3a
push dword [ebp - 0xdcc]
call fcn.00526380
add esp, 8
test eax, eax
je 0x491142
mov byte [eax], 0
push 0x3a
push dword [ebp - 0xdc4]
mov dword [ebp - 0xdd4], 0x157c
call fcn.00526380
add esp, 8
test eax, eax
je 0x491179
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x49116a
inc eax
push eax
call fcn.005345b0
mov dword [ebp - 0xdd4], eax
add esp, 4
push dword [ebp - 0xdc4]
call fcn.00524771
push dword [ebp - 0xdd4]
push dword [ebp - 0xdcc]
push str.WinMain_:_test...__s__d_n
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0x18
push dword [ebp - 0xdcc]
push 0xff
push 0x5cf198
call fcn.0052c1a3
mov ecx, dword [ebp - 0xdcc]
call fcn.0048e940
push dword [ebp - 0xdcc]
mov dword [ebp - 0xdd0], eax
call fcn.00524771
add esp, 0x10
cmp dword [ebp - 0xdd0], 0
je 0x491237
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5c3db0
call fcn.0041dde0
mov edx, dword [ebp - 0xdd4]
add esp, 0xc
mov ecx, dword [ebp - 0xdd0]
call fcn.00426560
test eax, eax
jne 0x490e63
mov eax, dword [ebp - 0xdd4]
inc edi
mov ecx, dword [ebp - 0xdc8]
mov dword [0x5cf8c8], eax
mov eax, dword [ebp - 0xdd0]
mov byte [0x5c64af], 1
mov dword [0x5cfa58], eax
jmp 0x48ff1d
push 0x7d0
mov byte [0x5c64af], 1
mov dword [0x5cf8c8], 0
mov dword [0x5cfa58], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x490088
push str.WinMain_:_PostAddNewClient_IIII_n
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
xor edx, edx
xor ecx, ecx
call fcn.004265c0
mov ecx, dword [ebp - 0xdc8]
test eax, eax
jne 0x490e69
mov byte [0x5c64af], 1
inc edi
mov dword [0x5cf8c8], eax
mov dword [0x5cfa58], eax
jmp 0x48ff1d
push 5
push str._auth
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x491485
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 5
mov edx, edi
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x4912e1
test al, al
je 0x4912e1
mov al, byte [edx + ecx + 1]
inc edx
cmp al, 0x20
jle 0x4912d4
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x49132f
mov eax, dword [ebp - 0xdec]
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [ebp - 0xdc4]
inc esi
mov dword [ebp - 0xdc4], esi
cmp byte [eax + esi], 0x20
mov esi, dword [ebp - 0xde0]
jg 0x491310
mov eax, dword [ebp - 0xdc4]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x49146a
mov eax, dword [0x5b4cdc]
movq xmm0, qword [str.requested_auth:]
mov dword [ebp - 0xd68], eax
mov ax, word [0x5b4ce0]
mov word [ebp - 0xd64], ax
mov al, byte [0x5b4ce2]
mov byte [ebp - 0xd61], 0
mov dword [ebp - 0xd60], 0xf
mov dword [ebp - 0xd5c], 0xf
movq qword [ebp - 0xd70], xmm0
mov byte [ebp - 0xd62], al
mov byte [ebp - 0xd61], 0
push edi
lea ecx, [ebp - 0xd70]
mov byte [ebp - 4], 6
call fcn.0042f470
push 1
push 0x5a8340
lea ecx, [ebp - 0xd70]
call fcn.00430320
cmp dword [ebp - 0xd5c], 0xf
lea eax, [ebp - 0xd70]
cmova eax, dword [ebp - 0xd70]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea ecx, [ebp - 0xda0]
push edi
call fcn.0041e2b0
lea eax, [ebp - 0xda0]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xdc0]
push eax
call fcn.0042f4c0
lea ecx, [ebp - 0xda0]
call fcn.0041ca00
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xd5c]
cmp eax, 0xf
jbe 0x49146a
push eax
push dword [ebp - 0xd70]
lea eax, [ebp - 0xd70]
push eax
call fcn.0041cba0
add esp, 0xc
push edi
call fcn.00524771
mov edi, dword [ebp - 0xdc4]
add esp, 4
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
push 9
push str._compress
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x49172a
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 9
mov edx, edi
mov dword [ebp - 0xdbc], edx
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x4914d3
nop dword [eax + eax]
test al, al
je 0x4914d3
mov al, byte [edx + ecx + 1]
inc edx
mov dword [ebp - 0xdbc], edx
cmp al, 0x20
jle 0x4914c0
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x491513
mov edx, dword [ebp - 0xdec]
nop word [eax + eax]
inc eax
mov dword [ebp - 0xdc4], eax
cmp byte [edx + eax], 0x20
jg 0x491500
mov edx, dword [ebp - 0xdbc]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
mov dword [ebp - 0xdd4], edi
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
mov dword [ebp - 0xdc0], 9
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 8
push edi
call fcn.0041e2b0
push ecx
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 9
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xdd0], eax
lea ecx, [ebp - 0xda0]
call fcn.0041ca00
mov dword [ebp - 4], 5
jmp 0x4915e0
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x49170d
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xd60], 0
push eax
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd5c], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdbc], 0x1f
push eax
movups xmmword [ebp - 0xd70], xmm0
call fcn.0041cc20
movups xmm0, xmmword [str.requested_compress:]
mov ecx, dword [ebp - 0xdbc]
mov edx, eax
mov dword [ebp - 0xd70], edx
add esp, 8
mov dword [ebp - 0xd60], 0x13
mov dword [ebp - 0xd5c], ecx
movups xmmword [edx], xmm0
mov ax, word [0x5b4d08]
mov word [edx + 0x10], ax
mov al, byte [0x5b4d0a]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov edx, dword [ebp - 0xdd0]
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0xb
call fcn.0042d780
push eax
lea ecx, [ebp - 0xd70]
mov byte [ebp - 4], 0xc
call fcn.0042f4a0
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0xb
call fcn.0041ca00
push 1
push 0x5a8340
lea ecx, [ebp - 0xd70]
call fcn.00430320
cmp dword [ebp - 0xd5c], 0xf
lea eax, [ebp - 0xd70]
cmova eax, dword [ebp - 0xd70]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
mov ecx, dword [ebp - 0xdc0]
mov eax, dword [ebp - 0xdd0]
mov dword [ecx + 0x18], eax
add esp, 0xc
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xd5c]
cmp eax, 0xf
jbe 0x49170d
push eax
push dword [ebp - 0xd70]
lea eax, [ebp - 0xd70]
push eax
call fcn.0041cba0
add esp, 0xc
push 1
push edi
call fcn.005247a6
mov edi, dword [ebp - 0xdc4]
add esp, 8
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
push 8
push str._quality
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x491982
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 8
mov edx, edi
mov dword [ebp - 0xdbc], edx
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x491773
test al, al
je 0x491773
mov al, byte [edx + ecx + 1]
inc edx
mov dword [ebp - 0xdbc], edx
cmp al, 0x20
jle 0x491760
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x4917b3
mov edx, dword [ebp - 0xdec]
nop word [eax + eax]
inc eax
mov dword [ebp - 0xdc4], eax
cmp byte [edx + eax], 0x20
jg 0x4917a0
mov edx, dword [ebp - 0xdbc]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
mov dword [ebp - 0xdd4], edi
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
mov dword [ebp - 0xdc0], 3
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0xd
push edi
call fcn.0041e2b0
push ecx
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0xe
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xdd0], eax
lea ecx, [ebp - 0xda0]
call fcn.0041ca00
mov dword [ebp - 4], 5
jmp 0x491880
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x49170d
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xd60], 0
push eax
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd5c], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdbc], 0x1f
push eax
movups xmmword [ebp - 0xd70], xmm0
call fcn.0041cc20
movups xmm0, xmmword [str.requested_quality:]
mov ecx, dword [ebp - 0xdbc]
mov edx, eax
mov dword [ebp - 0xd70], edx
add esp, 8
mov dword [ebp - 0xd60], 0x12
mov dword [ebp - 0xd5c], ecx
movups xmmword [edx], xmm0
mov ax, word [0x5b4cf4]
mov word [edx + 0x10], ax
mov byte [edx + 0x12], 0
mov edx, dword [ebp - 0xdd0]
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0x10
call fcn.0042d780
push eax
lea ecx, [ebp - 0xd70]
mov byte [ebp - 4], 0x11
call fcn.0042f4a0
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0x10
call fcn.0041ca00
push 1
push 0x5a8340
lea ecx, [ebp - 0xd70]
call fcn.00430320
cmp dword [ebp - 0xd5c], 0xf
lea eax, [ebp - 0xd70]
cmova eax, dword [ebp - 0xd70]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
mov ecx, dword [ebp - 0xdc0]
mov eax, dword [ebp - 0xdd0]
mov dword [ecx + 0x1c], eax
jmp 0x4916e5
push 8
push str._encoder
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x491b3e
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 8
mov edx, edi
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x4919bf
test al, al
je 0x4919bf
mov al, byte [edx + ecx + 1]
inc edx
cmp al, 0x20
jle 0x4919b2
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x491a01
mov eax, dword [ebp - 0xdec]
mov esi, dword [ebp - 0xdc4]
inc esi
mov dword [ebp - 0xdc4], esi
cmp byte [eax + esi], 0x20
mov esi, dword [ebp - 0xde0]
jg 0x4919e2
mov eax, dword [ebp - 0xdc4]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x49170d
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xd60], 0
push eax
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd5c], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdbc], 0x1f
push eax
movups xmmword [ebp - 0xd70], xmm0
call fcn.0041cc20
movups xmm0, xmmword [str.requested_encoder:]
mov ecx, dword [ebp - 0xdbc]
mov edx, eax
mov dword [ebp - 0xd70], edx
add esp, 8
mov dword [ebp - 0xd60], 0x12
mov dword [ebp - 0xd5c], ecx
movups xmmword [edx], xmm0
mov ax, word [0x5b4d30]
mov word [edx + 0x10], ax
mov byte [edx + 0x12], 0
push edi
lea ecx, [ebp - 0xd70]
mov byte [ebp - 4], 0x12
call fcn.0042f470
push 1
push 0x5a8340
lea ecx, [ebp - 0xd70]
call fcn.00430320
cmp dword [ebp - 0xd5c], 0xf
lea eax, [ebp - 0xd70]
cmova eax, dword [ebp - 0xd70]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea ecx, [ebp - 0xda0]
push edi
call fcn.0041e2b0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0xda0]
mov ecx, dword [ebp - 0xdc0]
push eax
add ecx, 0x20
call fcn.0042f4c0
lea ecx, [ebp - 0xda0]
call fcn.0041ca00
jmp 0x4916e8
push 5
push str._pipe
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x491d04
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 5
mov edx, edi
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x491b7d
nop
test al, al
je 0x491b7d
mov al, byte [edx + ecx + 1]
inc edx
cmp al, 0x20
jle 0x491b70
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x491bbf
mov eax, dword [ebp - 0xdec]
mov esi, dword [ebp - 0xdc4]
inc esi
mov dword [ebp - 0xdc4], esi
cmp byte [eax + esi], 0x20
mov esi, dword [ebp - 0xde0]
jg 0x491ba0
mov eax, dword [ebp - 0xdc4]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x49170d
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xd60], 0
push eax
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd5c], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdbc], 0x1f
push eax
movups xmmword [ebp - 0xd70], xmm0
call fcn.0041cc20
movups xmm0, xmmword [str.requested_pipeName:]
mov ecx, dword [ebp - 0xdbc]
mov edx, eax
mov dword [ebp - 0xd70], edx
add esp, 8
mov dword [ebp - 0xd60], 0x13
mov dword [ebp - 0xd5c], ecx
movups xmmword [edx], xmm0
mov ax, word [0x5b4d1c]
mov word [edx + 0x10], ax
mov al, byte [0x5b4d1e]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push edi
lea ecx, [ebp - 0xd70]
mov byte [ebp - 4], 0x14
call fcn.0042f470
push 1
push 0x5a8340
lea ecx, [ebp - 0xd70]
call fcn.00430320
cmp dword [ebp - 0xd5c], 0xf
lea eax, [ebp - 0xd70]
cmova eax, dword [ebp - 0xd70]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea ecx, [ebp - 0xda0]
push edi
call fcn.0041e2b0
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xda0]
mov ecx, dword [ebp - 0xdc0]
push eax
add ecx, 0x38
call fcn.0042f4c0
lea ecx, [ebp - 0xda0]
call fcn.0041ca00
jmp 0x4916e8
push 6
push str._retry
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x491f8d
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 6
mov edx, edi
mov dword [ebp - 0xdbc], edx
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x491d53
nop word [eax + eax]
test al, al
je 0x491d53
mov al, byte [edx + ecx + 1]
inc edx
mov dword [ebp - 0xdbc], edx
cmp al, 0x20
jle 0x491d40
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdd8], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdd0], eax
jle 0x491d93
mov edx, dword [ebp - 0xdec]
nop word [eax + eax]
inc eax
mov dword [ebp - 0xdd0], eax
cmp byte [edx + eax], 0x20
jg 0x491d80
mov edx, dword [ebp - 0xdbc]
sub eax, edx
mov dword [ebp - 0xdc0], eax
je 0x490e69
inc eax
push eax
mov dword [ebp - 0xdbc], eax
call fcn.005247b4
add esp, 4
mov edi, eax
mov dword [ebp - 0xdc4], edi
push dword [ebp - 0xdc0]
push dword [ebp - 0xdd8]
push dword [ebp - 0xdbc]
push edi
call fcn.00534cfe
add esp, 0x10
call fcn.0042e0b0
mov dword [ebp - 0xdc0], eax
test eax, eax
je 0x491f70
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xd78], 0
push eax
lea eax, [ebp - 0xd88]
mov dword [ebp - 0xd74], 0
xorps xmm0, xmm0
mov dword [ebp - 0xdbc], 0x1f
push eax
movups xmmword [ebp - 0xd88], xmm0
call fcn.0041cc20
movups xmm0, xmmword [str.requested_retryTime:]
mov ecx, dword [ebp - 0xdbc]
mov edx, eax
mov dword [ebp - 0xd88], edx
add esp, 8
mov dword [ebp - 0xd78], 0x14
mov dword [ebp - 0xd74], ecx
movups xmmword [edx], xmm0
mov eax, dword [0x5b4d70]
mov dword [edx + 0x10], eax
mov byte [edx + 0x14], 0
push edi
lea ecx, [ebp - 0xd88]
mov byte [ebp - 4], 0x16
call fcn.0042f470
push 1
push 0x5a8340
lea ecx, [ebp - 0xd88]
call fcn.00430320
cmp dword [ebp - 0xd74], 0xf
lea eax, [ebp - 0xd88]
cmova eax, dword [ebp - 0xd88]
push eax
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea ecx, [ebp - 0xd88]
push edi
call fcn.0042f470
push edi
lea ecx, [ebp - 0xdb8]
mov byte [ebp - 4], 0x17
call fcn.0041e2b0
push ecx
lea ecx, [ebp - 0xdb8]
mov byte [ebp - 4], 0x18
call fcn.0048f440
add esp, 4
mov dword [ebp - 0xdd8], eax
lea ecx, [ebp - 0xdb8]
call fcn.0041ca00
mov eax, dword [ebp - 0xdc0]
mov ecx, dword [ebp - 0xdd8]
mov dword [ebp - 4], 0x16
mov dword [eax + 0x50], ecx
jmp 0x491f30
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xd74]
cmp eax, 0xf
jbe 0x491f55
push eax
push dword [ebp - 0xd88]
lea eax, [ebp - 0xd88]
push eax
call fcn.0041cba0
add esp, 0xc
mov dword [ebp - 0xd78], 0
mov dword [ebp - 0xd74], 0xf
mov byte [ebp - 0xd88], 0
push 1
push edi
call fcn.005247a6
mov edi, dword [ebp - 0xdd0]
add esp, 8
mov ecx, dword [ebp - 0xdc8]
inc edi
jmp 0x48ff1d
push 9
push str._repeater
push edi
call fcn.00534300
add esp, 0xc
test eax, eax
jne 0x4920c7
mov edi, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 0xdc8]
add edi, 9
mov edx, edi
mov dword [ebp - 0xdd0], edx
mov al, byte [edi + ecx]
cmp al, 0x20
jg 0x491fd6
test al, al
je 0x491fd6
mov al, byte [edx + ecx + 1]
inc edx
mov dword [ebp - 0xdd0], edx
cmp al, 0x20
jle 0x491fc3
cmp byte [edx + ecx], 0x20
lea esi, [edx + ecx]
mov eax, edx
mov dword [ebp - 0xdc0], esi
mov esi, dword [ebp - 0xde0]
mov dword [ebp - 0xdc4], eax
jle 0x49201f
mov eax, dword [ebp - 0xdec]
nop dword [eax]
mov esi, dword [ebp - 0xdc4]
inc esi
mov dword [ebp - 0xdc4], esi
cmp byte [esi + eax], 0x20
mov esi, dword [ebp - 0xde0]
jg 0x492000
mov eax, dword [ebp - 0xdc4]
sub eax, edx
mov dword [ebp - 0xdbc], eax
je 0x490e69
mov ecx, dword [0x5d0810]
test ecx, ecx
je 0x492050
push ecx
call fcn.00524771
mov eax, dword [ebp - 0xdbc]
add esp, 4
mov dword [0x5d0810], 0
lea edi, [eax + 1]
push edi
call fcn.005247b4
add esp, 4
mov dword [0x5d0810], eax
push dword [ebp - 0xdbc]
push dword [ebp - 0xdc0]
push edi
push eax
call fcn.00534cfe
mov eax, dword [0x5d0810]
sub eax, dword [ebp - 0xdd0]
mov edi, dword [ebp - 0xdc4]
push str.WinMain_:_PostAddNewRepeaterClient_I_n
push 0
push 0x5c3db0
mov byte [eax + edi], 0
call fcn.0041dde0
add esp, 0x1c
call fcn.004263b0
test eax, eax
jne 0x490e63
mov ecx, dword [ebp - 0xdc8]
inc edi
mov byte [0x5c64bc], 1
mov dword [0x5cf8c8], eax
mov dword [0x5cfa58], eax
jmp 0x48ff1d
push 0x40
push 0x5d01b0
mov edx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
call fcn.00425f30
add esp, 8
test esi, esi
je 0x4920e5
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5c66bc]
test eax, eax
jne 0x49211f
push 0x1134
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov dword [ebp - 4], 0x1f
call fcn.0042b8e0
mov dword [0x5c66bc], eax
test eax, eax
je 0x49212d
push 0x1134
push eax
call fcn.005247a6
add esp, 8
xor eax, eax
jmp 0x492206
mov edi, dword [ebp - 0xdcc]
inc edi
jmp 0x48ff1d
cmp dword [ebp - 0xddc], 0
jne 0x4920db
mov ecx, dword [ebp - 0xdf0]
call fcn.0048f820
test al, al
jne 0x4921a4
mov eax, dword [0x5c66bc]
test eax, eax
jne 0x492188
push 0x1134
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.0042b8e0
mov dword [0x5c66bc], eax
test eax, eax
je 0x492196
push 0x1134
push eax
call fcn.005247a6
add esp, 8
test esi, esi
je 0x4921a0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x492206
call fcn.00492690
mov edi, eax
mov eax, dword [0x5c66bc]
test eax, eax
jne 0x4921db
push 0x1134
call fcn.00524776
add esp, 4
mov dword [ebp - 0xdc0], eax
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.0042b8e0
mov dword [0x5c66bc], eax
test eax, eax
je 0x4921e9
push 0x1134
push eax
call fcn.005247a6
add esp, 8
xor eax, eax
test edi, edi
setne al
mov dword [ebp - 0xdc0], eax
test esi, esi
je 0x492206
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0xdc0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 0x10