Function at 0x140052bc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov rbx, rcx
lea r8, str.vncDesktop::InitWindow_:_InitWindow_called_n
lea rcx, vtable.VNCLog.0
xor edx, edx
call fcn.140018d00
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov r13, rax
lea r8, str.vncDesktop::InitWindow_:_InitWindow:OpenInputdesktop_Error__n
lea rax, str.vncDesktop::InitWindow_:_InitWindow:OpenInputdesktop_OK_n
test r13, r13
lea rcx, vtable.VNCLog.0
cmovne r8, rax
xor edx, edx
call fcn.140018d00
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp - 0x80], rax
mov r9d, 0x100
mov rsi, rax
lea r8, [rbp + 0x230]
lea rax, [rsp + 0x78]
mov edx, 2
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
jne 0x140052c88
lea r8, str.vncDesktop::InitWindow_:_InitWindow:_GetUserObjectInformation__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov qword [rsp + 0x28], rsi
lea r9, [rbp + 0x230]
lea r8, str.vncDesktop::InitWindow_:_InitWindow:SelectHDESK_to__s___x__from__x_n
mov qword [rsp + 0x20], r13
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, r13
call qword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
jne 0x140052cd0
lea r8, str.vncDesktop::InitWindow_:_InitWindow:SelectHDESK:_SetThreadDesktop__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov ecx, dword [0x14022a728]
mov edx, 1
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov ecx, dword [0x14022a71c]
mov edx, 1
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov ecx, dword [0x14022a724]
mov edx, 1
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x8008
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
xor esi, esi
lea rdi, [0x1401ea8b8]
cmp word [0x14021fa60], si
jne 0x140052db8
lea rax, [0x140052150]
mov qword [rbp - 0x70], 0x50
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
mov rax, qword [0x1402281b8]
xor ecx, ecx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x60], rsi
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov word [0x14021fa60], ax
test ax, ax
jne 0x140052db8
lea r8, str.vncDesktop::InitWindow_:_failed_to_register_window_class_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
jmp 0x140053422
mov rax, qword [0x1402281b8]
lea r8, str.WinVNC
mov qword [rsp + 0x58], rsi
mov r9d, 0xcf0000
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov qword [rsp + 0x48], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 0xc8
mov dword [rsp + 0x30], 0x190
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rbx + 0xe4b8], rax
test rax, rax
jne 0x140052e23
lea r8, str.vncDesktop::InitWindow_:_failed_to_create_hook_window_n
jmp 0x140052d96
mov edx, 0x3e9
xor r9d, r9d
mov rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rbx + 0xe4b8]
mov r8, rbx
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rcx, qword [rbx + 0xe4b8]
mov byte [rbx + 0xe4c8], 1
call qword [sym.imp.USER32.dll_SetClipboardViewer]
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_load_hookdlls_n
mov byte [rbx + 0xe4c8], sil
xor edx, edx
mov qword [rbx + 0xe4c0], rax
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r8d, 0x104
mov qword [rbx + 0xea08], rsi
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140052ed0
mov edx, 0x5c
lea rcx, [rbp + 0x10]
call fcn.140149b38
test rax, rax
je 0x140052db1
lea r8, str._vnchooks.dll
mov byte [rax], sil
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140150860
mov r8d, 0x104
mov qword [rbx + 0xea10], rsi
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140052f25
mov edx, 0x5c
lea rcx, [rbp + 0x120]
call fcn.140149b38
test rax, rax
je 0x140052db1
lea r8, str._schook_legacy64.dll
mov byte [rax], sil
mov edx, 0x104
lea rcx, [rbp + 0x120]
call fcn.140150860
lea rcx, [rbp + 0x10]
mov qword [rbx + 0xea20], rsi
mov qword [rbx + 0xea40], rsi
mov qword [rbx + 0xea38], rsi
mov qword [rbx + 0xea50], rsi
mov qword [rbx + 0xea48], rsi
mov qword [rbx + 0xea18], rsi
mov qword [rbx + 0xea30], rsi
mov qword [rbx + 0xea28], rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x120]
mov qword [rbx + 0xea08], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbx + 0xea08]
mov qword [rbx + 0xea10], rax
test rcx, rcx
je 0x140052ff3
lea rdx, str.UnSetHooks
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea08]
lea rdx, str.SetMouseFilterHook
mov qword [rbx + 0xea20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea08]
lea rdx, str.SetKeyboardFilterHook
mov qword [rbx + 0xea40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea08]
lea rdx, str.SetHooks
mov qword [rbx + 0xea38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xea18], rax
mov rcx, qword [rbx + 0xea10]
test rcx, rcx
je 0x140053064
lea rdx, str.UnSetHook
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea10]
lea rdx, str.SetHook
mov qword [rbx + 0xea30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea10]
lea rdx, str.SetMouseFilterHook
mov qword [rbx + 0xea28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0xea10]
lea rdx, str.SetKeyboardFilterHook
mov qword [rbx + 0xea50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xea48], rax
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_start_dispatch_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0x478], r12
mov qword [rsp + 0x480], r14
mov qword [rsp + 0x488], r15
nop
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x20]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14005331f
mov eax, dword [rbp - 0x18]
cmp eax, 0x12
je 0x14005334e
cmp byte [0x14021fa63], 0
jne 0x14005334e
cmp eax, 0x8008
je 0x14005332a
cmp eax, dword [0x14022a728]
jne 0x140053287
lea r8, str.vnchook
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x14021fa68]
call fcn.14015b9d4
cmp byte [rbx + 0xea78], 0
je 0x1400530a0
lea r8, str.vncDesktop::InitWindow_:_RFB_SCREEN_UPDATE___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbp - 0x10]
lea r8, str.vncDesktop::InitWindow_:_REct3__i__i__i__i___n
movsx esi, ax
lea rcx, vtable.VNCLog.0
shr rax, 0x10
xor edx, edx
movsx r14d, ax
mov rax, qword [rbp - 8]
movsx r15d, ax
shr rax, 0x10
cwde
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x70], r15d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov eax, dword [rbx + 0x890]
sub esi, eax
mov edi, dword [rsp + 0x6c]
sub r15d, eax
mov eax, dword [rbx + 0x894]
mov r9d, esi
sub edi, eax
mov dword [rsp + 0x60], esi
sub r14d, eax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x6c], edi
call fcn.140018d00
lea rdx, [rbx + 0x8d8]
cmp esi, dword [rdx]
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x64]
cmovl rax, rdx
cmp r14d, dword [rdx + 4]
mov r12d, dword [rax]
lea rax, [rdx + 4]
cmovl rcx, rax
cmp dword [rdx + 8], r15d
lea rax, [rdx + 8]
mov r14d, dword [rcx]
lea rcx, [rsp + 0x68]
cmovl rcx, rax
cmp dword [rdx + 0xc], edi
lea rax, [rdx + 0xc]
mov r15d, dword [rcx]
lea rcx, [rsp + 0x6c]
cmovl rcx, rax
mov edi, dword [rcx]
cmp r12d, r15d
jge 0x1400530a0
cmp r14d, edi
jge 0x1400530a0
cmp byte [rbx + 0xe428], 0
je 0x140053227
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0xe428], 0
jne 0x140053213
lea rcx, [0x1401e9c5c]
call fcn.14015b020
mov r9d, edi
mov r8d, r15d
mov edx, r14d
mov ecx, r12d
mov rsi, rax
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rcx, qword [rbx + 0xe418]
mov r9d, 2
mov rdx, rcx
mov r8, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.14014e740
mov rcx, qword [rbx + 0xe3c0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400530a0
cmp eax, dword [0x14022a724]
jne 0x1400532ea
cmp byte [rbx + 0xea78], 0
je 0x1400530a0
lea r8, str.vncDesktop::InitWindow_:_RFB_MOUSE_UPDATE___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbp - 0x10]
test rcx, rcx
jne 0x1400532c3
mov rcx, qword [rbx + 0xe970]
jmp 0x1400532d1
mov rax, qword [rbx + 0xe960]
mov qword [rbx + 0xe968], rax
mov qword [rbx + 0xe960], rcx
mov rcx, qword [rbx + 0xe3c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400530a0
cmp eax, 0x403
jne 0x140053306
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_called_wm_user3_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400530a0
call qword [sym.imp.USER32.dll_WaitMessage]
jmp 0x1400530a0
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_called_wm_user4_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0xe4b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14005337d
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_called_wm_quit_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0xe4b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbx + 0xe3e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x14021f634], 0
mov r15, qword [rsp + 0x488]
mov r14, qword [rsp + 0x480]
mov r12, qword [rsp + 0x478]
je 0x1400533b4
nop
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14021f634], 0
jne 0x1400533a0
mov rcx, qword [rbx + 0xe4b8]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xea08]
test rcx, rcx
je 0x1400533d8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0xea10]
test rcx, rcx
je 0x1400533ea
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, r13
call qword [sym.imp.USER32.dll_CloseDesktop]
lea r8, str.vncDesktop::InitWindow_:_OOOOOOOOOOOO_end_dispatch_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov eax, 1
mov qword [rbx + 0xe4b8], 0
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x440
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret