Function at 0x4133c0
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47175a
mov eax, dword fs:[0]
push eax
sub esp, 0xa48
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0xa40], eax
push ebx
push esi
push edi
mov eax, dword [0x489348]
xor eax, esp
push eax
lea eax, [esp + 0xa58]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x68]
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x40]
mov ecx, esi
mov dword [esp + 0x14], ebx
call eax
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [edx + 0x3c]
push ecx
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_connected_:__s___hd__n
mov ecx, 1
mov eax, 0x48b3f0
call fcn.00401000
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, dword [ebx + 0x60]
push 0x7530
mov dword [esp + 0x80], eax
call fcn.0044a0a0
test eax, eax
jne 0x413479
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncclient.cpp_:_failed_to_set_socket_timeout__d__n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
test eax, eax
je 0x41656b
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
mov ecx, dword [ebx + 0x60]
mov dword [ecx + 8], eax
push str.._vncclient.cpp_:_DSMPlugin_Pointer_to_socket_OK_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov ecx, dword [ebx + 0x64]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
add esp, 4
add esi, 0x17c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
mov al, byte [eax + 0x21]
test al, al
je 0x41353f
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jbe 0x413506
push str.._vncclient.cpp_:_A_connection_using_DSM_already_exist___client_rejected_to_avoid_crash__n
mov ecx, 1
jmp 0x416575
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jne 0x413529
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
mov eax, dword [eax + 0x2ec]
call eax
mov eax, dword [ebx + 0x60]
mov byte [eax + 0xc], 1
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x6c], 0
jmp 0x41354c
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x6c], 1
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
mov ecx, ebx
call eax
test eax, eax
jne 0x4135a2
mov ecx, dword [ebx + 0x64]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x22c]
call edx
test eax, eax
je 0x416582
push 0x457
push 0x457
call fcn.004486d0
add esp, 8
jmp 0x416582
push str.._vncclient.cpp_:_negotiated_version_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
add esp, 4
mov ecx, ebx
call edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [ebx + 0x64]
mov esi, dword [eax]
jne 0x4135e8
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
jmp 0x416582
mov eax, dword [edx + 0x3c]
add esi, 0x180
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b8]
call edx
imul eax, eax, 0x3e8
mov edi, dword [ebx + 0x60]
push eax
call fcn.0044a0a0
push str.._vncclient.cpp_:_authenticated_connection_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [ebx + 0x68]
mov esi, dword [eax]
add esp, 4
add esi, 0x68
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebx + 0x68]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa60], 0
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1cc]
call edx
mov ecx, dword [ebx + 0x68]
mov esi, dword [ecx + 0xc8]
call fcn.0040e060
push edi
mov dword [esp + 0xa64], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0xc8]
lea edi, [esp + 0x108]
call fcn.0040e130
mov edx, dword [eax]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x460], edx
mov edx, dword [eax + 4]
add ecx, 0x460
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov ecx, dword [ecx + 0x30]
push 0x110
lea edx, [esp + 0x310]
push 0
mov dword [eax + 0x470], ecx
push edx
mov dword [esp + 0x90], 0x110
call fcn.00462100
add esp, 0xc
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x41377b
lea eax, [esp + 0x30c]
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413725
sub eax, edx
je 0x413760
movsx edx, byte [esp + esi + 0x30c]
push edx
call fcn.0045e217
mov byte [esp + esi + 0x310], al
lea eax, [esp + 0x310]
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413753
sub eax, edx
cmp esi, eax
jb 0x413730
lea eax, [esp + 0x30c]
push 0x2e
push eax
call fcn.0045e0eb
add esp, 8
test eax, eax
je 0x4137a3
jmp 0x41384c
mov ecx, dword [str.WinVNC]
mov dx, word [0x47c064]
mov al, byte [0x47c066]
mov dword [esp + 0x30c], ecx
mov word [esp + 0x310], dx
mov byte [esp + 0x312], al
lea edi, [esp + 0x204]
call fcn.00413240
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4137b4
sub eax, edx
cmp eax, 3
jbe 0x41384c
mov al, byte [esp + 0x204]
cmp al, 0x49
je 0x41384c
cmp al, 0x48
je 0x41384c
lea edi, [esp + 0x30c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4137e0
mov ecx, dword [0x47c068]
lea eax, [esp + 0x204]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413800
lea edi, [esp + 0x30c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413811
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x30c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413831
mov dx, word [0x47c06c]
mov cl, byte [0x47c06e]
mov word [eax], dx
mov byte [eax + 2], cl
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x9c], edx
mov edx, dword [ecx + 0x10]
mov dword [esp + 0xa0], edx
mov edx, dword [ecx + 0x14]
mov dword [esp + 0xa4], edx
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0xa8], ecx
movzx ecx, word [eax + 0x468]
sub cx, word [eax + 0x460]
mov edx, dword [eax + 0x468]
sub edx, dword [eax + 0x460]
mov esi, 0x100
imul cx, si
sar edx, 8
and edx, 0xff
xor dx, cx
mov word [esp + 0x98], dx
movzx ecx, word [eax + 0x46c]
sub cx, word [eax + 0x464]
mov edx, dword [eax + 0x46c]
sub edx, dword [eax + 0x464]
mov eax, esi
imul cx, ax
mov ax, word [esp + 0xa4]
sar edx, 8
and edx, 0xff
xor dx, cx
movzx ecx, word [esp + 0xa0]
mov word [esp + 0x9a], dx
mov dx, word [esp + 0xa2]
rol cx, 8
rol dx, 8
rol ax, 8
mov word [esp + 0xa4], ax
lea eax, [esp + 0x30c]
mov word [esp + 0xa2], dx
mov word [esp + 0xa0], cx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413930
sub eax, edx
lea esi, [esp + 0x30c]
mov ecx, eax
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x413945
lea eax, [esp + 0x30c]
sub esi, edx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413958
sub eax, edi
mov edi, eax
lea eax, [esp + 0x30c]
lea edx, [eax + 1]
mov dword [esp + 0x44], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413971
sub eax, dword [esp + 0x44]
shr ecx, 0x10
shl eax, 0x10
and edi, 0xff00
or eax, edi
mov edi, dword [ebx + 0x60]
and esi, 0xff0000
or esi, ecx
shl eax, 8
shr esi, 8
or eax, esi
mov dword [esp + 0xac], eax
mov ecx, 0x18
lea eax, [esp + 0x98]
call fcn.0044a300
test eax, eax
jne 0x4139c8
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
jmp 0x4135d0
lea eax, [esp + 0x30c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4139d2
mov edi, dword [ebx + 0x60]
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x30c]
call fcn.0044a300
test eax, eax
je 0x4139b9
push str.._vncclient.cpp_:_sent_pixel_format_to_client_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
add esp, 4
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0xa60], 1
mov esi, dword [ebx + 0x68]
add esi, 0x460
lea edi, [esp + 0x48]
call fcn.004060b0
mov byte [esp + 0xa60], 2
mov eax, dword [ebx + 0x68]
lea ecx, [eax + 0x118]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov edx, edi
push edx
call eax
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 8]
push ecx
mov esi, eax
call fcn.0045d511
add esp, 4
push esi
call fcn.0045d511
mov dword [esp + 0xa64], 0xffffffff
mov edx, dword [esp + 0x48]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 2
mov ecx, ebx
call fcn.0045c1e0
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x120]
mov dword [esp + 0x30], 1
call edx
movzx eax, al
mov dword [esp + 0x94], eax
mov byte [esp + 0x37], 1
lea esp, [esp]
mov edi, 1
call fcn.00448350
test eax, eax
jne 0x413ae4
cmp dword [0x4a1090], 2
jne 0x413ae4
call fcn.00448290
test eax, eax
je 0x41483c
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x34], 0
je 0x413b10
cmp byte [esp + 0x37], 0
je 0x413b10
mov bl, 0x14
call fcn.004131e0
mov bl, 0x91
call fcn.004131e0
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x37], 0
mov edi, 1
cmp dword [esp + 0x94], 0
je 0x413b4e
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x120]
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xc8]
mov bl, al
mov eax, dword [edx + 0x54]
call fcn.0041d4b0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x94], 0
mov edi, 1
mov eax, dword [ebx + 0x60]
cmp byte [eax + 0xc], 0
mov esi, edi
je 0x413b88
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
cmp byte [eax + 0x21], 0
je 0x413b88
mov edx, dword [ebx + 0x60]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov ecx, edi
call fcn.0044a3e0
test eax, eax
je 0x41483c
xor esi, esi
jmp 0x413ba0
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, edi
call fcn.0044a3e0
test eax, eax
je 0x41483c
movzx eax, byte [esp + 0x1c]
cmp eax, 0xf
ja case.0x413bae.1
jmp dword [eax*4 + 0x4165a8]
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 0x14
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
mov cx, word [esp + 0x24]
mov dx, word [esp + 0x26]
mov ax, word [esp + 0x28]
rol cx, 8
mov word [esp + 0x24], cx
rol dx, 8
rol ax, 8
xor ecx, ecx
cmp byte [esp + 0x2d], 1
mov word [esp + 0x26], dx
mov edx, dword [ebx + 0x68]
sete cl
mov word [esp + 0x28], ax
mov eax, dword [edx + 0xc8]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov eax, dword [ebx + 0x68]
add eax, 0x4c
lea edi, [esp + 0x20]
call fcn.004108b0
test eax, eax
jne 0x413c4b
push str.._vncclient.cpp_:_remote_pixel_format_invalid_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
mov dword [esp + 0x30], 0
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x140], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
jmp 0x414818
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 4
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
mov eax, dword [ebx + 0x68]
add eax, 0x4c
xor esi, esi
mov dword [eax + 0x70], esi
mov eax, dword [eax + 0x7c]
mov dword [eax + 0x20], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x60], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x68], esi
mov eax, dword [ebx + 0x68]
add eax, 0x4c
or ecx, 0xffffffff
mov dword [eax + 0x4c], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x413cc6
mov dword [eax + 0x60], ecx
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov ecx, 6
mov dword [eax + 0x48], ecx
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x413cde
mov dword [eax + 0x5c], ecx
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x50], esi
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x413cf1
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], esi
cmp ecx, esi
je 0x413d04
mov dword [ecx + 0x68], esi
mov dword [eax + 0x5c], esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], esi
cmp ecx, esi
je 0x413d1a
mov dword [ecx + 0x6c], esi
mov dword [eax + 0x5c], esi
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push esi
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x15c], esi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x160], esi
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
call edx
mov ax, word [esp + 0x1e]
rol ax, 8
mov word [esp + 0x1e], ax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x118]
lea ecx, [eax + 0x118]
mov eax, dword [edx + 0x10]
push esi
mov dword [esp + 0x1c], esi
call eax
xor ecx, ecx
mov dword [esp + 0x4c], esi
cmp cx, word [esp + 0x1e]
jae 0x41409b
nop
mov eax, dword [ebx + 0x60]
lea edx, [esp + 0x80]
push edx
push eax
mov ecx, 4
call fcn.0044a3e0
test eax, eax
je 0x414091
mov ecx, dword [esp + 0x80]
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
mov esi, ecx
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, edi
jne 0x413de8
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x118]
mov edx, dword [eax + 0x10]
add ecx, 0x118
push edi
call edx
jmp 0x414076
cmp eax, 0xffffff21
jne 0x413dfd
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x14c], edi
jmp 0x414076
cmp eax, 0xffff0001
jne 0x413e34
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x70], edi
mov eax, dword [eax + 0x7c]
mov dword [eax + 0x20], edi
call fcn.0040ff60
push str.._vncclient.cpp_:_Cache_protocol_extension_enabled_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
jmp 0x414076
cmp eax, 0xffff0006
jne 0x413e4b
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x60], edi
push str.._vncclient.cpp_:_XOR_protocol_extension_enabled_n
jmp 0x413e1d
cmp eax, 0xffffff00
jb 0x413e89
cmp eax, 0xffffff09
ja 0x413e89
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 0x100]
add ecx, 0x4c
mov eax, esi
call fcn.00410a10
push esi
push str.._vncclient.cpp_:_compression_level_requested:__d_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
jmp 0x414076
cmp eax, 0xffffffe0
jb 0x413eab
cmp eax, 0xffffffe9
ja 0x413eab
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 0x20]
add ecx, 0x4c
mov eax, esi
call fcn.00410a40
push esi
push str.._vncclient.cpp_:_image_quality_level_requested:__d_n
jmp 0x413e72
cmp eax, 0xffffff20
jne 0x413ecf
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x50], edi
mov eax, dword [eax + 0x20]
test eax, eax
je 0x413ec5
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_LastRect_protocol_extension_enabled_n
jmp 0x413e1d
cmp eax, 0xffffff10
jne 0x413f08
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x54], edi
test ecx, ecx
je 0x413ee9
mov dword [ecx + 0x68], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push edi
call eax
push str.._vncclient.cpp_:_X_style_cursor_shape_updates_enabled_n
jmp 0x413e1d
cmp eax, 0xffffff11
jne 0x413f41
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x6c]
add eax, 0x4c
mov dword [eax + 0x58], edi
test ecx, ecx
je 0x413f22
mov dword [ecx + 0x6c], edi
mov dword [eax + 0x5c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push edi
call eax
push str.._vncclient.cpp_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x413e1d
cmp eax, 0xffffff18
jne 0x413f5b
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x168], edi
push str.._vncclient.cpp_:_PointerPos_protocol_extension_enabled_n
jmp 0x413e1d
cmp eax, 0xffff8000
jne 0x413f80
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x4b0], 1
mov eax, dword [ebx + 0x64]
mov byte [eax + 0x56c], 1
push str.._vncclient.cpp_:_ServerState_protocol_extension_enabled_n
jmp 0x413e1d
cmp eax, 0x10
jne 0x413fac
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x64], edi
push str.._vncclient.cpp_:_ZRLE_found__n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov ecx, dword [esp + 0x84]
add esp, 4
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, 7
jne 0x413ff4
mov eax, dword [ebx + 0x68]
add eax, 0x4c
mov dword [eax + 0x68], edi
push str.._vncclient.cpp_:_Tight_found_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
cmp dword [esp + 0x18], 0
jne 0x414076
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
lea ecx, [esp + 0x108]
call fcn.004023d0
mov dword [esp + 0xa60], 3
mov eax, dword [esp + 0x80]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
or ecx, edx
push 0
push ecx
mov ecx, dword [ebx + 0x68]
add ecx, 0x4c
call fcn.004102f0
test eax, eax
je 0x41405d
mov dword [esp + 0x18], edi
mov dword [esp + 0xa60], 0xffffffff
mov eax, dword [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x4c]
movzx ecx, word [esp + 0x1e]
add eax, edi
xor esi, esi
cmp eax, ecx
mov dword [esp + 0x4c], eax
jl 0x413d80
jmp 0x414095
mov dword [esp + 0x30], esi
cmp dword [esp + 0x18], esi
jne 0x414116
push str.._vncclient.cpp_:_defaulting_to_raw_encoder_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
add esp, 4
call eax
push eax
lea ecx, [esp + 0x100]
call fcn.004023d0
mov dword [esp + 0xa60], 4
mov ecx, dword [ebx + 0x68]
push esi
push esi
add ecx, 0x4c
call fcn.004102f0
test eax, eax
jne 0x4140fd
push str.._vncclient.cpp_:_failed_to_select_raw_encoder__n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0xa60], 0xffffffff
mov ecx, dword [esp + 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, edi
jbe 0x414131
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x214]
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2c], edi
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
xor ecx, ecx
cmp byte [eax + 0xe200], cl
sete cl
mov eax, ecx
mov ecx, dword [ebx + 0x68]
call fcn.00419550
jmp 0x414818
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 0xa
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
movzx ecx, word [esp + 0x1e]
mov esi, dword [ebx + 0x68]
mov edx, dword [esi + 0x470]
rol cx, 8
movzx eax, cx
add eax, dword [esi + 4]
movzx ecx, word [esp + 0x20]
imul eax, edx
rol cx, 8
movzx ecx, cx
add ecx, dword [esi + 8]
mov si, word [esp + 0x22]
imul ecx, edx
rol si, 8
movzx esi, si
imul esi, edx
add esi, eax
mov dword [esp + 0x154], eax
mov ax, word [esp + 0x24]
rol ax, 8
movzx eax, ax
imul eax, edx
mov dword [esp + 0x15c], esi
add eax, ecx
lea esi, [esp + 0x154]
lea edi, [esp + 0x58]
mov dword [esp + 0x158], ecx
mov dword [esp + 0x160], eax
call fcn.004060b0
mov dword [esp + 0xa60], 5
mov ecx, dword [esp + 0x58]
cmp dword [ecx + 4], 0
jne 0x414247
push str.._vncclient.cpp_:_FATAL__client_update_region_is_empty__n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
mov dword [esp + 0x30], 0
lea eax, [esp + 0x58]
mov dword [esp + 0xa60], 0xffffffff
call fcn.00406100
jmp 0x414818
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0xfc]
call fcn.004023d0
lea ecx, [esp + 0x58]
mov byte [esp + 0xa60], 6
mov eax, dword [ebx + 0x68]
push ecx
lea edx, [esp + 0x4c]
push edx
add eax, 0x13c
push eax
call fcn.004061e0
mov byte [esp + 0xa60], 7
mov esi, dword [ebx + 0x68]
add esi, 0x13c
mov edx, eax
call fcn.00406120
lea eax, [esp + 0x48]
mov byte [esp + 0xa60], 6
call fcn.00406100
cmp byte [esp + 0x1d], 0
jne 0x4142e0
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x118]
mov edx, dword [edx + 4]
lea ecx, [eax + 0x118]
lea eax, [esp + 0x58]
push eax
call edx
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov edx, dword [ecx + 0x54]
push edx
lea eax, [esp + 0x158]
call fcn.0041ac40
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov esi, dword [ecx + 0x54]
call fcn.0041ac80
mov edi, dword [ebx + 0x68]
call fcn.00416c80
mov edx, dword [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41422e
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x1c]
push eax
mov ecx, 8
sub ecx, esi
push edx
call fcn.0044a3e0
test eax, eax
je 0x414818
mov edx, dword [ebx + 0x68]
cmp dword [edx + 0x34], 0
je 0x414818
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and ecx, 0xff00
shl esi, 0x10
or esi, ecx
shr eax, 8
shl esi, 8
or eax, esi
cmp byte [esp + 0x1d], 0
mov dword [esp + 0x20], eax
movzx ecx, byte [edx + 0x3c]
push ecx
setne dl
movzx ecx, dl
push ecx
push eax
call fcn.004346d0
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x144], 1
jmp 0x414818
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x1c]
push eax
mov ecx, 6
sub ecx, esi
push edx
call fcn.0044a3e0
test eax, eax
je 0x414818
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x38], 0
je 0x414818
mov ax, word [esp + 0x1e]
mov dx, word [esp + 0x20]
rol ax, 8
add ax, word [ecx + 0xc]
mov dword [esp + 0x18], 0x8000
add ax, word [ecx + 4]
imul ax, word [ecx + 0x470]
rol dx, 8
mov word [esp + 0x1e], ax
add dx, word [ecx + 0x10]
add dx, word [ecx + 8]
imul dx, word [ecx + 0x470]
mov word [esp + 0x20], dx
cmp ax, word [ecx + 0x112]
jne 0x41440a
cmp dx, word [ecx + 0x114]
je 0x414412
mov dword [esp + 0x18], 0x8001
mov cl, byte [ecx + 0x111]
mov al, byte [esp + 0x1d]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor cl, al
test cl, 1
je 0x41445e
push 0x17
call esi
test eax, eax
mov al, byte [esp + 0x1d]
je 0x41444c
test al, 1
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x18], edx
jmp 0x41445e
test al, 1
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x18], ecx
mov edx, dword [ebx + 0x68]
mov dl, byte [edx + 0x111]
mov cl, al
mov byte [esp + 0x13], dl
and cl, 2
and dl, 2
cmp cl, dl
je 0x414488
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x40
or dword [esp + 0x18], ecx
mov dl, al
xor dl, byte [esp + 0x13]
test dl, 4
je 0x4144c8
push 0x17
call esi
test eax, eax
mov al, byte [esp + 0x1d]
je 0x4144b3
test al, 4
mov ecx, 0
sete cl
lea ecx, [ecx + ecx + 2]
or dword [esp + 0x18], ecx
jmp 0x4144c8
test al, 4
mov edx, 0
sete dl
lea edx, [edx*8 + 8]
or dword [esp + 0x18], edx
mov ecx, dword [ebx + 0x68]
xor edi, edi
cmp dword [ecx + 0xb4], edi
je 0x414500
cmp dword [ecx + 0xac], edi
jne 0x414500
test al, 8
je 0x4144f1
test byte [ecx + 0x111], 8
jne 0x4144f1
mov edi, 0x78
jmp 0x41451a
test al, 0x10
je 0x414522
test byte [ecx + 0x111], 0x10
jne 0x414522
jmp 0x414515
test al, 8
je 0x414511
or dword [esp + 0x18], 0x800
mov edi, 0x78
test al, 0x10
je 0x414522
mov edi, 0xffffff88
or dword [esp + 0x18], 0x800
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x164]
lea edx, [esp + 0x180]
push edx
lea edx, [esp + 0xe0]
push edx
lea edx, [esp + 0xf4]
push edx
call eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x14], 1
jne 0x414593
movzx eax, word [esp + 0x20]
mov ecx, dword [esp + 0xdc]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [esp + 0xec]
push 0
push edi
lea ecx, [edx - 1]
push eax
movzx eax, word [esp + 0x2a]
imul eax, eax, 0xffff
cdq
idiv ecx
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x41470e
cmp dword [eax + 0x4ac], 0
je 0x414638
push 0x4c
mov dword [esp + 0x1ec], 0
call esi
sub word [esp + 0x1e], ax
push 0x4d
call esi
sub word [esp + 0x20], ax
push 0x4e
call esi
mov ecx, eax
movzx eax, word [esp + 0x1e]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
push 0x4f
mov dword [esp + 0x1f0], eax
call esi
mov ecx, eax
movzx eax, word [esp + 0x20]
imul eax, eax, 0xffff
cdq
dec ecx
idiv ecx
mov edx, dword [ebx + 0x68]
push 0x1c
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x1f4], eax
mov eax, dword [esp + 0x1c]
or eax, 0x4000
mov dword [esp + 0x1fc], eax
xor eax, eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x200], eax
mov ecx, dword [edx + 0x4ac]
lea eax, [esp + 0x1ec]
push eax
push 1
call ecx
jmp 0x41470e
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
test byte [esp + 0x18], 1
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esp + 0x100], 0xa
je 0x4146bf
and dword [esp + 0x18], 0xffff7fff
push 0
lea eax, [esp + 0x190]
push eax
push 0
push 3
call esi
push 0
lea ecx, [esp + 0xdc]
push ecx
push 0
push 0x70
call esi
xor eax, eax
push eax
lea edx, [esp + 0x104]
push edx
push eax
push 0x71
mov dword [esp + 0x184], 0xa
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
call esi
push 0
lea eax, [esp + 0x178]
push eax
push 0
push 4
call esi
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x1e]
sub ecx, dword [esp + 0x150]
sub edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_mouse_event]
test byte [esp + 0x18], 1
je 0x41470e
push 0
lea ecx, [esp + 0x190]
push ecx
push 0
push 4
call esi
push 0
lea edx, [esp + 0xdc]
push edx
push 0
push 0x71
call esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x110], ecx
mov dx, word [esp + 0x20]
add eax, 0x110
mov word [eax + 4], dx
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x144], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xc8]
mov esi, dword [edx + 0x54]
call fcn.0041ac80
jmp 0x414818
mov edx, dword [ebx + 0x60]
lea eax, [esp + esi + 0x1c]
push eax
mov ecx, 8
sub ecx, esi
push edx
call fcn.0044a3e0
test eax, eax
je 0x414818
mov eax, dword [esp + 0x20]
mov esi, eax
mov ecx, eax
mov edx, eax
and esi, 0xff0000
shl edx, 0x10
and eax, 0xff00
shr ecx, 0x10
or esi, ecx
or edx, eax
shl edx, 8
shr esi, 8
or esi, edx
lea eax, [esi + 1]
push eax
call fcn.0045cadd
mov edi, eax
add esp, 4
test edi, edi
je 0x414818
mov byte [edi + esi], 0
mov ecx, dword [ebx + 0x60]
push edi
push ecx
mov ecx, esi
call fcn.0044a3e0
push edi
test eax, eax
jne 0x4147c1
call fcn.0045d506
add esp, 4
jmp 0x414818
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0xec]
call eax
push edi
call fcn.0045d506
add esp, 4
jmp 0x414818
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x475], 1
mov edx, dword [ebx + 0x68]
mov ecx, 4
lea eax, [esp + esi + 0x1c]
sub ecx, esi
cmp byte [edx + 0x475], 0
mov edx, dword [ebx + 0x60]
push eax
push edx
je 0x4148bb
call fcn.0044a3e0
test eax, eax
jne 0x4148c8
mov dword [esp + 0x30], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x260]
call eax
test eax, eax
je 0x414831
mov esi, dword [ebx + 0x68]
call fcn.004194d0
cmp dword [esp + 0x30], 0
jne 0x413ac0
mov esi, dword [esp + 0x7c]
call fcn.00448180
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x4b1], 0
je 0x416413
mov ecx, dword [eax + 0xc8]
mov edi, dword [ecx + 0x54]
xor bl, bl
mov esi, edi
call fcn.0041d270
push str.enabled
push str.._vncdesktop.cpp_:_SetDisableInput:_inputs__s_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [0x48a140]
add esp, 8
cmp eax, 1
je 0x4163aa
cmp eax, 2
je 0x4163aa
mov ecx, dword [edi + 0xdbd0]
mov edx, dword [ecx]
mov eax, dword [edx + 0x11c]
push 0
call eax
mov dword [edi + 0xe108], 1
jmp 0x4163ef
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
mov al, byte [esp + 0x1d]
mov cl, al
dec cl
cmp cl, 8
ja 0x414818
movzx edx, al
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x470], edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x48]
call fcn.004023d0
mov dword [esp + 0xa60], 8
mov ecx, dword [ebx + 0x68]
movzx eax, byte [esp + 0x1d]
mov esi, dword [ecx + 0xc8]
call fcn.0040e060
test eax, eax
jne 0x41493a
mov dword [esp + 0xa60], 0xffffffff
mov edx, dword [esp + 0x44]
push edx
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414818
mov eax, dword [ebx + 0x68]
push 1
push 0
push 0
mov byte [eax + 0x474], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [ebx + 0x68]
call fcn.00416c80
mov dword [esp + 0xa60], 0xffffffff
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414818
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 4
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x34], 0
je 0x414818
cmp byte [esp + 0x1d], 1
mov eax, str.disabled
je 0x4149ae
mov eax, str.enabled
push eax
push str.._vncclient.cpp_:_rfbSetServerInput:_inputs__s_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
add esp, 8
call eax
cmp byte [eax + 0xe200], 0
je 0x414a08
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x4b1], 0
jne 0x414a08
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
mov esi, dword [ebx + 0x64]
xor ecx, ecx
cmp byte [eax + 0xe200], cl
sete cl
push ecx
call fcn.004476e0
jmp 0x414818
mov edx, dword [ebx + 0x68]
cmp byte [esp + 0x1d], 1
mov ecx, dword [edx + 0xc8]
mov ecx, dword [ecx + 0x54]
sete al
call fcn.0041df70
cmp byte [esp + 0x1d], 1
mov eax, dword [ebx + 0x68]
sete dl
mov byte [eax + 0x4b1], dl
jmp 0x414818
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 6
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je case.0x413bae.1
movzx ecx, word [esp + 0x1e]
rol cx, 8
movzx esi, cx
mov cx, word [esp + 0x20]
cmp si, 5
jae 0x414ae4
mov dx, cx
rol dx, 8
cmp dx, 5
jae 0x414ae4
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xc8]
mov esi, dword [ecx + 0x54]
push edi
push edi
push str.._vncdesktop.cpp_:_SETW__i__i_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [esi + 0xe1fc]
add esp, 0xc
sub eax, edi
je 0x414ad4
sub eax, edi
je 0x414ac2
sub eax, edi
jne 0x414818
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], eax
mov dword [esi + 0x64], eax
jmp 0x414818
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x64], 0
jmp 0x414818
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x64], eax
jmp 0x414818
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x470]
mov ebx, dword [eax + 0xc]
add ebx, dword [eax + 4]
rol cx, 8
movzx ecx, cx
add ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
imul ecx, edx
push ecx
movzx ecx, si
add ebx, ecx
imul ebx, edx
mov edx, dword [eax + 0xc8]
mov eax, dword [edx + 0x54]
call fcn.0041d580
mov ebx, dword [esp + 0x14]
jmp 0x414818
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0x49c]
mov eax, esi
call fcn.004095c0
jmp 0x414818
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x260]
mov byte [esp + 0x13], 1
call eax
test eax, eax
je 0x414b5f
mov edi, dword [ebx + 0x68]
call fcn.004192d0
mov byte [esp + 0x13], al
mov edi, 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x7c]
call fcn.004023d0
mov dword [esp + 0xa60], 9
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x174], edi
mov eax, dword [ebx + 0x60]
lea edx, [esp + esi + 0x1c]
push edx
mov ecx, 0xc
sub ecx, esi
push eax
call fcn.0044a3e0
test eax, eax
je 0x41635f
movzx eax, byte [esp + 0x1d]
dec eax
cmp eax, 0xb
ja case.0x414bb3.2
jmp dword [eax*4 + 0x4165e8]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x40]
call fcn.004023d0
mov byte [esp + 0xa60], 0xa
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je 0x414cc0
cmp byte [esp + 0x13], 0
je 0x414cc0
mov eax, dword [esp + 0x24]
mov edx, eax
mov esi, eax
mov ecx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
and esi, 0xff0000
shr ecx, 0x10
or esi, ecx
push 0x144
add eax, 0x17c
shl edx, 8
push 0
shr esi, 8
push eax
or esi, edx
call fcn.00462100
add esp, 0xc
cmp esi, 0x144
jbe 0x414c4d
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov edx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
add edx, 0x17c
push edx
push eax
mov ecx, esi
call fcn.0044a3e0
test eax, eax
jne 0x414c76
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x20]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x68]
push eax
push ecx
mov ecx, 4
mov dword [esp + 0x70], 0
call fcn.0044a3e0
test eax, eax
jne 0x414cd0
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x68]
mov edx, eax
mov edi, eax
mov ecx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
and edi, 0xff0000
shr ecx, 0x10
or edi, ecx
add eax, 0x17c
shl edx, 8
push 0x2c
shr edi, 8
push eax
or edi, edx
call fcn.0045e2ff
add esp, 8
mov dword [esp + 0x4c], eax
test eax, eax
jne 0x414d1e
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2c0], 0
jmp 0x414d38
mov ecx, dword [ebx + 0x68]
inc eax
add ecx, 0x2c0
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x414d28
mov ecx, dword [esp + 0x4c]
mov byte [ecx], dl
mov edx, dword [ebx + 0x68]
push 0
push 0x8000000
push 4
push 0
push 3
push 0xc0000000
add edx, 0x17c
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2dc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 0x68]
cmp eax, 0xb7
sete byte [esp + 0x13]
xor eax, eax
cmp dword [edx + 0x2dc], 0xffffffff
setne al
add esi, 0x41
push esi
mov dword [esp + 0x50], esi
dec eax
mov dword [esp + 0x1c], eax
call fcn.0045cadd
mov esi, eax
add esp, 4
test esi, esi
jne 0x414dad
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov edx, dword [esp + 0x4c]
push edx
push 0
push esi
call fcn.00462100
mov eax, dword [ebx + 0x68]
add esp, 0xc
add eax, 0x17c
mov edx, esi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x414dc7
push 0x5c
push esi
call fcn.0045e2ff
add esp, 8
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414e21
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x140]
push edx
lea ecx, [esp + 0x16c]
push ecx
push esi
call eax
test eax, eax
jne 0x414e21
mov dword [esp + 0x18], 0xffffffff
push esi
call fcn.0045d506
add esp, 4
mov ecx, 0xa
mov eax, dword [esp + 0x164]
mov edx, dword [esp + 0x168]
shrd eax, edx, cl
sar edx, cl
push 1
push 0
push 0
push edi
mov dword [esp + 0x60], edx
mov esi, eax
call fcn.00469840
xor ecx, ecx
add eax, dword [esp + 0x38]
push ecx
push 0x3e8
adc edx, ecx
push edx
push eax
call fcn.0046a8a0
xor ecx, ecx
cmp ecx, edx
jg 0x414e7e
jl 0x414e75
cmp esi, eax
jae 0x414e7e
or esi, 0xffffffff
mov dword [esp + 0x18], esi
jmp 0x414e81
or esi, 0xffffffff
push 0x2400
call fcn.0045cadd
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2d4], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d4], 0
jne 0x414ea7
mov dword [esp + 0x18], esi
push 0x2000
call fcn.0045cadd
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2d8], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d8], 0
jne 0x414ecd
mov dword [esp + 0x18], esi
cmp byte [esp + 0x13], 0
mov byte [esp + 0x88], 7
je 0x415006
cmp dword [esp + 0x18], 0xffffffff
je 0x415006
lea ecx, [eax + 0x17c]
lea esi, [esp + 0x144]
call fcn.00419230
test al, al
je 0x415006
mov edx, dword [esp + 0x144]
mov eax, dword [esp + 0x148]
shrd edx, eax, 0xd
mov ecx, edx
shr eax, 0xd
lea eax, [ecx*4 + 0x400]
push eax
mov dword [esp + 0x3c], eax
call fcn.0045cadd
add esp, 4
mov dword [esp + 0x4c], eax
test eax, eax
je 0x415006
mov edx, dword [ebx + 0x68]
mov edi, dword [edx + 0x2dc]
push 0x2000
call fcn.0045cadd
add esp, 4
test eax, eax
je 0x415006
mov ecx, dword [esp + 0x4c]
push ecx
mov esi, eax
mov ebx, edi
call fcn.00418720
mov edi, eax
cmp edi, 0xffffffff
je 0x415002
mov eax, dword [esp + 0x38]
mov edx, eax
shl edx, 0x10
mov ecx, eax
and ecx, 0xff00
or edx, ecx
mov ecx, eax
shl edx, 8
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr eax, 0x18
or edx, eax
mov dword [esp + 0x8c], edx
mov edx, edi
shl edx, 0x10
mov eax, edi
and eax, 0xff00
or edx, eax
mov ecx, edi
sar ecx, 8
shl edx, 8
and ecx, 0xff00
or edx, ecx
mov eax, edi
shr eax, 0x18
or edx, eax
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x88]
mov byte [esp + 0x89], 0xc
call fcn.0044a2c0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
mov ecx, edi
mov edi, dword [edx + 0x60]
call fcn.0044a300
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx + 0x68]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
lea eax, [ebx + 0x17c]
mov dword [esp + 0x8c], ecx
mov ecx, eax
mov byte [esp + 0x89], 9
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415050
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415060
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov edi, edi
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x415070
sub esi, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x415080
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x90], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x88]
call fcn.0044a2c0
mov eax, dword [edi + 0x68]
add eax, 0x17c
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4150d5
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044a300
cmp dword [esp + 0x18], 0xffffffff
jne 0x41513f
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x2d8]
test eax, eax
je 0x415117
push eax
call fcn.0045c7c2
add esp, 4
mov eax, dword [esi + 0x68]
mov eax, dword [eax + 0x2d4]
test eax, eax
je 0x41512d
push eax
call fcn.0045c7c2
add esp, 4
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, esi
jmp case.0x414bb3.2
mov eax, dword [esp + 0x20]
mov edx, eax
and edx, 0xff0000
mov ecx, eax
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
shr edx, 8
and eax, 0xff00
or ecx, eax
mov eax, dword [esp + 0x14]
shl ecx, 8
or edx, ecx
mov ecx, dword [eax + 0x68]
mov dword [ecx + 0x2e0], edx
mov ecx, dword [eax + 0x68]
mov edx, dword [ecx + 0x2e0]
shr edx, 0xd
mov dword [ecx + 0x2e4], edx
mov edx, dword [eax + 0x68]
xor ecx, ecx
mov dword [edx + 0x2e8], ecx
mov edx, dword [eax + 0x68]
mov dword [edx + 0x2ec], ecx
mov edx, dword [eax + 0x68]
mov dword [edx + 0x2f0], ecx
mov edx, dword [eax + 0x68]
mov byte [edx + 0x2f6], cl
mov edx, dword [eax + 0x68]
mov byte [edx + 0x2f4], cl
mov ecx, dword [esp + 0x3c]
mov eax, dword [eax + 0x68]
push ecx
mov byte [eax + 0x2f5], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
lea ecx, [esp + 0x44]
call fcn.004023d0
mov byte [esp + 0xa60], 0xb
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je 0x4156b2
cmp byte [esp + 0x13], 0
je 0x4156b2
mov eax, dword [esp + 0x20]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 1
mov ecx, dword [ebx + 0x68]
sete al
mov byte [ecx + 0x450], al
mov eax, dword [esp + 0x24]
mov edi, eax
mov edx, eax
shr edx, 0x10
and edi, 0xff0000
or edi, edx
mov edx, dword [ebx + 0x68]
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
push 0x144
or ecx, eax
add edx, 0x2f7
shl ecx, 8
push 0
shr edi, 8
push edx
or edi, ecx
call fcn.00462100
add esp, 0xc
cmp edi, 0x144
jbe 0x41529c
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x68]
mov edx, dword [ebx + 0x60]
add ecx, 0x2f7
push ecx
push edx
mov ecx, edi
call fcn.0044a3e0
test eax, eax
jne 0x4152c5
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov eax, dword [ebx + 0x68]
lea ecx, [eax + 0x2f7]
push ecx
push eax
call fcn.00418ee0
or esi, 0xffffffff
cmp eax, esi
jne 0x4153df
mov ebx, dword [ebx + 0x68]
lea eax, [ebx + 0x2f7]
mov ecx, eax
mov dword [esp + 0x11c], esi
mov byte [esp + 0x118], 7
mov byte [esp + 0x119], 4
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415305
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415315
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x415323
sub esi, ebx
lea edx, [eax + 1]
nop
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x415330
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x120], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x118]
call fcn.0044a2c0
mov eax, dword [edi + 0x68]
add eax, 0x2f7
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415385
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044a300
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x60]
mov ecx, 4
lea eax, [esp + 0xf4]
mov dword [esp + 0xf4], 0xffffffff
call fcn.0044a300
mov edx, dword [esi + 0x68]
mov ecx, dword [esp + 0x40]
mov byte [edx + 0x451], 1
mov eax, dword [esi + 0x68]
push ecx
mov byte [eax + 0x452], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, esi
jmp case.0x414bb3.2
mov edx, dword [ebx + 0x68]
push 0
push 0x8000000
push 3
push 0
push 1
push accept
add edx, 0x2f7
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x43c], eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x43c], esi
jne 0x415428
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
jmp 0x41551e
lea ecx, [eax + 0x2f7]
lea esi, [esp + 0x5c]
call fcn.00419230
mov edx, dword [ebx + 0x68]
test al, al
mov eax, dword [edx + 0x43c]
jne 0x41545b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
jmp 0x41551a
lea ecx, [esp + 0x184]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x41551a
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x188]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x112]
movzx ecx, word [esp + 0x110]
movzx edx, word [esp + 0x108]
push eax
movzx eax, word [esp + 0x112]
push ecx
movzx ecx, word [esp + 0x112]
push edx
push eax
push ecx
lea edx, [esp + 0x1fc]
push str._2.2d__2.2d__4.4d__2.2d:_2.2d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [ebx + 0x68]
add esp, 0x1c
add edi, 0x2f6
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4154d8
mov ax, word [0x47c420]
mov word [edi], ax
lea eax, [esp + 0x1e8]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4154f2
mov edi, dword [ebx + 0x68]
sub eax, esi
add edi, 0x2f6
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x415504
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x5c]
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x454]
xor edi, edi
cmp eax, edi
je 0x41553f
push eax
call fcn.0045d506
mov edx, dword [ebx + 0x68]
add esp, 4
mov dword [edx + 0x454], edi
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x458], edi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x45c], edi
mov ebx, dword [ebx + 0x68]
mov edx, esi
mov eax, esi
mov ecx, esi
shl ecx, 0x10
and edx, 0xff0000
shr eax, 0x10
and esi, 0xff00
or ecx, esi
or edx, eax
shl ecx, 8
shr edx, 8
or edx, ecx
lea eax, [ebx + 0x2f7]
mov ecx, eax
mov byte [esp + 0x130], 7
mov byte [esp + 0x131], 4
mov dword [esp + 0x134], edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4155a0
sub ecx, esi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4155b0
sub ecx, esi
mov esi, eax
lea ebx, [esi + 1]
mov edi, edi
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x4155c0
sub esi, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4155d0
sub eax, edx
shl eax, 0x10
and ecx, 0xff0000
and esi, 0xff00
or eax, esi
shr edi, 0x10
or ecx, edi
mov edi, dword [esp + 0x14]
shl eax, 8
shr ecx, 8
or eax, ecx
mov dword [esp + 0x138], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x130]
call fcn.0044a2c0
mov eax, dword [edi + 0x68]
add eax, 0x2f7
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415625
mov edi, dword [edi + 0x60]
sub ecx, esi
call fcn.0044a300
mov esi, dword [esp + 0x60]
mov edx, esi
and edx, 0xff0000
mov eax, esi
shr eax, 0x10
or edx, eax
mov ecx, esi
shl ecx, 0x10
mov eax, esi
and eax, 0xff00
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
mov dword [esp + 0xc8], edx
mov edx, dword [esp + 0x14]
mov edi, dword [edx + 0x60]
mov ecx, 4
lea eax, [esp + 0xc8]
call fcn.0044a300
cmp dword [esp + 0x5c], 0xffffffff
jne 0x41569e
cmp esi, 0xffffffff
jne 0x41569e
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov ecx, dword [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x24]
mov edi, dword [ebx + 0x68]
mov esi, eax
mov ecx, eax
mov edx, eax
and esi, 0xff0000
shl edx, 0x10
and eax, 0xff00
shr ecx, 0x10
or esi, ecx
or edx, eax
shl edx, 8
shr esi, 8
or esi, edx
lea eax, [esi + 1]
push eax
mov dword [esp + 0x3c], edi
call fcn.0045cadd
add esp, 4
mov dword [edi + 0x454], eax
test eax, eax
je case.0x414bb3.2
mov edi, esi
mov esi, dword [esp + 0x38]
call fcn.004187b0
jmp case.0x414bb3.2
mov eax, dword [esp + 0x20]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 0xffffffff
jne 0x41575b
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x414bb3.2
push 0x2000
call fcn.0045cadd
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2d4], eax
mov eax, dword [ebx + 0x68]
xor esi, esi
add esp, 4
cmp dword [eax + 0x2d4], esi
jne 0x415790
mov eax, dword [eax + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x414bb3.2
push 0x2400
call fcn.0045cadd
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2d8], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d8], esi
jne 0x4157dd
mov edx, dword [eax + 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x2d4]
cmp eax, esi
je case.0x414bb3.2
push eax
call fcn.0045c7c2
add esp, 4
jmp case.0x414bb3.2
mov byte [eax + 0x440], 0
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x444], esi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2f0], esi
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x44c], esi
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x451], 0
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x452], 1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2f6], 0
mov ecx, dword [ebx + 0x68]
push ecx
call fcn.00418a50
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x414bb3.2
cmp byte [esp + 0x13], 0
je case.0x414bb3.2
mov eax, dword [esp + 0x20]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
mov esi, dword [ebx + 0x68]
and eax, 0xff00
or edx, eax
shl edx, 8
shr ecx, 8
or ecx, edx
push ecx
mov ecx, dword [esp + 0x28]
mov eax, ecx
mov edx, ecx
shr edx, 0x10
and eax, 0xff0000
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
call fcn.004187f0
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je case.0x414bb3.2
cmp byte [esp + 0x13], 0
je case.0x414bb3.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je case.0x414bb3.2
call fcn.00418910
jmp case.0x414bb3.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je 0x41590b
mov byte [eax + 0x2f4], 1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2f6], 1
mov eax, dword [ebx + 0x68]
call fcn.00418910
jmp case.0x414bb3.2
cmp byte [eax + 0x452], 0
je 0x41592a
mov byte [eax + 0x451], 1
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x2f6], 1
jmp case.0x414bb3.2
mov byte [eax + 0x476], 1
mov edx, dword [ebx + 0x68]
cmp byte [edx + 0x476], 0
je case.0x414bb3.2
cmp word [esp + 0x1e], 0
mov byte [esp + 0xcc], 7
sete al
test al, al
je 0x415960
mov byte [esp + 0xcd], 7
jmp 0x4159a2
mov ecx, dword [ebx + 0x64]
mov byte [esp + 0xcd], 0xe
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je 0x4159a2
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xe8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x118]
call eax
test eax, eax
je 0x4159a2
cmp byte [esp + 0x13], 0
mov dword [esp + 0xd0], 0x1000000
jne 0x4159ad
mov dword [esp + 0xd0], 0xffffffff
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0xec]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0xcc]
call fcn.0044a2c0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x68]
mov byte [ecx + 0x476], 0
mov ebx, eax
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x414bb3.2
cmp byte [esp + 0x13], 0
je case.0x414bb3.2
movzx eax, word [esp + 0x1e]
sub eax, edi
je 0x415b2e
sub eax, edi
jne case.0x414bb3.2
lea ecx, [esp + 0x204]
push ecx
push 0x100
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
lea eax, [edi - 3]
mov dword [esp + 0x38], edi
test eax, eax
jbe 0x415ab1
lea esi, [esp + 0xf0]
lea edx, [esp + 0x204]
sub esi, edx
lea esp, [esp]
lea eax, [esp + ebx + 0x204]
mov cl, byte [eax]
mov byte [eax + esi], cl
inc eax
test cl, cl
jne 0x415a57
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x415a77
jmp dword [eax*4 + 0x416618]
mov byte [esp + ebx + 0x206], 0x6c
jmp case.default.0x415a77
mov byte [esp + ebx + 0x206], 0x66
jmp case.default.0x415a77
mov byte [esp + ebx + 0x206], 0x63
jmp case.default.0x415a77
mov byte [esp + ebx + 0x206], 0x6e
add ebx, 4
lea eax, [edi - 3]
sub esi, 4
cmp ebx, eax
jb 0x415a50
mov edx, 3
mov word [esp + 0x126], dx
mov eax, edi
shl eax, 0x10
mov edx, edi
and edx, 0xff00
or eax, edx
mov edx, edi
shl eax, 8
sar edx, 8
and edx, 0xff00
or eax, edx
shr edi, 0x18
or eax, edi
mov edi, dword [esp + 0x14]
mov cl, 7
mov dword [esp + 0x12c], eax
mov eax, dword [edi + 0x60]
mov esi, 0xc
lea ebx, [esp + 0x124]
mov byte [esp + 0x124], cl
mov byte [esp + 0x125], 2
call fcn.0044a2c0
mov ecx, dword [esp + 0x38]
mov edi, dword [edi + 0x60]
lea eax, [esp + 0x204]
call fcn.0044a300
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x24]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x414bb3.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x204]
push eax
push ecx
mov ecx, esi
call fcn.0044a3e0
test eax, eax
je case.0x414bb3.2
push 0xb
lea edx, [esp + 0x208]
push str.My_Documents
mov byte [esp + esi + 0x20c], 0
push edx
or esi, 0xffffffff
xor bl, bl
call fcn.0045dd67
add esp, 0xc
test eax, eax
jne 0x415ba7
lea esi, [eax + 5]
push 7
lea eax, [esp + 0x208]
push str.Desktop
push eax
call fcn.0045dd67
add esp, 0xc
test eax, eax
jne 0x415bc4
xor esi, esi
push 0x11
lea ecx, [esp + 0x208]
push str.Network_Favorites
push ecx
call fcn.0045dd67
add esp, 0xc
test eax, eax
jne 0x415be4
lea esi, [eax + 0x13]
jmp 0x415be9
cmp esi, 0xffffffff
je 0x415c58
lea edx, [esp + 0x83c]
push edx
push esi
call fcn.00418e70
test al, al
je 0x415c56
lea eax, [esp + 0x83c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415c05
sub eax, edx
cmp byte [esp + eax + 0x83b], 0x5c
je 0x415c36
lea edi, [esp + 0x83c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415c20
mov ax, word [0x47533c]
mov word [edi], ax
mov edi, 1
xor eax, eax
jmp 0x415c40
mov cl, byte [esp + eax + 0x83c]
mov byte [esp + eax + 0x204], cl
add eax, edi
test cl, cl
jne 0x415c40
jmp 0x415c58
mov bl, 1
lea edi, [esp + 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415c60
mov cx, word [0x47c450]
mov edx, 1
mov word [edi], cx
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edx
mov byte [esp + 0x70], 7
mov byte [esp + 0x71], 2
mov word [esp + 0x72], dx
call edi
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push 0
mov dword [esp + 0x50], esi
call edi
cmp esi, 0xffffffff
je 0x415f61
test bl, bl
jne 0x415f61
lea eax, [esp + 0x204]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415cd0
sub eax, edx
mov ebx, eax
lea eax, [esp + 0x204]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415ce5
sub eax, edx
mov edi, eax
lea eax, [esp + 0x204]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415d00
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x204]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x415d15
sub eax, esi
dec eax
dec edi
shl eax, 0x10
dec ecx
dec ebx
and edi, 0xff0000
and ecx, 0xff00
or eax, ecx
shr ebx, 0x10
or edi, ebx
shl eax, 8
shr edi, 8
or eax, edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x74], eax
mov eax, dword [edi + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
call fcn.0044a2c0
lea eax, [esp + 0x204]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x415d65
mov edi, dword [edi + 0x60]
sub eax, ecx
lea ecx, [eax - 1]
lea eax, [esp + 0x204]
call fcn.0044a300
test byte [esp + 0x41c], 0x10
je 0x415dbf
mov ecx, 0x47c454
lea eax, [esp + 0x448]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415db6
test dl, dl
je 0x415db2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415db6
add eax, 2
add ecx, 2
test dl, dl
jne 0x415d96
xor eax, eax
jmp 0x415dbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x415df9
mov ecx, 0x47c458
lea eax, [esp + 0x448]
jmp 0x415dd0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415df0
test dl, dl
je 0x415dec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415df0
add eax, 2
add ecx, 2
test dl, dl
jne 0x415dd0
xor eax, eax
jmp 0x415df5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x415e53
lea edx, [esp + 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea eax, [esp + 0x420]
push eax
lea ecx, [esp + 0x634]
push ecx
call fcn.00462180
mov edx, edi
shl edx, 0x10
mov eax, edi
and eax, 0xff00
or edx, eax
mov ecx, edi
sar ecx, 8
shl edx, 8
and ecx, 0xff00
mov eax, edi
or edx, ecx
shr eax, 0x18
or edx, eax
mov dword [esp + 0x80], edx
jmp 0x415ee3
mov ecx, 0x47c454
lea eax, [esp + 0x448]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415e80
test dl, dl
je 0x415e7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415e80
add eax, 2
add ecx, 2
test dl, dl
jne 0x415e60
xor eax, eax
jmp 0x415e85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x415f12
lea eax, [esp + 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 0x2e
push edi
lea ecx, [esp + 0x420]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.00462180
mov eax, edi
shl eax, 0x10
mov ecx, edi
and ecx, 0xff00
or eax, ecx
mov edx, edi
sar edx, 8
shl eax, 8
and edx, 0xff00
mov ecx, edi
or eax, edx
shr ecx, 0x18
or eax, ecx
mov dword [esp + 0x80], eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x60]
add esp, 0xc
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
call fcn.0044a2c0
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
lea eax, [esp + 0x62c]
call fcn.0044a300
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x41c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415d80
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x14]
xor eax, eax
mov word [esp + 0x6e], ax
mov dword [esp + 0x74], eax
lea esi, [eax + 0xc]
mov eax, dword [edx + 0x60]
mov cl, 7
lea ebx, [esp + 0x6c]
call fcn.0044a2c0
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x60]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x6c]
mov dword [esp + 0x74], 0
call fcn.0044a2c0
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x414bb3.2
cmp byte [esp + 0x13], 0
je case.0x414bb3.2
movzx eax, word [esp + 0x1e]
sub eax, edi
je 0x416291
sub eax, 3
je 0x4160f6
sub eax, edi
jne case.0x414bb3.2
mov eax, dword [esp + 0x24]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
mov dword [esp + 0x38], esi
cmp esi, 0x209
ja case.0x414bb3.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x62c]
push eax
push ecx
mov ecx, esi
call fcn.0044a3e0
test eax, eax
je case.0x414bb3.2
lea edx, [esp + 0x62c]
push 0x2a
push edx
mov byte [esp + esi + 0x634], 0
call fcn.0045e2ff
add esp, 8
test eax, eax
je case.0x414bb3.2
lea ecx, [eax + 1]
lea esi, [esp + 0x41c]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
add ecx, edi
test dl, dl
jne 0x416047
mov byte [eax], dl
xor ecx, ecx
jmp 0x416060
mov dl, byte [esp + ecx + 0x62c]
mov byte [esp + ecx + 0x83c], dl
add ecx, edi
test dl, dl
jne 0x416060
mov byte [eax], 0x2a
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, dword [esp + 0x14]
neg eax
sbb eax, eax
neg eax
dec eax
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x24]
mov edx, 8
mov cl, 7
mov dword [esp + 0xb8], eax
mov eax, dword [edi + 0x60]
lea esi, [edx + 4]
lea ebx, [esp + 0xb0]
mov byte [esp + 0xb0], cl
mov byte [esp + 0xb1], 0xb
mov word [esp + 0xb2], dx
call fcn.0044a2c0
mov ecx, dword [esp + 0x38]
mov edi, dword [edi + 0x60]
lea eax, [esp + 0x62c]
call fcn.0044a300
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x24]
mov esi, eax
and esi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or esi, ecx
or edx, eax
shr esi, 8
shl edx, 8
or esi, edx
cmp esi, 0x104
ja case.0x414bb3.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x204]
push eax
push ecx
mov ecx, esi
call fcn.0044a3e0
test eax, eax
je case.0x414bb3.2
lea edx, [esp + 0x1b4]
push edx
lea eax, [esp + 0x208]
push eax
mov byte [esp + esi + 0x20c], 0
call fcn.0045e3f0
mov bl, byte [esp + 0x1c2]
add esp, 8
lea ecx, [esp + 0x204]
push ecx
lea ecx, [esp + 0x1ec]
and bl, 1
call fcn.00406c30
mov byte [esp + 0xa60], 0xc
test bl, bl
je 0x4161c9
lea edi, [esp + 0x204]
lea esi, [esp + 0x198]
call fcn.00410e50
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x1f4]
mov byte [esp + 0xa6c], 0xd
call fcn.00406520
mov ecx, esi
mov byte [esp + 0xa60], 0xc
call fcn.00406480
mov edi, dword [esp + 0x1fc]
lea esi, [esp + 0x204]
inc edi
call fcn.00410db0
movzx eax, al
neg eax
sbb eax, eax
neg eax
dec eax
mov ecx, 7
mov dword [esp + 0xe4], eax
mov edx, ecx
mov word [esp + 0xe2], dx
mov eax, edi
and eax, 0xff0000
mov edx, edi
shr edx, 0x10
or eax, edx
mov edx, edi
shl edx, 0x10
mov esi, edi
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x60]
lea esi, [ecx + 5]
lea ebx, [esp + 0xe0]
mov byte [esp + 0xe0], cl
mov byte [esp + 0xe1], 0xb
call fcn.0044a2c0
cmp dword [esp + 0x200], 0x10
mov eax, dword [esp + 0x1ec]
jae 0x416266
lea eax, [esp + 0x1ec]
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
call fcn.0044a300
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xa60], 9
call fcn.00406480
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov eax, dword [esp + 0x24]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x414bb3.2
mov ecx, dword [ebx + 0x60]
lea eax, [esp + 0x204]
push eax
push ecx
mov ecx, edi
call fcn.0044a3e0
test eax, eax
je case.0x414bb3.2
push 0
lea edx, [esp + 0x208]
push edx
mov byte [esp + edi + 0x20c], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
dec eax
mov edx, 4
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x24]
mov word [esp + 0xbe], dx
lea esi, [edx + 8]
mov edx, dword [esp + 0x14]
mov cl, 7
mov dword [esp + 0xc4], eax
mov eax, dword [edx + 0x60]
lea ebx, [esp + 0xbc]
mov byte [esp + 0xbc], cl
mov byte [esp + 0xbd], 0xb
call fcn.0044a2c0
mov edx, dword [esp + 0x14]
mov ecx, edi
mov edi, dword [edx + 0x60]
lea eax, [esp + 0x204]
call fcn.0044a300
mov ebx, dword [esp + 0x14]
jmp case.0x414bb3.2
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f5], 0
je case.0x414bb3.2
mov byte [eax + 0x2f4], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebx + 0x68]
mov dword [esp + 0xa60], 0xffffffff
mov eax, dword [esp + 0x78]
push eax
mov dword [edx + 0x174], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414818
mov eax, dword [edi + 0xe13c]
test eax, eax
je 0x4163ef
push 0
call eax
test eax, eax
jne 0x4163da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncdesktop.cpp_:_BlockInput_failed:__Last_error__08X_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [edi + 0xe13c]
push 0
call ecx
mov esi, dword [edi + 0xdbd0]
push 1
call fcn.004476e0
mov edx, dword [esp + 0x14]
xor al, al
mov byte [edi + 0xe200], al
mov ecx, dword [edx + 0x68]
mov byte [ecx + 0x4b1], al
mov ebx, edx
mov edx, dword [ebx + 0x68]
mov esi, edx
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
mov ecx, esi
call edx
mov edx, dword [esi]
cwde
push eax
mov eax, dword [edx + 0x3c]
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_disconnected_:__s___hd__n
mov ecx, 1
mov eax, 0x48b3f0
call fcn.00401000
add esp, 0xc
push 0x104
lea ecx, [esp + 0x208]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4164ab
lea edx, [esp + 0x204]
push 0x5c
push edx
call fcn.0045e2ff
mov byte [eax], 0
lea eax, [esp + 0x20c]
add esp, 8
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x416480
mov ecx, dword [str.logging.dll]
mov edx, dword [0x47bd8c]
mov dword [eax], ecx
mov ecx, dword [0x47bd90]
mov dword [eax + 4], edx
mov dl, byte [0x47bd94]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4164e4
push str.LOGEXIT
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x3c]
call eax
push eax
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [ebx + 0x68]
mov esi, dword [ecx + 0x138]
test esi, esi
je 0x416510
call fcn.004110f0
mov edx, dword [ebx + 0x68]
mov ecx, dword [edx + 0x138]
push 0
call fcn.0045c120
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov edx, dword [esi]
movzx ecx, ax
push ecx
mov ecx, dword [ebx + 0x64]
call edx
mov ebx, dword [ebx + 0x64]
mov eax, dword [ebx]
mov edx, dword [eax + 0x22c]
mov ecx, ebx
call edx
test eax, eax
je 0x416582
mov esi, dword [0x4a67c4]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x416582
push 0x457
push 0x457
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x416582
push str.._vncclient.cpp_:_Invalid_DSMPlugin_Pointer_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
mov ecx, dword [esp + 0xa58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa40]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 4