Function at 0x41d9f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
mov dword [esi + 0xe10c], edi
cmp dword [ebp + 8], edi
jne 0x41da46
cmp ebx, edi
jne 0x41da46
mov ecx, dword [esi + 0xdbd0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xb8]
call edx
test eax, eax
jne 0x41da46
mov ecx, dword [esi + 0xdbd0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
push 1
mov dword [ebp + 8], 1
call edx
push str.._vncdesktop.cpp_:_SethookMechanism_called_r_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
mov eax, dword [0x48a140]
add esp, 4
cmp eax, 4
je 0x41dbeb
cmp eax, 5
je 0x41dbeb
mov edx, 1
cmp eax, edx
je 0x41dacf
cmp eax, 2
je 0x41dacf
cmp dword [ebp + 8], edi
jne 0x41da8c
mov dword [esi + 0xe104], edi
jmp 0x41da92
mov dword [esi + 0xe104], edx
mov eax, dword [esi + 0xe108]
xor ecx, ecx
cmp dword [esi + 0xe104], edi
mov dword [esi + 0xa0], edi
setne cl
xor edx, edx
cmp eax, ecx
setne dl
mov dword [esi + 0xe108], ecx
mov dword [esi + 0xe110], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], edi
jne 0x41dae6
mov dword [esi + 0xe104], edi
cmp ebx, edi
jne 0x41daf0
mov dword [esi + 0xa0], edi
jmp 0x41daf6
cmp ebx, edi
je 0x41db1b
mov dword [esi + 0xe104], edi
mov dword [esi + 0xa0], edx
mov ecx, dword [esi + 0xe104]
mov eax, dword [esi + 0xe108]
xor ebx, ebx
cmp ecx, edi
setne bl
mov dword [esi + 0xe108], ebx
cmp eax, ebx
je 0x41db29
mov dword [esi + 0xe110], edx
jmp 0x41db2f
mov dword [esi + 0xe104], edx
mov dword [esi + 0xa0], edi
jmp 0x41daf6
mov dword [esi + 0xe110], edi
cmp dword [0x48a140], 2
jne 0x41db3e
mov dword [esi + 0xe110], edx
mov eax, dword [esi + 0xa0]
push eax
push ecx
push str.._vncdesktop.cpp_:_Sethook_restart_wanted_hook_d_driver_d__r_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 0xc
cmp dword [esi + 0xe110], edi
je 0x41db76
push str.._vncdesktop.cpp_:_Hookdll_status_changed__r_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
mov ecx, dword [esi + 0xa0]
cmp ecx, edi
je 0x41dbaa
mov eax, dword [esi + 0xe0d8]
cmp eax, edi
je 0x41dbb9
cmp dword [eax + 8], edi
jne 0x41dba2
mov eax, 1
mov dword [esi + 0xe10c], eax
mov dword [esi + 0xe110], eax
jmp 0x41dbbe
cmp ecx, edi
jne 0x41dc6b
mov ecx, esi
call fcn.0041d6f0
test eax, eax
je 0x41dc6b
mov eax, 1
mov dword [esi + 0xe10c], eax
push str.._vncdesktop.cpp_:_Driver_Status_changed_r_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0xa0], edi
mov dword [esi + 0xe104], edi
cmp dword [ebp + 8], edi
jne 0x41dc00
cmp ebx, edi
je 0x41dc0a
mov dword [esi + 0xe104], 1
mov eax, dword [esi + 0xe118]
cmp eax, edi
je 0x41dc28
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0xe118], edi
mov dword [esi + 0xe0f8], edi
mov dword [esi + 0xe0f8], edi
cmp ebx, edi
je 0x41dc39
push 1
call fcn.0041dc80
mov eax, dword [esi + 0xe108]
cmp ebx, edi
jne 0x41dc50
cmp dword [ebp + 8], edi
jne 0x41dc50
mov dword [esi + 0xe108], edi
jmp 0x41dc5a
mov dword [esi + 0xe108], 1
xor ecx, ecx
cmp eax, dword [esi + 0xe108]
setne cl
mov dword [esi + 0xe110], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 4