Function at 0x488c70
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Delete registry value
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568edd
mov eax, dword fs:[0]
push eax
sub esp, 0xdb8
mov eax, dword [0x5d60c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xd7c], eax
mov dword [ebp - 4], 0
mov eax, dword [0x5e1d58]
mov dword [ebp - 0xd60], edx
test eax, eax
jne 0x488ce7
push 0x20
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0047bdb0
mov byte [ebp - 4], 0
mov dword [0x5e1d58], eax
mov ecx, eax
cmp byte [ecx + 9], 1
jne 0x488d08
push 0x10
push str.Warning
mov edx, str.Windows_XP_requires_special_build
call fcn.00425890
mov eax, dword [0x5e1d58]
add esp, 8
test eax, eax
jne 0x488d30
push 0x20
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0047bdb0
mov byte [ebp - 4], 0
mov dword [0x5e1d58], eax
cmp byte [eax + 0xd], 1
jne 0x488d92
push 0x10
push str.Unsupported_OS
mov edx, str.Error_OS_not_supported
call fcn.00425890
mov eax, dword [0x5d9298]
add esp, 8
test eax, eax
jne 0x488d7a
push 0x1134
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0042b330
mov dword [0x5d9298], eax
test eax, eax
je 0x488d88
push 0x1134
push eax
call fcn.0052b7cc
add esp, 8
mov eax, 1
jmp 0x48a77d
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call edi
push str.SHCore.dll
mov esi, eax
call edi
mov edi, eax
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488dcd
push 2
call eax
jmp 0x488ddf
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488ddf
call eax
test esi, esi
je 0x488dee
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
jmp 0x488df4
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x488dfb
push edi
call esi
mov eax, dword [0x5e44e8]
push 0
push 2
mov byte [ebp - 0xd75], 0
mov word [eax + 0xe2c], 0
call fcn.0053aee3
add esp, 4
push eax
call fcn.00540e32
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x824]
add esp, 8
mov dword [0x5e1df4], 0
push 0x104
push eax
push 0
call edi
test eax, eax
je 0x488e5d
lea eax, [ebp - 0x824]
push 0x5c
push eax
call fcn.0052cf50
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push 0x104
push eax
call fcn.0053193e
push 0x5bea9c
lea eax, [ebp - 0x720]
push 0x104
push eax
call fcn.00531998
push str.vnclang_server.dll
lea eax, [ebp - 0x720]
push 0x104
push eax
call fcn.00531998
add esp, 0x24
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [ebp - 0xd7c]
test eax, eax
cmove eax, esi
mov dword [0x5e1df4], eax
call fcn.00488560
push 0x104
lea eax, [ebp - 0x928]
push eax
push 0
call edi
test eax, eax
je 0x488ef2
lea eax, [ebp - 0x928]
push 0x5c
push eax
call fcn.0052cf50
add esp, 8
test eax, eax
je 0x488f56
mov byte [eax], 0
push 0x104
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0xb30]
push 0x104
push eax
call fcn.0053a408
add esp, 0x10
mov byte [ebp - 0xa2d], 0
call fcn.00475ee0
mov dword [0x5e1fcc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0xd88]
call fcn.004859a0
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0xd88]
test esi, esi
jne 0x488f65
push esi
push str.WinVNC
mov edx, 0x5e22e0
call fcn.00425890
add esp, 8
xor cl, cl
call fcn.00488bf0
movzx eax, al
jmp 0x48a77d
mov ecx, dword [ebp - 0xd60]
xor edi, edi
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0xd74], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x488f78
sub edx, dword [ebp - 0xd74]
je 0x488fc3
nop word [eax + eax]
movsx eax, byte [ecx + edi]
push eax
call fcn.0053a1b3
mov ecx, dword [ebp - 0xd60]
add esp, 4
mov edx, ecx
mov byte [ecx + edi], al
inc edi
lea eax, [edx + 1]
mov dword [ebp - 0xd74], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x488fb2
sub edx, dword [ebp - 0xd74]
cmp edi, edx
jb 0x488f90
xor eax, eax
xor edi, edi
mov dword [ebp - 0xd74], eax
mov edx, ecx
mov dword [ebp - 0xd5c], edi
lea eax, [edx + 1]
mov dword [ebp - 0xd70], eax
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x488fe0
sub edx, dword [ebp - 0xd70]
cmp edi, edx
jae 0x48a6b6
add edi, ecx
cmp byte [edi], 0x20
jle 0x48a6aa
push 8
push str._inifile
push edi
mov dword [ebp - 0xd74], 1
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4890e7
mov edi, dword [ebp - 0xd5c]
lea eax, [ebp - 0xa2c]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0xc34]
add edi, 8
push eax
push 0x104
lea eax, [ebp - 0xd38]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0xd60]
inc eax
add eax, edi
push eax
call fcn.005414ad
lea eax, [ebp - 0xa2c]
push 0x20
push eax
call fcn.0052d300
add esp, 0x2c
test eax, eax
je 0x489082
mov byte [eax], 0
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00540fb4
lea eax, [ebp - 0x118]
push eax
call fcn.0053a752
lea ecx, [ebp - 0x118]
mov dword [0x5d913c], eax
add esp, 0x1c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4890d0
sub ecx, edx
add edi, ecx
mov ecx, dword [ebp - 0xd60]
inc edi
jmp 0x488fcd
push 0xf
push str._settingshelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489160
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd60]
add ecx, 0x10
add eax, ecx
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0053193e
add esp, 0xc
lea ecx, [ebp - 0x320]
call fcn.00423a80
mov eax, dword [0x5d9298]
test eax, eax
jne 0x48a6ff
push 0x1134
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 6
jmp 0x48a6ef
push 0x12
push str._stopservicehelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48919f
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425430
xor cl, cl
call fcn.00488bf0
movzx edi, al
test esi, esi
je 0x489198
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
jmp 0x48a77d
push 5
push str._kill
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48922a
push str.GlobalSessionEventUltra
push eax
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x61fab0], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x61fab0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xd64], eax
test eax, eax
jne 0x489202
mov eax, dword [0x5d90f4]
mov dword [ebp - 0xd64], eax
test eax, eax
je 0x489184
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push eax
call edi
push 0
push 0
push 0x10
push dword [ebp - 0xd64]
call edi
jmp 0x489184
push 0xd
push str._openhomepage
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489258
push 1
push eax
push eax
push 0x5c0578
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xa
push str._openforum
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489286
push 1
push eax
push eax
push str.https:__forum.uvnc.com_
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xb
push str._opengithub
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4892b4
push 1
push eax
push eax
push str.https:__github.com_ultravnc
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xd
push str._openmastodon
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4892e2
push 1
push eax
push eax
push str.https:__mastodon.social__ultravnc
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xd
push str._openfacebook
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489310
push 1
push eax
push eax
push str.https:__www.facebook.com_ultravnc1
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xd
push str._openxtwitter
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48933e
push 1
push eax
push eax
push str.https:__twitter.com_ultravnc1
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xb
push str._openreddit
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48936c
push 1
push eax
push eax
push str.https:__www.reddit.com_r_ultravnc
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0xc
push str._openopenhub
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48939a
push 1
push eax
push eax
push str.https:__openhub.net_p_ultravnc
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x489184
push 0x13
push str._startservicehelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4893c3
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425540
jmp 0x489184
push 0xe
push str._installhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4893ec
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425650
jmp 0x489184
push 0x10
push str._uninstallhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489415
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425710
jmp 0x489184
push 0x12
push str._softwarecadhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48943e
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041d540
jmp 0x489184
push 0x15
push str._delsoftwarecadhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48950a
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x2ac], 6
jb 0x489184
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call eax
mov dword [ebp - 0xdc4], 0x3c
mov dword [ebp - 0xdc0], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xdbc], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0xdb4], eax
mov dword [ebp - 0xdb0], str._delsoftwarecad
mov dword [ebp - 0xda8], 1
lea eax, [ebp - 0xdc4]
mov dword [ebp - 0xdac], 0
push eax
mov dword [ebp - 0xdb8], str.runas
mov dword [ebp - 0xda4], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x489184
push 0x15
push str._rebootsafemodehelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489533
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042e160
jmp 0x489184
push 0x12
push str._rebootforcehelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48955c
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042e0c0
jmp 0x489184
push 0x15
push str._securityeditorhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489585
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004257d0
jmp 0x489184
push 0xf
push str._securityeditor
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489634
push 0x104
lea eax, [ebp - 0x320]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call eax
test eax, eax
je 0x4895e0
lea eax, [ebp - 0x320]
push 0x5c
push eax
call fcn.0052cf50
push str._authSSP.dll
push 0x104
mov byte [eax], 0
lea eax, [ebp - 0x320]
push eax
call fcn.00531998
add esp, 0x14
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x489184
push str.vncEditSecurity
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [ebp - 0xd74], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x5e1fcc]
push 0
call dword [ebp - 0xd74]
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x489184
push 9
push str._settings
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48967e
mov ecx, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd60]
add ecx, 0xa
add eax, ecx
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0053193e
add esp, 0xc
lea ecx, [ebp - 0x320]
call fcn.00423ba0
jmp 0x489184
push 0x10
push str._dsmpluginhelper
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489746
mov ecx, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd60]
add ecx, 0x11
add eax, ecx
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0053193e
push str.__dsmplugininstance
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0053193e
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.00531998
add esp, 0x24
lea eax, [ebp - 0x21c]
push 0x104
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call eax
mov dword [ebp - 0xdc4], 0x3c
mov dword [ebp - 0xdc0], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xdbc], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0xdb4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0xdb0], eax
mov dword [ebp - 0xda8], 0
jmp 0x4894da
push 0x12
push str._dsmplugininstance
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489790
mov ecx, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd60]
add ecx, 0x13
add eax, ecx
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0053193e
add esp, 0xc
lea ecx, [ebp - 0x320]
call fcn.0047f010
jmp 0x489184
push 0xc
push 0x5bb1e4
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489852
lea eax, [ebp - 0xd6c]
push eax
lea eax, [ebp - 0xd64]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x489184
lea eax, [ebp - 0xd7c]
push eax
push 0x2001f
push 0
push str.System
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48980f
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x489184
push 4
lea eax, [ebp - 0xd74]
mov dword [ebp - 0xd74], 1
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [ebp - 0xd7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd7c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xd64]
call edi
jmp 0x489184
push 0xf
push 0x5bb150
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4898e3
lea eax, [ebp - 0xd6c]
push eax
lea eax, [ebp - 0xd64]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x489184
lea eax, [ebp - 0xd7c]
push eax
push 0x2001f
push 0
push str.System
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4898cd
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x489184
push str.SoftwareSASGeneration
push dword [ebp - 0xd7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x489837
push 0xf
push 0x5bb42c
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x4899f9
push str.uvnc_service
push 0x5c2948
push str.SYSTEMCurrentControlSetControlSafeBoot_s_s
mov dword [ebp - 0xd74], eax
lea eax, [ebp - 0x61c]
push 0x400
push eax
call fcn.0042fea0
add esp, 0x14
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0xd64]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x61c]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x489184
push 8
push str.Service
push 1
push eax
push eax
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042dc70
lea eax, [ebp - 0xd74]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x489184
lea eax, [ebp - 0xd44]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0xd48]
mov dword [ebp - 0xd48], 1
push eax
push 0
push dword [ebp - 0xd74]
mov dword [ebp - 0xd3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x489184
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x489184
push 0xc
push 0x5bb218
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489a17
call fcn.0042e000
jmp 0x489184
push 0xc
push str._stopservice
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489a35
call fcn.004254f0
jmp 0x489184
push 0xd
push str._startservice
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489a53
call fcn.00425600
jmp 0x489184
push 0xe
push str._installdriver
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489a73
mov cl, 1
call fcn.004358f0
jmp 0x489184
push 8
push str._install
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489b69
mov al, byte [edi]
test al, al
je 0x489b27
movzx eax, al
push eax
call fcn.00541170
add esp, 4
test eax, eax
jne 0x489aaf
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x489a95
jmp 0x489b27
mov al, byte [edi]
test al, al
je 0x489b27
movzx eax, al
push eax
call fcn.00541170
add esp, 4
test eax, eax
je 0x489acf
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x489ab5
jmp 0x489b27
mov al, byte [edi]
test al, al
je 0x489b27
cmp al, 0x22
jne 0x489adf
inc edi
cmp byte [edi], 0
je 0x489b27
push 0x22
push edi
call fcn.0052cf50
add esp, 8
test eax, eax
je 0x489af1
mov byte [eax], 0
cmp byte [edi], 0
je 0x489b27
push str.uvnc_service
push edi
call fcn.0053a44c
add esp, 8
test eax, eax
je 0x489b27
push 0x100
push edi
push 0x100
push str.uvnc_service
call fcn.0053a408
add esp, 0x10
mov byte [0x5d6c57], 0
call fcn.0042d7f0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
lea eax, [ebp - 0x340]
push 0x124
push eax
call fcn.00426900
add esp, 0x10
lea eax, [ebp - 0x340]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x489184
push 0xa
push str._uninstall
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489c59
mov al, byte [edi]
test al, al
je 0x489c22
nop dword [eax + eax]
movzx eax, al
push eax
call fcn.00541170
add esp, 4
test eax, eax
jne 0x489baa
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x489b90
jmp 0x489c22
mov al, byte [edi]
test al, al
je 0x489c22
movzx eax, al
push eax
call fcn.00541170
add esp, 4
test eax, eax
je 0x489bca
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x489bb0
jmp 0x489c22
mov al, byte [edi]
test al, al
je 0x489c22
cmp al, 0x22
jne 0x489bda
inc edi
cmp byte [edi], 0
je 0x489c22
push 0x22
push edi
call fcn.0052cf50
add esp, 8
test eax, eax
je 0x489bec
mov byte [eax], 0
cmp byte [edi], 0
je 0x489c22
push str.uvnc_service
push edi
call fcn.0053a44c
add esp, 8
test eax, eax
je 0x489c22
push 0x100
push edi
push 0x100
push str.uvnc_service
call fcn.0053a408
add esp, 0x10
mov byte [0x5d6c57], 0
push str.uvnc_service
push str.net_stop___s_
lea eax, [ebp - 0x340]
push 0x124
push eax
call fcn.00426900
add esp, 0x10
lea eax, [ebp - 0x340]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.0042dac0
jmp 0x489184
push 0xb
push str._preconnect
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489c89
mov edi, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd60]
add edi, 0xb
mov byte [0x5d9606], 1
inc edi
jmp 0x488fcd
push 0xc
push str._service_run
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489cce
mov ecx, dword [ebp - 0xd7c]
call fcn.004888e0
test al, al
je 0x489184
mov eax, dword [0x5e44e8]
mov dword [eax + 0xe20], 1
call fcn.0048ad60
test eax, eax
setne cl
jmp 0x489186
push 0x10
push str._service_rdp_run
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489d1d
mov ecx, dword [ebp - 0xd7c]
call fcn.004888e0
test al, al
je 0x489184
mov eax, dword [0x5e44e8]
mov dword [eax + 0xe20], 1
mov dword [eax + 0xe24], 1
call fcn.0048ad60
test eax, eax
setne cl
jmp 0x489186
push 8
push str._service
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489d41
mov ecx, dword [ebp - 0xd60]
call fcn.0042d7a0
jmp 0x489184
push 4
push str._run
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489d6d
mov ecx, dword [ebp - 0xd7c]
call fcn.004888e0
test al, al
jne 0x489cbf
jmp 0x489184
push 8
push str._sc_exit
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489da2
mov eax, dword [0x5e44e8]
mov edi, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd60]
add edi, 8
inc edi
mov byte [eax + 0xe2c], 1
jmp 0x488fcd
push 0xa
push str._sc_prompt
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489dd7
mov eax, dword [0x5e44e8]
mov edi, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd60]
add edi, 0xa
inc edi
mov byte [eax + 0xe2d], 1
jmp 0x488fcd
push 6
push str._multi
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489e07
mov edi, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd60]
add edi, 6
mov byte [0x5d9092], 1
inc edi
jmp 0x488fcd
push 0xe
push str._stopreconnect
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489e35
mov edi, dword [ebp - 0xd5c]
add edi, 0xe
call fcn.00425de0
mov ecx, dword [ebp - 0xd60]
inc edi
jmp 0x488fcd
push 0xe
push str._autoreconnect
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489faa
mov edi, dword [ebp - 0xd5c]
add edi, 0xe
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0xd60]
mov ecx, edi
mov byte [ebp - 0xd75], 1
mov dword [ebp - 0xd64], ecx
mov dl, byte [edi + eax]
cmp dl, 0x20
jg 0x489e94
nop dword [eax]
test dl, dl
je 0x489e94
mov dl, byte [ecx + eax + 1]
inc ecx
mov dword [ebp - 0xd64], ecx
cmp dl, 0x20
jle 0x489e80
push 3
add eax, ecx
push 0x5bb278
push eax
mov dword [ebp - 0xd5c], eax
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x489f32
mov ecx, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd64]
mov edi, eax
cmp byte [ecx], 0x20
jle 0x489ed7
mov edx, dword [ebp - 0xd60]
nop dword [eax]
inc edi
cmp byte [edi + edx], 0x20
jg 0x489ed0
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0xd64], ecx
je 0x489f32
lea eax, [ecx + 1]
push eax
mov dword [ebp - 0xd70], eax
call fcn.0052b7da
add esp, 4
mov dword [ebp - 0xd80], eax
push dword [ebp - 0xd64]
push dword [ebp - 0xd5c]
push dword [ebp - 0xd70]
push eax
call fcn.0053a408
mov ecx, dword [ebp - 0xd80]
mov eax, dword [ebp - 0xd64]
push ecx
mov byte [eax + ecx], 0
call fcn.0053ad88
add esp, 0x14
mov dword [ebp - 0xd68], eax
mov ecx, dword [ebp - 0xd68]
call fcn.00425c90
test eax, eax
mov eax, dword [ebp - 0xd68]
jne 0x489f91
mov byte [0x5e1b51], 1
test eax, eax
jne 0x489f6a
mov ecx, dword [ebp - 0xd60]
inc edi
mov byte [0x5e1da1], 1
mov byte [0x5e1b51], al
jmp 0x488fcd
push eax
push 0x14
push 0x5e2b4c
call fcn.0053193e
push dword [ebp - 0xd68]
call fcn.0052b797
mov ecx, dword [ebp - 0xd60]
add esp, 0x10
inc edi
jmp 0x488fcd
test eax, eax
je 0x489f9e
push eax
call fcn.0052b797
add esp, 4
mov ecx, dword [ebp - 0xd60]
inc edi
jmp 0x488fcd
push 4
push str._id:
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48a08e
mov ecx, dword [ebp - 0xd5c]
mov edx, dword [ebp - 0xd60]
inc ecx
mov dword [ebp - 0xd68], eax
mov edi, ecx
cmp byte [ecx + edx], 0x20
lea esi, [ecx + edx]
mov dword [ebp - 0xd70], esi
mov esi, dword [ebp - 0xd88]
jle 0x489ff7
nop dword [eax]
inc edi
cmp byte [edi + edx], 0x20
jg 0x489ff0
mov edx, edi
sub edx, ecx
mov dword [ebp - 0xd64], edx
je 0x48a052
lea eax, [edx + 1]
push eax
mov dword [ebp - 0xd80], eax
call fcn.0052b7da
add esp, 4
mov dword [ebp - 0xd68], eax
push dword [ebp - 0xd64]
push dword [ebp - 0xd70]
push dword [ebp - 0xd80]
push eax
call fcn.0053a408
mov ecx, dword [ebp - 0xd68]
mov eax, dword [ebp - 0xd64]
push ecx
mov byte [ecx + eax], 0
call fcn.0053ad88
add esp, 0x14
mov dword [ebp - 0xd68], eax
mov ecx, eax
call fcn.00426220
test eax, eax
mov eax, dword [ebp - 0xd68]
jne 0x489f91
mov byte [0x5e1dae], 1
test eax, eax
jne 0x489f6a
mov ecx, dword [ebp - 0xd60]
inc edi
mov byte [0x5e1da2], 1
mov byte [0x5e1dae], al
jmp 0x488fcd
push 8
push str._connect
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48a503
cmp byte [ebp - 0xd75], al
jne 0x48a0b3
call fcn.00425d80
mov edi, dword [ebp - 0xd5c]
mov eax, dword [ebp - 0xd60]
add edi, 8
mov ecx, edi
mov dword [ebp - 0xd80], ecx
mov dl, byte [edi + eax]
cmp dl, 0x20
jg 0x48a0e6
test dl, dl
je 0x48a0e6
mov dl, byte [ecx + eax + 1]
inc ecx
mov dword [ebp - 0xd80], ecx
cmp dl, 0x20
jle 0x48a0d2
cmp byte [ecx + eax], 0x20
lea esi, [ecx + eax]
mov edx, ecx
mov dword [ebp - 0xd6c], esi
mov esi, dword [ebp - 0xd88]
mov dword [ebp - 0xd70], edx
jle 0x48a110
inc edx
mov dword [ebp - 0xd70], edx
cmp byte [edx + eax], 0x20
jg 0x48a103
mov eax, edx
sub eax, ecx
mov dword [ebp - 0xd84], eax
je 0x48a485
inc eax
push eax
mov dword [ebp - 0xd68], eax
call fcn.0052b7da
add esp, 4
mov edi, eax
mov dword [ebp - 0xd5c], edi
push dword [ebp - 0xd68]
call fcn.0052b7da
add esp, 4
mov dword [ebp - 0xd64], eax
push dword [ebp - 0xd84]
push dword [ebp - 0xd6c]
push dword [ebp - 0xd68]
push edi
call fcn.0053a408
push dword [ebp - 0xd5c]
mov eax, edi
mov edi, dword [ebp - 0xd70]
sub eax, dword [ebp - 0xd80]
push dword [ebp - 0xd68]
push dword [ebp - 0xd64]
mov byte [eax + edi], 0
call fcn.0053193e
push 0x5b
push dword [ebp - 0xd5c]
call fcn.0052d300
push 0x5d
push dword [ebp - 0xd5c]
mov dword [ebp - 0xd70], eax
call fcn.0052d300
add esp, 0x2c
mov edx, eax
cmp dword [ebp - 0xd70], 0
mov dword [ebp - 0xd84], edx
je 0x48a21a
test edx, edx
je 0x48a21a
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xd6c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48a1d0
sub ecx, dword [ebp - 0xd6c]
lea eax, [edx + 1]
push ecx
push eax
push dword [ebp - 0xd68]
push dword [ebp - 0xd64]
call fcn.0053a408
mov eax, dword [ebp - 0xd84]
mov byte [eax], 0
mov eax, dword [ebp - 0xd70]
inc eax
push eax
push dword [ebp - 0xd68]
push dword [ebp - 0xd5c]
call fcn.0053193e
add esp, 0x1c
jmp 0x48a231
push 0x3a
push dword [ebp - 0xd5c]
call fcn.0052d300
add esp, 8
test eax, eax
je 0x48a231
mov byte [eax], 0
push 0x3a
push dword [ebp - 0xd64]
mov dword [ebp - 0xd68], 0x157c
call fcn.0052d300
add esp, 8
test eax, eax
je 0x48a268
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x48a259
inc eax
push eax
call fcn.00539cb9
mov dword [ebp - 0xd68], eax
add esp, 4
push dword [ebp - 0xd64]
call fcn.0052b797
push dword [ebp - 0xd68]
push dword [ebp - 0xd5c]
push str.WinMain_:_test...__s__d_n
push 0
push 0x5d6df8
call fcn.0041d510
add esp, 0x18
push dword [ebp - 0xd5c]
push 0xff
push 0x5e2728
call fcn.0053193e
mov eax, dword [0x5e44e8]
add esp, 0xc
mov ecx, dword [ebp - 0xd5c]
cmp dword [eax + 0xe64], 0
je 0x48a3e2
xorps xmm0, xmm0
lea edx, [ebp - 0xd58]
movups xmmword [ebp - 0xd58], xmm0
call fcn.00486d70
test al, al
je 0x48a3a9
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5d6df8
call fcn.0041d510
mov eax, dword [ebp - 0xd68]
lea ecx, [ebp - 0xd58]
movzx eax, ax
add esp, 0xc
mov edx, eax
mov dword [ebp - 0xd6c], eax
call fcn.004260e0
test eax, eax
jne 0x48a336
movups xmm0, xmmword [ebp - 0xd58]
mov eax, dword [ebp - 0xd68]
mov byte [0x5e1b52], 1
mov dword [0x5e26e4], eax
movups xmmword [0x5e29b0], xmm0
jmp 0x48a33b
mov eax, dword [0x5e26e4]
test eax, eax
jne 0x48a38f
mov ecx, dword [ebp - 0xd5c]
call fcn.00486d40
mov dword [ebp - 0xd84], eax
test eax, eax
je 0x48a3b3
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5d6df8
call fcn.0041d510
mov edx, dword [ebp - 0xd6c]
add esp, 0xc
mov ecx, dword [ebp - 0xd84]
call fcn.00426020
test eax, eax
jne 0x48a38f
mov eax, dword [ebp - 0xd68]
mov byte [0x5e1b52], 1
mov dword [0x5e26e4], eax
push dword [ebp - 0xd5c]
call fcn.0052b797
mov ecx, dword [ebp - 0xd60]
add esp, 4
inc edi
jmp 0x488fcd
xorps xmm0, xmm0
movups xmmword [0x5e29b0], xmm0
push 0x7d0
mov dword [0x5e26e4], 0
mov byte [0x5e1b52], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0xd5c]
call fcn.0052b797
add esp, 4
jmp 0x489184
call fcn.00486e80
push dword [ebp - 0xd5c]
mov dword [ebp - 0xd64], eax
call fcn.0052b797
add esp, 4
cmp dword [ebp - 0xd64], 0
je 0x48a45a
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5d6df8
call fcn.0041d510
mov edx, dword [ebp - 0xd68]
add esp, 0xc
mov ecx, dword [ebp - 0xd64]
call fcn.00425ea0
test eax, eax
jne 0x489f9e
mov eax, dword [ebp - 0xd68]
inc edi
mov ecx, dword [ebp - 0xd60]
mov dword [0x5e26e4], eax
mov eax, dword [ebp - 0xd64]
mov byte [0x5e1b52], 1
mov dword [0x5e2b48], eax
jmp 0x488fcd
push 0x7d0
mov byte [0x5e1b52], 1
mov dword [0x5e26e4], 0
mov dword [0x5e2b48], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x489184
push str.WinMain_:_PostAddNewClient_IIII_n
push 0
push 0x5d6df8
call fcn.0041d510
mov eax, dword [0x5e44e8]
xor ecx, ecx
add esp, 0xc
xor edx, edx
cmp dword [eax + 0xe64], ecx
je 0x48a4d9
call fcn.00425f60
mov ecx, dword [ebp - 0xd60]
test eax, eax
jne 0x489fa4
xorps xmm0, xmm0
mov byte [0x5e1b52], 1
mov dword [0x5e26e4], eax
inc edi
movups xmmword [0x5e29b0], xmm0
jmp 0x488fcd
call fcn.00426160
mov ecx, dword [ebp - 0xd60]
test eax, eax
jne 0x489fa4
mov byte [0x5e1b52], 1
inc edi
mov dword [0x5e26e4], eax
mov dword [0x5e2b48], eax
jmp 0x488fcd
push 9
push str._repeater
push edi
call fcn.00539a10
add esp, 0xc
test eax, eax
jne 0x48a63d
mov edi, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd60]
add edi, 9
mov eax, edi
mov dl, byte [edi + ecx]
cmp dl, 0x20
jg 0x48a542
test dl, dl
je 0x48a542
mov dl, byte [eax + ecx + 1]
inc eax
cmp dl, 0x20
jle 0x48a534
cmp byte [eax + ecx], 0x20
lea esi, [eax + ecx]
mov edx, eax
mov dword [ebp - 0xd6c], esi
mov esi, dword [ebp - 0xd88]
mov dword [ebp - 0xd80], edx
jle 0x48a56d
nop
inc edx
mov dword [ebp - 0xd80], edx
cmp byte [edx + ecx], 0x20
jg 0x48a560
sub edx, eax
mov dword [ebp - 0xd70], edx
je 0x489fa4
mov eax, dword [0x5e26e0]
test eax, eax
je 0x48a59d
push eax
call fcn.0052b797
mov edx, dword [ebp - 0xd70]
add esp, 4
mov dword [0x5e26e0], 0
lea eax, [edx + 1]
push eax
call fcn.0052b7da
mov edi, dword [ebp - 0xd70]
add esp, 4
mov dword [0x5e26e0], eax
push edi
push dword [ebp - 0xd6c]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.0053a408
mov eax, dword [0x5e26e0]
push str.WinMain_:_PostAddNewRepeaterClient_I_n
push 0
push 0x5d6df8
mov byte [edi + eax], 0
call fcn.0041d510
add esp, 0x1c
call fcn.00425d10
test eax, eax
jne 0x48a62b
mov dword [0x5e26e4], eax
mov eax, dword [0x5e44e8]
mov byte [0x5e1b53], 1
cmp dword [eax + 0xe64], 0
je 0x48a621
mov edi, dword [ebp - 0xd80]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xd60]
inc edi
movups xmmword [0x5e29b0], xmm0
jmp 0x488fcd
mov dword [0x5e2b48], 0
mov edi, dword [ebp - 0xd80]
mov ecx, dword [ebp - 0xd60]
inc edi
jmp 0x488fcd
push 0x40
push 0x5e3318
mov edx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
call fcn.00425890
add esp, 8
test esi, esi
je 0x48a65b
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x5d9298]
test eax, eax
jne 0x48a695
push 0x1134
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov ecx, eax
mov dword [ebp - 4], 0xd
call fcn.0042b330
mov dword [0x5d9298], eax
test eax, eax
je 0x48a6a3
push 0x1134
push eax
call fcn.0052b7cc
add esp, 8
xor eax, eax
jmp 0x48a77d
mov edi, dword [ebp - 0xd5c]
inc edi
jmp 0x488fcd
mov eax, dword [ebp - 0xd74]
test eax, eax
jne 0x48a651
mov ecx, dword [ebp - 0xd7c]
call fcn.004888e0
test al, al
jne 0x48a71b
mov eax, dword [0x5d9298]
test eax, eax
jne 0x48a6ff
push 0x1134
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 8
mov ecx, eax
call fcn.0042b330
mov dword [0x5d9298], eax
test eax, eax
je 0x48a70d
push 0x1134
push eax
call fcn.0052b7cc
add esp, 8
test esi, esi
je 0x48a717
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x48a77d
call fcn.0048ad60
mov edi, eax
mov eax, dword [0x5d9298]
test eax, eax
jne 0x48a752
push 0x1134
call fcn.0052b79c
add esp, 4
mov dword [ebp - 0xd6c], eax
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0042b330
mov dword [0x5d9298], eax
test eax, eax
je 0x48a760
push 0x1134
push eax
call fcn.0052b7cc
add esp, 8
xor eax, eax
test edi, edi
setne al
mov dword [ebp - 0xd6c], eax
test esi, esi
je 0x48a77d
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0xd6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052b789
mov esp, ebp
pop ebp
ret 0x10