Function at 0x14003e640
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc90]
sub rsp, 0xd90
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0xc80], rax
mov rbx, rcx
mov qword [rbp + 0x20], rcx
xor r13d, r13d
mov qword [rcx + 0x2d8], r13
mov qword [rcx + 0x2e0], r13
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003e6d3
lea rdx, str.InjectTouchInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2d8], rax
lea rdx, str.InitializeTouchInjection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2e0], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [rbx + 0x2b8]
mov rdx, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_connected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140018c00
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x28], r13
mov rcx, qword [rbx + 0x2b8]
mov rdx, qword [rcx + 0x4f8]
mov rcx, qword [rbx + 0x2b0]
mov r8, qword [rcx]
call qword [r8 + 0x1e0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x40]
test al, al
je 0x14003e887
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x14003e8b6
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], r13b
je 0x14003e887
cmp byte [0x1401f32e3], r13b
jne 0x14003e887
mov rdx, qword [rbx + 0x2b0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
test ecx, ecx
jle 0x14003e7e2
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0x98], 0
jne 0x1400433c6
inc r13d
mov rdx, qword [rbx + 0x2b0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
cmp r13d, ecx
jl 0x14003e7b0
add dword [rdx + 0xb8], 0xa
mov rax, qword [rbx + 0x2b0]
cmp dword [rax + 0xb8], 0x14
jle 0x14003e803
mov dword [rax + 0xb8], setsockopt
lea r8, str.vncClientThread::run_:_PostAddNewClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x2b0]
mov r8, qword [rcx]
mov rax, qword [rbx + 0x2b8]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0x9c]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xa0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x19f]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140021390
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
jmp 0x1400433c6
mov rax, qword [rbx + 0x2b0]
mov dword [rax + 0xb8], r13d
lea r8, str.vncClientThread::run_:_negotiated_version_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x14003e933
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
cmp byte [0x1401f32e3], r13b
jne 0x1400433c6
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], r13b
jmp 0x14004333c
mov rdx, qword [rbx + 0x2b8]
cmp byte [rdx + 0x10c], r13b
jne 0x14003e961
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov rdx, qword [rdx + 0x4f8]
call qword [rax + 0x1e8]
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + 0x10c], r13b
mov rax, qword [0x1401fdf80]
imul edx, dword [rax + 0x758], 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.1400881c0
lea r8, str.vncClientThread::run_:_authenticated_connection_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov rcx, qword [rbx + 0x2b8]
call qword [rdi + 0x108]
mov rax, qword [rbx + 0x2b0]
mov rcx, qword [rbx + 0x2b8]
cmp qword [rax + 0x138], 1
ja 0x14003ea1e
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [0x1401fdf80]
mov r8, qword [rbx + 0x2b8]
mov edx, dword [rcx + 0x7a0]
mov rcx, qword [r8 + 0x4b0]
call fcn.140035220
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003ea72
mov rax, qword [rax + 0x108]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xd8]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2b0]
mov rdx, qword [rax + 0x108]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xd0]
mov rcx, qword [rbx + 0x2b8]
lea rdx, [rbp + 0x80]
mov rcx, qword [rcx + 0x4b0]
call fcn.1400352b0
mov rcx, qword [rbx + 0x2b8]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x840], xmm0
mov rdx, qword [rbx + 0x2b8]
mov rax, qword [rdx + 0x4b0]
mov ecx, dword [rax + 0x14]
mov dword [rdx + 0x850], ecx
mov dword [rbp - 0x4c], pe_nt_image_headers64
xor edx, edx
mov r8d, 0x132
lea rcx, [rbp + 0x400]
call fcn.140135010
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rsi, 0xffffffffffffffff
mov r14d, 0x100
lea rcx, [rbp + 0x400]
test eax, eax
je 0x14003eb5a
mov rdi, r13
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14003eb00
test rax, rax
je 0x14003eb3f
nop
movsx ecx, byte [rbp + rdi + 0x400]
call fcn.1401454f4
mov byte [rbp + rdi + 0x400], al
inc rdi
lea rcx, [rbp + 0x400]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003eb31
cmp rdi, rax
jb 0x14003eb10
mov edx, 0x2e
lea rcx, [rbp + 0x400]
call fcn.140146478
test rax, rax
je 0x14003eb6b
jmp 0x14003ebe8
lea r8, [0x1401c9b4c]
mov edx, 0x132
call fcn.14013b330
mov edx, r14d
lea rcx, [rbp + 0x2f0]
call fcn.14003df80
lea rcx, [rbp + 0x2f0]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003eb84
cmp rax, 3
jbe 0x14003ebe8
movzx eax, byte [rbp + 0x2f0]
sub al, 0x48
cmp al, 1
jbe 0x14003ebe8
lea r8, [0x1401c9b54]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013b390
lea r8, [rbp + 0x2f0]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013b390
lea r8, [0x1401c9b58]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013b390
lea r8, [0x1401c9b5c]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013b390
mov rax, qword [0x1401fdf80]
lea rcx, str.application_mode
lea r8, str.service_mode
cmp dword [rax + 0xe20], 0
cmove r8, rcx
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013b390
mov r8, qword [rbx + 0x2b8]
mov rax, qword [r8 + 0x4b0]
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0x23c], xmm0
mov ecx, dword [r8 + 0x848]
mov eax, dword [r8 + 0x840]
mov edx, ecx
sub edx, eax
sar edx, 8
mov r9d, 0xff
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x238], dx
mov ecx, dword [r8 + 0x84c]
mov eax, dword [r8 + 0x844]
mov edx, ecx
sub edx, eax
sar edx, 8
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x23a], dx
movq rax, xmm0
shr rax, 0x20
rol ax, 8
mov word [rbp + 0x240], ax
rol word [rbp + 0x242], 8
rol word [rbp + 0x244], 8
lea rax, [rbp + 0x400]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003ece0
mov eax, edi
bswap eax
mov dword [rbp + 0x24c], eax
mov r8d, 0x18
lea rdx, [rbp + 0x238]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088740
test eax, eax
je 0x14003e887
mov r8d, edi
lea rdx, [rbp + 0x400]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
test eax, eax
je 0x14003e887
lea r8, str.vncClientThread::run_:_sent_pixel_format_to_client_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x840
lea rcx, [rbp - 0x78]
call fcn.140025b70
nop
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x70]
call fcn.140139270
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 2
mov rcx, rbx
call fcn.140125e10
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 1
mov rax, qword [0x1401fdf80]
mov eax, dword [rax + 0x77c]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x50], 1
xor r15b, r15b
mov byte [rsp + 0x46], r15b
xor al, al
mov byte [rsp + 0x41], al
xor dil, dil
mov byte [rsp + 0x44], dil
mov byte [rsp + 0x51], 1
xor r12b, r12b
mov byte [rsp + 0x42], r12b
xor r14b, r14b
mov byte [rsp + 0x45], r14b
xor sil, sil
mov byte [rsp + 0x43], sil
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x118], al
je 0x140043090
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], eax
mov rax, qword [rcx]
call qword [rax + 0x138]
test al, al
jne 0x14003ee94
call fcn.140020fe0
test eax, eax
jne 0x14003ee94
lea r8, str.vncClientThread::run_:_vncClientThread__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.1400212b0
test eax, eax
je 0x140043090
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3c9], 0
je 0x14003eec6
cmp byte [rsp + 0x50], 0
je 0x14003eec6
mov cl, setsockopt
call fcn.14003df00
mov cl, 0x91
call fcn.14003df00
xor al, al
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 0x2b8]
cmp dword [rsp + 0x68], 0
je 0x14003eeec
mov rcx, qword [rcx + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004f570
mov dword [rsp + 0x68], r13d
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x4b0]
movzx edx, byte [rsp + 0x51]
mov rcx, qword [rcx + 0x90]
call fcn.14004fea0
mov byte [rsp + 0x51], 0
test r15b, r15b
mov r15d, 2
je 0x14003ef44
mov rax, qword [0x1401fdf80]
mov r8d, dword [rax + 0x118]
mov edx, r15d
mov rcx, qword [rbx + 0x2b8]
call fcn.1400482d0
mov dl, 1
mov rcx, qword [rbx + 0x2b8]
call fcn.140048340
mov byte [rsp + 0x46], 0
cmp byte [rsp + 0x41], 0
je 0x14003ef5f
mov dl, 1
mov rcx, qword [rbx + 0x2b8]
call fcn.140048340
xor al, al
mov byte [rsp + 0x41], al
test dil, dil
je 0x14003ef88
mov rax, qword [0x1401fdf80]
mov r8d, dword [rax + 0x11c]
mov edx, 3
mov rcx, qword [rbx + 0x2b8]
call fcn.1400482d0
mov byte [rsp + 0x44], 0
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x378], 0
je 0x14003efc1
cmp byte [rax + 0x9ca], 0
je 0x14003efc1
mov byte [rax + 0x378], 0
mov rcx, qword [rbx + 0x2b8]
mov r8d, dword [rcx + 0x374]
mov edx, dword [rcx + 0x370]
call fcn.1400482d0
test r12b, r12b
je 0x14003efd7
mov rcx, qword [rbx + 0x2b8]
call fcn.140048400
mov byte [rsp + 0x42], 0
test r14b, r14b
je 0x14003efed
mov rcx, qword [rbx + 0x2b8]
call fcn.140048450
mov byte [rsp + 0x45], 0
test sil, sil
je 0x14003f003
mov rcx, qword [rbx + 0x2b8]
call fcn.140048570
mov byte [rsp + 0x43], 0
mov r12d, 1
mov edi, r12d
mov rax, qword [rbx + 0x2a8]
cmp byte [rax + 0x31], 0
jne 0x14003f058
cmp byte [rax + 0x30], 0
je 0x14003f058
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x210]
cmp byte [rax + 0x39], 0
je 0x14003f058
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140043082
mov edi, r13d
jmp 0x14003f076
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140043082
movzx eax, byte [rbp + 0x140]
cmp eax, 0xfd
ja case.0x14003f0a1.1
lea rsi, [0x140000000]
movzx eax, byte [rsi + rax + 0x43454]
mov ecx, dword [rsi + rax*4 + 0x43410]
add rcx, rsi
jmp rcx
mov byte [rsp + 0x41], r12b
jmp 0x140040969
mov r8d, setsockopt
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140040962
rol word [rbp + 0x148], 8
rol word [rbp + 0x14a], 8
rol word [rbp + 0x14c], 8
mov edx, r13d
cmp byte [rbp + 0x151], r12b
sete dl
mov rcx, qword [rax + 0x4b0]
mov dword [rcx + 0x9c], edx
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
lea rdx, [rbp + 0x144]
call fcn.1400384f0
test eax, eax
jne 0x14003f160
lea r8, str.vncClientThread::run_:_remote_pixel_format_invalid_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x5a8], r12d
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
jmp 0x140040969
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
mov rcx, qword [rbx + 0x2b8]
mov dword [rcx + 0x4a0], r13d
xor edx, edx
mov rcx, qword [rcx + 0x4b0]
call fcn.1400371b0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x48c], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x490], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x494], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x498], r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
mov rdi, 0xffffffffffffffff
mov edx, edi
call fcn.1400386f0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x478], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f238
mov dword [rcx + 0x7c], edi
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x470], 6
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f25c
mov dword [rcx + 0x74], 6
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x480], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f27d
mov dword [rcx + 0x84], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f29e
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f2cd
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
rol word [rbp + 0x142], 8
mov esi, r13d
mov r15d, r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x20]
mov r14d, r13d
cmp r13w, word [rbp + 0x142]
jae 0x14003f9dc
nop dword [rax]
mov dword [rsp + 0x48], r13d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x14003f9c6
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov r8d, edi
and r8d, 0xff00
mov ecx, edi
shl ecx, 0x10
or ecx, r8d
shl ecx, 8
or ecx, edx
cmp ecx, 1
jne 0x14003f3d1
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x20]
jmp 0x14003f9b1
cmp ecx, 0xffffff21
jne 0x14003f3ec
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x648], r12d
jmp 0x14003f9b1
cmp ecx, 0xfffffecc
jne 0x14003f407
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x64c], r12d
jmp 0x14003f9b1
cmp ecx, 0xffff0001
jne 0x14003f449
mov rcx, qword [rbx + 0x2b8]
mov dword [rcx + 0x4a0], r12d
mov edx, r12d
mov rcx, qword [rcx + 0x4b0]
call fcn.1400371b0
lea r8, str.vncClientThread::run_:_Cache_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
jmp 0x14003f9b1
cmp ecx, 0xffff000b
jne 0x14003f468
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x48c], r12d
lea r8, str.vncClientThread::run_:_XOR_protocol_extension_enabled_n
jmp 0x14003f433
lea eax, [rcx + 0x100]
cmp eax, 9
ja 0x14003f4d6
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x100]
mov rax, qword [rbx + 0x2b8]
mov ecx, 6
cmp r9d, 9
cmovbe ecx, r9d
mov dword [rax + 0x470], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003f4b9
mov eax, 6
cmp ecx, 9
cmovbe eax, ecx
mov dword [rdx + 0x74], eax
lea r8, str.vncClientThread::run_:_compression_level_requested:__d_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
jmp 0x14003f9b1
cmp ecx, 0xffffffe0
jb 0x14003f512
cmp ecx, 0xffffffe9
ja 0x14003f88e
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
lea edx, [rdi + 0x20]
call fcn.1400386f0
lea r9d, [rdi + 0x20]
lea r8, str.vncClientThread::run_:_image_quality_level_requested:__d_n
jmp 0x14003f4c0
cmp ecx, 0xfffffe00
jb 0x14003f6d6
cmp ecx, 0xfffffe64
ja 0x14003f579
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x200]
mov rax, qword [rbx + 0x2b8]
mov rdi, 0xffffffffffffffff
mov ecx, edi
cmp r9d, 0x64
cmovbe ecx, r9d
mov dword [rax + 0x478], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003f56d
mov eax, edi
cmp ecx, 0x64
cmovbe eax, ecx
mov dword [rdx + 0x7c], eax
lea r8, str.vncClientThread::run_:_fine_grained_image_quality_level_requested:__d_n
jmp 0x14003f4c0
cmp ecx, 0xffffff20
jne 0x14003f5ae
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x480], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f5a2
mov dword [rcx + 0x84], r12d
lea r8, str.vncClientThread::run_:_LastRect_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xffffff10
jne 0x14003f631
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x484], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f5d7
mov dword [rcx + 0x88], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_X_style_cursor_shape_updates_enabled_n
jmp 0x14003f433
cmp ecx, 0xffffff11
jne 0x14003f6b4
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f65a
mov dword [rcx + 0x8c], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x14003f433
cmp ecx, 0xffffff18
jne 0x14003f729
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r12d
lea r8, str.vncClientThread::run_:_PointerPos_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xfffffd00
jb 0x14003f729
cmp ecx, 0xfffffd05
ja 0x14003f88e
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
add edi, 0x300
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x47c], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f71a
mov dword [rcx + 0x80], edi
mov r9d, edi
lea r8, str.vncClientThread::run_:_subsampling_requested:__d_n
jmp 0x14003f4c0
cmp ecx, 0xffff8000
jne 0x14003f759
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c8], 1
mov rax, qword [0x1401fdf80]
mov byte [rax + 0xe1c], 1
lea r8, str.vncClientThread::run_:_ServerState_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xffff8003
jne 0x14003f77b
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9cc], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xffff8001
jne 0x14003f7b0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9cb], 1
mov rax, qword [0x1401fdf80]
mov byte [rax + 0xe1d], 1
mov byte [rsp + 0x46], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xffff8004
jne 0x14003f7c9
mov byte [rsp + 0x44], 1
lea r8, str.vncClientThread::run_:_IdleTime_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xffff8002
jne 0x14003f7f9
mov byte [rsp + 0x42], 1
lea r8, str.vncClientThread::run_:_FTProtocolVersion_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r12d, 1
jmp 0x14003f9b1
cmp ecx, 0xc0a1e5ce
jne 0x14003f820
mov byte [rsp + 0x45], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x5b0], 1
lea r8, str.vncClientThread::run_:_Extended_clipboard_protocol_extension_enabled_n
jmp 0x14003f433
cmp ecx, 0xc0a1e5cf
jne 0x14003f839
mov byte [rsp + 0x43], 1
lea r8, str.vncClientThread::run_:_Streaming_DSM_support_enabled_n
jmp 0x14003f433
cmp ecx, 0xfffffecf
jne 0x14003f861
lea r8, str.vncClientThread::run_:_Gii_Encoding_found_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r15d, r12d
jmp 0x14003f9b1
cmp ecx, 0x10
jne 0x14003f88e
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x490], r12d
lea r8, str.vncClientThread::run_:_ZRLE_found__n
lea edx, [rcx - 7]
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov ecx, edi
shl ecx, 0x10
mov eax, edi
and eax, 0xff00
or ecx, eax
shl ecx, 8
or edx, ecx
cmp edx, 0x12
jne 0x14003f8e2
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x494], r12d
lea r8, str.vncClientThread::run_:_XZ_found__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov edi, dword [rsp + 0x48]
mov ecx, edi
and ecx, 0xff0000
mov eax, edi
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shl eax, 8
or ecx, eax
cmp ecx, 7
jne 0x14003f92f
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x498], r12d
lea r8, str.vncClientThread::run_:_Tight_found_n
lea edx, [rcx + 2]
lea rcx, vtable.VNCLog.0
call fcn.140018c00
test esi, esi
jne 0x14003f9b1
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 0x55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, dword [rsp + 0x48]
mov edx, r8d
and edx, 0xff0000
mov ecx, r8d
shr ecx, 0x10
or edx, ecx
shr edx, 8
mov eax, r8d
shl eax, 0x10
and r8d, 0xff00
or eax, r8d
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
xor r8d, r8d
call fcn.140037630
test eax, eax
cmovne esi, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc r14d
movzx eax, word [rbp + 0x142]
cmp r14d, eax
jl 0x14003f360
jmp 0x14003f9d4
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
test esi, esi
jne 0x14003fa67
lea r8, str.vncClientThread::run_:_defaulting_to_raw_encoder_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
xor r8d, r8d
xor edx, edx
call fcn.140037630
test eax, eax
jne 0x14003fa5e
lea r8, str.vncClientThread::run_:_failed_to_select_raw_encoder__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x2b8]
cmp dword [rax + 0x670], 0
jne 0x14003fb0e
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003fa95
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003fac4
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp eax, 1
jbe 0x14003fb30
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x228]
test r15d, r15d
je 0x14003fb61
cmp qword [rbx + 0x2d8], 0
je 0x14003fb61
cmp qword [rbx + 0x2e0], 0
je 0x14003fb61
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3cb], 0
je 0x14003fb61
mov rcx, rbx
call fcn.14003b040
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x3a8], r12d
jmp 0x14003f16e
mov byte [rsp + 0x40], 0
mov word [rsp + 0x4c], r13w
xor sil, sil
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x308
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x14003fbee
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_subtype_failed___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140040969
mov r8d, r15d
lea rdx, [rsp + 0x4c]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x14003fc0f
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_length_failed___n
jmp 0x14003fbc3
movzx edx, byte [rsp + 0x40]
movzx r8d, word [rsp + 0x4c]
test dl, dl
jns 0x14003fc33
mov sil, 1
rol r8w, 8
mov word [rsp + 0x4c], r8w
and dl, 0x7f
mov byte [rsp + 0x40], dl
movzx r9d, dl
mov ecx, r9d
test dl, dl
je 0x140040298
sub ecx, 1
je 0x1400401df
sub ecx, 1
je 0x14003fcd7
cmp ecx, 1
je 0x14003fc81
lea r8, str.vncClientThread::run_:_GII:_Extension_invalid_subtype:__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
mov rax, qword [rbx + 0x2b8]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], dl
jne 0x14003fcb8
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3cb], 0
jne 0x14003fd0f
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1bc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1cc], xmm1
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1ec], r13
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x309
lea rcx, [rbp + 0x48]
call fcn.140019c00
nop
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIDeviceCreation__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov byte [rbp + 0x1b8], 0xfd
movzx eax, byte [rsp + 0x40]
mov byte [rbp + 0x1b9], al
movzx eax, word [rsp + 0x4c]
mov word [rbp + 0x1ba], ax
mov r8d, gethostname
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x14003fdd1
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
lea rcx, [rbp + 0x48]
call fcn.140019c30
jmp 0x1400408ff
test sil, sil
je 0x14003ff04
mov ecx, dword [rbp + 0x1e0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e0], edx
mov ecx, dword [rbp + 0x1e4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e4], edx
mov ecx, dword [rbp + 0x1e8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e8], edx
mov ecx, dword [rbp + 0x1ec]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x1ec], r8d
mov ecx, dword [rbp + 0x1f0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1f0], edx
mov ecx, dword [rbp + 0x1dc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
bswap edx
mov dword [rbp + 0x1dc], edx
jmp 0x14003ff0b
mov r8d, dword [rbp + 0x1ec]
lea eax, [r8 - 1]
cmp eax, 9
ja 0x1400401d3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], eax
mov edi, r13d
test r8d, r8d
je 0x14003fdc3
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, [rbp + 0x250]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400401c7
test sil, sil
je 0x14004013a
mov ecx, dword [rbp + 0x250]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x250], edx
mov ecx, dword [rbp + 0x2a4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a4], edx
mov ecx, dword [rbp + 0x2a8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a8], edx
mov ecx, dword [rbp + 0x2ac]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2ac], edx
mov ecx, dword [rbp + 0x2b0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b0], edx
mov ecx, dword [rbp + 0x2b4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b4], edx
mov ecx, dword [rbp + 0x2b8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b8], edx
mov ecx, dword [rbp + 0x2bc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2bc], edx
mov ecx, dword [rbp + 0x2c0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2c0], edx
mov dword [rbp - 0x80], 0x40082fd
mov dword [rbp - 0x7c], 0x1000000
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r8d, 8
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088740
test eax, eax
je 0x1400401bb
mov edx, r12d
mov ecx, dword [rbp + 0x1f0]
call qword [rbx + 0x2e0]
mov ecx, dword [rbp + 0x1f0]
mov dword [rbx + 0x2f0], ecx
lea eax, [rcx - 1]
cmp eax, 0xfc
ja 0x1400401a8
call fcn.14013268c
mov qword [rbx + 0x2e8], rax
inc edi
cmp edi, dword [rbp + 0x1ec]
jb 0x14003ff60
jmp 0x14003fdc3
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
jmp 0x14003fda7
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation_valuators_failed_n
jmp 0x14003fda7
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation__invalid_amount_of_valuators_n
jmp 0x14003fda7
mov rax, qword [rbx + 0x2b8]
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], 0
je 0x140043058
mov word [rsp + 0x54], r13w
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIVersionMessage__n
mov edx, 9
call fcn.140018c00
cmp word [rsp + 0x4c], 2
je 0x14004022b
movzx r9d, word [rsp + 0x54]
lea r8, str.vncClientThread::run_:_GII:Extension_invalid_length:__d_n
jmp 0x14003fc60
mov r8d, r15d
lea rdx, [rsp + 0x54]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x14004026b
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_version_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
movzx eax, word [rsp + 0x54]
test sil, sil
je 0x14004027e
rol ax, 8
mov word [rsp + 0x54], ax
cmp ax, 1
je 0x1400408ff
movzx r9d, ax
lea r8, str.vncClientThread::run_:_GII:_Extension_client_version_invalid_number:__d_n
jmp 0x14003fc60
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3cb], 0
jne 0x1400402d0
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x1400408ff
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov byte [rbp + 0x188], 0xfd
mov byte [rbp + 0x189], dl
mov word [rbp + 0x18a], r8w
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x18c]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x140040316
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
jmp 0x1400402af
test sil, sil
je 0x1400403bf
rol word [rbp + 0x18e], 8
mov ecx, dword [rbp + 0x190]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x190], edx
mov ecx, dword [rbp + 0x194]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x194], r8d
mov ecx, dword [rbp + 0x198]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x198], edx
jmp 0x1400403c6
mov r8d, dword [rbp + 0x194]
mov ecx, r8d
mov eax, 0x20
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14013268c
mov r15, rax
mov r14d, r13d
cmp dword [rbp + 0x194], r13d
jbe 0x1400407d1
lea r12d, [rdi + 5]
nop dword [rax + rax]
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x78], r13d
mov qword [rbp + 0x168], r13
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
test sil, sil
je 0x140040472
mov ecx, dword [rsp + 0x48]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x48], edx
mov r8d, r12d
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
test sil, sil
je 0x1400404c1
mov ecx, dword [rsp + 0x58]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x58], edx
jmp 0x1400404c5
mov edx, dword [rsp + 0x58]
mov edi, r14d
shl rdi, 5
add rdi, r15
mov dword [rdi], edx
mov r8d, r12d
lea rdx, [rsp + 0x5c]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
test sil, sil
je 0x140040520
mov ecx, dword [rsp + 0x5c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x5c], edx
jmp 0x140040524
mov edx, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x48]
test r9b, 0x10
je 0x14004079e
mov eax, edx
shr eax, 0x10
mov dword [rdi + 0xc], eax
movzx eax, dx
mov dword [rdi + 0x10], eax
bt r9d, 0x1c
jae 0x1400405b3
mov r8d, r12d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
test sil, sil
je 0x1400405a2
mov ecx, dword [rsp + 0x60]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x60], edx
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x1400405b9
mov edx, dword [rsp + 0x60]
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x1400405b9
mov eax, r12d
mov edx, r12d
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], eax
bt r9d, 0x19
jae 0x1400405e7
mov r8d, r12d
lea rdx, [rsp + 0x64]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140040618
mov ecx, dword [rsp + 0x64]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x64], edx
bt r9d, 0x18
jae 0x140040640
mov r8d, r12d
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140040671
mov ecx, dword [rsp + 0x78]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x78], edx
bt r9d, 0x17
jae 0x14004069e
mov r8d, 8
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400407a7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140040738
mov rdx, qword [rbp + 0x168]
mov r8, rdx
movabs rax, 0xff000000000000
and r8, rax
mov rax, rdx
shr rax, 0x10
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff0000000000
and rax, rcx
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff00000000
and rax, rcx
or r8, rax
shr r8, 8
mov rcx, rdx
shl rcx, 0x10
mov rax, rdx
and eax, 0xff00
or rcx, rax
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
mov eax, 0xff000000
and rdx, rax
or rcx, rdx
shl rcx, 8
or r8, rcx
mov qword [rbp + 0x168], r8
mov dword [rdi + 4], r13d
mov eax, dword [rdi]
cmp eax, dword [rbx + 0x2f0]
jae 0x140040789
mov ecx, eax
test r9d, r9d
jns 0x140040777
mov rax, qword [rbx + 0x2e8]
cmp byte [rcx + rax], 1
jne 0x140040763
mov dword [rdi + 4], 0x20006
jmp 0x140040789
mov dword [rdi + 4], 0x10006
mov rax, qword [rbx + 0x2e8]
mov byte [rcx + rax], 1
jmp 0x140040789
mov dword [rdi + 4], 0x40000
mov rax, qword [rbx + 0x2e8]
mov byte [rcx + rax], 0
mov dword [rdi + 0x1c], r13d
inc r14d
cmp r14d, dword [rbp + 0x194]
jae 0x1400407ca
jmp 0x140040400
lea r8, str.vncClientThread::run_:_Only_16bit_XT_supported_n
jmp 0x1400407ae
lea r8, str.vncClientThread::run_:_GIIExtension_reading_TouchINfo_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rdi, 0xffffffffffffffff
mov eax, dword [rbp + 0x194]
cmp eax, 0xfe
ja 0x1400408f6
mov ecx, eax
mov eax, 0x90
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14013268c
mov rsi, rax
mov ecx, dword [rbp + 0x194]
lea r8, [rcx + rcx*8]
shl r8, 4
xor edx, edx
mov rcx, rax
call fcn.140135010
mov edi, r13d
mov ecx, dword [rbp + 0x194]
test ecx, ecx
je 0x1400408e5
mov ebx, 7
lea r14d, [rbx - 5]
nop dword [rax]
mov ecx, edi
lea r11, [rcx + rcx*8]
shl r11, 4
add r11, rsi
mov dword [r11], r14d
shl rcx, 5
lea r10, [rcx + r15]
mov r9d, dword [r10 + 0xc]
mov dword [r11 + 0x20], r9d
mov r8d, dword [r10 + 0x10]
mov dword [r11 + 0x24], r8d
mov eax, dword [r10 + 0x1c]
mov dword [r11 + 0x40], eax
mov dword [r11 + 0x60], r13d
mov dword [r11 + 0x64], ebx
mov dword [r11 + 0x88], 0x5a
mov dword [r11 + 0x8c], 0x7d00
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ecx, r8d
sub ecx, eax
mov dword [r11 + 0x6c], ecx
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, r8d
mov dword [r11 + 0x74], eax
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
mov ecx, r9d
sub ecx, eax
mov dword [r11 + 0x68], ecx
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, r9d
mov dword [r11 + 0x70], eax
mov eax, dword [r10]
mov dword [r11 + 4], eax
mov eax, dword [r10 + 4]
mov dword [r11 + 0xc], eax
inc edi
mov ecx, dword [rbp + 0x194]
cmp edi, ecx
jb 0x140040830
mov rbx, qword [rbp + 0x20]
mov rdx, rsi
call qword [rbx + 0x2d8]
mov rcx, rsi
call fcn.140132640
mov rcx, r15
call fcn.140132640
nop
lea rcx, [rbp - 0x20]
call fcn.140019c30
jmp 0x140040969
mov r8d, 0xa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
movsd xmm0, qword [rbp + 0x140]
movsd qword [rbp - 0x10], xmm0
movzx eax, word [rbp + 0x148]
mov word [rbp - 8], ax
lea rdx, [rbp - 0x10]
mov rcx, qword [rbx + 0x2b8]
call fcn.140044520
test al, al
jne 0x140040969
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, qword [0x1401fdf80]
call fcn.140038ff0
test eax, eax
je 0x140040985
mov rcx, qword [rbx + 0x2b8]
call fcn.1400481b0
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x118], 0
je 0x140043090
movzx r12d, byte [rsp + 0x42]
movzx esi, byte [rsp + 0x43]
movzx edi, byte [rsp + 0x44]
movzx r14d, byte [rsp + 0x45]
movzx r15d, byte [rsp + 0x46]
jmp 0x14003ee44
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140040b67
cmp byte [0x1401f2eda], 0
je 0x140040af9
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x144], edx
cmp byte [rbp + 0x141], 0
je 0x140040b67
lea r8d, [rdx - 0x61]
cmp r8d, 0x63
ja 0x140040b67
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rdx, qword [rcx + 0x90]
movsxd rax, r8d
imul rcx, rax, 0x64
mov rax, qword [rdx + 0xe440]
mov ecx, dword [rcx + rax]
mov dword [0x1401f2edc], ecx
lea r8, str.GlobalSessionEventUltraPreConnect
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rsi, rax
lea r8, str.GlobalSessionUltraPreConnect
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x140040acd
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140040ac4
mov ecx, dword [0x1401f2edc]
mov dword [rax], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140040b67
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2b8]
call fcn.140046de0
jmp 0x140040969
mov r8, qword [rbx + 0x2b8]
cmp byte [r8 + 0x3c9], 0
je 0x140040b67
mov edx, dword [rbp + 0x144]
mov ecx, edx
and ecx, 0xff0000
mov eax, edx
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shl eax, 8
or ecx, eax
mov dword [rbp + 0x144], ecx
cmp byte [rbp + 0x141], 0
setne dl
movzx r9d, byte [r8 + 0x3cd]
movzx r8d, byte [r8 + 0x3cc]
call fcn.140076080
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x5ac], r12d
mov rcx, qword [rbx + 0x2b8]
call fcn.140046de0
jmp 0x140040969
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140040969
cmp byte [0x1401f2eda], 0
jne 0x140040969
mov r8, qword [rbx + 0x2b8]
cmp byte [r8 + 0x3ca], 0
je 0x140040969
movzx eax, word [rbp + 0x142]
rol ax, 8
mov word [rbp + 0x142], ax
movzx ecx, word [rbp + 0x144]
rol cx, 8
mov word [rbp + 0x144], cx
movzx eax, ax
movzx edx, word [r8 + 0x850]
imul edx, eax
mov word [rbp + 0x142], dx
movzx eax, word [r8 + 0x850]
movzx r9d, cx
imul r9d, eax
mov word [rbp + 0x144], r9w
mov r14d, 0x8000
cmp dx, word [r8 + 0x536]
jne 0x140040c2e
cmp r9w, word [r8 + 0x538]
je 0x140040c34
mov r14d, 0x8001
movzx ecx, byte [rbp + 0x141]
movzx eax, cl
xor al, byte [r8 + 0x535]
test r12b, al
je 0x140040c7e
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movzx ecx, byte [rbp + 0x141]
test eax, eax
movzx eax, cl
not al
je 0x140040c71
and eax, r12d
lea eax, [rax*8 + 8]
jmp 0x140040c7b
and eax, r12d
lea eax, [rax*2 + 2]
or r14d, eax
mov rax, qword [rbx + 0x2b8]
movzx r8d, byte [rax + 0x535]
movzx edx, cl
and dl, 2
movzx eax, r8b
and al, 2
cmp dl, al
je 0x140040caf
mov eax, 0x40
test dl, dl
mov edx, 0x20
cmovne eax, edx
or r14d, eax
xor r8b, cl
test r8b, 4
je 0x140040cf7
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 4
test eax, eax
je 0x140040cde
test byte [rbp + 0x141], dil
mov eax, edi
cmovne eax, r15d
or r14d, eax
jmp 0x140040cfc
test byte [rbp + 0x141], 4
mov eax, reloc.WS2_32.dll_recv
mov ecx, 8
cmovne eax, ecx
or r14d, eax
jmp 0x140040cfc
mov edi, 4
mov rcx, qword [0x1401fdf80]
call fcn.140039000
test eax, eax
je 0x140040e15
mov rcx, qword [rbx + 0x2b8]
movzx edx, byte [rcx + 0x535]
movzx eax, dl
movzx r8d, byte [rbp + 0x141]
xor al, r8b
test r12b, al
jne 0x140040d39
xor dl, r8b
test dl, 2
je 0x140040d60
cmp byte [rcx + 0x3b8], 0
jne 0x140040e15
mov byte [rcx + 0x3ad], r12b
mov rcx, qword [rbx + 0x2b0]
call fcn.1400864b0
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3b8], 0
jne 0x140040e15
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, dword [rdi + 0x38c]
add r14d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r14d, ecx
sub r14d, eax
mov rcx, qword [0x1401fdf80]
call fcn.140039030
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140040df6
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r14d, word [rbp + 0x144]
add r14d, dword [rax + 0x384]
mov rcx, qword [rax + 0x3c0]
test rcx, rcx
je 0x140040969
mov r8d, r14d
mov edx, esi
call fcn.140023ef0
jmp 0x140040969
mov r12d, r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
call fcn.140038780
movzx ecx, byte [rbp + 0x141]
test eax, eax
je 0x140040e63
mov rax, qword [rbx + 0x2b8]
test cl, 8
je 0x140040e53
test byte [rax + 0x535], 8
jne 0x140040e53
mov r12d, 0x78
jmp 0x140040e83
test cl, 0x10
je 0x140040e88
test byte [rax + 0x535], 0x10
jne 0x140040e88
jmp 0x140040e7d
movzx eax, cl
and al, 8
je 0x140040e6f
bts r14d, 0xb
neg al
sbb r12d, r12d
and r12d, 0x78
test cl, 0x10
je 0x140040e88
mov r12d, 0xffffff88
bts r14d, 0xb
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x48]
call qword [rax + 0x1c0]
mov r8, qword [rbx + 0x2b8]
cmp dword [r8 + 0x390], 0
je 0x140040f2a
movzx eax, word [rbp + 0x142]
mov ecx, dword [r8 + 0x380]
add ecx, eax
imul eax, ecx, 0xffff
mov ecx, dword [rbp - 0x48]
dec ecx
cdq
idiv ecx
mov esi, eax
movzx ecx, word [rbp + 0x144]
mov edx, dword [r8 + 0x384]
add edx, ecx
imul eax, edx, 0xffff
mov r8d, dword [rbp - 0x68]
dec r8d
cdq
idiv r8d
mov edi, eax
mov rcx, qword [rbx + 0x2b0]
call fcn.140085420
neg eax
sbb rdx, rdx
and edx, 0x564e4300
mov qword [rsp + 0x20], rdx
mov r9d, r12d
mov r8d, edi
mov edx, esi
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x14004115f
lea rcx, [r8 + 0x998]
call fcn.140029f10
test al, al
je 0x140041064
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
mov rdi, qword [rbx + 0x2b8]
lea ecx, [rax + 0x4c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, dword [rdi + 0x38c]
add r15d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r15d, ecx
sub r15d, eax
mov rcx, qword [0x1401fdf80]
call fcn.140039030
test eax, eax
je 0x140040fd6
mov rax, qword [rbx + 0x2b8]
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r15d, word [rbp + 0x144]
add r15d, dword [rax + 0x384]
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, esi, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x60], eax
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, r15d, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x64], eax
bts r14d, 0xe
mov dword [rbp + 0x6c], r14d
mov rcx, qword [rbx + 0x2b0]
call fcn.140085420
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x68], r12d
mov dword [rbp + 0x70], r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x998
call fcn.140049010
mov r8d, 0x28
lea rdx, [rbp + 0x58]
mov r12d, 1
mov ecx, r12d
call rax
jmp 0x140041165
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6c], r13d
mov dword [rbp - 0x64], 0xa
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov dword [rbp + 0x2e8], eax
test r14b, 1
je 0x1400410f4
btr r14d, 0xf
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x70]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov qword [rbp + 0x2d0], 0xa
mov dword [rbp + 0x2d8], r13d
xor r9d, r9d
lea r8, [rbp - 0x64]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rbp + 0x2d0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov rcx, qword [rbx + 0x2b0]
call fcn.140085420
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
movzx r8d, word [rbp + 0x144]
sub r8d, dword [rbp - 0x2c]
movzx edx, word [rbp + 0x142]
sub edx, dword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
test r14b, 1
je 0x14004115f
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r12d, 1
mov rcx, qword [rbx + 0x2b8]
mov eax, dword [rbp + 0x140]
mov dword [rcx + 0x534], eax
movzx eax, word [rbp + 0x144]
mov word [rcx + 0x538], ax
jmp 0x140040b59
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140040969
mov ecx, dword [rbp + 0x144]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x6400000
jg 0x140040969
test edi, edi
jns 0x140041339
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x5b0], 0
je 0x140040969
mov eax, edi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, 0x6400000
ja 0x140040969
lea rcx, [rbp]
call fcn.140015360
nop
xor r8d, r8d
mov edx, edi
lea rcx, [rbp]
call fcn.1400153c0
lea rcx, [rbp]
call fcn.1400153b0
mov rdx, rax
mov r8d, edi
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x140041260
lea rcx, [rbp]
call fcn.1400153a0
jmp 0x140040969
lea rcx, [rbp]
call fcn.140015470
mov ecx, 0xff000000
and eax, ecx
bt eax, 0x18
jb 0x140041310
cmp eax, 0x1000000
je 0x140041310
lea ecx, [rax - 0x2000000]
test ecx, 0xfdffffff
je 0x1400412bb
cmp eax, 0x10000000
jne 0x14004132b
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2b8]
lea rdx, [rbp]
call qword [rax + 0x158]
jmp 0x14004132b
lea rcx, [rbp + 0x1b8]
call fcn.1400158c0
nop
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.140015930
test al, al
je 0x140041302
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
lea rcx, [rbp]
call fcn.140015470
mov r8d, eax
lea rdx, [rbp + 0x1b8]
mov rcx, qword [rbx + 0x2b8]
call qword [rdi + 0x28]
nop
lea rcx, [rbp + 0x1b8]
call fcn.1400158e0
jmp 0x14004132b
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x5b0
mov r8b, 1
lea rdx, [rbp]
call fcn.1400156f0
nop
lea rcx, [rbp]
call fcn.1400153a0
jmp 0x140040969
movsxd rcx, edi
inc rcx
call fcn.14013268c
mov r14, rax
movsxd rcx, edi
mov byte [rcx + rax], 0
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
jne 0x140041371
mov rcx, r14
call fcn.140132640
jmp 0x140040969
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140041380
lea eax, [rdi + rdi]
movsxd rcx, eax
inc rcx
call fcn.14013268c
mov rsi, rax
mov rcx, r13
movsxd rax, edi
test edi, edi
jle 0x1400413d4
mov rdx, r14
nop dword [rax + rax]
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x1400413c5
mov byte [rsi + rcx], reloc.WS2_32.dll_listen
inc rcx
movzx r8d, byte [rdx]
mov byte [rsi + rcx], r8b
inc rcx
inc rdx
sub rax, r12
jne 0x1400413b0
mov byte [rsi + rcx], 0
mov rcx, r14
call fcn.140132640
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x5e0
mov rdx, rsi
call fcn.140016e30
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x150]
mov rcx, rsi
call fcn.140132640
jmp 0x140040969
mov rcx, qword [rbx + 0x2b0]
call fcn.1400834f0
test al, al
jne case.0x14003f0a1.8
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x859], r12b
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x859], 0
je 0x14004146e
call fcn.140088930
test eax, eax
jne 0x14004147b
jmp case.0x14003f0a1.1
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
mov rcx, qword [rbx + 0x2b0]
call fcn.1400834f0
cmp al, r12b
je 0x140040969
movzx ecx, byte [rbp + 0x141]
lea eax, [rcx - 1]
cmp al, 8
ja 0x140040969
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x854], ecx
movzx ecx, byte [rbp + 0x141]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x850], ecx
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x57
lea rcx, [rbp + 0x90]
call fcn.140019c00
nop
movzx edx, byte [rbp + 0x141]
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x4b0]
call fcn.140035220
mov rcx, qword [rbx + 0x2b8]
test eax, eax
jne 0x140041522
mov byte [rcx + 0x118], al
lea rcx, [rbp + 0x90]
call fcn.140019c30
jmp 0x140040969
mov byte [rcx + 0x858], 1
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe434]
cdq
idiv ecx
mov dword [r8 + 0xe434], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe438]
cdq
idiv ecx
mov dword [r8 + 0xe438], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe42c]
cdq
idiv ecx
mov dword [r8 + 0xe42c], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe430]
cdq
idiv ecx
mov dword [r8 + 0xe430], eax
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x2b8]
call fcn.140044a50
nop
lea rcx, [rbp + 0x90]
call fcn.140019c30
jmp 0x140040969
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140040962
mov byte [rax + 0x9ca], r12b
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3c9], 0
je 0x140040969
lea r9, str.enabled
cmp byte [rbp + 0x141], r12b
lea rax, str.disabled
cmove r9, rax
lea r8, str.vncClientThread::run_:_rfbSetServerInput:_inputs__s_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.1400373f0
test al, al
jne 0x1400416da
cmp byte [rbp + 0x141], r12b
jne 0x1400416da
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
movzx edx, r12b
mov rcx, qword [rcx + 0x90]
call fcn.14004fe00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], r12b
jmp 0x140040969
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.1400373f0
test al, al
je 0x14004170f
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], 0
je 0x14004170f
cmp byte [rbp + 0x141], 0
je 0x14004174e
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.1400373f0
test al, al
jne 0x140040969
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], al
jne 0x140040969
cmp byte [rbp + 0x141], al
jne 0x140040969
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004fe00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], 0
jmp 0x140040969
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
lea rcx, [rbp - 0x78]
call fcn.140048f70
nop
mov esi, r13d
mov r14d, r13d
cmp byte [rbp + 0x146], r13b
jbe 0x1400418da
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x1400418cc
movzx eax, word [rbp + 0x16c]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x54], eax
movzx eax, word [rbp + 0x16e]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x58], eax
movzx eax, word [rbp + 0x170]
rol ax, 8
movzx r8d, ax
mov dword [rbp - 0x5c], r8d
movzx eax, word [rbp + 0x172]
rol ax, 8
movzx edx, ax
mov dword [rbp - 0x60], edx
mov ecx, dword [rbp + 0x174]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
imul edx, r8d
cmp edx, 0xc00000
jg 0x1400418b7
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x5c]
lea rcx, [rbp + 0x118]
call fcn.1400492d0
mov rdi, rax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xe0]
call fcn.1400492d0
mov rdx, rax
mov r8, rdi
lea rcx, [rbp + 0x120]
call fcn.1400492e0
mov r8, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140049300
inc r14d
movzx eax, byte [rbp + 0x146]
cmp r14d, eax
jl 0x1400417c0
jmp 0x1400418da
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2b0]
mov edi, r13d
cmp dword [rax + 0xd4], r13d
cmovne edi, esi
cmp edi, 3
sete cl
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x4d8], cl
mov rcx, qword [rbx + 0x2b0]
cmp qword [rcx + 0xd8], 0
je 0x14004194a
call fcn.1400834f0
test al, al
jne 0x14004194a
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x108]
call fcn.140033ed0
mov r9, qword [rbx + 0x2b8]
lea r8, [r9 + 0xc]
movsx r10d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r10d
jmp 0x1400419a1
mov rcx, qword [rbx + 0x2b0]
cmp qword [rcx + 0xd8], 0
je 0x1400419c1
call fcn.1400834f0
test al, al
je 0x1400419c1
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x4d8], 0
je 0x1400419c1
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xe8]
call fcn.140033ed0
mov r9, qword [rbx + 0x2b8]
lea rdx, [r9 + 0xc]
movsx r8d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r8d
mov rcx, qword [rbx + 0x2b0]
movzx r9d, byte [r9 + 0x4d8]
mov r8, rax
mov edx, edi
mov rcx, qword [rcx + 0xd8]
call fcn.1400332c0
mov rcx, qword [rbx + 0x2b8]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax + 0xc], 0
jne 0x1400419d0
test rax, rax
jne 0x1400419e5
mov byte [rcx + 0x4d8], al
lea rcx, [rbp - 0x78]
call fcn.140032a60
jmp 0x140040969
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
movzx r10d, word [rbp + 0x142]
rol r10w, 8
movzx edx, word [rbp + 0x144]
cmp r10w, 5
jae 0x140041a69
movzx eax, dx
rol ax, 8
cmp ax, 5
jae 0x140041a69
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8d, r12d
mov edx, r12d
mov rcx, qword [rcx + 0x90]
call fcn.14004f5a0
jmp 0x140040969
mov r9, qword [rbx + 0x2b8]
mov ecx, dword [r9 + 0x850]
rol dx, 8
movzx r8d, dx
add r8d, dword [r9 + 0x38c]
add r8d, dword [r9 + 0x384]
imul r8d, ecx
mov edx, dword [r9 + 0x388]
add edx, dword [r9 + 0x380]
movzx eax, r10w
add edx, eax
imul edx, ecx
mov rcx, qword [r9 + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004f5a0
jmp 0x140040969
mov rcx, qword [rbx + 0x2b8]
mov edx, edi
mov rcx, qword [rcx + 0x880]
call fcn.14002cb40
jmp 0x140040969
movzx r14d, r12b
mov rcx, qword [0x1401fdf80]
call fcn.140038ff0
test eax, eax
je 0x140041afe
mov rcx, qword [rbx + 0x2b8]
call fcn.140047f20
movzx r14d, al
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3c9], 0
je 0x140041b17
cmp byte [rcx + 0x3ca], 0
jne 0x140041b1a
xor r14b, r14b
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x58
lea rcx, [rbp + 0x80]
call fcn.140019c00
nop
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x67c], r12d
mov r8d, reloc.WS2_32.dll_inet_ntoa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140042f67
movzx eax, byte [rbp + 0x141]
dec eax
cmp eax, 0xf
ja case.0x140041b8b.2
cdqe
mov ecx, dword [rsi + rax*4 + 0x43554]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80e], 1
jmp case.0x140041b8b.2
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80e], 0
jmp case.0x140041b8b.2
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x59
lea rcx, [rbp - 0x40]
call fcn.140019c00
nop
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je 0x140042233
test r14b, r14b
je 0x140042233
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
xor edx, edx
mov r8d, 0x144
call fcn.140135010
cmp edi, 0x138
ja 0x140042233
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
mov r8d, edi
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140042233
mov ecx, dword [rbp + 0x144]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
mov dword [rsp + 0x70], r13d
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je 0x140042233
mov ecx, dword [rsp + 0x70]
mov r14d, ecx
and r14d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r14d, eax
shr r14d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r14d, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
mov edx, 0x2c
call fcn.1400373c0
mov r15, rax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7cc
test rax, rax
jne 0x140041d13
mov byte [rcx], al
jmp 0x140041d20
lea rdx, [rax + 1]
call fcn.140049420
mov byte [r15], 0
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
lea rcx, [rbp + 0x188]
call fcn.140039040
mov rcx, rax
call fcn.140021ba0
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
call fcn.140049430
lea rcx, [rbp + 0x188]
call fcn.140016e50
mov r12d, r13d
lea eax, [rdi + 0x41]
mov edi, eax
mov ecx, eax
call fcn.14013268c
mov r15, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140135010
mov r8, qword [rbx + 0x2b8]
add r8, 0x688
mov edx, edi
mov rcx, r15
call fcn.14013b330
mov edx, 0x5c
mov rcx, r15
call fcn.1400373c0
mov byte [rax], r12b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140041def
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x28]
mov rcx, r15
call rax
test eax, eax
mov eax, 0xffffffff
cmove r12d, eax
mov rcx, r15
call fcn.140132640
mov r8, qword [rbp + 0x28]
sar r8, 0xa
mov ecx, r14d
shl rcx, 0x20
mov eax, esi
add rcx, rax
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
cmp rax, rdx
mov esi, 0xffffffff
cmovl r12d, esi
mov ecx, 0x2400
call fcn.14013268c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e0], rax
mov rax, qword [rbx + 0x2b8]
cmp qword [rax + 0x7e0], 0
cmove r12d, esi
mov ecx, 0x2000
call fcn.14013268c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e8], rax
mov rcx, qword [rbx + 0x2b8]
cmp qword [rcx + 0x7e8], 0
cmove r12d, esi
xor eax, eax
mov qword [rbp + 0x178], rax
mov dword [rbp + 0x180], eax
mov byte [rbp + 0x178], 7
cmp r12d, esi
je 0x14004202b
mov rax, qword [rcx + 0x110]
test rax, rax
je 0x140041ec6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov eax, 4
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7f0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov rcx, qword [rbx + 0x2b8]
mov rdx, qword [rcx + 0x7f0]
mov edi, esi
cmp rdx, 0xffffffffffffffff
cmovne edi, r13d
mov r12d, edi
test al, al
je 0x14004202b
cmp rdx, 0xffffffffffffffff
je 0x14004202b
lea rdx, [rcx + 0x688]
lea r8, [rbp + 0x30]
call fcn.140047e80
test al, al
je 0x14004202b
mov rax, qword [rbp + 0x30]
shr rax, 0xd
lea esi, [rax*4 + 0x400]
movsxd rcx, esi
call fcn.14013268c
mov r15, rax
mov rcx, qword [rbx + 0x2b8]
mov r9d, esi
mov r8, rax
mov rdx, qword [rcx + 0x7f0]
call fcn.140046e10
mov r14d, eax
cmp eax, 0xffffffff
je 0x140042026
mov byte [rbp + 0x179], reloc.WS2_32.dll_inet_ntoa
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shl edx, 8
mov ecx, esi
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr esi, 0x18
or edx, esi
mov dword [rbp + 0x17c], edx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r14d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r14d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x180], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx + 0x2a8]
call fcn.140088740
mov rcx, r15
call fcn.140132640
mov esi, 0xffffffff
mov byte [rbp + 0x179], 9
mov eax, r12d
bswap eax
mov dword [rbp + 0x17c], eax
mov rax, qword [rbx + 0x2b8]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140042050
shr rcx, 0x18
movzx edx, cl
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140042070
shl rcx, 8
and ecx, 0xff0000
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140042090
shr rcx, 8
and ecx, 0xff00
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400420b0
shl rcx, 0x18
or edx, ecx
mov dword [rbp + 0x180], edx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400420f6
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
mov r8, qword [rbx + 0x2b8]
cmp r12d, esi
jne 0x140042179
lea rcx, [r8 + 0x7f0]
call fcn.140088d50
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e8]
test rcx, rcx
je 0x140042151
call fcn.140132640
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e8], r13
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je 0x140042233
call fcn.140132640
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e0], r13
jmp 0x140042233
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8 + 0x7f8], edx
mov rcx, qword [rbx + 0x2b8]
mov eax, dword [rcx + 0x7f8]
shr eax, 0xd
mov dword [rcx + 0x7fc], eax
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x800], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x804], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80c], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 1
mov rcx, qword [0x1401fdf80]
call fcn.140039020
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.1400882c0
nop
lea rcx, [rbp - 0x40]
call fcn.140019c30
jmp case.0x140041b8b.2
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0xa0], xmm0
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0xb0], eax
movzx r8d, r14b
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140048610
jmp case.0x140041b8b.2
mov rcx, qword [0x1401fdf80]
call fcn.140039020
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.140088240
mov ecx, dword [rbp + 0x148]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
call fcn.140046ef0
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
jmp case.0x140041b8b.2
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov eax, 0xffffffff
cmp edx, eax
jne 0x140042357
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.140088d50
jmp case.0x140041b8b.2
mov ecx, 0x2000
call fcn.14013268c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e0], rax
mov rcx, qword [rbx + 0x2b8]
cmp qword [rcx + 0x7e0], 0
jne 0x140042391
add rcx, 0x810
call fcn.140088d50
jmp case.0x140041b8b.2
mov ecx, 0x2400
call fcn.14013268c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e8], rax
mov rax, qword [rbx + 0x2b8]
cmp qword [rax + 0x7e8], 0
jne 0x1400423f5
lea rcx, [rax + 0x810]
call fcn.140088d50
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je case.0x140041b8b.2
call fcn.140132640
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e0], r13
jmp case.0x140041b8b.2
mov byte [rax + 0x818], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x81c], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x824], r13d
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x829], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 0
mov rcx, qword [rbx + 0x2b8]
call fcn.140047550
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
jmp case.0x140041b8b.2
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
mov ecx, dword [rbp + 0x144]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x148]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
call fcn.140046f70
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
xor edx, edx
mov rcx, qword [rbx + 0x2b8]
call fcn.140048340
jmp case.0x140041b8b.2
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x80d], 0
je case.0x140041b8b.2
call fcn.1400470c0
jmp case.0x140041b8b.2
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x140042581
mov byte [rax + 0x80c], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 1
mov rcx, qword [rbx + 0x2b8]
call fcn.1400470c0
jmp case.0x140041b8b.2
cmp byte [rax + 0x82a], 0
je 0x1400425a4
mov byte [rax + 0x829], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 1
jmp case.0x140041b8b.2
mov byte [rax + 0x85a], 1
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x85a], 0
je case.0x140041b8b.2
xor eax, eax
mov qword [rbp + 0x1a8], rax
mov dword [rbp + 0x1b0], eax
mov byte [rbp + 0x1a8], 7
cmp word [rbp + 0x142], ax
jne 0x140042626
mov byte [rbp + 0x1a9], 7
mov eax, 0xffffffff
mov dword [rbp + 0x1ac], eax
mov rcx, qword [rbx + 0x2b8]
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rcx + 0x3b0]
call fcn.140088470
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x85a], 0
jmp case.0x140041b8b.2
mov byte [rbp + 0x1a9], recv
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je 0x1400425e5
mov rcx, qword [0x1401fdf80]
call fcn.140039010
test eax, eax
je 0x1400425e5
test r14b, r14b
je 0x1400425e5
mov dword [rbp + 0x1ac], 0x1000000
jmp 0x1400425f0
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x14004279c
cmp ecx, 1
jne case.0x140041b8b.2
lea rdx, [rbp + 0x2f0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov r15d, eax
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
lea esi, [r15 - 3]
test esi, esi
je 0x14004272c
mov edi, 2
nop word [rax + rax]
lea ecx, [rdi - 2]
lea rdx, [rbp + 0x2f0]
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140049440
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x140042718
sub eax, 1
je 0x14004270c
sub eax, 1
je 0x140042700
cmp eax, 1
jne 0x140042722
mov eax, edi
mov byte [rbp + rax + 0x2f0], Ordinal_102
jmp 0x140042722
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSACleanup
jmp 0x140042722
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSAGetLastError
jmp 0x140042722
mov eax, edi
mov byte [rbp + rax + 0x2f0], reloc.dwmapi.dll_Ordinal_102
add edi, 4
lea eax, [rdi - 2]
cmp eax, esi
jb 0x1400426c0
mov qword [rbp + 0x1f8], 0x30207
mov ecx, r15d
shl ecx, 0x10
mov eax, r15d
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r15d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r15d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x200], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov r8d, r15d
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
jmp case.0x140041b8b.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x105
ja case.0x140041b8b.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x140041b8b.2
cmp edi, 0x106
jae 0x1400433fc
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
xor sil, sil
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.My_Documents
lea rcx, [rbp + 0x2f0]
call fcn.140146590
mov r15, 0xffffffffffffffff
mov edi, r15d
test eax, eax
mov eax, 5
cmove edi, eax
lea r8d, [r15 + 8]
lea rdx, str.Desktop
lea rcx, [rbp + 0x2f0]
call fcn.140146590
test eax, eax
cmove edi, r13d
lea r8d, [r15 + 0x12]
lea rdx, str.Network_Favorites
lea rcx, [rbp + 0x2f0]
call fcn.140146590
test eax, eax
jne 0x14004288e
lea edi, [rax + 0x13]
jmp 0x140042893
cmp edi, r15d
je 0x1400428f5
lea r8, [rbp + 0xa70]
mov edx, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140047ab0
test al, al
je 0x1400428f2
lea rcx, [rbp + 0xa70]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], sil
jne 0x1400428b6
cmp byte [rbp + rax + 0xa6f], 0x5c
je 0x1400428dd
lea rdx, [0x1401c3148]
lea rcx, [rbp + 0xa70]
call fcn.140049450
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x2f0]
call fcn.140049460
jmp 0x1400428f5
mov sil, 1
lea rdx, [0x1401c8904]
lea rcx, [rbp + 0x2f0]
call fcn.140049450
mov qword [rbp + 0x15c], r13
mov dword [rbp + 0x158], 0x10207
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp r14, r15
je 0x140042ad7
test sil, sil
jne 0x140042ad7
lea rax, [rbp + 0x2f0]
mov rdx, r15
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x140042960
dec rdx
mov rax, rdx
shr rax, 0x18
movzx ecx, al
mov rax, rdx
shl rax, 8
and eax, 0xff0000
or ecx, eax
mov rax, rdx
shr rax, 8
and eax, 0xff00
or ecx, eax
shl rdx, 0x18
or ecx, edx
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
lea rcx, [rbp + 0x2f0]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x1400429c4
lea r8d, [rax - 1]
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088740
nop word [rax + rax]
movzx ecx, byte [rbp + 0x56d]
movzx eax, byte [rbp + 0x56c]
test byte [rbp + 0x540], 0x10
je 0x140042a0f
cmp al, 0x2e
jne 0x140042a2c
test cl, cl
jne 0x140042a2c
cmp al, 0x2e
jne 0x140042a2c
cmp cl, al
jne 0x140042a20
cmp byte [rbp + 0x56e], 0
je 0x140042a2c
cmp al, 0x2e
jne 0x140042a2c
test cl, cl
je 0x140042aae
lea rcx, [rbp + 0x56c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [rax + 0x2e]
movsxd r8, edi
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x750]
call fcn.140134960
mov eax, edi
mov ecx, edi
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
mov eax, edi
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, edi
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov r8d, edi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088740
lea rdx, [rbp + 0x540]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400429f0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov word [rbp + 0x15a], r13w
mov dword [rbp + 0x160], r13d
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088470
jmp case.0x140041b8b.2
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x140042e49
sub ecx, 3
je 0x140042cb2
cmp ecx, 1
jne case.0x140041b8b.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x208
ja case.0x140041b8b.2
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x140041b8b.2
cmp esi, 0x209
jae 0x140043402
mov byte [rbp + rsi + 0x750], 0
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
mov edx, 0x2a
lea rcx, [rbp + 0x750]
call fcn.1400373c0
mov rdi, rax
test rax, rax
je case.0x140041b8b.2
lea rdx, [rax + 1]
lea rcx, [rbp + 0x540]
call fcn.140049470
mov byte [rdi], 0
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0xa70]
call fcn.140049470
mov byte [rdi], 0x2a
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
mov dword [rbp + 0x208], 0x80b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x20c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x210], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x208]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
test edi, edi
je case.0x140041b8b.2
lea rax, [rbp + 0x188]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x188]
call fcn.140021bb0
mov rdi, rax
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x1b8]
call fcn.140021bb0
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140039400
jmp case.0x140041b8b.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x104
ja case.0x140041b8b.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x140041b8b.2
cmp edi, 0x105
jae 0x140043408
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
lea rcx, [rbp + 0x2f0]
call fcn.1400393a0
movzx r14d, al
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x188]
call fcn.140021bb0
nop
test r14b, r14b
je 0x140042d8e
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140039330
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.1400491c0
lea rcx, [rbp + 0x1b8]
call fcn.140016e50
lea rcx, [rbp + 0x188]
call fcn.140049120
mov rsi, rax
lea rcx, [rbp + 0x2f0]
call fcn.140039260
movzx edi, al
mov dword [rbp + 0x218], 0x70b07
mov ecx, 0xffffffff
test al, al
cmovne ecx, r13d
mov dword [rbp + 0x21c], ecx
lea eax, [rsi + 1]
bswap eax
mov dword [rbp + 0x220], eax
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x218]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
lea rcx, [rbp + 0x188]
call fcn.140021ba0
mov rdx, rax
lea r8d, [rsi + 1]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
test edi, edi
je 0x140042e38
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021bb0
movzx r8d, r14b
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.1400393f0
nop
lea rcx, [rbp + 0x188]
call fcn.140016e50
jmp case.0x140041b8b.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x104
ja case.0x140041b8b.2
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x140041b8b.2
cmp esi, 0x105
jae 0x1400433f6
mov byte [rbp + rsi + 0x2f0], 0
mov rcx, qword [0x1401fdf80]
call fcn.140038fe0
test eax, eax
je case.0x140041b8b.2
test r14b, r14b
je case.0x140041b8b.2
xor edx, edx
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov dword [rbp + 0x228], 0x40b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x22c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x230], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x228]
mov rcx, qword [rbx + 0x2a8]
call fcn.1400885a0
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.140088620
test edi, edi
je case.0x140041b8b.2
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021bb0
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.1400393e0
jmp case.0x140041b8b.2
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x140042fba
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7f0
call fcn.140088d50
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 0
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x82a], 0
je case.0x140041b8b.2
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.140088d50
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x67c], r13d
lea rcx, [rbp + 0x80]
call fcn.140019c30
jmp 0x140040969
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.140088930
test eax, eax
je case.0x14003f0a1.1
mov rcx, qword [rbx + 0x2a8]
call fcn.1400373b0
jmp 0x140040969
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
lea rcx, [rbp - 0x20]
call fcn.140019c30
jmp 0x1400433c6
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
cmp byte [0x1401f32e3], 0
je 0x1400430ab
mov byte [rbx + 0x98], 1
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x1400430fe
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 0
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7f0
call fcn.140088d50
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x82a], 0
je 0x140043143
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 0
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.140088d50
mov rcx, qword [rbp + 0x38]
call fcn.1400211c0
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], 0
je 0x14004317f
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004fe00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400431a7
call qword [sym.imp.USER32.dll_CloseDesktop]
test eax, eax
jne 0x1400431a7
lea r8, str.vncClientThread::run_:_failed_to_close_desktop_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rax, qword [rbx + 0x2b8]
mov r9, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [r9 + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_disconnected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov r8d, 0x104
lea rdx, [rbp + 0x960]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14004322c
mov edx, 0x5c
lea rcx, [rbp + 0x960]
call fcn.1400373c0
mov byte [rax], 0
lea rdx, str.logging.dll
lea rcx, [rbp + 0x960]
call fcn.140019380
lea rcx, [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x1400432c7
lea rdx, str.LOGEXIT
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rdx, qword [rbx + 0x2b8]
cmp byte [rdx + 0x3c9], 0
je 0x140043276
cmp byte [rdx + 0x3ca], 0
je 0x140043276
mov r12b, 1
jmp 0x140043279
xor r12d, r12d
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx r14d, ax
mov rcx, rsi
call qword [rdi + 0x90]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x98]
mov rcx, rax
movzx r9d, r12b
mov r8d, r14d
mov rdx, rdi
call r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx + 0x590]
test rax, rax
je 0x1400432fe
mov rcx, rax
call fcn.1400394e0
mov rcx, qword [rbx + 0x2b8]
xor edx, edx
mov rcx, qword [rcx + 0x590]
call fcn.140125d20
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
cmp byte [0x1401f32e3], 0
jne 0x1400433c6
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], 0
je 0x1400433c6
lea r8, str.vncClientThread::run_:_PostAddNewClient_II_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rbx + 0x2b8]
mov r8, qword [rcx]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0x9c]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xa0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x19f]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140021390
mov rcx, qword [rbp + 0xc80]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0xd90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401327c8
nop
call fcn.1401327c8
int3
call fcn.1401327c8
int3
call fcn.1401327c8
int3