Function at 0x472750
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56af03
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x22c], edi
lea eax, [edi + 0x1530]
mov dword [ebp - 0x23c], 0x45
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x240], eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x234], eax
call eax
push 0x1e4
lea eax, [edi + 0x134c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0053f2b0
mov eax, dword [edi + 0x132c]
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [edi + 0x1338], eax
mov dword [edi + 0x1334], 0x1fc
mov dword [edi + 0x133c], 0x66
je 0x4727fb
mov eax, dword [edi + 0x1658]
jmp 0x472801
mov eax, dword [edi + 0x1654]
mov ecx, dword [edi + 8]
mov dword [edi + 0x1348], eax
mov dword [edi + 0x1340], 0xb
mov dword [edi + 0x1344], 0x8001
mov eax, dword [ecx]
call dword [eax + 0x17c]
neg eax
sbb eax, eax
neg eax
mov dword [edi + 0x13cc], eax
mov dword [edi + 0x13d0], 1
mov edx, dword [edi + 0x1548]
mov eax, edx
test edx, edx
je 0x4728f8
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472851
mov eax, edx
sub ecx, esi
je 0x4728fc
or dword [edi + 0x1340], 0x10
lea eax, [edi + 0x13d4]
push 0xff
push edx
push 0x100
push eax
call fcn.0054cc69
mov byte [edi + 0x14d3], 0
add esp, 0x10
mov edx, dword [edi + 0x154c]
test edx, edx
je 0x4728c8
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4728a0
sub ecx, esi
je 0x4728c8
push 0x3f
push edx
lea eax, [edi + 0x14d8]
push 0x40
push eax
call fcn.0054cc69
add esp, 0x10
mov byte [edi + 0x1517], 0
jmp 0x4728de
push str.Remote_Connection
lea eax, [edi + 0x14d8]
push 0x40
push eax
call fcn.005417f5
add esp, 0xc
mov eax, dword [edi + 0x1548]
mov dword [edi + 0x14d4], 0x2710
mov dword [edi + 0x1518], 1
test eax, eax
je 0x47290f
push eax
call fcn.005417da
add esp, 4
mov dword [edi + 0x1548], 0
mov eax, dword [edi + 0x154c]
test eax, eax
je 0x47292c
push eax
call fcn.005417da
add esp, 4
mov dword [edi + 0x154c], 0
push 0x80
lea ebx, [edi + 0x134c]
push ebx
push 0x66
push dword [0x5e6634]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x472951
or dword [edi + 0x1340], 4
mov eax, dword [edi + 0x1340]
mov esi, 0x7f
test al, 4
je 0x472a2e
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472970
sub ecx, edx
sub esi, ecx
push esi
push 0x5bfa0c
push 0x80
push ebx
call fcn.005415c2
mov ecx, dword [edi + 8]
add esp, 0x10
mov eax, dword [ecx]
call dword [eax + 0x16c]
mov edx, ebx
lea esi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4729a0
sub edx, esi
test eax, eax
je 0x472bf6
lea ebx, [edi + 0x134c]
mov esi, 0x80
sub esi, edx
add ebx, edx
mov dword [ebp - 0x224], esi
cmp byte [0x5d9e83], cl
je 0x4729ef
mov eax, dword [0x5e22b0]
cmp eax, 0xc
jge 0x4729ef
push 0x5e23c0
inc eax
push esi
push ebx
mov dword [0x5e22b0], eax
call fcn.005417f5
add esp, 0xc
jmp 0x472a23
push 0x100
lea eax, [ebp - 0x118]
mov dword [0x5e22b0], 0
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x472ac3
push esi
push str.Host_name_unavailable
push esi
push ebx
call fcn.0054cc69
add esp, 0x10
lea ebx, [edi + 0x134c]
mov esi, 0x7f
push 0x100
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x472a99
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472a50
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
push 0x5bfa0c
push 0x80
push ebx
call fcn.005415c2
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472a76
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 0x80
push ebx
call fcn.005415c2
add esp, 0x10
cmp dword [0x5e65ec], 0
mov ecx, ebx
lea edx, [ecx + 1]
je 0x472c18
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472ab0
sub ecx, edx
mov edx, str.___service__
jmp 0x472c26
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x472ae5
push esi
push str.IP_address_unavailable
jmp 0x472a19
mov byte [ebx], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x228], 0
cmp dword [eax], 0
je 0x472a23
mov edi, dword [ebp - 0x220]
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
nop dword [eax]
xor eax, eax
xor esi, esi
cmp ax, word [edi + 0xa]
jge 0x472b73
nop word [eax + eax]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ecx]
movzx eax, byte [eax + esi]
push eax
lea eax, [ebp - 0x18]
push 0x5bf604
push eax
call fcn.004477a0
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472b41
sub ecx, edx
mov edx, dword [ebp - 0x224]
mov eax, edx
sub eax, ecx
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
push edx
push ebx
call fcn.005415c2
movsx eax, word [edi + 0xa]
inc esi
mov ecx, dword [ebp - 0x21c]
add esp, 0x10
cmp esi, eax
jl 0x472b20
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472b78
sub ecx, edx
mov byte [ecx + ebx - 1], al
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + eax + 4], 0
je 0x472bc7
mov ecx, ebx
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472ba0
sub ecx, edx
mov edx, dword [ebp - 0x224]
mov eax, edx
sub eax, ecx
dec eax
push eax
push 0x5bf608
push edx
push ebx
call fcn.005415c2
mov eax, dword [edi + 0xc]
add esp, 0x10
mov edx, dword [ebp - 0x228]
inc edx
cmp dword [eax + edx*4], 0
mov dword [ebp - 0x228], edx
lea ecx, [edx*4]
mov dword [ebp - 0x21c], ecx
jne 0x472b10
mov edi, dword [ebp - 0x22c]
jmp 0x472a23
mov esi, 0x7f
mov eax, esi
sub eax, edx
push eax
push str.Not_listening
push 0x80
push ebx
call fcn.005415c2
add esp, 0x10
jmp 0x472a2e
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472c18
sub ecx, edx
mov edx, str.___application__
mov eax, esi
sub eax, ecx
push eax
push edx
push 0x80
push ebx
call fcn.005415c2
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472c40
sub ecx, edx
sub esi, ecx
push esi
push 0x5da288
push 0x80
push ebx
call fcn.005415c2
mov ebx, dword [ebp + 8]
add esp, 0x10
cmp ebx, 1
jne 0x472c76
cmp byte [edi + 0x1674], 0
je 0x47300a
jmp 0x472c9d
test ebx, ebx
jne 0x472c87
cmp byte [edi + 0x1674], bl
je 0x472c9d
jmp 0x47300a
cmp ebx, 2
jne 0x472c9d
mov byte [edi + 0x1674], 0
mov dword [edi + 0x1678], 0
lea eax, [edi + 0x1334]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
test eax, eax
je 0x472f17
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
cmp dword [edi + 0x12c], eax
sete al
push eax
push 0x9c40
push dword [edi + 0x1330]
call esi
xor eax, eax
cmp dword [edi + 0x12c], eax
sete al
push eax
push 0x9c41
push dword [edi + 0x1330]
call esi
xor eax, eax
cmp dword [edi + 0x134], eax
sete al
push eax
push 0x9c42
push dword [edi + 0x1330]
call esi
xor eax, eax
cmp dword [edi + 0x138], eax
sete al
push eax
push 0x9c43
push dword [edi + 0x1330]
call esi
xor eax, eax
cmp dword [edi + 0x138], eax
sete al
push eax
push 0x9c45
push dword [edi + 0x1330]
call esi
cmp dword [0x5e65ec], 0
je 0x472d52
call fcn.00487390
test al, al
jne 0x472d84
mov dword [0x5e65ec], 0
mov eax, 1
push eax
push 0x9c4f
push dword [edi + 0x1330]
call esi
call fcn.00487390
test al, al
je 0x472d9a
cmp dword [0x5e65ec], 0
jne 0x472d9a
cmp dword [edi + 0x134], 0
je 0x472d9a
xor eax, eax
jmp 0x472d9f
cmp dword [0x5e65ec], 0
je 0x472d52
cmp dword [edi + 0x134], 0
je 0x472d52
xor eax, eax
jmp 0x472d57
mov eax, 1
push eax
push 0x9c52
push dword [edi + 0x1330]
call esi
call fcn.00487390
test al, al
jne 0x472dcc
cmp dword [0x5e65ec], 0
jne 0x472dcc
cmp dword [edi + 0x134], 0
je 0x472dcc
xor eax, eax
jmp 0x472dd1
mov eax, 1
push eax
push 0x9c50
push dword [edi + 0x1330]
call esi
call fcn.00487390
test al, al
je 0x472df5
cmp dword [edi + 0x134], 0
je 0x472df5
xor eax, eax
jmp 0x472dfa
mov eax, 1
push eax
push 0x9c51
push dword [edi + 0x1330]
call esi
cmp dword [0x5e65ec], 0
je 0x472e1e
cmp dword [edi + 0x134], 0
je 0x472e1e
xor eax, eax
jmp 0x472e23
mov eax, 1
push eax
push 0x9c59
push dword [edi + 0x1330]
call esi
cmp dword [0x5e65ec], 0
je 0x472e47
cmp dword [edi + 0x134], 0
je 0x472e47
xor eax, eax
jmp 0x472e4c
mov eax, 1
push eax
push 0x9c5d
push dword [edi + 0x1330]
call esi
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x5e7b1c], 0
je 0x472ee9
mov esi, dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0x9c40
push dword [edi + 0x1330]
call esi
push 0
push 0x9c4f
push dword [edi + 0x1330]
call esi
push 0
push 0x9c52
push dword [edi + 0x1330]
call esi
push 0
push 0x9c50
push dword [edi + 0x1330]
call esi
push 0
push 0x9c51
push dword [edi + 0x1330]
call esi
push 0
push 0x9c59
push dword [edi + 0x1330]
call esi
push 0
push 0x9c5d
push dword [edi + 0x1330]
call esi
test ebx, ebx
jne 0x47300a
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncmenu.cpp_:_IsIconSet__n
push 9
push 0x5d7d48
mov byte [edi + 0x1674], 1
mov dword [edi + 0x1678], ebx
call fcn.0041c960
add esp, 0xc
jmp 0x47300a
test ebx, ebx
jne 0x47300a
mov ecx, dword [edi + 8]
cmp dword [0x5e65ec], ebx
je 0x472feb
mov byte [edi + 0x1674], bl
mov eax, dword [ecx]
call dword [eax + 0x17c]
test eax, eax
jne 0x472f46
inc dword [edi + 0x1678]
mov edi, dword [edi + 8]
mov esi, dword [ebp - 0x234]
mov dword [ebp - 0x22c], 0x96
lea eax, [edi + 0x364]
push eax
mov dword [ebp - 0x230], eax
call esi
lea eax, [edi + 8]
mov dword [ebp - 0x14], 0x96
push eax
mov dword [ebp - 0x18], eax
call esi
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x158]
mov esi, dword [eax]
cmp esi, eax
je 0x472fc0
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov edx, dword [edi]
mov ecx, edi
movzx eax, word [esi + 8]
push eax
call dword [edx + 0x48]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x68]
cmp dword [eax + 0xe3c4], 0
jne 0x472fb6
push dword [eax + 0xe36c]
call ebx
mov esi, dword [esi]
cmp esi, dword [edi + 0x158]
jne 0x472f90
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncmenu.cpp_:_Failed_IsIconSet__n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0xc
jmp 0x47300a
mov eax, dword [ecx]
call dword [eax + 0x2f0]
test eax, eax
jne 0x47300a
push 1
push ecx
lea ecx, [edi + 0xc]
call fcn.004775b0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret 8