Function at 0x4617a0
Capabilities:
Create process on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5dc
mov eax, dword [0x4ea5e0]
xor eax, esp
mov dword [esp + 0x5d8], eax
cmp byte [0x544943], 1
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ebx
jne 0x461807
push str.Unsupported_OS
push str.Error_OS_not_supported
mov eax, 0x10
call fcn.00409310
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d8]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 0x10
push 0
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46183e
push str.SetProcessDPIAware
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x461837
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
push edi
mov byte [esp + 0x1b], 0
mov dword [0x5447b8], edi
mov dword [0x5447bc], edi
call fcn.004abb88
add eax, 0x40
push eax
call fcn.004acea3
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 8
push 0x104
lea ecx, [esp + 0x2cc]
push ecx
push edi
mov dword [0x513794], edi
call esi
test eax, eax
je 0x461898
lea edx, [esp + 0x2c8]
push 0x5c
push edx
call fcn.004a9130
add esp, 8
mov byte [eax], 0
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x2c8]
mov byte [esp + eax + 0x1c0], cl
inc eax
test cl, cl
jne 0x4618a0
lea edi, [esp + 0x1c0]
dec edi
jmp 0x4618c0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4618c0
mov ax, word [0x4ce6f4]
mov word [edi], ax
lea eax, [esp + 0x1c0]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4618e0
mov ecx, dword [0x4df78c]
mov edx, dword [0x4df790]
mov dword [eax], ecx
mov ecx, dword [0x4df794]
mov dword [eax + 4], edx
mov edx, dword [0x4df798]
mov dword [eax + 8], ecx
mov cx, word [0x4df79c]
mov dword [eax + 0xc], edx
mov dl, byte [0x4df79e]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
lea eax, [esp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x513794], eax
test eax, eax
jne 0x461940
mov ecx, dword [esp + 0x20]
mov dword [0x513794], ecx
call fcn.00461290
push 0x104
lea edx, [esp + 0x3d4]
push edx
push 0
call esi
test eax, eax
je 0x461977
lea eax, [esp + 0x3d0]
push 0x5c
push eax
call fcn.004a9130
add esp, 8
test eax, eax
je 0x462318
mov byte [eax], 0
push 0x104
lea ecx, [esp + 0x3d4]
push ecx
lea edx, [esp + 0x4e0]
push edx
call fcn.004a9c60
add esp, 0xc
mov byte [esp + 0x5db], 0
call fcn.00449a30
mov eax, dword [esp + 0x20]
mov dword [0x517c58], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x30]
push ecx
push 2
mov dword [0x518264], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x461d20
mov dx, word [esp + 0x30]
lea eax, [esp + 0x4d8]
push eax
mov ecx, str.uvnc_service
mov word [0x5447a0], dx
call fcn.00409080
mov eax, ebx
add esp, 4
xor edi, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4619f2
sub eax, edx
je 0x461a23
lea ecx, [ecx]
movsx ecx, byte [ebx + edi]
push ecx
call fcn.004ab46d
mov byte [ebx + edi], al
mov eax, ebx
add esp, 4
inc edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461a16
sub eax, edx
cmp edi, eax
jb 0x461a00
xor edi, edi
mov eax, ebx
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461a36
sub eax, edx
je 0x46221c
cmp byte [ebx + edi], 0x20
lea esi, [ebx + edi]
jle 0x4621ea
push 0xf
push str._settingshelper
push esi
mov dword [esp + 0x34], 1
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462253
push 0x12
push str._stopservicehelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462280
push 5
push str._kill
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462295
push 0xd
push str._openhomepage
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4622fa
push 0xa
push str._openforum
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462331
push 0x13
push str._startservicehelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46233e
push 0xe
push str._installhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462350
push 0x10
push str._uninstallhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462362
push 0x12
push str._softwarecadhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462374
push 0x15
push str._delsoftwarecadhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462386
push 0x15
push str._rebootsafemodehelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46239b
push 0x12
push str._rebootforcehelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4623b0
push 0x15
push str._securityeditorhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4623c5
push 0xf
push 0x4d3e54
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4623da
push 9
push 0x4d3d14
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46247d
push 0x10
push str._dsmpluginhelper
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46249f
push 0x12
push str._dsmplugininstance
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4624cc
push 0xc
push 0x4d3da4
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4624ee
push 0xf
push 0x4d3e14
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4624f8
push 0xf
push 0x4d3dc8
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462502
push 0xc
push 0x4d3df0
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46251e
push 0xc
push 0x4d3d34
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462528
push 0xd
push 0x4d3d58
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462532
push 8
push 0x4d3d68
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46253c
push 0xa
push 0x4d3d74
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46261b
push 0xc
push str._service_run
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x4626f0
push 8
push str._service
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x462736
push 4
push 0x4d3c98
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46221c
push 8
push str._sc_exit
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461d39
mov dword [0x5447b8], 1
add edi, 8
jmp 0x4621e6
push 0x4d8a6c
push 0x518cd0
xor eax, eax
call fcn.00409310
add esp, 8
jmp 0x462318
push 0xa
push str._sc_prompt
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461d5f
mov dword [0x5447bc], 1
add edi, 0xa
jmp 0x4621e6
push 6
push str._multi
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461d85
mov dword [0x5447c0], 1
add edi, 6
jmp 0x4621e6
push 0xa
push str._httpproxy
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461dab
mov dword [0x518260], 1
add edi, 0xa
jmp 0x4621e6
push 0xe
push str._stopreconnect
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461dd0
add edi, 0xe
mov dword [esp + 0x10], edi
call fcn.0045e800
jmp 0x4621ea
push 0xe
push str._autoreconnect
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461ede
add edi, 0xe
mov dword [esp + 0x24], eax
mov al, byte [ebx + edi]
mov dword [esp + 0x10], edi
mov byte [esp + 0x17], 1
mov esi, edi
cmp al, 0x20
jg 0x461e0e
test al, al
je 0x461e0e
mov al, byte [ebx + esi + 1]
inc esi
cmp al, 0x20
jle 0x461e01
push 3
lea edi, [ebx + esi]
push 0x4d3cc0
push edi
mov dword [esp + 0x24], edi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461e77
cmp byte [edi], 0x20
mov eax, esi
mov dword [esp + 0x1c], esi
jle 0x461e3f
inc eax
cmp byte [ebx + eax], 0x20
jg 0x461e34
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
mov edi, ebx
sub edi, esi
test edi, edi
jle 0x461e73
lea edx, [edi + 1]
push edx
call fcn.004a8a24
mov esi, eax
mov eax, dword [esp + 0x1c]
push edi
push eax
push esi
call fcn.004a9c60
push esi
mov byte [edi + esi], 0
call fcn.004ab103
add esp, 0x14
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.0045e740
test eax, eax
jne 0x461ec8
mov byte [0x5447a2], 1
test esi, esi
jne 0x461ea2
mov byte [0x5447b4], 1
mov byte [0x5447a2], al
jmp 0x4621ea
mov edx, 0x518d10
mov eax, esi
sub edx, esi
jmp 0x461eb0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x461eb0
push esi
call fcn.004a9011
add esp, 4
jmp 0x4621ea
test esi, esi
je 0x4621ea
push esi
call fcn.004a9011
add esp, 4
jmp 0x4621ea
push 4
push str._id:
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x461f9e
lea eax, [edi + 1]
lea ecx, [ebx + eax]
xor esi, esi
cmp byte [ecx], 0x20
mov edi, eax
mov dword [esp + 0x18], ecx
jle 0x461f17
lea esp, [esp]
inc edi
cmp byte [ebx + edi], 0x20
jg 0x461f10
mov ebx, edi
sub ebx, eax
test ebx, ebx
jle 0x461f4c
lea ecx, [ebx + 1]
push ecx
call fcn.004a8a24
mov esi, eax
add esp, 4
test esi, esi
je 0x461f4c
mov edx, dword [esp + 0x18]
push ebx
push edx
push esi
call fcn.004a9c60
push esi
mov byte [ebx + esi], 0
call fcn.004ab103
add esp, 0x10
mov esi, eax
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0045e8a0
test eax, eax
jne 0x461ec8
mov byte [0x5447b5], 1
test esi, esi
jne 0x461f7d
mov byte [0x5447b6], 1
mov byte [0x5447b5], 0
jmp 0x4621ea
mov edx, 0x518d10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x461f86
push esi
call fcn.004a9011
add esp, 4
jmp 0x4621ea
push 8
push str._connect
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x462112
cmp byte [esp + 0x17], al
jne 0x461fc1
call fcn.0045e7b0
mov al, byte [ebx + edi + 8]
add edi, 8
mov dword [esp + 0x10], edi
cmp al, 0x20
jg 0x461fdd
test al, al
je 0x461fdd
mov al, byte [ebx + edi + 1]
inc edi
cmp al, 0x20
jle 0x461fd0
cmp byte [ebx + edi], 0x20
lea ecx, [ebx + edi]
mov eax, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
jle 0x461ffb
inc eax
cmp byte [ebx + eax], 0x20
jg 0x461ff0
mov dword [esp + 0x1c], eax
mov ebx, eax
sub ebx, edi
test ebx, ebx
jle 0x4620d7
lea eax, [ebx + 1]
push eax
call fcn.004a8a24
mov esi, eax
add esp, 4
test esi, esi
je 0x4620ca
mov ecx, dword [esp + 0x18]
push ebx
push ecx
push esi
call fcn.004a9c60
mov eax, dword [esp + 0x28]
mov edx, esi
sub edx, edi
push 0x3a
push esi
mov byte [edx + eax], 0
mov ebx, 0x157c
call fcn.004aa370
add esp, 0x14
test eax, eax
je 0x46205e
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x462053
inc eax
push eax
call fcn.004a9a0c
mov ebx, eax
add esp, 4
push ebx
push esi
push str.winvnc.cpp_:_test...__s__d_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
push esi
push 0xff
push 0x5178d8
call fcn.004a9480
call fcn.00460500
push esi
mov edi, eax
call fcn.004a9011
add esp, 0x1c
test edi, edi
je 0x462742
push str.winvnc.cpp_:_PostAddNewClient_III__n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
push ebx
call fcn.0045e650
add esp, 8
test eax, eax
jne 0x4620ca
mov byte [0x5447a3], 1
mov dword [0x517eec], ebx
mov dword [0x517c5c], edi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
jmp 0x4621ea
push str.winvnc.cpp_:_PostAddNewClient_IIII_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
push 0
xor edi, edi
call fcn.0045e5c0
add esp, 8
test eax, eax
jne 0x4621ea
mov byte [0x5447a3], 1
mov dword [0x517eec], eax
mov dword [0x517c5c], eax
jmp 0x4621ea
push 9
push str._repeater
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x46276d
mov al, byte [ebx + edi + 9]
add edi, 9
mov dword [esp + 0x10], edi
mov esi, edi
cmp al, 0x20
jg 0x46214d
jmp 0x462140
test al, al
je 0x46214d
mov al, byte [ebx + esi + 1]
inc esi
cmp al, 0x20
jle 0x462140
cmp byte [ebx + esi], 0x20
lea eax, [ebx + esi]
mov edi, esi
mov dword [esp + 0x18], eax
jle 0x462167
lea esp, [esp]
inc edi
cmp byte [ebx + edi], 0x20
jg 0x462160
mov ebx, edi
sub ebx, esi
test ebx, ebx
jle 0x4621ea
mov eax, dword [0x5447a8]
test eax, eax
je 0x46218b
push eax
call fcn.004a9011
add esp, 4
mov dword [0x5447a8], 0
lea edx, [ebx + 1]
push edx
call fcn.004a8a24
add esp, 4
mov dword [0x5447a8], eax
test eax, eax
je 0x4621e6
mov ecx, dword [esp + 0x18]
push ebx
push ecx
push eax
call fcn.004a9c60
mov edx, dword [0x5447a8]
sub edx, esi
push str.winvnc.cpp_:_PostAddNewRepeaterClient_I_n
xor eax, eax
mov ecx, 0x4ecb00
mov byte [edx + edi], 0
call fcn.00403230
add esp, 0x10
call fcn.0045e6e0
test eax, eax
jne 0x4621e6
mov byte [0x5447b7], 1
mov dword [0x517eec], eax
mov dword [0x517c5c], eax
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
inc edi
mov eax, ebx
mov dword [esp + 0x10], edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x462200
sub eax, edx
cmp edi, eax
jb 0x461a45
cmp dword [esp + 0x28], 0
jne 0x462312
mov esi, dword [esp + 0x20]
call fcn.00461610
test al, al
je 0x462312
call fcn.00462be0
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d8]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebx + edi + 0x10]
lea edx, [esp + 0x30]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x462268
lea esi, [esp + 0x30]
call fcn.00407820
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408c70
jmp 0x462312
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x54856c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x54856c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
xor esi, esi
test esi, esi
je 0x4622e9
push 0
push 0x9c42
push 0x111
push esi
call edi
push 0
push 0
push 0x10
push esi
call edi
push 0
push str.WinVNC_Tray_Icon
call ebx
mov esi, eax
test esi, esi
jne 0x4622d1
jmp 0x462312
push 1
push 0
push 0
push str.http:__www.uvnc.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d8]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0
push 0
push str.http:__forum.uvnc.com
jmp 0x462305
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408d60
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408e50
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408ef0
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00412420
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00412360
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00411b00
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00411a60
jmp 0x462312
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408f90
jmp 0x462312
push 0x104
lea ecx, [esp + 0x34]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x462432
lea edx, [esp + 0x30]
push 0x5c
push edx
call fcn.004a9130
mov byte [eax], 0
lea eax, [esp + 0x38]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x462407
mov ecx, dword [str._authSSP.dll]
mov edx, dword [0x4dd13c]
mov dword [eax], ecx
mov ecx, dword [0x4dd140]
mov dword [eax + 4], edx
mov dl, byte [0x4dd144]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x462312
push str.vncEditSecurity
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x517c58]
push ecx
push 0
call edi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x462312
lea eax, [ebx + edi + 0xa]
lea edx, [esp + 0x30]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x462487
lea ecx, [esp + 0x30]
call fcn.00407940
jmp 0x462312
lea eax, [ebx + edi + 0x11]
lea edx, [esp + 0x30]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4624b0
lea edx, [esp + 0x30]
push edx
call fcn.00456010
add esp, 4
jmp 0x462312
lea eax, [ebx + edi + 0x13]
lea edx, [esp + 0x30]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4624d6
lea ecx, [esp + 0x30]
call fcn.00456120
jmp 0x462312
call fcn.00412230
jmp 0x462312
call fcn.004122d0
jmp 0x462312
call fcn.004112d0
test eax, eax
je 0x462312
call fcn.00411390
call fcn.00411930
jmp 0x462312
call fcn.004119b0
jmp 0x462312
call fcn.00408d10
jmp 0x462312
call fcn.00408e00
jmp 0x462312
mov al, byte [ebx + edi]
lea esi, [ebx + edi]
test al, al
je 0x4625dd
lea ebx, [ebx]
movzx eax, al
push eax
call fcn.004aa750
add esp, 4
test eax, eax
jne 0x46256a
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x462550
jmp 0x4625dd
mov al, byte [esi]
test al, al
je 0x4625dd
movzx ecx, al
push ecx
call fcn.004aa750
add esp, 4
test eax, eax
je 0x46258a
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x462570
jmp 0x4625dd
mov al, byte [esi]
test al, al
je 0x4625dd
cmp al, 0x22
jne 0x462595
inc esi
cmp byte [esi], 0
je 0x4625dd
push 0x22
push esi
call fcn.004a9130
add esp, 8
test eax, eax
je 0x4625ac
mov byte [eax], 0
cmp byte [esi], 0
je 0x4625dd
push str.uvnc_service
push esi
call fcn.004aab8d
add esp, 8
test eax, eax
je 0x4625dd
push pe_nt_image_headers32
push esi
push str.uvnc_service
call fcn.004a9c60
add esp, 0xc
mov byte [0x4ec047], 0
call fcn.00410f20
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
lea edx, [esp + 0x38]
push 0x124
push edx
call fcn.004a9bad
add esp, 0x10
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x462312
mov al, byte [ebx + edi]
lea esi, [ebx + edi]
test al, al
je 0x4626bd
lea esp, [esp]
movzx ecx, al
push ecx
call fcn.004aa750
add esp, 4
test eax, eax
jne 0x46264a
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x462630
jmp 0x4626bd
mov al, byte [esi]
test al, al
je 0x4626bd
movzx edx, al
push edx
call fcn.004aa750
add esp, 4
test eax, eax
je 0x46266a
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x462650
jmp 0x4626bd
mov al, byte [esi]
test al, al
je 0x4626bd
cmp al, 0x22
jne 0x462675
inc esi
cmp byte [esi], 0
je 0x4626bd
push 0x22
push esi
call fcn.004a9130
add esp, 8
test eax, eax
je 0x46268c
mov byte [eax], 0
cmp byte [esi], 0
je 0x4626bd
push str.uvnc_service
push esi
call fcn.004aab8d
add esp, 8
test eax, eax
je 0x4626bd
push pe_nt_image_headers32
push esi
push str.uvnc_service
call fcn.004a9c60
add esp, 0xc
mov byte [0x4ec047], 0
push str.uvnc_service
push str.net_stop___s_
lea eax, [esp + 0x38]
push 0x124
push eax
call fcn.004a9bad
add esp, 0x10
push 0
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.00411000
jmp 0x462312
mov esi, dword [esp + 0x20]
call fcn.00461610
test al, al
je 0x462312
mov eax, 1
mov dword [0x5447a4], eax
mov dword [0x544798], eax
call fcn.00462be0
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x5e4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 0x10
mov eax, ebx
call fcn.00410e10
jmp 0x462312
push 0x7d0
mov byte [0x5447a3], 1
mov dword [0x517eec], 0
mov dword [0x517c5c], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x462312
push 0x518970
push str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____run__n
mov eax, 0x40
call fcn.00409310
add esp, 8
jmp 0x462312