Function at 0x44ada0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x348
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x344], eax
push ebx
mov ebx, dword [esp + 0x358]
push ebp
push edi
mov edi, dword [esp + 0x358]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
call fcn.0043c630
xor ebp, ebp
push ebp
call fcn.0045f2e6
add eax, 0x40
push eax
call fcn.0046021d
add esp, 8
push str.vnclang_server.dll
mov dword [0x4a9630], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [0x4a9630], eax
jne 0x44ae07
mov eax, edi
mov dword [0x4a9630], eax
push eax
call fcn.0044a2e0
add esp, 4
push 0x104
lea eax, [esp + 0x14c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x44ae41
lea ecx, [esp + 0x148]
push 0x5c
push ecx
call fcn.0045c1e0
add esp, 8
cmp eax, ebp
je 0x44ae99
mov byte [eax], 0
push 0x104
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x254]
push eax
call fcn.0045d150
add esp, 0xc
mov ecx, 0x490660
mov byte [esp + 0x34f], 0
call fcn.00437bd0
mov dword [0x4a9634], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0xc]
mov dword [0x4a9ec4], eax
call fcn.004495e0
cmp dword [esp + 0xc], ebp
jne 0x44aea0
lea ecx, [esp + 0xc]
call fcn.00449650
xor eax, eax
jmp 0x44b405
push esi
lea ecx, [esp + 0x250]
push str.RealSvc
push ecx
call fcn.00405190
mov eax, ebx
add esp, 8
xor esi, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44aec0
sub eax, edx
je 0x44aef7
lea ecx, [ecx]
movsx edx, byte [ebx + esi]
push edx
call fcn.0045ec1e
mov byte [ebx + esi], al
mov eax, ebx
add esp, 4
add esi, 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44aee8
sub eax, edx
cmp esi, eax
jb 0x44aed0
mov eax, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44af04
sub eax, edx
je 0x44b3ae
jmp 0x44af24
mov edi, dword [esp + 0x20]
cmp byte [ebx + ebp], 0x20
lea esi, [ebx + ebp]
jle 0x44b376
push 0xf
push str._settingshelper
push esi
mov dword [esp + 0x24], 1
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b3cf
push 0x12
push str._stopservicehelper
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b41f
push 5
push str._kill
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b426
push 0x13
push str._startservicehelper
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b487
push 0xe
push str._installhelper
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b491
push 0x10
push str._uninstallhelper
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b49b
push 0x15
push str._securityeditorhelper
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b4a5
push 0xf
push str._securityeditor
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b4af
push 9
push str._settings
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b557
push 0xc
push str._stopservice
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b57c
push 0xd
push str._startservice
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b586
push 8
push str._install
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b590
push 0xa
push str._uninstall
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b671
push 0xc
push str._service_run
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b746
push 8
push str._service
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b770
push 4
push str._run
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
je 0x44b3ae
push 0xe
push str._autoreconnect
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
jne 0x44b1a7
mov al, byte [ebx + ebp + 0xe]
add ebp, 0xe
xor edi, edi
cmp al, 0x20
mov dword [esp + 0x14], ebp
mov esi, ebp
jg 0x44b0f3
test al, al
je 0x44b0f3
mov al, byte [ebx + esi + 1]
add esi, 1
cmp al, 0x20
jle 0x44b0e4
push 3
lea eax, [ebx + esi]
push 0x47e920
push eax
mov dword [esp + 0x28], eax
call fcn.0045e71d
add esp, 0xc
test eax, eax
jne 0x44b15e
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0x20
mov ebp, esi
jle 0x44b129
lea esp, [esp]
add ebp, 1
cmp byte [ebx + ebp], 0x20
jg 0x44b120
mov ebx, ebp
sub ebx, esi
lea ecx, [ebx + 1]
push ecx
call fcn.0045cd98
mov edi, eax
add esp, 4
test edi, edi
je 0x44b15a
mov edx, dword [esp + 0x1c]
push ebx
push edx
push edi
call fcn.0045d150
push edi
mov byte [ebx + edi], 0
call fcn.0045df00
add esp, 0x10
mov edi, eax
mov dword [esp + 0x14], ebp
push edi
call fcn.00448110
add esp, 4
test eax, eax
jne 0x44b376
test edi, edi
mov byte [0x4aaaa3], 1
jne 0x44b18d
mov byte [0x4aaaad], 1
mov byte [0x4aaaa3], 0
jmp 0x44b376
mov edx, 0x4aa978
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x44b196
jmp 0x44b376
push 4
push str._id:
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
jne 0x44b253
lea eax, [ebp + 1]
cmp byte [ebx + eax], 0x20
lea ebp, [ebx + eax]
mov edi, eax
jle 0x44b1d9
lea ecx, [ecx]
add edi, 1
cmp byte [ebx + edi], 0x20
jg 0x44b1d0
mov ebx, edi
sub ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0045cd98
mov esi, eax
add esp, 4
test esi, esi
je 0x44b206
push ebx
push ebp
push esi
call fcn.0045d150
push esi
mov byte [ebx + esi], 0
call fcn.0045df00
add esp, 0x10
mov esi, eax
push esi
mov dword [esp + 0x18], edi
call fcn.00448140
add esp, 4
test eax, eax
jne 0x44b376
test esi, esi
mov byte [0x4aaaae], 1
jne 0x44b239
mov byte [0x4aaaaf], 1
mov byte [0x4aaaae], 0
jmp 0x44b376
mov edx, 0x4aa978
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x44b242
jmp 0x44b376
push 8
push str._connect
push esi
call fcn.0045e71d
add esp, 0xc
test eax, eax
jne 0x44b3f9
mov al, byte [ebx + ebp + 8]
add ebp, 8
cmp al, 0x20
mov dword [esp + 0x14], ebp
mov edi, ebp
jg 0x44b28f
lea esp, [esp]
test al, al
je 0x44b28f
mov al, byte [ebx + edi + 1]
add edi, 1
cmp al, 0x20
jle 0x44b280
cmp byte [ebx + edi], 0x20
mov ebp, edi
jle 0x44b2a0
add ebp, 1
cmp byte [ebx + ebp], 0x20
jg 0x44b297
mov ebx, ebp
sub ebx, edi
test ebx, ebx
jle 0x44b355
lea ecx, [ebx + 1]
push ecx
call fcn.0045cd98
mov esi, eax
add esp, 4
test esi, esi
je 0x44b34f
mov edx, dword [esp + 0x24]
push ebx
lea eax, [edx + edi]
push eax
push esi
call fcn.0045d150
mov eax, esi
sub eax, edi
push 0x3a
push esi
mov byte [eax + ebp], 0
mov edi, 0x157c
call fcn.0045ec60
add esp, 0x14
test eax, eax
je 0x44b306
mov byte [eax], 0
add eax, 1
cmp byte [eax], 0x3a
jne 0x44b2fb
add eax, 1
push eax
call fcn.0045e9b6
mov edi, eax
add esp, 4
push edi
push esi
push str..winvnc.cpp_:_test...__s__d_n
push 0
push 0x490660
call fcn.00401810
push esi
call fcn.00449a50
push esi
mov ebx, eax
call fcn.0045d145
add esp, 0x1c
test ebx, ebx
je 0x44b34f
push edi
push ebx
call fcn.004480c0
add esp, 8
test eax, eax
jne 0x44b34f
mov byte [0x4aaaac], 1
mov dword [0x4a9ec0], edi
mov dword [0x4a9a3c], ebx
mov dword [esp + 0x14], ebp
jmp 0x44b376
push 0
push 0
call fcn.004480c0
add esp, 8
test eax, eax
jne 0x44b376
mov byte [0x4aaaac], 1
mov dword [0x4a9ec0], eax
mov dword [0x4a9a3c], eax
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
add ebp, 1
mov eax, ebx
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44b390
sub eax, edx
cmp ebp, eax
jb 0x44af20
cmp dword [esp + 0x18], 0
jne 0x44b3f9
mov edi, dword [esp + 0x20]
push edi
call fcn.0044a660
add esp, 4
test al, al
je 0x44b3f9
call fcn.0044ab50
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00449650
mov eax, esi
jmp 0x44b404
lea ebx, [ebx + ebp + 0x10]
lea ecx, [esp + 0x28]
sub ecx, ebx
lea esp, [esp]
mov al, byte [ebx]
mov byte [ecx + ebx], al
add ebx, 1
test al, al
jne 0x44b3e0
lea ecx, [esp + 0x28]
push ecx
call fcn.00403900
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00449650
xor eax, eax
pop esi
mov ecx, dword [esp + 0x350]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045c20d
add esp, 0x348
ret 0x10
call fcn.00404670
jmp 0x44b3f9
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x4aaab4], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [0x4aaab4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x44b3f9
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push esi
call edi
push 0
push 0
push 0x10
push esi
call edi
jmp 0x44b3f9
call fcn.00404760
jmp 0x44b3f9
call fcn.00404850
jmp 0x44b3f9
call fcn.004048e0
jmp 0x44b3f9
call fcn.00404970
jmp 0x44b3f9
push 0x104
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x44b50d
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call fcn.0045c1e0
mov byte [eax], 0
lea eax, [esp + 0x30]
add esp, 8
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x44b4e0
mov edx, dword [str._authSSP.dll]
mov ecx, dword [0x47c770]
mov dword [eax], edx
mov edx, dword [0x47c774]
mov dword [eax + 4], ecx
mov cl, byte [0x47c778]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x44b3f9
push str.vncEditSecurity
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x4a9634]
push eax
push 0
call edi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44b3f9
lea ebx, [ebx + ebp + 0xa]
lea ecx, [esp + 0x28]
sub ecx, ebx
mov al, byte [ebx]
mov byte [ecx + ebx], al
add ebx, 1
test al, al
jne 0x44b561
lea ecx, [esp + 0x28]
push ecx
call fcn.00404660
jmp 0x44b3f6
call fcn.00404700
jmp 0x44b3f9
call fcn.004047f0
jmp 0x44b3f9
mov al, byte [ebx + ebp]
test al, al
lea esi, [ebx + ebp]
je 0x44b633
mov edi, edi
movsx edx, al
push edx
call fcn.00460388
add esp, 4
test eax, eax
jne 0x44b5bc
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x44b5a0
jmp 0x44b633
mov al, byte [esi]
test al, al
je 0x44b633
movsx eax, al
push eax
call fcn.00460388
add esp, 4
test eax, eax
je 0x44b5de
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x44b5c2
jmp 0x44b633
mov al, byte [esi]
test al, al
je 0x44b633
cmp al, 0x22
jne 0x44b5eb
add esi, 1
cmp byte [esi], 0
je 0x44b633
push 0x22
push esi
call fcn.0045c1e0
add esp, 8
test eax, eax
je 0x44b602
mov byte [eax], 0
cmp byte [esi], 0
je 0x44b633
push str.RealSvc
push esi
call fcn.0045dab4
add esp, 8
test eax, eax
je 0x44b633
push pe_nt_image_headers32
push esi
push str.RealSvc
call fcn.0045d150
add esp, 0xc
mov byte [0x48db17], 0
call fcn.00409ff0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.RealSvc
push str.net_start___s_
lea ecx, [esp + 0x30]
push 0x124
push ecx
call fcn.0045cd9d
add esp, 0x10
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x44b3f9
mov al, byte [ebx + ebp]
test al, al
lea esi, [ebx + ebp]
je 0x44b713
nop
movsx eax, al
push eax
call fcn.00460388
add esp, 4
test eax, eax
jne 0x44b69c
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x44b680
jmp 0x44b713
mov al, byte [esi]
test al, al
je 0x44b713
movsx ecx, al
push ecx
call fcn.00460388
add esp, 4
test eax, eax
je 0x44b6be
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x44b6a2
jmp 0x44b713
mov al, byte [esi]
test al, al
je 0x44b713
cmp al, 0x22
jne 0x44b6cb
add esi, 1
cmp byte [esi], 0
je 0x44b713
push 0x22
push esi
call fcn.0045c1e0
add esp, 8
test eax, eax
je 0x44b6e2
mov byte [eax], 0
cmp byte [esi], 0
je 0x44b713
push str.RealSvc
push esi
call fcn.0045dab4
add esp, 8
test eax, eax
je 0x44b713
push pe_nt_image_headers32
push esi
push str.RealSvc
call fcn.0045d150
add esp, 0xc
mov byte [0x48db17], 0
push str.RealSvc
push str.net_stop___s_
lea edx, [esp + 0x30]
push 0x124
push edx
call fcn.0045cd9d
add esp, 0x10
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.00409ca0
jmp 0x44b3f9
push edi
call fcn.0044a660
add esp, 4
test al, al
je 0x44b3f9
push 1
mov dword [0x4aaaa4], 1
call fcn.00448190
add esp, 4
jmp 0x44b3bb
push ebx
call fcn.00409f90
jmp 0x44b3f6