Function at 0x14003de70
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc70]
sub rsp, 0xd70
mov rax, qword [0x1401f0010]
xor rax, rsp
mov qword [rbp + 0xc60], rax
mov rbx, rcx
mov qword [rbp + 0x20], rcx
xor r13d, r13d
mov qword [rcx + 0x2e8], r13
mov qword [rcx + 0x2f0], r13
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003df03
lea rdx, str.InjectTouchInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2e8], rax
lea rdx, str.InitializeTouchInjection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2f0], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [rbx + 0x2c8]
mov rdx, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_connected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140017a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x28], r13
mov rcx, qword [rbx + 0x2c8]
mov rdx, qword [rcx + 0x4f8]
mov rcx, qword [rbx + 0x2c0]
mov r8, qword [rcx]
call qword [r8 + 0x1e0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x40]
test al, al
je 0x14003e0b7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x14003e0e6
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], r13b
je 0x14003e0b7
cmp byte [0x1401f42c3], r13b
jne 0x14003e0b7
mov rdx, qword [rbx + 0x2c0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
test ecx, ecx
jle 0x14003e012
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0xa8], 0
jne 0x140042bf6
inc r13d
mov rdx, qword [rbx + 0x2c0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
cmp r13d, ecx
jl 0x14003dfe0
add dword [rdx + 0xb8], 0xa
mov rax, qword [rbx + 0x2c0]
cmp dword [rax + 0xb8], 0x14
jle 0x14003e033
mov dword [rax + 0xb8], setsockopt
lea r8, str.vncClientThread::run_:_PostAddNewClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov r8, qword [rcx]
mov rax, qword [rbx + 0x2c8]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0xac]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xb0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x1af]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140020d20
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
jmp 0x140042bf6
mov rax, qword [rbx + 0x2c0]
mov dword [rax + 0xb8], r13d
lea r8, str.vncClientThread::run_:_negotiated_version_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x14003e163
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
cmp byte [0x1401f42c3], r13b
jne 0x140042bf6
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], r13b
jmp 0x140042b6c
mov rdx, qword [rbx + 0x2c8]
cmp byte [rdx + 0x10c], r13b
jne 0x14003e191
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov rdx, qword [rdx + 0x4f8]
call qword [rax + 0x1e8]
mov rdx, qword [rbx + 0x2c8]
mov byte [rdx + 0x10c], r13b
mov rax, qword [0x1401fef68]
imul edx, dword [rax + 0x758], 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.140087610
lea r8, str.vncClientThread::run_:_authenticated_connection_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov rcx, qword [rbx + 0x2c8]
call qword [rdi + 0x108]
mov rax, qword [rbx + 0x2c0]
mov rcx, qword [rbx + 0x2c8]
cmp qword [rax + 0x138], 1
ja 0x14003e24e
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [0x1401fef68]
mov r8, qword [rbx + 0x2c8]
mov edx, dword [rcx + 0x7a0]
mov rcx, qword [r8 + 0x4b0]
call fcn.140034bb0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003e2a2
mov rax, qword [rax + 0x108]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xd8]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rbx + 0x2c0]
mov rdx, qword [rax + 0x108]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xd0]
mov rcx, qword [rbx + 0x2c8]
lea rdx, [rbp + 0x80]
mov rcx, qword [rcx + 0x4b0]
call fcn.140034c40
mov rcx, qword [rbx + 0x2c8]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x840], xmm0
mov rdx, qword [rbx + 0x2c8]
mov rax, qword [rdx + 0x4b0]
mov ecx, dword [rax + 0x14]
mov dword [rdx + 0x850], ecx
mov dword [rbp - 0x4c], 0x110
xor edx, edx
mov r8d, 0x112
lea rcx, [rbp + 0x400]
call fcn.1401348e0
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rsi, 0xffffffffffffffff
mov r14d, 0x100
lea rcx, [rbp + 0x400]
test eax, eax
je 0x14003e38a
mov rdi, r13
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14003e330
test rax, rax
je 0x14003e36f
nop
movsx ecx, byte [rbp + rdi + 0x400]
call fcn.14014a344
mov byte [rbp + rdi + 0x400], al
inc rdi
lea rcx, [rbp + 0x400]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003e361
cmp rdi, rax
jb 0x14003e340
mov edx, 0x2e
lea rcx, [rbp + 0x400]
call fcn.14014b2c8
test rax, rax
je 0x14003e39b
jmp 0x14003e418
lea r8, [0x1401ca37c]
mov edx, 0x112
call fcn.14013ac00
mov edx, r14d
lea rcx, [rbp + 0x2f0]
call fcn.14003d7b0
lea rcx, [rbp + 0x2f0]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003e3b4
cmp rax, 3
jbe 0x14003e418
movzx eax, byte [rbp + 0x2f0]
sub al, 0x48
cmp al, 1
jbe 0x14003e418
lea r8, [0x1401ca384]
mov edx, 0x112
lea rcx, [rbp + 0x400]
call fcn.14013ac60
lea r8, [rbp + 0x2f0]
mov edx, 0x112
lea rcx, [rbp + 0x400]
call fcn.14013ac60
lea r8, [0x1401ca388]
mov edx, 0x112
lea rcx, [rbp + 0x400]
call fcn.14013ac60
lea r8, [0x1401ca38c]
mov edx, 0x112
lea rcx, [rbp + 0x400]
call fcn.14013ac60
mov rax, qword [0x1401fef68]
lea rcx, str.application_mode
lea r8, str.service_mode
cmp dword [rax + 0xe20], 0
cmove r8, rcx
mov edx, 0x112
lea rcx, [rbp + 0x400]
call fcn.14013ac60
mov r8, qword [rbx + 0x2c8]
mov rax, qword [r8 + 0x4b0]
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0x23c], xmm0
mov ecx, dword [r8 + 0x848]
mov eax, dword [r8 + 0x840]
mov edx, ecx
sub edx, eax
sar edx, 8
mov r9d, 0xff
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x238], dx
mov ecx, dword [r8 + 0x84c]
mov eax, dword [r8 + 0x844]
mov edx, ecx
sub edx, eax
sar edx, 8
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x23a], dx
movq rax, xmm0
shr rax, 0x20
rol ax, 8
mov word [rbp + 0x240], ax
rol word [rbp + 0x242], 8
rol word [rbp + 0x244], 8
lea rax, [rbp + 0x400]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003e510
mov eax, edi
bswap eax
mov dword [rbp + 0x24c], eax
mov r8d, 0x18
lea rdx, [rbp + 0x238]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b90
test eax, eax
je 0x14003e0b7
mov r8d, edi
lea rdx, [rbp + 0x400]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
test eax, eax
je 0x14003e0b7
lea r8, str.vncClientThread::run_:_sent_pixel_format_to_client_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x840
lea rcx, [rbp - 0x78]
call fcn.140025500
nop
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x70]
call fcn.140138b40
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 2
mov rcx, rbx
call fcn.1401256d0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 1
mov rax, qword [0x1401fef68]
mov eax, dword [rax + 0x77c]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x50], 1
xor r15b, r15b
mov byte [rsp + 0x46], r15b
xor al, al
mov byte [rsp + 0x41], al
xor dil, dil
mov byte [rsp + 0x44], dil
mov byte [rsp + 0x51], 1
xor r12b, r12b
mov byte [rsp + 0x42], r12b
xor r14b, r14b
mov byte [rsp + 0x45], r14b
xor sil, sil
mov byte [rsp + 0x43], sil
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x118], al
je 0x1400428c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], eax
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test al, al
jne 0x14003e6c4
call fcn.1400209d0
test eax, eax
jne 0x14003e6c4
lea r8, str.vncClientThread::run_:_vncClientThread__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.140020c40
test eax, eax
je 0x1400428c0
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3c9], 0
je 0x14003e6f6
cmp byte [rsp + 0x50], 0
je 0x14003e6f6
mov cl, setsockopt
call fcn.14003d730
mov cl, 0x91
call fcn.14003d730
xor al, al
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 0x2c8]
cmp dword [rsp + 0x68], 0
je 0x14003e71c
mov rcx, qword [rcx + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004ed90
mov dword [rsp + 0x68], r13d
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x4b0]
movzx edx, byte [rsp + 0x51]
mov rcx, qword [rcx + 0x90]
call fcn.14004f6c0
mov byte [rsp + 0x51], 0
test r15b, r15b
mov r15d, 2
je 0x14003e774
mov rax, qword [0x1401fef68]
mov r8d, dword [rax + 0x118]
mov edx, r15d
mov rcx, qword [rbx + 0x2c8]
call fcn.140047af0
mov dl, 1
mov rcx, qword [rbx + 0x2c8]
call fcn.140047b60
mov byte [rsp + 0x46], 0
cmp byte [rsp + 0x41], 0
je 0x14003e78f
mov dl, 1
mov rcx, qword [rbx + 0x2c8]
call fcn.140047b60
xor al, al
mov byte [rsp + 0x41], al
test dil, dil
je 0x14003e7b8
mov rax, qword [0x1401fef68]
mov r8d, dword [rax + 0x11c]
mov edx, 3
mov rcx, qword [rbx + 0x2c8]
call fcn.140047af0
mov byte [rsp + 0x44], 0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x378], 0
je 0x14003e7f1
cmp byte [rax + 0x9ca], 0
je 0x14003e7f1
mov byte [rax + 0x378], 0
mov rcx, qword [rbx + 0x2c8]
mov r8d, dword [rcx + 0x374]
mov edx, dword [rcx + 0x370]
call fcn.140047af0
test r12b, r12b
je 0x14003e807
mov rcx, qword [rbx + 0x2c8]
call fcn.140047c20
mov byte [rsp + 0x42], 0
test r14b, r14b
je 0x14003e81d
mov rcx, qword [rbx + 0x2c8]
call fcn.140047c70
mov byte [rsp + 0x45], 0
test sil, sil
je 0x14003e833
mov rcx, qword [rbx + 0x2c8]
call fcn.140047d90
mov byte [rsp + 0x43], 0
mov r12d, 1
mov edi, r12d
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x31], 0
jne 0x14003e888
cmp byte [rax + 0x30], 0
je 0x14003e888
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x210]
cmp byte [rax + 0x39], 0
je 0x14003e888
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x1400428b2
mov edi, r13d
jmp 0x14003e8a6
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x1400428b2
movzx eax, byte [rbp + 0x140]
cmp eax, 0xfd
ja case.0x14003e8d1.1
lea rsi, [0x140000000]
movzx eax, byte [rsi + rax + 0x42c84]
mov ecx, dword [rsi + rax*4 + 0x42c40]
add rcx, rsi
jmp rcx
mov byte [rsp + 0x41], r12b
jmp 0x140040199
mov r8d, setsockopt
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x140040192
rol word [rbp + 0x148], 8
rol word [rbp + 0x14a], 8
rol word [rbp + 0x14c], 8
mov edx, r13d
cmp byte [rbp + 0x151], r12b
sete dl
mov rcx, qword [rax + 0x4b0]
mov dword [rcx + 0x9c], edx
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
lea rdx, [rbp + 0x144]
call fcn.140037e10
test eax, eax
jne 0x14003e990
lea r8, str.vncClientThread::run_:_remote_pixel_format_invalid_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x5a8], r12d
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
jmp 0x140040199
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
mov rcx, qword [rbx + 0x2c8]
mov dword [rcx + 0x4a0], r13d
xor edx, edx
mov rcx, qword [rcx + 0x4b0]
call fcn.140036b40
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x48c], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x490], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x494], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x498], r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
mov rdi, 0xffffffffffffffff
mov edx, edi
call fcn.140038010
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x478], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ea68
mov dword [rcx + 0x7c], edi
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x470], 6
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ea8c
mov dword [rcx + 0x74], 6
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x480], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003eaad
mov dword [rcx + 0x84], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003eace
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003eafd
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
rol word [rbp + 0x142], 8
mov esi, r13d
mov r15d, r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x20]
mov r14d, r13d
cmp r13w, word [rbp + 0x142]
jae 0x14003f20c
nop dword [rax]
mov dword [rsp + 0x48], r13d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003f1f6
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov r8d, edi
and r8d, 0xff00
mov ecx, edi
shl ecx, 0x10
or ecx, r8d
shl ecx, 8
or ecx, edx
cmp ecx, 1
jne 0x14003ec01
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x20]
jmp 0x14003f1e1
cmp ecx, 0xffffff21
jne 0x14003ec1c
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x648], r12d
jmp 0x14003f1e1
cmp ecx, 0xfffffecc
jne 0x14003ec37
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x64c], r12d
jmp 0x14003f1e1
cmp ecx, 0xffff0001
jne 0x14003ec79
mov rcx, qword [rbx + 0x2c8]
mov dword [rcx + 0x4a0], r12d
mov edx, r12d
mov rcx, qword [rcx + 0x4b0]
call fcn.140036b40
lea r8, str.vncClientThread::run_:_Cache_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
jmp 0x14003f1e1
cmp ecx, 0xffff000b
jne 0x14003ec98
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x48c], r12d
lea r8, str.vncClientThread::run_:_XOR_protocol_extension_enabled_n
jmp 0x14003ec63
lea eax, [rcx + 0x100]
cmp eax, 9
ja 0x14003ed06
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x100]
mov rax, qword [rbx + 0x2c8]
mov ecx, 6
cmp r9d, 9
cmovbe ecx, r9d
mov dword [rax + 0x470], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003ece9
mov eax, 6
cmp ecx, 9
cmovbe eax, ecx
mov dword [rdx + 0x74], eax
lea r8, str.vncClientThread::run_:_compression_level_requested:__d_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
jmp 0x14003f1e1
cmp ecx, 0xffffffe0
jb 0x14003ed42
cmp ecx, 0xffffffe9
ja 0x14003f0be
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
lea edx, [rdi + 0x20]
call fcn.140038010
lea r9d, [rdi + 0x20]
lea r8, str.vncClientThread::run_:_image_quality_level_requested:__d_n
jmp 0x14003ecf0
cmp ecx, 0xfffffe00
jb 0x14003ef06
cmp ecx, 0xfffffe64
ja 0x14003eda9
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x200]
mov rax, qword [rbx + 0x2c8]
mov rdi, 0xffffffffffffffff
mov ecx, edi
cmp r9d, 0x64
cmovbe ecx, r9d
mov dword [rax + 0x478], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003ed9d
mov eax, edi
cmp ecx, 0x64
cmovbe eax, ecx
mov dword [rdx + 0x7c], eax
lea r8, str.vncClientThread::run_:_fine_grained_image_quality_level_requested:__d_n
jmp 0x14003ecf0
cmp ecx, 0xffffff20
jne 0x14003edde
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x480], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003edd2
mov dword [rcx + 0x84], r12d
lea r8, str.vncClientThread::run_:_LastRect_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffffff10
jne 0x14003ee61
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x484], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ee07
mov dword [rcx + 0x88], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_X_style_cursor_shape_updates_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffffff11
jne 0x14003eee4
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ee8a
mov dword [rcx + 0x8c], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffffff18
jne 0x14003ef59
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r12d
lea r8, str.vncClientThread::run_:_PointerPos_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xfffffd00
jb 0x14003ef59
cmp ecx, 0xfffffd05
ja 0x14003f0be
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
add edi, 0x300
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x47c], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ef4a
mov dword [rcx + 0x80], edi
mov r9d, edi
lea r8, str.vncClientThread::run_:_subsampling_requested:__d_n
jmp 0x14003ecf0
cmp ecx, 0xffff8000
jne 0x14003ef89
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c8], 1
mov rax, qword [0x1401fef68]
mov byte [rax + 0xe1c], 1
lea r8, str.vncClientThread::run_:_ServerState_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffff8003
jne 0x14003efab
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9cc], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffff8001
jne 0x14003efe0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9cb], 1
mov rax, qword [0x1401fef68]
mov byte [rax + 0xe1d], 1
mov byte [rsp + 0x46], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffff8004
jne 0x14003eff9
mov byte [rsp + 0x44], 1
lea r8, str.vncClientThread::run_:_IdleTime_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xffff8002
jne 0x14003f029
mov byte [rsp + 0x42], 1
lea r8, str.vncClientThread::run_:_FTProtocolVersion_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r12d, 1
jmp 0x14003f1e1
cmp ecx, 0xc0a1e5ce
jne 0x14003f050
mov byte [rsp + 0x45], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x5b0], 1
lea r8, str.vncClientThread::run_:_Extended_clipboard_protocol_extension_enabled_n
jmp 0x14003ec63
cmp ecx, 0xc0a1e5cf
jne 0x14003f069
mov byte [rsp + 0x43], 1
lea r8, str.vncClientThread::run_:_Streaming_DSM_support_enabled_n
jmp 0x14003ec63
cmp ecx, 0xfffffecf
jne 0x14003f091
lea r8, str.vncClientThread::run_:_Gii_Encoding_found_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r15d, r12d
jmp 0x14003f1e1
cmp ecx, 0x10
jne 0x14003f0be
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x490], r12d
lea r8, str.vncClientThread::run_:_ZRLE_found__n
lea edx, [rcx - 7]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov ecx, edi
shl ecx, 0x10
mov eax, edi
and eax, 0xff00
or ecx, eax
shl ecx, 8
or edx, ecx
cmp edx, 0x12
jne 0x14003f112
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x494], r12d
lea r8, str.vncClientThread::run_:_XZ_found__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov edi, dword [rsp + 0x48]
mov ecx, edi
and ecx, 0xff0000
mov eax, edi
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shl eax, 8
or ecx, eax
cmp ecx, 7
jne 0x14003f15f
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x498], r12d
lea r8, str.vncClientThread::run_:_Tight_found_n
lea edx, [rcx + 2]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
test esi, esi
jne 0x14003f1e1
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 0x55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, dword [rsp + 0x48]
mov edx, r8d
and edx, 0xff0000
mov ecx, r8d
shr ecx, 0x10
or edx, ecx
shr edx, 8
mov eax, r8d
shl eax, 0x10
and r8d, 0xff00
or eax, r8d
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
xor r8d, r8d
call fcn.140036f50
test eax, eax
cmovne esi, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc r14d
movzx eax, word [rbp + 0x142]
cmp r14d, eax
jl 0x14003eb90
jmp 0x14003f204
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
test esi, esi
jne 0x14003f297
lea r8, str.vncClientThread::run_:_defaulting_to_raw_encoder_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
xor r8d, r8d
xor edx, edx
call fcn.140036f50
test eax, eax
jne 0x14003f28e
lea r8, str.vncClientThread::run_:_failed_to_select_raw_encoder__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x2c8]
cmp dword [rax + 0x670], 0
jne 0x14003f33e
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f2c5
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f2f4
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp eax, 1
jbe 0x14003f360
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x228]
test r15d, r15d
je 0x14003f391
cmp qword [rbx + 0x2e8], 0
je 0x14003f391
cmp qword [rbx + 0x2f0], 0
je 0x14003f391
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3cb], 0
je 0x14003f391
mov rcx, rbx
call fcn.14003a960
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x3a8], r12d
jmp 0x14003e99e
mov byte [rsp + 0x40], 0
mov word [rsp + 0x4c], r13w
xor sil, sil
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x308
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x14003f41e
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_subtype_failed___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140040199
mov r8d, r15d
lea rdx, [rsp + 0x4c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x14003f43f
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_length_failed___n
jmp 0x14003f3f3
movzx edx, byte [rsp + 0x40]
movzx r8d, word [rsp + 0x4c]
test dl, dl
jns 0x14003f463
mov sil, 1
rol r8w, 8
mov word [rsp + 0x4c], r8w
and dl, 0x7f
mov byte [rsp + 0x40], dl
movzx r9d, dl
mov ecx, r9d
test dl, dl
je 0x14003fac8
sub ecx, 1
je 0x14003fa0f
sub ecx, 1
je 0x14003f507
cmp ecx, 1
je 0x14003f4b1
lea r8, str.vncClientThread::run_:_GII:_Extension_invalid_subtype:__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
mov rax, qword [rbx + 0x2c8]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], dl
jne 0x14003f4e8
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3cb], 0
jne 0x14003f53f
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1bc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1cc], xmm1
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1ec], r13
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x309
lea rcx, [rbp + 0x48]
call fcn.140019e70
nop
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIDeviceCreation__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov byte [rbp + 0x1b8], 0xfd
movzx eax, byte [rsp + 0x40]
mov byte [rbp + 0x1b9], al
movzx eax, word [rsp + 0x4c]
mov word [rbp + 0x1ba], ax
mov r8d, gethostname
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x14003f601
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
lea rcx, [rbp + 0x48]
call fcn.140019ea0
jmp 0x14004012f
test sil, sil
je 0x14003f734
mov ecx, dword [rbp + 0x1e0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e0], edx
mov ecx, dword [rbp + 0x1e4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e4], edx
mov ecx, dword [rbp + 0x1e8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e8], edx
mov ecx, dword [rbp + 0x1ec]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x1ec], r8d
mov ecx, dword [rbp + 0x1f0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1f0], edx
mov ecx, dword [rbp + 0x1dc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
bswap edx
mov dword [rbp + 0x1dc], edx
jmp 0x14003f73b
mov r8d, dword [rbp + 0x1ec]
lea eax, [r8 - 1]
cmp eax, 9
ja 0x14003fa03
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], eax
mov edi, r13d
test r8d, r8d
je 0x14003f5f3
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, [rbp + 0x250]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003f9f7
test sil, sil
je 0x14003f96a
mov ecx, dword [rbp + 0x250]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x250], edx
mov ecx, dword [rbp + 0x2a4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a4], edx
mov ecx, dword [rbp + 0x2a8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a8], edx
mov ecx, dword [rbp + 0x2ac]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2ac], edx
mov ecx, dword [rbp + 0x2b0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b0], edx
mov ecx, dword [rbp + 0x2b4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b4], edx
mov ecx, dword [rbp + 0x2b8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b8], edx
mov ecx, dword [rbp + 0x2bc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2bc], edx
mov ecx, dword [rbp + 0x2c0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2c0], edx
mov dword [rbp - 0x80], 0x40082fd
mov dword [rbp - 0x7c], 0x1000000
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r8d, 8
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b90
test eax, eax
je 0x14003f9eb
mov edx, r12d
mov ecx, dword [rbp + 0x1f0]
call qword [rbx + 0x2f0]
mov ecx, dword [rbp + 0x1f0]
mov dword [rbx + 0x300], ecx
lea eax, [rcx - 1]
cmp eax, 0xfc
ja 0x14003f9d8
call fcn.140131f5c
mov qword [rbx + 0x2f8], rax
inc edi
cmp edi, dword [rbp + 0x1ec]
jb 0x14003f790
jmp 0x14003f5f3
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
jmp 0x14003f5d7
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation_valuators_failed_n
jmp 0x14003f5d7
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation__invalid_amount_of_valuators_n
jmp 0x14003f5d7
mov rax, qword [rbx + 0x2c8]
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], 0
je 0x140042888
mov word [rsp + 0x54], r13w
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIVersionMessage__n
mov edx, 9
call fcn.140017a50
cmp word [rsp + 0x4c], 2
je 0x14003fa5b
movzx r9d, word [rsp + 0x54]
lea r8, str.vncClientThread::run_:_GII:Extension_invalid_length:__d_n
jmp 0x14003f490
mov r8d, r15d
lea rdx, [rsp + 0x54]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x14003fa9b
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_version_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
movzx eax, word [rsp + 0x54]
test sil, sil
je 0x14003faae
rol ax, 8
mov word [rsp + 0x54], ax
cmp ax, 1
je 0x14004012f
movzx r9d, ax
lea r8, str.vncClientThread::run_:_GII:_Extension_client_version_invalid_number:__d_n
jmp 0x14003f490
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3cb], 0
jne 0x14003fb00
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004012f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov byte [rbp + 0x188], 0xfd
mov byte [rbp + 0x189], dl
mov word [rbp + 0x18a], r8w
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x18c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x14003fb46
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
jmp 0x14003fadf
test sil, sil
je 0x14003fbef
rol word [rbp + 0x18e], 8
mov ecx, dword [rbp + 0x190]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x190], edx
mov ecx, dword [rbp + 0x194]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x194], r8d
mov ecx, dword [rbp + 0x198]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x198], edx
jmp 0x14003fbf6
mov r8d, dword [rbp + 0x194]
mov ecx, r8d
mov eax, 0x20
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140131f5c
mov r15, rax
mov r14d, r13d
cmp dword [rbp + 0x194], r13d
jbe 0x140040001
lea r12d, [rdi + 5]
nop dword [rax + rax]
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x78], r13d
mov qword [rbp + 0x168], r13
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
test sil, sil
je 0x14003fca2
mov ecx, dword [rsp + 0x48]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x48], edx
mov r8d, r12d
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
test sil, sil
je 0x14003fcf1
mov ecx, dword [rsp + 0x58]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x58], edx
jmp 0x14003fcf5
mov edx, dword [rsp + 0x58]
mov edi, r14d
shl rdi, 5
add rdi, r15
mov dword [rdi], edx
mov r8d, r12d
lea rdx, [rsp + 0x5c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
test sil, sil
je 0x14003fd50
mov ecx, dword [rsp + 0x5c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x5c], edx
jmp 0x14003fd54
mov edx, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x48]
test r9b, 0x10
je 0x14003ffce
mov eax, edx
shr eax, 0x10
mov dword [rdi + 0xc], eax
movzx eax, dx
mov dword [rdi + 0x10], eax
bt r9d, 0x1c
jae 0x14003fde3
mov r8d, r12d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
test sil, sil
je 0x14003fdd2
mov ecx, dword [rsp + 0x60]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x60], edx
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x14003fde9
mov edx, dword [rsp + 0x60]
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x14003fde9
mov eax, r12d
mov edx, r12d
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], eax
bt r9d, 0x19
jae 0x14003fe17
mov r8d, r12d
lea rdx, [rsp + 0x64]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x14003fe48
mov ecx, dword [rsp + 0x64]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x64], edx
bt r9d, 0x18
jae 0x14003fe70
mov r8d, r12d
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x14003fea1
mov ecx, dword [rsp + 0x78]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x78], edx
bt r9d, 0x17
jae 0x14003fece
mov r8d, 8
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x14003ffd7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x14003ff68
mov rdx, qword [rbp + 0x168]
mov r8, rdx
movabs rax, 0xff000000000000
and r8, rax
mov rax, rdx
shr rax, 0x10
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff0000000000
and rax, rcx
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff00000000
and rax, rcx
or r8, rax
shr r8, 8
mov rcx, rdx
shl rcx, 0x10
mov rax, rdx
and eax, 0xff00
or rcx, rax
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
mov eax, 0xff000000
and rdx, rax
or rcx, rdx
shl rcx, 8
or r8, rcx
mov qword [rbp + 0x168], r8
mov dword [rdi + 4], r13d
mov eax, dword [rdi]
cmp eax, dword [rbx + 0x300]
jae 0x14003ffb9
mov ecx, eax
test r9d, r9d
jns 0x14003ffa7
mov rax, qword [rbx + 0x2f8]
cmp byte [rcx + rax], 1
jne 0x14003ff93
mov dword [rdi + 4], 0x20006
jmp 0x14003ffb9
mov dword [rdi + 4], 0x10006
mov rax, qword [rbx + 0x2f8]
mov byte [rcx + rax], 1
jmp 0x14003ffb9
mov dword [rdi + 4], 0x40000
mov rax, qword [rbx + 0x2f8]
mov byte [rcx + rax], 0
mov dword [rdi + 0x1c], r13d
inc r14d
cmp r14d, dword [rbp + 0x194]
jae 0x14003fffa
jmp 0x14003fc30
lea r8, str.vncClientThread::run_:_Only_16bit_XT_supported_n
jmp 0x14003ffde
lea r8, str.vncClientThread::run_:_GIIExtension_reading_TouchINfo_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rdi, 0xffffffffffffffff
mov eax, dword [rbp + 0x194]
cmp eax, 0xfe
ja 0x140040126
mov ecx, eax
mov eax, 0x90
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140131f5c
mov rsi, rax
mov ecx, dword [rbp + 0x194]
lea r8, [rcx + rcx*8]
shl r8, 4
xor edx, edx
mov rcx, rax
call fcn.1401348e0
mov edi, r13d
mov ecx, dword [rbp + 0x194]
test ecx, ecx
je 0x140040115
mov ebx, 7
lea r14d, [rbx - 5]
nop dword [rax]
mov ecx, edi
lea r11, [rcx + rcx*8]
shl r11, 4
add r11, rsi
mov dword [r11], r14d
shl rcx, 5
lea r10, [rcx + r15]
mov r9d, dword [r10 + 0xc]
mov dword [r11 + 0x20], r9d
mov r8d, dword [r10 + 0x10]
mov dword [r11 + 0x24], r8d
mov eax, dword [r10 + 0x1c]
mov dword [r11 + 0x40], eax
mov dword [r11 + 0x60], r13d
mov dword [r11 + 0x64], ebx
mov dword [r11 + 0x88], 0x5a
mov dword [r11 + 0x8c], 0x7d00
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ecx, r8d
sub ecx, eax
mov dword [r11 + 0x6c], ecx
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, r8d
mov dword [r11 + 0x74], eax
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
mov ecx, r9d
sub ecx, eax
mov dword [r11 + 0x68], ecx
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, r9d
mov dword [r11 + 0x70], eax
mov eax, dword [r10]
mov dword [r11 + 4], eax
mov eax, dword [r10 + 4]
mov dword [r11 + 0xc], eax
inc edi
mov ecx, dword [rbp + 0x194]
cmp edi, ecx
jb 0x140040060
mov rbx, qword [rbp + 0x20]
mov rdx, rsi
call qword [rbx + 0x2e8]
mov rcx, rsi
call fcn.140131f10
mov rcx, r15
call fcn.140131f10
nop
lea rcx, [rbp - 0x20]
call fcn.140019ea0
jmp 0x140040199
mov r8d, 0xa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
movsd xmm0, qword [rbp + 0x140]
movsd qword [rbp - 0x10], xmm0
movzx eax, word [rbp + 0x148]
mov word [rbp - 8], ax
lea rdx, [rbp - 0x10]
mov rcx, qword [rbx + 0x2c8]
call fcn.140043d40
test al, al
jne 0x140040199
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, qword [0x1401fef68]
call fcn.140038910
test eax, eax
je 0x1400401b5
mov rcx, qword [rbx + 0x2c8]
call fcn.1400479d0
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x118], 0
je 0x1400428c0
movzx r12d, byte [rsp + 0x42]
movzx esi, byte [rsp + 0x43]
movzx edi, byte [rsp + 0x44]
movzx r14d, byte [rsp + 0x45]
movzx r15d, byte [rsp + 0x46]
jmp 0x14003e674
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140040397
cmp byte [0x1401f3eba], 0
je 0x140040329
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x144], edx
cmp byte [rbp + 0x141], 0
je 0x140040397
lea r8d, [rdx - 0x61]
cmp r8d, 0x63
ja 0x140040397
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rdx, qword [rcx + 0x90]
movsxd rax, r8d
imul rcx, rax, 0x64
mov rax, qword [rdx + 0xe440]
mov ecx, dword [rcx + rax]
mov dword [0x1401f3ebc], ecx
lea r8, str.GlobalSessionEventUltraPreConnect
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rsi, rax
lea r8, str.GlobalSessionUltraPreConnect
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400402fd
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1400402f4
mov ecx, dword [0x1401f3ebc]
mov dword [rax], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140040397
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2c8]
call fcn.140046600
jmp 0x140040199
mov r8, qword [rbx + 0x2c8]
cmp byte [r8 + 0x3c9], 0
je 0x140040397
mov edx, dword [rbp + 0x144]
mov ecx, edx
and ecx, 0xff0000
mov eax, edx
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shl eax, 8
or ecx, eax
mov dword [rbp + 0x144], ecx
cmp byte [rbp + 0x141], 0
setne dl
movzx r9d, byte [r8 + 0x3cd]
movzx r8d, byte [r8 + 0x3cc]
call fcn.1400758a0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x5ac], r12d
mov rcx, qword [rbx + 0x2c8]
call fcn.140046600
jmp 0x140040199
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140040199
cmp byte [0x1401f3eba], 0
jne 0x140040199
mov r8, qword [rbx + 0x2c8]
cmp byte [r8 + 0x3ca], 0
je 0x140040199
movzx eax, word [rbp + 0x142]
rol ax, 8
mov word [rbp + 0x142], ax
movzx ecx, word [rbp + 0x144]
rol cx, 8
mov word [rbp + 0x144], cx
movzx eax, ax
movzx edx, word [r8 + 0x850]
imul edx, eax
mov word [rbp + 0x142], dx
movzx eax, word [r8 + 0x850]
movzx r9d, cx
imul r9d, eax
mov word [rbp + 0x144], r9w
mov r14d, 0x8000
cmp dx, word [r8 + 0x536]
jne 0x14004045e
cmp r9w, word [r8 + 0x538]
je 0x140040464
mov r14d, 0x8001
movzx ecx, byte [rbp + 0x141]
movzx eax, cl
xor al, byte [r8 + 0x535]
test r12b, al
je 0x1400404ae
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movzx ecx, byte [rbp + 0x141]
test eax, eax
movzx eax, cl
not al
je 0x1400404a1
and eax, r12d
lea eax, [rax*8 + 8]
jmp 0x1400404ab
and eax, r12d
lea eax, [rax*2 + 2]
or r14d, eax
mov rax, qword [rbx + 0x2c8]
movzx r8d, byte [rax + 0x535]
movzx edx, cl
and dl, 2
movzx eax, r8b
and al, 2
cmp dl, al
je 0x1400404df
mov eax, 0x40
test dl, dl
mov edx, 0x20
cmovne eax, edx
or r14d, eax
xor r8b, cl
test r8b, 4
je 0x140040527
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 4
test eax, eax
je 0x14004050e
test byte [rbp + 0x141], dil
mov eax, edi
cmovne eax, r15d
or r14d, eax
jmp 0x14004052c
test byte [rbp + 0x141], 4
mov eax, reloc.WS2_32.dll_recv
mov ecx, 8
cmovne eax, ecx
or r14d, eax
jmp 0x14004052c
mov edi, 4
mov rcx, qword [0x1401fef68]
call fcn.140038920
test eax, eax
je 0x140040645
mov rcx, qword [rbx + 0x2c8]
movzx edx, byte [rcx + 0x535]
movzx eax, dl
movzx r8d, byte [rbp + 0x141]
xor al, r8b
test r12b, al
jne 0x140040569
xor dl, r8b
test dl, 2
je 0x140040590
cmp byte [rcx + 0x3b8], 0
jne 0x140040645
mov byte [rcx + 0x3ad], r12b
mov rcx, qword [rbx + 0x2c0]
call fcn.140085910
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3b8], 0
jne 0x140040645
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, dword [rdi + 0x38c]
add r14d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r14d, ecx
sub r14d, eax
mov rcx, qword [0x1401fef68]
call fcn.140038950
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x140040626
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r14d, word [rbp + 0x144]
add r14d, dword [rax + 0x384]
mov rcx, qword [rax + 0x3c0]
test rcx, rcx
je 0x140040199
mov r8d, r14d
mov edx, esi
call fcn.140023880
jmp 0x140040199
mov r12d, r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
call fcn.1400380a0
movzx ecx, byte [rbp + 0x141]
test eax, eax
je 0x140040693
mov rax, qword [rbx + 0x2c8]
test cl, 8
je 0x140040683
test byte [rax + 0x535], 8
jne 0x140040683
mov r12d, 0x78
jmp 0x1400406b3
test cl, 0x10
je 0x1400406b8
test byte [rax + 0x535], 0x10
jne 0x1400406b8
jmp 0x1400406ad
movzx eax, cl
and al, 8
je 0x14004069f
bts r14d, 0xb
neg al
sbb r12d, r12d
and r12d, 0x78
test cl, 0x10
je 0x1400406b8
mov r12d, 0xffffff88
bts r14d, 0xb
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x48]
call qword [rax + 0x1c0]
mov r8, qword [rbx + 0x2c8]
cmp dword [r8 + 0x390], 0
je 0x14004075a
movzx eax, word [rbp + 0x142]
mov ecx, dword [r8 + 0x380]
add ecx, eax
imul eax, ecx, 0xffff
mov ecx, dword [rbp - 0x48]
dec ecx
cdq
idiv ecx
mov esi, eax
movzx ecx, word [rbp + 0x144]
mov edx, dword [r8 + 0x384]
add edx, ecx
imul eax, edx, 0xffff
mov r8d, dword [rbp - 0x68]
dec r8d
cdq
idiv r8d
mov edi, eax
mov rcx, qword [rbx + 0x2c0]
call fcn.140084880
neg eax
sbb rdx, rdx
and edx, 0x564e4300
mov qword [rsp + 0x20], rdx
mov r9d, r12d
mov r8d, edi
mov edx, esi
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x14004098f
lea rcx, [r8 + 0x998]
call fcn.1400298a0
test al, al
je 0x140040894
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
mov rdi, qword [rbx + 0x2c8]
lea ecx, [rax + 0x4c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, dword [rdi + 0x38c]
add r15d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r15d, ecx
sub r15d, eax
mov rcx, qword [0x1401fef68]
call fcn.140038950
test eax, eax
je 0x140040806
mov rax, qword [rbx + 0x2c8]
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r15d, word [rbp + 0x144]
add r15d, dword [rax + 0x384]
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, esi, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x60], eax
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, r15d, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x64], eax
bts r14d, 0xe
mov dword [rbp + 0x6c], r14d
mov rcx, qword [rbx + 0x2c0]
call fcn.140084880
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x68], r12d
mov dword [rbp + 0x70], r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x998
call fcn.140048830
mov r8d, 0x28
lea rdx, [rbp + 0x58]
mov r12d, 1
mov ecx, r12d
call rax
jmp 0x140040995
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6c], r13d
mov dword [rbp - 0x64], 0xa
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov dword [rbp + 0x2e8], eax
test r14b, 1
je 0x140040924
btr r14d, 0xf
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x70]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov qword [rbp + 0x2d0], 0xa
mov dword [rbp + 0x2d8], r13d
xor r9d, r9d
lea r8, [rbp - 0x64]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rbp + 0x2d0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov rcx, qword [rbx + 0x2c0]
call fcn.140084880
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
movzx r8d, word [rbp + 0x144]
sub r8d, dword [rbp - 0x2c]
movzx edx, word [rbp + 0x142]
sub edx, dword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
test r14b, 1
je 0x14004098f
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r12d, 1
mov rcx, qword [rbx + 0x2c8]
mov eax, dword [rbp + 0x140]
mov dword [rcx + 0x534], eax
movzx eax, word [rbp + 0x144]
mov word [rcx + 0x538], ax
jmp 0x140040389
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140040199
mov ecx, dword [rbp + 0x144]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x6400000
jg 0x140040199
test edi, edi
jns 0x140040b69
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x5b0], 0
je 0x140040199
mov eax, edi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, 0x6400000
ja 0x140040199
lea rcx, [rbp]
call fcn.1400155c0
nop
xor r8d, r8d
mov edx, edi
lea rcx, [rbp]
call fcn.140015620
lea rcx, [rbp]
call fcn.140015610
mov rdx, rax
mov r8d, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x140040a90
lea rcx, [rbp]
call fcn.140015600
jmp 0x140040199
lea rcx, [rbp]
call fcn.1400156d0
mov ecx, 0xff000000
and eax, ecx
bt eax, 0x18
jb 0x140040b40
cmp eax, 0x1000000
je 0x140040b40
lea ecx, [rax - 0x2000000]
test ecx, 0xfdffffff
je 0x140040aeb
cmp eax, 0x10000000
jne 0x140040b5b
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2c8]
lea rdx, [rbp]
call qword [rax + 0x158]
jmp 0x140040b5b
lea rcx, [rbp + 0x1b8]
call fcn.140015b20
nop
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.140015b90
test al, al
je 0x140040b32
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
lea rcx, [rbp]
call fcn.1400156d0
mov r8d, eax
lea rdx, [rbp + 0x1b8]
mov rcx, qword [rbx + 0x2c8]
call qword [rdi + 0x28]
nop
lea rcx, [rbp + 0x1b8]
call fcn.140015b40
jmp 0x140040b5b
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x5b0
mov r8b, 1
lea rdx, [rbp]
call fcn.140015950
nop
lea rcx, [rbp]
call fcn.140015600
jmp 0x140040199
movsxd rcx, edi
inc rcx
call fcn.140131f5c
mov r14, rax
movsxd rcx, edi
mov byte [rcx + rax], 0
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
jne 0x140040ba1
mov rcx, r14
call fcn.140131f10
jmp 0x140040199
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140040bb0
lea eax, [rdi + rdi]
movsxd rcx, eax
inc rcx
call fcn.140131f5c
mov rsi, rax
mov rcx, r13
movsxd rax, edi
test edi, edi
jle 0x140040c04
mov rdx, r14
nop dword [rax + rax]
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140040bf5
mov byte [rsi + rcx], reloc.WS2_32.dll_listen
inc rcx
movzx r8d, byte [rdx]
mov byte [rsi + rcx], r8b
inc rcx
inc rdx
sub rax, r12
jne 0x140040be0
mov byte [rsi + rcx], 0
mov rcx, r14
call fcn.140131f10
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x5e0
mov rdx, rsi
call fcn.140017090
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x150]
mov rcx, rsi
call fcn.140131f10
jmp 0x140040199
mov rcx, qword [rbx + 0x2c0]
call fcn.140082950
test al, al
jne case.0x14003e8d1.8
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x859], r12b
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x859], 0
je 0x140040c9e
call fcn.140087d80
test eax, eax
jne 0x140040cab
jmp case.0x14003e8d1.1
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
mov rcx, qword [rbx + 0x2c0]
call fcn.140082950
cmp al, r12b
je 0x140040199
movzx ecx, byte [rbp + 0x141]
lea eax, [rcx - 1]
cmp al, 8
ja 0x140040199
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x854], ecx
movzx ecx, byte [rbp + 0x141]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x850], ecx
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x57
lea rcx, [rbp + 0x90]
call fcn.140019e70
nop
movzx edx, byte [rbp + 0x141]
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x4b0]
call fcn.140034bb0
mov rcx, qword [rbx + 0x2c8]
test eax, eax
jne 0x140040d52
mov byte [rcx + 0x118], al
lea rcx, [rbp + 0x90]
call fcn.140019ea0
jmp 0x140040199
mov byte [rcx + 0x858], 1
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe434]
cdq
idiv ecx
mov dword [r8 + 0xe434], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe438]
cdq
idiv ecx
mov dword [r8 + 0xe438], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe42c]
cdq
idiv ecx
mov dword [r8 + 0xe42c], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe430]
cdq
idiv ecx
mov dword [r8 + 0xe430], eax
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x2c8]
call fcn.140044270
nop
lea rcx, [rbp + 0x90]
call fcn.140019ea0
jmp 0x140040199
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x140040192
mov byte [rax + 0x9ca], r12b
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3c9], 0
je 0x140040199
lea r9, str.enabled
cmp byte [rbp + 0x141], r12b
lea rax, str.disabled
cmove r9, rax
lea r8, str.vncClientThread::run_:_rfbSetServerInput:_inputs__s_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d10
test al, al
jne 0x140040f0a
cmp byte [rbp + 0x141], r12b
jne 0x140040f0a
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
movzx edx, r12b
mov rcx, qword [rcx + 0x90]
call fcn.14004f620
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], r12b
jmp 0x140040199
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d10
test al, al
je 0x140040f3f
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], 0
je 0x140040f3f
cmp byte [rbp + 0x141], 0
je 0x140040f7e
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d10
test al, al
jne 0x140040199
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], al
jne 0x140040199
cmp byte [rbp + 0x141], al
jne 0x140040199
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004f620
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], 0
jmp 0x140040199
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
lea rcx, [rbp - 0x78]
call fcn.140048790
nop
mov esi, r13d
mov r14d, r13d
cmp byte [rbp + 0x146], r13b
jbe 0x14004110a
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x1400410fc
movzx eax, word [rbp + 0x16c]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x54], eax
movzx eax, word [rbp + 0x16e]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x58], eax
movzx eax, word [rbp + 0x170]
rol ax, 8
movzx r8d, ax
mov dword [rbp - 0x5c], r8d
movzx eax, word [rbp + 0x172]
rol ax, 8
movzx edx, ax
mov dword [rbp - 0x60], edx
mov ecx, dword [rbp + 0x174]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
imul edx, r8d
cmp edx, 0xc00000
jg 0x1400410e7
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x5c]
lea rcx, [rbp + 0x118]
call fcn.140048af0
mov rdi, rax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xe0]
call fcn.140048af0
mov rdx, rax
mov r8, rdi
lea rcx, [rbp + 0x120]
call fcn.140048b00
mov r8, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140048b20
inc r14d
movzx eax, byte [rbp + 0x146]
cmp r14d, eax
jl 0x140040ff0
jmp 0x14004110a
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2c0]
mov edi, r13d
cmp dword [rax + 0xd4], r13d
cmovne edi, esi
cmp edi, 3
sete cl
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x4d8], cl
mov rcx, qword [rbx + 0x2c0]
cmp qword [rcx + 0xd8], 0
je 0x14004117a
call fcn.140082950
test al, al
jne 0x14004117a
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x108]
call fcn.140033860
mov r9, qword [rbx + 0x2c8]
lea r8, [r9 + 0xc]
movsx r10d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r10d
jmp 0x1400411d1
mov rcx, qword [rbx + 0x2c0]
cmp qword [rcx + 0xd8], 0
je 0x1400411f1
call fcn.140082950
test al, al
je 0x1400411f1
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x4d8], 0
je 0x1400411f1
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xe8]
call fcn.140033860
mov r9, qword [rbx + 0x2c8]
lea rdx, [r9 + 0xc]
movsx r8d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r8d
mov rcx, qword [rbx + 0x2c0]
movzx r9d, byte [r9 + 0x4d8]
mov r8, rax
mov edx, edi
mov rcx, qword [rcx + 0xd8]
call fcn.140032c50
mov rcx, qword [rbx + 0x2c8]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax + 0xc], 0
jne 0x140041200
test rax, rax
jne 0x140041215
mov byte [rcx + 0x4d8], al
lea rcx, [rbp - 0x78]
call fcn.1400323f0
jmp 0x140040199
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
movzx r10d, word [rbp + 0x142]
rol r10w, 8
movzx edx, word [rbp + 0x144]
cmp r10w, 5
jae 0x140041299
movzx eax, dx
rol ax, 8
cmp ax, 5
jae 0x140041299
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8d, r12d
mov edx, r12d
mov rcx, qword [rcx + 0x90]
call fcn.14004edc0
jmp 0x140040199
mov r9, qword [rbx + 0x2c8]
mov ecx, dword [r9 + 0x850]
rol dx, 8
movzx r8d, dx
add r8d, dword [r9 + 0x38c]
add r8d, dword [r9 + 0x384]
imul r8d, ecx
mov edx, dword [r9 + 0x388]
add edx, dword [r9 + 0x380]
movzx eax, r10w
add edx, eax
imul edx, ecx
mov rcx, qword [r9 + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004edc0
jmp 0x140040199
mov rcx, qword [rbx + 0x2c8]
mov edx, edi
mov rcx, qword [rcx + 0x880]
call fcn.14002c4d0
jmp 0x140040199
movzx r14d, r12b
mov rcx, qword [0x1401fef68]
call fcn.140038910
test eax, eax
je 0x14004132e
mov rcx, qword [rbx + 0x2c8]
call fcn.140047740
movzx r14d, al
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3c9], 0
je 0x140041347
cmp byte [rcx + 0x3ca], 0
jne 0x14004134a
xor r14b, r14b
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x58
lea rcx, [rbp + 0x80]
call fcn.140019e70
nop
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x67c], r12d
mov r8d, reloc.WS2_32.dll_inet_ntoa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140042797
movzx eax, byte [rbp + 0x141]
dec eax
cmp eax, 0xf
ja case.0x1400413bb.2
cdqe
mov ecx, dword [rsi + rax*4 + 0x42d84]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80e], 1
jmp case.0x1400413bb.2
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80e], 0
jmp case.0x1400413bb.2
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x59
lea rcx, [rbp - 0x40]
call fcn.140019e70
nop
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je 0x140041a63
test r14b, r14b
je 0x140041a63
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
xor edx, edx
mov r8d, 0x144
call fcn.1401348e0
cmp edi, 0x138
ja 0x140041a63
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
mov r8d, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140041a63
mov ecx, dword [rbp + 0x144]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
mov dword [rsp + 0x70], r13d
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je 0x140041a63
mov ecx, dword [rsp + 0x70]
mov r14d, ecx
and r14d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r14d, eax
shr r14d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r14d, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
mov edx, 0x2c
call fcn.140036ce0
mov r15, rax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7cc
test rax, rax
jne 0x140041543
mov byte [rcx], al
jmp 0x140041550
lea rdx, [rax + 1]
call fcn.140048c40
mov byte [r15], 0
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
lea rcx, [rbp + 0x188]
call fcn.140038960
mov rcx, rax
call fcn.140021530
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
call fcn.140048c50
lea rcx, [rbp + 0x188]
call fcn.1400170b0
mov r12d, r13d
lea eax, [rdi + 0x41]
mov edi, eax
mov ecx, eax
call fcn.140131f5c
mov r15, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.1401348e0
mov r8, qword [rbx + 0x2c8]
add r8, 0x688
mov edx, edi
mov rcx, r15
call fcn.14013ac00
mov edx, 0x5c
mov rcx, r15
call fcn.140036ce0
mov byte [rax], r12b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004161f
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x28]
mov rcx, r15
call rax
test eax, eax
mov eax, 0xffffffff
cmove r12d, eax
mov rcx, r15
call fcn.140131f10
mov r8, qword [rbp + 0x28]
sar r8, 0xa
mov ecx, r14d
shl rcx, 0x20
mov eax, esi
add rcx, rax
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
cmp rax, rdx
mov esi, 0xffffffff
cmovl r12d, esi
mov ecx, 0x2400
call fcn.140131f5c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e0], rax
mov rax, qword [rbx + 0x2c8]
cmp qword [rax + 0x7e0], 0
cmove r12d, esi
mov ecx, 0x2000
call fcn.140131f5c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e8], rax
mov rcx, qword [rbx + 0x2c8]
cmp qword [rcx + 0x7e8], 0
cmove r12d, esi
xor eax, eax
mov qword [rbp + 0x178], rax
mov dword [rbp + 0x180], eax
mov byte [rbp + 0x178], 7
cmp r12d, esi
je 0x14004185b
mov rax, qword [rcx + 0x110]
test rax, rax
je 0x1400416f6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov eax, 4
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7f0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov rcx, qword [rbx + 0x2c8]
mov rdx, qword [rcx + 0x7f0]
mov edi, esi
cmp rdx, 0xffffffffffffffff
cmovne edi, r13d
mov r12d, edi
test al, al
je 0x14004185b
cmp rdx, 0xffffffffffffffff
je 0x14004185b
lea rdx, [rcx + 0x688]
lea r8, [rbp + 0x30]
call fcn.1400476a0
test al, al
je 0x14004185b
mov rax, qword [rbp + 0x30]
shr rax, 0xd
lea esi, [rax*4 + 0x400]
movsxd rcx, esi
call fcn.140131f5c
mov r15, rax
mov rcx, qword [rbx + 0x2c8]
mov r9d, esi
mov r8, rax
mov rdx, qword [rcx + 0x7f0]
call fcn.140046630
mov r14d, eax
cmp eax, 0xffffffff
je 0x140041856
mov byte [rbp + 0x179], reloc.WS2_32.dll_inet_ntoa
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shl edx, 8
mov ecx, esi
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr esi, 0x18
or edx, esi
mov dword [rbp + 0x17c], edx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r14d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r14d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x180], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b90
mov rcx, r15
call fcn.140131f10
mov esi, 0xffffffff
mov byte [rbp + 0x179], 9
mov eax, r12d
bswap eax
mov dword [rbp + 0x17c], eax
mov rax, qword [rbx + 0x2c8]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140041880
shr rcx, 0x18
movzx edx, cl
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400418a0
shl rcx, 8
and ecx, 0xff0000
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400418c0
shr rcx, 8
and ecx, 0xff00
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400418e0
shl rcx, 0x18
or edx, ecx
mov dword [rbp + 0x180], edx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140041926
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
mov r8, qword [rbx + 0x2c8]
cmp r12d, esi
jne 0x1400419a9
lea rcx, [r8 + 0x7f0]
call fcn.1400881a0
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e8]
test rcx, rcx
je 0x140041981
call fcn.140131f10
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e8], r13
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je 0x140041a63
call fcn.140131f10
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e0], r13
jmp 0x140041a63
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8 + 0x7f8], edx
mov rcx, qword [rbx + 0x2c8]
mov eax, dword [rcx + 0x7f8]
shr eax, 0xd
mov dword [rcx + 0x7fc], eax
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x800], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x804], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80c], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 1
mov rcx, qword [0x1401fef68]
call fcn.140038940
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.140087710
nop
lea rcx, [rbp - 0x40]
call fcn.140019ea0
jmp case.0x1400413bb.2
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0xa0], xmm0
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0xb0], eax
movzx r8d, r14b
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbx + 0x2c8]
call fcn.140047e30
jmp case.0x1400413bb.2
mov rcx, qword [0x1401fef68]
call fcn.140038940
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.140087690
mov ecx, dword [rbp + 0x148]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
call fcn.140046710
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
jmp case.0x1400413bb.2
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov eax, 0xffffffff
cmp edx, eax
jne 0x140041b87
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.1400881a0
jmp case.0x1400413bb.2
mov ecx, 0x2000
call fcn.140131f5c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e0], rax
mov rcx, qword [rbx + 0x2c8]
cmp qword [rcx + 0x7e0], 0
jne 0x140041bc1
add rcx, 0x810
call fcn.1400881a0
jmp case.0x1400413bb.2
mov ecx, 0x2400
call fcn.140131f5c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e8], rax
mov rax, qword [rbx + 0x2c8]
cmp qword [rax + 0x7e8], 0
jne 0x140041c25
lea rcx, [rax + 0x810]
call fcn.1400881a0
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je case.0x1400413bb.2
call fcn.140131f10
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e0], r13
jmp case.0x1400413bb.2
mov byte [rax + 0x818], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x81c], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x824], r13d
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x829], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 0
mov rcx, qword [rbx + 0x2c8]
call fcn.140046d70
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
jmp case.0x1400413bb.2
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
mov ecx, dword [rbp + 0x144]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x148]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
call fcn.140046790
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
xor edx, edx
mov rcx, qword [rbx + 0x2c8]
call fcn.140047b60
jmp case.0x1400413bb.2
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x80d], 0
je case.0x1400413bb.2
call fcn.1400468e0
jmp case.0x1400413bb.2
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x140041db1
mov byte [rax + 0x80c], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 1
mov rcx, qword [rbx + 0x2c8]
call fcn.1400468e0
jmp case.0x1400413bb.2
cmp byte [rax + 0x82a], 0
je 0x140041dd4
mov byte [rax + 0x829], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 1
jmp case.0x1400413bb.2
mov byte [rax + 0x85a], 1
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x85a], 0
je case.0x1400413bb.2
xor eax, eax
mov qword [rbp + 0x1a8], rax
mov dword [rbp + 0x1b0], eax
mov byte [rbp + 0x1a8], 7
cmp word [rbp + 0x142], ax
jne 0x140041e56
mov byte [rbp + 0x1a9], 7
mov eax, 0xffffffff
mov dword [rbp + 0x1ac], eax
mov rcx, qword [rbx + 0x2c8]
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rcx + 0x3b0]
call fcn.1400878c0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x85a], 0
jmp case.0x1400413bb.2
mov byte [rbp + 0x1a9], recv
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je 0x140041e15
mov rcx, qword [0x1401fef68]
call fcn.140038930
test eax, eax
je 0x140041e15
test r14b, r14b
je 0x140041e15
mov dword [rbp + 0x1ac], 0x1000000
jmp 0x140041e20
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x140041fcc
cmp ecx, 1
jne case.0x1400413bb.2
lea rdx, [rbp + 0x2f0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov r15d, eax
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
lea esi, [r15 - 3]
test esi, esi
je 0x140041f5c
mov edi, 2
nop word [rax + rax]
lea ecx, [rdi - 2]
lea rdx, [rbp + 0x2f0]
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140048c60
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x140041f48
sub eax, 1
je 0x140041f3c
sub eax, 1
je 0x140041f30
cmp eax, 1
jne 0x140041f52
mov eax, edi
mov byte [rbp + rax + 0x2f0], Ordinal_102
jmp 0x140041f52
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSACleanup
jmp 0x140041f52
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSAGetLastError
jmp 0x140041f52
mov eax, edi
mov byte [rbp + rax + 0x2f0], reloc.dwmapi.dll_Ordinal_102
add edi, 4
lea eax, [rdi - 2]
cmp eax, esi
jb 0x140041ef0
mov qword [rbp + 0x1f8], 0x30207
mov ecx, r15d
shl ecx, 0x10
mov eax, r15d
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r15d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r15d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x200], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov r8d, r15d
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
jmp case.0x1400413bb.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x105
ja case.0x1400413bb.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x1400413bb.2
cmp edi, 0x106
jae 0x140042c2c
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
xor sil, sil
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.My_Documents
lea rcx, [rbp + 0x2f0]
call fcn.14014b3e0
mov r15, 0xffffffffffffffff
mov edi, r15d
test eax, eax
mov eax, 5
cmove edi, eax
lea r8d, [r15 + 8]
lea rdx, str.Desktop
lea rcx, [rbp + 0x2f0]
call fcn.14014b3e0
test eax, eax
cmove edi, r13d
lea r8d, [r15 + 0x12]
lea rdx, str.Network_Favorites
lea rcx, [rbp + 0x2f0]
call fcn.14014b3e0
test eax, eax
jne 0x1400420be
lea edi, [rax + 0x13]
jmp 0x1400420c3
cmp edi, r15d
je 0x140042125
lea r8, [rbp + 0xa50]
mov edx, edi
mov rcx, qword [rbx + 0x2c8]
call fcn.1400472d0
test al, al
je 0x140042122
lea rcx, [rbp + 0xa50]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], sil
jne 0x1400420e6
cmp byte [rbp + rax + 0xa4f], 0x5c
je 0x14004210d
lea rdx, [0x1401c3a08]
lea rcx, [rbp + 0xa50]
call fcn.140048c70
lea rdx, [rbp + 0xa50]
lea rcx, [rbp + 0x2f0]
call fcn.140048c80
jmp 0x140042125
mov sil, 1
lea rdx, [0x1401c9194]
lea rcx, [rbp + 0x2f0]
call fcn.140048c70
mov qword [rbp + 0x15c], r13
mov dword [rbp + 0x158], 0x10207
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp r14, r15
je 0x140042307
test sil, sil
jne 0x140042307
lea rax, [rbp + 0x2f0]
mov rdx, r15
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x140042190
dec rdx
mov rax, rdx
shr rax, 0x18
movzx ecx, al
mov rax, rdx
shl rax, 8
and eax, 0xff0000
or ecx, eax
mov rax, rdx
shr rax, 8
and eax, 0xff00
or ecx, eax
shl rdx, 0x18
or ecx, edx
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
lea rcx, [rbp + 0x2f0]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x1400421f4
lea r8d, [rax - 1]
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b90
nop word [rax + rax]
movzx ecx, byte [rbp + 0x54d]
movzx eax, byte [rbp + 0x54c]
test byte [rbp + 0x520], 0x10
je 0x14004223f
cmp al, 0x2e
jne 0x14004225c
test cl, cl
jne 0x14004225c
cmp al, 0x2e
jne 0x14004225c
cmp cl, al
jne 0x140042250
cmp byte [rbp + 0x54e], 0
je 0x14004225c
cmp al, 0x2e
jne 0x14004225c
test cl, cl
je 0x1400422de
lea rcx, [rbp + 0x54c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [rax + 0x2e]
movsxd r8, edi
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x730]
call fcn.140134230
mov eax, edi
mov ecx, edi
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
mov eax, edi
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, edi
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov r8d, edi
lea rdx, [rbp + 0x730]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b90
lea rdx, [rbp + 0x520]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140042220
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov word [rbp + 0x15a], r13w
mov dword [rbp + 0x160], r13d
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400878c0
jmp case.0x1400413bb.2
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x140042679
sub ecx, 3
je 0x1400424e2
cmp ecx, 1
jne case.0x1400413bb.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x208
ja case.0x1400413bb.2
mov r8d, esi
lea rdx, [rbp + 0x730]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x1400413bb.2
cmp esi, 0x209
jae 0x140042c32
mov byte [rbp + rsi + 0x730], 0
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
mov edx, 0x2a
lea rcx, [rbp + 0x730]
call fcn.140036ce0
mov rdi, rax
test rax, rax
je case.0x1400413bb.2
lea rdx, [rax + 1]
lea rcx, [rbp + 0x520]
call fcn.140048c90
mov byte [rdi], 0
lea rdx, [rbp + 0x730]
lea rcx, [rbp + 0xa50]
call fcn.140048c90
mov byte [rdi], 0x2a
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0xa50]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
mov dword [rbp + 0x208], 0x80b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x20c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x210], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x208]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov r8d, esi
lea rdx, [rbp + 0x730]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
test edi, edi
je case.0x1400413bb.2
lea rax, [rbp + 0x188]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x188]
call fcn.140021540
mov rdi, rax
lea rdx, [rbp + 0xa50]
lea rcx, [rbp + 0x1b8]
call fcn.140021540
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d20
jmp case.0x1400413bb.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x104
ja case.0x1400413bb.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x1400413bb.2
cmp edi, 0x105
jae 0x140042c38
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
lea rcx, [rbp + 0x2f0]
call fcn.140038cc0
movzx r14d, al
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x188]
call fcn.140021540
nop
test r14b, r14b
je 0x1400425be
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140038c50
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.1400489e0
lea rcx, [rbp + 0x1b8]
call fcn.1400170b0
lea rcx, [rbp + 0x188]
call fcn.140048940
mov rsi, rax
lea rcx, [rbp + 0x2f0]
call fcn.140038b80
movzx edi, al
mov dword [rbp + 0x218], 0x70b07
mov ecx, 0xffffffff
test al, al
cmovne ecx, r13d
mov dword [rbp + 0x21c], ecx
lea eax, [rsi + 1]
bswap eax
mov dword [rbp + 0x220], eax
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x218]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
lea rcx, [rbp + 0x188]
call fcn.140021530
mov rdx, rax
lea r8d, [rsi + 1]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
test edi, edi
je 0x140042668
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021540
movzx r8d, r14b
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d10
nop
lea rcx, [rbp + 0x188]
call fcn.1400170b0
jmp case.0x1400413bb.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x104
ja case.0x1400413bb.2
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x1400413bb.2
cmp esi, 0x105
jae 0x140042c26
mov byte [rbp + rsi + 0x2f0], 0
mov rcx, qword [0x1401fef68]
call fcn.140038900
test eax, eax
je case.0x1400413bb.2
test r14b, r14b
je case.0x1400413bb.2
xor edx, edx
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov dword [rbp + 0x228], 0x40b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x22c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x230], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x228]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400879f0
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a70
test edi, edi
je case.0x1400413bb.2
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021540
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d00
jmp case.0x1400413bb.2
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x1400427ea
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7f0
call fcn.1400881a0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x82a], 0
je case.0x1400413bb.2
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.1400881a0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x67c], r13d
lea rcx, [rbp + 0x80]
call fcn.140019ea0
jmp 0x140040199
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087d80
test eax, eax
je case.0x14003e8d1.1
mov rcx, qword [rbx + 0x2b8]
call fcn.140036cd0
jmp 0x140040199
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
lea rcx, [rbp - 0x20]
call fcn.140019ea0
jmp 0x140042bf6
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
cmp byte [0x1401f42c3], 0
je 0x1400428db
mov byte [rbx + 0xa8], 1
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x14004292e
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 0
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7f0
call fcn.1400881a0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x82a], 0
je 0x140042973
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 0
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.1400881a0
mov rcx, qword [rbp + 0x38]
call fcn.140020b50
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], 0
je 0x1400429af
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004f620
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400429d7
call qword [sym.imp.USER32.dll_CloseDesktop]
test eax, eax
jne 0x1400429d7
lea r8, str.vncClientThread::run_:_failed_to_close_desktop_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov r9, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [r9 + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_disconnected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r8d, 0x104
lea rdx, [rbp + 0x940]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140042a5c
mov edx, 0x5c
lea rcx, [rbp + 0x940]
call fcn.140036ce0
mov byte [rax], 0
lea rdx, str.logging.dll
lea rcx, [rbp + 0x940]
call fcn.1400181d0
lea rcx, [rbp + 0x940]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x140042af7
lea rdx, str.LOGEXIT
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rdx, qword [rbx + 0x2c8]
cmp byte [rdx + 0x3c9], 0
je 0x140042aa6
cmp byte [rdx + 0x3ca], 0
je 0x140042aa6
mov r12b, 1
jmp 0x140042aa9
xor r12d, r12d
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx r14d, ax
mov rcx, rsi
call qword [rdi + 0x90]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x98]
mov rcx, rax
movzx r9d, r12b
mov r8d, r14d
mov rdx, rdi
call r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx + 0x590]
test rax, rax
je 0x140042b2e
mov rcx, rax
call fcn.140038e00
mov rcx, qword [rbx + 0x2c8]
xor edx, edx
mov rcx, qword [rcx + 0x590]
call fcn.1401255e0
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
cmp byte [0x1401f42c3], 0
jne 0x140042bf6
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], 0
je 0x140042bf6
lea r8, str.vncClientThread::run_:_PostAddNewClient_II_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rbx + 0x2c8]
mov r8, qword [rcx]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0xac]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xb0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x1af]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140020d20
mov rcx, qword [rbp + 0xc60]
xor rcx, rsp
call fcn.140131ef0
lea r11, [rsp + 0xd70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401322e8
nop
call fcn.1401322e8
int3
call fcn.1401322e8
int3
call fcn.1401322e8
int3