Function at 0x42e7d0
Capabilities:
Create thread
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4a0
mov eax, dword [0x4ea5e0]
xor eax, esp
mov dword [esp + 0x49c], eax
push ebx
push edi
push str.vncdesktopsink.cpp_:_InitWindow_called_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push 0x400001cf
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edi, eax
xor eax, eax
mov dword [esp + 0x30], edi
mov ecx, 0x4ecb00
cmp edi, ebx
jne 0x42e827
push str.vncdesktopsink.cpp_:_InitWindow:OpenInputdesktop_Error__n
jmp 0x42e82c
push str.vncdesktopsink.cpp_:_InitWindow:OpenInputdesktop_OK_n
call fcn.00403230
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x80]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0x3a8]
push ecx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
test eax, eax
jne 0x42e879
push str.vncdesktopsink.cpp_:_InitWindow:_GetUserObjectInformation__n
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
mov edx, dword [esp + 0xc]
push edx
push edi
lea eax, [esp + 0x3a8]
push eax
push str.vncdesktopsink.cpp_:_InitWindow:SelectHDESK_to__s___x__from__x_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 0x10
push edi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
jne 0x42e8b8
push str.vncdesktopsink.cpp_:_InitWindow:SelectHDESK:_SetThreadDesktop__n
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ChangeWindowMessageFilter
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x42e904
mov ecx, dword [0x5448b4]
push 1
push ecx
call edi
mov edx, dword [0x5448bc]
push 1
push edx
call edi
mov eax, dword [0x5448b8]
push 1
push eax
call edi
push 1
push 0x12
call edi
push 1
push 0x8008
call edi
cmp word [0x544750], bx
jne 0x42e9aa
mov ecx, dword [0x517c58]
push ebx
mov dword [esp + 0x54], 0x30
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], 0x42dd60
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.WinVNC_desktop_sink
mov dword [esp + 0x80], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov word [0x544750], ax
cmp ax, bx
jne 0x42e9aa
push str.vncdesktopsink.cpp_:_failed_to_register_window_class_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [esi + 0xdbac]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x49c]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x517c58]
push ebx
push ecx
push ebx
push ebx
push 0xc8
push 0x190
push accept
push accept
push 0xcf0000
push 0x4d8a6c
push str.WinVNC_desktop_sink
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esi + 0xdc08], eax
cmp eax, ebx
jne 0x42ea1f
push str.vncdesktopsink.cpp_:_failed_to_create_hook_window_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov edx, dword [esi + 0xdbac]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x49c]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push ebx
push 0x3e8
push 0x3e9
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0xdc08]
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [esi + 0xdc08]
push ecx
mov byte [esi + 0xdc10], 1
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [esi + 0xdc0c], eax
mov eax, dword [esi + 0xe0f4]
mov byte [esi + 0xdc10], bl
mov byte [esi + 0xc8], bl
cmp eax, ebx
je 0x42eab1
cmp dword [eax + 8], ebx
jne 0x42ea89
mov eax, 1
mov dword [esi + 0xe124], eax
mov dword [esi + 0xe128], eax
jmp 0x42eab1
mov eax, dword [esi + 0xdc08]
lea edx, [esp + 0x84]
push edx
push ebx
push eax
push 0x42b770
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x42eab1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_load_hookdlls_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 4
push 0x104
lea ecx, [esp + 0x194]
push ecx
push ebx
mov dword [esi + 0xe138], ebx
call edi
test eax, eax
je 0x42eb3d
lea edx, [esp + 0x190]
push 0x5c
push edx
call fcn.004a9130
add esp, 8
cmp eax, ebx
je 0x42e994
mov byte [eax], bl
lea eax, [esp + 0x190]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42eb10
mov ecx, dword [str._vnchooks.dll]
mov edx, dword [0x4dae5c]
mov dword [eax], ecx
mov ecx, dword [0x4dae60]
mov dword [eax + 4], edx
mov dx, word [0x4dae64]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
push 0x104
lea eax, [esp + 0x29c]
push eax
push ebx
mov dword [esi + 0xe13c], ebx
call edi
test eax, eax
je 0x42eba2
lea ecx, [esp + 0x298]
push 0x5c
push ecx
call fcn.004a9130
add esp, 8
cmp eax, ebx
je 0x42e994
mov byte [eax], bl
lea eax, [esp + 0x298]
dec eax
jmp 0x42eb80
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42eb80
mov edx, dword [str._schook.dll]
mov ecx, dword [0x4dae6c]
mov dword [eax], edx
mov edx, dword [0x4dae70]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [esi + 0xe140], ebx
cmp byte [0x54493c], bl
je 0x42ec0a
push 0x104
lea eax, [esp + 0x8c]
push eax
push ebx
call edi
test eax, eax
je 0x42ec0a
lea ecx, [esp + 0x88]
push 0x5c
push ecx
call fcn.004a9130
add esp, 8
cmp eax, ebx
je 0x42e994
mov byte [eax], bl
lea eax, [esp + 0x88]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42ebe8
mov edx, dword [str.w8hook.dll]
mov ecx, dword [0x4dae78]
mov dword [eax], edx
mov edx, dword [0x4dae7c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x190]
push eax
mov dword [esi + 0xe148], ebx
mov dword [esi + 0xe158], ebx
mov dword [esi + 0xe154], ebx
mov dword [esi + 0xe160], ebx
mov dword [esi + 0xe15c], ebx
mov dword [esi + 0xe144], ebx
mov dword [esi + 0xe150], ebx
mov dword [esi + 0xe14c], ebx
call edi
lea ecx, [esp + 0x298]
push ecx
mov dword [esi + 0xe138], eax
call edi
mov dword [esi + 0xe13c], eax
cmp byte [0x54493c], bl
je 0x42ec78
lea edx, [esp + 0x88]
push edx
call edi
mov dword [esi + 0xe140], eax
cmp dword [esi + 0xe138], ebx
je 0x42ecec
push str.vnchook
push 0x10
push 0x544754
call fcn.004a9480
mov eax, dword [esi + 0xe138]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push str.UnSetHooks
push eax
call edi
mov ecx, dword [esi + 0xe138]
push str.SetMouseFilterHook
push ecx
mov dword [esi + 0xe148], eax
call edi
mov edx, dword [esi + 0xe138]
push str.SetKeyboardFilterHook
push edx
mov dword [esi + 0xe158], eax
call edi
mov dword [esi + 0xe154], eax
mov eax, dword [esi + 0xe138]
push str.SetHooks
push eax
call edi
mov dword [esi + 0xe144], eax
jmp 0x42ecf2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0xe13c]
cmp eax, ebx
je 0x42ed46
push str.UnSetHook
push eax
call edi
mov ecx, dword [esi + 0xe13c]
push str.SetHook
push ecx
mov dword [esi + 0xe150], eax
call edi
mov edx, dword [esi + 0xe13c]
push str.SetMouseFilterHook
push edx
mov dword [esi + 0xe14c], eax
call edi
mov dword [esi + 0xe160], eax
mov eax, dword [esi + 0xe13c]
push str.SetKeyboardFilterHook
push eax
call edi
mov dword [esi + 0xe15c], eax
mov eax, dword [esi + 0xe140]
mov dword [esi + 0xe164], ebx
mov dword [esi + 0xe168], ebx
mov dword [esi + 0xe16c], ebx
cmp eax, ebx
je 0x42ed98
push str.StartW8
push eax
call edi
mov ecx, dword [esi + 0xe140]
push str.StopW8
push ecx
mov dword [esi + 0xe164], eax
call edi
mov edx, dword [esi + 0xe140]
push str.CaptureW8
push edx
mov dword [esi + 0xe168], eax
call edi
mov dword [esi + 0xe16c], eax
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_start_dispatch_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [esi + 0xdbac]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esp, [esp]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42f02e
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push edx
push eax
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO__i__i_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, 0x113
jne 0x42ee17
cmp dword [esp + 0x3c], 0x3e9
jne 0x42ee20
call fcn.00415110
mov eax, dword [esp + 0x38]
cmp eax, 0x12
je 0x42f05c
cmp byte [0x544753], 0
jne 0x42f05c
cmp eax, 0x8008
je 0x42f039
cmp eax, dword [0x5448b4]
jne 0x42ef91
cmp byte [esi + 0xe180], 0
je 0x42edc0
push str.vncdesktopsink.cpp_:_RFB_SCREEN_UPDATE___n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
movsx eax, cx
shr ecx, 0x10
movsx edi, cx
movsx ecx, dx
shr edx, 0x10
movsx edx, dx
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x74]
mov dword [esp + 0x24], eax
sub eax, edx
mov dword [esp + 0x2c], ecx
sub ecx, edx
mov edx, dword [esp + 0x30]
mov ebx, eax
mov eax, dword [esi + 0x78]
add esp, 4
sub edx, eax
push edx
sub edi, eax
push edi
push ecx
mov dword [esp + 0x34], ecx
push ebx
push str.vncdesktopsink.cpp_:_REct3__i__i__i__i___n
xor eax, eax
mov ecx, 0x4ecb00
mov dword [esp + 0x40], edx
call fcn.00403230
mov eax, dword [esi + 0xb8]
add esp, 0x14
mov dword [esp + 0x10], ebx
cmp ebx, eax
jg 0x42eed1
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x14], edi
cmp edi, eax
jg 0x42eee3
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esi + 0xc0]
mov dword [esp + 0x18], ecx
cmp ecx, eax
jl 0x42eef9
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc4]
mov edi, dword [esp + 0x2c]
cmp edi, eax
jl 0x42ef09
mov edi, eax
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x10], ecx
jge 0x42edc0
cmp dword [esp + 0x14], edi
jge 0x42edc0
cmp byte [esi + 0xdbbc], 0
je 0x42ef3d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 5
call ebx
cmp byte [esi + 0xdbbc], 0
jne 0x42ef30
push 0x4ce44c
call fcn.004aa83c
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add esp, 4
push edi
mov ebx, eax
mov eax, dword [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 2
mov edi, eax
mov eax, dword [esi + 0xdbb4]
push edi
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call fcn.004aa14e
mov edx, dword [esi + 0xdb98]
add esp, 4
push edx
jmp 0x42edb3
cmp eax, dword [0x5448b8]
jne 0x42eff8
cmp byte [esi + 0xe180], 0
je 0x42edc0
push str.vncdesktopsink.cpp_:_RFB_MOUSE_UPDATE___n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [esp + 0x40]
add esp, 4
test eax, eax
jne 0x42efda
mov eax, dword [esi + 0xe0ac]
mov edx, dword [esi + 0xdb9c]
mov dword [esi + 0xe0a4], eax
push edx
jmp 0x42edb3
mov ecx, dword [esi + 0xe0a4]
mov edx, dword [esi + 0xdb9c]
mov dword [esi + 0xe0a8], ecx
mov dword [esi + 0xe0a4], eax
push edx
jmp 0x42edb3
cmp eax, 0x403
jne 0x42f013
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_called_wm_user3_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42edc0
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x42edc0
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_called_wm_user4_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov edx, dword [esi + 0xdc08]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x42f08a
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_called_wm_quit_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov eax, dword [esi + 0xdc08]
add esp, 4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [esi + 0xdba8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0xdc08]
push 0x3e9
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0xe138]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x42f0af
push eax
call edi
mov eax, dword [esi + 0xe13c]
test eax, eax
je 0x42f0bc
push eax
call edi
mov eax, dword [esi + 0xe140]
test eax, eax
je 0x42f0c9
push eax
call edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_CloseDesktop]
push str.vncdesktopsink.cpp_:_OOOOOOOOOOOO_end_dispatch_n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
mov ecx, dword [esp + 0x4a8]
add esp, 4
pop edi
pop ebx
xor ecx, esp
mov dword [esi + 0xdc08], 0
mov eax, 1
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret